Attachment #260323 for bug #148610

View Details Raw Unified Return to Bug 148610

| Differences between

and this patch



    {
        touch(StringFireDetail(reason));
    }

    // Note that for any watchpoint that is visible from the DFG, it would be incorrect to write code like:
    //
    // if (w.isBeingWatched())
    //     w.fireAll()
    //
    // Concurrently to this, the DFG could do:
    //
    // if (w.isStillValid())
    //     perform optimizations;
    // if (!w.isStillValid())
    //     retry compilation;
    //
    // Note that the DFG algorithm is widespread, and sound, because fireAll() and invalidate() will leave
    // the watchpoint in a !isStillValid() state. Hence, if fireAll() or invalidate() interleaved between
    // the first isStillValid() check and the second one, then it would simply cause the DFG to retry
    // compilation later.
    //
    // But, if you change some piece of state that the DFG might optimize for, but invalidate the
    // watchpoint by doing:
    //
    // if (w.isBeingWatched())
    //     w.fireAll()
    //
    // then the DFG would never know that you invalidated state between the two checks.
    //
    // There are two ways to work around this:
    //
    // - Call fireAll() without a isBeingWatched() check. Then, the DFG will know that the watchpoint has
    //   been invalidated when it does its second check.
    //
    // - Do not expose the watchpoint set to the DFG directly, and have your own way of validating whether
    //   the assumptions that the DFG thread used are still valid when the DFG code is installed.
    bool isBeingWatched() const
    {
        if (isFat())



        }
        
        AbstractValue& value = forNode(node->child1());
        if (value.m_structure.isFinite()
            && (node->child1().useKind() == CellUse || !(value.m_type & ~SpecCell))) {
            GetByIdStatus status = GetByIdStatus::computeFor(
                value.m_structure.set(), m_graph.identifiers()[node->identifierNumber()]);

                    // This thing won't give us a variant that involves prototypes. If it did, we'd
                    // have more work to do here.
                    DFG_ASSERT(m_graph, node, status[i].conditionSet().isEmpty());

                    result.merge(
                        m_graph.inferredValueForProperty(
                            value, status[i].offset(), m_graph.structureClobberState()));
                        result.makeHeapTop();
                        break;
                    }
                    
                    AbstractValue thisResult;
                    thisResult.set(
                        m_graph, *m_graph.freeze(constantResult),
                        m_state.structureClobberState());
                    result.merge(thisResult);
                }
                m_state.setFoundConstants(true);
                    m_state.setFoundConstants(true);
                forNode(node) = result;
                break;
            }

        
    case GetByOffset: {
        StorageAccessData& data = node->storageAccessData();

        // FIXME: The part of this that handles inferred property types relies on AI knowing the structure
        // right now. That's probably not optimal. In some cases, we may perform an optimization (usually
        // by something other than AI, maybe by CSE for example) that obscures AI's view of the structure
        // at the point where GetByOffset runs. Currently, when that happens, we'll forget what the proven
        // type should have been, even though we would have known it at parse time. It might be worthwhile
        // to put an inferred type into the StorageAccessData. Note that this might become particularly
        // unfortunate due to https://bugs.webkit.org/show_bug.cgi?id=148649.
        AbstractValue value = m_graph.inferredValueForProperty(
            forNode(node->child2()), data.offset, m_state.structureClobberState());

        forNode(node) = value;
        if (value.m_value)
            m_state.setFoundConstants(true);
        break;
    }
        

            if (set.isEmpty())
                continue;
            baseSet.merge(set);

            switch (getCase.method().kind()) {
            case GetByOffsetMethod::Constant: {
                AbstractValue thisResult;
                thisResult.set(
                    m_graph,
                    *getCase.method().constant(),
                    m_state.structureClobberState());
                result.merge(thisResult);
                break;
            }

            case GetByOffetMethod::Load: {
                result.merge(
                    m_graph.inferredValueForProperty(
                        set, getCase.method().offset(), m_graph.structureClobberState()));
                break;
            }

            default: {
                result.makeHeapTop();
                break;
            } }
        }
        
        if (forNode(node->child1()).changeStructure(m_graph, baseSet) == Contradiction)



    checkConsistency();
}

void AbstractValue::set(Graph& graph, const InferredType::Descriptor& descriptor)
{
    switch (descriptor.kind()) {
    case InferredType::Bottom:
        clear();
        return;
    case InferredType::Boolean:
        setType(SpecBoolean);
        return;
    case InferredType::Other:
        setType(SpecOther);
        return;
    case InferredType::Int32:
        setType(SpecInt32);
        return;
    case InferredType::Double:
        setType(SpecBytecodeDouble);
        return;
    case InferredType::Number:
        setType(SpecBytecodeNumber);
        return;
    case InferredType::String:
        set(graph, graph.m_vm.stringStructure.get());
        return;
    case InferredType::ObjectWithStructure:
        set(graph, descriptor.structure());
        return;
    case InferredType::ObjectWithStructureOrOther:
        set(graph, descriptor.structure());
        merge(SpecOther);
        return;
    case InferredType::Object:
        setType(graph, SpecObject);
        return;
    case InferredType::ObjectOrOther:
        setType(graph, SpecObject | SpecOther);
        return;
    case InferredType::Top:
        makeHeapTop();
        return;
    }

    RELEASE_ASSERT_NOT_REACHED();
}

void AbstractValue::set(
    Graph& graph, const InferredType::Descriptor& descriptor, StructureClobberState clobberState)
{
    set(graph, descriptor);
    if (clobberState == StructuresAreClobbered)
        clobberStructures();
}

void AbstractValue::fixTypeForRepresentation(Graph& graph, NodeFlags representation, Node* node)
{
    if (representation == NodeResultDouble) {

Lines 34-39 Source/JavaScriptCore/dfg/DFGAbstractValue.h_sec1
- Source/JavaScriptCore/dfg/DFGAbstractValue.h -1 / +5 lines
34	#include "DFGNodeFlags.h"	34	#include "DFGNodeFlags.h"
35	#include "DFGStructureAbstractValue.h"	35	#include "DFGStructureAbstractValue.h"
36	#include "DFGStructureClobberState.h"	36	#include "DFGStructureClobberState.h"
		37	#include "InferredType.h"
37	#include "JSCell.h"	38	#include "JSCell.h"
38	#include "SpeculatedType.h"	39	#include "SpeculatedType.h"
39	#include "DumpContext.h"	40	#include "DumpContext.h"
Lines 214-220 struct AbstractValue { Source/JavaScriptCore/dfg/DFGAbstractValue.h_sec2
214	m_value = JSValue();	215	m_value = JSValue();
215	checkConsistency();	216	checkConsistency();
216	}	217	}
217		218
		219	void set(Graph&, const InferredType::Descriptor&);
		220	void set(Graph&, const InferredType::Descriptor&, StructureClobberState);
		221
218	void fixTypeForRepresentation(Graph&, NodeFlags representation, Node* = nullptr);	222	void fixTypeForRepresentation(Graph&, NodeFlags representation, Node* = nullptr);
219	void fixTypeForRepresentation(Graph&, Node*);	223	void fixTypeForRepresentation(Graph&, Node*);
220		224



/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGDesiredInferredType_h
#define DFGDesiredInferredType_h

#if ENABLE(DFG_JIT)

#include "InferredType.h"
#include <wtf/HashMap.h>

namespace JSC { namespace DFG {

// This documents the DFG's expectation for an InferredType: specifically, that we want it to have a live
// InferredType object and that this object has the type that we originally saw.

class DesiredInferredType {
public:
    DesiredInferredType()
        : m_object(nullptr)
    {
    }
    
    DesiredInferredType(InferredType* object, const InferredType::Descriptor& expected)
        : m_object(object)
        , m_expected(expected)
    {
    }

    DesiredInferredType(WTF::HashTableDeletedValueType)
        : m_object(nullptr)
        , m_expected(Top)
    {
    }

    explicit operator bool() const { return m_object && m_expected; }

    InferredType* object() const { return m_object; }
    InferredType::Descriptor expected() const { return m_expected; }

    bool isStillValid() const
    {
        return m_object->canWatch(m_expected);
    }

    void add(Watchpoint* watchpoint) const
    {
        m_object->addWatchpoint(watchpoint);
    }

    bool operator==(const DesiredInferredType& other) const
    {
        return m_object == other.m_object
            && m_expected == other.m_expected;
    }

    bool operator!=(const DesiredInferredType& other) const
    {
        return !(*this == other);
    }

    bool isHashTableDeletedValue() const
    {
        return !m_object && m_expected == Top;
    }

    unsigned hash() const
    {
        return WTF::PtrHash<InferredType*>::hash(m_object) + m_expected.hash() * 7;
    }

    void dumpInContext(PrintStream& out, DumpContext* context) const
    {
        out.print(inContext(m_expected, context), " for ", RawPointer(m_object));
    }

    void dump(PrintStream& out) const
    {
        dumpInContext(out, context);
    }

private:
    InferredType* m_object;
    InferredType::Descriptor m_expected;
};

struct DesiredInferredTypeHash {
    static unsigned hash(const DesiredInferredType& key) { return key.hash(); }
    static bool equal(const DesiredInferredType& a, const DesiredInferredType& b) { return a == b; }
    static const bool safeToCompareToEmptyOrDeleted = true;
};

} } // namespace JSC::DFG

namespace WTF {

template<typename T> struct DefaultHash;
template<> struct DefaultHash<JSC::DFG::DesiredInferredType> {
    typedef JSC::DFG::DesiredInferredTypeHash Hash;
};

template<typename T> struct HashTraits;
template<> struct HashTraits<JSC::DFG::DesiredInferredType> : SimpleClassHashTraits<JSC::DFG::DesiredInferredType> { };

} // namespace WTF

#endif // ENABLE(DFG_JIT)

#endif // DFGDesiredInferredType_h


Lines 65-70 void AdaptiveStructureWatchpointAdaptor: Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp_sec1
- Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp -1 / +14 lines
65	}	65	}
66	}	66	}
67		67
		68	void InferredTypeAdaptor::add(CodeBlock* codeBlock, const DesiredInferredType& key, CommonData& common)
		69	{
		70	key.add(common.watchpoints.add(codeBlock));
		71	}
		72
68	DesiredWatchpoints::DesiredWatchpoints() { }	73	DesiredWatchpoints::DesiredWatchpoints() { }
69	DesiredWatchpoints::~DesiredWatchpoints() { }	74	DesiredWatchpoints::~DesiredWatchpoints() { }
70		75
Lines 93-98 void DesiredWatchpoints::addLazily(const Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp_sec2
93	m_adaptiveStructureSets.addLazily(key);	98	m_adaptiveStructureSets.addLazily(key);
94	}	99	}
95		100
		101	void DesiredWatchpoints::addLazily(const DesiredInferredType& key)
		102	{
		103	m_inferredTypes.addLazily(key);
		104	}
		105
96	bool DesiredWatchpoints::consider(Structure* structure)	106	bool DesiredWatchpoints::consider(Structure* structure)
97	{	107	{
98	if (!structure->dfgShouldWatch())	108	if (!structure->dfgShouldWatch())
Lines 108-113 void DesiredWatchpoints::reallyAdd(CodeB Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp_sec3
108	m_inferredValues.reallyAdd(codeBlock, commonData);	118	m_inferredValues.reallyAdd(codeBlock, commonData);
109	m_bufferViews.reallyAdd(codeBlock, commonData);	119	m_bufferViews.reallyAdd(codeBlock, commonData);
110	m_adaptiveStructureSets.reallyAdd(codeBlock, commonData);	120	m_adaptiveStructureSets.reallyAdd(codeBlock, commonData);
		121	m_inferredTypes.reallyAdd(codeBlock, commonData);
111	}	122	}
112		123
113	bool DesiredWatchpoints::areStillValid() const	124	bool DesiredWatchpoints::areStillValid() const
Lines 116-122 bool DesiredWatchpoints::areStillValid() Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp_sec4
116	&& m_inlineSets.areStillValid()	127	&& m_inlineSets.areStillValid()
117	&& m_inferredValues.areStillValid()	128	&& m_inferredValues.areStillValid()
118	&& m_bufferViews.areStillValid()	129	&& m_bufferViews.areStillValid()
119	&& m_adaptiveStructureSets.areStillValid();	130	&& m_adaptiveStructureSets.areStillValid()
		131	&& m_inferredTypes.areStillValid();
120	}	132	}
121		133
122	void DesiredWatchpoints::dumpInContext(PrintStream& out, DumpContext* context) const	134	void DesiredWatchpoints::dumpInContext(PrintStream& out, DumpContext* context) const
Lines 127-132 void DesiredWatchpoints::dumpInContext(P Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp_sec5
127	out.print(" Inferred values: ", inContext(m_inferredValues, context), "\n");	139	out.print(" Inferred values: ", inContext(m_inferredValues, context), "\n");
128	out.print(" Buffer views: ", inContext(m_bufferViews, context), "\n");	140	out.print(" Buffer views: ", inContext(m_bufferViews, context), "\n");
129	out.print(" Object property conditions: ", inContext(m_adaptiveStructureSets, context), "\n");	141	out.print(" Object property conditions: ", inContext(m_adaptiveStructureSets, context), "\n");
		142	out.print(" Inferred types: ", inContext(m_inferredTypes, context), "\n");
130	}	143	}
131		144
132	} } // namespace JSC::DFG	145	} } // namespace JSC::DFG

Lines 30-35 Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h_sec1
- Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h +22 lines
30		30
31	#include "CodeOrigin.h"	31	#include "CodeOrigin.h"
32	#include "DFGCommonData.h"	32	#include "DFGCommonData.h"
		33	#include "DFGDesiredInferredType.h"
33	#include "InferredValue.h"	34	#include "InferredValue.h"
34	#include "JSArrayBufferView.h"	35	#include "JSArrayBufferView.h"
35	#include "ObjectPropertyCondition.h"	36	#include "ObjectPropertyCondition.h"
Lines 91-96 struct AdaptiveStructureWatchpointAdapto Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h_sec2
91	}	92	}
92	};	93	};
93		94
		95	struct InferredTypeAdaptor {
		96	static void add(CodeBlock*, const DesiredInferredType&, CommonData&);
		97	static bool hasBeenInvalidated(const DesiredInferredType& key)
		98	{
		99	return !key.isStillValid();
		100	}
		101	static void dumpInContext(PrintStream& out, const DesiredInferredType& key, DumpContext* context)
		102	{
		103	out.print(inContext(key, context));
		104	}
		105	};
		106
94	template<typename WatchpointSetType, typename Adaptor = SetPointerAdaptor<WatchpointSetType>>	107	template<typename WatchpointSetType, typename Adaptor = SetPointerAdaptor<WatchpointSetType>>
95	class GenericDesiredWatchpoints {	108	class GenericDesiredWatchpoints {
96	#if !ASSERT_DISABLED	109	#if !ASSERT_DISABLED
Lines 159-164 public: Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h_sec3
159	// It's recommended that you don't call this directly. Use Graph::watchCondition(), which does	172	// It's recommended that you don't call this directly. Use Graph::watchCondition(), which does
160	// the required GC magic as well as some other bookkeeping.	173	// the required GC magic as well as some other bookkeeping.
161	void addLazily(const ObjectPropertyCondition&);	174	void addLazily(const ObjectPropertyCondition&);
		175
		176	// It's recommended that you don't call this directly. Use Graph::inferredTypeFor(), which does
		177	// the required GC magic.
		178	void addLazily(const DesiredInferredType&);
162		179
163	bool consider(Structure*);	180	bool consider(Structure*);
164		181
Lines 186-191 public: Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h_sec4
186	{	203	{
187	return m_adaptiveStructureSets.isWatched(key);	204	return m_adaptiveStructureSets.isWatched(key);
188	}	205	}
		206	bool isWatched(const DesiredInferredType& key)
		207	{
		208	return m_inferredTypes.isWatched(key);
		209	}
189		210
190	void dumpInContext(PrintStream&, DumpContext*) const;	211	void dumpInContext(PrintStream&, DumpContext*) const;
191	void dump(PrintStream&) const;	212	void dump(PrintStream&) const;
Lines 196-201 private: Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h_sec5
196	GenericDesiredWatchpoints<InferredValue*, InferredValueAdaptor> m_inferredValues;	217	GenericDesiredWatchpoints<InferredValue*, InferredValueAdaptor> m_inferredValues;
197	GenericDesiredWatchpoints<JSArrayBufferView*, ArrayBufferViewWatchpointAdaptor> m_bufferViews;	218	GenericDesiredWatchpoints<JSArrayBufferView*, ArrayBufferViewWatchpointAdaptor> m_bufferViews;
198	GenericDesiredWatchpoints<ObjectPropertyCondition, AdaptiveStructureWatchpointAdaptor> m_adaptiveStructureSets;	219	GenericDesiredWatchpoints<ObjectPropertyCondition, AdaptiveStructureWatchpointAdaptor> m_adaptiveStructureSets;
		220	GenericDesiredWatchpoints<DesiredInferredType, InferredTypeAdaptor> m_inferredTypes;
199	};	221	};
200		222
201	} } // namespace JSC::DFG	223	} } // namespace JSC::DFG



    return m_safeToLoad.contains(std::make_pair(base, offset));
}

InferredType::Descriptor Graph::inferredTypeFor(const PropertyTypeKey& key)
{
    assertIsRegistered(key.structure());
    
    auto iter = m_inferredTypes.get(key);
    if (iter != m_inferredTypes.end())
        return iter->value;

    InferredType* typeObject = key.structure()->inferredTypeForOffset(key.offset());
    if (!typeObject) {
        m_inferredTypes.add(key, InferredType::Top);
        return InferredType::Top;
    }

    InferredType::Descriptor typeDescriptor = typeObject->descriptor();
    if (!typeDescriptor.isStillValid()) {
        m_inferredTypes.add(key, InferredType::Top);
        return InferredType::Top;
    }
    
    m_inferredTypes.add(key, typeDescriptor);

    m_plan.weakReferences.addLazily(typeObject);
    if (typeDescriptor.structure())
        registerStructure(typeDescriptor.structure());

    // Note that we may already be watching this desired inferred type, because multiple structures may
    // point to the same InferredType instance.
    m_plan.watchpoints.addLazily(DesiredInferredType(typeObject, typeDescriptor));

    return typeDescriptor;
}

bool Graph::watchDesiredType(const DesiredInferredType& key)
{
    if (!key.isStillValid())
        return false;

    m_plan.weakReferences.addLazily(key.object());
    if (Structure* structure = key.expected().structure())
        registerStructure(structure);
    m_plan.watchpoints.addLazily(key);
}

FullBytecodeLiveness& Graph::livenessFor(CodeBlock* codeBlock)
{
    HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>>::iterator iter = m_bytecodeLiveness.find(codeBlock);

JSValue Graph::tryGetConstantProperty(
    JSValue base, const StructureAbstractValue& structure, PropertyOffset offset)
{
    if (structure.isInfinite()) {
        // FIXME: If we just converted the offset to a uid, we could do ObjectPropertyCondition
        // watching to constant-fold the property.
        // https://bugs.webkit.org/show_bug.cgi?id=147271

    return tryGetConstantProperty(base.m_value, base.m_structure, offset);
}

AbstractValue Graph::inferredValueForProperty(
    const StructureSet& base, PropertyOffset offset, StructureClobberState clobberState)
{
    AbstractValue result;
    base.forEach(
        [&] (Structure* structure) {
            AbstractValue value;
            value.set(*this, inferredTypeFor(structure, offset));
            result.merge(value);
        });
    return result;
}

AbstractValue Graph::inferredValueForProperty(
    const AbstractValue& base, PropertyOffset offset, StructureClobberState clobberState)
{
    if (JSValue value = tryGetConstantProperty(base, offset)) {
        AbstractValue result;
        result.set(*this, *freeze(value), clobberState);
        return result;
    }

    if (base.m_structure.isFinite())
        return inferredValueForProperty(base.m_structure.set(), offset, clobberState);

    return AbstractValue::heapTop();
}

JSValue Graph::tryGetConstantClosureVar(JSValue base, ScopeOffset offset)
{
    // This has an awesome concurrency story. See comment for GetGlobalVar in ByteCodeParser.



    // Checks if it's known that loading from the given object at the given offset is fine. This is
    // computed by tracking which conditions we track with watchCondition().
    bool isSafeToLoad(JSObject* base, PropertyOffset);

    // Tells us what inferred type we are able to prove the property to have now and in the future.
    InferredType::Descriptor inferredTypeFor(const PropertyTypeKey&);
    InferredType::Descriptor inferredValueForProperty(Structure* structure, PropertyOffset offset)
    {
        return inferredTypeFor(PropertyTypeKey(structure, offset));
    }

    AbstractValue inferredValueForProperty(
        const StructureSet& base, PropertyOffset, StructureClobberState);

    // This uses either constant property inference or property type inference to derive a good abstract
    // value for some property accessed with the given abstract value base.
    AbstractValue inferredValueForProperty(
        const AbstractValue& base, PropertyOffset, StructureClobberState);
    
    FullBytecodeLiveness& livenessFor(CodeBlock*);
    FullBytecodeLiveness& livenessFor(InlineCallFrame*);

    HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
    HashMap<CodeBlock*, std::unique_ptr<BytecodeKills>> m_bytecodeKills;
    HashSet<std::pair<JSObject*, PropertyOffset>> m_safeToLoad;
    HashMap<PropertyTypeKey, InferredType::Descriptor> m_inferredTypes;
    Dominators m_dominators;
    PrePostNumbering m_prePostNumbering;
    NaturalLoops m_naturalLoops;



/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGPropertyTypeKey_h
#define DFGPropertyTypeKey_h

#if ENABLE(DFG_JIT)

#include <wtf/HashMap.h>

namespace JSC { namespace DFG {

// This object is a key for finding a property's type. It's a tuple of Structure* and PropertyOffset.

class PropertyTypeKey {
public:
    PropertyTypeKey()
        : m_structure(nullptr)
        , m_offset(invalidOffset)
    {
    }

    PropertyTypeKey(Structure* structure, PropertyOffset offset)
        : m_structure(structure)
        , m_offset(offset)
    {
    }

    PropertyTypeKey(WTF::HashTableDeletedValueType)
        : m_object(nullptr)
        , m_offset(invalidOffset - 1)
    {
    }

    explicit operator bool() const { return m_structure && m_offset != invalidOffset; }

    Structure* structure() const { return m_structure; }
    PropertyOffset offset() const { return m_offset; }

    bool operator==(const PropertyTypeKey& other) const
    {
        return m_structure == other.m_structure
            && m_offset == other.m_offset;
    }

    bool operator!=(const PropertyTypeKey& other) const
    {
        return !(*this == other);
    }

    unsigned hash() const
    {
        return WTF::PtrHash<Structure*>::hash(m_structure) + m_offset;
    }

    bool isHashTableDeletedValue() const
    {
        return !m_object && m_offset == invalidOffset - 1;
    }

    void dumpInContext(PrintStream& out, DumpContext* context) const
    {
        out.print(pointerDumpInContext(m_structure, context), "+", m_offset);
    }

    void dump(PrintStream& out) const
    {
        dumpInContext(out, context);
    }

private:
    Structure* m_structure;
    PropertyOffset m_offset;
};

struct PropertyTypeKeyHash {
    static unsigned hash(const PropertyTypeKey& key) { return key.hash(); }
    static bool equal(const PropertyTypeKey& a, const PropertyTypeKey& b) { return a == b; }
    static const bool safeToCompareToEmptyOrDeleted = true;
};

} } // namespace JSC::DFG

namespace WTF {

template<typename T> struct DefaultHash;
template<> struct DefaultHash<JSC::DFG::PropertyTypeKey> {
    typedef JSC::DFG::PropertyTypeKeyHash Hash;
};

template<typename T> struct HashTraits;
template<> struct HashTraits<JSC::DFG::PropertyTypeKey> : SimpleClassHashTraits<JSC::DFG::PropertyTypeKey> {
    static const bool emptyValueIsZero = false;
};

} // namespace WTF

#endif // ENABLE(DFG_JIT)

#endif // DFGPropertyTypeKey_h


Lines 192-198 public: Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h_sec1
- Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h -1 / +8 lines
192	}	192	}
193		193
194	Structure* operator[](size_t i) const { return at(i); }	194	Structure* operator[](size_t i) const { return at(i); }
195		195
196	// In most cases, what you really want to do is verify whether the set is top or clobbered, and	196	// In most cases, what you really want to do is verify whether the set is top or clobbered, and
197	// if not, enumerate the set of structures. Use this only in cases where the singleton case is	197	// if not, enumerate the set of structures. Use this only in cases where the singleton case is
198	// meaningfully special, like for transitions.	198	// meaningfully special, like for transitions.
Lines 202-207 public: Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h_sec2
202	return nullptr;	202	return nullptr;
203	return m_set.onlyStructure();	203	return m_set.onlyStructure();
204	}	204	}
		205
		206	template<typename Functor>
		207	void forEach(const Functor& functor) const
		208	{
		209	ASSERT(!isTop());
		210	m_set.forEach(functor);
		211	}
205		212
206	void dumpInContext(PrintStream&, DumpContext*) const;	213	void dumpInContext(PrintStream&, DumpContext*) const;
207	void dump(PrintStream&) const;	214	void dump(PrintStream&) const;



    return result.iterator->value;
}

AssemblyHelpers::JumpList AssemblyHelpers::branchIfNotType(
    JSValueRegs regs, GPRReg tempGPR, const InferredType::Descriptor& descriptor)
{
    AssemblyHelpers::JumpList result;

    switch (descriptor.kind()) {
    case InferredType::Bottom:
        result.append(jump());
        break;

    case InferredType::Boolean:
        result.append(branchIfNotBoolean(regs, tempGPR));
        break;

    case InferredType::Other:
        result.append(branchIfNotOther(regs, tempGPR));
        break;

    case InferredType::Int32:
        result.append(branchIfNotInt32(regs));
        break;

    case InferredType::Double:
        result.append(branchIfInt32(regs));
        result.append(branchIfNotNumber(regs));
        break;

    case InferredType::Number:
        result.append(branchIfNotNumber(regs));
        break;

    case InferredType::String:
        result.append(branchIfNotCell(regs));
        result.append(branchIfNotString(regs.payloadGPR()));
        break;

    case InferredType::ObjectWithStructure:
        result.append(branchIfNotCell(regs));
        result.append(branchStructure(regs.payloadGPR(), descriptor.structure()));
        break;

    case InferredType::ObjectWithStructureOrOther: {
        Jump ok = branchIfOther(regs, tempGPR);
        result.append(branchIfNotCell(regs));
        result.append(branchStructure(regs.payloadGPR(), descriptor.structure()));
        ok.link(this);
        break;
    }

    case InferredType::Object:
        result.append(branchIfNotCell(regs));
        result.append(branchIfNotObject(regs.payloadGPR()));
        break;

    case InferredType::ObjectOrOther: {
        Jump ok = branchIfOther(regs, tempGPR);
        result.append(branchIfNotCell(regs));
        result.append(branchIfNotObject(regs.payloadGPR()));
        ok.link(this);
        break;
    }

    case InferredType::Top:
        break;
    }

    return result;
}

void AssemblyHelpers::purifyNaN(FPRReg fpr)
{
    MacroAssembler::Jump notNaN = branchDouble(DoubleEqual, fpr, fpr);



        return branch32(Equal, regs.tagGPR(), TrustedImm32(JSValue::EmptyValueTag));
#endif
    }

    JumpList branchIfNotType(JSValueRegs regs, GPRReg tempGPR, const InferredType::Descriptor&);

    template<typename T>
    Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)
    {
#if USE(JSVALUE64)
        return branch32(condition, leftHandSide, TrustedImm32(structure->id()));
#else
        return branchPtr(condition, leftHandSide, TrustedImmPtr(structure));
#endif
    }
    
    static Address addressForByteOffset(ptrdiff_t byteOffset)
    {




        enum FinalObjectMode { MayBeFinal, KnownNotFinal };

        template <typename T> Jump branchStructure(RelationalCondition, T leftHandSide, Structure*);

#if USE(JSVALUE32_64)
        bool getOperandConstantImmediateInt(int op1, int op2, int& op, int32_t& constant);





#endif // USE(JSVALUE32_64)

template <typename T>
JIT::Jump JIT::branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)
{
#if USE(JSVALUE64)
    return branch32(condition, leftHandSide, TrustedImm32(structure->id()));
#else
    return branchPtr(condition, leftHandSide, TrustedImmPtr(structure));
#endif
}

template <typename T>
MacroAssembler::Jump branchStructure(MacroAssembler& jit, MacroAssembler::RelationalCondition condition, T leftHandSide, Structure* structure)
{
#if USE(JSVALUE64)
    return jit.branch32(condition, leftHandSide, MacroAssembler::TrustedImm32(structure->id()));
#else
    return jit.branchPtr(condition, leftHandSide, MacroAssembler::TrustedImmPtr(structure));
#endif
}

} // namespace JSC

#endif // ENABLE(JIT)



/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "InferredType.h"

#include "JSCInlines.h"

namespace JSC {

const ClassInfo InferredType::s_info = { "InferredType", 0, 0, CREATE_METHOD_TABLE(InferredType) };

InferredType* InferredType::create(VM& vm)
{
    InferredType* result = new (NotNull, allocateCell<InferredType>(vm.heap)) InferredType(vm);
    result->finishCreation(vm);
    return result;
}

void InferredType::destroy(JSCell* cell)
{
    InferredType* inferredType = static_cast<InferredType*>(cell);
    inferredType->InferredType::~InferredType();
}

Structure* InferredType::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
{
    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
}

void InferredType::visitChildren(JSCell* cell, SlotVisitor& visitor)
{
    InferredType* inferredType = jsCast<InferredType*>(cell);

    if (inferredType->m_structure)
        visitor.addUnconditionalFinalizer(inferredType->m_structure.get());
}

InferredType::Descriptor InferredType::Descriptor::forValue(JSValue value)
{
    if (value.isBoolean())
        return Boolean;
    if (value.isUndefinedOrNull())
        return Other;
    if (value.isInt32())
        return Int32;
    if (value.isDouble())
        return Double;
    if (value.isCell()) {
        JSCell* cell = value.asCell();
        if (cell->isString())
            return String;
        if (cell->isObject()) {
            if (cell->structure()->transitionWatchpointSetIsStillValid())
                return Descriptor(ObjectWithStructure, cell->structure());
            return Object;
        }
    }
    return Top;
}

void InferredType::Descriptor::merge(const Descriptor& other)
{
    if (*this == other)
        return;
    
    switch (m_kind) {
    case Bottom:
        *this = other;
        return;
    case Boolean:
    case String:
        *this = Top;
        return;
    case Other:
        switch (other.m_kind) {
        case ObjectWithStructure:
            m_kind = ObjectWithStructureOrOther;
            return;
        case Object:
            m_kind = ObjectOrOther;
            return;
        default:
            *this = Top;
            return;
        }
    case Int32:
        switch (other.m_kind) {
        case Double:
        case Number:
            m_kind = Number;
            return;
        default:
            *this = Top;
            return;
        }
    case Double:
        switch (other.m_kind) {
        case Int32:
        case Number:
            m_kind = Number;
            return;
        default:
            *this = Top;
            return;
        }
    case Number:
        switch (other.m_kind) {
        case Int32:
        case Double:
            return;
        default:
            *this = Top;
            return;
        }
    case ObjectWithStructure:
        switch (other.m_kind) {
        case ObjectWithStructure:
        case Object:
            *this = Object;
            return;
        case ObjectWithStructureOrOther:
            if (m_structure == other.m_structure) {
                *this = other;
                return;
            }
            *this = ObjectOrOther;
            return;
        case ObjectOrOther:
            *this = ObjectOrOther;
            return;
        case Other:
            m_kind = ObjectWithStructureOrOther;
            return;
        default:
            *this = Top;
            return;
        }
    case ObjectWithStructureOrOther:
        switch (other.m_kind) {
        case ObjectWithStructure:
            if (m_structure == other.m_structure)
                return;
            *this = ObjectOrOther;
            return;
        case Object:
        case ObjectWithStructureOrOther:
        case ObjectOrOther:
            *this = ObjectOrOther;
            return;
        case Other:
            return;
        default:
            *this = Top;
            return;
        }
    case Object:
        switch (other.m_kind) {
        case ObjectWithStructure:
            return;
        case ObjectWithStructureOrOther:
        case ObjectOrOther:
        case Other:
            m_kind = ObjectOrOther;
            return;
        default:
            *this = Top;
            return;
        }
    case ObjectOrOther:
        switch (other.m_kind) {
        case ObjectWithStructure:
        case ObjectWithStructureOrOther:
        case Object:
        case Other:
            return;
        default:
            *this = Top;
            return;
        }
    case Top:
        return;
    }

    RELEASE_ASSERT_NOT_REACHED();
}

void InferredType::Descriptor::removeStructure()
{
    switch (m_kind) {
    case ObjectWithStructure:
        *this = Object;
        return;
    case ObjectWithStructureOrOther:
        *this = ObjectOrOther;
        return;
    default:
        return;
    }
}

bool InferredType::Descriptor::subsumes(const Descriptor& other) const
{
    Descriptor merged = *this;
    merged.merge(other);
    return *this == merged;
}

void InferredType::Descriptor::dumpInContext(PrintStream& out, DumpContext* context) const
{
    out.print(m_kind);
    if (m_structure)
        out.print(":", inContext(*m_structure, context));
}

void InferredType::Descriptor::dump(PrintStream& out) const
{
    dumpInContext(out, nullptr);
}

InferredType::InferredType(VM& vm)
    : Base(vm, vm.inferredTypeStructure.get())
    , m_watchpointSet(ClearWatchpoint)
{
}

InferredType::~InferredType()
{
}

bool InferredType::isStillValid(const ConcurrentJITLocker& locker, const Descriptor& expected)
{
    if (expected.kind() == Top)
        return false;
    
    return descriptor(locker) == expected;
}

bool InferredType::isStillValid(const Descriptor& expected)
{
    ConcurrentJITLocker locker(m_lock);
    return isStillValid(locker, expected);
}

void InferredType::addWatchpoint(const ConcurrentJITLocker& locker, Watchpoint* watchpoint)
{
    RELEASE_ASSERT(descriptor(locker).kind() != Top);

    m_watchpointSet.add(watchpoint);
}

void InferredType::addWatchpoint(Watchpoint* watchpoint)
{
    ConcurrentJITLocker locker(m_lock);
    addWatchpoint(locker, watchpoint);
}

void InferredType::dump(PrintStream& out) const
{
    out.print(RawPointer(this), ":", descriptor());
}

void InferredType::willStoreValueSlow(const ConcurrentJITLocker& locker, VM& vm, JSValue value)
{
    Descriptor myType = descriptor(locker);
    Descriptor otherType = Descriptor::forValue(value);

    myType.merge(otherType);

    ASSERT(descriptor(locker) != myType); // The type must have changed if we're on the slow path.

    set(locker, vm, myType);
}

void InferredType::makeTop(VM& vm)
{
    ConcurrentJITLocker locker(m_lock);
    set(locker, vm, Top);
}

void InferredType::set(const ConcurrentJITLocker& locker, VM& vm, Descriptor newDescriptor)
{
    // We will trigger write barriers while holding our lock. Currently, write barriers don't GC, but that
    // could change. If it does, we don't want to deadlock. Note that we could have used
    // GCSafeConcurrentJITLocker in the caller, but the caller is on a fast path so maybe that wouldn't be
    // a good idea.
    DeferGCForAWhile deferGC(vm.heap);
    
    // Be defensive: if we're not really changing the type, then we don't have to do anything.
    if (descriptor(locker) == newDescriptor)
        return;

    // The new descriptor must be more general than the previous one.
    ASSERT(newDescriptor.subsumes(descriptor(locker)));

    // If the new descriptors have different structures, then it can only be because one is null.
    if (descriptor(locker).structure() != newDescriptor.structure())
        ASSERT(!descriptor(locker).structure() || !newDescriptor.structure());

    // We are changing the type, so make sure that if anyone was watching, they find out about it now. If
    // anyone is watching, we make sure to go to Top so that we don't do this sort of thing again.
    if (m_watchpointSet.state() != ClearWatchpoint) {
        // We cannot have been invalidated, since if we were, then we'd already be at Top.
        ASSERT(m_watchpointSet.state() != IsInvalidated);

        // We're about to do expensive things because some compiler thread decided to watch this type and
        // then the type changed. Assume that this property is crazy, and don't ever do any more things for
        // it.
        newDescriptor = Top;

        m_watchpointSet.fireAll("Inferred type changed");
    }

    // Remove the old InferredStructure object if we no longer need it.
    if (!newDescriptor.structure())
        m_structure = nullptr;

    // Add a new InferredStructure object if we need one now.
    if (newDescriptor.structure()) {
        if (m_structure) {
            // We should agree on the structures if we get here.
            ASSERT(newDescriptor.structure() == m_structure->structure());
        } else {
            m_structure = std::make_unique<InferredStructure>(this, newDescriptor.structure());
            newDescriptor.structure()->addTransitionWatchpoint(m_structure.get());
        }
    }

    // Finally, set the descriptor kind.
    m_kind = newDescriptor.kind();

    // Assert that we did things.
    ASSERT(descriptor(locker) == newDescriptor);
}

void InferredType::removeStructure()
{
    VM& vm = *Heap::heap(this)->vm();

    ConcurrentJITLocker locker(m_parent->m_lock);
    
    Descriptor newDescriptor = descriptor(locker);
    newDescriptor.removeStructure();
    
    set(locker, vm, newDescriptor);
}

void InferredType::InferredStructure::InferredStructure(InferredType* parent, Structure* structure)
    : m_parent(parent)
    , m_structure(vm, parent, structure)
{
}

void InferredType::InferredStructure::fireInternal(const FireDetail&)
{
    m_parent->removeStructure();
}

void InferredType::InferredStructure::finalizeUnconditionally()
{
    VM& vm = *Heap::heap(m_parent)->vm();

    ASSERT(Heap::isMarked(m_parent));
    
    if (!Heap::isMarked(m_structure.get()))
        m_parent->removeStructure();
}

} // namespace JSC

namespace WTF {

using namespace JSC;

void printInternal(PrintStream& out, InferredType::Kind kind)
{
    switch (kind) {
    case InferredType::Bottom:
        out.print("Bottom");
        return;
    case InferredType::Boolean:
        out.print("Boolean");
        return;
    case InferredType::Other:
        out.print("Other");
        return;
    case InferredType::Int32:
        out.print("Int32");
        return;
    case InferredType::Double:
        out.print("Double");
        return;
    case InferredType::Number:
        out.print("Number");
        return;
    case InferredType::String:
        out.print("String");
        return;
    case InferredType::ObjectWithStructure:
        out.print("ObjectWithStructure");
        return;
    case InferredType::ObjectWithStructureOrOther:
        out.print("ObjectWithStructureOrOther");
        return;
    case InferredType::Object:
        out.print("Object");
        return;
    case InferredType::ObjectOrOther:
        out.print("ObjectOrOther");
        return;
    case InferredType::Top:
        out.print("Top");
        return;
    }

    RELEASE_ASSERT_NOT_REACHED();
}

} // namespace WTF




/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#infdef InferredType_h
#define InferredType_h

#include "ConcurrentJITLock.h"
#include "JSCell.h"

namespace JSC {

// This is an object used for the inference of the types of object properties.

class InferredType final : public JSCell {
public:
    typedef JSCell Base;

    static InferredType* create(VM&);

    static const bool needsDestruction = true;
    static void destroy(JSCell*);

    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);

    static void visitChildren(JSCell*, SlotVisitor&);

    DECLARE_INFO;

    enum Kind : uint8_t {
        Bottom,
        Boolean,
        Other,
        Int32,
        Double,
        Number,
        String,
        ObjectWithStructure,
        ObjectWithStructureOrOther,
        Object,
        ObjectOrOther,
        Top
    };

    class Descriptor {
    public:
        Descriptor()
            : m_kind(Bottom)
            , m_structure(nullptr)
        {
        }

        Descriptor(Kind kind, Structure* structure = nullptr)
            : m_kind(kind)
            , m_structure(structure)
        {
        }

        static Descriptor forValue(JSValue);

        explicit operator bool() const
        {
            return m_kind == Bottom && !m_structure;
        }

        Kind kind() const { return m_kind; }
        Structure* structure() const { return m_structure; }

        ALWAYS_INLINE bool includesValue(JSValue value)
        {
            switch (m_kind) {
            case Bottom:
                return false;
            case Boolean:
                return value.isBoolean();
            case Other:
                return value.isUndefinedOrNull();
            case Int32:
                return value.isInt32();
            case Double:
                return value.isDouble();
            case Number:
                return value.isNumber();
            case String:
                return value.isString();
            case ObjectWithStructure:
                return value.isCell() && value.asCell()->structure() == m_structure;
            case ObjectWithStructureOrOther:
                return value.isUndefinedOrNull()
                    || (value.isCell() && value.asCell()->structure() == m_structure);
            case Object:
                return value.isObject();
            case ObjectOrOther:
                return value.isUndefinedOrNull() || value.isObject();
            case Top:
                return true;
            }

            RELEASE_ASSERT_NOT_REACHED();
        }

        bool operator==(const Descriptor& other)
        {
            return m_kind == other.m_kind
                && m_structure == other.m_structure;
        }

        bool operator!=(const Descriptor& other)
        {
            return !(*this == other);
        }

        unsigned hash() const
        {
            return WTF::PtrHash<Structure*>::hash(m_structure) ^ static_cast<unsigned>(m_kind);
        }
    
        void merge(const Descriptor&);
        void removeStructure();

        // Returns true if this descriptor is more general than the other one.
        bool subsumes(const Descriptor&) const;

        void dumpInContext(PrintStream&, DumpContext*) const;
        void dump(PrintStream&) const;

    private:
        Kind m_kind;
        Structure* m_structure;
    };

    ConcurrentJITLock& lock() const { return m_lock; }

    Descriptor descriptor(const ConcurrentJITLocker&) const
    {
        return Descriptor(m_kind, m_structure ? m_structure->structure() : nullptr);
    }
    Descriptor descriptor() const
    {
        ConcurrentJITLocker locker(m_lock);
        return descriptor(locker);
    }
    
    Kind kind(const ConcurrentJITLocker& locker) const { return descriptor().kind(); }
    Structure* structure(const ConcurrentJITLocker& locker) const { return descriptor().structure(); }

    bool isRelevant() const { return m_kind != Top; }

    // Returns true if the InferredType is still relevant after the store. It's not relevant if it's Top.
    ALWAYS_INLINE bool willStoreValue(VM& vm, JSValue value)
    {
        ConcurrentJITLocker locker(m_lock);
        if (!descriptor(locker).includesValue(locker, value))
            willStoreValueSlow(locker, vm, value);
        return kind(locker) != Top;
    }

    // Immediately makes this type irrelevant.
    void makeTop(VM&);

    // Returns true if it currently makes sense to watch this InferredType for this descriptor. Note that
    // this will always return false for Top.
    bool canWatch(const ConcurrentJITLocker& locker, const Descriptor&);
    bool canWatch(const Descriptor&);
    
    void addWatchpoint(const ConcurrentJITLocker& locker, Watchpoint*);
    void addWatchpoint(Watchpoint*);

    void dump(PrintStream&) const;

private:
    InferredType(VM&);
    ~InferredType();

    void willStoreValueSlow(const ConcurrentJITLocker&, VM&, JSValue);
    void set(const ConcurrentJITLocker&, VM&, Descriptor);
    void removeStructure();

    mutable ConcurrentJITLock m_lock;
    
    Kind m_kind { Bottom };

    class InferredStructure : public Watchpoint, public UnconditionalFinalizer {
    public:
        InferredStructure(InferredType* parent, Structure*);

        Structure* structure() const { return m_structure.get(); };

    protected:
        void fireInternal(const FireDetail&) override;
        void finalizeUnconditionally() override;

    private:
        InferredType* m_parent;
        WriteBarrier<Structure> m_structure;
    };

    std::unique_ptr<InferredStructure> m_structure;

    // NOTE: If this is being watched, we transform to Top because that implies that it wouldn't be
    // profitable to watch it again. Also, this set is initialized clear, and is never exposed to the DFG
    // thread. The DFG will use the InferredType as the thing that it watches.
    InlineWatchpointSet m_watchpointSet;
};

} // namespace JSC

namespace WTF {

void printInternal(PrintStream&, JSC::InferredType::Kind);

} // namespace WTF

#endif // InferredType_h




/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "InferredTypeTable.h"

#include "JSCInlines.h"

namespace JSC {

const ClassInfo InferredTypeTable::s_info = { "InferredTypeTable", 0, 0, CREATE_METHOD_TABLE(InferredTypeTable) };

InferredTypeTable* InferredTypeTable::create(VM& vm)
{
    InferredTypeTable* result = new (NotNull, allocateCell<InferredTypeTable>(vm.heap)) InferredTypeTable(vm);
    result->finishCreation(vm);
    return result;
}

void InferredTypeTable::destroy(JSCell* cell)
{
    InferredTypeTable* inferredTypeTable = static_cast<InferredTypeTable*>(cell);
    inferredTypeTable->InferredTypeTable::~InferredTypeTable();
}

Structure* InferredTypeTable::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
{
    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
}

void InferredTypeTable::visitChildren(JSCell* cell, SlotVisitor& visitor)
{
    InferredTypeTable* inferredTypeTable = jsCast<InferredTypeTable*>(cell);

    ConcurrentJITLocker locker(m_lock);
    
    Vector<PropertyOffset> toRemove;
    
    for (auto& entry : m_table) {
        if (entry.value->isRelevant())
            visitor.append(&entry.value);
        else
            toRemove.append(entry.key);
    }

    for (PropertyOffset offset : toRemove)
        m_table.remove(offset);
}

InferredTypeTable* InferredTypeTable::clone(VM& vm)
{
    Vector<TableType::KeyValuePairType, 8> toAdd;
    
    {
        ConcurrentJITLocker locker(m_lock);
        for (auto& entry : m_table) {
            if (entry.value->isRelevant())
                toAdd.append(entry);
        }
    }

    InferredTypeTable* result = create(vm);

    for (auto& entry : toAdd)
        result->m_table.add(entry.key, WriteBarrier<InferredType>(vm, result, entry.get()));

    return result;
}

InferredType* InferredTypeTable::get(const ConcurrentJITLocker& locker, PropertyOffset offset)
{
    InferredType* result = m_table.get(offset);
    if (!result)
        return nullptr;

    // Take this opportunity to prune invalidated types.
    if (!result->isRelevant()) {
        m_table.remove(offset);
        return nullptr;
    }

    return result;
}

InferredType* InferredTypeTable::get(PropertyOffset offset)
{
    ConcurrentJITLocker locker(m_lock);
    return get(locker, offset);
}

bool InferredTypeTable::willStoreValue(VM& vm, PropertyOffset offset, JSValue value)
{
    ConcurrentJITLocker locker(m_lock);
    InferredType* type = m_table.get(offset);
    if (!type)
        return false;

    if (type->willStoreValue(vm, value))
        return true;

    m_table.remove(offset);
    return false;
}

void InferredTypeTable::makeTop(VM& vm, PropertyOffset offset)
{
    ConcurrentJITlocker locker(m_lock);
    InferredType* type = m_table.take(offset);
    if (!type)
        return;

    type->makeTop();
}

bool InferredTypeTable::createInferredTypeForNewProperty(VM& vm, PropertyOffset offset, JSValue value)
{
    InferredType* type = InferredType::create(vm);
    if (!type->willStoreValue(vm, value))
        return false;

    // Fire the barrier before grabbing the lock.
    WriteBarrier<InferredType> typeBarrier(vm, this, type);
    
    ConcurrentJITLocker locker(m_lock);
    auto result = m_table.add(offset, typeBarrier);
    RELEASE_ASSERT(result.isNewEntry);
    return true;
}

} // namespace JSC




/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef InferredTypeTable_h
#define InferredTypeTable_h

#include "InferredType.h"
#include "JSCell.h"

namespace JSC {

// A table of inferred types for some structure. This is a JSCell because that simplifies the Structure
// destructor and makes lifetype easier to manage. For example, since it's a cell, we know that this thing
// cannot be deleted while the DFG is running. This is separate from PropertyTable because most properties
// will not have an InferredType, since most properties are in dictionaries (if you think of "a property"
// as being "a property in some Structure").

class InferredTypeTable final : public JSCell {
public:
    typedef JSCell Base;

    static InferredTypeTable* create(VM&);

    static const bool needsDestruction = true;
    static void destroy(JSCell*);

    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);

    static void visitChildren(JSCell*, SlotVisitor&);

    DECLARE_INFO;

    InferredTypeTable* clone(VM&);

    ConcurrentJITLock& lock() { return m_lock; }

    bool isEmpty() const { return m_table.isEmpty(); }

    InferredType* get(const ConcurrentJITLocker&, PropertyOffset);
    InferredType* get(PropertyOffset);

    // Returns true if the InferredType for this property is still relevant after the store. It's not
    // relevant if it's Top. Note that this table will internally prune Top entries.
    bool willStoreValue(VM&, PropertyOffset, JSValue);

    // Invalidates the type for the property. Useful if we detect a store in a reflective context.
    void makeTop(VM&, PropertyOffset);

    // This creates a new InferredType for this property. Note that this method is needed because
    // willStoreValue() assumes that if there isn't an InferredType object for the property, then it's
    // because we've already concluded that the property should not have a type.
    bool createInferredTypeForNewProperty(VM&, PropertyOffset, JSValue);

private:
    InferredTypeTable(VM&);
    ~InferredTypeTable();

    typedef HashMap<PropertyOffset, WriteBarrier<InferredType>, WTF::IntHash<PropertyOffset>, WTF::UnsignedWithZeroKeyHashTraits<PropertyOffset>> TableType;
    
    TableType m_table;
    ConcurrentJITLock m_lock;
};

} // namespace JSC

#endif // InferredTypeTable_h



Lines 1214-1219 inline bool JSObject::putDirectInternal( Source/JavaScriptCore/runtime/JSObject.h_sec1
- Source/JavaScriptCore/runtime/JSObject.h -1 / +19 lines
1214		1214
1215	Structure* structure = this->structure(vm);	1215	Structure* structure = this->structure(vm);
1216	if (structure->isDictionary()) {	1216	if (structure->isDictionary()) {
		1217	ASSERT(!structure->hasInferredTypes());
		1218
1217	unsigned currentAttributes;	1219	unsigned currentAttributes;
1218	PropertyOffset offset = structure->get(vm, propertyName, currentAttributes);	1220	PropertyOffset offset = structure->get(vm, propertyName, currentAttributes);
1219	if (offset != invalidOffset) {	1221	if (offset != invalidOffset) {
Lines 1253-1258 inline bool JSObject::putDirectInternal( Source/JavaScriptCore/runtime/JSObject.h_sec2
1253	PropertyOffset offset;	1255	PropertyOffset offset;
1254	size_t currentCapacity = this->structure()->outOfLineCapacity();	1256	size_t currentCapacity = this->structure()->outOfLineCapacity();
1255	if (Structure* structure = Structure::addPropertyTransitionToExistingStructure(this->structure(), propertyName, attributes, offset)) {	1257	if (Structure* structure = Structure::addPropertyTransitionToExistingStructure(this->structure(), propertyName, attributes, offset)) {
		1258	// Check if we should do type inference.
		1259	if (slot.context() == PutById)
		1260	structure->createInferredTypeForNewProperty(vm, propertyName, value);
		1261
1256	DeferGC deferGC(vm.heap);	1262	DeferGC deferGC(vm.heap);
1257	Butterfly* newButterfly = butterfly();	1263	Butterfly* newButterfly = butterfly();
1258	if (currentCapacity != structure->outOfLineCapacity()) {	1264	if (currentCapacity != structure->outOfLineCapacity()) {
Lines 1269-1280 inline bool JSObject::putDirectInternal( Source/JavaScriptCore/runtime/JSObject.h_sec3
1269	}	1275	}
1270		1276
1271	unsigned currentAttributes;	1277	unsigned currentAttributes;
1272	offset = structure->get(vm, propertyName, currentAttributes);	1278	bool hasInferredType;
		1279	offset = structure->get(vm, propertyName, currentAttributes, hasInferredType);
1273	if (offset != invalidOffset) {	1280	if (offset != invalidOffset) {
1274	if ((mode == PutModePut) && currentAttributes & ReadOnly)	1281	if ((mode == PutModePut) && currentAttributes & ReadOnly)
1275	return false;	1282	return false;
1276		1283
1277	structure->didReplaceProperty(offset);	1284	structure->didReplaceProperty(offset);
		1285	if (UNLIKELY(hasInferredType)) {
		1286	bool isStillValid;
		1287	if (slot.context() == PutById)
		1288	isStillValid = structure->willStoreValue(vm, offset, value);
		1289	else
		1290	isStillValid = structure->makeTop(vm, offset);
		1291	if (UNLIKELY(!isStillValid))
		1292	structure->updateHasInferredTypeForProperty(vm, propertyName);
		1293	}
1278	slot.setExistingProperty(this, offset);	1294	slot.setExistingProperty(this, offset);
1279	putDirect(vm, offset, value);	1295	putDirect(vm, offset, value);
1280		1296
Lines 1294-1299 inline bool JSObject::putDirectInternal( Source/JavaScriptCore/runtime/JSObject.h_sec4
1294	DeferredStructureTransitionWatchpointFire deferredWatchpointFire;	1310	DeferredStructureTransitionWatchpointFire deferredWatchpointFire;
1295		1311
1296	structure = Structure::addPropertyTransition(vm, structure, propertyName, attributes, offset, slot.context(), &deferredWatchpointFire);	1312	structure = Structure::addPropertyTransition(vm, structure, propertyName, attributes, offset, slot.context(), &deferredWatchpointFire);
		1313	if (slot.context() == PutById)
		1314	structure->createInferredTypeForNewProperty(vm, propertyName, value);
1297		1315
1298	validateOffset(offset);	1316	validateOffset(offset);
1299	ASSERT(structure->isValidOffset(offset));	1317	ASSERT(structure->isValidOffset(offset));

Lines 347-357 void Structure::materializePropertyMap(V Source/JavaScriptCore/runtime/Structure.cpp_sec1
- Source/JavaScriptCore/runtime/Structure.cpp +73 lines
347	else	347	else
348	propertyTable().set(vm, this, table);	348	propertyTable().set(vm, this, table);
349		349
		350	InferredTypeTable* typeTable = m_inferredTypeTable.get();
		351
350	for (size_t i = structures.size(); i--;) {	352	for (size_t i = structures.size(); i--;) {
351	structure = structures[i];	353	structure = structures[i];
352	if (!structure->m_nameInPrevious)	354	if (!structure->m_nameInPrevious)
353	continue;	355	continue;
354	PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->attributesInPrevious());	356	PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->attributesInPrevious());
		357	if (typeTable && typeTable->get(structure->m_offset))
		358	entry.hasInferredType = true;
355	propertyTable()->add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);	359	propertyTable()->add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);
356	}	360	}
357		361
Lines 461-466 Structure* Structure::addPropertyTransit Source/JavaScriptCore/runtime/Structure.cpp_sec2
461	transition->setAttributesInPrevious(attributes);	465	transition->setAttributesInPrevious(attributes);
462	transition->propertyTable().set(vm, transition, structure->takePropertyTableOrCloneIfPinned(vm));	466	transition->propertyTable().set(vm, transition, structure->takePropertyTableOrCloneIfPinned(vm));
463	transition->m_offset = structure->m_offset;	467	transition->m_offset = structure->m_offset;
		468	if (structure->m_inferredTypeTable) {
		469	// FIXME: We could probably get some space savings by having transitions share a table with their
		470	// predecessors. This means that the first property name you use when creating an object determines
		471	// the "space" of inferred types that the structure lives in, and thereafter, everything is shared.
		472	// Unfortunately, this currently won't work, because of how adding new properties works. We assume
		473	// that the inferred type table had never seen the property before. We could fix this by ensuring
		474	// that the InferredTypeTable doesn't forget that it had an entry for type whenever that type goes
		475	// to Top.
		476	transition->m_inferredTypeTable = structure->m_inferredTypeTable->clone(vm);
		477	}
464		478
465	offset = transition->add(vm, propertyName, attributes);	479	offset = transition->add(vm, propertyName, attributes);
466		480
Lines 838-843 void Structure::startWatchingInternalPro Source/JavaScriptCore/runtime/Structure.cpp_sec3
838	setDidWatchInternalProperties(true);	852	setDidWatchInternalProperties(true);
839	}	853	}
840		854
		855	void Structure::updateInferredTypeForProperty(VM& vm, PropertyName propertyName)
		856	{
		857	ASSERT(!isCompilationThread());
		858	ASSERT(structure()->classInfo() == info());
		859
		860	// This only works if we've got a property table.
		861	PropertyTable* propertyTable;
		862	materializePropertyMapIfNecessary(vm, propertyTable);
		863
		864	if (!propertyTable)
		865	return;
		866
		867	PropertyMapEntry* entry = propertyTable->get(propertyName.uid());
		868	if (!entry)
		869	return;
		870
		871	if (InferredTypeTable* table = m_inferredTypeTable.get())
		872	entry->hasInferredType = table->get(entry->offset);
		873	else
		874	entry->hasInferredType = false;
		875	}
		876
		877	void Structure::createInferredTypeForNewProperty(VM& vm, PropertyName propertyName, JSValue value)
		878	{
		879	ASSERT(!isCompilationThread());
		880	ASSERT(structure()->classInfo() == info());
		881
		882	// Create the inferred type table before doing anything else, so that we don't GC after we have already
		883	// grabbed a pointer into the property map.
		884	InferredTypeTable* table = m_inferredTypeTable.get();
		885	if (!table) {
		886	table = InferredTypeTable::create(vm);
		887	WTF::storeStoreBarrier();
		888	m_inferredTypeTable.set(vm, this, table);
		889	}
		890
		891	// This only works if we've got a property table.
		892	PropertyTable* propertyTable;
		893	materializePropertyMapIfNecessary(vm, propertyTable);
		894
		895	// We must be calling this after having created the given property, so we must have a property table
		896	// now.
		897	ASSERT(propertyTable);
		898
		899	PropertyMapEntry* entry = propertyTable->get(propertyName.uid());
		900	ASSERT(entry);
		901
		902	// Since this is a new property, we must not have set hasInferredType previously.
		903	ASSERT(!entry->hasInferredType);
		904
		905	if (!table->createInferredTypeForNewProperty(vm, entry->offset, value)) {
		906	// This is super rare and weird, but we need to handle it. It'll occur if the value has a type that
		907	// we don't have type inference rules for.
		908	return;
		909	}
		910
		911	entry->hasInferredType = true;
		912	}
		913
841	#if DUMP_PROPERTYMAP_STATS	914	#if DUMP_PROPERTYMAP_STATS
842		915
843	PropertyMapHashTableStats* propertyMapHashTableStats = 0;	916	PropertyMapHashTableStats* propertyMapHashTableStats = 0;



    UniquedStringImpl* key;
    PropertyOffset offset;
    uint8_t attributes;
    bool hasInferredType; // This caches whether or not a property has an inferred type in the inferred type table, and is used for a fast check in JSObject::putDirectInternal().

    PropertyMapEntry()
        : key(nullptr)
        , offset(invalidOffset)
        , attributes(0)
        , hasInferredType(false)
    {
    }
    

        : key(key)
        , offset(offset)
        , attributes(attributes)
        , hasInferredType(false)
    {
        ASSERT(this->attributes == attributes);
    }


    PropertyOffset get(VM&, PropertyName);
    PropertyOffset get(VM&, PropertyName, unsigned& attributes);
    PropertyOffset get(VM&, PropertyName, unsigned& attributes, bool& hasInferredType);

    // This is a somewhat internalish method. It will call your functor while possibly holding the
    // Structure's lock. There is no guarantee whether the lock is held or not in any particular

            structure->startWatchingInternalPropertiesIfNecessary(vm);
    }

    bool hasInferredTypes() const
    {
        return !!m_inferredTypeTable;
    }

    InferredType* inferredTypeForOffset(PropertyOffset offset)
    {
        if (InferredTypeTable* table = m_inferredTypeTable.get())
            return table->get(offset);
        return nullptr;
    }

    // Returns true if the type of the property is still valid.
    ALWAYS_INLINE bool willStoreValue(VM& vm, PropertyOffset offset, JSValue value)
    {
        InferredTypeTable* table = m_inferredTypeTable.get();
        if (LIKELY(!table))
            return false;
        bool result = table->willStoreValue(vm, offset, value);
        if (table->isEmpty())
            m_inferredTypeTable.clear();
        return result;
    }

    // Returns false always, to match the return value semantics of willStoreValue(): if it returns false,
    // then the property type is invalid (which is always).
    ALWAYS_INLINE bool makeTop(VM& vm, PropertyOffset offset)
    {
        InferredTypeTable* table = m_inferredTypeTable.get();
        if (LIKELY(!table))
            return false;
        table->makeTop(vm, offset);
        if (table->isEmpty())
            m_inferredTypeTable.clear();
        return false;
    }

    void updateHasInferredTypeForProperty(VM&, PropertyName);

    ALWAYS_INLINE void createInferredTypeForNewProperty(VM& vm, PropertyName propertyName, JSValue value)
    {
        // FIXME: These conditions could probably be refined.
        if (isDictionary() || transitionWatchpointIsLikelyToBeFired())
            return;

        createInferredTypeForNewPropertySlow(vm, propertyName, value);
    }

    PassRefPtr<StructureShape> toStructureShape(JSValue);
    
    // Determines if the two structures match enough that this one could be used for allocations

    
    void startWatchingInternalProperties(VM&);

    void createInferredTypeForNewPropertySlow(VM&, PropertyName, JSValue);

    static const int s_maxTransitionLength = 64;
    static const int s_maxTransitionLengthForNonEvalPutById = 512;


    // Should be accessed through propertyTable(). During GC, it may be set to 0 by another thread.
    WriteBarrier<PropertyTable> m_propertyTableUnsafe;

    WriteBarrier<InferredTypeTable> m_inferredTypeTable;

    mutable InlineWatchpointSet m_transitionWatchpointSet;

    COMPILE_ASSERT(firstOutOfLineOffset < 256, firstOutOfLineOffset_fits);




ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName)
{
    unsigned attributes;
    bool hasInferredType;
    return get(vm, propertyName, attributes, hasInferredType);
    materializePropertyMapIfNecessary(vm, propertyTable);
    if (!propertyTable)
        return invalidOffset;

    PropertyMapEntry* entry = propertyTable->get(propertyName.uid());
    return entry ? entry->offset : invalidOffset;
}
    
ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes)
{
    bool hasInferredType;
    return get(vm, propertyName, attributes, hasInferredType);
}

ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes, bool& hasInferredType)
{
    ASSERT(!isCompilationThread());
    ASSERT(structure()->classInfo() == info());


        return invalidOffset;

    attributes = entry->attributes;
    hasInferredType = entry->hasInferredType;
    return entry->offset;
}


Return to Bug 148610

Lines 1823-1829 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec1
- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h -34 / +42 lines
1823	}	1823	}
1824		1824
1825	AbstractValue& value = forNode(node->child1());	1825	AbstractValue& value = forNode(node->child1());
1826	if (!value.m_structure.isTop() && !value.m_structure.isClobbered()	1826	if (value.m_structure.isFinite()
1827	&& (node->child1().useKind() == CellUse \|\| !(value.m_type & ~SpecCell))) {	1827	&& (node->child1().useKind() == CellUse \|\| !(value.m_type & ~SpecCell))) {
1828	GetByIdStatus status = GetByIdStatus::computeFor(	1828	GetByIdStatus status = GetByIdStatus::computeFor(
1829	value.m_structure.set(), m_graph.identifiers()[node->identifierNumber()]);	1829	value.m_structure.set(), m_graph.identifiers()[node->identifierNumber()]);
Lines 1835-1856 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec2
1835	// This thing won't give us a variant that involves prototypes. If it did, we'd	1835	// This thing won't give us a variant that involves prototypes. If it did, we'd
1836	// have more work to do here.	1836	// have more work to do here.
1837	DFG_ASSERT(m_graph, node, status[i].conditionSet().isEmpty());	1837	DFG_ASSERT(m_graph, node, status[i].conditionSet().isEmpty());
1838		1838
1839	JSValue constantResult =	1839	result.merge(
1840	m_graph.tryGetConstantProperty(value, status[i].offset());	1840	m_graph.inferredValueForProperty(
1841	if (!constantResult) {	1841	value, status[i].offset(), m_graph.structureClobberState()));
1842	result.makeHeapTop();
1843	break;
1844	}
1845
1846	AbstractValue thisResult;
1847	thisResult.set(
1848	m_graph, *m_graph.freeze(constantResult),
1849	m_state.structureClobberState());
1850	result.merge(thisResult);
1851	}	1842	}
1852	if (status.numVariants() == 1 \|\| isFTL(m_graph.m_plan.mode))	1843	m_state.setFoundConstants(true);
1853	m_state.setFoundConstants(true);
1854	forNode(node) = result;	1844	forNode(node) = result;
1855	break;	1845	break;
1856	}	1846	}
Lines 2078-2090 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec3
2078		2068
2079	case GetByOffset: {	2069	case GetByOffset: {
2080	StorageAccessData& data = node->storageAccessData();	2070	StorageAccessData& data = node->storageAccessData();
2081	JSValue result = m_graph.tryGetConstantProperty(forNode(node->child2()), data.offset);	2071
2082	if (result) {	2072	// FIXME: The part of this that handles inferred property types relies on AI knowing the structure
2083	setConstant(node, *m_graph.freeze(result));	2073	// right now. That's probably not optimal. In some cases, we may perform an optimization (usually
2084	break;	2074	// by something other than AI, maybe by CSE for example) that obscures AI's view of the structure
2085	}	2075	// at the point where GetByOffset runs. Currently, when that happens, we'll forget what the proven
2086		2076	// type should have been, even though we would have known it at parse time. It might be worthwhile
2087	forNode(node).makeHeapTop();	2077	// to put an inferred type into the StorageAccessData. Note that this might become particularly
		2078	// unfortunate due to https://bugs.webkit.org/show_bug.cgi?id=148649.
		2079	AbstractValue value = m_graph.inferredValueForProperty(
		2080	forNode(node->child2()), data.offset, m_state.structureClobberState());
		2081
		2082	forNode(node) = value;
		2083	if (value.m_value)
		2084	m_state.setFoundConstants(true);
2088	break;	2085	break;
2089	}	2086	}
2090		2087
Lines 2123-2140 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec4
2123	if (set.isEmpty())	2120	if (set.isEmpty())
2124	continue;	2121	continue;
2125	baseSet.merge(set);	2122	baseSet.merge(set);
2126		2123
2127	if (getCase.method().kind() != GetByOffsetMethod::Constant) {	2124	switch (getCase.method().kind()) {
2128	result.makeHeapTop();	2125	case GetByOffsetMethod::Constant: {
2129	continue;	2126	AbstractValue thisResult;
		2127	thisResult.set(
		2128	m_graph,
		2129	*getCase.method().constant(),
		2130	m_state.structureClobberState());
		2131	result.merge(thisResult);
		2132	break;
2130	}	2133	}
2131		2134
2132	AbstractValue thisResult;	2135	case GetByOffetMethod::Load: {
2133	thisResult.set(	2136	result.merge(
2134	m_graph,	2137	m_graph.inferredValueForProperty(
2135	*getCase.method().constant(),	2138	set, getCase.method().offset(), m_graph.structureClobberState()));
2136	m_state.structureClobberState());	2139	break;
2137	result.merge(thisResult);	2140	}
		2141
		2142	default: {
		2143	result.makeHeapTop();
		2144	break;
		2145	} }
2138	}	2146	}
2139		2147
2140	if (forNode(node->child1()).changeStructure(m_graph, baseSet) == Contradiction)	2148	if (forNode(node->child1()).changeStructure(m_graph, baseSet) == Contradiction)

Lines 404-411 namespace JSC { Source/JavaScriptCore/jit/JIT.h_sec1
- Source/JavaScriptCore/jit/JIT.h -2 lines
404		404
405	enum FinalObjectMode { MayBeFinal, KnownNotFinal };	405	enum FinalObjectMode { MayBeFinal, KnownNotFinal };
406		406
407	template <typename T> Jump branchStructure(RelationalCondition, T leftHandSide, Structure*);
408
409	#if USE(JSVALUE32_64)	407	#if USE(JSVALUE32_64)
410	bool getOperandConstantImmediateInt(int op1, int op2, int& op, int32_t& constant);	408	bool getOperandConstantImmediateInt(int op1, int op2, int& op, int32_t& constant);
411		409

Lines 335-341 public: Source/JavaScriptCore/bytecode/Watchpoint.h_sec1
- Source/JavaScriptCore/bytecode/Watchpoint.h -1 / +33 lines
335	{	335	{
336	touch(StringFireDetail(reason));	336	touch(StringFireDetail(reason));
337	}	337	}
338		338
		339	// Note that for any watchpoint that is visible from the DFG, it would be incorrect to write code like:
		340	//
		341	// if (w.isBeingWatched())
		342	// w.fireAll()
		343	//
		344	// Concurrently to this, the DFG could do:
		345	//
		346	// if (w.isStillValid())
		347	// perform optimizations;
		348	// if (!w.isStillValid())
		349	// retry compilation;
		350	//
		351	// Note that the DFG algorithm is widespread, and sound, because fireAll() and invalidate() will leave
		352	// the watchpoint in a !isStillValid() state. Hence, if fireAll() or invalidate() interleaved between
		353	// the first isStillValid() check and the second one, then it would simply cause the DFG to retry
		354	// compilation later.
		355	//
		356	// But, if you change some piece of state that the DFG might optimize for, but invalidate the
		357	// watchpoint by doing:
		358	//
		359	// if (w.isBeingWatched())
		360	// w.fireAll()
		361	//
		362	// then the DFG would never know that you invalidated state between the two checks.
		363	//
		364	// There are two ways to work around this:
		365	//
		366	// - Call fireAll() without a isBeingWatched() check. Then, the DFG will know that the watchpoint has
		367	// been invalidated when it does its second check.
		368	//
		369	// - Do not expose the watchpoint set to the DFG directly, and have your own way of validating whether
		370	// the assumptions that the DFG thread used are still valid when the DFG code is installed.
339	bool isBeingWatched() const	371	bool isBeingWatched() const
340	{	372	{
341	if (isFat())	373	if (isFat())

Line 0 Source/JavaScriptCore/dfg/DFGDesiredInferredType.h_sec1
- Source/JavaScriptCore/dfg/DFGDesiredInferredType.h +132 lines
		1	/*
		2	* Copyright (C) 2015 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#ifndef DFGDesiredInferredType_h
		27	#define DFGDesiredInferredType_h
		28
		29	#if ENABLE(DFG_JIT)
		30
		31	#include "InferredType.h"
		32	#include <wtf/HashMap.h>
		33
		34	namespace JSC { namespace DFG {
		35
		36	// This documents the DFG's expectation for an InferredType: specifically, that we want it to have a live
		37	// InferredType object and that this object has the type that we originally saw.
		38
		39	class DesiredInferredType {
		40	public:
		41	DesiredInferredType()
		42	: m_object(nullptr)
		43	{
		44	}
		45
		46	DesiredInferredType(InferredType* object, const InferredType::Descriptor& expected)
		47	: m_object(object)
		48	, m_expected(expected)
		49	{
		50	}
		51
		52	DesiredInferredType(WTF::HashTableDeletedValueType)
		53	: m_object(nullptr)
		54	, m_expected(Top)
		55	{
		56	}
		57
		58	explicit operator bool() const { return m_object && m_expected; }
		59
		60	InferredType* object() const { return m_object; }
		61	InferredType::Descriptor expected() const { return m_expected; }
		62
		63	bool isStillValid() const
		64	{
65	return m_object->canWatch(m_expected);
66	}
67
68	void add(Watchpoint* watchpoint) const
69	{
70	m_object->addWatchpoint(watchpoint);
71	}
72
73	bool operator==(const DesiredInferredType& other) const
74	{
75	return m_object == other.m_object
76	&& m_expected == other.m_expected;
77	}
78
79	bool operator!=(const DesiredInferredType& other) const
80	{
81	return !(*this == other);
82	}
83
84	bool isHashTableDeletedValue() const
85	{
86	return !m_object && m_expected == Top;
87	}
88
89	unsigned hash() const
90	{
91	return WTF::PtrHash<InferredType>::hash(m_object) + m_expected.hash() 7;
92	}
93
94	void dumpInContext(PrintStream& out, DumpContext* context) const
95	{
96	out.print(inContext(m_expected, context), " for ", RawPointer(m_object));
97	}
98
99	void dump(PrintStream& out) const
100	{
101	dumpInContext(out, context);
102	}
103
104	private:
105	InferredType* m_object;
106	InferredType::Descriptor m_expected;
107	};
108
109	struct DesiredInferredTypeHash {
110	static unsigned hash(const DesiredInferredType& key) { return key.hash(); }
111	static bool equal(const DesiredInferredType& a, const DesiredInferredType& b) { return a == b; }
112	static const bool safeToCompareToEmptyOrDeleted = true;
113	};
114
115	} } // namespace JSC::DFG
116
117	namespace WTF {
118
119	template<typename T> struct DefaultHash;
120	template<> struct DefaultHash<JSC::DFG::DesiredInferredType> {
121	typedef JSC::DFG::DesiredInferredTypeHash Hash;
122	};
123
124	template<typename T> struct HashTraits;
125	template<> struct HashTraits<JSC::DFG::DesiredInferredType> : SimpleClassHashTraits<JSC::DFG::DesiredInferredType> { };
126
127	} // namespace WTF
128
129	#endif // ENABLE(DFG_JIT)
130
131	#endif // DFGDesiredInferredType_h
132

Lines 887-892 bool Graph::isSafeToLoad(JSObject* base, Source/JavaScriptCore/dfg/DFGGraph.cpp_sec1
- Source/JavaScriptCore/dfg/DFGGraph.cpp -1 / +73 lines
887	return m_safeToLoad.contains(std::make_pair(base, offset));	887	return m_safeToLoad.contains(std::make_pair(base, offset));
888	}	888	}
889		889
		890	InferredType::Descriptor Graph::inferredTypeFor(const PropertyTypeKey& key)
		891	{
		892	assertIsRegistered(key.structure());
		893
		894	auto iter = m_inferredTypes.get(key);
		895	if (iter != m_inferredTypes.end())
		896	return iter->value;
		897
		898	InferredType* typeObject = key.structure()->inferredTypeForOffset(key.offset());
		899	if (!typeObject) {
		900	m_inferredTypes.add(key, InferredType::Top);
		901	return InferredType::Top;
		902	}
		903
		904	InferredType::Descriptor typeDescriptor = typeObject->descriptor();
		905	if (!typeDescriptor.isStillValid()) {
		906	m_inferredTypes.add(key, InferredType::Top);
		907	return InferredType::Top;
		908	}
		909
		910	m_inferredTypes.add(key, typeDescriptor);
		911
		912	m_plan.weakReferences.addLazily(typeObject);
		913	if (typeDescriptor.structure())
		914	registerStructure(typeDescriptor.structure());
		915
		916	// Note that we may already be watching this desired inferred type, because multiple structures may
		917	// point to the same InferredType instance.
		918	m_plan.watchpoints.addLazily(DesiredInferredType(typeObject, typeDescriptor));
		919
		920	return typeDescriptor;
		921	}
		922
		923	bool Graph::watchDesiredType(const DesiredInferredType& key)
		924	{
		925	if (!key.isStillValid())
		926	return false;
		927
		928	m_plan.weakReferences.addLazily(key.object());
		929	if (Structure* structure = key.expected().structure())
		930	registerStructure(structure);
		931	m_plan.watchpoints.addLazily(key);
		932	}
		933
890	FullBytecodeLiveness& Graph::livenessFor(CodeBlock* codeBlock)	934	FullBytecodeLiveness& Graph::livenessFor(CodeBlock* codeBlock)
891	{	935	{
892	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>>::iterator iter = m_bytecodeLiveness.find(codeBlock);	936	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>>::iterator iter = m_bytecodeLiveness.find(codeBlock);
Lines 1061-1067 JSValue Graph::tryGetConstantProperty(JS Source/JavaScriptCore/dfg/DFGGraph.cpp_sec2
1061	JSValue Graph::tryGetConstantProperty(	1105	JSValue Graph::tryGetConstantProperty(
1062	JSValue base, const StructureAbstractValue& structure, PropertyOffset offset)	1106	JSValue base, const StructureAbstractValue& structure, PropertyOffset offset)
1063	{	1107	{
1064	if (structure.isTop() \|\| structure.isClobbered()) {	1108	if (structure.isInfinite()) {
1065	// FIXME: If we just converted the offset to a uid, we could do ObjectPropertyCondition	1109	// FIXME: If we just converted the offset to a uid, we could do ObjectPropertyCondition
1066	// watching to constant-fold the property.	1110	// watching to constant-fold the property.
1067	// https://bugs.webkit.org/show_bug.cgi?id=147271	1111	// https://bugs.webkit.org/show_bug.cgi?id=147271
Lines 1076-1081 JSValue Graph::tryGetConstantProperty(co Source/JavaScriptCore/dfg/DFGGraph.cpp_sec3
1076	return tryGetConstantProperty(base.m_value, base.m_structure, offset);	1120	return tryGetConstantProperty(base.m_value, base.m_structure, offset);
1077	}	1121	}
1078		1122
		1123	AbstractValue Graph::inferredValueForProperty(
		1124	const StructureSet& base, PropertyOffset offset, StructureClobberState clobberState)
		1125	{
		1126	AbstractValue result;
		1127	base.forEach(
		1128	[&] (Structure* structure) {
		1129	AbstractValue value;
		1130	value.set(*this, inferredTypeFor(structure, offset));
		1131	result.merge(value);
		1132	});
		1133	return result;
		1134	}
		1135
		1136	AbstractValue Graph::inferredValueForProperty(
		1137	const AbstractValue& base, PropertyOffset offset, StructureClobberState clobberState)
		1138	{
		1139	if (JSValue value = tryGetConstantProperty(base, offset)) {
		1140	AbstractValue result;
		1141	result.set(this, freeze(value), clobberState);
		1142	return result;
		1143	}
		1144
		1145	if (base.m_structure.isFinite())
		1146	return inferredValueForProperty(base.m_structure.set(), offset, clobberState);
		1147
		1148	return AbstractValue::heapTop();
		1149	}
		1150
1079	JSValue Graph::tryGetConstantClosureVar(JSValue base, ScopeOffset offset)	1151	JSValue Graph::tryGetConstantClosureVar(JSValue base, ScopeOffset offset)
1080	{	1152	{
1081	// This has an awesome concurrency story. See comment for GetGlobalVar in ByteCodeParser.	1153	// This has an awesome concurrency story. See comment for GetGlobalVar in ByteCodeParser.

Lines 675-680 public: Source/JavaScriptCore/dfg/DFGGraph.h_sec1
- Source/JavaScriptCore/dfg/DFGGraph.h +16 lines
675	// Checks if it's known that loading from the given object at the given offset is fine. This is	675	// Checks if it's known that loading from the given object at the given offset is fine. This is
676	// computed by tracking which conditions we track with watchCondition().	676	// computed by tracking which conditions we track with watchCondition().
677	bool isSafeToLoad(JSObject* base, PropertyOffset);	677	bool isSafeToLoad(JSObject* base, PropertyOffset);
		678
		679	// Tells us what inferred type we are able to prove the property to have now and in the future.
		680	InferredType::Descriptor inferredTypeFor(const PropertyTypeKey&);
		681	InferredType::Descriptor inferredValueForProperty(Structure* structure, PropertyOffset offset)
		682	{
		683	return inferredTypeFor(PropertyTypeKey(structure, offset));
		684	}
		685
		686	AbstractValue inferredValueForProperty(
		687	const StructureSet& base, PropertyOffset, StructureClobberState);
		688
		689	// This uses either constant property inference or property type inference to derive a good abstract
		690	// value for some property accessed with the given abstract value base.
		691	AbstractValue inferredValueForProperty(
		692	const AbstractValue& base, PropertyOffset, StructureClobberState);
678		693
679	FullBytecodeLiveness& livenessFor(CodeBlock*);	694	FullBytecodeLiveness& livenessFor(CodeBlock*);
680	FullBytecodeLiveness& livenessFor(InlineCallFrame*);	695	FullBytecodeLiveness& livenessFor(InlineCallFrame*);
Lines 856-861 public: Source/JavaScriptCore/dfg/DFGGraph.h_sec2
856	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;	871	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
857	HashMap<CodeBlock*, std::unique_ptr<BytecodeKills>> m_bytecodeKills;	872	HashMap<CodeBlock*, std::unique_ptr<BytecodeKills>> m_bytecodeKills;
858	HashSet<std::pair<JSObject*, PropertyOffset>> m_safeToLoad;	873	HashSet<std::pair<JSObject*, PropertyOffset>> m_safeToLoad;
		874	HashMap<PropertyTypeKey, InferredType::Descriptor> m_inferredTypes;
859	Dominators m_dominators;	875	Dominators m_dominators;
860	PrePostNumbering m_prePostNumbering;	876	PrePostNumbering m_prePostNumbering;
861	NaturalLoops m_naturalLoops;	877	NaturalLoops m_naturalLoops;

Line 0 Source/JavaScriptCore/dfg/DFGPropertyTypeKey.h_sec1
- Source/JavaScriptCore/dfg/DFGPropertyTypeKey.h +123 lines
		1	/*
		2	* Copyright (C) 2015 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#ifndef DFGPropertyTypeKey_h
		27	#define DFGPropertyTypeKey_h
		28
		29	#if ENABLE(DFG_JIT)
		30
		31	#include <wtf/HashMap.h>
		32
		33	namespace JSC { namespace DFG {
		34
		35	// This object is a key for finding a property's type. It's a tuple of Structure* and PropertyOffset.
		36
		37	class PropertyTypeKey {
		38	public:
		39	PropertyTypeKey()
		40	: m_structure(nullptr)
		41	, m_offset(invalidOffset)
		42	{
		43	}
		44
		45	PropertyTypeKey(Structure* structure, PropertyOffset offset)
		46	: m_structure(structure)
		47	, m_offset(offset)
		48	{
		49	}
		50
		51	PropertyTypeKey(WTF::HashTableDeletedValueType)
		52	: m_object(nullptr)
		53	, m_offset(invalidOffset - 1)
		54	{
		55	}
		56
		57	explicit operator bool() const { return m_structure && m_offset != invalidOffset; }
		58
		59	Structure* structure() const { return m_structure; }
		60	PropertyOffset offset() const { return m_offset; }
		61
		62	bool operator==(const PropertyTypeKey& other) const
		63	{
		64	return m_structure == other.m_structure
65	&& m_offset == other.m_offset;
66	}
67
68	bool operator!=(const PropertyTypeKey& other) const
69	{
70	return !(*this == other);
71	}
72
73	unsigned hash() const
74	{
75	return WTF::PtrHash<Structure*>::hash(m_structure) + m_offset;
76	}
77
78	bool isHashTableDeletedValue() const
79	{
80	return !m_object && m_offset == invalidOffset - 1;
81	}
82
83	void dumpInContext(PrintStream& out, DumpContext* context) const
84	{
85	out.print(pointerDumpInContext(m_structure, context), "+", m_offset);
86	}
87
88	void dump(PrintStream& out) const
89	{
90	dumpInContext(out, context);
91	}
92
93	private:
94	Structure* m_structure;
95	PropertyOffset m_offset;
96	};
97
98	struct PropertyTypeKeyHash {
99	static unsigned hash(const PropertyTypeKey& key) { return key.hash(); }
100	static bool equal(const PropertyTypeKey& a, const PropertyTypeKey& b) { return a == b; }
101	static const bool safeToCompareToEmptyOrDeleted = true;
102	};
103
104	} } // namespace JSC::DFG
105
106	namespace WTF {
107
108	template<typename T> struct DefaultHash;
109	template<> struct DefaultHash<JSC::DFG::PropertyTypeKey> {
110	typedef JSC::DFG::PropertyTypeKeyHash Hash;
111	};
112
113	template<typename T> struct HashTraits;
114	template<> struct HashTraits<JSC::DFG::PropertyTypeKey> : SimpleClassHashTraits<JSC::DFG::PropertyTypeKey> {
115	static const bool emptyValueIsZero = false;
116	};
117
118	} // namespace WTF
119
120	#endif // ENABLE(DFG_JIT)
121
122	#endif // DFGPropertyTypeKey_h
123

Lines 55-60 Vector<BytecodeAndMachineOffset>& Assemb Source/JavaScriptCore/jit/AssemblyHelpers.cpp_sec1
- Source/JavaScriptCore/jit/AssemblyHelpers.cpp +69 lines
55	return result.iterator->value;	55	return result.iterator->value;
56	}	56	}
57		57
		58	AssemblyHelpers::JumpList AssemblyHelpers::branchIfNotType(
		59	JSValueRegs regs, GPRReg tempGPR, const InferredType::Descriptor& descriptor)
		60	{
		61	AssemblyHelpers::JumpList result;
		62
		63	switch (descriptor.kind()) {
		64	case InferredType::Bottom:
		65	result.append(jump());
		66	break;
		67
		68	case InferredType::Boolean:
		69	result.append(branchIfNotBoolean(regs, tempGPR));
		70	break;
		71
		72	case InferredType::Other:
		73	result.append(branchIfNotOther(regs, tempGPR));
		74	break;
		75
		76	case InferredType::Int32:
		77	result.append(branchIfNotInt32(regs));
		78	break;
		79
		80	case InferredType::Double:
		81	result.append(branchIfInt32(regs));
		82	result.append(branchIfNotNumber(regs));
		83	break;
		84
		85	case InferredType::Number:
		86	result.append(branchIfNotNumber(regs));
		87	break;
		88
		89	case InferredType::String:
		90	result.append(branchIfNotCell(regs));
		91	result.append(branchIfNotString(regs.payloadGPR()));
		92	break;
		93
		94	case InferredType::ObjectWithStructure:
		95	result.append(branchIfNotCell(regs));
		96	result.append(branchStructure(regs.payloadGPR(), descriptor.structure()));
		97	break;
		98
		99	case InferredType::ObjectWithStructureOrOther: {
		100	Jump ok = branchIfOther(regs, tempGPR);
		101	result.append(branchIfNotCell(regs));
		102	result.append(branchStructure(regs.payloadGPR(), descriptor.structure()));
		103	ok.link(this);
		104	break;
		105	}
		106
		107	case InferredType::Object:
		108	result.append(branchIfNotCell(regs));
		109	result.append(branchIfNotObject(regs.payloadGPR()));
		110	break;
		111
		112	case InferredType::ObjectOrOther: {
		113	Jump ok = branchIfOther(regs, tempGPR);
		114	result.append(branchIfNotCell(regs));
		115	result.append(branchIfNotObject(regs.payloadGPR()));
		116	ok.link(this);
		117	break;
		118	}
		119
		120	case InferredType::Top:
		121	break;
122	}
123
124	return result;
125	}
126
58	void AssemblyHelpers::purifyNaN(FPRReg fpr)	127	void AssemblyHelpers::purifyNaN(FPRReg fpr)
59	{	128	{
60	MacroAssembler::Jump notNaN = branchDouble(DoubleEqual, fpr, fpr);	129	MacroAssembler::Jump notNaN = branchDouble(DoubleEqual, fpr, fpr);

Lines 563-568 public: Source/JavaScriptCore/jit/AssemblyHelpers.h_sec1
- Source/JavaScriptCore/jit/AssemblyHelpers.h +12 lines
563	return branch32(Equal, regs.tagGPR(), TrustedImm32(JSValue::EmptyValueTag));	563	return branch32(Equal, regs.tagGPR(), TrustedImm32(JSValue::EmptyValueTag));
564	#endif	564	#endif
565	}	565	}
		566
		567	JumpList branchIfNotType(JSValueRegs regs, GPRReg tempGPR, const InferredType::Descriptor&);
		568
		569	template<typename T>
		570	Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)
		571	{
		572	#if USE(JSVALUE64)
		573	return branch32(condition, leftHandSide, TrustedImm32(structure->id()));
		574	#else
		575	return branchPtr(condition, leftHandSide, TrustedImmPtr(structure));
		576	#endif
		577	}
566		578
567	static Address addressForByteOffset(ptrdiff_t byteOffset)	579	static Address addressForByteOffset(ptrdiff_t byteOffset)
568	{	580	{

Lines 1259-1284 ALWAYS_INLINE void JIT::emitTagAsBoolImm Source/JavaScriptCore/jit/JITInlines.h_sec1
- Source/JavaScriptCore/jit/JITInlines.h -20 lines
1259		1259
1260	#endif // USE(JSVALUE32_64)	1260	#endif // USE(JSVALUE32_64)
1261		1261
1262	template <typename T>
1263	JIT::Jump JIT::branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)
1264	{
1265	#if USE(JSVALUE64)
1266	return branch32(condition, leftHandSide, TrustedImm32(structure->id()));
1267	#else
1268	return branchPtr(condition, leftHandSide, TrustedImmPtr(structure));
1269	#endif
1270	}
1271
1272	template <typename T>
1273	MacroAssembler::Jump branchStructure(MacroAssembler& jit, MacroAssembler::RelationalCondition condition, T leftHandSide, Structure* structure)
1274	{
1275	#if USE(JSVALUE64)
1276	return jit.branch32(condition, leftHandSide, MacroAssembler::TrustedImm32(structure->id()));
1277	#else
1278	return jit.branchPtr(condition, leftHandSide, MacroAssembler::TrustedImmPtr(structure));
1279	#endif
1280	}
1281
1282	} // namespace JSC	1262	} // namespace JSC
1283		1263
1284	#endif // ENABLE(JIT)	1264	#endif // ENABLE(JIT)

Line 0 Source/JavaScriptCore/runtime/InferredType.cpp_sec1
- Source/JavaScriptCore/runtime/InferredType.cpp +442 lines
		1	/*
		2	* Copyright (C) 2015 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "InferredType.h"
		28
		29	#include "JSCInlines.h"
		30
		31	namespace JSC {
		32
		33	const ClassInfo InferredType::s_info = { "InferredType", 0, 0, CREATE_METHOD_TABLE(InferredType) };
		34
		35	InferredType* InferredType::create(VM& vm)
		36	{
		37	InferredType* result = new (NotNull, allocateCell<InferredType>(vm.heap)) InferredType(vm);
		38	result->finishCreation(vm);
		39	return result;
		40	}
		41
		42	void InferredType::destroy(JSCell* cell)
		43	{
		44	InferredType* inferredType = static_cast<InferredType*>(cell);
		45	inferredType->InferredType::~InferredType();
		46	}
		47
		48	Structure* InferredType::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
		49	{
		50	return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
		51	}
		52
		53	void InferredType::visitChildren(JSCell* cell, SlotVisitor& visitor)
		54	{
		55	InferredType* inferredType = jsCast<InferredType*>(cell);
		56
		57	if (inferredType->m_structure)
		58	visitor.addUnconditionalFinalizer(inferredType->m_structure.get());
		59	}
		60
		61	InferredType::Descriptor InferredType::Descriptor::forValue(JSValue value)
		62	{
		63	if (value.isBoolean())
		64	return Boolean;
65	if (value.isUndefinedOrNull())
66	return Other;
67	if (value.isInt32())
68	return Int32;
69	if (value.isDouble())
70	return Double;
71	if (value.isCell()) {
72	JSCell* cell = value.asCell();
73	if (cell->isString())
74	return String;
75	if (cell->isObject()) {
76	if (cell->structure()->transitionWatchpointSetIsStillValid())
77	return Descriptor(ObjectWithStructure, cell->structure());
78	return Object;
79	}
80	}
81	return Top;
82	}
83
84	void InferredType::Descriptor::merge(const Descriptor& other)
85	{
86	if (*this == other)
87	return;
88
89	switch (m_kind) {
90	case Bottom:
91	*this = other;
92	return;
93	case Boolean:
94	case String:
95	*this = Top;
96	return;
97	case Other:
98	switch (other.m_kind) {
99	case ObjectWithStructure:
100	m_kind = ObjectWithStructureOrOther;
101	return;
102	case Object:
103	m_kind = ObjectOrOther;
104	return;
105	default:
106	*this = Top;
107	return;
108	}
109	case Int32:
110	switch (other.m_kind) {
111	case Double:
112	case Number:
113	m_kind = Number;
114	return;
115	default:
116	*this = Top;
117	return;
118	}
119	case Double:
120	switch (other.m_kind) {
121	case Int32:
122	case Number:
123	m_kind = Number;
124	return;
125	default:
126	*this = Top;
127	return;
128	}
129	case Number:
130	switch (other.m_kind) {
131	case Int32:
132	case Double:
133	return;
134	default:
135	*this = Top;
136	return;
137	}
138	case ObjectWithStructure:
139	switch (other.m_kind) {
140	case ObjectWithStructure:
141	case Object:
142	*this = Object;
143	return;
144	case ObjectWithStructureOrOther:
145	if (m_structure == other.m_structure) {
146	*this = other;
147	return;
148	}
149	*this = ObjectOrOther;
150	return;
151	case ObjectOrOther:
152	*this = ObjectOrOther;
153	return;
154	case Other:
155	m_kind = ObjectWithStructureOrOther;
156	return;
157	default:
158	*this = Top;
159	return;
160	}
161	case ObjectWithStructureOrOther:
162	switch (other.m_kind) {
163	case ObjectWithStructure:
164	if (m_structure == other.m_structure)
165	return;
166	*this = ObjectOrOther;
167	return;
168	case Object:
169	case ObjectWithStructureOrOther:
170	case ObjectOrOther:
171	*this = ObjectOrOther;
172	return;
173	case Other:
174	return;
175	default:
176	*this = Top;
177	return;
178	}
179	case Object:
180	switch (other.m_kind) {
181	case ObjectWithStructure:
182	return;
183	case ObjectWithStructureOrOther:
184	case ObjectOrOther:
185	case Other:
186	m_kind = ObjectOrOther;
187	return;
188	default:
189	*this = Top;
190	return;
191	}
192	case ObjectOrOther:
193	switch (other.m_kind) {
194	case ObjectWithStructure:
195	case ObjectWithStructureOrOther:
196	case Object:
197	case Other:
198	return;
199	default:
200	*this = Top;
201	return;
202	}
203	case Top:
204	return;
205	}
206
207	RELEASE_ASSERT_NOT_REACHED();
208	}
209
210	void InferredType::Descriptor::removeStructure()
211	{
212	switch (m_kind) {
213	case ObjectWithStructure:
214	*this = Object;
215	return;
216	case ObjectWithStructureOrOther:
217	*this = ObjectOrOther;
218	return;
219	default:
220	return;
221	}
222	}
223
224	bool InferredType::Descriptor::subsumes(const Descriptor& other) const
225	{
226	Descriptor merged = *this;
227	merged.merge(other);
228	return *this == merged;
229	}
230
231	void InferredType::Descriptor::dumpInContext(PrintStream& out, DumpContext* context) const
232	{
233	out.print(m_kind);
234	if (m_structure)
235	out.print(":", inContext(*m_structure, context));
236	}
237
238	void InferredType::Descriptor::dump(PrintStream& out) const
239	{
240	dumpInContext(out, nullptr);
241	}
242
243	InferredType::InferredType(VM& vm)
244	: Base(vm, vm.inferredTypeStructure.get())
245	, m_watchpointSet(ClearWatchpoint)
246	{
247	}
248
249	InferredType::~InferredType()
250	{
251	}
252
253	bool InferredType::isStillValid(const ConcurrentJITLocker& locker, const Descriptor& expected)
254	{
255	if (expected.kind() == Top)
256	return false;
257
258	return descriptor(locker) == expected;
259	}
260
261	bool InferredType::isStillValid(const Descriptor& expected)
262	{
263	ConcurrentJITLocker locker(m_lock);
264	return isStillValid(locker, expected);
265	}
266
267	void InferredType::addWatchpoint(const ConcurrentJITLocker& locker, Watchpoint* watchpoint)
268	{
269	RELEASE_ASSERT(descriptor(locker).kind() != Top);
270
271	m_watchpointSet.add(watchpoint);
272	}
273
274	void InferredType::addWatchpoint(Watchpoint* watchpoint)
275	{
276	ConcurrentJITLocker locker(m_lock);
277	addWatchpoint(locker, watchpoint);
278	}
279
280	void InferredType::dump(PrintStream& out) const
281	{
282	out.print(RawPointer(this), ":", descriptor());
283	}
284
285	void InferredType::willStoreValueSlow(const ConcurrentJITLocker& locker, VM& vm, JSValue value)
286	{
287	Descriptor myType = descriptor(locker);
288	Descriptor otherType = Descriptor::forValue(value);
289
290	myType.merge(otherType);
291
292	ASSERT(descriptor(locker) != myType); // The type must have changed if we're on the slow path.
293
294	set(locker, vm, myType);
295	}
296
297	void InferredType::makeTop(VM& vm)
298	{
299	ConcurrentJITLocker locker(m_lock);
300	set(locker, vm, Top);
301	}
302
303	void InferredType::set(const ConcurrentJITLocker& locker, VM& vm, Descriptor newDescriptor)
304	{
305	// We will trigger write barriers while holding our lock. Currently, write barriers don't GC, but that
306	// could change. If it does, we don't want to deadlock. Note that we could have used
307	// GCSafeConcurrentJITLocker in the caller, but the caller is on a fast path so maybe that wouldn't be
308	// a good idea.
309	DeferGCForAWhile deferGC(vm.heap);
310
311	// Be defensive: if we're not really changing the type, then we don't have to do anything.
312	if (descriptor(locker) == newDescriptor)
313	return;
314
315	// The new descriptor must be more general than the previous one.
316	ASSERT(newDescriptor.subsumes(descriptor(locker)));
317
318	// If the new descriptors have different structures, then it can only be because one is null.
319	if (descriptor(locker).structure() != newDescriptor.structure())
320	ASSERT(!descriptor(locker).structure() \|\| !newDescriptor.structure());
321
322	// We are changing the type, so make sure that if anyone was watching, they find out about it now. If
323	// anyone is watching, we make sure to go to Top so that we don't do this sort of thing again.
324	if (m_watchpointSet.state() != ClearWatchpoint) {
325	// We cannot have been invalidated, since if we were, then we'd already be at Top.
326	ASSERT(m_watchpointSet.state() != IsInvalidated);
327
328	// We're about to do expensive things because some compiler thread decided to watch this type and
329	// then the type changed. Assume that this property is crazy, and don't ever do any more things for
330	// it.
331	newDescriptor = Top;
332
333	m_watchpointSet.fireAll("Inferred type changed");
334	}
335
336	// Remove the old InferredStructure object if we no longer need it.
337	if (!newDescriptor.structure())
338	m_structure = nullptr;
339
340	// Add a new InferredStructure object if we need one now.
341	if (newDescriptor.structure()) {
342	if (m_structure) {
343	// We should agree on the structures if we get here.
344	ASSERT(newDescriptor.structure() == m_structure->structure());
345	} else {
346	m_structure = std::make_unique<InferredStructure>(this, newDescriptor.structure());
347	newDescriptor.structure()->addTransitionWatchpoint(m_structure.get());
348	}
349	}
350
351	// Finally, set the descriptor kind.
352	m_kind = newDescriptor.kind();
353
354	// Assert that we did things.
355	ASSERT(descriptor(locker) == newDescriptor);
356	}
357
358	void InferredType::removeStructure()
359	{
360	VM& vm = *Heap::heap(this)->vm();
361
362	ConcurrentJITLocker locker(m_parent->m_lock);
363
364	Descriptor newDescriptor = descriptor(locker);
365	newDescriptor.removeStructure();
366
367	set(locker, vm, newDescriptor);
368	}
369
370	void InferredType::InferredStructure::InferredStructure(InferredType* parent, Structure* structure)
371	: m_parent(parent)
372	, m_structure(vm, parent, structure)
373	{
374	}
375
376	void InferredType::InferredStructure::fireInternal(const FireDetail&)
377	{
378	m_parent->removeStructure();
379	}
380
381	void InferredType::InferredStructure::finalizeUnconditionally()
382	{
383	VM& vm = *Heap::heap(m_parent)->vm();
384
385	ASSERT(Heap::isMarked(m_parent));
386
387	if (!Heap::isMarked(m_structure.get()))
388	m_parent->removeStructure();
389	}
390
391	} // namespace JSC
392
393	namespace WTF {
394
395	using namespace JSC;
396
397	void printInternal(PrintStream& out, InferredType::Kind kind)
398	{
399	switch (kind) {
400	case InferredType::Bottom:
401	out.print("Bottom");
402	return;
403	case InferredType::Boolean:
404	out.print("Boolean");
405	return;
406	case InferredType::Other:
407	out.print("Other");
408	return;
409	case InferredType::Int32:
410	out.print("Int32");
411	return;
412	case InferredType::Double:
413	out.print("Double");
414	return;
415	case InferredType::Number:
416	out.print("Number");
417	return;
418	case InferredType::String:
419	out.print("String");
420	return;
421	case InferredType::ObjectWithStructure:
422	out.print("ObjectWithStructure");
423	return;
424	case InferredType::ObjectWithStructureOrOther:
425	out.print("ObjectWithStructureOrOther");
426	return;
427	case InferredType::Object:
428	out.print("Object");
429	return;
430	case InferredType::ObjectOrOther:
431	out.print("ObjectOrOther");
432	return;
433	case InferredType::Top:
434	out.print("Top");
435	return;
436	}
437
438	RELEASE_ASSERT_NOT_REACHED();
439	}
440
441	} // namespace WTF
442

Lines 81-91 struct PropertyMapEntry { Source/JavaScriptCore/runtime/Structure.h_sec1
- Source/JavaScriptCore/runtime/Structure.h +56 lines
81	UniquedStringImpl* key;	81	UniquedStringImpl* key;
82	PropertyOffset offset;	82	PropertyOffset offset;
83	uint8_t attributes;	83	uint8_t attributes;
		84	bool hasInferredType; // This caches whether or not a property has an inferred type in the inferred type table, and is used for a fast check in JSObject::putDirectInternal().
84		85
85	PropertyMapEntry()	86	PropertyMapEntry()
86	: key(nullptr)	87	: key(nullptr)
87	, offset(invalidOffset)	88	, offset(invalidOffset)
88	, attributes(0)	89	, attributes(0)
		90	, hasInferredType(false)
89	{	91	{
90	}	92	}
91		93
Lines 93-98 struct PropertyMapEntry { Source/JavaScriptCore/runtime/Structure.h_sec2
93	: key(key)	95	: key(key)
94	, offset(offset)	96	, offset(offset)
95	, attributes(attributes)	97	, attributes(attributes)
		98	, hasInferredType(false)
96	{	99	{
97	ASSERT(this->attributes == attributes);	100	ASSERT(this->attributes == attributes);
98	}	101	}
Lines 323-328 public: Source/JavaScriptCore/runtime/Structure.h_sec3
323		326
324	PropertyOffset get(VM&, PropertyName);	327	PropertyOffset get(VM&, PropertyName);
325	PropertyOffset get(VM&, PropertyName, unsigned& attributes);	328	PropertyOffset get(VM&, PropertyName, unsigned& attributes);
		329	PropertyOffset get(VM&, PropertyName, unsigned& attributes, bool& hasInferredType);
326		330
327	// This is a somewhat internalish method. It will call your functor while possibly holding the	331	// This is a somewhat internalish method. It will call your functor while possibly holding the
328	// Structure's lock. There is no guarantee whether the lock is held or not in any particular	332	// Structure's lock. There is no guarantee whether the lock is held or not in any particular
Lines 477-482 public: Source/JavaScriptCore/runtime/Structure.h_sec4
477	structure->startWatchingInternalPropertiesIfNecessary(vm);	481	structure->startWatchingInternalPropertiesIfNecessary(vm);
478	}	482	}
479		483
		484	bool hasInferredTypes() const
		485	{
		486	return !!m_inferredTypeTable;
		487	}
		488
		489	InferredType* inferredTypeForOffset(PropertyOffset offset)
		490	{
		491	if (InferredTypeTable* table = m_inferredTypeTable.get())
		492	return table->get(offset);
		493	return nullptr;
		494	}
		495
		496	// Returns true if the type of the property is still valid.
		497	ALWAYS_INLINE bool willStoreValue(VM& vm, PropertyOffset offset, JSValue value)
		498	{
		499	InferredTypeTable* table = m_inferredTypeTable.get();
		500	if (LIKELY(!table))
		501	return false;
		502	bool result = table->willStoreValue(vm, offset, value);
		503	if (table->isEmpty())
		504	m_inferredTypeTable.clear();
		505	return result;
		506	}
		507
		508	// Returns false always, to match the return value semantics of willStoreValue(): if it returns false,
		509	// then the property type is invalid (which is always).
		510	ALWAYS_INLINE bool makeTop(VM& vm, PropertyOffset offset)
		511	{
		512	InferredTypeTable* table = m_inferredTypeTable.get();
		513	if (LIKELY(!table))
		514	return false;
		515	table->makeTop(vm, offset);
		516	if (table->isEmpty())
		517	m_inferredTypeTable.clear();
		518	return false;
		519	}
		520
		521	void updateHasInferredTypeForProperty(VM&, PropertyName);
		522
		523	ALWAYS_INLINE void createInferredTypeForNewProperty(VM& vm, PropertyName propertyName, JSValue value)
		524	{
		525	// FIXME: These conditions could probably be refined.
		526	if (isDictionary() \|\| transitionWatchpointIsLikelyToBeFired())
		527	return;
		528
		529	createInferredTypeForNewPropertySlow(vm, propertyName, value);
		530	}
		531
480	PassRefPtr<StructureShape> toStructureShape(JSValue);	532	PassRefPtr<StructureShape> toStructureShape(JSValue);
481		533
482	// Determines if the two structures match enough that this one could be used for allocations	534	// Determines if the two structures match enough that this one could be used for allocations
Lines 627-632 private: Source/JavaScriptCore/runtime/Structure.h_sec5
627		679
628	void startWatchingInternalProperties(VM&);	680	void startWatchingInternalProperties(VM&);
629		681
		682	void createInferredTypeForNewPropertySlow(VM&, PropertyName, JSValue);
		683
630	static const int s_maxTransitionLength = 64;	684	static const int s_maxTransitionLength = 64;
631	static const int s_maxTransitionLengthForNonEvalPutById = 512;	685	static const int s_maxTransitionLengthForNonEvalPutById = 512;
632		686
Lines 650-655 private: Source/JavaScriptCore/runtime/Structure.h_sec6
650	// Should be accessed through propertyTable(). During GC, it may be set to 0 by another thread.	704	// Should be accessed through propertyTable(). During GC, it may be set to 0 by another thread.
651	WriteBarrier<PropertyTable> m_propertyTableUnsafe;	705	WriteBarrier<PropertyTable> m_propertyTableUnsafe;
652		706
		707	WriteBarrier<InferredTypeTable> m_inferredTypeTable;
		708
653	mutable InlineWatchpointSet m_transitionWatchpointSet;	709	mutable InlineWatchpointSet m_transitionWatchpointSet;
654		710
655	COMPILE_ASSERT(firstOutOfLineOffset < 256, firstOutOfLineOffset_fits);	711	COMPILE_ASSERT(firstOutOfLineOffset < 256, firstOutOfLineOffset_fits);

Lines 86-91 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec1
- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj -4 / +28 lines
86	0F04396E1B03DC0B009598B7 /* DFGCombinedLiveness.h in Headers / = {isa = PBXBuildFile; fileRef = 0F04396C1B03DC0B009598B7 / DFGCombinedLiveness.h */; settings = {ATTRIBUTES = (Private, ); }; };	86	0F04396E1B03DC0B009598B7 /* DFGCombinedLiveness.h in Headers / = {isa = PBXBuildFile; fileRef = 0F04396C1B03DC0B009598B7 / DFGCombinedLiveness.h */; settings = {ATTRIBUTES = (Private, ); }; };
87	0F05C3B41683CF9200BAF45B /* DFGArrayifySlowPathGenerator.h in Headers / = {isa = PBXBuildFile; fileRef = 0F05C3B21683CF8F00BAF45B / DFGArrayifySlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };	87	0F05C3B41683CF9200BAF45B /* DFGArrayifySlowPathGenerator.h in Headers / = {isa = PBXBuildFile; fileRef = 0F05C3B21683CF8F00BAF45B / DFGArrayifySlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
88	0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0776BD14FF002800102332 / JITCompilationEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };	88	0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0776BD14FF002800102332 / JITCompilationEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };
		89	0F0A75221B94BFA900110660 /* InferredType.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F0A75201B94BFA900110660 / InferredType.cpp */; };
		90	0F0A75231B94BFA900110660 /* InferredType.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0A75211B94BFA900110660 / InferredType.h */; settings = {ATTRIBUTES = (Private, ); }; };
89	0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F0B839714BCF45A00885B4F / LLIntThunks.cpp */; };	91	0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F0B839714BCF45A00885B4F / LLIntThunks.cpp */; };
90	0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0B839814BCF45A00885B4F / LLIntThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };	92	0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0B839814BCF45A00885B4F / LLIntThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };
91	0F0B83A714BCF50700885B4F /* CodeType.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0B83A514BCF50400885B4F / CodeType.h */; settings = {ATTRIBUTES = (Private, ); }; };	93	0F0B83A714BCF50700885B4F /* CodeType.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0B83A514BCF50400885B4F / CodeType.h */; settings = {ATTRIBUTES = (Private, ); }; };
Lines 754-759 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec2
754	0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers / = {isa = PBXBuildFile; fileRef = 65987F2C167FE84B003C2F8D / DFGOSRExitCompilationInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };	756	0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers / = {isa = PBXBuildFile; fileRef = 65987F2C167FE84B003C2F8D / DFGOSRExitCompilationInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
755	0FFB921D16D02F300055A5DB /* DFGSlowPathGenerator.h in Headers / = {isa = PBXBuildFile; fileRef = 0F1E3A501537C2CB000F9456 / DFGSlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };	757	0FFB921D16D02F300055A5DB /* DFGSlowPathGenerator.h in Headers / = {isa = PBXBuildFile; fileRef = 0F1E3A501537C2CB000F9456 / DFGSlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
756	0FFB922016D033B70055A5DB /* NodeConstructors.h in Headers / = {isa = PBXBuildFile; fileRef = 930DAD030FB1EB1A0082D205 / NodeConstructors.h */; settings = {ATTRIBUTES = (Private, ); }; };	758	0FFB922016D033B70055A5DB /* NodeConstructors.h in Headers / = {isa = PBXBuildFile; fileRef = 930DAD030FB1EB1A0082D205 / NodeConstructors.h */; settings = {ATTRIBUTES = (Private, ); }; };
		759	0FFC92111B94D4DF0071DD66 /* InferredTypeTable.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0FFC920F1B94D4DF0071DD66 / InferredTypeTable.cpp */; };
		760	0FFC92121B94D4DF0071DD66 /* InferredTypeTable.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC92101B94D4DF0071DD66 / InferredTypeTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
		761	0FFC92141B94E83E0071DD66 /* DFGDesiredInferredType.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC92131B94E83E0071DD66 / DFGDesiredInferredType.h */; };
		762	0FFC92161B94FB3E0071DD66 /* DFGPropertyTypeKey.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC92151B94FB3E0071DD66 / DFGPropertyTypeKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
757	0FFC99D1184EC8AD009C10AB /* ConstantMode.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC99D0184EC8AD009C10AB / ConstantMode.h */; settings = {ATTRIBUTES = (Private, ); }; };	763	0FFC99D1184EC8AD009C10AB /* ConstantMode.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC99D0184EC8AD009C10AB / ConstantMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
758	0FFC99D4184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0FFC99D2184EE318009C10AB / ArrayBufferNeuteringWatchpoint.cpp */; };	764	0FFC99D4184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0FFC99D2184EE318009C10AB / ArrayBufferNeuteringWatchpoint.cpp */; };
759	0FFC99D5184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC99D3184EE318009C10AB / ArrayBufferNeuteringWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };	765	0FFC99D5184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC99D3184EE318009C10AB / ArrayBufferNeuteringWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
Lines 1907-1912 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec3
1907	0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCombinedLiveness.h; path = dfg/DFGCombinedLiveness.h; sourceTree = "<group>"; };	1913	0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCombinedLiveness.h; path = dfg/DFGCombinedLiveness.h; sourceTree = "<group>"; };
1908	0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArrayifySlowPathGenerator.h; path = dfg/DFGArrayifySlowPathGenerator.h; sourceTree = "<group>"; };	1914	0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArrayifySlowPathGenerator.h; path = dfg/DFGArrayifySlowPathGenerator.h; sourceTree = "<group>"; };
1909	0F0776BD14FF002800102332 /* JITCompilationEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCompilationEffort.h; sourceTree = "<group>"; };	1915	0F0776BD14FF002800102332 /* JITCompilationEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCompilationEffort.h; sourceTree = "<group>"; };
		1916	0F0A75201B94BFA900110660 /* InferredType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredType.cpp; sourceTree = "<group>"; };
		1917	0F0A75211B94BFA900110660 /* InferredType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredType.h; sourceTree = "<group>"; };
1910	0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntThunks.cpp; path = llint/LLIntThunks.cpp; sourceTree = "<group>"; };	1918	0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntThunks.cpp; path = llint/LLIntThunks.cpp; sourceTree = "<group>"; };
1911	0F0B839814BCF45A00885B4F /* LLIntThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntThunks.h; path = llint/LLIntThunks.h; sourceTree = "<group>"; };	1919	0F0B839814BCF45A00885B4F /* LLIntThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntThunks.h; path = llint/LLIntThunks.h; sourceTree = "<group>"; };
1912	0F0B83A514BCF50400885B4F /* CodeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeType.h; sourceTree = "<group>"; };	1920	0F0B83A514BCF50400885B4F /* CodeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeType.h; sourceTree = "<group>"; };
Lines 2572-2577 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec4
2572	0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = JSCLLIntOffsetsExtractor; sourceTree = BUILT_PRODUCTS_DIR; };	2580	0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = JSCLLIntOffsetsExtractor; sourceTree = BUILT_PRODUCTS_DIR; };
2573	0FFB6C361AF48DDC00DB1BF7 /* TypeofType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypeofType.cpp; sourceTree = "<group>"; };	2581	0FFB6C361AF48DDC00DB1BF7 /* TypeofType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypeofType.cpp; sourceTree = "<group>"; };
2574	0FFB6C371AF48DDC00DB1BF7 /* TypeofType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeofType.h; sourceTree = "<group>"; };	2582	0FFB6C371AF48DDC00DB1BF7 /* TypeofType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeofType.h; sourceTree = "<group>"; };
		2583	0FFC920F1B94D4DF0071DD66 /* InferredTypeTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredTypeTable.cpp; sourceTree = "<group>"; };
		2584	0FFC92101B94D4DF0071DD66 /* InferredTypeTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredTypeTable.h; sourceTree = "<group>"; };
		2585	0FFC92131B94E83E0071DD66 /* DFGDesiredInferredType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDesiredInferredType.h; path = dfg/DFGDesiredInferredType.h; sourceTree = "<group>"; };
		2586	0FFC92151B94FB3E0071DD66 /* DFGPropertyTypeKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPropertyTypeKey.h; path = dfg/DFGPropertyTypeKey.h; sourceTree = "<group>"; };
2575	0FFC99D0184EC8AD009C10AB /* ConstantMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstantMode.h; sourceTree = "<group>"; };	2587	0FFC99D0184EC8AD009C10AB /* ConstantMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstantMode.h; sourceTree = "<group>"; };
2576	0FFC99D2184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayBufferNeuteringWatchpoint.cpp; sourceTree = "<group>"; };	2588	0FFC99D2184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayBufferNeuteringWatchpoint.cpp; sourceTree = "<group>"; };
2577	0FFC99D3184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayBufferNeuteringWatchpoint.h; sourceTree = "<group>"; };	2589	0FFC99D3184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayBufferNeuteringWatchpoint.h; sourceTree = "<group>"; };

Lines 75-93 inline Structure* Structure::storedProto Source/JavaScriptCore/runtime/StructureInlines.h_sec1
- Source/JavaScriptCore/runtime/StructureInlines.h -9 / +10 lines
75		75
76	ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName)	76	ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName)
77	{	77	{
78	ASSERT(!isCompilationThread());	78	unsigned attributes;
79	ASSERT(structure()->classInfo() == info());	79	bool hasInferredType;
80	PropertyTable* propertyTable;	80	return get(vm, propertyName, attributes, hasInferredType);
81	materializePropertyMapIfNecessary(vm, propertyTable);
82	if (!propertyTable)
83	return invalidOffset;
84
85	PropertyMapEntry* entry = propertyTable->get(propertyName.uid());
86	return entry ? entry->offset : invalidOffset;
87	}	81	}
88		82
89	ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes)	83	ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes)
90	{	84	{
		85	bool hasInferredType;
		86	return get(vm, propertyName, attributes, hasInferredType);
		87	}
		88
		89	ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes, bool& hasInferredType)
		90	{
91	ASSERT(!isCompilationThread());	91	ASSERT(!isCompilationThread());
92	ASSERT(structure()->classInfo() == info());	92	ASSERT(structure()->classInfo() == info());
93		93
Lines 101-106 ALWAYS_INLINE PropertyOffset Structure:: Source/JavaScriptCore/runtime/StructureInlines.h_sec2
101	return invalidOffset;	101	return invalidOffset;
102		102
103	attributes = entry->attributes;	103	attributes = entry->attributes;
		104	hasInferredType = entry->hasInferredType;
104	return entry->offset;	105	return entry->offset;
105	}	106	}
106		107