Attachment #260955 for bug #148610

View Details Raw Unified Return to Bug 148610

| Differences between

and this patch



    {
        touch(StringFireDetail(reason));
    }

    // Note that for any watchpoint that is visible from the DFG, it would be incorrect to write code like:
    //
    // if (w.isBeingWatched())
    //     w.fireAll()
    //
    // Concurrently to this, the DFG could do:
    //
    // if (w.isStillValid())
    //     perform optimizations;
    // if (!w.isStillValid())
    //     retry compilation;
    //
    // Note that the DFG algorithm is widespread, and sound, because fireAll() and invalidate() will leave
    // the watchpoint in a !isStillValid() state. Hence, if fireAll() or invalidate() interleaved between
    // the first isStillValid() check and the second one, then it would simply cause the DFG to retry
    // compilation later.
    //
    // But, if you change some piece of state that the DFG might optimize for, but invalidate the
    // watchpoint by doing:
    //
    // if (w.isBeingWatched())
    //     w.fireAll()
    //
    // then the DFG would never know that you invalidated state between the two checks.
    //
    // There are two ways to work around this:
    //
    // - Call fireAll() without a isBeingWatched() check. Then, the DFG will know that the watchpoint has
    //   been invalidated when it does its second check.
    //
    // - Do not expose the watchpoint set to the DFG directly, and have your own way of validating whether
    //   the assumptions that the DFG thread used are still valid when the DFG code is installed.
    bool isBeingWatched() const
    {
        if (isFat())



    void dump(PrintStream& out);
    
    template<typename T>
    FiltrationResult filter(T node, const StructureSet& set, SpeculatedType admittedTypes = SpecNone)
    {
        return filter(forNode(node), set, admittedTypes);
    }
    
    template<typename T>

        return filterByValue(forNode(node), value);
    }
    
    FiltrationResult filter(AbstractValue&, const StructureSet&, SpeculatedType admittedTypes = SpecNone);
    FiltrationResult filterArrayModes(AbstractValue&, ArrayModes);
    FiltrationResult filter(AbstractValue&, SpeculatedType);
    FiltrationResult filterByValue(AbstractValue&, FrozenValue);



        }
        
        AbstractValue& value = forNode(node->child1());
        if (value.m_structure.isFinite()
            && (node->child1().useKind() == CellUse || !(value.m_type & ~SpecCell))) {
            UniquedStringImpl* uid = m_graph.identifiers()[node->identifierNumber()];
            GetByIdStatus status = GetByIdStatus::computeFor(value.m_structure.set(), uid);
            if (status.isSimple()) {
                // Figure out what the result is going to be - is it TOP, a constant, or maybe
                // something more subtle?

                    // This thing won't give us a variant that involves prototypes. If it did, we'd
                    // have more work to do here.
                    DFG_ASSERT(m_graph, node, status[i].conditionSet().isEmpty());

                    result.merge(
                        m_graph.inferredValueForProperty(
                            value, uid, status[i].offset(), m_graph.structureClobberState()));
                        result.makeHeapTop();
                        break;
                    }
                    
                    AbstractValue thisResult;
                    thisResult.set(
                        m_graph, *m_graph.freeze(constantResult),
                        m_state.structureClobberState());
                    result.merge(thisResult);
                }
                m_state.setFoundConstants(true);
                    m_state.setFoundConstants(true);
                forNode(node) = result;
                break;
            }

        
    case CheckStructure: {
        AbstractValue& value = forNode(node->child1());
        ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.

        StructureSet& set = node->structureSet();
        

        // that includes the set we're testing. In that case we could make the structure check
        // more efficient. We currently don't.
        
        if (value.m_structure.isSubsetOf(set))
            m_state.setFoundConstants(true);

        SpeculatedType admittedTypes = SpecNone;
        switch (node->child1().useKind()) {
        case CellUse:
            admittedTypes = SpecNone;
            break;
        case CellOrOther:
            admittedTypes = SpecOther;
            break;
        default:
            DFG_CRASH(m_graph, node, "Bad use kind");
            break;
        }
        
        filter(value, set, admittedTypes);
        break;
    }
        

        
    case GetByOffset: {
        StorageAccessData& data = node->storageAccessData();
        UniquedStringImpl* uid = m_graph.identifiers()[data.identifierNumber];

        // FIXME: The part of this that handles inferred property types relies on AI knowing the structure
        // right now. That's probably not optimal. In some cases, we may perform an optimization (usually
        // by something other than AI, maybe by CSE for example) that obscures AI's view of the structure
        // at the point where GetByOffset runs. Currently, when that happens, we'll have to rely entirely
        // on the type that ByteCodeParser was able to prove.
        AbstractValue value = m_graph.inferredValueForProperty(
            forNode(node->child2()), uid, data.offset, m_state.structureClobberState());

        // It's possible that the type that ByteCodeParser came up with is better.
        AbstractValue typeFromParsing;
        typeFromParsing.set(m_graph, data->inferredType, m_state.structureClobberState());
        value.filter(typeFromParsing);

        // If we decide that there does not exist any value that this can return, then it's probably
        // because the compilation was already invalidated.
        if (value.isClear())
            m_state.setIsValid(false);

        forNode(node) = value;
        if (value.m_value)
            m_state.setFoundConstants(true);
        break;
    }
        

        // because of the effect on compile times, but this node is FTL-only.
        m_state.setFoundConstants(true);
        
        UniquedStringImpl* uid = m_graph.identifiers()[node->multiGetByOffsetData().identifierNumber];

        AbstractValue base = forNode(node->child1());
        StructureSet baseSet;
        AbstractValue result;

            if (set.isEmpty())
                continue;
            baseSet.merge(set);

            switch (getCase.method().kind()) {
            case GetByOffsetMethod::Constant: {
                AbstractValue thisResult;
                thisResult.set(
                    m_graph,
                    *getCase.method().constant(),
                    m_state.structureClobberState());
                result.merge(thisResult);
                break;
            }

            case GetByOffetMethod::Load: {
                result.merge(
                    m_graph.inferredValueForProperty(
                        set, uid, getCase.method().offset(), m_graph.structureClobberState()));
                break;
            }

            default: {
                result.makeHeapTop();
                break;
            } }
        }
        
        if (forNode(node->child1()).changeStructure(m_graph, baseSet) == Contradiction)


template<typename AbstractStateType>
FiltrationResult AbstractInterpreter<AbstractStateType>::filter(
    AbstractValue& value, const StructureSet& set, SpeculatedType admittedTypes)
{
    if (value.filter(m_graph, set, admittedTypes) == FiltrationOK)
        return FiltrationOK;
    m_state.setIsValid(false);
    return Contradiction;



    checkConsistency();
}

void AbstractValue::set(Graph& graph, const InferredType::Descriptor& descriptor)
{
    switch (descriptor.kind()) {
    case InferredType::Bottom:
        clear();
        return;
    case InferredType::Boolean:
        setType(SpecBoolean);
        return;
    case InferredType::Other:
        setType(SpecOther);
        return;
    case InferredType::Int32:
        setType(SpecInt32);
        return;
    case InferredType::Double:
        setType(SpecBytecodeDouble);
        return;
    case InferredType::Number:
        setType(SpecBytecodeNumber);
        return;
    case InferredType::String:
        set(graph, graph.m_vm.stringStructure.get());
        return;
    case InferredType::ObjectWithStructure:
        set(graph, descriptor.structure());
        return;
    case InferredType::ObjectWithStructureOrOther:
        set(graph, descriptor.structure());
        merge(SpecOther);
        return;
    case InferredType::Object:
        setType(graph, SpecObject);
        return;
    case InferredType::ObjectOrOther:
        setType(graph, SpecObject | SpecOther);
        return;
    case InferredType::Top:
        makeHeapTop();
        return;
    }

    RELEASE_ASSERT_NOT_REACHED();
}

void AbstractValue::set(
    Graph& graph, const InferredType::Descriptor& descriptor, StructureClobberState clobberState)
{
    set(graph, descriptor);
    if (clobberState == StructuresAreClobbered)
        clobberStructures();
}

void AbstractValue::fixTypeForRepresentation(Graph& graph, NodeFlags representation, Node* node)
{
    if (representation == NodeResultDouble) {

    return oldMe != *this;
}

FiltrationResult AbstractValue::filter(
    Graph& graph, const StructureSet& other, SpeculatedType admittedTypes)
{
    ASSERT(!(admittedTypes & SpecCell));
    
    if (isClear())
        return FiltrationOK;
    

    // having structures, array modes, or a specific value.
    // https://bugs.webkit.org/show_bug.cgi?id=109663
    
    m_type &= other.speculationFromStructures() | admittedTypes;
    m_arrayModes &= other.arrayModesFromStructures();
    m_structure.filter(other);
    

Lines 34-39 Source/JavaScriptCore/dfg/DFGAbstractValue.h_sec1
- Source/JavaScriptCore/dfg/DFGAbstractValue.h -2 / +12 lines
34	#include "DFGNodeFlags.h"	34	#include "DFGNodeFlags.h"
35	#include "DFGStructureAbstractValue.h"	35	#include "DFGStructureAbstractValue.h"
36	#include "DFGStructureClobberState.h"	36	#include "DFGStructureClobberState.h"
		37	#include "InferredType.h"
37	#include "JSCell.h"	38	#include "JSCell.h"
38	#include "SpeculatedType.h"	39	#include "SpeculatedType.h"
39	#include "DumpContext.h"	40	#include "DumpContext.h"
Lines 214-220 struct AbstractValue { Source/JavaScriptCore/dfg/DFGAbstractValue.h_sec2
214	m_value = JSValue();	215	m_value = JSValue();
215	checkConsistency();	216	checkConsistency();
216	}	217	}
217		218
		219	void set(Graph&, const InferredType::Descriptor&);
		220	void set(Graph&, const InferredType::Descriptor&, StructureClobberState);
		221
218	void fixTypeForRepresentation(Graph&, NodeFlags representation, Node* = nullptr);	222	void fixTypeForRepresentation(Graph&, NodeFlags representation, Node* = nullptr);
219	void fixTypeForRepresentation(Graph&, Node*);	223	void fixTypeForRepresentation(Graph&, Node*);
220		224
Lines 280-287 struct AbstractValue { Source/JavaScriptCore/dfg/DFGAbstractValue.h_sec3
280	{	284	{
281	return !(m_type & ~desiredType);	285	return !(m_type & ~desiredType);
282	}	286	}
		287
		288	// Filters the value using the given structure set. If the admittedTypes argument is not passed, this
		289	// implicitly filters by the types implied by the structure set, which are usually a subset of
		290	// SpecCell. Hence, after this call, the value will no longer have any non-cell members. But, you can
		291	// use admittedTypes to preserve some non-cell types. Note that it's wrong for admittedTypes to overlap
		292	// with SpecCell.
		293	FiltrationResult filter(Graph&, const StructureSet&, SpeculatedType admittedTypes = SpecNone);
283		294
284	FiltrationResult filter(Graph&, const StructureSet&);
285	FiltrationResult filterArrayModes(ArrayModes);	295	FiltrationResult filterArrayModes(ArrayModes);
286	FiltrationResult filter(SpeculatedType);	296	FiltrationResult filter(SpeculatedType);
287	FiltrationResult filterByValue(const FrozenValue& value);	297	FiltrationResult filterByValue(const FrozenValue& value);



    bool handleTypedArrayConstructor(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, TypedArrayType, const ChecksFunctor& insertChecks);
    template<typename ChecksFunctor>
    bool handleConstantInternalFunction(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, CodeSpecializationKind, const ChecksFunctor& insertChecks);
    Node* handlePutByOffset(Node* base, unsigned identifier, PropertyOffset, const InferredType::Descriptor&, Node* value);
    Node* handleGetByOffset(SpeculatedType, Node* base, unsigned identifierNumber, PropertyOffset, const InferredType::Descriptor&, NodeType = GetByOffset);
    Node* handleGetByOffset(SpeculatedType, Node* base, UniquedStringImpl*, PropertyOffset, NodeType = GetByOffset);

    // Create a presence ObjectPropertyCondition based on some known offset and structure set. Does not
    // check the validity of the condition, but it may return a null one if it encounters a contradiction.

    return false;
}

Node* ByteCodeParser::handleGetByOffset(
    SpeculatedType prediction, Node* base, unsigned identifierNumber, PropertyOffset offset,
    const InferredType::Descriptor& inferredType, NodeType op)
{
    Node* propertyStorage;
    if (isInlineOffset(offset))

    StorageAccessData* data = m_graph.m_storageAccessData.add();
    data->offset = offset;
    data->identifierNumber = identifierNumber;
    data->inferredType = inferredType;
    
    Node* getByOffset = addToGraph(op, OpInfo(data), OpInfo(prediction), propertyStorage, base);

    return getByOffset;
}

Node* ByteCodeParser::handlePutByOffset(
    Node* base, unsigned identifier, PropertyOffset offset, const InferredType::Descriptor& inferredType,
    Node* value)
{
    Node* propertyStorage;
    if (isInlineOffset(offset))

    StorageAccessData* data = m_graph.m_storageAccessData.add();
    data->offset = offset;
    data->identifierNumber = identifier;
    data->inferredType = inferredType;
    
    Node* result = addToGraph(PutByOffset, OpInfo(data), propertyStorage, base, value);
    

        return addToGraph(JSConstant, OpInfo(method.constant()));
    case GetByOffsetMethod::LoadFromPrototype: {
        Node* baseNode = addToGraph(JSConstant, OpInfo(method.prototype()));
        return handleGetByOffset(
            prediction, baseNode, identifierNumber, method.offset(), InferredType::Top, op);
    }
    case GetByOffsetMethod::Load:
        // Will never see this from planLoad().

    
    bool needStructureCheck = true;
    
    UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
    
    if (JSObject* knownBase = base->dynamicCastConstant<JSObject*>()) {
        // Try to optimize away the structure check. Note that it's not worth doing anything about this
        // if the base's structure is watched.
        Structure* structure = base->constant()->structure();
        if (!structure->dfgShouldWatch()) {
            UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
            
            if (!variant.conditionSet().isEmpty()) {
                // This means that we're loading from a prototype. We expect the base not to have the
                // property. We can only use ObjectPropertyCondition if all of the structures in the

            if (constant)
                return weakJSConstant(constant);
        }

        InferredType::Descriptor inferredType;
        if (needStructureCheck) {
            for (Structure* structure : variant.structureSet())
                inferredType.merge(m_graph.inferredTypeForProperty(structure, uid));
        } else
            inferredType = InferredType::Top;
        
        loadedValue = handleGetByOffset(
            loadPrediction, base, identifierNumber, variant.offset(), inferredType, loadOp);
    }

    return loadedValue;

    RELEASE_ASSERT(variant.kind() == PutByIdVariant::Replace);

    checkPresenceLike(base, m_graph.identifiers()[identifier], variant.offset(), variant.structure());
    return handlePutByOffset(base, identifier, variant.offset(), variant.inferredType(), value);
}

void ByteCodeParser::handleGetById(



/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGDesiredInferredType_h
#define DFGDesiredInferredType_h

#if ENABLE(DFG_JIT)

#include "InferredType.h"
#include <wtf/HashMap.h>

namespace JSC { namespace DFG {

// This documents the DFG's expectation for an InferredType: specifically, that we want it to have a live
// InferredType object and that this object has the type that we originally saw.

class DesiredInferredType {
public:
    DesiredInferredType()
        : m_object(nullptr)
    {
    }
    
    DesiredInferredType(InferredType* object, const InferredType::Descriptor& expected)
        : m_object(object)
        , m_expected(expected)
    {
    }

    DesiredInferredType(WTF::HashTableDeletedValueType)
        : m_object(nullptr)
        , m_expected(Top)
    {
    }

    explicit operator bool() const { return m_object && m_expected; }

    InferredType* object() const { return m_object; }
    InferredType::Descriptor expected() const { return m_expected; }

    bool isStillValid() const
    {
        return m_object->canWatch(m_expected);
    }

    void add(Watchpoint* watchpoint) const
    {
        m_object->addWatchpoint(watchpoint);
    }

    bool operator==(const DesiredInferredType& other) const
    {
        return m_object == other.m_object
            && m_expected == other.m_expected;
    }

    bool operator!=(const DesiredInferredType& other) const
    {
        return !(*this == other);
    }

    bool isHashTableDeletedValue() const
    {
        return !m_object && m_expected == Top;
    }

    unsigned hash() const
    {
        return WTF::PtrHash<InferredType*>::hash(m_object) + m_expected.hash() * 7;
    }

    void dumpInContext(PrintStream& out, DumpContext* context) const
    {
        out.print(inContext(m_expected, context), " for ", RawPointer(m_object));
    }

    void dump(PrintStream& out) const
    {
        dumpInContext(out, context);
    }

private:
    InferredType* m_object;
    InferredType::Descriptor m_expected;
};

struct DesiredInferredTypeHash {
    static unsigned hash(const DesiredInferredType& key) { return key.hash(); }
    static bool equal(const DesiredInferredType& a, const DesiredInferredType& b) { return a == b; }
    static const bool safeToCompareToEmptyOrDeleted = true;
};

} } // namespace JSC::DFG

namespace WTF {

template<typename T> struct DefaultHash;
template<> struct DefaultHash<JSC::DFG::DesiredInferredType> {
    typedef JSC::DFG::DesiredInferredTypeHash Hash;
};

template<typename T> struct HashTraits;
template<> struct HashTraits<JSC::DFG::DesiredInferredType> : SimpleClassHashTraits<JSC::DFG::DesiredInferredType> { };

} // namespace WTF

#endif // ENABLE(DFG_JIT)

#endif // DFGDesiredInferredType_h


Lines 65-70 void AdaptiveStructureWatchpointAdaptor: Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp_sec1
- Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp -1 / +14 lines
65	}	65	}
66	}	66	}
67		67
		68	void InferredTypeAdaptor::add(CodeBlock* codeBlock, const DesiredInferredType& key, CommonData& common)
		69	{
		70	key.add(common.watchpoints.add(codeBlock));
		71	}
		72
68	DesiredWatchpoints::DesiredWatchpoints() { }	73	DesiredWatchpoints::DesiredWatchpoints() { }
69	DesiredWatchpoints::~DesiredWatchpoints() { }	74	DesiredWatchpoints::~DesiredWatchpoints() { }
70		75
Lines 93-98 void DesiredWatchpoints::addLazily(const Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp_sec2
93	m_adaptiveStructureSets.addLazily(key);	98	m_adaptiveStructureSets.addLazily(key);
94	}	99	}
95		100
		101	void DesiredWatchpoints::addLazily(const DesiredInferredType& key)
		102	{
		103	m_inferredTypes.addLazily(key);
		104	}
		105
96	bool DesiredWatchpoints::consider(Structure* structure)	106	bool DesiredWatchpoints::consider(Structure* structure)
97	{	107	{
98	if (!structure->dfgShouldWatch())	108	if (!structure->dfgShouldWatch())
Lines 108-113 void DesiredWatchpoints::reallyAdd(CodeB Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp_sec3
108	m_inferredValues.reallyAdd(codeBlock, commonData);	118	m_inferredValues.reallyAdd(codeBlock, commonData);
109	m_bufferViews.reallyAdd(codeBlock, commonData);	119	m_bufferViews.reallyAdd(codeBlock, commonData);
110	m_adaptiveStructureSets.reallyAdd(codeBlock, commonData);	120	m_adaptiveStructureSets.reallyAdd(codeBlock, commonData);
		121	m_inferredTypes.reallyAdd(codeBlock, commonData);
111	}	122	}
112		123
113	bool DesiredWatchpoints::areStillValid() const	124	bool DesiredWatchpoints::areStillValid() const
Lines 116-122 bool DesiredWatchpoints::areStillValid() Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp_sec4
116	&& m_inlineSets.areStillValid()	127	&& m_inlineSets.areStillValid()
117	&& m_inferredValues.areStillValid()	128	&& m_inferredValues.areStillValid()
118	&& m_bufferViews.areStillValid()	129	&& m_bufferViews.areStillValid()
119	&& m_adaptiveStructureSets.areStillValid();	130	&& m_adaptiveStructureSets.areStillValid()
		131	&& m_inferredTypes.areStillValid();
120	}	132	}
121		133
122	void DesiredWatchpoints::dumpInContext(PrintStream& out, DumpContext* context) const	134	void DesiredWatchpoints::dumpInContext(PrintStream& out, DumpContext* context) const
Lines 127-132 void DesiredWatchpoints::dumpInContext(P Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp_sec5
127	out.print(" Inferred values: ", inContext(m_inferredValues, context), "\n");	139	out.print(" Inferred values: ", inContext(m_inferredValues, context), "\n");
128	out.print(" Buffer views: ", inContext(m_bufferViews, context), "\n");	140	out.print(" Buffer views: ", inContext(m_bufferViews, context), "\n");
129	out.print(" Object property conditions: ", inContext(m_adaptiveStructureSets, context), "\n");	141	out.print(" Object property conditions: ", inContext(m_adaptiveStructureSets, context), "\n");
		142	out.print(" Inferred types: ", inContext(m_inferredTypes, context), "\n");
130	}	143	}
131		144
132	} } // namespace JSC::DFG	145	} } // namespace JSC::DFG

Lines 30-35 Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h_sec1
- Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h +22 lines
30		30
31	#include "CodeOrigin.h"	31	#include "CodeOrigin.h"
32	#include "DFGCommonData.h"	32	#include "DFGCommonData.h"
		33	#include "DFGDesiredInferredType.h"
33	#include "InferredValue.h"	34	#include "InferredValue.h"
34	#include "JSArrayBufferView.h"	35	#include "JSArrayBufferView.h"
35	#include "ObjectPropertyCondition.h"	36	#include "ObjectPropertyCondition.h"
Lines 91-96 struct AdaptiveStructureWatchpointAdapto Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h_sec2
91	}	92	}
92	};	93	};
93		94
		95	struct InferredTypeAdaptor {
		96	static void add(CodeBlock*, const DesiredInferredType&, CommonData&);
		97	static bool hasBeenInvalidated(const DesiredInferredType& key)
		98	{
		99	return !key.isStillValid();
		100	}
		101	static void dumpInContext(PrintStream& out, const DesiredInferredType& key, DumpContext* context)
		102	{
		103	out.print(inContext(key, context));
		104	}
		105	};
		106
94	template<typename WatchpointSetType, typename Adaptor = SetPointerAdaptor<WatchpointSetType>>	107	template<typename WatchpointSetType, typename Adaptor = SetPointerAdaptor<WatchpointSetType>>
95	class GenericDesiredWatchpoints {	108	class GenericDesiredWatchpoints {
96	#if !ASSERT_DISABLED	109	#if !ASSERT_DISABLED
Lines 159-164 public: Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h_sec3
159	// It's recommended that you don't call this directly. Use Graph::watchCondition(), which does	172	// It's recommended that you don't call this directly. Use Graph::watchCondition(), which does
160	// the required GC magic as well as some other bookkeeping.	173	// the required GC magic as well as some other bookkeeping.
161	void addLazily(const ObjectPropertyCondition&);	174	void addLazily(const ObjectPropertyCondition&);
		175
		176	// It's recommended that you don't call this directly. Use Graph::inferredTypeFor(), which does
		177	// the required GC magic.
		178	void addLazily(const DesiredInferredType&);
162		179
163	bool consider(Structure*);	180	bool consider(Structure*);
164		181
Lines 186-191 public: Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h_sec4
186	{	203	{
187	return m_adaptiveStructureSets.isWatched(key);	204	return m_adaptiveStructureSets.isWatched(key);
188	}	205	}
		206	bool isWatched(const DesiredInferredType& key)
		207	{
		208	return m_inferredTypes.isWatched(key);
		209	}
189		210
190	void dumpInContext(PrintStream&, DumpContext*) const;	211	void dumpInContext(PrintStream&, DumpContext*) const;
191	void dump(PrintStream&) const;	212	void dump(PrintStream&) const;
Lines 196-201 private: Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h_sec5
196	GenericDesiredWatchpoints<InferredValue*, InferredValueAdaptor> m_inferredValues;	217	GenericDesiredWatchpoints<InferredValue*, InferredValueAdaptor> m_inferredValues;
197	GenericDesiredWatchpoints<JSArrayBufferView*, ArrayBufferViewWatchpointAdaptor> m_bufferViews;	218	GenericDesiredWatchpoints<JSArrayBufferView*, ArrayBufferViewWatchpointAdaptor> m_bufferViews;
198	GenericDesiredWatchpoints<ObjectPropertyCondition, AdaptiveStructureWatchpointAdaptor> m_adaptiveStructureSets;	219	GenericDesiredWatchpoints<ObjectPropertyCondition, AdaptiveStructureWatchpointAdaptor> m_adaptiveStructureSets;
		220	GenericDesiredWatchpoints<DesiredInferredType, InferredTypeAdaptor> m_inferredTypes;
199	};	221	};
200		222
201	} } // namespace JSC::DFG	223	} } // namespace JSC::DFG



    return m_safeToLoad.contains(std::make_pair(base, offset));
}

InferredType::Descriptor Graph::inferredTypeFor(const PropertyTypeKey& key)
{
    assertIsRegistered(key.structure());
    
    auto iter = m_inferredTypes.get(key);
    if (iter != m_inferredTypes.end())
        return iter->value;

    InferredType* typeObject = key.structure()->inferredTypeFor(key.uid());
    if (!typeObject) {
        m_inferredTypes.add(key, InferredType::Top);
        return InferredType::Top;
    }

    InferredType::Descriptor typeDescriptor = typeObject->descriptor();
    if (!typeDescriptor.isStillValid()) {
        m_inferredTypes.add(key, InferredType::Top);
        return InferredType::Top;
    }
    
    m_inferredTypes.add(key, typeDescriptor);

    m_plan.weakReferences.addLazily(typeObject);
    if (typeDescriptor.structure())
        registerStructure(typeDescriptor.structure());

    // Note that we may already be watching this desired inferred type, because multiple structures may
    // point to the same InferredType instance.
    m_plan.watchpoints.addLazily(DesiredInferredType(typeObject, typeDescriptor));

    return typeDescriptor;
}

bool Graph::watchDesiredType(const DesiredInferredType& key)
{
    if (!key.isStillValid())
        return false;

    m_plan.weakReferences.addLazily(key.object());
    if (Structure* structure = key.expected().structure())
        registerStructure(structure);
    m_plan.watchpoints.addLazily(key);
}

FullBytecodeLiveness& Graph::livenessFor(CodeBlock* codeBlock)
{
    HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>>::iterator iter = m_bytecodeLiveness.find(codeBlock);

JSValue Graph::tryGetConstantProperty(
    JSValue base, const StructureAbstractValue& structure, PropertyOffset offset)
{
    if (structure.isInfinite()) {
        // FIXME: If we just converted the offset to a uid, we could do ObjectPropertyCondition
        // watching to constant-fold the property.
        // https://bugs.webkit.org/show_bug.cgi?id=147271

    return tryGetConstantProperty(base.m_value, base.m_structure, offset);
}

AbstractValue Graph::inferredValueForProperty(
    const StructureSet& base, UniquedStringImpl* uid, StructureClobberState clobberState)
{
    AbstractValue result;
    base.forEach(
        [&] (Structure* structure) {
            AbstractValue value;
            value.set(*this, inferredTypeForProperty(structure, uid));
            result.merge(value);
        });
    return result;
}

AbstractValue Graph::inferredValueForProperty(
    const AbstractValue& base, UniquedStringImpl* uid, PropertyOffset offset,
    StructureClobberState clobberState)
{
    if (JSValue value = tryGetConstantProperty(base, offset)) {
        AbstractValue result;
        result.set(*this, *freeze(value), clobberState);
        return result;
    }

    if (base.m_structure.isFinite())
        return inferredValueForProperty(base.m_structure.set(), uid, clobberState);

    return AbstractValue::heapTop();
}

JSValue Graph::tryGetConstantClosureVar(JSValue base, ScopeOffset offset)
{
    // This has an awesome concurrency story. See comment for GetGlobalVar in ByteCodeParser.



    // Checks if it's known that loading from the given object at the given offset is fine. This is
    // computed by tracking which conditions we track with watchCondition().
    bool isSafeToLoad(JSObject* base, PropertyOffset);

    // Tells us what inferred type we are able to prove the property to have now and in the future.
    InferredType::Descriptor inferredTypeFor(const PropertyTypeKey&);
    InferredType::Descriptor inferredTypeForProperty(Structure* structure, UniquedStringImpl* uid)
    {
        return inferredTypeFor(PropertyTypeKey(structure, uid));
    }

    AbstractValue inferredValueForProperty(
        const StructureSet& base, UniquedStringImpl* uid, StructureClobberState);

    // This uses either constant property inference or property type inference to derive a good abstract
    // value for some property accessed with the given abstract value base.
    AbstractValue inferredValueForProperty(
        const AbstractValue& base, UniquedStringImpl* uid, PropertyOffset, StructureClobberState);
    
    FullBytecodeLiveness& livenessFor(CodeBlock*);
    FullBytecodeLiveness& livenessFor(InlineCallFrame*);

    HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
    HashMap<CodeBlock*, std::unique_ptr<BytecodeKills>> m_bytecodeKills;
    HashSet<std::pair<JSObject*, PropertyOffset>> m_safeToLoad;
    HashMap<PropertyTypeKey, InferredType::Descriptor> m_inferredTypes;
    Dominators m_dominators;
    PrePostNumbering m_prePostNumbering;
    NaturalLoops m_naturalLoops;

Lines 64-69 struct BasicBlock; Source/JavaScriptCore/dfg/DFGNode.h_sec1
- Source/JavaScriptCore/dfg/DFGNode.h +5 lines
64	struct StorageAccessData {	64	struct StorageAccessData {
65	PropertyOffset offset;	65	PropertyOffset offset;
66	unsigned identifierNumber;	66	unsigned identifierNumber;
		67
		68	// This needs to know the inferred type. For puts, this is necessary because we need to remember
		69	// what check is needed. For gets, this is necessary because otherwise AI might forget what type is
		70	// guaranteed.
		71	InferredType::Descriptor inferredType;
67	};	72	};
68		73
69	struct MultiPutByOffsetData {	74	struct MultiPutByOffsetData {



/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef DFGPropertyTypeKey_h
#define DFGPropertyTypeKey_h

#if ENABLE(DFG_JIT)

#include <wtf/HashMap.h>

namespace JSC { namespace DFG {

// This object is a key for finding a property's type. It's a tuple of Structure* and UniquedStringImpl*.

class PropertyTypeKey {
public:
    PropertyTypeKey()
        : m_structure(nullptr)
        , m_uid(nullptr)
    {
    }

    PropertyTypeKey(Structure* structure, UniquedStringImpl* uid)
        : m_structure(structure)
        , m_uid(uid)
    {
    }

    PropertyTypeKey(WTF::HashTableDeletedValueType)
        : m_object(nullptr)
        , m_uid(deletedUID())
    {
    }

    explicit operator bool() const { return m_structure && m_uid; }

    Structure* structure() const { return m_structure; }
    PropertyOffset uid() const { return m_uid; }

    bool operator==(const PropertyTypeKey& other) const
    {
        return m_structure == other.m_structure
            && m_uid == other.m_uid;
    }

    bool operator!=(const PropertyTypeKey& other) const
    {
        return !(*this == other);
    }

    unsigned hash() const
    {
        return WTF::PtrHash<Structure*>::hash(m_structure) + WTF::PtrHash<UniquedStringImpl*>::hash(m_uid);
    }

    bool isHashTableDeletedValue() const
    {
        return !m_object && m_uid == deletedUID();
    }

    void dumpInContext(PrintStream& out, DumpContext* context) const
    {
        out.print(pointerDumpInContext(m_structure, context), "+", m_uid);
    }

    void dump(PrintStream& out) const
    {
        dumpInContext(out, context);
    }

private:
    static UniquedStringImpl* deletedUID()
    {
        return bitwise_cast<UniquedStringImpl*>(static_cast<intptr_t>(1));
    }
    
    Structure* m_structure;
    UniquedStringImpl* m_uid;
};

struct PropertyTypeKeyHash {
    static unsigned hash(const PropertyTypeKey& key) { return key.hash(); }
    static bool equal(const PropertyTypeKey& a, const PropertyTypeKey& b) { return a == b; }
    static const bool safeToCompareToEmptyOrDeleted = true;
};

} } // namespace JSC::DFG

namespace WTF {

template<typename T> struct DefaultHash;
template<> struct DefaultHash<JSC::DFG::PropertyTypeKey> {
    typedef JSC::DFG::PropertyTypeKeyHash Hash;
};

template<typename T> struct HashTraits;
template<> struct HashTraits<JSC::DFG::PropertyTypeKey> : SimpleClassHashTraits<JSC::DFG::PropertyTypeKey> {
    static const bool emptyValueIsZero = false;
};

} // namespace WTF

#endif // ENABLE(DFG_JIT)

#endif // DFGPropertyTypeKey_h


Lines 53-58 public: Source/JavaScriptCore/dfg/DFGSafeToExecute.h_sec1
- Source/JavaScriptCore/dfg/DFGSafeToExecute.h +1 lines
53	case RealNumberUse:	53	case RealNumberUse:
54	case BooleanUse:	54	case BooleanUse:
55	case CellUse:	55	case CellUse:
		56	case CellOrOtherUse:
56	case ObjectUse:	57	case ObjectUse:
57	case FunctionUse:	58	case FunctionUse:
58	case FinalObjectUse:	59	case FinalObjectUse:



    cellResult(resultGPR, node);
}

void SpeculativeJIT::compileCheckStructure(Node* node, GPRReg cellGPR, GPRReg tempGPR)
{
    ASSERT(node->structureSet().size());
    
    if (node->structureSet().size() == 1) {
        speculationCheck(
            BadCache, JSValueSource::unboxedCell(cellGPR), 0,
            m_jit.branchWeakStructure(
                JITCompiler::NotEqual,
                JITCompiler::Address(cellGPR, JSCell::structureIDOffset()),
                node->structureSet()[0]));
    } else {
        std::unique_ptr<GPRTemporary> structure;
        GPRReg structureGPR;
        
        if (tempGPR == InvalidGPR) {
            structure = std::make_unique<GPRTemporary>(this);
            structureGPR = structure->gpr();
        } else
            structureGPR = tempGPR;
        
        m_jit.load32(JITCompiler::Address(cellGPR, JSCell::structureIDOffset()), structureGPR);
        
        JITCompiler::JumpList done;
        
        for (size_t i = 0; i < node->structureSet().size() - 1; ++i) {
            done.append(
                m_jit.branchWeakStructur(JITCompiler::Equal, structureGPR, node->structureSet()[i]));
        }
        
        speculationCheck(
            BadCache, JSValueSource::unboxedCell(cellGPR), 0,
            m_jit.branchWeakStructure(
                JITCompiler::NotEqual, structureGPR, node->structureSet().last()));
        
        done.link(&m_jit);
    }
}

void SpeculativeJIT::compileCheckStructure(Node* node)
{
    switch (node->child1().useKind()) {
    case CellUse: {
        SpeculateCellOperand cell(this, node->child1());
        compileCheckStructure(node, cell.gpr(), InvalidGPRReg);
        noResult(node);
        return;
    }

    case CellOrOtherUse: {
        JSValueOperand value(this, node->child1(), ManualOperandSpeculation);
        GPRTemporary temp(this);

        JSValueRegs valueRegs = value.jsValueRegs();
        GPRReg tempGPR = temp.gpr();

        JITCompiler::Jump cell = m_jit.branchIfCell(valueRegs);
        DFG_TYPE_CHECK(
            valueRegs, node->child1(), SpecCell | SpecOther,
            m_jit.branchIfNotOther(valueRegs, tempGPR));
        JITCompiler::Jump done = m_jit.jump();
        cell.link(&m_jit);
        compileCheckStructure(node, valueRegs.payloadGPR(), tempGPR);
        done.link(&m_jit);
        noResult(this);
        return;
    }

    default:
        DFG_CRASH(m_jit.graph(), node, "Bad use kind");
        return;
    }
}

void SpeculativeJIT::compileAllocatePropertyStorage(Node* node)
{
    if (node->transition()->previous->couldHaveIndexingHeader()) {

    (SpeculateCellOperand(this, edge)).gpr();
}

void SpeculativeJIT::speculateCellOrOther(Edge edge)
{
    if (!needsTypeCheck(edge, SpecCell | SpecOther))
        return;
    
    JSValueOperand operand(this, edge, ManualOperandSpeculation);
    GPRTemporary temp(this);
    GPRReg tempGPR = temp.gpr();

    MacroAssembler::Jump ok = m_jit.branchIfCell(operand.jsValueRegs());
    DFG_TYPE_CHECK(
        operand.jsValueRegs(), edge, SpecCell | SpecOther,
        m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
    ok.link(&m_jit);
}

void SpeculativeJIT::speculateObject(Edge edge)
{
    if (!needsTypeCheck(edge, SpecObject))

    case CellUse:
        speculateCell(edge);
        break;
    case CellOrOtherUse:
        speculateCellOrOther(edge);
        break;
    case ObjectUse:
        speculateObject(edge);
        break;

Lines 2215-2220 public: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h +3 lines
2215	void compileIsObjectOrNull(Node*);	2215	void compileIsObjectOrNull(Node*);
2216	void compileIsFunction(Node*);	2216	void compileIsFunction(Node*);
2217	void compileTypeOf(Node*);	2217	void compileTypeOf(Node*);
		2218	void compileCheckStructure(Node*, GPRReg cellGPR, GPRReg tempGPR);
		2219	void compileCheckStructure(Node*);
2218		2220
2219	void moveTrueTo(GPRReg);	2221	void moveTrueTo(GPRReg);
2220	void moveFalseTo(GPRReg);	2222	void moveFalseTo(GPRReg);
Lines 2374-2379 public: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h_sec2
2374	void speculateDoubleRepReal(Edge);	2376	void speculateDoubleRepReal(Edge);
2375	void speculateBoolean(Edge);	2377	void speculateBoolean(Edge);
2376	void speculateCell(Edge);	2378	void speculateCell(Edge);
		2379	void speculateCellOrOther(Edge);
2377	void speculateObject(Edge);	2380	void speculateObject(Edge);
2378	void speculateFunction(Edge);	2381	void speculateFunction(Edge);
2379	void speculateFinalObject(Edge);	2382	void speculateFinalObject(Edge);

Lines 192-198 public: Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h_sec1
- Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h -1 / +8 lines
192	}	192	}
193		193
194	Structure* operator[](size_t i) const { return at(i); }	194	Structure* operator[](size_t i) const { return at(i); }
195		195
196	// In most cases, what you really want to do is verify whether the set is top or clobbered, and	196	// In most cases, what you really want to do is verify whether the set is top or clobbered, and
197	// if not, enumerate the set of structures. Use this only in cases where the singleton case is	197	// if not, enumerate the set of structures. Use this only in cases where the singleton case is
198	// meaningfully special, like for transitions.	198	// meaningfully special, like for transitions.
Lines 202-207 public: Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h_sec2
202	return nullptr;	202	return nullptr;
203	return m_set.onlyStructure();	203	return m_set.onlyStructure();
204	}	204	}
		205
		206	template<typename Functor>
		207	void forEach(const Functor& functor) const
		208	{
		209	ASSERT(!isTop());
		210	m_set.forEach(functor);
		211	}
205		212
206	void dumpInContext(PrintStream&, DumpContext*) const;	213	void dumpInContext(PrintStream&, DumpContext*) const;
207	void dump(PrintStream&) const;	214	void dump(PrintStream&) const;

Lines 79-84 void printInternal(PrintStream& out, Use Source/JavaScriptCore/dfg/DFGUseKind.cpp_sec1
- Source/JavaScriptCore/dfg/DFGUseKind.cpp +3 lines
79	case KnownCellUse:	79	case KnownCellUse:
80	out.print("KnownCell");	80	out.print("KnownCell");
81	return;	81	return;
		82	case CellOrOtherUse:
		83	out.print("CellOrOther");
		84	return;
82	case ObjectUse:	85	case ObjectUse:
83	out.print("Object");	86	out.print("Object");
84	return;	87	return;

Lines 51-56 enum UseKind { Source/JavaScriptCore/dfg/DFGUseKind.h_sec1
- Source/JavaScriptCore/dfg/DFGUseKind.h +3 lines
51	KnownBooleanUse,	51	KnownBooleanUse,
52	CellUse,	52	CellUse,
53	KnownCellUse,	53	KnownCellUse,
		54	CellOrOtherUse,
54	ObjectUse,	55	ObjectUse,
55	FunctionUse,	56	FunctionUse,
56	FinalObjectUse,	57	FinalObjectUse,
Lines 108-113 inline SpeculatedType typeFilterFor(UseK Source/JavaScriptCore/dfg/DFGUseKind.h_sec2
108	case CellUse:	109	case CellUse:
109	case KnownCellUse:	110	case KnownCellUse:
110	return SpecCell;	111	return SpecCell;
		112	case CellOrOtherUse:
		113	return SpecCell \| SpecOther;
111	case ObjectUse:	114	case ObjectUse:
112	return SpecObject;	115	return SpecObject;
113	case FunctionUse:	116	case FunctionUse:

Lines 418-423 CapabilityLevel canCompile(Graph& graph) Source/JavaScriptCore/ftl/FTLCapabilities.cpp_sec1
- Source/JavaScriptCore/ftl/FTLCapabilities.cpp +1 lines
418	case KnownBooleanUse:	418	case KnownBooleanUse:
419	case CellUse:	419	case CellUse:
420	case KnownCellUse:	420	case KnownCellUse:
		421	case CellOrOtherUse:
421	case ObjectUse:	422	case ObjectUse:
422	case FunctionUse:	423	case FunctionUse:
423	case ObjectOrOtherUse:	424	case ObjectOrOtherUse:



    
    void compileCheckStructure()
    {
        LValue cell = lowCell(m_node->child1());
        
        ExitKind exitKind;
        if (m_node->child1()->hasConstant())
            exitKind = BadConstantCache;
        else
            exitKind = BadCache;

        switch (m_node->child1().useKind()) {
        case CellUse: {
            LValue cell = lowCell(m_node->child1());
            
            checkStructure(
                m_out.load32(cell, m_heaps.JSCell_structureID), jsValueValue(cell),
                exitKind, m_node->structureSet(),
                [&] (Structure* structure) {
                    return weakStructureID(structure);
                });
            return;
        }

        case CellOrOtherUse: {
            LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);

            LBasicBlock cellCase = FTL_NEW_BLOCK(m_out, ("CheckStructure CellOrOtherUse cell case"));
            LBasicBlock notCellCase = FTL_NEW_BLOCK(m_out, ("CheckStructure CellOrOtherUse not cell case"));
            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("CheckStructure CellOrOtherUse continuation"));

            m_out.branch(
                isCell(value, provenType(m_node->child1())), unsure(cellCase), unsure(notCellCase));

            LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
            checkStructure(
                m_out.load32(cell, m_heaps.JSCell_structureID), jsValueValue(cell),
                exitKind, m_node->structureSet(),
                [&] (Structure* structure) {
                    return weakStructureID(structure);
                });
            m_out.jump(continuation);

            m_out.appendTo(notCellCase, continuation);
            FTL_TYPE_CHECK(jsValueValue(value), m_node->child1(), SpecCell | SpecOther, isNotOther(value));
            m_out.jump(continuation);

            m_out.appendTo(continuation, lastNext);
            return;
        }

        default:
            DFG_CRASH(m_graph, m_node, "Bad use kind");
            return;
        }
    }
    
    void compileCheckCell()

        case CellUse:
            speculateCell(edge);
            break;
        case CellOrOtherUse:
            speculateCellOrOther(edge);
            break;
        case KnownCellUse:
            ASSERT(!m_interpreter.needsTypeCheck(edge));
            break;

        lowCell(edge);
    }
    
    void speculateCellOrOther(Edge edge)
    {
        LValue value = lowJSValue(edge, ManualOperandSpeculation);

        LBasicBlock isNotCell = FTL_NEW_BLOCK(m_out, ("Speculate CellOrOther not cell"));
        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Speculate CellOrOther continuation"));

        m_out.branch(isCell(value, provenType(edge)), unsure(continuation), unsure(isNotCell));

        LBasicBlock lastNext = m_out.appendTo(isNotCell, continuation);
        FTL_TYPE_CHECK(jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
        m_out.jump(continuation);

        m_out.appendTo(continuation, lastNext);
    }
    
    void speculateMachineInt(Edge edge)
    {
        if (!m_interpreter.needsTypeCheck(edge))



    return result.iterator->value;
}

AssemblyHelpers::JumpList AssemblyHelpers::branchIfNotType(
    JSValueRegs regs, GPRReg tempGPR, const InferredType::Descriptor& descriptor)
{
    AssemblyHelpers::JumpList result;

    switch (descriptor.kind()) {
    case InferredType::Bottom:
        result.append(jump());
        break;

    case InferredType::Boolean:
        result.append(branchIfNotBoolean(regs, tempGPR));
        break;

    case InferredType::Other:
        result.append(branchIfNotOther(regs, tempGPR));
        break;

    case InferredType::Int32:
        result.append(branchIfNotInt32(regs));
        break;

    case InferredType::Double:
        result.append(branchIfInt32(regs));
        result.append(branchIfNotNumber(regs));
        break;

    case InferredType::Number:
        result.append(branchIfNotNumber(regs));
        break;

    case InferredType::String:
        result.append(branchIfNotCell(regs));
        result.append(branchIfNotString(regs.payloadGPR()));
        break;

    case InferredType::ObjectWithStructure:
        result.append(branchIfNotCell(regs));
        result.append(branchStructure(regs.payloadGPR(), descriptor.structure()));
        break;

    case InferredType::ObjectWithStructureOrOther: {
        Jump ok = branchIfOther(regs, tempGPR);
        result.append(branchIfNotCell(regs));
        result.append(branchStructure(regs.payloadGPR(), descriptor.structure()));
        ok.link(this);
        break;
    }

    case InferredType::Object:
        result.append(branchIfNotCell(regs));
        result.append(branchIfNotObject(regs.payloadGPR()));
        break;

    case InferredType::ObjectOrOther: {
        Jump ok = branchIfOther(regs, tempGPR);
        result.append(branchIfNotCell(regs));
        result.append(branchIfNotObject(regs.payloadGPR()));
        ok.link(this);
        break;
    }

    case InferredType::Top:
        break;
    }

    return result;
}

void AssemblyHelpers::purifyNaN(FPRReg fpr)
{
    MacroAssembler::Jump notNaN = branchDouble(DoubleEqual, fpr, fpr);



        return branch32(Equal, regs.tagGPR(), TrustedImm32(JSValue::EmptyValueTag));
#endif
    }

    JumpList branchIfNotType(JSValueRegs regs, GPRReg tempGPR, const InferredType::Descriptor&);

    template<typename T>
    Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)
    {
#if USE(JSVALUE64)
        return branch32(condition, leftHandSide, TrustedImm32(structure->id()));
#else
        return branchPtr(condition, leftHandSide, TrustedImmPtr(structure));
#endif
    }
    
    template<typename T>
    Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)



/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "InferredType.h"

#include "JSCInlines.h"

namespace JSC {

const ClassInfo InferredType::s_info = { "InferredType", 0, 0, CREATE_METHOD_TABLE(InferredType) };

InferredType* InferredType::create(VM& vm)
{
    InferredType* result = new (NotNull, allocateCell<InferredType>(vm.heap)) InferredType(vm);
    result->finishCreation(vm);
    return result;
}

void InferredType::destroy(JSCell* cell)
{
    InferredType* inferredType = static_cast<InferredType*>(cell);
    inferredType->InferredType::~InferredType();
}

Structure* InferredType::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
{
    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
}

void InferredType::visitChildren(JSCell* cell, SlotVisitor& visitor)
{
    InferredType* inferredType = jsCast<InferredType*>(cell);

    if (inferredType->m_structure)
        visitor.addUnconditionalFinalizer(inferredType->m_structure.get());
}

InferredType::Descriptor InferredType::Descriptor::forValue(JSValue value)
{
    if (value.isBoolean())
        return Boolean;
    if (value.isUndefinedOrNull())
        return Other;
    if (value.isInt32())
        return Int32;
    if (value.isDouble())
        return Double;
    if (value.isCell()) {
        JSCell* cell = value.asCell();
        if (cell->isString())
            return String;
        if (cell->isObject()) {
            if (cell->structure()->transitionWatchpointSetIsStillValid())
                return Descriptor(ObjectWithStructure, cell->structure());
            return Object;
        }
    }
    return Top;
}

void InferredType::Descriptor::merge(const Descriptor& other)
{
    if (*this == other)
        return;
    
    switch (m_kind) {
    case Bottom:
        *this = other;
        return;
    case Boolean:
    case String:
        *this = Top;
        return;
    case Other:
        switch (other.m_kind) {
        case ObjectWithStructure:
            m_kind = ObjectWithStructureOrOther;
            return;
        case Object:
            m_kind = ObjectOrOther;
            return;
        default:
            *this = Top;
            return;
        }
    case Int32:
        switch (other.m_kind) {
        case Double:
        case Number:
            m_kind = Number;
            return;
        default:
            *this = Top;
            return;
        }
    case Double:
        switch (other.m_kind) {
        case Int32:
        case Number:
            m_kind = Number;
            return;
        default:
            *this = Top;
            return;
        }
    case Number:
        switch (other.m_kind) {
        case Int32:
        case Double:
            return;
        default:
            *this = Top;
            return;
        }
    case ObjectWithStructure:
        switch (other.m_kind) {
        case ObjectWithStructure:
        case Object:
            *this = Object;
            return;
        case ObjectWithStructureOrOther:
            if (m_structure == other.m_structure) {
                *this = other;
                return;
            }
            *this = ObjectOrOther;
            return;
        case ObjectOrOther:
            *this = ObjectOrOther;
            return;
        case Other:
            m_kind = ObjectWithStructureOrOther;
            return;
        default:
            *this = Top;
            return;
        }
    case ObjectWithStructureOrOther:
        switch (other.m_kind) {
        case ObjectWithStructure:
            if (m_structure == other.m_structure)
                return;
            *this = ObjectOrOther;
            return;
        case Object:
        case ObjectWithStructureOrOther:
        case ObjectOrOther:
            *this = ObjectOrOther;
            return;
        case Other:
            return;
        default:
            *this = Top;
            return;
        }
    case Object:
        switch (other.m_kind) {
        case ObjectWithStructure:
            return;
        case ObjectWithStructureOrOther:
        case ObjectOrOther:
        case Other:
            m_kind = ObjectOrOther;
            return;
        default:
            *this = Top;
            return;
        }
    case ObjectOrOther:
        switch (other.m_kind) {
        case ObjectWithStructure:
        case ObjectWithStructureOrOther:
        case Object:
        case Other:
            return;
        default:
            *this = Top;
            return;
        }
    case Top:
        return;
    }

    RELEASE_ASSERT_NOT_REACHED();
}

void InferredType::Descriptor::removeStructure()
{
    switch (m_kind) {
    case ObjectWithStructure:
        *this = Object;
        return;
    case ObjectWithStructureOrOther:
        *this = ObjectOrOther;
        return;
    default:
        return;
    }
}

bool InferredType::Descriptor::subsumes(const Descriptor& other) const
{
    Descriptor merged = *this;
    merged.merge(other);
    return *this == merged;
}

void InferredType::Descriptor::dumpInContext(PrintStream& out, DumpContext* context) const
{
    out.print(m_kind);
    if (m_structure)
        out.print(":", inContext(*m_structure, context));
}

void InferredType::Descriptor::dump(PrintStream& out) const
{
    dumpInContext(out, nullptr);
}

InferredType::InferredType(VM& vm)
    : Base(vm, vm.inferredTypeStructure.get())
    , m_watchpointSet(ClearWatchpoint)
{
}

InferredType::~InferredType()
{
}

bool InferredType::isStillValid(const ConcurrentJITLocker& locker, const Descriptor& expected)
{
    if (expected.kind() == Top)
        return false;
    
    return descriptor(locker) == expected;
}

bool InferredType::isStillValid(const Descriptor& expected)
{
    ConcurrentJITLocker locker(m_lock);
    return isStillValid(locker, expected);
}

void InferredType::addWatchpoint(const ConcurrentJITLocker& locker, Watchpoint* watchpoint)
{
    RELEASE_ASSERT(descriptor(locker).kind() != Top);

    m_watchpointSet.add(watchpoint);
}

void InferredType::addWatchpoint(Watchpoint* watchpoint)
{
    ConcurrentJITLocker locker(m_lock);
    addWatchpoint(locker, watchpoint);
}

void InferredType::dump(PrintStream& out) const
{
    out.print(RawPointer(this), ":", descriptor());
}

void InferredType::willStoreValueSlow(VM& vm, JSValue value)
{
    ConcurrentJITLocker locker(m_lock);
    Descriptor myType = descriptor(locker);
    Descriptor otherType = Descriptor::forValue(value);

    myType.merge(otherType);

    ASSERT(descriptor(locker) != myType); // The type must have changed if we're on the slow path.

    set(locker, vm, myType);
}

void InferredType::makeTopSlow(VM& vm)
{
    ConcurrentJITLocker locker(m_lock);
    set(locker, vm, Top);
}

void InferredType::set(const ConcurrentJITLocker& locker, VM& vm, Descriptor newDescriptor)
{
    // We will trigger write barriers while holding our lock. Currently, write barriers don't GC, but that
    // could change. If it does, we don't want to deadlock. Note that we could have used
    // GCSafeConcurrentJITLocker in the caller, but the caller is on a fast path so maybe that wouldn't be
    // a good idea.
    DeferGCForAWhile deferGC(vm.heap);
    
    // Be defensive: if we're not really changing the type, then we don't have to do anything.
    if (descriptor(locker) == newDescriptor)
        return;

    // The new descriptor must be more general than the previous one.
    ASSERT(newDescriptor.subsumes(descriptor(locker)));

    // If the new descriptors have different structures, then it can only be because one is null.
    if (descriptor(locker).structure() != newDescriptor.structure())
        ASSERT(!descriptor(locker).structure() || !newDescriptor.structure());

    // We are changing the type, so make sure that if anyone was watching, they find out about it now. If
    // anyone is watching, we make sure to go to Top so that we don't do this sort of thing again.
    if (m_watchpointSet.state() != ClearWatchpoint) {
        // We cannot have been invalidated, since if we were, then we'd already be at Top.
        ASSERT(m_watchpointSet.state() != IsInvalidated);

        // We're about to do expensive things because some compiler thread decided to watch this type and
        // then the type changed. Assume that this property is crazy, and don't ever do any more things for
        // it.
        newDescriptor = Top;

        m_watchpointSet.fireAll("Inferred type changed");
    }

    // Remove the old InferredStructure object if we no longer need it.
    if (!newDescriptor.structure())
        m_structure = nullptr;

    // Add a new InferredStructure object if we need one now.
    if (newDescriptor.structure()) {
        if (m_structure) {
            // We should agree on the structures if we get here.
            ASSERT(newDescriptor.structure() == m_structure->structure());
        } else {
            m_structure = std::make_unique<InferredStructure>(this, newDescriptor.structure());
            newDescriptor.structure()->addTransitionWatchpoint(m_structure.get());
        }
    }

    // Finally, set the descriptor kind.
    m_kind = newDescriptor.kind();

    // Assert that we did things.
    ASSERT(descriptor(locker) == newDescriptor);
}

void InferredType::removeStructure()
{
    VM& vm = *Heap::heap(this)->vm();

    ConcurrentJITLocker locker(m_parent->m_lock);
    
    Descriptor newDescriptor = descriptor(locker);
    newDescriptor.removeStructure();
    
    set(locker, vm, newDescriptor);
}

void InferredType::InferredStructure::InferredStructure(InferredType* parent, Structure* structure)
    : m_parent(parent)
    , m_structure(vm, parent, structure)
{
}

void InferredType::InferredStructure::fireInternal(const FireDetail&)
{
    m_parent->removeStructure();
}

void InferredType::InferredStructure::finalizeUnconditionally()
{
    VM& vm = *Heap::heap(m_parent)->vm();

    ASSERT(Heap::isMarked(m_parent));
    
    if (!Heap::isMarked(m_structure.get()))
        m_parent->removeStructure();
}

} // namespace JSC

namespace WTF {

using namespace JSC;

void printInternal(PrintStream& out, InferredType::Kind kind)
{
    switch (kind) {
    case InferredType::Bottom:
        out.print("Bottom");
        return;
    case InferredType::Boolean:
        out.print("Boolean");
        return;
    case InferredType::Other:
        out.print("Other");
        return;
    case InferredType::Int32:
        out.print("Int32");
        return;
    case InferredType::Double:
        out.print("Double");
        return;
    case InferredType::Number:
        out.print("Number");
        return;
    case InferredType::String:
        out.print("String");
        return;
    case InferredType::ObjectWithStructure:
        out.print("ObjectWithStructure");
        return;
    case InferredType::ObjectWithStructureOrOther:
        out.print("ObjectWithStructureOrOther");
        return;
    case InferredType::Object:
        out.print("Object");
        return;
    case InferredType::ObjectOrOther:
        out.print("ObjectOrOther");
        return;
    case InferredType::Top:
        out.print("Top");
        return;
    }

    RELEASE_ASSERT_NOT_REACHED();
}

} // namespace WTF




/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#infdef InferredType_h
#define InferredType_h

#include "ConcurrentJITLock.h"
#include "JSCell.h"

namespace JSC {

// This is an object used for the inference of the types of object properties.

class InferredType final : public JSCell {
public:
    typedef JSCell Base;

    static InferredType* create(VM&);

    static const bool needsDestruction = true;
    static void destroy(JSCell*);

    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);

    static void visitChildren(JSCell*, SlotVisitor&);

    DECLARE_INFO;

    enum Kind : uint8_t {
        Bottom,
        Boolean,
        Other,
        Int32,
        Double,
        Number,
        String,
        ObjectWithStructure,
        ObjectWithStructureOrOther,
        Object,
        ObjectOrOther,
        Top
    };

    class Descriptor {
    public:
        Descriptor()
            : m_kind(Bottom)
            , m_structure(nullptr)
        {
        }

        Descriptor(Kind kind, Structure* structure = nullptr)
            : m_kind(kind)
            , m_structure(structure)
        {
        }

        static Descriptor forValue(JSValue);

        explicit operator bool() const
        {
            return m_kind == Bottom && !m_structure;
        }

        Kind kind() const { return m_kind; }
        Structure* structure() const { return m_structure; }

        ALWAYS_INLINE bool includesValue(JSValue value)
        {
            switch (m_kind) {
            case Bottom:
                return false;
            case Boolean:
                return value.isBoolean();
            case Other:
                return value.isUndefinedOrNull();
            case Int32:
                return value.isInt32();
            case Double:
                return value.isDouble();
            case Number:
                return value.isNumber();
            case String:
                return value.isString();
            case ObjectWithStructure:
                return value.isCell() && value.asCell()->structure() == m_structure;
            case ObjectWithStructureOrOther:
                return value.isUndefinedOrNull()
                    || (value.isCell() && value.asCell()->structure() == m_structure);
            case Object:
                return value.isObject();
            case ObjectOrOther:
                return value.isUndefinedOrNull() || value.isObject();
            case Top:
                return true;
            }

            RELEASE_ASSERT_NOT_REACHED();
        }

        bool operator==(const Descriptor& other)
        {
            return m_kind == other.m_kind
                && m_structure == other.m_structure;
        }

        bool operator!=(const Descriptor& other)
        {
            return !(*this == other);
        }

        unsigned hash() const
        {
            return WTF::PtrHash<Structure*>::hash(m_structure) ^ static_cast<unsigned>(m_kind);
        }
    
        void merge(const Descriptor&);
        void removeStructure();

        // Returns true if this descriptor is more general than the other one.
        bool subsumes(const Descriptor&) const;

        void dumpInContext(PrintStream&, DumpContext*) const;
        void dump(PrintStream&) const;

    private:
        Kind m_kind;
        Structure* m_structure;
    };

    ConcurrentJITLock& lock() const { return m_lock; }

    Descriptor descriptorMainThread() const
    {
        return Descriptor(m_kind, m_structure ? m_structure->structure() : nullptr);
    }
    
    Descriptor descriptor(const ConcurrentJITLocker&) const
    {
        return descriptorMainThread();
    }
    Descriptor descriptor() const
    {
        ConcurrentJITLocker locker(m_lock);
        return descriptor(locker);
    }
    
    Kind kind(const ConcurrentJITLocker& locker) const { return descriptor().kind(); }
    Structure* structure(const ConcurrentJITLocker& locker) const { return descriptor().structure(); }

    bool isTop() const { return m_kind == Top; }
    bool isRelevant() const { return m_kind != Top; }

    // Returns true if the InferredType is still relevant after the store. It's not relevant if it's Top.
    ALWAYS_INLINE bool willStoreValue(VM& vm, JSValue value)
    {
        Descriptor currentDescriptor = descriptorMainThread();
        if (currentDescriptor.includesValue(value))
            return currentDescriptor.kind() != Top;
        return willStoreValueSlow(vm, value);
    }

    // Immediately makes this type irrelevant.
    void makeTop(VM& vm)
    {
        if (isTop())
            return;
        makeTopSlow(vm);
    }

    // Returns true if it currently makes sense to watch this InferredType for this descriptor. Note that
    // this will always return false for Top.
    bool canWatch(const ConcurrentJITLocker& locker, const Descriptor&);
    bool canWatch(const Descriptor&);
    
    void addWatchpoint(const ConcurrentJITLocker& locker, Watchpoint*);
    void addWatchpoint(Watchpoint*);

    void dump(PrintStream&) const;

private:
    InferredType(VM&);
    ~InferredType();

    void willStoreValueSlow(VM&, JSValue);
    void makeTopSlow(VM&);
    void set(const ConcurrentJITLocker&, VM&, Descriptor);
    void removeStructure();

    mutable ConcurrentJITLock m_lock;
    
    Kind m_kind { Bottom };

    class InferredStructure : public Watchpoint, public UnconditionalFinalizer {
    public:
        InferredStructure(InferredType* parent, Structure*);

        Structure* structure() const { return m_structure.get(); };

    protected:
        void fireInternal(const FireDetail&) override;
        void finalizeUnconditionally() override;

    private:
        InferredType* m_parent;
        WriteBarrier<Structure> m_structure;
    };

    std::unique_ptr<InferredStructure> m_structure;

    // NOTE: If this is being watched, we transform to Top because that implies that it wouldn't be
    // profitable to watch it again. Also, this set is initialized clear, and is never exposed to the DFG
    // thread. The DFG will use the InferredType as the thing that it watches.
    InlineWatchpointSet m_watchpointSet;
};

} // namespace JSC

namespace WTF {

void printInternal(PrintStream&, JSC::InferredType::Kind);

} // namespace WTF

#endif // InferredType_h




/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "InferredTypeTable.h"

#include "JSCInlines.h"

namespace JSC {

const ClassInfo InferredTypeTable::s_info = { "InferredTypeTable", 0, 0, CREATE_METHOD_TABLE(InferredTypeTable) };

InferredTypeTable* InferredTypeTable::create(VM& vm)
{
    InferredTypeTable* result = new (NotNull, allocateCell<InferredTypeTable>(vm.heap)) InferredTypeTable(vm);
    result->finishCreation(vm);
    return result;
}

void InferredTypeTable::destroy(JSCell* cell)
{
    InferredTypeTable* inferredTypeTable = static_cast<InferredTypeTable*>(cell);
    inferredTypeTable->InferredTypeTable::~InferredTypeTable();
}

Structure* InferredTypeTable::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
{
    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
}

void InferredTypeTable::visitChildren(JSCell* cell, SlotVisitor& visitor)
{
    InferredTypeTable* inferredTypeTable = jsCast<InferredTypeTable*>(cell);

    ConcurrentJITLocker locker(m_lock);
    
    for (auto& entry : m_table) {
        if (entry.value->isRelevant())
            visitor.append(&entry.value);
        else
            entry.value.clear();
    }
}

InferredType* InferredTypeTable::get(const ConcurrentJITLocker& locker, UniquedStringImpl* uid)
{
    auto iter = m_table.find(uid);
    if (iter == m_table.end() || !iter->value)
        return nullptr;

    // Take this opportunity to prune invalidated types.
    if (!iter->value->isRelevant()) {
        iter->value.clear();
        return nullptr;
    }

    return iter->value.get();
}

InferredType* InferredTypeTable::get(UniquedStringImpl* uid)
{
    ConcurrentJITLocker locker(m_lock);
    return get(locker, uid);
}

InferredType* InferredTypeTable::get(PropertyName propertyName)
{
    return get(propertyName.uid());
}

bool InferredTypeTable::willStoreValue(
    VM& vm, PropertyName propertyName, JSValue value, StoredPropertyAge age)
{
    // The algorithm here relies on the fact that only one thread modifies the hash map.
    
    if (age == OldProperty) {
        TypeTable::iterator iter = m_table.find(propertyName);
        if (iter == m_table.end() || !iter->value)
            return false; // Absence on replace => top.
        
        if (iter->value->willStoreValue(vm, value))
            return true;
        
        iter->value.clear();
        return false;
    }

    TypeTable::AddResult result;
    {
        ConcurrentJITLocker locker(m_lock);
        result = m_table.add(propertyName, WriteBarrier<InferredType>());
    }
    if (result.isNewEntry) {
        InferredType* inferredType = InferredType::create(vm);
        WTF::storeStoreFence();
        result.iterator->value.set(vm, this, inferredType);
    } else if (!result.iterator->value)
        return false;
    
    if (result.iterator->value->willStoreValue(vm, value))
        return true;
    
    result.iterator->value.clear();
    return false;
}

void InferredTypeTable::makeTop(VM& vm, PropertyName propertyName, StoredPropertyAge age)
{
    // The algorithm here relies on the fact that only one thread modifies the hash map.
    if (age == OldProperty) {
        TypeTable::iterator iter = m_table.find(propertyName);
        if (iter == m_table.end() || !iter->value)
            return; // Absence on replace => top.

        iter->value->makeTop();
        iter->value.clear();
        return;
    }
    
    ConcurrentJITLocker locker(m_lock);
    TypeTable::AddResult result = m_table.add(propertyName, WriteBarrier<InferredType>());
    if (!result.iterator->value)
        return;
    
    result.iterator->value->makeTop();
    result.iterator->value.clear();
}

void InferredTypeTable::makeTopForTransition(VM& vm, PropertyName propertyName)
{
}

} // namespace JSC




/*
 * Copyright (C) 2015 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#ifndef InferredTypeTable_h
#define InferredTypeTable_h

#include "InferredType.h"
#include "JSCell.h"

namespace JSC {

// A table of inferred types for some structure. This is a JSCell because that simplifies the Structure
// destructor and makes lifetype easier to manage. For example, since it's a cell, we know that this thing
// cannot be deleted while the DFG is running. This is separate from PropertyTable because most properties
// will not have an InferredType, since most properties are in dictionaries (if you think of "a property"
// as being "a property in some Structure"). Also, this will happily conflate the types of properties from
// different structures even if the structures represent disjoint sets of objects.

class InferredTypeTable final : public JSCell {
public:
    typedef JSCell Base;

    static InferredTypeTable* create(VM&);

    static const bool needsDestruction = true;
    static void destroy(JSCell*);

    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);

    static void visitChildren(JSCell*, SlotVisitor&);

    DECLARE_INFO;

    ConcurrentJITLock& lock() { return m_lock; }

    bool isEmpty() const { return m_table.isEmpty(); }

    // Get the current inferred type. Returns nullptr for both Top and Bottom. Null means Bottom if the
    // owning Structure doesn't know about the property.
    InferredType* get(const ConcurrentJITLocker&, UniquedStringImpl*);
    InferredType* get(UniquedStringImpl*);
    InferredType* get(PropertyName);

    enum StoredPropertyAge {
        NewProperty,
        OldProperty
    };
    
    // Returns true if the InferredType for this property is still relevant after the store. It's not
    // relevant if it's Top. Note that this table will internally prune Top entries.
    bool willStoreValue(VM&, PropertyName, JSValue, StoredPropertyAge);

    // Invalidates the type for the property. Useful if we detect a store in a reflective context.
    void makeTop(VM&, PropertyName, StoredPropertyAge);

private:
    InferredTypeTable(VM&);
    ~InferredTypeTable();

    // Bottom: absence from table.
    // Top: null value in table, !value->isRelevant(), or absence from table.
    //
    // We know how to determine if absence from the table is bottom or top depending on whether the
    // property is present in the owning structure. Hence, depending on the structure, absence may have
    // different meanings. The way that this class determines if the owning structure knows of the property
    // is that we differentiate between actions: replace or transition. If we're adding a new property
    // (transition), then absence means bottom. If we're storing to an existing property (replace, then
    // absence means top. To make this work, we have to watch out for the case where two structures, S1 and
    // S2, share the same InferredTypeTable and neither of them initially know about property P. S1 may
    // want to add P without a type, while S2 may want to add P with a type. If S1 added P and used absence
    // to indicate Top, then S2 would use that absence to mean Bottom and would end up creating a non-Top
    // entry in the table. Then S1 would forget that it wanted Top, and would use S2's type. Clearly,
    // that's bad. We avoid such confusion by ensuring that a transition always adds an entry. Hence,
    // absence-means-bottom only comes into play for properties added before the InferredTypeTable was
    // created.
    typedef HashMap<RefPtr<UniquedStringImpl>, WriteBarrier<InferredType>, IdentifierRepHash, HashTraits<UniquedStringImpl*>> TableType;
    
    TableType m_table;

    // We only grab this lock when we're doing modifications on the main thread, or reads on the compiler
    // thread. The compiler thread is not allowed to do modifications.
    ConcurrentJITLock m_lock;
};

} // namespace JSC

#endif // InferredTypeTable_h



Lines 1189-1194 inline bool JSObject::putDirectInternal( Source/JavaScriptCore/runtime/JSObject.h_sec1
- Source/JavaScriptCore/runtime/JSObject.h -1 / +10 lines
1189		1189
1190	Structure* structure = this->structure(vm);	1190	Structure* structure = this->structure(vm);
1191	if (structure->isDictionary()) {	1191	if (structure->isDictionary()) {
		1192	ASSERT(!structure->hasInferredTypes());
		1193
1192	unsigned currentAttributes;	1194	unsigned currentAttributes;
1193	PropertyOffset offset = structure->get(vm, propertyName, currentAttributes);	1195	PropertyOffset offset = structure->get(vm, propertyName, currentAttributes);
1194	if (offset != invalidOffset) {	1196	if (offset != invalidOffset) {
Lines 1228-1233 inline bool JSObject::putDirectInternal( Source/JavaScriptCore/runtime/JSObject.h_sec2
1228	PropertyOffset offset;	1230	PropertyOffset offset;
1229	size_t currentCapacity = this->structure()->outOfLineCapacity();	1231	size_t currentCapacity = this->structure()->outOfLineCapacity();
1230	if (Structure* structure = Structure::addPropertyTransitionToExistingStructure(this->structure(), propertyName, attributes, offset)) {	1232	if (Structure* structure = Structure::addPropertyTransitionToExistingStructure(this->structure(), propertyName, attributes, offset)) {
		1233	structure->willStoreValueForTransition(vm, propertyName, value, slot.context() == PutById);
		1234
1231	DeferGC deferGC(vm.heap);	1235	DeferGC deferGC(vm.heap);
1232	Butterfly* newButterfly = butterfly();	1236	Butterfly* newButterfly = butterfly();
1233	if (currentCapacity != structure->outOfLineCapacity()) {	1237	if (currentCapacity != structure->outOfLineCapacity()) {
Lines 1244-1255 inline bool JSObject::putDirectInternal( Source/JavaScriptCore/runtime/JSObject.h_sec3
1244	}	1248	}
1245		1249
1246	unsigned currentAttributes;	1250	unsigned currentAttributes;
1247	offset = structure->get(vm, propertyName, currentAttributes);	1251	bool hasInferredType;
		1252	offset = structure->get(vm, propertyName, currentAttributes, hasInferredType);
1248	if (offset != invalidOffset) {	1253	if (offset != invalidOffset) {
1249	if ((mode == PutModePut) && currentAttributes & ReadOnly)	1254	if ((mode == PutModePut) && currentAttributes & ReadOnly)
1250	return false;	1255	return false;
1251		1256
1252	structure->didReplaceProperty(offset);	1257	structure->didReplaceProperty(offset);
		1258	if (UNLIKELY(hasInferredType))
		1259	structure->willStoreValueForReplace(vm, propertyName, value, slot.context() == PutById);
		1260
1253	slot.setExistingProperty(this, offset);	1261	slot.setExistingProperty(this, offset);
1254	putDirect(vm, offset, value);	1262	putDirect(vm, offset, value);
1255		1263
Lines 1269-1274 inline bool JSObject::putDirectInternal( Source/JavaScriptCore/runtime/JSObject.h_sec4
1269	DeferredStructureTransitionWatchpointFire deferredWatchpointFire;	1277	DeferredStructureTransitionWatchpointFire deferredWatchpointFire;
1270		1278
1271	structure = Structure::addPropertyTransition(vm, structure, propertyName, attributes, offset, slot.context(), &deferredWatchpointFire);	1279	structure = Structure::addPropertyTransition(vm, structure, propertyName, attributes, offset, slot.context(), &deferredWatchpointFire);
		1280	structure->willStoreValueForTransition(vm, propertyName, value, slot.context() == PutById);
1272		1281
1273	validateOffset(offset);	1282	validateOffset(offset);
1274	ASSERT(structure->isValidOffset(offset));	1283	ASSERT(structure->isValidOffset(offset));

Lines 347-357 void Structure::materializePropertyMap(V Source/JavaScriptCore/runtime/Structure.cpp_sec1
- Source/JavaScriptCore/runtime/Structure.cpp +62 lines
347	else	347	else
348	propertyTable().set(vm, this, table);	348	propertyTable().set(vm, this, table);
349		349
		350	InferredTypeTable* typeTable = m_inferredTypeTable.get();
		351
350	for (size_t i = structures.size(); i--;) {	352	for (size_t i = structures.size(); i--;) {
351	structure = structures[i];	353	structure = structures[i];
352	if (!structure->m_nameInPrevious)	354	if (!structure->m_nameInPrevious)
353	continue;	355	continue;
354	PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->attributesInPrevious());	356	PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->attributesInPrevious());
		357	if (typeTable && typeTable->get(structure->m_nameInPrevious.get()))
		358	entry.hasInferredType = true;
355	propertyTable()->add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);	359	propertyTable()->add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);
356	}	360	}
357		361
Lines 461-466 Structure* Structure::addPropertyTransit Source/JavaScriptCore/runtime/Structure.cpp_sec2
461	transition->setAttributesInPrevious(attributes);	465	transition->setAttributesInPrevious(attributes);
462	transition->propertyTable().set(vm, transition, structure->takePropertyTableOrCloneIfPinned(vm));	466	transition->propertyTable().set(vm, transition, structure->takePropertyTableOrCloneIfPinned(vm));
463	transition->m_offset = structure->m_offset;	467	transition->m_offset = structure->m_offset;
		468	transition->m_inferredTypeTable.setMayBeNull(vm, transition, structure->m_inferredTypeTable.get());
464		469
465	offset = transition->add(vm, propertyName, attributes);	470	offset = transition->add(vm, propertyName, attributes);
466		471
Lines 476-481 Structure* Structure::addPropertyTransit Source/JavaScriptCore/runtime/Structure.cpp_sec3
476		481
477	Structure* Structure::removePropertyTransition(VM& vm, Structure* structure, PropertyName propertyName, PropertyOffset& offset)	482	Structure* Structure::removePropertyTransition(VM& vm, Structure* structure, PropertyName propertyName, PropertyOffset& offset)
478	{	483	{
		484	// NOTE: There are some good reasons why this goes directly to uncacheable dictionary rather than
		485	// caching the removal. We can fix all of these things, but we must remember to do so, if we ever try
		486	// to optimize this case.
		487	//
		488	// - Cached transitions usually steal the property table, and assume that this is possible because they
		489	// can just rebuild the table by looking at past transitions. That code assumes that the table only
		490	// grew and never shrank. To support removals, we'd have to change the property table materialization
		491	// code to handle deletions. Also, we have logic to get the list of properties on a structure that
		492	// lacks a property table by just looking back through the set of transitions since the last
		493	// structure that had a pinned table. That logic would also have to be changed to handle cached
		494	// removals.
		495	//
		496	// - InferredTypeTable assumes that removal has never happened. This is important since if we could
		497	// remove a property and then re-add it later, then the "absence means top" optimization wouldn't
		498	// work anymore, unless removal also either poisoned type inference (by doing something equivalent to
		499	// hasBeenDictionary) or by strongly marking the entry as Top by ensuring that it is not absent, but
		500	// instead, has a null entry.
		501
479	ASSERT(!structure->isUncacheableDictionary());	502	ASSERT(!structure->isUncacheableDictionary());
480		503
481	Structure* transition = toUncacheableDictionaryTransition(vm, structure);	504	Structure* transition = toUncacheableDictionaryTransition(vm, structure);
Lines 838-843 void Structure::startWatchingInternalPro Source/JavaScriptCore/runtime/Structure.cpp_sec4
838	setDidWatchInternalProperties(true);	861	setDidWatchInternalProperties(true);
839	}	862	}
840		863
		864	void Structure::willStoreValueSlow(
		865	VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize,
		866	InferredTypeTable::StoredPropertyAge age)
		867	{
		868	ASSERT(!isCompilationThread());
		869	ASSERT(structure()->classInfo() == info());
		870	ASSERT(!hadBeenDictionary());
		871
		872	// Create the inferred type table before doing anything else, so that we don't GC after we have already
		873	// grabbed a pointer into the property map.
		874	InferredTypeTable* table = m_inferredTypeTable.get();
		875	if (!table) {
		876	table = InferredTypeTable::create(vm);
		877	WTF::storeStoreBarrier();
		878	m_inferredTypeTable.set(vm, this, table);
		879	}
		880
		881	// This only works if we've got a property table.
		882	PropertyTable* propertyTable;
		883	materializePropertyMapIfNecessary(vm, propertyTable);
		884
		885	// We must be calling this after having created the given property or confirmed that it was present
		886	// already, so we must have a property table now.
		887	ASSERT(propertyTable);
		888
		889	// ... and the property must be present.
		890	PropertyMapEntry* entry = propertyTable->get(propertyName.uid());
		891	ASSERT(entry);
		892
		893	if (shouldOptimize)
		894	entry->hasInferredType = table->willStoreValue(vm, propertyName, value, age);
		895	else {
		896	table->makeTop(vm, propertyName, age);
		897	entry->hasInferredType = false;
		898	}
		899	}
		900
841	#if DUMP_PROPERTYMAP_STATS	901	#if DUMP_PROPERTYMAP_STATS
842		902
843	PropertyMapHashTableStats* propertyMapHashTableStats = 0;	903	PropertyMapHashTableStats* propertyMapHashTableStats = 0;
Lines 1055-1060 void Structure::visitChildren(JSCell* ce Source/JavaScriptCore/runtime/Structure.cpp_sec5
1055	visitor.append(&thisObject->m_propertyTableUnsafe);	1115	visitor.append(&thisObject->m_propertyTableUnsafe);
1056	} else if (thisObject->m_propertyTableUnsafe)	1116	} else if (thisObject->m_propertyTableUnsafe)
1057	thisObject->m_propertyTableUnsafe.clear();	1117	thisObject->m_propertyTableUnsafe.clear();
		1118
		1119	visitor.append(&thisObject->m_inferredTypeTable);
1058	}	1120	}
1059		1121
1060	bool Structure::prototypeChainMayInterceptStoreTo(VM& vm, PropertyName propertyName)	1122	bool Structure::prototypeChainMayInterceptStoreTo(VM& vm, PropertyName propertyName)



#include "ClassInfo.h"
#include "ConcurrentJITLock.h"
#include "IndexingType.h"
#include "InferredTypeTable.h"
#include "JSCJSValue.h"
#include "JSCell.h"
#include "JSType.h"

    UniquedStringImpl* key;
    PropertyOffset offset;
    uint8_t attributes;
    bool hasInferredType; // This caches whether or not a property has an inferred type in the inferred type table, and is used for a fast check in JSObject::putDirectInternal().

    PropertyMapEntry()
        : key(nullptr)
        , offset(invalidOffset)
        , attributes(0)
        , hasInferredType(false)
    {
    }
    

        : key(key)
        , offset(offset)
        , attributes(attributes)
        , hasInferredType(false)
    {
        ASSERT(this->attributes == attributes);
    }


    PropertyOffset get(VM&, PropertyName);
    PropertyOffset get(VM&, PropertyName, unsigned& attributes);
    PropertyOffset get(VM&, PropertyName, unsigned& attributes, bool& hasInferredType);

    // This is a somewhat internalish method. It will call your functor while possibly holding the
    // Structure's lock. There is no guarantee whether the lock is held or not in any particular

            structure->startWatchingInternalPropertiesIfNecessary(vm);
    }

    bool hasInferredTypes() const
    {
        return !!m_inferredTypeTable;
    }

    InferredType* inferredTypeFor(UniquedStringImpl* uid)
    {
        if (InferredTypeTable* table = m_inferredTypeTable.get())
            return table->get(uid);
        return nullptr;
    }

    // Returns true if the type of the property is still valid.
    ALWAYS_INLINE void willStoreValueForTransition(
        VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize)
    {
        if (hasBeenDictionary() || (!shouldOptimize && !m_inferredTypeTable))
            return;
        willStoreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::NewProperty);
    }
    ALWAYS_INLINE void willStoreValueForReplace(
        VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize)
    {
        if (hasBeenDictionary())
            return;
        willSloreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::OldProperty);
    }

    PassRefPtr<StructureShape> toStructureShape(JSValue);
    
    // Determines if the two structures match enough that this one could be used for allocations

    
    void startWatchingInternalProperties(VM&);

    void willStoreValueSlow(
        VM&, PropertyOffset, PropertyName, JSValue, bool, InferredTypeTable::StoredPropertyAge);

    static const int s_maxTransitionLength = 64;
    static const int s_maxTransitionLengthForNonEvalPutById = 512;


    // Should be accessed through propertyTable(). During GC, it may be set to 0 by another thread.
    WriteBarrier<PropertyTable> m_propertyTableUnsafe;

    WriteBarrier<InferredTypeTable> m_inferredTypeTable;

    mutable InlineWatchpointSet m_transitionWatchpointSet;

    COMPILE_ASSERT(firstOutOfLineOffset < 256, firstOutOfLineOffset_fits);




ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName)
{
    unsigned attributes;
    bool hasInferredType;
    return get(vm, propertyName, attributes, hasInferredType);
    materializePropertyMapIfNecessary(vm, propertyTable);
    if (!propertyTable)
        return invalidOffset;

    PropertyMapEntry* entry = propertyTable->get(propertyName.uid());
    return entry ? entry->offset : invalidOffset;
}
    
ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes)
{
    bool hasInferredType;
    return get(vm, propertyName, attributes, hasInferredType);
}

ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes, bool& hasInferredType)
{
    ASSERT(!isCompilationThread());
    ASSERT(structure()->classInfo() == info());


        return invalidOffset;

    attributes = entry->attributes;
    hasInferredType = entry->hasInferredType;
    return entry->offset;
}


Return to Bug 148610

Lines 1829-1838 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec1
- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h -42 / +71 lines
1829	}	1829	}
1830		1830
1831	AbstractValue& value = forNode(node->child1());	1831	AbstractValue& value = forNode(node->child1());
1832	if (!value.m_structure.isTop() && !value.m_structure.isClobbered()	1832	if (value.m_structure.isFinite()
1833	&& (node->child1().useKind() == CellUse \|\| !(value.m_type & ~SpecCell))) {	1833	&& (node->child1().useKind() == CellUse \|\| !(value.m_type & ~SpecCell))) {
1834	GetByIdStatus status = GetByIdStatus::computeFor(	1834	UniquedStringImpl* uid = m_graph.identifiers()[node->identifierNumber()];
1835	value.m_structure.set(), m_graph.identifiers()[node->identifierNumber()]);	1835	GetByIdStatus status = GetByIdStatus::computeFor(value.m_structure.set(), uid);
1836	if (status.isSimple()) {	1836	if (status.isSimple()) {
1837	// Figure out what the result is going to be - is it TOP, a constant, or maybe	1837	// Figure out what the result is going to be - is it TOP, a constant, or maybe
1838	// something more subtle?	1838	// something more subtle?
Lines 1841-1862 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec2
1841	// This thing won't give us a variant that involves prototypes. If it did, we'd	1841	// This thing won't give us a variant that involves prototypes. If it did, we'd
1842	// have more work to do here.	1842	// have more work to do here.
1843	DFG_ASSERT(m_graph, node, status[i].conditionSet().isEmpty());	1843	DFG_ASSERT(m_graph, node, status[i].conditionSet().isEmpty());
1844		1844
1845	JSValue constantResult =	1845	result.merge(
1846	m_graph.tryGetConstantProperty(value, status[i].offset());	1846	m_graph.inferredValueForProperty(
1847	if (!constantResult) {	1847	value, uid, status[i].offset(), m_graph.structureClobberState()));
1848	result.makeHeapTop();
1849	break;
1850	}
1851
1852	AbstractValue thisResult;
1853	thisResult.set(
1854	m_graph, *m_graph.freeze(constantResult),
1855	m_state.structureClobberState());
1856	result.merge(thisResult);
1857	}	1848	}
1858	if (status.numVariants() == 1 \|\| isFTL(m_graph.m_plan.mode))	1849	m_state.setFoundConstants(true);
1859	m_state.setFoundConstants(true);
1860	forNode(node) = result;	1850	forNode(node) = result;
1861	break;	1851	break;
1862	}	1852	}
Lines 1880-1886 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec3
1880		1870
1881	case CheckStructure: {	1871	case CheckStructure: {
1882	AbstractValue& value = forNode(node->child1());	1872	AbstractValue& value = forNode(node->child1());
1883	ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.
1884		1873
1885	StructureSet& set = node->structureSet();	1874	StructureSet& set = node->structureSet();
1886		1875
Lines 1888-1899 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec4
1888	// that includes the set we're testing. In that case we could make the structure check	1877	// that includes the set we're testing. In that case we could make the structure check
1889	// more efficient. We currently don't.	1878	// more efficient. We currently don't.
1890		1879
1891	if (value.m_structure.isSubsetOf(set)) {	1880	if (value.m_structure.isSubsetOf(set))
1892	m_state.setFoundConstants(true);	1881	m_state.setFoundConstants(true);
		1882
		1883	SpeculatedType admittedTypes = SpecNone;
		1884	switch (node->child1().useKind()) {
		1885	case CellUse:
		1886	admittedTypes = SpecNone;
		1887	break;
		1888	case CellOrOther:
		1889	admittedTypes = SpecOther;
		1890	break;
		1891	default:
		1892	DFG_CRASH(m_graph, node, "Bad use kind");
1893	break;	1893	break;
1894	}	1894	}
1895		1895
1896	filter(value, set);	1896	filter(value, set, admittedTypes);
1897	break;	1897	break;
1898	}	1898	}
1899		1899
Lines 2084-2096 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec5
2084		2084
2085	case GetByOffset: {	2085	case GetByOffset: {
2086	StorageAccessData& data = node->storageAccessData();	2086	StorageAccessData& data = node->storageAccessData();
2087	JSValue result = m_graph.tryGetConstantProperty(forNode(node->child2()), data.offset);	2087	UniquedStringImpl* uid = m_graph.identifiers()[data.identifierNumber];
2088	if (result) {	2088
2089	setConstant(node, *m_graph.freeze(result));	2089	// FIXME: The part of this that handles inferred property types relies on AI knowing the structure
2090	break;	2090	// right now. That's probably not optimal. In some cases, we may perform an optimization (usually
2091	}	2091	// by something other than AI, maybe by CSE for example) that obscures AI's view of the structure
2092		2092	// at the point where GetByOffset runs. Currently, when that happens, we'll have to rely entirely
2093	forNode(node).makeHeapTop();	2093	// on the type that ByteCodeParser was able to prove.
		2094	AbstractValue value = m_graph.inferredValueForProperty(
		2095	forNode(node->child2()), uid, data.offset, m_state.structureClobberState());
		2096
		2097	// It's possible that the type that ByteCodeParser came up with is better.
		2098	AbstractValue typeFromParsing;
		2099	typeFromParsing.set(m_graph, data->inferredType, m_state.structureClobberState());
		2100	value.filter(typeFromParsing);
		2101
		2102	// If we decide that there does not exist any value that this can return, then it's probably
		2103	// because the compilation was already invalidated.
		2104	if (value.isClear())
		2105	m_state.setIsValid(false);
		2106
		2107	forNode(node) = value;
		2108	if (value.m_value)
		2109	m_state.setFoundConstants(true);
2094	break;	2110	break;
2095	}	2111	}
2096		2112
Lines 2120-2125 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec6
2120	// because of the effect on compile times, but this node is FTL-only.	2136	// because of the effect on compile times, but this node is FTL-only.
2121	m_state.setFoundConstants(true);	2137	m_state.setFoundConstants(true);
2122		2138
		2139	UniquedStringImpl* uid = m_graph.identifiers()[node->multiGetByOffsetData().identifierNumber];
		2140
2123	AbstractValue base = forNode(node->child1());	2141	AbstractValue base = forNode(node->child1());
2124	StructureSet baseSet;	2142	StructureSet baseSet;
2125	AbstractValue result;	2143	AbstractValue result;
Lines 2129-2146 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec7
2129	if (set.isEmpty())	2147	if (set.isEmpty())
2130	continue;	2148	continue;
2131	baseSet.merge(set);	2149	baseSet.merge(set);
2132		2150
2133	if (getCase.method().kind() != GetByOffsetMethod::Constant) {	2151	switch (getCase.method().kind()) {
2134	result.makeHeapTop();	2152	case GetByOffsetMethod::Constant: {
2135	continue;	2153	AbstractValue thisResult;
		2154	thisResult.set(
		2155	m_graph,
		2156	*getCase.method().constant(),
		2157	m_state.structureClobberState());
		2158	result.merge(thisResult);
		2159	break;
2136	}	2160	}
2137		2161
2138	AbstractValue thisResult;	2162	case GetByOffetMethod::Load: {
2139	thisResult.set(	2163	result.merge(
2140	m_graph,	2164	m_graph.inferredValueForProperty(
2141	*getCase.method().constant(),	2165	set, uid, getCase.method().offset(), m_graph.structureClobberState()));
2142	m_state.structureClobberState());	2166	break;
2143	result.merge(thisResult);	2167	}
		2168
		2169	default: {
		2170	result.makeHeapTop();
		2171	break;
		2172	} }
2144	}	2173	}
2145		2174
2146	if (forNode(node->child1()).changeStructure(m_graph, baseSet) == Contradiction)	2175	if (forNode(node->child1()).changeStructure(m_graph, baseSet) == Contradiction)
Lines 2615-2623 void AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec8
2615		2644
2616	template<typename AbstractStateType>	2645	template<typename AbstractStateType>
2617	FiltrationResult AbstractInterpreter<AbstractStateType>::filter(	2646	FiltrationResult AbstractInterpreter<AbstractStateType>::filter(
2618	AbstractValue& value, const StructureSet& set)	2647	AbstractValue& value, const StructureSet& set, SpeculatedType admittedTypes)
2619	{	2648	{
2620	if (value.filter(m_graph, set) == FiltrationOK)	2649	if (value.filter(m_graph, set, admittedTypes) == FiltrationOK)
2621	return FiltrationOK;	2650	return FiltrationOK;
2622	m_state.setIsValid(false);	2651	m_state.setIsValid(false);
2623	return Contradiction;	2652	return Contradiction;

Lines 205-213 private: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec1
- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp -10 / +23 lines
205	bool handleTypedArrayConstructor(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, TypedArrayType, const ChecksFunctor& insertChecks);	205	bool handleTypedArrayConstructor(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, TypedArrayType, const ChecksFunctor& insertChecks);
206	template<typename ChecksFunctor>	206	template<typename ChecksFunctor>
207	bool handleConstantInternalFunction(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, CodeSpecializationKind, const ChecksFunctor& insertChecks);	207	bool handleConstantInternalFunction(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, CodeSpecializationKind, const ChecksFunctor& insertChecks);
208	Node* handlePutByOffset(Node* base, unsigned identifier, PropertyOffset, Node* value);	208	Node* handlePutByOffset(Node* base, unsigned identifier, PropertyOffset, const InferredType::Descriptor&, Node* value);
209	Node* handleGetByOffset(SpeculatedType, Node* base, unsigned identifierNumber, PropertyOffset, NodeType = GetByOffset);	209	Node* handleGetByOffset(SpeculatedType, Node* base, unsigned identifierNumber, PropertyOffset, const InferredType::Descriptor&, NodeType = GetByOffset);
210	Node* handleGetByOffset(SpeculatedType, Node* base, UniquedStringImpl*, PropertyOffset, NodeType = GetByOffset);
211		210
212	// Create a presence ObjectPropertyCondition based on some known offset and structure set. Does not	211	// Create a presence ObjectPropertyCondition based on some known offset and structure set. Does not
213	// check the validity of the condition, but it may return a null one if it encounters a contradiction.	212	// check the validity of the condition, but it may return a null one if it encounters a contradiction.
Lines 2303-2309 bool ByteCodeParser::handleConstantInter Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec2
2303	return false;	2302	return false;
2304	}	2303	}
2305		2304
2306	Node* ByteCodeParser::handleGetByOffset(SpeculatedType prediction, Node* base, unsigned identifierNumber, PropertyOffset offset, NodeType op)	2305	Node* ByteCodeParser::handleGetByOffset(
		2306	SpeculatedType prediction, Node* base, unsigned identifierNumber, PropertyOffset offset,
		2307	const InferredType::Descriptor& inferredType, NodeType op)
2307	{	2308	{
2308	Node* propertyStorage;	2309	Node* propertyStorage;
2309	if (isInlineOffset(offset))	2310	if (isInlineOffset(offset))
Lines 2314-2326 Node* ByteCodeParser::handleGetByOffset( Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec3
2314	StorageAccessData* data = m_graph.m_storageAccessData.add();	2315	StorageAccessData* data = m_graph.m_storageAccessData.add();
2315	data->offset = offset;	2316	data->offset = offset;
2316	data->identifierNumber = identifierNumber;	2317	data->identifierNumber = identifierNumber;
		2318	data->inferredType = inferredType;
2317		2319
2318	Node* getByOffset = addToGraph(op, OpInfo(data), OpInfo(prediction), propertyStorage, base);	2320	Node* getByOffset = addToGraph(op, OpInfo(data), OpInfo(prediction), propertyStorage, base);
2319		2321
2320	return getByOffset;	2322	return getByOffset;
2321	}	2323	}
2322		2324
2323	Node* ByteCodeParser::handlePutByOffset(Node* base, unsigned identifier, PropertyOffset offset, Node* value)	2325	Node* ByteCodeParser::handlePutByOffset(
		2326	Node* base, unsigned identifier, PropertyOffset offset, const InferredType::Descriptor& inferredType,
		2327	Node* value)
2324	{	2328	{
2325	Node* propertyStorage;	2329	Node* propertyStorage;
2326	if (isInlineOffset(offset))	2330	if (isInlineOffset(offset))
Lines 2331-2336 Node* ByteCodeParser::handlePutByOffset( Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec4
2331	StorageAccessData* data = m_graph.m_storageAccessData.add();	2335	StorageAccessData* data = m_graph.m_storageAccessData.add();
2332	data->offset = offset;	2336	data->offset = offset;
2333	data->identifierNumber = identifier;	2337	data->identifierNumber = identifier;
		2338	data->inferredType = inferredType;
2334		2339
2335	Node* result = addToGraph(PutByOffset, OpInfo(data), propertyStorage, base, value);	2340	Node* result = addToGraph(PutByOffset, OpInfo(data), propertyStorage, base, value);
2336		2341
Lines 2445-2451 Node* ByteCodeParser::load( Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec5
2445	return addToGraph(JSConstant, OpInfo(method.constant()));	2450	return addToGraph(JSConstant, OpInfo(method.constant()));
2446	case GetByOffsetMethod::LoadFromPrototype: {	2451	case GetByOffsetMethod::LoadFromPrototype: {
2447	Node* baseNode = addToGraph(JSConstant, OpInfo(method.prototype()));	2452	Node* baseNode = addToGraph(JSConstant, OpInfo(method.prototype()));
2448	return handleGetByOffset(prediction, baseNode, identifierNumber, method.offset(), op);	2453	return handleGetByOffset(
		2454	prediction, baseNode, identifierNumber, method.offset(), InferredType::Top, op);
2449	}	2455	}
2450	case GetByOffsetMethod::Load:	2456	case GetByOffsetMethod::Load:
2451	// Will never see this from planLoad().	2457	// Will never see this from planLoad().
Lines 2551-2563 Node* ByteCodeParser::load( Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec6
2551		2557
2552	bool needStructureCheck = true;	2558	bool needStructureCheck = true;
2553		2559
		2560	UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
		2561
2554	if (JSObject* knownBase = base->dynamicCastConstant<JSObject*>()) {	2562	if (JSObject* knownBase = base->dynamicCastConstant<JSObject*>()) {
2555	// Try to optimize away the structure check. Note that it's not worth doing anything about this	2563	// Try to optimize away the structure check. Note that it's not worth doing anything about this
2556	// if the base's structure is watched.	2564	// if the base's structure is watched.
2557	Structure* structure = base->constant()->structure();	2565	Structure* structure = base->constant()->structure();
2558	if (!structure->dfgShouldWatch()) {	2566	if (!structure->dfgShouldWatch()) {
2559	UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
2560
2561	if (!variant.conditionSet().isEmpty()) {	2567	if (!variant.conditionSet().isEmpty()) {
2562	// This means that we're loading from a prototype. We expect the base not to have the	2568	// This means that we're loading from a prototype. We expect the base not to have the
2563	// property. We can only use ObjectPropertyCondition if all of the structures in the	2569	// property. We can only use ObjectPropertyCondition if all of the structures in the
Lines 2622-2630 Node* ByteCodeParser::load( Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec7
2622	if (constant)	2628	if (constant)
2623	return weakJSConstant(constant);	2629	return weakJSConstant(constant);
2624	}	2630	}
		2631
		2632	InferredType::Descriptor inferredType;
		2633	if (needStructureCheck) {
		2634	for (Structure* structure : variant.structureSet())
		2635	inferredType.merge(m_graph.inferredTypeForProperty(structure, uid));
		2636	} else
		2637	inferredType = InferredType::Top;
2625		2638
2626	loadedValue = handleGetByOffset(	2639	loadedValue = handleGetByOffset(
2627	loadPrediction, base, identifierNumber, variant.offset(), loadOp);	2640	loadPrediction, base, identifierNumber, variant.offset(), inferredType, loadOp);
2628	}	2641	}
2629		2642
2630	return loadedValue;	2643	return loadedValue;
Lines 2635-2641 Node* ByteCodeParser::store(Node* base, Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec8
2635	RELEASE_ASSERT(variant.kind() == PutByIdVariant::Replace);	2648	RELEASE_ASSERT(variant.kind() == PutByIdVariant::Replace);
2636		2649
2637	checkPresenceLike(base, m_graph.identifiers()[identifier], variant.offset(), variant.structure());	2650	checkPresenceLike(base, m_graph.identifiers()[identifier], variant.offset(), variant.structure());
2638	return handlePutByOffset(base, identifier, variant.offset(), value);	2651	return handlePutByOffset(base, identifier, variant.offset(), variant.inferredType(), value);
2639	}	2652	}
2640		2653
2641	void ByteCodeParser::handleGetById(	2654	void ByteCodeParser::handleGetById(

Lines 5229-5234 void SpeculativeJIT::compileTypeOf(Node* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp +93 lines
5229	cellResult(resultGPR, node);	5229	cellResult(resultGPR, node);
5230	}	5230	}
5231		5231
		5232	void SpeculativeJIT::compileCheckStructure(Node* node, GPRReg cellGPR, GPRReg tempGPR)
		5233	{
		5234	ASSERT(node->structureSet().size());
		5235
		5236	if (node->structureSet().size() == 1) {
		5237	speculationCheck(
		5238	BadCache, JSValueSource::unboxedCell(cellGPR), 0,
		5239	m_jit.branchWeakStructure(
		5240	JITCompiler::NotEqual,
		5241	JITCompiler::Address(cellGPR, JSCell::structureIDOffset()),
		5242	node->structureSet()[0]));
		5243	} else {
		5244	std::unique_ptr<GPRTemporary> structure;
		5245	GPRReg structureGPR;
		5246
		5247	if (tempGPR == InvalidGPR) {
		5248	structure = std::make_unique<GPRTemporary>(this);
		5249	structureGPR = structure->gpr();
		5250	} else
		5251	structureGPR = tempGPR;
		5252
		5253	m_jit.load32(JITCompiler::Address(cellGPR, JSCell::structureIDOffset()), structureGPR);
		5254
		5255	JITCompiler::JumpList done;
		5256
		5257	for (size_t i = 0; i < node->structureSet().size() - 1; ++i) {
		5258	done.append(
		5259	m_jit.branchWeakStructur(JITCompiler::Equal, structureGPR, node->structureSet()[i]));
		5260	}
		5261
		5262	speculationCheck(
		5263	BadCache, JSValueSource::unboxedCell(cellGPR), 0,
		5264	m_jit.branchWeakStructure(
		5265	JITCompiler::NotEqual, structureGPR, node->structureSet().last()));
		5266
		5267	done.link(&m_jit);
		5268	}
		5269	}
		5270
		5271	void SpeculativeJIT::compileCheckStructure(Node* node)
		5272	{
		5273	switch (node->child1().useKind()) {
		5274	case CellUse: {
		5275	SpeculateCellOperand cell(this, node->child1());
		5276	compileCheckStructure(node, cell.gpr(), InvalidGPRReg);
		5277	noResult(node);
		5278	return;
		5279	}
		5280
		5281	case CellOrOtherUse: {
		5282	JSValueOperand value(this, node->child1(), ManualOperandSpeculation);
		5283	GPRTemporary temp(this);
		5284
		5285	JSValueRegs valueRegs = value.jsValueRegs();
		5286	GPRReg tempGPR = temp.gpr();
		5287
		5288	JITCompiler::Jump cell = m_jit.branchIfCell(valueRegs);
		5289	DFG_TYPE_CHECK(
		5290	valueRegs, node->child1(), SpecCell \| SpecOther,
		5291	m_jit.branchIfNotOther(valueRegs, tempGPR));
		5292	JITCompiler::Jump done = m_jit.jump();
		5293	cell.link(&m_jit);
		5294	compileCheckStructure(node, valueRegs.payloadGPR(), tempGPR);
		5295	done.link(&m_jit);
5296	noResult(this);
5297	return;
5298	}
5299
5300	default:
5301	DFG_CRASH(m_jit.graph(), node, "Bad use kind");
5302	return;
5303	}
5304	}
5305
5232	void SpeculativeJIT::compileAllocatePropertyStorage(Node* node)	5306	void SpeculativeJIT::compileAllocatePropertyStorage(Node* node)
5233	{	5307	{
5234	if (node->transition()->previous->couldHaveIndexingHeader()) {	5308	if (node->transition()->previous->couldHaveIndexingHeader()) {
Lines 5633-5638 void SpeculativeJIT::speculateCell(Edge Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec2
5633	(SpeculateCellOperand(this, edge)).gpr();	5707	(SpeculateCellOperand(this, edge)).gpr();
5634	}	5708	}
5635		5709
		5710	void SpeculativeJIT::speculateCellOrOther(Edge edge)
		5711	{
		5712	if (!needsTypeCheck(edge, SpecCell \| SpecOther))
		5713	return;
		5714
		5715	JSValueOperand operand(this, edge, ManualOperandSpeculation);
		5716	GPRTemporary temp(this);
		5717	GPRReg tempGPR = temp.gpr();
		5718
		5719	MacroAssembler::Jump ok = m_jit.branchIfCell(operand.jsValueRegs());
		5720	DFG_TYPE_CHECK(
		5721	operand.jsValueRegs(), edge, SpecCell \| SpecOther,
		5722	m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
		5723	ok.link(&m_jit);
		5724	}
		5725
5636	void SpeculativeJIT::speculateObject(Edge edge)	5726	void SpeculativeJIT::speculateObject(Edge edge)
5637	{	5727	{
5638	if (!needsTypeCheck(edge, SpecObject))	5728	if (!needsTypeCheck(edge, SpecObject))
Lines 5913-5918 void SpeculativeJIT::speculate(Node*, Ed Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec3
5913	case CellUse:	6003	case CellUse:
5914	speculateCell(edge);	6004	speculateCell(edge);
5915	break;	6005	break;
		6006	case CellOrOtherUse:
		6007	speculateCellOrOther(edge);
		6008	break;
5916	case ObjectUse:	6009	case ObjectUse:
5917	speculateObject(edge);	6010	speculateObject(edge);
5918	break;	6011	break;

Lines 2026-2046 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec1
- Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp -10 / +64 lines
2026		2026
2027	void compileCheckStructure()	2027	void compileCheckStructure()
2028	{	2028	{
2029	LValue cell = lowCell(m_node->child1());
2030
2031	ExitKind exitKind;	2029	ExitKind exitKind;
2032	if (m_node->child1()->hasConstant())	2030	if (m_node->child1()->hasConstant())
2033	exitKind = BadConstantCache;	2031	exitKind = BadConstantCache;
2034	else	2032	else
2035	exitKind = BadCache;	2033	exitKind = BadCache;
2036		2034
2037	LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);	2035	switch (m_node->child1().useKind()) {
2038		2036	case CellUse: {
2039	checkStructure(	2037	LValue cell = lowCell(m_node->child1());
2040	structureID, jsValueValue(cell), exitKind, m_node->structureSet(),	2038
2041	[this] (Structure* structure) {	2039	checkStructure(
2042	return weakStructureID(structure);	2040	m_out.load32(cell, m_heaps.JSCell_structureID), jsValueValue(cell),
2043	});	2041	exitKind, m_node->structureSet(),
		2042	[&] (Structure* structure) {
		2043	return weakStructureID(structure);
		2044	});
		2045	return;
		2046	}
		2047
		2048	case CellOrOtherUse: {
		2049	LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);
		2050
		2051	LBasicBlock cellCase = FTL_NEW_BLOCK(m_out, ("CheckStructure CellOrOtherUse cell case"));
		2052	LBasicBlock notCellCase = FTL_NEW_BLOCK(m_out, ("CheckStructure CellOrOtherUse not cell case"));
		2053	LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("CheckStructure CellOrOtherUse continuation"));
		2054
		2055	m_out.branch(
		2056	isCell(value, provenType(m_node->child1())), unsure(cellCase), unsure(notCellCase));
		2057
		2058	LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
		2059	checkStructure(
		2060	m_out.load32(cell, m_heaps.JSCell_structureID), jsValueValue(cell),
		2061	exitKind, m_node->structureSet(),
		2062	[&] (Structure* structure) {
		2063	return weakStructureID(structure);
		2064	});
		2065	m_out.jump(continuation);
		2066
		2067	m_out.appendTo(notCellCase, continuation);
		2068	FTL_TYPE_CHECK(jsValueValue(value), m_node->child1(), SpecCell \| SpecOther, isNotOther(value));
		2069	m_out.jump(continuation);
		2070
		2071	m_out.appendTo(continuation, lastNext);
		2072	return;
		2073	}
		2074
		2075	default:
		2076	DFG_CRASH(m_graph, m_node, "Bad use kind");
		2077	return;
		2078	}
2044	}	2079	}
2045		2080
2046	void compileCheckCell()	2081	void compileCheckCell()
Lines 7509-7514 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec2
7509	case CellUse:	7544	case CellUse:
7510	speculateCell(edge);	7545	speculateCell(edge);
7511	break;	7546	break;
		7547	case CellOrOtherUse:
		7548	speculateCellOrOther(edge);
		7549	break;
7512	case KnownCellUse:	7550	case KnownCellUse:
7513	ASSERT(!m_interpreter.needsTypeCheck(edge));	7551	ASSERT(!m_interpreter.needsTypeCheck(edge));
7514	break;	7552	break;
Lines 7589-7594 private: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec3
7589	lowCell(edge);	7627	lowCell(edge);
7590	}	7628	}
7591		7629
		7630	void speculateCellOrOther(Edge edge)
		7631	{
		7632	LValue value = lowJSValue(edge, ManualOperandSpeculation);
		7633
		7634	LBasicBlock isNotCell = FTL_NEW_BLOCK(m_out, ("Speculate CellOrOther not cell"));
		7635	LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Speculate CellOrOther continuation"));
		7636
		7637	m_out.branch(isCell(value, provenType(edge)), unsure(continuation), unsure(isNotCell));
		7638
		7639	LBasicBlock lastNext = m_out.appendTo(isNotCell, continuation);
		7640	FTL_TYPE_CHECK(jsValueValue(value), edge, SpecCell \| SpecOther, isNotOther(value));
		7641	m_out.jump(continuation);
		7642
		7643	m_out.appendTo(continuation, lastNext);
		7644	}
		7645
7592	void speculateMachineInt(Edge edge)	7646	void speculateMachineInt(Edge edge)
7593	{	7647	{
7594	if (!m_interpreter.needsTypeCheck(edge))	7648	if (!m_interpreter.needsTypeCheck(edge))

Lines 563-568 public: Source/JavaScriptCore/jit/AssemblyHelpers.h_sec1
- Source/JavaScriptCore/jit/AssemblyHelpers.h +12 lines
563	return branch32(Equal, regs.tagGPR(), TrustedImm32(JSValue::EmptyValueTag));	563	return branch32(Equal, regs.tagGPR(), TrustedImm32(JSValue::EmptyValueTag));
564	#endif	564	#endif
565	}	565	}
		566
		567	JumpList branchIfNotType(JSValueRegs regs, GPRReg tempGPR, const InferredType::Descriptor&);
		568
		569	template<typename T>
		570	Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)
		571	{
		572	#if USE(JSVALUE64)
		573	return branch32(condition, leftHandSide, TrustedImm32(structure->id()));
		574	#else
		575	return branchPtr(condition, leftHandSide, TrustedImmPtr(structure));
		576	#endif
		577	}
566		578
567	template<typename T>	579	template<typename T>
568	Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)	580	Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)

Lines 336-342 public: Source/JavaScriptCore/bytecode/Watchpoint.h_sec1
- Source/JavaScriptCore/bytecode/Watchpoint.h -1 / +33 lines
336	{	336	{
337	touch(StringFireDetail(reason));	337	touch(StringFireDetail(reason));
338	}	338	}
339		339
		340	// Note that for any watchpoint that is visible from the DFG, it would be incorrect to write code like:
		341	//
		342	// if (w.isBeingWatched())
		343	// w.fireAll()
		344	//
		345	// Concurrently to this, the DFG could do:
		346	//
		347	// if (w.isStillValid())
		348	// perform optimizations;
		349	// if (!w.isStillValid())
		350	// retry compilation;
		351	//
		352	// Note that the DFG algorithm is widespread, and sound, because fireAll() and invalidate() will leave
		353	// the watchpoint in a !isStillValid() state. Hence, if fireAll() or invalidate() interleaved between
		354	// the first isStillValid() check and the second one, then it would simply cause the DFG to retry
		355	// compilation later.
		356	//
		357	// But, if you change some piece of state that the DFG might optimize for, but invalidate the
		358	// watchpoint by doing:
		359	//
		360	// if (w.isBeingWatched())
		361	// w.fireAll()
		362	//
		363	// then the DFG would never know that you invalidated state between the two checks.
		364	//
		365	// There are two ways to work around this:
		366	//
		367	// - Call fireAll() without a isBeingWatched() check. Then, the DFG will know that the watchpoint has
		368	// been invalidated when it does its second check.
		369	//
		370	// - Do not expose the watchpoint set to the DFG directly, and have your own way of validating whether
		371	// the assumptions that the DFG thread used are still valid when the DFG code is installed.
340	bool isBeingWatched() const	372	bool isBeingWatched() const
341	{	373	{
342	if (isFat())	374	if (isFat())

Lines 116-124 public: Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h_sec1
- Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h -3 / +3 lines
116	void dump(PrintStream& out);	116	void dump(PrintStream& out);
117		117
118	template<typename T>	118	template<typename T>
119	FiltrationResult filter(T node, const StructureSet& set)	119	FiltrationResult filter(T node, const StructureSet& set, SpeculatedType admittedTypes = SpecNone)
120	{	120	{
121	return filter(forNode(node), set);	121	return filter(forNode(node), set, admittedTypes);
122	}	122	}
123		123
124	template<typename T>	124	template<typename T>
Lines 139-145 public: Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h_sec2
139	return filterByValue(forNode(node), value);	139	return filterByValue(forNode(node), value);
140	}	140	}
141		141
142	FiltrationResult filter(AbstractValue&, const StructureSet&);	142	FiltrationResult filter(AbstractValue&, const StructureSet&, SpeculatedType admittedTypes = SpecNone);
143	FiltrationResult filterArrayModes(AbstractValue&, ArrayModes);	143	FiltrationResult filterArrayModes(AbstractValue&, ArrayModes);
144	FiltrationResult filter(AbstractValue&, SpeculatedType);	144	FiltrationResult filter(AbstractValue&, SpeculatedType);
145	FiltrationResult filterByValue(AbstractValue&, FrozenValue);	145	FiltrationResult filterByValue(AbstractValue&, FrozenValue);

Line 0 Source/JavaScriptCore/dfg/DFGDesiredInferredType.h_sec1
- Source/JavaScriptCore/dfg/DFGDesiredInferredType.h +132 lines
		1	/*
		2	* Copyright (C) 2015 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#ifndef DFGDesiredInferredType_h
		27	#define DFGDesiredInferredType_h
		28
		29	#if ENABLE(DFG_JIT)
		30
		31	#include "InferredType.h"
		32	#include <wtf/HashMap.h>
		33
		34	namespace JSC { namespace DFG {
		35
		36	// This documents the DFG's expectation for an InferredType: specifically, that we want it to have a live
		37	// InferredType object and that this object has the type that we originally saw.
		38
		39	class DesiredInferredType {
		40	public:
		41	DesiredInferredType()
		42	: m_object(nullptr)
		43	{
		44	}
		45
		46	DesiredInferredType(InferredType* object, const InferredType::Descriptor& expected)
		47	: m_object(object)
		48	, m_expected(expected)
		49	{
		50	}
		51
		52	DesiredInferredType(WTF::HashTableDeletedValueType)
		53	: m_object(nullptr)
		54	, m_expected(Top)
		55	{
		56	}
		57
		58	explicit operator bool() const { return m_object && m_expected; }
		59
		60	InferredType* object() const { return m_object; }
		61	InferredType::Descriptor expected() const { return m_expected; }
		62
		63	bool isStillValid() const
		64	{
65	return m_object->canWatch(m_expected);
66	}
67
68	void add(Watchpoint* watchpoint) const
69	{
70	m_object->addWatchpoint(watchpoint);
71	}
72
73	bool operator==(const DesiredInferredType& other) const
74	{
75	return m_object == other.m_object
76	&& m_expected == other.m_expected;
77	}
78
79	bool operator!=(const DesiredInferredType& other) const
80	{
81	return !(*this == other);
82	}
83
84	bool isHashTableDeletedValue() const
85	{
86	return !m_object && m_expected == Top;
87	}
88
89	unsigned hash() const
90	{
91	return WTF::PtrHash<InferredType>::hash(m_object) + m_expected.hash() 7;
92	}
93
94	void dumpInContext(PrintStream& out, DumpContext* context) const
95	{
96	out.print(inContext(m_expected, context), " for ", RawPointer(m_object));
97	}
98
99	void dump(PrintStream& out) const
100	{
101	dumpInContext(out, context);
102	}
103
104	private:
105	InferredType* m_object;
106	InferredType::Descriptor m_expected;
107	};
108
109	struct DesiredInferredTypeHash {
110	static unsigned hash(const DesiredInferredType& key) { return key.hash(); }
111	static bool equal(const DesiredInferredType& a, const DesiredInferredType& b) { return a == b; }
112	static const bool safeToCompareToEmptyOrDeleted = true;
113	};
114
115	} } // namespace JSC::DFG
116
117	namespace WTF {
118
119	template<typename T> struct DefaultHash;
120	template<> struct DefaultHash<JSC::DFG::DesiredInferredType> {
121	typedef JSC::DFG::DesiredInferredTypeHash Hash;
122	};
123
124	template<typename T> struct HashTraits;
125	template<> struct HashTraits<JSC::DFG::DesiredInferredType> : SimpleClassHashTraits<JSC::DFG::DesiredInferredType> { };
126
127	} // namespace WTF
128
129	#endif // ENABLE(DFG_JIT)
130
131	#endif // DFGDesiredInferredType_h
132

Lines 887-892 bool Graph::isSafeToLoad(JSObject* base, Source/JavaScriptCore/dfg/DFGGraph.cpp_sec1
- Source/JavaScriptCore/dfg/DFGGraph.cpp -1 / +74 lines
887	return m_safeToLoad.contains(std::make_pair(base, offset));	887	return m_safeToLoad.contains(std::make_pair(base, offset));
888	}	888	}
889		889
		890	InferredType::Descriptor Graph::inferredTypeFor(const PropertyTypeKey& key)
		891	{
		892	assertIsRegistered(key.structure());
		893
		894	auto iter = m_inferredTypes.get(key);
		895	if (iter != m_inferredTypes.end())
		896	return iter->value;
		897
		898	InferredType* typeObject = key.structure()->inferredTypeFor(key.uid());
		899	if (!typeObject) {
		900	m_inferredTypes.add(key, InferredType::Top);
		901	return InferredType::Top;
		902	}
		903
		904	InferredType::Descriptor typeDescriptor = typeObject->descriptor();
		905	if (!typeDescriptor.isStillValid()) {
		906	m_inferredTypes.add(key, InferredType::Top);
		907	return InferredType::Top;
		908	}
		909
		910	m_inferredTypes.add(key, typeDescriptor);
		911
		912	m_plan.weakReferences.addLazily(typeObject);
		913	if (typeDescriptor.structure())
		914	registerStructure(typeDescriptor.structure());
		915
		916	// Note that we may already be watching this desired inferred type, because multiple structures may
		917	// point to the same InferredType instance.
		918	m_plan.watchpoints.addLazily(DesiredInferredType(typeObject, typeDescriptor));
		919
		920	return typeDescriptor;
		921	}
		922
		923	bool Graph::watchDesiredType(const DesiredInferredType& key)
		924	{
		925	if (!key.isStillValid())
		926	return false;
		927
		928	m_plan.weakReferences.addLazily(key.object());
		929	if (Structure* structure = key.expected().structure())
		930	registerStructure(structure);
		931	m_plan.watchpoints.addLazily(key);
		932	}
		933
890	FullBytecodeLiveness& Graph::livenessFor(CodeBlock* codeBlock)	934	FullBytecodeLiveness& Graph::livenessFor(CodeBlock* codeBlock)
891	{	935	{
892	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>>::iterator iter = m_bytecodeLiveness.find(codeBlock);	936	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>>::iterator iter = m_bytecodeLiveness.find(codeBlock);
Lines 1061-1067 JSValue Graph::tryGetConstantProperty(JS Source/JavaScriptCore/dfg/DFGGraph.cpp_sec2
1061	JSValue Graph::tryGetConstantProperty(	1105	JSValue Graph::tryGetConstantProperty(
1062	JSValue base, const StructureAbstractValue& structure, PropertyOffset offset)	1106	JSValue base, const StructureAbstractValue& structure, PropertyOffset offset)
1063	{	1107	{
1064	if (structure.isTop() \|\| structure.isClobbered()) {	1108	if (structure.isInfinite()) {
1065	// FIXME: If we just converted the offset to a uid, we could do ObjectPropertyCondition	1109	// FIXME: If we just converted the offset to a uid, we could do ObjectPropertyCondition
1066	// watching to constant-fold the property.	1110	// watching to constant-fold the property.
1067	// https://bugs.webkit.org/show_bug.cgi?id=147271	1111	// https://bugs.webkit.org/show_bug.cgi?id=147271
Lines 1076-1081 JSValue Graph::tryGetConstantProperty(co Source/JavaScriptCore/dfg/DFGGraph.cpp_sec3
1076	return tryGetConstantProperty(base.m_value, base.m_structure, offset);	1120	return tryGetConstantProperty(base.m_value, base.m_structure, offset);
1077	}	1121	}
1078		1122
		1123	AbstractValue Graph::inferredValueForProperty(
		1124	const StructureSet& base, UniquedStringImpl* uid, StructureClobberState clobberState)
		1125	{
		1126	AbstractValue result;
		1127	base.forEach(
		1128	[&] (Structure* structure) {
		1129	AbstractValue value;
		1130	value.set(*this, inferredTypeForProperty(structure, uid));
		1131	result.merge(value);
		1132	});
		1133	return result;
		1134	}
		1135
		1136	AbstractValue Graph::inferredValueForProperty(
		1137	const AbstractValue& base, UniquedStringImpl* uid, PropertyOffset offset,
		1138	StructureClobberState clobberState)
		1139	{
		1140	if (JSValue value = tryGetConstantProperty(base, offset)) {
		1141	AbstractValue result;
		1142	result.set(this, freeze(value), clobberState);
		1143	return result;
		1144	}
		1145
		1146	if (base.m_structure.isFinite())
		1147	return inferredValueForProperty(base.m_structure.set(), uid, clobberState);
		1148
		1149	return AbstractValue::heapTop();
		1150	}
		1151
1079	JSValue Graph::tryGetConstantClosureVar(JSValue base, ScopeOffset offset)	1152	JSValue Graph::tryGetConstantClosureVar(JSValue base, ScopeOffset offset)
1080	{	1153	{
1081	// This has an awesome concurrency story. See comment for GetGlobalVar in ByteCodeParser.	1154	// This has an awesome concurrency story. See comment for GetGlobalVar in ByteCodeParser.

Lines 675-680 public: Source/JavaScriptCore/dfg/DFGGraph.h_sec1
- Source/JavaScriptCore/dfg/DFGGraph.h +16 lines
675	// Checks if it's known that loading from the given object at the given offset is fine. This is	675	// Checks if it's known that loading from the given object at the given offset is fine. This is
676	// computed by tracking which conditions we track with watchCondition().	676	// computed by tracking which conditions we track with watchCondition().
677	bool isSafeToLoad(JSObject* base, PropertyOffset);	677	bool isSafeToLoad(JSObject* base, PropertyOffset);
		678
		679	// Tells us what inferred type we are able to prove the property to have now and in the future.
		680	InferredType::Descriptor inferredTypeFor(const PropertyTypeKey&);
		681	InferredType::Descriptor inferredTypeForProperty(Structure* structure, UniquedStringImpl* uid)
		682	{
		683	return inferredTypeFor(PropertyTypeKey(structure, uid));
		684	}
		685
		686	AbstractValue inferredValueForProperty(
		687	const StructureSet& base, UniquedStringImpl* uid, StructureClobberState);
		688
		689	// This uses either constant property inference or property type inference to derive a good abstract
		690	// value for some property accessed with the given abstract value base.
		691	AbstractValue inferredValueForProperty(
		692	const AbstractValue& base, UniquedStringImpl* uid, PropertyOffset, StructureClobberState);
678		693
679	FullBytecodeLiveness& livenessFor(CodeBlock*);	694	FullBytecodeLiveness& livenessFor(CodeBlock*);
680	FullBytecodeLiveness& livenessFor(InlineCallFrame*);	695	FullBytecodeLiveness& livenessFor(InlineCallFrame*);
Lines 856-861 public: Source/JavaScriptCore/dfg/DFGGraph.h_sec2
856	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;	871	HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
857	HashMap<CodeBlock*, std::unique_ptr<BytecodeKills>> m_bytecodeKills;	872	HashMap<CodeBlock*, std::unique_ptr<BytecodeKills>> m_bytecodeKills;
858	HashSet<std::pair<JSObject*, PropertyOffset>> m_safeToLoad;	873	HashSet<std::pair<JSObject*, PropertyOffset>> m_safeToLoad;
		874	HashMap<PropertyTypeKey, InferredType::Descriptor> m_inferredTypes;
859	Dominators m_dominators;	875	Dominators m_dominators;
860	PrePostNumbering m_prePostNumbering;	876	PrePostNumbering m_prePostNumbering;
861	NaturalLoops m_naturalLoops;	877	NaturalLoops m_naturalLoops;

Line 0 Source/JavaScriptCore/dfg/DFGPropertyTypeKey.h_sec1
- Source/JavaScriptCore/dfg/DFGPropertyTypeKey.h +128 lines
		1	/*
		2	* Copyright (C) 2015 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#ifndef DFGPropertyTypeKey_h
		27	#define DFGPropertyTypeKey_h
		28
		29	#if ENABLE(DFG_JIT)
		30
		31	#include <wtf/HashMap.h>
		32
		33	namespace JSC { namespace DFG {
		34
		35	// This object is a key for finding a property's type. It's a tuple of Structure* and UniquedStringImpl*.
		36
		37	class PropertyTypeKey {
		38	public:
		39	PropertyTypeKey()
		40	: m_structure(nullptr)
		41	, m_uid(nullptr)
		42	{
		43	}
		44
		45	PropertyTypeKey(Structure* structure, UniquedStringImpl* uid)
		46	: m_structure(structure)
		47	, m_uid(uid)
		48	{
		49	}
		50
		51	PropertyTypeKey(WTF::HashTableDeletedValueType)
		52	: m_object(nullptr)
		53	, m_uid(deletedUID())
		54	{
		55	}
		56
		57	explicit operator bool() const { return m_structure && m_uid; }
		58
		59	Structure* structure() const { return m_structure; }
		60	PropertyOffset uid() const { return m_uid; }
		61
		62	bool operator==(const PropertyTypeKey& other) const
		63	{
		64	return m_structure == other.m_structure
65	&& m_uid == other.m_uid;
66	}
67
68	bool operator!=(const PropertyTypeKey& other) const
69	{
70	return !(*this == other);
71	}
72
73	unsigned hash() const
74	{
75	return WTF::PtrHash<Structure>::hash(m_structure) + WTF::PtrHash<UniquedStringImpl>::hash(m_uid);
76	}
77
78	bool isHashTableDeletedValue() const
79	{
80	return !m_object && m_uid == deletedUID();
81	}
82
83	void dumpInContext(PrintStream& out, DumpContext* context) const
84	{
85	out.print(pointerDumpInContext(m_structure, context), "+", m_uid);
86	}
87
88	void dump(PrintStream& out) const
89	{
90	dumpInContext(out, context);
91	}
92
93	private:
94	static UniquedStringImpl* deletedUID()
95	{
96	return bitwise_cast<UniquedStringImpl*>(static_cast<intptr_t>(1));
97	}
98
99	Structure* m_structure;
100	UniquedStringImpl* m_uid;
101	};
102
103	struct PropertyTypeKeyHash {
104	static unsigned hash(const PropertyTypeKey& key) { return key.hash(); }
105	static bool equal(const PropertyTypeKey& a, const PropertyTypeKey& b) { return a == b; }
106	static const bool safeToCompareToEmptyOrDeleted = true;
107	};
108
109	} } // namespace JSC::DFG
110
111	namespace WTF {
112
113	template<typename T> struct DefaultHash;
114	template<> struct DefaultHash<JSC::DFG::PropertyTypeKey> {
115	typedef JSC::DFG::PropertyTypeKeyHash Hash;
116	};
117
118	template<typename T> struct HashTraits;
119	template<> struct HashTraits<JSC::DFG::PropertyTypeKey> : SimpleClassHashTraits<JSC::DFG::PropertyTypeKey> {
120	static const bool emptyValueIsZero = false;
121	};
122
123	} // namespace WTF
124
125	#endif // ENABLE(DFG_JIT)
126
127	#endif // DFGPropertyTypeKey_h
128

Lines 55-60 Vector<BytecodeAndMachineOffset>& Assemb Source/JavaScriptCore/jit/AssemblyHelpers.cpp_sec1
- Source/JavaScriptCore/jit/AssemblyHelpers.cpp +69 lines
55	return result.iterator->value;	55	return result.iterator->value;
56	}	56	}
57		57
		58	AssemblyHelpers::JumpList AssemblyHelpers::branchIfNotType(
		59	JSValueRegs regs, GPRReg tempGPR, const InferredType::Descriptor& descriptor)
		60	{
		61	AssemblyHelpers::JumpList result;
		62
		63	switch (descriptor.kind()) {
		64	case InferredType::Bottom:
		65	result.append(jump());
		66	break;
		67
		68	case InferredType::Boolean:
		69	result.append(branchIfNotBoolean(regs, tempGPR));
		70	break;
		71
		72	case InferredType::Other:
		73	result.append(branchIfNotOther(regs, tempGPR));
		74	break;
		75
		76	case InferredType::Int32:
		77	result.append(branchIfNotInt32(regs));
		78	break;
		79
		80	case InferredType::Double:
		81	result.append(branchIfInt32(regs));
		82	result.append(branchIfNotNumber(regs));
		83	break;
		84
		85	case InferredType::Number:
		86	result.append(branchIfNotNumber(regs));
		87	break;
		88
		89	case InferredType::String:
		90	result.append(branchIfNotCell(regs));
		91	result.append(branchIfNotString(regs.payloadGPR()));
		92	break;
		93
		94	case InferredType::ObjectWithStructure:
		95	result.append(branchIfNotCell(regs));
		96	result.append(branchStructure(regs.payloadGPR(), descriptor.structure()));
		97	break;
		98
		99	case InferredType::ObjectWithStructureOrOther: {
		100	Jump ok = branchIfOther(regs, tempGPR);
		101	result.append(branchIfNotCell(regs));
		102	result.append(branchStructure(regs.payloadGPR(), descriptor.structure()));
		103	ok.link(this);
		104	break;
		105	}
		106
		107	case InferredType::Object:
		108	result.append(branchIfNotCell(regs));
		109	result.append(branchIfNotObject(regs.payloadGPR()));
		110	break;
		111
		112	case InferredType::ObjectOrOther: {
		113	Jump ok = branchIfOther(regs, tempGPR);
		114	result.append(branchIfNotCell(regs));
		115	result.append(branchIfNotObject(regs.payloadGPR()));
		116	ok.link(this);
		117	break;
		118	}
		119
		120	case InferredType::Top:
		121	break;
122	}
123
124	return result;
125	}
126
58	void AssemblyHelpers::purifyNaN(FPRReg fpr)	127	void AssemblyHelpers::purifyNaN(FPRReg fpr)
59	{	128	{
60	MacroAssembler::Jump notNaN = branchDouble(DoubleEqual, fpr, fpr);	129	MacroAssembler::Jump notNaN = branchDouble(DoubleEqual, fpr, fpr);

Line 0 Source/JavaScriptCore/runtime/InferredType.cpp_sec1
- Source/JavaScriptCore/runtime/InferredType.cpp +443 lines
		1	/*
		2	* Copyright (C) 2015 Apple Inc. All rights reserved.
		3	*
		4	* Redistribution and use in source and binary forms, with or without
		5	* modification, are permitted provided that the following conditions
		6	* are met:
		7	* 1. Redistributions of source code must retain the above copyright
		8	* notice, this list of conditions and the following disclaimer.
		9	* 2. Redistributions in binary form must reproduce the above copyright
		10	* notice, this list of conditions and the following disclaimer in the
		11	* documentation and/or other materials provided with the distribution.
		12	*
		13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
		14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
		17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
		18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
		19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
		20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
		21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		24	*/
		25
		26	#include "config.h"
		27	#include "InferredType.h"
		28
		29	#include "JSCInlines.h"
		30
		31	namespace JSC {
		32
		33	const ClassInfo InferredType::s_info = { "InferredType", 0, 0, CREATE_METHOD_TABLE(InferredType) };
		34
		35	InferredType* InferredType::create(VM& vm)
		36	{
		37	InferredType* result = new (NotNull, allocateCell<InferredType>(vm.heap)) InferredType(vm);
		38	result->finishCreation(vm);
		39	return result;
		40	}
		41
		42	void InferredType::destroy(JSCell* cell)
		43	{
		44	InferredType* inferredType = static_cast<InferredType*>(cell);
		45	inferredType->InferredType::~InferredType();
		46	}
		47
		48	Structure* InferredType::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
		49	{
		50	return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
		51	}
		52
		53	void InferredType::visitChildren(JSCell* cell, SlotVisitor& visitor)
		54	{
		55	InferredType* inferredType = jsCast<InferredType*>(cell);
		56
		57	if (inferredType->m_structure)
		58	visitor.addUnconditionalFinalizer(inferredType->m_structure.get());
		59	}
		60
		61	InferredType::Descriptor InferredType::Descriptor::forValue(JSValue value)
		62	{
		63	if (value.isBoolean())
		64	return Boolean;
65	if (value.isUndefinedOrNull())
66	return Other;
67	if (value.isInt32())
68	return Int32;
69	if (value.isDouble())
70	return Double;
71	if (value.isCell()) {
72	JSCell* cell = value.asCell();
73	if (cell->isString())
74	return String;
75	if (cell->isObject()) {
76	if (cell->structure()->transitionWatchpointSetIsStillValid())
77	return Descriptor(ObjectWithStructure, cell->structure());
78	return Object;
79	}
80	}
81	return Top;
82	}
83
84	void InferredType::Descriptor::merge(const Descriptor& other)
85	{
86	if (*this == other)
87	return;
88
89	switch (m_kind) {
90	case Bottom:
91	*this = other;
92	return;
93	case Boolean:
94	case String:
95	*this = Top;
96	return;
97	case Other:
98	switch (other.m_kind) {
99	case ObjectWithStructure:
100	m_kind = ObjectWithStructureOrOther;
101	return;
102	case Object:
103	m_kind = ObjectOrOther;
104	return;
105	default:
106	*this = Top;
107	return;
108	}
109	case Int32:
110	switch (other.m_kind) {
111	case Double:
112	case Number:
113	m_kind = Number;
114	return;
115	default:
116	*this = Top;
117	return;
118	}
119	case Double:
120	switch (other.m_kind) {
121	case Int32:
122	case Number:
123	m_kind = Number;
124	return;
125	default:
126	*this = Top;
127	return;
128	}
129	case Number:
130	switch (other.m_kind) {
131	case Int32:
132	case Double:
133	return;
134	default:
135	*this = Top;
136	return;
137	}
138	case ObjectWithStructure:
139	switch (other.m_kind) {
140	case ObjectWithStructure:
141	case Object:
142	*this = Object;
143	return;
144	case ObjectWithStructureOrOther:
145	if (m_structure == other.m_structure) {
146	*this = other;
147	return;
148	}
149	*this = ObjectOrOther;
150	return;
151	case ObjectOrOther:
152	*this = ObjectOrOther;
153	return;
154	case Other:
155	m_kind = ObjectWithStructureOrOther;
156	return;
157	default:
158	*this = Top;
159	return;
160	}
161	case ObjectWithStructureOrOther:
162	switch (other.m_kind) {
163	case ObjectWithStructure:
164	if (m_structure == other.m_structure)
165	return;
166	*this = ObjectOrOther;
167	return;
168	case Object:
169	case ObjectWithStructureOrOther:
170	case ObjectOrOther:
171	*this = ObjectOrOther;
172	return;
173	case Other:
174	return;
175	default:
176	*this = Top;
177	return;
178	}
179	case Object:
180	switch (other.m_kind) {
181	case ObjectWithStructure:
182	return;
183	case ObjectWithStructureOrOther:
184	case ObjectOrOther:
185	case Other:
186	m_kind = ObjectOrOther;
187	return;
188	default:
189	*this = Top;
190	return;
191	}
192	case ObjectOrOther:
193	switch (other.m_kind) {
194	case ObjectWithStructure:
195	case ObjectWithStructureOrOther:
196	case Object:
197	case Other:
198	return;
199	default:
200	*this = Top;
201	return;
202	}
203	case Top:
204	return;
205	}
206
207	RELEASE_ASSERT_NOT_REACHED();
208	}
209
210	void InferredType::Descriptor::removeStructure()
211	{
212	switch (m_kind) {
213	case ObjectWithStructure:
214	*this = Object;
215	return;
216	case ObjectWithStructureOrOther:
217	*this = ObjectOrOther;
218	return;
219	default:
220	return;
221	}
222	}
223
224	bool InferredType::Descriptor::subsumes(const Descriptor& other) const
225	{
226	Descriptor merged = *this;
227	merged.merge(other);
228	return *this == merged;
229	}
230
231	void InferredType::Descriptor::dumpInContext(PrintStream& out, DumpContext* context) const
232	{
233	out.print(m_kind);
234	if (m_structure)
235	out.print(":", inContext(*m_structure, context));
236	}
237
238	void InferredType::Descriptor::dump(PrintStream& out) const
239	{
240	dumpInContext(out, nullptr);
241	}
242
243	InferredType::InferredType(VM& vm)
244	: Base(vm, vm.inferredTypeStructure.get())
245	, m_watchpointSet(ClearWatchpoint)
246	{
247	}
248
249	InferredType::~InferredType()
250	{
251	}
252
253	bool InferredType::isStillValid(const ConcurrentJITLocker& locker, const Descriptor& expected)
254	{
255	if (expected.kind() == Top)
256	return false;
257
258	return descriptor(locker) == expected;
259	}
260
261	bool InferredType::isStillValid(const Descriptor& expected)
262	{
263	ConcurrentJITLocker locker(m_lock);
264	return isStillValid(locker, expected);
265	}
266
267	void InferredType::addWatchpoint(const ConcurrentJITLocker& locker, Watchpoint* watchpoint)
268	{
269	RELEASE_ASSERT(descriptor(locker).kind() != Top);
270
271	m_watchpointSet.add(watchpoint);
272	}
273
274	void InferredType::addWatchpoint(Watchpoint* watchpoint)
275	{
276	ConcurrentJITLocker locker(m_lock);
277	addWatchpoint(locker, watchpoint);
278	}
279
280	void InferredType::dump(PrintStream& out) const
281	{
282	out.print(RawPointer(this), ":", descriptor());
283	}
284
285	void InferredType::willStoreValueSlow(VM& vm, JSValue value)
286	{
287	ConcurrentJITLocker locker(m_lock);
288	Descriptor myType = descriptor(locker);
289	Descriptor otherType = Descriptor::forValue(value);
290
291	myType.merge(otherType);
292
293	ASSERT(descriptor(locker) != myType); // The type must have changed if we're on the slow path.
294
295	set(locker, vm, myType);
296	}
297
298	void InferredType::makeTopSlow(VM& vm)
299	{
300	ConcurrentJITLocker locker(m_lock);
301	set(locker, vm, Top);
302	}
303
304	void InferredType::set(const ConcurrentJITLocker& locker, VM& vm, Descriptor newDescriptor)
305	{
306	// We will trigger write barriers while holding our lock. Currently, write barriers don't GC, but that
307	// could change. If it does, we don't want to deadlock. Note that we could have used
308	// GCSafeConcurrentJITLocker in the caller, but the caller is on a fast path so maybe that wouldn't be
309	// a good idea.
310	DeferGCForAWhile deferGC(vm.heap);
311
312	// Be defensive: if we're not really changing the type, then we don't have to do anything.
313	if (descriptor(locker) == newDescriptor)
314	return;
315
316	// The new descriptor must be more general than the previous one.
317	ASSERT(newDescriptor.subsumes(descriptor(locker)));
318
319	// If the new descriptors have different structures, then it can only be because one is null.
320	if (descriptor(locker).structure() != newDescriptor.structure())
321	ASSERT(!descriptor(locker).structure() \|\| !newDescriptor.structure());
322
323	// We are changing the type, so make sure that if anyone was watching, they find out about it now. If
324	// anyone is watching, we make sure to go to Top so that we don't do this sort of thing again.
325	if (m_watchpointSet.state() != ClearWatchpoint) {
326	// We cannot have been invalidated, since if we were, then we'd already be at Top.
327	ASSERT(m_watchpointSet.state() != IsInvalidated);
328
329	// We're about to do expensive things because some compiler thread decided to watch this type and
330	// then the type changed. Assume that this property is crazy, and don't ever do any more things for
331	// it.
332	newDescriptor = Top;
333
334	m_watchpointSet.fireAll("Inferred type changed");
335	}
336
337	// Remove the old InferredStructure object if we no longer need it.
338	if (!newDescriptor.structure())
339	m_structure = nullptr;
340
341	// Add a new InferredStructure object if we need one now.
342	if (newDescriptor.structure()) {
343	if (m_structure) {
344	// We should agree on the structures if we get here.
345	ASSERT(newDescriptor.structure() == m_structure->structure());
346	} else {
347	m_structure = std::make_unique<InferredStructure>(this, newDescriptor.structure());
348	newDescriptor.structure()->addTransitionWatchpoint(m_structure.get());
349	}
350	}
351
352	// Finally, set the descriptor kind.
353	m_kind = newDescriptor.kind();
354
355	// Assert that we did things.
356	ASSERT(descriptor(locker) == newDescriptor);
357	}
358
359	void InferredType::removeStructure()
360	{
361	VM& vm = *Heap::heap(this)->vm();
362
363	ConcurrentJITLocker locker(m_parent->m_lock);
364
365	Descriptor newDescriptor = descriptor(locker);
366	newDescriptor.removeStructure();
367
368	set(locker, vm, newDescriptor);
369	}
370
371	void InferredType::InferredStructure::InferredStructure(InferredType* parent, Structure* structure)
372	: m_parent(parent)
373	, m_structure(vm, parent, structure)
374	{
375	}
376
377	void InferredType::InferredStructure::fireInternal(const FireDetail&)
378	{
379	m_parent->removeStructure();
380	}
381
382	void InferredType::InferredStructure::finalizeUnconditionally()
383	{
384	VM& vm = *Heap::heap(m_parent)->vm();
385
386	ASSERT(Heap::isMarked(m_parent));
387
388	if (!Heap::isMarked(m_structure.get()))
389	m_parent->removeStructure();
390	}
391
392	} // namespace JSC
393
394	namespace WTF {
395
396	using namespace JSC;
397
398	void printInternal(PrintStream& out, InferredType::Kind kind)
399	{
400	switch (kind) {
401	case InferredType::Bottom:
402	out.print("Bottom");
403	return;
404	case InferredType::Boolean:
405	out.print("Boolean");
406	return;
407	case InferredType::Other:
408	out.print("Other");
409	return;
410	case InferredType::Int32:
411	out.print("Int32");
412	return;
413	case InferredType::Double:
414	out.print("Double");
415	return;
416	case InferredType::Number:
417	out.print("Number");
418	return;
419	case InferredType::String:
420	out.print("String");
421	return;
422	case InferredType::ObjectWithStructure:
423	out.print("ObjectWithStructure");
424	return;
425	case InferredType::ObjectWithStructureOrOther:
426	out.print("ObjectWithStructureOrOther");
427	return;
428	case InferredType::Object:
429	out.print("Object");
430	return;
431	case InferredType::ObjectOrOther:
432	out.print("ObjectOrOther");
433	return;
434	case InferredType::Top:
435	out.print("Top");
436	return;
437	}
438
439	RELEASE_ASSERT_NOT_REACHED();
440	}
441
442	} // namespace WTF
443

Lines 29-34 Source/JavaScriptCore/runtime/Structure.h_sec1
- Source/JavaScriptCore/runtime/Structure.h +38 lines
29	#include "ClassInfo.h"	29	#include "ClassInfo.h"
30	#include "ConcurrentJITLock.h"	30	#include "ConcurrentJITLock.h"
31	#include "IndexingType.h"	31	#include "IndexingType.h"
		32	#include "InferredTypeTable.h"
32	#include "JSCJSValue.h"	33	#include "JSCJSValue.h"
33	#include "JSCell.h"	34	#include "JSCell.h"
34	#include "JSType.h"	35	#include "JSType.h"
Lines 81-91 struct PropertyMapEntry { Source/JavaScriptCore/runtime/Structure.h_sec2
81	UniquedStringImpl* key;	82	UniquedStringImpl* key;
82	PropertyOffset offset;	83	PropertyOffset offset;
83	uint8_t attributes;	84	uint8_t attributes;
		85	bool hasInferredType; // This caches whether or not a property has an inferred type in the inferred type table, and is used for a fast check in JSObject::putDirectInternal().
84		86
85	PropertyMapEntry()	87	PropertyMapEntry()
86	: key(nullptr)	88	: key(nullptr)
87	, offset(invalidOffset)	89	, offset(invalidOffset)
88	, attributes(0)	90	, attributes(0)
		91	, hasInferredType(false)
89	{	92	{
90	}	93	}
91		94
Lines 93-98 struct PropertyMapEntry { Source/JavaScriptCore/runtime/Structure.h_sec3
93	: key(key)	96	: key(key)
94	, offset(offset)	97	, offset(offset)
95	, attributes(attributes)	98	, attributes(attributes)
		99	, hasInferredType(false)
96	{	100	{
97	ASSERT(this->attributes == attributes);	101	ASSERT(this->attributes == attributes);
98	}	102	}
Lines 323-328 public: Source/JavaScriptCore/runtime/Structure.h_sec4
323		327
324	PropertyOffset get(VM&, PropertyName);	328	PropertyOffset get(VM&, PropertyName);
325	PropertyOffset get(VM&, PropertyName, unsigned& attributes);	329	PropertyOffset get(VM&, PropertyName, unsigned& attributes);
		330	PropertyOffset get(VM&, PropertyName, unsigned& attributes, bool& hasInferredType);
326		331
327	// This is a somewhat internalish method. It will call your functor while possibly holding the	332	// This is a somewhat internalish method. It will call your functor while possibly holding the
328	// Structure's lock. There is no guarantee whether the lock is held or not in any particular	333	// Structure's lock. There is no guarantee whether the lock is held or not in any particular
Lines 477-482 public: Source/JavaScriptCore/runtime/Structure.h_sec5
477	structure->startWatchingInternalPropertiesIfNecessary(vm);	482	structure->startWatchingInternalPropertiesIfNecessary(vm);
478	}	483	}
479		484
		485	bool hasInferredTypes() const
		486	{
		487	return !!m_inferredTypeTable;
		488	}
		489
		490	InferredType* inferredTypeFor(UniquedStringImpl* uid)
		491	{
		492	if (InferredTypeTable* table = m_inferredTypeTable.get())
		493	return table->get(uid);
		494	return nullptr;
		495	}
		496
		497	// Returns true if the type of the property is still valid.
		498	ALWAYS_INLINE void willStoreValueForTransition(
		499	VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize)
		500	{
		501	if (hasBeenDictionary() \|\| (!shouldOptimize && !m_inferredTypeTable))
		502	return;
		503	willStoreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::NewProperty);
		504	}
		505	ALWAYS_INLINE void willStoreValueForReplace(
		506	VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize)
		507	{
		508	if (hasBeenDictionary())
		509	return;
		510	willSloreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::OldProperty);
		511	}
		512
480	PassRefPtr<StructureShape> toStructureShape(JSValue);	513	PassRefPtr<StructureShape> toStructureShape(JSValue);
481		514
482	// Determines if the two structures match enough that this one could be used for allocations	515	// Determines if the two structures match enough that this one could be used for allocations
Lines 627-632 private: Source/JavaScriptCore/runtime/Structure.h_sec6
627		660
628	void startWatchingInternalProperties(VM&);	661	void startWatchingInternalProperties(VM&);
629		662
		663	void willStoreValueSlow(
		664	VM&, PropertyOffset, PropertyName, JSValue, bool, InferredTypeTable::StoredPropertyAge);
		665
630	static const int s_maxTransitionLength = 64;	666	static const int s_maxTransitionLength = 64;
631	static const int s_maxTransitionLengthForNonEvalPutById = 512;	667	static const int s_maxTransitionLengthForNonEvalPutById = 512;
632		668
Lines 650-655 private: Source/JavaScriptCore/runtime/Structure.h_sec7
650	// Should be accessed through propertyTable(). During GC, it may be set to 0 by another thread.	686	// Should be accessed through propertyTable(). During GC, it may be set to 0 by another thread.
651	WriteBarrier<PropertyTable> m_propertyTableUnsafe;	687	WriteBarrier<PropertyTable> m_propertyTableUnsafe;
652		688
		689	WriteBarrier<InferredTypeTable> m_inferredTypeTable;
		690
653	mutable InlineWatchpointSet m_transitionWatchpointSet;	691	mutable InlineWatchpointSet m_transitionWatchpointSet;
654		692
655	COMPILE_ASSERT(firstOutOfLineOffset < 256, firstOutOfLineOffset_fits);	693	COMPILE_ASSERT(firstOutOfLineOffset < 256, firstOutOfLineOffset_fits);

Lines 75-93 inline Structure* Structure::storedProto Source/JavaScriptCore/runtime/StructureInlines.h_sec1
- Source/JavaScriptCore/runtime/StructureInlines.h -9 / +10 lines
75		75
76	ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName)	76	ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName)
77	{	77	{
78	ASSERT(!isCompilationThread());	78	unsigned attributes;
79	ASSERT(structure()->classInfo() == info());	79	bool hasInferredType;
80	PropertyTable* propertyTable;	80	return get(vm, propertyName, attributes, hasInferredType);
81	materializePropertyMapIfNecessary(vm, propertyTable);
82	if (!propertyTable)
83	return invalidOffset;
84
85	PropertyMapEntry* entry = propertyTable->get(propertyName.uid());
86	return entry ? entry->offset : invalidOffset;
87	}	81	}
88		82
89	ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes)	83	ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes)
90	{	84	{
		85	bool hasInferredType;
		86	return get(vm, propertyName, attributes, hasInferredType);
		87	}
		88
		89	ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes, bool& hasInferredType)
		90	{
91	ASSERT(!isCompilationThread());	91	ASSERT(!isCompilationThread());
92	ASSERT(structure()->classInfo() == info());	92	ASSERT(structure()->classInfo() == info());
93		93
Lines 101-106 ALWAYS_INLINE PropertyOffset Structure:: Source/JavaScriptCore/runtime/StructureInlines.h_sec2
101	return invalidOffset;	101	return invalidOffset;
102		102
103	attributes = entry->attributes;	103	attributes = entry->attributes;
		104	hasInferredType = entry->hasInferredType;
104	return entry->offset;	105	return entry->offset;
105	}	106	}
106		107

Lines 86-91 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec1
- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj -4 / +28 lines
86	0F04396E1B03DC0B009598B7 /* DFGCombinedLiveness.h in Headers / = {isa = PBXBuildFile; fileRef = 0F04396C1B03DC0B009598B7 / DFGCombinedLiveness.h */; settings = {ATTRIBUTES = (Private, ); }; };	86	0F04396E1B03DC0B009598B7 /* DFGCombinedLiveness.h in Headers / = {isa = PBXBuildFile; fileRef = 0F04396C1B03DC0B009598B7 / DFGCombinedLiveness.h */; settings = {ATTRIBUTES = (Private, ); }; };
87	0F05C3B41683CF9200BAF45B /* DFGArrayifySlowPathGenerator.h in Headers / = {isa = PBXBuildFile; fileRef = 0F05C3B21683CF8F00BAF45B / DFGArrayifySlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };	87	0F05C3B41683CF9200BAF45B /* DFGArrayifySlowPathGenerator.h in Headers / = {isa = PBXBuildFile; fileRef = 0F05C3B21683CF8F00BAF45B / DFGArrayifySlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
88	0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0776BD14FF002800102332 / JITCompilationEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };	88	0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0776BD14FF002800102332 / JITCompilationEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };
		89	0F0A75221B94BFA900110660 /* InferredType.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F0A75201B94BFA900110660 / InferredType.cpp */; };
		90	0F0A75231B94BFA900110660 /* InferredType.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0A75211B94BFA900110660 / InferredType.h */; settings = {ATTRIBUTES = (Private, ); }; };
89	0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F0B839714BCF45A00885B4F / LLIntThunks.cpp */; };	91	0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F0B839714BCF45A00885B4F / LLIntThunks.cpp */; };
90	0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0B839814BCF45A00885B4F / LLIntThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };	92	0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0B839814BCF45A00885B4F / LLIntThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };
91	0F0B83A714BCF50700885B4F /* CodeType.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0B83A514BCF50400885B4F / CodeType.h */; settings = {ATTRIBUTES = (Private, ); }; };	93	0F0B83A714BCF50700885B4F /* CodeType.h in Headers / = {isa = PBXBuildFile; fileRef = 0F0B83A514BCF50400885B4F / CodeType.h */; settings = {ATTRIBUTES = (Private, ); }; };
Lines 752-757 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec2
752	0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers / = {isa = PBXBuildFile; fileRef = 65987F2C167FE84B003C2F8D / DFGOSRExitCompilationInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };	754	0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers / = {isa = PBXBuildFile; fileRef = 65987F2C167FE84B003C2F8D / DFGOSRExitCompilationInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
753	0FFB921D16D02F300055A5DB /* DFGSlowPathGenerator.h in Headers / = {isa = PBXBuildFile; fileRef = 0F1E3A501537C2CB000F9456 / DFGSlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };	755	0FFB921D16D02F300055A5DB /* DFGSlowPathGenerator.h in Headers / = {isa = PBXBuildFile; fileRef = 0F1E3A501537C2CB000F9456 / DFGSlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
754	0FFB922016D033B70055A5DB /* NodeConstructors.h in Headers / = {isa = PBXBuildFile; fileRef = 930DAD030FB1EB1A0082D205 / NodeConstructors.h */; settings = {ATTRIBUTES = (Private, ); }; };	756	0FFB922016D033B70055A5DB /* NodeConstructors.h in Headers / = {isa = PBXBuildFile; fileRef = 930DAD030FB1EB1A0082D205 / NodeConstructors.h */; settings = {ATTRIBUTES = (Private, ); }; };
		757	0FFC92111B94D4DF0071DD66 /* InferredTypeTable.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0FFC920F1B94D4DF0071DD66 / InferredTypeTable.cpp */; };
		758	0FFC92121B94D4DF0071DD66 /* InferredTypeTable.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC92101B94D4DF0071DD66 / InferredTypeTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
		759	0FFC92141B94E83E0071DD66 /* DFGDesiredInferredType.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC92131B94E83E0071DD66 / DFGDesiredInferredType.h */; };
		760	0FFC92161B94FB3E0071DD66 /* DFGPropertyTypeKey.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC92151B94FB3E0071DD66 / DFGPropertyTypeKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
755	0FFC99D1184EC8AD009C10AB /* ConstantMode.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC99D0184EC8AD009C10AB / ConstantMode.h */; settings = {ATTRIBUTES = (Private, ); }; };	761	0FFC99D1184EC8AD009C10AB /* ConstantMode.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC99D0184EC8AD009C10AB / ConstantMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
756	0FFC99D4184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0FFC99D2184EE318009C10AB / ArrayBufferNeuteringWatchpoint.cpp */; };	762	0FFC99D4184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0FFC99D2184EE318009C10AB / ArrayBufferNeuteringWatchpoint.cpp */; };
757	0FFC99D5184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC99D3184EE318009C10AB / ArrayBufferNeuteringWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };	763	0FFC99D5184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h in Headers / = {isa = PBXBuildFile; fileRef = 0FFC99D3184EE318009C10AB / ArrayBufferNeuteringWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
Lines 1920-1925 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec3
1920	0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCombinedLiveness.h; path = dfg/DFGCombinedLiveness.h; sourceTree = "<group>"; };	1926	0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCombinedLiveness.h; path = dfg/DFGCombinedLiveness.h; sourceTree = "<group>"; };
1921	0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArrayifySlowPathGenerator.h; path = dfg/DFGArrayifySlowPathGenerator.h; sourceTree = "<group>"; };	1927	0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArrayifySlowPathGenerator.h; path = dfg/DFGArrayifySlowPathGenerator.h; sourceTree = "<group>"; };
1922	0F0776BD14FF002800102332 /* JITCompilationEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCompilationEffort.h; sourceTree = "<group>"; };	1928	0F0776BD14FF002800102332 /* JITCompilationEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCompilationEffort.h; sourceTree = "<group>"; };
		1929	0F0A75201B94BFA900110660 /* InferredType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredType.cpp; sourceTree = "<group>"; };
		1930	0F0A75211B94BFA900110660 /* InferredType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredType.h; sourceTree = "<group>"; };
1923	0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntThunks.cpp; path = llint/LLIntThunks.cpp; sourceTree = "<group>"; };	1931	0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntThunks.cpp; path = llint/LLIntThunks.cpp; sourceTree = "<group>"; };
1924	0F0B839814BCF45A00885B4F /* LLIntThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntThunks.h; path = llint/LLIntThunks.h; sourceTree = "<group>"; };	1932	0F0B839814BCF45A00885B4F /* LLIntThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntThunks.h; path = llint/LLIntThunks.h; sourceTree = "<group>"; };
1925	0F0B83A514BCF50400885B4F /* CodeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeType.h; sourceTree = "<group>"; };	1933	0F0B83A514BCF50400885B4F /* CodeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeType.h; sourceTree = "<group>"; };
Lines 2583-2588 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec4
2583	0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = JSCLLIntOffsetsExtractor; sourceTree = BUILT_PRODUCTS_DIR; };	2591	0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = JSCLLIntOffsetsExtractor; sourceTree = BUILT_PRODUCTS_DIR; };
2584	0FFB6C361AF48DDC00DB1BF7 /* TypeofType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypeofType.cpp; sourceTree = "<group>"; };	2592	0FFB6C361AF48DDC00DB1BF7 /* TypeofType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypeofType.cpp; sourceTree = "<group>"; };
2585	0FFB6C371AF48DDC00DB1BF7 /* TypeofType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeofType.h; sourceTree = "<group>"; };	2593	0FFB6C371AF48DDC00DB1BF7 /* TypeofType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeofType.h; sourceTree = "<group>"; };
		2594	0FFC920F1B94D4DF0071DD66 /* InferredTypeTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredTypeTable.cpp; sourceTree = "<group>"; };
		2595	0FFC92101B94D4DF0071DD66 /* InferredTypeTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredTypeTable.h; sourceTree = "<group>"; };
		2596	0FFC92131B94E83E0071DD66 /* DFGDesiredInferredType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDesiredInferredType.h; path = dfg/DFGDesiredInferredType.h; sourceTree = "<group>"; };
		2597	0FFC92151B94FB3E0071DD66 /* DFGPropertyTypeKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPropertyTypeKey.h; path = dfg/DFGPropertyTypeKey.h; sourceTree = "<group>"; };
2586	0FFC99D0184EC8AD009C10AB /* ConstantMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstantMode.h; sourceTree = "<group>"; };	2598	0FFC99D0184EC8AD009C10AB /* ConstantMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstantMode.h; sourceTree = "<group>"; };
2587	0FFC99D2184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayBufferNeuteringWatchpoint.cpp; sourceTree = "<group>"; };	2599	0FFC99D2184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayBufferNeuteringWatchpoint.cpp; sourceTree = "<group>"; };
2588	0FFC99D3184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayBufferNeuteringWatchpoint.h; sourceTree = "<group>"; };	2600	0FFC99D3184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayBufferNeuteringWatchpoint.h; sourceTree = "<group>"; };