Attachment #238415 for bug #136330

View Details Raw Unified Return to Bug 136330

| Differences between

and this patch



#include "DFGBranchDirection.h"
#include "DFGGraph.h"
#include "DFGNode.h"
#include "DFGPhiChildren.h"

namespace JSC { namespace DFG {


    CodeBlock* m_codeBlock;
    Graph& m_graph;
    AbstractStateType& m_state;
    std::unique_ptr<PhiChildren> m_phiChildren;
};

} } // namespace JSC::DFG

Lines 43-48 AbstractInterpreter<AbstractStateType>:: Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec1
- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h +2 lines
43	, m_graph(graph)	43	, m_graph(graph)
44	, m_state(state)	44	, m_state(state)
45	{	45	{
		46	if (m_graph.m_form == SSA)
		47	m_phiChildren = std::make_unique<PhiChildren>(m_graph);
46	}	48	}
47		49
48	template<typename AbstractStateType>	50	template<typename AbstractStateType>



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGAvailabilityMap.h"

#if ENABLE(DFG_JIT)

#include <wtf/ListDump.h>

namespace JSC { namespace DFG {

void AvailabilityMap::prune()
{
    HashSet<Node*> possibleNodes;
    
    for (unsigned i = m_locals.size(); i--;) {
        if (m_locals[i].hasNode())
            possibleNodes.add(m_locals[i].node());
    }

    unsigned oldPossibleNodesSize;
    do {
        oldPossibleNodesSize = possibleNodes.size();
        for (auto pair : m_heap) {
            if (pair.value.hasNode() && possibleNodes.contains(pair.key.base()))
                possibleNodes.add(pair.value.node());
        }
    } while (oldPossibleNodesSize != possibleNodes.size());
    
    HashMap<PromotedHeapLocation, Availability> newHeap;
    for (auto pair : m_heap) {
        if (possibleNodes.contains(pair.key.base()))
            newHeap.add(pair.key, pair.value);
    }
    m_heap = newHeap;
}

void AvailabilityMap::dump(PrintStream& out) const
{
    out.print("{locals = ", m_locals, "; heap = ", mapDump(m_heap), "}");
}

bool AvailabilityMap::operator==(const AvailabilityMap& other) const
{
    return m_locals == other.m_locals
        && m_heap == other.m_heap;
}

void AvailabilityMap::merge(const AvailabilityMap& other)
{
    for (unsigned i = other.m_locals.size(); i--;)
        locals[i] = other.m_locals[i].merge(locals[i]);
    
    for (auto pair : other.m_heap) {
        auto result = m_heap.add(pair.key, Availability());
        result.iterator->value = pair.value.merge(result.iterator->value);
    }
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGAvailabilityMap_h
#define DFGAvailabilityMap_h

#if ENABLE(DFG_JIT)

#include "DFGAvailability.h"

namespace JSC { namespace DFG {

struct AvailabilityMap {
    void prune();
    
    void dump(PrintStream& out) const;
    
    bool operator==(const AvailabilityMap& other) const;
    
    void merge(const AvailabilityMap& other);
    
    Operands<Availability> m_locals;
    HashMap<PromotedHeapLocation, Availability> m_heap;
};

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGAvailabilityMap_h




}

BasicBlock::SSAData::SSAData(BasicBlock* block)
    : availabilityAtHead(OperandsLike, block->variablesAtHead)
    , availabilityAtTail(OperandsLike, block->variablesAtHead)
{
    m_availabilityAtHead.m_locals = Operands<Availability>(OperandsLike, block->variablesAtHead);
    m_availabilityAtTail.m_locals = Operands<Availability>(OperandsLike, block->variablesAtHead);
}

BasicBlock::SSAData::~SSAData() { }

Lines 46-51 class Graph; Source/JavaScriptCore/dfg/DFGBasicBlock.h_sec1
- Source/JavaScriptCore/dfg/DFGBasicBlock.h -3 / +78 lines
46	class InsertionSet;	46	class InsertionSet;
47		47
48	typedef Vector<BasicBlock*, 2> PredecessorList;	48	typedef Vector<BasicBlock*, 2> PredecessorList;
		49	typedef Vector<Node*, 8> BlockNodeList;
49		50
50	struct BasicBlock : RefCounted<BasicBlock> {	51	struct BasicBlock : RefCounted<BasicBlock> {
51	BasicBlock(	52	BasicBlock(
Lines 85-90 struct BasicBlock : RefCounted<BasicBloc Source/JavaScriptCore/dfg/DFGBasicBlock.h_sec2
85	bool isInPhis(Node* node) const;	86	bool isInPhis(Node* node) const;
86	bool isInBlock(Node* myNode) const;	87	bool isInBlock(Node* myNode) const;
87		88
		89	BlockNodeList::iterator begin() { return m_nodes.begin(); }
		90	BlockNodeList::iterator end() { return m_nodes.end(); }
		91
88	unsigned numSuccessors() { return last()->numSuccessors(); }	92	unsigned numSuccessors() { return last()->numSuccessors(); }
89		93
90	BasicBlock*& successor(unsigned index)	94	BasicBlock*& successor(unsigned index)
Lines 96-101 struct BasicBlock : RefCounted<BasicBloc Source/JavaScriptCore/dfg/DFGBasicBlock.h_sec3
96	return last()->successorForCondition(condition);	100	return last()->successorForCondition(condition);
97	}	101	}
98		102
		103	class SuccessorsIterable {
		104	public:
		105	SuccessorsIterable()
		106	: m_block(nullptr)
		107	{
		108	}
		109
		110	SuccessorsIterable(BasicBlock* block)
		111	: m_block(block)
		112	{
		113	}
		114
		115	class iterator {
		116	public:
		117	iterator()
		118	: m_block(nullptr)
		119	, m_index(UINT_MAX)
		120	{
		121	}
		122
		123	iterator(BasicBlock* block, unsigned index)
		124	: m_block(block)
		125	, m_index(index)
		126	{
		127	}
		128
		129	BasicBlock* operator*()
		130	{
		131	return m_block->successor(index);
		132	}
		133
		134	iterator& operator++()
		135	{
		136	m_index++;
		137	return *this;
		138	}
		139
		140	bool operator==(const iterator& other) const
		141	{
		142	return m_index == other.m_index;
		143	}
		144
		145	bool operator!=(const iterator& other) const
		146	{
		147	return !(*this == other);
		148	}
		149	private:
		150	BasicBlock* m_block;
		151	unsigned m_index;
		152	};
		153
		154	iterator begin()
		155	{
		156	return iterator(m_block, 0);
		157	}
		158
		159	iterator end()
		160	{
		161	return iterator(m_block, m_block->numSuccessors());
		162	}
		163
		164	private:
		165	BasicBlock* m_block;
		166	};
167
168	SuccessorsIterable successors()
169	{
170	return SuccessorsIterable(this);
171	}
172
99	void removePredecessor(BasicBlock* block);	173	void removePredecessor(BasicBlock* block);
100	void replacePredecessor(BasicBlock* from, BasicBlock* to);	174	void replacePredecessor(BasicBlock* from, BasicBlock* to);
101		175
Lines 169-176 struct BasicBlock : RefCounted<BasicBloc Source/JavaScriptCore/dfg/DFGBasicBlock.h_sec4
169	unsigned innerMostLoopIndices[numberOfInnerMostLoopIndices];	243	unsigned innerMostLoopIndices[numberOfInnerMostLoopIndices];
170		244
171	struct SSAData {	245	struct SSAData {
172	Operands<Availability> availabilityAtHead;	246	AvailabilityMap availabilityAtHead;
173	Operands<Availability> availabilityAtTail;	247	AvailabilityMap availabilityAtTail;
		248
174	HashSet<Node*> liveAtHead;	249	HashSet<Node*> liveAtHead;
175	HashSet<Node*> liveAtTail;	250	HashSet<Node*> liveAtTail;
176	HashMap<Node*, AbstractValue> valuesAtHead;	251	HashMap<Node*, AbstractValue> valuesAtHead;
Lines 183-189 struct BasicBlock : RefCounted<BasicBloc Source/JavaScriptCore/dfg/DFGBasicBlock.h_sec5
183		258
184	private:	259	private:
185	friend class InsertionSet;	260	friend class InsertionSet;
186	Vector<Node*, 8> m_nodes;	261	BlockNodeList m_nodes;
187	};	262	};
188		263
189	typedef Vector<BasicBlock*, 5> BlockList;	264	typedef Vector<BasicBlock*, 5> BlockList;



    BlockList blocksInPreOrder();
    BlockList blocksInPostOrder();
    
    class NaturalBlockIterable {
    public:
        NaturalBlockIterable()
            : m_graph(nullptr)
        {
        }
        
        NaturalBlockIterable(Graph& graph)
            : m_graph(&graph)
        {
        }
        
        class iterator {
        public:
            iterator()
                : m_graph(nullptr)
                , m_index(0)
            {
            }
            
            iterator(Graph& graph, BlockIndex index)
                : m_graph(&graph)
                , m_index(findNext(index))
            {
            }
            
            BasicBlock *operator*()
            {
                return m_graph->block(index);
            }
            
            iterator& operator++()
            {
                m_index = findNext(m_index);
                return *this;
            }
            
            bool operator==(const iterator& other) const
            {
                return m_index == other.m_index;
            }
            
            bool operator!=(const iterator& other) const
            {
                return !(*this == other);
            }
            
        private:
            BlockIndex findNext(BlockIndex index)
            {
                while (index < m_graph->numBlocks() && !m_graph->block(index))
                    index++;
                return index;
            }
            
            Graph* m_graph;
            BlockIndex m_index;
        };
        
        iterator begin()
        {
            return iterator(*m_graph, 0);
        }
        
        iterator end()
        {
            return iterator(*m_graph, m_graph->numBlocks());
        }
        
    private:
        Graph* m_graph;
    };
    
    NaturalBlockIterable blocksInNaturalOrder()
    {
        return NaturalBlockIterable(*this);
    }
    
    template<typename ChildFunctor>
    void doToChildrenWithNode(Node* node, const ChildFunctor& functor)
    {
        DFG_NODE_DO_TO_CHILDREN(node, functor);
    }
    
    template<typename ChildFunctor>
    void doToChildEdges(Node* node, const ChildFunctor& functor)
    {
        doToChildrenWithNode(
            node,
            [&functor] (Node*, Edge& edge) {
                functor(edge);
            });
    }
    
    template<typename ChildFunctor>
    void doToChildren(Node* node, const ChildFunctor& functor)
    {
        doToChildrenWithNode(
            node,
            [&functor] (Node*, Edge edge) {
                functor(edge);
            });
    }
    
    Profiler::Compilation* compilation() { return m_plan.compilation.get(); }
    
    DesiredIdentifiers& identifiers() { return m_plan.identifiers; }

    Bag<SwitchData> m_switchData;
    Bag<MultiGetByOffsetData> m_multiGetByOffsetData;
    Bag<MultiPutByOffsetData> m_multiPutByOffsetData;
    Bag<ObjectMaterializationData> m_objectMaterializationData;
    Vector<InlineVariableData, 4> m_inlineVariableData;
    HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
    bool m_hasArguments;

Lines 147-152 void printInternal(PrintStream& out, Loc Source/JavaScriptCore/dfg/DFGHeapLocation.cpp_sec1
- Source/JavaScriptCore/dfg/DFGHeapLocation.cpp +4 lines
147	case AllocationProfileWatchpointLoc:	147	case AllocationProfileWatchpointLoc:
148	out.print("AllocationProfileWatchpointLoc");	148	out.print("AllocationProfileWatchpointLoc");
149	return;	149	return;
		150
		151	case StructureLoc:
		152	out.print("StructureLoc");
		153	return;
150	}	154	}
151		155
152	RELEASE_ASSERT_NOT_REACHED();	156	RELEASE_ASSERT_NOT_REACHED();

Lines 55-60 enum LocationKind { Source/JavaScriptCore/dfg/DFGHeapLocation.h_sec1
- Source/JavaScriptCore/dfg/DFGHeapLocation.h +1 lines
55	MyArgumentsLengthLoc,	55	MyArgumentsLengthLoc,
56	NamedPropertyLoc,	56	NamedPropertyLoc,
57	SetterLoc,	57	SetterLoc,
		58	StructureLoc,
58	TypeOfLoc,	59	TypeOfLoc,
59	TypedArrayByteOffsetLoc,	60	TypedArrayByteOffsetLoc,
60	VarInjectionWatchpointLoc,	61	VarInjectionWatchpointLoc,



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGInsertOSRHintsForUpdate.h"

#if ENABLE(DFG_JIT)

namespace JSC { namespace DFG {

void insertOSRHintsForUpdate(
    InsertionSet& insertionSet, unsigned nodeIndex, AvailabilityMap& availability,
    Node* originalNode, Node* newNode)
{
    for (unsigned i = availability.m_locals.size(); i--;) {
        int operand = availability.m_ocals.operandForIndex(i);
        
        if (availability.m_locals[i].hasNode() && availability.m_locals[i].node() == originalNode) {
            insertionSet.insertNode(
                nodeIndex, SpecNone, MovHint, NodeOrigin(), OpInfo(operand),
                newNode->defaultEdge());
        }
    }
    
    for (auto pair : availability.m_heap) {
        if (pair.value.hasNode() && pair.value.node() == originalNode) {
            insertionSet.insertNode(
                nodeIndex, pair.key.createHint(insertionSet.graph(), NodeOrigin(), newNode));
        }
    }
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGInsertOSRHintsForUpdate_h
#define DFGInsertOSRHintsForUpdate_h

#if ENABLE(DFG_JIT)

#include "DFGInsertionSet.h"
#include "DFGAvailabilityMap.h"

namespace JSC { namespace DFG {

void insertOSRHintsForUpdate(
    InsertionSet&, unsigned nodeIndex, AvailabilityMap&,
    Node* originalNode, Node* newNode);

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGInsertOSRHintsForUpdate_h


Lines 43-48 public: Source/JavaScriptCore/dfg/DFGInsertionSet.h_sec1
- Source/JavaScriptCore/dfg/DFGInsertionSet.h +2 lines
43	{	43	{
44	}	44	}
45		45
		46	Graph& graph() { return m_graph; }
		47
46	Node* insert(const Insertion& insertion)	48	Node* insert(const Insertion& insertion)
47	{	49	{
48	ASSERT(!m_insertions.size() \|\| m_insertions.last().index() <= insertion.index());	50	ASSERT(!m_insertions.size() \|\| m_insertions.last().index() <= insertion.index());



#include "DFGNodeFlags.h"
#include "DFGNodeOrigin.h"
#include "DFGNodeType.h"
#include "DFGObjectMaterializationData.h"
#include "DFGTransition.h"
#include "DFGUseKind.h"
#include "DFGVariableAccessData.h"

        m_flags &= ~NodeClobbersWorld;
    }
    
    void convertToPutByOffsetHint()
    {
        ASSERT(m_op == PutByOffset);
        m_op = PutByOffsetHint;
        m_opInfo = storageAccessData().identifierNumber;
        child1() = child2();
        child2() = child3();
        child3() = Edge();
    }
    
    void convertToPutStructureHint(Node* structure)
    {
        ASSERT(m_op == PutStructure);
        ASSERT(structure->structure() == transition()->next);
        m_op = PhantomPutStructure;
        m_opInfo = 0;
        child2() = Edge(structure, KnownCellUse);
    }
    
    void convertToPhantomNewObject()
    {
        ASSERT(m_op == NewObject || m_op == MaterializeNewObject);
        m_op = PhantomNewObject;
        m_flags &= ~NodeHasVarArgs;
        m_opInfo = 0;
        m_opInfo2 = 0;
        children = AdjacencyList();
    }
    
    void convertToPhantomLocal()
    {
        ASSERT(m_op == Phantom && (child1()->op() == Phi || child1()->op() == SetLocal || child1()->op() == SetArgument));

        case PutById:
        case PutByIdFlush:
        case PutByIdDirect:
        case PutByOffsetHint:
            return true;
        default:
            return false;

    {
        switch (op()) {
        case PutStructure:
        case PutStructureHint:
        case AllocatePropertyStorage:
        case ReallocatePropertyStorage:
            return true;

        case ArrayifyToStructure:
        case NewObject:
        case NewStringObject:
        case PhantomStructure:
            return true;
        default:
            return false;

    
    bool hasStorageAccessData()
    {
        switch (op()) {
        case GetByOffset:
        case PutByOffset:
        case GetGetterSetterByOffset:
            return true;
        default:
            return false;
        }
    }
    
    StorageAccessData& storageAccessData()

        return *reinterpret_cast<MultiPutByOffsetData*>(m_opInfo);
    }
    
    bool hasObjectMaterializationData()
    {
        return op() == MaterializeNewObject;
    }
    
    ObjectMaterializationData& objectMaterializationData()
    {
        return *reinterpret_cast<ObjectMaterializationData*>(m_opInfo);
    }
    
    bool hasFunctionDeclIndex()
    {
        return op() == NewFunction

Lines 228-233 namespace JSC { namespace DFG { Source/JavaScriptCore/dfg/DFGNodeType.h_sec1
- Source/JavaScriptCore/dfg/DFGNodeType.h +8 lines
228	macro(NewTypedArray, NodeResultJS \| NodeClobbersWorld \| NodeMustGenerate) \	228	macro(NewTypedArray, NodeResultJS \| NodeClobbersWorld \| NodeMustGenerate) \
229	macro(NewRegexp, NodeResultJS) \	229	macro(NewRegexp, NodeResultJS) \
230	\	230	\
		231	/* Support for allocation sinking. */\
		232	macro(PhantomNewObject, NodeResultJS) \
		233	macro(PhantomStructure, NodeResultJS) \
		234	macro(PutByOffsetHint, NodeMustGenerate) \
		235	macro(CheckStructureImmediate, NodeMustGenerate) \
		236	macro(PutStructureHint, NodeMustGenerate) \
		237	macro(MaterializeNewObject, NodeResultJS \| NodeHasVarArgs) \
		238	\
231	/* Nodes for misc operations. */\	239	/* Nodes for misc operations. */\
232	macro(Breakpoint, NodeMustGenerate) \	240	macro(Breakpoint, NodeMustGenerate) \
233	macro(ProfileWillCall, NodeMustGenerate) \	241	macro(ProfileWillCall, NodeMustGenerate) \

Lines 87-92 public: Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp_sec1
- Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp -10 / +20 lines
87	for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex)	87	for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex)
88	calculator.executeNode(block->at(nodeIndex));	88	calculator.executeNode(block->at(nodeIndex));
89		89
		90	calculator.m_availability.prune();
		91
90	if (calculator.m_availability == block->ssa->availabilityAtTail)	92	if (calculator.m_availability == block->ssa->availabilityAtTail)
91	continue;	93	continue;
92		94
Lines 95-105 public: Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp_sec2
95		97
96	for (unsigned successorIndex = block->numSuccessors(); successorIndex--;) {	98	for (unsigned successorIndex = block->numSuccessors(); successorIndex--;) {
97	BasicBlock* successor = block->successor(successorIndex);	99	BasicBlock* successor = block->successor(successorIndex);
98	for (unsigned i = calculator.m_availability.size(); i--;) {	100	successor->ssa->availabilityAtHead.merge(calculator.m_availability);
99	successor->ssa->availabilityAtHead[i] =
100	calculator.m_availability[i].merge(
101	successor->ssa->availabilityAtHead[i]);
102	}
103	}	101	}
104	}	102	}
105	} while (changed);	103	} while (changed);
Lines 127-164 void LocalOSRAvailabilityCalculator::beg Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp_sec3
127	m_availability = block->ssa->availabilityAtHead;	125	m_availability = block->ssa->availabilityAtHead;
128	}	126	}
129		127
		128	void LocalOSRAvailabilityCalculator::endBlock(BasicBlock* block)
		129	{
		130	m_availability = block->ssa->availabilityAtTail;
		131	}
		132
130	void LocalOSRAvailabilityCalculator::executeNode(Node* node)	133	void LocalOSRAvailabilityCalculator::executeNode(Node* node)
131	{	134	{
132	switch (node->op()) {	135	switch (node->op()) {
133	case SetLocal: {	136	case SetLocal: {
134	VariableAccessData* variable = node->variableAccessData();	137	VariableAccessData* variable = node->variableAccessData();
135	m_availability.operand(variable->local()) =	138	m_availability.m_locals.operand(variable->local()) =
136	Availability(node->child1().node(), variable->flushedAt());	139	Availability(node->child1().node(), variable->flushedAt());
137	break;	140	break;
138	}	141	}
139		142
140	case GetArgument: {	143	case GetArgument: {
141	VariableAccessData* variable = node->variableAccessData();	144	VariableAccessData* variable = node->variableAccessData();
142	m_availability.operand(variable->local()) =	145	m_availability.m_locals.operand(variable->local()) =
143	Availability(node, variable->flushedAt());	146	Availability(node, variable->flushedAt());
144	break;	147	break;
145	}	148	}
146		149
147	case MovHint: {	150	case MovHint: {
148	m_availability.operand(node->unlinkedLocal()) =	151	m_availability.m_locals.operand(node->unlinkedLocal()) =
149	Availability(node->child1().node());	152	Availability(node->child1().node());
150	break;	153	break;
151	}	154	}
152		155
153	case ZombieHint: {	156	case ZombieHint: {
154	m_availability.operand(node->unlinkedLocal()) =	157	m_availability.m_locals.operand(node->unlinkedLocal()) =
155	Availability::unavailable();	158	Availability::unavailable();
156	break;	159	break;
157	}	160	}
158		161
159	default:	162	default:
160	break;	163	break;
161	}	164	}
		165
		166	promote(
		167	node,
		168	[&] (PromotedHeapLocation location, Edge value) {
		169	m_availability.m_heap.set(location, Availability(value.node()));
		170	},
		171	[&] (PromotedHeapLocation) { });
162	}	172	}
163		173
164	} } // namespace JSC::DFG	174	} } // namespace JSC::DFG



    ~LocalOSRAvailabilityCalculator();
    
    void beginBlock(BasicBlock*);
    void endBlock(BasicBlock*); // Useful if you want to get data for the end of the block. You don't need to call this if you did beginBlock() and then executeNode() for every node.
    void executeNode(Node*);
    
    AvailabilityMap m_availability;
};

} } // namespace JSC::DFG



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGObjectAllocationSinkingPhase.h"

#if ENABLE(DFG_JIT)

#include "DFGAbstractHeap.h"
#include "DFGClobberize.h"
#include "DFGGraph.h"
#include "DFGInsertionSet.h"
#include "DFGPhase.h"
#include "JSCInlines.h"

namespace JSC { namespace DFG {

class ObjectAllocationSinkingPhase : public Phase {
public:
    ObjectAllocationSinkingPhase(Graph& graph)
        : Phase(graph, "object allocation sinking")
        , m_ssaCalculator(graph)
        , m_insertionSet(graph)
    {
    }
    
    bool run()
    {
        ASSERT(m_graph.m_fixpointState == FixpointNotConverged);
        
        m_changed = false;
        
        // Logically we wish to consider every NewObject and sink it. However it's definitely not
        // profitable to sink a NewObject that will always escape. So, first we do a very simple
        // forward flow analysis that determines the set of NewObject nodes that have any chance
        // of benefiting from object allocation sinking. Then we fixpoint the following rules:
        //
        // - For each NewObject, we turn the original NewObject into a PhantomNewObject and then
        //   we insert MaterializeNewObject just before each escaping site. Note that Upsilons
        //   constitute escaping sites. Then we use forward flow to eliminate unnecessary cases of
        //   MaterializeNewObject. We use the SSACalculator to insert these materializations. If a
        //   Phi is ever created that has the PhantomNewObject as one of its kids, then we insert
        //   a MaterializeNewObject in front of it; this way we never have a Phi that is confused
        //   about whether or not it has the real object. We then turn each PutByOffset over a
        //   PhantomNewObject into a PutByOffsetHint.
        //
        // - We perform the same optimization for MaterializeNewObject. This allows us to cover
        //   cases where we had MaterializeNewObject flowing into a PutByOffsetHint.
        //
        // We could also add this rule:
        //
        // - If all of the Upsilons of a Phi have a MaterializeNewObject that isn't used by anyone
        //   else, then replace the Phi with the MaterializeNewObject.
        //
        //   FIXME: Implement this. Note that this totally doable but it requires some gnarly
        //   code, and to be effective the pruner needs to be aware of it. Currently any Upsilon
        //   is considered to be an escape even by the pruner, so it's unlikely that we'll see
        //   many cases of Phi over Materializations.
        //   https://bugs.webkit.org/show_bug.cgi?id=136927
        
        if (!performSinking())
            return false;
        
        while (performSinking()) { }
        
        return true;
    }

private:
    bool performSinking()
    {
        m_graph.computeRefCounts();
        performLivenessAnalysis();
        performOSRAvailabilityAnalysis();
        
        // We want to only do sinking for those things that would benefit. We use a rough
        // heuristic: if it's possible for an allocation to make it to a return without escaping,
        // then we assume that it's worth sinking. It's a simple forward flow problem.
        //
        // It just so happens that this forward flow problem also tells us where we would
        // materialize those nodes that we choose to sink.
        pruneSinkingCandidates();
        if (m_sinkCandidates.isEmpty())
            return false;
        
        // At this point we are committed to sinking the sinking candidates.
        determineMaterializationPoints();
        placeMaterializationPoints();
        lowerNonReadingOperationsOnPhantomAllocations();
        promoteSunkenFields();
        
        return true;
    }
    
    void pruneSinkingCandidates()
    {
        m_sinkCandidates.clear();
        BlockMap<HashSet<Node*>> sinkCandidatesAtHead(m_graph);
        BlockMap<HashSet<Node*>> sinkCandidatesAtTail(m_graph);
        
        bool changed;
        do {
            changed = false;
            for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
                HashSet<Node*> sinkCandidates = sinkCandidatesAtHead[block];
                for (Node* node : *block) {
                    handleNode(
                        node,
                        [&] () {
                            sinkCandidates.add(node);
                        },
                        [&] (Node* escapee) {
                            sinkCandidates.remove(escapee);
                        });
                }
                if (sinkCandidatesAtTail[block] == sinkCandidates)
                    continue;
                
                sinkCandidatesAtTail[block] = sinkCandidates;
                changed = true;
                
                for (BasicBlock* successorBlock : block->successors()) {
                    for (Node* sinkCandidate : sinkCandidates) {
                        if (!successorBlock->ssa->liveAtHead.contains(sinkCandidate))
                            continue;
                        sinkCandidatesAtHead[successorBlock].add(sinkCandidate);
                    }
                }
            }
        } while (changed);
        
        // A node is a sink candidate if it is in the sinkCandidatesAtTail of a block but not in
        // the liveAtTail of that same block.
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            for (Node* sinkCandidate : sinkCandidatesAtTail[block]) {
                if (!block->ssa->liveAtTail.contains(sinkCandidate))
                    m_sinkCandidates.add(sinkCandidate);
            }
        }
    }
    
    void determineMaterializationPoints()
    {
        // The premise of this pass is that if there exists a point in the program where some
        // path from a phantom allocation site to that point causes materialization, then *all*
        // paths cause materialization. This should mean that there are never any redundant
        // materializations.
        
        m_edgeToMaterializationPoint.clear();
        
        BlockMap<HashSet<Node*>> materializedAtHead;
        BlockMap<HashSet<Node*>> materializedAtTail;
        
        bool changed;
        do {
            changed = false;
            for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
                HashSet<Node*> materialized = materializedAtHead[block];
                for (Node* node : *block) {
                    handleNode(
                        node,
                        doNothing,
                        [&] (Node* escapee) {
                            if (m_sinkCandidates.contains(escapee))
                                materialized.add(escapee);
                        });
                }
                
                if (materialized == materializedAtTail[block])
                    continue;
                
                changed = true;
                
                for (BasicBlock* successorBlock : block->successors()) {
                    for (Node* materializee : materialized) {
                        if (!successorBlock->ssa->liveAtHead.contains(materializee))
                            continue;
                        materializedAtHead[successorBlock].add(materializee);
                    }
                }
            }
        } while (changed);
        
        // A materialization edge exists at any point where a node escapes but hasn't been
        // materialized yet.
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            HashSet<Node*> materialized = materializedAtHead[block];
            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
                Node* node = block->at(nodeIndex);
                
                handleNode(
                    node,
                    doNothing,
                    [&] (Node* escapee) {
                        if (!m_sinkCandidates.contains(escapee))
                            return;
                        
                        if (!materialized.add(escapee))
                            return;
                        
                        m_edgeToMaterializationPoint.add(
                            std::make_pair(where, escapee),
                            createMaterialize(escapee, node->origin));
                    });
            }
        }
    }
    
    void placeMaterializationPoints()
    {
        m_ssaCalculator.reset();
        
        HashMap<Node*, SSACalculator::Variable*> nodeToVariable;
        Vector<Node*> indexToNode;
        
        for (Node* node : m_sinkCandidates) {
            SSACalculator::Variable* variable = m_ssaCalculator.newVariable();
            nodeToVariable.add(node, variable);
            ASSERT(indexToNode.size() == variable->index());
            indexToNode.append(node);
        }
        
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            for (Node* node : *block) {
                if (SSACalculator::Variable* variable = nodeToVariable.get(node))
                    m_ssaCalculator.newDef(variable, block, node);
                
                m_graph.doToChildren(
                    node,
                    [&] (Edge edge) {
                        Node* materialize =
                            m_edgeToMaterializationPoint.get(std::make_pair(node, edge.node()));
                        if (!materialize)
                            return;
                        
                        m_ssaCalculator.newDef(
                            nodeToVariable.get(edge.node()), block, materialize);
                    });
            }
        }
        
        m_ssaCalculator.computePhis(
            [&] (SSACalculator::Variable* variable, BasicBlock* block) -> Node* {
                Node* allocation = indexToNode[variable->index()];
                if (!block->ssa->liveAtHead.contains(allocation))
                    return nullptr;
                
                Node* phiNode = m_graph.addNode(allocation->prediction(), Phi, NodeOrigin());
                phiNode->mergeFlags(NodeResultJS);
                return phiNode;
            });
        
        // Place Phis in the right places. Replace all uses of any allocation with the appropriate
        // materialization. Create the appropriate Upsilon nodes.
        LocalOSRAvailabilityCalculator availabilityCalculator;
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            HashMap<Node*, Node*> mapping;
            
            for (Node* candidate : block->ssa->liveAtHead) {
                SSACalculator::Variable* variable = nodeToVariable.get(candidate);
                if (!variable)
                    continue;
                
                Def* def = m_ssaCalculator.reachingDefAtHead(block, variable);
                if (!def)
                    continue;
                
                mapping.add(indexToNode[variable->index()], def->value());
            }
            
            availabilityCalculator.beginBlock(block);
            for (SSACalculator::Def* phiDef : m_ssaCalculator.phisForBlock(block)) {
                m_insertionSet.insert(0, phiDef->value());
                
                Node* originalNode = indexToNode[phiDef->variable()->index()];
                insertOSRHintsForUpdate(
                    m_insertionSet, 0, availabilityCalculator, originalNode, phiDef->value());

                mapping.add(originalNode, phiDef->value());
            }
            
            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
                Node* node = block->at(nodeIndex);

                m_graph.doToChildEdges(
                    node,
                    [&] (Edge edge) {
                        Node* materialize = m_edgeToMaterializationPoint.get(
                            std::make_pair(node, edge.node()));
                        if (materialize) {
                            m_insertionSet.insert(nodeIndex, materialize);
                            insertOSRHintsForUpdate(
                                m_insertionSet, nodeIndex, availabilityCalculator,
                                edge.node(), materialize);
                        }
                    });

                availabilityCalculator.executeNode(node);
                
                m_graph.doToChildEdges(
                    node,
                    [&] (Edge& edge) {
                        if (Node* materialize = mapping.get(edge.node()))
                            edge.setNode(materialize);
                    });
            }
            
            size_t upsilonInsertionPoint = block->size() - 1;
            NodeOrigin upsilonOrigin = block->last()->origin;
            for (BasicBlock* successorBlock : block->successors()) {
                for (SSACalculator::Def* phiDef : m_ssaCalculator.phisForBlock(successorBlock)) {
                    Node* phiNode = phiDef->value();
                    SSACalculator::Variable* variable = phiDef->variable();
                    Node* allocation = indexToNode[variable->index()];
                    
                    Node* originalIncoming = mapping.get(allocation);
                    Node* incoming;
                    if (originalIncoming == allocation) {
                        // If we have a Phi that combines materializations with the original
                        // phantom object, then the path with the phantom object must materialize.
                        
                        incoming = createMaterialize(allocation, upsilonOrigin);
                        m_insertionSet.insert(upsilonInsertionPoint, incoming);
                        insertOSRHintsForUpdate(
                            m_insertionSet, upsilonInsertionPoint, availabilityCalculator,
                            originalIncoming, incoming);
                    } else
                        incoming = originalIncoming;
                    
                    Node* upsilon = m_insertionSet.insertNode(
                        upsilonInsertionPoint, SpecNone, Upsilon, upsilonOrigin,
                        OpInfo(phiNode), incoming->defaultEdge());
                    
                    if (originalIncoming == allocation) {
                        m_edgeToMaterializationPoint.add(
                            std::make_pair(upsilon, allocation), incoming);
                    }
                }
            }
            
            m_insertionSet.execute(block);
        }
        
        // At this point we have dummy materialization nodes along with edges to them. This means
        // that the part of the control flow graph that prefers to see actual object allocations
        // is completely fixed up, except for the materializations themselves.
    }
    
    void lowerNonReadingOperationsOnPhantomAllocations()
    {
        // Lower everything but reading operations on phantom allocations. We absolutely have to
        // lower all writes so as to reveal them to the SSA calculator. We cannot lower reads
        // because the whole point is that those go away completely.
        
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
                Node* node = block->at(nodeIndex);
                switch (node->op()) {
                case PutByOffset: {
                    if (m_sinkCandidates.contains(node->child2().node()))
                        node->convertToPutByOffsetHint();
                    break;
                }
                    
                case PutStructure: {
                    if (m_sinkCandidates.contains(node->child1().node())) {
                        Node* structure = m_insertionSet.insertNode(
                            nodeIndex, SpecCellOther, PhantomStructure, node->origin,
                            OpInfo(node->transition()->next));
                        node->convertToPutStructureHint(structure);
                    }
                    break;
                }
                    
                case NewObject: {
                    if (m_sinkCandidates.contains(node)) {
                        Node* structure = m_insertionSet.insertNode(
                            nodeIndex + 1, SpecCellOther, PhantomStructure, node->origin,
                            OpInfo(node->structure()));
                        m_insertionSet.insertNode(
                            nodeIndex + 1, SpecNone, PutStructureHint, node->origin,
                            Edge(node, KnownCellUse), Edge(structure, KnownCellUse));
                        node->convertToPhantomNewObject();
                    }
                    break;
                }
                    
                case MaterializeNewObject: {
                    if (m_sinkCandidates.contains(node)) {
                        m_insertionSet.insertNode(
                            nodeIndex + 1, SpecNone, PutStructureHint, node->origin,
                            Edge(node, KnownCellUse), m_graph.varArgChild(node, 0));
                        for (unsigned i = 0; i < node->objectMaterializationData().m_properties.size(); ++i) {
                            m_insertionSet.insertNode(
                                nodeIndex + 1, SpecNone, PutByOffsetHint, node->origin,
                                Edge(node, KnownCellUse),m_graph.varArgChild(node, i + 1));
                        }
                        node->convertToPhantomNewObject();
                    }
                    break;
                }
                    
                default:
                    break;
                }
            }
            m_insertionSet.execute(block);
        }
    }
    
    void promoteSunkenFields()
    {
        // Henceforth when we encounter a materialization point, we will want to ask *who* it is
        // a materialization for. Invert the map to be able to answer such questions.
        m_materializationPointToEscapee.clear();
        for (auto pair : m_edgeToMaterializationPoint)
            m_materializationPointToEscapee.add(pair.value, pair.key.second);
        
        // Collect the set of heap locations that we will be operating over.
        HashSet<PromotedHeapLocation> locations;
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            for (Node* node : *block) {
                promote(
                    node,
                    [&] (PromotedHeapLocation location, Edge) {
                        locations.add(location);
                    },
                    [&] (PromotedHeapLocation location) {
                        locations.add(location);
                    });
            }
        }
        
        // Figure out which locations belong to which allocations.
        m_locationsForAllocation.clear();
        for (PromotedHeapLocation location : locations) {
            auto result = m_locationsForAllocation.add(location.base(), Vector<PromotedHeapLocation>());
            ASSERT(!result.iterator->value.contains(location));
            result.iterator->value.append(location);
        }
        
        // For each sunken thingy, make sure we create Bottom values for all of its fields.
        // Note that this has the hilarious slight inefficiency of creating redundant hints for
        // things that were previously materializations. This should only impact compile times and
        // not code quality, and it's necessary for soundness without some data structure hackage.
        // For example, a MaterializeNewObject that we choose to sink may have new fields added to
        // it conditionally. That would necessitate Bottoms.
        Node* bottom = nullptr;
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            if (block == m_graph.block(0))
                bottom = m_insertionSet.insertNode(0, SpecNone, Bottom, NodeOrigin());
            
            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
                Node* node = block->at(nodeIndex);
                for (PromotedHeapLocation location : locationsForAllocation.get(node)) {
                    m_insertionSet.insertNode(
                        nodeIndex + 1, location.createHint(m_graph, node->origin, bottom));
                }
            }
            m_insertionSet.execute(block);
        }

        m_ssaCalculator.reset();

        // Collect the set of "variables" that we will be sinking.
        m_locationToVariable.clear();
        m_indexToLocation.clear();
        for (PromotedHeapLocation location : locations) {
            SSACalculator::Variable* variable = m_ssaCalculator.newVariable();
            locationToVariable.add(location, variable);
            ASSERT(indexToLocation.size() == variable->index());
            indexToLocation.append(location);
        }
        
        // Create Defs from the existing hints.
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            for (Node* node : *block) {
                promote(
                    node,
                    [&] (PromotedHeapLocation location, Edge value) {
                        SSACalculator::Variable* variable = locationToVariable.get(location);
                        m_ssaCalculator.newDef(variable, block, value.node());
                    },
                    doNothing);
            }
        }
        
        // OMG run the SSA calculator to create Phis!
        m_ssaCalculator.computePhis(
            [&] (SSACalculator::Variable* variable, BasicBlock* block) -> Node* {
                PromotedHeapLocation location = indexToLocation[variable->index()];
                if (!block->ssa->liveAtHead.contains(location.base()))
                    return nullptr;
                
                Node* phiNode = m_graph.addNode(SpecHeapTop, Phi, NodeOrigin());
                phiNode->mergeFlags(NodeResultJS);
                return phiNode;
            });
        
        // Place Phis in the right places, replace all uses of any load with the appropriate
        // value, and create the appropriate Upsilon nodes.
        m_graph.clearReplacements();
        for (BasicBlock* block : m_graph.blocksInPreOrder()) {
            // This mapping table is intended to be lazy. If something is omitted from the table,
            // it means that there haven't been any local stores to that promoted heap location.
            m_localMapping.clear();
            
            // Insert the Phi functions that we had previously created.
            for (SSACalculator::Def* phiDef : m_ssaCalculator.phisForBlock(block)) {
                PromotedHeapLocation location = m_indexToLocation[phiDef->variable()->index()];
                
                m_insertionSet.insert(
                    0, phiDef->value());
                m_insertionSet.insert(
                    0, location.createHint(m_graph, NodeOrigin(), phiDef->value()));
                m_localMapping.add(location, phiDef->value());
            }
            
            // Process the block and replace all uses of loads with the promoted value.
            for (Node* node : *block) {
                m_graph.performSubstitution(node);
                
                if (Node* escapee = m_materializationPointToEscapee.get(node))
                    populateMaterialize(block, node, escapee);
                
                promote(
                    node,
                    [&] (PromotedHeapLocation location, Edge value) {
                        m_localMapping.set(location, edge.node());
                    },
                    [&] (PromotedHeapLocation location) {
                        node->replaceWith(resolve(block, location));
                    });
            }
            
            // Gotta drop some Upsilons.
            size_t upsilonInsertionPoint = block->size() - 1;
            NodeOrigin upsilonOrigin = block->last()->origin;
            for (BasicBlock* successorBlock : block->successors()) {
                for (SSACalculator::Def* phiDef : m_ssaCalculator.phisForBlock(successorBlock)) {
                    Node* phiNode = phiDef->value();
                    SSACalculator::Variable* variable = phiDef->variable();
                    PromotedHeapLocation location = m_indexToLocation[variable->index()];
                    Node* incoming = resolve(block, location);
                    
                    m_insertionSet.insertNode(
                        upsilonInsertionPoint, SpecNone, Upsilon, upsilonOrigin,
                        OpInfo(phiNode), incoming->defaultEdge());
                }
            }
            
            m_insertionSet.execute(block);
        }
    }
    
    Node* resolve(BasicBlock* block, PromotedHeapLocation location)
    {
        if (Node* result = m_localMapping.get(location))
            return result;
        
        // This implies that there is no local mapping. Find a non-local mapping.
        Def* def = m_ssaCalculator.nonLocalReachingDef(block, m_locationToVariable.get(location));
        ASSERT(def);
        ASSERT(def->value());
        m_localMapping.add(locaftion, def->value());
        return def->value();
    }

    template<typename... Args>
    static void doNothing(Args...) { }
    
    template<typename SinkCandidateFunctor, typename EscapeFunctor>
    void handleNode(
        Node* node,
        const SinkCandidateFunctor& sinkCandidate,
        const EscapeFunctor& escape)
    {
        switch (node->op()) {
        case NewObject:
        case MaterializeNewObject:
            sinkCandidate();
            break;
            
        case CheckStructure:
        case GetByOffset:
        case MultiGetByOffset:
        case PutStructure:
        case GetGetterSetterByOffset:
        case MovHint:
            break;
            
        case PutByOffset:
            escape(node->child3().node());
            break;
            
        case MultiPutByOffset:
            // FIXME: In the future we should be able to handle this. It's just a matter of
            // building the appropriate *Hint variant of this instruction, along with a
            // PhantomStructureSelect node - since this transforms the Structure in a conditional
            // way.
            // https://bugs.webkit.org/show_bug.cgi?id=136924
            escape(node->child1().node());
            escape(node->child2().node());
            break;

        default:
            m_graph.doToChildren(
                node,
                [&escape] (Edge edge) {
                    escape(edge.node());
                });
            break;
        }
    }
    
    Node* createMaterialize(Node* escapee, const NodeOrigin whereOrigin)
    {
        switch (escapee->op()) {
        case NewObject:
        case MaterializeNewObject:
            return m_graph.addNode(
                escapee->prediction(), MaterializeNewObject,
                NodeOrigin(
                    escapee->origin.semantic,
                    whereOrigin.forExit),
                OpInfo(m_graph.m_objectMaterializationData.add()),
                OpInfo(), 0, 0);
            
        default:
            DFG_CRASH(m_graph, where, "Bad escapee op");
            return nullptr;
        }
        
        return result;
    }
    
    void populateMaterialize(BasicBlock* block, Node* node, Node* escapee)
    {
        switch (node->op()) {
        case MaterializeNewObject: {
            ObjectMaterializationData* data = node->objectMaterializationData();
            unsigned firstChild = m_graph.m_varArgChildren.size();
            
            Vector<PromotedHeapLocation>& locations = m_LocationsForAllocation.get(escapee);
            
            PromotedHeapLocation structure(StructurePLoc, escapee);
            ASSERT(locations.contains(structure));
            
            m_graph.m_varArgChildren.append(resolve(block, structure));
            
            for (unsigned i = 0; i < locations.size(); ++i) {
                switch (locations[i].kind()) {
                case StructurePLoc: {
                    ASSERT(locations[i] == structure);
                    break;
                }
                    
                case NamedPropertyPLoc: {
                    Node* value = resolve(block, locations[i]);
                    if (value->op() == Bottom) {
                        // We can skip Bottoms entirely.
                        break;
                    }
                    
                    data->m_properties.append(PhantomPropertyValue(locations[i].info()));
                    m_graph.m_varArgChildren.append(value);
                    break;
                }
                    
                default:
                    DFG_CRASH(m_graph, node, "Bad location kind");
                }
            }
            
            node->children = AdjacencyList(
                AdjacencyList::Variable,
                firstChild, m_graph.m_varArgChildren.size() - firstChild);
            break;
        }
            
        default:
            DFG_CRASH(m_graph, node, "Bad materialize op");
            break;
        }
    }
    
    SSACalculator m_ssaCalculator;
    HashSet<Node*> m_sinkCandidates;
    HashMap<std::pair<Node*, Node*>, Node*> m_edgeToMaterializationPoint;
    HashMap<Node*, Node*> m_materializationPointToEscapee;
    HashMap<Node*, Vector<PromotedHeapLocation>> m_locationsForAllocation;
    HashMap<PromotedHeapLocation, SSACalculator::Variable*> m_locationToVariable;
    Vector<PromotedHeapLocation> m_indexToLocation;
    HashMap<PromotedHeapLocation, Node*> m_localMapping;
    InsertionSet m_insertionSet;
};
    
bool performObjectAllocationSinking(Graph& graph)
{
    SamplingRegion samplingRegion("DFG Object Allocation Sinking Phase");
    return runPhase<ObjectAllocationSinkingPhase>(graph);
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGObjectAllocationSinkingPhase_h
#define DFGObjectAllocationSinkingPhase_h

#if ENABLE(DFG_JIT)

namespace JSC { namespace DFG {

class Graph;

// Sinks object allocations down to their uses. This will sink the allocations over OSR exits, by
// replacing all stores to those objects with store hints so that OSR exit can materialize the
// object. This may sink allocations past returns, creating control flow paths along which the
// objects are not allocated at all. Replaces all uses of the objects' fields with SSA data flow.

bool performObjectAllocationSinking(Graph&);

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGObjectAllocationSinkingPhase_h




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGObjectMaterializationData.h"

namespace JSC { namespace DFG {

void PhantomPropertyValue::dump(PrintStream& out) const
{
    out.print("id", m_identifierNumber);
}

void ObjectMaterializationData::dump(PrintStream& out) const
{
    out.print("[", listDump(m_properties), "]");
}

float ObjectMaterializationData::oneWaySimilarityScore(
    const ObjectMaterializationData& other) const
{
    unsigned numHits = 0;
    for (PhantomPropertyValue value : m_properties) {
        if (other.m_properties.contains(value))
            numHits++;
    }
    return static_cast<float>(numHits) / static_cast<float>(m_properties.size());
}

float ObjectMaterializationData::similarityScore(const ObjectMaterializationData& other) const
{
    return std::min(oneWaySimilarityScore(other), other.oneWaySimilarityScore(*this));
}

} } // namespace JSC::DFG




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGObjectMaterializationData_h
#define DFGObjectMaterializationData_h

#if ENABLE(DFG_JIT)

namespace JSC { namespace DFG {

struct PhantomPropertyValue {
    PhantomPropertyValue()
        : m_identifierNumber(UINT_MAX)
    {
    }
    
    PhantomPropertyValue(unsigned identifierNumber)
        : m_identifierNumber(identifierNumber)
    {
    }
    
    unsigned m_identifierNumber;
    
    bool operator==(const PhantomPropertyValue& other) const
    {
        return m_identifierNumber == other.m_identifierNumber;
    }
    
    void dump(PrintStream&) const;
};

struct ObjectMaterializationData {
    // Determines the meaning of the passed nodes.
    Vector<PhantomPropertyValue> m_properties;
    
    void dump(PrintStream&) const;
    
    // The fraction of my properties that the other data has.
    float oneWaySimilarityScore(const ObjectMaterializationData&) const;
    
    // The minimum of the two possible one-way scores.
    float similarityScore(const ObjectMaterializationData&) const;
};

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGObjectMaterializationData_h




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGPhiChildren.h"

#if ENABLE(DFG_JIT)

namespace JSC { namespace DFG {

PhiChildren::PhiChildren()
{
}

PhiChildren::PhiChildren(Graph& graph)
{
    for (BasicBlock* block : graph.blocksInNaturalOrder()) {
        for (Node* node : *block) {
            if (node->op() != Upsilon)
                continue;
            
            m_children.add(node->phi(), List()).iterator->value.append(node);
        }
    }
}

PhiChildren::~PhiChildren()
{
}

const PhiChildren::List& PhiChildren::childrenOf(Node* node) const
{
    return m_children.get(node);
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGPhiChildren_h
#define DFGPhiChildren_h

#if ENABLE(DFG_JIT)

namespace JSC { namespace DFG {

class PhiChildren {
public:
    typedef Vector<Node*, 3> List;
    
    PhiChildren();
    PhiChildren(Graph&);
    ~PhiChildren();
    
    // The list of Upsilons that point to the children of the Phi.
    const List& upsilonsOf(Node*) const;
    
    template<typename Functor>
    void forAllIncomingValues(Node* node, const Functor& functor)
    {
        for (Node* upsilon : upsilonsOf(node))
            functor(node->child1().node());
    }
    
    // This walks the Phi graph.
    template<typename Functor>
    void forAllTransitiveIncomingValues(Node* node, const Functor& functor)
    {
        HashSet<Node*> seen;
        Vector<Node*> worklist;
        seen.add(node);
        worklist.append(node);
        while (!worklist.isEmpty()) {
            Node* currentNode = worklist.takeLast();
            forAllIncomingValues(
                currentNode,
                [&] (Node* incomingNode) {
                    if (incomingNode->op() == Phi) {
                        if (seen.add(incomingNode))
                            worklist.append(incomingNode);
                    } else
                        functor(incomingNode);
                });
        }
    }
    
private:
    HashMap<Node*, List> m_children;
};

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGPhiChildren_h




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGPromotedHeapLocation.h"

#if ENABLE(DFG_JIT)

namespace JSC { namespace DFG {

Node* PromotedHeapLocation::createHint(Graph& graph, NodeOrigin origin, Node* value)
{
    switch (kind()) {
    case StructurePLoc:
        return graph.addNode(
            SpecNone, PutStructureHint, origin,
            Edge(base(), KnownCellUse), value);
        
    case NamedPropertyPLoc:
        return graph.addNode(
            SpecNone, PutByOffsetHint, origin,
            OpInfo(location.info()), Edge(base(), KnownCellUse), value);
        
    case InvalidPromotedLocationKind:
        return nullptr;
    }
    
    RELEASE_ASSERT_NOT_REACHED();
}

void PromotedHeapLocation::dump(PrintStream& out) const
{
    out.print(m_kind, "(", m_base, ", ", m_info, ")");
}

} } // namespace JSC::DFG

namespace WTF {

using namespace JSC::DFG;

void printInternal(PrintStream& out, PromotedLocationKind kind)
{
    switch (kind) {
    case InvalidPromotedLocationKind:
        out.print("InvalidPromotedLocationKind");
        return;
        
    case StructurePLoc:
        out.print("StructurePLoc");
        return;
        
    case NamedPropertyPLoc:
        out.print("NamedPropertyPLoc");
        return;
    }
    
    RELEASE_ASSERT_NOT_REACHED();
}

} // namespace WTF;

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGPromotedHeapLocation_h
#define DFGPromotedHeapLocation_h

#if ENABLE(DFG_JIT)

#include "DFGNode.h"
#include <wtf/PrintStream.h>

namespace JSC { namespace DFG {

enum PromotedLocationKind {
    InvalidPromotedLocationKind,
    
    StructurePLoc,
    NamedPropertyPLoc
};

class PromotedHeapLocation {
public:
    PromotedHeapLocation(
        PromotedLocationKind kind = InvalidPromotedLocationKind,
        Node* base = nullptr, unsigned info = 0)
        : m_base(base)
        , m_kind(kind)
        , m_info(info)
    {
    }
    
    PromotedHeapLocation(
        PromotedLocationKind kind, Edge base, unsigned info = 0)
        : PromotedHeapLocation(kind, base.node(), info)
    {
    }
    
    PromotedHeapLocation(WTF::HashTableDeletedValueType)
        : m_base(nullptr)
        , m_kind(InvalidPromotedLocationKind)
        , m_info(1)
    {
    }
    
    Node* createHint(Graph&, NodeOrigin, Node* value);
    
    bool operator!() const { return m_kind == InvalidPromotedLocationKind; }
    
    PromotedLocationKind kind() const { return m_kind; }
    Node* base() const { return m_base; }
    unsigned info() const { return m_info; }
    
    unsigned hash() const
    {
        return m_kind + WTF::PtrHash<Node*>::hash(m_base) + m_info;
    }
    
    bool operator==(const PromotedHeapLocation& other) const
    {
        return m_base == other.m_base
            && m_kind == other.m_kind
            && m_info == other.m_info;
    }
    
    bool isHashTableDeletedValue() const
    {
        return m_kind == InvalidPromotedLocationKind && m_info;
    }
    
    void dump(PrintStream& out) const;
    
private:
    Node* m_base;
    PromotedLocationKind m_kind;
    unsigned m_info;
};

// Note that the write functor is really the useful thing here. The read functor is only useful
// for the object allocation sinking phase.
template<typename WriteFunctor, typename ReadFunctor>
void promote(Node* node, const WriteFunctor& write, const ReadFunctor& read)
{
    switch (node->op()) {
    case CheckStructure:
        if (m_sinkCandidates.contains(node->child1().node()))
            read(PromotedHeapLocation(StructurePLoc, node->child1()));
        break;
            
    case GetByOffset:
    case GetGetterSetterByOffset:
        if (m_sinkCandidates.contains(node->child2().node())) {
            unsigned identifierNumber =
                graph.m_storageAccessData[node->storageAccessDataIndex()].identifierNumber;
            read(PromotedHeapLocation(NamedPropertyPLoc, node->child2(), identifierNumber));
        }
        break;
                                  
    case MultiGetByOffset:
        if (m_sinkCandidates.contains(node->child1().node())) {
            unsigned identifierNumber = node->multiGetByOffsetData().identifierNumber;
            read(PromotedHeapLocation(NamedPropertyPLoc, node->child1(), identiferNumber));
        }
        break;
            
    case PutStructureHint:
        if (m_sinkCandidates.contains(node->child1().node()))
            write(PromotedHeapLocation(StructurePLoc, node->child1()), node->child2());
        break;
            
    case PutByOffsetHint:
        if (m_sinkCandidates.contains(node->child1().node())) {
            unsigned identifierNumber = node->identifierNumber();
            write(
                PromotedHeapLocation(NamedPropertyPLoc, node->child1(), identifierNumber),
                node->child2().node());
        }
        break;

    default:
        break;
    }
}

struct PromotedHeapLocationHash {
    static unsigned hash(const PromotedHeapLocation& key) { return key.hash(); }
    static bool equal(const PromotedHeapLocation& a, const PromotedHeapLocation& b) { return a == b; }
    static const bool safeToCompareToEmptyOrDeleted = true;
};

} } // namespace JSC::DFG

namespace WTF {

void printInternal(PrintStream&, JSC::DFG::PromotedLocationKind);

template<typename T> struct DefaultHash;
template<> struct DefaultHash<JSC::DFG::PromotedHeapLocation> {
    typedef JSC::DFG::PromotedHeapLocationHash Hash;
};

template<typename T> struct HashTraits;
template<> struct HashTraits<JSC::DFG::PromotedHeapLocation> : SimpleClassHashTraits<JSC::DFG::PromotedHeapLocation> {
    static const bool emptyValueIsZero = false;
};

} // namespace WTF

#endif // ENABLE(DFG_JIT)

#endif // DFGPromotedHeapLocation_h




{
}

void SSACalculator::reset()
{
    m_variables.clear();
    m_defs.clear();
    m_phis.clear();
    for (BlockIndex blockIndex = m_data.size(); blockIndex--;) {
        m_data[blockIndex].m_defs.clear();
        m_data[blockIndex].m_phis.clear();
    }
}

SSACalculator::Variable* SSACalculator::newVariable()
{
    return &m_variables.alloc(Variable(m_variables.size()));

Lines 105-110 public: Source/JavaScriptCore/dfg/DFGSSACalculator.h_sec1
- Source/JavaScriptCore/dfg/DFGSSACalculator.h +2 lines
105	SSACalculator(Graph&);	105	SSACalculator(Graph&);
106	~SSACalculator();	106	~SSACalculator();
107		107
		108	void reset();
		109
108	class Variable {	110	class Variable {
109	public:	111	public:
110	unsigned index() const { return m_index; }	112	unsigned index() const { return m_index; }



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLExitPropertyValue.h"

#if ENABLE(FTL_JIT)

namespace JSC { namespace FTL {

void ExitPropertyValue::dump(PrintStream& out) const
{
    out.print(m_uid, " => ", m_value);
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLExitPropertyValue_h
#define FTLExitPropertyValue_h

#if ENABLE(FTL_JIT)

#include "FTLExitValue.h"
#include <wtf/StringImpl.h>

namespace JSC { namespace FTL {

class ExitPropertyValue {
public:
    ExitPropertyValue()
        : m_uid(nullptr)
    {
    }
    
    ExitPropertyValue(StringImpl* uid, const ExitValue& value)
        : m_uid(uid)
        , m_value(value)
    {
        ASSERT(!!uid == !!value);
    }
    
    bool operator!() const { return !m_uid; }
    
    StringImpl* uid() const { return m_uid; }
    const ExitValue& value() const { return m_value; }
    
    void dump(PrintStream& out) const;

private:
    StringImpl* m_uid;
    ExitValue m_value;
};

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLExitPropertyValue_h




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLExitTimeObjectMaterialization.h"

#if ENABLE(FTL_JIT)

namespace JSC { namespace FTL {

ExitTimeObjectMaterialization::~ExitTimeObjectMaterialization()
{
}

void ExitTimeObjectMaterialization::dump(PrintStream& out) const
{
    out.print("<new Object: structure => ", m_structure, ", {", listDump(m_properties), "}>");
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLExitTimeObjectMaterialization_h
#define FTLExitTimeObjectMaterialization_h

#if ENABLE(FTL_JIT)

#include "FTLExitPropertyValue.h"
#include "FTLExitValue.h"

namespace JSC { namespace FTL {

class ExitTimeObjectMaterialization {
public:
    ExitTimeObjectMaterialization()
    {
    }
    
    ~ExitTimeObjectMaterialization();
    
    void setStructure(const ExitValue& value)
    {
        m_structure = value;
    }
    
    void addProperty(const ExitPropertyValue& value)
    {
        m_properties.append(value);
    }
    
    const ExitValue& structure() const { return m_structure; }
    const Vector<ExitPropertyValue>& properties() const { return m_properties; }
    
    void dump(PrintStream& out) const;
    
private:
    ExitValue m_structure;
    Vector<ExitPropertyValue> m_properties;
};

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLExitTimeObjectMaterialization_h





namespace JSC { namespace FTL {

ExitValue::~ExitValue()
{
    deleteData();
}

void ExitValue::deleteData()
{
    switch (kind()) {
    case ExitValueMaterializeNewObject:
        delete u.newObjectMaterializationData;
        break;
    default:
        break;
    }
}

ExitValue::ExitValue(const ExitValue& other)
    : m_kind(InvalidExitValue)
{
    *this = other;
}

ExitValue& ExitValue::operator=(const ExitValue& other)
{
    if (this == &other)
        return;
    
    deleteData();
    
    m_kind = other.m_kind;
    u = other.u;
    
    switch (kind()) {
    case ExitValueMaterializeNewObject:
        u.newObjectMaterializationData =
            new ExitTimeObjectMaterialization(*u.newObjectMaterializationData);
        break;
    default:
        break;
    }
}

void ExitValue ExitValue::materializeNewObject(const ExitTimeObjectMaterialization& data)
{
    ExitValue result;
    result.m_kind = ExitValueMaterializeNewObject;
    result.u.newObjectMaterializationData = new ExitTimeObjectMaterialization(data);
    return result;
}

void ExitValue::dumpInContext(PrintStream& out, DumpContext* context) const
{
    switch (kind()) {

    case ExitValueRecovery:
        out.print("Recovery(", recoveryOpcode(), ", arg", leftRecoveryArgument(), ", arg", rightRecoveryArgument(), ", ", recoveryFormat(), ")");
        return;
    case ExitValueMaterializeNewObject:
        out.print("Materialize(", objectMaterialization(), ")");
        return;
    }
    
    RELEASE_ASSERT_NOT_REACHED();

Lines 52-60 enum ExitValueKind { Source/JavaScriptCore/ftl/FTLExitValue.h_sec1
- Source/JavaScriptCore/ftl/FTLExitValue.h -3 / +24 lines
52	ExitValueInJSStackAsInt52,	52	ExitValueInJSStackAsInt52,
53	ExitValueInJSStackAsDouble,	53	ExitValueInJSStackAsDouble,
54	ExitValueArgumentsObjectThatWasNotCreated,	54	ExitValueArgumentsObjectThatWasNotCreated,
55	ExitValueRecovery	55	ExitValueRecovery,
		56	ExitValueMaterializeNewObject
56	};	57	};
57		58
		59	class ExitTimeObjectMaterialization;
		60
58	class ExitValue {	61	class ExitValue {
59	public:	62	public:
60	ExitValue()	63	ExitValue()
Lines 62-67 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec2
62	{	65	{
63	}	66	}
64		67
		68	~ExitValue();
		69
		70	ExitValue(const ExitValue&);
		71	ExitValue& operator=(const ExitValue&);
		72
65	bool operator!() const { return m_kind == InvalidExitValue; }	73	bool operator!() const { return m_kind == InvalidExitValue; }
66		74
67	static ExitValue dead()	75	static ExitValue dead()
Lines 137-142 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec3
137	return result;	145	return result;
138	}	146	}
139		147
		148	static ExitValue materializeNewObject(const ExitTimeObjectMaterialization&);
		149
140	ExitValueKind kind() const { return m_kind; }	150	ExitValueKind kind() const { return m_kind; }
141		151
142	bool isDead() const { return kind() == ExitValueDead; }	152	bool isDead() const { return kind() == ExitValueDead; }
Lines 156-161 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec4
156	bool isArgument() const { return kind() == ExitValueArgument; }	166	bool isArgument() const { return kind() == ExitValueArgument; }
157	bool isArgumentsObjectThatWasNotCreated() const { return kind() == ExitValueArgumentsObjectThatWasNotCreated; }	167	bool isArgumentsObjectThatWasNotCreated() const { return kind() == ExitValueArgumentsObjectThatWasNotCreated; }
158	bool isRecovery() const { return kind() == ExitValueRecovery; }	168	bool isRecovery() const { return kind() == ExitValueRecovery; }
		169	bool isObjectMaterialization() const { return kind() == ExitValueMaterializeNewObject; }
159		170
160	ExitArgument exitArgument() const	171	ExitArgument exitArgument() const
161	{	172	{
Lines 199-205 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec5
199	return VirtualRegister(u.virtualRegister);	210	return VirtualRegister(u.virtualRegister);
200	}	211	}
201		212
202	ExitValue withVirtualRegister(VirtualRegister virtualRegister)	213	const ExitTimeObjectMaterialization& objectMaterialization() const
		214	{
		215	ASSERT(isObjectMaterialization());
		216	return *u.newObjectMaterializationData;
		217	}
		218
		219	ExitValue withVirtualRegister(VirtualRegister virtualRegister) const
203	{	220	{
204	ASSERT(isInJSStackSomehow());	221	ASSERT(isInJSStackSomehow());
205	ExitValue result;	222	ExitValue result;
Lines 207-213 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec6
207	result.u.virtualRegister = virtualRegister.offset();	224	result.u.virtualRegister = virtualRegister.offset();
208	return result;	225	return result;
209	}	226	}
210		227
211	// If it's in the JSStack somehow, this will tell you what format it's in, in a manner	228	// If it's in the JSStack somehow, this will tell you what format it's in, in a manner
212	// that is compatible with exitArgument().format(). If it's a constant or it's dead, it	229	// that is compatible with exitArgument().format(). If it's a constant or it's dead, it
213	// will claim to be a JSValue. If it's an argument then it will tell you the argument's	230	// will claim to be a JSValue. If it's an argument then it will tell you the argument's
Lines 223-228 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec7
223	case ExitValueConstant:	240	case ExitValueConstant:
224	case ExitValueInJSStack:	241	case ExitValueInJSStack:
225	case ExitValueArgumentsObjectThatWasNotCreated:	242	case ExitValueArgumentsObjectThatWasNotCreated:
		243	case ExitValueMaterializeNewObject:
226	return ValueFormatJSValue;	244	return ValueFormatJSValue;
227		245
228	case ExitValueArgument:	246	case ExitValueArgument:
Lines 249-254 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec8
249	void dumpInContext(PrintStream&, DumpContext*) const;	267	void dumpInContext(PrintStream&, DumpContext*) const;
250		268
251	private:	269	private:
		270	void deleteData();
		271
252	ExitValueKind m_kind;	272	ExitValueKind m_kind;
253	union {	273	union {
254	ExitArgumentRepresentation argument;	274	ExitArgumentRepresentation argument;
Lines 260-265 private: Source/JavaScriptCore/ftl/FTLExitValue.h_sec9
260	uint16_t opcode;	280	uint16_t opcode;
261	uint16_t format;	281	uint16_t format;
262	} recovery;	282	} recovery;
		283	ExitTimeObjectMaterialization* newObjectMaterializationData;
263	} u;	284	} u;
264	};	285	};
265		286




using namespace DFG;

static void compileRecovery(
    CCallHeleprs& jit, const ExitValue& value, StackMaps::Record* record, StackMaps& stackmaps,
    char *registerScratch)
{
    switch (value.kind()) {
    case ExitValueDead:
        jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), GPRInfo::regT0);
        break;
            
    case ExitValueConstant:
        jit.move(MacroAssembler::TrustedImm64(JSValue::encode(value.constant())), GPRInfo::regT0);
        break;
            
    case ExitValueArgument:
        record->locations[value.exitArgument().argument()].restoreInto(
            jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
        break;
            
    case ExitValueInJSStack:
    case ExitValueInJSStackAsInt32:
    case ExitValueInJSStackAsInt52:
    case ExitValueInJSStackAsDouble:
        jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
        break;
            
    case ExitValueArgumentsObjectThatWasNotCreated:
        // We can't actually recover this yet, but we can make the stack look sane. This is
        // a prerequisite to running the actual arguments recovery.
        jit.move(MacroAssembler::TrustedImm64(JSValue::encode(JSValue())), GPRInfo::regT0);
        break;
            
    case ExitValueRecovery:
        record->locations[value.rightRecoveryArgument()].restoreInto(
            jit, jitCode->stackmaps, registerScratch, GPRInfo::regT1);
        record->locations[value.leftRecoveryArgument()].restoreInto(
            jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
        switch (value.recoveryOpcode()) {
        case AddRecovery:
            switch (value.recoveryFormat()) {
            case ValueFormatInt32:
                jit.add32(GPRInfo::regT1, GPRInfo::regT0);
                break;
            case ValueFormatInt52:
                jit.add64(GPRInfo::regT1, GPRInfo::regT0);
                break;
            default:
                RELEASE_ASSERT_NOT_REACHED();
                break;
            }
            break;
        case SubRecovery:
            switch (value.recoveryFormat()) {
            case ValueFormatInt32:
                jit.sub32(GPRInfo::regT1, GPRInfo::regT0);
                break;
            case ValueFormatInt52:
                jit.sub64(GPRInfo::regT1, GPRInfo::regT0);
                break;
            default:
                RELEASE_ASSERT_NOT_REACHED();
                break;
            }
            break;
        default:
            RELEASE_ASSERT_NOT_REACHED();
            break;
        }
        break;
            
    default:
        RELEASE_ASSERT_NOT_REACHED();
        break;
    }
        
    reboxAccordingToFormat(
        value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
}

static void compileStub(
    unsigned exitID, JITCode* jitCode, OSRExit& exit, VM* vm, CodeBlock* codeBlock)
{

    // the scratch buffer. This also does the reboxing.
    
    for (unsigned index = exit.m_values.size(); index--;) {
        ExitValue& value = exit.m_values[index];

        compileRecovery(jit, value, record, jitCode->stackmaps, registerScratch);
        case ExitValueDead:
            jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), GPRInfo::regT0);
            break;
            
        case ExitValueConstant:
            jit.move(MacroAssembler::TrustedImm64(JSValue::encode(value.constant())), GPRInfo::regT0);
            break;
            
        case ExitValueArgument:
            record->locations[value.exitArgument().argument()].restoreInto(
                jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
            break;
            
        case ExitValueInJSStack:
        case ExitValueInJSStackAsInt32:
        case ExitValueInJSStackAsInt52:
        case ExitValueInJSStackAsDouble:
            jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
            break;
            
        case ExitValueArgumentsObjectThatWasNotCreated:
            // We can't actually recover this yet, but we can make the stack look sane. This is
            // a prerequisite to running the actual arguments recovery.
            jit.move(MacroAssembler::TrustedImm64(JSValue::encode(JSValue())), GPRInfo::regT0);
            break;
            
        case ExitValueRecovery:
            record->locations[value.rightRecoveryArgument()].restoreInto(
                jit, jitCode->stackmaps, registerScratch, GPRInfo::regT1);
            record->locations[value.leftRecoveryArgument()].restoreInto(
                jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
            switch (value.recoveryOpcode()) {
            case AddRecovery:
                switch (value.recoveryFormat()) {
                case ValueFormatInt32:
                    jit.add32(GPRInfo::regT1, GPRInfo::regT0);
                    break;
                case ValueFormatInt52:
                    jit.add64(GPRInfo::regT1, GPRInfo::regT0);
                    break;
                default:
                    RELEASE_ASSERT_NOT_REACHED();
                    break;
                }
                break;
            case SubRecovery:
                switch (value.recoveryFormat()) {
                case ValueFormatInt32:
                    jit.sub32(GPRInfo::regT1, GPRInfo::regT0);
                    break;
                case ValueFormatInt52:
                    jit.sub64(GPRInfo::regT1, GPRInfo::regT0);
                    break;
                default:
                    RELEASE_ASSERT_NOT_REACHED();
                    break;
                }
                break;
            default:
                RELEASE_ASSERT_NOT_REACHED();
                break;
            }
            break;
            
        default:
            RELEASE_ASSERT_NOT_REACHED();
            break;
        }
        
        reboxAccordingToFormat(
            value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
        
        jit.store64(GPRInfo::regT0, scratch + index);
    }



    
public:
    Bag()
        : m_head(nullptr)
    {
    }
    
    ~Bag()
    {
        clear();
    }
    
    void clear()
    {
        while (m_head) {
            Node* current = m_head;
            m_head = current->m_next;
            delete current;
        }
        m_head = nullptr;
    }
    
    template<typename... Args>

Return to Bug 136330

Lines 676-681 public: Source/JavaScriptCore/dfg/DFGGraph.h_sec1
- Source/JavaScriptCore/dfg/DFGGraph.h +105 lines
676	BlockList blocksInPreOrder();	676	BlockList blocksInPreOrder();
677	BlockList blocksInPostOrder();	677	BlockList blocksInPostOrder();
678		678
		679	class NaturalBlockIterable {
		680	public:
		681	NaturalBlockIterable()
		682	: m_graph(nullptr)
		683	{
		684	}
		685
		686	NaturalBlockIterable(Graph& graph)
		687	: m_graph(&graph)
		688	{
		689	}
		690
		691	class iterator {
		692	public:
		693	iterator()
		694	: m_graph(nullptr)
		695	, m_index(0)
		696	{
		697	}
		698
		699	iterator(Graph& graph, BlockIndex index)
		700	: m_graph(&graph)
		701	, m_index(findNext(index))
		702	{
		703	}
		704
		705	BasicBlock operator()
		706	{
		707	return m_graph->block(index);
		708	}
		709
		710	iterator& operator++()
		711	{
		712	m_index = findNext(m_index);
		713	return *this;
		714	}
		715
		716	bool operator==(const iterator& other) const
		717	{
		718	return m_index == other.m_index;
		719	}
		720
		721	bool operator!=(const iterator& other) const
		722	{
		723	return !(*this == other);
		724	}
		725
		726	private:
		727	BlockIndex findNext(BlockIndex index)
		728	{
		729	while (index < m_graph->numBlocks() && !m_graph->block(index))
		730	index++;
		731	return index;
		732	}
		733
		734	Graph* m_graph;
		735	BlockIndex m_index;
		736	};
		737
		738	iterator begin()
		739	{
		740	return iterator(*m_graph, 0);
		741	}
		742
743	iterator end()
744	{
745	return iterator(*m_graph, m_graph->numBlocks());
746	}
747
748	private:
749	Graph* m_graph;
750	};
751
752	NaturalBlockIterable blocksInNaturalOrder()
753	{
754	return NaturalBlockIterable(*this);
755	}
756
757	template<typename ChildFunctor>
758	void doToChildrenWithNode(Node* node, const ChildFunctor& functor)
759	{
760	DFG_NODE_DO_TO_CHILDREN(node, functor);
761	}
762
763	template<typename ChildFunctor>
764	void doToChildEdges(Node* node, const ChildFunctor& functor)
765	{
766	doToChildrenWithNode(
767	node,
768	[&functor] (Node*, Edge& edge) {
769	functor(edge);
770	});
771	}
772
773	template<typename ChildFunctor>
774	void doToChildren(Node* node, const ChildFunctor& functor)
775	{
776	doToChildrenWithNode(
777	node,
778	[&functor] (Node*, Edge edge) {
779	functor(edge);
780	});
781	}
782
679	Profiler::Compilation* compilation() { return m_plan.compilation.get(); }	783	Profiler::Compilation* compilation() { return m_plan.compilation.get(); }
680		784
681	DesiredIdentifiers& identifiers() { return m_plan.identifiers; }	785	DesiredIdentifiers& identifiers() { return m_plan.identifiers; }
Lines 736-741 public: Source/JavaScriptCore/dfg/DFGGraph.h_sec2
736	Bag<SwitchData> m_switchData;	840	Bag<SwitchData> m_switchData;
737	Bag<MultiGetByOffsetData> m_multiGetByOffsetData;	841	Bag<MultiGetByOffsetData> m_multiGetByOffsetData;
738	Bag<MultiPutByOffsetData> m_multiPutByOffsetData;	842	Bag<MultiPutByOffsetData> m_multiPutByOffsetData;
		843	Bag<ObjectMaterializationData> m_objectMaterializationData;
739	Vector<InlineVariableData, 4> m_inlineVariableData;	844	Vector<InlineVariableData, 4> m_inlineVariableData;
740	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;	845	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
741	bool m_hasArguments;	846	bool m_hasArguments;

Lines 38-43 Source/JavaScriptCore/dfg/DFGNode.h_sec1
- Source/JavaScriptCore/dfg/DFGNode.h -1 / +51 lines
38	#include "DFGNodeFlags.h"	38	#include "DFGNodeFlags.h"
39	#include "DFGNodeOrigin.h"	39	#include "DFGNodeOrigin.h"
40	#include "DFGNodeType.h"	40	#include "DFGNodeType.h"
		41	#include "DFGObjectMaterializationData.h"
41	#include "DFGTransition.h"	42	#include "DFGTransition.h"
42	#include "DFGUseKind.h"	43	#include "DFGUseKind.h"
43	#include "DFGVariableAccessData.h"	44	#include "DFGVariableAccessData.h"
Lines 500-505 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec2
500	m_flags &= ~NodeClobbersWorld;	501	m_flags &= ~NodeClobbersWorld;
501	}	502	}
502		503
		504	void convertToPutByOffsetHint()
		505	{
		506	ASSERT(m_op == PutByOffset);
		507	m_op = PutByOffsetHint;
		508	m_opInfo = storageAccessData().identifierNumber;
		509	child1() = child2();
		510	child2() = child3();
		511	child3() = Edge();
		512	}
		513
		514	void convertToPutStructureHint(Node* structure)
		515	{
		516	ASSERT(m_op == PutStructure);
		517	ASSERT(structure->structure() == transition()->next);
		518	m_op = PhantomPutStructure;
		519	m_opInfo = 0;
		520	child2() = Edge(structure, KnownCellUse);
		521	}
		522
		523	void convertToPhantomNewObject()
		524	{
		525	ASSERT(m_op == NewObject \|\| m_op == MaterializeNewObject);
		526	m_op = PhantomNewObject;
		527	m_flags &= ~NodeHasVarArgs;
		528	m_opInfo = 0;
		529	m_opInfo2 = 0;
		530	children = AdjacencyList();
		531	}
		532
503	void convertToPhantomLocal()	533	void convertToPhantomLocal()
504	{	534	{
505	ASSERT(m_op == Phantom && (child1()->op() == Phi \|\| child1()->op() == SetLocal \|\| child1()->op() == SetArgument));	535	ASSERT(m_op == Phantom && (child1()->op() == Phi \|\| child1()->op() == SetLocal \|\| child1()->op() == SetArgument));
Lines 704-709 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec3
704	case PutById:	734	case PutById:
705	case PutByIdFlush:	735	case PutByIdFlush:
706	case PutByIdDirect:	736	case PutByIdDirect:
		737	case PutByOffsetHint:
707	return true;	738	return true;
708	default:	739	default:
709	return false;	740	return false;
Lines 1105-1110 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec4
1105	{	1136	{
1106	switch (op()) {	1137	switch (op()) {
1107	case PutStructure:	1138	case PutStructure:
		1139	case PutStructureHint:
1108	case AllocatePropertyStorage:	1140	case AllocatePropertyStorage:
1109	case ReallocatePropertyStorage:	1141	case ReallocatePropertyStorage:
1110	return true;	1142	return true;
Lines 1141-1146 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec5
1141	case ArrayifyToStructure:	1173	case ArrayifyToStructure:
1142	case NewObject:	1174	case NewObject:
1143	case NewStringObject:	1175	case NewStringObject:
		1176	case PhantomStructure:
1144	return true;	1177	return true;
1145	default:	1178	default:
1146	return false;	1179	return false;
Lines 1155-1161 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec6
1155		1188
1156	bool hasStorageAccessData()	1189	bool hasStorageAccessData()
1157	{	1190	{
1158	return op() == GetByOffset \|\| op() == GetGetterSetterByOffset \|\| op() == PutByOffset;	1191	switch (op()) {
		1192	case GetByOffset:
		1193	case PutByOffset:
		1194	case GetGetterSetterByOffset:
		1195	return true;
		1196	default:
		1197	return false;
		1198	}
1159	}	1199	}
1160		1200
1161	StorageAccessData& storageAccessData()	1201	StorageAccessData& storageAccessData()
Lines 1184-1189 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec7
1184	return reinterpret_cast<MultiPutByOffsetData>(m_opInfo);	1224	return reinterpret_cast<MultiPutByOffsetData>(m_opInfo);
1185	}	1225	}
1186		1226
		1227	bool hasObjectMaterializationData()
		1228	{
		1229	return op() == MaterializeNewObject;
		1230	}
		1231
		1232	ObjectMaterializationData& objectMaterializationData()
		1233	{
		1234	return reinterpret_cast<ObjectMaterializationData>(m_opInfo);
		1235	}
		1236
1187	bool hasFunctionDeclIndex()	1237	bool hasFunctionDeclIndex()
1188	{	1238	{
1189	return op() == NewFunction	1239	return op() == NewFunction

Lines 32-37 Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h_sec1
- Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h +2 lines
32	#include "DFGBranchDirection.h"	32	#include "DFGBranchDirection.h"
33	#include "DFGGraph.h"	33	#include "DFGGraph.h"
34	#include "DFGNode.h"	34	#include "DFGNode.h"
		35	#include "DFGPhiChildren.h"
35		36
36	namespace JSC { namespace DFG {	37	namespace JSC { namespace DFG {
37		38
Lines 195-200 private: Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h_sec2
195	CodeBlock* m_codeBlock;	196	CodeBlock* m_codeBlock;
196	Graph& m_graph;	197	Graph& m_graph;
197	AbstractStateType& m_state;	198	AbstractStateType& m_state;
		199	std::unique_ptr<PhiChildren> m_phiChildren;
198	};	200	};
199		201
200	} } // namespace JSC::DFG	202	} } // namespace JSC::DFG

Line 0 Source/JavaScriptCore/dfg/DFGAvailabilityMap.cpp_sec1
- Source/JavaScriptCore/dfg/DFGAvailabilityMap.cpp +86 lines
		1	/*
		2	* Copyright (C) 2014 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "DFGAvailabilityMap.h"
		28
		29	#if ENABLE(DFG_JIT)
		30
		31	#include <wtf/ListDump.h>
		32
		33	namespace JSC { namespace DFG {
		34
		35	void AvailabilityMap::prune()
		36	{
		37	HashSet<Node*> possibleNodes;
		38
		39	for (unsigned i = m_locals.size(); i--;) {
		40	if (m_locals[i].hasNode())
		41	possibleNodes.add(m_locals[i].node());
		42	}
		43
		44	unsigned oldPossibleNodesSize;
		45	do {
		46	oldPossibleNodesSize = possibleNodes.size();
		47	for (auto pair : m_heap) {
		48	if (pair.value.hasNode() && possibleNodes.contains(pair.key.base()))
		49	possibleNodes.add(pair.value.node());
		50	}
		51	} while (oldPossibleNodesSize != possibleNodes.size());
		52
		53	HashMap<PromotedHeapLocation, Availability> newHeap;
		54	for (auto pair : m_heap) {
		55	if (possibleNodes.contains(pair.key.base()))
		56	newHeap.add(pair.key, pair.value);
		57	}
		58	m_heap = newHeap;
		59	}
		60
		61	void AvailabilityMap::dump(PrintStream& out) const
		62	{
		63	out.print("{locals = ", m_locals, "; heap = ", mapDump(m_heap), "}");
		64	}
65
66	bool AvailabilityMap::operator==(const AvailabilityMap& other) const
67	{
68	return m_locals == other.m_locals
69	&& m_heap == other.m_heap;
70	}
71
72	void AvailabilityMap::merge(const AvailabilityMap& other)
73	{
74	for (unsigned i = other.m_locals.size(); i--;)
75	locals[i] = other.m_locals[i].merge(locals[i]);
76
77	for (auto pair : other.m_heap) {
78	auto result = m_heap.add(pair.key, Availability());
79	result.iterator->value = pair.value.merge(result.iterator->value);
80	}
81	}
82
83	} } // namespace JSC::DFG
84
85	#endif // ENABLE(DFG_JIT)
86

Lines 118-126 void BasicBlock::dump(PrintStream& out) Source/JavaScriptCore/dfg/DFGBasicBlock.cpp_sec1
- Source/JavaScriptCore/dfg/DFGBasicBlock.cpp -2 / +2 lines
118	}	118	}
119		119
120	BasicBlock::SSAData::SSAData(BasicBlock* block)	120	BasicBlock::SSAData::SSAData(BasicBlock* block)
121	: availabilityAtHead(OperandsLike, block->variablesAtHead)
122	, availabilityAtTail(OperandsLike, block->variablesAtHead)
123	{	121	{
		122	m_availabilityAtHead.m_locals = Operands<Availability>(OperandsLike, block->variablesAtHead);
		123	m_availabilityAtTail.m_locals = Operands<Availability>(OperandsLike, block->variablesAtHead);
124	}	124	}
125		125
126	BasicBlock::SSAData::~SSAData() { }	126	BasicBlock::SSAData::~SSAData() { }

Line 0 Source/JavaScriptCore/dfg/DFGInsertOSRHintsForUpdate.cpp_sec1
- Source/JavaScriptCore/dfg/DFGInsertOSRHintsForUpdate.cpp +58 lines
	1	/*
	2	* Copyright (C) 2014 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "DFGInsertOSRHintsForUpdate.h"
	28
	29	#if ENABLE(DFG_JIT)
	30
	31	namespace JSC { namespace DFG {
	32
	33	void insertOSRHintsForUpdate(
	34	InsertionSet& insertionSet, unsigned nodeIndex, AvailabilityMap& availability,
	35	Node* originalNode, Node* newNode)
	36	{
	37	for (unsigned i = availability.m_locals.size(); i--;) {
	38	int operand = availability.m_ocals.operandForIndex(i);
	39
	40	if (availability.m_locals[i].hasNode() && availability.m_locals[i].node() == originalNode) {
	41	insertionSet.insertNode(
	42	nodeIndex, SpecNone, MovHint, NodeOrigin(), OpInfo(operand),
	43	newNode->defaultEdge());
	44	}
	45	}
	46
	47	for (auto pair : availability.m_heap) {
	48	if (pair.value.hasNode() && pair.value.node() == originalNode) {
	49	insertionSet.insertNode(
	50	nodeIndex, pair.key.createHint(insertionSet.graph(), NodeOrigin(), newNode));
	51	}
	52	}
	53	}
	54
	55	} } // namespace JSC::DFG
	56
	57	#endif // ENABLE(DFG_JIT)
	58

Lines 49-57 public: Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.h_sec1
- Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.h -1 / +2 lines
49	~LocalOSRAvailabilityCalculator();	49	~LocalOSRAvailabilityCalculator();
50		50
51	void beginBlock(BasicBlock*);	51	void beginBlock(BasicBlock*);
		52	void endBlock(BasicBlock*); // Useful if you want to get data for the end of the block. You don't need to call this if you did beginBlock() and then executeNode() for every node.
52	void executeNode(Node*);	53	void executeNode(Node*);
53		54
54	Operands<Availability> m_availability;	55	AvailabilityMap m_availability;
55	};	56	};
56		57
57	} } // namespace JSC::DFG	58	} } // namespace JSC::DFG

Line 0 Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.h_sec1
- Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.h +47 lines
	1	/*
	2	* Copyright (C) 2014 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#ifndef DFGObjectAllocationSinkingPhase_h
	27	#define DFGObjectAllocationSinkingPhase_h
	28
	29	#if ENABLE(DFG_JIT)
	30
	31	namespace JSC { namespace DFG {
	32
	33	class Graph;
	34
	35	// Sinks object allocations down to their uses. This will sink the allocations over OSR exits, by
	36	// replacing all stores to those objects with store hints so that OSR exit can materialize the
	37	// object. This may sink allocations past returns, creating control flow paths along which the
	38	// objects are not allocated at all. Replaces all uses of the objects' fields with SSA data flow.
	39
	40	bool performObjectAllocationSinking(Graph&);
	41
	42	} } // namespace JSC::DFG
	43
	44	#endif // ENABLE(DFG_JIT)
	45
	46	#endif // DFGObjectAllocationSinkingPhase_h
	47

Line 0 Source/JavaScriptCore/dfg/DFGObjectMaterializationData.cpp_sec1
- Source/JavaScriptCore/dfg/DFGObjectMaterializationData.cpp +58 lines
	1	/*
	2	* Copyright (C) 2014 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "DFGObjectMaterializationData.h"
	28
	29	namespace JSC { namespace DFG {
	30
	31	void PhantomPropertyValue::dump(PrintStream& out) const
	32	{
	33	out.print("id", m_identifierNumber);
	34	}
	35
	36	void ObjectMaterializationData::dump(PrintStream& out) const
	37	{
	38	out.print("[", listDump(m_properties), "]");
	39	}
	40
	41	float ObjectMaterializationData::oneWaySimilarityScore(
	42	const ObjectMaterializationData& other) const
	43	{
	44	unsigned numHits = 0;
	45	for (PhantomPropertyValue value : m_properties) {
	46	if (other.m_properties.contains(value))
	47	numHits++;
	48	}
	49	return static_cast<float>(numHits) / static_cast<float>(m_properties.size());
	50	}
	51
	52	float ObjectMaterializationData::similarityScore(const ObjectMaterializationData& other) const
	53	{
	54	return std::min(oneWaySimilarityScore(other), other.oneWaySimilarityScore(*this));
	55	}
	56
	57	} } // namespace JSC::DFG
	58

Line 0 Source/JavaScriptCore/dfg/DFGPhiChildren.cpp_sec1
- Source/JavaScriptCore/dfg/DFGPhiChildren.cpp +61 lines
	1	/*
	2	* Copyright (C) 2014 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "DFGPhiChildren.h"
	28
	29	#if ENABLE(DFG_JIT)
	30
	31	namespace JSC { namespace DFG {
	32
	33	PhiChildren::PhiChildren()
	34	{
	35	}
	36
	37	PhiChildren::PhiChildren(Graph& graph)
	38	{
	39	for (BasicBlock* block : graph.blocksInNaturalOrder()) {
	40	for (Node* node : *block) {
	41	if (node->op() != Upsilon)
	42	continue;
	43
	44	m_children.add(node->phi(), List()).iterator->value.append(node);
	45	}
	46	}
	47	}
	48
	49	PhiChildren::~PhiChildren()
	50	{
	51	}
	52
	53	const PhiChildren::List& PhiChildren::childrenOf(Node* node) const
	54	{
	55	return m_children.get(node);
	56	}
	57
	58	} } // namespace JSC::DFG
	59
	60	#endif // ENABLE(DFG_JIT)
	61

Line 0 Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp_sec1
- Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp +86 lines
		1	/*
		2	* Copyright (C) 2014 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "DFGPromotedHeapLocation.h"
		28
		29	#if ENABLE(DFG_JIT)
		30
		31	namespace JSC { namespace DFG {
		32
		33	Node* PromotedHeapLocation::createHint(Graph& graph, NodeOrigin origin, Node* value)
		34	{
		35	switch (kind()) {
		36	case StructurePLoc:
		37	return graph.addNode(
		38	SpecNone, PutStructureHint, origin,
		39	Edge(base(), KnownCellUse), value);
		40
		41	case NamedPropertyPLoc:
		42	return graph.addNode(
		43	SpecNone, PutByOffsetHint, origin,
		44	OpInfo(location.info()), Edge(base(), KnownCellUse), value);
		45
		46	case InvalidPromotedLocationKind:
		47	return nullptr;
		48	}
		49
		50	RELEASE_ASSERT_NOT_REACHED();
		51	}
		52
		53	void PromotedHeapLocation::dump(PrintStream& out) const
		54	{
		55	out.print(m_kind, "(", m_base, ", ", m_info, ")");
		56	}
		57
		58	} } // namespace JSC::DFG
		59
		60	namespace WTF {
		61
		62	using namespace JSC::DFG;
		63
		64	void printInternal(PrintStream& out, PromotedLocationKind kind)
65	{
66	switch (kind) {
67	case InvalidPromotedLocationKind:
68	out.print("InvalidPromotedLocationKind");
69	return;
70
71	case StructurePLoc:
72	out.print("StructurePLoc");
73	return;
74
75	case NamedPropertyPLoc:
76	out.print("NamedPropertyPLoc");
77	return;
78	}
79
80	RELEASE_ASSERT_NOT_REACHED();
81	}
82
83	} // namespace WTF;
84
85	#endif // ENABLE(DFG_JIT)
86

Lines 66-71 SSACalculator::~SSACalculator() Source/JavaScriptCore/dfg/DFGSSACalculator.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSSACalculator.cpp +11 lines
66	{	66	{
67	}	67	}
68		68
		69	void SSACalculator::reset()
		70	{
		71	m_variables.clear();
		72	m_defs.clear();
		73	m_phis.clear();
		74	for (BlockIndex blockIndex = m_data.size(); blockIndex--;) {
		75	m_data[blockIndex].m_defs.clear();
		76	m_data[blockIndex].m_phis.clear();
		77	}
		78	}
		79
69	SSACalculator::Variable* SSACalculator::newVariable()	80	SSACalculator::Variable* SSACalculator::newVariable()
70	{	81	{
71	return &m_variables.alloc(Variable(m_variables.size()));	82	return &m_variables.alloc(Variable(m_variables.size()));

Line 0 Source/JavaScriptCore/ftl/FTLExitPropertyValue.cpp_sec1
- Source/JavaScriptCore/ftl/FTLExitPropertyValue.cpp +41 lines
	1	/*
	2	* Copyright (C) 2014 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "FTLExitPropertyValue.h"
	28
	29	#if ENABLE(FTL_JIT)
	30
	31	namespace JSC { namespace FTL {
	32
	33	void ExitPropertyValue::dump(PrintStream& out) const
	34	{
	35	out.print(m_uid, " => ", m_value);
	36	}
	37
	38	} } // namespace JSC::FTL
	39
	40	#endif // ENABLE(FTL_JIT)
	41

Line 0 Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.cpp_sec1
- Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.cpp +45 lines
	1	/*
	2	* Copyright (C) 2014 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "FTLExitTimeObjectMaterialization.h"
	28
	29	#if ENABLE(FTL_JIT)
	30
	31	namespace JSC { namespace FTL {
	32
	33	ExitTimeObjectMaterialization::~ExitTimeObjectMaterialization()
	34	{
	35	}
	36
	37	void ExitTimeObjectMaterialization::dump(PrintStream& out) const
	38	{
	39	out.print("<new Object: structure => ", m_structure, ", {", listDump(m_properties), "}>");
	40	}
	41
	42	} } // namespace JSC::FTL
	43
	44	#endif // ENABLE(FTL_JIT)
	45

Lines 46-51 namespace JSC { namespace FTL { Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp_sec1
- Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp -74 / +81 lines
46		46
47	using namespace DFG;	47	using namespace DFG;
48		48
		49	static void compileRecovery(
		50	CCallHeleprs& jit, const ExitValue& value, StackMaps::Record* record, StackMaps& stackmaps,
		51	char *registerScratch)
		52	{
		53	switch (value.kind()) {
		54	case ExitValueDead:
		55	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), GPRInfo::regT0);
		56	break;
		57
		58	case ExitValueConstant:
		59	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(value.constant())), GPRInfo::regT0);
		60	break;
		61
		62	case ExitValueArgument:
		63	record->locations[value.exitArgument().argument()].restoreInto(
		64	jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
		65	break;
		66
		67	case ExitValueInJSStack:
		68	case ExitValueInJSStackAsInt32:
		69	case ExitValueInJSStackAsInt52:
		70	case ExitValueInJSStackAsDouble:
		71	jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
		72	break;
		73
		74	case ExitValueArgumentsObjectThatWasNotCreated:
		75	// We can't actually recover this yet, but we can make the stack look sane. This is
		76	// a prerequisite to running the actual arguments recovery.
		77	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(JSValue())), GPRInfo::regT0);
		78	break;
		79
		80	case ExitValueRecovery:
		81	record->locations[value.rightRecoveryArgument()].restoreInto(
		82	jit, jitCode->stackmaps, registerScratch, GPRInfo::regT1);
		83	record->locations[value.leftRecoveryArgument()].restoreInto(
		84	jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
		85	switch (value.recoveryOpcode()) {
		86	case AddRecovery:
		87	switch (value.recoveryFormat()) {
		88	case ValueFormatInt32:
		89	jit.add32(GPRInfo::regT1, GPRInfo::regT0);
		90	break;
		91	case ValueFormatInt52:
		92	jit.add64(GPRInfo::regT1, GPRInfo::regT0);
		93	break;
		94	default:
		95	RELEASE_ASSERT_NOT_REACHED();
		96	break;
		97	}
		98	break;
		99	case SubRecovery:
		100	switch (value.recoveryFormat()) {
		101	case ValueFormatInt32:
		102	jit.sub32(GPRInfo::regT1, GPRInfo::regT0);
		103	break;
		104	case ValueFormatInt52:
		105	jit.sub64(GPRInfo::regT1, GPRInfo::regT0);
		106	break;
		107	default:
		108	RELEASE_ASSERT_NOT_REACHED();
		109	break;
		110	}
		111	break;
		112	default:
113	RELEASE_ASSERT_NOT_REACHED();
114	break;
115	}
116	break;
117
118	default:
119	RELEASE_ASSERT_NOT_REACHED();
120	break;
121	}
122
123	reboxAccordingToFormat(
124	value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
125	}
126
49	static void compileStub(	127	static void compileStub(
50	unsigned exitID, JITCode* jitCode, OSRExit& exit, VM* vm, CodeBlock* codeBlock)	128	unsigned exitID, JITCode* jitCode, OSRExit& exit, VM* vm, CodeBlock* codeBlock)
51	{	129	{
Lines 125-204 static void compileStub( Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp_sec2
125	// the scratch buffer. This also does the reboxing.	203	// the scratch buffer. This also does the reboxing.
126		204
127	for (unsigned index = exit.m_values.size(); index--;) {	205	for (unsigned index = exit.m_values.size(); index--;) {
128	ExitValue value = exit.m_values[index];	206	ExitValue& value = exit.m_values[index];
129		207
130	switch (value.kind()) {	208	compileRecovery(jit, value, record, jitCode->stackmaps, registerScratch);
131	case ExitValueDead:
132	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), GPRInfo::regT0);
133	break;
134
135	case ExitValueConstant:
136	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(value.constant())), GPRInfo::regT0);
137	break;
138
139	case ExitValueArgument:
140	record->locations[value.exitArgument().argument()].restoreInto(
141	jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
142	break;
143
144	case ExitValueInJSStack:
145	case ExitValueInJSStackAsInt32:
146	case ExitValueInJSStackAsInt52:
147	case ExitValueInJSStackAsDouble:
148	jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
149	break;
150
151	case ExitValueArgumentsObjectThatWasNotCreated:
152	// We can't actually recover this yet, but we can make the stack look sane. This is
153	// a prerequisite to running the actual arguments recovery.
154	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(JSValue())), GPRInfo::regT0);
155	break;
156
157	case ExitValueRecovery:
158	record->locations[value.rightRecoveryArgument()].restoreInto(
159	jit, jitCode->stackmaps, registerScratch, GPRInfo::regT1);
160	record->locations[value.leftRecoveryArgument()].restoreInto(
161	jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
162	switch (value.recoveryOpcode()) {
163	case AddRecovery:
164	switch (value.recoveryFormat()) {
165	case ValueFormatInt32:
166	jit.add32(GPRInfo::regT1, GPRInfo::regT0);
167	break;
168	case ValueFormatInt52:
169	jit.add64(GPRInfo::regT1, GPRInfo::regT0);
170	break;
171	default:
172	RELEASE_ASSERT_NOT_REACHED();
173	break;
174	}
175	break;
176	case SubRecovery:
177	switch (value.recoveryFormat()) {
178	case ValueFormatInt32:
179	jit.sub32(GPRInfo::regT1, GPRInfo::regT0);
180	break;
181	case ValueFormatInt52:
182	jit.sub64(GPRInfo::regT1, GPRInfo::regT0);
183	break;
184	default:
185	RELEASE_ASSERT_NOT_REACHED();
186	break;
187	}
188	break;
189	default:
190	RELEASE_ASSERT_NOT_REACHED();
191	break;
192	}
193	break;
194
195	default:
196	RELEASE_ASSERT_NOT_REACHED();
197	break;
198	}
199
200	reboxAccordingToFormat(
201	value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
202		209
203	jit.store64(GPRInfo::regT0, scratch + index);	210	jit.store64(GPRInfo::regT0, scratch + index);
204	}	211	}

Lines 46-62 private: Source/WTF/wtf/Bag.h_sec1
- Source/WTF/wtf/Bag.h -1 / +7 lines
46		46
47	public:	47	public:
48	Bag()	48	Bag()
49	: m_head(0)	49	: m_head(nullptr)
50	{	50	{
51	}	51	}
52		52
53	~Bag()	53	~Bag()
54	{	54	{
		55	clear();
		56	}
		57
		58	void clear()
		59	{
55	while (m_head) {	60	while (m_head) {
56	Node* current = m_head;	61	Node* current = m_head;
57	m_head = current->m_next;	62	m_head = current->m_next;
58	delete current;	63	delete current;
59	}	64	}
		65	m_head = nullptr;
60	}	66	}
61		67
62	template<typename... Args>	68	template<typename... Args>