Attachment #238629 for bug #136330

View Details Raw Unified Return to Bug 136330

| Differences between

and this patch



2014-09-24  Filip Pizlo  <fpizlo@apple.com>

        FTL should sink object allocations
        https://bugs.webkit.org/show_bug.cgi?id=136330

        Reviewed by NOBODY (OOPS!).
        
        Work in progress.

        * CMakeLists.txt:
        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/StructureSet.h:
        (JSC::StructureSet::iterator::iterator):
        (JSC::StructureSet::iterator::operator*):
        (JSC::StructureSet::iterator::operator++):
        (JSC::StructureSet::iterator::operator==):
        (JSC::StructureSet::iterator::operator!=):
        (JSC::StructureSet::begin):
        (JSC::StructureSet::end):
        * dfg/DFGAbstractInterpreter.h:
        (JSC::DFG::AbstractInterpreter::phiChildren):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::AbstractInterpreter):
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGAvailability.h:
        (JSC::DFG::Availability::shouldUseNode):
        (JSC::DFG::Availability::isFlushUseful):
        (JSC::DFG::Availability::isDead):
        * dfg/DFGAvailabilityMap.cpp: Added.
        (JSC::DFG::AvailabilityMap::prune):
        (JSC::DFG::AvailabilityMap::dump):
        (JSC::DFG::AvailabilityMap::operator==):
        (JSC::DFG::AvailabilityMap::merge):
        * dfg/DFGAvailabilityMap.h: Added.
        (JSC::DFG::AvailabilityMap::forEachAvailability):
        * dfg/DFGBasicBlock.cpp:
        (JSC::DFG::BasicBlock::SSAData::SSAData):
        * dfg/DFGBasicBlock.h:
        (JSC::DFG::BasicBlock::begin):
        (JSC::DFG::BasicBlock::end):
        (JSC::DFG::BasicBlock::SuccessorsIterable::SuccessorsIterable):
        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::iterator):
        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator*):
        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator++):
        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator==):
        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator!=):
        (JSC::DFG::BasicBlock::SuccessorsIterable::begin):
        (JSC::DFG::BasicBlock::SuccessorsIterable::end):
        (JSC::DFG::BasicBlock::successors):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::mergeRelevantToOSR):
        * dfg/DFGGraph.h:
        (JSC::DFG::Graph::NaturalBlockIterable::NaturalBlockIterable):
        (JSC::DFG::Graph::NaturalBlockIterable::iterator::iterator):
        (JSC::DFG::Graph::NaturalBlockIterable::iterator::operator*):
        (JSC::DFG::Graph::NaturalBlockIterable::iterator::operator++):
        (JSC::DFG::Graph::NaturalBlockIterable::iterator::operator==):
        (JSC::DFG::Graph::NaturalBlockIterable::iterator::operator!=):
        (JSC::DFG::Graph::NaturalBlockIterable::iterator::findNext):
        (JSC::DFG::Graph::NaturalBlockIterable::begin):
        (JSC::DFG::Graph::NaturalBlockIterable::end):
        (JSC::DFG::Graph::blocksInNaturalOrder):
        (JSC::DFG::Graph::doToChildrenWithNode):
        (JSC::DFG::Graph::doToChildEdges):
        (JSC::DFG::Graph::doToChildren):
        * dfg/DFGHeapLocation.cpp:
        (WTF::printInternal):
        * dfg/DFGHeapLocation.h:
        * dfg/DFGInsertOSRHintsForUpdate.cpp: Added.
        (JSC::DFG::insertOSRHintsForUpdate):
        * dfg/DFGInsertOSRHintsForUpdate.h: Added.
        * dfg/DFGInsertionSet.h:
        (JSC::DFG::InsertionSet::graph):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::convertToPutByOffsetHint):
        (JSC::DFG::Node::convertToPutStructureHint):
        (JSC::DFG::Node::convertToPhantomNewObject):
        (JSC::DFG::Node::isCellConstant):
        (JSC::DFG::Node::hasIdentifier):
        (JSC::DFG::Node::hasTransition):
        (JSC::DFG::Node::hasStorageAccessData):
        (JSC::DFG::Node::hasObjectMaterializationData):
        (JSC::DFG::Node::objectMaterializationData):
        (JSC::DFG::Node::isPhantomObjectAllocation):
        * dfg/DFGNodeType.h:
        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
        (JSC::DFG::LocalOSRAvailabilityCalculator::endBlock):
        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
        * dfg/DFGOSRAvailabilityAnalysisPhase.h:
        * dfg/DFGObjectAllocationSinkingPhase.cpp: Added.
        (JSC::DFG::ObjectAllocationSinkingPhase::ObjectAllocationSinkingPhase):
        (JSC::DFG::ObjectAllocationSinkingPhase::run):
        (JSC::DFG::ObjectAllocationSinkingPhase::performSinking):
        (JSC::DFG::ObjectAllocationSinkingPhase::pruneSinkingCandidates):
        (JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints):
        (JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
        (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
        (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
        (JSC::DFG::ObjectAllocationSinkingPhase::resolve):
        (JSC::DFG::ObjectAllocationSinkingPhase::doNothing):
        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
        (JSC::DFG::ObjectAllocationSinkingPhase::createMaterialize):
        (JSC::DFG::ObjectAllocationSinkingPhase::populateMaterialize):
        (JSC::DFG::performObjectAllocationSinking):
        * dfg/DFGObjectAllocationSinkingPhase.h: Added.
        * dfg/DFGObjectMaterializationData.cpp: Added.
        (JSC::DFG::PhantomPropertyValue::dump):
        (JSC::DFG::ObjectMaterializationData::dump):
        (JSC::DFG::ObjectMaterializationData::oneWaySimilarityScore):
        (JSC::DFG::ObjectMaterializationData::similarityScore):
        * dfg/DFGObjectMaterializationData.h: Added.
        (JSC::DFG::PhantomPropertyValue::PhantomPropertyValue):
        (JSC::DFG::PhantomPropertyValue::operator==):
        * dfg/DFGPhantomCanonicalizationPhase.cpp:
        (JSC::DFG::PhantomCanonicalizationPhase::run):
        * dfg/DFGPhantomRemovalPhase.cpp:
        (JSC::DFG::PhantomRemovalPhase::run):
        * dfg/DFGPhiChildren.cpp: Added.
        (JSC::DFG::PhiChildren::PhiChildren):
        (JSC::DFG::PhiChildren::~PhiChildren):
        (JSC::DFG::PhiChildren::childrenOf):
        * dfg/DFGPhiChildren.h: Added.
        (JSC::DFG::PhiChildren::forAllIncomingValues):
        (JSC::DFG::PhiChildren::forAllTransitiveIncomingValues):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::compileInThreadImpl):
        * dfg/DFGPredictionPropagationPhase.cpp:
        (JSC::DFG::PredictionPropagationPhase::propagate):
        * dfg/DFGPromotedHeapLocation.cpp: Added.
        (JSC::DFG::BaselessPromotedHeapLocation::dump):
        (JSC::DFG::PromotedHeapLocation::createHint):
        (JSC::DFG::PromotedHeapLocation::dump):
        (WTF::printInternal):
        * dfg/DFGPromotedHeapLocation.h: Added.
        (JSC::DFG::BaselessPromotedHeapLocation::BaselessPromotedHeapLocation):
        (JSC::DFG::BaselessPromotedHeapLocation::operator!):
        (JSC::DFG::BaselessPromotedHeapLocation::kind):
        (JSC::DFG::BaselessPromotedHeapLocation::info):
        (JSC::DFG::BaselessPromotedHeapLocation::hash):
        (JSC::DFG::BaselessPromotedHeapLocation::operator==):
        (JSC::DFG::BaselessPromotedHeapLocation::isHashTableDeletedValue):
        (JSC::DFG::PromotedHeapLocation::PromotedHeapLocation):
        (JSC::DFG::PromotedHeapLocation::PromotedHeapLocaftion):
        (JSC::DFG::PromotedHeapLocation::operator!):
        (JSC::DFG::PromotedHeapLocation::kind):
        (JSC::DFG::PromotedHeapLocation::base):
        (JSC::DFG::PromotedHeapLocation::info):
        (JSC::DFG::PromotedHeapLocation::baseless):
        (JSC::DFG::PromotedHeapLocation::hash):
        (JSC::DFG::PromotedHeapLocation::operator==):
        (JSC::DFG::PromotedHeapLocation::isHashTableDeletedValue):
        (JSC::DFG::promote):
        (JSC::DFG::PromotedHeapLocationHash::hash):
        (JSC::DFG::PromotedHeapLocationHash::equal):
        * dfg/DFGSSACalculator.cpp:
        (JSC::DFG::SSACalculator::reset):
        * dfg/DFGSSACalculator.h:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLExitPropertyValue.cpp: Added.
        (JSC::FTL::ExitPropertyValue::dump):
        * ftl/FTLExitPropertyValue.h: Added.
        (JSC::FTL::ExitPropertyValue::ExitPropertyValue):
        (JSC::FTL::ExitPropertyValue::operator!):
        (JSC::FTL::ExitPropertyValue::location):
        (JSC::FTL::ExitPropertyValue::value):
        * ftl/FTLExitTimeObjectMaterialization.cpp: Added.
        (JSC::FTL::ExitTimeObjectMaterialization::ExitTimeObjectMaterialization):
        (JSC::FTL::ExitTimeObjectMaterialization::~ExitTimeObjectMaterialization):
        (JSC::FTL::ExitTimeObjectMaterialization::add):
        (JSC::FTL::ExitTimeObjectMaterialization::get):
        (JSC::FTL::ExitTimeObjectMaterialization::dump):
        * ftl/FTLExitTimeObjectMaterialization.h: Added.
        (JSC::FTL::ExitTimeObjectMaterialization::type):
        (JSC::FTL::ExitTimeObjectMaterialization::properties):
        * ftl/FTLExitValue.cpp:
        (JSC::FTL::ExitValue::materializeNewObject):
        (JSC::FTL::ExitValue::dumpInContext):
        * ftl/FTLExitValue.h:
        (JSC::FTL::ExitValue::isObjectMaterialization):
        (JSC::FTL::ExitValue::objectMaterialization):
        (JSC::FTL::ExitValue::withVirtualRegister):
        (JSC::FTL::ExitValue::valueFormat):
        * ftl/FTLLowerDFGToLLVM.cpp:
        (JSC::FTL::LowerDFGToLLVM::compileNode):
        (JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
        (JSC::FTL::LowerDFGToLLVM::compileNewObject):
        (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
        (JSC::FTL::LowerDFGToLLVM::compileInvalidationPoint):
        (JSC::FTL::LowerDFGToLLVM::compileCheckStructureImmediate):
        (JSC::FTL::LowerDFGToLLVM::compileMaterializeNewObject):
        (JSC::FTL::LowerDFGToLLVM::checkStructure):
        (JSC::FTL::LowerDFGToLLVM::allocatePropertyStorage):
        (JSC::FTL::LowerDFGToLLVM::reallocatePropertyStorage):
        (JSC::FTL::LowerDFGToLLVM::allocatePropertyStorageWithSizeImpl):
        (JSC::FTL::LowerDFGToLLVM::allocateCell):
        (JSC::FTL::LowerDFGToLLVM::storeStructure):
        (JSC::FTL::LowerDFGToLLVM::allocateObject):
        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
        (JSC::FTL::LowerDFGToLLVM::exitValueForAvailability):
        (JSC::FTL::LowerDFGToLLVM::exitValueForNode):
        (JSC::FTL::LowerDFGToLLVM::availabilityMap):
        (JSC::FTL::LowerDFGToLLVM::availability): Deleted.
        * ftl/FTLOSRExit.h:
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileRecovery):
        (JSC::FTL::compileStub):
        * ftl/FTLOperations.cpp: Added.
        (JSC::FTL::operationNewObjectWithButterfly):
        (JSC::FTL::operationMaterializeObjectInOSR):
        * ftl/FTLOperations.h: Added.
        * runtime/JSObject.h:
        (JSC::JSFinalObject::JSFinalObject):
        (JSC::JSFinalObject::create):
        * runtime/Structure.cpp:
        (JSC::Structure::canUseForAllocationsOf):
        * runtime/Structure.h:

2014-09-21  Filip Pizlo  <fpizlo@apple.com>

        FTL should store the four bytes of the cell header using a 32-bit store rather than four 8-bit stores

Lines 122-127 set(JavaScriptCore_SOURCES Source/JavaScriptCore/CMakeLists.txt_sec1
- Source/JavaScriptCore/CMakeLists.txt +9 lines
122	dfg/DFGArrayMode.cpp	122	dfg/DFGArrayMode.cpp
123	dfg/DFGAtTailAbstractState.cpp	123	dfg/DFGAtTailAbstractState.cpp
124	dfg/DFGAvailability.cpp	124	dfg/DFGAvailability.cpp
		125	dfg/DFGAvailabilityMap.cpp
125	dfg/DFGBackwardsPropagationPhase.cpp	126	dfg/DFGBackwardsPropagationPhase.cpp
126	dfg/DFGBasicBlock.cpp	127	dfg/DFGBasicBlock.cpp
127	dfg/DFGBinarySwitch.cpp	128	dfg/DFGBinarySwitch.cpp
Lines 164-169 set(JavaScriptCore_SOURCES Source/JavaScriptCore/CMakeLists.txt_sec2
164	dfg/DFGGraphSafepoint.cpp	165	dfg/DFGGraphSafepoint.cpp
165	dfg/DFGHeapLocation.cpp	166	dfg/DFGHeapLocation.cpp
166	dfg/DFGInPlaceAbstractState.cpp	167	dfg/DFGInPlaceAbstractState.cpp
		168	dfg/DFGInsertOSRHintsForUpdate.cpp
167	dfg/DFGIntegerCheckCombiningPhase.cpp	169	dfg/DFGIntegerCheckCombiningPhase.cpp
168	dfg/DFGInvalidationPointInjectionPhase.cpp	170	dfg/DFGInvalidationPointInjectionPhase.cpp
169	dfg/DFGJITCode.cpp	171	dfg/DFGJITCode.cpp
Lines 192-204 set(JavaScriptCore_SOURCES Source/JavaScriptCore/CMakeLists.txt_sec3
192	dfg/DFGOSRExitCompilerCommon.cpp	194	dfg/DFGOSRExitCompilerCommon.cpp
193	dfg/DFGOSRExitJumpPlaceholder.cpp	195	dfg/DFGOSRExitJumpPlaceholder.cpp
194	dfg/DFGOSRExitPreparation.cpp	196	dfg/DFGOSRExitPreparation.cpp
		197	dfg/DFGObjectAllocationSinkingPhase.cpp
		198	dfg/DFGObjectMaterializationData.cpp
195	dfg/DFGOperations.cpp	199	dfg/DFGOperations.cpp
196	dfg/DFGPhantomCanonicalizationPhase.cpp	200	dfg/DFGPhantomCanonicalizationPhase.cpp
197	dfg/DFGPhantomRemovalPhase.cpp	201	dfg/DFGPhantomRemovalPhase.cpp
198	dfg/DFGPhase.cpp	202	dfg/DFGPhase.cpp
		203	dfg/DFGPhiChildren.cpp
199	dfg/DFGPlan.cpp	204	dfg/DFGPlan.cpp
200	dfg/DFGPredictionInjectionPhase.cpp	205	dfg/DFGPredictionInjectionPhase.cpp
201	dfg/DFGPredictionPropagationPhase.cpp	206	dfg/DFGPredictionPropagationPhase.cpp
		207	dfg/DFGPromotedHeapLocation.cpp
202	dfg/DFGPureValue.cpp	208	dfg/DFGPureValue.cpp
203	dfg/DFGResurrectionForValidationPhase.cpp	209	dfg/DFGResurrectionForValidationPhase.cpp
204	dfg/DFGSSACalculator.cpp	210	dfg/DFGSSACalculator.cpp
Lines 774-780 if (ENABLE_FTL_JIT) Source/JavaScriptCore/CMakeLists.txt_sec4
774	ftl/FTLDataSection.cpp	780	ftl/FTLDataSection.cpp
775	ftl/FTLExitArgument.cpp	781	ftl/FTLExitArgument.cpp
776	ftl/FTLExitArgumentForOperand.cpp	782	ftl/FTLExitArgumentForOperand.cpp
		783	ftl/FTLExitPropertyValue.cpp
777	ftl/FTLExitThunkGenerator.cpp	784	ftl/FTLExitThunkGenerator.cpp
		785	ftl/FTLExitTimeObjectMaterialization.cpp
778	ftl/FTLExitValue.cpp	786	ftl/FTLExitValue.cpp
779	ftl/FTLFail.cpp	787	ftl/FTLFail.cpp
780	ftl/FTLForOSREntryJITCode.cpp	788	ftl/FTLForOSREntryJITCode.cpp
Lines 789-794 if (ENABLE_FTL_JIT) Source/JavaScriptCore/CMakeLists.txt_sec5
789	ftl/FTLOSREntry.cpp	797	ftl/FTLOSREntry.cpp
790	ftl/FTLOSRExitCompiler.cpp	798	ftl/FTLOSRExitCompiler.cpp
791	ftl/FTLOSRExit.cpp	799	ftl/FTLOSRExit.cpp
		800	ftl/FTLOperations.cpp
792	ftl/FTLOutput.cpp	801	ftl/FTLOutput.cpp
793	ftl/FTLRecoveryOpcode.cpp	802	ftl/FTLRecoveryOpcode.cpp
794	ftl/FTLRegisterAtOffset.cpp	803	ftl/FTLRegisterAtOffset.cpp



		0F2B670917B6B5AB00A7AE3F /* TypedArrays.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66DB17B6B5AB00A7AE3F /* TypedArrays.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2B670A17B6B5AB00A7AE3F /* TypedArrayType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66DC17B6B5AB00A7AE3F /* TypedArrayType.cpp */; };
		0F2B670B17B6B5AB00A7AE3F /* TypedArrayType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66DD17B6B5AB00A7AE3F /* TypedArrayType.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2B9CE219D0BA7D00B1D1B5 /* DFGAvailabilityMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CD619D0BA7D00B1D1B5 /* DFGAvailabilityMap.cpp */; };
		0F2B9CE319D0BA7D00B1D1B5 /* DFGAvailabilityMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CD719D0BA7D00B1D1B5 /* DFGAvailabilityMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2B9CE419D0BA7D00B1D1B5 /* DFGInsertOSRHintsForUpdate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CD819D0BA7D00B1D1B5 /* DFGInsertOSRHintsForUpdate.cpp */; };
		0F2B9CE519D0BA7D00B1D1B5 /* DFGInsertOSRHintsForUpdate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CD919D0BA7D00B1D1B5 /* DFGInsertOSRHintsForUpdate.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2B9CE619D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CDA19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.cpp */; };
		0F2B9CE719D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CDB19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2B9CE819D0BA7D00B1D1B5 /* DFGObjectMaterializationData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CDC19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.cpp */; };
		0F2B9CE919D0BA7D00B1D1B5 /* DFGObjectMaterializationData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CDD19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2B9CEA19D0BA7D00B1D1B5 /* DFGPhiChildren.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CDE19D0BA7D00B1D1B5 /* DFGPhiChildren.cpp */; };
		0F2B9CEB19D0BA7D00B1D1B5 /* DFGPhiChildren.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CDF19D0BA7D00B1D1B5 /* DFGPhiChildren.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2B9CEC19D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CE019D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.cpp */; };
		0F2B9CED19D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CE119D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2B9CF419D0BAC100B1D1B5 /* FTLExitPropertyValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CEE19D0BAC100B1D1B5 /* FTLExitPropertyValue.cpp */; };
		0F2B9CF519D0BAC100B1D1B5 /* FTLExitPropertyValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CEF19D0BAC100B1D1B5 /* FTLExitPropertyValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2B9CF619D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CF019D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.cpp */; };
		0F2B9CF719D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CF119D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2B9CF819D0BAC100B1D1B5 /* FTLOperations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CF219D0BAC100B1D1B5 /* FTLOperations.cpp */; };
		0F2B9CF919D0BAC100B1D1B5 /* FTLOperations.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CF319D0BAC100B1D1B5 /* FTLOperations.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2BDC15151C5D4D00CD8910 /* DFGFixupPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC12151C5D4A00CD8910 /* DFGFixupPhase.cpp */; };
		0F2BDC16151C5D4F00CD8910 /* DFGFixupPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC13151C5D4A00CD8910 /* DFGFixupPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F2BDC21151E803B00CD8910 /* DFGInsertionSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC1F151E803800CD8910 /* DFGInsertionSet.h */; settings = {ATTRIBUTES = (Private, ); }; };

		0F3B7E2D19A12AAE00D9BC56 /* CallEdge.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3B7E2C19A12AAE00D9BC56 /* CallEdge.cpp */; };
		0F3D0BBC194A414300FC9CF9 /* ConstantStructureCheck.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3D0BBA194A414300FC9CF9 /* ConstantStructureCheck.cpp */; };
		0F3D0BBD194A414300FC9CF9 /* ConstantStructureCheck.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3D0BBB194A414300FC9CF9 /* ConstantStructureCheck.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F3E01AA19D353A500F61B7F /* DFGPrePostNumbering.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3E01A819D353A500F61B7F /* DFGPrePostNumbering.cpp */; };
		0F3E01AB19D353A500F61B7F /* DFGPrePostNumbering.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3E01A919D353A500F61B7F /* DFGPrePostNumbering.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F426A481460CBB300131F8F /* ValueRecovery.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A451460CBAB00131F8F /* ValueRecovery.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F426A491460CBB700131F8F /* VirtualRegister.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A461460CBAB00131F8F /* VirtualRegister.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0F426A4B1460CD6E00131F8F /* DataFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A4A1460CD6B00131F8F /* DataFormat.h */; settings = {ATTRIBUTES = (Private, ); }; };

		0FA7A8EB18B413C80052371D /* Reg.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA7A8E918B413C80052371D /* Reg.cpp */; };
		0FA7A8EC18B413C80052371D /* Reg.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA7A8EA18B413C80052371D /* Reg.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0FA7A8EE18CE4FD80052371D /* ScratchRegisterAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA7A8ED18CE4FD80052371D /* ScratchRegisterAllocator.cpp */; };
		0FAA3E0919D0C2CB00FAC9E2 /* DFGPromoteHeapAccess.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FAA3E0819D0C2CB00FAC9E2 /* DFGPromoteHeapAccess.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0FAF7EFD165BA91B000C8455 /* JITDisassembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FAF7EFA165BA919000C8455 /* JITDisassembler.cpp */; };
		0FAF7EFE165BA91F000C8455 /* JITDisassembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FAF7EFB165BA919000C8455 /* JITDisassembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
		0FB105851675480F00F8AB6E /* ExitKind.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB105821675480C00F8AB6E /* ExitKind.cpp */; };

		0F2B66DB17B6B5AB00A7AE3F /* TypedArrays.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypedArrays.h; sourceTree = "<group>"; };
		0F2B66DC17B6B5AB00A7AE3F /* TypedArrayType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypedArrayType.cpp; sourceTree = "<group>"; };
		0F2B66DD17B6B5AB00A7AE3F /* TypedArrayType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypedArrayType.h; sourceTree = "<group>"; };
		0F2B9CD619D0BA7D00B1D1B5 /* DFGAvailabilityMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAvailabilityMap.cpp; path = dfg/DFGAvailabilityMap.cpp; sourceTree = "<group>"; };
		0F2B9CD719D0BA7D00B1D1B5 /* DFGAvailabilityMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAvailabilityMap.h; path = dfg/DFGAvailabilityMap.h; sourceTree = "<group>"; };
		0F2B9CD819D0BA7D00B1D1B5 /* DFGInsertOSRHintsForUpdate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGInsertOSRHintsForUpdate.cpp; path = dfg/DFGInsertOSRHintsForUpdate.cpp; sourceTree = "<group>"; };
		0F2B9CD919D0BA7D00B1D1B5 /* DFGInsertOSRHintsForUpdate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInsertOSRHintsForUpdate.h; path = dfg/DFGInsertOSRHintsForUpdate.h; sourceTree = "<group>"; };
		0F2B9CDA19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGObjectAllocationSinkingPhase.cpp; path = dfg/DFGObjectAllocationSinkingPhase.cpp; sourceTree = "<group>"; };
		0F2B9CDB19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGObjectAllocationSinkingPhase.h; path = dfg/DFGObjectAllocationSinkingPhase.h; sourceTree = "<group>"; };
		0F2B9CDC19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGObjectMaterializationData.cpp; path = dfg/DFGObjectMaterializationData.cpp; sourceTree = "<group>"; };
		0F2B9CDD19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGObjectMaterializationData.h; path = dfg/DFGObjectMaterializationData.h; sourceTree = "<group>"; };
		0F2B9CDE19D0BA7D00B1D1B5 /* DFGPhiChildren.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPhiChildren.cpp; path = dfg/DFGPhiChildren.cpp; sourceTree = "<group>"; };
		0F2B9CDF19D0BA7D00B1D1B5 /* DFGPhiChildren.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPhiChildren.h; path = dfg/DFGPhiChildren.h; sourceTree = "<group>"; };
		0F2B9CE019D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPromotedHeapLocation.cpp; path = dfg/DFGPromotedHeapLocation.cpp; sourceTree = "<group>"; };
		0F2B9CE119D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPromotedHeapLocation.h; path = dfg/DFGPromotedHeapLocation.h; sourceTree = "<group>"; };
		0F2B9CEE19D0BAC100B1D1B5 /* FTLExitPropertyValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExitPropertyValue.cpp; path = ftl/FTLExitPropertyValue.cpp; sourceTree = "<group>"; };
		0F2B9CEF19D0BAC100B1D1B5 /* FTLExitPropertyValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitPropertyValue.h; path = ftl/FTLExitPropertyValue.h; sourceTree = "<group>"; };
		0F2B9CF019D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExitTimeObjectMaterialization.cpp; path = ftl/FTLExitTimeObjectMaterialization.cpp; sourceTree = "<group>"; };
		0F2B9CF119D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitTimeObjectMaterialization.h; path = ftl/FTLExitTimeObjectMaterialization.h; sourceTree = "<group>"; };
		0F2B9CF219D0BAC100B1D1B5 /* FTLOperations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLOperations.cpp; path = ftl/FTLOperations.cpp; sourceTree = "<group>"; };
		0F2B9CF319D0BAC100B1D1B5 /* FTLOperations.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLOperations.h; path = ftl/FTLOperations.h; sourceTree = "<group>"; };
		0F2BDC12151C5D4A00CD8910 /* DFGFixupPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFixupPhase.cpp; path = dfg/DFGFixupPhase.cpp; sourceTree = "<group>"; };
		0F2BDC13151C5D4A00CD8910 /* DFGFixupPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFixupPhase.h; path = dfg/DFGFixupPhase.h; sourceTree = "<group>"; };
		0F2BDC1F151E803800CD8910 /* DFGInsertionSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInsertionSet.h; path = dfg/DFGInsertionSet.h; sourceTree = "<group>"; };

		0F3B7E2C19A12AAE00D9BC56 /* CallEdge.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallEdge.cpp; sourceTree = "<group>"; };
		0F3D0BBA194A414300FC9CF9 /* ConstantStructureCheck.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConstantStructureCheck.cpp; sourceTree = "<group>"; };
		0F3D0BBB194A414300FC9CF9 /* ConstantStructureCheck.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstantStructureCheck.h; sourceTree = "<group>"; };
		0F3E01A819D353A500F61B7F /* DFGPrePostNumbering.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPrePostNumbering.cpp; path = dfg/DFGPrePostNumbering.cpp; sourceTree = "<group>"; };
		0F3E01A919D353A500F61B7F /* DFGPrePostNumbering.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPrePostNumbering.h; path = dfg/DFGPrePostNumbering.h; sourceTree = "<group>"; };
		0F426A451460CBAB00131F8F /* ValueRecovery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ValueRecovery.h; sourceTree = "<group>"; };
		0F426A461460CBAB00131F8F /* VirtualRegister.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VirtualRegister.h; sourceTree = "<group>"; };
		0F426A4A1460CD6B00131F8F /* DataFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataFormat.h; sourceTree = "<group>"; };

		0FA7A8E918B413C80052371D /* Reg.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Reg.cpp; sourceTree = "<group>"; };
		0FA7A8EA18B413C80052371D /* Reg.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Reg.h; sourceTree = "<group>"; };
		0FA7A8ED18CE4FD80052371D /* ScratchRegisterAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScratchRegisterAllocator.cpp; sourceTree = "<group>"; };
		0FAA3E0819D0C2CB00FAC9E2 /* DFGPromoteHeapAccess.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPromoteHeapAccess.h; path = dfg/DFGPromoteHeapAccess.h; sourceTree = "<group>"; };
		0FAF7EFA165BA919000C8455 /* JITDisassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITDisassembler.cpp; sourceTree = "<group>"; };
		0FAF7EFB165BA919000C8455 /* JITDisassembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITDisassembler.h; sourceTree = "<group>"; };
		0FB105821675480C00F8AB6E /* ExitKind.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExitKind.cpp; sourceTree = "<group>"; };

				0F235BBF17178E1C00690C7F /* FTLExitArgumentForOperand.cpp */,
				0F235BC017178E1C00690C7F /* FTLExitArgumentForOperand.h */,
				0F235BC117178E1C00690C7F /* FTLExitArgumentList.h */,
				0F2B9CEE19D0BAC100B1D1B5 /* FTLExitPropertyValue.cpp */,
				0F2B9CEF19D0BAC100B1D1B5 /* FTLExitPropertyValue.h */,
				0F235BC217178E1C00690C7F /* FTLExitThunkGenerator.cpp */,
				0F235BC317178E1C00690C7F /* FTLExitThunkGenerator.h */,
				0F2B9CF019D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.cpp */,
				0F2B9CF119D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.h */,
				0F235BC417178E1C00690C7F /* FTLExitValue.cpp */,
				0F235BC517178E1C00690C7F /* FTLExitValue.h */,
				A7F2996917A0BB670010417A /* FTLFail.cpp */,

				0FEA0A04170513DB00BB722C /* FTLLowerDFGToLLVM.cpp */,
				0FEA0A05170513DB00BB722C /* FTLLowerDFGToLLVM.h */,
				A7D89D0117A0B90400773AD8 /* FTLLoweredNodeValue.h */,
				0F2B9CF219D0BAC100B1D1B5 /* FTLOperations.cpp */,
				0F2B9CF319D0BAC100B1D1B5 /* FTLOperations.h */,
				0FD8A31717D51F2200CA2C40 /* FTLOSREntry.cpp */,
				0FD8A31817D51F2200CA2C40 /* FTLOSREntry.h */,
				0F235BC617178E1C00690C7F /* FTLOSRExit.cpp */,

				A7D9A29017A0BC7400EE2618 /* DFGAtTailAbstractState.h */,
				0F666EC21835672B00D017F1 /* DFGAvailability.cpp */,
				0F666EC31835672B00D017F1 /* DFGAvailability.h */,
				0F2B9CD619D0BA7D00B1D1B5 /* DFGAvailabilityMap.cpp */,
				0F2B9CD719D0BA7D00B1D1B5 /* DFGAvailabilityMap.h */,
				0F714CA116EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.cpp */,
				0F714CA216EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.h */,
				A7D89CE317A0B8CC00773AD8 /* DFGBasicBlock.cpp */,

				A704D90017A0BAA8006BA554 /* DFGInPlaceAbstractState.cpp */,
				A704D90117A0BAA8006BA554 /* DFGInPlaceAbstractState.h */,
				0F2BDC1F151E803800CD8910 /* DFGInsertionSet.h */,
				0F2B9CD819D0BA7D00B1D1B5 /* DFGInsertOSRHintsForUpdate.cpp */,
				0F2B9CD919D0BA7D00B1D1B5 /* DFGInsertOSRHintsForUpdate.h */,
				0F300B7918AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.cpp */,
				0F300B7A18AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.h */,
				0FC97F3718202119002C9B26 /* DFGInvalidationPointInjectionPhase.cpp */,

				0FA581B8150E952A00B9A2D9 /* DFGNodeFlags.h */,
				0F300B7718AB051100A6D72E /* DFGNodeOrigin.h */,
				0FA581B9150E952A00B9A2D9 /* DFGNodeType.h */,
				0F2B9CDA19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.cpp */,
				0F2B9CDB19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.h */,
				0F2B9CDC19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.cpp */,
				0F2B9CDD19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.h */,
				86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */,
				86EC9DC01328DF82002B2AD7 /* DFGOperations.h */,
				A7D89CEE17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.cpp */,

				0FBFDD03196C92BF007A5BFA /* DFGPhantomRemovalPhase.h */,
				0FFFC94F14EF909500C72532 /* DFGPhase.cpp */,
				0FFFC95014EF909500C72532 /* DFGPhase.h */,
				0F2B9CDE19D0BA7D00B1D1B5 /* DFGPhiChildren.cpp */,
				0F2B9CDF19D0BA7D00B1D1B5 /* DFGPhiChildren.h */,
				A78A9772179738B8009DF744 /* DFGPlan.cpp */,
				A78A9773179738B8009DF744 /* DFGPlan.h */,
				0FBE0F6D16C1DB010082C5E8 /* DFGPredictionInjectionPhase.cpp */,
				0FBE0F6E16C1DB010082C5E8 /* DFGPredictionInjectionPhase.h */,
				0FFFC95114EF909500C72532 /* DFGPredictionPropagationPhase.cpp */,
				0FFFC95214EF909500C72532 /* DFGPredictionPropagationPhase.h */,
				0F3E01A819D353A500F61B7F /* DFGPrePostNumbering.cpp */,
				0F3E01A919D353A500F61B7F /* DFGPrePostNumbering.h */,
				0F2B9CE019D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.cpp */,
				0F2B9CE119D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.h */,
				0FAA3E0819D0C2CB00FAC9E2 /* DFGPromoteHeapAccess.h */,
				0FB1765E196B8F9E0091052A /* DFGPureValue.cpp */,
				0FB1765F196B8F9E0091052A /* DFGPureValue.h */,
				86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */,

				A5D2E665195E174000A518E7 /* JSContextRefInternal.h in Headers */,
				A7D801A51880D66E0026C39B /* BuiltinExecutables.h in Headers */,
				A75EE9B218AAB7E200AAD043 /* BuiltinNames.h in Headers */,
				0F2B9CF719D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.h in Headers */,
				0FB7F39715ED8E4600F167B2 /* Butterfly.h in Headers */,
				0FB7F39815ED8E4600F167B2 /* ButterflyInlines.h in Headers */,
				C2FCAE1117A9C24E0034C735 /* BytecodeBasicBlock.h in Headers */,

				2A68295B1875F80500B6C3E2 /* CopyWriteBarrier.h in Headers */,
				5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */,
				0F426A4B1460CD6E00131F8F /* DataFormat.h in Headers */,
				0F2B9CE519D0BA7D00B1D1B5 /* DFGInsertOSRHintsForUpdate.h in Headers */,
				0F2B66DF17B6B5AB00A7AE3F /* DataView.h in Headers */,
				BCD2034A0E17135E002C7E82 /* DateConstructor.h in Headers */,
				41359CF30FDD89AD00206180 /* DateConversion.h in Headers */,

				A78A9779179738B8009DF744 /* DFGJITFinalizer.h in Headers */,
				0FC97F4018202119002C9B26 /* DFGJumpReplacement.h in Headers */,
				A73A535B1799CD5D00170C19 /* DFGLazyJSValue.h in Headers */,
				0F2B9CE919D0BA7D00B1D1B5 /* DFGObjectMaterializationData.h in Headers */,
				A7D9A29817A0BC7400EE2618 /* DFGLICMPhase.h in Headers */,
				A7D89CFC17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.h in Headers */,
				0FF0F19B16B729FA005DF95B /* DFGLongLivedState.h in Headers */,
				A767B5B617A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h in Headers */,
				0F2B9CED19D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.h in Headers */,
				A704D90717A0BAA8006BA554 /* DFGMergeMode.h in Headers */,
				0FB17663196B8F9E0091052A /* DFGPureValue.h in Headers */,
				0F2BDC451522801B00CD8910 /* DFGMinifiedGraph.h in Headers */,

				0F2BDC471522802500CD8910 /* DFGValueRecoveryOverride.h in Headers */,
				0F2BDC481522802900CD8910 /* DFGValueSource.h in Headers */,
				0F620174143FCD330068B77C /* DFGVariableAccessData.h in Headers */,
				0FAA3E0919D0C2CB00FAC9E2 /* DFGPromoteHeapAccess.h in Headers */,
				0FDDBFB61666EEDA00C55FEF /* DFGVariableAccessDataDump.h in Headers */,
				0F2BDC491522809600CD8910 /* DFGVariableEvent.h in Headers */,
				0F2BDC4B1522809D00CD8910 /* DFGVariableEventStream.h in Headers */,

				0F24E55617F0B71C00ABB217 /* InlineCallFrameSet.h in Headers */,
				99E45A2718A1B2590026D88F /* InputCursor.h in Headers */,
				A593CF7F1840362C00BFCE27 /* InspectorAgentBase.h in Headers */,
				0F3E01AB19D353A500F61B7F /* DFGPrePostNumbering.h in Headers */,
				A593CF87184038CA00BFCE27 /* InspectorAgentRegistry.h in Headers */,
				A593CF7D1840360300BFCE27 /* InspectorBackendDispatcher.h in Headers */,
				A5FD0082189B191A00633231 /* InspectorConsoleAgent.h in Headers */,

				1429D77C0ED20D7300B89619 /* Interpreter.h in Headers */,
				860BD801148EA6F200112B2F /* Intrinsic.h in Headers */,
				BC18C4130E16F5CD00B34460 /* JavaScript.h in Headers */,
				0F2B9CF519D0BAC100B1D1B5 /* FTLExitPropertyValue.h in Headers */,
				A503FA1A188E0FB000110F14 /* JavaScriptCallFrame.h in Headers */,
				BC18C4140E16F5CD00B34460 /* JavaScriptCore.h in Headers */,
				BC18C4150E16F5CD00B34460 /* JavaScriptCorePrefix.h in Headers */,

				657CF45919BF6662004ACBF2 /* JSCallee.h in Headers */,
				BC18C4190E16F5CD00B34460 /* JSCallbackConstructor.h in Headers */,
				BC18C41A0E16F5CD00B34460 /* JSCallbackFunction.h in Headers */,
				0F2B9CF919D0BAC100B1D1B5 /* FTLOperations.h in Headers */,
				BC18C41B0E16F5CD00B34460 /* JSCallbackObject.h in Headers */,
				BC18C41C0E16F5CD00B34460 /* JSCallbackObjectFunctions.h in Headers */,
				A7D801A91880D6A80026C39B /* JSCBuiltins.h in Headers */,

				BC18C42D0E16F5CD00B34460 /* JSEnvironmentRecord.h in Headers */,
				86E3C615167BABD7006D760A /* JSVirtualMachine.h in Headers */,
				86E3C61D167BABEE006D760A /* JSVirtualMachineInternal.h in Headers */,
				0F2B9CE719D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.h in Headers */,
				A7CA3AE817DA41AE006538AF /* JSWeakMap.h in Headers */,
				A7482E93116A7CAD003B0712 /* JSWeakObjectMapRefInternal.h in Headers */,
				A7482B9311671147003B0712 /* JSWeakObjectMapRefPrivate.h in Headers */,

				0F13912A16771C36009CCB07 /* ProfilerBytecodeSequence.h in Headers */,
				0FF729BA166AD360000F5BA3 /* ProfilerCompilation.h in Headers */,
				0FF729BB166AD360000F5BA3 /* ProfilerCompilationKind.h in Headers */,
				0F2B9CE319D0BA7D00B1D1B5 /* DFGAvailabilityMap.h in Headers */,
				0FF729BC166AD360000F5BA3 /* ProfilerCompiledBytecode.h in Headers */,
				0FF729BD166AD360000F5BA3 /* ProfilerDatabase.h in Headers */,
				2A05ABD61961DF2400341750 /* JSPropertyNameEnumerator.h in Headers */,

				0FD2C92416D01EE900C7803F /* StructureInlines.h in Headers */,
				C2FE18A416BAEC4000AF3061 /* StructureRareData.h in Headers */,
				C20BA92D16BB1C1500B3AEA2 /* StructureRareDataInlines.h in Headers */,
				0F2B9CEB19D0BA7D00B1D1B5 /* DFGPhiChildren.h in Headers */,
				0F9332A514CA7DDD0085F3C6 /* StructureSet.h in Headers */,
				0F766D3915AE4A1F008F363E /* StructureStubClearingWatchpoint.h in Headers */,
				BCCF0D080EF0AAB900413C8F /* StructureStubInfo.h in Headers */,

				1429D8DD0ED2205B00B89619 /* CallFrame.cpp in Sources */,
				0F0B83B014BCF71600885B4F /* CallLinkInfo.cpp in Sources */,
				0F93329D14CA7DC30085F3C6 /* CallLinkStatus.cpp in Sources */,
				0F2B9CE419D0BA7D00B1D1B5 /* DFGInsertOSRHintsForUpdate.cpp in Sources */,
				0F73D7AE165A142D00ACAB71 /* ClosureCallStubRoutine.cpp in Sources */,
				969A07960ED1D3AE00F1F681 /* CodeBlock.cpp in Sources */,
				0F8F94401667633000D61971 /* CodeBlockHash.cpp in Sources */,

				A7D9A29417A0BC7400EE2618 /* DFGAtTailAbstractState.cpp in Sources */,
				0F666EC61835672B00D017F1 /* DFGAvailability.cpp in Sources */,
				0F714CA416EA92F000F3EBEB /* DFGBackwardsPropagationPhase.cpp in Sources */,
				0F2B9CEC19D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.cpp in Sources */,
				A7D89CF217A0B8CC00773AD8 /* DFGBasicBlock.cpp in Sources */,
				A70B083217A0B79B00DAF14B /* DFGBinarySwitch.cpp in Sources */,
				2A88067819107D5500CB0BBB /* DFGFunctionWhitelist.cpp in Sources */,
				A7D89CF317A0B8CC00773AD8 /* DFGBlockInsertionSet.cpp in Sources */,
				86EC9DC41328DF82002B2AD7 /* DFGByteCodeParser.cpp in Sources */,
				0FD82E2114172CE300179C94 /* DFGCapabilities.cpp in Sources */,
				0F2B9CE619D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.cpp in Sources */,
				0FFFC95714EF90A000C72532 /* DFGCFAPhase.cpp in Sources */,
				0F3B3A271544C995003ED0FF /* DFGCFGSimplificationPhase.cpp in Sources */,
				A77A423F17A0BBFD00A8DB81 /* DFGClobberize.cpp in Sources */,

				0FCA9113195E66A000426438 /* VariableWatchpointSet.cpp in Sources */,
				0FD81AD2154FB4EE00983E72 /* DFGDominators.cpp in Sources */,
				0FD3C82614115D4000FD81CB /* DFGDriver.cpp in Sources */,
				0F2B9CE219D0BA7D00B1D1B5 /* DFGAvailabilityMap.cpp in Sources */,
				0F2B9CE819D0BA7D00B1D1B5 /* DFGObjectMaterializationData.cpp in Sources */,
				0FF0F19E16B72A0B005DF95B /* DFGEdge.cpp in Sources */,
				0FBC0AE71496C7C400D4FBDD /* DFGExitProfile.cpp in Sources */,
				0F0123321944EA1B00843A0C /* DFGValueStrength.cpp in Sources */,

				0FC3CCFF19ADA410006AC72A /* DFGBlockWorklist.cpp in Sources */,
				0FEA0A0D170513DB00BB722C /* FTLJITCode.cpp in Sources */,
				A78A9780179738D5009DF744 /* FTLJITFinalizer.cpp in Sources */,
				0F2B9CF419D0BAC100B1D1B5 /* FTLExitPropertyValue.cpp in Sources */,
				0F6B1CB5185FC9E900845D97 /* FTLJSCall.cpp in Sources */,
				0F8F2B95172E04A0007DBDA5 /* FTLLink.cpp in Sources */,
				0FCEFADF180738C000472CE4 /* FTLLocation.cpp in Sources */,

				0F24E55517F0B71C00ABB217 /* InlineCallFrameSet.cpp in Sources */,
				A5CEEE14187F3BAD00E55C99 /* InspectorAgent.cpp in Sources */,
				A593CF86184038CA00BFCE27 /* InspectorAgentRegistry.cpp in Sources */,
				0F2B9CF619D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.cpp in Sources */,
				A593CF7C1840360300BFCE27 /* InspectorBackendDispatcher.cpp in Sources */,
				2AF7382C18BBBF92008A5A37 /* StructureIDTable.cpp in Sources */,
				A5FD0081189B191A00633231 /* InspectorConsoleAgent.cpp in Sources */,

				0F9FC8C314E1B5FE00D52AE0 /* PolymorphicPutByIdList.cpp in Sources */,
				0F98206016BFE38100240D02 /* PreciseJumpTargets.cpp in Sources */,
				95742F650DD11F5A000917FB /* Profile.cpp in Sources */,
				0F2B9CF819D0BAC100B1D1B5 /* FTLOperations.cpp in Sources */,
				95CD45760E1C4FDD0085358E /* ProfileGenerator.cpp in Sources */,
				95AB83560DA43C3000BC83F3 /* ProfileNode.cpp in Sources */,
				0FF729AD166AD35C000F5BA3 /* ProfilerBytecode.cpp in Sources */,

				65FB5117184EEE7000C12B70 /* ProtoCallFrame.cpp in Sources */,
				1474C33C16AA2D9B0062F01D /* PrototypeMap.cpp in Sources */,
				0F9332A314CA7DD70085F3C6 /* PutByIdStatus.cpp in Sources */,
				0F3E01AA19D353A500F61B7F /* DFGPrePostNumbering.cpp in Sources */,
				0FF60AC316740F8800029779 /* ReduceWhitespace.cpp in Sources */,
				0FA7A8EB18B413C80052371D /* Reg.cpp in Sources */,
				14280841107EC0930013E7B2 /* RegExp.cpp in Sources */,

				0FF42745158EBE91004CB9FF /* udis86_syn-att.c in Sources */,
				0FF42746158EBE91004CB9FF /* udis86_syn-intel.c in Sources */,
				0FF42747158EBE91004CB9FF /* udis86_syn.c in Sources */,
				0F2B9CEA19D0BA7D00B1D1B5 /* DFGPhiChildren.cpp in Sources */,
				0FF42732158EBD58004CB9FF /* UDis86Disassembler.cpp in Sources */,
				A76F279415F13C9600517D67 /* UnlinkedCodeBlock.cpp in Sources */,
				B59F89391891F29F00D5CCDC /* UnlinkedInstructionStream.cpp in Sources */,



        return structureList()->list()[structureList()->m_length - 1];
    }
    
    class iterator {
    public:
        iterator()
            : m_set(nullptr)
            , m_index(0)
        {
        }
        
        iterator(const StructureSet* set, size_t index)
            : m_set(set)
            , m_index(index)
        {
        }
        
        Structure* operator*() const { return m_set->at(m_index); }
        iterator& operator++()
        {
            m_index++;
            return *this;
        }
        bool operator==(const iterator& other) const { return m_index == other.m_index; }
        bool operator!=(const iterator& other) const { return !(*this == other); }
        
    private:
        const StructureSet* m_set;
        size_t m_index;
    };
    
    iterator begin() const { return iterator(this, 0); }
    iterator end() const { return iterator(this, size()); }
    
    bool operator==(const StructureSet& other) const;
    
    SpeculatedType speculationFromStructures() const;



#include "DFGBranchDirection.h"
#include "DFGGraph.h"
#include "DFGNode.h"
#include "DFGPhiChildren.h"

namespace JSC { namespace DFG {


    //
    // This is guaranteed to be equivalent to doing:
    //
    // state.startExecuting()
    // state.executeEdges(index);
    // result = state.executeEffects(index);
    // } else
    //     result = true;
    bool execute(unsigned indexInBlock);
    bool execute(Node*);
    
    // Indicate the start of execution of a node. It resets any state in the node
    // that is progressively built up by executeEdges() and executeEffects().
    void startExecuting();
    bool startExecuting(unsigned indexInBlock);
    
    // Abstractly execute the edges of the given node. This runs filterEdgeByUse()
    // on all edges of the node. You can skip this step, if you have already used

    FiltrationResult filter(AbstractValue&, SpeculatedType);
    FiltrationResult filterByValue(AbstractValue&, FrozenValue);
    
    PhiChildren* phiChildren() { return m_phiChildren.get(); }
    
private:
    void clobberWorld(const CodeOrigin&, unsigned indexInBlock);
    void clobberCapturedVars(const CodeOrigin&);

    CodeBlock* m_codeBlock;
    Graph& m_graph;
    AbstractStateType& m_state;
    std::unique_ptr<PhiChildren> m_phiChildren;
};

} } // namespace JSC::DFG



    , m_graph(graph)
    , m_state(state)
{
    if (m_graph.m_form == SSA)
        m_phiChildren = std::make_unique<PhiChildren>(m_graph);
}

template<typename AbstractStateType>

}

template<typename AbstractStateType>
void AbstractInterpreter<AbstractStateType>::startExecuting()
{
    ASSERT(m_state.block());
    ASSERT(m_state.isValid());
    
    m_state.setDidClobber(false);
    
    return node->shouldGenerate();
}

template<typename AbstractStateType>
bool AbstractInterpreter<AbstractStateType>::startExecuting(unsigned indexInBlock)
{
    return startExecuting(m_state.block()->at(indexInBlock));
}

template<typename AbstractStateType>

        forNode(node).set(m_graph, node->structure());
        break;
        
    case PhantomNewObject:
    case BottomValue:
        m_state.setDidClobber(true); // Prevent constant folding.
        // This claims to return bottom.
        break;
        
    case PutByOffsetHint:
    case PutStructureHint:
        break;
        
    case MaterializeNewObject: {
        StructureSet set;
        
        m_phiChildren->forAllTransitiveIncomingValues(
            m_graph.varArgChild(node, 0).node(),
            [&] (Node* incoming) {
                set.add(incoming->castConstant<Structure*>());
            });
        
        forNode(node).set(m_graph, set);
        break;
    }
        
    case CreateActivation:
        forNode(node).set(
            m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->activationStructure());

        break;
        
    case CheckStructure: {
        // FIXME: We should be able to propagate the structure sets of constants (i.e. prototypes).
        AbstractValue& value = forNode(node->child1());
        ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.


        break;
    }
        
    case CheckStructureImmediate: {
        // FIXME: This currently can only reason about one structure at a time.
        // https://bugs.webkit.org/show_bug.cgi?id=136988
        
        AbstractValue& value = forNode(node->child1());
        StructureSet& set = node->structureSet();
        
        if (value.value()) {
            if (Structure* structure = jsDynamicCast<Structure*>(value.value())) {
                if (set.contains(structure)) {
                    m_state.setFoundConstants(true);
                    break;
                }
            }
            m_state.setIsValid(false);
            break;
        }
        
        if (m_phiChildren) {
            bool allGood = true;
            m_phiChildren->forAllTransitiveIncomingValues(
                node,
                [&] (Node* incoming) {
                    if (Structure* structure = incoming->dynamicCastConstant<Structure*>()) {
                        if (set.contains(structure))
                            return;
                    }
                    allGood = false;
                });
            if (allGood) {
                m_state.setFoundConstants(true);
                break;
            }
        }
            
        if (Structure* structure = set.onlyStructure()) {
            filterByValue(node->child1(), *m_graph.freeze(structure));
            break;
        }
        
        // Aw shucks, we can't do anything!
        break;
    }
        
    case PutStructure:
        if (!forNode(node->child1()).m_structure.isClear()) {
            if (forNode(node->child1()).m_structure.onlyStructure() == node->transition()->next)


    case CheckTierUpAndOSREnter:
    case LoopHint:
    case ZombieHint:
        break;

    case ZombieHint:
    case Unreachable:
    case LastNodeType:
    case ArithIMul:
    case FiatInt52:
    case BottomValue:
        DFG_CRASH(m_graph, node, "Unexpected node type");
        break;
    }

bool AbstractInterpreter<AbstractStateType>::execute(unsigned indexInBlock)
{
    Node* node = m_state.block()->at(indexInBlock);
    if (!startExecuting(node))
        return true;
    
    startExecuting();
    executeEdges(node);
    return executeEffects(indexInBlock, node);
}

template<typename AbstractStateType>
bool AbstractInterpreter<AbstractStateType>::execute(Node* node)
{
    startExecuting();
        return true;
    
    executeEdges(node);
    return executeEffects(UINT_MAX, node);
}

Lines 85-90 public: Source/JavaScriptCore/dfg/DFGAvailability.h_sec1
- Source/JavaScriptCore/dfg/DFGAvailability.h +12 lines
85	bool nodeIsUnavailable() const { return m_node == unavailableMarker(); }	85	bool nodeIsUnavailable() const { return m_node == unavailableMarker(); }
86		86
87	bool hasNode() const { return !nodeIsUndecided() && !nodeIsUnavailable(); }	87	bool hasNode() const { return !nodeIsUndecided() && !nodeIsUnavailable(); }
		88	bool shouldUseNode() const { return !isFlushUseful() && hasNode(); }
88		89
89	Node* node() const	90	Node* node() const
90	{	91	{
Lines 94-99 public: Source/JavaScriptCore/dfg/DFGAvailability.h_sec2
94	}	95	}
95		96
96	FlushedAt flushedAt() const { return m_flushedAt; }	97	FlushedAt flushedAt() const { return m_flushedAt; }
		98	bool isFlushUseful() const
		99	{
		100	return flushedAt().format() != DeadFlush && flushedAt().format() != ConflictingFlush;
		101	}
		102
		103	bool isDead() const { return !isFlushUseful() && !hasNode(); }
97		104
98	bool operator!() const { return nodeIsUnavailable() && flushedAt().format() == ConflictingFlush; }	105	bool operator!() const { return nodeIsUnavailable() && flushedAt().format() == ConflictingFlush; }
99		106
Lines 103-108 public: Source/JavaScriptCore/dfg/DFGAvailability.h_sec3
103	&& m_flushedAt == other.m_flushedAt;	110	&& m_flushedAt == other.m_flushedAt;
104	}	111	}
105		112
		113	bool operator!=(const Availability& other) const
		114	{
		115	return !(*this == other);
		116	}
		117
106	Availability merge(const Availability& other) const	118	Availability merge(const Availability& other) const
107	{	119	{
108	return Availability(	120	return Availability(



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGAvailabilityMap.h"

#if ENABLE(DFG_JIT)

#include "OperandsInlines.h"
#include <wtf/ListDump.h>

namespace JSC { namespace DFG {

void AvailabilityMap::prune()
{
    if (m_heap.isEmpty())
        return;
    
    HashSet<Node*> possibleNodes;
    
    for (unsigned i = m_locals.size(); i--;) {
        if (m_locals[i].hasNode())
            possibleNodes.add(m_locals[i].node());
    }

    int oldPossibleNodesSize;
    do {
        oldPossibleNodesSize = possibleNodes.size();
        for (auto pair : m_heap) {
            if (pair.value.hasNode() && possibleNodes.contains(pair.key.base()))
                possibleNodes.add(pair.value.node());
        }
    } while (oldPossibleNodesSize != possibleNodes.size());
    
    HashMap<PromotedHeapLocation, Availability> newHeap;
    for (auto pair : m_heap) {
        if (possibleNodes.contains(pair.key.base()))
            newHeap.add(pair.key, pair.value);
    }
    m_heap = newHeap;
}

void AvailabilityMap::clear()
{
    m_locals.fill(Availability());
    m_heap.clear();
}

void AvailabilityMap::dump(PrintStream& out) const
{
    out.print("{locals = ", m_locals, "; heap = ", mapDump(m_heap), "}");
}

bool AvailabilityMap::operator==(const AvailabilityMap& other) const
{
    return m_locals == other.m_locals
        && m_heap == other.m_heap;
}

void AvailabilityMap::merge(const AvailabilityMap& other)
{
    for (unsigned i = other.m_locals.size(); i--;)
        m_locals[i] = other.m_locals[i].merge(m_locals[i]);
    
    for (auto pair : other.m_heap) {
        auto result = m_heap.add(pair.key, Availability());
        result.iterator->value = pair.value.merge(result.iterator->value);
    }
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGAvailabilityMap_h
#define DFGAvailabilityMap_h

#if ENABLE(DFG_JIT)

#include "DFGAvailability.h"
#include "DFGPromotedHeapLocation.h"

namespace JSC { namespace DFG {

struct AvailabilityMap {
    void prune();
    void clear();
    
    void dump(PrintStream& out) const;
    
    bool operator==(const AvailabilityMap& other) const;
    
    void merge(const AvailabilityMap& other);
    
    template<typename Functor>
    void forEachAvailability(const Functor& functor)
    {
        for (unsigned i = m_locals.size(); i--;)
            functor(m_locals[i]);
        for (auto pair : m_heap)
            functor(pair.value);
    }
    
    Operands<Availability> m_locals;
    HashMap<PromotedHeapLocation, Availability> m_heap;
};

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGAvailabilityMap_h




}

BasicBlock::SSAData::SSAData(BasicBlock* block)
    : availabilityAtHead(OperandsLike, block->variablesAtHead)
    , availabilityAtTail(OperandsLike, block->variablesAtHead)
{
    availabilityAtHead.m_locals = Operands<Availability>(OperandsLike, block->variablesAtHead);
    availabilityAtTail.m_locals = Operands<Availability>(OperandsLike, block->variablesAtHead);
}

BasicBlock::SSAData::~SSAData() { }

Lines 30-35 Source/JavaScriptCore/dfg/DFGBasicBlock.h_sec1
- Source/JavaScriptCore/dfg/DFGBasicBlock.h -3 / +79 lines
30		30
31	#include "DFGAbstractValue.h"	31	#include "DFGAbstractValue.h"
32	#include "DFGAvailability.h"	32	#include "DFGAvailability.h"
		33	#include "DFGAvailabilityMap.h"
33	#include "DFGBranchDirection.h"	34	#include "DFGBranchDirection.h"
34	#include "DFGFlushedAt.h"	35	#include "DFGFlushedAt.h"
35	#include "DFGNode.h"	36	#include "DFGNode.h"
Lines 46-51 class Graph; Source/JavaScriptCore/dfg/DFGBasicBlock.h_sec2
46	class InsertionSet;	47	class InsertionSet;
47		48
48	typedef Vector<BasicBlock*, 2> PredecessorList;	49	typedef Vector<BasicBlock*, 2> PredecessorList;
		50	typedef Vector<Node*, 8> BlockNodeList;
49		51
50	struct BasicBlock : RefCounted<BasicBlock> {	52	struct BasicBlock : RefCounted<BasicBlock> {
51	BasicBlock(	53	BasicBlock(
Lines 85-90 struct BasicBlock : RefCounted<BasicBloc Source/JavaScriptCore/dfg/DFGBasicBlock.h_sec3
85	bool isInPhis(Node* node) const;	87	bool isInPhis(Node* node) const;
86	bool isInBlock(Node* myNode) const;	88	bool isInBlock(Node* myNode) const;
87		89
		90	BlockNodeList::iterator begin() { return m_nodes.begin(); }
		91	BlockNodeList::iterator end() { return m_nodes.end(); }
		92
88	unsigned numSuccessors() { return last()->numSuccessors(); }	93	unsigned numSuccessors() { return last()->numSuccessors(); }
89		94
90	BasicBlock*& successor(unsigned index)	95	BasicBlock*& successor(unsigned index)
Lines 96-101 struct BasicBlock : RefCounted<BasicBloc Source/JavaScriptCore/dfg/DFGBasicBlock.h_sec4
96	return last()->successorForCondition(condition);	101	return last()->successorForCondition(condition);
97	}	102	}
98		103
		104	class SuccessorsIterable {
		105	public:
		106	SuccessorsIterable()
		107	: m_block(nullptr)
		108	{
		109	}
		110
		111	SuccessorsIterable(BasicBlock* block)
		112	: m_block(block)
		113	{
		114	}
		115
		116	class iterator {
		117	public:
		118	iterator()
		119	: m_block(nullptr)
		120	, m_index(UINT_MAX)
		121	{
		122	}
		123
		124	iterator(BasicBlock* block, unsigned index)
		125	: m_block(block)
		126	, m_index(index)
		127	{
		128	}
		129
		130	BasicBlock* operator*()
		131	{
		132	return m_block->successor(m_index);
		133	}
		134
		135	iterator& operator++()
		136	{
		137	m_index++;
		138	return *this;
		139	}
		140
		141	bool operator==(const iterator& other) const
		142	{
		143	return m_index == other.m_index;
		144	}
		145
		146	bool operator!=(const iterator& other) const
		147	{
		148	return !(*this == other);
		149	}
		150	private:
		151	BasicBlock* m_block;
		152	unsigned m_index;
		153	};
		154
		155	iterator begin()
		156	{
		157	return iterator(m_block, 0);
		158	}
		159
		160	iterator end()
		161	{
		162	return iterator(m_block, m_block->numSuccessors());
		163	}
		164
		165	private:
		166	BasicBlock* m_block;
		167	};
168
169	SuccessorsIterable successors()
170	{
171	return SuccessorsIterable(this);
172	}
173
99	void removePredecessor(BasicBlock* block);	174	void removePredecessor(BasicBlock* block);
100	void replacePredecessor(BasicBlock* from, BasicBlock* to);	175	void replacePredecessor(BasicBlock* from, BasicBlock* to);
101		176
Lines 169-176 struct BasicBlock : RefCounted<BasicBloc Source/JavaScriptCore/dfg/DFGBasicBlock.h_sec5
169	unsigned innerMostLoopIndices[numberOfInnerMostLoopIndices];	244	unsigned innerMostLoopIndices[numberOfInnerMostLoopIndices];
170		245
171	struct SSAData {	246	struct SSAData {
172	Operands<Availability> availabilityAtHead;	247	AvailabilityMap availabilityAtHead;
173	Operands<Availability> availabilityAtTail;	248	AvailabilityMap availabilityAtTail;
		249
174	HashSet<Node*> liveAtHead;	250	HashSet<Node*> liveAtHead;
175	HashSet<Node*> liveAtTail;	251	HashSet<Node*> liveAtTail;
176	HashMap<Node*, AbstractValue> valuesAtHead;	252	HashMap<Node*, AbstractValue> valuesAtHead;
Lines 183-189 struct BasicBlock : RefCounted<BasicBloc Source/JavaScriptCore/dfg/DFGBasicBlock.h_sec6
183		259
184	private:	260	private:
185	friend class InsertionSet;	261	friend class InsertionSet;
186	Vector<Node*, 8> m_nodes;	262	BlockNodeList m_nodes;
187	};	263	};
188		264
189	typedef Vector<BasicBlock*, 5> BlockList;	265	typedef Vector<BasicBlock*, 5> BlockList;

Lines 109-114 void clobberize(Graph& graph, Node* node Source/JavaScriptCore/dfg/DFGClobberize.h_sec1
- Source/JavaScriptCore/dfg/DFGClobberize.h -5 / +6 lines
109	case HardPhantom:	109	case HardPhantom:
110	case Check:	110	case Check:
111	case ExtractOSREntryLocal:	111	case ExtractOSREntryLocal:
		112	case CheckStructureImmediate:
112	return;	113	return;
113		114
114	case BitAnd:	115	case BitAnd:
Lines 273-278 void clobberize(Graph& graph, Node* node Source/JavaScriptCore/dfg/DFGClobberize.h_sec2
273	case ProfileDidCall:	274	case ProfileDidCall:
274	case StoreBarrier:	275	case StoreBarrier:
275	case StoreBarrierWithNullCheck:	276	case StoreBarrierWithNullCheck:
		277	case PutByOffsetHint:
		278	case PutStructureHint:
276	write(SideState);	279	write(SideState);
277	return;	280	return;
278		281
Lines 787-803 void clobberize(Graph& graph, Node* node Source/JavaScriptCore/dfg/DFGClobberize.h_sec3
787	case NewObject:	790	case NewObject:
788	case NewRegexp:	791	case NewRegexp:
789	case NewStringObject:	792	case NewStringObject:
790	read(HeapObjectCount);	793	case PhantomNewObject:
791	write(HeapObjectCount);	794	case MaterializeNewObject:
792	return;
793
794	case NewFunctionNoCheck:	795	case NewFunctionNoCheck:
795	case NewFunction:	796	case NewFunction:
796	case NewFunctionExpression:	797	case NewFunctionExpression:
797	read(HeapObjectCount);	798	read(HeapObjectCount);
798	write(HeapObjectCount);	799	write(HeapObjectCount);
799	return;	800	return;
800		801
801	case RegExpExec:	802	case RegExpExec:
802	case RegExpTest:	803	case RegExpTest:
803	read(RegExpState);	804	read(RegExpState);



                break;
            }
                
            case CheckStructureImmediate: {
                AbstractValue& value = m_state.forNode(node->child1());
                StructureSet& set = node->structureSet();
                
                if (value.value()) {
                    if (Structure* structure = jsDynamicCast<Structure*>(value.value())) {
                        if (set.contains(structure)) {
                            m_interpreter.execute(indexInBlock);
                            node->convertToPhantom();
                            eliminated = true;
                            break;
                        }
                    }
                }
                
                if (PhiChildren* phiChildren = m_interpreter.phiChildren()) {
                    bool allGood = true;
                    phiChildren->forAllTransitiveIncomingValues(
                        node,
                        [&] (Node* incoming) {
                            if (Structure* structure = incoming->dynamicCastConstant<Structure*>()) {
                                if (set.contains(structure))
                                    return;
                            }
                            allGood = false;
                        });
                    if (allGood) {
                        m_interpreter.execute(indexInBlock);
                        node->convertToPhantom();
                        eliminated = true;
                        break;
                    }
                }
                break;
            }
                
            case CheckArray:
            case Arrayify: {
                if (!node->arrayMode().alreadyChecked(m_graph, node, m_state.forNode(node->child1())))

Lines 199-204 bool doesGC(Graph& graph, Node* node) Source/JavaScriptCore/dfg/DFGDoesGC.cpp_sec1
- Source/JavaScriptCore/dfg/DFGDoesGC.cpp +5 lines
199	case BooleanToNumber:	199	case BooleanToNumber:
200	case CheckBadCell:	200	case CheckBadCell:
201	case BottomValue:	201	case BottomValue:
		202	case PhantomNewObject:
		203	case PutByOffsetHint:
		204	case CheckStructureImmediate:
		205	case PutStructureHint:
202	return false;	206	return false;
203		207
204	case CreateActivation:	208	case CreateActivation:
Lines 225-230 bool doesGC(Graph& graph, Node* node) Source/JavaScriptCore/dfg/DFGDoesGC.cpp_sec2
225	case GetGenericPropertyEnumerator:	229	case GetGenericPropertyEnumerator:
226	case GetEnumeratorPname:	230	case GetEnumeratorPname:
227	case ToIndexString:	231	case ToIndexString:
		232	case MaterializeNewObject:
228	return true;	233	return true;
229		234
230	case MultiPutByOffset:	235	case MultiPutByOffset:

Lines 1013-1018 private: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp_sec1
- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp +5 lines
1013	case Int52Constant:	1013	case Int52Constant:
1014	case Identity: // This should have been cleaned up.	1014	case Identity: // This should have been cleaned up.
1015	case BooleanToNumber:	1015	case BooleanToNumber:
		1016	case PhantomNewObject:
		1017	case PutByOffsetHint:
		1018	case CheckStructureImmediate:
		1019	case PutStructureHint:
		1020	case MaterializeNewObject:
1016	// These are just nodes that we don't currently expect to see during fixup.	1021	// These are just nodes that we don't currently expect to see during fixup.
1017	// If we ever wanted to insert them prior to fixup, then we just have to create	1022	// If we ever wanted to insert them prior to fixup, then we just have to create
1018	// fixup rules for them.	1023	// fixup rules for them.

Lines 36-43 void FlushedAt::dump(PrintStream& out) c Source/JavaScriptCore/dfg/DFGFlushedAt.cpp_sec1
- Source/JavaScriptCore/dfg/DFGFlushedAt.cpp -1 / +3 lines
36	{	36	{
37	if (m_format == DeadFlush \|\| m_format == ConflictingFlush)	37	if (m_format == DeadFlush \|\| m_format == ConflictingFlush)
38	out.print(m_format);	38	out.print(m_format);
39	else	39	else if (m_virtualRegister.isValid())
40	out.print("r", m_virtualRegister, ":", m_format);	40	out.print("r", m_virtualRegister, ":", m_format);
		41	else
		42	out.print(m_format);
41	}	43	}
42		44
43	void FlushedAt::dumpInContext(PrintStream& out, DumpContext*) const	45	void FlushedAt::dumpInContext(PrintStream& out, DumpContext*) const



    {
        if (format == DeadFlush)
            ASSERT(!virtualRegister.isValid());
        else
            ASSERT(virtualRegister.isValid());
    }
    
    bool operator!() const { return m_format == DeadFlush; }

Lines 323-328 void Graph::dump(PrintStream& out, const Source/JavaScriptCore/dfg/DFGGraph.cpp_sec1
- Source/JavaScriptCore/dfg/DFGGraph.cpp +33 lines
323	out.print(comma, inContext(JSValue(node->typedArray()), context));	323	out.print(comma, inContext(JSValue(node->typedArray()), context));
324	if (node->hasStoragePointer())	324	if (node->hasStoragePointer())
325	out.print(comma, RawPointer(node->storagePointer()));	325	out.print(comma, RawPointer(node->storagePointer()));
		326	if (node->hasObjectMaterializationData())
		327	out.print(comma, node->objectMaterializationData());
326	if (node->isConstant())	328	if (node->isConstant())
327	out.print(comma, pointerDumpInContext(node->constant(), context));	329	out.print(comma, pointerDumpInContext(node->constant(), context));
328	if (node->isJump())	330	if (node->isJump())
Lines 368-379 void Graph::dumpBlockHeader(PrintStream& Source/JavaScriptCore/dfg/DFGGraph.cpp_sec2
368	for (size_t i = 0; i < block->predecessors.size(); ++i)	370	for (size_t i = 0; i < block->predecessors.size(); ++i)
369	out.print(" ", *block->predecessors[i]);	371	out.print(" ", *block->predecessors[i]);
370	out.print("\n");	372	out.print("\n");
		373	out.print(prefix, " Successors:");
		374	for (BasicBlock* successor : block->successors()) {
		375	out.print(" ", *successor);
		376	if (m_prePostNumbering.isValid())
		377	out.print(" (", m_prePostNumbering.edgeKind(block, successor), ")");
		378	}
		379	out.print("\n");
371	if (m_dominators.isValid()) {	380	if (m_dominators.isValid()) {
372	out.print(prefix, " Dominated by: ", m_dominators.dominatorsOf(block), "\n");	381	out.print(prefix, " Dominated by: ", m_dominators.dominatorsOf(block), "\n");
373	out.print(prefix, " Dominates: ", m_dominators.blocksDominatedBy(block), "\n");	382	out.print(prefix, " Dominates: ", m_dominators.blocksDominatedBy(block), "\n");
374	out.print(prefix, " Dominance Frontier: ", m_dominators.dominanceFrontierOf(block), "\n");	383	out.print(prefix, " Dominance Frontier: ", m_dominators.dominanceFrontierOf(block), "\n");
375	out.print(prefix, " Iterated Dominance Frontier: ", m_dominators.iteratedDominanceFrontierOf(BlockList(1, block)), "\n");	384	out.print(prefix, " Iterated Dominance Frontier: ", m_dominators.iteratedDominanceFrontierOf(BlockList(1, block)), "\n");
376	}	385	}
		386	if (m_prePostNumbering.isValid())
		387	out.print(prefix, " Pre/Post Numbering: ", m_prePostNumbering.preNumber(block), "/", m_prePostNumbering.postNumber(block), "\n");
377	if (m_naturalLoops.isValid()) {	388	if (m_naturalLoops.isValid()) {
378	if (const NaturalLoop* loop = m_naturalLoops.headerOf(block)) {	389	if (const NaturalLoop* loop = m_naturalLoops.headerOf(block)) {
379	out.print(prefix, " Loop header, contains:");	390	out.print(prefix, " Loop header, contains:");
Lines 562-567 void Graph::resetReachability() Source/JavaScriptCore/dfg/DFGGraph.cpp_sec3
562	determineReachability();	573	determineReachability();
563	}	574	}
564		575
		576	void Graph::mergeRelevantToOSR()
		577	{
		578	for (BasicBlock* block : blocksInNaturalOrder()) {
		579	for (Node* node : *block) {
		580	switch (node->op()) {
		581	case MovHint:
		582	node->child1()->mergeFlags(NodeRelevantToOSR);
		583	break;
		584
		585	case PutStructureHint:
		586	case PutByOffsetHint:
		587	node->child2()->mergeFlags(NodeRelevantToOSR);
		588	break;
		589
		590	default:
		591	break;
		592	}
		593	}
		594	}
		595	}
		596
565	namespace {	597	namespace {
566		598
567	class RefCountCalculator {	599	class RefCountCalculator {
Lines 707-712 void Graph::invalidateCFG() Source/JavaScriptCore/dfg/DFGGraph.cpp_sec4
707	{	739	{
708	m_dominators.invalidate();	740	m_dominators.invalidate();
709	m_naturalLoops.invalidate();	741	m_naturalLoops.invalidate();
		742	m_prePostNumbering.invalidate();
710	}	743	}
711		744
712	void Graph::substituteGetLocal(BasicBlock& block, unsigned startIndexInBlock, VariableAccessData* variableAccessData, Node* newGetLocal)	745	void Graph::substituteGetLocal(BasicBlock& block, unsigned startIndexInBlock, VariableAccessData* variableAccessData, Node* newGetLocal)



#include "DFGNode.h"
#include "DFGNodeAllocator.h"
#include "DFGPlan.h"
#include "DFGPrePostNumbering.h"
#include "DFGScannable.h"
#include "JSStack.h"
#include "MethodOfGettingAValueProfile.h"


namespace DFG {

#define DFG_NODE_DO_TO_CHILDREN(graph, node, thingToDo) do {            \
        Node* _node = (node);                                           \
        if (_node->flags() & NodeHasVarArgs) {                          \
            for (unsigned _childIdx = _node->firstChild();              \
                _childIdx < _node->firstChild() + _node->numChildren(); \
                _childIdx++) {                                          \
                if (!!(graph).m_varArgChildren[_childIdx])              \
                    thingToDo(_node, (graph).m_varArgChildren[_childIdx]); \
            }                                                           \
        } else {                                                        \
            if (!_node->child1()) {                                     \
                ASSERT(                                                 \
                    !_node->child2()                                    \
                    && !_node->child3());                               \
                break;                                                  \
            }                                                           \
            thingToDo(_node, _node->child1());                          \
                                                                        \
            if (!_node->child2()) {                                     \
                ASSERT(!_node->child3());                               \
                break;                                                  \
            }                                                           \
            thingToDo(_node, _node->child2());                          \
                                                                        \
            if (!_node->child3())                                       \
                break;                                                  \
            thingToDo(_node, _node->child3());                          \
        }                                                               \
    } while (false)

#define DFG_ASSERT(graph, node, assertion) do {                         \
        if (!!(assertion))                                              \
            break;                                                      \
        (graph).handleAssertionFailure(                                 \
            (node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, #assertion); \
    } while (false)

#define DFG_CRASH(graph, node, reason)                                  \
    (graph).handleAssertionFailure(                                     \
        (node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, (reason));

struct InlineVariableData {
    InlineCallFrame* inlineCallFrame;
    unsigned argumentPositionStart;

    void determineReachability();
    void resetReachability();
    
    void mergeRelevantToOSR();
    
    void computeRefCounts();
    
    unsigned varArgNumChildren(Node* node)

    BlockList blocksInPreOrder();
    BlockList blocksInPostOrder();
    
    class NaturalBlockIterable {
    public:
        NaturalBlockIterable()
            : m_graph(nullptr)
        {
        }
        
        NaturalBlockIterable(Graph& graph)
            : m_graph(&graph)
        {
        }
        
        class iterator {
        public:
            iterator()
                : m_graph(nullptr)
                , m_index(0)
            {
            }
            
            iterator(Graph& graph, BlockIndex index)
                : m_graph(&graph)
                , m_index(findNext(index))
            {
            }
            
            BasicBlock *operator*()
            {
                return m_graph->block(m_index);
            }
            
            iterator& operator++()
            {
                m_index = findNext(m_index + 1);
                return *this;
            }
            
            bool operator==(const iterator& other) const
            {
                return m_index == other.m_index;
            }
            
            bool operator!=(const iterator& other) const
            {
                return !(*this == other);
            }
            
        private:
            BlockIndex findNext(BlockIndex index)
            {
                while (index < m_graph->numBlocks() && !m_graph->block(index))
                    index++;
                return index;
            }
            
            Graph* m_graph;
            BlockIndex m_index;
        };
        
        iterator begin()
        {
            return iterator(*m_graph, 0);
        }
        
        iterator end()
        {
            return iterator(*m_graph, m_graph->numBlocks());
        }
        
    private:
        Graph* m_graph;
    };
    
    NaturalBlockIterable blocksInNaturalOrder()
    {
        return NaturalBlockIterable(*this);
    }
    
    template<typename ChildFunctor>
    void doToChildrenWithNode(Node* node, const ChildFunctor& functor)
    {
        DFG_NODE_DO_TO_CHILDREN(*this, node, functor);
    }
    
    template<typename ChildFunctor>
    void doToChildren(Node* node, const ChildFunctor& functor)
    {
        doToChildrenWithNode(
            node,
            [&functor] (Node*, Edge& edge) {
                functor(edge);
            });
    }
    
    Profiler::Compilation* compilation() { return m_plan.compilation.get(); }
    
    DesiredIdentifiers& identifiers() { return m_plan.identifiers; }

    Bag<SwitchData> m_switchData;
    Bag<MultiGetByOffsetData> m_multiGetByOffsetData;
    Bag<MultiPutByOffsetData> m_multiPutByOffsetData;
    Bag<ObjectMaterializationData> m_objectMaterializationData;
    Vector<InlineVariableData, 4> m_inlineVariableData;
    HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
    bool m_hasArguments;
    HashSet<ExecutableBase*> m_executablesWhoseArgumentsEscaped;
    BitVector m_lazyVars;
    Dominators m_dominators;
    PrePostNumbering m_prePostNumbering;
    NaturalLoops m_naturalLoops;
    unsigned m_localVars;
    unsigned m_nextMachineLocal;

    }
};

#define DFG_NODE_DO_TO_CHILDREN(graph, node, thingToDo) do {            \
        Node* _node = (node);                                           \
        if (_node->flags() & NodeHasVarArgs) {                          \
            for (unsigned _childIdx = _node->firstChild();              \
                _childIdx < _node->firstChild() + _node->numChildren(); \
                _childIdx++) {                                          \
                if (!!(graph).m_varArgChildren[_childIdx])              \
                    thingToDo(_node, (graph).m_varArgChildren[_childIdx]); \
            }                                                           \
        } else {                                                        \
            if (!_node->child1()) {                                     \
                ASSERT(                                                 \
                    !_node->child2()                                    \
                    && !_node->child3());                               \
                break;                                                  \
            }                                                           \
            thingToDo(_node, _node->child1());                          \
                                                                        \
            if (!_node->child2()) {                                     \
                ASSERT(!_node->child3());                               \
                break;                                                  \
            }                                                           \
            thingToDo(_node, _node->child2());                          \
                                                                        \
            if (!_node->child3())                                       \
                break;                                                  \
            thingToDo(_node, _node->child3());                          \
        }                                                               \
    } while (false)

#define DFG_ASSERT(graph, node, assertion) do {                         \
        if (!!(assertion))                                              \
            break;                                                      \
        (graph).handleAssertionFailure(                                 \
            (node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, #assertion); \
    } while (false)

#define DFG_CRASH(graph, node, reason)                                  \
    (graph).handleAssertionFailure(                                     \
        (node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, (reason));

} } // namespace JSC::DFG

#endif

Lines 147-152 void printInternal(PrintStream& out, Loc Source/JavaScriptCore/dfg/DFGHeapLocation.cpp_sec1
- Source/JavaScriptCore/dfg/DFGHeapLocation.cpp +4 lines
147	case AllocationProfileWatchpointLoc:	147	case AllocationProfileWatchpointLoc:
148	out.print("AllocationProfileWatchpointLoc");	148	out.print("AllocationProfileWatchpointLoc");
149	return;	149	return;
		150
		151	case StructureLoc:
		152	out.print("StructureLoc");
		153	return;
150	}	154	}
151		155
152	RELEASE_ASSERT_NOT_REACHED();	156	RELEASE_ASSERT_NOT_REACHED();

Lines 55-60 enum LocationKind { Source/JavaScriptCore/dfg/DFGHeapLocation.h_sec1
- Source/JavaScriptCore/dfg/DFGHeapLocation.h +1 lines
55	MyArgumentsLengthLoc,	55	MyArgumentsLengthLoc,
56	NamedPropertyLoc,	56	NamedPropertyLoc,
57	SetterLoc,	57	SetterLoc,
		58	StructureLoc,
58	TypeOfLoc,	59	TypeOfLoc,
59	TypedArrayByteOffsetLoc,	60	TypedArrayByteOffsetLoc,
60	VarInjectionWatchpointLoc,	61	VarInjectionWatchpointLoc,



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGInsertOSRHintsForUpdate.h"

#if ENABLE(DFG_JIT)

namespace JSC { namespace DFG {

void insertOSRHintsForUpdate(
    InsertionSet& insertionSet, unsigned nodeIndex, NodeOrigin origin,
    AvailabilityMap& availability, Node* originalNode, Node* newNode)
{
    for (unsigned i = availability.m_locals.size(); i--;) {
        int operand = availability.m_locals.operandForIndex(i);
        
        if (availability.m_locals[i].hasNode() && availability.m_locals[i].node() == originalNode) {
            insertionSet.insertNode(
                nodeIndex, SpecNone, MovHint, origin, OpInfo(operand),
                newNode->defaultEdge());
        }
    }
    
    for (auto pair : availability.m_heap) {
        if (pair.value.hasNode() && pair.value.node() == originalNode) {
            insertionSet.insert(
                nodeIndex, pair.key.createHint(insertionSet.graph(), origin, newNode));
        }
    }
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGInsertOSRHintsForUpdate_h
#define DFGInsertOSRHintsForUpdate_h

#if ENABLE(DFG_JIT)

#include "DFGInsertionSet.h"
#include "DFGAvailabilityMap.h"

namespace JSC { namespace DFG {

void insertOSRHintsForUpdate(
    InsertionSet&, unsigned nodeIndex, NodeOrigin, AvailabilityMap&,
    Node* originalNode, Node* newNode);

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGInsertOSRHintsForUpdate_h


Lines 43-48 public: Source/JavaScriptCore/dfg/DFGInsertionSet.h_sec1
- Source/JavaScriptCore/dfg/DFGInsertionSet.h +2 lines
43	{	43	{
44	}	44	}
45		45
		46	Graph& graph() { return m_graph; }
		47
46	Node* insert(const Insertion& insertion)	48	Node* insert(const Insertion& insertion)
47	{	49	{
48	ASSERT(!m_insertions.size() \|\| m_insertions.last().index() <= insertion.index());	50	ASSERT(!m_insertions.size() \|\| m_insertions.last().index() <= insertion.index());

Lines 75-80 bool mayExit(Graph& graph, Node* node) Source/JavaScriptCore/dfg/DFGMayExit.cpp_sec1
- Source/JavaScriptCore/dfg/DFGMayExit.cpp +4 lines
75	case Phi:	75	case Phi:
76	case Upsilon:	76	case Upsilon:
77	case ZombieHint:	77	case ZombieHint:
		78	case BottomValue:
		79	case PutStructureHint:
		80	case PutByOffsetHint:
		81	case PhantomNewObject:
78	break;	82	break;
79		83
80	default:	84	default:



#include "DFGNodeFlags.h"
#include "DFGNodeOrigin.h"
#include "DFGNodeType.h"
#include "DFGObjectMaterializationData.h"
#include "DFGTransition.h"
#include "DFGUseKind.h"
#include "DFGVariableAccessData.h"

        m_flags &= ~NodeClobbersWorld;
    }
    
    void convertToPutByOffsetHint()
    {
        ASSERT(m_op == PutByOffset);
        m_opInfo = storageAccessData().identifierNumber;
        m_op = PutByOffsetHint;
        child1() = child2();
        child2() = child3();
        child3() = Edge();
    }
    
    void convertToPutStructureHint(Node* structure)
    {
        ASSERT(m_op == PutStructure);
        ASSERT(structure->castConstant<Structure*>() == transition()->next);
        m_op = PutStructureHint;
        m_opInfo = 0;
        child2() = Edge(structure, KnownCellUse);
    }
    
    void convertToPhantomNewObject()
    {
        ASSERT(m_op == NewObject || m_op == MaterializeNewObject);
        m_op = PhantomNewObject;
        m_flags &= ~NodeHasVarArgs;
        m_opInfo = 0;
        m_opInfo2 = 0;
        children = AdjacencyList();
    }
    
    void convertToPhantomLocal()
    {
        ASSERT(m_op == Phantom && (child1()->op() == Phi || child1()->op() == SetLocal || child1()->op() == SetArgument));

     
    bool isCellConstant()
    {
        return isConstant() && constant()->value() && constant()->value().isCell();
    }
     
    JSCell* asCell()

            return nullptr;
        return jsDynamicCast<T>(asCell());
    }
    
    template<typename T>
    T castConstant()
    {
        T result = dynamicCastConstant<T>();
        RELEASE_ASSERT(result);
        return result;
    }
     
    bool containsMovHint()
    {

        case PutById:
        case PutByIdFlush:
        case PutByIdDirect:
        case PutByOffsetHint:
            return true;
        default:
            return false;

    
    bool hasStorageAccessData()
    {
        switch (op()) {
        case GetByOffset:
        case PutByOffset:
        case GetGetterSetterByOffset:
            return true;
        default:
            return false;
        }
    }
    
    StorageAccessData& storageAccessData()

        return *reinterpret_cast<MultiPutByOffsetData*>(m_opInfo);
    }
    
    bool hasObjectMaterializationData()
    {
        return op() == MaterializeNewObject;
    }
    
    ObjectMaterializationData& objectMaterializationData()
    {
        return *reinterpret_cast<ObjectMaterializationData*>(m_opInfo);
    }
    
    bool isPhantomObjectAllocation()
    {
        switch (op()) {
        case PhantomNewObject:
            return true;
        default:
            return false;
        }
    }
    
    bool hasFunctionDeclIndex()
    {
        return op() == NewFunction

Lines 228-233 namespace JSC { namespace DFG { Source/JavaScriptCore/dfg/DFGNodeType.h_sec1
- Source/JavaScriptCore/dfg/DFGNodeType.h +7 lines
228	macro(NewTypedArray, NodeResultJS \| NodeClobbersWorld \| NodeMustGenerate) \	228	macro(NewTypedArray, NodeResultJS \| NodeClobbersWorld \| NodeMustGenerate) \
229	macro(NewRegexp, NodeResultJS) \	229	macro(NewRegexp, NodeResultJS) \
230	\	230	\
		231	/* Support for allocation sinking. */\
		232	macro(PhantomNewObject, NodeResultJS) \
		233	macro(PutByOffsetHint, NodeMustGenerate) \
		234	macro(CheckStructureImmediate, NodeMustGenerate) \
		235	macro(PutStructureHint, NodeMustGenerate) \
		236	macro(MaterializeNewObject, NodeResultJS \| NodeHasVarArgs) \
		237	\
231	/* Nodes for misc operations. */\	238	/* Nodes for misc operations. */\
232	macro(Breakpoint, NodeMustGenerate) \	239	macro(Breakpoint, NodeMustGenerate) \
233	macro(ProfileWillCall, NodeMustGenerate) \	240	macro(ProfileWillCall, NodeMustGenerate) \



#include "DFGGraph.h"
#include "DFGInsertionSet.h"
#include "DFGPhase.h"
#include "DFGPromoteHeapAccess.h"
#include "JSCInlines.h"

namespace JSC { namespace DFG {

            BasicBlock* block = m_graph.block(blockIndex);
            if (!block)
                continue;
            block->ssa->availabilityAtHead.clear();
            block->ssa->availabilityAtTail.clear();
        }
        
        BasicBlock* root = m_graph.block(0);
        root->ssa->availabilityAtHead.m_locals.fill(Availability::unavailable());
        for (unsigned argument = root->ssa->availabilityAtHead.m_locals.numberOfArguments(); argument--;) {
            root->ssa->availabilityAtHead.m_locals.argument(argument) =
                Availability::unavailable().withFlush(
                    FlushedAt(FlushedJSValue, virtualRegisterForArgument(argument)));
        }

        if (m_graph.m_plan.mode == FTLForOSREntryMode) {
            for (unsigned local = m_graph.m_profiledBlock->m_numCalleeRegisters; local--;)
                root->ssa->availabilityAtHead.local(local) = Availability::unavailable();
        } else {
            for (unsigned local = root->ssa->availabilityAtHead.numberOfLocals(); local--;)
                root->ssa->availabilityAtHead.local(local) = Availability::unavailable();
        }
        
        // This could be made more efficient by processing blocks in reverse postorder.
        
        LocalOSRAvailabilityCalculator calculator;

                for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex)
                    calculator.executeNode(block->at(nodeIndex));
                
                calculator.m_availability.prune();
                
                if (calculator.m_availability == block->ssa->availabilityAtTail)
                    continue;
                

                
                for (unsigned successorIndex = block->numSuccessors(); successorIndex--;) {
                    BasicBlock* successor = block->successor(successorIndex);
                    successor->ssa->availabilityAtHead.merge(calculator.m_availability);
                        successor->ssa->availabilityAtHead[i] =
                            calculator.m_availability[i].merge(
                                successor->ssa->availabilityAtHead[i]);
                    }
                }
            }
        } while (changed);

    m_availability = block->ssa->availabilityAtHead;
}

void LocalOSRAvailabilityCalculator::endBlock(BasicBlock* block)
{
    m_availability = block->ssa->availabilityAtTail;
}

void LocalOSRAvailabilityCalculator::executeNode(Node* node)
{
    switch (node->op()) {
    case SetLocal: {
        VariableAccessData* variable = node->variableAccessData();
        m_availability.m_locals.operand(variable->local()) =
            Availability(node->child1().node(), variable->flushedAt());
        break;
    }

    case GetArgument: {
        VariableAccessData* variable = node->variableAccessData();
        m_availability.m_locals.operand(variable->local()) =
            Availability(node, variable->flushedAt());
        break;
    }

    case MovHint: {
        m_availability.m_locals.operand(node->unlinkedLocal()) =
            Availability(node->child1().node());
        break;
    }

    case ZombieHint: {
        m_availability.m_locals.operand(node->unlinkedLocal()) =
            Availability::unavailable();
        break;
    }
        
    default:
        break;
    }
    
    promoteHeapAccess(
        node,
        [&] (PromotedHeapLocation location, Edge value) {
            m_availability.m_heap.set(location, Availability(value.node()));
        },
        [&] (PromotedHeapLocation) { });
}

} } // namespace JSC::DFG

Lines 37-43 class Graph; Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.h_sec1
- Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.h -2 / +5 lines
37		37
38	// Computes BasicBlock::ssa->availabiltiyAtHead/Tail. This is a forward flow type inference	38	// Computes BasicBlock::ssa->availabiltiyAtHead/Tail. This is a forward flow type inference
39	// over MovHints and SetLocals. This analysis is run directly by the Plan for preparing for	39	// over MovHints and SetLocals. This analysis is run directly by the Plan for preparing for
40	// lowering to LLVM IR, but it can also be used as a utility.	40	// lowering to LLVM IR, but it can also be used as a utility. Note that if you run it before
		41	// stack layout, all of the flush availability will omit the virtual register - but it will
		42	// tell you the format.
41		43
42	bool performOSRAvailabilityAnalysis(Graph&);	44	bool performOSRAvailabilityAnalysis(Graph&);
43		45
Lines 49-57 public: Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.h_sec2
49	~LocalOSRAvailabilityCalculator();	51	~LocalOSRAvailabilityCalculator();
50		52
51	void beginBlock(BasicBlock*);	53	void beginBlock(BasicBlock*);
		54	void endBlock(BasicBlock*); // Useful if you want to get data for the end of the block. You don't need to call this if you did beginBlock() and then executeNode() for every node.
52	void executeNode(Node*);	55	void executeNode(Node*);
53		56
54	Operands<Availability> m_availability;	57	AvailabilityMap m_availability;
55	};	58	};
56		59
57	} } // namespace JSC::DFG	60	} } // namespace JSC::DFG



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGObjectAllocationSinkingPhase.h"

#if ENABLE(DFG_JIT)

#include "DFGAbstractHeap.h"
#include "DFGBlockMapInlines.h"
#include "DFGClobberize.h"
#include "DFGGraph.h"
#include "DFGInsertOSRHintsForUpdate.h"
#include "DFGInsertionSet.h"
#include "DFGLivenessAnalysisPhase.h"
#include "DFGOSRAvailabilityAnalysisPhase.h"
#include "DFGPhase.h"
#include "DFGPromoteHeapAccess.h"
#include "DFGSSACalculator.h"
#include "DFGValidate.h"
#include "JSCInlines.h"

namespace JSC { namespace DFG {

static bool verbose = false;

class ObjectAllocationSinkingPhase : public Phase {
public:
    ObjectAllocationSinkingPhase(Graph& graph)
        : Phase(graph, "object allocation sinking")
        , m_ssaCalculator(graph)
        , m_insertionSet(graph)
    {
    }
    
    bool run()
    {
        ASSERT(m_graph.m_fixpointState == FixpointNotConverged);
        
        m_graph.m_dominators.computeIfNecessary(m_graph);
        
        // Logically we wish to consider every NewObject and sink it. However it's definitely not
        // profitable to sink a NewObject that will always escape. So, first we do a very simple
        // forward flow analysis that determines the set of NewObject nodes that have any chance
        // of benefiting from object allocation sinking. Then we fixpoint the following rules:
        //
        // - For each NewObject, we turn the original NewObject into a PhantomNewObject and then
        //   we insert MaterializeNewObject just before each escaping site. Note that Upsilons
        //   constitute escaping sites. Then we use forward flow to eliminate unnecessary cases of
        //   MaterializeNewObject. We use the SSACalculator to insert these materializations. If a
        //   Phi is ever created that has the PhantomNewObject as one of its kids, then we insert
        //   a MaterializeNewObject in front of it; this way we never have a Phi that is confused
        //   about whether or not it has the real object. We then turn each PutByOffset over a
        //   PhantomNewObject into a PutByOffsetHint.
        //
        // - We perform the same optimization for MaterializeNewObject. This allows us to cover
        //   cases where we had MaterializeNewObject flowing into a PutByOffsetHint.
        //
        // We could also add this rule:
        //
        // - If all of the Upsilons of a Phi have a MaterializeNewObject that isn't used by anyone
        //   else, then replace the Phi with the MaterializeNewObject.
        //
        //   FIXME: Implement this. Note that this totally doable but it requires some gnarly
        //   code, and to be effective the pruner needs to be aware of it. Currently any Upsilon
        //   is considered to be an escape even by the pruner, so it's unlikely that we'll see
        //   many cases of Phi over Materializations.
        //   https://bugs.webkit.org/show_bug.cgi?id=136927
        
        if (!performSinking())
            return false;
        
        while (performSinking()) { }
        
        if (verbose) {
            dataLog("Graph after sinking:\n");
            m_graph.dump();
        }
        
        return true;
    }

private:
    bool performSinking()
    {
        m_graph.computeRefCounts();
        performLivenessAnalysis(m_graph);
        performOSRAvailabilityAnalysis(m_graph);
        
        CString graphBeforeSinking;
        if (Options::verboseValidationFailure() && Options::validateGraphAtEachPhase()) {
            StringPrintStream out;
            m_graph.dump(out);
            graphBeforeSinking = out.toCString();
        }
        
        if (verbose) {
            dataLog("Graph before sinking:\n");
            m_graph.dump();
        }
        
        determineMaterializationPoints();
        if (m_sinkCandidates.isEmpty())
            return false;
        
        // At this point we are committed to sinking the sinking candidates.
        placeMaterializationPoints();
        lowerNonReadingOperationsOnPhantomAllocations();
        promoteSunkenFields();
        
        if (Options::validateGraphAtEachPhase())
            validate(m_graph, DumpGraph, graphBeforeSinking);
        
        if (verbose)
            dataLog("Sinking iteration changed the graph.\n");
        return true;
    }
    
    void determineMaterializationPoints()
    {
        // The premise of this pass is that if there exists a point in the program where some
        // path from a phantom allocation site to that point causes materialization, then *all*
        // paths cause materialization. This should mean that there are never any redundant
        // materializations.
        
        m_sinkCandidates.clear();
        m_edgeToMaterializationPoint.clear();
        
        BlockMap<HashMap<Node*, bool>> materializedAtHead(m_graph);
        BlockMap<HashMap<Node*, bool>> materializedAtTail(m_graph);
        
        bool changed;
        do {
            if (verbose)
                dataLog("Doing iteration of materialization point placement.\n");
            changed = false;
            for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
                HashMap<Node*, bool> materialized = materializedAtHead[block];
                for (Node* node : *block) {
                    handleNode(
                        node,
                        [&] () {
                            materialized.add(node, false);
                        },
                        [&] (Node* escapee) {
                            auto iter = materialized.find(escapee);
                            if (iter != materialized.end())
                                iter->value = true;
                        });
                }
                
                if (verbose)
                    dataLog("    Materialized at tail of ", pointerDump(block), ": ", mapDump(materialized), "\n");
                
                if (materialized == materializedAtTail[block])
                    continue;
                
                materializedAtTail[block] = materialized;
                changed = true;
                
                // Only propagate things to our successors if they are alive in all successors.
                // So, we prune materialized-at-tail to only include things that are live.
                Vector<Node*> toRemove;
                for (auto pair : materialized) {
                    if (!block->ssa->liveAtTail.contains(pair.key))
                        toRemove.append(pair.key);
                }
                for (Node* key : toRemove)
                    materialized.remove(key);
                
                for (BasicBlock* successorBlock : block->successors()) {
                    for (auto pair : materialized) {
                        materializedAtHead[successorBlock].add(
                            pair.key, false).iterator->value |= pair.value;
                    }
                }
            }
        } while (changed);
        
        // Determine the sink candidates. Braodly, a sink candidate is a node that handleNode()
        // believes is sinkable, and one of the following is true:
        //
        // 1) There exists a basic block with only backward outgoing edges (or no outgoing edges)
        //    in which the node wasn't materialized. This is meant to catch effectively-infinite
        //    loops in which we don't need to have allocated the object.
        //
        // 2) There exists a basic block at the tail of which the node is not materialized and the
        //    node is dead.
        //
        // 3) The sum of execution counts of the materializations is less than the sum of
        //    execution counts of the original node.
        //
        // We currently implement only rule #2.
        // FIXME: Implement the two other rules.
        // https://bugs.webkit.org/show_bug.cgi?id=137073 (rule #1)
        // https://bugs.webkit.org/show_bug.cgi?id=137074 (rule #3)
        
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            for (auto pair : materializedAtTail[block]) {
                if (pair.value)
                    continue; // It was materialized.
                
                if (block->ssa->liveAtTail.contains(pair.key))
                    continue; // It might still get materialized in all of the successors.
                
                // We know that it died in this block and it wasn't materialized. That means that
                // if we sink this allocation, then *this* will be a path along which we never
                // have to allocate. Profit!
                m_sinkCandidates.add(pair.key);
            }
        }
        
        if (m_sinkCandidates.isEmpty())
            return;
        
        // A materialization edge exists at any point where a node escapes but hasn't been
        // materialized yet.
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            HashSet<Node*> materialized;
            for (auto pair : materializedAtHead[block]) {
                if (pair.value && m_sinkCandidates.contains(pair.key))
                    materialized.add(pair.key);
            }
            
            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
                Node* node = block->at(nodeIndex);
                
                handleNode(
                    node,
                    [&] () { },
                    [&] (Node* escapee) {
                        if (!m_sinkCandidates.contains(escapee))
                            return;
                        
                        if (!materialized.add(escapee).isNewEntry)
                            return;
                        
                        Node *materialize = createMaterialize(escapee, node->origin);
                        dataLog("Adding materialization point: ", node, "->", escapee, " = ", materialize, "\n");
                        m_edgeToMaterializationPoint.add(
                            std::make_pair(node, escapee), materialize);
                    });
            }
        }
    }
    
    void placeMaterializationPoints()
    {
        m_ssaCalculator.reset();
        
        HashMap<Node*, SSACalculator::Variable*> nodeToVariable;
        Vector<Node*> indexToNode;
        
        for (Node* node : m_sinkCandidates) {
            SSACalculator::Variable* variable = m_ssaCalculator.newVariable();
            nodeToVariable.add(node, variable);
            ASSERT(indexToNode.size() == variable->index());
            indexToNode.append(node);
        }
        
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            for (Node* node : *block) {
                if (SSACalculator::Variable* variable = nodeToVariable.get(node))
                    m_ssaCalculator.newDef(variable, block, node);
                
                m_graph.doToChildren(
                    node,
                    [&] (Edge edge) {
                        Node* materialize =
                            m_edgeToMaterializationPoint.get(std::make_pair(node, edge.node()));
                        if (!materialize)
                            return;
                        
                        m_ssaCalculator.newDef(
                            nodeToVariable.get(edge.node()), block, materialize);
                    });
            }
        }
        
        m_ssaCalculator.computePhis(
            [&] (SSACalculator::Variable* variable, BasicBlock* block) -> Node* {
                Node* allocation = indexToNode[variable->index()];
                if (!block->ssa->liveAtHead.contains(allocation))
                    return nullptr;
                
                Node* phiNode = m_graph.addNode(allocation->prediction(), Phi, NodeOrigin());
                phiNode->mergeFlags(NodeResultJS);
                return phiNode;
            });
        
        // Place Phis in the right places. Replace all uses of any allocation with the appropriate
        // materialization. Create the appropriate Upsilon nodes.
        LocalOSRAvailabilityCalculator availabilityCalculator;
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            HashMap<Node*, Node*> mapping;
            
            for (Node* candidate : block->ssa->liveAtHead) {
                SSACalculator::Variable* variable = nodeToVariable.get(candidate);
                if (!variable)
                    continue;
                
                SSACalculator::Def* def = m_ssaCalculator.reachingDefAtHead(block, variable);
                if (!def)
                    continue;
                
                mapping.set(indexToNode[variable->index()], def->value());
            }
            
            availabilityCalculator.beginBlock(block);
            for (SSACalculator::Def* phiDef : m_ssaCalculator.phisForBlock(block)) {
                m_insertionSet.insert(0, phiDef->value());
                
                Node* originalNode = indexToNode[phiDef->variable()->index()];
                insertOSRHintsForUpdate(
                    m_insertionSet, 0, NodeOrigin(), availabilityCalculator.m_availability,
                    originalNode, phiDef->value());

                mapping.set(originalNode, phiDef->value());
            }
            
            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
                Node* node = block->at(nodeIndex);

                m_graph.doToChildren(
                    node,
                    [&] (Edge edge) {
                        Node* materialize = m_edgeToMaterializationPoint.get(
                            std::make_pair(node, edge.node()));
                        if (materialize) {
                            m_insertionSet.insert(nodeIndex, materialize);
                            insertOSRHintsForUpdate(
                                m_insertionSet, nodeIndex, node->origin,
                                availabilityCalculator.m_availability, edge.node(), materialize);
                            mapping.set(edge.node(), materialize);
                        }
                    });

                availabilityCalculator.executeNode(node);
                
                m_graph.doToChildren(
                    node,
                    [&] (Edge& edge) {
                        if (Node* materialize = mapping.get(edge.node()))
                            edge.setNode(materialize);
                    });
            }
            
            size_t upsilonInsertionPoint = block->size() - 1;
            NodeOrigin upsilonOrigin = block->last()->origin;
            for (BasicBlock* successorBlock : block->successors()) {
                for (SSACalculator::Def* phiDef : m_ssaCalculator.phisForBlock(successorBlock)) {
                    Node* phiNode = phiDef->value();
                    SSACalculator::Variable* variable = phiDef->variable();
                    Node* allocation = indexToNode[variable->index()];
                    
                    Node* originalIncoming = mapping.get(allocation);
                    Node* incoming;
                    if (originalIncoming == allocation) {
                        // If we have a Phi that combines materializations with the original
                        // phantom object, then the path with the phantom object must materialize.
                        
                        incoming = createMaterialize(allocation, upsilonOrigin);
                        m_insertionSet.insert(upsilonInsertionPoint, incoming);
                        insertOSRHintsForUpdate(
                            m_insertionSet, upsilonInsertionPoint, upsilonOrigin,
                            availabilityCalculator.m_availability, originalIncoming, incoming);
                    } else
                        incoming = originalIncoming;
                    
                    Node* upsilon = m_insertionSet.insertNode(
                        upsilonInsertionPoint, SpecNone, Upsilon, upsilonOrigin,
                        OpInfo(phiNode), incoming->defaultEdge());
                    
                    if (originalIncoming == allocation) {
                        m_edgeToMaterializationPoint.add(
                            std::make_pair(upsilon, allocation), incoming);
                    }
                }
            }
            
            m_insertionSet.execute(block);
        }
        
        // At this point we have dummy materialization nodes along with edges to them. This means
        // that the part of the control flow graph that prefers to see actual object allocations
        // is completely fixed up, except for the materializations themselves.
    }
    
    void lowerNonReadingOperationsOnPhantomAllocations()
    {
        // Lower everything but reading operations on phantom allocations. We absolutely have to
        // lower all writes so as to reveal them to the SSA calculator. We cannot lower reads
        // because the whole point is that those go away completely.
        
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
                Node* node = block->at(nodeIndex);
                switch (node->op()) {
                case PutByOffset: {
                    if (m_sinkCandidates.contains(node->child2().node()))
                        node->convertToPutByOffsetHint();
                    break;
                }
                    
                case PutStructure: {
                    if (m_sinkCandidates.contains(node->child1().node())) {
                        Node* structure = m_insertionSet.insertConstant(
                            nodeIndex, node->origin, JSValue(node->transition()->next));
                        node->convertToPutStructureHint(structure);
                    }
                    break;
                }
                    
                case NewObject: {
                    if (m_sinkCandidates.contains(node)) {
                        Node* structure = m_insertionSet.insertConstant(
                            nodeIndex + 1, node->origin, JSValue(node->structure()));
                        m_insertionSet.insertNode(
                            nodeIndex + 1, SpecNone, PutStructureHint, node->origin,
                            Edge(node, KnownCellUse), Edge(structure, KnownCellUse));
                        node->convertToPhantomNewObject();
                    }
                    break;
                }
                    
                case MaterializeNewObject: {
                    if (m_sinkCandidates.contains(node)) {
                        m_insertionSet.insertNode(
                            nodeIndex + 1, SpecNone, PutStructureHint, node->origin,
                            Edge(node, KnownCellUse), m_graph.varArgChild(node, 0));
                        for (unsigned i = 0; i < node->objectMaterializationData().m_properties.size(); ++i) {
                            m_insertionSet.insertNode(
                                nodeIndex + 1, SpecNone, PutByOffsetHint, node->origin,
                                Edge(node, KnownCellUse),m_graph.varArgChild(node, i + 1));
                        }
                        node->convertToPhantomNewObject();
                    }
                    break;
                }
                    
                case StoreBarrier:
                case StoreBarrierWithNullCheck: {
                    if (m_sinkCandidates.contains(node->child1().node()))
                        node->convertToPhantom();
                    break;
                }
                    
                default:
                    break;
                }
                
                m_graph.doToChildren(
                    node,
                    [&] (Edge& edge) {
                        if (m_sinkCandidates.contains(edge.node()))
                            edge.setUseKind(KnownCellUse);
                    });
            }
            m_insertionSet.execute(block);
        }
    }
    
    void promoteSunkenFields()
    {
        // Henceforth when we encounter a materialization point, we will want to ask *who* it is
        // a materialization for. Invert the map to be able to answer such questions.
        m_materializationPointToEscapee.clear();
        for (auto pair : m_edgeToMaterializationPoint)
            m_materializationPointToEscapee.add(pair.value, pair.key.second);
        
        // Collect the set of heap locations that we will be operating over.
        HashSet<PromotedHeapLocation> locations;
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            for (Node* node : *block) {
                promoteHeapAccess(
                    node,
                    [&] (PromotedHeapLocation location, Edge) {
                        locations.add(location);
                    },
                    [&] (PromotedHeapLocation location) {
                        locations.add(location);
                    });
            }
        }
        
        // Figure out which locations belong to which allocations.
        m_locationsForAllocation.clear();
        for (PromotedHeapLocation location : locations) {
            auto result = m_locationsForAllocation.add(location.base(), Vector<PromotedHeapLocation>());
            ASSERT(!result.iterator->value.contains(location));
            result.iterator->value.append(location);
        }
        
        // For each sunken thingy, make sure we create Bottom values for all of its fields.
        // Note that this has the hilarious slight inefficiency of creating redundant hints for
        // things that were previously materializations. This should only impact compile times and
        // not code quality, and it's necessary for soundness without some data structure hackage.
        // For example, a MaterializeNewObject that we choose to sink may have new fields added to
        // it conditionally. That would necessitate Bottoms.
        Node* bottom = nullptr;
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            if (block == m_graph.block(0))
                bottom = m_insertionSet.insertNode(0, SpecNone, BottomValue, NodeOrigin());
            
            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
                Node* node = block->at(nodeIndex);
                for (PromotedHeapLocation location : m_locationsForAllocation.get(node)) {
                    m_insertionSet.insert(
                        nodeIndex + 1, location.createHint(m_graph, node->origin, bottom));
                }
            }
            m_insertionSet.execute(block);
        }

        m_ssaCalculator.reset();

        // Collect the set of "variables" that we will be sinking.
        m_locationToVariable.clear();
        m_indexToLocation.clear();
        for (PromotedHeapLocation location : locations) {
            SSACalculator::Variable* variable = m_ssaCalculator.newVariable();
            m_locationToVariable.add(location, variable);
            ASSERT(m_indexToLocation.size() == variable->index());
            m_indexToLocation.append(location);
        }
        
        // Create Defs from the existing hints.
        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
            for (Node* node : *block) {
                promoteHeapAccess(
                    node,
                    [&] (PromotedHeapLocation location, Edge value) {
                        SSACalculator::Variable* variable = m_locationToVariable.get(location);
                        m_ssaCalculator.newDef(variable, block, value.node());
                    },
                    [&] (PromotedHeapLocation) { });
            }
        }
        
        // OMG run the SSA calculator to create Phis!
        m_ssaCalculator.computePhis(
            [&] (SSACalculator::Variable* variable, BasicBlock* block) -> Node* {
                PromotedHeapLocation location = m_indexToLocation[variable->index()];
                if (!block->ssa->liveAtHead.contains(location.base()))
                    return nullptr;
                
                Node* phiNode = m_graph.addNode(SpecHeapTop, Phi, NodeOrigin());
                phiNode->mergeFlags(NodeResultJS);
                return phiNode;
            });
        
        // Place Phis in the right places, replace all uses of any load with the appropriate
        // value, and create the appropriate Upsilon nodes.
        m_graph.clearReplacements();
        for (BasicBlock* block : m_graph.blocksInPreOrder()) {
            // This mapping table is intended to be lazy. If something is omitted from the table,
            // it means that there haven't been any local stores to that promoted heap location.
            m_localMapping.clear();
            
            // Insert the Phi functions that we had previously created.
            for (SSACalculator::Def* phiDef : m_ssaCalculator.phisForBlock(block)) {
                PromotedHeapLocation location = m_indexToLocation[phiDef->variable()->index()];
                
                m_insertionSet.insert(
                    0, phiDef->value());
                m_insertionSet.insert(
                    0, location.createHint(m_graph, NodeOrigin(), phiDef->value()));
                m_localMapping.add(location, phiDef->value());
            }
            
            if (verbose)
                dataLog("Local mapping at ", pointerDump(block), ": ", mapDump(m_localMapping), "\n");
            
            // Process the block and replace all uses of loads with the promoted value.
            for (Node* node : *block) {
                m_graph.performSubstitution(node);
                
                if (Node* escapee = m_materializationPointToEscapee.get(node))
                    populateMaterialize(block, node, escapee);
                
                promoteHeapAccess(
                    node,
                    [&] (PromotedHeapLocation location, Edge value) {
                        m_localMapping.set(location, value.node());
                    },
                    [&] (PromotedHeapLocation location) {
                        node->replaceWith(resolve(block, location));
                    });
            }
            
            // Gotta drop some Upsilons.
            size_t upsilonInsertionPoint = block->size() - 1;
            NodeOrigin upsilonOrigin = block->last()->origin;
            for (BasicBlock* successorBlock : block->successors()) {
                for (SSACalculator::Def* phiDef : m_ssaCalculator.phisForBlock(successorBlock)) {
                    Node* phiNode = phiDef->value();
                    SSACalculator::Variable* variable = phiDef->variable();
                    PromotedHeapLocation location = m_indexToLocation[variable->index()];
                    Node* incoming = resolve(block, location);
                    
                    m_insertionSet.insertNode(
                        upsilonInsertionPoint, SpecNone, Upsilon, upsilonOrigin,
                        OpInfo(phiNode), incoming->defaultEdge());
                }
            }
            
            m_insertionSet.execute(block);
        }
    }
    
    Node* resolve(BasicBlock* block, PromotedHeapLocation location)
    {
        if (Node* result = m_localMapping.get(location))
            return result;
        
        // This implies that there is no local mapping. Find a non-local mapping.
        SSACalculator::Def* def = m_ssaCalculator.nonLocalReachingDef(
            block, m_locationToVariable.get(location));
        ASSERT(def);
        ASSERT(def->value());
        m_localMapping.add(location, def->value());
        return def->value();
    }

    template<typename SinkCandidateFunctor, typename EscapeFunctor>
    void handleNode(
        Node* node,
        const SinkCandidateFunctor& sinkCandidate,
        const EscapeFunctor& escape)
    {
        switch (node->op()) {
        case NewObject:
        case MaterializeNewObject:
            sinkCandidate();
            break;
            
        case CheckStructure:
        case GetByOffset:
        case MultiGetByOffset:
        case PutStructure:
        case GetGetterSetterByOffset:
        case MovHint:
        case Phantom:
        case Check:
        case HardPhantom:
        case StoreBarrier:
        case StoreBarrierWithNullCheck:
        case PutByOffsetHint:
            break;
            
        case PutByOffset:
            escape(node->child3().node());
            break;
            
        case MultiPutByOffset:
            // FIXME: In the future we should be able to handle this. It's just a matter of
            // building the appropriate *Hint variant of this instruction, along with a
            // PhantomStructureSelect node - since this transforms the Structure in a conditional
            // way.
            // https://bugs.webkit.org/show_bug.cgi?id=136924
            escape(node->child1().node());
            escape(node->child2().node());
            break;

        default:
            m_graph.doToChildren(
                node,
                [&escape] (Edge edge) {
                    escape(edge.node());
                });
            break;
        }
    }
    
    Node* createMaterialize(Node* escapee, const NodeOrigin whereOrigin)
    {
        switch (escapee->op()) {
        case NewObject:
        case MaterializeNewObject: {
            ObjectMaterializationData* data = m_graph.m_objectMaterializationData.add();
            
            Node* result = m_graph.addNode(
                escapee->prediction(), Node::VarArg, MaterializeNewObject,
                NodeOrigin(
                    escapee->origin.semantic,
                    whereOrigin.forExit),
                OpInfo(data), OpInfo(), 0, 0);
            return result;
        }
            
        default:
            DFG_CRASH(m_graph, escapee, "Bad escapee op");
            return nullptr;
        }
    }
    
    void populateMaterialize(BasicBlock* block, Node* node, Node* escapee)
    {
        switch (node->op()) {
        case MaterializeNewObject: {
            ObjectMaterializationData& data = node->objectMaterializationData();
            unsigned firstChild = m_graph.m_varArgChildren.size();
            
            Vector<PromotedHeapLocation> locations = m_locationsForAllocation.get(escapee);
            
            PromotedHeapLocation structure(StructurePLoc, escapee);
            ASSERT(locations.contains(structure));
            
            m_graph.m_varArgChildren.append(Edge(resolve(block, structure), KnownCellUse));
            
            for (unsigned i = 0; i < locations.size(); ++i) {
                switch (locations[i].kind()) {
                case StructurePLoc: {
                    ASSERT(locations[i] == structure);
                    break;
                }
                    
                case NamedPropertyPLoc: {
                    Node* value = resolve(block, locations[i]);
                    if (value->op() == BottomValue) {
                        // We can skip Bottoms entirely.
                        break;
                    }
                    
                    data.m_properties.append(PhantomPropertyValue(locations[i].info()));
                    m_graph.m_varArgChildren.append(value);
                    break;
                }
                    
                default:
                    DFG_CRASH(m_graph, node, "Bad location kind");
                }
            }
            
            node->children = AdjacencyList(
                AdjacencyList::Variable,
                firstChild, m_graph.m_varArgChildren.size() - firstChild);
            break;
        }
            
        default:
            DFG_CRASH(m_graph, node, "Bad materialize op");
            break;
        }
    }
    
    SSACalculator m_ssaCalculator;
    HashSet<Node*> m_sinkCandidates;
    HashMap<std::pair<Node*, Node*>, Node*> m_edgeToMaterializationPoint;
    HashMap<Node*, Node*> m_materializationPointToEscapee;
    HashMap<Node*, Vector<PromotedHeapLocation>> m_locationsForAllocation;
    HashMap<PromotedHeapLocation, SSACalculator::Variable*> m_locationToVariable;
    Vector<PromotedHeapLocation> m_indexToLocation;
    HashMap<PromotedHeapLocation, Node*> m_localMapping;
    InsertionSet m_insertionSet;
};
    
bool performObjectAllocationSinking(Graph& graph)
{
    SamplingRegion samplingRegion("DFG Object Allocation Sinking Phase");
    return runPhase<ObjectAllocationSinkingPhase>(graph);
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGObjectAllocationSinkingPhase_h
#define DFGObjectAllocationSinkingPhase_h

#if ENABLE(DFG_JIT)

namespace JSC { namespace DFG {

class Graph;

// Sinks object allocations down to their uses. This will sink the allocations over OSR exits, by
// replacing all stores to those objects with store hints so that OSR exit can materialize the
// object. This may sink allocations past returns, creating control flow paths along which the
// objects are not allocated at all. Replaces all uses of the objects' fields with SSA data flow.

bool performObjectAllocationSinking(Graph&);

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGObjectAllocationSinkingPhase_h




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGObjectMaterializationData.h"

#if ENABLE(DFG_JIT)

#include <wtf/ListDump.h>

namespace JSC { namespace DFG {

void PhantomPropertyValue::dump(PrintStream& out) const
{
    out.print("id", m_identifierNumber);
}

void ObjectMaterializationData::dump(PrintStream& out) const
{
    out.print("[", listDump(m_properties), "]");
}

float ObjectMaterializationData::oneWaySimilarityScore(
    const ObjectMaterializationData& other) const
{
    unsigned numHits = 0;
    for (PhantomPropertyValue value : m_properties) {
        if (other.m_properties.contains(value))
            numHits++;
    }
    return static_cast<float>(numHits) / static_cast<float>(m_properties.size());
}

float ObjectMaterializationData::similarityScore(const ObjectMaterializationData& other) const
{
    return std::min(oneWaySimilarityScore(other), other.oneWaySimilarityScore(*this));
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGObjectMaterializationData_h
#define DFGObjectMaterializationData_h

#if ENABLE(DFG_JIT)

#include <wtf/PrintStream.h>
#include <wtf/Vector.h>

namespace JSC { namespace DFG {

struct PhantomPropertyValue {
    PhantomPropertyValue()
        : m_identifierNumber(UINT_MAX)
    {
    }
    
    PhantomPropertyValue(unsigned identifierNumber)
        : m_identifierNumber(identifierNumber)
    {
    }
    
    unsigned m_identifierNumber;
    
    bool operator==(const PhantomPropertyValue& other) const
    {
        return m_identifierNumber == other.m_identifierNumber;
    }
    
    void dump(PrintStream&) const;
};

struct ObjectMaterializationData {
    // Determines the meaning of the passed nodes.
    Vector<PhantomPropertyValue> m_properties;
    
    void dump(PrintStream&) const;
    
    // The fraction of my properties that the other data has.
    float oneWaySimilarityScore(const ObjectMaterializationData&) const;
    
    // The minimum of the two possible one-way scores.
    float similarityScore(const ObjectMaterializationData&) const;
};

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGObjectMaterializationData_h




        ASSERT(m_graph.m_form == SSA);
        
        m_graph.clearFlagsOnAllNodes(NodeNeedsPhantom | NodeNeedsHardPhantom | NodeRelevantToOSR);
        m_graph.mergeRelevantToOSR();
        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
            BasicBlock* block = m_graph.block(blockIndex);
            if (!block)
                continue;
            
            for (unsigned i = block->size(); i--;) {
                Node* node = block->at(i);
                if (node->op() == MovHint)
                    node->child1()->mergeFlags(NodeRelevantToOSR);
            }
        }
        
        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
            BasicBlock* block = m_graph.block(blockIndex);



            }
        }
        
        m_graph.mergeRelevantToOSR();
            BasicBlock* block = m_graph.block(blockIndex);
            if (!block)
                continue;
            
            for (unsigned i = block->size(); i--;) {
                Node* node = block->at(i);
                if (node->op() == MovHint)
                    node->child1()->mergeFlags(NodeRelevantToOSR);
            }
        }
        
        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
            BasicBlock* block = m_graph.block(blockIndex);



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGPhiChildren.h"

#if ENABLE(DFG_JIT)

#include "DFGGraph.h"

namespace JSC { namespace DFG {

PhiChildren::PhiChildren()
{
}

PhiChildren::PhiChildren(Graph& graph)
{
    for (BasicBlock* block : graph.blocksInNaturalOrder()) {
        for (Node* node : *block) {
            if (node->op() != Upsilon)
                continue;
            
            m_children.add(node->phi(), List()).iterator->value.append(node);
        }
    }
}

PhiChildren::~PhiChildren()
{
}

const PhiChildren::List& PhiChildren::upsilonsOf(Node* node) const
{
    ASSERT(node->op() == Phi);
    return m_children.find(node)->value;
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGPhiChildren_h
#define DFGPhiChildren_h

#if ENABLE(DFG_JIT)

#include "DFGNode.h"
#include <wtf/HashSet.h>
#include <wtf/Vector.h>

namespace JSC { namespace DFG {

class Graph;

class PhiChildren {
public:
    typedef Vector<Node*, 3> List;
    
    PhiChildren();
    PhiChildren(Graph&);
    ~PhiChildren();
    
    // The list of Upsilons that point to the children of the Phi.
    const List& upsilonsOf(Node*) const;
    
    template<typename Functor>
    void forAllIncomingValues(Node* node, const Functor& functor)
    {
        for (Node* upsilon : upsilonsOf(node))
            functor(upsilon->child1().node());
    }
    
    // This walks the Phi graph.
    template<typename Functor>
    void forAllTransitiveIncomingValues(Node* node, const Functor& functor)
    {
        if (node->op() != Phi) {
            functor(node);
            return;
        }
        HashSet<Node*> seen;
        Vector<Node*> worklist;
        seen.add(node);
        worklist.append(node);
        while (!worklist.isEmpty()) {
            Node* currentNode = worklist.takeLast();
            forAllIncomingValues(
                currentNode,
                [&] (Node* incomingNode) {
                    if (incomingNode->op() == Phi) {
                        if (seen.add(incomingNode).isNewEntry)
                            worklist.append(incomingNode);
                    } else
                        functor(incomingNode);
                });
        }
    }
    
private:
    HashMap<Node*, List> m_children;
};

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGPhiChildren_h




#include "DFGLoopPreHeaderCreationPhase.h"
#include "DFGOSRAvailabilityAnalysisPhase.h"
#include "DFGOSREntrypointCreationPhase.h"
#include "DFGObjectAllocationSinkingPhase.h"
#include "DFGPhantomCanonicalizationPhase.h"
#include "DFGPhantomRemovalPhase.h"
#include "DFGPredictionInjectionPhase.h"

    if (validationEnabled()) {
        dfg.m_dominators.computeIfNecessary(dfg);
        dfg.m_naturalLoops.computeIfNecessary(dfg);
        dfg.m_prePostNumbering.computeIfNecessary(dfg);
    }

    switch (mode) {

        performCFA(dfg);
        performConstantFolding(dfg);
        performPhantomCanonicalization(dfg); // Reduce the graph size a lot.
        if (performStrengthReduction(dfg) | performObjectAllocationSinking(dfg)) {
            // State-at-tail and state-at-head will be invalid if we did strength reduction since
            // it might increase live ranges.
            performLivenessAnalysis(dfg);
            performCFA(dfg);
            performConstantFolding(dfg);
        }
        performLICM(dfg);
        performPhantomCanonicalization(dfg);



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGPrePostNumbering.h"

#if ENABLE(DFG_JIT)

#include "DFGBlockMapInlines.h"
#include "DFGBlockWorklist.h"
#include "DFGGraph.h"

namespace JSC { namespace DFG {

PrePostNumbering::PrePostNumbering() { }
PrePostNumbering::~PrePostNumbering() { }

void PrePostNumbering::compute(Graph& graph)
{
    m_map = BlockMap<Numbering>(graph);
    
    PostOrderBlockWorklist worklist;
    worklist.push(graph.block(0));
    unsigned nextPreNumber = 0;
    unsigned nextPostNumber = 0;
    while (BlockWithOrder item = worklist.pop()) {
        switch (item.order) {
        case PreOrder:
            m_map[item.block].m_preNumber = nextPreNumber++;
            worklist.pushPost(item.block);
            for (BasicBlock* successor : item.block->successors())
                worklist.push(successor);
            break;
        case PostOrder:
            m_map[item.block].m_postNumber = nextPostNumber++;
            break;
        }
    }
}

} } // namespace JSC::DFG

namespace WTF {

using namespace JSC::DFG;

void printInternal(PrintStream& out, EdgeKind kind)
{
    switch (kind) {
    case ForwardEdge:
        out.print("ForwardEdge");
        return;
    case CrossEdge:
        out.print("CrossEdge");
        return;
    case BackEdge:
        out.print("BackEdge");
        return;
    }
    
    RELEASE_ASSERT_NOT_REACHED();
}

} // namespace WTF

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGPrePostNumbering_h
#define DFGPrePostNumbering_h

#if ENABLE(DFG_JIT)

#include "DFGAnalysis.h"
#include "DFGBasicBlock.h"
#include "DFGBlockMap.h"

namespace JSC { namespace DFG {

enum EdgeKind {
    ForwardEdge,
    CrossEdge,
    BackEdge
};

class PrePostNumbering : public Analysis<PrePostNumbering> {
public:
    PrePostNumbering();
    ~PrePostNumbering();

    void compute(Graph&);
    
    unsigned preNumber(BasicBlock* block) const { return m_map[block].m_preNumber; }
    unsigned postNumber(BasicBlock* block) const { return m_map[block].m_postNumber; }
    
    // Is from a strict ancestor of to?
    bool isStrictAncestorOf(BasicBlock* from, BasicBlock* to) const
    {
        return preNumber(from) < preNumber(to)
            && postNumber(from) > postNumber(to);
    }
    
    bool isAncestorOf(BasicBlock* from, BasicBlock* to) const
    {
        return from == to || isStrictAncestorOf(from, to);
    }
    
    bool isStrictDescendantOf(BasicBlock* from, BasicBlock* to) const
    {
        return isStrictAncestorOf(to, from);
    }
    
    bool isDescendantOf(BasicBlock* from, BasicBlock* to) const
    {
        return isAncestorOf(to, from);
    }
    
    // This will give a bogus answer if there is actually no such edge. If you want to determine
    // if there is any such edge, you have to do it yourself.
    EdgeKind edgeKind(BasicBlock* from, BasicBlock* to) const
    {
        if (isStrictDescendantOf(to, from))
            return ForwardEdge;
        
        if (isAncestorOf(to, from))
            return BackEdge;
        
        return CrossEdge;
    }
    
private:
    struct Numbering {
        unsigned m_preNumber;
        unsigned m_postNumber;
    };
    
    BlockMap<Numbering> m_map;
};

} } // namespace JSC::DFG

namespace WTF {

void printInternal(PrintStream&, JSC::DFG::EdgeKind);

} // namespace WTF

#endif // ENABLE(DFG_JIT)

#endif // DFGPrePostNumbering_h


Lines 560-566 private: Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp_sec1
- Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp -1 / +6 lines
560	case DoubleConstant:	560	case DoubleConstant:
561	case Int52Constant:	561	case Int52Constant:
562	case Identity:	562	case Identity:
563	case BooleanToNumber: {	563	case BooleanToNumber:
		564	case PhantomNewObject:
		565	case PutByOffsetHint:
		566	case CheckStructureImmediate:
		567	case PutStructureHint:
		568	case MaterializeNewObject: {
564	// This node should never be visible at this stage of compilation. It is	569	// This node should never be visible at this stage of compilation. It is
565	// inserted by fixup(), which follows this phase.	570	// inserted by fixup(), which follows this phase.
566	RELEASE_ASSERT_NOT_REACHED();	571	RELEASE_ASSERT_NOT_REACHED();



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGPromoteHeapAccess_h
#define DFGPromoteHeapAccess_h

#if ENABLE(DFG_JIT)

#include "DFGNode.h"
#include "DFGPromotedHeapLocation.h"

namespace JSC { namespace DFG {

// Note that the write functor is really the useful thing here. The read functor is only useful
// for the object allocation sinking phase.
template<typename WriteFunctor, typename ReadFunctor>
void promoteHeapAccess(Node* node, const WriteFunctor& write, const ReadFunctor& read)
{
    switch (node->op()) {
    case CheckStructure: {
        if (node->child1()->isPhantomObjectAllocation())
            read(PromotedHeapLocation(StructurePLoc, node->child1()));
        break;
    }
            
    case GetByOffset:
    case GetGetterSetterByOffset: {
        if (node->child2()->isPhantomObjectAllocation()) {
            unsigned identifierNumber = node->storageAccessData().identifierNumber;
            read(PromotedHeapLocation(NamedPropertyPLoc, node->child2(), identifierNumber));
        }
        break;
    }
                                  
    case MultiGetByOffset: {
        if (node->child1()->isPhantomObjectAllocation()) {
            unsigned identifierNumber = node->multiGetByOffsetData().identifierNumber;
            read(PromotedHeapLocation(NamedPropertyPLoc, node->child1(), identifierNumber));
        }
        break;
    }
            
    case PutStructureHint: {
        ASSERT(node->child1()->isPhantomObjectAllocation());
        write(PromotedHeapLocation(StructurePLoc, node->child1()), node->child2());
        break;
    }
            
    case PutByOffsetHint: {
        ASSERT(node->child1()->isPhantomObjectAllocation());
        unsigned identifierNumber = node->identifierNumber();
        write(
            PromotedHeapLocation(NamedPropertyPLoc, node->child1(), identifierNumber),
            node->child2());
        break;
    }

    default:
        break;
    }
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)

#endif // DFGPromoteHeapAccess_h




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGPromotedHeapLocation.h"

#if ENABLE(DFG_JIT)

#include "DFGGraph.h"

namespace JSC { namespace DFG {

void PromotedLocationDescriptor::dump(PrintStream& out) const
{
    out.print(m_kind, "(", m_info, ")");
}

Node* PromotedHeapLocation::createHint(Graph& graph, NodeOrigin origin, Node* value)
{
    switch (kind()) {
    case StructurePLoc:
        return graph.addNode(
            SpecNone, PutStructureHint, origin,
            Edge(base(), KnownCellUse), Edge(value, KnownCellUse));
        
    case NamedPropertyPLoc:
        return graph.addNode(
            SpecNone, PutByOffsetHint, origin,
            OpInfo(info()), Edge(base(), KnownCellUse), Edge(value, UntypedUse));
        
    case InvalidPromotedLocationKind:
        return nullptr;
    }
    
    RELEASE_ASSERT_NOT_REACHED();
}

void PromotedHeapLocation::dump(PrintStream& out) const
{
    out.print(kind(), "(", m_base, ", ", info(), ")");
}

} } // namespace JSC::DFG

namespace WTF {

using namespace JSC::DFG;

void printInternal(PrintStream& out, PromotedLocationKind kind)
{
    switch (kind) {
    case InvalidPromotedLocationKind:
        out.print("InvalidPromotedLocationKind");
        return;
        
    case StructurePLoc:
        out.print("StructurePLoc");
        return;
        
    case NamedPropertyPLoc:
        out.print("NamedPropertyPLoc");
        return;
    }
    
    RELEASE_ASSERT_NOT_REACHED();
}

} // namespace WTF;

#endif // ENABLE(DFG_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGPromotedHeapLocation_h
#define DFGPromotedHeapLocation_h

#if ENABLE(DFG_JIT)

#include "DFGNode.h"
#include <wtf/PrintStream.h>

namespace JSC { namespace DFG {

enum PromotedLocationKind {
    InvalidPromotedLocationKind,
    
    StructurePLoc,
    NamedPropertyPLoc
};

class PromotedLocationDescriptor {
public:
    PromotedLocationDescriptor(
        PromotedLocationKind kind = InvalidPromotedLocationKind, unsigned info = 0)
        : m_kind(kind)
        , m_info(info)
    {
    }
    
    bool operator!() const { return m_kind == InvalidPromotedLocationKind; }
    
    PromotedLocationKind kind() const { return m_kind; }
    unsigned info() const { return m_info; }
    
    unsigned hash() const
    {
        return m_kind + m_info;
    }
    
    bool operator==(const PromotedLocationDescriptor& other) const
    {
        return m_kind == other.m_kind
            && m_info == other.m_info;
    }
    
    bool operator!=(const PromotedLocationDescriptor& other) const
    {
        return !(*this == other);
    }

    bool isHashTableDeletedValue() const
    {
        return m_kind == InvalidPromotedLocationKind && m_info;
    }
    
    void dump(PrintStream& out) const;

private:
    PromotedLocationKind m_kind;
    unsigned m_info;
};

class PromotedHeapLocation {
public:
    PromotedHeapLocation(
        PromotedLocationKind kind = InvalidPromotedLocationKind,
        Node* base = nullptr, unsigned info = 0)
        : m_base(base)
        , m_meta(kind, info)
    {
    }
    
    PromotedHeapLocation(
        PromotedLocationKind kind, Edge base, unsigned info = 0)
        : PromotedHeapLocation(kind, base.node(), info)
    {
    }
    
    PromotedHeapLocation(Node* base, PromotedLocationDescriptor meta)
        : m_base(base)
        , m_meta(meta)
    {
    }
    
    PromotedHeapLocation(WTF::HashTableDeletedValueType)
        : m_base(nullptr)
        , m_meta(InvalidPromotedLocationKind, 1)
    {
    }
    
    Node* createHint(Graph&, NodeOrigin, Node* value);
    
    bool operator!() const { return kind() == InvalidPromotedLocationKind; }
    
    PromotedLocationKind kind() const { return m_meta.kind(); }
    Node* base() const { return m_base; }
    unsigned info() const { return m_meta.info(); }
    PromotedLocationDescriptor descriptor() const { return m_meta; }
    
    unsigned hash() const
    {
        return m_meta.hash() + WTF::PtrHash<Node*>::hash(m_base);
    }
    
    bool operator==(const PromotedHeapLocation& other) const
    {
        return m_base == other.m_base
            && m_meta == other.m_meta;
    }
    
    bool isHashTableDeletedValue() const
    {
        return m_meta.isHashTableDeletedValue();
    }
    
    void dump(PrintStream& out) const;
    
private:
    Node* m_base;
    PromotedLocationDescriptor m_meta;
};

struct PromotedHeapLocationHash {
    static unsigned hash(const PromotedHeapLocation& key) { return key.hash(); }
    static bool equal(const PromotedHeapLocation& a, const PromotedHeapLocation& b) { return a == b; }
    static const bool safeToCompareToEmptyOrDeleted = true;
};

} } // namespace JSC::DFG

namespace WTF {

void printInternal(PrintStream&, JSC::DFG::PromotedLocationKind);

template<typename T> struct DefaultHash;
template<> struct DefaultHash<JSC::DFG::PromotedHeapLocation> {
    typedef JSC::DFG::PromotedHeapLocationHash Hash;
};

template<typename T> struct HashTraits;
template<> struct HashTraits<JSC::DFG::PromotedHeapLocation> : SimpleClassHashTraits<JSC::DFG::PromotedHeapLocation> {
    static const bool emptyValueIsZero = false;
};

} // namespace WTF

#endif // ENABLE(DFG_JIT)

#endif // DFGPromotedHeapLocation_h




{
}

void SSACalculator::reset()
{
    m_variables.clear();
    m_defs.clear();
    m_phis.clear();
    for (BlockIndex blockIndex = m_data.size(); blockIndex--;) {
        m_data[blockIndex].m_defs.clear();
        m_data[blockIndex].m_phis.clear();
    }
}

SSACalculator::Variable* SSACalculator::newVariable()
{
    return &m_variables.alloc(Variable(m_variables.size()));

Lines 105-110 public: Source/JavaScriptCore/dfg/DFGSSACalculator.h_sec1
- Source/JavaScriptCore/dfg/DFGSSACalculator.h +2 lines
105	SSACalculator(Graph&);	105	SSACalculator(Graph&);
106	~SSACalculator();	106	~SSACalculator();
107		107
		108	void reset();
		109
108	class Variable {	110	class Variable {
109	public:	111	public:
110	unsigned index() const { return m_index; }	112	unsigned index() const { return m_index; }

Lines 270-275 bool safeToExecute(AbstractStateType& st Source/JavaScriptCore/dfg/DFGSafeToExecute.h_sec1
- Source/JavaScriptCore/dfg/DFGSafeToExecute.h +5 lines
270	case GetGenericPropertyEnumerator:	270	case GetGenericPropertyEnumerator:
271	case GetEnumeratorPname:	271	case GetEnumeratorPname:
272	case ToIndexString:	272	case ToIndexString:
		273	case PhantomNewObject:
		274	case PutByOffsetHint:
		275	case CheckStructureImmediate:
		276	case PutStructureHint:
		277	case MaterializeNewObject:
273	return true;	278	return true;
274		279
275	case NativeCall:	280	case NativeCall:

Lines 4912-4917 void SpeculativeJIT::compile(Node* node) Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp +5 lines
4912	case NativeConstruct:	4912	case NativeConstruct:
4913	case CheckBadCell:	4913	case CheckBadCell:
4914	case BottomValue:	4914	case BottomValue:
		4915	case PhantomNewObject:
		4916	case PutByOffsetHint:
		4917	case CheckStructureImmediate:
		4918	case PutStructureHint:
		4919	case MaterializeNewObject:
4915	RELEASE_ASSERT_NOT_REACHED();	4920	RELEASE_ASSERT_NOT_REACHED();
4916	break;	4921	break;
4917	}	4922	}

Lines 4982-4987 void SpeculativeJIT::compile(Node* node) Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp +5 lines
4982	case FiatInt52:	4982	case FiatInt52:
4983	case CheckBadCell:	4983	case CheckBadCell:
4984	case BottomValue:	4984	case BottomValue:
		4985	case PhantomNewObject:
		4986	case PutByOffsetHint:
		4987	case CheckStructureImmediate:
		4988	case PutStructureHint:
		4989	case MaterializeNewObject:
4985	DFG_CRASH(m_jit.graph(), node, "Unexpected node");	4990	DFG_CRASH(m_jit.graph(), node, "Unexpected node");
4986	break;	4991	break;
4987	}	4992	}



        else
            m_canExit = mayExit(m_jit.graph(), m_currentNode);
        
        m_interpreter.startExecuting();
        m_jit.setForNode(m_currentNode);
        m_codeOriginForExitTarget = m_currentNode->origin.forExit;
        m_codeOriginForExitProfile = m_currentNode->origin.semantic;

        }
        
        // Make sure that the abstract state is rematerialized for the next node.
        m_interpreter.executeEffects(m_indexInBlock);
            m_interpreter.executeEffects(m_indexInBlock);
    }
    
    // Perform the most basic verification that children have been used correctly.



                Node* node = block->node(i);
                if (m_graph.m_refCountState == ExactRefCount)
                    V_EQUAL((node), m_myRefCounts.get(node), node->adjustedRefCount());
                else
                    V_EQUAL((node), node->refCount(), 1);
            }
            
            for (size_t i = 0 ; i < block->size() - 1; ++i) {

Lines 168-173 inline CapabilityLevel canCompile(Node* Source/JavaScriptCore/ftl/FTLCapabilities.cpp_sec1
- Source/JavaScriptCore/ftl/FTLCapabilities.cpp +5 lines
168	case GetEnumeratorPname:	168	case GetEnumeratorPname:
169	case ToIndexString:	169	case ToIndexString:
170	case BottomValue:	170	case BottomValue:
		171	case PhantomNewObject:
		172	case PutByOffsetHint:
		173	case CheckStructureImmediate:
		174	case PutStructureHint:
		175	case MaterializeNewObject:
171	// These are OK.	176	// These are OK.
172	break;	177	break;
173	case ProfiledCall:	178	case ProfiledCall:



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLExitPropertyValue.h"

#if ENABLE(FTL_JIT)

namespace JSC { namespace FTL {

void ExitPropertyValue::dump(PrintStream& out) const
{
    out.print(m_location, " => ", m_value);
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLExitPropertyValue_h
#define FTLExitPropertyValue_h

#if ENABLE(FTL_JIT)

#include "DFGPromotedHeapLocation.h"
#include "FTLExitValue.h"

namespace JSC { namespace FTL {

class ExitPropertyValue {
public:
    ExitPropertyValue()
    {
    }
    
    ExitPropertyValue(DFG::PromotedLocationDescriptor location, const ExitValue& value)
        : m_location(location)
        , m_value(value)
    {
        ASSERT(!!location == !!value);
    }
    
    bool operator!() const { return !m_location; }
    
    DFG::PromotedLocationDescriptor location() const { return m_location; }
    const ExitValue& value() const { return m_value; }
    
    void dump(PrintStream& out) const;

private:
    DFG::PromotedLocationDescriptor m_location;
    ExitValue m_value;
};

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLExitPropertyValue_h




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLExitTimeObjectMaterialization.h"

#if ENABLE(FTL_JIT)

#include "DFGGraph.h"

namespace JSC { namespace FTL {

using namespace JSC::DFG;

ExitTimeObjectMaterialization::ExitTimeObjectMaterialization(NodeType type)
    : m_type(type)
{
}

ExitTimeObjectMaterialization::~ExitTimeObjectMaterialization()
{
}

void ExitTimeObjectMaterialization::add(
    PromotedLocationDescriptor location, const ExitValue& value)
{
    m_properties.append(ExitPropertyValue(location, value));
}

ExitValue ExitTimeObjectMaterialization::get(PromotedLocationDescriptor location) const
{
    for (ExitPropertyValue value : m_properties) {
        if (value.location() == location)
            return value.value();
    }
    return ExitValue();
}

void ExitTimeObjectMaterialization::dump(PrintStream& out) const
{
    out.print(RawPointer(this), ":", Graph::opName(m_type), "(", listDump(m_properties), ")");
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLExitTimeObjectMaterialization_h
#define FTLExitTimeObjectMaterialization_h

#if ENABLE(FTL_JIT)

#include "DFGNodeType.h"
#include "FTLExitPropertyValue.h"
#include "FTLExitValue.h"
#include <wtf/Noncopyable.h>

namespace JSC { namespace FTL {

class ExitTimeObjectMaterialization {
    WTF_MAKE_NONCOPYABLE(ExitTimeObjectMaterialization)
public:
    ExitTimeObjectMaterialization(DFG::NodeType);
    ~ExitTimeObjectMaterialization();
    
    void add(DFG::PromotedLocationDescriptor, const ExitValue&);
    
    DFG::NodeType type() const { return m_type; }
    
    ExitValue get(DFG::PromotedLocationDescriptor) const;
    const Vector<ExitPropertyValue>& properties() const { return m_properties; }
    
    void dump(PrintStream& out) const;
    
private:
    DFG::NodeType m_type;
    Vector<ExitPropertyValue> m_properties;
};

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

#endif // FTLExitTimeObjectMaterialization_h


Lines 28-37 Source/JavaScriptCore/ftl/FTLExitValue.cpp_sec1
- Source/JavaScriptCore/ftl/FTLExitValue.cpp +12 lines
28		28
29	#if ENABLE(FTL_JIT)	29	#if ENABLE(FTL_JIT)
30		30
		31	#include "FTLExitTimeObjectMaterialization.h"
31	#include "JSCInlines.h"	32	#include "JSCInlines.h"
32		33
33	namespace JSC { namespace FTL {	34	namespace JSC { namespace FTL {
34		35
		36	ExitValue ExitValue::materializeNewObject(ExitTimeObjectMaterialization* data)
		37	{
		38	ExitValue result;
		39	result.m_kind = ExitValueMaterializeNewObject;
		40	result.u.newObjectMaterializationData = data;
		41	return result;
		42	}
		43
35	void ExitValue::dumpInContext(PrintStream& out, DumpContext* context) const	44	void ExitValue::dumpInContext(PrintStream& out, DumpContext* context) const
36	{	45	{
37	switch (kind()) {	46	switch (kind()) {
Lines 65-70 void ExitValue::dumpInContext(PrintStrea Source/JavaScriptCore/ftl/FTLExitValue.cpp_sec2
65	case ExitValueRecovery:	74	case ExitValueRecovery:
66	out.print("Recovery(", recoveryOpcode(), ", arg", leftRecoveryArgument(), ", arg", rightRecoveryArgument(), ", ", recoveryFormat(), ")");	75	out.print("Recovery(", recoveryOpcode(), ", arg", leftRecoveryArgument(), ", arg", rightRecoveryArgument(), ", ", recoveryFormat(), ")");
67	return;	76	return;
		77	case ExitValueMaterializeNewObject:
		78	out.print("Materialize(", pointerDump(objectMaterialization()), ")");
		79	return;
68	}	80	}
69		81
70	RELEASE_ASSERT_NOT_REACHED();	82	RELEASE_ASSERT_NOT_REACHED();

Lines 52-60 enum ExitValueKind { Source/JavaScriptCore/ftl/FTLExitValue.h_sec1
- Source/JavaScriptCore/ftl/FTLExitValue.h -3 / +17 lines
52	ExitValueInJSStackAsInt52,	52	ExitValueInJSStackAsInt52,
53	ExitValueInJSStackAsDouble,	53	ExitValueInJSStackAsDouble,
54	ExitValueArgumentsObjectThatWasNotCreated,	54	ExitValueArgumentsObjectThatWasNotCreated,
55	ExitValueRecovery	55	ExitValueRecovery,
		56	ExitValueMaterializeNewObject
56	};	57	};
57		58
		59	class ExitTimeObjectMaterialization;
		60
58	class ExitValue {	61	class ExitValue {
59	public:	62	public:
60	ExitValue()	63	ExitValue()
Lines 137-142 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec2
137	return result;	140	return result;
138	}	141	}
139		142
		143	static ExitValue materializeNewObject(ExitTimeObjectMaterialization*);
		144
140	ExitValueKind kind() const { return m_kind; }	145	ExitValueKind kind() const { return m_kind; }
141		146
142	bool isDead() const { return kind() == ExitValueDead; }	147	bool isDead() const { return kind() == ExitValueDead; }
Lines 156-161 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec3
156	bool isArgument() const { return kind() == ExitValueArgument; }	161	bool isArgument() const { return kind() == ExitValueArgument; }
157	bool isArgumentsObjectThatWasNotCreated() const { return kind() == ExitValueArgumentsObjectThatWasNotCreated; }	162	bool isArgumentsObjectThatWasNotCreated() const { return kind() == ExitValueArgumentsObjectThatWasNotCreated; }
158	bool isRecovery() const { return kind() == ExitValueRecovery; }	163	bool isRecovery() const { return kind() == ExitValueRecovery; }
		164	bool isObjectMaterialization() const { return kind() == ExitValueMaterializeNewObject; }
159		165
160	ExitArgument exitArgument() const	166	ExitArgument exitArgument() const
161	{	167	{
Lines 199-205 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec4
199	return VirtualRegister(u.virtualRegister);	205	return VirtualRegister(u.virtualRegister);
200	}	206	}
201		207
202	ExitValue withVirtualRegister(VirtualRegister virtualRegister)	208	ExitTimeObjectMaterialization* objectMaterialization() const
		209	{
		210	ASSERT(isObjectMaterialization());
		211	return u.newObjectMaterializationData;
		212	}
		213
		214	ExitValue withVirtualRegister(VirtualRegister virtualRegister) const
203	{	215	{
204	ASSERT(isInJSStackSomehow());	216	ASSERT(isInJSStackSomehow());
205	ExitValue result;	217	ExitValue result;
Lines 207-213 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec5
207	result.u.virtualRegister = virtualRegister.offset();	219	result.u.virtualRegister = virtualRegister.offset();
208	return result;	220	return result;
209	}	221	}
210		222
211	// If it's in the JSStack somehow, this will tell you what format it's in, in a manner	223	// If it's in the JSStack somehow, this will tell you what format it's in, in a manner
212	// that is compatible with exitArgument().format(). If it's a constant or it's dead, it	224	// that is compatible with exitArgument().format(). If it's a constant or it's dead, it
213	// will claim to be a JSValue. If it's an argument then it will tell you the argument's	225	// will claim to be a JSValue. If it's an argument then it will tell you the argument's
Lines 223-228 public: Source/JavaScriptCore/ftl/FTLExitValue.h_sec6
223	case ExitValueConstant:	235	case ExitValueConstant:
224	case ExitValueInJSStack:	236	case ExitValueInJSStack:
225	case ExitValueArgumentsObjectThatWasNotCreated:	237	case ExitValueArgumentsObjectThatWasNotCreated:
		238	case ExitValueMaterializeNewObject:
226	return ValueFormatJSValue;	239	return ValueFormatJSValue;
227		240
228	case ExitValueArgument:	241	case ExitValueArgument:
Lines 260-265 private: Source/JavaScriptCore/ftl/FTLExitValue.h_sec7
260	uint16_t opcode;	273	uint16_t opcode;
261	uint16_t format;	274	uint16_t format;
262	} recovery;	275	} recovery;
		276	ExitTimeObjectMaterialization* newObjectMaterializationData;
263	} u;	277	} u;
264	};	278	};
265		279

Lines 38-43 Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec1
- Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp -165 / +348 lines
38	#include "FTLFormattedValue.h"	38	#include "FTLFormattedValue.h"
39	#include "FTLInlineCacheSize.h"	39	#include "FTLInlineCacheSize.h"
40	#include "FTLLoweredNodeValue.h"	40	#include "FTLLoweredNodeValue.h"
		41	#include "FTLOperations.h"
41	#include "FTLOutput.h"	42	#include "FTLOutput.h"
42	#include "FTLThunks.h"	43	#include "FTLThunks.h"
43	#include "FTLWeightedTarget.h"	44	#include "FTLWeightedTarget.h"
Lines 341-347 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec2
341		342
342	m_availableRecoveries.resize(0);	343	m_availableRecoveries.resize(0);
343		344
344	bool shouldExecuteEffects = m_interpreter.startExecuting(m_node);	345	m_interpreter.startExecuting();
345		346
346	switch (m_node->op()) {	347	switch (m_node->op()) {
347	case Upsilon:	348	case Upsilon:
Lines 725-730 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec3
725	case ToIndexString:	726	case ToIndexString:
726	compileToIndexString();	727	compileToIndexString();
727	break;	728	break;
		729	case CheckStructureImmediate:
		730	compileCheckStructureImmediate();
		731	break;
		732	case MaterializeNewObject:
		733	compileMaterializeNewObject();
		734	break;
728		735
729	case PhantomLocal:	736	case PhantomLocal:
730	case SetArgument:	737	case SetArgument:
Lines 735-740 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec4
735	case AllocationProfileWatchpoint:	742	case AllocationProfileWatchpoint:
736	case MovHint:	743	case MovHint:
737	case ZombieHint:	744	case ZombieHint:
		745	case PhantomNewObject:
		746	case PutByOffsetHint:
		747	case PutStructureHint:
		748	case BottomValue:
738	break;	749	break;
739	default:	750	default:
740	DFG_CRASH(m_graph, m_node, "Unrecognized node in FTL backend");	751	DFG_CRASH(m_graph, m_node, "Unrecognized node in FTL backend");
Lines 742-750 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec5
742	}	753	}
743		754
744	m_availabilityCalculator.executeNode(m_node);	755	m_availabilityCalculator.executeNode(m_node);
745		756	m_interpreter.executeEffects(nodeIndex);
746	if (shouldExecuteEffects)
747	m_interpreter.executeEffects(nodeIndex);
748		757
749	return true;	758	return true;
750	}	759	}
Lines 1704-1733 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec6
1704		1713
1705	LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);	1714	LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
1706		1715
1707	if (m_node->structureSet().size() == 1) {	1716	checkStructure(structureID, jsValueValue(cell), exitKind, m_node->structureSet());
1708	speculate(
1709	exitKind, jsValueValue(cell), 0,
1710	m_out.notEqual(structureID, weakStructure(m_node->structureSet()[0])));
1711	return;
1712	}
1713
1714	LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("CheckStructure continuation"));
1715
1716	LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
1717	for (unsigned i = 0; i < m_node->structureSet().size() - 1; ++i) {
1718	LBasicBlock nextStructure = FTL_NEW_BLOCK(m_out, ("CheckStructure nextStructure"));
1719	m_out.branch(
1720	m_out.equal(structureID, weakStructure(m_node->structureSet()[i])),
1721	unsure(continuation), unsure(nextStructure));
1722	m_out.appendTo(nextStructure);
1723	}
1724
1725	speculate(
1726	exitKind, jsValueValue(cell), 0,
1727	m_out.notEqual(structureID, weakStructure(m_node->structureSet().last())));
1728
1729	m_out.jump(continuation);
1730	m_out.appendTo(continuation, lastNext);
1731	}	1717	}
1732		1718
1733	void compileCheckCell()	1719	void compileCheckCell()
Lines 1762-1768 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec7
1762	LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);	1748	LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
1763		1749
1764	m_out.branch(	1750	m_out.branch(
1765	m_out.notEqual(structureID, weakStructure(m_node->structure())),	1751	m_out.notEqual(structureID, weakStructureID(m_node->structure())),
1766	rarely(unexpectedStructure), usually(continuation));	1752	rarely(unexpectedStructure), usually(continuation));
1767		1753
1768	LBasicBlock lastNext = m_out.appendTo(unexpectedStructure, continuation);	1754	LBasicBlock lastNext = m_out.appendTo(unexpectedStructure, continuation);
Lines 1806-1812 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec8
1806	structureID = m_out.load32(cell, m_heaps.JSCell_structureID);	1792	structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
1807	speculate(	1793	speculate(
1808	BadIndexingType, jsValueValue(cell), 0,	1794	BadIndexingType, jsValueValue(cell), 0,
1809	m_out.notEqual(structureID, weakStructure(m_node->structure())));	1795	m_out.notEqual(structureID, weakStructureID(m_node->structure())));
1810	m_out.jump(continuation);	1796	m_out.jump(continuation);
1811		1797
1812	m_out.appendTo(continuation, lastNext);	1798	m_out.appendTo(continuation, lastNext);
Lines 1824-1830 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec9
1824		1810
1825	LValue cell = lowCell(m_node->child1());	1811	LValue cell = lowCell(m_node->child1());
1826	m_out.store32(	1812	m_out.store32(
1827	weakStructure(newStructure),	1813	weakStructureID(newStructure),
1828	cell, m_heaps.JSCell_structureID);	1814	cell, m_heaps.JSCell_structureID);
1829	}	1815	}
1830		1816
Lines 2649-2676 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec10
2649		2635
2650	void compileNewObject()	2636	void compileNewObject()
2651	{	2637	{
2652	Structure* structure = m_node->structure();	2638	setJSValue(allocateObject(m_node->structure()));
2653	size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
2654	MarkedAllocator* allocator = &vm().heap.allocatorForObjectWithoutDestructor(allocationSize);
2655
2656	LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("NewObject slow path"));
2657	LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("NewObject continuation"));
2658
2659	LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
2660
2661	ValueFromBlock fastResult = m_out.anchor(allocateObject(
2662	m_out.constIntPtr(allocator), structure, m_out.intPtrZero, slowPath));
2663
2664	m_out.jump(continuation);
2665
2666	m_out.appendTo(slowPath, continuation);
2667
2668	ValueFromBlock slowResult = m_out.anchor(vmCall(
2669	m_out.operation(operationNewObject), m_callFrame, m_out.constIntPtr(structure)));
2670	m_out.jump(continuation);
2671
2672	m_out.appendTo(continuation, lastNext);
2673	setJSValue(m_out.phi(m_out.intPtr, fastResult, slowResult));
2674	}	2639	}
2675		2640
2676	void compileNewArray()	2641	void compileNewArray()
Lines 3290-3296 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec11
3290	GetByIdVariant variant = data.variants[i];	3255	GetByIdVariant variant = data.variants[i];
3291	for (unsigned j = variant.structureSet().size(); j--;) {	3256	for (unsigned j = variant.structureSet().size(); j--;) {
3292	cases.append(SwitchCase(	3257	cases.append(SwitchCase(
3293	weakStructure(variant.structureSet()[j]), blocks[i], Weight(1)));	3258	weakStructureID(variant.structureSet()[j]), blocks[i], Weight(1)));
3294	}	3259	}
3295	}	3260	}
3296	m_out.switchInstruction(	3261	m_out.switchInstruction(
Lines 3361-3367 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec12
3361	PutByIdVariant variant = data.variants[i];	3326	PutByIdVariant variant = data.variants[i];
3362	for (unsigned j = variant.oldStructure().size(); j--;) {	3327	for (unsigned j = variant.oldStructure().size(); j--;) {
3363	cases.append(	3328	cases.append(
3364	SwitchCase(weakStructure(variant.oldStructure()[j]), blocks[i], Weight(1)));	3329	SwitchCase(weakStructureID(variant.oldStructure()[j]), blocks[i], Weight(1)));
3365	}	3330	}
3366	}	3331	}
3367	m_out.switchInstruction(	3332	m_out.switchInstruction(
Lines 3370-3376 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec13
3370	LBasicBlock lastNext = m_out.m_nextBlock;	3335	LBasicBlock lastNext = m_out.m_nextBlock;
3371		3336
3372	for (unsigned i = data.variants.size(); i--;) {	3337	for (unsigned i = data.variants.size(); i--;) {
3373	m_out.appendTo(blocks[i], i + 1 < data.variants.size() ? blocks[i + 1] : exit);	3338	m_out.appendTo(blocks[i], i + 1 < data.variants.size() ? blocks[i + 1] : exit);
3374		3339
3375	PutByIdVariant variant = data.variants[i];	3340	PutByIdVariant variant = data.variants[i];
3376		3341
Lines 3393-3399 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec14
3393	ASSERT(variant.oldStructureForTransition()->typeInfo().inlineTypeFlags() == variant.newStructure()->typeInfo().inlineTypeFlags());	3358	ASSERT(variant.oldStructureForTransition()->typeInfo().inlineTypeFlags() == variant.newStructure()->typeInfo().inlineTypeFlags());
3394	ASSERT(variant.oldStructureForTransition()->typeInfo().type() == variant.newStructure()->typeInfo().type());	3359	ASSERT(variant.oldStructureForTransition()->typeInfo().type() == variant.newStructure()->typeInfo().type());
3395	m_out.store32(	3360	m_out.store32(
3396	weakStructure(variant.newStructure()), base, m_heaps.JSCell_structureID);	3361	weakStructureID(variant.newStructure()), base, m_heaps.JSCell_structureID);
3397	}	3362	}
3398		3363
3399	storeProperty(value, storage, data.identifierNumber, variant.offset());	3364	storeProperty(value, storage, data.identifierNumber, variant.offset());
Lines 3953-3964 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec15
3953	void compileInvalidationPoint()	3918	void compileInvalidationPoint()
3954	{	3919	{
3955	if (verboseCompilationEnabled())	3920	if (verboseCompilationEnabled())
3956	dataLog(" Invalidation point with availability: ", availability(), "\n");	3921	dataLog(" Invalidation point with availability: ", availabilityMap(), "\n");
3957		3922
3958	m_ftlState.jitCode->osrExit.append(OSRExit(	3923	m_ftlState.jitCode->osrExit.append(OSRExit(
3959	UncountableInvalidation, InvalidValueFormat, MethodOfGettingAValueProfile(),	3924	UncountableInvalidation, InvalidValueFormat, MethodOfGettingAValueProfile(),
3960	m_codeOriginForExitTarget, m_codeOriginForExitProfile,	3925	m_codeOriginForExitTarget, m_codeOriginForExitProfile,
3961	availability().numberOfArguments(), availability().numberOfLocals()));	3926	availabilityMap().m_locals.numberOfArguments(),
		3927	availabilityMap().m_locals.numberOfLocals()));
3962	m_ftlState.finalizer->osrExit.append(OSRExitCompilationInfo());	3928	m_ftlState.finalizer->osrExit.append(OSRExitCompilationInfo());
3963		3929
3964	OSRExit& exit = m_ftlState.jitCode->osrExit.last();	3930	OSRExit& exit = m_ftlState.jitCode->osrExit.last();
Lines 4360-4365 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec16
4360	LValue index = lowInt32(m_node->child1());	4326	LValue index = lowInt32(m_node->child1());
4361	setJSValue(vmCall(m_out.operation(operationToIndexString), m_callFrame, index));	4327	setJSValue(vmCall(m_out.operation(operationToIndexString), m_callFrame, index));
4362	}	4328	}
		4329
		4330	void compileCheckStructureImmediate()
		4331	{
		4332	LValue structureID = lowCell(m_node->child1());
		4333	checkStructure(structureID, noValue(), BadCache, m_node->structureSet());
		4334	}
		4335
		4336	void compileMaterializeNewObject()
		4337	{
		4338	ObjectMaterializationData& data = m_node->objectMaterializationData();
		4339
		4340	// Lower the values first, to avoid creating values inside a control flow diamond.
		4341
		4342	Vector<LValue, 8> values;
		4343	for (unsigned i = 0; i < data.m_properties.size(); ++i)
		4344	values.append(lowJSValue(m_graph.varArgChild(m_node, 1 + i)));
		4345
		4346	StructureSet set;
		4347	m_interpreter.phiChildren()->forAllTransitiveIncomingValues(
		4348	m_graph.varArgChild(m_node, 0).node(),
		4349	[&] (Node* incoming) {
		4350	set.add(incoming->castConstant<Structure*>());
		4351	});
		4352
		4353	Vector<LBasicBlock, 1> blocks(set.size());
		4354	for (unsigned i = set.size(); i--;)
		4355	blocks[i] = FTL_NEW_BLOCK(m_out, ("MaterializeNewObject case ", i));
		4356	LBasicBlock dummyDefault = FTL_NEW_BLOCK(m_out, ("MaterializeNewObject default case"));
		4357	LBasicBlock outerContinuation = FTL_NEW_BLOCK(m_out, ("MaterializeNewObject continuation"));
		4358
		4359	Vector<SwitchCase, 1> cases(set.size());
		4360	for (unsigned i = set.size(); i--;)
		4361	cases[i] = SwitchCase(weakStructure(set[i]), blocks[i], Weight(1));
		4362	m_out.switchInstruction(
		4363	lowCell(m_graph.varArgChild(m_node, 0)), cases, dummyDefault, Weight(0));
		4364
		4365	LBasicBlock outerLastNext = m_out.m_nextBlock;
		4366
		4367	Vector<ValueFromBlock, 1> results;
		4368
		4369	for (unsigned i = set.size(); i--;) {
		4370	m_out.appendTo(blocks[i], i + 1 < set.size() ? blocks[i + 1] : dummyDefault);
		4371
		4372	Structure* structure = set[i];
		4373
		4374	LValue object;
		4375	LValue butterfly;
		4376
		4377	if (structure->outOfLineCapacity()) {
		4378	size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
		4379	MarkedAllocator* allocator = &vm().heap.allocatorForObjectWithoutDestructor(allocationSize);
		4380
		4381	LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("MaterializeNewObject complex object allocation slow path"));
		4382	LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("MaterializeNewObject complex object allocation continuation"));
		4383
		4384	LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
		4385
		4386	LValue endOfStorage = allocateBasicStorageAndGetEnd(
		4387	m_out.constIntPtr(structure->outOfLineCapacity() * sizeof(JSValue)),
		4388	slowPath);
		4389
		4390	LValue fastButterflyValue = m_out.add(
		4391	m_out.constIntPtr(sizeof(IndexingHeader)), endOfStorage);
		4392
4393	LValue fastObjectValue = allocateObject(
4394	m_out.constIntPtr(allocator), structure, fastButterflyValue, slowPath);
4395
4396	ValueFromBlock fastObject = m_out.anchor(fastObjectValue);
4397	ValueFromBlock fastButterfly = m_out.anchor(fastButterflyValue);
4398	m_out.jump(continuation);
4399
4400	m_out.appendTo(slowPath, continuation);
4401
4402	ValueFromBlock slowObject = m_out.anchor(vmCall(
4403	m_out.operation(operationNewObjectWithButterfly),
4404	m_callFrame, m_out.constIntPtr(structure)));
4405	ValueFromBlock slowButterfly = m_out.anchor(
4406	m_out.loadPtr(slowObject.value(), m_heaps.JSObject_butterfly));
4407
4408	m_out.jump(continuation);
4409
4410	m_out.appendTo(continuation, lastNext);
4411
4412	object = m_out.phi(m_out.intPtr, fastObject, slowObject);
4413	butterfly = m_out.phi(m_out.intPtr, fastButterfly, slowButterfly);
4414	} else {
4415	// In the easy case where we can do a one-shot allocation, we simply allocate the
4416	// object to directly have the desired structure.
4417	object = allocateObject(structure);
4418	butterfly = nullptr; // Don't have one, don't need one.
4419	}
4420
4421	for (PropertyMapEntry entry : structure->getPropertiesConcurrently()) {
4422	for (unsigned i = data.m_properties.size(); i--;) {
4423	PhantomPropertyValue value = data.m_properties[i];
4424	if (m_graph.identifiers()[value.m_identifierNumber] != entry.key)
4425	continue;
4426
4427	LValue base = isInlineOffset(entry.offset) ? object : butterfly;
4428	storeProperty(values[i], base, value.m_identifierNumber, entry.offset);
4429	break;
4430	}
4431	}
4432
4433	results.append(m_out.anchor(object));
4434	m_out.jump(outerContinuation);
4435	}
4436
4437	m_out.appendTo(dummyDefault, outerContinuation);
4438	m_out.unreachable();
4439
4440	m_out.appendTo(outerContinuation, outerLastNext);
4441	setJSValue(m_out.phi(m_out.intPtr, results));
4442	}
4363		4443
4364	#if ENABLE(FTL_NATIVE_CALL_INLINING)	4444	#if ENABLE(FTL_NATIVE_CALL_INLINING)
4365	LValue getFunctionBySymbol(const CString symbol)	4445	LValue getFunctionBySymbol(const CString symbol)
Lines 4525-4530 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec17
4525	return m_out.booleanFalse;	4605	return m_out.booleanFalse;
4526	}	4606	}
4527		4607
		4608	void checkStructure(
		4609	LValue structureID, const FormattedValue& formattedValue, ExitKind exitKind,
		4610	const StructureSet& set)
		4611	{
		4612	if (set.size() == 1) {
		4613	speculate(
		4614	exitKind, formattedValue, 0,
		4615	m_out.notEqual(structureID, weakStructureID(set[0])));
		4616	return;
		4617	}
		4618
		4619	LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("checkStructure continuation"));
		4620
		4621	LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
		4622	for (unsigned i = 0; i < set.size() - 1; ++i) {
		4623	LBasicBlock nextStructure = FTL_NEW_BLOCK(m_out, ("checkStructure nextStructure"));
		4624	m_out.branch(
		4625	m_out.equal(structureID, weakStructureID(set[i])),
		4626	unsure(continuation), unsure(nextStructure));
		4627	m_out.appendTo(nextStructure);
		4628	}
		4629
		4630	speculate(
		4631	exitKind, formattedValue, 0,
		4632	m_out.notEqual(structureID, weakStructureID(set.last())));
		4633
		4634	m_out.jump(continuation);
		4635	m_out.appendTo(continuation, lastNext);
		4636	}
		4637
4528	LValue numberOrNotCellToInt32(Edge edge, LValue value)	4638	LValue numberOrNotCellToInt32(Edge edge, LValue value)
4529	{	4639	{
4530	LBasicBlock intCase = FTL_NEW_BLOCK(m_out, ("ValueToInt32 int case"));	4640	LBasicBlock intCase = FTL_NEW_BLOCK(m_out, ("ValueToInt32 int case"));
Lines 4624-4707 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec18
4624	m_callFrame, object);	4734	m_callFrame, object);
4625	}	4735	}
4626		4736
4627	LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("allocatePropertyStorage slow path"));	4737	LValue result = allocatePropertyStorageWithSizeImpl(initialOutOfLineCapacity);
4628	LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("allocatePropertyStorage continuation"));
4629
4630	LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
4631
4632	LValue endOfStorage = allocateBasicStorageAndGetEnd(
4633	m_out.constIntPtr(initialOutOfLineCapacity * sizeof(JSValue)), slowPath);
4634
4635	ValueFromBlock fastButterfly = m_out.anchor(
4636	m_out.add(m_out.constIntPtr(sizeof(IndexingHeader)), endOfStorage));
4637
4638	m_out.jump(continuation);
4639
4640	m_out.appendTo(slowPath, continuation);
4641
4642	ValueFromBlock slowButterfly = m_out.anchor(vmCall(
4643	m_out.operation(operationAllocatePropertyStorageWithInitialCapacity), m_callFrame));
4644
4645	m_out.jump(continuation);
4646
4647	m_out.appendTo(continuation, lastNext);
4648
4649	LValue result = m_out.phi(m_out.intPtr, fastButterfly, slowButterfly);
4650	m_out.storePtr(result, object, m_heaps.JSObject_butterfly);	4738	m_out.storePtr(result, object, m_heaps.JSObject_butterfly);
4651
4652	return result;	4739	return result;
4653	}	4740	}
4654		4741
4655	LValue reallocatePropertyStorage(	4742	LValue reallocatePropertyStorage(
4656	LValue object, LValue oldStorage, Structure* previous, Structure* next)	4743	LValue object, LValue oldStorage, Structure* previous, Structure* next)
4657	{	4744	{
4658	size_t oldSize = previous->outOfLineCapacity() * sizeof(JSValue);	4745	size_t oldSize = previous->outOfLineCapacity();
4659	size_t newSize = oldSize * outOfLineGrowthFactor;	4746	size_t newSize = oldSize * outOfLineGrowthFactor;
4660		4747
4661	ASSERT_UNUSED(next, newSize == next->outOfLineCapacity() * sizeof(JSValue));	4748	ASSERT_UNUSED(next, newSize == next->outOfLineCapacity());
4662		4749
4663	if (previous->couldHaveIndexingHeader()) {	4750	if (previous->couldHaveIndexingHeader()) {
4664	LValue newAllocSize = m_out.constInt64(newSize / sizeof(JSValue));	4751	LValue newAllocSize = m_out.constIntPtr(newSize);
4665	return vmCall(m_out.operation(operationReallocateButterflyToGrowPropertyStorage), m_callFrame, object, newAllocSize);	4752	return vmCall(m_out.operation(operationReallocateButterflyToGrowPropertyStorage), m_callFrame, object, newAllocSize);
4666	}	4753	}
4667		4754
4668	LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("reallocatePropertyStorage slow path"));	4755	LValue result = allocatePropertyStorageWithSizeImpl(newSize);
4669	LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("reallocatePropertyStorage continuation"));	4756
		4757	ptrdiff_t headerSize = -sizeof(IndexingHeader) - sizeof(void*);
		4758	ptrdiff_t endStorage = headerSize - static_cast<ptrdiff_t>(oldSize * sizeof(JSValue));
		4759
		4760	for (ptrdiff_t offset = headerSize; offset > endStorage; offset -= sizeof(void*)) {
		4761	LValue loaded =
		4762	m_out.loadPtr(m_out.address(m_heaps.properties.atAnyNumber(), oldStorage, offset));
		4763	m_out.storePtr(loaded, m_out.address(m_heaps.properties.atAnyNumber(), result, offset));
		4764	}
		4765
		4766	m_out.storePtr(result, m_out.address(object, m_heaps.JSObject_butterfly));
		4767
		4768	return result;
		4769	}
		4770
		4771	LValue allocatePropertyStorageWithSizeImpl(size_t sizeInValues)
		4772	{
		4773	LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("allocatePropertyStorageWithSizeImpl slow path"));
		4774	LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("allocatePropertyStorageWithSizeImpl continuation"));
		4775
4670	LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);	4776	LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
4671		4777
4672	LValue endOfStorage =	4778	LValue endOfStorage = allocateBasicStorageAndGetEnd(
4673	allocateBasicStorageAndGetEnd(m_out.constIntPtr(newSize), slowPath);	4779	m_out.constIntPtr(sizeInValues * sizeof(JSValue)), slowPath);
4674		4780
4675	ValueFromBlock fastButterfly = m_out.anchor(m_out.add(m_out.constIntPtr(sizeof(IndexingHeader)), endOfStorage));	4781	ValueFromBlock fastButterfly = m_out.anchor(
		4782	m_out.add(m_out.constIntPtr(sizeof(IndexingHeader)), endOfStorage));
4676		4783
4677	m_out.jump(continuation);	4784	m_out.jump(continuation);
4678		4785
4679	m_out.appendTo(slowPath, continuation);	4786	m_out.appendTo(slowPath, continuation);
4680		4787
4681	LValue newAllocSize = m_out.constInt64(newSize / sizeof(JSValue));	4788	LValue slowButterflyValue;
4682		4789	if (sizeInValues == initialOutOfLineCapacity) {
4683	LValue storageLocation = vmCall(m_out.operation(operationAllocatePropertyStorage), m_callFrame, newAllocSize);	4790	slowButterflyValue = vmCall(
4684		4791	m_out.operation(operationAllocatePropertyStorageWithInitialCapacity),
4685	ValueFromBlock slowButterfly = m_out.anchor(storageLocation);	4792	m_callFrame);
		4793	} else {
		4794	slowButterflyValue = vmCall(
		4795	m_out.operation(operationAllocatePropertyStorage),
		4796	m_callFrame, m_out.constIntPtr(sizeInValues));
		4797	}
		4798	ValueFromBlock slowButterfly = m_out.anchor(slowButterflyValue);
4686		4799
4687	m_out.jump(continuation);	4800	m_out.jump(continuation);
4688		4801
4689	m_out.appendTo(continuation, lastNext);	4802	m_out.appendTo(continuation, lastNext);
4690		4803
4691	LValue result = m_out.phi(m_out.intPtr, fastButterfly, slowButterfly);	4804	return m_out.phi(m_out.intPtr, fastButterfly, slowButterfly);
4692
4693	ptrdiff_t headerSize = -sizeof(JSValue) - sizeof(void *);
4694	ptrdiff_t endStorage = headerSize - static_cast<ptrdiff_t>(oldSize);
4695
4696	for (ptrdiff_t offset = headerSize; offset > endStorage; offset -= sizeof(void*)) {
4697	LValue loaded =
4698	m_out.loadPtr(m_out.address(m_heaps.properties.atAnyNumber(), oldStorage, offset));
4699	m_out.storePtr(loaded, m_out.address(m_heaps.properties.atAnyNumber(), result, offset));
4700	}
4701
4702	m_out.storePtr(result, m_out.address(object, m_heaps.JSObject_butterfly));
4703
4704	return result;
4705	}	4805	}
4706		4806
4707	LValue getById(LValue base)	4807	LValue getById(LValue base)
Lines 4841-4847 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec19
4841	setBoolean(m_out.phi(m_out.boolean, fastResult, slowResult));	4941	setBoolean(m_out.phi(m_out.boolean, fastResult, slowResult));
4842	}	4942	}
4843		4943
4844	LValue allocateCell(LValue allocator, Structure* structure, LBasicBlock slowPath)	4944	LValue allocateCell(LValue allocator, LBasicBlock slowPath)
4845	{	4945	{
4846	LBasicBlock success = FTL_NEW_BLOCK(m_out, ("object allocation success"));	4946	LBasicBlock success = FTL_NEW_BLOCK(m_out, ("object allocation success"));
4847		4947
Lines 4856-4867 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec20
4856	m_out.loadPtr(result, m_heaps.JSCell_freeListNext),	4956	m_out.loadPtr(result, m_heaps.JSCell_freeListNext),
4857	allocator, m_heaps.MarkedAllocator_freeListHead);	4957	allocator, m_heaps.MarkedAllocator_freeListHead);
4858		4958
4859	m_out.store32(m_out.constInt32(structure->id()), result, m_heaps.JSCell_structureID);	4959	return result;
4860		4960	}
		4961
		4962	void storeStructure(LValue object, Structure* structure)
		4963	{
		4964	m_out.store32(m_out.constInt32(structure->id()), object, m_heaps.JSCell_structureID);
4861	m_out.store32(	4965	m_out.store32(
4862	m_out.constInt32(structure->objectInitializationBlob()),	4966	m_out.constInt32(structure->objectInitializationBlob()),
4863	result, m_heaps.JSCell_usefulBytes);	4967	object, m_heaps.JSCell_usefulBytes);
4864		4968	}
		4969
		4970	LValue allocateCell(LValue allocator, Structure* structure, LBasicBlock slowPath)
		4971	{
		4972	LValue result = allocateCell(allocator, slowPath);
		4973	storeStructure(result, structure);
4865	return result;	4974	return result;
4866	}	4975	}
4867		4976
Lines 4908-4913 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec21
4908	m_out.loadPtr(m_out.absolute(&allocator.m_currentPayloadEnd)), newRemaining);	5017	m_out.loadPtr(m_out.absolute(&allocator.m_currentPayloadEnd)), newRemaining);
4909	}	5018	}
4910		5019
		5020	LValue allocateObject(Structure* structure)
		5021	{
		5022	size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
		5023	MarkedAllocator* allocator = &vm().heap.allocatorForObjectWithoutDestructor(allocationSize);
		5024
		5025	LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("allocateObject slow path"));
		5026	LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("allocateObject continuation"));
		5027
		5028	LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
		5029
		5030	ValueFromBlock fastResult = m_out.anchor(allocateObject(
		5031	m_out.constIntPtr(allocator), structure, m_out.intPtrZero, slowPath));
		5032
		5033	m_out.jump(continuation);
		5034
		5035	m_out.appendTo(slowPath, continuation);
		5036
		5037	ValueFromBlock slowResult = m_out.anchor(vmCall(
		5038	m_out.operation(operationNewObject), m_callFrame, m_out.constIntPtr(structure)));
		5039	m_out.jump(continuation);
		5040
		5041	m_out.appendTo(continuation, lastNext);
		5042	return m_out.phi(m_out.intPtr, fastResult, slowResult);
		5043	}
		5044
4911	struct ArrayValues {	5045	struct ArrayValues {
4912	ArrayValues()	5046	ArrayValues()
4913	: array(0)	5047	: array(0)
Lines 6117-6123 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec22
6117		6251
6118	speculate(	6252	speculate(
6119	NotStringObject, noValue(), 0,	6253	NotStringObject, noValue(), 0,
6120	m_out.notEqual(structureID, weakStructure(stringObjectStructure)));	6254	m_out.notEqual(structureID, weakStructureID(stringObjectStructure)));
6121	}	6255	}
6122		6256
6123	void speculateNonNullObject(Edge edge, LValue cell)	6257	void speculateNonNullObject(Edge edge, LValue cell)
Lines 6344-6350 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec23
6344	ExitKind kind, FormattedValue lowValue, Node* highValue, LValue failCondition)	6478	ExitKind kind, FormattedValue lowValue, Node* highValue, LValue failCondition)
6345	{	6479	{
6346	if (verboseCompilationEnabled()) {	6480	if (verboseCompilationEnabled()) {
6347	dataLog(" OSR exit #", m_ftlState.jitCode->osrExit.size(), " with availability: ", availability(), "\n");	6481	dataLog(" OSR exit #", m_ftlState.jitCode->osrExit.size(), " with availability: ", availabilityMap(), "\n");
6348	if (!m_availableRecoveries.isEmpty())	6482	if (!m_availableRecoveries.isEmpty())
6349	dataLog(" Available recoveries: ", listDump(m_availableRecoveries), "\n");	6483	dataLog(" Available recoveries: ", listDump(m_availableRecoveries), "\n");
6350	}	6484	}
Lines 6354-6360 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec24
6354	m_ftlState.jitCode->osrExit.append(OSRExit(	6488	m_ftlState.jitCode->osrExit.append(OSRExit(
6355	kind, lowValue.format(), m_graph.methodOfGettingAValueProfileFor(highValue),	6489	kind, lowValue.format(), m_graph.methodOfGettingAValueProfileFor(highValue),
6356	m_codeOriginForExitTarget, m_codeOriginForExitProfile,	6490	m_codeOriginForExitTarget, m_codeOriginForExitProfile,
6357	availability().numberOfArguments(), availability().numberOfLocals()));	6491	availabilityMap().m_locals.numberOfArguments(),
		6492	availabilityMap().m_locals.numberOfLocals()));
6358	m_ftlState.finalizer->osrExit.append(OSRExitCompilationInfo());	6493	m_ftlState.finalizer->osrExit.append(OSRExitCompilationInfo());
6359		6494
6360	OSRExit& exit = m_ftlState.jitCode->osrExit.last();	6495	OSRExit& exit = m_ftlState.jitCode->osrExit.last();
Lines 6394-6449 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec25
6394	if (!!lowValue)	6529	if (!!lowValue)
6395	arguments.append(lowValue.value());	6530	arguments.append(lowValue.value());
6396		6531
		6532	AvailabilityMap availabilityMap = this->availabilityMap();
		6533
6397	for (unsigned i = 0; i < exit.m_values.size(); ++i) {	6534	for (unsigned i = 0; i < exit.m_values.size(); ++i) {
6398	int operand = exit.m_values.operandForIndex(i);	6535	int operand = exit.m_values.operandForIndex(i);
6399	bool isLive = m_graph.isLiveInBytecode(VirtualRegister(operand), codeOrigin);	6536	bool isLive = m_graph.isLiveInBytecode(VirtualRegister(operand), codeOrigin);
6400	if (!isLive) {	6537	if (!isLive)
6401	exit.m_values[i] = ExitValue::dead();	6538	availabilityMap.m_locals[i] = Availability();
6402	continue;	6539	}
6403	}	6540
6404		6541	availabilityMap.prune();
6405	Availability availability = this->availability()[i];	6542
6406	FlushedAt flush = availability.flushedAt();	6543	HashMap<Node, ExitTimeObjectMaterialization> map;
6407	switch (flush.format()) {	6544	availabilityMap.forEachAvailability(
6408	case DeadFlush:	6545	[&] (Availability availability) {
6409	case ConflictingFlush:	6546	if (!availability.shouldUseNode())
6410	if (availability.hasNode()) {	6547	return;
6411	exit.m_values[i] = exitValueForNode(arguments, availability.node());
6412	break;
6413	}
6414
6415	if (Options::validateFTLOSRExitLiveness())
6416	DFG_CRASH(m_graph, m_node, toCString("Expected r", operand, " to be available but it wasn't.").data());
6417
6418	// This means that the DFG's DCE proved that the value is dead in bytecode
6419	// even though the bytecode liveness analysis thinks it's live. This is
6420	// acceptable since the DFG's DCE is by design more aggressive while still
6421	// being sound.
6422	exit.m_values[i] = ExitValue::dead();
6423	break;
6424
6425	case FlushedJSValue:
6426	case FlushedCell:
6427	case FlushedBoolean:
6428	exit.m_values[i] = ExitValue::inJSStack(flush.virtualRegister());
6429	break;
6430
6431	case FlushedInt32:
6432	exit.m_values[i] = ExitValue::inJSStackAsInt32(flush.virtualRegister());
6433	break;
6434
6435	case FlushedInt52:
6436	exit.m_values[i] = ExitValue::inJSStackAsInt52(flush.virtualRegister());
6437	break;
6438		6548
6439	case FlushedDouble:	6549	Node* node = availability.node();
6440	exit.m_values[i] = ExitValue::inJSStackAsDouble(flush.virtualRegister());	6550	if (!node->isPhantomObjectAllocation())
6441	break;	6551	return;
6442		6552
6443	case FlushedArguments:	6553	auto result = map.add(node, nullptr);
6444	exit.m_values[i] = ExitValue::argumentsObjectThatWasNotCreated();	6554	if (result.isNewEntry)
6445	break;	6555	result.iterator->value = exit.m_materializations.add(node->op());
		6556	});
		6557
		6558	for (unsigned i = 0; i < exit.m_values.size(); ++i) {
		6559	int operand = exit.m_values.operandForIndex(i);
		6560
		6561	Availability availability = availabilityMap.m_locals[i];
		6562
		6563	if (Options::validateFTLOSRExitLiveness()) {
		6564	DFG_ASSERT(
		6565	m_graph, m_node,
		6566	!(availability.isDead() && m_graph.isLiveInBytecode(VirtualRegister(operand), codeOrigin)));
6446	}	6567	}
		6568
		6569	exit.m_values[i] = exitValueForAvailability(arguments, map, availability);
		6570	}
		6571
		6572	for (auto heapPair : availabilityMap.m_heap) {
		6573	Node* node = heapPair.key.base();
		6574	ExitTimeObjectMaterialization* materialization = map.get(node);
		6575	materialization->add(
		6576	heapPair.key.descriptor(),
		6577	exitValueForAvailability(arguments, map, heapPair.value));
6447	}	6578	}
6448		6579
6449	if (verboseCompilationEnabled())	6580	if (verboseCompilationEnabled())
Lines 6459-6471 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec26
6459	m_out.call(m_out.stackmapIntrinsic(), arguments);	6590	m_out.call(m_out.stackmapIntrinsic(), arguments);
6460	}	6591	}
6461		6592
6462	ExitValue exitValueForNode(ExitArgumentList& arguments, Node* node)	6593	ExitValue exitValueForAvailability(
		6594	ExitArgumentList& arguments, const HashMap<Node, ExitTimeObjectMaterialization>& map,
		6595	Availability availability)
		6596	{
		6597	FlushedAt flush = availability.flushedAt();
		6598	switch (flush.format()) {
		6599	case DeadFlush:
		6600	case ConflictingFlush:
		6601	if (availability.hasNode())
		6602	return exitValueForNode(arguments, map, availability.node());
		6603
		6604	// This means that the value is dead. It could be dead in bytecode or it could have
		6605	// been killed by our DCE, which can sometimes kill things even if they were live in
		6606	// bytecode.
		6607	return ExitValue::dead();
		6608
		6609	case FlushedJSValue:
		6610	case FlushedCell:
		6611	case FlushedBoolean:
		6612	return ExitValue::inJSStack(flush.virtualRegister());
		6613
		6614	case FlushedInt32:
		6615	return ExitValue::inJSStackAsInt32(flush.virtualRegister());
		6616
		6617	case FlushedInt52:
		6618	return ExitValue::inJSStackAsInt52(flush.virtualRegister());
		6619
		6620	case FlushedDouble:
		6621	return ExitValue::inJSStackAsDouble(flush.virtualRegister());
		6622
		6623	case FlushedArguments:
		6624	return ExitValue::argumentsObjectThatWasNotCreated();
		6625	}
		6626
		6627	DFG_CRASH(m_graph, m_node, "Invalid flush format");
		6628	}
		6629
		6630	ExitValue exitValueForNode(
		6631	ExitArgumentList& arguments, const HashMap<Node, ExitTimeObjectMaterialization>& map,
		6632	Node* node)
6463	{	6633	{
6464	ASSERT(node->shouldGenerate());	6634	ASSERT(node->shouldGenerate());
6465	ASSERT(node->hasResult());	6635	ASSERT(node->hasResult());
6466		6636
6467	if (node) {	6637	if (node) {
6468	switch (node->op()) {	6638	switch (node->op()) {
		6639	case BottomValue:
		6640	// This might arise in object materializations. I actually doubt that it would,
		6641	// but it seems worthwhile to be conservative.
		6642	return ExitValue::dead();
		6643
6469	case JSConstant:	6644	case JSConstant:
6470	case Int52Constant:	6645	case Int52Constant:
6471	case DoubleConstant:	6646	case DoubleConstant:
Lines 6474-6479 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec27
6474	case PhantomArguments:	6649	case PhantomArguments:
6475	return ExitValue::argumentsObjectThatWasNotCreated();	6650	return ExitValue::argumentsObjectThatWasNotCreated();
6476		6651
		6652	case PhantomNewObject:
		6653	return ExitValue::materializeNewObject(map.get(node));
		6654
6477	default:	6655	default:
6478	break;	6656	break;
6479	}	6657	}
Lines 6657-6668 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec28
6657	return m_out.constIntPtr(pointer);	6835	return m_out.constIntPtr(pointer);
6658	}	6836	}
6659		6837
6660	LValue weakStructure(Structure* structure)	6838	LValue weakStructureID(Structure* structure)
6661	{	6839	{
6662	addWeakReference(structure);	6840	addWeakReference(structure);
6663	return m_out.constInt32(structure->id());	6841	return m_out.constInt32(structure->id());
6664	}	6842	}
6665		6843
		6844	LValue weakStructure(Structure* structure)
		6845	{
		6846	return weakPointer(structure);
		6847	}
		6848
6666	TypedPointer addressFor(LValue base, int operand, ptrdiff_t offset = 0)	6849	TypedPointer addressFor(LValue base, int operand, ptrdiff_t offset = 0)
6667	{	6850	{
6668	return m_out.address(base, m_heaps.variables[operand], offset);	6851	return m_out.address(base, m_heaps.variables[operand], offset);
Lines 6721-6727 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec29
6721	m_out.unreachable();	6904	m_out.unreachable();
6722	}	6905	}
6723		6906
6724	Operands<Availability>& availability() { return m_availabilityCalculator.m_availability; }	6907	AvailabilityMap& availabilityMap() { return m_availabilityCalculator.m_availability; }
6725		6908
6726	VM& vm() { return m_graph.m_vm; }	6909	VM& vm() { return m_graph.m_vm; }
6727	CodeBlock* codeBlock() { return m_graph.m_codeBlock; }	6910	CodeBlock* codeBlock() { return m_graph.m_codeBlock; }



/*
 * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions

#include "DFGOSRExitBase.h"
#include "FTLAbbreviations.h"
#include "FTLExitArgumentList.h"
#include "FTLExitTimeObjectMaterialization.h"
#include "FTLExitValue.h"
#include "FTLFormattedValue.h"
#include "MethodOfGettingAValueProfile.h"

    unsigned m_patchableCodeOffset;
    
    Operands<ExitValue> m_values;
    Bag<ExitTimeObjectMaterialization> m_materializations;
    
    uint32_t m_stackmapID;
    



#include "FTLExitArgumentForOperand.h"
#include "FTLJITCode.h"
#include "FTLOSRExit.h"
#include "FTLOperations.h"
#include "FTLState.h"
#include "FTLSaveRestore.h"
#include "LinkBuffer.h"


using namespace DFG;

static void compileRecovery(
    CCallHelpers& jit, const ExitValue& value, StackMaps::Record* record, StackMaps& stackmaps,
    char *registerScratch,
    const HashMap<ExitTimeObjectMaterialization*, EncodedJSValue*>& materializationToPointer)
{
    switch (value.kind()) {
    case ExitValueDead:
        jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), GPRInfo::regT0);
        break;
            
    case ExitValueConstant:
        jit.move(MacroAssembler::TrustedImm64(JSValue::encode(value.constant())), GPRInfo::regT0);
        break;
            
    case ExitValueArgument:
        record->locations[value.exitArgument().argument()].restoreInto(
            jit, stackmaps, registerScratch, GPRInfo::regT0);
        break;
            
    case ExitValueInJSStack:
    case ExitValueInJSStackAsInt32:
    case ExitValueInJSStackAsInt52:
    case ExitValueInJSStackAsDouble:
        jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
        break;
            
    case ExitValueArgumentsObjectThatWasNotCreated:
        // We can't actually recover this yet, but we can make the stack look sane. This is
        // a prerequisite to running the actual arguments recovery.
        jit.move(MacroAssembler::TrustedImm64(JSValue::encode(JSValue())), GPRInfo::regT0);
        break;
            
    case ExitValueRecovery:
        record->locations[value.rightRecoveryArgument()].restoreInto(
            jit, stackmaps, registerScratch, GPRInfo::regT1);
        record->locations[value.leftRecoveryArgument()].restoreInto(
            jit, stackmaps, registerScratch, GPRInfo::regT0);
        switch (value.recoveryOpcode()) {
        case AddRecovery:
            switch (value.recoveryFormat()) {
            case ValueFormatInt32:
                jit.add32(GPRInfo::regT1, GPRInfo::regT0);
                break;
            case ValueFormatInt52:
                jit.add64(GPRInfo::regT1, GPRInfo::regT0);
                break;
            default:
                RELEASE_ASSERT_NOT_REACHED();
                break;
            }
            break;
        case SubRecovery:
            switch (value.recoveryFormat()) {
            case ValueFormatInt32:
                jit.sub32(GPRInfo::regT1, GPRInfo::regT0);
                break;
            case ValueFormatInt52:
                jit.sub64(GPRInfo::regT1, GPRInfo::regT0);
                break;
            default:
                RELEASE_ASSERT_NOT_REACHED();
                break;
            }
            break;
        default:
            RELEASE_ASSERT_NOT_REACHED();
            break;
        }
        break;
        
    case ExitValueMaterializeNewObject:
        jit.loadPtr(materializationToPointer.get(value.objectMaterialization()), GPRInfo::regT0);
        break;
            
    default:
        RELEASE_ASSERT_NOT_REACHED();
        break;
    }
        
    reboxAccordingToFormat(
        value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
}

static void compileStub(
    unsigned exitID, JITCode* jitCode, OSRExit& exit, VM* vm, CodeBlock* codeBlock)
{


    CCallHelpers jit(vm, codeBlock);
    
    // We need scratch space to save all registers, to build up the JS stack, to deal with unwind
    // fixup, pointers to all of the objects we materialize, and the elements inside those objects
    // that we materialize.
    
    // Figure out how much space we need for those object allocations.
    unsigned numMaterializations = 0;
    size_t maxMaterializationNumArguments = 0;
    for (ExitTimeObjectMaterialization* materialization : exit.m_materializations) {
        numMaterializations++;
        
        maxMaterializationNumArguments = std::max(
            maxMaterializationNumArguments,
            materialization->properties().size());
    }
    
    ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(
        sizeof(EncodedJSValue) * (
            exit.m_values.size() + numMaterializations + maxMaterializationNumArguments) +
        requiredScratchMemorySizeInBytes() +
        jitCode->unwindInfo.m_registers.size() * sizeof(uint64_t));
    EncodedJSValue* scratch = scratchBuffer ? static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) : 0;
    EncodedJSValue* materializationPointers = scratch + exit.m_values.size();
    EncodedJSValue* materializationArguments = materializationPointers + numMaterializations;
    char* registerScratch = bitwise_cast<char*>(materializationArguments + maxMaterializationNumArguments);
    uint64_t* unwindScratch = bitwise_cast<uint64_t*>(registerScratch + requiredScratchMemorySizeInBytes());
    
    HashMap<ExitTimeObjectMaterialization*, EncodedJSValue*> materializationToPointer;
    unsigned materializationCount = 0;
    for (ExitTimeObjectMaterialization* materialization : exit.m_materializations) {
        materializationToPointer.add(
            materialization, materializationPointers + materializationCount++);
    }
    
    // Note that we come in here, the stack used to be as LLVM left it except that someone called pushToSave().
    // We don't care about the value they saved. But, we do appreciate the fact that they did it, because we use
    // that slot for saveAllRegisters().

        if (!!exit.m_valueProfile)
            jit.store64(GPRInfo::regT0, exit.m_valueProfile.getSpecFailBucket(0));
    }

    // Save all state from wherever the exit data tells us it was, into the appropriate place in
    // the scratch buffer. This also does the reboxing.
    
    // Materialize all objects. Don't materialize an object until all of the objects it needs
    // have been materialized.
    HashSet<ExitTimeObjectMaterialization*> toMaterialize;
    for (ExitTimeObjectMaterialization* materialization : exit.m_materializations)
        toMaterialize.add(materialization);
    
    while (!toMaterialize.isEmpty()) {
        int previousToMaterializeSize = toMaterialize.size();
        
        Vector<ExitTimeObjectMaterialization*> worklist;
        worklist.appendRange(toMaterialize.begin(), toMaterialize.end());
        for (ExitTimeObjectMaterialization* materialization : worklist) {
            // Check if we can do anything about this right now.
            bool allGood = true;
            for (ExitPropertyValue value : materialization->properties()) {
                if (!value.value().isObjectMaterialization())
                    continue;
                if (toMaterialize.contains(value.value().objectMaterialization())) {
                    // Gotta skip this one, since one of its fields points to a materialization
                    // that hasn't been materialized.
                    allGood = false;
            break;
            
        case ExitValueInJSStack:
        case ExitValueInJSStackAsInt32:
        case ExitValueInJSStackAsInt52:
        case ExitValueInJSStackAsDouble:
            jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
            break;
            
        case ExitValueArgumentsObjectThatWasNotCreated:
            // We can't actually recover this yet, but we can make the stack look sane. This is
            // a prerequisite to running the actual arguments recovery.
            jit.move(MacroAssembler::TrustedImm64(JSValue::encode(JSValue())), GPRInfo::regT0);
            break;
            
        case ExitValueRecovery:
            record->locations[value.rightRecoveryArgument()].restoreInto(
                jit, jitCode->stackmaps, registerScratch, GPRInfo::regT1);
            record->locations[value.leftRecoveryArgument()].restoreInto(
                jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
            switch (value.recoveryOpcode()) {
            case AddRecovery:
                switch (value.recoveryFormat()) {
                case ValueFormatInt32:
                    jit.add32(GPRInfo::regT1, GPRInfo::regT0);
                    break;
                case ValueFormatInt52:
                    jit.add64(GPRInfo::regT1, GPRInfo::regT0);
                    break;
                default:
                    RELEASE_ASSERT_NOT_REACHED();
                    break;
                }
                break;
            case SubRecovery:
                switch (value.recoveryFormat()) {
                case ValueFormatInt32:
                    jit.sub32(GPRInfo::regT1, GPRInfo::regT0);
                    break;
                case ValueFormatInt52:
                    jit.sub64(GPRInfo::regT1, GPRInfo::regT0);
                    break;
                default:
                    RELEASE_ASSERT_NOT_REACHED();
                    break;
                }
                break;
            default:
                RELEASE_ASSERT_NOT_REACHED();
                break;
            }
            if (!allGood)
                continue;
            
            // All systems go for materializing the object. First we recover the values of all of
            // its fields and then we call a function to actually allocate the beast.
            for (unsigned propertyIndex = materialization->properties().size(); propertyIndex--;) {
                const ExitValue& value = materialization->properties()[propertyIndex].value();
                compileRecovery(
                    jit, value, record, jitCode->stackmaps, registerScratch,
                    materializationToPointer);
                jit.storePtr(GPRInfo::regT0, materializationArguments + propertyIndex);
            }
            
            // This call assumes that we don't pass arguments on the stack.
            jit.setupArgumentsWithExecState(
                CCallHelpers::TrustedImmPtr(materialization),
                CCallHelpers::TrustedImmPtr(materializationArguments));
            jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(operationMaterializeObjectInOSR)), GPRInfo::nonArgGPR0);
            jit.call(GPRInfo::nonArgGPR0);
            jit.storePtr(GPRInfo::returnValueGPR, materializationToPointer.get(materialization));
            
            // Let everyone know that we're done.
            toMaterialize.remove(materialization);
        }
        
        // We expect progress! This ensures that we crash rather than looping infinitely if there
        // is something broken about this fixpoint. Or, this could happen if we ever violate the
        // "materializations form a DAG" rule.
        RELEASE_ASSERT(toMaterialize.size() < previousToMaterializeSize);
    }

    // Save all state from wherever the exit data tells us it was, into the appropriate place in
    // the scratch buffer. This also does the reboxing.
    
    for (unsigned index = exit.m_values.size(); index--;) {
        compileRecovery(
            jit, exit.m_values[index], record, jitCode->stackmaps, registerScratch,
            materializationToPointer);
        jit.store64(GPRInfo::regT0, scratch + index);
    }
    



/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "FTLOperations.h"

#if ENABLE(FTL_JIT)

namespace JSC { namespace FTL {

using namespace JSC::DFG;

extern "C" JSCell* JIT_OPERATION operationNewObjectWithButterfly(ExecState* exec, Structure* structure)
{
    VM& vm = exec->vm();
    NativeCallFrameTracer tracer(&vm, exec);
    
    Butterfly* butterfly = Butterfly::create(
        vm, nullptr, 0, structure->outOfLineCapacity(), false, IndexingHeader(), 0);
    
    return JSFinalObject::create(exec, structure, butterfly);
}

extern "C" JSCell* JIT_OPERATION operationMaterializeObjectInOSR(
    ExecState* exec, ExitTimeObjectMaterialization* materialization, EncodedJSValue* values)
{
    VM& vm = exec->vm();
    CodeBlock* codeBlock = exec->codeBlock();

    // We cannot GC. We've got pointers in evil places.
    DeferGCForAWhile deferGC(vm.heap);
    
    // In the future, we may have many different kinds of materializations. For now we just
    // materialize NewObject.
    RELEASE_ASSERT(materialization->type() == PhantomNewObject);
    
    // First figure out what the structure is.
    Structure* structure = nullptr;
    for (unsigned i = materialization->properties().size(); i--;) {
        const ExitPropertyValue& property = materialization->properties()[i];
        if (property.location() != PromotedLocationDescriptor(StructurePLoc))
            continue;
        
        structure = jsCast<Structure*>(JSValue::decode(values[i]));
    }
    RELEASE_ASSERT(structure);
    
    // Let's create that object!
    JSFinalObject* result = JSFinalObject::create(vm, structure);
    
    // Now figure out what the heck to populate the object with. Use getPropertiesConcurrently()
    // because that happens to be lower-level and more convenient. It doesn't change the
    // materialization of the property table. We want to have minimal visible effects on the
    // system. Also, don't mind that this is O(n^2). It doesn't matter. We only get here from OSR
    // exit.
    for (PropertyMapEntry entry : structure->getPropertiesConcurrently()) {
        for (unsigned i = materialization->properties().size(); i--;) {
            const ExitPropertyValue& property = materialization->properties()[i];
            if (property.location().kind() != NamedPropertyPLoc)
                continue;
            if (codeBlock->identifier(property.location().info()).impl() != entry.key)
                continue;
            
            result->putDirect(vm, entry.offset, JSValue::decode(values[i]));
        }
    }
    
    return result;
}

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)




/*
 * Copyright (C) 2014 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef FTLOperations_h
#define FTLOperations_h

#if ENABLE(FTL_JIT)

#include "DFGOperations.h"
#include "FTLExitTimeObjectMaterialization.h"

namespace JSC { namespace FTL {

extern "C" {

JSCell* JIT_OPERATION operationNewObjectWithButterfly(ExecState*, Structure* structure) WTF_INTERNAL;

JSCell* JIT_OPERATION operationMaterializeObjectInOSR(
    ExecState*, ExitTimeObjectMaterialization*, EncodedJSValue*) WTF_INTERNAL;

} // extern "C"

} } // namespace JSC::DFG

#endif // ENABLE(FTL_JIT)

#endif // FTLOperations_h


Lines 35-40 namespace JSC { namespace FTL { Source/JavaScriptCore/ftl/FTLSwitchCase.h_sec1
- Source/JavaScriptCore/ftl/FTLSwitchCase.h +6 lines
35		35
36	class SwitchCase {	36	class SwitchCase {
37	public:	37	public:
		38	SwitchCase()
		39	: m_value(nullptr)
		40	, m_target(nullptr)
		41	{
		42	}
		43
38	SwitchCase(LValue value, LBasicBlock target, Weight weight)	44	SwitchCase(LValue value, LBasicBlock target, Weight weight)
39	: m_value(value)	45	: m_value(value)
40	, m_target(target)	46	, m_target(target)



    {
        Base::finishCreation(vm);
        ASSERT(inherits(info()));
        ASSERT(!structure()->outOfLineCapacity());
        ASSERT(structure()->isEmpty());
        ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
        ASSERT(structure()->isObject());
        ASSERT(classInfo());

        return (maxSize - allocationSize(0)) / sizeof(WriteBarrier<Unknown>);
    }

    static JSFinalObject* create(ExecState*, Structure*, Butterfly* = nullptr);
    static JSFinalObject* create(VM&, Structure*);
    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, unsigned inlineCapacity)
    {

private:
    friend class LLIntOffsetsExtractor;

    explicit JSFinalObject(VM& vm, Structure* structure, Butterfly* butterfly = nullptr)
        : JSObject(vm, structure, butterfly)
    {
    }

    static const unsigned StructureFlags = JSObject::StructureFlags;
};

inline JSFinalObject* JSFinalObject::create(
    ExecState* exec, Structure* structure, Butterfly* butterfly)
{
    JSFinalObject* finalObject = new (
        NotNull, 

            *exec->heap(),
            allocationSize(structure->inlineCapacity())
        )
    ) JSFinalObject(exec->vm(), structure, butterfly);
    finalObject->finishCreation(exec->vm());
    return finalObject;
}

Lines 1105-1110 PassRefPtr<StructureShape> Structure::to Source/JavaScriptCore/runtime/Structure.cpp_sec1
- Source/JavaScriptCore/runtime/Structure.cpp +7 lines
1105	return baseShape.release();	1105	return baseShape.release();
1106	}	1106	}
1107		1107
		1108	bool Structure::canUseForAllocationsOf(Structure* other)
		1109	{
		1110	return inlineCapacity() == other->inlineCapacity()
		1111	&& storedPrototype() == other->storedPrototype()
		1112	&& objectInitializationBlob() == other->objectInitializationBlob();
		1113	}
		1114
1108	void Structure::dump(PrintStream& out) const	1115	void Structure::dump(PrintStream& out) const
1109	{	1116	{
1110	out.print(RawPointer(this), ":[", classInfo()->className, ", {");	1117	out.print(RawPointer(this), ":[", classInfo()->className, ", {");

Lines 433-438 public: Source/JavaScriptCore/runtime/Structure.h_sec1
- Source/JavaScriptCore/runtime/Structure.h +4 lines
433		433
434	PassRefPtr<StructureShape> toStructureShape(JSValue);	434	PassRefPtr<StructureShape> toStructureShape(JSValue);
435		435
		436	// Determines if the two structures match enough that this one could be used for allocations
		437	// of the other one.
		438	bool canUseForAllocationsOf(Structure*);
		439
436	void dump(PrintStream&) const;	440	void dump(PrintStream&) const;
437	void dumpInContext(PrintStream&, DumpContext*) const;	441	void dumpInContext(PrintStream&, DumpContext*) const;
438	void dumpBrief(PrintStream&, const CString&) const;	442	void dumpBrief(PrintStream&, const CString&) const;



function sumOfArithSeries(limit) {
    return limit * (limit + 1) / 2;
}

var n = 100000000;

var array = [1, "hello"];

function foo() {
    var result = 0;
    var q;
    for (var i = 0; i < n; ++i) {
        var o = {f: i};
        var p = {f: i + 1};
        q = array[(i >= n - 100) | 0] + 1;
        result += o.f + p.f;
    }
    return q + result;
}

var result = foo();
if (result != "hello" + 1 + (sumOfArithSeries(n - 1) + sumOfArithSeries(n)))
    throw "Error: bad result: " + result;



2014-09-24  Filip Pizlo  <fpizlo@apple.com>

        FTL should sink object allocations
        https://bugs.webkit.org/show_bug.cgi?id=136330

        Reviewed by NOBODY (OOPS!).
        
        Make it possible to reset a Bag.

        * wtf/Bag.h:
        (WTF::Bag::Bag):
        (WTF::Bag::~Bag):
        (WTF::Bag::clear):

2014-09-22  Sam Weinig  <sam@webkit.org>

        Eliminate redundant PtrHash specializations



    
public:
    Bag()
        : m_head(nullptr)
    {
    }
    
    ~Bag()
    {
        clear();
    }
    
    void clear()
    {
        while (m_head) {
            Node* current = m_head;
            m_head = current->m_next;
            delete current;
        }
        m_head = nullptr;
    }
    
    template<typename... Args>



<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/math-denorm.js"></script>
<script src="resources/js-test-post.js"></script>
</body>
</html>



JSRegress/elidable-new-object-tree

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS no exception thrown
PASS successfullyParsed is true

TEST COMPLETE




<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body>
<script src="../../resources/regress-pre.js"></script>
<script src="script-tests/elidable-new-object-tree.js"></script>
<script src="../../resources/regress-post.js"></script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>



JSRegress/obvious-sink-pathology

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS no exception thrown
PASS successfullyParsed is true

TEST COMPLETE




JSRegress/obvious-sink-pathology-taken

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS no exception thrown
PASS successfullyParsed is true

TEST COMPLETE




<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body>
<script src="../../resources/regress-pre.js"></script>
<script src="script-tests/obvious-sink-pathology-taken.js"></script>
<script src="../../resources/regress-post.js"></script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>



<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body>
<script src="../../resources/regress-pre.js"></script>
<script src="script-tests/obvious-sink-pathology.js"></script>
<script src="../../resources/regress-post.js"></script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>



JSRegress/obviously-elidable-new-object

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS no exception thrown
PASS successfullyParsed is true

TEST COMPLETE




<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body>
<script src="../../resources/regress-pre.js"></script>
<script src="script-tests/obviously-elidable-new-object.js"></script>
<script src="../../resources/regress-post.js"></script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>



JSRegress/sinkable-new-object

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS no exception thrown
PASS successfullyParsed is true

TEST COMPLETE




JSRegress/sinkable-new-object-taken

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS no exception thrown
PASS successfullyParsed is true

TEST COMPLETE




<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body>
<script src="../../resources/regress-pre.js"></script>
<script src="script-tests/sinkable-new-object-taken.js"></script>
<script src="../../resources/regress-post.js"></script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>



<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body>
<script src="../../resources/regress-pre.js"></script>
<script src="script-tests/sinkable-new-object.js"></script>
<script src="../../resources/regress-post.js"></script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>



function sumOfArithSeries(limit) {
    return limit * (limit + 1) / 2;
}

var n = 100000000;

function foo() {
    var result = 0;
    for (var i = 0; i < n; ++i) {
        var o = {f: {f:i}};
        var p = {f: {f:i + 1}};
        result += o.f.f + p.f.f;
    }
    return result;
}

var result = foo();
if (result != sumOfArithSeries(n - 1) + sumOfArithSeries(n))
    throw "Error: bad result: " + result;



function sumOfArithSeries(limit) {
    return limit * (limit + 1) / 2;
}

var n = 100000000;

function bar() { }

function foo() {
    var result = 0;
    for (var i = 0; i < n; ++i) {
        var o = {f: i};
        var p = {f: i + 1};
        if (!(i % 100))
            bar(o, p);
        result += o.f + p.f;
    }
    return result;
}

noInline(bar);
noInline(foo);

var result = foo();
if (result != sumOfArithSeries(n - 1) + sumOfArithSeries(n))
    throw "Error: bad result: " + result;



function sumOfArithSeries(limit) {
    return limit * (limit + 1) / 2;
}

var n = 100000000;

function bar() { }

function foo(b) {
    var result = 0;
    for (var i = 0; i < n; ++i) {
        var o = {f: i};
        var p = {f: i + 1};
        if (b)
            bar(o, p);
        result += o.f + p.f;
    }
    return result;
}

noInline(bar);
noInline(foo);

var result = foo(false);
if (result != sumOfArithSeries(n - 1) + sumOfArithSeries(n))
    throw "Error: bad result: " + result;



function sumOfArithSeries(limit) {
    return limit * (limit + 1) / 2;
}

var n = 100000000;

function foo() {
    var result = 0;
    for (var i = 0; i < n; ++i) {
        var o = {f: i};
        var p = {f: i + 1};
        result += o.f + p.f;
    }
    return result;
}

var result = foo();
if (result != sumOfArithSeries(n - 1) + sumOfArithSeries(n))
    throw "Error: bad result: " + result;



function sumOfArithSeries(limit) {
    return limit * (limit + 1) / 2;
}

var n = 100000000;

function bar() { }

function foo() {
    var result = 0;
    for (var i = 0; i < n; ++i) {
        var o = {f: i};
        var p = {f: i + 1};
        result += o.f + p.f;
        if (!(i % 100))
            bar(o, p);
    }
    return result;
}

noInline(bar);
noInline(foo);

var result = foo();
if (result != sumOfArithSeries(n - 1) + sumOfArithSeries(n))
    throw "Error: bad result: " + result;



function sumOfArithSeries(limit) {
    return limit * (limit + 1) / 2;
}

var n = 100000000;

function bar() { }

function foo(b) {
    var result = 0;
    for (var i = 0; i < n; ++i) {
        var o = {f: i};
        var p = {f: i + 1};
        if (b) {
            bar(o, p);
            return;
        }
        result += o.f + p.f;
    }
    return result;
}

noInline(bar);
noInline(foo);

var result = foo(false);
if (result != sumOfArithSeries(n - 1) + sumOfArithSeries(n))
    throw "Error: bad result: " + result;

Return to Bug 136330

Lines 1415-1421 void SpeculativeJIT::compileCurrentBlock Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp -3 / +2 lines
1415	else	1415	else
1416	m_canExit = mayExit(m_jit.graph(), m_currentNode);	1416	m_canExit = mayExit(m_jit.graph(), m_currentNode);
1417		1417
1418	bool shouldExecuteEffects = m_interpreter.startExecuting(m_currentNode);	1418	m_interpreter.startExecuting();
1419	m_jit.setForNode(m_currentNode);	1419	m_jit.setForNode(m_currentNode);
1420	m_codeOriginForExitTarget = m_currentNode->origin.forExit;	1420	m_codeOriginForExitTarget = m_currentNode->origin.forExit;
1421	m_codeOriginForExitProfile = m_currentNode->origin.semantic;	1421	m_codeOriginForExitProfile = m_currentNode->origin.semantic;
Lines 1472-1479 void SpeculativeJIT::compileCurrentBlock Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec2
1472	}	1472	}
1473		1473
1474	// Make sure that the abstract state is rematerialized for the next node.	1474	// Make sure that the abstract state is rematerialized for the next node.
1475	if (shouldExecuteEffects)	1475	m_interpreter.executeEffects(m_indexInBlock);
1476	m_interpreter.executeEffects(m_indexInBlock);
1477	}	1476	}
1478		1477
1479	// Perform the most basic verification that children have been used correctly.	1478	// Perform the most basic verification that children have been used correctly.

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +235 lines
		1	2014-09-24 Filip Pizlo <fpizlo@apple.com>
		2
		3	FTL should sink object allocations
		4	https://bugs.webkit.org/show_bug.cgi?id=136330
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Work in progress.
		9
		10	* CMakeLists.txt:
		11	* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
		12	* JavaScriptCore.xcodeproj/project.pbxproj:
		13	* bytecode/StructureSet.h:
		14	(JSC::StructureSet::iterator::iterator):
		15	(JSC::StructureSet::iterator::operator*):
		16	(JSC::StructureSet::iterator::operator++):
		17	(JSC::StructureSet::iterator::operator==):
		18	(JSC::StructureSet::iterator::operator!=):
		19	(JSC::StructureSet::begin):
		20	(JSC::StructureSet::end):
		21	* dfg/DFGAbstractInterpreter.h:
		22	(JSC::DFG::AbstractInterpreter::phiChildren):
		23	* dfg/DFGAbstractInterpreterInlines.h:
		24	(JSC::DFG::AbstractInterpreter<AbstractStateType>::AbstractInterpreter):
		25	(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
		26	* dfg/DFGAvailability.h:
		27	(JSC::DFG::Availability::shouldUseNode):
		28	(JSC::DFG::Availability::isFlushUseful):
		29	(JSC::DFG::Availability::isDead):
		30	* dfg/DFGAvailabilityMap.cpp: Added.
		31	(JSC::DFG::AvailabilityMap::prune):
		32	(JSC::DFG::AvailabilityMap::dump):
		33	(JSC::DFG::AvailabilityMap::operator==):
		34	(JSC::DFG::AvailabilityMap::merge):
		35	* dfg/DFGAvailabilityMap.h: Added.
		36	(JSC::DFG::AvailabilityMap::forEachAvailability):
		37	* dfg/DFGBasicBlock.cpp:
		38	(JSC::DFG::BasicBlock::SSAData::SSAData):
		39	* dfg/DFGBasicBlock.h:
		40	(JSC::DFG::BasicBlock::begin):
		41	(JSC::DFG::BasicBlock::end):
		42	(JSC::DFG::BasicBlock::SuccessorsIterable::SuccessorsIterable):
		43	(JSC::DFG::BasicBlock::SuccessorsIterable::iterator::iterator):
		44	(JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator*):
		45	(JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator++):
		46	(JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator==):
		47	(JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator!=):
		48	(JSC::DFG::BasicBlock::SuccessorsIterable::begin):
		49	(JSC::DFG::BasicBlock::SuccessorsIterable::end):
		50	(JSC::DFG::BasicBlock::successors):
		51	* dfg/DFGClobberize.h:
		52	(JSC::DFG::clobberize):
		53	* dfg/DFGConstantFoldingPhase.cpp:
		54	(JSC::DFG::ConstantFoldingPhase::foldConstants):
		55	* dfg/DFGDoesGC.cpp:
		56	(JSC::DFG::doesGC):
		57	* dfg/DFGFixupPhase.cpp:
		58	(JSC::DFG::FixupPhase::fixupNode):
		59	* dfg/DFGGraph.cpp:
		60	(JSC::DFG::Graph::mergeRelevantToOSR):
		61	* dfg/DFGGraph.h:
		62	(JSC::DFG::Graph::NaturalBlockIterable::NaturalBlockIterable):
		63	(JSC::DFG::Graph::NaturalBlockIterable::iterator::iterator):
		64	(JSC::DFG::Graph::NaturalBlockIterable::iterator::operator*):
65	(JSC::DFG::Graph::NaturalBlockIterable::iterator::operator++):
66	(JSC::DFG::Graph::NaturalBlockIterable::iterator::operator==):
67	(JSC::DFG::Graph::NaturalBlockIterable::iterator::operator!=):
68	(JSC::DFG::Graph::NaturalBlockIterable::iterator::findNext):
69	(JSC::DFG::Graph::NaturalBlockIterable::begin):
70	(JSC::DFG::Graph::NaturalBlockIterable::end):
71	(JSC::DFG::Graph::blocksInNaturalOrder):
72	(JSC::DFG::Graph::doToChildrenWithNode):
73	(JSC::DFG::Graph::doToChildEdges):
74	(JSC::DFG::Graph::doToChildren):
75	* dfg/DFGHeapLocation.cpp:
76	(WTF::printInternal):
77	* dfg/DFGHeapLocation.h:
78	* dfg/DFGInsertOSRHintsForUpdate.cpp: Added.
79	(JSC::DFG::insertOSRHintsForUpdate):
80	* dfg/DFGInsertOSRHintsForUpdate.h: Added.
81	* dfg/DFGInsertionSet.h:
82	(JSC::DFG::InsertionSet::graph):
83	* dfg/DFGNode.h:
84	(JSC::DFG::Node::convertToPutByOffsetHint):
85	(JSC::DFG::Node::convertToPutStructureHint):
86	(JSC::DFG::Node::convertToPhantomNewObject):
87	(JSC::DFG::Node::isCellConstant):
88	(JSC::DFG::Node::hasIdentifier):
89	(JSC::DFG::Node::hasTransition):
90	(JSC::DFG::Node::hasStorageAccessData):
91	(JSC::DFG::Node::hasObjectMaterializationData):
92	(JSC::DFG::Node::objectMaterializationData):
93	(JSC::DFG::Node::isPhantomObjectAllocation):
94	* dfg/DFGNodeType.h:
95	* dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
96	(JSC::DFG::OSRAvailabilityAnalysisPhase::run):
97	(JSC::DFG::LocalOSRAvailabilityCalculator::endBlock):
98	(JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
99	* dfg/DFGOSRAvailabilityAnalysisPhase.h:
100	* dfg/DFGObjectAllocationSinkingPhase.cpp: Added.
101	(JSC::DFG::ObjectAllocationSinkingPhase::ObjectAllocationSinkingPhase):
102	(JSC::DFG::ObjectAllocationSinkingPhase::run):
103	(JSC::DFG::ObjectAllocationSinkingPhase::performSinking):
104	(JSC::DFG::ObjectAllocationSinkingPhase::pruneSinkingCandidates):
105	(JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints):
106	(JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
107	(JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
108	(JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
109	(JSC::DFG::ObjectAllocationSinkingPhase::resolve):
110	(JSC::DFG::ObjectAllocationSinkingPhase::doNothing):
111	(JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
112	(JSC::DFG::ObjectAllocationSinkingPhase::createMaterialize):
113	(JSC::DFG::ObjectAllocationSinkingPhase::populateMaterialize):
114	(JSC::DFG::performObjectAllocationSinking):
115	* dfg/DFGObjectAllocationSinkingPhase.h: Added.
116	* dfg/DFGObjectMaterializationData.cpp: Added.
117	(JSC::DFG::PhantomPropertyValue::dump):
118	(JSC::DFG::ObjectMaterializationData::dump):
119	(JSC::DFG::ObjectMaterializationData::oneWaySimilarityScore):
120	(JSC::DFG::ObjectMaterializationData::similarityScore):
121	* dfg/DFGObjectMaterializationData.h: Added.
122	(JSC::DFG::PhantomPropertyValue::PhantomPropertyValue):
123	(JSC::DFG::PhantomPropertyValue::operator==):
124	* dfg/DFGPhantomCanonicalizationPhase.cpp:
125	(JSC::DFG::PhantomCanonicalizationPhase::run):
126	* dfg/DFGPhantomRemovalPhase.cpp:
127	(JSC::DFG::PhantomRemovalPhase::run):
128	* dfg/DFGPhiChildren.cpp: Added.
129	(JSC::DFG::PhiChildren::PhiChildren):
130	(JSC::DFG::PhiChildren::~PhiChildren):
131	(JSC::DFG::PhiChildren::childrenOf):
132	* dfg/DFGPhiChildren.h: Added.
133	(JSC::DFG::PhiChildren::forAllIncomingValues):
134	(JSC::DFG::PhiChildren::forAllTransitiveIncomingValues):
135	* dfg/DFGPlan.cpp:
136	(JSC::DFG::Plan::compileInThreadImpl):
137	* dfg/DFGPredictionPropagationPhase.cpp:
138	(JSC::DFG::PredictionPropagationPhase::propagate):
139	* dfg/DFGPromotedHeapLocation.cpp: Added.
140	(JSC::DFG::BaselessPromotedHeapLocation::dump):
141	(JSC::DFG::PromotedHeapLocation::createHint):
142	(JSC::DFG::PromotedHeapLocation::dump):
143	(WTF::printInternal):
144	* dfg/DFGPromotedHeapLocation.h: Added.
145	(JSC::DFG::BaselessPromotedHeapLocation::BaselessPromotedHeapLocation):
146	(JSC::DFG::BaselessPromotedHeapLocation::operator!):
147	(JSC::DFG::BaselessPromotedHeapLocation::kind):
148	(JSC::DFG::BaselessPromotedHeapLocation::info):
149	(JSC::DFG::BaselessPromotedHeapLocation::hash):
150	(JSC::DFG::BaselessPromotedHeapLocation::operator==):
151	(JSC::DFG::BaselessPromotedHeapLocation::isHashTableDeletedValue):
152	(JSC::DFG::PromotedHeapLocation::PromotedHeapLocation):
153	(JSC::DFG::PromotedHeapLocation::PromotedHeapLocaftion):
154	(JSC::DFG::PromotedHeapLocation::operator!):
155	(JSC::DFG::PromotedHeapLocation::kind):
156	(JSC::DFG::PromotedHeapLocation::base):
157	(JSC::DFG::PromotedHeapLocation::info):
158	(JSC::DFG::PromotedHeapLocation::baseless):
159	(JSC::DFG::PromotedHeapLocation::hash):
160	(JSC::DFG::PromotedHeapLocation::operator==):
161	(JSC::DFG::PromotedHeapLocation::isHashTableDeletedValue):
162	(JSC::DFG::promote):
163	(JSC::DFG::PromotedHeapLocationHash::hash):
164	(JSC::DFG::PromotedHeapLocationHash::equal):
165	* dfg/DFGSSACalculator.cpp:
166	(JSC::DFG::SSACalculator::reset):
167	* dfg/DFGSSACalculator.h:
168	* dfg/DFGSafeToExecute.h:
169	(JSC::DFG::safeToExecute):
170	* dfg/DFGSpeculativeJIT32_64.cpp:
171	(JSC::DFG::SpeculativeJIT::compile):
172	* dfg/DFGSpeculativeJIT64.cpp:
173	(JSC::DFG::SpeculativeJIT::compile):
174	* ftl/FTLCapabilities.cpp:
175	(JSC::FTL::canCompile):
176	* ftl/FTLExitPropertyValue.cpp: Added.
177	(JSC::FTL::ExitPropertyValue::dump):
178	* ftl/FTLExitPropertyValue.h: Added.
179	(JSC::FTL::ExitPropertyValue::ExitPropertyValue):
180	(JSC::FTL::ExitPropertyValue::operator!):
181	(JSC::FTL::ExitPropertyValue::location):
182	(JSC::FTL::ExitPropertyValue::value):
183	* ftl/FTLExitTimeObjectMaterialization.cpp: Added.
184	(JSC::FTL::ExitTimeObjectMaterialization::ExitTimeObjectMaterialization):
185	(JSC::FTL::ExitTimeObjectMaterialization::~ExitTimeObjectMaterialization):
186	(JSC::FTL::ExitTimeObjectMaterialization::add):
187	(JSC::FTL::ExitTimeObjectMaterialization::get):
188	(JSC::FTL::ExitTimeObjectMaterialization::dump):
189	* ftl/FTLExitTimeObjectMaterialization.h: Added.
190	(JSC::FTL::ExitTimeObjectMaterialization::type):
191	(JSC::FTL::ExitTimeObjectMaterialization::properties):
192	* ftl/FTLExitValue.cpp:
193	(JSC::FTL::ExitValue::materializeNewObject):
194	(JSC::FTL::ExitValue::dumpInContext):
195	* ftl/FTLExitValue.h:
196	(JSC::FTL::ExitValue::isObjectMaterialization):
197	(JSC::FTL::ExitValue::objectMaterialization):
198	(JSC::FTL::ExitValue::withVirtualRegister):
199	(JSC::FTL::ExitValue::valueFormat):
200	* ftl/FTLLowerDFGToLLVM.cpp:
201	(JSC::FTL::LowerDFGToLLVM::compileNode):
202	(JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
203	(JSC::FTL::LowerDFGToLLVM::compileNewObject):
204	(JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
205	(JSC::FTL::LowerDFGToLLVM::compileInvalidationPoint):
206	(JSC::FTL::LowerDFGToLLVM::compileCheckStructureImmediate):
207	(JSC::FTL::LowerDFGToLLVM::compileMaterializeNewObject):
208	(JSC::FTL::LowerDFGToLLVM::checkStructure):
209	(JSC::FTL::LowerDFGToLLVM::allocatePropertyStorage):
210	(JSC::FTL::LowerDFGToLLVM::reallocatePropertyStorage):
211	(JSC::FTL::LowerDFGToLLVM::allocatePropertyStorageWithSizeImpl):
212	(JSC::FTL::LowerDFGToLLVM::allocateCell):
213	(JSC::FTL::LowerDFGToLLVM::storeStructure):
214	(JSC::FTL::LowerDFGToLLVM::allocateObject):
215	(JSC::FTL::LowerDFGToLLVM::appendOSRExit):
216	(JSC::FTL::LowerDFGToLLVM::buildExitArguments):
217	(JSC::FTL::LowerDFGToLLVM::exitValueForAvailability):
218	(JSC::FTL::LowerDFGToLLVM::exitValueForNode):
219	(JSC::FTL::LowerDFGToLLVM::availabilityMap):
220	(JSC::FTL::LowerDFGToLLVM::availability): Deleted.
221	* ftl/FTLOSRExit.h:
222	* ftl/FTLOSRExitCompiler.cpp:
223	(JSC::FTL::compileRecovery):
224	(JSC::FTL::compileStub):
225	* ftl/FTLOperations.cpp: Added.
226	(JSC::FTL::operationNewObjectWithButterfly):
227	(JSC::FTL::operationMaterializeObjectInOSR):
228	* ftl/FTLOperations.h: Added.
229	* runtime/JSObject.h:
230	(JSC::JSFinalObject::JSFinalObject):
231	(JSC::JSFinalObject::create):
232	* runtime/Structure.cpp:
233	(JSC::Structure::canUseForAllocationsOf):
234	* runtime/Structure.h:
235
1	2014-09-21 Filip Pizlo <fpizlo@apple.com>	236	2014-09-21 Filip Pizlo <fpizlo@apple.com>
2		237
3	FTL should store the four bytes of the cell header using a 32-bit store rather than four 8-bit stores	238	FTL should store the four bytes of the cell header using a 32-bit store rather than four 8-bit stores

Lines 368-373 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec1
- Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj +19 lines
368	<ClCompile Include="..\dfg\DFGArrayMode.cpp" />	368	<ClCompile Include="..\dfg\DFGArrayMode.cpp" />
369	<ClCompile Include="..\dfg\DFGAtTailAbstractState.cpp" />	369	<ClCompile Include="..\dfg\DFGAtTailAbstractState.cpp" />
370	<ClCompile Include="..\dfg\DFGAvailability.cpp" />	370	<ClCompile Include="..\dfg\DFGAvailability.cpp" />
		371	<ClCompile Include="..\dfg\DFGAvailabilityMap.cpp" />
371	<ClCompile Include="..\dfg\DFGBackwardsPropagationPhase.cpp" />	372	<ClCompile Include="..\dfg\DFGBackwardsPropagationPhase.cpp" />
372	<ClCompile Include="..\dfg\DFGBasicBlock.cpp" />	373	<ClCompile Include="..\dfg\DFGBasicBlock.cpp" />
373	<ClCompile Include="..\dfg\DFGBinarySwitch.cpp" />	374	<ClCompile Include="..\dfg\DFGBinarySwitch.cpp" />
Lines 410-415 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec2
410	<ClCompile Include="..\dfg\DFGGraphSafepoint.cpp" />	411	<ClCompile Include="..\dfg\DFGGraphSafepoint.cpp" />
411	<ClCompile Include="..\dfg\DFGHeapLocation.cpp" />	412	<ClCompile Include="..\dfg\DFGHeapLocation.cpp" />
412	<ClCompile Include="..\dfg\DFGInPlaceAbstractState.cpp" />	413	<ClCompile Include="..\dfg\DFGInPlaceAbstractState.cpp" />
		414	<ClCompile Include="..\dfg\DFGInsertOSRHintsForUpdate.cpp" />
413	<ClCompile Include="..\dfg\DFGIntegerCheckCombiningPhase.cpp" />	415	<ClCompile Include="..\dfg\DFGIntegerCheckCombiningPhase.cpp" />
414	<ClCompile Include="..\dfg\DFGInvalidationPointInjectionPhase.cpp" />	416	<ClCompile Include="..\dfg\DFGInvalidationPointInjectionPhase.cpp" />
415	<ClCompile Include="..\dfg\DFGJITCode.cpp" />	417	<ClCompile Include="..\dfg\DFGJITCode.cpp" />
Lines 439-450 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec3
439	<ClCompile Include="..\dfg\DFGOSRExitCompilerCommon.cpp" />	441	<ClCompile Include="..\dfg\DFGOSRExitCompilerCommon.cpp" />
440	<ClCompile Include="..\dfg\DFGOSRExitJumpPlaceholder.cpp" />	442	<ClCompile Include="..\dfg\DFGOSRExitJumpPlaceholder.cpp" />
441	<ClCompile Include="..\dfg\DFGOSRExitPreparation.cpp" />	443	<ClCompile Include="..\dfg\DFGOSRExitPreparation.cpp" />
		444	<ClCompile Include="..\dfg\DFGObjectAllocationSinkingPhase.cpp" />
		445	<ClCompile Include="..\dfg\DFGObjectMaterializationData.cpp" />
442	<ClCompile Include="..\dfg\DFGPhantomCanonicalizationPhase.cpp" />	446	<ClCompile Include="..\dfg\DFGPhantomCanonicalizationPhase.cpp" />
443	<ClCompile Include="..\dfg\DFGPhantomRemovalPhase.cpp" />	447	<ClCompile Include="..\dfg\DFGPhantomRemovalPhase.cpp" />
444	<ClCompile Include="..\dfg\DFGPhase.cpp" />	448	<ClCompile Include="..\dfg\DFGPhase.cpp" />
		449	<ClCompile Include="..\dfg\DFGPhiChildren.cpp" />
445	<ClCompile Include="..\dfg\DFGPlan.cpp" />	450	<ClCompile Include="..\dfg\DFGPlan.cpp" />
446	<ClCompile Include="..\dfg\DFGPredictionInjectionPhase.cpp" />	451	<ClCompile Include="..\dfg\DFGPredictionInjectionPhase.cpp" />
447	<ClCompile Include="..\dfg\DFGPredictionPropagationPhase.cpp" />	452	<ClCompile Include="..\dfg\DFGPredictionPropagationPhase.cpp" />
		453	<ClCompile Include="..\dfg\DFGPromotedHeapLocation.cpp" />
448	<ClCompile Include="..\dfg\DFGPureValue.cpp" />	454	<ClCompile Include="..\dfg\DFGPureValue.cpp" />
449	<ClCompile Include="..\dfg\DFGResurrectionForValidationPhase.cpp" />	455	<ClCompile Include="..\dfg\DFGResurrectionForValidationPhase.cpp" />
450	<ClCompile Include="..\dfg\DFGSafepoint.cpp" />	456	<ClCompile Include="..\dfg\DFGSafepoint.cpp" />
Lines 493-499 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec4
493	<ClCompile Include="..\ftl\FTLDWARFRegister.cpp" />	499	<ClCompile Include="..\ftl\FTLDWARFRegister.cpp" />
494	<ClCompile Include="..\ftl\FTLExitArgument.cpp" />	500	<ClCompile Include="..\ftl\FTLExitArgument.cpp" />
495	<ClCompile Include="..\ftl\FTLExitArgumentForOperand.cpp" />	501	<ClCompile Include="..\ftl\FTLExitArgumentForOperand.cpp" />
		502	<ClCompile Include="..\ftl\FTLExitPropertyValue.cpp" />
496	<ClCompile Include="..\ftl\FTLExitThunkGenerator.cpp" />	503	<ClCompile Include="..\ftl\FTLExitThunkGenerator.cpp" />
		504	<ClCompile Include="..\ftl\FTLExitTimeObjectMaterialization.cpp" />
497	<ClCompile Include="..\ftl\FTLExitValue.cpp" />	505	<ClCompile Include="..\ftl\FTLExitValue.cpp" />
498	<ClCompile Include="..\ftl\FTLFail.cpp" />	506	<ClCompile Include="..\ftl\FTLFail.cpp" />
499	<ClCompile Include="..\ftl\FTLForOSREntryJITCode.cpp" />	507	<ClCompile Include="..\ftl\FTLForOSREntryJITCode.cpp" />
Lines 508-513 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec5
508	<ClCompile Include="..\ftl\FTLOSREntry.cpp" />	516	<ClCompile Include="..\ftl\FTLOSREntry.cpp" />
509	<ClCompile Include="..\ftl\FTLOSRExit.cpp" />	517	<ClCompile Include="..\ftl\FTLOSRExit.cpp" />
510	<ClCompile Include="..\ftl\FTLOSRExitCompiler.cpp" />	518	<ClCompile Include="..\ftl\FTLOSRExitCompiler.cpp" />
		519	<ClCompile Include="..\ftl\FTLOperations.cpp" />
511	<ClCompile Include="..\ftl\FTLOutput.cpp" />	520	<ClCompile Include="..\ftl\FTLOutput.cpp" />
512	<ClCompile Include="..\ftl\FTLRecoveryOpcode.cpp" />	521	<ClCompile Include="..\ftl\FTLRecoveryOpcode.cpp" />
513	<ClCompile Include="..\ftl\FTLRegisterAtOffset.cpp" />	522	<ClCompile Include="..\ftl\FTLRegisterAtOffset.cpp" />
Lines 993-998 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec6
993	<ClInclude Include="..\dfg\DFGArrayMode.h" />	1002	<ClInclude Include="..\dfg\DFGArrayMode.h" />
994	<ClInclude Include="..\dfg\DFGAtTailAbstractState.h" />	1003	<ClInclude Include="..\dfg\DFGAtTailAbstractState.h" />
995	<ClInclude Include="..\dfg\DFGAvailability.h" />	1004	<ClInclude Include="..\dfg\DFGAvailability.h" />
		1005	<ClInclude Include="..\dfg\DFGAvailabilityMap.h" />
996	<ClInclude Include="..\dfg\DFGBackwardsPropagationPhase.h" />	1006	<ClInclude Include="..\dfg\DFGBackwardsPropagationPhase.h" />
997	<ClInclude Include="..\dfg\DFGBasicBlock.h" />	1007	<ClInclude Include="..\dfg\DFGBasicBlock.h" />
998	<ClInclude Include="..\dfg\DFGBasicBlockInlines.h" />	1008	<ClInclude Include="..\dfg\DFGBasicBlockInlines.h" />
Lines 1049-1054 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec7
1049	<ClInclude Include="..\dfg\DFGGraphSafepoint.h" />	1059	<ClInclude Include="..\dfg\DFGGraphSafepoint.h" />
1050	<ClInclude Include="..\dfg\DFGHeapLocation.h" />	1060	<ClInclude Include="..\dfg\DFGHeapLocation.h" />
1051	<ClInclude Include="..\dfg\DFGInPlaceAbstractState.h" />	1061	<ClInclude Include="..\dfg\DFGInPlaceAbstractState.h" />
		1062	<ClInclude Include="..\dfg\DFGInsertOSRHintsForUpdate.h" />
1052	<ClInclude Include="..\dfg\DFGInsertionSet.h" />	1063	<ClInclude Include="..\dfg\DFGInsertionSet.h" />
1053	<ClInclude Include="..\dfg\DFGIntegerCheckCombiningPhase.h" />	1064	<ClInclude Include="..\dfg\DFGIntegerCheckCombiningPhase.h" />
1054	<ClInclude Include="..\dfg\DFGInvalidationPointInjectionPhase.h" />	1065	<ClInclude Include="..\dfg\DFGInvalidationPointInjectionPhase.h" />
Lines 1073-1078 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec8
1073	<ClInclude Include="..\dfg\DFGNodeFlags.h" />	1084	<ClInclude Include="..\dfg\DFGNodeFlags.h" />
1074	<ClInclude Include="..\dfg\DFGNodeOrigin.h" />	1085	<ClInclude Include="..\dfg\DFGNodeOrigin.h" />
1075	<ClInclude Include="..\dfg\DFGNodeType.h" />	1086	<ClInclude Include="..\dfg\DFGNodeType.h" />
		1087	<ClInclude Include="..\dfg\DFGObjectAllocationSinkingPhase.h" />
		1088	<ClInclude Include="..\dfg\DFGObjectMaterializationData.h" />
1076	<ClInclude Include="..\dfg\DFGOperations.h" />	1089	<ClInclude Include="..\dfg\DFGOperations.h" />
1077	<ClInclude Include="..\dfg\DFGOSRAvailabilityAnalysisPhase.h" />	1090	<ClInclude Include="..\dfg\DFGOSRAvailabilityAnalysisPhase.h" />
1078	<ClInclude Include="..\dfg\DFGOSREntry.h" />	1091	<ClInclude Include="..\dfg\DFGOSREntry.h" />
Lines 1087-1095 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec9
1087	<ClInclude Include="..\dfg\DFGPhantomCanonicalizationPhase.h" />	1100	<ClInclude Include="..\dfg\DFGPhantomCanonicalizationPhase.h" />
1088	<ClInclude Include="..\dfg\DFGPhantomRemovalPhase.h" />	1101	<ClInclude Include="..\dfg\DFGPhantomRemovalPhase.h" />
1089	<ClInclude Include="..\dfg\DFGPhase.h" />	1102	<ClInclude Include="..\dfg\DFGPhase.h" />
		1103	<ClInclude Include="..\dfg\DFGPhiChildren.h" />
1090	<ClInclude Include="..\dfg\DFGPlan.h" />	1104	<ClInclude Include="..\dfg\DFGPlan.h" />
1091	<ClInclude Include="..\dfg\DFGPredictionInjectionPhase.h" />	1105	<ClInclude Include="..\dfg\DFGPredictionInjectionPhase.h" />
1092	<ClInclude Include="..\dfg\DFGPredictionPropagationPhase.h" />	1106	<ClInclude Include="..\dfg\DFGPredictionPropagationPhase.h" />
		1107	<ClInclude Include="..\dfg\DFGPromoteHeapAccess.h" />
		1108	<ClInclude Include="..\dfg\DFGPromotedHeapLocation.h" />
1093	<ClInclude Include="..\dfg\DFGPureValue.h" />	1109	<ClInclude Include="..\dfg\DFGPureValue.h" />
1094	<ClInclude Include="..\dfg\DFGRegisterBank.h" />	1110	<ClInclude Include="..\dfg\DFGRegisterBank.h" />
1095	<ClInclude Include="..\dfg\DFGRegisterSet.h" />	1111	<ClInclude Include="..\dfg\DFGRegisterSet.h" />
Lines 1150-1156 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec10
1150	<ClInclude Include="..\ftl\FTLExitArgument.h" />	1166	<ClInclude Include="..\ftl\FTLExitArgument.h" />
1151	<ClInclude Include="..\ftl\FTLExitArgumentForOperand.h" />	1167	<ClInclude Include="..\ftl\FTLExitArgumentForOperand.h" />
1152	<ClInclude Include="..\ftl\FTLExitArgumentList.h" />	1168	<ClInclude Include="..\ftl\FTLExitArgumentList.h" />
		1169	<ClInclude Include="..\ftl\FTLExitPropertyValue.h" />
1153	<ClInclude Include="..\ftl\FTLExitThunkGenerator.h" />	1170	<ClInclude Include="..\ftl\FTLExitThunkGenerator.h" />
		1171	<ClInclude Include="..\ftl\FTLExitTimeObjectMaterialization.h" />
1154	<ClInclude Include="..\ftl\FTLExitValue.h" />	1172	<ClInclude Include="..\ftl\FTLExitValue.h" />
1155	<ClInclude Include="..\ftl\FTLFail.h" />	1173	<ClInclude Include="..\ftl\FTLFail.h" />
1156	<ClInclude Include="..\ftl\FTLFormattedValue.h" />	1174	<ClInclude Include="..\ftl\FTLFormattedValue.h" />
Lines 1170-1175 Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj_sec11
1170	<ClInclude Include="..\ftl\FTLOSRExit.h" />	1188	<ClInclude Include="..\ftl\FTLOSRExit.h" />
1171	<ClInclude Include="..\ftl\FTLOSRExitCompilationInfo.h" />	1189	<ClInclude Include="..\ftl\FTLOSRExitCompilationInfo.h" />
1172	<ClInclude Include="..\ftl\FTLOSRExitCompiler.h" />	1190	<ClInclude Include="..\ftl\FTLOSRExitCompiler.h" />
		1191	<ClInclude Include="..\ftl\FTLOperations.h" />
1173	<ClInclude Include="..\ftl\FTLOutput.h" />	1192	<ClInclude Include="..\ftl\FTLOutput.h" />
1174	<ClInclude Include="..\ftl\FTLRecoveryOpcode.h" />	1193	<ClInclude Include="..\ftl\FTLRecoveryOpcode.h" />
1175	<ClInclude Include="..\ftl\FTLRegisterAtOffset.h" />	1194	<ClInclude Include="..\ftl\FTLRegisterAtOffset.h" />

Lines 166-171 public: Source/JavaScriptCore/bytecode/StructureSet.h_sec1
- Source/JavaScriptCore/bytecode/StructureSet.h +31 lines
166	return structureList()->list()[structureList()->m_length - 1];	166	return structureList()->list()[structureList()->m_length - 1];
167	}	167	}
168		168
		169	class iterator {
		170	public:
		171	iterator()
		172	: m_set(nullptr)
		173	, m_index(0)
		174	{
		175	}
		176
		177	iterator(const StructureSet* set, size_t index)
		178	: m_set(set)
		179	, m_index(index)
		180	{
		181	}
		182
		183	Structure* operator*() const { return m_set->at(m_index); }
		184	iterator& operator++()
		185	{
		186	m_index++;
		187	return *this;
		188	}
		189	bool operator==(const iterator& other) const { return m_index == other.m_index; }
		190	bool operator!=(const iterator& other) const { return !(*this == other); }
		191
		192	private:
		193	const StructureSet* m_set;
		194	size_t m_index;
		195	};
		196
		197	iterator begin() const { return iterator(this, 0); }
		198	iterator end() const { return iterator(this, size()); }
		199
169	bool operator==(const StructureSet& other) const;	200	bool operator==(const StructureSet& other) const;
170		201
171	SpeculatedType speculationFromStructures() const;	202	SpeculatedType speculationFromStructures() const;

Lines 32-37 Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h_sec1
- Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h -8 / +9 lines
32	#include "DFGBranchDirection.h"	32	#include "DFGBranchDirection.h"
33	#include "DFGGraph.h"	33	#include "DFGGraph.h"
34	#include "DFGNode.h"	34	#include "DFGNode.h"
		35	#include "DFGPhiChildren.h"
35		36
36	namespace JSC { namespace DFG {	37	namespace JSC { namespace DFG {
37		38
Lines 80-97 public: Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h_sec2
80	//	81	//
81	// This is guaranteed to be equivalent to doing:	82	// This is guaranteed to be equivalent to doing:
82	//	83	//
83	// if (state.startExecuting(index)) {	84	// state.startExecuting()
84	// state.executeEdges(index);	85	// state.executeEdges(index);
85	// result = state.executeEffects(index);	86	// result = state.executeEffects(index);
86	// } else
87	// result = true;
88	bool execute(unsigned indexInBlock);	87	bool execute(unsigned indexInBlock);
89	bool execute(Node*);	88	bool execute(Node*);
90		89
91	// Indicate the start of execution of the node. It resets any state in the node	90	// Indicate the start of execution of a node. It resets any state in the node
92	// that is progressively built up by executeEdges() and executeEffects().	91	// that is progressively built up by executeEdges() and executeEffects().
93	bool startExecuting(Node*);	92	void startExecuting();
94	bool startExecuting(unsigned indexInBlock);
95		93
96	// Abstractly execute the edges of the given node. This runs filterEdgeByUse()	94	// Abstractly execute the edges of the given node. This runs filterEdgeByUse()
97	// on all edges of the node. You can skip this step, if you have already used	95	// on all edges of the node. You can skip this step, if you have already used
Lines 146-151 public: Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h_sec3
146	FiltrationResult filter(AbstractValue&, SpeculatedType);	144	FiltrationResult filter(AbstractValue&, SpeculatedType);
147	FiltrationResult filterByValue(AbstractValue&, FrozenValue);	145	FiltrationResult filterByValue(AbstractValue&, FrozenValue);
148		146
		147	PhiChildren* phiChildren() { return m_phiChildren.get(); }
		148
149	private:	149	private:
150	void clobberWorld(const CodeOrigin&, unsigned indexInBlock);	150	void clobberWorld(const CodeOrigin&, unsigned indexInBlock);
151	void clobberCapturedVars(const CodeOrigin&);	151	void clobberCapturedVars(const CodeOrigin&);
Lines 195-200 private: Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h_sec4
195	CodeBlock* m_codeBlock;	195	CodeBlock* m_codeBlock;
196	Graph& m_graph;	196	Graph& m_graph;
197	AbstractStateType& m_state;	197	AbstractStateType& m_state;
		198	std::unique_ptr<PhiChildren> m_phiChildren;
198	};	199	};
199		200
200	} } // namespace JSC::DFG	201	} } // namespace JSC::DFG

Lines 43-48 AbstractInterpreter<AbstractStateType>:: Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec1
- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h -18 / +73 lines
43	, m_graph(graph)	43	, m_graph(graph)
44	, m_state(state)	44	, m_state(state)
45	{	45	{
		46	if (m_graph.m_form == SSA)
		47	m_phiChildren = std::make_unique<PhiChildren>(m_graph);
46	}	48	}
47		49
48	template<typename AbstractStateType>	50	template<typename AbstractStateType>
Lines 81-100 AbstractInterpreter<AbstractStateType>:: Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec2
81	}	83	}
82		84
83	template<typename AbstractStateType>	85	template<typename AbstractStateType>
84	bool AbstractInterpreter<AbstractStateType>::startExecuting(Node* node)	86	void AbstractInterpreter<AbstractStateType>::startExecuting()
85	{	87	{
86	ASSERT(m_state.block());	88	ASSERT(m_state.block());
87	ASSERT(m_state.isValid());	89	ASSERT(m_state.isValid());
88		90
89	m_state.setDidClobber(false);	91	m_state.setDidClobber(false);
90
91	return node->shouldGenerate();
92	}
93
94	template<typename AbstractStateType>
95	bool AbstractInterpreter<AbstractStateType>::startExecuting(unsigned indexInBlock)
96	{
97	return startExecuting(m_state.block()->at(indexInBlock));
98	}	92	}
99		93
100	template<typename AbstractStateType>	94	template<typename AbstractStateType>
Lines 1260-1265 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec3
1260	forNode(node).set(m_graph, node->structure());	1254	forNode(node).set(m_graph, node->structure());
1261	break;	1255	break;
1262		1256
		1257	case PhantomNewObject:
		1258	case BottomValue:
		1259	m_state.setDidClobber(true); // Prevent constant folding.
		1260	// This claims to return bottom.
		1261	break;
		1262
		1263	case PutByOffsetHint:
		1264	case PutStructureHint:
		1265	break;
		1266
		1267	case MaterializeNewObject: {
		1268	StructureSet set;
		1269
		1270	m_phiChildren->forAllTransitiveIncomingValues(
		1271	m_graph.varArgChild(node, 0).node(),
		1272	[&] (Node* incoming) {
		1273	set.add(incoming->castConstant<Structure*>());
		1274	});
		1275
		1276	forNode(node).set(m_graph, set);
		1277	break;
		1278	}
		1279
1263	case CreateActivation:	1280	case CreateActivation:
1264	forNode(node).set(	1281	forNode(node).set(
1265	m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->activationStructure());	1282	m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->activationStructure());
Lines 1459-1465 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec4
1459	break;	1476	break;
1460		1477
1461	case CheckStructure: {	1478	case CheckStructure: {
1462	// FIXME: We should be able to propagate the structure sets of constants (i.e. prototypes).
1463	AbstractValue& value = forNode(node->child1());	1479	AbstractValue& value = forNode(node->child1());
1464	ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.	1480	ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.
1465		1481
Lines 1478-1483 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec5
1478	break;	1494	break;
1479	}	1495	}
1480		1496
		1497	case CheckStructureImmediate: {
		1498	// FIXME: This currently can only reason about one structure at a time.
		1499	// https://bugs.webkit.org/show_bug.cgi?id=136988
		1500
		1501	AbstractValue& value = forNode(node->child1());
		1502	StructureSet& set = node->structureSet();
		1503
		1504	if (value.value()) {
		1505	if (Structure* structure = jsDynamicCast<Structure*>(value.value())) {
		1506	if (set.contains(structure)) {
		1507	m_state.setFoundConstants(true);
		1508	break;
		1509	}
		1510	}
		1511	m_state.setIsValid(false);
		1512	break;
		1513	}
		1514
		1515	if (m_phiChildren) {
		1516	bool allGood = true;
		1517	m_phiChildren->forAllTransitiveIncomingValues(
		1518	node,
		1519	[&] (Node* incoming) {
		1520	if (Structure* structure = incoming->dynamicCastConstant<Structure*>()) {
		1521	if (set.contains(structure))
		1522	return;
		1523	}
		1524	allGood = false;
		1525	});
		1526	if (allGood) {
		1527	m_state.setFoundConstants(true);
		1528	break;
		1529	}
		1530	}
		1531
		1532	if (Structure* structure = set.onlyStructure()) {
		1533	filterByValue(node->child1(), *m_graph.freeze(structure));
		1534	break;
		1535	}
		1536
		1537	// Aw shucks, we can't do anything!
		1538	break;
		1539	}
		1540
1481	case PutStructure:	1541	case PutStructure:
1482	if (!forNode(node->child1()).m_structure.isClear()) {	1542	if (!forNode(node->child1()).m_structure.isClear()) {
1483	if (forNode(node->child1()).m_structure.onlyStructure() == node->transition()->next)	1543	if (forNode(node->child1()).m_structure.onlyStructure() == node->transition()->next)
Lines 1957-1971 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec6
1957		2017
1958	case CheckTierUpAndOSREnter:	2018	case CheckTierUpAndOSREnter:
1959	case LoopHint:	2019	case LoopHint:
1960	// We pretend that it can exit because it may want to get all state.	2020	case ZombieHint:
1961	break;	2021	break;
1962		2022
1963	case ZombieHint:
1964	case Unreachable:	2023	case Unreachable:
1965	case LastNodeType:	2024	case LastNodeType:
1966	case ArithIMul:	2025	case ArithIMul:
1967	case FiatInt52:	2026	case FiatInt52:
1968	case BottomValue:
1969	DFG_CRASH(m_graph, node, "Unexpected node type");	2027	DFG_CRASH(m_graph, node, "Unexpected node type");
1970	break;	2028	break;
1971	}	2029	}
Lines 1983-1991 template<typename AbstractStateType> Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec7
1983	bool AbstractInterpreter<AbstractStateType>::execute(unsigned indexInBlock)	2041	bool AbstractInterpreter<AbstractStateType>::execute(unsigned indexInBlock)
1984	{	2042	{
1985	Node* node = m_state.block()->at(indexInBlock);	2043	Node* node = m_state.block()->at(indexInBlock);
1986	if (!startExecuting(node))
1987	return true;
1988		2044
		2045	startExecuting();
1989	executeEdges(node);	2046	executeEdges(node);
1990	return executeEffects(indexInBlock, node);	2047	return executeEffects(indexInBlock, node);
1991	}	2048	}
Lines 1993-2001 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec8
1993	template<typename AbstractStateType>	2050	template<typename AbstractStateType>
1994	bool AbstractInterpreter<AbstractStateType>::execute(Node* node)	2051	bool AbstractInterpreter<AbstractStateType>::execute(Node* node)
1995	{	2052	{
1996	if (!startExecuting(node))	2053	startExecuting();
1997	return true;
1998
1999	executeEdges(node);	2054	executeEdges(node);
2000	return executeEffects(UINT_MAX, node);	2055	return executeEffects(UINT_MAX, node);
2001	}	2056	}

Line 0 Source/JavaScriptCore/dfg/DFGAvailabilityMap.cpp_sec1
- Source/JavaScriptCore/dfg/DFGAvailabilityMap.cpp +96 lines
		1	/*
		2	* Copyright (C) 2014 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "DFGAvailabilityMap.h"
		28
		29	#if ENABLE(DFG_JIT)
		30
		31	#include "OperandsInlines.h"
		32	#include <wtf/ListDump.h>
		33
		34	namespace JSC { namespace DFG {
		35
		36	void AvailabilityMap::prune()
		37	{
		38	if (m_heap.isEmpty())
		39	return;
		40
		41	HashSet<Node*> possibleNodes;
		42
		43	for (unsigned i = m_locals.size(); i--;) {
		44	if (m_locals[i].hasNode())
		45	possibleNodes.add(m_locals[i].node());
		46	}
		47
		48	int oldPossibleNodesSize;
		49	do {
		50	oldPossibleNodesSize = possibleNodes.size();
		51	for (auto pair : m_heap) {
		52	if (pair.value.hasNode() && possibleNodes.contains(pair.key.base()))
		53	possibleNodes.add(pair.value.node());
		54	}
		55	} while (oldPossibleNodesSize != possibleNodes.size());
		56
		57	HashMap<PromotedHeapLocation, Availability> newHeap;
		58	for (auto pair : m_heap) {
		59	if (possibleNodes.contains(pair.key.base()))
		60	newHeap.add(pair.key, pair.value);
		61	}
		62	m_heap = newHeap;
		63	}
		64
65	void AvailabilityMap::clear()
66	{
67	m_locals.fill(Availability());
68	m_heap.clear();
69	}
70
71	void AvailabilityMap::dump(PrintStream& out) const
72	{
73	out.print("{locals = ", m_locals, "; heap = ", mapDump(m_heap), "}");
74	}
75
76	bool AvailabilityMap::operator==(const AvailabilityMap& other) const
77	{
78	return m_locals == other.m_locals
79	&& m_heap == other.m_heap;
80	}
81
82	void AvailabilityMap::merge(const AvailabilityMap& other)
83	{
84	for (unsigned i = other.m_locals.size(); i--;)
85	m_locals[i] = other.m_locals[i].merge(m_locals[i]);
86
87	for (auto pair : other.m_heap) {
88	auto result = m_heap.add(pair.key, Availability());
89	result.iterator->value = pair.value.merge(result.iterator->value);
90	}
91	}
92
93	} } // namespace JSC::DFG
94
95	#endif // ENABLE(DFG_JIT)
96

Lines 118-126 void BasicBlock::dump(PrintStream& out) Source/JavaScriptCore/dfg/DFGBasicBlock.cpp_sec1
- Source/JavaScriptCore/dfg/DFGBasicBlock.cpp -2 / +2 lines
118	}	118	}
119		119
120	BasicBlock::SSAData::SSAData(BasicBlock* block)	120	BasicBlock::SSAData::SSAData(BasicBlock* block)
121	: availabilityAtHead(OperandsLike, block->variablesAtHead)
122	, availabilityAtTail(OperandsLike, block->variablesAtHead)
123	{	121	{
		122	availabilityAtHead.m_locals = Operands<Availability>(OperandsLike, block->variablesAtHead);
		123	availabilityAtTail.m_locals = Operands<Availability>(OperandsLike, block->variablesAtHead);
124	}	124	}
125		125
126	BasicBlock::SSAData::~SSAData() { }	126	BasicBlock::SSAData::~SSAData() { }

Lines 124-129 private: Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp_sec1
- Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp +36 lines
124	break;	124	break;
125	}	125	}
126		126
		127	case CheckStructureImmediate: {
		128	AbstractValue& value = m_state.forNode(node->child1());
		129	StructureSet& set = node->structureSet();
		130
		131	if (value.value()) {
		132	if (Structure* structure = jsDynamicCast<Structure*>(value.value())) {
		133	if (set.contains(structure)) {
		134	m_interpreter.execute(indexInBlock);
		135	node->convertToPhantom();
		136	eliminated = true;
		137	break;
		138	}
		139	}
		140	}
		141
		142	if (PhiChildren* phiChildren = m_interpreter.phiChildren()) {
		143	bool allGood = true;
		144	phiChildren->forAllTransitiveIncomingValues(
		145	node,
		146	[&] (Node* incoming) {
		147	if (Structure* structure = incoming->dynamicCastConstant<Structure*>()) {
		148	if (set.contains(structure))
		149	return;
		150	}
		151	allGood = false;
		152	});
		153	if (allGood) {
		154	m_interpreter.execute(indexInBlock);
		155	node->convertToPhantom();
		156	eliminated = true;
		157	break;
		158	}
		159	}
		160	break;
		161	}
		162
127	case CheckArray:	163	case CheckArray:
128	case Arrayify: {	164	case Arrayify: {
129	if (!node->arrayMode().alreadyChecked(m_graph, node, m_state.forNode(node->child1())))	165	if (!node->arrayMode().alreadyChecked(m_graph, node, m_state.forNode(node->child1())))

Lines 52-59 public: Source/JavaScriptCore/dfg/DFGFlushedAt.h_sec1
- Source/JavaScriptCore/dfg/DFGFlushedAt.h -2 lines
52	{	52	{
53	if (format == DeadFlush)	53	if (format == DeadFlush)
54	ASSERT(!virtualRegister.isValid());	54	ASSERT(!virtualRegister.isValid());
55	else
56	ASSERT(virtualRegister.isValid());
57	}	55	}
58		56
59	bool operator!() const { return m_format == DeadFlush; }	57	bool operator!() const { return m_format == DeadFlush; }

Lines 39-44 Source/JavaScriptCore/dfg/DFGGraph.h_sec1
- Source/JavaScriptCore/dfg/DFGGraph.h -41 / +140 lines
39	#include "DFGNode.h"	39	#include "DFGNode.h"
40	#include "DFGNodeAllocator.h"	40	#include "DFGNodeAllocator.h"
41	#include "DFGPlan.h"	41	#include "DFGPlan.h"
		42	#include "DFGPrePostNumbering.h"
42	#include "DFGScannable.h"	43	#include "DFGScannable.h"
43	#include "JSStack.h"	44	#include "JSStack.h"
44	#include "MethodOfGettingAValueProfile.h"	45	#include "MethodOfGettingAValueProfile.h"
Lines 55-60 class ExecState; Source/JavaScriptCore/dfg/DFGGraph.h_sec2
55		56
56	namespace DFG {	57	namespace DFG {
57		58
		59	#define DFG_NODE_DO_TO_CHILDREN(graph, node, thingToDo) do { \
		60	Node* _node = (node); \
		61	if (_node->flags() & NodeHasVarArgs) { \
		62	for (unsigned _childIdx = _node->firstChild(); \
		63	_childIdx < _node->firstChild() + _node->numChildren(); \
		64	_childIdx++) { \
		65	if (!!(graph).m_varArgChildren[_childIdx]) \
		66	thingToDo(_node, (graph).m_varArgChildren[_childIdx]); \
		67	} \
		68	} else { \
		69	if (!_node->child1()) { \
		70	ASSERT( \
		71	!_node->child2() \
		72	&& !_node->child3()); \
		73	break; \
		74	} \
		75	thingToDo(_node, _node->child1()); \
		76	\
		77	if (!_node->child2()) { \
		78	ASSERT(!_node->child3()); \
		79	break; \
		80	} \
		81	thingToDo(_node, _node->child2()); \
		82	\
		83	if (!_node->child3()) \
		84	break; \
		85	thingToDo(_node, _node->child3()); \
		86	} \
		87	} while (false)
		88
		89	#define DFG_ASSERT(graph, node, assertion) do { \
		90	if (!!(assertion)) \
		91	break; \
		92	(graph).handleAssertionFailure( \
		93	(node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, #assertion); \
		94	} while (false)
		95
		96	#define DFG_CRASH(graph, node, reason) \
		97	(graph).handleAssertionFailure( \
		98	(node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, (reason));
		99
58	struct InlineVariableData {	100	struct InlineVariableData {
59	InlineCallFrame* inlineCallFrame;	101	InlineCallFrame* inlineCallFrame;
60	unsigned argumentPositionStart;	102	unsigned argumentPositionStart;
Lines 565-570 public: Source/JavaScriptCore/dfg/DFGGraph.h_sec3
565	void determineReachability();	607	void determineReachability();
566	void resetReachability();	608	void resetReachability();
567		609
		610	void mergeRelevantToOSR();
		611
568	void computeRefCounts();	612	void computeRefCounts();
569		613
570	unsigned varArgNumChildren(Node* node)	614	unsigned varArgNumChildren(Node* node)
Lines 676-681 public: Source/JavaScriptCore/dfg/DFGGraph.h_sec4
676	BlockList blocksInPreOrder();	720	BlockList blocksInPreOrder();
677	BlockList blocksInPostOrder();	721	BlockList blocksInPostOrder();
678		722
		723	class NaturalBlockIterable {
		724	public:
		725	NaturalBlockIterable()
		726	: m_graph(nullptr)
		727	{
		728	}
		729
		730	NaturalBlockIterable(Graph& graph)
		731	: m_graph(&graph)
		732	{
		733	}
		734
		735	class iterator {
		736	public:
		737	iterator()
		738	: m_graph(nullptr)
		739	, m_index(0)
		740	{
		741	}
		742
		743	iterator(Graph& graph, BlockIndex index)
		744	: m_graph(&graph)
		745	, m_index(findNext(index))
		746	{
		747	}
		748
		749	BasicBlock operator()
		750	{
		751	return m_graph->block(m_index);
		752	}
		753
		754	iterator& operator++()
		755	{
		756	m_index = findNext(m_index + 1);
		757	return *this;
		758	}
		759
		760	bool operator==(const iterator& other) const
		761	{
		762	return m_index == other.m_index;
		763	}
		764
		765	bool operator!=(const iterator& other) const
		766	{
		767	return !(*this == other);
		768	}
		769
		770	private:
		771	BlockIndex findNext(BlockIndex index)
		772	{
		773	while (index < m_graph->numBlocks() && !m_graph->block(index))
		774	index++;
		775	return index;
		776	}
		777
		778	Graph* m_graph;
		779	BlockIndex m_index;
		780	};
		781
		782	iterator begin()
		783	{
		784	return iterator(*m_graph, 0);
		785	}
		786
787	iterator end()
788	{
789	return iterator(*m_graph, m_graph->numBlocks());
790	}
791
792	private:
793	Graph* m_graph;
794	};
795
796	NaturalBlockIterable blocksInNaturalOrder()
797	{
798	return NaturalBlockIterable(*this);
799	}
800
801	template<typename ChildFunctor>
802	void doToChildrenWithNode(Node* node, const ChildFunctor& functor)
803	{
804	DFG_NODE_DO_TO_CHILDREN(*this, node, functor);
805	}
806
807	template<typename ChildFunctor>
808	void doToChildren(Node* node, const ChildFunctor& functor)
809	{
810	doToChildrenWithNode(
811	node,
812	[&functor] (Node*, Edge& edge) {
813	functor(edge);
814	});
815	}
816
679	Profiler::Compilation* compilation() { return m_plan.compilation.get(); }	817	Profiler::Compilation* compilation() { return m_plan.compilation.get(); }
680		818
681	DesiredIdentifiers& identifiers() { return m_plan.identifiers; }	819	DesiredIdentifiers& identifiers() { return m_plan.identifiers; }
Lines 736-747 public: Source/JavaScriptCore/dfg/DFGGraph.h_sec5
736	Bag<SwitchData> m_switchData;	874	Bag<SwitchData> m_switchData;
737	Bag<MultiGetByOffsetData> m_multiGetByOffsetData;	875	Bag<MultiGetByOffsetData> m_multiGetByOffsetData;
738	Bag<MultiPutByOffsetData> m_multiPutByOffsetData;	876	Bag<MultiPutByOffsetData> m_multiPutByOffsetData;
		877	Bag<ObjectMaterializationData> m_objectMaterializationData;
739	Vector<InlineVariableData, 4> m_inlineVariableData;	878	Vector<InlineVariableData, 4> m_inlineVariableData;
740	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;	879	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
741	bool m_hasArguments;	880	bool m_hasArguments;
742	HashSet<ExecutableBase*> m_executablesWhoseArgumentsEscaped;	881	HashSet<ExecutableBase*> m_executablesWhoseArgumentsEscaped;
743	BitVector m_lazyVars;	882	BitVector m_lazyVars;
744	Dominators m_dominators;	883	Dominators m_dominators;
		884	PrePostNumbering m_prePostNumbering;
745	NaturalLoops m_naturalLoops;	885	NaturalLoops m_naturalLoops;
746	unsigned m_localVars;	886	unsigned m_localVars;
747	unsigned m_nextMachineLocal;	887	unsigned m_nextMachineLocal;
Lines 786-832 private: Source/JavaScriptCore/dfg/DFGGraph.h_sec6
786	}	926	}
787	};	927	};
788		928
789	#define DFG_NODE_DO_TO_CHILDREN(graph, node, thingToDo) do { \
790	Node* _node = (node); \
791	if (_node->flags() & NodeHasVarArgs) { \
792	for (unsigned _childIdx = _node->firstChild(); \
793	_childIdx < _node->firstChild() + _node->numChildren(); \
794	_childIdx++) { \
795	if (!!(graph).m_varArgChildren[_childIdx]) \
796	thingToDo(_node, (graph).m_varArgChildren[_childIdx]); \
797	} \
798	} else { \
799	if (!_node->child1()) { \
800	ASSERT( \
801	!_node->child2() \
802	&& !_node->child3()); \
803	break; \
804	} \
805	thingToDo(_node, _node->child1()); \
806	\
807	if (!_node->child2()) { \
808	ASSERT(!_node->child3()); \
809	break; \
810	} \
811	thingToDo(_node, _node->child2()); \
812	\
813	if (!_node->child3()) \
814	break; \
815	thingToDo(_node, _node->child3()); \
816	} \
817	} while (false)
818
819	#define DFG_ASSERT(graph, node, assertion) do { \
820	if (!!(assertion)) \
821	break; \
822	(graph).handleAssertionFailure( \
823	(node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, #assertion); \
824	} while (false)
825
826	#define DFG_CRASH(graph, node, reason) \
827	(graph).handleAssertionFailure( \
828	(node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, (reason));
829
830	} } // namespace JSC::DFG	929	} } // namespace JSC::DFG
831		930
832	#endif	931	#endif

Line 0 Source/JavaScriptCore/dfg/DFGInsertOSRHintsForUpdate.cpp_sec1
- Source/JavaScriptCore/dfg/DFGInsertOSRHintsForUpdate.cpp +58 lines
	1	/*
	2	* Copyright (C) 2014 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "DFGInsertOSRHintsForUpdate.h"
	28
	29	#if ENABLE(DFG_JIT)
	30
	31	namespace JSC { namespace DFG {
	32
	33	void insertOSRHintsForUpdate(
	34	InsertionSet& insertionSet, unsigned nodeIndex, NodeOrigin origin,
	35	AvailabilityMap& availability, Node* originalNode, Node* newNode)
	36	{
	37	for (unsigned i = availability.m_locals.size(); i--;) {
	38	int operand = availability.m_locals.operandForIndex(i);
	39
	40	if (availability.m_locals[i].hasNode() && availability.m_locals[i].node() == originalNode) {
	41	insertionSet.insertNode(
	42	nodeIndex, SpecNone, MovHint, origin, OpInfo(operand),
	43	newNode->defaultEdge());
	44	}
	45	}
	46
	47	for (auto pair : availability.m_heap) {
	48	if (pair.value.hasNode() && pair.value.node() == originalNode) {
	49	insertionSet.insert(
	50	nodeIndex, pair.key.createHint(insertionSet.graph(), origin, newNode));
	51	}
	52	}
	53	}
	54
	55	} } // namespace JSC::DFG
	56
	57	#endif // ENABLE(DFG_JIT)
	58

Lines 38-43 Source/JavaScriptCore/dfg/DFGNode.h_sec1
- Source/JavaScriptCore/dfg/DFGNode.h -2 / +68 lines
38	#include "DFGNodeFlags.h"	38	#include "DFGNodeFlags.h"
39	#include "DFGNodeOrigin.h"	39	#include "DFGNodeOrigin.h"
40	#include "DFGNodeType.h"	40	#include "DFGNodeType.h"
		41	#include "DFGObjectMaterializationData.h"
41	#include "DFGTransition.h"	42	#include "DFGTransition.h"
42	#include "DFGUseKind.h"	43	#include "DFGUseKind.h"
43	#include "DFGVariableAccessData.h"	44	#include "DFGVariableAccessData.h"
Lines 500-505 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec2
500	m_flags &= ~NodeClobbersWorld;	501	m_flags &= ~NodeClobbersWorld;
501	}	502	}
502		503
		504	void convertToPutByOffsetHint()
		505	{
		506	ASSERT(m_op == PutByOffset);
		507	m_opInfo = storageAccessData().identifierNumber;
		508	m_op = PutByOffsetHint;
		509	child1() = child2();
		510	child2() = child3();
		511	child3() = Edge();
		512	}
		513
		514	void convertToPutStructureHint(Node* structure)
		515	{
		516	ASSERT(m_op == PutStructure);
		517	ASSERT(structure->castConstant<Structure*>() == transition()->next);
		518	m_op = PutStructureHint;
		519	m_opInfo = 0;
		520	child2() = Edge(structure, KnownCellUse);
		521	}
		522
		523	void convertToPhantomNewObject()
		524	{
		525	ASSERT(m_op == NewObject \|\| m_op == MaterializeNewObject);
		526	m_op = PhantomNewObject;
		527	m_flags &= ~NodeHasVarArgs;
		528	m_opInfo = 0;
		529	m_opInfo2 = 0;
		530	children = AdjacencyList();
		531	}
		532
503	void convertToPhantomLocal()	533	void convertToPhantomLocal()
504	{	534	{
505	ASSERT(m_op == Phantom && (child1()->op() == Phi \|\| child1()->op() == SetLocal \|\| child1()->op() == SetArgument));	535	ASSERT(m_op == Phantom && (child1()->op() == Phi \|\| child1()->op() == SetLocal \|\| child1()->op() == SetArgument));
Lines 580-586 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec3
580		610
581	bool isCellConstant()	611	bool isCellConstant()
582	{	612	{
583	return isConstant() && constant()->value().isCell();	613	return isConstant() && constant()->value() && constant()->value().isCell();
584	}	614	}
585		615
586	JSCell* asCell()	616	JSCell* asCell()
Lines 595-600 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec4
595	return nullptr;	625	return nullptr;
596	return jsDynamicCast<T>(asCell());	626	return jsDynamicCast<T>(asCell());
597	}	627	}
		628
		629	template<typename T>
		630	T castConstant()
		631	{
		632	T result = dynamicCastConstant<T>();
		633	RELEASE_ASSERT(result);
		634	return result;
		635	}
598		636
599	bool containsMovHint()	637	bool containsMovHint()
600	{	638	{
Lines 704-709 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec5
704	case PutById:	742	case PutById:
705	case PutByIdFlush:	743	case PutByIdFlush:
706	case PutByIdDirect:	744	case PutByIdDirect:
		745	case PutByOffsetHint:
707	return true;	746	return true;
708	default:	747	default:
709	return false;	748	return false;
Lines 1155-1161 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec6
1155		1194
1156	bool hasStorageAccessData()	1195	bool hasStorageAccessData()
1157	{	1196	{
1158	return op() == GetByOffset \|\| op() == GetGetterSetterByOffset \|\| op() == PutByOffset;	1197	switch (op()) {
		1198	case GetByOffset:
		1199	case PutByOffset:
		1200	case GetGetterSetterByOffset:
		1201	return true;
		1202	default:
		1203	return false;
		1204	}
1159	}	1205	}
1160		1206
1161	StorageAccessData& storageAccessData()	1207	StorageAccessData& storageAccessData()
Lines 1184-1189 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec7
1184	return reinterpret_cast<MultiPutByOffsetData>(m_opInfo);	1230	return reinterpret_cast<MultiPutByOffsetData>(m_opInfo);
1185	}	1231	}
1186		1232
		1233	bool hasObjectMaterializationData()
		1234	{
		1235	return op() == MaterializeNewObject;
		1236	}
		1237
		1238	ObjectMaterializationData& objectMaterializationData()
		1239	{
		1240	return reinterpret_cast<ObjectMaterializationData>(m_opInfo);
		1241	}
		1242
		1243	bool isPhantomObjectAllocation()
		1244	{
		1245	switch (op()) {
		1246	case PhantomNewObject:
		1247	return true;
		1248	default:
		1249	return false;
		1250	}
		1251	}
		1252
1187	bool hasFunctionDeclIndex()	1253	bool hasFunctionDeclIndex()
1188	{	1254	{
1189	return op() == NewFunction	1255	return op() == NewFunction

Line 0 Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.h_sec1
- Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.h +47 lines
	1	/*
	2	* Copyright (C) 2014 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#ifndef DFGObjectAllocationSinkingPhase_h
	27	#define DFGObjectAllocationSinkingPhase_h
	28
	29	#if ENABLE(DFG_JIT)
	30
	31	namespace JSC { namespace DFG {
	32
	33	class Graph;
	34
	35	// Sinks object allocations down to their uses. This will sink the allocations over OSR exits, by
	36	// replacing all stores to those objects with store hints so that OSR exit can materialize the
	37	// object. This may sink allocations past returns, creating control flow paths along which the
	38	// objects are not allocated at all. Replaces all uses of the objects' fields with SSA data flow.
	39
	40	bool performObjectAllocationSinking(Graph&);
	41
	42	} } // namespace JSC::DFG
	43
	44	#endif // ENABLE(DFG_JIT)
	45
	46	#endif // DFGObjectAllocationSinkingPhase_h
	47

Line 0 Source/JavaScriptCore/dfg/DFGObjectMaterializationData.cpp_sec1
- Source/JavaScriptCore/dfg/DFGObjectMaterializationData.cpp +63 lines
	1	/*
	2	* Copyright (C) 2014 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "DFGObjectMaterializationData.h"
	28
	29	#if ENABLE(DFG_JIT)
	30
	31	#include <wtf/ListDump.h>
	32
	33	namespace JSC { namespace DFG {
	34
	35	void PhantomPropertyValue::dump(PrintStream& out) const
	36	{
	37	out.print("id", m_identifierNumber);
	38	}
	39
	40	void ObjectMaterializationData::dump(PrintStream& out) const
	41	{
	42	out.print("[", listDump(m_properties), "]");
	43	}
	44
	45	float ObjectMaterializationData::oneWaySimilarityScore(
	46	const ObjectMaterializationData& other) const
	47	{
	48	unsigned numHits = 0;
	49	for (PhantomPropertyValue value : m_properties) {
	50	if (other.m_properties.contains(value))
	51	numHits++;
	52	}
	53	return static_cast<float>(numHits) / static_cast<float>(m_properties.size());
	54	}
	55
	56	float ObjectMaterializationData::similarityScore(const ObjectMaterializationData& other) const
	57	{
	58	return std::min(oneWaySimilarityScore(other), other.oneWaySimilarityScore(*this));
	59	}
	60
	61	} } // namespace JSC::DFG
	62
	63	#endif // ENABLE(DFG_JIT)

Lines 52-69 public: Source/JavaScriptCore/dfg/DFGPhantomCanonicalizationPhase.cpp_sec1
- Source/JavaScriptCore/dfg/DFGPhantomCanonicalizationPhase.cpp -12 / +1 lines
52	ASSERT(m_graph.m_form == SSA);	52	ASSERT(m_graph.m_form == SSA);
53		53
54	m_graph.clearFlagsOnAllNodes(NodeNeedsPhantom \| NodeNeedsHardPhantom \| NodeRelevantToOSR);	54	m_graph.clearFlagsOnAllNodes(NodeNeedsPhantom \| NodeNeedsHardPhantom \| NodeRelevantToOSR);
55		55	m_graph.mergeRelevantToOSR();
56	for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
57	BasicBlock* block = m_graph.block(blockIndex);
58	if (!block)
59	continue;
60
61	for (unsigned i = block->size(); i--;) {
62	Node* node = block->at(i);
63	if (node->op() == MovHint)
64	node->child1()->mergeFlags(NodeRelevantToOSR);
65	}
66	}
67		56
68	for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {	57	for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
69	BasicBlock* block = m_graph.block(blockIndex);	58	BasicBlock* block = m_graph.block(blockIndex);

Lines 74-90 public: Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.cpp_sec1
- Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.cpp -11 / +1 lines
74	}	74	}
75	}	75	}
76		76
77	for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {	77	m_graph.mergeRelevantToOSR();
78	BasicBlock* block = m_graph.block(blockIndex);
79	if (!block)
80	continue;
81
82	for (unsigned i = block->size(); i--;) {
83	Node* node = block->at(i);
84	if (node->op() == MovHint)
85	node->child1()->mergeFlags(NodeRelevantToOSR);
86	}
87	}
88		78
89	for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {	79	for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
90	BasicBlock* block = m_graph.block(blockIndex);	80	BasicBlock* block = m_graph.block(blockIndex);

Line 0 Source/JavaScriptCore/dfg/DFGPhiChildren.cpp_sec1
- Source/JavaScriptCore/dfg/DFGPhiChildren.cpp +64 lines
	1	/*
	2	* Copyright (C) 2014 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "DFGPhiChildren.h"
	28
	29	#if ENABLE(DFG_JIT)
	30
	31	#include "DFGGraph.h"
	32
	33	namespace JSC { namespace DFG {
	34
	35	PhiChildren::PhiChildren()
	36	{
	37	}
	38
	39	PhiChildren::PhiChildren(Graph& graph)
	40	{
	41	for (BasicBlock* block : graph.blocksInNaturalOrder()) {
	42	for (Node* node : *block) {
	43	if (node->op() != Upsilon)
	44	continue;
	45
	46	m_children.add(node->phi(), List()).iterator->value.append(node);
	47	}
	48	}
	49	}
	50
	51	PhiChildren::~PhiChildren()
	52	{
	53	}
	54
	55	const PhiChildren::List& PhiChildren::upsilonsOf(Node* node) const
	56	{
	57	ASSERT(node->op() == Phi);
	58	return m_children.find(node)->value;
	59	}
	60
	61	} } // namespace JSC::DFG
	62
	63	#endif // ENABLE(DFG_JIT)
	64

Lines 49-54 Source/JavaScriptCore/dfg/DFGPlan.cpp_sec1
- Source/JavaScriptCore/dfg/DFGPlan.cpp -1 / +4 lines
49	#include "DFGLoopPreHeaderCreationPhase.h"	49	#include "DFGLoopPreHeaderCreationPhase.h"
50	#include "DFGOSRAvailabilityAnalysisPhase.h"	50	#include "DFGOSRAvailabilityAnalysisPhase.h"
51	#include "DFGOSREntrypointCreationPhase.h"	51	#include "DFGOSREntrypointCreationPhase.h"
		52	#include "DFGObjectAllocationSinkingPhase.h"
52	#include "DFGPhantomCanonicalizationPhase.h"	53	#include "DFGPhantomCanonicalizationPhase.h"
53	#include "DFGPhantomRemovalPhase.h"	54	#include "DFGPhantomRemovalPhase.h"
54	#include "DFGPredictionInjectionPhase.h"	55	#include "DFGPredictionInjectionPhase.h"
Lines 277-282 Plan::CompilationPath Plan::compileInThr Source/JavaScriptCore/dfg/DFGPlan.cpp_sec2
277	if (validationEnabled()) {	278	if (validationEnabled()) {
278	dfg.m_dominators.computeIfNecessary(dfg);	279	dfg.m_dominators.computeIfNecessary(dfg);
279	dfg.m_naturalLoops.computeIfNecessary(dfg);	280	dfg.m_naturalLoops.computeIfNecessary(dfg);
		281	dfg.m_prePostNumbering.computeIfNecessary(dfg);
280	}	282	}
281		283
282	switch (mode) {	284	switch (mode) {
Lines 325-335 Plan::CompilationPath Plan::compileInThr Source/JavaScriptCore/dfg/DFGPlan.cpp_sec3
325	performCFA(dfg);	327	performCFA(dfg);
326	performConstantFolding(dfg);	328	performConstantFolding(dfg);
327	performPhantomCanonicalization(dfg); // Reduce the graph size a lot.	329	performPhantomCanonicalization(dfg); // Reduce the graph size a lot.
328	if (performStrengthReduction(dfg)) {	330	if (performStrengthReduction(dfg) \| performObjectAllocationSinking(dfg)) {
329	// State-at-tail and state-at-head will be invalid if we did strength reduction since	331	// State-at-tail and state-at-head will be invalid if we did strength reduction since
330	// it might increase live ranges.	332	// it might increase live ranges.
331	performLivenessAnalysis(dfg);	333	performLivenessAnalysis(dfg);
332	performCFA(dfg);	334	performCFA(dfg);
		335	performConstantFolding(dfg);
333	}	336	}
334	performLICM(dfg);	337	performLICM(dfg);
335	performPhantomCanonicalization(dfg);	338	performPhantomCanonicalization(dfg);

Line 0 Source/JavaScriptCore/dfg/DFGPrePostNumbering.cpp_sec1
- Source/JavaScriptCore/dfg/DFGPrePostNumbering.cpp +89 lines
		1	/*
		2	* Copyright (C) 2014 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "DFGPrePostNumbering.h"
		28
		29	#if ENABLE(DFG_JIT)
		30
		31	#include "DFGBlockMapInlines.h"
		32	#include "DFGBlockWorklist.h"
		33	#include "DFGGraph.h"
		34
		35	namespace JSC { namespace DFG {
		36
		37	PrePostNumbering::PrePostNumbering() { }
		38	PrePostNumbering::~PrePostNumbering() { }
		39
		40	void PrePostNumbering::compute(Graph& graph)
		41	{
		42	m_map = BlockMap<Numbering>(graph);
		43
		44	PostOrderBlockWorklist worklist;
		45	worklist.push(graph.block(0));
		46	unsigned nextPreNumber = 0;
		47	unsigned nextPostNumber = 0;
		48	while (BlockWithOrder item = worklist.pop()) {
		49	switch (item.order) {
		50	case PreOrder:
		51	m_map[item.block].m_preNumber = nextPreNumber++;
		52	worklist.pushPost(item.block);
		53	for (BasicBlock* successor : item.block->successors())
		54	worklist.push(successor);
		55	break;
		56	case PostOrder:
		57	m_map[item.block].m_postNumber = nextPostNumber++;
		58	break;
		59	}
		60	}
		61	}
		62
		63	} } // namespace JSC::DFG
		64
65	namespace WTF {
66
67	using namespace JSC::DFG;
68
69	void printInternal(PrintStream& out, EdgeKind kind)
70	{
71	switch (kind) {
72	case ForwardEdge:
73	out.print("ForwardEdge");
74	return;
75	case CrossEdge:
76	out.print("CrossEdge");
77	return;
78	case BackEdge:
79	out.print("BackEdge");
80	return;
81	}
82
83	RELEASE_ASSERT_NOT_REACHED();
84	}
85
86	} // namespace WTF
87
88	#endif // ENABLE(DFG_JIT)
89

Line 0 Source/JavaScriptCore/dfg/DFGPromoteHeapAccess.h_sec1
- Source/JavaScriptCore/dfg/DFGPromoteHeapAccess.h +90 lines
		1	/*
		2	* Copyright (C) 2014 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#ifndef DFGPromoteHeapAccess_h
		27	#define DFGPromoteHeapAccess_h
		28
		29	#if ENABLE(DFG_JIT)
		30
		31	#include "DFGNode.h"
		32	#include "DFGPromotedHeapLocation.h"
		33
		34	namespace JSC { namespace DFG {
		35
		36	// Note that the write functor is really the useful thing here. The read functor is only useful
		37	// for the object allocation sinking phase.
		38	template<typename WriteFunctor, typename ReadFunctor>
		39	void promoteHeapAccess(Node* node, const WriteFunctor& write, const ReadFunctor& read)
		40	{
		41	switch (node->op()) {
		42	case CheckStructure: {
		43	if (node->child1()->isPhantomObjectAllocation())
		44	read(PromotedHeapLocation(StructurePLoc, node->child1()));
		45	break;
		46	}
		47
		48	case GetByOffset:
		49	case GetGetterSetterByOffset: {
		50	if (node->child2()->isPhantomObjectAllocation()) {
		51	unsigned identifierNumber = node->storageAccessData().identifierNumber;
		52	read(PromotedHeapLocation(NamedPropertyPLoc, node->child2(), identifierNumber));
		53	}
		54	break;
		55	}
		56
		57	case MultiGetByOffset: {
		58	if (node->child1()->isPhantomObjectAllocation()) {
		59	unsigned identifierNumber = node->multiGetByOffsetData().identifierNumber;
		60	read(PromotedHeapLocation(NamedPropertyPLoc, node->child1(), identifierNumber));
		61	}
		62	break;
		63	}
		64
65	case PutStructureHint: {
66	ASSERT(node->child1()->isPhantomObjectAllocation());
67	write(PromotedHeapLocation(StructurePLoc, node->child1()), node->child2());
68	break;
69	}
70
71	case PutByOffsetHint: {
72	ASSERT(node->child1()->isPhantomObjectAllocation());
73	unsigned identifierNumber = node->identifierNumber();
74	write(
75	PromotedHeapLocation(NamedPropertyPLoc, node->child1(), identifierNumber),
76	node->child2());
77	break;
78	}
79
80	default:
81	break;
82	}
83	}
84
85	} } // namespace JSC::DFG
86
87	#endif // ENABLE(DFG_JIT)
88
89	#endif // DFGPromoteHeapAccess_h
90

Line 0 Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp_sec1
- Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp +93 lines
		1	/*
		2	* Copyright (C) 2014 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "DFGPromotedHeapLocation.h"
		28
		29	#if ENABLE(DFG_JIT)
		30
		31	#include "DFGGraph.h"
		32
		33	namespace JSC { namespace DFG {
		34
		35	void PromotedLocationDescriptor::dump(PrintStream& out) const
		36	{
		37	out.print(m_kind, "(", m_info, ")");
		38	}
		39
		40	Node* PromotedHeapLocation::createHint(Graph& graph, NodeOrigin origin, Node* value)
		41	{
		42	switch (kind()) {
		43	case StructurePLoc:
		44	return graph.addNode(
		45	SpecNone, PutStructureHint, origin,
		46	Edge(base(), KnownCellUse), Edge(value, KnownCellUse));
		47
		48	case NamedPropertyPLoc:
		49	return graph.addNode(
		50	SpecNone, PutByOffsetHint, origin,
		51	OpInfo(info()), Edge(base(), KnownCellUse), Edge(value, UntypedUse));
		52
		53	case InvalidPromotedLocationKind:
		54	return nullptr;
		55	}
		56
		57	RELEASE_ASSERT_NOT_REACHED();
		58	}
		59
		60	void PromotedHeapLocation::dump(PrintStream& out) const
		61	{
		62	out.print(kind(), "(", m_base, ", ", info(), ")");
		63	}
		64
65	} } // namespace JSC::DFG
66
67	namespace WTF {
68
69	using namespace JSC::DFG;
70
71	void printInternal(PrintStream& out, PromotedLocationKind kind)
72	{
73	switch (kind) {
74	case InvalidPromotedLocationKind:
75	out.print("InvalidPromotedLocationKind");
76	return;
77
78	case StructurePLoc:
79	out.print("StructurePLoc");
80	return;
81
82	case NamedPropertyPLoc:
83	out.print("NamedPropertyPLoc");
84	return;
85	}
86
87	RELEASE_ASSERT_NOT_REACHED();
88	}
89
90	} // namespace WTF;
91
92	#endif // ENABLE(DFG_JIT)
93

Lines 66-71 SSACalculator::~SSACalculator() Source/JavaScriptCore/dfg/DFGSSACalculator.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSSACalculator.cpp +11 lines
66	{	66	{
67	}	67	}
68		68
		69	void SSACalculator::reset()
		70	{
		71	m_variables.clear();
		72	m_defs.clear();
		73	m_phis.clear();
		74	for (BlockIndex blockIndex = m_data.size(); blockIndex--;) {
		75	m_data[blockIndex].m_defs.clear();
		76	m_data[blockIndex].m_phis.clear();
		77	}
		78	}
		79
69	SSACalculator::Variable* SSACalculator::newVariable()	80	SSACalculator::Variable* SSACalculator::newVariable()
70	{	81	{
71	return &m_variables.alloc(Variable(m_variables.size()));	82	return &m_variables.alloc(Variable(m_variables.size()));

Lines 187-194 public: Source/JavaScriptCore/dfg/DFGValidate.cpp_sec1
- Source/JavaScriptCore/dfg/DFGValidate.cpp -2 lines
187	Node* node = block->node(i);	187	Node* node = block->node(i);
188	if (m_graph.m_refCountState == ExactRefCount)	188	if (m_graph.m_refCountState == ExactRefCount)
189	V_EQUAL((node), m_myRefCounts.get(node), node->adjustedRefCount());	189	V_EQUAL((node), m_myRefCounts.get(node), node->adjustedRefCount());
190	else
191	V_EQUAL((node), node->refCount(), 1);
192	}	190	}
193		191
194	for (size_t i = 0 ; i < block->size() - 1; ++i) {	192	for (size_t i = 0 ; i < block->size() - 1; ++i) {

Line 0 Source/JavaScriptCore/ftl/FTLExitPropertyValue.cpp_sec1
- Source/JavaScriptCore/ftl/FTLExitPropertyValue.cpp +41 lines
	1	/*
	2	* Copyright (C) 2014 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "FTLExitPropertyValue.h"
	28
	29	#if ENABLE(FTL_JIT)
	30
	31	namespace JSC { namespace FTL {
	32
	33	void ExitPropertyValue::dump(PrintStream& out) const
	34	{
	35	out.print(m_location, " => ", m_value);
	36	}
	37
	38	} } // namespace JSC::FTL
	39
	40	#endif // ENABLE(FTL_JIT)
	41

Line 0 Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.cpp_sec1
- Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.cpp +69 lines
		1	/*
		2	* Copyright (C) 2014 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "FTLExitTimeObjectMaterialization.h"
		28
		29	#if ENABLE(FTL_JIT)
		30
		31	#include "DFGGraph.h"
		32
		33	namespace JSC { namespace FTL {
		34
		35	using namespace JSC::DFG;
		36
		37	ExitTimeObjectMaterialization::ExitTimeObjectMaterialization(NodeType type)
		38	: m_type(type)
		39	{
		40	}
		41
		42	ExitTimeObjectMaterialization::~ExitTimeObjectMaterialization()
		43	{
		44	}
		45
		46	void ExitTimeObjectMaterialization::add(
		47	PromotedLocationDescriptor location, const ExitValue& value)
		48	{
		49	m_properties.append(ExitPropertyValue(location, value));
		50	}
		51
		52	ExitValue ExitTimeObjectMaterialization::get(PromotedLocationDescriptor location) const
		53	{
		54	for (ExitPropertyValue value : m_properties) {
		55	if (value.location() == location)
		56	return value.value();
		57	}
		58	return ExitValue();
		59	}
		60
		61	void ExitTimeObjectMaterialization::dump(PrintStream& out) const
		62	{
		63	out.print(RawPointer(this), ":", Graph::opName(m_type), "(", listDump(m_properties), ")");
		64	}
65
66	} } // namespace JSC::FTL
67
68	#endif // ENABLE(FTL_JIT)
69

Lines 1-5 Source/JavaScriptCore/ftl/FTLOSRExit.h_sec1
- Source/JavaScriptCore/ftl/FTLOSRExit.h -1 / +3 lines
1	/*	1	/*
2	* Copyright (C) 2013 Apple Inc. All rights reserved.	2	* Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
3	*	3	*
4	* Redistribution and use in source and binary forms, with or without	4	* Redistribution and use in source and binary forms, with or without
5	* modification, are permitted provided that the following conditions	5	* modification, are permitted provided that the following conditions
Lines 33-38 Source/JavaScriptCore/ftl/FTLOSRExit.h_sec2
33	#include "DFGOSRExitBase.h"	33	#include "DFGOSRExitBase.h"
34	#include "FTLAbbreviations.h"	34	#include "FTLAbbreviations.h"
35	#include "FTLExitArgumentList.h"	35	#include "FTLExitArgumentList.h"
		36	#include "FTLExitTimeObjectMaterialization.h"
36	#include "FTLExitValue.h"	37	#include "FTLExitValue.h"
37	#include "FTLFormattedValue.h"	38	#include "FTLFormattedValue.h"
38	#include "MethodOfGettingAValueProfile.h"	39	#include "MethodOfGettingAValueProfile.h"
Lines 160-165 struct OSRExit : public DFG::OSRExitBase Source/JavaScriptCore/ftl/FTLOSRExit.h_sec3
160	unsigned m_patchableCodeOffset;	161	unsigned m_patchableCodeOffset;
161		162
162	Operands<ExitValue> m_values;	163	Operands<ExitValue> m_values;
		164	Bag<ExitTimeObjectMaterialization> m_materializations;
163		165
164	uint32_t m_stackmapID;	166	uint32_t m_stackmapID;
165		167

Lines 33-38 Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp_sec1
- Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp -76 / +169 lines
33	#include "FTLExitArgumentForOperand.h"	33	#include "FTLExitArgumentForOperand.h"
34	#include "FTLJITCode.h"	34	#include "FTLJITCode.h"
35	#include "FTLOSRExit.h"	35	#include "FTLOSRExit.h"
		36	#include "FTLOperations.h"
36	#include "FTLState.h"	37	#include "FTLState.h"
37	#include "FTLSaveRestore.h"	38	#include "FTLSaveRestore.h"
38	#include "LinkBuffer.h"	39	#include "LinkBuffer.h"
Lines 46-51 namespace JSC { namespace FTL { Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp_sec2
46		47
47	using namespace DFG;	48	using namespace DFG;
48		49
		50	static void compileRecovery(
		51	CCallHelpers& jit, const ExitValue& value, StackMaps::Record* record, StackMaps& stackmaps,
		52	char *registerScratch,
		53	const HashMap<ExitTimeObjectMaterialization, EncodedJSValue>& materializationToPointer)
		54	{
		55	switch (value.kind()) {
		56	case ExitValueDead:
		57	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), GPRInfo::regT0);
		58	break;
		59
		60	case ExitValueConstant:
		61	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(value.constant())), GPRInfo::regT0);
		62	break;
		63
		64	case ExitValueArgument:
		65	record->locations[value.exitArgument().argument()].restoreInto(
		66	jit, stackmaps, registerScratch, GPRInfo::regT0);
		67	break;
		68
		69	case ExitValueInJSStack:
		70	case ExitValueInJSStackAsInt32:
		71	case ExitValueInJSStackAsInt52:
		72	case ExitValueInJSStackAsDouble:
		73	jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
		74	break;
		75
		76	case ExitValueArgumentsObjectThatWasNotCreated:
		77	// We can't actually recover this yet, but we can make the stack look sane. This is
		78	// a prerequisite to running the actual arguments recovery.
		79	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(JSValue())), GPRInfo::regT0);
		80	break;
		81
		82	case ExitValueRecovery:
		83	record->locations[value.rightRecoveryArgument()].restoreInto(
		84	jit, stackmaps, registerScratch, GPRInfo::regT1);
		85	record->locations[value.leftRecoveryArgument()].restoreInto(
		86	jit, stackmaps, registerScratch, GPRInfo::regT0);
		87	switch (value.recoveryOpcode()) {
		88	case AddRecovery:
		89	switch (value.recoveryFormat()) {
		90	case ValueFormatInt32:
		91	jit.add32(GPRInfo::regT1, GPRInfo::regT0);
		92	break;
		93	case ValueFormatInt52:
		94	jit.add64(GPRInfo::regT1, GPRInfo::regT0);
		95	break;
		96	default:
		97	RELEASE_ASSERT_NOT_REACHED();
		98	break;
		99	}
		100	break;
		101	case SubRecovery:
		102	switch (value.recoveryFormat()) {
		103	case ValueFormatInt32:
		104	jit.sub32(GPRInfo::regT1, GPRInfo::regT0);
		105	break;
		106	case ValueFormatInt52:
		107	jit.sub64(GPRInfo::regT1, GPRInfo::regT0);
		108	break;
		109	default:
		110	RELEASE_ASSERT_NOT_REACHED();
		111	break;
		112	}
		113	break;
114	default:
115	RELEASE_ASSERT_NOT_REACHED();
116	break;
117	}
118	break;
119
120	case ExitValueMaterializeNewObject:
121	jit.loadPtr(materializationToPointer.get(value.objectMaterialization()), GPRInfo::regT0);
122	break;
123
124	default:
125	RELEASE_ASSERT_NOT_REACHED();
126	break;
127	}
128
129	reboxAccordingToFormat(
130	value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
131	}
132
49	static void compileStub(	133	static void compileStub(
50	unsigned exitID, JITCode* jitCode, OSRExit& exit, VM* vm, CodeBlock* codeBlock)	134	unsigned exitID, JITCode* jitCode, OSRExit& exit, VM* vm, CodeBlock* codeBlock)
51	{	135	{
Lines 64-76 static void compileStub( Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp_sec3
64		148
65	CCallHelpers jit(vm, codeBlock);	149	CCallHelpers jit(vm, codeBlock);
66		150
67	// We need scratch space to save all registers and to build up the JSStack.	151	// We need scratch space to save all registers, to build up the JS stack, to deal with unwind
68	// Use a scratch buffer to transfer all values.	152	// fixup, pointers to all of the objects we materialize, and the elements inside those objects
69	ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(sizeof(EncodedJSValue) * exit.m_values.size() + requiredScratchMemorySizeInBytes() + jitCode->unwindInfo.m_registers.size() * sizeof(uint64_t));	153	// that we materialize.
		154
		155	// Figure out how much space we need for those object allocations.
		156	unsigned numMaterializations = 0;
		157	size_t maxMaterializationNumArguments = 0;
		158	for (ExitTimeObjectMaterialization* materialization : exit.m_materializations) {
		159	numMaterializations++;
		160
		161	maxMaterializationNumArguments = std::max(
		162	maxMaterializationNumArguments,
		163	materialization->properties().size());
		164	}
		165
		166	ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(
		167	sizeof(EncodedJSValue) * (
		168	exit.m_values.size() + numMaterializations + maxMaterializationNumArguments) +
		169	requiredScratchMemorySizeInBytes() +
		170	jitCode->unwindInfo.m_registers.size() * sizeof(uint64_t));
70	EncodedJSValue* scratch = scratchBuffer ? static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) : 0;	171	EncodedJSValue* scratch = scratchBuffer ? static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) : 0;
71	char* registerScratch = bitwise_cast<char*>(scratch + exit.m_values.size());	172	EncodedJSValue* materializationPointers = scratch + exit.m_values.size();
		173	EncodedJSValue* materializationArguments = materializationPointers + numMaterializations;
		174	char* registerScratch = bitwise_cast<char*>(materializationArguments + maxMaterializationNumArguments);
72	uint64_t* unwindScratch = bitwise_cast<uint64_t*>(registerScratch + requiredScratchMemorySizeInBytes());	175	uint64_t* unwindScratch = bitwise_cast<uint64_t*>(registerScratch + requiredScratchMemorySizeInBytes());
73		176
		177	HashMap<ExitTimeObjectMaterialization, EncodedJSValue> materializationToPointer;
		178	unsigned materializationCount = 0;
		179	for (ExitTimeObjectMaterialization* materialization : exit.m_materializations) {
		180	materializationToPointer.add(
		181	materialization, materializationPointers + materializationCount++);
		182	}
		183
74	// Note that we come in here, the stack used to be as LLVM left it except that someone called pushToSave().	184	// Note that we come in here, the stack used to be as LLVM left it except that someone called pushToSave().
75	// We don't care about the value they saved. But, we do appreciate the fact that they did it, because we use	185	// We don't care about the value they saved. But, we do appreciate the fact that they did it, because we use
76	// that slot for saveAllRegisters().	186	// that slot for saveAllRegisters().
Lines 120-205 static void compileStub( Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp_sec4
120	if (!!exit.m_valueProfile)	230	if (!!exit.m_valueProfile)
121	jit.store64(GPRInfo::regT0, exit.m_valueProfile.getSpecFailBucket(0));	231	jit.store64(GPRInfo::regT0, exit.m_valueProfile.getSpecFailBucket(0));
122	}	232	}
123
124	// Save all state from wherever the exit data tells us it was, into the appropriate place in
125	// the scratch buffer. This also does the reboxing.
126		233
127	for (unsigned index = exit.m_values.size(); index--;) {	234	// Materialize all objects. Don't materialize an object until all of the objects it needs
128	ExitValue value = exit.m_values[index];	235	// have been materialized.
		236	HashSet<ExitTimeObjectMaterialization*> toMaterialize;
		237	for (ExitTimeObjectMaterialization* materialization : exit.m_materializations)
		238	toMaterialize.add(materialization);
		239
		240	while (!toMaterialize.isEmpty()) {
		241	int previousToMaterializeSize = toMaterialize.size();
129		242
130	switch (value.kind()) {	243	Vector<ExitTimeObjectMaterialization*> worklist;
131	case ExitValueDead:	244	worklist.appendRange(toMaterialize.begin(), toMaterialize.end());
132	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), GPRInfo::regT0);	245	for (ExitTimeObjectMaterialization* materialization : worklist) {
133	break;	246	// Check if we can do anything about this right now.
134		247	bool allGood = true;
135	case ExitValueConstant:	248	for (ExitPropertyValue value : materialization->properties()) {
136	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(value.constant())), GPRInfo::regT0);	249	if (!value.value().isObjectMaterialization())
137	break;	250	continue;
138		251	if (toMaterialize.contains(value.value().objectMaterialization())) {
139	case ExitValueArgument:	252	// Gotta skip this one, since one of its fields points to a materialization
140	record->locations[value.exitArgument().argument()].restoreInto(	253	// that hasn't been materialized.
141	jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);	254	allGood = false;
142	break;
143
144	case ExitValueInJSStack:
145	case ExitValueInJSStackAsInt32:
146	case ExitValueInJSStackAsInt52:
147	case ExitValueInJSStackAsDouble:
148	jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
149	break;
150
151	case ExitValueArgumentsObjectThatWasNotCreated:
152	// We can't actually recover this yet, but we can make the stack look sane. This is
153	// a prerequisite to running the actual arguments recovery.
154	jit.move(MacroAssembler::TrustedImm64(JSValue::encode(JSValue())), GPRInfo::regT0);
155	break;
156
157	case ExitValueRecovery:
158	record->locations[value.rightRecoveryArgument()].restoreInto(
159	jit, jitCode->stackmaps, registerScratch, GPRInfo::regT1);
160	record->locations[value.leftRecoveryArgument()].restoreInto(
161	jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
162	switch (value.recoveryOpcode()) {
163	case AddRecovery:
164	switch (value.recoveryFormat()) {
165	case ValueFormatInt32:
166	jit.add32(GPRInfo::regT1, GPRInfo::regT0);
167	break;
168	case ValueFormatInt52:
169	jit.add64(GPRInfo::regT1, GPRInfo::regT0);
170	break;
171	default:
172	RELEASE_ASSERT_NOT_REACHED();
173	break;
174	}
175	break;
176	case SubRecovery:
177	switch (value.recoveryFormat()) {
178	case ValueFormatInt32:
179	jit.sub32(GPRInfo::regT1, GPRInfo::regT0);
180	break;
181	case ValueFormatInt52:
182	jit.sub64(GPRInfo::regT1, GPRInfo::regT0);
183	break;
184	default:
185	RELEASE_ASSERT_NOT_REACHED();
186	break;	255	break;
187	}	256	}
188	break;
189	default:
190	RELEASE_ASSERT_NOT_REACHED();
191	break;
192	}	257	}
193	break;	258	if (!allGood)
		259	continue;
194		260
195	default:	261	// All systems go for materializing the object. First we recover the values of all of
196	RELEASE_ASSERT_NOT_REACHED();	262	// its fields and then we call a function to actually allocate the beast.
197	break;	263	for (unsigned propertyIndex = materialization->properties().size(); propertyIndex--;) {
		264	const ExitValue& value = materialization->properties()[propertyIndex].value();
		265	compileRecovery(
		266	jit, value, record, jitCode->stackmaps, registerScratch,
		267	materializationToPointer);
		268	jit.storePtr(GPRInfo::regT0, materializationArguments + propertyIndex);
		269	}
		270
		271	// This call assumes that we don't pass arguments on the stack.
		272	jit.setupArgumentsWithExecState(
		273	CCallHelpers::TrustedImmPtr(materialization),
		274	CCallHelpers::TrustedImmPtr(materializationArguments));
		275	jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(operationMaterializeObjectInOSR)), GPRInfo::nonArgGPR0);
		276	jit.call(GPRInfo::nonArgGPR0);
		277	jit.storePtr(GPRInfo::returnValueGPR, materializationToPointer.get(materialization));
		278
		279	// Let everyone know that we're done.
		280	toMaterialize.remove(materialization);
198	}	281	}
199		282
200	reboxAccordingToFormat(	283	// We expect progress! This ensures that we crash rather than looping infinitely if there
201	value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);	284	// is something broken about this fixpoint. Or, this could happen if we ever violate the
202		285	// "materializations form a DAG" rule.
		286	RELEASE_ASSERT(toMaterialize.size() < previousToMaterializeSize);
		287	}
		288
		289	// Save all state from wherever the exit data tells us it was, into the appropriate place in
		290	// the scratch buffer. This also does the reboxing.
		291
		292	for (unsigned index = exit.m_values.size(); index--;) {
		293	compileRecovery(
		294	jit, exit.m_values[index], record, jitCode->stackmaps, registerScratch,
		295	materializationToPointer);
203	jit.store64(GPRInfo::regT0, scratch + index);	296	jit.store64(GPRInfo::regT0, scratch + index);
204	}	297	}
205		298

Line 0 Source/JavaScriptCore/ftl/FTLOperations.cpp_sec1
- Source/JavaScriptCore/ftl/FTLOperations.cpp +96 lines
		1	/*
		2	* Copyright (C) 2014 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "FTLOperations.h"
		28
		29	#if ENABLE(FTL_JIT)
		30
		31	namespace JSC { namespace FTL {
		32
		33	using namespace JSC::DFG;
		34
		35	extern "C" JSCell* JIT_OPERATION operationNewObjectWithButterfly(ExecState* exec, Structure* structure)
		36	{
		37	VM& vm = exec->vm();
		38	NativeCallFrameTracer tracer(&vm, exec);
		39
		40	Butterfly* butterfly = Butterfly::create(
		41	vm, nullptr, 0, structure->outOfLineCapacity(), false, IndexingHeader(), 0);
		42
		43	return JSFinalObject::create(exec, structure, butterfly);
		44	}
		45
		46	extern "C" JSCell* JIT_OPERATION operationMaterializeObjectInOSR(
		47	ExecState* exec, ExitTimeObjectMaterialization* materialization, EncodedJSValue* values)
		48	{
		49	VM& vm = exec->vm();
		50	CodeBlock* codeBlock = exec->codeBlock();
		51
		52	// We cannot GC. We've got pointers in evil places.
		53	DeferGCForAWhile deferGC(vm.heap);
		54
		55	// In the future, we may have many different kinds of materializations. For now we just
		56	// materialize NewObject.
		57	RELEASE_ASSERT(materialization->type() == PhantomNewObject);
		58
		59	// First figure out what the structure is.
		60	Structure* structure = nullptr;
		61	for (unsigned i = materialization->properties().size(); i--;) {
		62	const ExitPropertyValue& property = materialization->properties()[i];
		63	if (property.location() != PromotedLocationDescriptor(StructurePLoc))
		64	continue;
65
66	structure = jsCast<Structure*>(JSValue::decode(values[i]));
67	}
68	RELEASE_ASSERT(structure);
69
70	// Let's create that object!
71	JSFinalObject* result = JSFinalObject::create(vm, structure);
72
73	// Now figure out what the heck to populate the object with. Use getPropertiesConcurrently()
74	// because that happens to be lower-level and more convenient. It doesn't change the
75	// materialization of the property table. We want to have minimal visible effects on the
76	// system. Also, don't mind that this is O(n^2). It doesn't matter. We only get here from OSR
77	// exit.
78	for (PropertyMapEntry entry : structure->getPropertiesConcurrently()) {
79	for (unsigned i = materialization->properties().size(); i--;) {
80	const ExitPropertyValue& property = materialization->properties()[i];
81	if (property.location().kind() != NamedPropertyPLoc)
82	continue;
83	if (codeBlock->identifier(property.location().info()).impl() != entry.key)
84	continue;
85
86	result->putDirect(vm, entry.offset, JSValue::decode(values[i]));
87	}
88	}
89
90	return result;
91	}
92
93	} } // namespace JSC::FTL
94
95	#endif // ENABLE(FTL_JIT)
96

Lines 724-731 protected: Source/JavaScriptCore/runtime/JSObject.h_sec1
- Source/JavaScriptCore/runtime/JSObject.h -7 / +6 lines
724	{	724	{
725	Base::finishCreation(vm);	725	Base::finishCreation(vm);
726	ASSERT(inherits(info()));	726	ASSERT(inherits(info()));
727	ASSERT(!structure()->outOfLineCapacity());
728	ASSERT(structure()->isEmpty());
729	ASSERT(prototype().isNull() \|\| Heap::heap(this) == Heap::heap(prototype()));	727	ASSERT(prototype().isNull() \|\| Heap::heap(this) == Heap::heap(prototype()));
730	ASSERT(structure()->isObject());	728	ASSERT(structure()->isObject());
731	ASSERT(classInfo());	729	ASSERT(classInfo());
Lines 1052-1058 public: Source/JavaScriptCore/runtime/JSObject.h_sec2
1052	return (maxSize - allocationSize(0)) / sizeof(WriteBarrier<Unknown>);	1050	return (maxSize - allocationSize(0)) / sizeof(WriteBarrier<Unknown>);
1053	}	1051	}
1054		1052
1055	static JSFinalObject* create(ExecState, Structure);	1053	static JSFinalObject* create(ExecState, Structure, Butterfly* = nullptr);
1056	static JSFinalObject* create(VM&, Structure*);	1054	static JSFinalObject* create(VM&, Structure*);
1057	static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, unsigned inlineCapacity)	1055	static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, unsigned inlineCapacity)
1058	{	1056	{
Lines 1076-1090 protected: Source/JavaScriptCore/runtime/JSObject.h_sec3
1076	private:	1074	private:
1077	friend class LLIntOffsetsExtractor;	1075	friend class LLIntOffsetsExtractor;
1078		1076
1079	explicit JSFinalObject(VM& vm, Structure* structure)	1077	explicit JSFinalObject(VM& vm, Structure* structure, Butterfly* butterfly = nullptr)
1080	: JSObject(vm, structure)	1078	: JSObject(vm, structure, butterfly)
1081	{	1079	{
1082	}	1080	}
1083		1081
1084	static const unsigned StructureFlags = JSObject::StructureFlags;	1082	static const unsigned StructureFlags = JSObject::StructureFlags;
1085	};	1083	};
1086		1084
1087	inline JSFinalObject* JSFinalObject::create(ExecState* exec, Structure* structure)	1085	inline JSFinalObject* JSFinalObject::create(
		1086	ExecState* exec, Structure* structure, Butterfly* butterfly)
1088	{	1087	{
1089	JSFinalObject* finalObject = new (	1088	JSFinalObject* finalObject = new (
1090	NotNull,	1089	NotNull,
Lines 1092-1098 inline JSFinalObject* JSFinalObject::cre Source/JavaScriptCore/runtime/JSObject.h_sec4
1092	*exec->heap(),	1091	*exec->heap(),
1093	allocationSize(structure->inlineCapacity())	1092	allocationSize(structure->inlineCapacity())
1094	)	1093	)
1095	) JSFinalObject(exec->vm(), structure);	1094	) JSFinalObject(exec->vm(), structure, butterfly);
1096	finalObject->finishCreation(exec->vm());	1095	finalObject->finishCreation(exec->vm());
1097	return finalObject;	1096	return finalObject;
1098	}	1097	}

Line 0 Source/JavaScriptCore/tests/stress/obviously-elidable-new-object-then-exit.js_sec1
- Source/JavaScriptCore/tests/stress/obviously-elidable-new-object-then-exit.js +23 lines
	1	function sumOfArithSeries(limit) {
	2	return limit * (limit + 1) / 2;
	3	}
	4
	5	var n = 100000000;
	6
	7	var array = [1, "hello"];
	8
	9	function foo() {
	10	var result = 0;
	11	var q;
	12	for (var i = 0; i < n; ++i) {
	13	var o = {f: i};
	14	var p = {f: i + 1};
	15	q = array[(i >= n - 100) \| 0] + 1;
	16	result += o.f + p.f;
	17	}
	18	return q + result;
	19	}
	20
	21	var result = foo();
	22	if (result != "hello" + 1 + (sumOfArithSeries(n - 1) + sumOfArithSeries(n)))
	23	throw "Error: bad result: " + result;