Attachment 223637 Details for Bug 128291 – the patch

[patch] the patch

blah.patch (text/plain), 73.09 KB, created by Filip Pizlo on 2014-02-09 12:11:13 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Filip Pizlo

Created: 2014-02-09 12:11:13 PST

Size: 73.09 KB

patch

obsolete

>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 163752)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,103 @@
>+2014-02-09  Filip Pizlo  <fpizlo@apple.com>
>+
>+        GC blocks on FTL and then badness
>+        https://bugs.webkit.org/show_bug.cgi?id=128291
>+
>+        Reviewed by NOBODY (OOPS!).
>+        
>+        Introduce the notion of a DFG::Safepoint, which allows you to unlock the rightToRun
>+        mutex for your JIT thread, while supplying the GC with all of the information it would
>+        need to scan you at that moment in time. The default way of using this is
>+        DFG::GraphSafepoint, where you just supply the Graph. There's a lot of machinery in
>+        this patch just to make the Graph scannable.
>+        
>+        We then use DFG::GraphSafepoint in just two places for now: (1) while initializing LLVM
>+        and (2) while invoking LLVM' optimizer and backend.
>+        
>+        Making this change was difficult because I ran into the limits of our lack of header
>+        file discipline. Even though Operations.h is meant to be the thing that is only
>+        included from .cpp files, it was included from CodeBlock.h. Similarly,
>+        CallFrameInlines.h was included from DFGJITCompiler.h. Then, CallLinkInfo.h included
>+        DFGGraph.h. It was a total mess. I unraveled this mess to get my code to build.
>+
>+        * API/JSContextRef.cpp:
>+        * CMakeLists.txt:
>+        * GNUmakefile.list.am:
>+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
>+        * JavaScriptCore.xcodeproj/project.pbxproj:
>+        * bytecode/CodeBlock.cpp:
>+        * bytecode/CodeBlock.h:
>+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp:
>+        * debugger/DebuggerCallFrame.cpp:
>+        * dfg/DFGDesiredTransitions.cpp:
>+        * dfg/DFGDriver.cpp:
>+        (JSC::DFG::compileImpl):
>+        * dfg/DFGGraph.cpp:
>+        (JSC::DFG::Graph::visitChildren):
>+        * dfg/DFGGraph.h:
>+        * dfg/DFGGraphSafepoint.cpp: Added.
>+        (JSC::DFG::GraphSafepoint::GraphSafepoint):
>+        (JSC::DFG::GraphSafepoint::~GraphSafepoint):
>+        * dfg/DFGGraphSafepoint.h: Added.
>+        * dfg/DFGJITCode.cpp:
>+        * dfg/DFGJITCompiler.cpp:
>+        * dfg/DFGJITCompiler.h:
>+        * dfg/DFGOSRExitCompilerCommon.cpp:
>+        * dfg/DFGOperations.cpp:
>+        * dfg/DFGOperations.h:
>+        * dfg/DFGPlan.cpp:
>+        (JSC::DFG::Plan::compileInThread):
>+        (JSC::DFG::Plan::compileInThreadImpl):
>+        * dfg/DFGPlan.h:
>+        * dfg/DFGSafepoint.cpp: Added.
>+        (JSC::DFG::Safepoint::Safepoint):
>+        (JSC::DFG::Safepoint::~Safepoint):
>+        (JSC::DFG::Safepoint::add):
>+        (JSC::DFG::Safepoint::begin):
>+        (JSC::DFG::Safepoint::visitChildren):
>+        * dfg/DFGSafepoint.h: Added.
>+        * dfg/DFGScannable.h: Added.
>+        (JSC::DFG::Scannable::Scannable):
>+        (JSC::DFG::Scannable::~Scannable):
>+        * dfg/DFGThreadData.cpp: Added.
>+        (JSC::DFG::ThreadData::ThreadData):
>+        (JSC::DFG::ThreadData::~ThreadData):
>+        * dfg/DFGThreadData.h: Added.
>+        * dfg/DFGThunks.cpp:
>+        * dfg/DFGWorklist.cpp:
>+        (JSC::DFG::Worklist::finishCreation):
>+        (JSC::DFG::Worklist::visitChildren):
>+        (JSC::DFG::Worklist::runThread):
>+        * dfg/DFGWorklist.h:
>+        * ftl/FTLCompile.cpp:
>+        (JSC::FTL::compile):
>+        * ftl/FTLLink.cpp:
>+        * ftl/FTLOSRExitCompiler.cpp:
>+        * ftl/FTLSlowPathCall.cpp:
>+        * ftl/FTLThunks.cpp:
>+        (JSC::FTL::slowPathCallThunkGenerator):
>+        * heap/SlotVisitor.h:
>+        * heap/SlotVisitorInlines.h:
>+        (JSC::SlotVisitor::appendUnbarrieredReadOnlyPointer):
>+        (JSC::SlotVisitor::appendUnbarrieredReadOnlyValue):
>+        * inspector/ScriptCallStackFactory.cpp:
>+        * interpreter/ProtoCallFrame.cpp:
>+        * jit/JITExceptions.cpp:
>+        * jit/JITInlines.h:
>+        * jit/JITOperations.cpp:
>+        * jit/Repatch.cpp:
>+        * jsc.cpp:
>+        * profiler/ProfileGenerator.cpp:
>+        * runtime/Arguments.cpp:
>+        * runtime/ArgumentsIteratorPrototype.cpp:
>+        * runtime/CommonSlowPathsExceptions.cpp:
>+        * runtime/JSArgumentsIterator.cpp:
>+        * runtime/JSFunction.cpp:
>+        * runtime/JSGlobalObjectFunctions.cpp:
>+        * runtime/ObjectConstructor.cpp:
>+        * runtime/Operations.h:
>+        * runtime/VM.cpp:
>+
> 2014-02-09  Anders Carlsson  <andersca@apple.com>
> 
>         Convert some JSC code over to std::mutex
>Index: Source/JavaScriptCore/CMakeLists.txt
>===================================================================
>--- Source/JavaScriptCore/CMakeLists.txt	(revision 163695)
>+++ Source/JavaScriptCore/CMakeLists.txt	(working copy)
>@@ -138,6 +138,7 @@ set(JavaScriptCore_SOURCES
>     dfg/DFGFlushLivenessAnalysisPhase.cpp
>     dfg/DFGFlushedAt.cpp
>     dfg/DFGGraph.cpp
>+    dfg/DFGGraphSafepoint.cpp
>     dfg/DFGInPlaceAbstractState.cpp
>     dfg/DFGInvalidationPointInjectionPhase.cpp
>     dfg/DFGJITCode.cpp
>@@ -172,12 +173,14 @@ set(JavaScriptCore_SOURCES
>     dfg/DFGResurrectionForValidationPhase.cpp
>     dfg/DFGSSAConversionPhase.cpp
>     dfg/DFGSSALoweringPhase.cpp
>+    dfg/DFGSafepoint.cpp
>     dfg/DFGSpeculativeJIT.cpp
>     dfg/DFGSpeculativeJIT32_64.cpp
>     dfg/DFGSpeculativeJIT64.cpp
>     dfg/DFGStackLayoutPhase.cpp
>     dfg/DFGStoreBarrierElisionPhase.cpp
>     dfg/DFGStrengthReductionPhase.cpp
>+    dfg/DFGThreadData.cpp
>     dfg/DFGThunks.cpp
>     dfg/DFGTierUpCheckInjectionPhase.cpp
>     dfg/DFGTypeCheckHoistingPhase.cpp
>Index: Source/JavaScriptCore/GNUmakefile.list.am
>===================================================================
>--- Source/JavaScriptCore/GNUmakefile.list.am	(revision 163695)
>+++ Source/JavaScriptCore/GNUmakefile.list.am	(working copy)
>@@ -304,6 +304,8 @@ javascriptcore_sources += \
> 	Source/JavaScriptCore/dfg/DFGGenerationInfo.h \
> 	Source/JavaScriptCore/dfg/DFGGraph.cpp \
> 	Source/JavaScriptCore/dfg/DFGGraph.h \
>+	Source/JavaScriptCore/dfg/DFGGraphSafepoint.cpp \
>+	Source/JavaScriptCore/dfg/DFGGraphSafepoint.h \
> 	Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp \
> 	Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h \
> 	Source/JavaScriptCore/dfg/DFGInlineCacheWrapper.h \
>@@ -377,7 +379,10 @@ javascriptcore_sources += \
> 	Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.cpp \
> 	Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.h \
> 	Source/JavaScriptCore/dfg/DFGSafeToExecute.h \
>+	Source/JavaScriptCore/dfg/DFGSafepoint.cpp \
>+	Source/JavaScriptCore/dfg/DFGSafepoint.h \
> 	Source/JavaScriptCore/dfg/DFGSaneStringGetByValSlowPathGenerator.h \
>+	Source/JavaScriptCore/dfg/DFGScannable.h \
> 	Source/JavaScriptCore/dfg/DFGScoreBoard.h \
> 	Source/JavaScriptCore/dfg/DFGSilentRegisterSavePlan.h \
> 	Source/JavaScriptCore/dfg/DFGSlowPathGenerator.h \
>@@ -398,6 +403,8 @@ javascriptcore_sources += \
> 	Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h \
> 	Source/JavaScriptCore/dfg/DFGTierUpCheckInjectionPhase.cpp \
> 	Source/JavaScriptCore/dfg/DFGTierUpCheckInjectionPhase.h \
>+	Source/JavaScriptCore/dfg/DFGThreadData.cpp \
>+	Source/JavaScriptCore/dfg/DFGThreadData.h \
> 	Source/JavaScriptCore/dfg/DFGThunks.cpp \
> 	Source/JavaScriptCore/dfg/DFGThunks.h \
> 	Source/JavaScriptCore/dfg/DFGToFTLDeferredCompilationCallback.cpp \
>Index: Source/JavaScriptCore/jsc.cpp
>===================================================================
>--- Source/JavaScriptCore/jsc.cpp	(revision 163695)
>+++ Source/JavaScriptCore/jsc.cpp	(working copy)
>@@ -25,7 +25,6 @@
> #include "APIShims.h"
> #include "ButterflyInlines.h"
> #include "BytecodeGenerator.h"
>-#include "CallFrameInlines.h"
> #include "Completion.h"
> #include "CopiedSpaceInlines.h"
> #include "ExceptionHelpers.h"
>Index: Source/JavaScriptCore/API/JSContextRef.cpp
>===================================================================
>--- Source/JavaScriptCore/API/JSContextRef.cpp	(revision 163695)
>+++ Source/JavaScriptCore/API/JSContextRef.cpp	(working copy)
>@@ -29,7 +29,6 @@
> 
> #include "APICast.h"
> #include "CallFrame.h"
>-#include "CallFrameInlines.h"
> #include "InitializeThreading.h"
> #include "JSCallbackObject.h"
> #include "JSClassRef.h"
>Index: Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj	(revision 163695)
>+++ Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj	(working copy)
>@@ -392,6 +392,7 @@
>     <ClCompile Include="..\dfg\DFGFlushFormat.cpp" />
>     <ClCompile Include="..\dfg\DFGFlushLivenessAnalysisPhase.cpp" />
>     <ClCompile Include="..\dfg\DFGGraph.cpp" />
>+    <ClCompile Include="..\dfg\DFGGraphSafepoint.cpp" />
>     <ClCompile Include="..\dfg\DFGInPlaceAbstractState.cpp" />
>     <ClCompile Include="..\dfg\DFGInvalidationPointInjectionPhase.cpp" />
>     <ClCompile Include="..\dfg\DFGJITCode.cpp" />
>@@ -424,6 +425,7 @@
>     <ClCompile Include="..\dfg\DFGPredictionInjectionPhase.cpp" />
>     <ClCompile Include="..\dfg\DFGPredictionPropagationPhase.cpp" />
>     <ClCompile Include="..\dfg\DFGResurrectionForValidationPhase.cpp" />
>+    <ClCompile Include="..\dfg\DFGSafepoint.cpp" />
>     <ClCompile Include="..\dfg\DFGSpeculativeJIT.cpp" />
>     <ClCompile Include="..\dfg\DFGSpeculativeJIT32_64.cpp" />
>     <ClCompile Include="..\dfg\DFGSpeculativeJIT64.cpp" />
>@@ -432,6 +434,7 @@
>     <ClCompile Include="..\dfg\DFGStackLayoutPhase.cpp" />
>     <ClCompile Include="..\dfg\DFGStoreBarrierElisionPhase.cpp" />
>     <ClCompile Include="..\dfg\DFGStrengthReductionPhase.cpp" />
>+    <ClCompile Include="..\dfg\DFGThreadData.cpp" />
>     <ClCompile Include="..\dfg\DFGThunks.cpp" />
>     <ClCompile Include="..\dfg\DFGTierUpCheckInjectionPhase.cpp" />
>     <ClCompile Include="..\dfg\DFGToFTLDeferredCompilationCallback.cpp" />
>@@ -929,6 +932,7 @@
>     <ClInclude Include="..\dfg\DFGGenerationInfo.h" />
>     <ClInclude Include="..\dfg\DFGGPRInfo.h" />
>     <ClInclude Include="..\dfg\DFGGraph.h" />
>+    <ClInclude Include="..\dfg\DFGGraphSafepoint.h" />
>     <ClInclude Include="..\dfg\DFGInPlaceAbstractState.h" />
>     <ClInclude Include="..\dfg\DFGInsertionSet.h" />
>     <ClInclude Include="..\dfg\DFGInvalidationPointInjectionPhase.h" />
>@@ -969,7 +973,9 @@
>     <ClInclude Include="..\dfg\DFGRegisterSet.h" />
>     <ClInclude Include="..\dfg\DFGResurrectionForValidationPhase.h" />
>     <ClInclude Include="..\dfg\DFGSafeToExecute.h" />
>+    <ClInclude Include="..\dfg\DFGSafepoint.h" />
>     <ClInclude Include="..\dfg\DFGSaneStringGetByValSlowPathGenerator.h" />
>+    <ClInclude Include="..\dfg\DFGScannable.h" />
>     <ClInclude Include="..\dfg\DFGScoreBoard.h" />
>     <ClInclude Include="..\dfg\DFGScratchRegisterAllocator.h" />
>     <ClInclude Include="..\dfg\DFGSilentRegisterSavePlan.h" />
>@@ -981,6 +987,7 @@
>     <ClInclude Include="..\dfg\DFGStoreBarrierElisionPhase.h" />
>     <ClInclude Include="..\dfg\DFGStrengthReductionPhase.h" />
>     <ClInclude Include="..\dfg\DFGStructureAbstractValue.h" />
>+    <ClInclude Include="..\dfg\DFGThreadData.h" />
>     <ClInclude Include="..\dfg\DFGThunks.h" />
>     <ClInclude Include="..\dfg\DFGTierUpCheckInjectionPhase.h" />
>     <ClInclude Include="..\dfg\DFGToFTLDeferredCompilationCallback.h" />
>Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(revision 163695)
>+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(working copy)
>@@ -202,6 +202,13 @@
> 		0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51016B3A964003F696B /* DFGMinifiedID.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F2FC77216E12F710038D976 /* DFGDCEPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */; };
> 		0F2FC77316E12F740038D976 /* DFGDCEPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F2FCCF918A60070001A27F8 /* DFGGraphSafepoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */; };
>+		0F2FCCFA18A60070001A27F8 /* DFGGraphSafepoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF318A60070001A27F8 /* DFGGraphSafepoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F2FCCFB18A60070001A27F8 /* DFGSafepoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FCCF418A60070001A27F8 /* DFGSafepoint.cpp */; };
>+		0F2FCCFC18A60070001A27F8 /* DFGSafepoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF518A60070001A27F8 /* DFGSafepoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F2FCCFD18A60070001A27F8 /* DFGScannable.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF618A60070001A27F8 /* DFGScannable.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F2FCCFE18A60070001A27F8 /* DFGThreadData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FCCF718A60070001A27F8 /* DFGThreadData.cpp */; };
>+		0F2FCCFF18A60070001A27F8 /* DFGThreadData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF818A60070001A27F8 /* DFGThreadData.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F34B14916D42010001CDA5A /* DFGUseKind.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F34B14716D4200E001CDA5A /* DFGUseKind.cpp */; };
> 		0F34B14A16D42013001CDA5A /* DFGUseKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F34B14816D4200E001CDA5A /* DFGUseKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F34B14C16D43E0D001CDA5A /* PolymorphicAccessStructureList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F34B14B16D43E0C001CDA5A /* PolymorphicAccessStructureList.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -1351,7 +1358,7 @@
> 		C2981FDD17BAFF4400A3BC98 /* DFGDesiredWriteBarriers.h in Headers */ = {isa = PBXBuildFile; fileRef = C2981FDB17BAFF4400A3BC98 /* DFGDesiredWriteBarriers.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		C29ECB031804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.mm in Sources */ = {isa = PBXBuildFile; fileRef = C29ECB011804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.mm */; };
> 		C2A7F688160432D400F76B98 /* JSDestructibleObject.h in Headers */ = {isa = PBXBuildFile; fileRef = C2A7F687160432D400F76B98 /* JSDestructibleObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
>-       C2B6D75318A33793004A9301 /* WriteBarrierInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		C2B6D75318A33793004A9301 /* WriteBarrierInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		C2B916C514DA040C00CBAC86 /* MarkedAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */; };
> 		C2C0F7CD17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2C0F7CB17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp */; };
>@@ -1644,6 +1651,13 @@
> 		0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableEvent.cpp; path = dfg/DFGVariableEvent.cpp; sourceTree = "<group>"; };
> 		0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDCEPhase.cpp; path = dfg/DFGDCEPhase.cpp; sourceTree = "<group>"; };
> 		0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDCEPhase.h; path = dfg/DFGDCEPhase.h; sourceTree = "<group>"; };
>+		0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGGraphSafepoint.cpp; path = dfg/DFGGraphSafepoint.cpp; sourceTree = "<group>"; };
>+		0F2FCCF318A60070001A27F8 /* DFGGraphSafepoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGGraphSafepoint.h; path = dfg/DFGGraphSafepoint.h; sourceTree = "<group>"; };
>+		0F2FCCF418A60070001A27F8 /* DFGSafepoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSafepoint.cpp; path = dfg/DFGSafepoint.cpp; sourceTree = "<group>"; };
>+		0F2FCCF518A60070001A27F8 /* DFGSafepoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSafepoint.h; path = dfg/DFGSafepoint.h; sourceTree = "<group>"; };
>+		0F2FCCF618A60070001A27F8 /* DFGScannable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGScannable.h; path = dfg/DFGScannable.h; sourceTree = "<group>"; };
>+		0F2FCCF718A60070001A27F8 /* DFGThreadData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGThreadData.cpp; path = dfg/DFGThreadData.cpp; sourceTree = "<group>"; };
>+		0F2FCCF818A60070001A27F8 /* DFGThreadData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGThreadData.h; path = dfg/DFGThreadData.h; sourceTree = "<group>"; };
> 		0F34B14716D4200E001CDA5A /* DFGUseKind.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGUseKind.cpp; path = dfg/DFGUseKind.cpp; sourceTree = "<group>"; };
> 		0F34B14816D4200E001CDA5A /* DFGUseKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGUseKind.h; path = dfg/DFGUseKind.h; sourceTree = "<group>"; };
> 		0F34B14B16D43E0C001CDA5A /* PolymorphicAccessStructureList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolymorphicAccessStructureList.h; sourceTree = "<group>"; };
>@@ -2802,7 +2816,7 @@
> 		C29ECB011804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = CurrentThisInsideBlockGetterTest.mm; path = API/tests/CurrentThisInsideBlockGetterTest.mm; sourceTree = "<group>"; };
> 		C29ECB021804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CurrentThisInsideBlockGetterTest.h; path = API/tests/CurrentThisInsideBlockGetterTest.h; sourceTree = "<group>"; };
> 		C2A7F687160432D400F76B98 /* JSDestructibleObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDestructibleObject.h; sourceTree = "<group>"; };
>-       C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrierInlines.h; sourceTree = "<group>"; };
>+		C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrierInlines.h; sourceTree = "<group>"; };
> 		C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedAllocator.h; sourceTree = "<group>"; };
> 		C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedAllocator.cpp; sourceTree = "<group>"; };
> 		C2C0F7CB17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredTransitions.cpp; path = dfg/DFGDesiredTransitions.cpp; sourceTree = "<group>"; };
>@@ -3663,7 +3677,7 @@
> 		7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
> 			isa = PBXGroup;
> 			children = (
>-               C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */,
>+				C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */,
> 				BCF605110E203EF800B9A64D /* ArgList.cpp */,
> 				BCF605120E203EF800B9A64D /* ArgList.h */,
> 				BC257DE50E1F51C50016B6C9 /* Arguments.cpp */,
>@@ -4087,8 +4101,6 @@
> 		86EC9DB31328DF44002B2AD7 /* dfg */ = {
> 			isa = PBXGroup;
> 			children = (
>-				2ACCF3DC185FE26B0083E2AD /* DFGStoreBarrierElisionPhase.cpp */,
>-				2ACCF3DD185FE26B0083E2AD /* DFGStoreBarrierElisionPhase.h */,
> 				A77A423617A0BBFD00A8DB81 /* DFGAbstractHeap.cpp */,
> 				A77A423717A0BBFD00A8DB81 /* DFGAbstractHeap.h */,
> 				A704D8FE17A0BAA8006BA554 /* DFGAbstractInterpreter.h */,
>@@ -4190,6 +4202,8 @@
> 				86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */,
> 				86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */,
> 				86EC9DB81328DF82002B2AD7 /* DFGGraph.h */,
>+				0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */,
>+				0F2FCCF318A60070001A27F8 /* DFGGraphSafepoint.h */,
> 				0FB14E201812570B009B6B4D /* DFGInlineCacheWrapper.h */,
> 				0FB14E2218130955009B6B4D /* DFGInlineCacheWrapperInlines.h */,
> 				A704D90017A0BAA8006BA554 /* DFGInPlaceAbstractState.cpp */,
>@@ -4262,8 +4276,11 @@
> 				86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */,
> 				0F666ECA1836B37E00D017F1 /* DFGResurrectionForValidationPhase.cpp */,
> 				0F666ECB1836B37E00D017F1 /* DFGResurrectionForValidationPhase.h */,
>+				0F2FCCF418A60070001A27F8 /* DFGSafepoint.cpp */,
>+				0F2FCCF518A60070001A27F8 /* DFGSafepoint.h */,
> 				A77A423C17A0BBFD00A8DB81 /* DFGSafeToExecute.h */,
> 				A741017E179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h */,
>+				0F2FCCF618A60070001A27F8 /* DFGScannable.h */,
> 				86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */,
> 				0F1E3A65153A21DF000F9456 /* DFGSilentRegisterSavePlan.h */,
> 				0F1E3A501537C2CB000F9456 /* DFGSlowPathGenerator.h */,
>@@ -4277,9 +4294,13 @@
> 				0FC20CB818556A3500C9E954 /* DFGSSALoweringPhase.h */,
> 				0F9FB4F217FCB91700CB67F8 /* DFGStackLayoutPhase.cpp */,
> 				0F9FB4F317FCB91700CB67F8 /* DFGStackLayoutPhase.h */,
>+				2ACCF3DC185FE26B0083E2AD /* DFGStoreBarrierElisionPhase.cpp */,
>+				2ACCF3DD185FE26B0083E2AD /* DFGStoreBarrierElisionPhase.h */,
> 				0FC20CB31852E2C600C9E954 /* DFGStrengthReductionPhase.cpp */,
> 				0FC20CB41852E2C600C9E954 /* DFGStrengthReductionPhase.h */,
> 				0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */,
>+				0F2FCCF718A60070001A27F8 /* DFGThreadData.cpp */,
>+				0F2FCCF818A60070001A27F8 /* DFGThreadData.h */,
> 				0FC0979F146B28C700CF2442 /* DFGThunks.cpp */,
> 				0FC097A0146B28C700CF2442 /* DFGThunks.h */,
> 				0FD8A31F17D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.cpp */,
>@@ -4698,7 +4719,7 @@
> 				65C0285D1717966800351E35 /* ARMv7DOpcode.h in Headers */,
> 				2A68295B1875F80500B6C3E2 /* CopyWriteBarrier.h in Headers */,
> 				2A4EC90C1860D6C20094F782 /* WriteBarrierBuffer.h in Headers */,
>-               C2B6D75318A33793004A9301 /* WriteBarrierInlines.h in Headers */,
>+				C2B6D75318A33793004A9301 /* WriteBarrierInlines.h in Headers */,
> 				FE5932A8183C5A2600A1ECCC /* VMEntryScope.h in Headers */,
> 				A532439318569709002ED692 /* CodeGeneratorInspectorStrings.py in Headers */,
> 				A532439218569709002ED692 /* CodeGeneratorInspector.py in Headers */,
>@@ -5077,6 +5098,7 @@
> 				A790DD70182F499700588807 /* JSSetIterator.h in Headers */,
> 				0F24E54E17EE274900ABB217 /* JITOperationWrappers.h in Headers */,
> 				0F766D3115AA8112008F363E /* JITStubRoutine.h in Headers */,
>+				0F2FCCFA18A60070001A27F8 /* DFGGraphSafepoint.h in Headers */,
> 				0F766D2C15A8CC3A008F363E /* JITStubRoutineSet.h in Headers */,
> 				14C5242B0F5355E900BA3D04 /* JITStubs.h in Headers */,
> 				FEF6835E174343CC00A32E25 /* JITStubsARM.h in Headers */,
>@@ -5116,6 +5138,7 @@
> 				86E3C613167BABD7006D760A /* JSContext.h in Headers */,
> 				86E3C617167BABEE006D760A /* JSContextInternal.h in Headers */,
> 				BC18C41E0E16F5CD00B34460 /* JSContextRef.h in Headers */,
>+				0F2FCCFF18A60070001A27F8 /* DFGThreadData.h in Headers */,
> 				148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */,
> 				A72028B81797601E0098028C /* JSCTestRunnerUtils.h in Headers */,
> 				0F2B66EC17B6B5AB00A7AE3F /* JSDataView.h in Headers */,
>@@ -5236,6 +5259,7 @@
> 				86C568E111A213EE0007F7F0 /* MacroAssemblerMIPS.h in Headers */,
> 				86AE64A9135E5E1C00963012 /* MacroAssemblerSH4.h in Headers */,
> 				860161E40F3A83C100F84710 /* MacroAssemblerX86.h in Headers */,
>+				0F2FCCFC18A60070001A27F8 /* DFGSafepoint.h in Headers */,
> 				860161E50F3A83C100F84710 /* MacroAssemblerX86_64.h in Headers */,
> 				860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */,
> 				A700873A17CBE85300C3E643 /* MapConstructor.h in Headers */,
>@@ -5447,6 +5471,7 @@
> 				0F242DA713F3B1E8007ADD4C /* WeakReferenceHarvester.h in Headers */,
> 				14E84FA114EE1ACC00D6D5D4 /* WeakSet.h in Headers */,
> 				14150133154BB13F005D8C98 /* WeakSetInlines.h in Headers */,
>+				0F2FCCFD18A60070001A27F8 /* DFGScannable.h in Headers */,
> 				BC18C47A0E16F5CD00B34460 /* WebKitAvailability.h in Headers */,
> 				A74DEF92182D991400522C22 /* MapIteratorConstructor.h in Headers */,
> 				A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */,
>@@ -6040,6 +6065,7 @@
> 				A70447ED17A0BD7000F5898E /* DumpContext.cpp in Sources */,
> 				147F39C7107EC37600427A48 /* Error.cpp in Sources */,
> 				147F39C8107EC37600427A48 /* ErrorConstructor.cpp in Sources */,
>+				0F2FCCF918A60070001A27F8 /* DFGGraphSafepoint.cpp in Sources */,
> 				147F39C9107EC37600427A48 /* ErrorInstance.cpp in Sources */,
> 				147F39CA107EC37600427A48 /* ErrorPrototype.cpp in Sources */,
> 				A5FD0067189AFE9C00633231 /* ScriptArguments.cpp in Sources */,
>@@ -6210,6 +6236,7 @@
> 				A7482B9411671147003B0712 /* JSWeakObjectMapRefPrivate.cpp in Sources */,
> 				1442566115EDE98D0066A49B /* JSWithScope.cpp in Sources */,
> 				A503FA1B188E0FB000110F14 /* JSJavaScriptCallFrame.cpp in Sources */,
>+				0F2FCCFE18A60070001A27F8 /* DFGThreadData.cpp in Sources */,
> 				86E3C618167BABEE006D760A /* JSWrapperMap.mm in Sources */,
> 				14280870107EC1340013E7B2 /* JSWrapperObject.cpp in Sources */,
> 				A57D23E91891B0770031C7FA /* JSGlobalObjectDebuggerAgent.cpp in Sources */,
>@@ -6321,6 +6348,7 @@
> 				C225494315F7DBAA0065E898 /* SlotVisitor.cpp in Sources */,
> 				9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */,
> 				0F8F2B9E17306C8D007DBDA5 /* SourceCode.cpp in Sources */,
>+				0F2FCCFB18A60070001A27F8 /* DFGSafepoint.cpp in Sources */,
> 				A5FD0079189B051000633231 /* ConsoleMessage.cpp in Sources */,
> 				0F493AFA16D0CAD30084508B /* SourceProvider.cpp in Sources */,
> 				E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,
>Index: Source/JavaScriptCore/bytecode/CodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.cpp	(revision 163695)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.cpp	(working copy)
>@@ -36,6 +36,7 @@
> #include "DFGCapabilities.h"
> #include "DFGCommon.h"
> #include "DFGDriver.h"
>+#include "DFGJITCode.h"
> #include "DFGNode.h"
> #include "DFGWorklist.h"
> #include "Debugger.h"
>Index: Source/JavaScriptCore/bytecode/CodeBlock.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.h	(revision 163695)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.h	(working copy)
>@@ -56,7 +56,6 @@
> #include "HandlerInfo.h"
> #include "ObjectAllocationProfile.h"
> #include "Options.h"
>-#include "Operations.h"
> #include "PutPropertySlot.h"
> #include "Instruction.h"
> #include "JITCode.h"
>Index: Source/JavaScriptCore/bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp	(revision 163695)
>+++ Source/JavaScriptCore/bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp	(working copy)
>@@ -31,6 +31,7 @@
> #include "CodeBlock.h"
> #include "DFGCommon.h"
> #include "DFGExitProfile.h"
>+#include "Operations.h"
> 
> namespace JSC {
> 
>Index: Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
>===================================================================
>--- Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp	(revision 163695)
>+++ Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp	(working copy)
>@@ -29,7 +29,6 @@
> #include "config.h"
> #include "DebuggerCallFrame.h"
> 
>-#include "CallFrameInlines.h"
> #include "CodeBlock.h"
> #include "Interpreter.h"
> #include "JSActivation.h"
>Index: Source/JavaScriptCore/dfg/DFGDesiredTransitions.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGDesiredTransitions.cpp	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGDesiredTransitions.cpp	(working copy)
>@@ -31,6 +31,7 @@
> 
> #include "CodeBlock.h"
> #include "DFGCommonData.h"
>+#include "Operations.h"
> 
> namespace JSC { namespace DFG {
> 
>Index: Source/JavaScriptCore/dfg/DFGDriver.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGDriver.cpp	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGDriver.cpp	(working copy)
>@@ -121,7 +121,7 @@ static CompilationResult compileImpl(
>         return CompilationDeferred;
>     }
>     
>-    plan->compileInThread(*vm.dfgState);
>+    plan->compileInThread(*vm.dfgState, 0);
>     return plan->finalizeWithoutNotifyingCallback();
> }
> #else // ENABLE(DFG_JIT)
>Index: Source/JavaScriptCore/dfg/DFGGraph.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGGraph.cpp	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGGraph.cpp	(working copy)
>@@ -790,6 +790,59 @@ JSArrayBufferView* Graph::tryGetFoldable
>     return tryGetFoldableView(child(node, 0).node(), node->arrayMode());
> }
> 
>+void Graph::visitChildren(SlotVisitor& visitor)
>+{
>+    for (BlockIndex blockIndex = numBlocks(); blockIndex--;) {
>+        BasicBlock* block = this->block(blockIndex);
>+        if (!block)
>+            continue;
>+        
>+        for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
>+            Node* node = block->at(nodeIndex);
>+            
>+            switch (node->op()) {
>+            case JSConstant:
>+            case WeakJSConstant:
>+                visitor.appendUnbarrieredReadOnlyValue(valueOfJSConstant(node));
>+                break;
>+                
>+            case CheckFunction:
>+                visitor.appendUnbarrieredReadOnlyPointer(node->function());
>+                break;
>+                
>+            case CheckExecutable:
>+                visitor.appendUnbarrieredReadOnlyPointer(node->executable());
>+                break;
>+                
>+            case CheckStructure:
>+                for (unsigned i = node->structureSet().size(); i--;)
>+                    visitor.appendUnbarrieredReadOnlyPointer(node->structureSet()[i]);
>+                break;
>+                
>+            case StructureTransitionWatchpoint:
>+            case NewObject:
>+            case ArrayifyToStructure:
>+            case NewStringObject:
>+                visitor.appendUnbarrieredReadOnlyPointer(node->structure());
>+                break;
>+                
>+            case PutStructure:
>+            case PhantomPutStructure:
>+            case AllocatePropertyStorage:
>+            case ReallocatePropertyStorage:
>+                visitor.appendUnbarrieredReadOnlyPointer(
>+                    node->structureTransitionData().previousStructure);
>+                visitor.appendUnbarrieredReadOnlyPointer(
>+                    node->structureTransitionData().newStructure);
>+                break;
>+                
>+            default:
>+                break;
>+            }
>+        }
>+    }
>+}
>+
> } } // namespace JSC::DFG
> 
> #endif
>Index: Source/JavaScriptCore/dfg/DFGGraph.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGGraph.h	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGGraph.h	(working copy)
>@@ -40,6 +40,7 @@
> #include "DFGNode.h"
> #include "DFGNodeAllocator.h"
> #include "DFGPlan.h"
>+#include "DFGScannable.h"
> #include "DFGVariadicFunction.h"
> #include "InlineCallFrameSet.h"
> #include "JSStack.h"
>@@ -78,7 +79,7 @@ enum AddSpeculationMode {
> //
> // The order may be significant for nodes with side-effects (property accesses, value conversions).
> // Nodes that are 'dead' remain in the vector with refCount 0.
>-class Graph {
>+class Graph : public virtual Scannable {
> public:
>     Graph(VM&, Plan&, LongLivedState&);
>     ~Graph();
>@@ -799,6 +800,8 @@ public:
>     JSArrayBufferView* tryGetFoldableView(Node*, ArrayMode);
>     JSArrayBufferView* tryGetFoldableViewForChild1(Node*);
>     
>+    virtual void visitChildren(SlotVisitor&) override;
>+    
>     VM& m_vm;
>     Plan& m_plan;
>     CodeBlock* m_codeBlock;
>Index: Source/JavaScriptCore/dfg/DFGGraphSafepoint.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGGraphSafepoint.cpp	(revision 0)
>+++ Source/JavaScriptCore/dfg/DFGGraphSafepoint.cpp	(working copy)
>@@ -0,0 +1,47 @@
>+/*
>+ * Copyright (C) 2014 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "DFGGraphSafepoint.h"
>+
>+#if ENABLE(DFG_JIT)
>+
>+#include "DFGGraph.h"
>+
>+namespace JSC { namespace DFG {
>+
>+GraphSafepoint::GraphSafepoint(Graph& graph)
>+    : m_safepoint(graph.m_plan)
>+{
>+    m_safepoint.add(&graph);
>+    m_safepoint.begin();
>+}
>+
>+GraphSafepoint::~GraphSafepoint() { }
>+
>+} } // namespace JSC::DFG
>+
>+#endif // ENABLE(DFG_JIT)
>+
>Index: Source/JavaScriptCore/dfg/DFGGraphSafepoint.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGGraphSafepoint.h	(revision 0)
>+++ Source/JavaScriptCore/dfg/DFGGraphSafepoint.h	(working copy)
>@@ -0,0 +1,51 @@
>+/*
>+ * Copyright (C) 2014 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef DFGGraphSafepoint_h
>+#define DFGGraphSafepoint_h
>+
>+#if ENABLE(DFG_JIT)
>+
>+#include "DFGSafepoint.h"
>+
>+namespace JSC { namespace DFG {
>+
>+class Graph;
>+
>+class GraphSafepoint {
>+public:
>+    GraphSafepoint(Graph&);
>+    ~GraphSafepoint();
>+    
>+private:
>+    Safepoint m_safepoint;
>+};
>+
>+} } // namespace JSC::DFG
>+
>+#endif // ENABLE(DFG_JIT)
>+
>+#endif // DFGGraphSafepoint_h
>+
>Index: Source/JavaScriptCore/dfg/DFGJITCode.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGJITCode.cpp	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGJITCode.cpp	(working copy)
>@@ -29,6 +29,7 @@
> #if ENABLE(DFG_JIT)
> 
> #include "CodeBlock.h"
>+#include "Operations.h"
> 
> namespace JSC { namespace DFG {
> 
>Index: Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGJITCompiler.cpp	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGJITCompiler.cpp	(working copy)
>@@ -41,6 +41,7 @@
> #include "DFGSpeculativeJIT.h"
> #include "DFGThunks.h"
> #include "JSCJSValueInlines.h"
>+#include "Operations.h"
> #include "MaxFrameExtentForSlowPathCall.h"
> #include "VM.h"
> #include "LinkBuffer.h"
>Index: Source/JavaScriptCore/dfg/DFGJITCompiler.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGJITCompiler.h	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGJITCompiler.h	(working copy)
>@@ -29,7 +29,6 @@
> #if ENABLE(DFG_JIT)
> 
> #include "CCallHelpers.h"
>-#include "CallFrameInlines.h"
> #include "CodeBlock.h"
> #include "DFGDisassembler.h"
> #include "DFGGraph.h"
>Index: Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp	(working copy)
>@@ -29,6 +29,7 @@
> #if ENABLE(DFG_JIT)
> 
> #include "Arguments.h"
>+#include "DFGJITCode.h"
> #include "DFGOperations.h"
> #include "JIT.h"
> #include "JSCJSValueInlines.h"
>Index: Source/JavaScriptCore/dfg/DFGOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOperations.cpp	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGOperations.cpp	(working copy)
>@@ -32,6 +32,7 @@
> #include "CommonSlowPaths.h"
> #include "CopiedSpaceInlines.h"
> #include "DFGDriver.h"
>+#include "DFGJITCode.h"
> #include "DFGOSRExit.h"
> #include "DFGThunks.h"
> #include "DFGToFTLDeferredCompilationCallback.h"
>Index: Source/JavaScriptCore/dfg/DFGOperations.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOperations.h	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGOperations.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
>+ * Copyright (C) 2011, 2013, 2014 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -28,7 +28,6 @@
> 
> #if ENABLE(DFG_JIT)
> 
>-#include "DFGJITCompiler.h"
> #include "JITOperations.h"
> #include "PutKind.h"
> 
>Index: Source/JavaScriptCore/dfg/DFGPlan.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGPlan.cpp	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGPlan.cpp	(working copy)
>@@ -41,6 +41,7 @@
> #include "DFGFailedFinalizer.h"
> #include "DFGFlushLivenessAnalysisPhase.h"
> #include "DFGFixupPhase.h"
>+#include "DFGGraphSafepoint.h"
> #include "DFGInvalidationPointInjectionPhase.h"
> #include "DFGJITCompiler.h"
> #include "DFGLICMPhase.h"
>@@ -135,8 +136,10 @@ bool Plan::reportCompileTimes() const
>         || (Options::reportFTLCompileTimes() && isFTL(mode));
> }
> 
>-void Plan::compileInThread(LongLivedState& longLivedState)
>+void Plan::compileInThread(LongLivedState& longLivedState, ThreadData* threadData)
> {
>+    this->threadData = threadData;
>+    
>     double before = 0;
>     if (reportCompileTimes())
>         before = currentTimeMS();
>@@ -313,11 +316,14 @@ Plan::CompilationPath Plan::compileInThr
>         
>         dumpAndVerifyGraph(dfg, "Graph just before FTL lowering:");
>         
>-        initializeLLVM();
>-        
>+        {
>+            GraphSafepoint safepoint(dfg);
>+            initializeLLVM();
>+        }
>+            
>         FTL::State state(dfg);
>         FTL::lowerDFGToLLVM(state);
>-        
>+            
>         if (reportCompileTimes())
>             beforeFTL = currentTimeMS();
>         
>@@ -327,7 +333,7 @@ Plan::CompilationPath Plan::compileInThr
>         }
>         
>         FTL::compile(state);
>-
>+            
>         if (Options::llvmAlwaysFailsBeforeLink()) {
>             FTL::fail(state);
>             return FTLPath;
>Index: Source/JavaScriptCore/dfg/DFGPlan.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGPlan.h	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGPlan.h	(working copy)
>@@ -52,6 +52,7 @@ class SlotVisitor;
> namespace DFG {
> 
> class LongLivedState;
>+class ThreadData;
> 
> #if ENABLE(DFG_JIT)
> 
>@@ -62,7 +63,7 @@ struct Plan : public ThreadSafeRefCounte
>         const Operands<JSValue>& mustHandleValues);
>     ~Plan();
>     
>-    void compileInThread(LongLivedState&);
>+    void compileInThread(LongLivedState&, ThreadData*);
>     
>     CompilationResult finalizeWithoutNotifyingCallback();
>     void finalizeAndNotifyCallback();
>@@ -79,6 +80,8 @@ struct Plan : public ThreadSafeRefCounte
>     CompilationMode mode;
>     const unsigned osrEntryBytecodeIndex;
>     Operands<JSValue> mustHandleValues;
>+    
>+    ThreadData* threadData;
> 
>     RefPtr<Profiler::Compilation> compilation;
> 
>Index: Source/JavaScriptCore/dfg/DFGSafepoint.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSafepoint.cpp	(revision 0)
>+++ Source/JavaScriptCore/dfg/DFGSafepoint.cpp	(working copy)
>@@ -0,0 +1,74 @@
>+/*
>+ * Copyright (C) 2014 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "DFGSafepoint.h"
>+
>+#if ENABLE(DFG_JIT)
>+
>+#include "DFGPlan.h"
>+#include "DFGScannable.h"
>+#include "DFGThreadData.h"
>+
>+namespace JSC { namespace DFG {
>+
>+Safepoint::Safepoint(Plan& plan)
>+    : m_plan(plan)
>+    , m_didCallBegin(false)
>+{
>+}
>+
>+Safepoint::~Safepoint()
>+{
>+    RELEASE_ASSERT(m_didCallBegin);
>+    if (ThreadData* data = m_plan.threadData)
>+        data->m_rightToRun.lock();
>+}
>+
>+void Safepoint::add(Scannable* scannable)
>+{
>+    RELEASE_ASSERT(!m_didCallBegin);
>+    m_scannables.append(scannable);
>+}
>+
>+void Safepoint::begin()
>+{
>+    RELEASE_ASSERT(!m_didCallBegin);
>+    if (ThreadData* data = m_plan.threadData)
>+        data->m_rightToRun.unlock();
>+    m_didCallBegin = true;
>+}
>+
>+void Safepoint::visitChildren(SlotVisitor& visitor)
>+{
>+    RELEASE_ASSERT(m_didCallBegin);
>+    for (unsigned i = m_scannables.size(); i--;)
>+        m_scannables[i]->visitChildren(visitor);
>+}
>+
>+} } // namespace JSC::DFG
>+
>+#endif // ENABLE(DFG_JIT)
>+
>Index: Source/JavaScriptCore/dfg/DFGSafepoint.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSafepoint.h	(revision 0)
>+++ Source/JavaScriptCore/dfg/DFGSafepoint.h	(working copy)
>@@ -0,0 +1,64 @@
>+/*
>+ * Copyright (C) 2014 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef DFGSafepoint_h
>+#define DFGSafepoint_h
>+
>+#if ENABLE(DFG_JIT)
>+
>+#include <wtf/Vector.h>
>+
>+namespace JSC {
>+
>+class SlotVisitor;
>+
>+namespace DFG {
>+
>+class Scannable;
>+struct Plan;
>+
>+class Safepoint {
>+public:
>+    Safepoint(Plan&);
>+    ~Safepoint();
>+    
>+    void add(Scannable*);
>+    
>+    void begin();
>+    
>+    void visitChildren(SlotVisitor&);
>+    
>+private:
>+    Plan& m_plan;
>+    Vector<Scannable*> m_scannables;
>+    bool m_didCallBegin;
>+};
>+
>+} } // namespace JSC::DFG
>+
>+#endif // ENABLE(DFG_JIT)
>+
>+#endif // DFGSafepoint_h
>+
>Index: Source/JavaScriptCore/dfg/DFGScannable.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGScannable.h	(revision 0)
>+++ Source/JavaScriptCore/dfg/DFGScannable.h	(working copy)
>@@ -0,0 +1,50 @@
>+/*
>+ * Copyright (C) 2014 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef DFGScannable_h
>+#define DFGScannable_h
>+
>+#if ENABLE(DFG_JIT)
>+
>+namespace JSC {
>+
>+class SlotVisitor;
>+
>+namespace DFG {
>+
>+class Scannable {
>+public:
>+    Scannable() { }
>+    virtual ~Scannable() { }
>+    
>+    virtual void visitChildren(SlotVisitor&) = 0;
>+};
>+
>+} } // namespace JSC::DFG
>+
>+#endif // ENABLE(DFG_JIT)
>+
>+#endif // DFGScannable_h
>+
>Index: Source/JavaScriptCore/dfg/DFGThreadData.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGThreadData.cpp	(revision 0)
>+++ Source/JavaScriptCore/dfg/DFGThreadData.cpp	(working copy)
>@@ -0,0 +1,47 @@
>+/*
>+ * Copyright (C) 2014 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "DFGThreadData.h"
>+
>+#if ENABLE(DFG_JIT)
>+
>+namespace JSC { namespace DFG {
>+
>+ThreadData::ThreadData(Worklist* worklist)
>+    : m_worklist(worklist)
>+    , m_identifier(0)
>+    , m_safepoint(nullptr)
>+{
>+}
>+
>+ThreadData::~ThreadData()
>+{
>+}
>+
>+} } // namespace JSC::DFG
>+
>+#endif // ENABLE(DFG_JIT)
>+
>Index: Source/JavaScriptCore/dfg/DFGThreadData.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGThreadData.h	(revision 0)
>+++ Source/JavaScriptCore/dfg/DFGThreadData.h	(working copy)
>@@ -0,0 +1,59 @@
>+/*
>+ * Copyright (C) 2014 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef DFGThreadData_h
>+#define DFGThreadData_h
>+
>+#if ENABLE(DFG_JIT)
>+
>+#include <wtf/Threading.h>
>+#include <wtf/ThreadingPrimitives.h>
>+
>+namespace JSC { namespace DFG {
>+
>+class Safepoint;
>+class Worklist;
>+
>+class ThreadData {
>+public:
>+    ThreadData(Worklist*);
>+    ~ThreadData();
>+    
>+private:
>+    friend class Safepoint;
>+    friend class Worklist;
>+    
>+    Worklist* m_worklist;
>+    ThreadIdentifier m_identifier;
>+    Mutex m_rightToRun;
>+    Safepoint* m_safepoint;
>+};
>+
>+} } // namespace JSC::DFG
>+
>+#endif // ENABLE(DFG_JIT)
>+
>+#endif // DFGThreadData_h
>+
>Index: Source/JavaScriptCore/dfg/DFGThunks.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGThunks.cpp	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGThunks.cpp	(working copy)
>@@ -32,6 +32,7 @@
> #include "DFGOSRExitCompiler.h"
> #include "FPRInfo.h"
> #include "GPRInfo.h"
>+#include "LinkBuffer.h"
> #include "MacroAssembler.h"
> 
> namespace JSC { namespace DFG {
>Index: Source/JavaScriptCore/dfg/DFGWorklist.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGWorklist.cpp	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGWorklist.cpp	(working copy)
>@@ -31,6 +31,7 @@
> #include "CodeBlock.h"
> #include "DeferGC.h"
> #include "DFGLongLivedState.h"
>+#include "DFGSafepoint.h"
> #include <mutex>
> 
> namespace JSC { namespace DFG {
>@@ -57,8 +58,7 @@ void Worklist::finishCreation(unsigned n
> {
>     RELEASE_ASSERT(numberOfThreads);
>     for (unsigned i = numberOfThreads; i--;) {
>-        std::unique_ptr<ThreadData> data = std::make_unique<ThreadData>();
>-        data->m_worklist = this;
>+        std::unique_ptr<ThreadData> data = std::make_unique<ThreadData>(this);
>         data->m_identifier = createThread(threadFunction, data.get(), "JSC Compilation Thread");
>         m_threads.append(std::move(data));
>     }
>@@ -210,6 +210,12 @@ void Worklist::visitChildren(SlotVisitor
>         iter->key.visitChildren(codeBlocks);
>         iter->value->visitChildren(visitor, codeBlocks);
>     }
>+    
>+    for (unsigned i = m_threads.size(); i--;) {
>+        ThreadData* data = m_threads[i].get();
>+        if (Safepoint* safepoint = data->m_safepoint)
>+            safepoint->visitChildren(visitor);
>+    }
> }
> 
> size_t Worklist::queueLength()
>@@ -265,7 +271,7 @@ void Worklist::runThread(ThreadData* dat
>             if (Options::verboseCompilationQueue())
>                 dataLog(*this, ": Compiling ", plan->key(), " asynchronously\n");
>         
>-            plan->compileInThread(longLivedState);
>+            plan->compileInThread(longLivedState, data);
>         }
>         
>         {
>Index: Source/JavaScriptCore/dfg/DFGWorklist.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGWorklist.h	(revision 163695)
>+++ Source/JavaScriptCore/dfg/DFGWorklist.h	(working copy)
>@@ -31,6 +31,7 @@
> #if ENABLE(DFG_JIT)
> 
> #include "DFGPlan.h"
>+#include "DFGThreadData.h"
> #include <wtf/Deque.h>
> #include <wtf/HashMap.h>
> #include <wtf/Noncopyable.h>
>@@ -77,12 +78,6 @@ public:
>     void dump(PrintStream&) const;
>     
> private:
>-    struct ThreadData {
>-        Worklist* m_worklist;
>-        ThreadIdentifier m_identifier;
>-        Mutex m_rightToRun;
>-    };
>-    
>     Worklist();
>     void finishCreation(unsigned numberOfThreads);
>     
>Index: Source/JavaScriptCore/ftl/FTLCompile.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLCompile.cpp	(revision 163695)
>+++ Source/JavaScriptCore/ftl/FTLCompile.cpp	(working copy)
>@@ -31,6 +31,7 @@
> #include "CodeBlockWithJITType.h"
> #include "CCallHelpers.h"
> #include "DFGCommon.h"
>+#include "DFGGraphSafepoint.h"
> #include "DataView.h"
> #include "Disassembler.h"
> #include "FTLExitThunkGenerator.h"
>@@ -452,70 +453,74 @@ void compile(State& state)
> {
>     char* error = 0;
>     
>-    LLVMMCJITCompilerOptions options;
>-    llvm->InitializeMCJITCompilerOptions(&options, sizeof(options));
>-    options.OptLevel = Options::llvmBackendOptimizationLevel();
>-    options.NoFramePointerElim = true;
>-    if (Options::useLLVMSmallCodeModel())
>-        options.CodeModel = LLVMCodeModelSmall;
>-    options.EnableFastISel = Options::enableLLVMFastISel();
>-    options.MCJMM = llvm->CreateSimpleMCJITMemoryManager(
>-        &state, mmAllocateCodeSection, mmAllocateDataSection, mmApplyPermissions, mmDestroy);
>-    
>-    LLVMExecutionEngineRef engine;
>-    
>-    if (llvm->CreateMCJITCompilerForModule(&engine, state.module, &options, sizeof(options), &error)) {
>-        dataLog("FATAL: Could not create LLVM execution engine: ", error, "\n");
>-        CRASH();
>-    }
>-
>-    LLVMPassManagerRef functionPasses = 0;
>-    LLVMPassManagerRef modulePasses;
>-    
>-    if (Options::llvmSimpleOpt()) {
>-        modulePasses = llvm->CreatePassManager();
>-        llvm->AddTargetData(llvm->GetExecutionEngineTargetData(engine), modulePasses);
>-        llvm->AddPromoteMemoryToRegisterPass(modulePasses);
>-        llvm->AddConstantPropagationPass(modulePasses);
>-        llvm->AddInstructionCombiningPass(modulePasses);
>-        llvm->AddBasicAliasAnalysisPass(modulePasses);
>-        llvm->AddTypeBasedAliasAnalysisPass(modulePasses);
>-        llvm->AddGVNPass(modulePasses);
>-        llvm->AddCFGSimplificationPass(modulePasses);
>-        llvm->RunPassManager(modulePasses, state.module);
>-    } else {
>-        LLVMPassManagerBuilderRef passBuilder = llvm->PassManagerBuilderCreate();
>-        llvm->PassManagerBuilderSetOptLevel(passBuilder, Options::llvmOptimizationLevel());
>-        llvm->PassManagerBuilderSetSizeLevel(passBuilder, Options::llvmSizeLevel());
>-        
>-        functionPasses = llvm->CreateFunctionPassManagerForModule(state.module);
>-        modulePasses = llvm->CreatePassManager();
>-        
>-        llvm->AddTargetData(llvm->GetExecutionEngineTargetData(engine), modulePasses);
>-        
>-        llvm->PassManagerBuilderPopulateFunctionPassManager(passBuilder, functionPasses);
>-        llvm->PassManagerBuilderPopulateModulePassManager(passBuilder, modulePasses);
>-        
>-        llvm->PassManagerBuilderDispose(passBuilder);
>-        
>-        llvm->InitializeFunctionPassManager(functionPasses);
>-        for (LValue function = llvm->GetFirstFunction(state.module); function; function = llvm->GetNextFunction(function))
>-            llvm->RunFunctionPassManager(functionPasses, function);
>-        llvm->FinalizeFunctionPassManager(functionPasses);
>-        
>-        llvm->RunPassManager(modulePasses, state.module);
>-    }
>-
>-    if (DFG::shouldShowDisassembly() || DFG::verboseCompilationEnabled())
>-        state.dumpState("after optimization");
>-    
>-    // FIXME: Need to add support for the case where JIT memory allocation failed.
>-    // https://bugs.webkit.org/show_bug.cgi?id=113620
>-    state.generatedFunction = reinterpret_cast<GeneratedFunction>(llvm->GetPointerToGlobal(engine, state.function));
>-    if (functionPasses)
>-        llvm->DisposePassManager(functionPasses);
>-    llvm->DisposePassManager(modulePasses);
>-    llvm->DisposeExecutionEngine(engine);
>+    {
>+        GraphSafepoint safepoint(state.graph);
>+        
>+        LLVMMCJITCompilerOptions options;
>+        llvm->InitializeMCJITCompilerOptions(&options, sizeof(options));
>+        options.OptLevel = Options::llvmBackendOptimizationLevel();
>+        options.NoFramePointerElim = true;
>+        if (Options::useLLVMSmallCodeModel())
>+            options.CodeModel = LLVMCodeModelSmall;
>+        options.EnableFastISel = Options::enableLLVMFastISel();
>+        options.MCJMM = llvm->CreateSimpleMCJITMemoryManager(
>+            &state, mmAllocateCodeSection, mmAllocateDataSection, mmApplyPermissions, mmDestroy);
>+    
>+        LLVMExecutionEngineRef engine;
>+    
>+        if (llvm->CreateMCJITCompilerForModule(&engine, state.module, &options, sizeof(options), &error)) {
>+            dataLog("FATAL: Could not create LLVM execution engine: ", error, "\n");
>+            CRASH();
>+        }
>+
>+        LLVMPassManagerRef functionPasses = 0;
>+        LLVMPassManagerRef modulePasses;
>+    
>+        if (Options::llvmSimpleOpt()) {
>+            modulePasses = llvm->CreatePassManager();
>+            llvm->AddTargetData(llvm->GetExecutionEngineTargetData(engine), modulePasses);
>+            llvm->AddPromoteMemoryToRegisterPass(modulePasses);
>+            llvm->AddConstantPropagationPass(modulePasses);
>+            llvm->AddInstructionCombiningPass(modulePasses);
>+            llvm->AddBasicAliasAnalysisPass(modulePasses);
>+            llvm->AddTypeBasedAliasAnalysisPass(modulePasses);
>+            llvm->AddGVNPass(modulePasses);
>+            llvm->AddCFGSimplificationPass(modulePasses);
>+            llvm->RunPassManager(modulePasses, state.module);
>+        } else {
>+            LLVMPassManagerBuilderRef passBuilder = llvm->PassManagerBuilderCreate();
>+            llvm->PassManagerBuilderSetOptLevel(passBuilder, Options::llvmOptimizationLevel());
>+            llvm->PassManagerBuilderSetSizeLevel(passBuilder, Options::llvmSizeLevel());
>+        
>+            functionPasses = llvm->CreateFunctionPassManagerForModule(state.module);
>+            modulePasses = llvm->CreatePassManager();
>+        
>+            llvm->AddTargetData(llvm->GetExecutionEngineTargetData(engine), modulePasses);
>+        
>+            llvm->PassManagerBuilderPopulateFunctionPassManager(passBuilder, functionPasses);
>+            llvm->PassManagerBuilderPopulateModulePassManager(passBuilder, modulePasses);
>+        
>+            llvm->PassManagerBuilderDispose(passBuilder);
>+        
>+            llvm->InitializeFunctionPassManager(functionPasses);
>+            for (LValue function = llvm->GetFirstFunction(state.module); function; function = llvm->GetNextFunction(function))
>+                llvm->RunFunctionPassManager(functionPasses, function);
>+            llvm->FinalizeFunctionPassManager(functionPasses);
>+        
>+            llvm->RunPassManager(modulePasses, state.module);
>+        }
>+
>+        if (DFG::shouldShowDisassembly() || DFG::verboseCompilationEnabled())
>+            state.dumpState("after optimization");
>+    
>+        // FIXME: Need to add support for the case where JIT memory allocation failed.
>+        // https://bugs.webkit.org/show_bug.cgi?id=113620
>+        state.generatedFunction = reinterpret_cast<GeneratedFunction>(llvm->GetPointerToGlobal(engine, state.function));
>+        if (functionPasses)
>+            llvm->DisposePassManager(functionPasses);
>+        llvm->DisposePassManager(modulePasses);
>+        llvm->DisposeExecutionEngine(engine);
>+    }
> 
>     if (shouldShowDisassembly()) {
>         for (unsigned i = 0; i < state.jitCode->handles().size(); ++i) {
>Index: Source/JavaScriptCore/ftl/FTLLink.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLLink.cpp	(revision 163695)
>+++ Source/JavaScriptCore/ftl/FTLLink.cpp	(working copy)
>@@ -30,7 +30,6 @@
> 
> #include "ArityCheckFailReturnThunks.h"
> #include "CCallHelpers.h"
>-#include "CallFrameInlines.h"
> #include "CodeBlockWithJITType.h"
> #include "DFGCommon.h"
> #include "FTLJITCode.h"
>@@ -38,6 +37,7 @@
> #include "JITStubs.h"
> #include "LLVMAPI.h"
> #include "LinkBuffer.h"
>+#include "Operations.h"
> #include "ProfilerCompilation.h"
> #include "VirtualRegister.h"
> 
>Index: Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp	(revision 163695)
>+++ Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp	(working copy)
>@@ -34,6 +34,7 @@
> #include "FTLJITCode.h"
> #include "FTLOSRExit.h"
> #include "FTLSaveRestore.h"
>+#include "LinkBuffer.h"
> #include "MaxFrameExtentForSlowPathCall.h"
> #include "OperandsInlines.h"
> #include "Operations.h"
>Index: Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp	(revision 163695)
>+++ Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp	(working copy)
>@@ -29,9 +29,9 @@
> #if ENABLE(FTL_JIT)
> 
> #include "CCallHelpers.h"
>-#include "CallFrameInlines.h"
> #include "FTLState.h"
> #include "GPRInfo.h"
>+#include "Operations.h"
> 
> namespace JSC { namespace FTL {
> 
>Index: Source/JavaScriptCore/ftl/FTLThunks.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLThunks.cpp	(revision 163695)
>+++ Source/JavaScriptCore/ftl/FTLThunks.cpp	(working copy)
>@@ -127,7 +127,7 @@ MacroAssemblerCodeRef slowPathCallThunkG
>     jit.preserveReturnAddressAfterCall(GPRInfo::nonArgGPR0);
>     jit.storePtr(GPRInfo::nonArgGPR0, AssemblyHelpers::Address(MacroAssembler::stackPointerRegister, key.offset()));
>     
>-    JITCompiler::Call call = jit.call();
>+    AssemblyHelpers::Call call = jit.call();
> 
>     // FIXME: CStack - Need to do something like jit.emitFunctionEpilogue();
>     jit.loadPtr(AssemblyHelpers::Address(MacroAssembler::stackPointerRegister, key.offset()), GPRInfo::nonPreservedNonReturnGPR);
>Index: Source/JavaScriptCore/heap/SlotVisitor.h
>===================================================================
>--- Source/JavaScriptCore/heap/SlotVisitor.h	(revision 163695)
>+++ Source/JavaScriptCore/heap/SlotVisitor.h	(working copy)
>@@ -68,6 +68,9 @@ public:
>     void appendUnbarrieredValue(JSValue*);
>     template<typename T>
>     void appendUnbarrieredWeak(Weak<T>*);
>+    template<typename T>
>+    void appendUnbarrieredReadOnlyPointer(T*);
>+    void appendUnbarrieredReadOnlyValue(JSValue);
>     void unconditionallyAppend(JSCell*);
>     
>     void addOpaqueRoot(void*);
>Index: Source/JavaScriptCore/heap/SlotVisitorInlines.h
>===================================================================
>--- Source/JavaScriptCore/heap/SlotVisitorInlines.h	(revision 163695)
>+++ Source/JavaScriptCore/heap/SlotVisitorInlines.h	(working copy)
>@@ -51,6 +51,12 @@ inline void SlotVisitor::appendUnbarrier
>     internalAppend(slot, cell);
> }
> 
>+template<typename T>
>+inline void SlotVisitor::appendUnbarrieredReadOnlyPointer(T* cell)
>+{
>+    internalAppend(0, cell);
>+}
>+
> ALWAYS_INLINE void SlotVisitor::append(JSValue* slot)
> {
>     ASSERT(slot);
>@@ -63,6 +69,11 @@ ALWAYS_INLINE void SlotVisitor::appendUn
>     internalAppend(slot, *slot);
> }
> 
>+ALWAYS_INLINE void SlotVisitor::appendUnbarrieredReadOnlyValue(JSValue value)
>+{
>+    internalAppend(0, value);
>+}
>+
> ALWAYS_INLINE void SlotVisitor::append(JSCell** slot)
> {
>     ASSERT(slot);
>Index: Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp
>===================================================================
>--- Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp	(revision 163695)
>+++ Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp	(working copy)
>@@ -35,9 +35,9 @@
> 
> #include "ArgList.h"
> #include "CallFrame.h"
>-#include "CallFrameInlines.h"
> #include "JSCJSValue.h"
> #include "JSFunction.h"
>+#include "Operations.h"
> #include "ScriptArguments.h"
> #include "ScriptCallFrame.h"
> #include "ScriptCallStack.h"
>Index: Source/JavaScriptCore/interpreter/ProtoCallFrame.cpp
>===================================================================
>--- Source/JavaScriptCore/interpreter/ProtoCallFrame.cpp	(revision 163695)
>+++ Source/JavaScriptCore/interpreter/ProtoCallFrame.cpp	(working copy)
>@@ -27,6 +27,7 @@
> #include "ProtoCallFrame.h"
> 
> #include "CodeBlock.h"
>+#include "Operations.h"
> #include "StackAlignment.h"
> 
> namespace JSC {
>Index: Source/JavaScriptCore/jit/JITExceptions.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITExceptions.cpp	(revision 163695)
>+++ Source/JavaScriptCore/jit/JITExceptions.cpp	(working copy)
>@@ -27,7 +27,6 @@
> #include "JITExceptions.h"
> 
> #include "CallFrame.h"
>-#include "CallFrameInlines.h"
> #include "CodeBlock.h"
> #include "Interpreter.h"
> #include "JITStubs.h"
>Index: Source/JavaScriptCore/jit/JITInlines.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITInlines.h	(revision 163695)
>+++ Source/JavaScriptCore/jit/JITInlines.h	(working copy)
>@@ -29,7 +29,7 @@
> 
> #if ENABLE(JIT)
> 
>-#include "CallFrameInlines.h"
>+#include "Operations.h"
> 
> namespace JSC {
> 
>Index: Source/JavaScriptCore/jit/JITOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.cpp	(revision 163695)
>+++ Source/JavaScriptCore/jit/JITOperations.cpp	(working copy)
>@@ -29,7 +29,6 @@
> 
> #include "Arguments.h"
> #include "ArrayConstructor.h"
>-#include "CallFrameInlines.h"
> #include "DFGCompilationMode.h"
> #include "DFGDriver.h"
> #include "DFGOSREntry.h"
>Index: Source/JavaScriptCore/jit/Repatch.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/Repatch.cpp	(revision 163695)
>+++ Source/JavaScriptCore/jit/Repatch.cpp	(working copy)
>@@ -29,7 +29,6 @@
> #if ENABLE(JIT)
> 
> #include "CCallHelpers.h"
>-#include "CallFrameInlines.h"
> #include "DFGOperations.h"
> #include "DFGSpeculativeJIT.h"
> #include "FTLThunks.h"
>Index: Source/JavaScriptCore/profiler/ProfileGenerator.cpp
>===================================================================
>--- Source/JavaScriptCore/profiler/ProfileGenerator.cpp	(revision 163695)
>+++ Source/JavaScriptCore/profiler/ProfileGenerator.cpp	(working copy)
>@@ -27,7 +27,6 @@
> #include "ProfileGenerator.h"
> 
> #include "CallFrame.h"
>-#include "CallFrameInlines.h"
> #include "CodeBlock.h"
> #include "JSGlobalObject.h"
> #include "JSStringRef.h"
>Index: Source/JavaScriptCore/runtime/Arguments.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/Arguments.cpp	(revision 163695)
>+++ Source/JavaScriptCore/runtime/Arguments.cpp	(working copy)
>@@ -25,7 +25,6 @@
> #include "config.h"
> #include "Arguments.h"
> 
>-#include "CallFrameInlines.h"
> #include "JSActivation.h"
> #include "JSArgumentsIterator.h"
> #include "JSFunction.h"
>Index: Source/JavaScriptCore/runtime/ArgumentsIteratorPrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/ArgumentsIteratorPrototype.cpp	(revision 163695)
>+++ Source/JavaScriptCore/runtime/ArgumentsIteratorPrototype.cpp	(working copy)
>@@ -27,6 +27,7 @@
> #include "ArgumentsIteratorPrototype.h"
> 
> #include "JSArgumentsIterator.h"
>+#include "Operations.h"
> 
> namespace JSC {
> 
>Index: Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp	(revision 163695)
>+++ Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp	(working copy)
>@@ -30,6 +30,7 @@
> #include "CodeBlock.h"
> #include "JITExceptions.h"
> #include "LLIntCommon.h"
>+#include "Operations.h"
> 
> namespace JSC { namespace CommonSlowPaths {
> 
>Index: Source/JavaScriptCore/runtime/JSArgumentsIterator.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArgumentsIterator.cpp	(revision 163695)
>+++ Source/JavaScriptCore/runtime/JSArgumentsIterator.cpp	(working copy)
>@@ -27,6 +27,7 @@
> #include "JSArgumentsIterator.h"
> 
> #include "Arguments.h"
>+#include "Operations.h"
> 
> namespace JSC {
> 
>Index: Source/JavaScriptCore/runtime/JSFunction.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSFunction.cpp	(revision 163695)
>+++ Source/JavaScriptCore/runtime/JSFunction.cpp	(working copy)
>@@ -29,7 +29,6 @@
> #include "CodeBlock.h"
> #include "CommonIdentifiers.h"
> #include "CallFrame.h"
>-#include "CallFrameInlines.h"
> #include "ExceptionHelpers.h"
> #include "FunctionPrototype.h"
> #include "GetterSetter.h"
>Index: Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp	(revision 163695)
>+++ Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp	(working copy)
>@@ -26,7 +26,6 @@
> #include "JSGlobalObjectFunctions.h"
> 
> #include "CallFrame.h"
>-#include "CallFrameInlines.h"
> #include "Interpreter.h"
> #include "JSFunction.h"
> #include "JSGlobalObject.h"
>Index: Source/JavaScriptCore/runtime/ObjectConstructor.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/ObjectConstructor.cpp	(revision 163695)
>+++ Source/JavaScriptCore/runtime/ObjectConstructor.cpp	(working copy)
>@@ -22,7 +22,6 @@
> #include "ObjectConstructor.h"
> 
> #include "ButterflyInlines.h"
>-#include "CallFrameInlines.h"
> #include "CopiedSpaceInlines.h"
> #include "Error.h"
> #include "ExceptionHelpers.h"
>Index: Source/JavaScriptCore/runtime/Operations.h
>===================================================================
>--- Source/JavaScriptCore/runtime/Operations.h	(revision 163695)
>+++ Source/JavaScriptCore/runtime/Operations.h	(working copy)
>@@ -1,6 +1,6 @@
> /*
>  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
>- *  Copyright (C) 2002, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
>+ *  Copyright (C) 2002, 2005, 2006, 2007, 2008, 2009, 2013, 2014 Apple Inc. All rights reserved.
>  *
>  *  This library is free software; you can redistribute it and/or
>  *  modify it under the terms of the GNU Library General Public
>@@ -22,6 +22,7 @@
> #ifndef Operations_h
> #define Operations_h
> 
>+#include "CallFrameInlines.h"
> #include "ExceptionHelpers.h"
> #include "GCIncomingRefCountedInlines.h"
> #include "Interpreter.h"
>Index: Source/JavaScriptCore/runtime/VM.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/VM.cpp	(revision 163695)
>+++ Source/JavaScriptCore/runtime/VM.cpp	(working copy)
>@@ -32,7 +32,6 @@
> #include "ArgList.h"
> #include "ArityCheckFailReturnThunks.h"
> #include "ArrayBufferNeuteringWatchpoint.h"
>-#include "CallFrameInlines.h"
> #include "CodeBlock.h"
> #include "CodeCache.h"
> #include "CommonIdentifiers.h"

Actions: View | Formatted Diff | Diff

Attachments on bug 128291: 223548 | 223635 | 223637 | 223638 | 223639 | 223640 | 223642 | 223643 | 223644 | 223645 | 223646 | 223663 | 223664