Attachment #233006 for bug #133821

View Details Raw Unified Return to Bug 133821

| Differences between



2014-06-12  Filip Pizlo  <fpizlo@apple.com>

        [ftlopt] A DFG inlined ById access variant should not speak of a chain, but only of what structures to test the base for, whether to use a constant as an alternate base for the actual access, and what structures to check on what additional cell constants
        https://bugs.webkit.org/show_bug.cgi?id=133821

        Reviewed by NOBODY (OOPS!).
        
        This allows us to efficiently cache accesses that differ only in the prototypes on the path
        from the base to the prototype that has the field.
        
        It also simplifies a bunch of code - IntendedStructureChain is now just an intermediate
        data structure.

        * CMakeLists.txt:
        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/ConstantStructureCheck.cpp: Added.
        (JSC::ConstantStructureCheck::dumpInContext):
        (JSC::ConstantStructureCheck::dump):
        (JSC::structureFor):
        (JSC::areCompatible):
        (JSC::mergeInto):
        * bytecode/ConstantStructureCheck.h: Added.
        (JSC::ConstantStructureCheck::ConstantStructureCheck):
        (JSC::ConstantStructureCheck::operator!):
        (JSC::ConstantStructureCheck::constant):
        (JSC::ConstantStructureCheck::structure):
        * bytecode/GetByIdStatus.cpp:
        (JSC::GetByIdStatus::computeForStubInfo):
        * bytecode/GetByIdVariant.cpp:
        (JSC::GetByIdVariant::GetByIdVariant):
        (JSC::GetByIdVariant::operator=):
        (JSC::GetByIdVariant::attemptToMerge):
        (JSC::GetByIdVariant::dumpInContext):
        * bytecode/GetByIdVariant.h:
        (JSC::GetByIdVariant::constantChecks):
        (JSC::GetByIdVariant::alternateBase):
        (JSC::GetByIdVariant::GetByIdVariant): Deleted.
        (JSC::GetByIdVariant::chain): Deleted.
        * bytecode/PutByIdVariant.cpp:
        (JSC::PutByIdVariant::dumpInContext):
        * bytecode/PutByIdVariant.h:
        (JSC::PutByIdVariant::transition):
        (JSC::PutByIdVariant::constantChecks):
        (JSC::PutByIdVariant::structureChain): Deleted.
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::emitChecks):
        (JSC::DFG::ByteCodeParser::handleGetById):
        (JSC::DFG::ByteCodeParser::handlePutById):
        (JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck): Deleted.
        (JSC::DFG::ByteCodeParser::structureChainIsStillValid): Deleted.
        (JSC::DFG::ByteCodeParser::emitPrototypeChecks): Deleted.
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
        * dfg/DFGDesiredStructureChains.cpp: Removed.
        * dfg/DFGDesiredStructureChains.h: Removed.
        * dfg/DFGGraph.h:
        (JSC::DFG::Graph::watchpoints):
        (JSC::DFG::Graph::chains): Deleted.
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::isStillValid):
        (JSC::DFG::Plan::checkLivenessAndVisitChildren):
        (JSC::DFG::Plan::cancel):
        * dfg/DFGPlan.h:
        * ftl/FTLLowerDFGToLLVM.cpp:
        (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
        * runtime/IntendedStructureChain.cpp:
        (JSC::IntendedStructureChain::gatherChecks):
        * runtime/IntendedStructureChain.h:
        (JSC::IntendedStructureChain::at):
        (JSC::IntendedStructureChain::operator[]):

2014-06-11  Filip Pizlo  <fpizlo@apple.com>

        [ftlopt] DFG get_by_id should inline chain accesses with a slightly polymorphic base



    bytecode/CodeBlockJettisoningWatchpoint.cpp
    bytecode/CodeOrigin.cpp
    bytecode/CodeType.cpp
    bytecode/ConstantStructureCheck.cpp
    bytecode/DFGExitProfile.cpp
    bytecode/DeferredCompilationCallback.cpp
    bytecode/ExecutionCounter.cpp

    dfg/DFGCriticalEdgeBreakingPhase.cpp
    dfg/DFGDCEPhase.cpp
    dfg/DFGDesiredIdentifiers.cpp
    dfg/DFGDesiredStructureChains.cpp
    dfg/DFGDesiredTransitions.cpp
    dfg/DFGDesiredWatchpoints.cpp
    dfg/DFGDesiredWeakReferences.cpp



    <ClCompile Include="..\bytecode\CodeBlockJettisoningWatchpoint.cpp" />
    <ClCompile Include="..\bytecode\CodeOrigin.cpp" />
    <ClCompile Include="..\bytecode\CodeType.cpp" />
    <ClCompile Include="..\bytecode\ConstantStructureCheck.cpp" />
    <ClCompile Include="..\bytecode\DeferredCompilationCallback.cpp" />
    <ClCompile Include="..\bytecode\DFGExitProfile.cpp" />
    <ClCompile Include="..\bytecode\ExecutionCounter.cpp" />

    <ClCompile Include="..\dfg\DFGCSEPhase.cpp" />
    <ClCompile Include="..\dfg\DFGDCEPhase.cpp" />
    <ClCompile Include="..\dfg\DFGDesiredIdentifiers.cpp" />
    <ClCompile Include="..\dfg\DFGDesiredStructureChains.cpp" />
    <ClCompile Include="..\dfg\DFGDesiredTransitions.cpp" />
    <ClCompile Include="..\dfg\DFGDesiredWatchpoints.cpp" />
    <ClCompile Include="..\dfg\DFGDesiredWeakReferences.cpp" />

    <ClInclude Include="..\bytecode\CodeOrigin.h" />
    <ClInclude Include="..\bytecode\CodeType.h" />
    <ClInclude Include="..\bytecode\Comment.h" />
    <ClInclude Include="..\bytecode\ConstantStructureCheck.h" />
    <ClInclude Include="..\bytecode\DataFormat.h" />
    <ClInclude Include="..\bytecode\DeferredCompilationCallback.h" />
    <ClInclude Include="..\bytecode\DFGExitProfile.h" />

    <ClInclude Include="..\dfg\DFGCSEPhase.h" />
    <ClInclude Include="..\dfg\DFGDCEPhase.h" />
    <ClInclude Include="..\dfg\DFGDesiredIdentifiers.h" />
    <ClInclude Include="..\dfg\DFGDesiredStructureChains.h" />
    <ClInclude Include="..\dfg\DFGDesiredTransitions.h" />
    <ClInclude Include="..\dfg\DFGDesiredWatchpoints.h" />
    <ClInclude Include="..\dfg\DFGDesiredWeakReferences.h" />



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "ConstantStructureCheck.h"

namespace JSC {

void ConstantStructureCheck::dumpInContext(PrintStream& out, DumpContext* context) const
{
    out.print(
        "(Check if ", inContext(JSValue(m_constant), context), " has structure ",
        pointerDumpInContext(m_structure, context), ")");
}

void ConstantStructureCheck::dump(PrintStream& out) const
{
    dumpInContext(out, nullptr);
}

Structure* structureFor(const ConstantStructureCheckVector& vector, JSCell* constant)
{
    for (unsigned i = vector.size(); i--;) {
        if (vector[i].constant() == constant)
            return vector[i].structure();
    }
    return nullptr;
}

bool areCompatible(const ConstantStructureCheckVector& a, const ConstantStructureCheckVector& b)
{
    for (unsigned i = a.size(); i--;) {
        Structure* otherStructure = structureFor(b, a[i].constant());
        if (!otherStructure)
            continue;
        if (a[i].structure() != otherStructure)
            return false;
    }
    return true;
}

void mergeInto(const ConstantStructureCheckVector& source, ConstantStructureCheckVector& target)
{
    for (unsigned i = source.size(); i--;) {
        if (structureFor(target, source[i].constant()))
            continue;
        target.append(source[i]);
    }
}

} // namespace JSC




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef ConstantStructureCheck_h
#define ConstantStructureCheck_h

#include "DumpContext.h"
#include "JSCell.h"
#include "Structure.h"
#include <wtf/PrintStream.h>
#include <wtf/Vector.h>

namespace JSC {

class ConstantStructureCheck {
public:
    ConstantStructureCheck()
        : m_constant(nullptr)
        , m_structure(nullptr)
    {
    }
    
    ConstantStructureCheck(JSCell* constant, Structure* structure)
        : m_constant(constant)
        , m_structure(structure)
    {
        ASSERT(!!m_constant == !!m_structure);
    }
    
    bool operator!() const { return !m_constant; }
    
    JSCell* constant() const { return m_constant; }
    Structure* structure() const { return m_structure; }
    
    void dumpInContext(PrintStream&, DumpContext*) const;
    void dump(PrintStream&) const;
    
private:
    JSCell* m_constant;
    Structure* m_structure;
};

typedef Vector<ConstantStructureCheck, 2> ConstantStructureCheckVector;

Structure* structureFor(const ConstantStructureCheckVector& vector, JSCell* constant);
bool areCompatible(const ConstantStructureCheckVector&, const ConstantStructureCheckVector&);
void mergeInto(const ConstantStructureCheckVector& source, ConstantStructureCheckVector& target);

} // namespace JSC

#endif // ConstantStructureCheck_h


Lines 253-259 GetByIdStatus GetByIdStatus::computeForS Source/JavaScriptCore/bytecode/GetByIdStatus.cpp_sec1
- Source/JavaScriptCore/bytecode/GetByIdStatus.cpp -1 / +1 lines
253	}	253	}
254		254
255	GetByIdVariant variant(	255	GetByIdVariant variant(
256	StructureSet(structure), myOffset, specificValue, chain,	256	StructureSet(structure), myOffset, specificValue, chain.get(),
257	std::move(callLinkStatus));	257	std::move(callLinkStatus));
258		258
259	if (!result.appendVariant(variant))	259	if (!result.appendVariant(variant))




#include "CallLinkStatus.h"
#include "JSCInlines.h"
#include <wtf/ListDump.h>

namespace JSC {

GetByIdVariant::GetByIdVariant(
    const StructureSet& structureSet, PropertyOffset offset, JSValue specificValue,
    const IntendedStructureChain* chain, std::unique_ptr<CallLinkStatus> callLinkStatus)
    : m_structureSet(structureSet)
    , m_alternateBase(nullptr)
    , m_specificValue(specificValue)
    , m_offset(offset)
    , m_callLinkStatus(std::move(callLinkStatus))
{
    if (!structureSet.size()) {
        ASSERT(offset == invalidOffset);
        ASSERT(!specificValue);
        ASSERT(!chain);
    }
    
    if (chain && chain->size()) {
        m_alternateBase = chain->terminalPrototype();
        chain->gatherChecks(m_constantChecks);
    }
}

GetByIdVariant::~GetByIdVariant() { }

GetByIdVariant::GetByIdVariant(const GetByIdVariant& other)

GetByIdVariant& GetByIdVariant::operator=(const GetByIdVariant& other)
{
    m_structureSet = other.m_structureSet;
    m_constantChecks = other.m_constantChecks;
    m_alternateBase = other.m_alternateBase;
    m_specificValue = other.m_specificValue;
    m_offset = other.m_offset;
    if (other.m_callLinkStatus)


bool GetByIdVariant::attemptToMerge(const GetByIdVariant& other)
{
    if (m_alternateBase != other.m_alternateBase)
        return false;
    if (m_chain && *m_chain != *other.m_chain)
        return false;
    if (m_offset != other.m_offset)
        return false;
    if (m_callLinkStatus || other.m_callLinkStatus)
        return false;
    if (!areCompatible(m_constantChecks, other.m_constantChecks))
        return false;
    
    if (m_specificValue != other.m_specificValue)
        m_specificValue = JSValue();

    mergeInto(other.m_constantChecks, m_constantChecks);
    m_structureSet.merge(other.m_structureSet);
    
    return true;

    
    out.print(
        "<", inContext(structureSet(), context), ", ",
        "[", listDumpInContext(m_constantChecks, context), "], ",
        "alternateBase = ", inContext(JSValue(m_alternateBase), context), ", ",
        "specificValue = ", inContext(specificValue(), context), ", ",
        "offset = ", offset());
    if (m_callLinkStatus)
        out.print("call = ", *m_callLinkStatus);
    out.print(">");
}




#define GetByIdVariant_h

#include "CallLinkStatus.h"
#include "ConstantStructureCheck.h"
#include "IntendedStructureChain.h"
#include "JSCJSValue.h"
#include "PropertyOffset.h"

    GetByIdVariant(
        const StructureSet& structureSet = StructureSet(),
        PropertyOffset offset = invalidOffset, JSValue specificValue = JSValue(),
        const IntendedStructureChain* chain = nullptr,
        std::unique_ptr<CallLinkStatus> callLinkStatus = nullptr);
        : m_structureSet(structureSet)
        , m_chain(chain)
        , m_specificValue(specificValue)
        , m_offset(offset)
        , m_callLinkStatus(std::move(callLinkStatus))
    {
        if (!structureSet.size()) {
            ASSERT(offset == invalidOffset);
            ASSERT(!specificValue);
            ASSERT(!chain);
        }
    }
    
    ~GetByIdVariant();
    

    bool isSet() const { return !!m_structureSet.size(); }
    bool operator!() const { return !isSet(); }
    const StructureSet& structureSet() const { return m_structureSet; }
    const ConstantStructureCheckVector& constantChecks() const { return m_constantChecks; }
    JSObject* alternateBase() const { return m_alternateBase; }
    JSValue specificValue() const { return m_specificValue; }
    PropertyOffset offset() const { return m_offset; }
    CallLinkStatus* callLinkStatus() const { return m_callLinkStatus.get(); }

    friend class GetByIdStatus;
    
    StructureSet m_structureSet;
    ConstantStructureCheckVector m_constantChecks;
    JSObject* m_alternateBase;
    JSValue m_specificValue;
    PropertyOffset m_offset;
    std::unique_ptr<CallLinkStatus> m_callLinkStatus;

Lines 26-31 Source/JavaScriptCore/bytecode/PutByIdVariant.cpp_sec1
- Source/JavaScriptCore/bytecode/PutByIdVariant.cpp -2 / +4 lines
26	#include "config.h"	26	#include "config.h"
27	#include "PutByIdVariant.h"	27	#include "PutByIdVariant.h"
28		28
		29	#include <wtf/ListDump.h>
		30
29	namespace JSC {	31	namespace JSC {
30		32
31	void PutByIdVariant::dump(PrintStream& out) const	33	void PutByIdVariant::dump(PrintStream& out) const
Lines 48-55 void PutByIdVariant::dumpInContext(Print Source/JavaScriptCore/bytecode/PutByIdVariant.cpp_sec2
48	case Transition:	50	case Transition:
49	out.print(	51	out.print(
50	"<Transition: ", pointerDumpInContext(oldStructure(), context), " -> ",	52	"<Transition: ", pointerDumpInContext(oldStructure(), context), " -> ",
51	pointerDumpInContext(newStructure(), context), ", ",	53	pointerDumpInContext(newStructure(), context), ", [",
52	pointerDumpInContext(structureChain(), context), ", ", offset(), ">");	54	listDumpInContext(constantChecks(), context), "], ", offset(), ">");
53	return;	55	return;
54	}	56	}
55		57



        result.m_kind = Transition;
        result.m_oldStructure = oldStructure;
        result.m_newStructure = newStructure;
        if (structureChain)
            structureChain->gatherChecks(result.m_constantChecks);
        result.m_offset = offset;
        return result;
    }

        return m_newStructure;
    }
    
    const ConstantStructureCheckVector& constantChecks() const
    {
        ASSERT(kind() == Transition);
        return m_constantChecks;
    }
    
    PropertyOffset offset() const

    Kind m_kind;
    Structure* m_oldStructure;
    Structure* m_newStructure;
    ConstantStructureCheckVector m_constantChecks;
    PropertyOffset m_offset;
};




                    // Assert things that we can't handle and that the computeFor() method
                    // above won't be able to return.
                    ASSERT(status[0].structureSet().size() == 1);
                    ASSERT(status[0].constantChecks().isEmpty());
                    ASSERT(!status[0].alternateBase());
                    
                    if (status[0].specificValue()) {
                        if (status[0].specificValue().isCell()) {

                if (!variant.structureSet().contains(structure))
                    continue;
                
                if (variant.alternateBase())
                    break;
                
                filter(value, structure);



    void handlePutById(
        Node* base, unsigned identifierNumber, Node* value, const PutByIdStatus&,
        bool isDirect);
    void emitChecks(const ConstantStructureCheckVector&);

    Node* getScope(bool skipTop, unsigned skipCount);
    

        return objectNode;
    }
    
    Node* cellConstantWithStructureCheck(JSCell* object)
    {
        return cellConstantWithStructureCheck(object, m_graph.freeze(object)->structure());
    }

    SpeculatedType getPredictionWithoutOSRExit(unsigned bytecodeIndex)
    {
        ConcurrentJITLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);

        return node;
    }
    
    bool structureChainIsStillValid(bool direct, Structure* previousStructure, StructureChain* chain)
    {
        if (direct)
            return true;
        
        if (!previousStructure->storedPrototype().isNull() && previousStructure->storedPrototype().asCell()->structure() != chain->head()->get())
            return false;
        
        for (WriteBarrier<Structure>* it = chain->head(); *it; ++it) {
            if (!(*it)->storedPrototype().isNull() && (*it)->storedPrototype().asCell()->structure() != it[1].get())
                return false;
        }
        
        return true;
    }
    
    void buildOperandMapsIfNecessary();
    
    VM* m_vm;

    return result;
}

void ByteCodeParser::emitChecks(const ConstantStructureCheckVector& vector)
{
    for (unsigned i = 0; i < vector.size(); ++i)
        cellConstantWithStructureCheck(vector[i].constant(), vector[i].structure());
    if (prototype.isNull())
        return nullptr;
    Node* base = nullptr;
    for (unsigned i = 0; i < chain->size(); ++i) {
        JSObject* currentObject = asObject(prototype);
        Structure* currentStructure = chain->at(i);
        base = cellConstantWithStructureCheck(currentObject, currentStructure);
        prototype = currentStructure->prototypeForLookup(m_inlineStackTop->m_codeBlock);
    }
    return base;
}

void ByteCodeParser::handleGetById(

        // 1) Emit prototype structure checks for all chains. This could sort of maybe not be
        //    optimal, if there is some rarely executed case in the chain that requires a lot
        //    of checks and those checks are not watchpointable.
        for (unsigned variantIndex = getByIdStatus.numVariants(); variantIndex--;)
            emitChecks(getByIdStatus[variantIndex].constantChecks());
                emitPrototypeChecks(getByIdStatus[variantIndex].chain());
        }
        
        // 2) Emit a MultiGetByOffset
        MultiGetByOffsetData* data = m_graph.m_multiGetByOffsetData.add();

                
    addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.structureSet())), base);
    
    emitChecks(variant.constantChecks());

    if (variant.alternateBase())
        base = weakJSConstant(variant.alternateBase());
    
    // Unless we want bugs like https://bugs.webkit.org/show_bug.cgi?id=88783, we need to
    // ensure that the base of the original get_by_id is kept alive until we're done with

            for (unsigned variantIndex = putByIdStatus.numVariants(); variantIndex--;) {
                if (putByIdStatus[variantIndex].kind() != PutByIdVariant::Transition)
                    continue;
                emitChecks(putByIdStatus[variantIndex].constantChecks());
                    continue;
                emitPrototypeChecks(putByIdStatus[variantIndex].structureChain());
            }
        }
        

        return;
    }

    if (variant.structureChain() && !variant.structureChain()->isStillValid()) {
        emitPutById(base, identifierNumber, value, putByIdStatus, isDirect);
        return;
    }
    
    m_graph.chains().addLazily(variant.structureChain());
                
    addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.oldStructure())), base);
    emitChecks(variant.constantChecks());
        emitPrototypeChecks(variant.structureChain());

    ASSERT(variant.oldStructure()->transitionWatchpointSetHasBeenInvalidated());
    



                    if (!variant.structureSet().contains(structure))
                        continue;
                    
                    if (variant.alternateBase())
                        break;
                    
                    emitGetByOffset(indexInBlock, node, structure, variant, data.identifierNumber);

                GetByIdStatus status = GetByIdStatus::computeFor(
                    vm(), structure, m_graph.identifiers()[identifierNumber]);
                
                if (!status.isSimple() || status.numVariants() != 1 ||
                    !status[0].constantChecks().isEmpty() || status[0].alternateBase()) {
                    // FIXME: We could handle prototype cases.
                    // https://bugs.webkit.org/show_bug.cgi?id=110386
                    break;


        bool needsCellCheck = m_state.forNode(child).m_type & ~SpecCell;
        
        ASSERT(!variant.alternateBase());
        ASSERT_UNUSED(structure, variant.structureSet().contains(structure));
        
        // Now before we do anything else, push the CFA forward over the GetById

        if (variant.kind() == PutByIdVariant::Transition) {
            transition = m_graph.m_transitions.add(structure, variant.newStructure());

            for (unsigned i = 0; i < variant.constantChecks().size(); ++i) {
                addStructureTransitionCheck(
                    origin, indexInBlock,
                    variant.constantChecks()[i].constant(),
                    variant.constantChecks()[i].structure());
                }

                m_graph.chains().addLazily(variant.structureChain());

                for (unsigned i = 0; i < variant.structureChain()->size(); ++i) {
                    JSValue prototype = variant.structureChain()->at(i)->storedPrototype();
                    if (prototype.isNull())
                        continue;
                    ASSERT(prototype.isCell());
                    addStructureTransitionCheck(
                        origin, indexInBlock, prototype.asCell());
                }
            }
        }


        m_graph.m_storageAccessData.append(storageAccessData);
    }

    void addStructureTransitionCheck(NodeOrigin origin, unsigned indexInBlock, JSCell* cell, Structure* structure)
    {
        if (m_graph.watchpoints().consider(cell->structure()))
            return;

        
        m_insertionSet.insertNode(
            indexInBlock, SpecNone, CheckStructure, origin,
            OpInfo(m_graph.addStructureSet(structure)), Edge(weakConstant, CellUse));
    }
    
    InPlaceAbstractState m_state;



/*
 * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGDesiredStructureChains.h"

#if ENABLE(DFG_JIT)

#include "JSCInlines.h"

namespace JSC { namespace DFG {

DesiredStructureChains::DesiredStructureChains() { }
DesiredStructureChains::~DesiredStructureChains() { }

bool DesiredStructureChains::areStillValid() const
{
    for (unsigned i = 0; i < m_vector.size(); ++i) {
        if (!m_vector[i]->isStillValid())
            return false;
    }
    return true;
}

void DesiredStructureChains::visitChildren(SlotVisitor& visitor)
{
    for (unsigned i = m_vector.size(); i--;)
        m_vector[i]->visitChildren(visitor);
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGDesiredStructureChains_h
#define DFGDesiredStructureChains_h

#if ENABLE(DFG_JIT)

#include "IntendedStructureChain.h"
#include <wtf/Vector.h>

namespace JSC { namespace DFG {

class DesiredStructureChains {
public:
    DesiredStructureChains();
    ~DesiredStructureChains();
    
    void addLazily(PassRefPtr<IntendedStructureChain> chain)
    {
        m_vector.append(chain);
    }
    
    bool areStillValid() const;
    
    void visitChildren(SlotVisitor&);
    
private:
    Vector<RefPtr<IntendedStructureChain>> m_vector;
};

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGDesiredStructureChains_h


Lines 671-677 public: Source/JavaScriptCore/dfg/DFGGraph.h_sec1
- Source/JavaScriptCore/dfg/DFGGraph.h -1 lines
671		671
672	DesiredIdentifiers& identifiers() { return m_plan.identifiers; }	672	DesiredIdentifiers& identifiers() { return m_plan.identifiers; }
673	DesiredWatchpoints& watchpoints() { return m_plan.watchpoints; }	673	DesiredWatchpoints& watchpoints() { return m_plan.watchpoints; }
674	DesiredStructureChains& chains() { return m_plan.chains; }
675		674
676	FullBytecodeLiveness& livenessFor(CodeBlock*);	675	FullBytecodeLiveness& livenessFor(CodeBlock*);
677	FullBytecodeLiveness& livenessFor(InlineCallFrame*);	676	FullBytecodeLiveness& livenessFor(InlineCallFrame*);



        return false;
    if (!watchpoints.areStillValid())
        return false;
    if (!chains.areStillValid())
        return false;
    return true;
}


    codeBlocks.mark(codeBlock.get());
    codeBlocks.mark(profiledDFGCodeBlock.get());
    
    chains.visitChildren(visitor);
    weakReferences.visitChildren(visitor);
    writeBarriers.visitChildren(visitor);
    transitions.visitChildren(visitor);

    inlineCallFrames = nullptr;
    watchpoints = DesiredWatchpoints();
    identifiers = DesiredIdentifiers();
    chains = DesiredStructureChains();
    weakReferences = DesiredWeakReferences();
    writeBarriers = DesiredWriteBarriers();
    transitions = DesiredTransitions();



#include "DFGCompilationKey.h"
#include "DFGCompilationMode.h"
#include "DFGDesiredIdentifiers.h"
#include "DFGDesiredStructureChains.h"
#include "DFGDesiredTransitions.h"
#include "DFGDesiredWatchpoints.h"
#include "DFGDesiredWeakReferences.h"

    RefPtr<InlineCallFrameSet> inlineCallFrames;
    DesiredWatchpoints watchpoints;
    DesiredIdentifiers identifiers;
    DesiredStructureChains chains;
    DesiredWeakReferences weakReferences;
    DesiredWriteBarriers writeBarriers;
    DesiredTransitions transitions;



                result = m_out.constInt64(JSValue::encode(variant.specificValue()));
            else {
                LValue propertyBase;
                if (variant.alternateBase())
                    propertyBase = weakPointer(variant.alternateBase());
                else
                    propertyBase = base;
                if (!isInlineOffset(variant.offset()))



        && m_vector == other.m_vector;
}

void IntendedStructureChain::gatherChecks(ConstantStructureCheckVector& vector) const
{
    JSValue currentPrototype = m_prototype;
    for (unsigned i = 0; i < size(); ++i) {
        JSObject* currentObject = asObject(currentPrototype);
        Structure* currentStructure = at(i);
        vector.append(ConstantStructureCheck(currentObject, currentStructure));
        currentPrototype = currentStructure->prototypeForLookup(m_globalObject);
    }
}

void IntendedStructureChain::visitChildren(SlotVisitor& visitor)
{
    visitor.appendUnbarrieredPointer(&m_globalObject);

Lines 26-31 Source/JavaScriptCore/runtime/IntendedStructureChain.h_sec1
- Source/JavaScriptCore/runtime/IntendedStructureChain.h -2 / +5 lines
26	#ifndef IntendedStructureChain_h	26	#ifndef IntendedStructureChain_h
27	#define IntendedStructureChain_h	27	#define IntendedStructureChain_h
28		28
		29	#include "ConstantStructureCheck.h"
29	#include "Structure.h"	30	#include "Structure.h"
30	#include <wtf/RefCounted.h>	31	#include <wtf/RefCounted.h>
31		32
Lines 54-61 public: Source/JavaScriptCore/runtime/IntendedStructureChain.h_sec2
54	JSValue prototype() const { return m_prototype; }	55	JSValue prototype() const { return m_prototype; }
55		56
56	size_t size() const { return m_vector.size(); }	57	size_t size() const { return m_vector.size(); }
57	Structure* at(size_t index) { return m_vector[index]; }	58	Structure* at(size_t index) const { return m_vector[index]; }
58	Structure* operator[](size_t index) { return at(index); }	59	Structure* operator[](size_t index) const { return at(index); }
59		60
60	JSObject* terminalPrototype() const;	61	JSObject* terminalPrototype() const;
61		62
Lines 67-72 public: Source/JavaScriptCore/runtime/IntendedStructureChain.h_sec3
67	return !(*this == other);	68	return !(*this == other);
68	}	69	}
69		70
		71	void gatherChecks(ConstantStructureCheckVector&) const;
		72
70	void visitChildren(SlotVisitor&);	73	void visitChildren(SlotVisitor&);
71	void dump(PrintStream&) const;	74	void dump(PrintStream&) const;
72	void dumpInContext(PrintStream&, DumpContext*) const;	75	void dumpInContext(PrintStream&, DumpContext*) const;



    return out.toCString();
}

template<typename T, typename U>
class ListDumpInContext {
public:
    ListDumpInContext(const T& list, U* context, const char* comma)
        : m_list(list)
        , m_context(context)
        , m_comma(comma)
    {
    }
    
    void dump(PrintStream& out) const
    {
        for (typename T::const_iterator iter = m_list.begin(); iter != m_list.end(); ++iter)
            out.print(m_comma, inContext(*iter, m_context));
    }

private:
    const T& m_list;
    U* m_context;
    CommaPrinter m_comma;
};

template<typename T, typename U>
ListDumpInContext<T, U> listDumpInContext(
    const T& list, U* context, const char* comma = ", ")
{
    return ListDumpInContext<T, U>(list, context, comma);
}

} // namespace WTF

using WTF::listDump;
using WTF::sortedListDump;
using WTF::mapDump;
using WTF::sortedMapDump;
using WTF::listDumpInContext;

#endif // ListDump_h




2014-06-12  Filip Pizlo  <fpizlo@apple.com>

        [ftlopt] A DFG inlined ById access variant should not speak of a chain, but only of what structures to test the base for, whether to use a constant as an alternate base for the actual access, and what structures to check on what additional cell constants
        https://bugs.webkit.org/show_bug.cgi?id=133821

        Reviewed by NOBODY (OOPS!).

        * js/regress/poly-chain-access-different-prototypes-expected.txt: Added.
        * js/regress/poly-chain-access-different-prototypes-simple-expected.txt: Added.
        * js/regress/poly-chain-access-different-prototypes-simple.html: Added.
        * js/regress/poly-chain-access-different-prototypes.html: Added.
        * js/regress/script-tests/poly-chain-access-different-prototypes-simple.js: Added.
        * js/regress/script-tests/poly-chain-access-different-prototypes.js: Added.

2014-06-11  Filip Pizlo  <fpizlo@apple.com>

        [ftlopt] DFG get_by_id should inline chain accesses with a slightly polymorphic base



JSRegress/poly-chain-access-different-prototypes

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS no exception thrown
PASS successfullyParsed is true

TEST COMPLETE




JSRegress/poly-chain-access-different-prototypes-simple

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS no exception thrown
PASS successfullyParsed is true

TEST COMPLETE




<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body>
<script src="../../resources/regress-pre.js"></script>
<script src="script-tests/poly-chain-access-different-prototypes-simple.js"></script>
<script src="../../resources/regress-post.js"></script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>



<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body>
<script src="../../resources/regress-pre.js"></script>
<script src="script-tests/poly-chain-access-different-prototypes.js"></script>
<script src="../../resources/regress-post.js"></script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>



(function() {
    function Foo() { }
    Foo.prototype.f = 42;
    function Bar() { }
    Bar.prototype = new Foo();
    function Baz() { }
    Baz.prototype = new Foo();
    
    function foo(o, p) {
        var n = 1000000;
        var result = 0;
        for (var i = 0; i < n; ++i) {
            result += o.f;
            var tmp = o;
            o = p;
            p = tmp;
        }
        
        if (result != n * 42)
            throw "Error: bad result: " + result;
    }

    foo(new Bar(), new Baz());
})();



(function() {
    function Foo() { }
    Foo.prototype.f = 42;
    function Bar() { }
    Bar.prototype = new Foo();
    function Baz() { }
    Baz.prototype = new Foo();
    
    var o = new Bar();
    var p = new Baz();
    
    var n = 1000000;
    var result = 0;
    for (var i = 0; i < n; ++i) {
        result += o.f;
        var tmp = o;
        o = p;
        p = tmp;
    }
    
    if (result != n * 42)
        throw "Error: bad result: " + result;
})();

Return to Bug 133821

Lines 1471-1477 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec1
- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h -2 / +3 lines
1471	// Assert things that we can't handle and that the computeFor() method	1471	// Assert things that we can't handle and that the computeFor() method
1472	// above won't be able to return.	1472	// above won't be able to return.
1473	ASSERT(status[0].structureSet().size() == 1);	1473	ASSERT(status[0].structureSet().size() == 1);
1474	ASSERT(!status[0].chain());	1474	ASSERT(status[0].constantChecks().isEmpty());
		1475	ASSERT(!status[0].alternateBase());
1475		1476
1476	if (status[0].specificValue()) {	1477	if (status[0].specificValue()) {
1477	if (status[0].specificValue().isCell()) {	1478	if (status[0].specificValue().isCell()) {
Lines 1679-1685 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec2
1679	if (!variant.structureSet().contains(structure))	1680	if (!variant.structureSet().contains(structure))
1680	continue;	1681	continue;
1681		1682
1682	if (variant.chain())	1683	if (variant.alternateBase())
1683	break;	1684	break;
1684		1685
1685	filter(value, structure);	1686	filter(value, structure);

Lines 192-198 private: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec1
- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp -53 / +12 lines
192	void handlePutById(	192	void handlePutById(
193	Node* base, unsigned identifierNumber, Node* value, const PutByIdStatus&,	193	Node* base, unsigned identifierNumber, Node* value, const PutByIdStatus&,
194	bool isDirect);	194	bool isDirect);
195	Node* emitPrototypeChecks(IntendedStructureChain*);	195	void emitChecks(const ConstantStructureCheckVector&);
196		196
197	Node* getScope(bool skipTop, unsigned skipCount);	197	Node* getScope(bool skipTop, unsigned skipCount);
198		198
Lines 665-675 private: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec2
665	return objectNode;	665	return objectNode;
666	}	666	}
667		667
668	Node* cellConstantWithStructureCheck(JSCell* object)
669	{
670	return cellConstantWithStructureCheck(object, m_graph.freeze(object)->structure());
671	}
672
673	SpeculatedType getPredictionWithoutOSRExit(unsigned bytecodeIndex)	668	SpeculatedType getPredictionWithoutOSRExit(unsigned bytecodeIndex)
674	{	669	{
675	ConcurrentJITLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);	670	ConcurrentJITLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
Lines 798-819 private: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec3
798	return node;	793	return node;
799	}	794	}
800		795
801	bool structureChainIsStillValid(bool direct, Structure* previousStructure, StructureChain* chain)
802	{
803	if (direct)
804	return true;
805
806	if (!previousStructure->storedPrototype().isNull() && previousStructure->storedPrototype().asCell()->structure() != chain->head()->get())
807	return false;
808
809	for (WriteBarrier<Structure>* it = chain->head(); *it; ++it) {
810	if (!(it)->storedPrototype().isNull() && (it)->storedPrototype().asCell()->structure() != it[1].get())
811	return false;
812	}
813
814	return true;
815	}
816
817	void buildOperandMapsIfNecessary();	796	void buildOperandMapsIfNecessary();
818		797
819	VM* m_vm;	798	VM* m_vm;
Lines 1705-1724 Node* ByteCodeParser::handlePutByOffset( Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec4
1705	return result;	1684	return result;
1706	}	1685	}
1707		1686
1708	Node* ByteCodeParser::emitPrototypeChecks(IntendedStructureChain* chain)	1687	void ByteCodeParser::emitChecks(const ConstantStructureCheckVector& vector)
1709	{	1688	{
1710	m_graph.chains().addLazily(chain);	1689	for (unsigned i = 0; i < vector.size(); ++i)
1711	JSValue prototype = chain->prototype();	1690	cellConstantWithStructureCheck(vector[i].constant(), vector[i].structure());
1712	if (prototype.isNull())
1713	return nullptr;
1714	Node* base = nullptr;
1715	for (unsigned i = 0; i < chain->size(); ++i) {
1716	JSObject* currentObject = asObject(prototype);
1717	Structure* currentStructure = chain->at(i);
1718	base = cellConstantWithStructureCheck(currentObject, currentStructure);
1719	prototype = currentStructure->prototypeForLookup(m_inlineStackTop->m_codeBlock);
1720	}
1721	return base;
1722	}	1691	}
1723		1692
1724	void ByteCodeParser::handleGetById(	1693	void ByteCodeParser::handleGetById(
Lines 1747-1756 void ByteCodeParser::handleGetById( Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec5
1747	// 1) Emit prototype structure checks for all chains. This could sort of maybe not be	1716	// 1) Emit prototype structure checks for all chains. This could sort of maybe not be
1748	// optimal, if there is some rarely executed case in the chain that requires a lot	1717	// optimal, if there is some rarely executed case in the chain that requires a lot
1749	// of checks and those checks are not watchpointable.	1718	// of checks and those checks are not watchpointable.
1750	for (unsigned variantIndex = getByIdStatus.numVariants(); variantIndex--;) {	1719	for (unsigned variantIndex = getByIdStatus.numVariants(); variantIndex--;)
1751	if (getByIdStatus[variantIndex].chain())	1720	emitChecks(getByIdStatus[variantIndex].constantChecks());
1752	emitPrototypeChecks(getByIdStatus[variantIndex].chain());
1753	}
1754		1721
1755	// 2) Emit a MultiGetByOffset	1722	// 2) Emit a MultiGetByOffset
1756	MultiGetByOffsetData* data = m_graph.m_multiGetByOffsetData.add();	1723	MultiGetByOffsetData* data = m_graph.m_multiGetByOffsetData.add();
Lines 1771-1778 void ByteCodeParser::handleGetById( Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec6
1771		1738
1772	addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.structureSet())), base);	1739	addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.structureSet())), base);
1773		1740
1774	if (variant.chain())	1741	emitChecks(variant.constantChecks());
1775	base = emitPrototypeChecks(variant.chain());	1742
		1743	if (variant.alternateBase())
		1744	base = weakJSConstant(variant.alternateBase());
1776		1745
1777	// Unless we want bugs like https://bugs.webkit.org/show_bug.cgi?id=88783, we need to	1746	// Unless we want bugs like https://bugs.webkit.org/show_bug.cgi?id=88783, we need to
1778	// ensure that the base of the original get_by_id is kept alive until we're done with	1747	// ensure that the base of the original get_by_id is kept alive until we're done with
Lines 1869-1877 void ByteCodeParser::handlePutById( Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec7
1869	for (unsigned variantIndex = putByIdStatus.numVariants(); variantIndex--;) {	1838	for (unsigned variantIndex = putByIdStatus.numVariants(); variantIndex--;) {
1870	if (putByIdStatus[variantIndex].kind() != PutByIdVariant::Transition)	1839	if (putByIdStatus[variantIndex].kind() != PutByIdVariant::Transition)
1871	continue;	1840	continue;
1872	if (!putByIdStatus[variantIndex].structureChain())	1841	emitChecks(putByIdStatus[variantIndex].constantChecks());
1873	continue;
1874	emitPrototypeChecks(putByIdStatus[variantIndex].structureChain());
1875	}	1842	}
1876	}	1843	}
1877		1844
Lines 1898-1913 void ByteCodeParser::handlePutById( Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec8
1898	return;	1865	return;
1899	}	1866	}
1900		1867
1901	if (variant.structureChain() && !variant.structureChain()->isStillValid()) {
1902	emitPutById(base, identifierNumber, value, putByIdStatus, isDirect);
1903	return;
1904	}
1905
1906	m_graph.chains().addLazily(variant.structureChain());
1907
1908	addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.oldStructure())), base);	1868	addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.oldStructure())), base);
1909	if (!isDirect)	1869	emitChecks(variant.constantChecks());
1910	emitPrototypeChecks(variant.structureChain());
1911		1870
1912	ASSERT(variant.oldStructure()->transitionWatchpointSetHasBeenInvalidated());	1871	ASSERT(variant.oldStructure()->transitionWatchpointSetHasBeenInvalidated());
1913		1872

Lines 150-156 private: Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp_sec1
- Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp -22 / +11 lines
150	if (!variant.structureSet().contains(structure))	150	if (!variant.structureSet().contains(structure))
151	continue;	151	continue;
152		152
153	if (variant.chain())	153	if (variant.alternateBase())
154	break;	154	break;
155		155
156	emitGetByOffset(indexInBlock, node, structure, variant, data.identifierNumber);	156	emitGetByOffset(indexInBlock, node, structure, variant, data.identifierNumber);
Lines 197-203 private: Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp_sec2
197	GetByIdStatus status = GetByIdStatus::computeFor(	197	GetByIdStatus status = GetByIdStatus::computeFor(
198	vm(), structure, m_graph.identifiers()[identifierNumber]);	198	vm(), structure, m_graph.identifiers()[identifierNumber]);
199		199
200	if (!status.isSimple() \|\| status.numVariants() != 1) {	200	if (!status.isSimple() \|\| status.numVariants() != 1 \|\|
		201	!status[0].constantChecks().isEmpty() \|\| status[0].alternateBase()) {
201	// FIXME: We could handle prototype cases.	202	// FIXME: We could handle prototype cases.
202	// https://bugs.webkit.org/show_bug.cgi?id=110386	203	// https://bugs.webkit.org/show_bug.cgi?id=110386
203	break;	204	break;
Lines 319-325 private: Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp_sec3
319		320
320	bool needsCellCheck = m_state.forNode(child).m_type & ~SpecCell;	321	bool needsCellCheck = m_state.forNode(child).m_type & ~SpecCell;
321		322
322	ASSERT(!variant.chain());	323	ASSERT(!variant.alternateBase());
323	ASSERT_UNUSED(structure, variant.structureSet().contains(structure));	324	ASSERT_UNUSED(structure, variant.structureSet().contains(structure));
324		325
325	// Now before we do anything else, push the CFA forward over the GetById	326	// Now before we do anything else, push the CFA forward over the GetById
Lines 382-404 private: Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp_sec4
382	if (variant.kind() == PutByIdVariant::Transition) {	383	if (variant.kind() == PutByIdVariant::Transition) {
383	transition = m_graph.m_transitions.add(structure, variant.newStructure());	384	transition = m_graph.m_transitions.add(structure, variant.newStructure());
384		385
385	if (node->op() == PutById) {	386	for (unsigned i = 0; i < variant.constantChecks().size(); ++i) {
386	if (!structure->storedPrototype().isNull()) {	387	addStructureTransitionCheck(
387	addStructureTransitionCheck(	388	origin, indexInBlock,
388	origin, indexInBlock,	389	variant.constantChecks()[i].constant(),
389	structure->storedPrototype().asCell());	390	variant.constantChecks()[i].structure());
390	}
391
392	m_graph.chains().addLazily(variant.structureChain());
393
394	for (unsigned i = 0; i < variant.structureChain()->size(); ++i) {
395	JSValue prototype = variant.structureChain()->at(i)->storedPrototype();
396	if (prototype.isNull())
397	continue;
398	ASSERT(prototype.isCell());
399	addStructureTransitionCheck(
400	origin, indexInBlock, prototype.asCell());
401	}
402	}	391	}
403	}	392	}
404		393
Lines 450-456 private: Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp_sec5
450	m_graph.m_storageAccessData.append(storageAccessData);	439	m_graph.m_storageAccessData.append(storageAccessData);
451	}	440	}
452		441
453	void addStructureTransitionCheck(NodeOrigin origin, unsigned indexInBlock, JSCell* cell)	442	void addStructureTransitionCheck(NodeOrigin origin, unsigned indexInBlock, JSCell* cell, Structure* structure)
454	{	443	{
455	if (m_graph.watchpoints().consider(cell->structure()))	444	if (m_graph.watchpoints().consider(cell->structure()))
456	return;	445	return;
Lines 461-467 private: Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp_sec6
461		450
462	m_insertionSet.insertNode(	451	m_insertionSet.insertNode(
463	indexInBlock, SpecNone, CheckStructure, origin,	452	indexInBlock, SpecNone, CheckStructure, origin,
464	OpInfo(m_graph.addStructureSet(cell->structure())), Edge(weakConstant, CellUse));	453	OpInfo(m_graph.addStructureSet(structure)), Edge(weakConstant, CellUse));
465	}	454	}
466		455
467	InPlaceAbstractState m_state;	456	InPlaceAbstractState m_state;

Lines 3240-3247 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec1
- Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp -2 / +2 lines
3240	result = m_out.constInt64(JSValue::encode(variant.specificValue()));	3240	result = m_out.constInt64(JSValue::encode(variant.specificValue()));
3241	else {	3241	else {
3242	LValue propertyBase;	3242	LValue propertyBase;
3243	if (variant.chain())	3243	if (variant.alternateBase())
3244	propertyBase = weakPointer(variant.chain()->terminalPrototype());	3244	propertyBase = weakPointer(variant.alternateBase());
3245	else	3245	else
3246	propertyBase = base;	3246	propertyBase = base;
3247	if (!isInlineOffset(variant.offset()))	3247	if (!isInlineOffset(variant.offset()))

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +77 lines
		1	2014-06-12 Filip Pizlo <fpizlo@apple.com>
		2
		3	[ftlopt] A DFG inlined ById access variant should not speak of a chain, but only of what structures to test the base for, whether to use a constant as an alternate base for the actual access, and what structures to check on what additional cell constants
		4	https://bugs.webkit.org/show_bug.cgi?id=133821
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	This allows us to efficiently cache accesses that differ only in the prototypes on the path
		9	from the base to the prototype that has the field.
		10
		11	It also simplifies a bunch of code - IntendedStructureChain is now just an intermediate
		12	data structure.
		13
		14	* CMakeLists.txt:
		15	* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
		16	* JavaScriptCore.xcodeproj/project.pbxproj:
		17	* bytecode/ConstantStructureCheck.cpp: Added.
		18	(JSC::ConstantStructureCheck::dumpInContext):
		19	(JSC::ConstantStructureCheck::dump):
		20	(JSC::structureFor):
		21	(JSC::areCompatible):
		22	(JSC::mergeInto):
		23	* bytecode/ConstantStructureCheck.h: Added.
		24	(JSC::ConstantStructureCheck::ConstantStructureCheck):
		25	(JSC::ConstantStructureCheck::operator!):
		26	(JSC::ConstantStructureCheck::constant):
		27	(JSC::ConstantStructureCheck::structure):
		28	* bytecode/GetByIdStatus.cpp:
		29	(JSC::GetByIdStatus::computeForStubInfo):
		30	* bytecode/GetByIdVariant.cpp:
		31	(JSC::GetByIdVariant::GetByIdVariant):
		32	(JSC::GetByIdVariant::operator=):
		33	(JSC::GetByIdVariant::attemptToMerge):
		34	(JSC::GetByIdVariant::dumpInContext):
		35	* bytecode/GetByIdVariant.h:
		36	(JSC::GetByIdVariant::constantChecks):
		37	(JSC::GetByIdVariant::alternateBase):
		38	(JSC::GetByIdVariant::GetByIdVariant): Deleted.
		39	(JSC::GetByIdVariant::chain): Deleted.
		40	* bytecode/PutByIdVariant.cpp:
		41	(JSC::PutByIdVariant::dumpInContext):
		42	* bytecode/PutByIdVariant.h:
		43	(JSC::PutByIdVariant::transition):
		44	(JSC::PutByIdVariant::constantChecks):
		45	(JSC::PutByIdVariant::structureChain): Deleted.
		46	* dfg/DFGAbstractInterpreterInlines.h:
		47	(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
		48	* dfg/DFGByteCodeParser.cpp:
		49	(JSC::DFG::ByteCodeParser::emitChecks):
		50	(JSC::DFG::ByteCodeParser::handleGetById):
		51	(JSC::DFG::ByteCodeParser::handlePutById):
		52	(JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck): Deleted.
		53	(JSC::DFG::ByteCodeParser::structureChainIsStillValid): Deleted.
		54	(JSC::DFG::ByteCodeParser::emitPrototypeChecks): Deleted.
		55	* dfg/DFGConstantFoldingPhase.cpp:
		56	(JSC::DFG::ConstantFoldingPhase::foldConstants):
		57	(JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
		58	(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
		59	(JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
		60	* dfg/DFGDesiredStructureChains.cpp: Removed.
		61	* dfg/DFGDesiredStructureChains.h: Removed.
		62	* dfg/DFGGraph.h:
		63	(JSC::DFG::Graph::watchpoints):
		64	(JSC::DFG::Graph::chains): Deleted.
65	* dfg/DFGPlan.cpp:
66	(JSC::DFG::Plan::isStillValid):
67	(JSC::DFG::Plan::checkLivenessAndVisitChildren):
68	(JSC::DFG::Plan::cancel):
69	* dfg/DFGPlan.h:
70	* ftl/FTLLowerDFGToLLVM.cpp:
71	(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
72	* runtime/IntendedStructureChain.cpp:
73	(JSC::IntendedStructureChain::gatherChecks):
74	* runtime/IntendedStructureChain.h:
75	(JSC::IntendedStructureChain::at):
76	(JSC::IntendedStructureChain::operator[]):
77
1	2014-06-11 Filip Pizlo <fpizlo@apple.com>	78	2014-06-11 Filip Pizlo <fpizlo@apple.com>
2		79
3	[ftlopt] DFG get_by_id should inline chain accesses with a slightly polymorphic base	80	[ftlopt] DFG get_by_id should inline chain accesses with a slightly polymorphic base

Lines 67-72 set(JavaScriptCore_SOURCES Source/JavaScriptCore/CMakeLists.txt_sec1
- Source/JavaScriptCore/CMakeLists.txt -1 / +1 lines
67	bytecode/CodeBlockJettisoningWatchpoint.cpp	67	bytecode/CodeBlockJettisoningWatchpoint.cpp
68	bytecode/CodeOrigin.cpp	68	bytecode/CodeOrigin.cpp
69	bytecode/CodeType.cpp	69	bytecode/CodeType.cpp
		70	bytecode/ConstantStructureCheck.cpp
70	bytecode/DFGExitProfile.cpp	71	bytecode/DFGExitProfile.cpp
71	bytecode/DeferredCompilationCallback.cpp	72	bytecode/DeferredCompilationCallback.cpp
72	bytecode/ExecutionCounter.cpp	73	bytecode/ExecutionCounter.cpp
Lines 131-137 set(JavaScriptCore_SOURCES Source/JavaScriptCore/CMakeLists.txt_sec2
131	dfg/DFGCriticalEdgeBreakingPhase.cpp	132	dfg/DFGCriticalEdgeBreakingPhase.cpp
132	dfg/DFGDCEPhase.cpp	133	dfg/DFGDCEPhase.cpp
133	dfg/DFGDesiredIdentifiers.cpp	134	dfg/DFGDesiredIdentifiers.cpp
134	dfg/DFGDesiredStructureChains.cpp
135	dfg/DFGDesiredTransitions.cpp	135	dfg/DFGDesiredTransitions.cpp
136	dfg/DFGDesiredWatchpoints.cpp	136	dfg/DFGDesiredWatchpoints.cpp
137	dfg/DFGDesiredWeakReferences.cpp	137	dfg/DFGDesiredWeakReferences.cpp

Lines 321-326 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec1
- Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj -2 / +2 lines
321	<ClCompile Include="..\bytecode\CodeBlockJettisoningWatchpoint.cpp" />	321	<ClCompile Include="..\bytecode\CodeBlockJettisoningWatchpoint.cpp" />
322	<ClCompile Include="..\bytecode\CodeOrigin.cpp" />	322	<ClCompile Include="..\bytecode\CodeOrigin.cpp" />
323	<ClCompile Include="..\bytecode\CodeType.cpp" />	323	<ClCompile Include="..\bytecode\CodeType.cpp" />
		324	<ClCompile Include="..\bytecode\ConstantStructureCheck.cpp" />
324	<ClCompile Include="..\bytecode\DeferredCompilationCallback.cpp" />	325	<ClCompile Include="..\bytecode\DeferredCompilationCallback.cpp" />
325	<ClCompile Include="..\bytecode\DFGExitProfile.cpp" />	326	<ClCompile Include="..\bytecode\DFGExitProfile.cpp" />
326	<ClCompile Include="..\bytecode\ExecutionCounter.cpp" />	327	<ClCompile Include="..\bytecode\ExecutionCounter.cpp" />
Lines 382-388 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec2
382	<ClCompile Include="..\dfg\DFGCSEPhase.cpp" />	383	<ClCompile Include="..\dfg\DFGCSEPhase.cpp" />
383	<ClCompile Include="..\dfg\DFGDCEPhase.cpp" />	384	<ClCompile Include="..\dfg\DFGDCEPhase.cpp" />
384	<ClCompile Include="..\dfg\DFGDesiredIdentifiers.cpp" />	385	<ClCompile Include="..\dfg\DFGDesiredIdentifiers.cpp" />
385	<ClCompile Include="..\dfg\DFGDesiredStructureChains.cpp" />
386	<ClCompile Include="..\dfg\DFGDesiredTransitions.cpp" />	386	<ClCompile Include="..\dfg\DFGDesiredTransitions.cpp" />
387	<ClCompile Include="..\dfg\DFGDesiredWatchpoints.cpp" />	387	<ClCompile Include="..\dfg\DFGDesiredWatchpoints.cpp" />
388	<ClCompile Include="..\dfg\DFGDesiredWeakReferences.cpp" />	388	<ClCompile Include="..\dfg\DFGDesiredWeakReferences.cpp" />
Lines 856-861 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec3
856	<ClInclude Include="..\bytecode\CodeOrigin.h" />	856	<ClInclude Include="..\bytecode\CodeOrigin.h" />
857	<ClInclude Include="..\bytecode\CodeType.h" />	857	<ClInclude Include="..\bytecode\CodeType.h" />
858	<ClInclude Include="..\bytecode\Comment.h" />	858	<ClInclude Include="..\bytecode\Comment.h" />
		859	<ClInclude Include="..\bytecode\ConstantStructureCheck.h" />
859	<ClInclude Include="..\bytecode\DataFormat.h" />	860	<ClInclude Include="..\bytecode\DataFormat.h" />
860	<ClInclude Include="..\bytecode\DeferredCompilationCallback.h" />	861	<ClInclude Include="..\bytecode\DeferredCompilationCallback.h" />
861	<ClInclude Include="..\bytecode\DFGExitProfile.h" />	862	<ClInclude Include="..\bytecode\DFGExitProfile.h" />
Lines 943-949 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec4
943	<ClInclude Include="..\dfg\DFGCSEPhase.h" />	944	<ClInclude Include="..\dfg\DFGCSEPhase.h" />
944	<ClInclude Include="..\dfg\DFGDCEPhase.h" />	945	<ClInclude Include="..\dfg\DFGDCEPhase.h" />
945	<ClInclude Include="..\dfg\DFGDesiredIdentifiers.h" />	946	<ClInclude Include="..\dfg\DFGDesiredIdentifiers.h" />
946	<ClInclude Include="..\dfg\DFGDesiredStructureChains.h" />
947	<ClInclude Include="..\dfg\DFGDesiredTransitions.h" />	947	<ClInclude Include="..\dfg\DFGDesiredTransitions.h" />
948	<ClInclude Include="..\dfg\DFGDesiredWatchpoints.h" />	948	<ClInclude Include="..\dfg\DFGDesiredWatchpoints.h" />
949	<ClInclude Include="..\dfg\DFGDesiredWeakReferences.h" />	949	<ClInclude Include="..\dfg\DFGDesiredWeakReferences.h" />

Lines 251-256 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec1
- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj -8 / +8 lines
251	0F3B3A281544C997003ED0FF /* DFGCFGSimplificationPhase.h in Headers / = {isa = PBXBuildFile; fileRef = 0F3B3A251544C991003ED0FF / DFGCFGSimplificationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };	251	0F3B3A281544C997003ED0FF /* DFGCFGSimplificationPhase.h in Headers / = {isa = PBXBuildFile; fileRef = 0F3B3A251544C991003ED0FF / DFGCFGSimplificationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
252	0F3B3A2B15475000003ED0FF /* DFGValidate.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F3B3A2915474FF4003ED0FF / DFGValidate.cpp */; };	252	0F3B3A2B15475000003ED0FF /* DFGValidate.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F3B3A2915474FF4003ED0FF / DFGValidate.cpp */; };
253	0F3B3A2C15475002003ED0FF /* DFGValidate.h in Headers / = {isa = PBXBuildFile; fileRef = 0F3B3A2A15474FF4003ED0FF / DFGValidate.h */; settings = {ATTRIBUTES = (Private, ); }; };	253	0F3B3A2C15475002003ED0FF /* DFGValidate.h in Headers / = {isa = PBXBuildFile; fileRef = 0F3B3A2A15474FF4003ED0FF / DFGValidate.h */; settings = {ATTRIBUTES = (Private, ); }; };
		254	0F3D0BBC194A414300FC9CF9 /* ConstantStructureCheck.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F3D0BBA194A414300FC9CF9 / ConstantStructureCheck.cpp */; };
		255	0F3D0BBD194A414300FC9CF9 /* ConstantStructureCheck.h in Headers / = {isa = PBXBuildFile; fileRef = 0F3D0BBB194A414300FC9CF9 / ConstantStructureCheck.h */; settings = {ATTRIBUTES = (Private, ); }; };
254	0F426A481460CBB300131F8F /* ValueRecovery.h in Headers / = {isa = PBXBuildFile; fileRef = 0F426A451460CBAB00131F8F / ValueRecovery.h */; settings = {ATTRIBUTES = (Private, ); }; };	256	0F426A481460CBB300131F8F /* ValueRecovery.h in Headers / = {isa = PBXBuildFile; fileRef = 0F426A451460CBAB00131F8F / ValueRecovery.h */; settings = {ATTRIBUTES = (Private, ); }; };
255	0F426A491460CBB700131F8F /* VirtualRegister.h in Headers / = {isa = PBXBuildFile; fileRef = 0F426A461460CBAB00131F8F / VirtualRegister.h */; settings = {ATTRIBUTES = (Private, ); }; };	257	0F426A491460CBB700131F8F /* VirtualRegister.h in Headers / = {isa = PBXBuildFile; fileRef = 0F426A461460CBAB00131F8F / VirtualRegister.h */; settings = {ATTRIBUTES = (Private, ); }; };
256	0F426A4B1460CD6E00131F8F /* DataFormat.h in Headers / = {isa = PBXBuildFile; fileRef = 0F426A4A1460CD6B00131F8F / DataFormat.h */; settings = {ATTRIBUTES = (Private, ); }; };	258	0F426A4B1460CD6E00131F8F /* DataFormat.h in Headers / = {isa = PBXBuildFile; fileRef = 0F426A4A1460CD6B00131F8F / DataFormat.h */; settings = {ATTRIBUTES = (Private, ); }; };
Lines 1723-1730 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec2
1723	A7386556118697B400540279 /* ThunkGenerators.h in Headers / = {isa = PBXBuildFile; fileRef = A7386553118697B400540279 / ThunkGenerators.h */; settings = {ATTRIBUTES = (Private, ); }; };	1725	A7386556118697B400540279 /* ThunkGenerators.h in Headers / = {isa = PBXBuildFile; fileRef = A7386553118697B400540279 / ThunkGenerators.h */; settings = {ATTRIBUTES = (Private, ); }; };
1724	A73A535A1799CD5D00170C19 /* DFGLazyJSValue.cpp in Sources / = {isa = PBXBuildFile; fileRef = A73A53581799CD5D00170C19 / DFGLazyJSValue.cpp */; };	1726	A73A535A1799CD5D00170C19 /* DFGLazyJSValue.cpp in Sources / = {isa = PBXBuildFile; fileRef = A73A53581799CD5D00170C19 / DFGLazyJSValue.cpp */; };
1725	A73A535B1799CD5D00170C19 /* DFGLazyJSValue.h in Headers / = {isa = PBXBuildFile; fileRef = A73A53591799CD5D00170C19 / DFGLazyJSValue.h */; settings = {ATTRIBUTES = (Private, ); }; };	1727	A73A535B1799CD5D00170C19 /* DFGLazyJSValue.h in Headers / = {isa = PBXBuildFile; fileRef = A73A53591799CD5D00170C19 / DFGLazyJSValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
1726	A73E1330179624CD00E4DEA8 /* DFGDesiredStructureChains.cpp in Sources / = {isa = PBXBuildFile; fileRef = A73E132C179624CD00E4DEA8 / DFGDesiredStructureChains.cpp */; };
1727	A73E1331179624CD00E4DEA8 /* DFGDesiredStructureChains.h in Headers / = {isa = PBXBuildFile; fileRef = A73E132D179624CD00E4DEA8 / DFGDesiredStructureChains.h */; settings = {ATTRIBUTES = (Private, ); }; };
1728	A741017F179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h in Headers / = {isa = PBXBuildFile; fileRef = A741017E179DAF80002EB8BA / DFGSaneStringGetByValSlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };	1728	A741017F179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h in Headers / = {isa = PBXBuildFile; fileRef = A741017E179DAF80002EB8BA / DFGSaneStringGetByValSlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
1729	A7482B9311671147003B0712 /* JSWeakObjectMapRefPrivate.h in Headers / = {isa = PBXBuildFile; fileRef = A7482B791166CDEA003B0712 / JSWeakObjectMapRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };	1729	A7482B9311671147003B0712 /* JSWeakObjectMapRefPrivate.h in Headers / = {isa = PBXBuildFile; fileRef = A7482B791166CDEA003B0712 / JSWeakObjectMapRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
1730	A7482B9411671147003B0712 /* JSWeakObjectMapRefPrivate.cpp in Sources / = {isa = PBXBuildFile; fileRef = A7482B7A1166CDEA003B0712 / JSWeakObjectMapRefPrivate.cpp */; };	1730	A7482B9411671147003B0712 /* JSWeakObjectMapRefPrivate.cpp in Sources / = {isa = PBXBuildFile; fileRef = A7482B7A1166CDEA003B0712 / JSWeakObjectMapRefPrivate.cpp */; };
Lines 2415-2420 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec3
2415	0F3B3A251544C991003ED0FF /* DFGCFGSimplificationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCFGSimplificationPhase.h; path = dfg/DFGCFGSimplificationPhase.h; sourceTree = "<group>"; };	2415	0F3B3A251544C991003ED0FF /* DFGCFGSimplificationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCFGSimplificationPhase.h; path = dfg/DFGCFGSimplificationPhase.h; sourceTree = "<group>"; };
2416	0F3B3A2915474FF4003ED0FF /* DFGValidate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGValidate.cpp; path = dfg/DFGValidate.cpp; sourceTree = "<group>"; };	2416	0F3B3A2915474FF4003ED0FF /* DFGValidate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGValidate.cpp; path = dfg/DFGValidate.cpp; sourceTree = "<group>"; };
2417	0F3B3A2A15474FF4003ED0FF /* DFGValidate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGValidate.h; path = dfg/DFGValidate.h; sourceTree = "<group>"; };	2417	0F3B3A2A15474FF4003ED0FF /* DFGValidate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGValidate.h; path = dfg/DFGValidate.h; sourceTree = "<group>"; };
		2418	0F3D0BBA194A414300FC9CF9 /* ConstantStructureCheck.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConstantStructureCheck.cpp; sourceTree = "<group>"; };
		2419	0F3D0BBB194A414300FC9CF9 /* ConstantStructureCheck.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstantStructureCheck.h; sourceTree = "<group>"; };
2418	0F426A451460CBAB00131F8F /* ValueRecovery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ValueRecovery.h; sourceTree = "<group>"; };	2420	0F426A451460CBAB00131F8F /* ValueRecovery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ValueRecovery.h; sourceTree = "<group>"; };
2419	0F426A461460CBAB00131F8F /* VirtualRegister.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VirtualRegister.h; sourceTree = "<group>"; };	2421	0F426A461460CBAB00131F8F /* VirtualRegister.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VirtualRegister.h; sourceTree = "<group>"; };
2420	0F426A4A1460CD6B00131F8F /* DataFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataFormat.h; sourceTree = "<group>"; };	2422	0F426A4A1460CD6B00131F8F /* DataFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataFormat.h; sourceTree = "<group>"; };
Lines 3366-3373 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec4
3366	A7386553118697B400540279 /* ThunkGenerators.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThunkGenerators.h; sourceTree = "<group>"; };	3368	A7386553118697B400540279 /* ThunkGenerators.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThunkGenerators.h; sourceTree = "<group>"; };
3367	A73A53581799CD5D00170C19 /* DFGLazyJSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLazyJSValue.cpp; path = dfg/DFGLazyJSValue.cpp; sourceTree = "<group>"; };	3369	A73A53581799CD5D00170C19 /* DFGLazyJSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLazyJSValue.cpp; path = dfg/DFGLazyJSValue.cpp; sourceTree = "<group>"; };
3368	A73A53591799CD5D00170C19 /* DFGLazyJSValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLazyJSValue.h; path = dfg/DFGLazyJSValue.h; sourceTree = "<group>"; };	3370	A73A53591799CD5D00170C19 /* DFGLazyJSValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLazyJSValue.h; path = dfg/DFGLazyJSValue.h; sourceTree = "<group>"; };
3369	A73E132C179624CD00E4DEA8 /* DFGDesiredStructureChains.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredStructureChains.cpp; path = dfg/DFGDesiredStructureChains.cpp; sourceTree = "<group>"; };
3370	A73E132D179624CD00E4DEA8 /* DFGDesiredStructureChains.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDesiredStructureChains.h; path = dfg/DFGDesiredStructureChains.h; sourceTree = "<group>"; };
3371	A741017E179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSaneStringGetByValSlowPathGenerator.h; path = dfg/DFGSaneStringGetByValSlowPathGenerator.h; sourceTree = "<group>"; };	3371	A741017E179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSaneStringGetByValSlowPathGenerator.h; path = dfg/DFGSaneStringGetByValSlowPathGenerator.h; sourceTree = "<group>"; };
3372	A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakObjectMapRefPrivate.h; sourceTree = "<group>"; };	3372	A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakObjectMapRefPrivate.h; sourceTree = "<group>"; };
3373	A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakObjectMapRefPrivate.cpp; sourceTree = "<group>"; };	3373	A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakObjectMapRefPrivate.cpp; sourceTree = "<group>"; };
Lines 5038-5045 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec5
5038	0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */,	5038	0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */,
5039	0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */,	5039	0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */,
5040	0F8F2B98172F04FD007DBDA5 /* DFGDesiredIdentifiers.h */,	5040	0F8F2B98172F04FD007DBDA5 /* DFGDesiredIdentifiers.h */,
5041	A73E132C179624CD00E4DEA8 /* DFGDesiredStructureChains.cpp */,
5042	A73E132D179624CD00E4DEA8 /* DFGDesiredStructureChains.h */,
5043	C2C0F7CB17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp */,	5041	C2C0F7CB17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp */,
5044	C2C0F7CC17BBFC5B00464FE4 /* DFGDesiredTransitions.h */,	5042	C2C0F7CC17BBFC5B00464FE4 /* DFGDesiredTransitions.h */,
5045	0FE853491723CDA500B618F5 /* DFGDesiredWatchpoints.cpp */,	5043	0FE853491723CDA500B618F5 /* DFGDesiredWatchpoints.cpp */,
Lines 5352-5357 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec6
5352	0FBD7E671447998F00481315 /* CodeOrigin.h */,	5350	0FBD7E671447998F00481315 /* CodeOrigin.h */,
5353	0F8F943F1667632D00D61971 /* CodeType.cpp */,	5351	0F8F943F1667632D00D61971 /* CodeType.cpp */,
5354	0F0B83A514BCF50400885B4F /* CodeType.h */,	5352	0F0B83A514BCF50400885B4F /* CodeType.h */,
		5353	0F3D0BBA194A414300FC9CF9 /* ConstantStructureCheck.cpp */,
		5354	0F3D0BBB194A414300FC9CF9 /* ConstantStructureCheck.h */,
5355	0F426A4A1460CD6B00131F8F /* DataFormat.h */,	5355	0F426A4A1460CD6B00131F8F /* DataFormat.h */,
5356	0FC712DC17CD8778008CC93C /* DeferredCompilationCallback.cpp */,	5356	0FC712DC17CD8778008CC93C /* DeferredCompilationCallback.cpp */,
5357	0FC712DD17CD8778008CC93C /* DeferredCompilationCallback.h */,	5357	0FC712DD17CD8778008CC93C /* DeferredCompilationCallback.h */,
Lines 6032-6038 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec7
6032	0FFFC95A14EF90A900C72532 /* DFGCSEPhase.h in Headers */,	6032	0FFFC95A14EF90A900C72532 /* DFGCSEPhase.h in Headers */,
6033	0F2FC77316E12F740038D976 /* DFGDCEPhase.h in Headers */,	6033	0F2FC77316E12F740038D976 /* DFGDCEPhase.h in Headers */,
6034	0F8F2B9A172F0501007DBDA5 /* DFGDesiredIdentifiers.h in Headers */,	6034	0F8F2B9A172F0501007DBDA5 /* DFGDesiredIdentifiers.h in Headers */,
6035	A73E1331179624CD00E4DEA8 /* DFGDesiredStructureChains.h in Headers */,
6036	C2C0F7CE17BBFC5B00464FE4 /* DFGDesiredTransitions.h in Headers */,	6035	C2C0F7CE17BBFC5B00464FE4 /* DFGDesiredTransitions.h in Headers */,
6037	0FE8534C1723CDA500B618F5 /* DFGDesiredWatchpoints.h in Headers */,	6036	0FE8534C1723CDA500B618F5 /* DFGDesiredWatchpoints.h in Headers */,
6038	C2981FD917BAEE4B00A3BC98 /* DFGDesiredWeakReferences.h in Headers */,	6037	C2981FD917BAEE4B00A3BC98 /* DFGDesiredWeakReferences.h in Headers */,
Lines 6483-6488 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec8
6483	BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */,	6482	BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */,
6484	90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */,	6483	90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */,
6485	0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */,	6484	0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */,
		6485	0F3D0BBD194A414300FC9CF9 /* ConstantStructureCheck.h in Headers */,
6486	7C008CE7187631B600955C24 /* Microtask.h in Headers */,	6486	7C008CE7187631B600955C24 /* Microtask.h in Headers */,
6487	86C568E211A213EE0007F7F0 /* MIPSAssembler.h in Headers */,	6487	86C568E211A213EE0007F7F0 /* MIPSAssembler.h in Headers */,
6488	86EBF3001560F06A008E9222 /* NameConstructor.h in Headers */,	6488	86EBF3001560F06A008E9222 /* NameConstructor.h in Headers */,
Lines 7618-7624 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec9
7618	0FFFC95914EF90A600C72532 /* DFGCSEPhase.cpp in Sources */,	7618	0FFFC95914EF90A600C72532 /* DFGCSEPhase.cpp in Sources */,
7619	0F2FC77216E12F710038D976 /* DFGDCEPhase.cpp in Sources */,	7619	0F2FC77216E12F710038D976 /* DFGDCEPhase.cpp in Sources */,
7620	0F8F2B99172F04FF007DBDA5 /* DFGDesiredIdentifiers.cpp in Sources */,	7620	0F8F2B99172F04FF007DBDA5 /* DFGDesiredIdentifiers.cpp in Sources */,
7621	A73E1330179624CD00E4DEA8 /* DFGDesiredStructureChains.cpp in Sources */,
7622	C2C0F7CD17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp in Sources */,	7621	C2C0F7CD17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp in Sources */,
7623	0FE8534B1723CDA500B618F5 /* DFGDesiredWatchpoints.cpp in Sources */,	7622	0FE8534B1723CDA500B618F5 /* DFGDesiredWatchpoints.cpp in Sources */,
7624	C2981FD817BAEE4B00A3BC98 /* DFGDesiredWeakReferences.cpp in Sources */,	7623	C2981FD817BAEE4B00A3BC98 /* DFGDesiredWeakReferences.cpp in Sources */,
Lines 7856-7861 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec10
7856	A503FA1B188E0FB000110F14 /* JSJavaScriptCallFrame.cpp in Sources */,	7855	A503FA1B188E0FB000110F14 /* JSJavaScriptCallFrame.cpp in Sources */,
7857	A503FA1D188E0FB000110F14 /* JSJavaScriptCallFramePrototype.cpp in Sources */,	7856	A503FA1D188E0FB000110F14 /* JSJavaScriptCallFramePrototype.cpp in Sources */,
7858	14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */,	7857	14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */,
		7858	0F3D0BBC194A414300FC9CF9 /* ConstantStructureCheck.cpp in Sources */,
7859	C25D709B16DE99F400FCA6BC /* JSManagedValue.mm in Sources */,	7859	C25D709B16DE99F400FCA6BC /* JSManagedValue.mm in Sources */,
7860	A700874117CBE8EB00C3E643 /* JSMap.cpp in Sources */,	7860	A700874117CBE8EB00C3E643 /* JSMap.cpp in Sources */,
7861	A74DEF95182D991400522C22 /* JSMapIterator.cpp in Sources */,	7861	A74DEF95182D991400522C22 /* JSMapIterator.cpp in Sources */,

Line 0 Source/JavaScriptCore/bytecode/ConstantStructureCheck.cpp_sec1
- Source/JavaScriptCore/bytecode/ConstantStructureCheck.cpp +74 lines
		1	/*
		2	* Copyright (C) 2014 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "ConstantStructureCheck.h"
		28
		29	namespace JSC {
		30
		31	void ConstantStructureCheck::dumpInContext(PrintStream& out, DumpContext* context) const
		32	{
		33	out.print(
		34	"(Check if ", inContext(JSValue(m_constant), context), " has structure ",
		35	pointerDumpInContext(m_structure, context), ")");
		36	}
		37
		38	void ConstantStructureCheck::dump(PrintStream& out) const
		39	{
		40	dumpInContext(out, nullptr);
		41	}
		42
		43	Structure* structureFor(const ConstantStructureCheckVector& vector, JSCell* constant)
		44	{
		45	for (unsigned i = vector.size(); i--;) {
		46	if (vector[i].constant() == constant)
		47	return vector[i].structure();
		48	}
		49	return nullptr;
		50	}
		51
		52	bool areCompatible(const ConstantStructureCheckVector& a, const ConstantStructureCheckVector& b)
		53	{
		54	for (unsigned i = a.size(); i--;) {
		55	Structure* otherStructure = structureFor(b, a[i].constant());
		56	if (!otherStructure)
		57	continue;
		58	if (a[i].structure() != otherStructure)
		59	return false;
		60	}
		61	return true;
		62	}
		63
		64	void mergeInto(const ConstantStructureCheckVector& source, ConstantStructureCheckVector& target)
65	{
66	for (unsigned i = source.size(); i--;) {
67	if (structureFor(target, source[i].constant()))
68	continue;
69	target.append(source[i]);
70	}
71	}
72
73	} // namespace JSC
74

Lines 28-36 Source/JavaScriptCore/bytecode/GetByIdVariant.cpp_sec1
- Source/JavaScriptCore/bytecode/GetByIdVariant.cpp -7 / +33 lines
28		28
29	#include "CallLinkStatus.h"	29	#include "CallLinkStatus.h"
30	#include "JSCInlines.h"	30	#include "JSCInlines.h"
		31	#include <wtf/ListDump.h>
31		32
32	namespace JSC {	33	namespace JSC {
33		34
		35	GetByIdVariant::GetByIdVariant(
		36	const StructureSet& structureSet, PropertyOffset offset, JSValue specificValue,
		37	const IntendedStructureChain* chain, std::unique_ptr<CallLinkStatus> callLinkStatus)
		38	: m_structureSet(structureSet)
		39	, m_alternateBase(nullptr)
		40	, m_specificValue(specificValue)
		41	, m_offset(offset)
		42	, m_callLinkStatus(std::move(callLinkStatus))
		43	{
		44	if (!structureSet.size()) {
		45	ASSERT(offset == invalidOffset);
		46	ASSERT(!specificValue);
		47	ASSERT(!chain);
		48	}
		49
		50	if (chain && chain->size()) {
		51	m_alternateBase = chain->terminalPrototype();
		52	chain->gatherChecks(m_constantChecks);
		53	}
		54	}
		55
34	GetByIdVariant::~GetByIdVariant() { }	56	GetByIdVariant::~GetByIdVariant() { }
35		57
36	GetByIdVariant::GetByIdVariant(const GetByIdVariant& other)	58	GetByIdVariant::GetByIdVariant(const GetByIdVariant& other)
Lines 41-47 GetByIdVariant::GetByIdVariant(const Get Source/JavaScriptCore/bytecode/GetByIdVariant.cpp_sec2
41	GetByIdVariant& GetByIdVariant::operator=(const GetByIdVariant& other)	63	GetByIdVariant& GetByIdVariant::operator=(const GetByIdVariant& other)
42	{	64	{
43	m_structureSet = other.m_structureSet;	65	m_structureSet = other.m_structureSet;
44	m_chain = other.m_chain;	66	m_constantChecks = other.m_constantChecks;
		67	m_alternateBase = other.m_alternateBase;
45	m_specificValue = other.m_specificValue;	68	m_specificValue = other.m_specificValue;
46	m_offset = other.m_offset;	69	m_offset = other.m_offset;
47	if (other.m_callLinkStatus)	70	if (other.m_callLinkStatus)
Lines 53-70 GetByIdVariant& GetByIdVariant::operator Source/JavaScriptCore/bytecode/GetByIdVariant.cpp_sec3
53		76
54	bool GetByIdVariant::attemptToMerge(const GetByIdVariant& other)	77	bool GetByIdVariant::attemptToMerge(const GetByIdVariant& other)
55	{	78	{
56	if (!!m_chain != !!other.m_chain)	79	if (m_alternateBase != other.m_alternateBase)
57	return false;
58	if (m_chain && m_chain != other.m_chain)
59	return false;	80	return false;
60	if (m_offset != other.m_offset)	81	if (m_offset != other.m_offset)
61	return false;	82	return false;
62	if (m_callLinkStatus \|\| other.m_callLinkStatus)	83	if (m_callLinkStatus \|\| other.m_callLinkStatus)
63	return false;	84	return false;
		85	if (!areCompatible(m_constantChecks, other.m_constantChecks))
		86	return false;
64		87
65	if (m_specificValue != other.m_specificValue)	88	if (m_specificValue != other.m_specificValue)
66	m_specificValue = JSValue();	89	m_specificValue = JSValue();
67		90
		91	mergeInto(other.m_constantChecks, m_constantChecks);
68	m_structureSet.merge(other.m_structureSet);	92	m_structureSet.merge(other.m_structureSet);
69		93
70	return true;	94	return true;
Lines 84-93 void GetByIdVariant::dumpInContext(Print Source/JavaScriptCore/bytecode/GetByIdVariant.cpp_sec4
84		108
85	out.print(	109	out.print(
86	"<", inContext(structureSet(), context), ", ",	110	"<", inContext(structureSet(), context), ", ",
87	pointerDumpInContext(chain(), context), ", ",	111	"[", listDumpInContext(m_constantChecks, context), "], ",
88	inContext(specificValue(), context), ", ", offset());	112	"alternateBase = ", inContext(JSValue(m_alternateBase), context), ", ",
		113	"specificValue = ", inContext(specificValue(), context), ", ",
		114	"offset = ", offset());
89	if (m_callLinkStatus)	115	if (m_callLinkStatus)
90	out.print("call: ", *m_callLinkStatus);	116	out.print("call = ", *m_callLinkStatus);
91	out.print(">");	117	out.print(">");
92	}	118	}
93		119

Lines 27-32 Source/JavaScriptCore/bytecode/GetByIdVariant.h_sec1
- Source/JavaScriptCore/bytecode/GetByIdVariant.h -16 / +7 lines
27	#define GetByIdVariant_h	27	#define GetByIdVariant_h
28		28
29	#include "CallLinkStatus.h"	29	#include "CallLinkStatus.h"
		30	#include "ConstantStructureCheck.h"
30	#include "IntendedStructureChain.h"	31	#include "IntendedStructureChain.h"
31	#include "JSCJSValue.h"	32	#include "JSCJSValue.h"
32	#include "PropertyOffset.h"	33	#include "PropertyOffset.h"
Lines 43-62 public: Source/JavaScriptCore/bytecode/GetByIdVariant.h_sec2
43	GetByIdVariant(	44	GetByIdVariant(
44	const StructureSet& structureSet = StructureSet(),	45	const StructureSet& structureSet = StructureSet(),
45	PropertyOffset offset = invalidOffset, JSValue specificValue = JSValue(),	46	PropertyOffset offset = invalidOffset, JSValue specificValue = JSValue(),
46	PassRefPtr<IntendedStructureChain> chain = nullptr,	47	const IntendedStructureChain* chain = nullptr,
47	std::unique_ptr<CallLinkStatus> callLinkStatus = nullptr)	48	std::unique_ptr<CallLinkStatus> callLinkStatus = nullptr);
48	: m_structureSet(structureSet)
49	, m_chain(chain)
50	, m_specificValue(specificValue)
51	, m_offset(offset)
52	, m_callLinkStatus(std::move(callLinkStatus))
53	{
54	if (!structureSet.size()) {
55	ASSERT(offset == invalidOffset);
56	ASSERT(!specificValue);
57	ASSERT(!chain);
58	}
59	}
60		49
61	~GetByIdVariant();	50	~GetByIdVariant();
62		51
Lines 66-72 public: Source/JavaScriptCore/bytecode/GetByIdVariant.h_sec3
66	bool isSet() const { return !!m_structureSet.size(); }	55	bool isSet() const { return !!m_structureSet.size(); }
67	bool operator!() const { return !isSet(); }	56	bool operator!() const { return !isSet(); }
68	const StructureSet& structureSet() const { return m_structureSet; }	57	const StructureSet& structureSet() const { return m_structureSet; }
69	IntendedStructureChain* chain() const { return const_cast<IntendedStructureChain*>(m_chain.get()); }	58	const ConstantStructureCheckVector& constantChecks() const { return m_constantChecks; }
		59	JSObject* alternateBase() const { return m_alternateBase; }
70	JSValue specificValue() const { return m_specificValue; }	60	JSValue specificValue() const { return m_specificValue; }
71	PropertyOffset offset() const { return m_offset; }	61	PropertyOffset offset() const { return m_offset; }
72	CallLinkStatus* callLinkStatus() const { return m_callLinkStatus.get(); }	62	CallLinkStatus* callLinkStatus() const { return m_callLinkStatus.get(); }
Lines 80-86 private: Source/JavaScriptCore/bytecode/GetByIdVariant.h_sec4
80	friend class GetByIdStatus;	70	friend class GetByIdStatus;
81		71
82	StructureSet m_structureSet;	72	StructureSet m_structureSet;
83	RefPtr<IntendedStructureChain> m_chain;	73	ConstantStructureCheckVector m_constantChecks;
		74	JSObject* m_alternateBase;
84	JSValue m_specificValue;	75	JSValue m_specificValue;
85	PropertyOffset m_offset;	76	PropertyOffset m_offset;
86	std::unique_ptr<CallLinkStatus> m_callLinkStatus;	77	std::unique_ptr<CallLinkStatus> m_callLinkStatus;

Lines 64-70 public: Source/JavaScriptCore/bytecode/PutByIdVariant.h_sec1
- Source/JavaScriptCore/bytecode/PutByIdVariant.h -4 / +5 lines
64	result.m_kind = Transition;	64	result.m_kind = Transition;
65	result.m_oldStructure = oldStructure;	65	result.m_oldStructure = oldStructure;
66	result.m_newStructure = newStructure;	66	result.m_newStructure = newStructure;
67	result.m_structureChain = structureChain;	67	if (structureChain)
		68	structureChain->gatherChecks(result.m_constantChecks);
68	result.m_offset = offset;	69	result.m_offset = offset;
69	return result;	70	return result;
70	}	71	}
Lines 92-101 public: Source/JavaScriptCore/bytecode/PutByIdVariant.h_sec2
92	return m_newStructure;	93	return m_newStructure;
93	}	94	}
94		95
95	IntendedStructureChain* structureChain() const	96	const ConstantStructureCheckVector& constantChecks() const
96	{	97	{
97	ASSERT(kind() == Transition);	98	ASSERT(kind() == Transition);
98	return m_structureChain.get();	99	return m_constantChecks;
99	}	100	}
100		101
101	PropertyOffset offset() const	102	PropertyOffset offset() const
Lines 111-117 private: Source/JavaScriptCore/bytecode/PutByIdVariant.h_sec3
111	Kind m_kind;	112	Kind m_kind;
112	Structure* m_oldStructure;	113	Structure* m_oldStructure;
113	Structure* m_newStructure;	114	Structure* m_newStructure;
114	RefPtr<IntendedStructureChain> m_structureChain;	115	ConstantStructureCheckVector m_constantChecks;
115	PropertyOffset m_offset;	116	PropertyOffset m_offset;
116	};	117	};
117		118

Lines 1-56 Source/JavaScriptCore/dfg/DFGDesiredStructureChains.cpp_sec1
- Source/JavaScriptCore/dfg/DFGDesiredStructureChains.cpp -56 lines
1	/*
2	* Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
3	*
4	* Redistribution and use in source and binary forms, with or without
5	* modification, are permitted provided that the following conditions
6	* are met:
7	* 1. Redistributions of source code must retain the above copyright
8	* notice, this list of conditions and the following disclaimer.
9	* 2. Redistributions in binary form must reproduce the above copyright
10	* notice, this list of conditions and the following disclaimer in the
11	* documentation and/or other materials provided with the distribution.
12	*
13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24	*/
25
26	#include "config.h"
27	#include "DFGDesiredStructureChains.h"
28
29	#if ENABLE(DFG_JIT)
30
31	#include "JSCInlines.h"
32
33	namespace JSC { namespace DFG {
34
35	DesiredStructureChains::DesiredStructureChains() { }
36	DesiredStructureChains::~DesiredStructureChains() { }
37
38	bool DesiredStructureChains::areStillValid() const
39	{
40	for (unsigned i = 0; i < m_vector.size(); ++i) {
41	if (!m_vector[i]->isStillValid())
42	return false;
43	}
44	return true;
45	}
46
47	void DesiredStructureChains::visitChildren(SlotVisitor& visitor)
48	{
49	for (unsigned i = m_vector.size(); i--;)
50	m_vector[i]->visitChildren(visitor);
51	}
52
53	} } // namespace JSC::DFG
54
55	#endif // ENABLE(DFG_JIT)
56

Lines 400-407 bool Plan::isStillValid() Source/JavaScriptCore/dfg/DFGPlan.cpp_sec1
- Source/JavaScriptCore/dfg/DFGPlan.cpp -4 lines
400	return false;	400	return false;
401	if (!watchpoints.areStillValid())	401	if (!watchpoints.areStillValid())
402	return false;	402	return false;
403	if (!chains.areStillValid())
404	return false;
405	return true;	403	return true;
406	}	404	}
407		405
Lines 471-477 void Plan::checkLivenessAndVisitChildren Source/JavaScriptCore/dfg/DFGPlan.cpp_sec2
471	codeBlocks.mark(codeBlock.get());	469	codeBlocks.mark(codeBlock.get());
472	codeBlocks.mark(profiledDFGCodeBlock.get());	470	codeBlocks.mark(profiledDFGCodeBlock.get());
473		471
474	chains.visitChildren(visitor);
475	weakReferences.visitChildren(visitor);	472	weakReferences.visitChildren(visitor);
476	writeBarriers.visitChildren(visitor);	473	writeBarriers.visitChildren(visitor);
477	transitions.visitChildren(visitor);	474	transitions.visitChildren(visitor);
Lines 500-506 void Plan::cancel() Source/JavaScriptCore/dfg/DFGPlan.cpp_sec3
500	inlineCallFrames = nullptr;	497	inlineCallFrames = nullptr;
501	watchpoints = DesiredWatchpoints();	498	watchpoints = DesiredWatchpoints();
502	identifiers = DesiredIdentifiers();	499	identifiers = DesiredIdentifiers();
503	chains = DesiredStructureChains();
504	weakReferences = DesiredWeakReferences();	500	weakReferences = DesiredWeakReferences();
505	writeBarriers = DesiredWriteBarriers();	501	writeBarriers = DesiredWriteBarriers();
506	transitions = DesiredTransitions();	502	transitions = DesiredTransitions();

Lines 30-36 Source/JavaScriptCore/dfg/DFGPlan.h_sec1
- Source/JavaScriptCore/dfg/DFGPlan.h -2 lines
30	#include "DFGCompilationKey.h"	30	#include "DFGCompilationKey.h"
31	#include "DFGCompilationMode.h"	31	#include "DFGCompilationMode.h"
32	#include "DFGDesiredIdentifiers.h"	32	#include "DFGDesiredIdentifiers.h"
33	#include "DFGDesiredStructureChains.h"
34	#include "DFGDesiredTransitions.h"	33	#include "DFGDesiredTransitions.h"
35	#include "DFGDesiredWatchpoints.h"	34	#include "DFGDesiredWatchpoints.h"
36	#include "DFGDesiredWeakReferences.h"	35	#include "DFGDesiredWeakReferences.h"
Lines 92-98 struct Plan : public ThreadSafeRefCounte Source/JavaScriptCore/dfg/DFGPlan.h_sec2
92	RefPtr<InlineCallFrameSet> inlineCallFrames;	91	RefPtr<InlineCallFrameSet> inlineCallFrames;
93	DesiredWatchpoints watchpoints;	92	DesiredWatchpoints watchpoints;
94	DesiredIdentifiers identifiers;	93	DesiredIdentifiers identifiers;
95	DesiredStructureChains chains;
96	DesiredWeakReferences weakReferences;	94	DesiredWeakReferences weakReferences;
97	DesiredWriteBarriers writeBarriers;	95	DesiredWriteBarriers writeBarriers;
98	DesiredTransitions transitions;	96	DesiredTransitions transitions;

Lines 145-150 bool IntendedStructureChain::operator==( Source/JavaScriptCore/runtime/IntendedStructureChain.cpp_sec1
- Source/JavaScriptCore/runtime/IntendedStructureChain.cpp +11 lines
145	&& m_vector == other.m_vector;	145	&& m_vector == other.m_vector;
146	}	146	}
147		147
		148	void IntendedStructureChain::gatherChecks(ConstantStructureCheckVector& vector) const
		149	{
		150	JSValue currentPrototype = m_prototype;
		151	for (unsigned i = 0; i < size(); ++i) {
		152	JSObject* currentObject = asObject(currentPrototype);
		153	Structure* currentStructure = at(i);
		154	vector.append(ConstantStructureCheck(currentObject, currentStructure));
		155	currentPrototype = currentStructure->prototypeForLookup(m_globalObject);
		156	}
		157	}
		158
148	void IntendedStructureChain::visitChildren(SlotVisitor& visitor)	159	void IntendedStructureChain::visitChildren(SlotVisitor& visitor)
149	{	160	{
150	visitor.appendUnbarrieredPointer(&m_globalObject);	161	visitor.appendUnbarrieredPointer(&m_globalObject);

Lines 119-130 CString sortedMapDump(const T& map, cons Source/WTF/wtf/ListDump.h_sec1
- Source/WTF/wtf/ListDump.h +30 lines
119	return out.toCString();	119	return out.toCString();
120	}	120	}
121		121
		122	template<typename T, typename U>
		123	class ListDumpInContext {
		124	public:
		125	ListDumpInContext(const T& list, U* context, const char* comma)
		126	: m_list(list)
		127	, m_context(context)
		128	, m_comma(comma)
		129	{
		130	}
		131
		132	void dump(PrintStream& out) const
		133	{
		134	for (typename T::const_iterator iter = m_list.begin(); iter != m_list.end(); ++iter)
		135	out.print(m_comma, inContext(*iter, m_context));
		136	}
		137
		138	private:
		139	const T& m_list;
		140	U* m_context;
		141	CommaPrinter m_comma;
		142	};
		143
		144	template<typename T, typename U>
		145	ListDumpInContext<T, U> listDumpInContext(
		146	const T& list, U* context, const char* comma = ", ")
		147	{
		148	return ListDumpInContext<T, U>(list, context, comma);
		149	}
		150
122	} // namespace WTF	151	} // namespace WTF
123		152
124	using WTF::listDump;	153	using WTF::listDump;
125	using WTF::sortedListDump;	154	using WTF::sortedListDump;
126	using WTF::mapDump;	155	using WTF::mapDump;
127	using WTF::sortedMapDump;	156	using WTF::sortedMapDump;
		157	using WTF::listDumpInContext;
128		158
129	#endif // ListDump_h	159	#endif // ListDump_h
130		160

Lines 1-3 LayoutTests/ChangeLog_sec1
- LayoutTests/ChangeLog +14 lines
		1	2014-06-12 Filip Pizlo <fpizlo@apple.com>
		2
		3	[ftlopt] A DFG inlined ById access variant should not speak of a chain, but only of what structures to test the base for, whether to use a constant as an alternate base for the actual access, and what structures to check on what additional cell constants
		4	https://bugs.webkit.org/show_bug.cgi?id=133821
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* js/regress/poly-chain-access-different-prototypes-expected.txt: Added.
		9	* js/regress/poly-chain-access-different-prototypes-simple-expected.txt: Added.
		10	* js/regress/poly-chain-access-different-prototypes-simple.html: Added.
		11	* js/regress/poly-chain-access-different-prototypes.html: Added.
		12	* js/regress/script-tests/poly-chain-access-different-prototypes-simple.js: Added.
		13	* js/regress/script-tests/poly-chain-access-different-prototypes.js: Added.
		14
1	2014-06-11 Filip Pizlo <fpizlo@apple.com>	15	2014-06-11 Filip Pizlo <fpizlo@apple.com>
2		16
3	[ftlopt] DFG get_by_id should inline chain accesses with a slightly polymorphic base	17	[ftlopt] DFG get_by_id should inline chain accesses with a slightly polymorphic base

Line 0 LayoutTests/js/regress/poly-chain-access-different-prototypes-expected.txt_sec1
- LayoutTests/js/regress/poly-chain-access-different-prototypes-expected.txt +10 lines
	1	JSRegress/poly-chain-access-different-prototypes
	2
	3	On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
	4
	5
	6	PASS no exception thrown
	7	PASS successfullyParsed is true
	8
	9	TEST COMPLETE
	10

Line 0 LayoutTests/js/regress/poly-chain-access-different-prototypes-simple.html_sec1
- LayoutTests/js/regress/poly-chain-access-different-prototypes-simple.html +12 lines
	1	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
	2	<html>
	3	<head>
	4	<script src="../../resources/js-test-pre.js"></script>
	5	</head>
	6	<body>
	7	<script src="../../resources/regress-pre.js"></script>
	8	<script src="script-tests/poly-chain-access-different-prototypes-simple.js"></script>
	9	<script src="../../resources/regress-post.js"></script>
	10	<script src="../../resources/js-test-post.js"></script>
	11	</body>
	12	</html>

Line 0 LayoutTests/js/regress/script-tests/poly-chain-access-different-prototypes-simple.js_sec1
- LayoutTests/js/regress/script-tests/poly-chain-access-different-prototypes-simple.js +24 lines
	1	(function() {
	2	function Foo() { }
	3	Foo.prototype.f = 42;
	4	function Bar() { }
	5	Bar.prototype = new Foo();
	6	function Baz() { }
	7	Baz.prototype = new Foo();
	8
	9	function foo(o, p) {
	10	var n = 1000000;
	11	var result = 0;
	12	for (var i = 0; i < n; ++i) {
	13	result += o.f;
	14	var tmp = o;
	15	o = p;
	16	p = tmp;
	17	}
	18
	19	if (result != n * 42)
	20	throw "Error: bad result: " + result;
	21	}
	22
	23	foo(new Bar(), new Baz());
	24	})();