Attachment #447073 for bug #234268

View Details Raw Unified Return to Bug 234268

| Differences between



2021-12-13  Saam Barati  <sbarati@apple.com>

        Roll back r286345, r286387, r286471, r286667, r286849
        https://bugs.webkit.org/show_bug.cgi?id=234268

        Reviewed by Mark Lam.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::AccessCase):
        (JSC::AccessCase::forEachDependentCell const):
        (JSC::AccessCase::dump const):
        (JSC::AccessCase::propagateTransitions const):
        (JSC::AccessCase::generateWithGuard):
        (JSC::AccessCase::canBeShared):
        * bytecode/AccessCase.h:
        (JSC::AccessCase::structure const):
        (JSC::AccessCase::newStructure const):
        (JSC::AccessCase::hash const):
        (JSC::AccessCase::AccessCase):
        * bytecode/ArrayProfile.cpp:
        (JSC::ArrayProfile::computeUpdatedPrediction):
        * bytecode/ArrayProfile.h:
        * bytecode/CheckPrivateBrandStatus.cpp:
        (JSC::CheckPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::propagateTransitions):
        (JSC::CodeBlock::determineLiveness):
        (JSC::CodeBlock::finalizeLLIntInlineCaches):
        (JSC::CodeBlock::stronglyVisitWeakReferences):
        * bytecode/DeleteByStatus.cpp:
        (JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/GetByIdMetadata.h:
        (JSC::GetByIdModeMetadata::GetByIdModeMetadata):
        (JSC::GetByIdModeMetadata::clearToDefaultModeWithoutCache):
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::computeFromLLInt):
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InByStatus.cpp:
        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InlineAccess.cpp:
        (JSC::InlineAccess::rewireStubAsJumpInAccess):
        (JSC::InlineAccess::resetStubAsJumpInAccess):
        * bytecode/InstanceOfStatus.cpp:
        (JSC::InstanceOfStatus::computeForStubInfo):
        * bytecode/InternalFunctionAllocationProfile.h:
        (JSC::InternalFunctionAllocationProfile::offsetOfStructure):
        (JSC::InternalFunctionAllocationProfile::structure):
        (JSC::InternalFunctionAllocationProfile::clear):
        (JSC::InternalFunctionAllocationProfile::visitAggregate):
        (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
        (JSC::InternalFunctionAllocationProfile::offsetOfStructureID): Deleted.
        * bytecode/PolyProtoAccessChain.cpp:
        (JSC::PolyProtoAccessChain::needImpurePropertyWatchpoint const):
        * bytecode/PolyProtoAccessChain.h:
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::visitWeak const):
        * bytecode/PutByIdFlags.h:
        * bytecode/PutByStatus.cpp:
        (JSC::PutByStatus::computeFromLLInt):
        (JSC::PutByStatus::computeForStubInfo):
        * bytecode/SetPrivateBrandStatus.cpp:
        (JSC::SetPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/SpeculatedType.cpp:
        (JSC::speculationFromCell):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initGetByIdSelf):
        (JSC::StructureStubInfo::initPutByIdReplace):
        (JSC::StructureStubInfo::initInByIdSelf):
        (JSC::StructureStubInfo::deref):
        (JSC::StructureStubInfo::aboutToDie):
        (JSC::StructureStubInfo::addAccessCase):
        (JSC::StructureStubInfo::reset):
        (JSC::StructureStubInfo::visitAggregateImpl):
        (JSC::StructureStubInfo::visitWeakReferences):
        (JSC::StructureStubInfo::propagateTransitions):
        (JSC::StructureStubInfo::summary const):
        (JSC::StructureStubInfo::containsPC const):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::offsetOfByIdSelfOffset):
        (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
        (JSC::StructureStubInfo::inlineAccessBaseStructure):
        (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructureID): Deleted.
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::dump):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::branchWeakStructure):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::finalize):
        * dfg/DFGSpeculativeJIT.cpp:
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
        (JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther):
        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
        (JSC::DFG::SpeculativeJIT::emitUntypedBranch):
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCreatePromise):
        (JSC::FTL::DFG::LowerDFGToB3::compileCreateInternalFieldObject):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * heap/AbstractSlotVisitor.h:
        * heap/AbstractSlotVisitorInlines.h:
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::runEndPhase):
        * heap/Heap.h:
        (JSC::Heap::structureIDTable):
        * heap/IsoAlignedMemoryAllocator.cpp:
        (JSC::IsoAlignedMemoryAllocator::IsoAlignedMemoryAllocator):
        (JSC::IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator):
        (JSC::IsoAlignedMemoryAllocator::tryAllocateAlignedMemory):
        (JSC::IsoAlignedMemoryAllocator::freeAlignedMemory):
        (JSC::IsoAlignedMemoryAllocator::tryMallocBlock): Deleted.
        (JSC::IsoAlignedMemoryAllocator::freeBlock): Deleted.
        (JSC::IsoAlignedMemoryAllocator::commitBlock): Deleted.
        (JSC::IsoAlignedMemoryAllocator::decommitBlock): Deleted.
        * heap/IsoAlignedMemoryAllocator.h:
        * heap/IsoMemoryAllocatorBase.cpp: Removed.
        * heap/IsoMemoryAllocatorBase.h: Removed.
        * heap/IsoSubspace.cpp:
        (JSC::IsoSubspace::IsoSubspace):
        (JSC::IsoSubspace::tryAllocateFromLowerTier):
        * heap/IsoSubspace.h:
        * heap/PreciseAllocation.cpp:
        (JSC::PreciseAllocation::createForLowerTier):
        (JSC::PreciseAllocation::tryCreateForLowerTier): Deleted.
        * heap/PreciseAllocation.h:
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::appendJSCellOrAuxiliary):
        * heap/SlotVisitor.h:
        * heap/SlotVisitorInlines.h:
        * heap/StructureAlignedMemoryAllocator.cpp: Removed.
        * heap/StructureAlignedMemoryAllocator.h: Removed.
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
        (JSC::AssemblyHelpers::emitLoadStructure):
        (JSC::AssemblyHelpers::emitLoadPrototype):
        (JSC::AssemblyHelpers::emitRandomThunk):
        (JSC::AssemblyHelpers::emitConvertValueToBoolean):
        (JSC::AssemblyHelpers::branchIfValue):
        (JSC::AssemblyHelpers::emitNonNullDecodeStructureID): Deleted.
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchStructure):
        (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly):
        * jit/GCAwareJITStubRoutine.cpp:
        (JSC::PolymorphicAccessJITStubRoutine::computeHash):
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::generateGetByIdInlineAccess):
        (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_typeof_is_undefined):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_eq_null):
        (JSC::JIT::emit_op_neq_null):
        (JSC::JIT::emit_op_get_prototype_of):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_property_enumerator):
        * jit/JITStubRoutine.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        (JSC::LLInt::performLLIntGetByID):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/ArrayPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/BigIntPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/BooleanPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/DatePrototype.cpp:
        (JSC::formateDateInstance):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::sanitizedMessageString):
        (JSC::ErrorInstance::sanitizedNameString):
        (JSC::ErrorInstance::sanitizedToString):
        * runtime/ErrorPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/FunctionExecutable.cpp:
        (JSC::FunctionExecutable::visitChildrenImpl):
        * runtime/FunctionExecutable.h:
        * runtime/FunctionPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/FunctionRareData.cpp:
        (JSC::FunctionRareData::visitChildrenImpl):
        * runtime/FunctionRareData.h:
        * runtime/HasOwnPropertyCache.h:
        * runtime/InitializeThreading.cpp:
        (JSC::initialize):
        * runtime/JSCConfig.h:
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::dumpInContextAssumingStructure const):
        (JSC::JSValue::dumpForBacktrace const):
        * runtime/JSCell.cpp:
        (JSC::JSCell::toObjectSlow const):
        * runtime/JSCell.h:
        (JSC::JSCell::clearStructure):
        * runtime/JSCellInlines.h:
        (JSC::JSCell::structure const):
        (JSC::JSCell::setStructure):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::visitChildrenImpl):
        * runtime/JSGlobalObject.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::visitButterflyImpl):
        (JSC::JSObject::createInitialUndecided):
        (JSC::JSObject::createInitialInt32):
        (JSC::JSObject::createInitialDouble):
        (JSC::JSObject::createInitialContiguous):
        (JSC::JSObject::createArrayStorage):
        (JSC::JSObject::convertUndecidedToArrayStorage):
        (JSC::JSObject::convertInt32ToArrayStorage):
        (JSC::JSObject::convertDoubleToArrayStorage):
        (JSC::JSObject::convertContiguousToArrayStorage):
        (JSC::JSObject::putDirectCustomGetterSetterWithoutTransition):
        (JSC::JSObject::putDirectNonIndexAccessorWithoutTransition):
        * runtime/JSObject.h:
        (JSC::JSObject::nukeStructureAndSetButterfly):
        (JSC::JSObject::getPropertySlot):
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::getPropertySlot):
        (JSC::JSObject::getNonIndexPropertySlot):
        (JSC::JSObject::putDirectWithoutTransition):
        (JSC::JSObject::putDirectInternal):
        * runtime/JSPropertyNameEnumerator.cpp:
        (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
        (JSC::JSPropertyNameEnumerator::visitChildrenImpl):
        * runtime/JSPropertyNameEnumerator.h:
        * runtime/NumberPrototype.cpp:
        (JSC::toThisNumber):
        * runtime/ObjectPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::objectPrototypeToString):
        * runtime/RegExpPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/StringPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/Structure.cpp:
        (JSC::Structure::Structure):
        (JSC::Structure::~Structure):
        (JSC::Structure::flattenDictionaryStructure):
        (JSC::Structure::dump const):
        (JSC::Structure::canCachePropertyNameEnumerator const):
        * runtime/Structure.h:
        (JSC::Structure::id const):
        * runtime/StructureChain.cpp:
        (JSC::StructureChain::create):
        (JSC::StructureChain::visitChildrenImpl):
        * runtime/StructureID.h: Removed.
        * runtime/StructureIDBlob.h:
        (JSC::StructureIDBlob::StructureIDBlob):
        * runtime/StructureIDTable.cpp: Added.
        (JSC::StructureIDTable::StructureIDTable):
        (JSC::StructureIDTable::makeFreeListFromRange):
        (JSC::StructureIDTable::resize):
        (JSC::StructureIDTable::flushOldTables):
        (JSC::StructureIDTable::allocateID):
        (JSC::StructureIDTable::deallocateID):
        * runtime/StructureIDTable.h: Added.
        (JSC::nukedStructureIDBit):
        (JSC::nuke):
        (JSC::isNuked):
        (JSC::decontaminate):
        (JSC::StructureIDTable::base):
        (JSC::StructureIDTable::size const):
        (JSC::StructureIDTable::table const):
        (JSC::StructureIDTable::decode):
        (JSC::StructureIDTable::encode):
        (JSC::StructureIDTable::get):
        (JSC::StructureIDTable::tryGet):
        (JSC::StructureIDTable::validate):
        (JSC::StructureIDTable::deallocateID):
        (JSC::StructureIDTable::allocateID):
        (JSC::StructureIDTable::flushOldTables):
        * runtime/StructureRareData.cpp:
        (JSC::StructureRareData::StructureRareData):
        * runtime/StructureRareData.h:
        * runtime/StructureRareDataInlines.h:
        (JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint):
        * runtime/SymbolPrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/TypeProfilerLog.cpp:
        (JSC::TypeProfilerLog::processLogEntries):
        (JSC::TypeProfilerLog::visit):
        * runtime/VM.h:
        (JSC::VM::getStructure):
        (JSC::VM::tryGetStructure):
        * runtime/WriteBarrier.h:
        (JSC::WriteBarrierStructureID::WriteBarrierStructureID): Deleted.
        (JSC::WriteBarrierStructureID::get const): Deleted.
        (JSC::WriteBarrierStructureID::operator* const): Deleted.
        (JSC::WriteBarrierStructureID::operator-> const): Deleted.
        (JSC::WriteBarrierStructureID::clear): Deleted.
        (JSC::WriteBarrierStructureID::operator bool const): Deleted.
        (JSC::WriteBarrierStructureID::operator! const): Deleted.
        (JSC::WriteBarrierStructureID::setWithoutWriteBarrier): Deleted.
        (JSC::WriteBarrierStructureID::unvalidatedGet const): Deleted.
        (JSC::WriteBarrierStructureID::value const): Deleted.
        * runtime/WriteBarrierInlines.h:
        (JSC::WriteBarrierStructureID::set): Deleted.
        (JSC::WriteBarrierStructureID::setMayBeNull): Deleted.
        (JSC::WriteBarrierStructureID::setEarlyValue): Deleted.
        * tools/HeapVerifier.cpp:
        (JSC::HeapVerifier::validateJSCell):
        * tools/Integrity.cpp:
        * tools/Integrity.h:
        * tools/IntegrityInlines.h:
        (JSC::Integrity::auditStructureID):
        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSDollarVM::finishCreation):
        (JSC::JSDollarVM::visitChildrenImpl):
        * tools/JSDollarVM.h:
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::WebAssemblyFunction::jsCallEntrypointSlow):
        * wasm/js/WebAssemblyGlobalPrototype.cpp:
        (JSC::getGlobal):

2021-12-13  waddlesplash  <waddlesplash@gmail.com>

        ExecutableAllocator: Do not store things in g_config when USE(SYSTEM_MALLOC).



    heap/HeapSnapshotBuilder.h
    heap/HeapSubspaceTypes.h
    heap/IncrementalSweeper.h
    heap/IsoAlignedMemoryAllocator.h
    heap/IsoCellSet.h
    heap/IsoHeapCellType.h
    heap/IsoInlinedHeapCellType.h
    heap/IsoInlinedHeapCellTypeInlines.h
    heap/IsoMemoryAllocatorBase.h
    heap/IsoSubspace.h
    heap/IsoSubspaceInlines.h
    heap/IsoSubspacePerVM.h

    heap/Strong.h
    heap/StrongForward.h
    heap/StrongInlines.h
    heap/StructureAlignedMemoryAllocator.h
    heap/Subspace.h
    heap/SubspaceInlines.h
    heap/Synchronousness.h

    runtime/Structure.h
    runtime/StructureCache.h
    runtime/StructureChain.h
    runtime/StructureID.h
    runtime/StructureIDBlob.h
    runtime/StructureIDTable.h
    runtime/StructureInlines.h
    runtime/StructureRareData.h
    runtime/StructureRareDataInlines.h



heap/IsoAlignedMemoryAllocator.cpp
heap/IsoCellSet.cpp
heap/IsoHeapCellType.cpp
heap/IsoMemoryAllocatorBase.cpp
heap/IsoSubspace.cpp
heap/IsoSubspacePerVM.cpp
heap/JITStubRoutineSet.cpp

heap/SpaceTimeMutatorScheduler.cpp
heap/StochasticSpaceTimeMutatorScheduler.cpp
heap/StopIfNecessaryTimer.cpp
heap/StructureAlignedMemoryAllocator.cpp
heap/Subspace.cpp
heap/SynchronousStopTheWorldMutatorScheduler.cpp
heap/Synchronousness.cpp

runtime/Structure.cpp
runtime/StructureCache.cpp
runtime/StructureChain.cpp
runtime/StructureIDTable.cpp
runtime/StructureRareData.cpp
runtime/Symbol.cpp
runtime/SymbolConstructor.cpp



    , m_polyProtoAccessChain(WTFMove(prototypeAccessChain))
    , m_identifier(identifier)
{
    m_structure.setMayBeNull(vm, owner, structure);
    m_conditionSet = conditionSet;
    RELEASE_ASSERT(m_conditionSet.isValid());
}

}

template<typename Functor>
void AccessCase::forEachDependentCell(VM& vm, const Functor& functor) const
{
    m_conditionSet.forEachDependentCell(functor);
    if (m_structure)
        functor(m_structure.get());
    if (m_polyProtoAccessChain) {
        for (StructureID structureID : m_polyProtoAccessChain->chain())
            functor(vm.getStructure(structureID));
    }

    switch (type()) {

        if (m_type == Transition || m_type == Delete || m_type == SetPrivateBrand)
            out.print("\n", indent, "from structure = ", pointerDump(structure()),
                "\n", indent, "to structure = ", pointerDump(newStructure()));
        else if (m_structure)
            out.print("\n", indent, "structure = ", pointerDump(m_structure.get()));
    }

    if (!m_conditionSet.isEmpty())

template<typename Visitor>
void AccessCase::propagateTransitions(Visitor& visitor) const
{
    if (m_structure)
        m_structure->markIfCheap(visitor);

    if (m_polyProtoAccessChain) {
        for (StructureID structureID : m_polyProtoAccessChain->chain())
            visitor.vm().getStructure(structureID)->markIfCheap(visitor);
    }

    switch (m_type) {
    case Transition:
    case Delete:
        if (visitor.isMarked(m_structure->previousID()))
            visitor.appendUnbarriered(m_structure.get());
        break;
    default:
        break;

        JSValueRegs resultRegs(scratchGPR, scratch2GPR);
#endif

        jit.emitLoadPrototype(vm, valueGPR, resultRegs, scratchGPR, failAndIgnore);
        jit.move(scratch2GPR, valueGPR);
        
        CCallHelpers::Jump isInstance = jit.branchPtr(CCallHelpers::Equal, valueGPR, prototypeGPR);

        return false;
    if (lhs.m_viaProxy != rhs.m_viaProxy)
        return false;
    if (lhs.m_structure.get() != rhs.m_structure.get())
        return false;
    if (lhs.m_identifier != rhs.m_identifier)
        return false;



    Structure* structure() const
    {
        if (m_type == Transition || m_type == Delete || m_type == SetPrivateBrand)
            return m_structure->previousID();
        return m_structure.get();
    }
    bool guardedByStructureCheck(const StructureStubInfo&) const;

    Structure* newStructure() const
    {
        ASSERT(m_type == Transition || m_type == Delete || m_type == SetPrivateBrand);
        return m_structure.get();
    }

    ObjectPropertyConditionSet conditionSet() const { return m_conditionSet; }


    unsigned hash() const
    {
        return computeHash(m_conditionSet.hash(), static_cast<unsigned>(m_type), m_viaProxy, m_structure.unvalidatedGet(), m_offset);
    }

    static bool canBeShared(const AccessCase&, const AccessCase&);

        , m_state(WTFMove(other.m_state))
        , m_viaProxy(WTFMove(other.m_viaProxy))
        , m_offset(WTFMove(other.m_offset))
        , m_structure(WTFMove(other.m_structure))
        , m_conditionSet(WTFMove(other.m_conditionSet))
        , m_polyProtoAccessChain(WTFMove(other.m_polyProtoAccessChain))
        , m_identifier(WTFMove(other.m_identifier))

        , m_state(other.m_state)
        , m_viaProxy(other.m_viaProxy)
        , m_offset(other.m_offset)
        , m_structure(other.m_structure)
        , m_conditionSet(other.m_conditionSet)
        , m_polyProtoAccessChain(other.m_polyProtoAccessChain)
        , m_identifier(other.m_identifier)

    // Usually this is the structure that we expect the base object to have. But, this is the *new*
    // structure for a transition and we rely on the fact that it has a strong reference to the old
    // structure. For proxies, this is the structure of the object behind the proxy.
    WriteBarrier<Structure> m_structure;

    ObjectPropertyConditionSet m_conditionSet;




    if (!m_lastSeenStructureID)
        return;
    
    Structure* lastSeenStructure = codeBlock->heap()->structureIDTable().get(m_lastSeenStructureID);
    computeUpdatedPrediction(locker, codeBlock, lastSeenStructure);
    m_lastSeenStructureID = 0;
}

void ArrayProfile::computeUpdatedPrediction(const ConcurrentJSLocker&, CodeBlock* codeBlock, Structure* lastSeenStructure)

Lines 249-255 private: Source/JavaScriptCore/bytecode/ArrayProfile.h_sec1
- Source/JavaScriptCore/bytecode/ArrayProfile.h -1 / +1 lines
249		249
250	static Structure* polymorphicStructure() { return static_cast<Structure>(reinterpret_cast<void>(1)); }	250	static Structure* polymorphicStructure() { return static_cast<Structure>(reinterpret_cast<void>(1)); }
251		251
252	StructureID m_lastSeenStructureID;	252	StructureID m_lastSeenStructureID { 0 };
253	bool m_mayStoreToHole { false }; // This flag may become overloaded to indicate other special cases that were encountered during array access, as it depends on indexing type. Since we currently have basically just one indexing type (two variants of ArrayStorage), this flag for now just means exactly what its name implies.	253	bool m_mayStoreToHole { false }; // This flag may become overloaded to indicate other special cases that were encountered during array access, as it depends on indexing type. Since we currently have basically just one indexing type (two variants of ArrayStorage), this flag for now just means exactly what its name implies.
254	bool m_outOfBounds { false };	254	bool m_outOfBounds { false };
255	#if USE(LARGE_TYPED_ARRAYS)	255	#if USE(LARGE_TYPED_ARRAYS)

Lines 100-106 CheckPrivateBrandStatus CheckPrivateBran Source/JavaScriptCore/bytecode/CheckPrivateBrandStatus.cpp_sec1
- Source/JavaScriptCore/bytecode/CheckPrivateBrandStatus.cpp -1 / +1 lines
100	return CheckPrivateBrandStatus(NoInformation);	100	return CheckPrivateBrandStatus(NoInformation);
101		101
102	case CacheType::Stub: {	102	case CacheType::Stub: {
103	PolymorphicAccess* list = stubInfo->m_stub;	103	PolymorphicAccess* list = stubInfo->u.stub;
104		104
105	for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {	105	for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {
106	const AccessCase& access = list->at(listIndex);	106	const AccessCase& access = list->at(listIndex);



void CodeBlock::propagateTransitions(const ConcurrentJSLocker&, Visitor& visitor)
{
    typename Visitor::SuppressGCVerifierScope suppressScope(visitor);
    VM& vm = *m_vm;

    if (jitType() == JITType::InterpreterThunk) {
        if (m_metadata) {

                if (!oldStructureID || !newStructureID)
                    return;

                Structure* oldStructure = vm.heap.structureIDTable().get(oldStructureID);
                if (visitor.isMarked(oldStructure)) {
                    Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
                    visitor.appendUnbarriered(newStructure);
                }
            });

                if (!visitor.isMarked(property))
                    return;

                Structure* oldStructure = vm.heap.structureIDTable().get(oldStructureID);
                if (visitor.isMarked(oldStructure)) {
                    Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
                    visitor.appendUnbarriered(newStructure);
                }
            });

                if (!visitor.isMarked(brand))
                    return;

                Structure* oldStructure = vm.heap.structureIDTable().get(oldStructureID);
                if (visitor.isMarked(oldStructure)) {
                    Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
                    visitor.appendUnbarriered(newStructure);
                }
            });

        dfgCommon->recordedStatuses.markIfCheap(visitor);
        
        for (StructureID structureID : dfgCommon->m_weakStructureReferences)
            vm.getStructure(structureID)->markIfCheap(visitor);

        for (auto& transition : dfgCommon->m_transitions) {
            if (shouldMarkTransition(visitor, transition)) {

    
#if ENABLE(DFG_JIT)
    VM& vm = *m_vm;
    UNUSED_VARIABLE(vm);
    if (visitor.isMarked(this))
        return;
    

    }
    if (allAreLiveSoFar) {
        for (StructureID structureID : dfgCommon->m_weakStructureReferences) {
            Structure* structure = vm.getStructure(structureID);
            if (!visitor.isMarked(structure)) {
                allAreLiveSoFar = false;
                break;

            if (modeMetadata.mode != GetByIdMode::Default)
                return;
            StructureID oldStructureID = modeMetadata.defaultMode.structureID;
            if (!oldStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
                return;
            dataLogLnIf(Options::verboseOSR(), "Clearing ", opName, " LLInt property access.");
            LLIntPrototypeLoadAdaptiveStructureWatchpoint::clearLLIntGetByIdCache(modeMetadata);


        m_metadata->forEach<OpTryGetById>([&] (auto& metadata) {
            StructureID oldStructureID = metadata.m_structureID;
            if (!oldStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
                return;
            dataLogLnIf(Options::verboseOSR(), "Clearing try_get_by_id LLInt property access.");
            metadata.m_structureID = 0;
            metadata.m_offset = 0;
        });

        m_metadata->forEach<OpGetByIdDirect>([&] (auto& metadata) {
            StructureID oldStructureID = metadata.m_structureID;
            if (!oldStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
                return;
            dataLogLnIf(Options::verboseOSR(), "Clearing get_by_id_direct LLInt property access.");
            metadata.m_structureID = 0;
            metadata.m_offset = 0;
        });


            JSCell* property = metadata.m_property.get();
            StructureID structureID = metadata.m_structureID;

            if ((!property || vm.heap.isMarked(property)) && (!structureID || vm.heap.isMarked(vm.heap.structureIDTable().get(structureID))))
                return;

            dataLogLnIf(Options::verboseOSR(), "Clearing LLInt private property access.");
            metadata.m_structureID = 0;
            metadata.m_offset = 0;
            metadata.m_property.clear();
        });

            StructureID oldStructureID = metadata.m_oldStructureID;
            StructureID newStructureID = metadata.m_newStructureID;
            StructureChain* chain = metadata.m_structureChain.get();
            if ((!oldStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
                && (!newStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(newStructureID)))
                && (!chain || vm.heap.isMarked(chain)))
                return;
            dataLogLnIf(Options::verboseOSR(), "Clearing LLInt put transition.");
            metadata.m_oldStructureID = 0;
            metadata.m_offset = 0;
            metadata.m_newStructureID = 0;
            metadata.m_structureChain.clear();
        });


            StructureID oldStructureID = metadata.m_oldStructureID;
            StructureID newStructureID = metadata.m_newStructureID;
            JSCell* property = metadata.m_property.get();
            if ((!oldStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
                && (!property || vm.heap.isMarked(property))
                && (!newStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(newStructureID))))
                return;

            dataLogLnIf(Options::verboseOSR(), "Clearing LLInt put_private_name transition.");
            metadata.m_oldStructureID = 0;
            metadata.m_offset = 0;
            metadata.m_newStructureID = 0;
            metadata.m_property.clear();
        });


            StructureID oldStructureID = metadata.m_oldStructureID;
            StructureID newStructureID = metadata.m_newStructureID;
            JSCell* brand = metadata.m_brand.get();
            if ((!oldStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
                && (!brand || vm.heap.isMarked(brand))
                && (!newStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(newStructureID))))
                return;

            dataLogLnIf(Options::verboseOSR(), "Clearing LLInt set_private_brand transition.");
            metadata.m_oldStructureID = 0;
            metadata.m_newStructureID = 0;
            metadata.m_brand.clear();
        });

        m_metadata->forEach<OpCheckPrivateBrand>([&] (auto& metadata) {
            StructureID structureID = metadata.m_structureID;
            JSCell* brand = metadata.m_brand.get();
            if ((!structureID || vm.heap.isMarked(vm.heap.structureIDTable().get(structureID)))
                && (!brand || vm.heap.isMarked(brand)))
                return;

            dataLogLnIf(Options::verboseOSR(), "Clearing LLInt check_private_brand transition.");
            metadata.m_structureID = 0;
            metadata.m_brand.clear();
        });

        m_metadata->forEach<OpToThis>([&] (auto& metadata) {
            if (!metadata.m_cachedStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(metadata.m_cachedStructureID)))
                return;
            if (Options::verboseOSR()) {
                Structure* structure = vm.heap.structureIDTable().get(metadata.m_cachedStructureID);
                dataLogF("Clearing LLInt to_this with structure %p.\n", structure);
            }
            metadata.m_cachedStructureID = 0;
            metadata.m_toThisStatus = merge(metadata.m_toThisStatus, ToThisClearedByGC);
        });


            return true;
        };

        if (!vm.heap.isMarked(vm.heap.structureIDTable().get(std::get<0>(pair.key))))
            return clear();

        for (const LLIntPrototypeLoadAdaptiveStructureWatchpoint& watchpoint : pair.value) {

        visitor.append(weakReference);

    for (StructureID structureID : dfgCommon->m_weakStructureReferences)
        visitor.appendUnbarriered(visitor.vm().getStructure(structureID));
#endif    
}


Lines 99-105 DeleteByStatus DeleteByStatus::computeFo Source/JavaScriptCore/bytecode/DeleteByStatus.cpp_sec1
- Source/JavaScriptCore/bytecode/DeleteByStatus.cpp -1 / +1 lines
99	return DeleteByStatus(NoInformation);	99	return DeleteByStatus(NoInformation);
100		100
101	case CacheType::Stub: {	101	case CacheType::Stub: {
102	PolymorphicAccess* list = stubInfo->m_stub;	102	PolymorphicAccess* list = stubInfo->u.stub;
103		103
104	for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {	104	for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {
105	const AccessCase& access = list->at(listIndex);	105	const AccessCase& access = list->at(listIndex);



union GetByIdModeMetadata {
    GetByIdModeMetadata()
    {
        defaultMode.structureID = 0;
        defaultMode.cachedOffset = 0;
        defaultMode.padding1 = 0;
        mode = GetByIdMode::Default;

struct GetByIdModeMetadata {
    GetByIdModeMetadata()
    {
        defaultMode.structureID = 0;
        defaultMode.cachedOffset = 0;
        defaultMode.padding1 = 0;
        mode = GetByIdMode::Default;

inline void GetByIdModeMetadata::clearToDefaultModeWithoutCache()
{
    mode = GetByIdMode::Default;
    defaultMode.structureID = 0;
    defaultMode.cachedOffset = 0;
}




    if (!structureID)
        return GetByStatus(NoInformation, false);

    Structure* structure = vm.heap.structureIDTable().get(structureID);

    if (structure->takesSlowPathInDFGForImpureProperty())
        return GetByStatus(NoInformation, false);

    }
        
    case CacheType::Stub: {
        PolymorphicAccess* list = stubInfo->u.stub;
        if (list->size() == 1) {
            const AccessCase& access = list->at(0);
            switch (access.type()) {

Lines 160-166 InByStatus InByStatus::computeForStubInf Source/JavaScriptCore/bytecode/InByStatus.cpp_sec1
- Source/JavaScriptCore/bytecode/InByStatus.cpp -1 / +1 lines
160	}	160	}
161		161
162	case CacheType::Stub: {	162	case CacheType::Stub: {
163	PolymorphicAccess* list = stubInfo->m_stub;	163	PolymorphicAccess* list = stubInfo->u.stub;
164	for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {	164	for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {
165	const AccessCase& access = list->at(listIndex);	165	const AccessCase& access = list->at(listIndex);
166	if (access.viaProxy())	166	if (access.viaProxy())



        }

        stubInfo.m_codePtr = target;
        stubInfo.m_inlineAccessBaseStructure = 0; // Clear out the inline access code.
        return;
    }


{
    if (codeBlock->useDataIC() && codeBlock->jitType() == JITType::BaselineJIT) {
        stubInfo.m_codePtr = stubInfo.slowPathStartLocation;
        stubInfo.m_inlineAccessBaseStructure = 0; // Clear out the inline access code.
        return;
    }


Lines 83-89 InstanceOfStatus InstanceOfStatus::compu Source/JavaScriptCore/bytecode/InstanceOfStatus.cpp_sec1
- Source/JavaScriptCore/bytecode/InstanceOfStatus.cpp -1 / +1 lines
83	if (stubInfo->cacheType() != CacheType::Stub)	83	if (stubInfo->cacheType() != CacheType::Stub)
84	return TakesSlowPath; // This is conservative. It could be that we have no information.	84	return TakesSlowPath; // This is conservative. It could be that we have no information.
85		85
86	PolymorphicAccess* list = stubInfo->m_stub;	86	PolymorphicAccess* list = stubInfo->u.stub;
87	InstanceOfStatus result;	87	InstanceOfStatus result;
88	for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {	88	for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {
89	const AccessCase& access = list->at(listIndex);	89	const AccessCase& access = list->at(listIndex);




class InternalFunctionAllocationProfile {
public:
    static inline ptrdiff_t offsetOfStructure() { return OBJECT_OFFSETOF(InternalFunctionAllocationProfile, m_structure); }

    Structure* structure() { return m_structure.get(); }
    Structure* createAllocationStructureFromBase(VM&, JSGlobalObject*, JSCell* owner, JSObject* prototype, Structure* base);

    void clear() { m_structure.clear(); }
    template<typename Visitor> void visitAggregate(Visitor& visitor) { visitor.append(m_structure); }

private:
    WriteBarrier<Structure> m_structure;
};

inline Structure* InternalFunctionAllocationProfile::createAllocationStructureFromBase(VM& vm, JSGlobalObject* baseGlobalObject, JSCell* owner, JSObject* prototype, Structure* baseStructure)
{
    ASSERT(!m_structure || m_structure.get()->classInfo() != baseStructure->classInfo() || m_structure->globalObject() != baseStructure->globalObject());
    ASSERT(baseStructure->hasMonoProto());

    Structure* structure;

    // Ensure that if another thread sees the structure, it will see it properly created.
    WTF::storeStoreFence();

    m_structure.set(vm, owner, structure);
    return m_structure.get();
}

} // namespace JSC



    return adoptRef(*new PolyProtoAccessChain(WTFMove(chain)));
}

bool PolyProtoAccessChain::needImpurePropertyWatchpoint(VM& vm) const
{
    for (StructureID structureID : m_chain) {
        if (vm.getStructure(structureID)->needImpurePropertyWatchpoint())
            return true;
    }
    return false;




#pragma once

#include "StructureIDTable.h"
#include "VM.h"
#include <wtf/FixedVector.h>
#include <wtf/Vector.h>

    bool needImpurePropertyWatchpoint(VM&) const;

    template <typename Func>
    void forEach(VM& vm, Structure* baseStructure, const Func& func) const
    {
        bool atEnd = !m_chain.size();
        func(baseStructure, atEnd);
        for (unsigned i = 0; i < m_chain.size(); ++i) {
            atEnd = i + 1 == m_chain.size();
            func(vm.getStructure(m_chain[i]), atEnd);
        }
    }

    Structure* slotBaseStructure(VM& vm, Structure* baseStructure) const
    {
        if (m_chain.size())
            return vm.getStructure(m_chain.last());
        return baseStructure;
    }


Lines 381-387 bool PolymorphicAccess::visitWeak(VM& vm Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp_sec1
- Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp -1 / +1 lines
381	}	381	}
382	if (m_stubRoutine) {	382	if (m_stubRoutine) {
383	for (StructureID weakReference : m_stubRoutine->weakStructures()) {	383	for (StructureID weakReference : m_stubRoutine->weakStructures()) {
384	Structure* structure = weakReference.decode();	384	Structure* structure = vm.getStructure(weakReference);
385	if (!vm.heap.isMarked(structure))	385	if (!vm.heap.isMarked(structure))
386	return false;	386	return false;
387	}	387	}

Lines 26-31 Source/JavaScriptCore/bytecode/PutByIdFlags.h_sec1
- Source/JavaScriptCore/bytecode/PutByIdFlags.h +1 lines
26	#pragma once	26	#pragma once
27		27
28	#include "ECMAMode.h"	28	#include "ECMAMode.h"
		29	#include "StructureIDTable.h"
29		30
30	namespace JSC {	31	namespace JSC {
31		32



    if (!structureID)
        return PutByStatus(NoInformation);
    
    Structure* structure = vm.heap.structureIDTable().get(structureID);

    StructureID newStructureID = metadata.m_newStructureID;
    if (!newStructureID) {

        return PutByVariant::replace(nullptr, structure, offset);
    }

    Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
    
    ASSERT(structure->transitionWatchpointSetHasBeenInvalidated());
    

    }
        
    case CacheType::Stub: {
        PolymorphicAccess* list = stubInfo->u.stub;
        
        PutByStatus result;
        result.m_state = Simple;

Lines 100-106 SetPrivateBrandStatus SetPrivateBrandSta Source/JavaScriptCore/bytecode/SetPrivateBrandStatus.cpp_sec1
- Source/JavaScriptCore/bytecode/SetPrivateBrandStatus.cpp -1 / +1 lines
100	return SetPrivateBrandStatus(NoInformation);	100	return SetPrivateBrandStatus(NoInformation);
101		101
102	case CacheType::Stub: {	102	case CacheType::Stub: {
103	PolymorphicAccess* list = stubInfo->m_stub;	103	PolymorphicAccess* list = stubInfo->u.stub;
104		104
105	for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {	105	for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {
106	const AccessCase& access = list->at(listIndex);	106	const AccessCase& access = list->at(listIndex);

Lines 596-602 SpeculatedType speculationFromCell(JSCel Source/JavaScriptCore/bytecode/SpeculatedType.cpp_sec1
- Source/JavaScriptCore/bytecode/SpeculatedType.cpp -1 / +7 lines
596	}	596	}
597	return SpecString;	597	return SpecString;
598	}	598	}
599	return speculationFromStructure(cell->structure());	599	// FIXME: rdar://69036888: undo this when no longer needed.
		600	auto* structure = cell->vm().tryGetStructure(cell->structureID());
		601	if (UNLIKELY(!isSanePointer(structure))) {
		602	ASSERT_NOT_REACHED();
		603	return SpecNone;
		604	}
		605	return speculationFromStructure(structure);
600	}	606	}
601		607
602	SpeculatedType speculationFromValue(JSValue value)	608	SpeculatedType speculationFromValue(JSValue value)



    ASSERT(hasConstantIdentifier);
    setCacheType(locker, CacheType::GetByIdSelf);
    m_identifier = identifier;
    m_inlineAccessBaseStructure = inlineAccessBaseStructure->id();
    codeBlock->vm().writeBarrier(codeBlock);
    byIdSelfOffset = offset;
}


    ASSERT(m_cacheType == CacheType::Unset);
    setCacheType(locker, CacheType::PutByIdReplace);
    m_identifier = identifier;
    m_inlineAccessBaseStructure = inlineAccessBaseStructure->id();
    codeBlock->vm().writeBarrier(codeBlock);
    byIdSelfOffset = offset;
}


    ASSERT(m_cacheType == CacheType::Unset);
    setCacheType(locker, CacheType::InByIdSelf);
    m_identifier = identifier;
    m_inlineAccessBaseStructure = inlineAccessBaseStructure->id();
    codeBlock->vm().writeBarrier(codeBlock);
    byIdSelfOffset = offset;
}


{
    switch (m_cacheType) {
    case CacheType::Stub:
        delete u.stub;
        return;
    case CacheType::Unset:
    case CacheType::GetByIdSelf:

{
    switch (m_cacheType) {
    case CacheType::Stub:
        u.stub->aboutToDie();
        return;
    case CacheType::Unset:
    case CacheType::GetByIdSelf:

        AccessGenerationResult result;
        
        if (m_cacheType == CacheType::Stub) {
            result = u.stub->addCase(locker, vm, codeBlock, *this, accessCase.releaseNonNull());
            
            if (StructureStubInfoInternal::verbose)
                dataLog("Had stub, result: ", result, "\n");

            }
            
            setCacheType(locker, CacheType::Stub);
            u.stub = access.release();
        }
        
        ASSERT(m_cacheType == CacheType::Stub);

        // PolymorphicAccess.
        clearBufferedStructures();
        
        result = u.stub->regenerate(locker, vm, globalObject, codeBlock, ecmaMode, *this);
        
        if (StructureStubInfoInternal::verbose)
            dataLog("Regeneration result: ", result, "\n");

        // access code. That's because when we first transition to becoming a Stub, we may
        // be buffered, and we have not yet generated any code. Once the Stub finally generates
        // code, we're no longer running the inline access code, so we can then clear out
        // m_inlineAccessBaseStructure. The reason we don't clear m_inlineAccessBaseStructure while
        // we're buffered is because we rely on it to reset during GC if m_inlineAccessBaseStructure
        // is collected.
        m_identifier = nullptr;
        m_inlineAccessBaseStructure = 0;
        
        // If we generated some code then we don't want to attempt to repatch in the future until we
        // gather enough cases.

{
    clearBufferedStructures();
    m_identifier = nullptr;
    m_inlineAccessBaseStructure = 0;

    if (m_cacheType == CacheType::Unset)
        return;

    case CacheType::GetByIdSelf:
        return;
    case CacheType::Stub:
        u.stub->visitAggregate(visitor);
        return;
    }
    

    if (Structure* structure = inlineAccessBaseStructure(vm))
        isValid &= vm.heap.isMarked(structure);
    if (m_cacheType == CacheType::Stub)
        isValid &= u.stub->visitWeak(vm);

    if (isValid)
        return;

        structure->markIfCheap(visitor);

    if (m_cacheType == CacheType::Stub)
        u.stub->propagateTransitions(visitor);
}

template void StructureStubInfo::propagateTransitions(AbstractSlotVisitor&);

    StubInfoSummary takesSlowPath = StubInfoSummary::TakesSlowPath;
    StubInfoSummary simple = StubInfoSummary::Simple;
    if (m_cacheType == CacheType::Stub) {
        PolymorphicAccess* list = u.stub;
        for (unsigned i = 0; i < list->size(); ++i) {
            const AccessCase& access = list->at(i);
            if (access.doesCalls(vm)) {

{
    if (m_cacheType != CacheType::Stub)
        return false;
    return u.stub->containsPC(pc);
}

ALWAYS_INLINE void StructureStubInfo::setCacheType(const ConcurrentJSLockerBase&, CacheType newCacheType)



        return considerCaching(vm, codeBlock, structure, impl);
    }

    Structure* inlineAccessBaseStructure(VM&)
    {
        return m_inlineAccessBaseStructureID.get();
    }

    static ptrdiff_t offsetOfByIdSelfOffset() { return OBJECT_OFFSETOF(StructureStubInfo, byIdSelfOffset); }
    static ptrdiff_t offsetOfInlineAccessBaseStructureID() { return OBJECT_OFFSETOF(StructureStubInfo, m_inlineAccessBaseStructureID); }

private:
    ALWAYS_INLINE bool considerCaching(VM& vm, CodeBlock* codeBlock, Structure* structure, CacheableIdentifier impl)
    {


public:
    CodeOrigin codeOrigin;
    PolymorphicAccess* m_stub { nullptr };
    PropertyOffset byIdSelfOffset;
    static ptrdiff_t offsetOfByIdSelfOffset() { return OBJECT_OFFSETOF(StructureStubInfo, byIdSelfOffset); }
    static ptrdiff_t offsetOfInlineAccessBaseStructure() { return OBJECT_OFFSETOF(StructureStubInfo, m_inlineAccessBaseStructure); }
    union {
        PolymorphicAccess* stub;
    } u;
    Structure* inlineAccessBaseStructure(VM& vm)
    {
        if (!m_inlineAccessBaseStructure)
            return nullptr;
        return vm.getStructure(m_inlineAccessBaseStructure);
    }
    StructureID m_inlineAccessBaseStructure { 0 };
private:
    CacheableIdentifier m_identifier;
    // Represents those structures that already have buffered AccessCases in the PolymorphicAccess.

    uint8_t countdown { 1 };
    uint8_t repatchCount { 0 };
    uint8_t numberOfCoolDowns { 0 };

private:
    Lock m_bufferedStructuresLock;
public:
    CallSiteIndex callSiteIndex;

    uint8_t bufferingCountdown;
    bool resetByGC : 1;
    bool tookSlowPath : 1;
    bool everConsidered : 1;

    bool propertyIsString : 1;
    bool propertyIsInt32 : 1;
    bool propertyIsSymbol : 1;
private:
    Lock m_bufferedStructuresLock;
};

inline CodeOrigin getStructureStubInfoCodeOrigin(StructureStubInfo& structureStubInfo)



                // And we check the indexing mode of the structure. If the indexing mode is CoW, the butterfly is
                // definitely JSImmutableButterfly.
                StructureID structureIDEarly = array->structureID();
                if (isNuked(structureIDEarly))
                    return false;

                if (node->arrayMode().arrayClass() == Array::OriginalCopyOnWriteArray) {

                    if (structureIDEarly != structureIDLate)
                        return false;

                    Structure* structure = m_vm.getStructure(structureIDLate);
                    switch (node->arrayMode().type()) {
                    case Array::Int32:
                    case Array::Contiguous:

                        if (structureIDEarly != structureIDLate)
                            return false;

                        Structure* structure = m_vm.getStructure(structureIDLate);
                        if (!hasAnyArrayStorage(structure->indexingMode()))
                            return false;


Lines 5504-5510 void ByteCodeParser::parseBlock(unsigned Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec1
- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp -1 / +1 lines
5504	StructureID cachedStructureID = metadata.m_cachedStructureID;	5504	StructureID cachedStructureID = metadata.m_cachedStructureID;
5505	Structure* cachedStructure = nullptr;	5505	Structure* cachedStructure = nullptr;
5506	if (cachedStructureID)	5506	if (cachedStructureID)
5507	cachedStructure = cachedStructureID.decode();	5507	cachedStructure = m_vm->heap.structureIDTable().get(cachedStructureID);
5508	if (metadata.m_toThisStatus != ToThisOK	5508	if (metadata.m_toThisStatus != ToThisOK
5509	\|\| !cachedStructure	5509	\|\| !cachedStructure
5510	\|\| cachedStructure->classInfo()->methodTable.toThis != JSObject::info()->methodTable.toThis	5510	\|\| cachedStructure->classInfo()->methodTable.toThis != JSObject::info()->methodTable.toThis

Lines 262-268 void Graph::dump(PrintStream& out, const Source/JavaScriptCore/dfg/DFGGraph.cpp_sec1
- Source/JavaScriptCore/dfg/DFGGraph.cpp -1 / +1 lines
262	if (node->hasTransition()) {	262	if (node->hasTransition()) {
263	out.print(comma, pointerDumpInContext(node->transition(), context));	263	out.print(comma, pointerDumpInContext(node->transition(), context));
264	#if USE(JSVALUE64)	264	#if USE(JSVALUE64)
265	out.print(", ID:", node->transition()->next->id().bits());	265	out.print(", ID:", node->transition()->next->id());
266	#else	266	#else
267	out.print(", ID:", RawPointer(node->transition()->next.get()));	267	out.print(", ID:", RawPointer(node->transition()->next.get()));
268	#endif	268	#endif

Lines 268-274 public: Source/JavaScriptCore/dfg/DFGJITCompiler.h_sec1
- Source/JavaScriptCore/dfg/DFGJITCompiler.h -1 / +1 lines
268	{	268	{
269	Structure* structure = weakStructure.get();	269	Structure* structure = weakStructure.get();
270	#if USE(JSVALUE64)	270	#if USE(JSVALUE64)
271	Jump result = branch32(cond, left, TrustedImm32(structure->id().bits()));	271	Jump result = branch32(cond, left, TrustedImm32(structure->id()));
272	return result;	272	return result;
273	#else	273	#else
274	return branchPtr(cond, left, TrustedImmPtr(structure));	274	return branchPtr(cond, left, TrustedImmPtr(structure));

Lines 564-570 CompilationResult Plan::finalize() Source/JavaScriptCore/dfg/DFGPlan.cpp_sec1
- Source/JavaScriptCore/dfg/DFGPlan.cpp -1 / +1 lines
564	for (WriteBarrier<JSCell>& reference : m_codeBlock->jitCode()->dfgCommon()->m_weakReferences)	564	for (WriteBarrier<JSCell>& reference : m_codeBlock->jitCode()->dfgCommon()->m_weakReferences)
565	trackedReferences.add(reference.get());	565	trackedReferences.add(reference.get());
566	for (StructureID structureID : m_codeBlock->jitCode()->dfgCommon()->m_weakStructureReferences)	566	for (StructureID structureID : m_codeBlock->jitCode()->dfgCommon()->m_weakStructureReferences)
567	trackedReferences.add(structureID.decode());	567	trackedReferences.add(m_vm->getStructure(structureID));
568	for (WriteBarrier<Unknown>& constant : m_codeBlock->constants())	568	for (WriteBarrier<Unknown>& constant : m_codeBlock->constants())
569	trackedReferences.add(constant.get());	569	trackedReferences.add(constant.get());
570		570



    } else {
        GPRTemporary localGlobalObject(this);
        GPRTemporary remoteGlobalObject(this);
        GPRTemporary scratch(this);

        JITCompiler::Jump notCell;
        if (!isKnownCell(operand.node()))

        GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
        GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
        m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
        m_jit.emitLoadStructure(vm(), argGPR, resultGPR, scratch.gpr());
        m_jit.loadPtr(JITCompiler::Address(resultGPR, Structure::globalObjectOffset()), remoteGlobalObjectGPR);
        m_jit.comparePtr(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, resultGPR);
        done.append(m_jit.jump());

    } else {
        GPRTemporary localGlobalObject(this);
        GPRTemporary remoteGlobalObject(this);
        GPRTemporary scratch(this);

        JITCompiler::Jump notCell;
        if (!isKnownCell(operand.node()))

        GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
        GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
        m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
        m_jit.emitLoadStructure(vm(), argGPR, resultGPR, scratch.gpr());
        m_jit.loadPtr(JITCompiler::Address(resultGPR, Structure::globalObjectOffset()), remoteGlobalObjectGPR);
        branchPtr(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, taken);


    GPRReg resultGPR = result.gpr();
    GPRTemporary structure;
    GPRReg structureGPR = InvalidGPRReg;
    GPRTemporary scratch;
    GPRReg scratchGPR = InvalidGPRReg;

    bool masqueradesAsUndefinedWatchpointValid =
        masqueradesAsUndefinedWatchpointIsStillValid();

        // The masquerades as undefined case will use the structure register, so allocate it here.
        // Do this at the top of the function to avoid branching around a register allocation.
        GPRTemporary realStructure(this);
        GPRTemporary realScratch(this);
        structure.adopt(realStructure);
        scratch.adopt(realScratch);
        structureGPR = structure.gpr();
        scratchGPR = scratch.gpr();
    }

    MacroAssembler::Jump notCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));

                MacroAssembler::Address(valueGPR, JSCell::typeInfoFlagsOffset()), 
                MacroAssembler::TrustedImm32(MasqueradesAsUndefined));

        m_jit.emitLoadStructure(vm(), valueGPR, structureGPR, scratchGPR);
        speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse, 
            m_jit.branchPtr(
                MacroAssembler::Equal, 

            MacroAssembler::Address(valueGPR, JSCell::typeInfoFlagsOffset()), 
            TrustedImm32(MasqueradesAsUndefined));

        m_jit.emitLoadStructure(vm(), valueGPR, structureGPR, scratchGPR);
        speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,
            m_jit.branchPtr(
                MacroAssembler::Equal, 

        bool shouldCheckMasqueradesAsUndefined = !masqueradesAsUndefinedWatchpointIsStillValid();
        if (shouldCheckMasqueradesAsUndefined) {
            branchTest8(MacroAssembler::Zero, MacroAssembler::Address(valueGPR, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined), taken);
            m_jit.emitLoadStructure(vm(), valueGPR, temp1GPR, temp2GPR);
            JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(m_currentNode->origin.semantic);
            m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), temp2GPR);
            branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp1GPR, Structure::globalObjectOffset()), temp2GPR, taken);

        ASSERT_UNUSED(oldStructure, oldStructure->indexingMode() == newStructure->indexingMode());
        ASSERT(oldStructure->typeInfo().type() == newStructure->typeInfo().type());
        ASSERT(oldStructure->typeInfo().inlineTypeFlags() == newStructure->typeInfo().inlineTypeFlags());
        m_jit.store32(MacroAssembler::TrustedImm32(newStructure->id()), MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()));
        
        noResult(node);
        break;

        GPRTemporary result(this);
        GPRTemporary localGlobalObject(this);
        GPRTemporary remoteGlobalObject(this);
        GPRTemporary scratch(this);

        JITCompiler::Jump isCell = m_jit.branchIfCell(value.jsValueRegs());


            GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
            GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
            m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.globalObjectFor(node->origin.semantic)), localGlobalObjectGPR);
            m_jit.emitLoadStructure(vm(), value.gpr(), result.gpr(), scratch.gpr());
            m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::globalObjectOffset()), remoteGlobalObjectGPR); 
            m_jit.comparePtr(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, result.gpr());
        }



{
    SpeculateCellOperand object(this, node->child1());
    GPRTemporary result(this);
    GPRTemporary scratch(this);
    m_jit.emitLoadStructure(vm(), object.gpr(), result.gpr(), scratch.gpr());
    m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::globalObjectOffset()), result.gpr());
    cellResult(result.gpr(), node);
}

        GPRReg otherGPR = other.gpr();
        GPRReg specifiedGPR = specified.gpr();

        m_jit.emitLoadStructure(vm(), baseGPR, otherGPR, specifiedGPR);
        m_jit.loadPtr(CCallHelpers::Address(otherGPR, Structure::classInfoOffset()), otherGPR);
        m_jit.move(CCallHelpers::TrustedImmPtr(node->classInfo()), specifiedGPR);



    speculateFunction(node->child1(), function.gpr());

    m_jit.emitLoadStructure(vm(), function.gpr(), result.gpr(), executable.gpr());
    m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::classInfoOffset()), result.gpr());
    static_assert(std::is_final_v<JSBoundFunction>, "We don't handle subclasses when comparing classInfo below");
    slowCases.append(m_jit.branchPtr(CCallHelpers::Equal, result.gpr(), TrustedImmPtr(JSBoundFunction::info())));

    if (node->child1().useKind() == CellUse || node->child1().useKind() == CellOrOtherUse) {
        JSValueOperand base(this, node->child1(), ManualOperandSpeculation);
        GPRTemporary scratch1(this);
        GPRTemporary scratch2(this);

        speculate(node, node->child1());

        JSValueRegs baseRegs = base.jsValueRegs();
        GPRReg scratch1GPR = scratch1.gpr();
        GPRReg scratch2GPR = scratch2.gpr();

        CCallHelpers::JumpList slowCases;
        CCallHelpers::JumpList doneCases;

            if (onlyStructure)
                m_jit.move(TrustedImmPtr(onlyStructure), scratch1GPR);
            else
                m_jit.emitLoadStructure(vm(), baseRegs.payloadGPR(), scratch1GPR, scratch2GPR);
            m_jit.loadPtr(CCallHelpers::Address(scratch1GPR, Structure::previousOrRareDataOffset()), scratch1GPR);
            slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, scratch1GPR));
            slowCases.append(m_jit.branchIfStructure(scratch1GPR));

        doneCases.append(m_jit.jump());

        slowCases.link(&m_jit);
        silentSpillAllRegisters(scratch1GPR, scratch2GPR);
        callOperation(operationGetPropertyEnumeratorCell, scratch1GPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs.payloadGPR());
        silentFillAllRegisters();
        m_jit.exceptionCheck();

            speculateObject(node->child1(), objectGPR);

            CCallHelpers::JumpList slowCases;
            m_jit.emitLoadStructure(vm(), objectGPR, structureGPR, scratchGPR);
            m_jit.loadPtr(CCallHelpers::Address(structureGPR, Structure::previousOrRareDataOffset()), scratchGPR);

            slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, scratchGPR));

    slowCases.append(m_jit.branchIfNotFunction(calleeGPR));
    m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfExecutableOrRareData()), rareDataGPR);
    slowCases.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR, CCallHelpers::TrustedImm32(JSFunction::rareDataTag)));
    m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructure() - JSFunction::rareDataTag), structureGPR);
    slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, structureGPR));
    m_jit.emitNonNullDecodeStructureID(structureGPR, structureGPR);
    m_jit.move(TrustedImmPtr(node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info()), scratch1GPR);
    slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));
    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), scratch1GPR);

    slowCases.append(m_jit.branchIfNotFunction(calleeGPR));
    m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfExecutableOrRareData()), rareDataGPR);
    slowCases.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR, CCallHelpers::TrustedImm32(JSFunction::rareDataTag)));
    m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructure() - JSFunction::rareDataTag), structureGPR);
    slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, structureGPR));
    m_jit.emitNonNullDecodeStructureID(structureGPR, structureGPR);
    m_jit.move(TrustedImmPtr(JSClass::info()), scratch1GPR);
    slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));
    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), scratch1GPR);

void SpeculativeJIT::compileGetPrototypeOf(Node* node)
{
    GPRTemporary temp(this);
    GPRTemporary temp2(this);

    GPRReg tempGPR = temp.gpr();
    GPRReg temp2GPR = temp2.gpr();

#if USE(JSVALUE64)
    JSValueRegs resultRegs(tempGPR);
#else
    JSValueRegs resultRegs(temp2GPR, tempGPR);
    JSValueRegs resultRegs(temp2.gpr(), tempGPR);
#endif

    switch (node->child1().useKind()) {

            break;
        }

        m_jit.emitLoadStructure(vm(), objectGPR, tempGPR, temp2GPR);

        AbstractValue& value = m_state.forNode(node->child1());
        if ((value.m_type && !(value.m_type & ~SpecObject)) && value.m_structure.isFinite()) {

        speculateObject(node->child1(), objectGPR);

        JITCompiler::JumpList slowCases;
        m_jit.emitLoadPrototype(vm(), objectGPR, resultRegs, temp2GPR, slowCases);
        addSlowPathGenerator(slowPathCall(slowCases, this, operationGetPrototypeOfObject,
            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR));


        GPRReg valueGPR = valueRegs.payloadGPR();
        slowCases.append(m_jit.branchIfNotObject(valueGPR));

        m_jit.emitLoadPrototype(vm(), valueGPR, resultRegs, temp2GPR, slowCases);
        addSlowPathGenerator(slowPathCall(slowCases, this, operationGetPrototypeOf,
            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs));


Lines 84-90 namespace JSC { namespace FTL { Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h_sec1
- Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h -1 / +3 lines
84	macro(FunctionRareData_prototype, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfileWithPrototype::offsetOfPrototype()) \	84	macro(FunctionRareData_prototype, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfileWithPrototype::offsetOfPrototype()) \
85	macro(FunctionRareData_allocationProfileWatchpointSet, FunctionRareData::offsetOfAllocationProfileWatchpointSet()) \	85	macro(FunctionRareData_allocationProfileWatchpointSet, FunctionRareData::offsetOfAllocationProfileWatchpointSet()) \
86	macro(FunctionRareData_executable, FunctionRareData::offsetOfExecutable()) \	86	macro(FunctionRareData_executable, FunctionRareData::offsetOfExecutable()) \
87	macro(FunctionRareData_internalFunctionAllocationProfile_structureID, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructureID()) \	87	macro(FunctionRareData_internalFunctionAllocationProfile_structure, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructure()) \
		88	macro(FunctionRareData_boundFunctionStructure, FunctionRareData::offsetOfBoundFunctionStructure()) \
		89	macro(FunctionRareData_allocationProfileClearingWatchpoint, FunctionRareData::offsetOfAllocationProfileClearingWatchpoint()) \
88	macro(GetterSetter_getter, GetterSetter::offsetOfGetter()) \	90	macro(GetterSetter_getter, GetterSetter::offsetOfGetter()) \
89	macro(GetterSetter_setter, GetterSetter::offsetOfSetter()) \	91	macro(GetterSetter_setter, GetterSetter::offsetOfSetter()) \
90	macro(JSArrayBufferView_length, JSArrayBufferView::offsetOfLength()) \	92	macro(JSArrayBufferView_length, JSArrayBufferView::offsetOfLength()) \




        m_out.appendTo(hasRareData, hasStructure);
        LValue rareData = m_out.sub(rareDataTags, m_out.constIntPtr(JSFunction::rareDataTag));
        LValue structure = m_out.loadPtr(rareData, m_heaps.FunctionRareData_internalFunctionAllocationProfile_structure);
        m_out.branch(m_out.isZero64(structure), rarely(slowCase), usually(hasStructure));

        m_out.appendTo(hasStructure, checkGlobalObjectCase);
        LValue structure = decodeNonNullStructure(structureID);
        m_out.branch(m_out.equal(m_out.loadPtr(structure, m_heaps.Structure_classInfo), m_out.constIntPtr(m_node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info())), usually(checkGlobalObjectCase), rarely(slowCase));

        m_out.appendTo(checkGlobalObjectCase, fastAllocationCase);


        m_out.appendTo(hasRareData, hasStructure);
        LValue rareData = m_out.sub(rareDataTags, m_out.constIntPtr(JSFunction::rareDataTag));
        LValue structure = m_out.loadPtr(rareData, m_heaps.FunctionRareData_internalFunctionAllocationProfile_structure);
        m_out.branch(m_out.isZero64(structure), rarely(slowCase), usually(hasStructure));

        m_out.appendTo(hasStructure, checkGlobalObjectCase);
        LValue structure = decodeNonNullStructure(structureID);
        m_out.branch(m_out.equal(m_out.loadPtr(structure, m_heaps.Structure_classInfo), m_out.constIntPtr(JSClass::info())), usually(checkGlobalObjectCase), rarely(slowCase));

        m_out.appendTo(checkGlobalObjectCase, fastAllocationCase);

        LValue structureID;
        auto structure = m_state.forNode(baseEdge.node()).m_structure.onlyStructure();
        if (structure)
            structureID = m_out.constInt32(structure->id());
        else
            structureID = m_out.load32(base, m_heaps.JSCell_structureID);


    
    void storeStructure(LValue object, Structure* structure)
    {
        m_out.store32(m_out.constInt32(structure->id()), object, m_heaps.JSCell_structureID);
        m_out.store32(
            m_out.constInt32(structure->objectInitializationBlob()),
            object, m_heaps.JSCell_usefulBytes);

            return proven;
        return m_out.notEqual(
            m_out.load32(cell, m_heaps.JSCell_structureID),
            m_out.constInt32(vm().stringStructure->id()));
    }
    
    LValue isString(LValue cell, SpeculatedType type = SpecFullTop)

            return proven;
        return m_out.equal(
            m_out.load32(cell, m_heaps.JSCell_structureID),
            m_out.constInt32(vm().stringStructure->id()));
    }

    LValue isRopeString(LValue string, Edge edge = Edge())

            return proven;
        return m_out.notEqual(
            m_out.load32(cell, m_heaps.JSCell_structureID),
            m_out.constInt32(vm().symbolStructure->id()));
    }
    
    LValue isSymbol(LValue cell, SpeculatedType type = SpecFullTop)

            return proven;
        return m_out.equal(
            m_out.load32(cell, m_heaps.JSCell_structureID),
            m_out.constInt32(vm().symbolStructure->id()));
    }

    LValue isNotHeapBigIntUnknownWhetherCell(LValue value, SpeculatedType type = SpecFullTop)

            return proven;
        return m_out.notEqual(
            m_out.load32(cell, m_heaps.JSCell_structureID),
            m_out.constInt32(vm().bigIntStructure->id()));
    }

    LValue isHeapBigInt(LValue cell, SpeculatedType type = SpecFullTop)

            return proven;
        return m_out.equal(
            m_out.load32(cell, m_heaps.JSCell_structureID),
            m_out.constInt32(vm().bigIntStructure->id()));
    }

    LValue isArrayTypeForArrayify(LValue cell, ArrayMode arrayMode)

            m_out.store32(
                m_out.bitOr(
                    m_out.load32(object, m_heaps.JSCell_structureID),
                    m_out.constInt32(nukedStructureIDBit())),
                object, m_heaps.JSCell_structureID);
            m_out.fence(&m_heaps.root, nullptr);
            m_out.storePtr(butterfly, object, m_heaps.JSObject_butterfly);

        m_out.store32(
            m_out.bitOr(
                m_out.load32(object, m_heaps.JSCell_structureID),
                m_out.constInt32(nukedStructureIDBit())),
            object, m_heaps.JSCell_structureID);
        m_out.fence(&m_heaps.root, nullptr);
        m_out.storePtr(butterfly, object, m_heaps.JSObject_butterfly);

        m_graph.m_plan.weakReferences().addLazily(target);
    }

    LValue decodeNonNullStructure(LValue structureID)
    {
        LValue maskedStructureID = m_out.bitAnd(structureID, m_out.constInt32(structureIDMask));
        return m_out.add(m_out.constIntPtr(g_jscConfig.startOfStructureHeap), m_out.zeroExtPtr(maskedStructureID));
    }

    LValue loadStructure(LValue value)
    {
        LValue structureID = m_out.load32(value, m_heaps.JSCell_structureID);
        LValue tableBase = m_out.loadPtr(m_out.absolute(vm().heap.structureIDTable().base()));
        LValue tableIndex = m_out.aShr(structureID, m_out.constInt32(StructureIDTable::s_numberOfEntropyBits));
        LValue entropyBits = m_out.shl(m_out.zeroExtPtr(structureID), m_out.constInt32(StructureIDTable::s_entropyBitsShiftForStructurePointer));
        TypedPointer address = m_out.baseIndex(m_heaps.structureTable, tableBase, m_out.zeroExtPtr(tableIndex));
        LValue encodedStructureBits = m_out.loadPtr(address);
        return m_out.bitXor(encodedStructureBits, entropyBits);
    }

    LValue weakPointer(JSCell* pointer)


    LValue weakStructureID(RegisteredStructure structure)
    {
        return m_out.constInt32(structure->id());
    }
    
    LValue weakStructure(RegisteredStructure structure)



class VerifierSlotVisitor;
template<typename T> class Weak;
template<typename T, typename Traits> class WriteBarrierBase;
class WriteBarrierStructureID;

class AbstractSlotVisitor {
    WTF_MAKE_NONCOPYABLE(AbstractSlotVisitor);


    template<typename T, typename Traits> void append(const WriteBarrierBase<T, Traits>&);
    template<typename T, typename Traits> void appendHidden(const WriteBarrierBase<T, Traits>&);
    void append(const WriteBarrierStructureID&);
    void appendHidden(const WriteBarrierStructureID&);
    template<typename Iterator> void append(Iterator begin , Iterator end);
    ALWAYS_INLINE void appendValues(const WriteBarrierBase<Unknown, RawValueTraits<Unknown>>*, size_t count);
    ALWAYS_INLINE void appendValuesHidden(const WriteBarrierBase<Unknown, RawValueTraits<Unknown>>*, size_t count);



    appendHiddenUnbarriered(slot.get());
}

ALWAYS_INLINE void AbstractSlotVisitor::append(const WriteBarrierStructureID& slot)
{
    appendUnbarriered(reinterpret_cast<JSCell*>(slot.get()));
}

ALWAYS_INLINE void AbstractSlotVisitor::appendHidden(const WriteBarrierStructureID& slot)
{
    appendHiddenUnbarriered(reinterpret_cast<JSCell*>(slot.get()));
}

ALWAYS_INLINE void AbstractSlotVisitor::appendHiddenUnbarriered(JSValue value)
{
    if (value.isCell())



#include "SpaceTimeMutatorScheduler.h"
#include "StochasticSpaceTimeMutatorScheduler.h"
#include "StopIfNecessaryTimer.h"
#include "StructureAlignedMemoryAllocator.h"
#include "SubspaceInlines.h"
#include "SuperSampler.h"
#include "SweepingScope.h"

    , stringObjectSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, StringObject)
    , structureChainSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, StructureChain)
    , structureRareDataSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, StructureRareData) // Hash:0xaca4e62d
    , structureSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, Structure)
    , brandedStructureSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, BrandedStructure)
    , symbolTableSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, SymbolTable) // Hash:0xc5215afd
    , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
    , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)

        if (vm().typeProfiler())
            vm().typeProfiler()->invalidateTypeSetCache(vm());

        m_structureIDTable.flushOldTables();

        reapWeakHandles();
        pruneStaleEntriesFromWeakGCHashTables();
        sweepArrayBuffers();

Lines 43-49 Source/JavaScriptCore/heap/Heap.h_sec1
- Source/JavaScriptCore/heap/Heap.h -1 / +4 lines
43	#include "MarkedSpace.h"	43	#include "MarkedSpace.h"
44	#include "MutatorState.h"	44	#include "MutatorState.h"
45	#include "Options.h"	45	#include "Options.h"
46	#include "StructureID.h"	46	#include "StructureIDTable.h"
47	#include "Synchronousness.h"	47	#include "Synchronousness.h"
48	#include "WeakHandleOwner.h"	48	#include "WeakHandleOwner.h"
49	#include <wtf/AutomaticThread.h>	49	#include <wtf/AutomaticThread.h>
Lines 275-280 public: Source/JavaScriptCore/heap/Heap.h_sec2
275		275
276	bool isDeferred() const { return !!m_deferralDepth; }	276	bool isDeferred() const { return !!m_deferralDepth; }
277		277
		278	StructureIDTable& structureIDTable() { return m_structureIDTable; }
		279
278	CodeBlockSet& codeBlockSet() { return *m_codeBlocks; }	280	CodeBlockSet& codeBlockSet() { return *m_codeBlocks; }
279		281
280	#if USE(FOUNDATION)	282	#if USE(FOUNDATION)
Lines 594-599 private: Source/JavaScriptCore/heap/Heap.h_sec3
594	Markable<CollectionScope, EnumMarkableTraits<CollectionScope>> m_lastCollectionScope;	596	Markable<CollectionScope, EnumMarkableTraits<CollectionScope>> m_lastCollectionScope;
595	Lock m_raceMarkStackLock;	597	Lock m_raceMarkStackLock;
596		598
		599	StructureIDTable m_structureIDTable;
597	MarkedSpace m_objectSpace;	600	MarkedSpace m_objectSpace;
598	GCIncomingRefCountedSet<ArrayBuffer> m_arrayBuffers;	601	GCIncomingRefCountedSet<ArrayBuffer> m_arrayBuffers;
599	size_t m_extraMemorySize { 0 };	602	size_t m_extraMemorySize { 0 };



namespace JSC {

IsoAlignedMemoryAllocator::IsoAlignedMemoryAllocator(CString name)
#if ENABLE(MALLOC_HEAP_BREAKDOWN)
    : m_debugHeap(name.data())
#endif
{
    UNUSED_PARAM(name);
}

IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator()
{
#if !ENABLE(MALLOC_HEAP_BREAKDOWN)
    for (unsigned i = 0; i < m_blocks.size(); ++i) {
        void* block = m_blocks[i];
        if (!m_committed.quickGet(i))
            WTF::fastCommitAlignedMemory(block, MarkedBlock::blockSize);
        fastAlignedFree(block);
    }
#endif
}

void* IsoAlignedMemoryAllocator::tryAllocateAlignedMemory(size_t alignment, size_t size)
{
    // Since this is designed specially for IsoSubspace, we know that we will only be asked to
    // allocate MarkedBlocks.
    RELEASE_ASSERT(alignment == MarkedBlock::blockSize);
    RELEASE_ASSERT(size == MarkedBlock::blockSize);

#if ENABLE(MALLOC_HEAP_BREAKDOWN)
    return m_debugHeap.memalign(MarkedBlock::blockSize, MarkedBlock::blockSize, true);
#else
    Locker locker { m_lock };
    
    m_firstUncommitted = m_committed.findBit(m_firstUncommitted, false);
    if (m_firstUncommitted < m_blocks.size()) {
        m_committed.quickSet(m_firstUncommitted);
        void* result = m_blocks[m_firstUncommitted];
        WTF::fastCommitAlignedMemory(result, MarkedBlock::blockSize);
        return result;
    }
    
    void* result = tryFastAlignedMalloc(MarkedBlock::blockSize, MarkedBlock::blockSize);
    if (!result)
        return nullptr;
    unsigned index = m_blocks.size();
    m_blocks.append(result);
    m_blockIndices.add(result, index);
    if (m_blocks.capacity() != m_committed.size())
        m_committed.resize(m_blocks.capacity());
    m_committed.quickSet(index);
    return result;
#endif
}

void IsoAlignedMemoryAllocator::freeAlignedMemory(void* basePtr)
{
#if ENABLE(MALLOC_HEAP_BREAKDOWN)
    m_debugHeap.free(basePtr);
#else
    Locker locker { m_lock };
    
    auto iter = m_blockIndices.find(basePtr);
    RELEASE_ASSERT(iter != m_blockIndices.end());
    unsigned index = iter->value;
    m_committed.quickClear(index);
    m_firstUncommitted = std::min(index, m_firstUncommitted);
    WTF::fastDecommitAlignedMemory(basePtr, MarkedBlock::blockSize);
#endif
}

void IsoAlignedMemoryAllocator::dump(PrintStream& out) const

    RELEASE_ASSERT_NOT_REACHED();
}

void* IsoAlignedMemoryAllocator::tryMallocBlock()
{
    return tryFastAlignedMalloc(MarkedBlock::blockSize, MarkedBlock::blockSize);
}

void IsoAlignedMemoryAllocator::freeBlock(void* block)
{
    fastAlignedFree(block);
}

void IsoAlignedMemoryAllocator::commitBlock(void* block)
{
    WTF::fastCommitAlignedMemory(block, MarkedBlock::blockSize);
}

void IsoAlignedMemoryAllocator::decommitBlock(void* block)
{
    WTF::fastDecommitAlignedMemory(block, MarkedBlock::blockSize);
}

} // namespace JSC





#pragma once

#include "AlignedMemoryAllocator.h"
#include <wtf/BitVector.h>
#include <wtf/DebugHeap.h>
#include <wtf/HashMap.h>


namespace JSC {

class IsoAlignedMemoryAllocator final : public AlignedMemoryAllocator {
public:
    using Base = IsoMemoryAllocatorBase;

    IsoAlignedMemoryAllocator(CString);
    ~IsoAlignedMemoryAllocator() final;

    void* tryAllocateAlignedMemory(size_t alignment, size_t size) final;
    void freeAlignedMemory(void*) final;

    void dump(PrintStream&) const final;

    void* tryAllocateMemory(size_t) final;
    void freeMemory(void*) final;
    void* tryReallocateMemory(void*, size_t) final;

private:
#if ENABLE(MALLOC_HEAP_BREAKDOWN)
    // If breakdown is enabled, we do not ensure Iso-feature. This is totally OK since breakdown is memory bloat debugging feature.
    WTF::DebugHeap m_debugHeap;
#else
    Vector<void*> m_blocks;
    HashMap<void*, unsigned> m_blockIndices;
    BitVector m_committed;
    unsigned m_firstUncommitted { 0 };
    Lock m_lock;
#endif
};

} // namespace JSC



/*
 * Copyright (C) 2017-2021 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "IsoMemoryAllocatorBase.h"

#include "MarkedBlock.h"

namespace JSC {

IsoMemoryAllocatorBase::IsoMemoryAllocatorBase(CString name)
#if ENABLE(MALLOC_HEAP_BREAKDOWN)
    : m_debugHeap(name.data())
#endif
{
    UNUSED_PARAM(name);
}

IsoMemoryAllocatorBase::~IsoMemoryAllocatorBase()
{
}

// We need to call this from the derived class's destructor because it's undefined behavior to call pure virtual methods from within a destructor.
void IsoMemoryAllocatorBase::releaseMemoryFromSubclassDestructor()
{
#if !ENABLE(MALLOC_HEAP_BREAKDOWN)
    for (unsigned i = 0; i < m_blocks.size(); ++i) {
        void* block = m_blocks[i];
        if (!m_committed.quickGet(i))
            commitBlock(block);
        freeBlock(block);
    }
#endif
}

void* IsoMemoryAllocatorBase::tryAllocateAlignedMemory(size_t alignment, size_t size)
{
    // Since this is designed specially for IsoSubspace, we know that we will only be asked to
    // allocate MarkedBlocks.
    RELEASE_ASSERT(alignment == MarkedBlock::blockSize);
    RELEASE_ASSERT(size == MarkedBlock::blockSize);

#if ENABLE(MALLOC_HEAP_BREAKDOWN)
    return m_debugHeap.memalign(MarkedBlock::blockSize, MarkedBlock::blockSize, true);
#else
    Locker locker { m_lock };
    
    m_firstUncommitted = m_committed.findBit(m_firstUncommitted, false);
    if (m_firstUncommitted < m_blocks.size()) {
        m_committed.quickSet(m_firstUncommitted);
        void* result = m_blocks[m_firstUncommitted];
        commitBlock(result);
        return result;
    }
    
    void* result = tryMallocBlock();
    if (!result)
        return nullptr;
    unsigned index = m_blocks.size();
    m_blocks.append(result);
    m_blockIndices.add(result, index);
    if (m_blocks.capacity() != m_committed.size())
        m_committed.resize(m_blocks.capacity());
    m_committed.quickSet(index);
    return result;
#endif
}

void IsoMemoryAllocatorBase::freeAlignedMemory(void* basePtr)
{
#if ENABLE(MALLOC_HEAP_BREAKDOWN)
    m_debugHeap.free(basePtr);
#else
    Locker locker { m_lock };
    
    auto iter = m_blockIndices.find(basePtr);
    RELEASE_ASSERT(iter != m_blockIndices.end());
    unsigned index = iter->value;
    m_committed.quickClear(index);
    m_firstUncommitted = std::min(index, m_firstUncommitted);
    decommitBlock(basePtr);
#endif
}

} // namespace JSC




/*
 * Copyright (C) 2017-2021 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#pragma once

#include "AlignedMemoryAllocator.h"
#include <wtf/BitVector.h>
#include <wtf/DebugHeap.h>
#include <wtf/HashMap.h>
#include <wtf/Vector.h>


namespace JSC {

class IsoMemoryAllocatorBase : public AlignedMemoryAllocator {
public:
    IsoMemoryAllocatorBase(CString);
    ~IsoMemoryAllocatorBase() override;

    void* tryAllocateAlignedMemory(size_t alignment, size_t size) final;
    void freeAlignedMemory(void*) final;

protected:
    void releaseMemoryFromSubclassDestructor();
    virtual void* tryMallocBlock() = 0;
    virtual void freeBlock(void* block) = 0;
    virtual void commitBlock(void* block) = 0;
    virtual void decommitBlock(void* block) = 0;

#if ENABLE(MALLOC_HEAP_BREAKDOWN)
protected:
    // If breakdown is enabled, we do not ensure Iso-feature. This is totally OK since breakdown is memory bloat debugging feature.
    WTF::DebugHeap m_debugHeap;
#else
private:
    Vector<void*> m_blocks;
    HashMap<void*, unsigned> m_blockIndices;
    BitVector m_committed;
    unsigned m_firstUncommitted { 0 };
    Lock m_lock;
#endif
};

} // namespace JSC





namespace JSC {

IsoSubspace::IsoSubspace(CString name, Heap& heap, const HeapCellType& heapCellType, size_t size, uint8_t numberOfLowerTierCells)
    : Subspace(name, heap)
    , m_directory(WTF::roundUpToMultipleOf<MarkedBlock::atomSize>(size))
    , m_localAllocator(&m_directory)
    , m_isoAlignedMemoryAllocator(makeUnique<IsoAlignedMemoryAllocator>(name))
{
    m_remainingLowerTierCellCount = numberOfLowerTierCells;
    ASSERT(WTF::roundUpToMultipleOf<MarkedBlock::atomSize>(size) == cellSize());

        return revive(allocation);
    }
    if (m_remainingLowerTierCellCount) {
        PreciseAllocation* allocation = PreciseAllocation::createForLowerTier(m_space.heap(), cellSize(), this, --m_remainingLowerTierCellCount);
        return revive(allocation);
            return revive(allocation);
    }
    return nullptr;
}



#pragma once

#include "BlockDirectory.h"
#include "IsoMemoryAllocatorBase.h"
#include "Subspace.h"
#include "SubspaceAccess.h"
#include <wtf/SinglyLinkedListWithTail.h>

namespace JSC {

class IsoAlignedMemoryAllocator;
class IsoCellSet;

class IsoSubspace : public Subspace {
public:
    JS_EXPORT_PRIVATE IsoSubspace(CString name, Heap&, const HeapCellType&, size_t, uint8_t numberOfLowerTierCells);
    JS_EXPORT_PRIVATE ~IsoSubspace() override;

    size_t cellSize() { return m_directory.cellSize(); }

    
    BlockDirectory m_directory;
    LocalAllocator m_localAllocator;
    std::unique_ptr<IsoAlignedMemoryAllocator> m_isoAlignedMemoryAllocator;
    SentinelLinkedList<PreciseAllocation, PackedRawSentinelNode<PreciseAllocation>> m_lowerTierFreeList;
    SentinelLinkedList<IsoCellSet, PackedRawSentinelNode<IsoCellSet>> m_cellSets;
};

Lines 120-126 PreciseAllocation* PreciseAllocation::tr Source/JavaScriptCore/heap/PreciseAllocation.cpp_sec1
- Source/JavaScriptCore/heap/PreciseAllocation.cpp -1 / +1 lines
120	}	120	}
121		121
122		122
123	PreciseAllocation* PreciseAllocation::tryCreateForLowerTier(Heap& heap, size_t size, Subspace* subspace, uint8_t lowerTierIndex)	123	PreciseAllocation* PreciseAllocation::createForLowerTier(Heap& heap, size_t size, Subspace* subspace, uint8_t lowerTierIndex)
124	{	124	{
125	if constexpr (validateDFGDoesGC)	125	if constexpr (validateDFGDoesGC)
126	heap.vm().verifyCanGC();	126	heap.vm().verifyCanGC();

Lines 45-51 public: Source/JavaScriptCore/heap/PreciseAllocation.h_sec1
- Source/JavaScriptCore/heap/PreciseAllocation.h -1 / +1 lines
45		45
46	static PreciseAllocation* tryCreate(Heap&, size_t, Subspace*, unsigned indexInSpace);	46	static PreciseAllocation* tryCreate(Heap&, size_t, Subspace*, unsigned indexInSpace);
47		47
48	static PreciseAllocation* tryCreateForLowerTier(Heap&, size_t, Subspace*, uint8_t lowerTierIndex);	48	static PreciseAllocation* createForLowerTier(Heap&, size_t, Subspace*, uint8_t lowerTierIndex);
49	PreciseAllocation* reuseForLowerTier();	49	PreciseAllocation* reuseForLowerTier();
50		50
51	PreciseAllocation* tryReallocate(size_t, Subspace*);	51	PreciseAllocation* tryReallocate(size_t, Subspace*);



                    out.print("GC type: ", heap()->collectionScope(), "\n");
                    out.print("Object at: ", RawPointer(jsCell), "\n");
#if USE(JSVALUE64)
                    out.print("Structure ID: ", structureID, " (0x", format("%x", structureID), ")\n");
                    out.print("Structure ID table size: ", heap()->structureIDTable().size(), "\n");
#else
                    out.print("Structure: ", RawPointer(structureID), "\n");
#endif
                    out.print("Object contents:");
                    for (unsigned i = 0; i < 2; ++i)

            die("GC scan found corrupt object: structureID is zero!\n");
        
        // It's not OK for the structure to be nuked at any GC scan point.
        if (isNuked(structureID))
            die("GC scan found object in bad state: structureID is nuked!\n");
        
        // This detects the worst of the badness.
        Integrity::auditStructureID(heap()->structureIDTable(), structureID);
    };
    
    // In debug mode, we validate before marking since this makes it clearer what the problem
    // was. It's also slower, so we don't do it normally.
    if (ASSERT_ENABLED && isJSCellKind(heapCell->cellKind()))




    template<typename T, typename Traits> void append(const WriteBarrierBase<T, Traits>&);
    template<typename T, typename Traits> void appendHidden(const WriteBarrierBase<T, Traits>&);
    void append(const WriteBarrierStructureID&);
    void appendHidden(const WriteBarrierStructureID&);
    template<typename Iterator> void append(Iterator begin , Iterator end);
    ALWAYS_INLINE void appendValues(const WriteBarrierBase<Unknown, RawValueTraits<Unknown>>*, size_t count);
    ALWAYS_INLINE void appendValuesHidden(const WriteBarrierBase<Unknown, RawValueTraits<Unknown>>*, size_t count);



    appendHiddenUnbarriered(slot.get());
}

ALWAYS_INLINE void SlotVisitor::append(const WriteBarrierStructureID& slot)
{
    appendUnbarriered(reinterpret_cast<JSCell*>(slot.get()));
}

ALWAYS_INLINE void SlotVisitor::appendHidden(const WriteBarrierStructureID& slot)
{
    appendHiddenUnbarriered(reinterpret_cast<JSCell*>(slot.get()));
}

template<typename Iterator>
ALWAYS_INLINE void SlotVisitor::append(Iterator begin, Iterator end)
{



/*
 * Copyright (C) 2017-2021 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "StructureAlignedMemoryAllocator.h"

#include "JSCConfig.h"
#include "MarkedBlock.h"

#include <wtf/OSAllocator.h>

namespace JSC {

StructureAlignedMemoryAllocator::StructureAlignedMemoryAllocator(CString name)
    : Base(name)
{
}

StructureAlignedMemoryAllocator::~StructureAlignedMemoryAllocator()
{
    releaseMemoryFromSubclassDestructor();
}

void StructureAlignedMemoryAllocator::dump(PrintStream& out) const
{
    out.print("Structure(", RawPointer(this), ")");
}

void* StructureAlignedMemoryAllocator::tryAllocateMemory(size_t)
{
    return nullptr;
}

void StructureAlignedMemoryAllocator::freeMemory(void*)
{
    // Structures do not support Precise allocations right now.
    RELEASE_ASSERT_NOT_REACHED();
}

void* StructureAlignedMemoryAllocator::tryReallocateMemory(void*, size_t)
{
    // Structures do not support Precise allocations right now.
    RELEASE_ASSERT_NOT_REACHED();
}

#if CPU(ADDRESS64)

class StructureMemoryManager {
public:
    StructureMemoryManager()
    {
        // Don't use the first page because zero is used as the empty StructureID and the first allocation will conflict.
        m_usedBlocks.set(0);
    }

    void* tryMallocStructureBlock()
    {
        size_t freeIndex;
        {
            Locker locker(m_lock);
            constexpr size_t startIndex = 0;
            freeIndex = m_usedBlocks.findBit(startIndex, 0);
            ASSERT(freeIndex <= m_usedBlocks.bitCount());
            if (freeIndex * MarkedBlock::blockSize >= structureHeapAddressSize)
                return nullptr;
            m_usedBlocks.set(freeIndex);
        }

        MarkedBlock* block = reinterpret_cast<MarkedBlock*>(g_jscConfig.startOfStructureHeap) + freeIndex * MarkedBlock::blockSize;
        constexpr bool writable = true;
        constexpr bool executable = false;
        OSAllocator::commit(block, MarkedBlock::blockSize, writable, executable);
        return block;
    }

    void freeStructureBlock(void* blockPtr)
    {
        OSAllocator::decommit(blockPtr, MarkedBlock::blockSize);
        uintptr_t block = reinterpret_cast<uintptr_t>(blockPtr);
        RELEASE_ASSERT(g_jscConfig.startOfStructureHeap <= block && block < g_jscConfig.startOfStructureHeap + structureHeapAddressSize);
        RELEASE_ASSERT(roundUpToMultipleOf<MarkedBlock::blockSize>(block) == block);

        Locker locker(m_lock);
        m_usedBlocks.quickClear((block - g_jscConfig.startOfStructureHeap) / MarkedBlock::blockSize);
    }

private:
    Lock m_lock;
    BitVector m_usedBlocks;
};

static LazyNeverDestroyed<StructureMemoryManager> s_structureMemoryManager;

void StructureAlignedMemoryAllocator::initializeStructureAddressSpace()
{
    static_assert(hasOneBitSet(structureHeapAddressSize));

    g_jscConfig.startOfStructureHeap = reinterpret_cast<uintptr_t>(OSAllocator::reserveUncommittedAligned(structureHeapAddressSize, OSAllocator::FastMallocPages));
    s_structureMemoryManager.construct();

    ASSERT((g_jscConfig.startOfStructureHeap & ~structureIDMask) == g_jscConfig.startOfStructureHeap);
}

void* StructureAlignedMemoryAllocator::tryMallocBlock()
{
    return s_structureMemoryManager->tryMallocStructureBlock();
}

void StructureAlignedMemoryAllocator::freeBlock(void* block)
{
    s_structureMemoryManager->freeStructureBlock(block);
}

void StructureAlignedMemoryAllocator::commitBlock(void* block)
{
    constexpr bool writable = true;
    constexpr bool executable = false;
    OSAllocator::commit(block, MarkedBlock::blockSize, writable, executable);
}

void StructureAlignedMemoryAllocator::decommitBlock(void* block)
{
    OSAllocator::decommit(block, MarkedBlock::blockSize);
}

#else // not CPU(ADDRESS64)

// FIXME: This is the same as IsoAlignedMemoryAllocator maybe we should just use that for 32-bit.

void StructureAlignedMemoryAllocator::initializeStructureAddressSpace()
{
    g_jscConfig.startOfStructureHeap = 0;
}

void* StructureAlignedMemoryAllocator::tryMallocBlock()
{
    return tryFastAlignedMalloc(MarkedBlock::blockSize, MarkedBlock::blockSize);
}

void StructureAlignedMemoryAllocator::freeBlock(void* block)
{
    fastAlignedFree(block);
}

void StructureAlignedMemoryAllocator::commitBlock(void* block)
{
    WTF::fastCommitAlignedMemory(block, MarkedBlock::blockSize);
}

void StructureAlignedMemoryAllocator::decommitBlock(void* block)
{
    WTF::fastDecommitAlignedMemory(block, MarkedBlock::blockSize);
}

#endif // CPU(ADDRESS64)

} // namespace JSC




/*
 * Copyright (C) 2021 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#pragma once

#include "IsoMemoryAllocatorBase.h"
#include <wtf/Gigacage.h>

#if ENABLE(MALLOC_HEAP_BREAKDOWN)
#include <wtf/DebugHeap.h>
#endif

namespace JSC {

class StructureAlignedMemoryAllocator final : public IsoMemoryAllocatorBase {
public:
    using Base = IsoMemoryAllocatorBase;

    StructureAlignedMemoryAllocator(CString);
    ~StructureAlignedMemoryAllocator() final;
    
    void dump(PrintStream&) const final;

    void* tryAllocateMemory(size_t) final;
    void freeMemory(void*) final;
    void* tryReallocateMemory(void*, size_t) final;

    static void initializeStructureAddressSpace();

protected:
    void* tryMallocBlock() final;
    void freeBlock(void* block) final;
    void commitBlock(void* block) final;
    void decommitBlock(void* block) final;
};

} // namespace JSC




#if USE(JSVALUE64)
    jit.store64(TrustedImm64(structurePtr->idBlob()), MacroAssembler::Address(dest, JSCell::structureIDOffset()));
    if (ASSERT_ENABLED) {
        Jump correctStructure = jit.branch32(Equal, MacroAssembler::Address(dest, JSCell::structureIDOffset()), TrustedImm32(structurePtr->id()));
        jit.abortWithReason(AHStructureIDIsValid);
        correctStructure.link(&jit);


        BaseIndex(scratch, offset, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)));
}

void AssemblyHelpers::emitLoadStructure(VM& vm, RegisterID source, RegisterID dest, RegisterID scratch)
{
#if USE(JSVALUE64)
#if CPU(ARM64)
    RegisterID scratch2 = dataTempRegister;
#elif CPU(X86_64)
    RegisterID scratch2 = scratchRegister();
#else
#error "Unsupported cpu"
#endif

    ASSERT(dest != scratch);
    ASSERT(dest != scratch2);
    ASSERT(scratch != scratch2);

    load32(MacroAssembler::Address(source, JSCell::structureIDOffset()), scratch2);
    loadPtr(vm.heap.structureIDTable().base(), scratch);
    rshift32(scratch2, TrustedImm32(StructureIDTable::s_numberOfEntropyBits), dest);
    loadPtr(MacroAssembler::BaseIndex(scratch, dest, MacroAssembler::ScalePtr), dest);
    lshiftPtr(TrustedImm32(StructureIDTable::s_entropyBitsShiftForStructurePointer), scratch2);
    xorPtr(scratch2, dest);
#else // not USE(JSVALUE64)
    UNUSED_PARAM(scratch);
    UNUSED_PARAM(vm);
    loadPtr(MacroAssembler::Address(source, JSCell::structureIDOffset()), dest);
#endif // not USE(JSVALUE64)
}

void AssemblyHelpers::emitLoadPrototype(VM& vm, GPRReg objectGPR, JSValueRegs resultRegs, GPRReg scratchGPR, JumpList& slowPath)
{
    ASSERT(resultRegs.payloadGPR() != objectGPR);
    ASSERT(resultRegs.payloadGPR() != scratchGPR);
    ASSERT(objectGPR != scratchGPR);

    emitLoadStructure(vm, objectGPR, resultRegs.payloadGPR(), scratchGPR);

    load16(MacroAssembler::Address(resultRegs.payloadGPR(), Structure::outOfLineTypeFlagsOffset()), scratchGPR);
    auto overridesGetPrototype = branchTest32(MacroAssembler::NonZero, scratchGPR, TrustedImm32(OverridesGetPrototypeOutOfLine));
    slowPath.append(overridesGetPrototype);

    loadValue(MacroAssembler::Address(resultRegs.payloadGPR(), Structure::prototypeOffset()), resultRegs);

void AssemblyHelpers::emitRandomThunk(VM& vm, GPRReg scratch0, GPRReg scratch1, GPRReg scratch2, GPRReg scratch3, FPRReg result)
{
    emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, scratch3);
    emitLoadStructure(vm, scratch3, scratch3, scratch0);
    loadPtr(Address(scratch3, Structure::globalObjectOffset()), scratch3);
    // Now, scratch3 holds JSGlobalObject*.


        ASSERT(scratchIfShouldCheckMasqueradesAsUndefined != InvalidGPRReg);
        JumpList isNotMasqueradesAsUndefined;
        isNotMasqueradesAsUndefined.append(branchTest8(Zero, Address(value.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)));
        emitLoadStructure(vm, value.payloadGPR(), result, scratchIfShouldCheckMasqueradesAsUndefined);
        move(TrustedImmPtr(globalObject), scratchIfShouldCheckMasqueradesAsUndefined);
        isNotMasqueradesAsUndefined.append(branchPtr(NotEqual, Address(result, Structure::globalObjectOffset()), scratchIfShouldCheckMasqueradesAsUndefined));


        ASSERT(scratchIfShouldCheckMasqueradesAsUndefined != InvalidGPRReg);
        JumpList isNotMasqueradesAsUndefined;
        isNotMasqueradesAsUndefined.append(branchTest8(Zero, Address(value.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)));
        emitLoadStructure(vm, value.payloadGPR(), scratch, scratchIfShouldCheckMasqueradesAsUndefined);
        if (std::holds_alternative<JSGlobalObject*>(globalObject))
            move(TrustedImmPtr(std::get<JSGlobalObject*>(globalObject)), scratchIfShouldCheckMasqueradesAsUndefined);
        else



    Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)
    {
#if USE(JSVALUE64)
        return branch32(condition, leftHandSide, TrustedImm32(structure->id()));
#else
        return branchPtr(condition, leftHandSide, TrustedImmPtr(structure));
#endif

        return argumentCount(codeOrigin.inlineCallFrame());
    }
    
    void emitLoadStructure(VM&, RegisterID source, RegisterID dest, RegisterID scratch);
    void emitLoadPrototype(VM&, GPRReg objectGPR, JSValueRegs resultRegs, GPRReg scratchGPR, JumpList& slowPath);
    void emitLoadPrototype(VM&, GPRReg objectGPR, JSValueRegs resultRegs, JumpList& slowPath);

    void emitStoreStructureWithTypeInfo(TrustedImmPtr structure, RegisterID dest, RegisterID)
    {

    void nukeStructureAndStoreButterfly(VM& vm, GPRReg butterfly, GPRReg object)
    {
        if (isX86()) {
            or32(TrustedImm32(bitwise_cast<int32_t>(nukedStructureIDBit())), Address(object, JSCell::structureIDOffset()));
            storePtr(butterfly, Address(object, JSObject::butterflyOffset()));
            return;
        }

        Jump ok = jumpIfMutatorFenceNotNeeded(vm);
        or32(TrustedImm32(bitwise_cast<int32_t>(nukedStructureIDBit())), Address(object, JSCell::structureIDOffset()));
        storeFence();
        storePtr(butterfly, Address(object, JSObject::butterflyOffset()));
        storeFence();

Lines 99-105 unsigned PolymorphicAccessJITStubRoutine Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp_sec1
- Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp -1 / +1 lines
99	for (auto& key : cases)	99	for (auto& key : cases)
100	WTF::add(hasher, key->hash());	100	WTF::add(hasher, key->hash());
101	for (auto& structureID : weakStructures)	101	for (auto& structureID : weakStructures)
102	WTF::add(hasher, structureID.bits());	102	WTF::add(hasher, structureID);
103	return hasher.hash();	103	return hasher.hash();
104	}	104	}
105		105



static void generateGetByIdInlineAccess(JIT& jit, GPRReg stubInfoGPR, JSValueRegs baseJSR, GPRReg scratchGPR, JSValueRegs resultJSR)
{
    jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);
    auto doInlineAccess = jit.branch32(CCallHelpers::Equal, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructure()));
    jit.farJump(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfCodePtr()), JITStubRoutinePtrTag);
    doInlineAccess.link(&jit);
    jit.load32(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfByIdSelfOffset()), scratchGPR);

    using BaselinePutByIdRegisters::scratch2GPR;

    jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);
    auto doInlineAccess = jit.branch32(CCallHelpers::Equal, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructure()));
    jit.farJump(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfCodePtr()), JITStubRoutinePtrTag);
    doInlineAccess.link(&jit);
    jit.load32(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfByIdSelfOffset()), scratchGPR);

    CCallHelpers::JumpList done;

    jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);
    auto skipInlineAccess = jit.branch32(CCallHelpers::NotEqual, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructure()));
    jit.boxBoolean(true, resultJSR);
    auto finished = jit.jump();




    Jump notMasqueradesAsUndefined = jump();

    isMasqueradesAsUndefined.link(this);
    emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT1, regT2);
    loadGlobalObject(regT0);
    loadPtr(Address(regT1, Structure::globalObjectOffset()), regT1);
    comparePtr(Equal, regT0, regT1, regT0);


    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
    Jump isNotMasqueradesAsUndefined = branchTest8(Zero, Address(jsRegT10.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
    emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2, regT1);
    loadGlobalObject(regT0);
    addJump(branchPtr(Equal, Address(regT2, Structure::globalObjectOffset()), regT0), target);
    Jump masqueradesGlobalObjectIsForeign = jump();


    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
    addJump(branchTest8(Zero, Address(jsRegT10.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
    emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2, regT1);
    loadGlobalObject(regT0);
    addJump(branchPtr(NotEqual, Address(regT2, Structure::globalObjectOffset()), regT0), target);
    Jump wasNotImmediate = jump();

    Jump wasNotMasqueradesAsUndefined = jump();

    isMasqueradesAsUndefined.link(this);
    emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2, regT1);
    loadGlobalObject(regT0);
    loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);
    comparePtr(Equal, regT0, regT2, regT0);

    Jump wasNotMasqueradesAsUndefined = jump();

    isMasqueradesAsUndefined.link(this);
    emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2, regT1);
    loadGlobalObject(regT0);
    loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);
    comparePtr(NotEqual, regT0, regT2, regT0);

    slowCases.append(branchIfNotCell(jsRegT10));
    slowCases.append(branchIfNotObject(jsRegT10.payloadGPR()));

    emitLoadPrototype(vm(), jsRegT10.payloadGPR(), jsRegT32, regT4, slowCases);
    addSlowCase(slowCases);

    emitValueProfilingSite(bytecode, jsRegT32);

Lines 2731-2737 void JIT::emit_op_get_property_enumerato Source/JavaScriptCore/jit/JITPropertyAccess.cpp_sec1
- Source/JavaScriptCore/jit/JITPropertyAccess.cpp -1 / +1 lines
2731	and32(TrustedImm32(IndexingTypeMask), regT1);	2731	and32(TrustedImm32(IndexingTypeMask), regT1);
2732	genericCases.append(branch32(Above, regT1, TrustedImm32(ArrayWithUndecided)));	2732	genericCases.append(branch32(Above, regT1, TrustedImm32(ArrayWithUndecided)));
2733		2733
2734	emitLoadStructure(vm(), regT0, regT1);	2734	emitLoadStructure(vm(), regT0, regT1, regT2);
2735	loadPtr(Address(regT1, Structure::previousOrRareDataOffset()), regT1);	2735	loadPtr(Address(regT1, Structure::previousOrRareDataOffset()), regT1);
2736	genericCases.append(branchTestPtr(Zero, regT1));	2736	genericCases.append(branchTestPtr(Zero, regT1));
2737	genericCases.append(branchIfStructure(regT1));	2737	genericCases.append(branchIfStructure(regT1));




#include "ExecutableAllocator.h"
#include "MacroAssemblerCodeRef.h"
#include "StructureID.h"

namespace JSC {

class JITStubRoutineSet;
class VM;

#if USE(JSVALUE64)
using StructureID = uint32_t;
#else
using StructureID = Structure*;
#endif

class AccessCase;

// This is a base-class for JIT stub routines, and also the class you want



        {
            StructureID oldStructureID = metadata.m_structureID;
            if (oldStructureID) {
                Structure* a = vm.heap.structureIDTable().get(oldStructureID);
                Structure* b = baseValue.asCell()->structure(vm);

                if (Structure::shouldConvertToPolyProto(a, b)) {

        Structure* structure = baseCell->structure(vm);
        if (slot.isValue() && slot.slotBase() == baseValue) {
            // Start out by clearing out the old cache.
            metadata.m_structureID = 0;
            metadata.m_offset = 0;

            if (structure->propertyAccessesAreCacheable() && !structure->needImpurePropertyWatchpoint()) {

        {
            StructureID oldStructureID = metadata.m_structureID;
            if (oldStructureID) {
                Structure* a = vm.heap.structureIDTable().get(oldStructureID);
                Structure* b = baseValue.asCell()->structure(vm);

                if (Structure::shouldConvertToPolyProto(a, b)) {

        Structure* structure = baseCell->structure(vm);
        if (slot.isValue()) {
            // Start out by clearing out the old cache.
            metadata.m_structureID = 0;
            metadata.m_offset = 0;

            if (structure->propertyAccessesAreCacheable() && !structure->needImpurePropertyWatchpoint()) {

                oldStructureID = metadata.protoLoadMode.structureID;
                break;
            default:
                oldStructureID = 0;
            }
            if (oldStructureID) {
                Structure* a = vm.heap.structureIDTable().get(oldStructureID);
                Structure* b = baseValue.asCell()->structure(vm);

                if (Structure::shouldConvertToPolyProto(a, b)) {

        {
            StructureID oldStructureID = metadata.m_oldStructureID;
            if (oldStructureID) {
                Structure* a = vm.heap.structureIDTable().get(oldStructureID);
                Structure* b = baseValue.asCell()->structure(vm);
                if (slot.type() == PutPropertySlot::NewProperty)
                    b = b->previousID();

        }

        // Start out by clearing out the old cache.
        metadata.m_oldStructureID = 0;
        metadata.m_offset = 0;
        metadata.m_newStructureID = 0;
        metadata.m_structureChain.clear();
        
        JSCell* baseCell = baseValue.asCell();

        {
            StructureID oldStructureID = metadata.m_structureID;
            if (oldStructureID) {
                Structure* a = vm.heap.structureIDTable().get(oldStructureID);
                Structure* b = baseValue.asCell()->structure(vm);

                if (Structure::shouldConvertToPolyProto(a, b)) {

        Structure* structure = baseCell->structure(vm);
        if (slot.isValue()) {
            // Start out by clearing out the old cache.
            metadata.m_structureID = 0;
            metadata.m_offset = 0;

            if (!structure->isUncacheableDictionary()) {

        {
            StructureID oldStructureID = metadata.m_oldStructureID;
            if (oldStructureID) {
                Structure* a = vm.heap.structureIDTable().get(oldStructureID);
                Structure* b = baseValue.asCell()->structure(vm);
                if (slot.type() == PutPropertySlot::NewProperty)
                    b = b->previousID();

        }

        // Start out by clearing out the old cache.
        metadata.m_oldStructureID = 0;
        metadata.m_offset = 0;
        metadata.m_newStructureID = 0;
        metadata.m_property.clear();
        
        JSCell* baseCell = baseValue.asCell();

        ASSERT(oldStructure->transitionWatchpointSetHasBeenInvalidated());

        // Start out by clearing out the old cache.
        metadata.m_oldStructureID = 0;
        metadata.m_newStructureID = 0;
        metadata.m_brand.clear();

        if (!newStructure->isDictionary()) {



        end)
end

macro structureIDToStructureWithScratch(structureIDThenStructure, scratch, scratch2)
    loadp CodeBlock[cfr], scratch
    move structureIDThenStructure, scratch2
    loadp CodeBlock::m_vm[scratch], scratch
    rshifti NumberOfStructureIDEntropyBits, scratch2
    loadp VM::heap + Heap::m_structureIDTable + StructureIDTable::m_table[scratch], scratch
    loadp [scratch, scratch2, PtrSize], scratch2
    lshiftp StructureEntropyBitsShift, structureIDThenStructure
    xorp scratch2, structureIDThenStructure
end

macro loadStructureWithScratch(cell, structure, scratch, scratch2)
    loadi JSCell::m_structureID[cell], structure
    structureIDToStructureWithScratch(structure, scratch, scratch2)
end

# Entrypoints into the interpreter.

        move 0, t0
        jmp .done
    .masqueradesAsUndefined:
        loadStructureWithScratch(t0, t2, t1, t3)
        loadp CodeBlock[cfr], t0
        loadp CodeBlock::m_globalObject[t0], t0
        cpeq Structure::m_globalObject[t2], t0, t0

    move ValueFalse, t1
    return(t1)
.masqueradesAsUndefined:
    loadStructureWithScratch(t0, t3, t1, t2)
    loadp CodeBlock[cfr], t1
    loadp CodeBlock::m_globalObject[t1], t1
    cpeq Structure::m_globalObject[t3], t1, t0

    btqnz t0, notCellMask, .opGetPrototypeOfSlow
    bbb JSCell::m_type[t0], ObjectType, .opGetPrototypeOfSlow

    loadStructureWithScratch(t0, t2, t1, t3)
    loadh Structure::m_outOfLineTypeFlags[t2], t3
    btinz t3, OverridesGetPrototypeOutOfLine, .opGetPrototypeOfSlow


    loadp OpPutById::Metadata::m_structureChain[t5], t3
    btpz t3, .opPutByIdTransitionDirect

    loadp CodeBlock[cfr], t1
    loadp CodeBlock::m_vm[t1], t1
    loadp VM::heap + Heap::m_structureIDTable + StructureIDTable::m_table[t1], t1

    macro structureIDToStructureWithScratchAndTable(structureIDThenStructure, table, scratch)
        move structureIDThenStructure, scratch
        rshifti NumberOfStructureIDEntropyBits, scratch
        loadp [table, scratch, PtrSize], scratch
        lshiftp StructureEntropyBitsShift, structureIDThenStructure
        xorp scratch, structureIDThenStructure
    end

    structureIDToStructureWithScratchAndTable(t2, t1, t0)

    loadp StructureChain::m_vector[t3], t3
    assert(macro (ok) btpnz t3, ok end)

    loadi JSCell::m_structureID[t2], t2
    bineq t2, [t3], .opPutByIdSlow
    addp 4, t3
    structureIDToStructureWithScratchAndTable(t2, t1, t0)
    loadq Structure::m_prototype[t2], t2
    bqneq t2, ValueNull, .opPutByIdTransitionChainLoop


        assertNotConstant(size, t0)
        loadq [cfr, t0, 8], t0
        btqnz t0, notCellMask, .immediate
        loadStructureWithScratch(t0, t2, t1, t3)
        cellHandler(t2, JSCell::m_flags[t0], .target)
        dispatch()


macro loadWithStructureCheck(opcodeStruct, get, slowPath)
    get(m_scope, t0)
    loadq [cfr, t0, 8], t0
    loadStructureWithScratch(t0, t2, t1, t3)
    loadp %opcodeStruct%::Metadata::m_structure[t5], t1
    bpneq t2, t1, slowPath
end

    andi IndexingTypeMask, t1
    bia t1, ArrayWithUndecided, .slowPath

    loadStructureWithScratch(t0, t1, t2, t3)
    loadp Structure::m_previousOrRareData[t1], t1
    btpz t1, .slowPath
    bbeq JSCell::m_type[t1], StructureType, .slowPath

Lines 212-217 else Source/JavaScriptCore/llint/LowLevelInterpreter.asm_sec1
- Source/JavaScriptCore/llint/LowLevelInterpreter.asm +5 lines
212	const LowestTag = constexpr JSValue::LowestTag	212	const LowestTag = constexpr JSValue::LowestTag
213	end	213	end
214		214
		215	if JSVALUE64
		216	const NumberOfStructureIDEntropyBits = constexpr StructureIDTable::s_numberOfEntropyBits
		217	const StructureEntropyBitsShift = constexpr StructureIDTable::s_entropyBitsShiftForStructurePointer
		218	end
		219
215	if LARGE_TYPED_ARRAYS	220	if LARGE_TYPED_ARRAYS
216	const SmallTypedArrayMaxLength = constexpr ArrayProfile::s_smallTypedArrayMaxLength	221	const SmallTypedArrayMaxLength = constexpr ArrayProfile::s_smallTypedArrayMaxLength
217	end	222	end

Lines 602-608 JSC_DEFINE_HOST_FUNCTION(arrayProtoFuncT Source/JavaScriptCore/runtime/ArrayPrototype.cpp_sec1
- Source/JavaScriptCore/runtime/ArrayPrototype.cpp -1 / +1 lines
602	JSObject* thisObject = thisValue.toObject(globalObject);	602	JSObject* thisObject = thisValue.toObject(globalObject);
603	RETURN_IF_EXCEPTION(scope, encodedJSValue());	603	RETURN_IF_EXCEPTION(scope, encodedJSValue());
604		604
605	Integrity::auditStructureID(thisObject->structureID());	605	Integrity::auditStructureID(vm, thisObject->structureID());
606	if (!canUseDefaultArrayJoinForToString(vm, thisObject)) {	606	if (!canUseDefaultArrayJoinForToString(vm, thisObject)) {
607	// 2. Let func be the result of calling the [[Get]] internal method of array with argument "join".	607	// 2. Let func be the result of calling the [[Get]] internal method of array with argument "join".
608	JSValue function = thisObject->get(globalObject, vm.propertyNames->join);	608	JSValue function = thisObject->get(globalObject, vm.propertyNames->join);




    ASSERT(value);

    Integrity::auditStructureID(vm, value->structureID());
    int32_t radix = extractToStringRadixArgument(globalObject, callFrame->argument(0), scope);
    RETURN_IF_EXCEPTION(scope, { });


    JSBigInt* value = toThisBigIntValue(globalObject, callFrame->thisValue());
    RETURN_IF_EXCEPTION(scope, { });

    Integrity::auditStructureID(vm, value->structureID());
    return JSValue::encode(value);
}




    if (UNLIKELY(!thisObject))
        return throwVMTypeError(globalObject, scope);

    Integrity::auditStructureID(vm, thisObject->structureID());
    if (thisObject->internalValue() == jsBoolean(false))
        return JSValue::encode(vm.smallStrings.falseString());


    if (UNLIKELY(!thisObject))
        return throwVMTypeError(globalObject, scope);

    Integrity::auditStructureID(vm, thisObject->structureID());
    return JSValue::encode(thisObject->internalValue());
}




            if (otherStructureID)
                metadata.m_toThisStatus = ToThisConflicted;
            metadata.m_cachedStructureID = myStructureID;
            vm.writeBarrier(codeBlock, vm.getStructure(myStructureID));
        }
    } else {
        metadata.m_toThisStatus = ToThisConflicted;
        metadata.m_cachedStructureID = 0;
    }
    // Note: We only need to do this value profiling here on the slow path. The fast path
    // just returns the input to to_this if the structure check succeeds. If the structure



    if (UNLIKELY(!thisDateObj))
        return throwVMTypeError(globalObject, scope);

    Integrity::auditStructureID(vm, thisDateObj->structureID());
    const GregorianDateTime* gregorianDateTime = asUTCVariant
        ? thisDateObj->gregorianDateTimeUTC(cache)
        : thisDateObj->gregorianDateTime(cache);

    if (UNLIKELY(!thisDateObj))
        return throwVMTypeError(globalObject, scope);

    Integrity::auditStructureID(vm, thisDateObj->structureID());
    if (!std::isfinite(thisDateObj->internalNumber()))
        return throwVMError(globalObject, scope, createRangeError(globalObject, "Invalid Date"_s));


    if (!thisValue.isObject())
        return throwVMTypeError(globalObject, scope, "Date.prototype[Symbol.toPrimitive] expected |this| to be an object.");
    JSObject* thisObject = jsCast<JSObject*>(thisValue);
    Integrity::auditStructureID(vm, thisObject->structureID());

    if (!callFrame->argumentCount())
        return throwVMTypeError(globalObject, scope, "Date.prototype[Symbol.toPrimitive] expected a first argument.");



{
    VM& vm = globalObject->vm();
    auto scope = DECLARE_THROW_SCOPE(vm);
    Integrity::auditStructureID(vm, structureID());

    JSValue messageValue;
    auto messagePropertName = vm.propertyNames->message;

{
    VM& vm = globalObject->vm();
    auto scope = DECLARE_THROW_SCOPE(vm);
    Integrity::auditStructureID(vm, structureID());

    JSValue nameValue;
    auto namePropertName = vm.propertyNames->name;

{
    VM& vm = globalObject->vm();
    auto scope = DECLARE_THROW_SCOPE(vm);
    Integrity::auditStructureID(vm, structureID());

    String nameString = sanitizedNameString(globalObject);
    RETURN_IF_EXCEPTION(scope, String());

Lines 79-85 JSC_DEFINE_HOST_FUNCTION(errorProtoFuncT Source/JavaScriptCore/runtime/ErrorPrototype.cpp_sec1
- Source/JavaScriptCore/runtime/ErrorPrototype.cpp -1 / +1 lines
79	if (!thisValue.isObject())	79	if (!thisValue.isObject())
80	return throwVMTypeError(globalObject, scope);	80	return throwVMTypeError(globalObject, scope);
81	JSObject* thisObj = asObject(thisValue);	81	JSObject* thisObj = asObject(thisValue);
82	Integrity::auditStructureID(thisObj->structureID());	82	Integrity::auditStructureID(vm, thisObj->structureID());
83		83
84	// Guard against recursion!	84	// Guard against recursion!
85	StringRecursionChecker checker(globalObject, thisObj);	85	StringRecursionChecker checker(globalObject, thisObj);

Lines 78-84 void FunctionExecutable::visitChildrenIm Source/JavaScriptCore/runtime/FunctionExecutable.cpp_sec1
- Source/JavaScriptCore/runtime/FunctionExecutable.cpp -1 / +1 lines
78	visitor.append(thisObject->m_codeBlockForConstruct);	78	visitor.append(thisObject->m_codeBlockForConstruct);
79	visitor.append(thisObject->m_unlinkedExecutable);	79	visitor.append(thisObject->m_unlinkedExecutable);
80	if (RareData* rareData = thisObject->m_rareData.get()) {	80	if (RareData* rareData = thisObject->m_rareData.get()) {
81	visitor.append(rareData->m_cachedPolyProtoStructureID);	81	visitor.append(rareData->m_cachedPolyProtoStructure);
82	visitor.append(rareData->m_asString);	82	visitor.append(rareData->m_asString);
83	if (TemplateObjectMap* map = rareData->m_templateObjectMap.get()) {	83	if (TemplateObjectMap* map = rareData->m_templateObjectMap.get()) {
84	Locker locker { thisObject->cellLock() };	84	Locker locker { thisObject->cellLock() };



    Structure* cachedPolyProtoStructure()
    {
        if (UNLIKELY(m_rareData))
            return m_rareData->m_cachedPolyProtoStructure.get();
        return nullptr;
    }
    void setCachedPolyProtoStructure(VM& vm, Structure* structure)
    {
        ensureRareData().m_cachedPolyProtoStructure.set(vm, this, structure);
    }

    InlineWatchpointSet& ensurePolyProtoWatchpoint()

        unsigned m_parametersStartOffset { 0 };
        unsigned m_typeProfilingStartOffset { UINT_MAX };
        unsigned m_typeProfilingEndOffset { UINT_MAX };
        WriteBarrierStructureID m_cachedPolyProtoStructureID;
        std::unique_ptr<TemplateObjectMap> m_templateObjectMap;
        WriteBarrier<Structure> m_cachedPolyProtoStructure;
        WriteBarrier<JSString> m_asString;
    };




    JSValue thisValue = callFrame->thisValue();
    if (thisValue.inherits<JSFunction>(vm)) {
        JSFunction* function = jsCast<JSFunction*>(thisValue);
        Integrity::auditStructureID(vm, function->structureID());
        RELEASE_AND_RETURN(scope, JSValue::encode(function->toString(globalObject)));
    }

    if (thisValue.inherits<InternalFunction>(vm)) {
        InternalFunction* function = jsCast<InternalFunction*>(thisValue);
        Integrity::auditStructureID(vm, function->structureID());
        RELEASE_AND_RETURN(scope, JSValue::encode(jsMakeNontrivialString(globalObject, "function ", function->name(), "() {\n    [native code]\n}")));
    }

    if (thisValue.isObject()) {
        JSObject* object = asObject(thisValue);
        Integrity::auditStructureID(vm, object->structureID());
        if (object->isCallable(vm))
            RELEASE_AND_RETURN(scope, JSValue::encode(jsMakeNontrivialString(globalObject, "function ", object->classInfo(vm)->className, "() {\n    [native code]\n}")));
    }

Lines 60-66 void FunctionRareData::visitChildrenImpl Source/JavaScriptCore/runtime/FunctionRareData.cpp_sec1
- Source/JavaScriptCore/runtime/FunctionRareData.cpp -1 / +1 lines
60		60
61	rareData->m_objectAllocationProfile.visitAggregate(visitor);	61	rareData->m_objectAllocationProfile.visitAggregate(visitor);
62	rareData->m_internalFunctionAllocationProfile.visitAggregate(visitor);	62	rareData->m_internalFunctionAllocationProfile.visitAggregate(visitor);
63	visitor.append(rareData->m_boundFunctionStructureID);	63	visitor.append(rareData->m_boundFunctionStructure);
64	visitor.append(rareData->m_executable);	64	visitor.append(rareData->m_executable);
65	}	65	}
66		66



    static inline ptrdiff_t offsetOfObjectAllocationProfile() { return OBJECT_OFFSETOF(FunctionRareData, m_objectAllocationProfile); }
    static inline ptrdiff_t offsetOfAllocationProfileWatchpointSet() { return OBJECT_OFFSETOF(FunctionRareData, m_allocationProfileWatchpointSet); }
    static inline ptrdiff_t offsetOfInternalFunctionAllocationProfile() { return OBJECT_OFFSETOF(FunctionRareData, m_internalFunctionAllocationProfile); }
    static inline ptrdiff_t offsetOfBoundFunctionStructure() { return OBJECT_OFFSETOF(FunctionRareData, m_boundFunctionStructure); }
    static inline ptrdiff_t offsetOfExecutable() { return OBJECT_OFFSETOF(FunctionRareData, m_executable); }
    static inline ptrdiff_t offsetOfAllocationProfileClearingWatchpoint() { return OBJECT_OFFSETOF(FunctionRareData, m_allocationProfileClearingWatchpoint); }

    ObjectAllocationProfileWithPrototype* objectAllocationProfile()
    {

            m_allocationProfileWatchpointSet.startWatching();
    }

    Structure* getBoundFunctionStructure() { return m_boundFunctionStructure.get(); }
    void setBoundFunctionStructure(VM& vm, Structure* structure) { m_boundFunctionStructure.set(vm, this, structure); }

    ExecutableBase* executable() const { return m_executable.get(); }


    ObjectAllocationProfileWithPrototype m_objectAllocationProfile;
    InlineWatchpointSet m_allocationProfileWatchpointSet;
    InternalFunctionAllocationProfile m_internalFunctionAllocationProfile;
    WriteBarrier<Structure> m_boundFunctionStructure;
    WriteBarrier<ExecutableBase> m_executable;
    std::unique_ptr<AllocationProfileClearingWatchpoint> m_allocationProfileClearingWatchpoint;
    bool m_hasReifiedLength : 1;

Lines 43-49 public: Source/JavaScriptCore/runtime/HasOwnPropertyCache.h_sec1
- Source/JavaScriptCore/runtime/HasOwnPropertyCache.h -1 / +1 lines
43	static ptrdiff_t offsetOfResult() { return OBJECT_OFFSETOF(Entry, result); }	43	static ptrdiff_t offsetOfResult() { return OBJECT_OFFSETOF(Entry, result); }
44		44
45	RefPtr<UniquedStringImpl> impl;	45	RefPtr<UniquedStringImpl> impl;
46	StructureID structureID;	46	StructureID structureID { 0 };
47	bool result { false };	47	bool result { false };
48	};	48	};
49		49



#include "LLIntData.h"
#include "Options.h"
#include "SigillCrashAnalyzer.h"
#include "StructureAlignedMemoryAllocator.h"
#include "SuperSampler.h"
#include "VMTraps.h"
#include "WasmCalleeRegistry.h"

#endif
        {
            Options::AllowUnfinalizedAccessScope scope;
            StructureAlignedMemoryAllocator::initializeStructureAddressSpace();
            JITOperationList::initialize();
            ExecutableAllocator::initialize();
            VM::computeCanUseJIT();



/*
 * Copyright (C) 2019-2020 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions

using JITWriteSeparateHeapsFunction = void (*)(off_t, const void*, size_t);
#endif

#if PLATFORM(IOS_FAMILY) && CPU(ARM64) && !CPU(ARM64E)
constexpr uintptr_t structureHeapAddressSize = 512 * MB;
#else
constexpr uintptr_t structureHeapAddressSize = 1 * GB;
#endif

struct Config {
    static Config& singleton();


    void* startExecutableMemory;
    void* endExecutableMemory;
    uintptr_t startOfFixedWritableMemoryPool;
    uintptr_t startOfStructureHeap;

#if ENABLE(SEPARATED_WX_HEAP)
    JITWriteSeparateHeapsFunction jitWriteSeparateHeaps;


constexpr size_t offsetOfJSCConfigInitializeHasBeenCalled = offsetof(JSC::Config, initializeHasBeenCalled);
constexpr size_t offsetOfJSCConfigGateMap = offsetof(JSC::Config, llint.gateMap);
constexpr size_t offsetOfJSCConfigStartOfStructureHeap = offsetof(JSC::Config, startOfStructureHeap);

} // namespace JSC


Lines 320-326 void JSValue::dumpInContextAssumingStruc Source/JavaScriptCore/runtime/JSCJSValue.cpp_sec1
- Source/JavaScriptCore/runtime/JSCJSValue.cpp -1 / +7 lines
320	out.print(" (", inContext(*structure, context), ")");	320	out.print(" (", inContext(*structure, context), ")");
321	}	321	}
322	#if USE(JSVALUE64)	322	#if USE(JSVALUE64)
323	out.print(", StructureID: ", asCell()->structureID().bits());	323	out.print(", StructureID: ", asCell()->structureID());
324	#endif	324	#endif
325	} else if (isTrue())	325	} else if (isTrue())
326	out.print("True");	326	out.print("True");
Lines 357-365 void JSValue::dumpForBacktrace(PrintStre Source/JavaScriptCore/runtime/JSCJSValue.cpp_sec2
357	out.print("(unresolved string)");	357	out.print("(unresolved string)");
358	} else if (asCell()->inherits<Structure>(vm)) {	358	} else if (asCell()->inherits<Structure>(vm)) {
359	out.print("Structure[ ", asCell()->structure()->classInfo()->className);	359	out.print("Structure[ ", asCell()->structure()->classInfo()->className);
		360	#if USE(JSVALUE64)
		361	out.print(" ID: ", asCell()->structureID());
		362	#endif
360	out.print("]: ", RawPointer(asCell()));	363	out.print("]: ", RawPointer(asCell()));
361	} else {	364	} else {
362	out.print("Cell[", asCell()->structure()->classInfo()->className);	365	out.print("Cell[", asCell()->structure()->classInfo()->className);
		366	#if USE(JSVALUE64)
		367	out.print(" ID: ", asCell()->structureID());
		368	#endif
363	out.print("]: ", RawPointer(asCell()));	369	out.print("]: ", RawPointer(asCell()));
364	}	370	}
365	} else if (isTrue())	371	} else if (isTrue())

Lines 173-179 double JSCell::toNumber(JSGlobalObject* Source/JavaScriptCore/runtime/JSCell.cpp_sec1
- Source/JavaScriptCore/runtime/JSCell.cpp -1 / +1 lines
173		173
174	JSObject* JSCell::toObjectSlow(JSGlobalObject* globalObject) const	174	JSObject* JSCell::toObjectSlow(JSGlobalObject* globalObject) const
175	{	175	{
176	Integrity::auditStructureID(structureID());	176	Integrity::auditStructureID(globalObject->vm(), structureID());
177	ASSERT(!isObject());	177	ASSERT(!isObject());
178	if (isString())	178	if (isString())
179	return static_cast<const JSString*>(this)->toObject(globalObject);	179	return static_cast<const JSString*>(this)->toObject(globalObject);

Lines 135-141 public: Source/JavaScriptCore/runtime/JSCell.h_sec1
- Source/JavaScriptCore/runtime/JSCell.h -1 / +1 lines
135	Structure* structure(VM&) const;	135	Structure* structure(VM&) const;
136	void setStructure(VM&, Structure*);	136	void setStructure(VM&, Structure*);
137	void setStructureIDDirectly(StructureID id) { m_structureID = id; }	137	void setStructureIDDirectly(StructureID id) { m_structureID = id; }
138	void clearStructure() { m_structureID = StructureID(); }	138	void clearStructure() { m_structureID = 0; }
139		139
140	TypeInfo::InlineTypeFlags inlineTypeFlags() const { return m_flags; }	140	TypeInfo::InlineTypeFlags inlineTypeFlags() const { return m_flags; }
141		141




ALWAYS_INLINE Structure* JSCell::structure() const
{
    return structure(vm());
}

ALWAYS_INLINE Structure* JSCell::structure(VM& vm) const
ALWAYS_INLINE Structure* JSCell::structure(VM&) const
{
    return vm.getStructure(m_structureID);
}

template<typename Visitor>

    ASSERT(structure->classInfo() == this->structure(vm)->classInfo());
    ASSERT(!this->structure(vm)
        || this->structure(vm)->transitionWatchpointSetHasBeenInvalidated()
        || Heap::heap(this)->structureIDTable().get(structure->id()) == structure);
    m_structureID = structure->id();
    m_flags = TypeInfo::mergeInlineTypeFlags(structure->typeInfo().inlineTypeFlags(), m_flags);
    m_type = structure->typeInfo().type();



    for (auto& property : thisObject->m_linkTimeConstants)
        property.visit(visitor);

#define VISIT_SIMPLE_TYPE(CapitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) if (featureFlag) { \
        visitor.append(thisObject->m_ ## lowerName ## Prototype); \

#define VISIT_SIMPLE_TYPE_STRUCTURE(CapitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) if (featureFlag) \
        visitor.append(thisObject->m_ ## properName ## Structure); \
    }

    FOR_EACH_SIMPLE_BUILTIN_TYPE(VISIT_SIMPLE_TYPE)
    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(VISIT_SIMPLE_TYPE)
    FOR_EACH_SIMPLE_BUILTIN_TYPE(VISIT_SIMPLE_TYPE_PROTOTYPE)
    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(VISIT_SIMPLE_TYPE_PROTOTYPE)

#define VISIT_LAZY_TYPE(CapitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) if (featureFlag) \
        thisObject->m_ ## properName ## Structure.visit(visitor);

Lines 376-382 public: Source/JavaScriptCore/runtime/JSGlobalObject.h_sec1
- Source/JavaScriptCore/runtime/JSGlobalObject.h -47 / +40 lines
376	LazyProperty<JSGlobalObject, Structure> m_debuggerScopeStructure;	376	LazyProperty<JSGlobalObject, Structure> m_debuggerScopeStructure;
377	LazyProperty<JSGlobalObject, Structure> m_withScopeStructure;	377	LazyProperty<JSGlobalObject, Structure> m_withScopeStructure;
378	LazyProperty<JSGlobalObject, Structure> m_strictEvalActivationStructure;	378	LazyProperty<JSGlobalObject, Structure> m_strictEvalActivationStructure;
		379	WriteBarrier<Structure> m_lexicalEnvironmentStructure;
379	LazyProperty<JSGlobalObject, Structure> m_moduleEnvironmentStructure;	380	LazyProperty<JSGlobalObject, Structure> m_moduleEnvironmentStructure;
		381	WriteBarrier<Structure> m_directArgumentsStructure;
		382	WriteBarrier<Structure> m_scopedArgumentsStructure;
		383	WriteBarrier<Structure> m_clonedArgumentsStructure;
		384
		385	WriteBarrier<Structure> m_objectStructureForObjectConstructor;
		386
		387	// Lists the actual structures used for having these particular indexing shapes.
		388	WriteBarrier<Structure> m_originalArrayStructureForIndexingShape[NumberOfArrayIndexingModes];
		389	// Lists the structures we should use during allocation for these particular indexing shapes.
		390	// These structures will differ from the originals list above when we are having a bad time.
		391	WriteBarrier<Structure> m_arrayStructureForIndexingShapeDuringAllocation[NumberOfArrayIndexingModes];
		392
380	LazyProperty<JSGlobalObject, Structure> m_callbackConstructorStructure;	393	LazyProperty<JSGlobalObject, Structure> m_callbackConstructorStructure;
381	LazyProperty<JSGlobalObject, Structure> m_callbackFunctionStructure;	394	LazyProperty<JSGlobalObject, Structure> m_callbackFunctionStructure;
382	LazyProperty<JSGlobalObject, Structure> m_callbackObjectStructure;	395	LazyProperty<JSGlobalObject, Structure> m_callbackObjectStructure;
Lines 388-444 public: Source/JavaScriptCore/runtime/JSGlobalObject.h_sec2
388	LazyProperty<JSGlobalObject, Structure> m_glibCallbackFunctionStructure;	401	LazyProperty<JSGlobalObject, Structure> m_glibCallbackFunctionStructure;
389	LazyProperty<JSGlobalObject, Structure> m_glibWrapperObjectStructure;	402	LazyProperty<JSGlobalObject, Structure> m_glibWrapperObjectStructure;
390	#endif	403	#endif
		404	WriteBarrier<Structure> m_nullPrototypeObjectStructure;
		405	WriteBarrier<Structure> m_calleeStructure;
391		406
392	WriteBarrierStructureID m_lexicalEnvironmentStructure;	407	WriteBarrier<Structure> m_hostFunctionStructure;
393	WriteBarrierStructureID m_directArgumentsStructure;
394	WriteBarrierStructureID m_scopedArgumentsStructure;
395	WriteBarrierStructureID m_clonedArgumentsStructure;
396
397	WriteBarrierStructureID m_objectStructureForObjectConstructor;
398
399	// Lists the actual structures used for having these particular indexing shapes.
400	WriteBarrierStructureID m_originalArrayStructureForIndexingShape[NumberOfArrayIndexingModes];
401	// Lists the structures we should use during allocation for these particular indexing shapes.
402	// These structures will differ from the originals list above when we are having a bad time.
403	WriteBarrierStructureID m_arrayStructureForIndexingShapeDuringAllocation[NumberOfArrayIndexingModes];
404
405	WriteBarrierStructureID m_nullPrototypeObjectStructure;
406	WriteBarrierStructureID m_calleeStructure;
407
408	WriteBarrierStructureID m_hostFunctionStructure;
409		408
410	struct FunctionStructures {	409	struct FunctionStructures {
411	WriteBarrierStructureID arrowFunctionStructure;	410	WriteBarrier<Structure> arrowFunctionStructure;
412	WriteBarrierStructureID sloppyFunctionStructure;	411	WriteBarrier<Structure> sloppyFunctionStructure;
413	WriteBarrierStructureID strictFunctionStructure;	412	WriteBarrier<Structure> strictFunctionStructure;
414	};	413	};
415	FunctionStructures m_builtinFunctions;	414	FunctionStructures m_builtinFunctions;
416	FunctionStructures m_ordinaryFunctions;	415	FunctionStructures m_ordinaryFunctions;
417		416
418	PropertyOffset m_functionNameOffset;
419	WriteBarrierStructureID m_shadowRealmObjectStructure;
420	WriteBarrierStructureID m_regExpStructure;
421	WriteBarrierStructureID m_asyncFunctionStructure;
422	WriteBarrierStructureID m_asyncGeneratorFunctionStructure;
423	WriteBarrierStructureID m_generatorFunctionStructure;
424	WriteBarrierStructureID m_generatorStructure;
425	WriteBarrierStructureID m_asyncGeneratorStructure;
426	WriteBarrierStructureID m_arrayIteratorStructure;
427	WriteBarrierStructureID m_mapIteratorStructure;
428	WriteBarrierStructureID m_setIteratorStructure;
429	WriteBarrierStructureID m_regExpMatchesArrayStructure;
430	WriteBarrierStructureID m_regExpMatchesArrayWithIndicesStructure;
431	WriteBarrierStructureID m_regExpMatchesIndicesArrayStructure;
432
433	LazyProperty<JSGlobalObject, Structure> m_boundFunctionStructure;	417	LazyProperty<JSGlobalObject, Structure> m_boundFunctionStructure;
434	LazyProperty<JSGlobalObject, Structure> m_customGetterFunctionStructure;	418	LazyProperty<JSGlobalObject, Structure> m_customGetterFunctionStructure;
435	LazyProperty<JSGlobalObject, Structure> m_customSetterFunctionStructure;	419	LazyProperty<JSGlobalObject, Structure> m_customSetterFunctionStructure;
436	LazyProperty<JSGlobalObject, Structure> m_nativeStdFunctionStructure;	420	LazyProperty<JSGlobalObject, Structure> m_nativeStdFunctionStructure;
		421	PropertyOffset m_functionNameOffset;
		422	WriteBarrier<Structure> m_shadowRealmObjectStructure;
		423	WriteBarrier<Structure> m_regExpStructure;
437	WriteBarrier<AsyncFunctionPrototype> m_asyncFunctionPrototype;	424	WriteBarrier<AsyncFunctionPrototype> m_asyncFunctionPrototype;
438	WriteBarrier<AsyncGeneratorFunctionPrototype> m_asyncGeneratorFunctionPrototype;	425	WriteBarrier<AsyncGeneratorFunctionPrototype> m_asyncGeneratorFunctionPrototype;
		426	WriteBarrier<Structure> m_asyncFunctionStructure;
		427	WriteBarrier<Structure> m_asyncGeneratorFunctionStructure;
		428	WriteBarrier<Structure> m_generatorFunctionStructure;
		429	WriteBarrier<Structure> m_generatorStructure;
		430	WriteBarrier<Structure> m_asyncGeneratorStructure;
		431	WriteBarrier<Structure> m_arrayIteratorStructure;
		432	WriteBarrier<Structure> m_mapIteratorStructure;
		433	WriteBarrier<Structure> m_setIteratorStructure;
439	LazyProperty<JSGlobalObject, Structure> m_iteratorResultObjectStructure;	434	LazyProperty<JSGlobalObject, Structure> m_iteratorResultObjectStructure;
440	LazyProperty<JSGlobalObject, Structure> m_dataPropertyDescriptorObjectStructure;	435	LazyProperty<JSGlobalObject, Structure> m_dataPropertyDescriptorObjectStructure;
441	LazyProperty<JSGlobalObject, Structure> m_accessorPropertyDescriptorObjectStructure;	436	LazyProperty<JSGlobalObject, Structure> m_accessorPropertyDescriptorObjectStructure;
		437	WriteBarrier<Structure> m_regExpMatchesArrayStructure;
		438	WriteBarrier<Structure> m_regExpMatchesArrayWithIndicesStructure;
		439	WriteBarrier<Structure> m_regExpMatchesIndicesArrayStructure;
442	LazyProperty<JSGlobalObject, Structure> m_moduleRecordStructure;	440	LazyProperty<JSGlobalObject, Structure> m_moduleRecordStructure;
443	LazyProperty<JSGlobalObject, Structure> m_moduleNamespaceObjectStructure;	441	LazyProperty<JSGlobalObject, Structure> m_moduleNamespaceObjectStructure;
444	LazyProperty<JSGlobalObject, Structure> m_proxyObjectStructure;	442	LazyProperty<JSGlobalObject, Structure> m_proxyObjectStructure;
Lines 446-464 public: Source/JavaScriptCore/runtime/JSGlobalObject.h_sec3
446	LazyProperty<JSGlobalObject, Structure> m_proxyRevokeStructure;	444	LazyProperty<JSGlobalObject, Structure> m_proxyRevokeStructure;
447	LazyClassStructure m_sharedArrayBufferStructure;	445	LazyClassStructure m_sharedArrayBufferStructure;
448		446
449	#define DEFINE_STORAGE_FOR_SIMPLE_TYPE_PROTOTYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) \	447	#define DEFINE_STORAGE_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) \
450	WriteBarrier<capitalName ## Prototype> m_ ## lowerName ## Prototype;	448	WriteBarrier<capitalName ## Prototype> m_ ## lowerName ## Prototype; \
451		449	WriteBarrier<Structure> m_ ## properName ## Structure;
452	#define DEFINE_STORAGE_FOR_SIMPLE_TYPE_STRUCTURE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) \
453	WriteBarrierStructureID m_ ## properName ## Structure;
454		450
455	#define DEFINE_STORAGE_FOR_LAZY_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) \	451	#define DEFINE_STORAGE_FOR_LAZY_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) \
456	LazyClassStructure m_ ## properName ## Structure;	452	LazyClassStructure m_ ## properName ## Structure;
457		453
458	FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE_STRUCTURE)	454	FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE)
459	FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE_STRUCTURE)	455	FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE)
460	FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE_PROTOTYPE)
461	FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE_PROTOTYPE)
462		456
463	#if ENABLE(WEBASSEMBLY)	457	#if ENABLE(WEBASSEMBLY)
464	LazyProperty<JSGlobalObject, Structure> m_webAssemblyModuleRecordStructure;	458	LazyProperty<JSGlobalObject, Structure> m_webAssemblyModuleRecordStructure;
Lines 470-477 public: Source/JavaScriptCore/runtime/JSGlobalObject.h_sec4
470		464
471	FOR_EACH_LAZY_BUILTIN_TYPE(DEFINE_STORAGE_FOR_LAZY_TYPE)	465	FOR_EACH_LAZY_BUILTIN_TYPE(DEFINE_STORAGE_FOR_LAZY_TYPE)
472		466
473	#undef DEFINE_STORAGE_FOR_SIMPLE_TYPE_PROTOTYPE	467	#undef DEFINE_STORAGE_FOR_SIMPLE_TYPE
474	#undef DEFINE_STORAGE_FOR_SIMPLE_TYPE_STRUCTURE
475	#undef DEFINE_STORAGE_FOR_LAZY_TYPE	468	#undef DEFINE_STORAGE_FOR_LAZY_TYPE
476		469
477	WriteBarrier<GetterSetter> m_speciesGetterSetter;	470	WriteBarrier<GetterSetter> m_speciesGetterSetter;
Lines 581-587 public: Source/JavaScriptCore/runtime/JSGlobalObject.h_sec5
581		574
582	bool m_evalEnabled { true };	575	bool m_evalEnabled { true };
583	bool m_webAssemblyEnabled { true };	576	bool m_webAssemblyEnabled { true };
584	bool m_needsSiteSpecificQuirks { false };
585	unsigned m_globalLexicalBindingEpoch { 1 };	577	unsigned m_globalLexicalBindingEpoch { 1 };
586	String m_evalDisabledErrorMessage;	578	String m_evalDisabledErrorMessage;
587	String m_webAssemblyDisabledErrorMessage;	579	String m_webAssemblyDisabledErrorMessage;
Lines 1202-1207 private: Source/JavaScriptCore/runtime/JSGlobalObject.h_sec6
1202		1194
1203	JS_EXPORT_PRIVATE static void clearRareData(JSCell*);	1195	JS_EXPORT_PRIVATE static void clearRareData(JSCell*);
1204		1196
		1197	bool m_needsSiteSpecificQuirks { false };
1205	#if JSC_OBJC_API_ENABLED	1198	#if JSC_OBJC_API_ENABLED
1206	RetainPtr<JSWrapperMap> m_wrapperMap;	1199	RetainPtr<JSWrapperMap> m_wrapperMap;
1207	#endif	1200	#endif



    // https://pdfs.semanticscholar.org/343f/7182cde7669ca2a7de3dc01127927f384ef7.pdf
    
    StructureID structureID = this->structureID();
    if (isNuked(structureID))
        return nullptr;
    structure = vm.getStructure(structureID);
    maxOffset = structure->maxOffset();
    IndexingType indexingMode;
    Dependency indexingModeDependency = structure->fencedIndexingMode(indexingMode);

    DeferGC deferGC(vm);
    Butterfly* newButterfly = createInitialIndexedStorage(vm, length);
    StructureID oldStructureID = this->structureID();
    Structure* oldStructure = vm.getStructure(oldStructureID);
    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, TransitionKind::AllocateUndecided);
    nukeStructureAndSetButterfly(vm, oldStructureID, newButterfly);
    setStructure(vm, newStructure);

    for (unsigned i = newButterfly->vectorLength(); i--;)
        newButterfly->contiguous().at(this, i).setWithoutWriteBarrier(JSValue());
    StructureID oldStructureID = this->structureID();
    Structure* oldStructure = vm.getStructure(oldStructureID);
    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, TransitionKind::AllocateInt32);
    nukeStructureAndSetButterfly(vm, oldStructureID, newButterfly);
    setStructure(vm, newStructure);

    for (unsigned i = newButterfly->vectorLength(); i--;)
        newButterfly->contiguousDouble().at(this, i) = PNaN;
    StructureID oldStructureID = this->structureID();
    Structure* oldStructure = vm.getStructure(oldStructureID);
    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, TransitionKind::AllocateDouble);
    nukeStructureAndSetButterfly(vm, oldStructureID, newButterfly);
    setStructure(vm, newStructure);

    for (unsigned i = newButterfly->vectorLength(); i--;)
        newButterfly->contiguous().at(this, i).setWithoutWriteBarrier(JSValue());
    StructureID oldStructureID = this->structureID();
    Structure* oldStructure = vm.getStructure(oldStructureID);
    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, TransitionKind::AllocateContiguous);
    nukeStructureAndSetButterfly(vm, oldStructureID, newButterfly);
    setStructure(vm, newStructure);

{
    DeferGC deferGC(vm);
    StructureID oldStructureID = this->structureID();
    Structure* oldStructure = vm.getStructure(oldStructureID);
    IndexingType oldType = indexingType();
    ASSERT_UNUSED(oldType, !hasIndexedProperties(oldType));


        storage->m_vector[i].setWithoutWriteBarrier(JSValue());
    
    StructureID oldStructureID = this->structureID();
    Structure* oldStructure = vm.getStructure(oldStructureID);
    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, transition);
    nukeStructureAndSetButterfly(vm, oldStructureID, storage->butterfly());
    setStructure(vm, newStructure);

    }
    
    StructureID oldStructureID = this->structureID();
    Structure* oldStructure = vm.getStructure(oldStructureID);
    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, transition);
    nukeStructureAndSetButterfly(vm, oldStructureID, newStorage->butterfly());
    setStructure(vm, newStructure);

    }
    
    StructureID oldStructureID = this->structureID();
    Structure* oldStructure = vm.getStructure(oldStructureID);
    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, transition);
    nukeStructureAndSetButterfly(vm, oldStructureID, newStorage->butterfly());
    setStructure(vm, newStructure);


    ASSERT(newStorage->butterfly() != butterfly);
    StructureID oldStructureID = this->structureID();
    Structure* oldStructure = vm.getStructure(oldStructureID);
    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, transition);

    // Ensure new Butterfly initialization is correctly done before exposing it to the concurrent threads.

    ASSERT(attributes & PropertyAttribute::CustomAccessorOrValue);

    StructureID structureID = this->structureID();
    Structure* structure = vm.heap.structureIDTable().get(structureID);
    PropertyOffset offset = prepareToPutDirectWithoutTransition(vm, propertyName, attributes, structureID, structure);
    putDirect(vm, offset, value);


{
    ASSERT(attributes & PropertyAttribute::Accessor);
    StructureID structureID = this->structureID();
    Structure* structure = vm.heap.structureIDTable().get(structureID);
    PropertyOffset offset = prepareToPutDirectWithoutTransition(vm, propertyName, attributes, structureID, structure);
    putDirect(vm, offset, accessor);
    if (attributes & PropertyAttribute::ReadOnly)



inline void JSObject::nukeStructureAndSetButterfly(VM& vm, StructureID oldStructureID, Butterfly* butterfly)
{
    if (isX86() || vm.heap.mutatorShouldBeFenced()) {
        setStructureIDDirectly(nuke(oldStructureID));
        WTF::storeStoreFence();
        m_butterfly.set(vm, this, butterfly);
        WTF::storeStoreFence();

ALWAYS_INLINE bool JSObject::getPropertySlot(JSGlobalObject* globalObject, PropertyName propertyName, PropertySlot& slot)
{
    VM& vm = getVM(globalObject);
    auto& structureIDTable = vm.heap.structureIDTable();
    JSObject* object = this;
    while (true) {
        if (UNLIKELY(TypeInfo::overridesGetOwnPropertySlot(object->inlineTypeFlags()))) {

            return object->getNonIndexPropertySlot(globalObject, propertyName, slot);
        }
        ASSERT(object->type() != ProxyObjectType);
        Structure* structure = structureIDTable.get(object->structureID());
#if USE(JSVALUE64)
        if (checkNullStructure && UNLIKELY(!structure))
            CRASH_WITH_INFO(object->type(), object->structureID(), structureIDTable.size());
#endif
        if (object->getOwnNonIndexPropertySlot(vm, structure, propertyName, slot))
            return true;



{
    VM& vm = getVM(globalObject);
    auto scope = DECLARE_THROW_SCOPE(vm);
    auto& structureIDTable = vm.heap.structureIDTable();
    JSObject* object = this;
    while (true) {
        Structure* structure = structureIDTable.get(object->structureID());
        bool hasSlot = structure->classInfo()->methodTable.getOwnPropertySlotByIndex(object, globalObject, propertyName, slot);
        RETURN_IF_EXCEPTION(scope, false);
        if (hasSlot)


    VM& vm = getVM(globalObject);
    auto scope = DECLARE_THROW_SCOPE(vm);
    auto& structureIDTable = vm.heap.structureIDTable();
    JSObject* object = this;
    while (true) {
        Structure* structure = structureIDTable.get(object->structureID());
        if (LIKELY(!TypeInfo::overridesGetOwnPropertySlot(object->inlineTypeFlags()))) {
            if (object->getOwnNonIndexPropertySlot(vm, structure, propertyName, slot))
                return true;

    ASSERT(!value.isGetterSetter() && !(attributes & PropertyAttribute::Accessor));
    ASSERT(!value.isCustomGetterSetter());
    StructureID structureID = this->structureID();
    Structure* structure = vm.heap.structureIDTable().get(structureID);
    PropertyOffset offset = prepareToPutDirectWithoutTransition(vm, propertyName, attributes, structureID, structure);
    putDirect(vm, offset, value);
    if (attributes & PropertyAttribute::ReadOnly)

    ASSERT(!parseIndex(propertyName));

    StructureID structureID = this->structureID();
    Structure* structure = vm.heap.structureIDTable().get(structureID);
    if (structure->isDictionary()) {
        ASSERT(!isCopyOnWrite(indexingMode()));
        

Lines 50-56 JSPropertyNameEnumerator* JSPropertyName Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp_sec1
- Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp -2 / +6 lines
50	JSPropertyNameEnumerator::JSPropertyNameEnumerator(VM& vm, Structure* structure, uint32_t indexedLength, uint32_t numberStructureProperties, WriteBarrier<JSString>* propertyNamesBuffer, unsigned propertyNamesSize)	50	JSPropertyNameEnumerator::JSPropertyNameEnumerator(VM& vm, Structure* structure, uint32_t indexedLength, uint32_t numberStructureProperties, WriteBarrier<JSString>* propertyNamesBuffer, unsigned propertyNamesSize)
51	: JSCell(vm, vm.propertyNameEnumeratorStructure.get())	51	: JSCell(vm, vm.propertyNameEnumeratorStructure.get())
52	, m_propertyNames(vm, this, propertyNamesBuffer)	52	, m_propertyNames(vm, this, propertyNamesBuffer)
53	, m_cachedStructureID(vm, this, structure, WriteBarrierStructureID::MayBeNull)	53	, m_cachedStructureID(structure ? structure->id() : 0)
54	, m_indexedLength(indexedLength)	54	, m_indexedLength(indexedLength)
55	, m_endStructurePropertyIndex(numberStructureProperties)	55	, m_endStructurePropertyIndex(numberStructureProperties)
56	, m_endGenericPropertyIndex(propertyNamesSize)	56	, m_endGenericPropertyIndex(propertyNamesSize)
Lines 86-92 void JSPropertyNameEnumerator::visitChil Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp_sec2
86	visitor.markAuxiliary(propertyNames);	86	visitor.markAuxiliary(propertyNames);
87	visitor.append(propertyNames, propertyNames + thisObject->sizeOfPropertyNames());	87	visitor.append(propertyNames, propertyNames + thisObject->sizeOfPropertyNames());
88	}	88	}
89	visitor.append(thisObject->m_cachedStructureID);	89
		90	if (thisObject->cachedStructureID()) {
		91	VM& vm = visitor.vm();
		92	visitor.appendUnbarriered(vm.getStructure(thisObject->cachedStructureID()));
		93	}
90	}	94	}
91		95
92	DEFINE_VISIT_CHILDREN(JSPropertyNameEnumerator);	96	DEFINE_VISIT_CHILDREN(JSPropertyNameEnumerator);




    Structure* cachedStructure(VM& vm) const
    {
        if (!m_cachedStructureID)
            return nullptr;
        return vm.heap.structureIDTable().get(m_cachedStructureID);
    }
    StructureID cachedStructureID() const { return m_cachedStructureID; }
    uint32_t indexedLength() const { return m_indexedLength; }
    uint32_t endStructurePropertyIndex() const { return m_endStructurePropertyIndex; }
    uint32_t endGenericPropertyIndex() const { return m_endGenericPropertyIndex; }

    // JSPropertyNameEnumerator is immutable data structure, which allows VM to cache the empty one.
    // After instantiating JSPropertyNameEnumerator, we must not change any fields.
    AuxiliaryBarrier<WriteBarrier<JSString>*> m_propertyNames;
    StructureID m_cachedStructureID;
    uint32_t m_indexedLength;
    uint32_t m_endStructurePropertyIndex;
    uint32_t m_endGenericPropertyIndex;

Lines 94-100 static ALWAYS_INLINE bool toThisNumber(V Source/JavaScriptCore/runtime/NumberPrototype.cpp_sec1
- Source/JavaScriptCore/runtime/NumberPrototype.cpp -1 / +1 lines
94	}	94	}
95		95
96	if (auto* numberObject = jsDynamicCast<NumberObject*>(vm, thisValue)) {	96	if (auto* numberObject = jsDynamicCast<NumberObject*>(vm, thisValue)) {
97	Integrity::auditStructureID(numberObject->structureID());	97	Integrity::auditStructureID(vm, numberObject->structureID());
98	x = numberObject->internalValue().asNumber();	98	x = numberObject->internalValue().asNumber();
99	return true;	99	return true;
100	}	100	}



    JSObject* valueObj = thisValue.toObject(globalObject);
    if (UNLIKELY(!valueObj))
        return encodedJSValue();
    Integrity::auditStructureID(globalObject->vm(), valueObj->structureID());
    return JSValue::encode(valueObj);
}


    JSObject* thisObject = thisValue.toObject(globalObject);
    RETURN_IF_EXCEPTION(scope, nullptr);

    Integrity::auditStructureID(vm, thisObject->structureID());
    auto result = thisObject->structure(vm)->cachedSpecialProperty(CachedSpecialPropertyKey::ToStringTag);
    if (result)
        return asString(result);

Lines 199-205 JSC_DEFINE_HOST_FUNCTION(regExpProtoFunc Source/JavaScriptCore/runtime/RegExpPrototype.cpp_sec1
- Source/JavaScriptCore/runtime/RegExpPrototype.cpp -1 / +1 lines
199	return throwVMTypeError(globalObject, scope);	199	return throwVMTypeError(globalObject, scope);
200		200
201	JSObject* thisObject = asObject(thisValue);	201	JSObject* thisObject = asObject(thisValue);
202	Integrity::auditStructureID(thisObject->structureID());	202	Integrity::auditStructureID(vm, thisObject->structureID());
203		203
204	StringRecursionChecker checker(globalObject, thisObject);	204	StringRecursionChecker checker(globalObject, thisObject);
205	EXCEPTION_ASSERT(!scope.exception() \|\| checker.earlyReturnValue());	205	EXCEPTION_ASSERT(!scope.exception() \|\| checker.earlyReturnValue());



    // Also used for valueOf.

    if (thisValue.isString()) {
        Integrity::auditStructureID(vm, thisValue.asCell()->structureID());
        return JSValue::encode(thisValue);
    }


    if (!stringObject)
        return throwVMTypeError(globalObject, scope);

    Integrity::auditStructureID(vm, stringObject->structureID());
    return JSValue::encode(stringObject->internalValue());
}





Structure::Structure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
    : JSCell(vm, vm.structureStructure.get())
    , m_blob(vm.heap.structureIDTable().allocateID(this), indexingType, typeInfo)
    , m_outOfLineTypeFlags(typeInfo.outOfLineTypeFlags())
    , m_inlineCapacity(inlineCapacity)
    , m_bitField(0)

    setMaxOffset(vm, invalidOffset);
 
    TypeInfo typeInfo = TypeInfo(StructureType, StructureFlags);
    m_blob = StructureIDBlob(vm.heap.structureIDTable().allocateID(this), 0, typeInfo);
    m_outOfLineTypeFlags = typeInfo.outOfLineTypeFlags();

    ASSERT(hasReadOnlyOrGetterSetterPropertiesExcludingProto() || !m_classInfo->hasStaticSetterOrReadonlyProperties());

    setMaxOffset(vm, invalidOffset);
 
    TypeInfo typeInfo = previous->typeInfo();
    m_blob = StructureIDBlob(vm.heap.structureIDTable().allocateID(this), previous->indexingModeIncludingHistory(), typeInfo);
    m_outOfLineTypeFlags = typeInfo.outOfLineTypeFlags();

    ASSERT(!previous->typeInfo().structureIsImmortal());


    if (isBrandedStructure())
        static_cast<BrandedStructure*>(this)->destruct();
    Heap::heap(this)->structureIDTable().deallocateID(this, m_blob.structureID());
}

void Structure::destroy(JSCell* cell)

    
    GCSafeConcurrentJSLocker locker(m_lock, vm);
    
    object->setStructureIDDirectly(nuke(id()));
    WTF::storeStoreFence();

    size_t beforeOutOfLineCapacity = this->outOfLineCapacity();


void Structure::dump(PrintStream& out) const
{
    auto* structureID = reinterpret_cast<void*>(id());
    out.print(RawPointer(this), ":[", RawPointer(structureID),
        "/", (uint32_t)(reinterpret_cast<uintptr_t>(structureID)), ", ",
        classInfo()->className, ", (", inlineSize(), "/", inlineCapacity(), ", ",

    return rareData()->cachedPropertyNameEnumeratorAndFlag();
}

bool Structure::canCachePropertyNameEnumerator(VM& vm) const
{
    if (!this->canCacheOwnPropertyNames())
        return false;

        StructureID structureID = *currentStructureID;
        if (!structureID)
            return true;
        Structure* structure = vm.getStructure(structureID);
        if (!structure->canCacheOwnPropertyNames())
            return false;
        currentStructureID++;




    typedef JSCell Base;
    static constexpr unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
    static constexpr uint8_t numberOfLowerTierCells = 0;
    
    enum PolyProtoTag { PolyProto };
    static Structure* create(VM&, JSGlobalObject*, JSValue prototype, const TypeInfo&, const ClassInfo*, IndexingType = NonArray, unsigned inlineCapacity = 0);

    void validateFlags();

public:
    StructureID id() const { return m_blob.structureID(); }
    int32_t objectInitializationBlob() const { return m_blob.blobExcludingStructureID(); }
    int64_t idBlob() const { return m_blob.blob(); }




    ++size; // Sentinel nullptr.
    size_t bytes = Checked<size_t>(size) * sizeof(StructureID);
    void* vector = vm.jsValueGigacageAuxiliarySpace().allocate(vm, bytes, nullptr, AllocationFailureMode::Assert);
    static_assert(!StructureID().bits(), "Make sure the value we're going to memcpy below matches the default StructureID");
    memset(vector, 0, bytes);
    StructureChain* chain = new (NotNull, allocateCell<StructureChain>(vm)) StructureChain(vm, vm.structureChainStructure.get(), static_cast<StructureID*>(vector));
    chain->finishCreation(vm, head);

    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
    Base::visitChildren(thisObject, visitor);
    visitor.markAuxiliary(thisObject->m_vector.get());
    VM& vm = visitor.vm();
    for (auto* current = thisObject->m_vector.get(); *current; ++current) {
        StructureID structureID = *current;
        Structure* structure = vm.getStructure(structureID);
        visitor.appendUnbarriered(structure);
    }
}



/*
 * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 * THE POSSIBILITY OF SUCH DAMAGE.
 */

#pragma once

#include "JSCConfig.h"
#include <wtf/HashTraits.h>
#include <wtf/StdIntExtras.h>

namespace JSC {

class Structure;

constexpr CPURegister structureIDMask = structureHeapAddressSize - 1;

class StructureID {
public:
    static constexpr uint32_t nukedStructureIDBit = 1;

    StructureID() = default;
    StructureID(StructureID const&) = default;
    StructureID& operator=(StructureID const&) = default;

    StructureID nuke() const { return StructureID(m_bits | nukedStructureIDBit); }
    bool isNuked() const { return m_bits & nukedStructureIDBit; }
    StructureID decontaminate() const { return StructureID(m_bits & ~nukedStructureIDBit); }

    inline Structure* decode() const;
    static StructureID encode(const Structure*);

    explicit operator bool() const { return !!m_bits; }
    bool operator==(StructureID const& other) const  { return m_bits == other.m_bits; }
    bool operator!=(StructureID const& other) const  { return m_bits != other.m_bits; }
    constexpr uint32_t bits() const { return m_bits; }

    StructureID(WTF::HashTableDeletedValueType) : m_bits(nukedStructureIDBit) { }
    bool isHashTableDeletedValue() const { return *this == StructureID(WTF::HashTableDeletedValue); }

private:
    explicit StructureID(uint32_t bits) : m_bits(bits) { }

    uint32_t m_bits { 0 };
};
static_assert(sizeof(StructureID) == sizeof(uint32_t));

#if CPU(ADDRESS64)

ALWAYS_INLINE Structure* StructureID::decode() const
{
    // Take care to only use the bits from m_bits in the structure's address reservation.
    ASSERT(decontaminate());
    return reinterpret_cast<Structure*>((static_cast<uintptr_t>(decontaminate().m_bits) & structureIDMask) + g_jscConfig.startOfStructureHeap);
}

ALWAYS_INLINE StructureID StructureID::encode(const Structure* structure)
{
    ASSERT(structure);
    ASSERT(g_jscConfig.startOfStructureHeap <= reinterpret_cast<uintptr_t>(structure) && reinterpret_cast<uintptr_t>(structure) < g_jscConfig.startOfStructureHeap + structureHeapAddressSize);
    auto result = StructureID(reinterpret_cast<uintptr_t>(structure) & structureIDMask);
    ASSERT(result.decode() == structure);
    return result;
}

#else // CPU(ADDRESS64)

ALWAYS_INLINE Structure* StructureID::decode() const
{
    ASSERT(decontaminate());
    return reinterpret_cast<Structure*>(m_bits);
}

ALWAYS_INLINE StructureID StructureID::encode(const Structure* structure)
{
    ASSERT(structure);
    return StructureID(reinterpret_cast<uint32_t>(structure));
}

#endif

struct StructureIDHash {
    static unsigned hash(const StructureID& key) { return key.bits(); }
    static bool equal(const StructureID& a, const StructureID& b) { return a == b; }
    static constexpr bool safeToCompareToEmptyOrDeleted = true;
};

} // namespace JSC

namespace WTF {

template<typename T> struct DefaultHash;
template<> struct DefaultHash<JSC::StructureID> : JSC::StructureIDHash { };

template<typename T> struct HashTraits;
template<> struct HashTraits<JSC::StructureID> : SimpleClassHashTraits<JSC::StructureID> {
    static constexpr bool emptyValueIsZero = true;
};

}



#include "CellState.h"
#include "IndexingType.h"
#include "JSTypeInfo.h"
#include "StructureIDTable.h"

namespace JSC {

class StructureIDBlob {
    friend class LLIntOffsetsExtractor;
public:
    StructureIDBlob()
    {
        u.doubleWord = 0xbbadbeef;
    }

    StructureIDBlob(StructureID structureID, IndexingType indexingModeIncludingHistory, const TypeInfo& typeInfo)
    {

    }

private:
    union {
        struct {
            // FIXME: We should remove this since the structureID can be directly computed from the Structure*
            StructureID structureID;
            IndexingType indexingModeIncludingHistory;
            JSType type;

            int32_t word2;
        } words;
        int64_t doubleWord;
    } u;
        Data() { doubleWord = 0xbbadbeef; }
    };

    Data u;
};

} // namespace JSC



/*
 * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 * THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "config.h"
#include "StructureIDTable.h"

#include "ResourceExhaustion.h"
#include <wtf/Atomics.h>
#include <wtf/DataLog.h>
#include <wtf/RawPointer.h>

namespace JSC {

#if USE(JSVALUE64)

namespace StructureIDTableInternal {
static constexpr bool verbose = false;
}

StructureIDTable::StructureIDTable()
    : m_table(makeUniqueArray<StructureOrOffset>(s_initialSize))
    , m_size(1)
    , m_capacity(s_initialSize)
{
    // We pre-allocate the first offset so that the null Structure
    // can still be represented as the StructureID '0'.
    table()[0].encodedStructureBits = 0;

    makeFreeListFromRange(1, m_capacity - 1);
}

void StructureIDTable::makeFreeListFromRange(uint32_t first, uint32_t last)
{
    ASSERT(!m_firstFreeOffset);
    ASSERT(!m_lastFreeOffset);

    // Put all the new IDs on the free list sequentially.
    uint32_t head = first;
    uint32_t tail = last;
    for (uint32_t i = first; i < last; ++i)
        table()[i].offset = i + 1;
    table()[last].offset = 0;

    // Randomize the free list.
    uint32_t size = last - first + 1;
    uint32_t maxIterations = (size * 2) / 3;
    for (uint32_t count = 0; count < maxIterations; ++count) {
        // Move a random pick either to the head or the tail of the free list.
        uint32_t random = m_weakRandom.getUint32();
        uint32_t nodeBefore = first + (random % size);
        uint32_t pick = table()[nodeBefore].offset;
        if (pick) {
            uint32_t nodeAfter = table()[pick].offset;
            table()[nodeBefore].offset = nodeAfter;
            if ((random & 1) || !nodeAfter) {
                // Move to the head.
                table()[pick].offset = head;
                head = pick;
                if (!nodeAfter)
                    tail = nodeBefore;
            } else {
                // Move to the tail.
                table()[pick].offset = 0;
                table()[tail].offset = pick;
                tail = pick;
            }
        }
    }

    // Cut list in half and swap halves.
    uint32_t cut = first + (m_weakRandom.getUint32() % size);
    uint32_t afterCut = table()[cut].offset;
    if (afterCut) {
        table()[tail].offset = head;
        tail = cut;
        head = afterCut;
        table()[cut].offset = 0;
    }

    m_firstFreeOffset = head;
    m_lastFreeOffset = tail;
}

void StructureIDTable::resize(size_t newCapacity)
{
    if (newCapacity > s_maximumNumberOfStructures)
        newCapacity = s_maximumNumberOfStructures;

    // If m_size is already s_maximumNumberOfStructures, newCapacity becomes s_maximumNumberOfStructures in the above code.
    // In that case, we should crash because of exhaust of StructureIDs.
    RELEASE_ASSERT_RESOURCE_AVAILABLE(m_size < newCapacity, StructureIDExhaustion, "Crash intentionally because of exhaust of StructureIDs.");

    // Create the new table.
    auto newTable = makeUniqueArray<StructureOrOffset>(newCapacity);

    // Copy the contents of the old table to the new table.
    memcpy(newTable.get(), table(), m_capacity * sizeof(StructureOrOffset));

    // Store fence to make sure we've copied everything before doing the swap.
    WTF::storeStoreFence();

    // Swap the old and new tables.
    swap(m_table, newTable);

    // Put the old table (now labeled as new) into the list of old tables.
    m_oldTables.append(WTFMove(newTable));

    // Update the capacity.
    m_capacity = newCapacity;

    makeFreeListFromRange(m_size, m_capacity - 1);
}

void StructureIDTable::flushOldTables()
{
    m_oldTables.clear();
}

StructureID StructureIDTable::allocateID(Structure* structure)
{
    if (UNLIKELY(!m_firstFreeOffset)) {
        RELEASE_ASSERT(m_capacity <= s_maximumNumberOfStructures);
        ASSERT(m_size == m_capacity);
        resize(m_capacity * 2);
        ASSERT(m_size < m_capacity);
        RELEASE_ASSERT(m_firstFreeOffset);
    }

    // entropyBits must not be zero. This ensures that if a corrupted
    // structureID is encountered (with incorrect entropyBits), the decoded
    // structure pointer for that ID will be always be a bad pointer with
    // high bits set.
    constexpr uint32_t entropyBitsMask = (1 << s_numberOfEntropyBits) - 1;
    uint32_t entropyBits = m_weakRandom.getUint32() & entropyBitsMask;
    if (UNLIKELY(!entropyBits)) {
        constexpr uint32_t numberOfValuesToPickFrom = entropyBitsMask;
        entropyBits = (m_weakRandom.getUint32() % numberOfValuesToPickFrom) + 1;
    }

    uint32_t structureIndex = m_firstFreeOffset;
    m_firstFreeOffset = table()[m_firstFreeOffset].offset;
    if (!m_firstFreeOffset)
        m_lastFreeOffset = 0;

    StructureID result = (structureIndex << s_numberOfEntropyBits) | entropyBits;
    table()[structureIndex].encodedStructureBits = encode(structure, result);
    m_size++;
    ASSERT(!isNuked(result));

    dataLogLnIf(StructureIDTableInternal::verbose, "Allocated StructureID ", result, " for Structure ", RawPointer(structure));
    return result;
}

void StructureIDTable::deallocateID(Structure* structure, StructureID structureID)
{
    dataLogLnIf(StructureIDTableInternal::verbose, "Deallocated StructureID ", structureID);
    ASSERT(structureID != s_unusedID);
    uint32_t structureIndex = structureID >> s_numberOfEntropyBits;
    ASSERT(structureIndex && structureIndex < s_maximumNumberOfStructures);
    RELEASE_ASSERT(table()[structureIndex].encodedStructureBits == encode(structure, structureID));
    m_size--;
    if (!m_firstFreeOffset) {
        table()[structureIndex].offset = 0;
        m_firstFreeOffset = structureIndex;
        m_lastFreeOffset = structureIndex;
        return;
    }

    bool insertAtHead = m_weakRandom.getUint32() & 1;
    if (insertAtHead) {
        table()[structureIndex].offset = m_firstFreeOffset;
        m_firstFreeOffset = structureIndex;
    } else {
        table()[structureIndex].offset = 0;
        table()[m_lastFreeOffset].offset = structureIndex;
        m_lastFreeOffset = structureIndex;
    }
}

#endif // USE(JSVALUE64)

} // namespace JSC



/*
 * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 * THE POSSIBILITY OF SUCH DAMAGE.
 */

#pragma once

#include "EnsureStillAliveHere.h"
#include "UnusedPointer.h"
#include <wtf/UniqueArray.h>
#include <wtf/Vector.h>
#include <wtf/WeakRandom.h>

namespace JSC {

class Structure;

#if USE(JSVALUE64)
using StructureID = uint32_t;

inline StructureID nukedStructureIDBit()
{
    return 0x80000000u;
}

inline StructureID nuke(StructureID id)
{
    return id | nukedStructureIDBit();
}

inline bool isNuked(StructureID id)
{
    return !!(id & nukedStructureIDBit());
}

inline StructureID decontaminate(StructureID id)
{
    return id & ~nukedStructureIDBit();
}
#else // not USE(JSVALUE64)
using StructureID = Structure*;

inline StructureID nukedStructureIDBit()
{
    return bitwise_cast<StructureID>(static_cast<uintptr_t>(1));
}

inline StructureID nuke(StructureID id)
{
    return bitwise_cast<StructureID>(bitwise_cast<uintptr_t>(id) | bitwise_cast<uintptr_t>(nukedStructureIDBit()));
}

inline bool isNuked(StructureID id)
{
    return !!(bitwise_cast<uintptr_t>(id) & bitwise_cast<uintptr_t>(nukedStructureIDBit()));
}

inline StructureID decontaminate(StructureID id)
{
    return bitwise_cast<StructureID>(bitwise_cast<uintptr_t>(id) & ~bitwise_cast<uintptr_t>(nukedStructureIDBit()));
}
#endif // not USE(JSVALUE64)

#if USE(JSVALUE64)

using EncodedStructureBits = uintptr_t;

class StructureIDTable {
    friend class LLIntOffsetsExtractor;
public:
    StructureIDTable();

    void** base() { return reinterpret_cast<void**>(&m_table); }

    ALWAYS_INLINE void validate(StructureID);

    // FIXME: rdar://69036888: remove this when no longer needed.
    // This is only used for a special case mitigation. It is not for general use.
    Structure* tryGet(StructureID);

    Structure* get(StructureID);
    void deallocateID(Structure*, StructureID);
    StructureID allocateID(Structure*);

    void flushOldTables();
    
    size_t size() const { return m_size; }

private:
    void resize(size_t newCapacity);
    void makeFreeListFromRange(uint32_t first, uint32_t last);

    union StructureOrOffset {
        WTF_MAKE_FAST_ALLOCATED;
    public:
        EncodedStructureBits encodedStructureBits;
        uintptr_t offset;
    };

    StructureOrOffset* table() const { return m_table.get(); }
    static Structure* decode(EncodedStructureBits, StructureID);
    static EncodedStructureBits encode(Structure*, StructureID);

    static constexpr size_t s_initialSize = 512;

    Vector<UniqueArray<StructureOrOffset>> m_oldTables;

    uint32_t m_firstFreeOffset { 0 };
    uint32_t m_lastFreeOffset { 0 };
    UniqueArray<StructureOrOffset> m_table;

    size_t m_size { 0 };
    size_t m_capacity;

    WeakRandom m_weakRandom;

    static constexpr StructureID s_unusedID = 0;

public:
    // 1. StructureID is encoded as:
    //
    //    ----------------------------------------------------------------
    //    | 1 Nuke Bit | 26 StructureIDTable index bits | 5 entropy bits |
    //    ----------------------------------------------------------------
    //
    //    The entropy bits are chosen at random and assigned when a StructureID
    //    is allocated.
    //
    // 2. For each StructureID, the StructureIDTable stores encodedStructureBits
    //    which are encoded from the structure pointer as such:
    //
    //    ------------------------------------------------------------------
    //    | 11 low index bits | 5 entropy bits | 48 structure pointer bits |
    //    ------------------------------------------------------------------
    //
    //    The entropy bits here are the same 5 bits used in the encoding of the
    //    StructureID for this structure entry in the StructureIDTable.

    static constexpr uint32_t s_numberOfNukeBits = 1;
    static constexpr uint32_t s_numberOfEntropyBits = 5;
    static constexpr uint32_t s_entropyBitsShiftForStructurePointer = (sizeof(EncodedStructureBits) * 8) - 16;

    static constexpr uint32_t s_maximumNumberOfStructures = 1 << (32 - s_numberOfEntropyBits - s_numberOfNukeBits);
};

ALWAYS_INLINE Structure* StructureIDTable::decode(EncodedStructureBits bits, StructureID structureID)
{
    return bitwise_cast<Structure*>(bits ^ (static_cast<uintptr_t>(structureID) << s_entropyBitsShiftForStructurePointer));
}

ALWAYS_INLINE EncodedStructureBits StructureIDTable::encode(Structure* structure, StructureID structureID)
{
    return bitwise_cast<EncodedStructureBits>(structure) ^ (static_cast<EncodedStructureBits>(structureID) << s_entropyBitsShiftForStructurePointer);
}

inline Structure* StructureIDTable::get(StructureID structureID)
{
    ASSERT_WITH_SECURITY_IMPLICATION(structureID);
    ASSERT_WITH_SECURITY_IMPLICATION(!isNuked(structureID));
    uint32_t structureIndex = structureID >> s_numberOfEntropyBits;
    RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(structureIndex < m_capacity);
    return decode(table()[structureIndex].encodedStructureBits, structureID);
}

// FIXME: rdar://69036888: remove this function when no longer needed.
inline Structure* StructureIDTable::tryGet(StructureID structureID)
{
    uint32_t structureIndex = structureID >> s_numberOfEntropyBits;
    if (structureIndex >= m_capacity)
        return nullptr;
    return decode(table()[structureIndex].encodedStructureBits, structureID);
}

ALWAYS_INLINE void StructureIDTable::validate(StructureID structureID)
{
    uint32_t structureIndex = structureID >> s_numberOfEntropyBits;
    Structure* structure = decode(table()[structureIndex].encodedStructureBits, structureID);
    RELEASE_ASSERT(structureIndex < m_capacity);
    *bitwise_cast<volatile uint64_t*>(structure);
}

#else // not USE(JSVALUE64)

class StructureIDTable {
    friend class LLIntOffsetsExtractor;
public:
    StructureIDTable() = default;

    // FIXME: rdar://69036888: remove this function when no longer needed.
    Structure* tryGet(StructureID structureID) { return structureID; }
    Structure* get(StructureID structureID) { return structureID; }
    void deallocateID(Structure*, StructureID) { }
    StructureID allocateID(Structure* structure)
    {
        ASSERT(!isNuked(structure));
        return structure;
    };

    void flushOldTables() { }
    void validate(StructureID) { }
};

#endif // not USE(JSVALUE64)

} // namespace JSC




StructureRareData::StructureRareData(VM& vm, Structure* previous)
    : JSCell(vm, vm.structureRareDataStructure.get())
    , m_previous(vm, this, previous, WriteBarrierStructureID::MayBeNull)
    , m_maxOffset(invalidOffset)
    , m_transitionOffset(invalidOffset)
{
    if (previous)
        m_previous.set(vm, this, previous);
}

template<typename Visitor>




    bool tryCachePropertyNameEnumeratorViaWatchpoint(VM&, Structure*, StructureChain*);

    WriteBarrier<Structure> m_previous;
    // FIXME: We should have some story for clearing these property names caches in GC.
    // https://bugs.webkit.org/show_bug.cgi?id=192659
    uintptr_t m_cachedPropertyNameEnumeratorAndFlag { 0 };

    std::unique_ptr<SpecialPropertyCache> m_specialPropertyCache;
    Box<InlineWatchpointSet> m_polyProtoWatchpoint;

    WriteBarrierStructureID m_previous;
    PropertyOffset m_maxOffset;
    PropertyOffset m_transitionOffset;
};



    m_structureRareData->clearCachedPropertyNameEnumerator();
}

inline bool StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint(VM& vm, Structure* baseStructure, StructureChain* chain)
{
    if (baseStructure->hasPolyProto())
        return false;

    for (auto* current = chain->head(); *current; ++current) {
        ++size;
        StructureID structureID = *current;
        Structure* structure = vm.getStructure(structureID);
        if (!structure->propertyNameEnumeratorShouldWatch())
            return false;
    }

    unsigned index = 0;
    for (auto* current = chain->head(); *current; ++current) {
        StructureID structureID = *current;
        Structure* structure = vm.getStructure(structureID);
        m_cachedPropertyNameEnumeratorWatchpoints[index].install(this, structure);
        ++index;
    }



    if (!symbol)
        return throwVMTypeError(globalObject, scope, SymbolDescriptionTypeError);
    scope.release();
    Integrity::auditStructureID(vm, symbol->structureID());
    const auto description = symbol->description();
    return JSValue::encode(description.isNull() ? jsUndefined() : jsString(vm, description));
}

    Symbol* symbol = tryExtractSymbol(vm, callFrame->thisValue());
    if (!symbol)
        return throwVMTypeError(globalObject, scope, SymbolToStringTypeError);
    Integrity::auditStructureID(vm, symbol->structureID());
    RELEASE_AND_RETURN(scope, JSValue::encode(jsNontrivialString(vm, symbol->descriptiveString())));
}


    if (!symbol)
        return throwVMTypeError(globalObject, scope, SymbolValueOfTypeError);

    Integrity::auditStructureID(vm, symbol->structureID());
    RELEASE_AND_RETURN(scope, JSValue::encode(symbol));
}




        Structure* structure = nullptr;
        bool sawPolyProtoStructure = false;
        if (id) {
            structure = Heap::heap(value.asCell())->structureIDTable().get(id);
            auto iter = cachedMonoProtoShapes.find(structure);
            if (iter == cachedMonoProtoShapes.end()) {
                auto key = std::make_pair(structure, value.asCell());

    for (LogEntry* entry = m_logStartPtr; entry != m_currentLogEntryPtr; ++entry) {
        visitor.appendUnbarriered(entry->value);
        if (StructureID id = entry->structureID) {
            Structure* structure = visitor.heap()->structureIDTable().get(id); 
            visitor.appendUnbarriered(structure);
        }
    }



        return result;
    }
    
    ALWAYS_INLINE Structure* getStructure(StructureID id)
    {
        return heap.structureIDTable().get(decontaminate(id));
    }

    // FIXME: rdar://69036888: remove this function when no longer needed.
    ALWAYS_INLINE Structure* tryGetStructure(StructureID id)
    {
        return heap.structureIDTable().tryGet(decontaminate(id));
    }

    void* stackPointerAtVMEntry() const { return m_stackPointerAtVMEntry; }
    void setStackPointerAtVMEntry(void*);





#include "GCAssertions.h"
#include "HandleTypes.h"
#include "StructureID.h"
#include <type_traits>
#include <wtf/RawPtrTraits.h>
#include <wtf/RawValueTraits.h>

    return lhs.get() == rhs.get();
}

class WriteBarrierStructureID {
public:
    constexpr WriteBarrierStructureID() = default;

    WriteBarrierStructureID(VM& vm, const JSCell* owner, Structure* value)
    {
        set(vm, owner, value);
    }

    WriteBarrierStructureID(DFG::DesiredWriteBarrier&, Structure* value)
    {
        ASSERT(isCompilationThread());
        setWithoutWriteBarrier(value);
    }

    enum MayBeNullTag { MayBeNull };
    WriteBarrierStructureID(VM& vm, const JSCell* owner, Structure* value, MayBeNullTag)
    {
        setMayBeNull(vm, owner, value);
    }

    void set(VM&, const JSCell* owner, Structure* value);

    void setMayBeNull(VM&, const JSCell* owner, Structure* value);

    // Should only be used by JSCell during early initialisation
    // when some basic types aren't yet completely instantiated
    void setEarlyValue(VM&, const JSCell* owner, Structure* value);

    Structure* get() const
    {
        // Copy m_structureID to a local to avoid multiple-read issues. (See <http://webkit.org/b/110854>)
        StructureID structureID = m_structureID;
        if (structureID) {
            Structure* structure = structureID.decode();
            validateCell(reinterpret_cast<JSCell*>(structure));
            return structure;
        }
        return nullptr;
    }

    Structure* operator*() const
    {
        StructureID structureID = m_structureID;
        ASSERT(structureID);
        Structure* structure = structureID.decode();
        validateCell(reinterpret_cast<JSCell*>(structure));
        return structure;
    }

    Structure* operator->() const
    {
        StructureID structureID = m_structureID;
        ASSERT(structureID);
        Structure* structure = structureID.decode();
        validateCell(reinterpret_cast<JSCell*>(structure));
        return structure;
    }

    void clear()
    {
        m_structureID = { };
    }

    explicit operator bool() const
    {
        return !!m_structureID;
    }

    bool operator!() const
    {
        return !m_structureID;
    }

    void setWithoutWriteBarrier(Structure* value)
    {
#if ENABLE(WRITE_BARRIER_PROFILING)
        WriteBarrierCounters::usesWithoutBarrierFromCpp.count();
#endif
        if (!value) {
            m_structureID = { };
            return;
        }
        m_structureID = StructureID::encode(value);
    }

    Structure* unvalidatedGet() const
    {
        StructureID structureID = m_structureID;
        if (structureID)
            return structureID.decode();
        return nullptr;
    }

    StructureID value() const { return m_structureID; }

private:
    StructureID m_structureID;
};

} // namespace JSC



    vm.writeBarrier(owner, value);
}

inline void WriteBarrierStructureID::set(VM& vm, const JSCell* owner, Structure* value)
{
    ASSERT(value);
    ASSERT(!Options::useConcurrentJIT() || !isCompilationThread());
    validateCell(reinterpret_cast<JSCell*>(value));
    setEarlyValue(vm, owner, value);
}

inline void WriteBarrierStructureID::setMayBeNull(VM& vm, const JSCell* owner, Structure* value)
{
    if (value)
        validateCell(reinterpret_cast<JSCell*>(value));
    setEarlyValue(vm, owner, value);
}

inline void WriteBarrierStructureID::setEarlyValue(VM& vm, const JSCell* owner, Structure* value)
{
    if (!value) {
        m_structureID = { };
        return;
    }
    m_structureID = StructureID::encode(value);
    vm.writeBarrier(owner, reinterpret_cast<JSCell*>(value));
}

} // namespace JSC 




        // 2. Validate the cell's structure

        Structure* structure = vm.getStructure(structureID);
        if (!structure) {
            printHeaderAndCell();
#if USE(JSVALUE64)
            uint32_t structureIDAsUint32 = structureID;
#else
            uint32_t structureIDAsUint32 = reinterpret_cast<uint32_t>(structureID);
#endif
            dataLog(" with structureID ", structureIDAsUint32, " maps to a NULL Structure pointer\n");
            return false;
        }


        // 3. Validate the cell's structure's structure.
        
        Structure* structureStructure = vm.getStructure(structureID);
        if (!structureStructure) {
            printHeaderAndCell();
            dataLog(" has structure ", RawPointer(structure), " whose structure is NULL\n");

Lines 1-5 Source/JavaScriptCore/tools/Integrity.cpp_sec1
- Source/JavaScriptCore/tools/Integrity.cpp -1 / +1 lines
1	/*	1	/*
2	* Copyright (C) 2019-2021 Apple Inc. All rights reserved.	2	* Copyright (C) 2019 Apple Inc. All rights reserved.
3	*	3	*
4	* Redistribution and use in source and binary forms, with or without	4	* Redistribution and use in source and binary forms, with or without
5	* modification, are permitted provided that the following conditions	5	* modification, are permitted provided that the following conditions



/*
 * Copyright (C) 2019-2020 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions

#pragma once

#include "JSCJSValue.h"
#include "StructureIDTable.h"
#include <wtf/Gigacage.h>
#include <wtf/Lock.h>


        auditCell<auditLevel>(vm, value.asCell());
}

ALWAYS_INLINE void auditStructureID(StructureIDTable&, StructureID);
ALWAYS_INLINE void auditStructureID(VM&, StructureID);

} // namespace Integrity




        auditCellFully(vm, cell);
}

ALWAYS_INLINE void auditStructureID(StructureIDTable& table, StructureID id)
{
    table.validate(id);
}

ALWAYS_INLINE void auditStructureID(VM& vm, StructureID id)
{
    auditStructureID(vm.heap.structureIDTable(), id);
#if CPU(ADDRESS64)
    ASSERT(structureID.bits() <= structureHeapAddressSize + StructureID::nukedStructureIDBit);
#endif
}

} // namespace Integrity




    for (size_t i = 0; i < structures.size(); ++i) {
        auto* structure = structures[structures.size() - i - 1];
        result->push(globalObject, JSValue(structure->id()));
        RETURN_IF_EXCEPTION(scope, { });
        result->push(globalObject, JSValue(structure->transitionOffset()));
        RETURN_IF_EXCEPTION(scope, { });


    addFunction(vm, "ensureArrayStorage", functionEnsureArrayStorage, 1);

    m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructure.set(vm, this, ObjectDoingSideEffectPutWithoutCorrectSlotStatus::createStructure(vm, globalObject, jsNull()));
}

void JSDollarVM::addFunction(VM& vm, JSGlobalObject* globalObject, const char* name, NativeFunction function, unsigned arguments)

{
    JSDollarVM* thisObject = jsCast<JSDollarVM*>(cell);
    Base::visitChildren(thisObject, visitor);
    visitor.append(thisObject->m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructure);
}

DEFINE_VISIT_CHILDREN(JSDollarVM);



        return instance;
    }

    Structure* objectDoingSideEffectPutWithoutCorrectSlotStatusStructure() { return m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructure.get(); }
    
private:
    JSDollarVM(VM& vm, Structure* structure)


    DECLARE_VISIT_CHILDREN;

    WriteBarrier<Structure> m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructure;
};

} // namespace JSC

Lines 266-272 MacroAssemblerCodePtr<JSEntryPtrTag> Web Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp_sec1
- Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp -1 / +1 lines
266	slowPath.append(jit.branchIfNotCell(scratchGPR));	266	slowPath.append(jit.branchIfNotCell(scratchGPR));
267		267
268	stackLimitGPRIsClobbered = true;	268	stackLimitGPRIsClobbered = true;
269	jit.emitLoadStructure(vm, scratchGPR, scratchGPR);	269	jit.emitLoadStructure(vm, scratchGPR, scratchGPR, stackLimitGPR);
270	jit.loadPtr(CCallHelpers::Address(scratchGPR, Structure::classInfoOffset()), scratchGPR);	270	jit.loadPtr(CCallHelpers::Address(scratchGPR, Structure::classInfoOffset()), scratchGPR);
271		271
272	static_assert(std::is_final<WebAssemblyFunction>::value, "We do not check for subtypes below");	272	static_assert(std::is_final<WebAssemblyFunction>::value, "We do not check for subtypes below");

Lines 64-70 static ALWAYS_INLINE JSWebAssemblyGlobal Source/JavaScriptCore/wasm/js/WebAssemblyGlobalPrototype.cpp_sec1
- Source/JavaScriptCore/wasm/js/WebAssemblyGlobalPrototype.cpp -1 / +1 lines
64	createTypeError(globalObject, "expected \|this\| value to be an instance of WebAssembly.Global"_s));	64	createTypeError(globalObject, "expected \|this\| value to be an instance of WebAssembly.Global"_s));
65	return nullptr;	65	return nullptr;
66	}	66	}
67	Integrity::auditStructureID(result->structureID());	67	Integrity::auditStructureID(vm, result->structureID());
68	return result;	68	return result;
69	}	69	}
70		70



2021-12-13  Saam Barati  <sbarati@apple.com>

        Roll back r286345, r286387, r286471, r286667, r286849
        https://bugs.webkit.org/show_bug.cgi?id=234268

        Reviewed by Mark Lam.

        * wtf/OSAllocator.h:
        * wtf/posix/OSAllocatorPOSIX.cpp:
        (WTF::OSAllocator::reserveUncommittedAligned): Deleted.

2021-12-13  Elliott Williams  <emw@apple.com>

        Deployment target for macOS 11+ does not follow minor version bumps



        JSJITCodePages = VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY,
    };

    // These methods are symmetric; reserveUncommitted allocates VM in an uncommitted state,
    // releaseDecommitted should be called on a region of VM allocated by a single reservation,
    // the memory must all currently be in a decommitted state. reserveUncommitted returns to
    // you memory that is zeroed.
    WTF_EXPORT_PRIVATE static void* reserveUncommitted(size_t, Usage = UnknownUsage, bool writable = true, bool executable = false, bool jitCageEnabled = false, bool includesGuardPages = false);
    // This guarantees the memory will be aligned to a multiple of the requested size. The requested
    // size must be a power of two and greater than the system page size.
    WTF_EXPORT_PRIVATE static void* reserveUncommittedAligned(size_t, Usage = UnknownUsage, bool writable = true, bool executable = false, bool jitCageEnabled = false, bool includesGuardPages = false);
    WTF_EXPORT_PRIVATE static void releaseDecommitted(void*, size_t);

    // These methods are symmetric; they commit or decommit a region of VM (uncommitted VM should



#include <errno.h>
#include <sys/mman.h>
#include <wtf/Assertions.h>
#include <wtf/MathExtras.h>
#include <wtf/PageBlock.h>

#if ENABLE(JIT_CAGE)

#endif // OS(DARWIN)
#endif // ENABLE(JIT_CAGE)

#if OS(DARWIN)
#include <wtf/spi/cocoa/MachVMSPI.h>
#endif

namespace WTF {

void* OSAllocator::reserveUncommitted(size_t bytes, Usage usage, bool writable, bool executable, bool jitCageEnabled, bool includesGuardPages)

    return result;
}

void* OSAllocator::reserveUncommittedAligned(size_t bytes, Usage usage, bool writable, bool executable, bool jitCageEnabled, bool includesGuardPages)
{
    ASSERT(hasOneBitSet(bytes) && bytes >= pageSize());

#if PLATFORM(MAC) || USE(APPLE_INTERNAL_SDK)
    UNUSED_PARAM(usage); // Not supported for mach API.
    ASSERT_UNUSED(includesGuardPages, !includesGuardPages);
    ASSERT_UNUSED(jitCageEnabled, !jitCageEnabled); // Not supported for mach API.
    vm_prot_t protections = VM_PROT_READ;
    if (writable)
        protections |= VM_PROT_WRITE;
    if (executable)
        protections |= VM_PROT_EXECUTE;

    const vm_inherit_t childProcessInheritance = VM_INHERIT_DEFAULT;
    const bool copy = false;
    const int flags = VM_FLAGS_ANYWHERE;

    void* aligned = nullptr;
    kern_return_t result = mach_vm_map(mach_task_self(), reinterpret_cast<mach_vm_address_t*>(&aligned), bytes, bytes - 1, flags, MEMORY_OBJECT_NULL, 0, copy, protections, protections, childProcessInheritance);
    RELEASE_ASSERT(result == KERN_SUCCESS, result, bytes);
#if HAVE(MADV_FREE_REUSE)
    if (aligned) {
        // To support the "reserve then commit" model, we have to initially decommit.
        while (madvise(aligned, bytes, MADV_FREE_REUSABLE) == -1 && errno == EAGAIN) { }
    }
#endif

    return aligned;
#else
    // Double the size so we can ensure enough mapped memory to get an aligned start.
    size_t mappedSize = bytes * 2;
    char* mapped = reinterpret_cast<char*>(reserveUncommitted(mappedSize, usage, writable, executable, jitCageEnabled, includesGuardPages));
    char* mappedEnd = mapped + mappedSize;

    char* aligned = reinterpret_cast<char*>(roundUpToMultipleOf(bytes, reinterpret_cast<uintptr_t>(mapped)));
    char* alignedEnd = aligned + bytes;

    RELEASE_ASSERT(alignedEnd <= mappedEnd);

    if (size_t leftExtra = aligned - mapped)
        releaseDecommitted(mapped, leftExtra);

    if (size_t rightExtra = mappedEnd - alignedEnd)
        releaseDecommitted(alignedEnd, rightExtra);

    return aligned;
#endif
}

void* OSAllocator::reserveAndCommit(size_t bytes, Usage usage, bool writable, bool executable, bool jitCageEnabled, bool includesGuardPages)
{
    // All POSIX reservations start out logically committed.

Return to Bug 234268

Lines 63-69 AccessCase::AccessCase(VM& vm, JSCell* o Source/JavaScriptCore/bytecode/AccessCase.cpp_sec1
- Source/JavaScriptCore/bytecode/AccessCase.cpp -14 / +14 lines
63	, m_polyProtoAccessChain(WTFMove(prototypeAccessChain))	63	, m_polyProtoAccessChain(WTFMove(prototypeAccessChain))
64	, m_identifier(identifier)	64	, m_identifier(identifier)
65	{	65	{
66	m_structureID.setMayBeNull(vm, owner, structure);	66	m_structure.setMayBeNull(vm, owner, structure);
67	m_conditionSet = conditionSet;	67	m_conditionSet = conditionSet;
68	RELEASE_ASSERT(m_conditionSet.isValid());	68	RELEASE_ASSERT(m_conditionSet.isValid());
69	}	69	}
Lines 536-549 bool AccessCase::needsScratchFPR() const Source/JavaScriptCore/bytecode/AccessCase.cpp_sec2
536	}	536	}
537		537
538	template<typename Functor>	538	template<typename Functor>
539	void AccessCase::forEachDependentCell(VM&, const Functor& functor) const	539	void AccessCase::forEachDependentCell(VM& vm, const Functor& functor) const
540	{	540	{
541	m_conditionSet.forEachDependentCell(functor);	541	m_conditionSet.forEachDependentCell(functor);
542	if (m_structureID)	542	if (m_structure)
543	functor(m_structureID.get());	543	functor(m_structure.get());
544	if (m_polyProtoAccessChain) {	544	if (m_polyProtoAccessChain) {
545	for (StructureID structureID : m_polyProtoAccessChain->chain())	545	for (StructureID structureID : m_polyProtoAccessChain->chain())
546	functor(structureID.decode());	546	functor(vm.getStructure(structureID));
547	}	547	}
548		548
549	switch (type()) {	549	switch (type()) {
Lines 874-881 void AccessCase::dump(PrintStream& out) Source/JavaScriptCore/bytecode/AccessCase.cpp_sec3
874	if (m_type == Transition \|\| m_type == Delete \|\| m_type == SetPrivateBrand)	874	if (m_type == Transition \|\| m_type == Delete \|\| m_type == SetPrivateBrand)
875	out.print("\n", indent, "from structure = ", pointerDump(structure()),	875	out.print("\n", indent, "from structure = ", pointerDump(structure()),
876	"\n", indent, "to structure = ", pointerDump(newStructure()));	876	"\n", indent, "to structure = ", pointerDump(newStructure()));
877	else if (m_structureID)	877	else if (m_structure)
878	out.print("\n", indent, "structure = ", pointerDump(m_structureID.get()));	878	out.print("\n", indent, "structure = ", pointerDump(m_structure.get()));
879	}	879	}
880		880
881	if (!m_conditionSet.isEmpty())	881	if (!m_conditionSet.isEmpty())
Lines 904-922 bool AccessCase::visitWeak(VM& vm) const Source/JavaScriptCore/bytecode/AccessCase.cpp_sec4
904	template<typename Visitor>	904	template<typename Visitor>
905	void AccessCase::propagateTransitions(Visitor& visitor) const	905	void AccessCase::propagateTransitions(Visitor& visitor) const
906	{	906	{
907	if (m_structureID)	907	if (m_structure)
908	m_structureID->markIfCheap(visitor);	908	m_structure->markIfCheap(visitor);
909		909
910	if (m_polyProtoAccessChain) {	910	if (m_polyProtoAccessChain) {
911	for (StructureID structureID : m_polyProtoAccessChain->chain())	911	for (StructureID structureID : m_polyProtoAccessChain->chain())
912	structureID.decode()->markIfCheap(visitor);	912	visitor.vm().getStructure(structureID)->markIfCheap(visitor);
913	}	913	}
914		914
915	switch (m_type) {	915	switch (m_type) {
916	case Transition:	916	case Transition:
917	case Delete:	917	case Delete:
918	if (visitor.isMarked(m_structureID->previousID()))	918	if (visitor.isMarked(m_structure->previousID()))
919	visitor.appendUnbarriered(m_structureID.get());	919	visitor.appendUnbarriered(m_structure.get());
920	break;	920	break;
921	default:	921	default:
922	break;	922	break;
Lines 1720-1726 void AccessCase::generateWithGuard( Source/JavaScriptCore/bytecode/AccessCase.cpp_sec5
1720	JSValueRegs resultRegs(scratchGPR, scratch2GPR);	1720	JSValueRegs resultRegs(scratchGPR, scratch2GPR);
1721	#endif	1721	#endif
1722		1722
1723	jit.emitLoadPrototype(vm, valueGPR, resultRegs, failAndIgnore);	1723	jit.emitLoadPrototype(vm, valueGPR, resultRegs, scratchGPR, failAndIgnore);
1724	jit.move(scratch2GPR, valueGPR);	1724	jit.move(scratch2GPR, valueGPR);
1725		1725
1726	CCallHelpers::Jump isInstance = jit.branchPtr(CCallHelpers::Equal, valueGPR, prototypeGPR);	1726	CCallHelpers::Jump isInstance = jit.branchPtr(CCallHelpers::Equal, valueGPR, prototypeGPR);
Lines 2613-2619 bool AccessCase::canBeShared(const Acces Source/JavaScriptCore/bytecode/AccessCase.cpp_sec6
2613	return false;	2613	return false;
2614	if (lhs.m_viaProxy != rhs.m_viaProxy)	2614	if (lhs.m_viaProxy != rhs.m_viaProxy)
2615	return false;	2615	return false;
2616	if (lhs.m_structureID.get() != rhs.m_structureID.get())	2616	if (lhs.m_structure.get() != rhs.m_structure.get())
2617	return false;	2617	return false;
2618	if (lhs.m_identifier != rhs.m_identifier)	2618	if (lhs.m_identifier != rhs.m_identifier)
2619	return false;	2619	return false;

Lines 1192-1197 template<typename Visitor> Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec1
- Source/JavaScriptCore/bytecode/CodeBlock.cpp -35 / +35 lines
1192	void CodeBlock::propagateTransitions(const ConcurrentJSLocker&, Visitor& visitor)	1192	void CodeBlock::propagateTransitions(const ConcurrentJSLocker&, Visitor& visitor)
1193	{	1193	{
1194	typename Visitor::SuppressGCVerifierScope suppressScope(visitor);	1194	typename Visitor::SuppressGCVerifierScope suppressScope(visitor);
		1195	VM& vm = *m_vm;
1195		1196
1196	if (jitType() == JITType::InterpreterThunk) {	1197	if (jitType() == JITType::InterpreterThunk) {
1197	if (m_metadata) {	1198	if (m_metadata) {
Lines 1201-1209 void CodeBlock::propagateTransitions(con Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec2
1201	if (!oldStructureID \|\| !newStructureID)	1202	if (!oldStructureID \|\| !newStructureID)
1202	return;	1203	return;
1203		1204
1204	Structure* oldStructure = oldStructureID.decode();	1205	Structure* oldStructure = vm.heap.structureIDTable().get(oldStructureID);
1205	if (visitor.isMarked(oldStructure)) {	1206	if (visitor.isMarked(oldStructure)) {
1206	Structure* newStructure = newStructureID.decode();	1207	Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
1207	visitor.appendUnbarriered(newStructure);	1208	visitor.appendUnbarriered(newStructure);
1208	}	1209	}
1209	});	1210	});
Lines 1219-1227 void CodeBlock::propagateTransitions(con Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec3
1219	if (!visitor.isMarked(property))	1220	if (!visitor.isMarked(property))
1220	return;	1221	return;
1221		1222
1222	Structure* oldStructure = oldStructureID.decode();	1223	Structure* oldStructure = vm.heap.structureIDTable().get(oldStructureID);
1223	if (visitor.isMarked(oldStructure)) {	1224	if (visitor.isMarked(oldStructure)) {
1224	Structure* newStructure = newStructureID.decode();	1225	Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
1225	visitor.appendUnbarriered(newStructure);	1226	visitor.appendUnbarriered(newStructure);
1226	}	1227	}
1227	});	1228	});
Lines 1237-1245 void CodeBlock::propagateTransitions(con Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec4
1237	if (!visitor.isMarked(brand))	1238	if (!visitor.isMarked(brand))
1238	return;	1239	return;
1239		1240
1240	Structure* oldStructure = oldStructureID.decode();	1241	Structure* oldStructure = vm.heap.structureIDTable().get(oldStructureID);
1241	if (visitor.isMarked(oldStructure)) {	1242	if (visitor.isMarked(oldStructure)) {
1242	Structure* newStructure = newStructureID.decode();	1243	Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
1243	visitor.appendUnbarriered(newStructure);	1244	visitor.appendUnbarriered(newStructure);
1244	}	1245	}
1245	});	1246	});
Lines 1268-1274 void CodeBlock::propagateTransitions(con Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec5
1268	dfgCommon->recordedStatuses.markIfCheap(visitor);	1269	dfgCommon->recordedStatuses.markIfCheap(visitor);
1269		1270
1270	for (StructureID structureID : dfgCommon->m_weakStructureReferences)	1271	for (StructureID structureID : dfgCommon->m_weakStructureReferences)
1271	structureID.decode()->markIfCheap(visitor);	1272	vm.getStructure(structureID)->markIfCheap(visitor);
1272		1273
1273	for (auto& transition : dfgCommon->m_transitions) {	1274	for (auto& transition : dfgCommon->m_transitions) {
1274	if (shouldMarkTransition(visitor, transition)) {	1275	if (shouldMarkTransition(visitor, transition)) {
Lines 1308-1314 void CodeBlock::determineLiveness(const Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec6
1308		1309
1309	#if ENABLE(DFG_JIT)	1310	#if ENABLE(DFG_JIT)
1310	VM& vm = *m_vm;	1311	VM& vm = *m_vm;
1311	UNUSED_VARIABLE(vm);
1312	if (visitor.isMarked(this))	1312	if (visitor.isMarked(this))
1313	return;	1313	return;
1314		1314
Lines 1333-1339 void CodeBlock::determineLiveness(const Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec7
1333	}	1333	}
1334	if (allAreLiveSoFar) {	1334	if (allAreLiveSoFar) {
1335	for (StructureID structureID : dfgCommon->m_weakStructureReferences) {	1335	for (StructureID structureID : dfgCommon->m_weakStructureReferences) {
1336	Structure* structure = structureID.decode();	1336	Structure* structure = vm.getStructure(structureID);
1337	if (!visitor.isMarked(structure)) {	1337	if (!visitor.isMarked(structure)) {
1338	allAreLiveSoFar = false;	1338	allAreLiveSoFar = false;
1339	break;	1339	break;
Lines 1367-1373 void CodeBlock::finalizeLLIntInlineCache Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec8
1367	if (modeMetadata.mode != GetByIdMode::Default)	1367	if (modeMetadata.mode != GetByIdMode::Default)
1368	return;	1368	return;
1369	StructureID oldStructureID = modeMetadata.defaultMode.structureID;	1369	StructureID oldStructureID = modeMetadata.defaultMode.structureID;
1370	if (!oldStructureID \|\| vm.heap.isMarked(oldStructureID.decode()))	1370	if (!oldStructureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
1371	return;	1371	return;
1372	dataLogLnIf(Options::verboseOSR(), "Clearing ", opName, " LLInt property access.");	1372	dataLogLnIf(Options::verboseOSR(), "Clearing ", opName, " LLInt property access.");
1373	LLIntPrototypeLoadAdaptiveStructureWatchpoint::clearLLIntGetByIdCache(modeMetadata);	1373	LLIntPrototypeLoadAdaptiveStructureWatchpoint::clearLLIntGetByIdCache(modeMetadata);
Lines 1388-1406 void CodeBlock::finalizeLLIntInlineCache Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec9
1388		1388
1389	m_metadata->forEach<OpTryGetById>([&] (auto& metadata) {	1389	m_metadata->forEach<OpTryGetById>([&] (auto& metadata) {
1390	StructureID oldStructureID = metadata.m_structureID;	1390	StructureID oldStructureID = metadata.m_structureID;
1391	if (!oldStructureID \|\| vm.heap.isMarked(oldStructureID.decode()))	1391	if (!oldStructureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
1392	return;	1392	return;
1393	dataLogLnIf(Options::verboseOSR(), "Clearing try_get_by_id LLInt property access.");	1393	dataLogLnIf(Options::verboseOSR(), "Clearing try_get_by_id LLInt property access.");
1394	metadata.m_structureID = StructureID();	1394	metadata.m_structureID = 0;
1395	metadata.m_offset = 0;	1395	metadata.m_offset = 0;
1396	});	1396	});
1397		1397
1398	m_metadata->forEach<OpGetByIdDirect>([&] (auto& metadata) {	1398	m_metadata->forEach<OpGetByIdDirect>([&] (auto& metadata) {
1399	StructureID oldStructureID = metadata.m_structureID;	1399	StructureID oldStructureID = metadata.m_structureID;
1400	if (!oldStructureID \|\| vm.heap.isMarked(oldStructureID.decode()))	1400	if (!oldStructureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
1401	return;	1401	return;
1402	dataLogLnIf(Options::verboseOSR(), "Clearing get_by_id_direct LLInt property access.");	1402	dataLogLnIf(Options::verboseOSR(), "Clearing get_by_id_direct LLInt property access.");
1403	metadata.m_structureID = StructureID();	1403	metadata.m_structureID = 0;
1404	metadata.m_offset = 0;	1404	metadata.m_offset = 0;
1405	});	1405	});
1406		1406
Lines 1408-1418 void CodeBlock::finalizeLLIntInlineCache Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec10
1408	JSCell* property = metadata.m_property.get();	1408	JSCell* property = metadata.m_property.get();
1409	StructureID structureID = metadata.m_structureID;	1409	StructureID structureID = metadata.m_structureID;
1410		1410
1411	if ((!property \|\| vm.heap.isMarked(property)) && (!structureID \|\| vm.heap.isMarked(structureID.decode())))	1411	if ((!property \|\| vm.heap.isMarked(property)) && (!structureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(structureID))))
1412	return;	1412	return;
1413		1413
1414	dataLogLnIf(Options::verboseOSR(), "Clearing LLInt private property access.");	1414	dataLogLnIf(Options::verboseOSR(), "Clearing LLInt private property access.");
1415	metadata.m_structureID = StructureID();	1415	metadata.m_structureID = 0;
1416	metadata.m_offset = 0;	1416	metadata.m_offset = 0;
1417	metadata.m_property.clear();	1417	metadata.m_property.clear();
1418	});	1418	});
Lines 1421-1434 void CodeBlock::finalizeLLIntInlineCache Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec11
1421	StructureID oldStructureID = metadata.m_oldStructureID;	1421	StructureID oldStructureID = metadata.m_oldStructureID;
1422	StructureID newStructureID = metadata.m_newStructureID;	1422	StructureID newStructureID = metadata.m_newStructureID;
1423	StructureChain* chain = metadata.m_structureChain.get();	1423	StructureChain* chain = metadata.m_structureChain.get();
1424	if ((!oldStructureID \|\| vm.heap.isMarked(oldStructureID.decode()))	1424	if ((!oldStructureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
1425	&& (!newStructureID \|\| vm.heap.isMarked(newStructureID.decode()))	1425	&& (!newStructureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(newStructureID)))
1426	&& (!chain \|\| vm.heap.isMarked(chain)))	1426	&& (!chain \|\| vm.heap.isMarked(chain)))
1427	return;	1427	return;
1428	dataLogLnIf(Options::verboseOSR(), "Clearing LLInt put transition.");	1428	dataLogLnIf(Options::verboseOSR(), "Clearing LLInt put transition.");
1429	metadata.m_oldStructureID = StructureID();	1429	metadata.m_oldStructureID = 0;
1430	metadata.m_offset = 0;	1430	metadata.m_offset = 0;
1431	metadata.m_newStructureID = StructureID();	1431	metadata.m_newStructureID = 0;
1432	metadata.m_structureChain.clear();	1432	metadata.m_structureChain.clear();
1433	});	1433	});
1434		1434
Lines 1436-1450 void CodeBlock::finalizeLLIntInlineCache Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec12
1436	StructureID oldStructureID = metadata.m_oldStructureID;	1436	StructureID oldStructureID = metadata.m_oldStructureID;
1437	StructureID newStructureID = metadata.m_newStructureID;	1437	StructureID newStructureID = metadata.m_newStructureID;
1438	JSCell* property = metadata.m_property.get();	1438	JSCell* property = metadata.m_property.get();
1439	if ((!oldStructureID \|\| vm.heap.isMarked(oldStructureID.decode()))	1439	if ((!oldStructureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
1440	&& (!property \|\| vm.heap.isMarked(property))	1440	&& (!property \|\| vm.heap.isMarked(property))
1441	&& (!newStructureID \|\| vm.heap.isMarked(newStructureID.decode())))	1441	&& (!newStructureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(newStructureID))))
1442	return;	1442	return;
1443		1443
1444	dataLogLnIf(Options::verboseOSR(), "Clearing LLInt put_private_name transition.");	1444	dataLogLnIf(Options::verboseOSR(), "Clearing LLInt put_private_name transition.");
1445	metadata.m_oldStructureID = StructureID();	1445	metadata.m_oldStructureID = 0;
1446	metadata.m_offset = 0;	1446	metadata.m_offset = 0;
1447	metadata.m_newStructureID = StructureID();	1447	metadata.m_newStructureID = 0;
1448	metadata.m_property.clear();	1448	metadata.m_property.clear();
1449	});	1449	});
1450		1450
Lines 1452-1488 void CodeBlock::finalizeLLIntInlineCache Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec13
1452	StructureID oldStructureID = metadata.m_oldStructureID;	1452	StructureID oldStructureID = metadata.m_oldStructureID;
1453	StructureID newStructureID = metadata.m_newStructureID;	1453	StructureID newStructureID = metadata.m_newStructureID;
1454	JSCell* brand = metadata.m_brand.get();	1454	JSCell* brand = metadata.m_brand.get();
1455	if ((!oldStructureID \|\| vm.heap.isMarked(oldStructureID.decode()))	1455	if ((!oldStructureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
1456	&& (!brand \|\| vm.heap.isMarked(brand))	1456	&& (!brand \|\| vm.heap.isMarked(brand))
1457	&& (!newStructureID \|\| vm.heap.isMarked(newStructureID.decode())))	1457	&& (!newStructureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(newStructureID))))
1458	return;	1458	return;
1459		1459
1460	dataLogLnIf(Options::verboseOSR(), "Clearing LLInt set_private_brand transition.");	1460	dataLogLnIf(Options::verboseOSR(), "Clearing LLInt set_private_brand transition.");
1461	metadata.m_oldStructureID = StructureID();	1461	metadata.m_oldStructureID = 0;
1462	metadata.m_newStructureID = StructureID();	1462	metadata.m_newStructureID = 0;
1463	metadata.m_brand.clear();	1463	metadata.m_brand.clear();
1464	});	1464	});
1465		1465
1466	m_metadata->forEach<OpCheckPrivateBrand>([&] (auto& metadata) {	1466	m_metadata->forEach<OpCheckPrivateBrand>([&] (auto& metadata) {
1467	StructureID structureID = metadata.m_structureID;	1467	StructureID structureID = metadata.m_structureID;
1468	JSCell* brand = metadata.m_brand.get();	1468	JSCell* brand = metadata.m_brand.get();
1469	if ((!structureID \|\| vm.heap.isMarked(structureID.decode()))	1469	if ((!structureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(structureID)))
1470	&& (!brand \|\| vm.heap.isMarked(brand)))	1470	&& (!brand \|\| vm.heap.isMarked(brand)))
1471	return;	1471	return;
1472		1472
1473	dataLogLnIf(Options::verboseOSR(), "Clearing LLInt check_private_brand transition.");	1473	dataLogLnIf(Options::verboseOSR(), "Clearing LLInt check_private_brand transition.");
1474	metadata.m_structureID = StructureID();	1474	metadata.m_structureID = 0;
1475	metadata.m_brand.clear();	1475	metadata.m_brand.clear();
1476	});	1476	});
1477		1477
1478	m_metadata->forEach<OpToThis>([&] (auto& metadata) {	1478	m_metadata->forEach<OpToThis>([&] (auto& metadata) {
1479	if (!metadata.m_cachedStructureID \|\| vm.heap.isMarked(metadata.m_cachedStructureID.decode()))	1479	if (!metadata.m_cachedStructureID \|\| vm.heap.isMarked(vm.heap.structureIDTable().get(metadata.m_cachedStructureID)))
1480	return;	1480	return;
1481	if (Options::verboseOSR()) {	1481	if (Options::verboseOSR()) {
1482	Structure* structure = metadata.m_cachedStructureID.decode();	1482	Structure* structure = vm.heap.structureIDTable().get(metadata.m_cachedStructureID);
1483	dataLogF("Clearing LLInt to_this with structure %p.\n", structure);	1483	dataLogF("Clearing LLInt to_this with structure %p.\n", structure);
1484	}	1484	}
1485	metadata.m_cachedStructureID = StructureID();	1485	metadata.m_cachedStructureID = 0;
1486	metadata.m_toThisStatus = merge(metadata.m_toThisStatus, ToThisClearedByGC);	1486	metadata.m_toThisStatus = merge(metadata.m_toThisStatus, ToThisClearedByGC);
1487	});	1487	});
1488		1488
Lines 1569-1575 void CodeBlock::finalizeLLIntInlineCache Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec14
1569	return true;	1569	return true;
1570	};	1570	};
1571		1571
1572	if (!vm.heap.isMarked(std::get<0>(pair.key).decode()))	1572	if (!vm.heap.isMarked(vm.heap.structureIDTable().get(std::get<0>(pair.key))))
1573	return clear();	1573	return clear();
1574		1574
1575	for (const LLIntPrototypeLoadAdaptiveStructureWatchpoint& watchpoint : pair.value) {	1575	for (const LLIntPrototypeLoadAdaptiveStructureWatchpoint& watchpoint : pair.value) {
Lines 1917-1923 void CodeBlock::stronglyVisitWeakReferen Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec15
1917	visitor.append(weakReference);	1917	visitor.append(weakReference);
1918		1918
1919	for (StructureID structureID : dfgCommon->m_weakStructureReferences)	1919	for (StructureID structureID : dfgCommon->m_weakStructureReferences)
1920	visitor.appendUnbarriered(structureID.decode());	1920	visitor.appendUnbarriered(visitor.vm().getStructure(structureID));
1921	#endif	1921	#endif
1922	}	1922	}
1923		1923

Lines 2201-2207 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec1
- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h -3 / +3 lines
2201	// And we check the indexing mode of the structure. If the indexing mode is CoW, the butterfly is	2201	// And we check the indexing mode of the structure. If the indexing mode is CoW, the butterfly is
2202	// definitely JSImmutableButterfly.	2202	// definitely JSImmutableButterfly.
2203	StructureID structureIDEarly = array->structureID();	2203	StructureID structureIDEarly = array->structureID();
2204	if (structureIDEarly.isNuked())	2204	if (isNuked(structureIDEarly))
2205	return false;	2205	return false;
2206		2206
2207	if (node->arrayMode().arrayClass() == Array::OriginalCopyOnWriteArray) {	2207	if (node->arrayMode().arrayClass() == Array::OriginalCopyOnWriteArray) {
Lines 2215-2221 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec2
2215	if (structureIDEarly != structureIDLate)	2215	if (structureIDEarly != structureIDLate)
2216	return false;	2216	return false;
2217		2217
2218	Structure* structure = structureIDLate.decode();	2218	Structure* structure = m_vm.getStructure(structureIDLate);
2219	switch (node->arrayMode().type()) {	2219	switch (node->arrayMode().type()) {
2220	case Array::Int32:	2220	case Array::Int32:
2221	case Array::Contiguous:	2221	case Array::Contiguous:
Lines 2273-2279 bool AbstractInterpreter<AbstractStateTy Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec3
2273	if (structureIDEarly != structureIDLate)	2273	if (structureIDEarly != structureIDLate)
2274	return false;	2274	return false;
2275		2275
2276	Structure* structure = structureIDLate.decode();	2276	Structure* structure = m_vm.getStructure(structureIDLate);
2277	if (!hasAnyArrayStorage(structure->indexingMode()))	2277	if (!hasAnyArrayStorage(structure->indexingMode()))
2278	return false;	2278	return false;
2279		2279

Lines 8533-8539 void SpeculativeJIT::compileGetGlobalObj Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp -17 / +19 lines
8533	{	8533	{
8534	SpeculateCellOperand object(this, node->child1());	8534	SpeculateCellOperand object(this, node->child1());
8535	GPRTemporary result(this);	8535	GPRTemporary result(this);
8536	m_jit.emitLoadStructure(vm(), object.gpr(), result.gpr());	8536	GPRTemporary scratch(this);
		8537	m_jit.emitLoadStructure(vm(), object.gpr(), result.gpr(), scratch.gpr());
8537	m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::globalObjectOffset()), result.gpr());	8538	m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::globalObjectOffset()), result.gpr());
8538	cellResult(result.gpr(), node);	8539	cellResult(result.gpr(), node);
8539	}	8540	}
Lines 11041-11047 void SpeculativeJIT::compileCheckJSCast( Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec2
11041	GPRReg otherGPR = other.gpr();	11042	GPRReg otherGPR = other.gpr();
11042	GPRReg specifiedGPR = specified.gpr();	11043	GPRReg specifiedGPR = specified.gpr();
11043		11044
11044	m_jit.emitLoadStructure(vm(), baseGPR, otherGPR);	11045	m_jit.emitLoadStructure(vm(), baseGPR, otherGPR, specifiedGPR);
11045	m_jit.loadPtr(CCallHelpers::Address(otherGPR, Structure::classInfoOffset()), otherGPR);	11046	m_jit.loadPtr(CCallHelpers::Address(otherGPR, Structure::classInfoOffset()), otherGPR);
11046	m_jit.move(CCallHelpers::TrustedImmPtr(node->classInfo()), specifiedGPR);	11047	m_jit.move(CCallHelpers::TrustedImmPtr(node->classInfo()), specifiedGPR);
11047		11048
Lines 11252-11258 void SpeculativeJIT::compileFunctionToSt Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec3
11252		11253
11253	speculateFunction(node->child1(), function.gpr());	11254	speculateFunction(node->child1(), function.gpr());
11254		11255
11255	m_jit.emitLoadStructure(vm(), function.gpr(), result.gpr());	11256	m_jit.emitLoadStructure(vm(), function.gpr(), result.gpr(), executable.gpr());
11256	m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::classInfoOffset()), result.gpr());	11257	m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::classInfoOffset()), result.gpr());
11257	static_assert(std::is_final_v<JSBoundFunction>, "We don't handle subclasses when comparing classInfo below");	11258	static_assert(std::is_final_v<JSBoundFunction>, "We don't handle subclasses when comparing classInfo below");
11258	slowCases.append(m_jit.branchPtr(CCallHelpers::Equal, result.gpr(), TrustedImmPtr(JSBoundFunction::info())));	11259	slowCases.append(m_jit.branchPtr(CCallHelpers::Equal, result.gpr(), TrustedImmPtr(JSBoundFunction::info())));
Lines 14267-14277 void SpeculativeJIT::compileGetPropertyE Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec4
14267	if (node->child1().useKind() == CellUse \|\| node->child1().useKind() == CellOrOtherUse) {	14268	if (node->child1().useKind() == CellUse \|\| node->child1().useKind() == CellOrOtherUse) {
14268	JSValueOperand base(this, node->child1(), ManualOperandSpeculation);	14269	JSValueOperand base(this, node->child1(), ManualOperandSpeculation);
14269	GPRTemporary scratch1(this);	14270	GPRTemporary scratch1(this);
		14271	GPRTemporary scratch2(this);
14270		14272
14271	speculate(node, node->child1());	14273	speculate(node, node->child1());
14272		14274
14273	JSValueRegs baseRegs = base.jsValueRegs();	14275	JSValueRegs baseRegs = base.jsValueRegs();
14274	GPRReg scratch1GPR = scratch1.gpr();	14276	GPRReg scratch1GPR = scratch1.gpr();
		14277	GPRReg scratch2GPR = scratch2.gpr();
14275		14278
14276	CCallHelpers::JumpList slowCases;	14279	CCallHelpers::JumpList slowCases;
14277	CCallHelpers::JumpList doneCases;	14280	CCallHelpers::JumpList doneCases;
Lines 14323-14329 void SpeculativeJIT::compileGetPropertyE Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec5
14323	if (onlyStructure)	14326	if (onlyStructure)
14324	m_jit.move(TrustedImmPtr(onlyStructure), scratch1GPR);	14327	m_jit.move(TrustedImmPtr(onlyStructure), scratch1GPR);
14325	else	14328	else
14326	m_jit.emitLoadStructure(vm(), baseRegs.payloadGPR(), scratch1GPR);	14329	m_jit.emitLoadStructure(vm(), baseRegs.payloadGPR(), scratch1GPR, scratch2GPR);
14327	m_jit.loadPtr(CCallHelpers::Address(scratch1GPR, Structure::previousOrRareDataOffset()), scratch1GPR);	14330	m_jit.loadPtr(CCallHelpers::Address(scratch1GPR, Structure::previousOrRareDataOffset()), scratch1GPR);
14328	slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, scratch1GPR));	14331	slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, scratch1GPR));
14329	slowCases.append(m_jit.branchIfStructure(scratch1GPR));	14332	slowCases.append(m_jit.branchIfStructure(scratch1GPR));
Lines 14335-14341 void SpeculativeJIT::compileGetPropertyE Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec6
14335	doneCases.append(m_jit.jump());	14338	doneCases.append(m_jit.jump());
14336		14339
14337	slowCases.link(&m_jit);	14340	slowCases.link(&m_jit);
14338	silentSpillAllRegisters(scratch1GPR);	14341	silentSpillAllRegisters(scratch1GPR, scratch2GPR);
14339	callOperation(operationGetPropertyEnumeratorCell, scratch1GPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs.payloadGPR());	14342	callOperation(operationGetPropertyEnumeratorCell, scratch1GPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs.payloadGPR());
14340	silentFillAllRegisters();	14343	silentFillAllRegisters();
14341	m_jit.exceptionCheck();	14344	m_jit.exceptionCheck();
Lines 14602-14608 void SpeculativeJIT::compileObjectKeysOr Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec7
14602	speculateObject(node->child1(), objectGPR);	14605	speculateObject(node->child1(), objectGPR);
14603		14606
14604	CCallHelpers::JumpList slowCases;	14607	CCallHelpers::JumpList slowCases;
14605	m_jit.emitLoadStructure(vm(), objectGPR, structureGPR);	14608	m_jit.emitLoadStructure(vm(), objectGPR, structureGPR, scratchGPR);
14606	m_jit.loadPtr(CCallHelpers::Address(structureGPR, Structure::previousOrRareDataOffset()), scratchGPR);	14609	m_jit.loadPtr(CCallHelpers::Address(structureGPR, Structure::previousOrRareDataOffset()), scratchGPR);
14607		14610
14608	slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, scratchGPR));	14611	slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, scratchGPR));
Lines 14819-14827 void SpeculativeJIT::compileCreatePromis Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec8
14819	slowCases.append(m_jit.branchIfNotFunction(calleeGPR));	14822	slowCases.append(m_jit.branchIfNotFunction(calleeGPR));
14820	m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfExecutableOrRareData()), rareDataGPR);	14823	m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfExecutableOrRareData()), rareDataGPR);
14821	slowCases.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR, CCallHelpers::TrustedImm32(JSFunction::rareDataTag)));	14824	slowCases.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR, CCallHelpers::TrustedImm32(JSFunction::rareDataTag)));
14822	m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructureID() - JSFunction::rareDataTag), structureGPR);	14825	m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructure() - JSFunction::rareDataTag), structureGPR);
14823	slowCases.append(m_jit.branchTest32(CCallHelpers::Zero, structureGPR));	14826	slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, structureGPR));
14824	m_jit.emitNonNullDecodeStructureID(structureGPR, structureGPR);
14825	m_jit.move(TrustedImmPtr(node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info()), scratch1GPR);	14827	m_jit.move(TrustedImmPtr(node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info()), scratch1GPR);
14826	slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));	14828	slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));
14827	m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), scratch1GPR);	14829	m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), scratch1GPR);
Lines 14868-14876 void SpeculativeJIT::compileCreateIntern Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec9
14868	slowCases.append(m_jit.branchIfNotFunction(calleeGPR));	14870	slowCases.append(m_jit.branchIfNotFunction(calleeGPR));
14869	m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfExecutableOrRareData()), rareDataGPR);	14871	m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfExecutableOrRareData()), rareDataGPR);
14870	slowCases.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR, CCallHelpers::TrustedImm32(JSFunction::rareDataTag)));	14872	slowCases.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR, CCallHelpers::TrustedImm32(JSFunction::rareDataTag)));
14871	m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructureID() - JSFunction::rareDataTag), structureGPR);	14873	m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructure() - JSFunction::rareDataTag), structureGPR);
14872	slowCases.append(m_jit.branchTest32(CCallHelpers::Zero, structureGPR));	14874	slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, structureGPR));
14873	m_jit.emitNonNullDecodeStructureID(structureGPR, structureGPR);
14874	m_jit.move(TrustedImmPtr(JSClass::info()), scratch1GPR);	14875	m_jit.move(TrustedImmPtr(JSClass::info()), scratch1GPR);
14875	slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));	14876	slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));
14876	m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), scratch1GPR);	14877	m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), scratch1GPR);
Lines 15331-15344 void SpeculativeJIT::compileWeakMapSet(N Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec10
15331	void SpeculativeJIT::compileGetPrototypeOf(Node* node)	15332	void SpeculativeJIT::compileGetPrototypeOf(Node* node)
15332	{	15333	{
15333	GPRTemporary temp(this);	15334	GPRTemporary temp(this);
		15335	GPRTemporary temp2(this);
15334		15336
15335	GPRReg tempGPR = temp.gpr();	15337	GPRReg tempGPR = temp.gpr();
		15338	GPRReg temp2GPR = temp2.gpr();
15336		15339
15337	#if USE(JSVALUE64)	15340	#if USE(JSVALUE64)
15338	JSValueRegs resultRegs(tempGPR);	15341	JSValueRegs resultRegs(tempGPR);
15339	#else	15342	#else
15340	GPRTemporary temp2(this);	15343	JSValueRegs resultRegs(temp2GPR, tempGPR);
15341	JSValueRegs resultRegs(temp2.gpr(), tempGPR);
15342	#endif	15344	#endif
15343		15345
15344	switch (node->child1().useKind()) {	15346	switch (node->child1().useKind()) {
Lines 15363-15369 void SpeculativeJIT::compileGetPrototype Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec11
15363	break;	15365	break;
15364	}	15366	}
15365		15367
15366	m_jit.emitLoadStructure(vm(), objectGPR, tempGPR);	15368	m_jit.emitLoadStructure(vm(), objectGPR, tempGPR, temp2GPR);
15367		15369
15368	AbstractValue& value = m_state.forNode(node->child1());	15370	AbstractValue& value = m_state.forNode(node->child1());
15369	if ((value.m_type && !(value.m_type & ~SpecObject)) && value.m_structure.isFinite()) {	15371	if ((value.m_type && !(value.m_type & ~SpecObject)) && value.m_structure.isFinite()) {
Lines 15402-15408 void SpeculativeJIT::compileGetPrototype Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec12
15402	speculateObject(node->child1(), objectGPR);	15404	speculateObject(node->child1(), objectGPR);
15403		15405
15404	JITCompiler::JumpList slowCases;	15406	JITCompiler::JumpList slowCases;
15405	m_jit.emitLoadPrototype(vm(), objectGPR, resultRegs, slowCases);	15407	m_jit.emitLoadPrototype(vm(), objectGPR, resultRegs, temp2GPR, slowCases);
15406	addSlowPathGenerator(slowPathCall(slowCases, this, operationGetPrototypeOfObject,	15408	addSlowPathGenerator(slowPathCall(slowCases, this, operationGetPrototypeOfObject,
15407	resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR));	15409	resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR));
15408		15410
Lines 15419-15425 void SpeculativeJIT::compileGetPrototype Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec13
15419	GPRReg valueGPR = valueRegs.payloadGPR();	15421	GPRReg valueGPR = valueRegs.payloadGPR();
15420	slowCases.append(m_jit.branchIfNotObject(valueGPR));	15422	slowCases.append(m_jit.branchIfNotObject(valueGPR));
15421		15423
15422	m_jit.emitLoadPrototype(vm(), valueGPR, resultRegs, slowCases);	15424	m_jit.emitLoadPrototype(vm(), valueGPR, resultRegs, temp2GPR, slowCases);
15423	addSlowPathGenerator(slowPathCall(slowCases, this, operationGetPrototypeOf,	15425	addSlowPathGenerator(slowPathCall(slowCases, this, operationGetPrototypeOf,
15424	resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs));	15426	resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs));
15425		15427

Lines 7877-7887 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec1
- Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp -24 / +21 lines
7877		7877
7878	m_out.appendTo(hasRareData, hasStructure);	7878	m_out.appendTo(hasRareData, hasStructure);
7879	LValue rareData = m_out.sub(rareDataTags, m_out.constIntPtr(JSFunction::rareDataTag));	7879	LValue rareData = m_out.sub(rareDataTags, m_out.constIntPtr(JSFunction::rareDataTag));
7880	LValue structureID = m_out.load32(rareData, m_heaps.FunctionRareData_internalFunctionAllocationProfile_structureID);	7880	LValue structure = m_out.loadPtr(rareData, m_heaps.FunctionRareData_internalFunctionAllocationProfile_structure);
7881	m_out.branch(m_out.isZero32(structureID), rarely(slowCase), usually(hasStructure));	7881	m_out.branch(m_out.isZero64(structure), rarely(slowCase), usually(hasStructure));
7882		7882
7883	m_out.appendTo(hasStructure, checkGlobalObjectCase);	7883	m_out.appendTo(hasStructure, checkGlobalObjectCase);
7884	LValue structure = decodeNonNullStructure(structureID);
7885	m_out.branch(m_out.equal(m_out.loadPtr(structure, m_heaps.Structure_classInfo), m_out.constIntPtr(m_node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info())), usually(checkGlobalObjectCase), rarely(slowCase));	7884	m_out.branch(m_out.equal(m_out.loadPtr(structure, m_heaps.Structure_classInfo), m_out.constIntPtr(m_node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info())), usually(checkGlobalObjectCase), rarely(slowCase));
7886		7885
7887	m_out.appendTo(checkGlobalObjectCase, fastAllocationCase);	7886	m_out.appendTo(checkGlobalObjectCase, fastAllocationCase);
Lines 7933-7943 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec2
7933		7932
7934	m_out.appendTo(hasRareData, hasStructure);	7933	m_out.appendTo(hasRareData, hasStructure);
7935	LValue rareData = m_out.sub(rareDataTags, m_out.constIntPtr(JSFunction::rareDataTag));	7934	LValue rareData = m_out.sub(rareDataTags, m_out.constIntPtr(JSFunction::rareDataTag));
7936	LValue structureID = m_out.load32(rareData, m_heaps.FunctionRareData_internalFunctionAllocationProfile_structureID);	7935	LValue structure = m_out.loadPtr(rareData, m_heaps.FunctionRareData_internalFunctionAllocationProfile_structure);
7937	m_out.branch(m_out.isZero32(structureID), rarely(slowCase), usually(hasStructure));	7936	m_out.branch(m_out.isZero64(structure), rarely(slowCase), usually(hasStructure));
7938		7937
7939	m_out.appendTo(hasStructure, checkGlobalObjectCase);	7938	m_out.appendTo(hasStructure, checkGlobalObjectCase);
7940	LValue structure = decodeNonNullStructure(structureID);
7941	m_out.branch(m_out.equal(m_out.loadPtr(structure, m_heaps.Structure_classInfo), m_out.constIntPtr(JSClass::info())), usually(checkGlobalObjectCase), rarely(slowCase));	7939	m_out.branch(m_out.equal(m_out.loadPtr(structure, m_heaps.Structure_classInfo), m_out.constIntPtr(JSClass::info())), usually(checkGlobalObjectCase), rarely(slowCase));
7942		7940
7943	m_out.appendTo(checkGlobalObjectCase, fastAllocationCase);	7941	m_out.appendTo(checkGlobalObjectCase, fastAllocationCase);
Lines 13712-13718 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec3
13712	LValue structureID;	13710	LValue structureID;
13713	auto structure = m_state.forNode(baseEdge.node()).m_structure.onlyStructure();	13711	auto structure = m_state.forNode(baseEdge.node()).m_structure.onlyStructure();
13714	if (structure)	13712	if (structure)
13715	structureID = m_out.constInt32(structure->id().bits());	13713	structureID = m_out.constInt32(structure->id());
13716	else	13714	else
13717	structureID = m_out.load32(base, m_heaps.JSCell_structureID);	13715	structureID = m_out.load32(base, m_heaps.JSCell_structureID);
13718		13716
Lines 16791-16797 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec4
16791		16789
16792	void storeStructure(LValue object, Structure* structure)	16790	void storeStructure(LValue object, Structure* structure)
16793	{	16791	{
16794	m_out.store32(m_out.constInt32(structure->id().bits()), object, m_heaps.JSCell_structureID);	16792	m_out.store32(m_out.constInt32(structure->id()), object, m_heaps.JSCell_structureID);
16795	m_out.store32(	16793	m_out.store32(
16796	m_out.constInt32(structure->objectInitializationBlob()),	16794	m_out.constInt32(structure->objectInitializationBlob()),
16797	object, m_heaps.JSCell_usefulBytes);	16795	object, m_heaps.JSCell_usefulBytes);
Lines 19572-19578 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec5
19572	return proven;	19570	return proven;
19573	return m_out.notEqual(	19571	return m_out.notEqual(
19574	m_out.load32(cell, m_heaps.JSCell_structureID),	19572	m_out.load32(cell, m_heaps.JSCell_structureID),
19575	m_out.constInt32(vm().stringStructure->id().bits()));	19573	m_out.constInt32(vm().stringStructure->id()));
19576	}	19574	}
19577		19575
19578	LValue isString(LValue cell, SpeculatedType type = SpecFullTop)	19576	LValue isString(LValue cell, SpeculatedType type = SpecFullTop)
Lines 19581-19587 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec6
19581	return proven;	19579	return proven;
19582	return m_out.equal(	19580	return m_out.equal(
19583	m_out.load32(cell, m_heaps.JSCell_structureID),	19581	m_out.load32(cell, m_heaps.JSCell_structureID),
19584	m_out.constInt32(vm().stringStructure->id().bits()));	19582	m_out.constInt32(vm().stringStructure->id()));
19585	}	19583	}
19586		19584
19587	LValue isRopeString(LValue string, Edge edge = Edge())	19585	LValue isRopeString(LValue string, Edge edge = Edge())
Lines 19628-19634 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec7
19628	return proven;	19626	return proven;
19629	return m_out.notEqual(	19627	return m_out.notEqual(
19630	m_out.load32(cell, m_heaps.JSCell_structureID),	19628	m_out.load32(cell, m_heaps.JSCell_structureID),
19631	m_out.constInt32(vm().symbolStructure->id().bits()));	19629	m_out.constInt32(vm().symbolStructure->id()));
19632	}	19630	}
19633		19631
19634	LValue isSymbol(LValue cell, SpeculatedType type = SpecFullTop)	19632	LValue isSymbol(LValue cell, SpeculatedType type = SpecFullTop)
Lines 19637-19643 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec8
19637	return proven;	19635	return proven;
19638	return m_out.equal(	19636	return m_out.equal(
19639	m_out.load32(cell, m_heaps.JSCell_structureID),	19637	m_out.load32(cell, m_heaps.JSCell_structureID),
19640	m_out.constInt32(vm().symbolStructure->id().bits()));	19638	m_out.constInt32(vm().symbolStructure->id()));
19641	}	19639	}
19642		19640
19643	LValue isNotHeapBigIntUnknownWhetherCell(LValue value, SpeculatedType type = SpecFullTop)	19641	LValue isNotHeapBigIntUnknownWhetherCell(LValue value, SpeculatedType type = SpecFullTop)
Lines 19666-19672 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec9
19666	return proven;	19664	return proven;
19667	return m_out.notEqual(	19665	return m_out.notEqual(
19668	m_out.load32(cell, m_heaps.JSCell_structureID),	19666	m_out.load32(cell, m_heaps.JSCell_structureID),
19669	m_out.constInt32(vm().bigIntStructure->id().bits()));	19667	m_out.constInt32(vm().bigIntStructure->id()));
19670	}	19668	}
19671		19669
19672	LValue isHeapBigInt(LValue cell, SpeculatedType type = SpecFullTop)	19670	LValue isHeapBigInt(LValue cell, SpeculatedType type = SpecFullTop)
Lines 19675-19681 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec10
19675	return proven;	19673	return proven;
19676	return m_out.equal(	19674	return m_out.equal(
19677	m_out.load32(cell, m_heaps.JSCell_structureID),	19675	m_out.load32(cell, m_heaps.JSCell_structureID),
19678	m_out.constInt32(vm().bigIntStructure->id().bits()));	19676	m_out.constInt32(vm().bigIntStructure->id()));
19679	}	19677	}
19680		19678
19681	LValue isArrayTypeForArrayify(LValue cell, ArrayMode arrayMode)	19679	LValue isArrayTypeForArrayify(LValue cell, ArrayMode arrayMode)
Lines 20402-20408 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec11
20402	m_out.store32(	20400	m_out.store32(
20403	m_out.bitOr(	20401	m_out.bitOr(
20404	m_out.load32(object, m_heaps.JSCell_structureID),	20402	m_out.load32(object, m_heaps.JSCell_structureID),
20405	m_out.constInt32(StructureID::nukedStructureIDBit)),	20403	m_out.constInt32(nukedStructureIDBit())),
20406	object, m_heaps.JSCell_structureID);	20404	object, m_heaps.JSCell_structureID);
20407	m_out.fence(&m_heaps.root, nullptr);	20405	m_out.fence(&m_heaps.root, nullptr);
20408	m_out.storePtr(butterfly, object, m_heaps.JSObject_butterfly);	20406	m_out.storePtr(butterfly, object, m_heaps.JSObject_butterfly);
Lines 20430-20436 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec12
20430	m_out.store32(	20428	m_out.store32(
20431	m_out.bitOr(	20429	m_out.bitOr(
20432	m_out.load32(object, m_heaps.JSCell_structureID),	20430	m_out.load32(object, m_heaps.JSCell_structureID),
20433	m_out.constInt32(StructureID::nukedStructureIDBit)),	20431	m_out.constInt32(nukedStructureIDBit())),
20434	object, m_heaps.JSCell_structureID);	20432	object, m_heaps.JSCell_structureID);
20435	m_out.fence(&m_heaps.root, nullptr);	20433	m_out.fence(&m_heaps.root, nullptr);
20436	m_out.storePtr(butterfly, object, m_heaps.JSObject_butterfly);	20434	m_out.storePtr(butterfly, object, m_heaps.JSObject_butterfly);
Lines 20975-20990 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec13
20975	m_graph.m_plan.weakReferences().addLazily(target);	20973	m_graph.m_plan.weakReferences().addLazily(target);
20976	}	20974	}
20977		20975
20978	LValue decodeNonNullStructure(LValue structureID)
20979	{
20980	LValue maskedStructureID = m_out.bitAnd(structureID, m_out.constInt32(structureIDMask));
20981	return m_out.add(m_out.constIntPtr(g_jscConfig.startOfStructureHeap), m_out.zeroExtPtr(maskedStructureID));
20982	}
20983
20984	LValue loadStructure(LValue value)	20976	LValue loadStructure(LValue value)
20985	{	20977	{
20986	LValue structureID = m_out.load32(value, m_heaps.JSCell_structureID);	20978	LValue structureID = m_out.load32(value, m_heaps.JSCell_structureID);
20987	return decodeNonNullStructure(structureID);	20979	LValue tableBase = m_out.loadPtr(m_out.absolute(vm().heap.structureIDTable().base()));
		20980	LValue tableIndex = m_out.aShr(structureID, m_out.constInt32(StructureIDTable::s_numberOfEntropyBits));
		20981	LValue entropyBits = m_out.shl(m_out.zeroExtPtr(structureID), m_out.constInt32(StructureIDTable::s_entropyBitsShiftForStructurePointer));
		20982	TypedPointer address = m_out.baseIndex(m_heaps.structureTable, tableBase, m_out.zeroExtPtr(tableIndex));
		20983	LValue encodedStructureBits = m_out.loadPtr(address);
		20984	return m_out.bitXor(encodedStructureBits, entropyBits);
20988	}	20985	}
20989		20986
20990	LValue weakPointer(JSCell* pointer)	20987	LValue weakPointer(JSCell* pointer)
Lines 21000-21006 IGNORE_CLANG_WARNINGS_END Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp_sec14
21000		20997
21001	LValue weakStructureID(RegisteredStructure structure)	20998	LValue weakStructureID(RegisteredStructure structure)
21002	{	20999	{
21003	return m_out.constInt32(structure->id().bits());	21000	return m_out.constInt32(structure->id());
21004	}	21001	}
21005		21002
21006	LValue weakStructure(RegisteredStructure structure)	21003	LValue weakStructure(RegisteredStructure structure)

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +331 lines
		1	2021-12-13 Saam Barati <sbarati@apple.com>
		2
		3	Roll back r286345, r286387, r286471, r286667, r286849
		4	https://bugs.webkit.org/show_bug.cgi?id=234268
		5
		6	Reviewed by Mark Lam.
		7
		8	* CMakeLists.txt:
		9	* JavaScriptCore.xcodeproj/project.pbxproj:
		10	* Sources.txt:
		11	* bytecode/AccessCase.cpp:
		12	(JSC::AccessCase::AccessCase):
		13	(JSC::AccessCase::forEachDependentCell const):
		14	(JSC::AccessCase::dump const):
		15	(JSC::AccessCase::propagateTransitions const):
		16	(JSC::AccessCase::generateWithGuard):
		17	(JSC::AccessCase::canBeShared):
		18	* bytecode/AccessCase.h:
		19	(JSC::AccessCase::structure const):
		20	(JSC::AccessCase::newStructure const):
		21	(JSC::AccessCase::hash const):
		22	(JSC::AccessCase::AccessCase):
		23	* bytecode/ArrayProfile.cpp:
		24	(JSC::ArrayProfile::computeUpdatedPrediction):
		25	* bytecode/ArrayProfile.h:
		26	* bytecode/CheckPrivateBrandStatus.cpp:
		27	(JSC::CheckPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
		28	* bytecode/CodeBlock.cpp:
		29	(JSC::CodeBlock::propagateTransitions):
		30	(JSC::CodeBlock::determineLiveness):
		31	(JSC::CodeBlock::finalizeLLIntInlineCaches):
		32	(JSC::CodeBlock::stronglyVisitWeakReferences):
		33	* bytecode/DeleteByStatus.cpp:
		34	(JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback):
		35	* bytecode/GetByIdMetadata.h:
		36	(JSC::GetByIdModeMetadata::GetByIdModeMetadata):
		37	(JSC::GetByIdModeMetadata::clearToDefaultModeWithoutCache):
		38	* bytecode/GetByStatus.cpp:
		39	(JSC::GetByStatus::computeFromLLInt):
		40	(JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
		41	* bytecode/InByStatus.cpp:
		42	(JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
		43	* bytecode/InlineAccess.cpp:
		44	(JSC::InlineAccess::rewireStubAsJumpInAccess):
		45	(JSC::InlineAccess::resetStubAsJumpInAccess):
		46	* bytecode/InstanceOfStatus.cpp:
		47	(JSC::InstanceOfStatus::computeForStubInfo):
		48	* bytecode/InternalFunctionAllocationProfile.h:
		49	(JSC::InternalFunctionAllocationProfile::offsetOfStructure):
		50	(JSC::InternalFunctionAllocationProfile::structure):
		51	(JSC::InternalFunctionAllocationProfile::clear):
		52	(JSC::InternalFunctionAllocationProfile::visitAggregate):
		53	(JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
		54	(JSC::InternalFunctionAllocationProfile::offsetOfStructureID): Deleted.
		55	* bytecode/PolyProtoAccessChain.cpp:
		56	(JSC::PolyProtoAccessChain::needImpurePropertyWatchpoint const):
		57	* bytecode/PolyProtoAccessChain.h:
		58	* bytecode/PolymorphicAccess.cpp:
		59	(JSC::PolymorphicAccess::visitWeak const):
		60	* bytecode/PutByIdFlags.h:
		61	* bytecode/PutByStatus.cpp:
		62	(JSC::PutByStatus::computeFromLLInt):
		63	(JSC::PutByStatus::computeForStubInfo):
		64	* bytecode/SetPrivateBrandStatus.cpp:
65	(JSC::SetPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
66	* bytecode/SpeculatedType.cpp:
67	(JSC::speculationFromCell):
68	* bytecode/StructureStubInfo.cpp:
69	(JSC::StructureStubInfo::initGetByIdSelf):
70	(JSC::StructureStubInfo::initPutByIdReplace):
71	(JSC::StructureStubInfo::initInByIdSelf):
72	(JSC::StructureStubInfo::deref):
73	(JSC::StructureStubInfo::aboutToDie):
74	(JSC::StructureStubInfo::addAccessCase):
75	(JSC::StructureStubInfo::reset):
76	(JSC::StructureStubInfo::visitAggregateImpl):
77	(JSC::StructureStubInfo::visitWeakReferences):
78	(JSC::StructureStubInfo::propagateTransitions):
79	(JSC::StructureStubInfo::summary const):
80	(JSC::StructureStubInfo::containsPC const):
81	* bytecode/StructureStubInfo.h:
82	(JSC::StructureStubInfo::offsetOfByIdSelfOffset):
83	(JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
84	(JSC::StructureStubInfo::inlineAccessBaseStructure):
85	(JSC::StructureStubInfo::offsetOfInlineAccessBaseStructureID): Deleted.
86	* dfg/DFGAbstractInterpreterInlines.h:
87	(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
88	* dfg/DFGByteCodeParser.cpp:
89	(JSC::DFG::ByteCodeParser::parseBlock):
90	* dfg/DFGGraph.cpp:
91	(JSC::DFG::Graph::dump):
92	* dfg/DFGJITCompiler.h:
93	(JSC::DFG::JITCompiler::branchWeakStructure):
94	* dfg/DFGPlan.cpp:
95	(JSC::DFG::Plan::finalize):
96	* dfg/DFGSpeculativeJIT.cpp:
97	* dfg/DFGSpeculativeJIT64.cpp:
98	(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
99	(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
100	(JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther):
101	(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
102	(JSC::DFG::SpeculativeJIT::emitUntypedBranch):
103	(JSC::DFG::SpeculativeJIT::compile):
104	* ftl/FTLAbstractHeapRepository.h:
105	* ftl/FTLLowerDFGToB3.cpp:
106	(JSC::FTL::DFG::LowerDFGToB3::compileCreatePromise):
107	(JSC::FTL::DFG::LowerDFGToB3::compileCreateInternalFieldObject):
108	(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
109	* heap/AbstractSlotVisitor.h:
110	* heap/AbstractSlotVisitorInlines.h:
111	* heap/Heap.cpp:
112	(JSC::Heap::Heap):
113	(JSC::Heap::runEndPhase):
114	* heap/Heap.h:
115	(JSC::Heap::structureIDTable):
116	* heap/IsoAlignedMemoryAllocator.cpp:
117	(JSC::IsoAlignedMemoryAllocator::IsoAlignedMemoryAllocator):
118	(JSC::IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator):
119	(JSC::IsoAlignedMemoryAllocator::tryAllocateAlignedMemory):
120	(JSC::IsoAlignedMemoryAllocator::freeAlignedMemory):
121	(JSC::IsoAlignedMemoryAllocator::tryMallocBlock): Deleted.
122	(JSC::IsoAlignedMemoryAllocator::freeBlock): Deleted.
123	(JSC::IsoAlignedMemoryAllocator::commitBlock): Deleted.
124	(JSC::IsoAlignedMemoryAllocator::decommitBlock): Deleted.
125	* heap/IsoAlignedMemoryAllocator.h:
126	* heap/IsoMemoryAllocatorBase.cpp: Removed.
127	* heap/IsoMemoryAllocatorBase.h: Removed.
128	* heap/IsoSubspace.cpp:
129	(JSC::IsoSubspace::IsoSubspace):
130	(JSC::IsoSubspace::tryAllocateFromLowerTier):
131	* heap/IsoSubspace.h:
132	* heap/PreciseAllocation.cpp:
133	(JSC::PreciseAllocation::createForLowerTier):
134	(JSC::PreciseAllocation::tryCreateForLowerTier): Deleted.
135	* heap/PreciseAllocation.h:
136	* heap/SlotVisitor.cpp:
137	(JSC::SlotVisitor::appendJSCellOrAuxiliary):
138	* heap/SlotVisitor.h:
139	* heap/SlotVisitorInlines.h:
140	* heap/StructureAlignedMemoryAllocator.cpp: Removed.
141	* heap/StructureAlignedMemoryAllocator.h: Removed.
142	* jit/AssemblyHelpers.cpp:
143	(JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
144	(JSC::AssemblyHelpers::emitLoadStructure):
145	(JSC::AssemblyHelpers::emitLoadPrototype):
146	(JSC::AssemblyHelpers::emitRandomThunk):
147	(JSC::AssemblyHelpers::emitConvertValueToBoolean):
148	(JSC::AssemblyHelpers::branchIfValue):
149	(JSC::AssemblyHelpers::emitNonNullDecodeStructureID): Deleted.
150	* jit/AssemblyHelpers.h:
151	(JSC::AssemblyHelpers::branchStructure):
152	(JSC::AssemblyHelpers::nukeStructureAndStoreButterfly):
153	* jit/GCAwareJITStubRoutine.cpp:
154	(JSC::PolymorphicAccessJITStubRoutine::computeHash):
155	* jit/JITInlineCacheGenerator.cpp:
156	(JSC::generateGetByIdInlineAccess):
157	(JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
158	(JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
159	* jit/JITOpcodes.cpp:
160	(JSC::JIT::emit_op_typeof_is_undefined):
161	(JSC::JIT::emit_op_jeq_null):
162	(JSC::JIT::emit_op_jneq_null):
163	(JSC::JIT::emit_op_eq_null):
164	(JSC::JIT::emit_op_neq_null):
165	(JSC::JIT::emit_op_get_prototype_of):
166	* jit/JITPropertyAccess.cpp:
167	(JSC::JIT::emit_op_get_property_enumerator):
168	* jit/JITStubRoutine.h:
169	* llint/LLIntSlowPaths.cpp:
170	(JSC::LLInt::LLINT_SLOW_PATH_DECL):
171	(JSC::LLInt::performLLIntGetByID):
172	* llint/LowLevelInterpreter.asm:
173	* llint/LowLevelInterpreter64.asm:
174	* runtime/ArrayPrototype.cpp:
175	(JSC::JSC_DEFINE_HOST_FUNCTION):
176	* runtime/BigIntPrototype.cpp:
177	(JSC::JSC_DEFINE_HOST_FUNCTION):
178	* runtime/BooleanPrototype.cpp:
179	(JSC::JSC_DEFINE_HOST_FUNCTION):
180	* runtime/CommonSlowPaths.cpp:
181	(JSC::JSC_DEFINE_COMMON_SLOW_PATH):
182	* runtime/DatePrototype.cpp:
183	(JSC::formateDateInstance):
184	(JSC::JSC_DEFINE_HOST_FUNCTION):
185	* runtime/ErrorInstance.cpp:
186	(JSC::ErrorInstance::sanitizedMessageString):
187	(JSC::ErrorInstance::sanitizedNameString):
188	(JSC::ErrorInstance::sanitizedToString):
189	* runtime/ErrorPrototype.cpp:
190	(JSC::JSC_DEFINE_HOST_FUNCTION):
191	* runtime/FunctionExecutable.cpp:
192	(JSC::FunctionExecutable::visitChildrenImpl):
193	* runtime/FunctionExecutable.h:
194	* runtime/FunctionPrototype.cpp:
195	(JSC::JSC_DEFINE_HOST_FUNCTION):
196	* runtime/FunctionRareData.cpp:
197	(JSC::FunctionRareData::visitChildrenImpl):
198	* runtime/FunctionRareData.h:
199	* runtime/HasOwnPropertyCache.h:
200	* runtime/InitializeThreading.cpp:
201	(JSC::initialize):
202	* runtime/JSCConfig.h:
203	* runtime/JSCJSValue.cpp:
204	(JSC::JSValue::dumpInContextAssumingStructure const):
205	(JSC::JSValue::dumpForBacktrace const):
206	* runtime/JSCell.cpp:
207	(JSC::JSCell::toObjectSlow const):
208	* runtime/JSCell.h:
209	(JSC::JSCell::clearStructure):
210	* runtime/JSCellInlines.h:
211	(JSC::JSCell::structure const):
212	(JSC::JSCell::setStructure):
213	* runtime/JSGlobalObject.cpp:
214	(JSC::JSGlobalObject::visitChildrenImpl):
215	* runtime/JSGlobalObject.h:
216	* runtime/JSObject.cpp:
217	(JSC::JSObject::visitButterflyImpl):
218	(JSC::JSObject::createInitialUndecided):
219	(JSC::JSObject::createInitialInt32):
220	(JSC::JSObject::createInitialDouble):
221	(JSC::JSObject::createInitialContiguous):
222	(JSC::JSObject::createArrayStorage):
223	(JSC::JSObject::convertUndecidedToArrayStorage):
224	(JSC::JSObject::convertInt32ToArrayStorage):
225	(JSC::JSObject::convertDoubleToArrayStorage):
226	(JSC::JSObject::convertContiguousToArrayStorage):
227	(JSC::JSObject::putDirectCustomGetterSetterWithoutTransition):
228	(JSC::JSObject::putDirectNonIndexAccessorWithoutTransition):
229	* runtime/JSObject.h:
230	(JSC::JSObject::nukeStructureAndSetButterfly):
231	(JSC::JSObject::getPropertySlot):
232	* runtime/JSObjectInlines.h:
233	(JSC::JSObject::getPropertySlot):
234	(JSC::JSObject::getNonIndexPropertySlot):
235	(JSC::JSObject::putDirectWithoutTransition):
236	(JSC::JSObject::putDirectInternal):
237	* runtime/JSPropertyNameEnumerator.cpp:
238	(JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
239	(JSC::JSPropertyNameEnumerator::visitChildrenImpl):
240	* runtime/JSPropertyNameEnumerator.h:
241	* runtime/NumberPrototype.cpp:
242	(JSC::toThisNumber):
243	* runtime/ObjectPrototype.cpp:
244	(JSC::JSC_DEFINE_HOST_FUNCTION):
245	(JSC::objectPrototypeToString):
246	* runtime/RegExpPrototype.cpp:
247	(JSC::JSC_DEFINE_HOST_FUNCTION):
248	* runtime/StringPrototype.cpp:
249	(JSC::JSC_DEFINE_HOST_FUNCTION):
250	* runtime/Structure.cpp:
251	(JSC::Structure::Structure):
252	(JSC::Structure::~Structure):
253	(JSC::Structure::flattenDictionaryStructure):
254	(JSC::Structure::dump const):
255	(JSC::Structure::canCachePropertyNameEnumerator const):
256	* runtime/Structure.h:
257	(JSC::Structure::id const):
258	* runtime/StructureChain.cpp:
259	(JSC::StructureChain::create):
260	(JSC::StructureChain::visitChildrenImpl):
261	* runtime/StructureID.h: Removed.
262	* runtime/StructureIDBlob.h:
263	(JSC::StructureIDBlob::StructureIDBlob):
264	* runtime/StructureIDTable.cpp: Added.
265	(JSC::StructureIDTable::StructureIDTable):
266	(JSC::StructureIDTable::makeFreeListFromRange):
267	(JSC::StructureIDTable::resize):
268	(JSC::StructureIDTable::flushOldTables):
269	(JSC::StructureIDTable::allocateID):
270	(JSC::StructureIDTable::deallocateID):
271	* runtime/StructureIDTable.h: Added.
272	(JSC::nukedStructureIDBit):
273	(JSC::nuke):
274	(JSC::isNuked):
275	(JSC::decontaminate):
276	(JSC::StructureIDTable::base):
277	(JSC::StructureIDTable::size const):
278	(JSC::StructureIDTable::table const):
279	(JSC::StructureIDTable::decode):
280	(JSC::StructureIDTable::encode):
281	(JSC::StructureIDTable::get):
282	(JSC::StructureIDTable::tryGet):
283	(JSC::StructureIDTable::validate):
284	(JSC::StructureIDTable::deallocateID):
285	(JSC::StructureIDTable::allocateID):
286	(JSC::StructureIDTable::flushOldTables):
287	* runtime/StructureRareData.cpp:
288	(JSC::StructureRareData::StructureRareData):
289	* runtime/StructureRareData.h:
290	* runtime/StructureRareDataInlines.h:
291	(JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint):
292	* runtime/SymbolPrototype.cpp:
293	(JSC::JSC_DEFINE_CUSTOM_GETTER):
294	(JSC::JSC_DEFINE_HOST_FUNCTION):
295	* runtime/TypeProfilerLog.cpp:
296	(JSC::TypeProfilerLog::processLogEntries):
297	(JSC::TypeProfilerLog::visit):
298	* runtime/VM.h:
299	(JSC::VM::getStructure):
300	(JSC::VM::tryGetStructure):
301	* runtime/WriteBarrier.h:
302	(JSC::WriteBarrierStructureID::WriteBarrierStructureID): Deleted.
303	(JSC::WriteBarrierStructureID::get const): Deleted.
304	(JSC::WriteBarrierStructureID::operator* const): Deleted.
305	(JSC::WriteBarrierStructureID::operator-> const): Deleted.
306	(JSC::WriteBarrierStructureID::clear): Deleted.
307	(JSC::WriteBarrierStructureID::operator bool const): Deleted.
308	(JSC::WriteBarrierStructureID::operator! const): Deleted.
309	(JSC::WriteBarrierStructureID::setWithoutWriteBarrier): Deleted.
310	(JSC::WriteBarrierStructureID::unvalidatedGet const): Deleted.
311	(JSC::WriteBarrierStructureID::value const): Deleted.
312	* runtime/WriteBarrierInlines.h:
313	(JSC::WriteBarrierStructureID::set): Deleted.
314	(JSC::WriteBarrierStructureID::setMayBeNull): Deleted.
315	(JSC::WriteBarrierStructureID::setEarlyValue): Deleted.
316	* tools/HeapVerifier.cpp:
317	(JSC::HeapVerifier::validateJSCell):
318	* tools/Integrity.cpp:
319	* tools/Integrity.h:
320	* tools/IntegrityInlines.h:
321	(JSC::Integrity::auditStructureID):
322	* tools/JSDollarVM.cpp:
323	(JSC::JSC_DEFINE_HOST_FUNCTION):
324	(JSC::JSDollarVM::finishCreation):
325	(JSC::JSDollarVM::visitChildrenImpl):
326	* tools/JSDollarVM.h:
327	* wasm/js/WebAssemblyFunction.cpp:
328	(JSC::WebAssemblyFunction::jsCallEntrypointSlow):
329	* wasm/js/WebAssemblyGlobalPrototype.cpp:
330	(JSC::getGlobal):
331
1	2021-12-13 waddlesplash <waddlesplash@gmail.com>	332	2021-12-13 waddlesplash <waddlesplash@gmail.com>
2		333
3	ExecutableAllocator: Do not store things in g_config when USE(SYSTEM_MALLOC).	334	ExecutableAllocator: Do not store things in g_config when USE(SYSTEM_MALLOC).

Lines 762-772 set(JavaScriptCore_PRIVATE_FRAMEWORK_HEA Source/JavaScriptCore/CMakeLists.txt_sec1
- Source/JavaScriptCore/CMakeLists.txt -3 / +2 lines
762	heap/HeapSnapshotBuilder.h	762	heap/HeapSnapshotBuilder.h
763	heap/HeapSubspaceTypes.h	763	heap/HeapSubspaceTypes.h
764	heap/IncrementalSweeper.h	764	heap/IncrementalSweeper.h
		765	heap/IsoAlignedMemoryAllocator.h
765	heap/IsoCellSet.h	766	heap/IsoCellSet.h
766	heap/IsoHeapCellType.h	767	heap/IsoHeapCellType.h
767	heap/IsoInlinedHeapCellType.h	768	heap/IsoInlinedHeapCellType.h
768	heap/IsoInlinedHeapCellTypeInlines.h	769	heap/IsoInlinedHeapCellTypeInlines.h
769	heap/IsoMemoryAllocatorBase.h
770	heap/IsoSubspace.h	770	heap/IsoSubspace.h
771	heap/IsoSubspaceInlines.h	771	heap/IsoSubspaceInlines.h
772	heap/IsoSubspacePerVM.h	772	heap/IsoSubspacePerVM.h
Lines 793-799 set(JavaScriptCore_PRIVATE_FRAMEWORK_HEA Source/JavaScriptCore/CMakeLists.txt_sec2
793	heap/Strong.h	793	heap/Strong.h
794	heap/StrongForward.h	794	heap/StrongForward.h
795	heap/StrongInlines.h	795	heap/StrongInlines.h
796	heap/StructureAlignedMemoryAllocator.h
797	heap/Subspace.h	796	heap/Subspace.h
798	heap/SubspaceInlines.h	797	heap/SubspaceInlines.h
799	heap/Synchronousness.h	798	heap/Synchronousness.h
Lines 1186-1193 set(JavaScriptCore_PRIVATE_FRAMEWORK_HEA Source/JavaScriptCore/CMakeLists.txt_sec3
1186	runtime/Structure.h	1185	runtime/Structure.h
1187	runtime/StructureCache.h	1186	runtime/StructureCache.h
1188	runtime/StructureChain.h	1187	runtime/StructureChain.h
1189	runtime/StructureID.h
1190	runtime/StructureIDBlob.h	1188	runtime/StructureIDBlob.h
		1189	runtime/StructureIDTable.h
1191	runtime/StructureInlines.h	1190	runtime/StructureInlines.h
1192	runtime/StructureRareData.h	1191	runtime/StructureRareData.h
1193	runtime/StructureRareDataInlines.h	1192	runtime/StructureRareDataInlines.h

Lines 537-543 heap/IncrementalSweeper.cpp Source/JavaScriptCore/Sources.txt_sec1
- Source/JavaScriptCore/Sources.txt -2 / +1 lines
537	heap/IsoAlignedMemoryAllocator.cpp	537	heap/IsoAlignedMemoryAllocator.cpp
538	heap/IsoCellSet.cpp	538	heap/IsoCellSet.cpp
539	heap/IsoHeapCellType.cpp	539	heap/IsoHeapCellType.cpp
540	heap/IsoMemoryAllocatorBase.cpp
541	heap/IsoSubspace.cpp	540	heap/IsoSubspace.cpp
542	heap/IsoSubspacePerVM.cpp	541	heap/IsoSubspacePerVM.cpp
543	heap/JITStubRoutineSet.cpp	542	heap/JITStubRoutineSet.cpp
Lines 559-565 heap/SlotVisitor.cpp Source/JavaScriptCore/Sources.txt_sec2
559	heap/SpaceTimeMutatorScheduler.cpp	558	heap/SpaceTimeMutatorScheduler.cpp
560	heap/StochasticSpaceTimeMutatorScheduler.cpp	559	heap/StochasticSpaceTimeMutatorScheduler.cpp
561	heap/StopIfNecessaryTimer.cpp	560	heap/StopIfNecessaryTimer.cpp
562	heap/StructureAlignedMemoryAllocator.cpp
563	heap/Subspace.cpp	561	heap/Subspace.cpp
564	heap/SynchronousStopTheWorldMutatorScheduler.cpp	562	heap/SynchronousStopTheWorldMutatorScheduler.cpp
565	heap/Synchronousness.cpp	563	heap/Synchronousness.cpp
Lines 1007-1012 runtime/StringRecursionChecker.cpp Source/JavaScriptCore/Sources.txt_sec3
1007	runtime/Structure.cpp	1005	runtime/Structure.cpp
1008	runtime/StructureCache.cpp	1006	runtime/StructureCache.cpp
1009	runtime/StructureChain.cpp	1007	runtime/StructureChain.cpp
		1008	runtime/StructureIDTable.cpp
1010	runtime/StructureRareData.cpp	1009	runtime/StructureRareData.cpp
1011	runtime/Symbol.cpp	1010	runtime/Symbol.cpp
1012	runtime/SymbolConstructor.cpp	1011	runtime/SymbolConstructor.cpp

Lines 857-862 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec1
- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj -18 / +6 lines
857	2AACE63D18CA5A0300ED0191 /* GCActivityCallback.h in Headers / = {isa = PBXBuildFile; fileRef = 2AACE63B18CA5A0300ED0191 / GCActivityCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };	857	2AACE63D18CA5A0300ED0191 /* GCActivityCallback.h in Headers / = {isa = PBXBuildFile; fileRef = 2AACE63B18CA5A0300ED0191 / GCActivityCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
858	2AD2EDFB19799E38004D6478 /* EnumerationMode.h in Headers / = {isa = PBXBuildFile; fileRef = 2AD2EDFA19799E38004D6478 / EnumerationMode.h */; settings = {ATTRIBUTES = (Private, ); }; };	858	2AD2EDFB19799E38004D6478 /* EnumerationMode.h in Headers / = {isa = PBXBuildFile; fileRef = 2AD2EDFA19799E38004D6478 / EnumerationMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
859	2AD8932B17E3868F00668276 /* HeapIterationScope.h in Headers / = {isa = PBXBuildFile; fileRef = 2AD8932917E3868F00668276 / HeapIterationScope.h */; };	859	2AD8932B17E3868F00668276 /* HeapIterationScope.h in Headers / = {isa = PBXBuildFile; fileRef = 2AD8932917E3868F00668276 / HeapIterationScope.h */; };
		860	2AF7382D18BBBF92008A5A37 /* StructureIDTable.h in Headers / = {isa = PBXBuildFile; fileRef = 2AF7382B18BBBF92008A5A37 / StructureIDTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
860	2D342F36F7244096804ADB24 /* SourceOrigin.h in Headers / = {isa = PBXBuildFile; fileRef = 425BA1337E4344E1B269A671 / SourceOrigin.h */; settings = {ATTRIBUTES = (Private, ); }; };	861	2D342F36F7244096804ADB24 /* SourceOrigin.h in Headers / = {isa = PBXBuildFile; fileRef = 425BA1337E4344E1B269A671 / SourceOrigin.h */; settings = {ATTRIBUTES = (Private, ); }; };
861	33111B8B2397256500AA34CE /* Scribble.h in Headers / = {isa = PBXBuildFile; fileRef = 33111B8A2397256500AA34CE / Scribble.h */; settings = {ATTRIBUTES = (Private, ); }; };	862	33111B8B2397256500AA34CE /* Scribble.h in Headers / = {isa = PBXBuildFile; fileRef = 33111B8A2397256500AA34CE / Scribble.h */; settings = {ATTRIBUTES = (Private, ); }; };
862	3395C70722555F6D00BDBFAD /* B3EliminateDeadCode.h in Headers / = {isa = PBXBuildFile; fileRef = 3395C70522555F6D00BDBFAD / B3EliminateDeadCode.h */; };	863	3395C70722555F6D00BDBFAD /* B3EliminateDeadCode.h in Headers / = {isa = PBXBuildFile; fileRef = 3395C70522555F6D00BDBFAD / B3EliminateDeadCode.h */; };
Lines 1089-1098 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec2
1089	536B319E1F735F160037FC33 /* LowLevelInterpreter.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F4680C714BBB16900BFE272 / LowLevelInterpreter.cpp */; };	1090	536B319E1F735F160037FC33 /* LowLevelInterpreter.cpp in Sources / = {isa = PBXBuildFile; fileRef = 0F4680C714BBB16900BFE272 / LowLevelInterpreter.cpp */; };
1090	5370806B1FE232DF00299E44 /* JSArrayBufferView.h in Headers / = {isa = PBXBuildFile; fileRef = 0F2B66BB17B6B5AB00A7AE3F / JSArrayBufferView.h */; };	1091	5370806B1FE232DF00299E44 /* JSArrayBufferView.h in Headers / = {isa = PBXBuildFile; fileRef = 0F2B66BB17B6B5AB00A7AE3F / JSArrayBufferView.h */; };
1091	5370B4F61BF26205005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h in Headers / = {isa = PBXBuildFile; fileRef = 5370B4F41BF25EA2005C40FC / AdaptiveInferredPropertyValueWatchpointBase.h */; };	1092	5370B4F61BF26205005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h in Headers / = {isa = PBXBuildFile; fileRef = 5370B4F41BF25EA2005C40FC / AdaptiveInferredPropertyValueWatchpointBase.h */; };
1092	537FEEC92742BDA300C9EFEE /* StructureID.h in Headers / = {isa = PBXBuildFile; fileRef = 537FEEC82742BDA300C9EFEE / StructureID.h */; settings = {ATTRIBUTES = (Private, ); }; };
1093	537FEECE2742BDE100C9EFEE /* IsoMemoryAllocatorBaseInlines.h in Headers / = {isa = PBXBuildFile; fileRef = 537FEECA2742BDE000C9EFEE / IsoMemoryAllocatorBaseInlines.h */; };
1094	537FEED02742BDE100C9EFEE /* StructureAlignedMemoryAllocator.h in Headers / = {isa = PBXBuildFile; fileRef = 537FEECC2742BDE000C9EFEE / StructureAlignedMemoryAllocator.h */; };
1095	537FEED12742BDE100C9EFEE /* IsoMemoryAllocatorBase.h in Headers / = {isa = PBXBuildFile; fileRef = 537FEECD2742BDE000C9EFEE / IsoMemoryAllocatorBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
1096	5381B9391E60E97D0090F794 /* WasmFaultSignalHandler.h in Headers / = {isa = PBXBuildFile; fileRef = 5381B9381E60E97D0090F794 / WasmFaultSignalHandler.h */; settings = {ATTRIBUTES = (Private, ); }; };	1093	5381B9391E60E97D0090F794 /* WasmFaultSignalHandler.h in Headers / = {isa = PBXBuildFile; fileRef = 5381B9381E60E97D0090F794 / WasmFaultSignalHandler.h */; settings = {ATTRIBUTES = (Private, ); }; };
1097	538F15E7268FBBB600D601C4 /* UnifiedSource148.cpp in Sources / = {isa = PBXBuildFile; fileRef = 538F15DD268FBBB300D601C4 / UnifiedSource148.cpp */; };	1094	538F15E7268FBBB600D601C4 /* UnifiedSource148.cpp in Sources / = {isa = PBXBuildFile; fileRef = 538F15DD268FBBB300D601C4 / UnifiedSource148.cpp */; };
1098	538F15E8268FBBB600D601C4 /* UnifiedSource151.cpp in Sources / = {isa = PBXBuildFile; fileRef = 538F15DE268FBBB300D601C4 / UnifiedSource151.cpp */; };	1095	538F15E8268FBBB600D601C4 /* UnifiedSource151.cpp in Sources / = {isa = PBXBuildFile; fileRef = 538F15DE268FBBB300D601C4 / UnifiedSource151.cpp */; };
Lines 3639-3644 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec3
3639	2AD2EDFA19799E38004D6478 /* EnumerationMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EnumerationMode.h; sourceTree = "<group>"; };	3636	2AD2EDFA19799E38004D6478 /* EnumerationMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EnumerationMode.h; sourceTree = "<group>"; };
3640	2AD8932917E3868F00668276 /* HeapIterationScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapIterationScope.h; sourceTree = "<group>"; };	3637	2AD8932917E3868F00668276 /* HeapIterationScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapIterationScope.h; sourceTree = "<group>"; };
3641	2ADFA26218EF3540004F9FCC /* GCLogging.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCLogging.cpp; sourceTree = "<group>"; };	3638	2ADFA26218EF3540004F9FCC /* GCLogging.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCLogging.cpp; sourceTree = "<group>"; };
		3639	2AF7382A18BBBF92008A5A37 /* StructureIDTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureIDTable.cpp; sourceTree = "<group>"; };
		3640	2AF7382B18BBBF92008A5A37 /* StructureIDTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureIDTable.h; sourceTree = "<group>"; };
3642	3032175DF1AD47D8998B34E1 /* JSSourceCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSourceCode.h; sourceTree = "<group>"; };	3641	3032175DF1AD47D8998B34E1 /* JSSourceCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSourceCode.h; sourceTree = "<group>"; };
3643	30A5F403F11C4F599CD596D5 /* WasmSignatureInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmSignatureInlines.h; sourceTree = "<group>"; };	3642	30A5F403F11C4F599CD596D5 /* WasmSignatureInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmSignatureInlines.h; sourceTree = "<group>"; };
3644	33111B8A2397256500AA34CE /* Scribble.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = Scribble.h; sourceTree = "<group>"; };	3643	33111B8A2397256500AA34CE /* Scribble.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = Scribble.h; sourceTree = "<group>"; };
Lines 3741-3747 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec4
3741	530FB3011E7A0B6E003C19DD /* WasmWorklist.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmWorklist.h; sourceTree = "<group>"; };	3740	530FB3011E7A0B6E003C19DD /* WasmWorklist.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmWorklist.h; sourceTree = "<group>"; };
3742	530FB3031E7A1146003C19DD /* WasmWorklist.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmWorklist.cpp; sourceTree = "<group>"; };	3741	530FB3031E7A1146003C19DD /* WasmWorklist.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmWorklist.cpp; sourceTree = "<group>"; };
3743	530FDE7321FAAFC600059D65 /* testIncludes.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; name = testIncludes.m; path = API/tests/testIncludes.m; sourceTree = "<group>"; };	3742	530FDE7321FAAFC600059D65 /* testIncludes.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; name = testIncludes.m; path = API/tests/testIncludes.m; sourceTree = "<group>"; };
3744	531013F3274419F40009009C /* libWTF.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; path = libWTF.a; sourceTree = BUILT_PRODUCTS_DIR; };
3745	5311BD481EA581E500525281 /* WasmOMGPlan.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmOMGPlan.cpp; sourceTree = "<group>"; };	3743	5311BD481EA581E500525281 /* WasmOMGPlan.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmOMGPlan.cpp; sourceTree = "<group>"; };
3746	5311BD491EA581E500525281 /* WasmOMGPlan.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmOMGPlan.h; sourceTree = "<group>"; };	3744	5311BD491EA581E500525281 /* WasmOMGPlan.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmOMGPlan.h; sourceTree = "<group>"; };
3747	531374BC1D5CE67600AF7A0B /* WasmPlan.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmPlan.h; sourceTree = "<group>"; };	3745	531374BC1D5CE67600AF7A0B /* WasmPlan.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmPlan.h; sourceTree = "<group>"; };
Lines 3930-3940 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec5
3930	5370B4F41BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AdaptiveInferredPropertyValueWatchpointBase.h; sourceTree = "<group>"; };	3928	5370B4F41BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AdaptiveInferredPropertyValueWatchpointBase.h; sourceTree = "<group>"; };
3931	5373B4D322AD8BF700803572 /* WeakObjectRefPrototype.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = WeakObjectRefPrototype.cpp; sourceTree = "<group>"; };	3929	5373B4D322AD8BF700803572 /* WeakObjectRefPrototype.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = WeakObjectRefPrototype.cpp; sourceTree = "<group>"; };
3932	5373B4D422ADB31400803572 /* WeakObjectRefConstructor.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = WeakObjectRefConstructor.cpp; sourceTree = "<group>"; };	3930	5373B4D422ADB31400803572 /* WeakObjectRefConstructor.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = WeakObjectRefConstructor.cpp; sourceTree = "<group>"; };
3933	537FEEC82742BDA300C9EFEE /* StructureID.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureID.h; sourceTree = "<group>"; };
3934	537FEECA2742BDE000C9EFEE /* IsoMemoryAllocatorBaseInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IsoMemoryAllocatorBaseInlines.h; sourceTree = "<group>"; };
3935	537FEECB2742BDE000C9EFEE /* StructureAlignedMemoryAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureAlignedMemoryAllocator.cpp; sourceTree = "<group>"; };
3936	537FEECC2742BDE000C9EFEE /* StructureAlignedMemoryAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureAlignedMemoryAllocator.h; sourceTree = "<group>"; };
3937	537FEECD2742BDE000C9EFEE /* IsoMemoryAllocatorBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IsoMemoryAllocatorBase.h; sourceTree = "<group>"; };
3938	5381B9361E60E9660090F794 /* WasmFaultSignalHandler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmFaultSignalHandler.cpp; sourceTree = "<group>"; };	3931	5381B9361E60E9660090F794 /* WasmFaultSignalHandler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmFaultSignalHandler.cpp; sourceTree = "<group>"; };
3939	5381B9381E60E97D0090F794 /* WasmFaultSignalHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmFaultSignalHandler.h; sourceTree = "<group>"; };	3932	5381B9381E60E97D0090F794 /* WasmFaultSignalHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmFaultSignalHandler.h; sourceTree = "<group>"; };
3940	5383AA2F1E65E8A100A532FC /* JSWebAssemblyCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyCodeBlock.cpp; path = js/JSWebAssemblyCodeBlock.cpp; sourceTree = "<group>"; };	3933	5383AA2F1E65E8A100A532FC /* JSWebAssemblyCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyCodeBlock.cpp; path = js/JSWebAssemblyCodeBlock.cpp; sourceTree = "<group>"; };
Lines 5790-5796 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec6
5790	5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */,	5783	5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */,
5791	9322A00306C341D3009067BB /* libicucore.dylib */,	5784	9322A00306C341D3009067BB /* libicucore.dylib */,
5792	51F0EC0705C86C9A00E6DF1B /* libobjc.dylib */,	5785	51F0EC0705C86C9A00E6DF1B /* libobjc.dylib */,
5793	531013F3274419F40009009C /* libWTF.a */,
5794	1498CAD3214656C400710879 /* libWTF.a */,	5786	1498CAD3214656C400710879 /* libWTF.a */,
5795	A8A4748D151A8306004123FF /* libWTF.a */,	5787	A8A4748D151A8306004123FF /* libWTF.a */,
5796	371D842C17C98B6E00ECF994 /* libz.dylib */,	5788	371D842C17C98B6E00ECF994 /* libz.dylib */,
Lines 6672-6679 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec7
6672	142E3132134FF0A600AFADB5 /* Strong.h */,	6664	142E3132134FF0A600AFADB5 /* Strong.h */,
6673	CD1F9B4A270CFE0F00617EB6 /* StrongForward.h */,	6665	CD1F9B4A270CFE0F00617EB6 /* StrongForward.h */,
6674	145722851437E140005FDE26 /* StrongInlines.h */,	6666	145722851437E140005FDE26 /* StrongInlines.h */,
6675	537FEECB2742BDE000C9EFEE /* StructureAlignedMemoryAllocator.cpp */,
6676	537FEECC2742BDE000C9EFEE /* StructureAlignedMemoryAllocator.h */,
6677	0F7DF1311E2970D50095951B /* Subspace.cpp */,	6667	0F7DF1311E2970D50095951B /* Subspace.cpp */,
6678	0F7DF1321E2970D50095951B /* Subspace.h */,	6668	0F7DF1321E2970D50095951B /* Subspace.h */,
6679	0F7DF1331E2970D50095951B /* SubspaceInlines.h */,	6669	0F7DF1331E2970D50095951B /* SubspaceInlines.h */,
Lines 8075-8082 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec8
8075	7986943A1F8C0AC8009232AE /* StructureCache.h */,	8065	7986943A1F8C0AC8009232AE /* StructureCache.h */,
8076	7E4EE70E0EBB7A5B005934AA /* StructureChain.cpp */,	8066	7E4EE70E0EBB7A5B005934AA /* StructureChain.cpp */,
8077	7E4EE7080EBB7963005934AA /* StructureChain.h */,	8067	7E4EE7080EBB7963005934AA /* StructureChain.h */,
8078	537FEEC82742BDA300C9EFEE /* StructureID.h */,
8079	2AAAA31018BD49D100394CC8 /* StructureIDBlob.h */,	8068	2AAAA31018BD49D100394CC8 /* StructureIDBlob.h */,
		8069	2AF7382A18BBBF92008A5A37 /* StructureIDTable.cpp */,
		8070	2AF7382B18BBBF92008A5A37 /* StructureIDTable.h */,
8080	0FD2C92316D01EE900C7803F /* StructureInlines.h */,	8071	0FD2C92316D01EE900C7803F /* StructureInlines.h */,
8081	C2F0F2D016BAEEE900187C19 /* StructureRareData.cpp */,	8072	C2F0F2D016BAEEE900187C19 /* StructureRareData.cpp */,
8082	C2FE18A316BAEC4000AF3061 /* StructureRareData.h */,	8073	C2FE18A316BAEC4000AF3061 /* StructureRareData.h */,
Lines 10276-10283 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec9
10276	0FB467811FDDA6F7003FCB09 /* IsoCellSetInlines.h in Headers */,	10267	0FB467811FDDA6F7003FCB09 /* IsoCellSetInlines.h in Headers */,
10277	E3BF1BAE238AAEDB003A1C2B /* IsoHeapCellType.h in Headers */,	10268	E3BF1BAE238AAEDB003A1C2B /* IsoHeapCellType.h in Headers */,
10278	E3C8ED4323A1DBCB00131958 /* IsoInlinedHeapCellType.h in Headers */,	10269	E3C8ED4323A1DBCB00131958 /* IsoInlinedHeapCellType.h in Headers */,
10279	537FEED12742BDE100C9EFEE /* IsoMemoryAllocatorBase.h in Headers */,
10280	537FEECE2742BDE100C9EFEE /* IsoMemoryAllocatorBaseInlines.h in Headers */,
10281	0FDCE12D1FAFB4E5006F3901 /* IsoSubspace.h in Headers */,	10270	0FDCE12D1FAFB4E5006F3901 /* IsoSubspace.h in Headers */,
10282	0FD2FD9520B52BE200F09441 /* IsoSubspaceInlines.h in Headers */,	10271	0FD2FD9520B52BE200F09441 /* IsoSubspaceInlines.h in Headers */,
10283	0F5E0FE72086AD480097F0DE /* IsoSubspacePerVM.h in Headers */,	10272	0F5E0FE72086AD480097F0DE /* IsoSubspacePerVM.h in Headers */,
Lines 10828-10838 Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj_sec10
10828	CD1F9B4B270CFE0F00617EB6 /* StrongForward.h in Headers */,	10817	CD1F9B4B270CFE0F00617EB6 /* StrongForward.h in Headers */,
10829	145722861437E140005FDE26 /* StrongInlines.h in Headers */,	10818	145722861437E140005FDE26 /* StrongInlines.h in Headers */,
10830	BCDE3AB80E6C82F5001453A7 /* Structure.h in Headers */,	10819	BCDE3AB80E6C82F5001453A7 /* Structure.h in Headers */,
10831	537FEED02742BDE100C9EFEE /* StructureAlignedMemoryAllocator.h in Headers */,
10832	7986943B1F8C0ACC009232AE /* StructureCache.h in Headers */,	10820	7986943B1F8C0ACC009232AE /* StructureCache.h in Headers */,
10833	7E4EE7090EBB7963005934AA /* StructureChain.h in Headers */,	10821	7E4EE7090EBB7963005934AA /* StructureChain.h in Headers */,
10834	537FEEC92742BDA300C9EFEE /* StructureID.h in Headers */,
10835	2AAAA31218BD49D100394CC8 /* StructureIDBlob.h in Headers */,	10822	2AAAA31218BD49D100394CC8 /* StructureIDBlob.h in Headers */,
		10823	2AF7382D18BBBF92008A5A37 /* StructureIDTable.h in Headers */,
10836	0FD2C92416D01EE900C7803F /* StructureInlines.h in Headers */,	10824	0FD2C92416D01EE900C7803F /* StructureInlines.h in Headers */,
10837	C2FE18A416BAEC4000AF3061 /* StructureRareData.h in Headers */,	10825	C2FE18A416BAEC4000AF3061 /* StructureRareData.h in Headers */,
10838	C20BA92D16BB1C1500B3AEA2 /* StructureRareDataInlines.h in Headers */,	10826	C20BA92D16BB1C1500B3AEA2 /* StructureRareDataInlines.h in Headers */,

Lines 184-198 public: Source/JavaScriptCore/bytecode/AccessCase.h_sec1
- Source/JavaScriptCore/bytecode/AccessCase.h -7 / +7 lines
184	Structure* structure() const	184	Structure* structure() const
185	{	185	{
186	if (m_type == Transition \|\| m_type == Delete \|\| m_type == SetPrivateBrand)	186	if (m_type == Transition \|\| m_type == Delete \|\| m_type == SetPrivateBrand)
187	return m_structureID->previousID();	187	return m_structure->previousID();
188	return m_structureID.get();	188	return m_structure.get();
189	}	189	}
190	bool guardedByStructureCheck(const StructureStubInfo&) const;	190	bool guardedByStructureCheck(const StructureStubInfo&) const;
191		191
192	Structure* newStructure() const	192	Structure* newStructure() const
193	{	193	{
194	ASSERT(m_type == Transition \|\| m_type == Delete \|\| m_type == SetPrivateBrand);	194	ASSERT(m_type == Transition \|\| m_type == Delete \|\| m_type == SetPrivateBrand);
195	return m_structureID.get();	195	return m_structure.get();
196	}	196	}
197		197
198	ObjectPropertyConditionSet conditionSet() const { return m_conditionSet; }	198	ObjectPropertyConditionSet conditionSet() const { return m_conditionSet; }
Lines 272-278 public: Source/JavaScriptCore/bytecode/AccessCase.h_sec2
272		272
273	unsigned hash() const	273	unsigned hash() const
274	{	274	{
275	return computeHash(m_conditionSet.hash(), static_cast<unsigned>(m_type), m_viaProxy, m_structureID.unvalidatedGet(), m_offset);	275	return computeHash(m_conditionSet.hash(), static_cast<unsigned>(m_type), m_viaProxy, m_structure.unvalidatedGet(), m_offset);
276	}	276	}
277		277
278	static bool canBeShared(const AccessCase&, const AccessCase&);	278	static bool canBeShared(const AccessCase&, const AccessCase&);
Lines 284-290 protected: Source/JavaScriptCore/bytecode/AccessCase.h_sec3
284	, m_state(WTFMove(other.m_state))	284	, m_state(WTFMove(other.m_state))
285	, m_viaProxy(WTFMove(other.m_viaProxy))	285	, m_viaProxy(WTFMove(other.m_viaProxy))
286	, m_offset(WTFMove(other.m_offset))	286	, m_offset(WTFMove(other.m_offset))
287	, m_structureID(WTFMove(other.m_structureID))	287	, m_structure(WTFMove(other.m_structure))
288	, m_conditionSet(WTFMove(other.m_conditionSet))	288	, m_conditionSet(WTFMove(other.m_conditionSet))
289	, m_polyProtoAccessChain(WTFMove(other.m_polyProtoAccessChain))	289	, m_polyProtoAccessChain(WTFMove(other.m_polyProtoAccessChain))
290	, m_identifier(WTFMove(other.m_identifier))	290	, m_identifier(WTFMove(other.m_identifier))
Lines 295-301 protected: Source/JavaScriptCore/bytecode/AccessCase.h_sec4
295	, m_state(other.m_state)	295	, m_state(other.m_state)
296	, m_viaProxy(other.m_viaProxy)	296	, m_viaProxy(other.m_viaProxy)
297	, m_offset(other.m_offset)	297	, m_offset(other.m_offset)
298	, m_structureID(other.m_structureID)	298	, m_structure(other.m_structure)
299	, m_conditionSet(other.m_conditionSet)	299	, m_conditionSet(other.m_conditionSet)
300	, m_polyProtoAccessChain(other.m_polyProtoAccessChain)	300	, m_polyProtoAccessChain(other.m_polyProtoAccessChain)
301	, m_identifier(other.m_identifier)	301	, m_identifier(other.m_identifier)
Lines 348-354 private: Source/JavaScriptCore/bytecode/AccessCase.h_sec5
348	// Usually this is the structure that we expect the base object to have. But, this is the new	348	// Usually this is the structure that we expect the base object to have. But, this is the new
349	// structure for a transition and we rely on the fact that it has a strong reference to the old	349	// structure for a transition and we rely on the fact that it has a strong reference to the old
350	// structure. For proxies, this is the structure of the object behind the proxy.	350	// structure. For proxies, this is the structure of the object behind the proxy.
351	WriteBarrierStructureID m_structureID;	351	WriteBarrier<Structure> m_structure;
352		352
353	ObjectPropertyConditionSet m_conditionSet;	353	ObjectPropertyConditionSet m_conditionSet;
354		354

Lines 123-131 void ArrayProfile::computeUpdatedPredict Source/JavaScriptCore/bytecode/ArrayProfile.cpp_sec1
- Source/JavaScriptCore/bytecode/ArrayProfile.cpp -2 / +2 lines
123	if (!m_lastSeenStructureID)	123	if (!m_lastSeenStructureID)
124	return;	124	return;
125		125
126	Structure* lastSeenStructure = m_lastSeenStructureID.decode();	126	Structure* lastSeenStructure = codeBlock->heap()->structureIDTable().get(m_lastSeenStructureID);
127	computeUpdatedPrediction(locker, codeBlock, lastSeenStructure);	127	computeUpdatedPrediction(locker, codeBlock, lastSeenStructure);
128	m_lastSeenStructureID = StructureID();	128	m_lastSeenStructureID = 0;
129	}	129	}
130		130
131	void ArrayProfile::computeUpdatedPrediction(const ConcurrentJSLocker&, CodeBlock* codeBlock, Structure* lastSeenStructure)	131	void ArrayProfile::computeUpdatedPrediction(const ConcurrentJSLocker&, CodeBlock* codeBlock, Structure* lastSeenStructure)

Lines 69-75 static_assert(sizeof(GetByIdModeMetadata Source/JavaScriptCore/bytecode/GetByIdMetadata.h_sec1
- Source/JavaScriptCore/bytecode/GetByIdMetadata.h -3 / +3 lines
69	union GetByIdModeMetadata {	69	union GetByIdModeMetadata {
70	GetByIdModeMetadata()	70	GetByIdModeMetadata()
71	{	71	{
72	defaultMode.structureID = StructureID();	72	defaultMode.structureID = 0;
73	defaultMode.cachedOffset = 0;	73	defaultMode.cachedOffset = 0;
74	defaultMode.padding1 = 0;	74	defaultMode.padding1 = 0;
75	mode = GetByIdMode::Default;	75	mode = GetByIdMode::Default;
Lines 100-106 static_assert(sizeof(GetByIdModeMetadata Source/JavaScriptCore/bytecode/GetByIdMetadata.h_sec2
100	struct GetByIdModeMetadata {	100	struct GetByIdModeMetadata {
101	GetByIdModeMetadata()	101	GetByIdModeMetadata()
102	{	102	{
103	defaultMode.structureID = StructureID();	103	defaultMode.structureID = 0;
104	defaultMode.cachedOffset = 0;	104	defaultMode.cachedOffset = 0;
105	defaultMode.padding1 = 0;	105	defaultMode.padding1 = 0;
106	mode = GetByIdMode::Default;	106	mode = GetByIdMode::Default;
Lines 127-133 struct GetByIdModeMetadata { Source/JavaScriptCore/bytecode/GetByIdMetadata.h_sec3
127	inline void GetByIdModeMetadata::clearToDefaultModeWithoutCache()	127	inline void GetByIdModeMetadata::clearToDefaultModeWithoutCache()
128	{	128	{
129	mode = GetByIdMode::Default;	129	mode = GetByIdMode::Default;
130	defaultMode.structureID = StructureID();	130	defaultMode.structureID = 0;
131	defaultMode.cachedOffset = 0;	131	defaultMode.cachedOffset = 0;
132	}	132	}
133		133

Lines 127-133 GetByStatus GetByStatus::computeFromLLIn Source/JavaScriptCore/bytecode/GetByStatus.cpp_sec1
- Source/JavaScriptCore/bytecode/GetByStatus.cpp -2 / +2 lines
127	if (!structureID)	127	if (!structureID)
128	return GetByStatus(NoInformation, false);	128	return GetByStatus(NoInformation, false);
129		129
130	Structure* structure = structureID.decode();	130	Structure* structure = vm.heap.structureIDTable().get(structureID);
131		131
132	if (structure->takesSlowPathInDFGForImpureProperty())	132	if (structure->takesSlowPathInDFGForImpureProperty())
133	return GetByStatus(NoInformation, false);	133	return GetByStatus(NoInformation, false);
Lines 236-242 GetByStatus GetByStatus::computeForStubI Source/JavaScriptCore/bytecode/GetByStatus.cpp_sec2
236	}	236	}
237		237
238	case CacheType::Stub: {	238	case CacheType::Stub: {
239	PolymorphicAccess* list = stubInfo->m_stub;	239	PolymorphicAccess* list = stubInfo->u.stub;
240	if (list->size() == 1) {	240	if (list->size() == 1) {
241	const AccessCase& access = list->at(0);	241	const AccessCase& access = list->at(0);
242	switch (access.type()) {	242	switch (access.type()) {

Lines 447-453 void InlineAccess::rewireStubAsJumpInAcc Source/JavaScriptCore/bytecode/InlineAccess.cpp_sec1
- Source/JavaScriptCore/bytecode/InlineAccess.cpp -2 / +2 lines
447	}	447	}
448		448
449	stubInfo.m_codePtr = target;	449	stubInfo.m_codePtr = target;
450	stubInfo.m_inlineAccessBaseStructureID.clear(); // Clear out the inline access code.	450	stubInfo.m_inlineAccessBaseStructure = 0; // Clear out the inline access code.
451	return;	451	return;
452	}	452	}
453		453
Lines 464-470 void InlineAccess::resetStubAsJumpInAcce Source/JavaScriptCore/bytecode/InlineAccess.cpp_sec2
464	{	464	{
465	if (codeBlock->useDataIC() && codeBlock->jitType() == JITType::BaselineJIT) {	465	if (codeBlock->useDataIC() && codeBlock->jitType() == JITType::BaselineJIT) {
466	stubInfo.m_codePtr = stubInfo.slowPathStartLocation;	466	stubInfo.m_codePtr = stubInfo.slowPathStartLocation;
467	stubInfo.m_inlineAccessBaseStructureID.clear(); // Clear out the inline access code.	467	stubInfo.m_inlineAccessBaseStructure = 0; // Clear out the inline access code.
468	return;	468	return;
469	}	469	}
470		470

Lines 33-53 namespace JSC { Source/JavaScriptCore/bytecode/InternalFunctionAllocationProfile.h_sec1
- Source/JavaScriptCore/bytecode/InternalFunctionAllocationProfile.h -8 / +8 lines
33		33
34	class InternalFunctionAllocationProfile {	34	class InternalFunctionAllocationProfile {
35	public:	35	public:
36	static inline ptrdiff_t offsetOfStructureID() { return OBJECT_OFFSETOF(InternalFunctionAllocationProfile, m_structureID); }	36	static inline ptrdiff_t offsetOfStructure() { return OBJECT_OFFSETOF(InternalFunctionAllocationProfile, m_structure); }
37		37
38	Structure* structure() { return m_structureID.get(); }	38	Structure* structure() { return m_structure.get(); }
39	Structure* createAllocationStructureFromBase(VM&, JSGlobalObject, JSCell owner, JSObject* prototype, Structure* base);	39	Structure* createAllocationStructureFromBase(VM&, JSGlobalObject, JSCell owner, JSObject* prototype, Structure* base);
40		40
41	void clear() { m_structureID.clear(); }	41	void clear() { m_structure.clear(); }
42	template<typename Visitor> void visitAggregate(Visitor& visitor) { visitor.append(m_structureID); }	42	template<typename Visitor> void visitAggregate(Visitor& visitor) { visitor.append(m_structure); }
43		43
44	private:	44	private:
45	WriteBarrierStructureID m_structureID;	45	WriteBarrier<Structure> m_structure;
46	};	46	};
47		47
48	inline Structure* InternalFunctionAllocationProfile::createAllocationStructureFromBase(VM& vm, JSGlobalObject* baseGlobalObject, JSCell* owner, JSObject* prototype, Structure* baseStructure)	48	inline Structure* InternalFunctionAllocationProfile::createAllocationStructureFromBase(VM& vm, JSGlobalObject* baseGlobalObject, JSCell* owner, JSObject* prototype, Structure* baseStructure)
49	{	49	{
50	ASSERT(!m_structureID \|\| m_structureID.get()->classInfo() != baseStructure->classInfo() \|\| m_structureID->globalObject() != baseStructure->globalObject());	50	ASSERT(!m_structure \|\| m_structure.get()->classInfo() != baseStructure->classInfo() \|\| m_structure->globalObject() != baseStructure->globalObject());
51	ASSERT(baseStructure->hasMonoProto());	51	ASSERT(baseStructure->hasMonoProto());
52		52
53	Structure* structure;	53	Structure* structure;
Lines 61-68 inline Structure* InternalFunctionAlloca Source/JavaScriptCore/bytecode/InternalFunctionAllocationProfile.h_sec2
61	// Ensure that if another thread sees the structure, it will see it properly created.	61	// Ensure that if another thread sees the structure, it will see it properly created.
62	WTF::storeStoreFence();	62	WTF::storeStoreFence();
63		63
64	m_structureID.set(vm, owner, structure);	64	m_structure.set(vm, owner, structure);
65	return structure;	65	return m_structure.get();
66	}	66	}
67		67
68	} // namespace JSC	68	} // namespace JSC

Lines 80-89 RefPtr<PolyProtoAccessChain> PolyProtoAc Source/JavaScriptCore/bytecode/PolyProtoAccessChain.cpp_sec1
- Source/JavaScriptCore/bytecode/PolyProtoAccessChain.cpp -2 / +2 lines
80	return adoptRef(*new PolyProtoAccessChain(WTFMove(chain)));	80	return adoptRef(*new PolyProtoAccessChain(WTFMove(chain)));
81	}	81	}
82		82
83	bool PolyProtoAccessChain::needImpurePropertyWatchpoint(VM&) const	83	bool PolyProtoAccessChain::needImpurePropertyWatchpoint(VM& vm) const
84	{	84	{
85	for (StructureID structureID : m_chain) {	85	for (StructureID structureID : m_chain) {
86	if (structureID.decode()->needImpurePropertyWatchpoint())	86	if (vm.getStructure(structureID)->needImpurePropertyWatchpoint())
87	return true;	87	return true;
88	}	88	}
89	return false;	89	return false;

Lines 81-87 PutByStatus PutByStatus::computeFromLLIn Source/JavaScriptCore/bytecode/PutByStatus.cpp_sec1
- Source/JavaScriptCore/bytecode/PutByStatus.cpp -3 / +3 lines
81	if (!structureID)	81	if (!structureID)
82	return PutByStatus(NoInformation);	82	return PutByStatus(NoInformation);
83		83
84	Structure* structure = structureID.decode();	84	Structure* structure = vm.heap.structureIDTable().get(structureID);
85		85
86	StructureID newStructureID = metadata.m_newStructureID;	86	StructureID newStructureID = metadata.m_newStructureID;
87	if (!newStructureID) {	87	if (!newStructureID) {
Lines 92-98 PutByStatus PutByStatus::computeFromLLIn Source/JavaScriptCore/bytecode/PutByStatus.cpp_sec2
92	return PutByVariant::replace(nullptr, structure, offset);	92	return PutByVariant::replace(nullptr, structure, offset);
93	}	93	}
94		94
95	Structure* newStructure = newStructureID.decode();	95	Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
96		96
97	ASSERT(structure->transitionWatchpointSetHasBeenInvalidated());	97	ASSERT(structure->transitionWatchpointSetHasBeenInvalidated());
98		98
Lines 188-194 PutByStatus PutByStatus::computeForStubI Source/JavaScriptCore/bytecode/PutByStatus.cpp_sec3
188	}	188	}
189		189
190	case CacheType::Stub: {	190	case CacheType::Stub: {
191	PolymorphicAccess* list = stubInfo->m_stub;	191	PolymorphicAccess* list = stubInfo->u.stub;
192		192
193	PutByStatus result;	193	PutByStatus result;
194	result.m_state = Simple;	194	result.m_state = Simple;

Lines 49-55 void StructureStubInfo::initGetByIdSelf( Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec1
- Source/JavaScriptCore/bytecode/StructureStubInfo.cpp -17 / +20 lines
49	ASSERT(hasConstantIdentifier);	49	ASSERT(hasConstantIdentifier);
50	setCacheType(locker, CacheType::GetByIdSelf);	50	setCacheType(locker, CacheType::GetByIdSelf);
51	m_identifier = identifier;	51	m_identifier = identifier;
52	m_inlineAccessBaseStructureID.set(codeBlock->vm(), codeBlock, inlineAccessBaseStructure);	52	m_inlineAccessBaseStructure = inlineAccessBaseStructure->id();
		53	codeBlock->vm().writeBarrier(codeBlock);
53	byIdSelfOffset = offset;	54	byIdSelfOffset = offset;
54	}	55	}
55		56
Lines 70-76 void StructureStubInfo::initPutByIdRepla Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec2
70	ASSERT(m_cacheType == CacheType::Unset);	71	ASSERT(m_cacheType == CacheType::Unset);
71	setCacheType(locker, CacheType::PutByIdReplace);	72	setCacheType(locker, CacheType::PutByIdReplace);
72	m_identifier = identifier;	73	m_identifier = identifier;
73	m_inlineAccessBaseStructureID.set(codeBlock->vm(), codeBlock, inlineAccessBaseStructure);	74	m_inlineAccessBaseStructure = inlineAccessBaseStructure->id();
		75	codeBlock->vm().writeBarrier(codeBlock);
74	byIdSelfOffset = offset;	76	byIdSelfOffset = offset;
75	}	77	}
76		78
Lines 79-85 void StructureStubInfo::initInByIdSelf(c Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec3
79	ASSERT(m_cacheType == CacheType::Unset);	81	ASSERT(m_cacheType == CacheType::Unset);
80	setCacheType(locker, CacheType::InByIdSelf);	82	setCacheType(locker, CacheType::InByIdSelf);
81	m_identifier = identifier;	83	m_identifier = identifier;
82	m_inlineAccessBaseStructureID.set(codeBlock->vm(), codeBlock, inlineAccessBaseStructure);	84	m_inlineAccessBaseStructure = inlineAccessBaseStructure->id();
		85	codeBlock->vm().writeBarrier(codeBlock);
83	byIdSelfOffset = offset;	86	byIdSelfOffset = offset;
84	}	87	}
85		88
Lines 87-93 void StructureStubInfo::deref() Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec4
87	{	90	{
88	switch (m_cacheType) {	91	switch (m_cacheType) {
89	case CacheType::Stub:	92	case CacheType::Stub:
90	delete m_stub;	93	delete u.stub;
91	return;	94	return;
92	case CacheType::Unset:	95	case CacheType::Unset:
93	case CacheType::GetByIdSelf:	96	case CacheType::GetByIdSelf:
Lines 105-111 void StructureStubInfo::aboutToDie() Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec5
105	{	108	{
106	switch (m_cacheType) {	109	switch (m_cacheType) {
107	case CacheType::Stub:	110	case CacheType::Stub:
108	m_stub->aboutToDie();	111	u.stub->aboutToDie();
109	return;	112	return;
110	case CacheType::Unset:	113	case CacheType::Unset:
111	case CacheType::GetByIdSelf:	114	case CacheType::GetByIdSelf:
Lines 136-142 AccessGenerationResult StructureStubInfo Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec6
136	AccessGenerationResult result;	139	AccessGenerationResult result;
137		140
138	if (m_cacheType == CacheType::Stub) {	141	if (m_cacheType == CacheType::Stub) {
139	result = m_stub->addCase(locker, vm, codeBlock, *this, accessCase.releaseNonNull());	142	result = u.stub->addCase(locker, vm, codeBlock, *this, accessCase.releaseNonNull());
140		143
141	if (StructureStubInfoInternal::verbose)	144	if (StructureStubInfoInternal::verbose)
142	dataLog("Had stub, result: ", result, "\n");	145	dataLog("Had stub, result: ", result, "\n");
Lines 173-179 AccessGenerationResult StructureStubInfo Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec7
173	}	176	}
174		177
175	setCacheType(locker, CacheType::Stub);	178	setCacheType(locker, CacheType::Stub);
176	m_stub = access.release();	179	u.stub = access.release();
177	}	180	}
178		181
179	ASSERT(m_cacheType == CacheType::Stub);	182	ASSERT(m_cacheType == CacheType::Stub);
Lines 199-205 AccessGenerationResult StructureStubInfo Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec8
199	// PolymorphicAccess.	202	// PolymorphicAccess.
200	clearBufferedStructures();	203	clearBufferedStructures();
201		204
202	result = m_stub->regenerate(locker, vm, globalObject, codeBlock, ecmaMode, *this);	205	result = u.stub->regenerate(locker, vm, globalObject, codeBlock, ecmaMode, *this);
203		206
204	if (StructureStubInfoInternal::verbose)	207	if (StructureStubInfoInternal::verbose)
205	dataLog("Regeneration result: ", result, "\n");	208	dataLog("Regeneration result: ", result, "\n");
Lines 213-223 AccessGenerationResult StructureStubInfo Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec9
213	// access code. That's because when we first transition to becoming a Stub, we may	216	// access code. That's because when we first transition to becoming a Stub, we may
214	// be buffered, and we have not yet generated any code. Once the Stub finally generates	217	// be buffered, and we have not yet generated any code. Once the Stub finally generates
215	// code, we're no longer running the inline access code, so we can then clear out	218	// code, we're no longer running the inline access code, so we can then clear out
216	// m_inlineAccessBaseStructureID. The reason we don't clear m_inlineAccessBaseStructureID while	219	// m_inlineAccessBaseStructure. The reason we don't clear m_inlineAccessBaseStructure while
217	// we're buffered is because we rely on it to reset during GC if m_inlineAccessBaseStructureID	220	// we're buffered is because we rely on it to reset during GC if m_inlineAccessBaseStructure
218	// is collected.	221	// is collected.
219	m_identifier = nullptr;	222	m_identifier = nullptr;
220	m_inlineAccessBaseStructureID.clear();	223	m_inlineAccessBaseStructure = 0;
221		224
222	// If we generated some code then we don't want to attempt to repatch in the future until we	225	// If we generated some code then we don't want to attempt to repatch in the future until we
223	// gather enough cases.	226	// gather enough cases.
Lines 232-238 void StructureStubInfo::reset(const Conc Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec10
232	{	235	{
233	clearBufferedStructures();	236	clearBufferedStructures();
234	m_identifier = nullptr;	237	m_identifier = nullptr;
235	m_inlineAccessBaseStructureID.clear();	238	m_inlineAccessBaseStructure = 0;
236		239
237	if (m_cacheType == CacheType::Unset)	240	if (m_cacheType == CacheType::Unset)
238	return;	241	return;
Lines 320-326 void StructureStubInfo::visitAggregateIm Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec11
320	case CacheType::GetByIdSelf:	323	case CacheType::GetByIdSelf:
321	return;	324	return;
322	case CacheType::Stub:	325	case CacheType::Stub:
323	m_stub->visitAggregate(visitor);	326	u.stub->visitAggregate(visitor);
324	return;	327	return;
325	}	328	}
326		329
Lines 345-351 void StructureStubInfo::visitWeakReferen Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec12
345	if (Structure* structure = inlineAccessBaseStructure(vm))	348	if (Structure* structure = inlineAccessBaseStructure(vm))
346	isValid &= vm.heap.isMarked(structure);	349	isValid &= vm.heap.isMarked(structure);
347	if (m_cacheType == CacheType::Stub)	350	if (m_cacheType == CacheType::Stub)
348	isValid &= m_stub->visitWeak(vm);	351	isValid &= u.stub->visitWeak(vm);
349		352
350	if (isValid)	353	if (isValid)
351	return;	354	return;
Lines 361-367 void StructureStubInfo::propagateTransit Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec13
361	structure->markIfCheap(visitor);	364	structure->markIfCheap(visitor);
362		365
363	if (m_cacheType == CacheType::Stub)	366	if (m_cacheType == CacheType::Stub)
364	m_stub->propagateTransitions(visitor);	367	u.stub->propagateTransitions(visitor);
365	}	368	}
366		369
367	template void StructureStubInfo::propagateTransitions(AbstractSlotVisitor&);	370	template void StructureStubInfo::propagateTransitions(AbstractSlotVisitor&);
Lines 372-378 StubInfoSummary StructureStubInfo::summa Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec14
372	StubInfoSummary takesSlowPath = StubInfoSummary::TakesSlowPath;	375	StubInfoSummary takesSlowPath = StubInfoSummary::TakesSlowPath;
373	StubInfoSummary simple = StubInfoSummary::Simple;	376	StubInfoSummary simple = StubInfoSummary::Simple;
374	if (m_cacheType == CacheType::Stub) {	377	if (m_cacheType == CacheType::Stub) {
375	PolymorphicAccess* list = m_stub;	378	PolymorphicAccess* list = u.stub;
376	for (unsigned i = 0; i < list->size(); ++i) {	379	for (unsigned i = 0; i < list->size(); ++i) {
377	const AccessCase& access = list->at(i);	380	const AccessCase& access = list->at(i);
378	if (access.doesCalls(vm)) {	381	if (access.doesCalls(vm)) {
Lines 404-410 bool StructureStubInfo::containsPC(void* Source/JavaScriptCore/bytecode/StructureStubInfo.cpp_sec15
404	{	407	{
405	if (m_cacheType != CacheType::Stub)	408	if (m_cacheType != CacheType::Stub)
406	return false;	409	return false;
407	return m_stub->containsPC(pc);	410	return u.stub->containsPC(pc);
408	}	411	}
409		412
410	ALWAYS_INLINE void StructureStubInfo::setCacheType(const ConcurrentJSLockerBase&, CacheType newCacheType)	413	ALWAYS_INLINE void StructureStubInfo::setCacheType(const ConcurrentJSLockerBase&, CacheType newCacheType)

Lines 211-224 public: Source/JavaScriptCore/bytecode/StructureStubInfo.h_sec1
- Source/JavaScriptCore/bytecode/StructureStubInfo.h -15 / +17 lines
211	return considerCaching(vm, codeBlock, structure, impl);	211	return considerCaching(vm, codeBlock, structure, impl);
212	}	212	}
213		213
214	Structure* inlineAccessBaseStructure(VM&)
215	{
216	return m_inlineAccessBaseStructureID.get();
217	}
218
219	static ptrdiff_t offsetOfByIdSelfOffset() { return OBJECT_OFFSETOF(StructureStubInfo, byIdSelfOffset); }
220	static ptrdiff_t offsetOfInlineAccessBaseStructureID() { return OBJECT_OFFSETOF(StructureStubInfo, m_inlineAccessBaseStructureID); }
221
222	private:	214	private:
223	ALWAYS_INLINE bool considerCaching(VM& vm, CodeBlock* codeBlock, Structure* structure, CacheableIdentifier impl)	215	ALWAYS_INLINE bool considerCaching(VM& vm, CodeBlock* codeBlock, Structure* structure, CacheableIdentifier impl)
224	{	216	{
Lines 359-368 private: Source/JavaScriptCore/bytecode/StructureStubInfo.h_sec2
359		351
360	public:	352	public:
361	CodeOrigin codeOrigin;	353	CodeOrigin codeOrigin;
362	PolymorphicAccess* m_stub { nullptr };
363	PropertyOffset byIdSelfOffset;	354	PropertyOffset byIdSelfOffset;
364	WriteBarrierStructureID m_inlineAccessBaseStructureID;	355	static ptrdiff_t offsetOfByIdSelfOffset() { return OBJECT_OFFSETOF(StructureStubInfo, byIdSelfOffset); }
365		356	static ptrdiff_t offsetOfInlineAccessBaseStructure() { return OBJECT_OFFSETOF(StructureStubInfo, m_inlineAccessBaseStructure); }
		357	union {
		358	PolymorphicAccess* stub;
		359	} u;
		360	Structure* inlineAccessBaseStructure(VM& vm)
		361	{
		362	if (!m_inlineAccessBaseStructure)
		363	return nullptr;
		364	return vm.getStructure(m_inlineAccessBaseStructure);
		365	}
		366	StructureID m_inlineAccessBaseStructure { 0 };
366	private:	367	private:
367	CacheableIdentifier m_identifier;	368	CacheableIdentifier m_identifier;
368	// Represents those structures that already have buffered AccessCases in the PolymorphicAccess.	369	// Represents those structures that already have buffered AccessCases in the PolymorphicAccess.
Lines 421-431 public: Source/JavaScriptCore/bytecode/StructureStubInfo.h_sec3
421	uint8_t countdown { 1 };	422	uint8_t countdown { 1 };
422	uint8_t repatchCount { 0 };	423	uint8_t repatchCount { 0 };
423	uint8_t numberOfCoolDowns { 0 };	424	uint8_t numberOfCoolDowns { 0 };
424	uint8_t bufferingCountdown;	425
425	private:
426	Lock m_bufferedStructuresLock;
427	public:
428	CallSiteIndex callSiteIndex;	426	CallSiteIndex callSiteIndex;
		427
		428	uint8_t bufferingCountdown;
429	bool resetByGC : 1;	429	bool resetByGC : 1;
430	bool tookSlowPath : 1;	430	bool tookSlowPath : 1;
431	bool everConsidered : 1;	431	bool everConsidered : 1;
Lines 435-440 public: Source/JavaScriptCore/bytecode/StructureStubInfo.h_sec4
435	bool propertyIsString : 1;	435	bool propertyIsString : 1;
436	bool propertyIsInt32 : 1;	436	bool propertyIsInt32 : 1;
437	bool propertyIsSymbol : 1;	437	bool propertyIsSymbol : 1;
		438	private:
		439	Lock m_bufferedStructuresLock;
438	};	440	};
439		441
440	inline CodeOrigin getStructureStubInfoCodeOrigin(StructureStubInfo& structureStubInfo)	442	inline CodeOrigin getStructureStubInfoCodeOrigin(StructureStubInfo& structureStubInfo)

Lines 48-54 class VM; Source/JavaScriptCore/heap/AbstractSlotVisitor.h_sec1
- Source/JavaScriptCore/heap/AbstractSlotVisitor.h -3 lines
48	class VerifierSlotVisitor;	48	class VerifierSlotVisitor;
49	template<typename T> class Weak;	49	template<typename T> class Weak;
50	template<typename T, typename Traits> class WriteBarrierBase;	50	template<typename T, typename Traits> class WriteBarrierBase;
51	class WriteBarrierStructureID;
52		51
53	class AbstractSlotVisitor {	52	class AbstractSlotVisitor {
54	WTF_MAKE_NONCOPYABLE(AbstractSlotVisitor);	53	WTF_MAKE_NONCOPYABLE(AbstractSlotVisitor);
Lines 144-151 public: Source/JavaScriptCore/heap/AbstractSlotVisitor.h_sec2
144		143
145	template<typename T, typename Traits> void append(const WriteBarrierBase<T, Traits>&);	144	template<typename T, typename Traits> void append(const WriteBarrierBase<T, Traits>&);
146	template<typename T, typename Traits> void appendHidden(const WriteBarrierBase<T, Traits>&);	145	template<typename T, typename Traits> void appendHidden(const WriteBarrierBase<T, Traits>&);
147	void append(const WriteBarrierStructureID&);
148	void appendHidden(const WriteBarrierStructureID&);
149	template<typename Iterator> void append(Iterator begin , Iterator end);	146	template<typename Iterator> void append(Iterator begin , Iterator end);
150	ALWAYS_INLINE void appendValues(const WriteBarrierBase<Unknown, RawValueTraits<Unknown>>*, size_t count);	147	ALWAYS_INLINE void appendValues(const WriteBarrierBase<Unknown, RawValueTraits<Unknown>>*, size_t count);
151	ALWAYS_INLINE void appendValuesHidden(const WriteBarrierBase<Unknown, RawValueTraits<Unknown>>*, size_t count);	148	ALWAYS_INLINE void appendValuesHidden(const WriteBarrierBase<Unknown, RawValueTraits<Unknown>>*, size_t count);

Lines 158-173 ALWAYS_INLINE void AbstractSlotVisitor:: Source/JavaScriptCore/heap/AbstractSlotVisitorInlines.h_sec1
- Source/JavaScriptCore/heap/AbstractSlotVisitorInlines.h -10 lines
158	appendHiddenUnbarriered(slot.get());	158	appendHiddenUnbarriered(slot.get());
159	}	159	}
160		160
161	ALWAYS_INLINE void AbstractSlotVisitor::append(const WriteBarrierStructureID& slot)
162	{
163	appendUnbarriered(reinterpret_cast<JSCell*>(slot.get()));
164	}
165
166	ALWAYS_INLINE void AbstractSlotVisitor::appendHidden(const WriteBarrierStructureID& slot)
167	{
168	appendHiddenUnbarriered(reinterpret_cast<JSCell*>(slot.get()));
169	}
170
171	ALWAYS_INLINE void AbstractSlotVisitor::appendHiddenUnbarriered(JSValue value)	161	ALWAYS_INLINE void AbstractSlotVisitor::appendHiddenUnbarriered(JSValue value)
172	{	162	{
173	if (value.isCell())	163	if (value.isCell())

Lines 67-73 Source/JavaScriptCore/heap/Heap.cpp_sec1
- Source/JavaScriptCore/heap/Heap.cpp -3 / +4 lines
67	#include "SpaceTimeMutatorScheduler.h"	67	#include "SpaceTimeMutatorScheduler.h"
68	#include "StochasticSpaceTimeMutatorScheduler.h"	68	#include "StochasticSpaceTimeMutatorScheduler.h"
69	#include "StopIfNecessaryTimer.h"	69	#include "StopIfNecessaryTimer.h"
70	#include "StructureAlignedMemoryAllocator.h"
71	#include "SubspaceInlines.h"	70	#include "SubspaceInlines.h"
72	#include "SuperSampler.h"	71	#include "SuperSampler.h"
73	#include "SweepingScope.h"	72	#include "SweepingScope.h"
Lines 389-396 Heap::Heap(VM& vm, HeapType heapType) Source/JavaScriptCore/heap/Heap.cpp_sec2
389	, stringObjectSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, StringObject)	388	, stringObjectSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, StringObject)
390	, structureChainSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, StructureChain)	389	, structureChainSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, StructureChain)
391	, structureRareDataSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, StructureRareData) // Hash:0xaca4e62d	390	, structureRareDataSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, StructureRareData) // Hash:0xaca4e62d
392	, structureSpace("IsolatedStructureSpace", *this, destructibleCellHeapCellType, sizeof(Structure), Structure::numberOfLowerTierCells, makeUnique<StructureAlignedMemoryAllocator>("Structure"))	391	, structureSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, Structure)
393	, brandedStructureSpace("IsolatedBrandedStructureSpace", *this, destructibleCellHeapCellType, sizeof(BrandedStructure), BrandedStructure::numberOfLowerTierCells, makeUnique<StructureAlignedMemoryAllocator>("Structure"))	392	, brandedStructureSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, BrandedStructure)
394	, symbolTableSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, SymbolTable) // Hash:0xc5215afd	393	, symbolTableSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, SymbolTable) // Hash:0xc5215afd
395	, executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)	394	, executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
396	, executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)	395	, executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
Lines 1606-1611 NEVER_INLINE bool Heap::runEndPhase(GCCo Source/JavaScriptCore/heap/Heap.cpp_sec3
1606	if (vm().typeProfiler())	1605	if (vm().typeProfiler())
1607	vm().typeProfiler()->invalidateTypeSetCache(vm());	1606	vm().typeProfiler()->invalidateTypeSetCache(vm());
1608		1607
		1608	m_structureIDTable.flushOldTables();
		1609
1609	reapWeakHandles();	1610	reapWeakHandles();
1610	pruneStaleEntriesFromWeakGCHashTables();	1611	pruneStaleEntriesFromWeakGCHashTables();
1611	sweepArrayBuffers();	1612	sweepArrayBuffers();

Lines 30-42 Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.cpp_sec1
- Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.cpp -22 / +61 lines
30	namespace JSC {	30	namespace JSC {
31		31
32	IsoAlignedMemoryAllocator::IsoAlignedMemoryAllocator(CString name)	32	IsoAlignedMemoryAllocator::IsoAlignedMemoryAllocator(CString name)
33	: Base(name)	33	#if ENABLE(MALLOC_HEAP_BREAKDOWN)
		34	: m_debugHeap(name.data())
		35	#endif
34	{	36	{
		37	UNUSED_PARAM(name);
35	}	38	}
36		39
37	IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator()	40	IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator()
38	{	41	{
39	releaseMemoryFromSubclassDestructor();	42	#if !ENABLE(MALLOC_HEAP_BREAKDOWN)
		43	for (unsigned i = 0; i < m_blocks.size(); ++i) {
		44	void* block = m_blocks[i];
		45	if (!m_committed.quickGet(i))
		46	WTF::fastCommitAlignedMemory(block, MarkedBlock::blockSize);
		47	fastAlignedFree(block);
		48	}
		49	#endif
		50	}
		51
		52	void* IsoAlignedMemoryAllocator::tryAllocateAlignedMemory(size_t alignment, size_t size)
		53	{
		54	// Since this is designed specially for IsoSubspace, we know that we will only be asked to
		55	// allocate MarkedBlocks.
		56	RELEASE_ASSERT(alignment == MarkedBlock::blockSize);
		57	RELEASE_ASSERT(size == MarkedBlock::blockSize);
		58
		59	#if ENABLE(MALLOC_HEAP_BREAKDOWN)
		60	return m_debugHeap.memalign(MarkedBlock::blockSize, MarkedBlock::blockSize, true);
		61	#else
		62	Locker locker { m_lock };
		63
		64	m_firstUncommitted = m_committed.findBit(m_firstUncommitted, false);
		65	if (m_firstUncommitted < m_blocks.size()) {
		66	m_committed.quickSet(m_firstUncommitted);
		67	void* result = m_blocks[m_firstUncommitted];
		68	WTF::fastCommitAlignedMemory(result, MarkedBlock::blockSize);
		69	return result;
		70	}
		71
		72	void* result = tryFastAlignedMalloc(MarkedBlock::blockSize, MarkedBlock::blockSize);
		73	if (!result)
		74	return nullptr;
		75	unsigned index = m_blocks.size();
		76	m_blocks.append(result);
		77	m_blockIndices.add(result, index);
		78	if (m_blocks.capacity() != m_committed.size())
		79	m_committed.resize(m_blocks.capacity());
		80	m_committed.quickSet(index);
		81	return result;
		82	#endif
		83	}
		84
		85	void IsoAlignedMemoryAllocator::freeAlignedMemory(void* basePtr)
		86	{
		87	#if ENABLE(MALLOC_HEAP_BREAKDOWN)
		88	m_debugHeap.free(basePtr);
		89	#else
		90	Locker locker { m_lock };
		91
		92	auto iter = m_blockIndices.find(basePtr);
		93	RELEASE_ASSERT(iter != m_blockIndices.end());
		94	unsigned index = iter->value;
		95	m_committed.quickClear(index);
		96	m_firstUncommitted = std::min(index, m_firstUncommitted);
		97	WTF::fastDecommitAlignedMemory(basePtr, MarkedBlock::blockSize);
		98	#endif
40	}	99	}
41		100
42	void IsoAlignedMemoryAllocator::dump(PrintStream& out) const	101	void IsoAlignedMemoryAllocator::dump(PrintStream& out) const
Lines 68-92 void* IsoAlignedMemoryAllocator::tryReal Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.cpp_sec2
68	RELEASE_ASSERT_NOT_REACHED();	127	RELEASE_ASSERT_NOT_REACHED();
69	}	128	}
70		129
71	void* IsoAlignedMemoryAllocator::tryMallocBlock()
72	{
73	return tryFastAlignedMalloc(MarkedBlock::blockSize, MarkedBlock::blockSize);
74	}
75
76	void IsoAlignedMemoryAllocator::freeBlock(void* block)
77	{
78	fastAlignedFree(block);
79	}
80
81	void IsoAlignedMemoryAllocator::commitBlock(void* block)
82	{
83	WTF::fastCommitAlignedMemory(block, MarkedBlock::blockSize);
84	}
85
86	void IsoAlignedMemoryAllocator::decommitBlock(void* block)
87	{
88	WTF::fastDecommitAlignedMemory(block, MarkedBlock::blockSize);
89	}
90
91	} // namespace JSC	130	} // namespace JSC
92		131

Lines 1-108 Source/JavaScriptCore/heap/IsoMemoryAllocatorBase.cpp_sec1
- Source/JavaScriptCore/heap/IsoMemoryAllocatorBase.cpp -108 lines
1	/*
2	* Copyright (C) 2017-2021 Apple Inc. All rights reserved.
3	*
4	* Redistribution and use in source and binary forms, with or without
5	* modification, are permitted provided that the following conditions
6	* are met:
7	* 1. Redistributions of source code must retain the above copyright
8	* notice, this list of conditions and the following disclaimer.
9	* 2. Redistributions in binary form must reproduce the above copyright
10	* notice, this list of conditions and the following disclaimer in the
11	* documentation and/or other materials provided with the distribution.
12	*
13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24	*/
25
26	#include "config.h"
27	#include "IsoMemoryAllocatorBase.h"
28
29	#include "MarkedBlock.h"
30
31	namespace JSC {
32
33	IsoMemoryAllocatorBase::IsoMemoryAllocatorBase(CString name)
34	#if ENABLE(MALLOC_HEAP_BREAKDOWN)
35	: m_debugHeap(name.data())
36	#endif
37	{
38	UNUSED_PARAM(name);
39	}
40
41	IsoMemoryAllocatorBase::~IsoMemoryAllocatorBase()
42	{
43	}
44
45	// We need to call this from the derived class's destructor because it's undefined behavior to call pure virtual methods from within a destructor.
46	void IsoMemoryAllocatorBase::releaseMemoryFromSubclassDestructor()
47	{
48	#if !ENABLE(MALLOC_HEAP_BREAKDOWN)
49	for (unsigned i = 0; i < m_blocks.size(); ++i) {
50	void* block = m_blocks[i];
51	if (!m_committed.quickGet(i))
52	commitBlock(block);
53	freeBlock(block);
54	}
55	#endif
56	}
57
58	void* IsoMemoryAllocatorBase::tryAllocateAlignedMemory(size_t alignment, size_t size)
59	{
60	// Since this is designed specially for IsoSubspace, we know that we will only be asked to
61	// allocate MarkedBlocks.
62	RELEASE_ASSERT(alignment == MarkedBlock::blockSize);
63	RELEASE_ASSERT(size == MarkedBlock::blockSize);
64
65	#if ENABLE(MALLOC_HEAP_BREAKDOWN)
66	return m_debugHeap.memalign(MarkedBlock::blockSize, MarkedBlock::blockSize, true);
67	#else
68	Locker locker { m_lock };
69
70	m_firstUncommitted = m_committed.findBit(m_firstUncommitted, false);
71	if (m_firstUncommitted < m_blocks.size()) {
72	m_committed.quickSet(m_firstUncommitted);
73	void* result = m_blocks[m_firstUncommitted];
74	commitBlock(result);
75	return result;
76	}
77
78	void* result = tryMallocBlock();
79	if (!result)
80	return nullptr;
81	unsigned index = m_blocks.size();
82	m_blocks.append(result);
83	m_blockIndices.add(result, index);
84	if (m_blocks.capacity() != m_committed.size())
85	m_committed.resize(m_blocks.capacity());
86	m_committed.quickSet(index);
87	return result;
88	#endif
89	}
90
91	void IsoMemoryAllocatorBase::freeAlignedMemory(void* basePtr)
92	{
93	#if ENABLE(MALLOC_HEAP_BREAKDOWN)
94	m_debugHeap.free(basePtr);
95	#else
96	Locker locker { m_lock };
97
98	auto iter = m_blockIndices.find(basePtr);
99	RELEASE_ASSERT(iter != m_blockIndices.end());
100	unsigned index = iter->value;
101	m_committed.quickClear(index);
102	m_firstUncommitted = std::min(index, m_firstUncommitted);
103	decommitBlock(basePtr);
104	#endif
105	}
106
107	} // namespace JSC
108

Lines 33-43 Source/JavaScriptCore/heap/IsoSubspace.cpp_sec1
- Source/JavaScriptCore/heap/IsoSubspace.cpp -5 / +4 lines
33		33
34	namespace JSC {	34	namespace JSC {
35		35
36	IsoSubspace::IsoSubspace(CString name, Heap& heap, const HeapCellType& heapCellType, size_t size, uint8_t numberOfLowerTierCells, std::unique_ptr<IsoMemoryAllocatorBase>&& allocator)	36	IsoSubspace::IsoSubspace(CString name, Heap& heap, const HeapCellType& heapCellType, size_t size, uint8_t numberOfLowerTierCells)
37	: Subspace(name, heap)	37	: Subspace(name, heap)
38	, m_directory(WTF::roundUpToMultipleOf<MarkedBlock::atomSize>(size))	38	, m_directory(WTF::roundUpToMultipleOf<MarkedBlock::atomSize>(size))
39	, m_localAllocator(&m_directory)	39	, m_localAllocator(&m_directory)
40	, m_isoAlignedMemoryAllocator(allocator ? WTFMove(allocator) : makeUnique<IsoAlignedMemoryAllocator>(name))	40	, m_isoAlignedMemoryAllocator(makeUnique<IsoAlignedMemoryAllocator>(name))
41	{	41	{
42	m_remainingLowerTierCellCount = numberOfLowerTierCells;	42	m_remainingLowerTierCellCount = numberOfLowerTierCells;
43	ASSERT(WTF::roundUpToMultipleOf<MarkedBlock::atomSize>(size) == cellSize());	43	ASSERT(WTF::roundUpToMultipleOf<MarkedBlock::atomSize>(size) == cellSize());
Lines 99-107 void* IsoSubspace::tryAllocateFromLowerT Source/JavaScriptCore/heap/IsoSubspace.cpp_sec2
99	return revive(allocation);	99	return revive(allocation);
100	}	100	}
101	if (m_remainingLowerTierCellCount) {	101	if (m_remainingLowerTierCellCount) {
102	PreciseAllocation* allocation = PreciseAllocation::tryCreateForLowerTier(m_space.heap(), cellSize(), this, --m_remainingLowerTierCellCount);	102	PreciseAllocation* allocation = PreciseAllocation::createForLowerTier(m_space.heap(), cellSize(), this, --m_remainingLowerTierCellCount);
103	if (allocation)	103	return revive(allocation);
104	return revive(allocation);
105	}	104	}
106	return nullptr;	105	return nullptr;
107	}	106	}

Lines 152-160 void SlotVisitor::appendJSCellOrAuxiliar Source/JavaScriptCore/heap/SlotVisitor.cpp_sec1
- Source/JavaScriptCore/heap/SlotVisitor.cpp -6 / +7 lines
152	out.print("GC type: ", heap()->collectionScope(), "\n");	152	out.print("GC type: ", heap()->collectionScope(), "\n");
153	out.print("Object at: ", RawPointer(jsCell), "\n");	153	out.print("Object at: ", RawPointer(jsCell), "\n");
154	#if USE(JSVALUE64)	154	#if USE(JSVALUE64)
155	out.print("Structure ID: ", structureID.bits(), " (", RawPointer(structureID.decode()), ")\n");	155	out.print("Structure ID: ", structureID, " (0x", format("%x", structureID), ")\n");
		156	out.print("Structure ID table size: ", heap()->structureIDTable().size(), "\n");
156	#else	157	#else
157	out.print("Structure: ", RawPointer(structureID.decode()), "\n");	158	out.print("Structure: ", RawPointer(structureID), "\n");
158	#endif	159	#endif
159	out.print("Object contents:");	160	out.print("Object contents:");
160	for (unsigned i = 0; i < 2; ++i)	161	for (unsigned i = 0; i < 2; ++i)
Lines 185-197 void SlotVisitor::appendJSCellOrAuxiliar Source/JavaScriptCore/heap/SlotVisitor.cpp_sec2
185	die("GC scan found corrupt object: structureID is zero!\n");	186	die("GC scan found corrupt object: structureID is zero!\n");
186		187
187	// It's not OK for the structure to be nuked at any GC scan point.	188	// It's not OK for the structure to be nuked at any GC scan point.
188	if (structureID.isNuked())	189	if (isNuked(structureID))
189	die("GC scan found object in bad state: structureID is nuked!\n");	190	die("GC scan found object in bad state: structureID is nuked!\n");
190		191
191	// This detects the worst of the badness.	192	// This detects the worst of the badness.
192	Integrity::auditStructureID(structureID);	193	Integrity::auditStructureID(heap()->structureIDTable(), structureID);
193	};	194	};
194		195
195	// In debug mode, we validate before marking since this makes it clearer what the problem	196	// In debug mode, we validate before marking since this makes it clearer what the problem
196	// was. It's also slower, so we don't do it normally.	197	// was. It's also slower, so we don't do it normally.
197	if (ASSERT_ENABLED && isJSCellKind(heapCell->cellKind()))	198	if (ASSERT_ENABLED && isJSCellKind(heapCell->cellKind()))

Lines 1-180 Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.cpp_sec1
- Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.cpp -180 lines
1	/*
2	* Copyright (C) 2017-2021 Apple Inc. All rights reserved.
3	*
4	* Redistribution and use in source and binary forms, with or without
5	* modification, are permitted provided that the following conditions
6	* are met:
7	* 1. Redistributions of source code must retain the above copyright
8	* notice, this list of conditions and the following disclaimer.
9	* 2. Redistributions in binary form must reproduce the above copyright
10	* notice, this list of conditions and the following disclaimer in the
11	* documentation and/or other materials provided with the distribution.
12	*
13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24	*/
25
26	#include "config.h"
27	#include "StructureAlignedMemoryAllocator.h"
28
29	#include "JSCConfig.h"
30	#include "MarkedBlock.h"
31
32	#include <wtf/OSAllocator.h>
33
34	namespace JSC {
35
36	StructureAlignedMemoryAllocator::StructureAlignedMemoryAllocator(CString name)
37	: Base(name)
38	{
39	}
40
41	StructureAlignedMemoryAllocator::~StructureAlignedMemoryAllocator()
42	{
43	releaseMemoryFromSubclassDestructor();
44	}
45
46	void StructureAlignedMemoryAllocator::dump(PrintStream& out) const
47	{
48	out.print("Structure(", RawPointer(this), ")");
49	}
50
51	void* StructureAlignedMemoryAllocator::tryAllocateMemory(size_t)
52	{
53	return nullptr;
54	}
55
56	void StructureAlignedMemoryAllocator::freeMemory(void*)
57	{
58	// Structures do not support Precise allocations right now.
59	RELEASE_ASSERT_NOT_REACHED();
60	}
61
62	void* StructureAlignedMemoryAllocator::tryReallocateMemory(void*, size_t)
63	{
64	// Structures do not support Precise allocations right now.
65	RELEASE_ASSERT_NOT_REACHED();
66	}
67
68	#if CPU(ADDRESS64)
69
70	class StructureMemoryManager {
71	public:
72	StructureMemoryManager()
73	{
74	// Don't use the first page because zero is used as the empty StructureID and the first allocation will conflict.
75	m_usedBlocks.set(0);
76	}
77
78	void* tryMallocStructureBlock()
79	{
80	size_t freeIndex;
81	{
82	Locker locker(m_lock);
83	constexpr size_t startIndex = 0;
84	freeIndex = m_usedBlocks.findBit(startIndex, 0);
85	ASSERT(freeIndex <= m_usedBlocks.bitCount());
86	if (freeIndex * MarkedBlock::blockSize >= structureHeapAddressSize)
87	return nullptr;
88	m_usedBlocks.set(freeIndex);
89	}
90
91	MarkedBlock* block = reinterpret_cast<MarkedBlock>(g_jscConfig.startOfStructureHeap) + freeIndex MarkedBlock::blockSize;
92	constexpr bool writable = true;
93	constexpr bool executable = false;
94	OSAllocator::commit(block, MarkedBlock::blockSize, writable, executable);
95	return block;
96	}
97
98	void freeStructureBlock(void* blockPtr)
99	{
100	OSAllocator::decommit(blockPtr, MarkedBlock::blockSize);
101	uintptr_t block = reinterpret_cast<uintptr_t>(blockPtr);
102	RELEASE_ASSERT(g_jscConfig.startOfStructureHeap <= block && block < g_jscConfig.startOfStructureHeap + structureHeapAddressSize);
103	RELEASE_ASSERT(roundUpToMultipleOf<MarkedBlock::blockSize>(block) == block);
104
105	Locker locker(m_lock);
106	m_usedBlocks.quickClear((block - g_jscConfig.startOfStructureHeap) / MarkedBlock::blockSize);
107	}
108
109	private:
110	Lock m_lock;
111	BitVector m_usedBlocks;
112	};
113
114	static LazyNeverDestroyed<StructureMemoryManager> s_structureMemoryManager;
115
116	void StructureAlignedMemoryAllocator::initializeStructureAddressSpace()
117	{
118	static_assert(hasOneBitSet(structureHeapAddressSize));
119
120	g_jscConfig.startOfStructureHeap = reinterpret_cast<uintptr_t>(OSAllocator::reserveUncommittedAligned(structureHeapAddressSize, OSAllocator::FastMallocPages));
121	s_structureMemoryManager.construct();
122
123	ASSERT((g_jscConfig.startOfStructureHeap & ~structureIDMask) == g_jscConfig.startOfStructureHeap);
124	}
125
126	void* StructureAlignedMemoryAllocator::tryMallocBlock()
127	{
128	return s_structureMemoryManager->tryMallocStructureBlock();
129	}
130
131	void StructureAlignedMemoryAllocator::freeBlock(void* block)
132	{
133	s_structureMemoryManager->freeStructureBlock(block);
134	}
135
136	void StructureAlignedMemoryAllocator::commitBlock(void* block)
137	{
138	constexpr bool writable = true;
139	constexpr bool executable = false;
140	OSAllocator::commit(block, MarkedBlock::blockSize, writable, executable);
141	}
142
143	void StructureAlignedMemoryAllocator::decommitBlock(void* block)
144	{
145	OSAllocator::decommit(block, MarkedBlock::blockSize);
146	}
147
148	#else // not CPU(ADDRESS64)
149
150	// FIXME: This is the same as IsoAlignedMemoryAllocator maybe we should just use that for 32-bit.
151
152	void StructureAlignedMemoryAllocator::initializeStructureAddressSpace()
153	{
154	g_jscConfig.startOfStructureHeap = 0;
155	}
156
157	void* StructureAlignedMemoryAllocator::tryMallocBlock()
158	{
159	return tryFastAlignedMalloc(MarkedBlock::blockSize, MarkedBlock::blockSize);
160	}
161
162	void StructureAlignedMemoryAllocator::freeBlock(void* block)
163	{
164	fastAlignedFree(block);
165	}
166
167	void StructureAlignedMemoryAllocator::commitBlock(void* block)
168	{
169	WTF::fastCommitAlignedMemory(block, MarkedBlock::blockSize);
170	}
171
172	void StructureAlignedMemoryAllocator::decommitBlock(void* block)
173	{
174	WTF::fastDecommitAlignedMemory(block, MarkedBlock::blockSize);
175	}
176
177	#endif // CPU(ADDRESS64)
178
179	} // namespace JSC
180

Lines 1-60 Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.h_sec1
- Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.h -60 lines
1	/*
2	* Copyright (C) 2021 Apple Inc. All rights reserved.
3	*
4	* Redistribution and use in source and binary forms, with or without
5	* modification, are permitted provided that the following conditions
6	* are met:
7	* 1. Redistributions of source code must retain the above copyright
8	* notice, this list of conditions and the following disclaimer.
9	* 2. Redistributions in binary form must reproduce the above copyright
10	* notice, this list of conditions and the following disclaimer in the
11	* documentation and/or other materials provided with the distribution.
12	*
13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24	*/
25
26	#pragma once
27
28	#include "IsoMemoryAllocatorBase.h"
29	#include <wtf/Gigacage.h>
30
31	#if ENABLE(MALLOC_HEAP_BREAKDOWN)
32	#include <wtf/DebugHeap.h>
33	#endif
34
35	namespace JSC {
36
37	class StructureAlignedMemoryAllocator final : public IsoMemoryAllocatorBase {
38	public:
39	using Base = IsoMemoryAllocatorBase;
40
41	StructureAlignedMemoryAllocator(CString);
42	~StructureAlignedMemoryAllocator() final;
43
44	void dump(PrintStream&) const final;
45
46	void* tryAllocateMemory(size_t) final;
47	void freeMemory(void*) final;
48	void* tryReallocateMemory(void*, size_t) final;
49
50	static void initializeStructureAddressSpace();
51
52	protected:
53	void* tryMallocBlock() final;
54	void freeBlock(void* block) final;
55	void commitBlock(void* block) final;
56	void decommitBlock(void* block) final;
57	};
58
59	} // namespace JSC
60

Lines 320-326 void AssemblyHelpers::emitStoreStructure Source/JavaScriptCore/jit/AssemblyHelpers.cpp_sec1
- Source/JavaScriptCore/jit/AssemblyHelpers.cpp -19 / +34 lines
320	#if USE(JSVALUE64)	320	#if USE(JSVALUE64)
321	jit.store64(TrustedImm64(structurePtr->idBlob()), MacroAssembler::Address(dest, JSCell::structureIDOffset()));	321	jit.store64(TrustedImm64(structurePtr->idBlob()), MacroAssembler::Address(dest, JSCell::structureIDOffset()));
322	if (ASSERT_ENABLED) {	322	if (ASSERT_ENABLED) {
323	Jump correctStructure = jit.branch32(Equal, MacroAssembler::Address(dest, JSCell::structureIDOffset()), TrustedImm32(structurePtr->id().bits()));	323	Jump correctStructure = jit.branch32(Equal, MacroAssembler::Address(dest, JSCell::structureIDOffset()), TrustedImm32(structurePtr->id()));
324	jit.abortWithReason(AHStructureIDIsValid);	324	jit.abortWithReason(AHStructureIDIsValid);
325	correctStructure.link(&jit);	325	correctStructure.link(&jit);
326		326
Lines 389-417 void AssemblyHelpers::storeProperty(JSVa Source/JavaScriptCore/jit/AssemblyHelpers.cpp_sec2
389	BaseIndex(scratch, offset, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)));	389	BaseIndex(scratch, offset, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)));
390	}	390	}
391		391
392	void AssemblyHelpers::emitNonNullDecodeStructureID(RegisterID source, RegisterID dest)	392	void AssemblyHelpers::emitLoadStructure(VM& vm, RegisterID source, RegisterID dest, RegisterID scratch)
393	{	393	{
394	move(source, dest);	394	#if USE(JSVALUE64)
395	#if CPU(ADDRESS64)	395	#if CPU(ARM64)
396	// This could use BFI on arm64 but that only helps if the start of structure heap is encodable as a mov and not as an immediate in the add so it's probably not super important.	396	RegisterID scratch2 = dataTempRegister;
397	and32(TrustedImm32(structureIDMask), dest);	397	#elif CPU(X86_64)
398	add64(TrustedImm64(g_jscConfig.startOfStructureHeap), dest);	398	RegisterID scratch2 = scratchRegister();
399	#endif // not CPU(ADDRESS64)	399	#else
400	}	400	#error "Unsupported cpu"
		401	#endif
401		402
402	void AssemblyHelpers::emitLoadStructure(VM&, RegisterID source, RegisterID dest)	403	ASSERT(dest != scratch);
403	{	404	ASSERT(dest != scratch2);
404	load32(MacroAssembler::Address(source, JSCell::structureIDOffset()), dest);	405	ASSERT(scratch != scratch2);
405	emitNonNullDecodeStructureID(dest, dest);	406
		407	load32(MacroAssembler::Address(source, JSCell::structureIDOffset()), scratch2);
		408	loadPtr(vm.heap.structureIDTable().base(), scratch);
		409	rshift32(scratch2, TrustedImm32(StructureIDTable::s_numberOfEntropyBits), dest);
		410	loadPtr(MacroAssembler::BaseIndex(scratch, dest, MacroAssembler::ScalePtr), dest);
		411	lshiftPtr(TrustedImm32(StructureIDTable::s_entropyBitsShiftForStructurePointer), scratch2);
		412	xorPtr(scratch2, dest);
		413	#else // not USE(JSVALUE64)
		414	UNUSED_PARAM(scratch);
		415	UNUSED_PARAM(vm);
		416	loadPtr(MacroAssembler::Address(source, JSCell::structureIDOffset()), dest);
		417	#endif // not USE(JSVALUE64)
406	}	418	}
407		419
408	void AssemblyHelpers::emitLoadPrototype(VM& vm, GPRReg objectGPR, JSValueRegs resultRegs, JumpList& slowPath)	420	void AssemblyHelpers::emitLoadPrototype(VM& vm, GPRReg objectGPR, JSValueRegs resultRegs, GPRReg scratchGPR, JumpList& slowPath)
409	{	421	{
410	ASSERT(resultRegs.payloadGPR() != objectGPR);	422	ASSERT(resultRegs.payloadGPR() != objectGPR);
		423	ASSERT(resultRegs.payloadGPR() != scratchGPR);
		424	ASSERT(objectGPR != scratchGPR);
411		425
412	emitLoadStructure(vm, objectGPR, resultRegs.payloadGPR());	426	emitLoadStructure(vm, objectGPR, resultRegs.payloadGPR(), scratchGPR);
413		427
414	auto overridesGetPrototype = branchTest32(MacroAssembler::NonZero, MacroAssembler::Address(resultRegs.payloadGPR(), Structure::outOfLineTypeFlagsOffset()), TrustedImm32(OverridesGetPrototypeOutOfLine));	428	load16(MacroAssembler::Address(resultRegs.payloadGPR(), Structure::outOfLineTypeFlagsOffset()), scratchGPR);
		429	auto overridesGetPrototype = branchTest32(MacroAssembler::NonZero, scratchGPR, TrustedImm32(OverridesGetPrototypeOutOfLine));
415	slowPath.append(overridesGetPrototype);	430	slowPath.append(overridesGetPrototype);
416		431
417	loadValue(MacroAssembler::Address(resultRegs.payloadGPR(), Structure::prototypeOffset()), resultRegs);	432	loadValue(MacroAssembler::Address(resultRegs.payloadGPR(), Structure::prototypeOffset()), resultRegs);
Lines 510-516 void AssemblyHelpers::emitRandomThunk(JS Source/JavaScriptCore/jit/AssemblyHelpers.cpp_sec3
510	void AssemblyHelpers::emitRandomThunk(VM& vm, GPRReg scratch0, GPRReg scratch1, GPRReg scratch2, GPRReg scratch3, FPRReg result)	525	void AssemblyHelpers::emitRandomThunk(VM& vm, GPRReg scratch0, GPRReg scratch1, GPRReg scratch2, GPRReg scratch3, FPRReg result)
511	{	526	{
512	emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, scratch3);	527	emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, scratch3);
513	emitLoadStructure(vm, scratch3, scratch3);	528	emitLoadStructure(vm, scratch3, scratch3, scratch0);
514	loadPtr(Address(scratch3, Structure::globalObjectOffset()), scratch3);	529	loadPtr(Address(scratch3, Structure::globalObjectOffset()), scratch3);
515	// Now, scratch3 holds JSGlobalObject*.	530	// Now, scratch3 holds JSGlobalObject*.
516		531
Lines 823-829 void AssemblyHelpers::emitConvertValueTo Source/JavaScriptCore/jit/AssemblyHelpers.cpp_sec4
823	ASSERT(scratchIfShouldCheckMasqueradesAsUndefined != InvalidGPRReg);	838	ASSERT(scratchIfShouldCheckMasqueradesAsUndefined != InvalidGPRReg);
824	JumpList isNotMasqueradesAsUndefined;	839	JumpList isNotMasqueradesAsUndefined;
825	isNotMasqueradesAsUndefined.append(branchTest8(Zero, Address(value.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)));	840	isNotMasqueradesAsUndefined.append(branchTest8(Zero, Address(value.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)));
826	emitLoadStructure(vm, value.payloadGPR(), result);	841	emitLoadStructure(vm, value.payloadGPR(), result, scratchIfShouldCheckMasqueradesAsUndefined);
827	move(TrustedImmPtr(globalObject), scratchIfShouldCheckMasqueradesAsUndefined);	842	move(TrustedImmPtr(globalObject), scratchIfShouldCheckMasqueradesAsUndefined);
828	isNotMasqueradesAsUndefined.append(branchPtr(NotEqual, Address(result, Structure::globalObjectOffset()), scratchIfShouldCheckMasqueradesAsUndefined));	843	isNotMasqueradesAsUndefined.append(branchPtr(NotEqual, Address(result, Structure::globalObjectOffset()), scratchIfShouldCheckMasqueradesAsUndefined));
829		844
Lines 914-920 AssemblyHelpers::JumpList AssemblyHelper Source/JavaScriptCore/jit/AssemblyHelpers.cpp_sec5
914	ASSERT(scratchIfShouldCheckMasqueradesAsUndefined != InvalidGPRReg);	929	ASSERT(scratchIfShouldCheckMasqueradesAsUndefined != InvalidGPRReg);
915	JumpList isNotMasqueradesAsUndefined;	930	JumpList isNotMasqueradesAsUndefined;
916	isNotMasqueradesAsUndefined.append(branchTest8(Zero, Address(value.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)));	931	isNotMasqueradesAsUndefined.append(branchTest8(Zero, Address(value.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)));
917	emitLoadStructure(vm, value.payloadGPR(), scratch);	932	emitLoadStructure(vm, value.payloadGPR(), scratch, scratchIfShouldCheckMasqueradesAsUndefined);
918	if (std::holds_alternative<JSGlobalObject*>(globalObject))	933	if (std::holds_alternative<JSGlobalObject*>(globalObject))
919	move(TrustedImmPtr(std::get<JSGlobalObject*>(globalObject)), scratchIfShouldCheckMasqueradesAsUndefined);	934	move(TrustedImmPtr(std::get<JSGlobalObject*>(globalObject)), scratchIfShouldCheckMasqueradesAsUndefined);
920	else	935	else

Lines 1123-1129 public: Source/JavaScriptCore/jit/AssemblyHelpers.h_sec1
- Source/JavaScriptCore/jit/AssemblyHelpers.h -6 / +5 lines
1123	Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)	1123	Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)
1124	{	1124	{
1125	#if USE(JSVALUE64)	1125	#if USE(JSVALUE64)
1126	return branch32(condition, leftHandSide, TrustedImm32(structure->id().bits()));	1126	return branch32(condition, leftHandSide, TrustedImm32(structure->id()));
1127	#else	1127	#else
1128	return branchPtr(condition, leftHandSide, TrustedImmPtr(structure));	1128	return branchPtr(condition, leftHandSide, TrustedImmPtr(structure));
1129	#endif	1129	#endif
Lines 1577-1585 public: Source/JavaScriptCore/jit/AssemblyHelpers.h_sec2
1577	return argumentCount(codeOrigin.inlineCallFrame());	1577	return argumentCount(codeOrigin.inlineCallFrame());
1578	}	1578	}
1579		1579
1580	void emitNonNullDecodeStructureID(RegisterID source, RegisterID dest);	1580	void emitLoadStructure(VM&, RegisterID source, RegisterID dest, RegisterID scratch);
1581	void emitLoadStructure(VM&, RegisterID source, RegisterID dest);	1581	void emitLoadPrototype(VM&, GPRReg objectGPR, JSValueRegs resultRegs, GPRReg scratchGPR, JumpList& slowPath);
1582	void emitLoadPrototype(VM&, GPRReg objectGPR, JSValueRegs resultRegs, JumpList& slowPath);
1583		1582
1584	void emitStoreStructureWithTypeInfo(TrustedImmPtr structure, RegisterID dest, RegisterID)	1583	void emitStoreStructureWithTypeInfo(TrustedImmPtr structure, RegisterID dest, RegisterID)
1585	{	1584	{
Lines 1664-1676 public: Source/JavaScriptCore/jit/AssemblyHelpers.h_sec3
1664	void nukeStructureAndStoreButterfly(VM& vm, GPRReg butterfly, GPRReg object)	1663	void nukeStructureAndStoreButterfly(VM& vm, GPRReg butterfly, GPRReg object)
1665	{	1664	{
1666	if (isX86()) {	1665	if (isX86()) {
1667	or32(TrustedImm32(bitwise_cast<int32_t>(StructureID::nukedStructureIDBit)), Address(object, JSCell::structureIDOffset()));	1666	or32(TrustedImm32(bitwise_cast<int32_t>(nukedStructureIDBit())), Address(object, JSCell::structureIDOffset()));
1668	storePtr(butterfly, Address(object, JSObject::butterflyOffset()));	1667	storePtr(butterfly, Address(object, JSObject::butterflyOffset()));
1669	return;	1668	return;
1670	}	1669	}
1671		1670
1672	Jump ok = jumpIfMutatorFenceNotNeeded(vm);	1671	Jump ok = jumpIfMutatorFenceNotNeeded(vm);
1673	or32(TrustedImm32(bitwise_cast<int32_t>(StructureID::nukedStructureIDBit)), Address(object, JSCell::structureIDOffset()));	1672	or32(TrustedImm32(bitwise_cast<int32_t>(nukedStructureIDBit())), Address(object, JSCell::structureIDOffset()));
1674	storeFence();	1673	storeFence();
1675	storePtr(butterfly, Address(object, JSObject::butterflyOffset()));	1674	storePtr(butterfly, Address(object, JSObject::butterflyOffset()));
1676	storeFence();	1675	storeFence();

Lines 136-142 void JITGetByIdGenerator::generateFastPa Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp_sec1
- Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp -3 / +3 lines
136	static void generateGetByIdInlineAccess(JIT& jit, GPRReg stubInfoGPR, JSValueRegs baseJSR, GPRReg scratchGPR, JSValueRegs resultJSR)	136	static void generateGetByIdInlineAccess(JIT& jit, GPRReg stubInfoGPR, JSValueRegs baseJSR, GPRReg scratchGPR, JSValueRegs resultJSR)
137	{	137	{
138	jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);	138	jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);
139	auto doInlineAccess = jit.branch32(CCallHelpers::Equal, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructureID()));	139	auto doInlineAccess = jit.branch32(CCallHelpers::Equal, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructure()));
140	jit.farJump(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfCodePtr()), JITStubRoutinePtrTag);	140	jit.farJump(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfCodePtr()), JITStubRoutinePtrTag);
141	doInlineAccess.link(&jit);	141	doInlineAccess.link(&jit);
142	jit.load32(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfByIdSelfOffset()), scratchGPR);	142	jit.load32(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfByIdSelfOffset()), scratchGPR);
Lines 221-227 void JITPutByIdGenerator::generateBaseli Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp_sec2
221	using BaselinePutByIdRegisters::scratch2GPR;	221	using BaselinePutByIdRegisters::scratch2GPR;
222		222
223	jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);	223	jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);
224	auto doInlineAccess = jit.branch32(CCallHelpers::Equal, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructureID()));	224	auto doInlineAccess = jit.branch32(CCallHelpers::Equal, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructure()));
225	jit.farJump(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfCodePtr()), JITStubRoutinePtrTag);	225	jit.farJump(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfCodePtr()), JITStubRoutinePtrTag);
226	doInlineAccess.link(&jit);	226	doInlineAccess.link(&jit);
227	jit.load32(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfByIdSelfOffset()), scratchGPR);	227	jit.load32(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfByIdSelfOffset()), scratchGPR);
Lines 412-418 void JITInByIdGenerator::generateBaselin Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp_sec3
412	CCallHelpers::JumpList done;	412	CCallHelpers::JumpList done;
413		413
414	jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);	414	jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);
415	auto skipInlineAccess = jit.branch32(CCallHelpers::NotEqual, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructureID()));	415	auto skipInlineAccess = jit.branch32(CCallHelpers::NotEqual, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructure()));
416	jit.boxBoolean(true, resultJSR);	416	jit.boxBoolean(true, resultJSR);
417	auto finished = jit.jump();	417	auto finished = jit.jump();
418		418

Lines 256-262 void JIT::emit_op_typeof_is_undefined(co Source/JavaScriptCore/jit/JITOpcodes.cpp_sec1
- Source/JavaScriptCore/jit/JITOpcodes.cpp -6 / +6 lines
256	Jump notMasqueradesAsUndefined = jump();	256	Jump notMasqueradesAsUndefined = jump();
257		257
258	isMasqueradesAsUndefined.link(this);	258	isMasqueradesAsUndefined.link(this);
259	emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT1);	259	emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT1, regT2);
260	loadGlobalObject(regT0);	260	loadGlobalObject(regT0);
261	loadPtr(Address(regT1, Structure::globalObjectOffset()), regT1);	261	loadPtr(Address(regT1, Structure::globalObjectOffset()), regT1);
262	comparePtr(Equal, regT0, regT1, regT0);	262	comparePtr(Equal, regT0, regT1, regT0);
Lines 514-520 void JIT::emit_op_jeq_null(const Instruc Source/JavaScriptCore/jit/JITOpcodes.cpp_sec2
514		514
515	// First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.	515	// First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
516	Jump isNotMasqueradesAsUndefined = branchTest8(Zero, Address(jsRegT10.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));	516	Jump isNotMasqueradesAsUndefined = branchTest8(Zero, Address(jsRegT10.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
517	emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2);	517	emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2, regT1);
518	loadGlobalObject(regT0);	518	loadGlobalObject(regT0);
519	addJump(branchPtr(Equal, Address(regT2, Structure::globalObjectOffset()), regT0), target);	519	addJump(branchPtr(Equal, Address(regT2, Structure::globalObjectOffset()), regT0), target);
520	Jump masqueradesGlobalObjectIsForeign = jump();	520	Jump masqueradesGlobalObjectIsForeign = jump();
Lines 539-545 void JIT::emit_op_jneq_null(const Instru Source/JavaScriptCore/jit/JITOpcodes.cpp_sec3
539		539
540	// First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.	540	// First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
541	addJump(branchTest8(Zero, Address(jsRegT10.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);	541	addJump(branchTest8(Zero, Address(jsRegT10.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
542	emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2);	542	emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2, regT1);
543	loadGlobalObject(regT0);	543	loadGlobalObject(regT0);
544	addJump(branchPtr(NotEqual, Address(regT2, Structure::globalObjectOffset()), regT0), target);	544	addJump(branchPtr(NotEqual, Address(regT2, Structure::globalObjectOffset()), regT0), target);
545	Jump wasNotImmediate = jump();	545	Jump wasNotImmediate = jump();
Lines 1196-1202 void JIT::emit_op_eq_null(const Instruct Source/JavaScriptCore/jit/JITOpcodes.cpp_sec4
1196	Jump wasNotMasqueradesAsUndefined = jump();	1196	Jump wasNotMasqueradesAsUndefined = jump();
1197		1197
1198	isMasqueradesAsUndefined.link(this);	1198	isMasqueradesAsUndefined.link(this);
1199	emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2);	1199	emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2, regT1);
1200	loadGlobalObject(regT0);	1200	loadGlobalObject(regT0);
1201	loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);	1201	loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);
1202	comparePtr(Equal, regT0, regT2, regT0);	1202	comparePtr(Equal, regT0, regT2, regT0);
Lines 1228-1234 void JIT::emit_op_neq_null(const Instruc Source/JavaScriptCore/jit/JITOpcodes.cpp_sec5
1228	Jump wasNotMasqueradesAsUndefined = jump();	1228	Jump wasNotMasqueradesAsUndefined = jump();
1229		1229
1230	isMasqueradesAsUndefined.link(this);	1230	isMasqueradesAsUndefined.link(this);
1231	emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2);	1231	emitLoadStructure(vm(), jsRegT10.payloadGPR(), regT2, regT1);
1232	loadGlobalObject(regT0);	1232	loadGlobalObject(regT0);
1233	loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);	1233	loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);
1234	comparePtr(NotEqual, regT0, regT2, regT0);	1234	comparePtr(NotEqual, regT0, regT2, regT0);
Lines 1959-1965 void JIT::emit_op_get_prototype_of(const Source/JavaScriptCore/jit/JITOpcodes.cpp_sec6
1959	slowCases.append(branchIfNotCell(jsRegT10));	1959	slowCases.append(branchIfNotCell(jsRegT10));
1960	slowCases.append(branchIfNotObject(jsRegT10.payloadGPR()));	1960	slowCases.append(branchIfNotObject(jsRegT10.payloadGPR()));
1961		1961
1962	emitLoadPrototype(vm(), jsRegT10.payloadGPR(), jsRegT32, slowCases);	1962	emitLoadPrototype(vm(), jsRegT10.payloadGPR(), jsRegT32, regT4, slowCases);
1963	addSlowCase(slowCases);	1963	addSlowCase(slowCases);
1964		1964
1965	emitValueProfilingSite(bytecode, jsRegT32);	1965	emitValueProfilingSite(bytecode, jsRegT32);

Lines 29-41 Source/JavaScriptCore/jit/JITStubRoutine.h_sec1
- Source/JavaScriptCore/jit/JITStubRoutine.h -1 / +6 lines
29		29
30	#include "ExecutableAllocator.h"	30	#include "ExecutableAllocator.h"
31	#include "MacroAssemblerCodeRef.h"	31	#include "MacroAssemblerCodeRef.h"
32	#include "StructureID.h"
33		32
34	namespace JSC {	33	namespace JSC {
35		34
36	class JITStubRoutineSet;	35	class JITStubRoutineSet;
37	class VM;	36	class VM;
38		37
		38	#if USE(JSVALUE64)
		39	using StructureID = uint32_t;
		40	#else
		41	using StructureID = Structure*;
		42	#endif
		43
39	class AccessCase;	44	class AccessCase;
40		45
41	// This is a base-class for JIT stub routines, and also the class you want	46	// This is a base-class for JIT stub routines, and also the class you want

Lines 672-678 LLINT_SLOW_PATH_DECL(slow_path_try_get_b Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec1
- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp -16 / +16 lines
672	{	672	{
673	StructureID oldStructureID = metadata.m_structureID;	673	StructureID oldStructureID = metadata.m_structureID;
674	if (oldStructureID) {	674	if (oldStructureID) {
675	Structure* a = oldStructureID.decode();	675	Structure* a = vm.heap.structureIDTable().get(oldStructureID);
676	Structure* b = baseValue.asCell()->structure(vm);	676	Structure* b = baseValue.asCell()->structure(vm);
677		677
678	if (Structure::shouldConvertToPolyProto(a, b)) {	678	if (Structure::shouldConvertToPolyProto(a, b)) {
Lines 686-692 LLINT_SLOW_PATH_DECL(slow_path_try_get_b Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec2
686	Structure* structure = baseCell->structure(vm);	686	Structure* structure = baseCell->structure(vm);
687	if (slot.isValue() && slot.slotBase() == baseValue) {	687	if (slot.isValue() && slot.slotBase() == baseValue) {
688	// Start out by clearing out the old cache.	688	// Start out by clearing out the old cache.
689	metadata.m_structureID = StructureID();	689	metadata.m_structureID = 0;
690	metadata.m_offset = 0;	690	metadata.m_offset = 0;
691		691
692	if (structure->propertyAccessesAreCacheable() && !structure->needImpurePropertyWatchpoint()) {	692	if (structure->propertyAccessesAreCacheable() && !structure->needImpurePropertyWatchpoint()) {
Lines 721-727 LLINT_SLOW_PATH_DECL(slow_path_get_by_id Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec3
721	{	721	{
722	StructureID oldStructureID = metadata.m_structureID;	722	StructureID oldStructureID = metadata.m_structureID;
723	if (oldStructureID) {	723	if (oldStructureID) {
724	Structure* a = oldStructureID.decode();	724	Structure* a = vm.heap.structureIDTable().get(oldStructureID);
725	Structure* b = baseValue.asCell()->structure(vm);	725	Structure* b = baseValue.asCell()->structure(vm);
726		726
727	if (Structure::shouldConvertToPolyProto(a, b)) {	727	if (Structure::shouldConvertToPolyProto(a, b)) {
Lines 735-741 LLINT_SLOW_PATH_DECL(slow_path_get_by_id Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec4
735	Structure* structure = baseCell->structure(vm);	735	Structure* structure = baseCell->structure(vm);
736	if (slot.isValue()) {	736	if (slot.isValue()) {
737	// Start out by clearing out the old cache.	737	// Start out by clearing out the old cache.
738	metadata.m_structureID = StructureID();	738	metadata.m_structureID = 0;
739	metadata.m_offset = 0;	739	metadata.m_offset = 0;
740		740
741	if (structure->propertyAccessesAreCacheable() && !structure->needImpurePropertyWatchpoint()) {	741	if (structure->propertyAccessesAreCacheable() && !structure->needImpurePropertyWatchpoint()) {
Lines 848-857 static JSValue performLLIntGetByID(const Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec5
848	oldStructureID = metadata.protoLoadMode.structureID;	848	oldStructureID = metadata.protoLoadMode.structureID;
849	break;	849	break;
850	default:	850	default:
851	oldStructureID = StructureID();	851	oldStructureID = 0;
852	}	852	}
853	if (oldStructureID) {	853	if (oldStructureID) {
854	Structure* a = oldStructureID.decode();	854	Structure* a = vm.heap.structureIDTable().get(oldStructureID);
855	Structure* b = baseValue.asCell()->structure(vm);	855	Structure* b = baseValue.asCell()->structure(vm);
856		856
857	if (Structure::shouldConvertToPolyProto(a, b)) {	857	if (Structure::shouldConvertToPolyProto(a, b)) {
Lines 986-992 LLINT_SLOW_PATH_DECL(slow_path_put_by_id Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec6
986	{	986	{
987	StructureID oldStructureID = metadata.m_oldStructureID;	987	StructureID oldStructureID = metadata.m_oldStructureID;
988	if (oldStructureID) {	988	if (oldStructureID) {
989	Structure* a = oldStructureID.decode();	989	Structure* a = vm.heap.structureIDTable().get(oldStructureID);
990	Structure* b = baseValue.asCell()->structure(vm);	990	Structure* b = baseValue.asCell()->structure(vm);
991	if (slot.type() == PutPropertySlot::NewProperty)	991	if (slot.type() == PutPropertySlot::NewProperty)
992	b = b->previousID();	992	b = b->previousID();
Lines 999-1007 LLINT_SLOW_PATH_DECL(slow_path_put_by_id Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec7
999	}	999	}
1000		1000
1001	// Start out by clearing out the old cache.	1001	// Start out by clearing out the old cache.
1002	metadata.m_oldStructureID = StructureID();	1002	metadata.m_oldStructureID = 0;
1003	metadata.m_offset = 0;	1003	metadata.m_offset = 0;
1004	metadata.m_newStructureID = StructureID();	1004	metadata.m_newStructureID = 0;
1005	metadata.m_structureChain.clear();	1005	metadata.m_structureChain.clear();
1006		1006
1007	JSCell* baseCell = baseValue.asCell();	1007	JSCell* baseCell = baseValue.asCell();
Lines 1175-1181 LLINT_SLOW_PATH_DECL(slow_path_get_priva Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec8
1175	{	1175	{
1176	StructureID oldStructureID = metadata.m_structureID;	1176	StructureID oldStructureID = metadata.m_structureID;
1177	if (oldStructureID) {	1177	if (oldStructureID) {
1178	Structure* a = oldStructureID.decode();	1178	Structure* a = vm.heap.structureIDTable().get(oldStructureID);
1179	Structure* b = baseValue.asCell()->structure(vm);	1179	Structure* b = baseValue.asCell()->structure(vm);
1180		1180
1181	if (Structure::shouldConvertToPolyProto(a, b)) {	1181	if (Structure::shouldConvertToPolyProto(a, b)) {
Lines 1189-1195 LLINT_SLOW_PATH_DECL(slow_path_get_priva Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec9
1189	Structure* structure = baseCell->structure(vm);	1189	Structure* structure = baseCell->structure(vm);
1190	if (slot.isValue()) {	1190	if (slot.isValue()) {
1191	// Start out by clearing out the old cache.	1191	// Start out by clearing out the old cache.
1192	metadata.m_structureID = StructureID();	1192	metadata.m_structureID = 0;
1193	metadata.m_offset = 0;	1193	metadata.m_offset = 0;
1194		1194
1195	if (!structure->isUncacheableDictionary()) {	1195	if (!structure->isUncacheableDictionary()) {
Lines 1308-1314 LLINT_SLOW_PATH_DECL(slow_path_put_priva Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec10
1308	{	1308	{
1309	StructureID oldStructureID = metadata.m_oldStructureID;	1309	StructureID oldStructureID = metadata.m_oldStructureID;
1310	if (oldStructureID) {	1310	if (oldStructureID) {
1311	Structure* a = oldStructureID.decode();	1311	Structure* a = vm.heap.structureIDTable().get(oldStructureID);
1312	Structure* b = baseValue.asCell()->structure(vm);	1312	Structure* b = baseValue.asCell()->structure(vm);
1313	if (slot.type() == PutPropertySlot::NewProperty)	1313	if (slot.type() == PutPropertySlot::NewProperty)
1314	b = b->previousID();	1314	b = b->previousID();
Lines 1321-1329 LLINT_SLOW_PATH_DECL(slow_path_put_priva Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec11
1321	}	1321	}
1322		1322
1323	// Start out by clearing out the old cache.	1323	// Start out by clearing out the old cache.
1324	metadata.m_oldStructureID = StructureID();	1324	metadata.m_oldStructureID = 0;
1325	metadata.m_offset = 0;	1325	metadata.m_offset = 0;
1326	metadata.m_newStructureID = StructureID();	1326	metadata.m_newStructureID = 0;
1327	metadata.m_property.clear();	1327	metadata.m_property.clear();
1328		1328
1329	JSCell* baseCell = baseValue.asCell();	1329	JSCell* baseCell = baseValue.asCell();
Lines 1397-1404 LLINT_SLOW_PATH_DECL(slow_path_set_priva Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec12
1397	ASSERT(oldStructure->transitionWatchpointSetHasBeenInvalidated());	1397	ASSERT(oldStructure->transitionWatchpointSetHasBeenInvalidated());
1398		1398
1399	// Start out by clearing out the old cache.	1399	// Start out by clearing out the old cache.
1400	metadata.m_oldStructureID = StructureID();	1400	metadata.m_oldStructureID = 0;
1401	metadata.m_newStructureID = StructureID();	1401	metadata.m_newStructureID = 0;
1402	metadata.m_brand.clear();	1402	metadata.m_brand.clear();
1403		1403
1404	if (!newStructure->isDictionary()) {	1404	if (!newStructure->isDictionary()) {

Lines 694-709 macro writeBarrierOnGlobalLexicalEnviron Source/JavaScriptCore/llint/LowLevelInterpreter64.asm_sec1
- Source/JavaScriptCore/llint/LowLevelInterpreter64.asm -15 / +31 lines
694	end)	694	end)
695	end	695	end
696		696
697	macro structureIDToStructureWithScratch(structureIDThenStructure, scratch)	697	macro structureIDToStructureWithScratch(structureIDThenStructure, scratch, scratch2)
698	andq constexpr structureIDMask, structureIDThenStructure	698	loadp CodeBlock[cfr], scratch
699	leap JSCConfig + constexpr JSC::offsetOfJSCConfigStartOfStructureHeap, scratch	699	move structureIDThenStructure, scratch2
700	loadp [scratch], scratch	700	loadp CodeBlock::m_vm[scratch], scratch
701	addp scratch, structureIDThenStructure	701	rshifti NumberOfStructureIDEntropyBits, scratch2
		702	loadp VM::heap + Heap::m_structureIDTable + StructureIDTable::m_table[scratch], scratch
		703	loadp [scratch, scratch2, PtrSize], scratch2
		704	lshiftp StructureEntropyBitsShift, structureIDThenStructure
		705	xorp scratch2, structureIDThenStructure
702	end	706	end
703		707
704	macro loadStructureWithScratch(cell, structure, scratch)	708	macro loadStructureWithScratch(cell, structure, scratch, scratch2)
705	loadi JSCell::m_structureID[cell], structure	709	loadi JSCell::m_structureID[cell], structure
706	structureIDToStructureWithScratch(structure, scratch)	710	structureIDToStructureWithScratch(structure, scratch, scratch2)
707	end	711	end
708		712
709	# Entrypoints into the interpreter.	713	# Entrypoints into the interpreter.
Lines 926-932 macro equalNullComparisonOp(opcodeName, Source/JavaScriptCore/llint/LowLevelInterpreter64.asm_sec2
926	move 0, t0	930	move 0, t0
927	jmp .done	931	jmp .done
928	.masqueradesAsUndefined:	932	.masqueradesAsUndefined:
929	loadStructureWithScratch(t0, t2, t1)	933	loadStructureWithScratch(t0, t2, t1, t3)
930	loadp CodeBlock[cfr], t0	934	loadp CodeBlock[cfr], t0
931	loadp CodeBlock::m_globalObject[t0], t0	935	loadp CodeBlock::m_globalObject[t0], t0
932	cpeq Structure::m_globalObject[t2], t0, t0	936	cpeq Structure::m_globalObject[t2], t0, t0
Lines 1428-1434 llintOpWithReturn(op_typeof_is_undefined Source/JavaScriptCore/llint/LowLevelInterpreter64.asm_sec3
1428	move ValueFalse, t1	1432	move ValueFalse, t1
1429	return(t1)	1433	return(t1)
1430	.masqueradesAsUndefined:	1434	.masqueradesAsUndefined:
1431	loadStructureWithScratch(t0, t3, t1)	1435	loadStructureWithScratch(t0, t3, t1, t2)
1432	loadp CodeBlock[cfr], t1	1436	loadp CodeBlock[cfr], t1
1433	loadp CodeBlock::m_globalObject[t1], t1	1437	loadp CodeBlock::m_globalObject[t1], t1
1434	cpeq Structure::m_globalObject[t3], t1, t0	1438	cpeq Structure::m_globalObject[t3], t1, t0
Lines 1640-1646 llintOpWithProfile(op_get_prototype_of, Source/JavaScriptCore/llint/LowLevelInterpreter64.asm_sec4
1640	btqnz t0, notCellMask, .opGetPrototypeOfSlow	1644	btqnz t0, notCellMask, .opGetPrototypeOfSlow
1641	bbb JSCell::m_type[t0], ObjectType, .opGetPrototypeOfSlow	1645	bbb JSCell::m_type[t0], ObjectType, .opGetPrototypeOfSlow
1642		1646
1643	loadStructureWithScratch(t0, t2, t1)	1647	loadStructureWithScratch(t0, t2, t1, t3)
1644	loadh Structure::m_outOfLineTypeFlags[t2], t3	1648	loadh Structure::m_outOfLineTypeFlags[t2], t3
1645	btinz t3, OverridesGetPrototypeOutOfLine, .opGetPrototypeOfSlow	1649	btinz t3, OverridesGetPrototypeOutOfLine, .opGetPrototypeOfSlow
1646		1650
Lines 1680-1686 llintOpWithMetadata(op_put_by_id, OpPutB Source/JavaScriptCore/llint/LowLevelInterpreter64.asm_sec5
1680	loadp OpPutById::Metadata::m_structureChain[t5], t3	1684	loadp OpPutById::Metadata::m_structureChain[t5], t3
1681	btpz t3, .opPutByIdTransitionDirect	1685	btpz t3, .opPutByIdTransitionDirect
1682		1686
1683	structureIDToStructureWithScratch(t2, t1)	1687	loadp CodeBlock[cfr], t1
		1688	loadp CodeBlock::m_vm[t1], t1
		1689	loadp VM::heap + Heap::m_structureIDTable + StructureIDTable::m_table[t1], t1
		1690
		1691	macro structureIDToStructureWithScratchAndTable(structureIDThenStructure, table, scratch)
		1692	move structureIDThenStructure, scratch
		1693	rshifti NumberOfStructureIDEntropyBits, scratch
		1694	loadp [table, scratch, PtrSize], scratch
		1695	lshiftp StructureEntropyBitsShift, structureIDThenStructure
		1696	xorp scratch, structureIDThenStructure
		1697	end
		1698
		1699	structureIDToStructureWithScratchAndTable(t2, t1, t0)
1684		1700
1685	loadp StructureChain::m_vector[t3], t3	1701	loadp StructureChain::m_vector[t3], t3
1686	assert(macro (ok) btpnz t3, ok end)	1702	assert(macro (ok) btpnz t3, ok end)
Lines 1691-1697 llintOpWithMetadata(op_put_by_id, OpPutB Source/JavaScriptCore/llint/LowLevelInterpreter64.asm_sec6
1691	loadi JSCell::m_structureID[t2], t2	1707	loadi JSCell::m_structureID[t2], t2
1692	bineq t2, [t3], .opPutByIdSlow	1708	bineq t2, [t3], .opPutByIdSlow
1693	addp 4, t3	1709	addp 4, t3
1694	structureIDToStructureWithScratch(t2, t1)	1710	structureIDToStructureWithScratchAndTable(t2, t1, t0)
1695	loadq Structure::m_prototype[t2], t2	1711	loadq Structure::m_prototype[t2], t2
1696	bqneq t2, ValueNull, .opPutByIdTransitionChainLoop	1712	bqneq t2, ValueNull, .opPutByIdTransitionChainLoop
1697		1713
Lines 2066-2072 macro equalNullJumpOp(opcodeName, opcode Source/JavaScriptCore/llint/LowLevelInterpreter64.asm_sec7
2066	assertNotConstant(size, t0)	2082	assertNotConstant(size, t0)
2067	loadq [cfr, t0, 8], t0	2083	loadq [cfr, t0, 8], t0
2068	btqnz t0, notCellMask, .immediate	2084	btqnz t0, notCellMask, .immediate
2069	loadStructureWithScratch(t0, t2, t1)	2085	loadStructureWithScratch(t0, t2, t1, t3)
2070	cellHandler(t2, JSCell::m_flags[t0], .target)	2086	cellHandler(t2, JSCell::m_flags[t0], .target)
2071	dispatch()	2087	dispatch()
2072		2088
Lines 2785-2791 end) Source/JavaScriptCore/llint/LowLevelInterpreter64.asm_sec8
2785	macro loadWithStructureCheck(opcodeStruct, get, slowPath)	2801	macro loadWithStructureCheck(opcodeStruct, get, slowPath)
2786	get(m_scope, t0)	2802	get(m_scope, t0)
2787	loadq [cfr, t0, 8], t0	2803	loadq [cfr, t0, 8], t0
2788	loadStructureWithScratch(t0, t2, t1)	2804	loadStructureWithScratch(t0, t2, t1, t3)
2789	loadp %opcodeStruct%::Metadata::m_structure[t5], t1	2805	loadp %opcodeStruct%::Metadata::m_structure[t5], t1
2790	bpneq t2, t1, slowPath	2806	bpneq t2, t1, slowPath
2791	end	2807	end
Lines 3236-3242 llintOpWithReturn(op_get_property_enumer Source/JavaScriptCore/llint/LowLevelInterpreter64.asm_sec9
3236	andi IndexingTypeMask, t1	3252	andi IndexingTypeMask, t1
3237	bia t1, ArrayWithUndecided, .slowPath	3253	bia t1, ArrayWithUndecided, .slowPath
3238		3254
3239	loadStructureWithScratch(t0, t1, t2)	3255	loadStructureWithScratch(t0, t1, t2, t3)
3240	loadp Structure::m_previousOrRareData[t1], t1	3256	loadp Structure::m_previousOrRareData[t1], t1
3241	btpz t1, .slowPath	3257	btpz t1, .slowPath
3242	bbeq JSCell::m_type[t1], StructureType, .slowPath	3258	bbeq JSCell::m_type[t1], StructureType, .slowPath