Attachment 274059 Details for Bug 155479 – work in progress

[patch] work in progress

blah.patch (text/plain), 108.70 KB, created by Filip Pizlo on 2016-03-14 17:34:58 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Filip Pizlo

Created: 2016-03-14 17:34:58 PDT

Size: 108.70 KB

patch

obsolete

>Index: Source/JavaScriptCore/CMakeLists.txt
>===================================================================
>--- Source/JavaScriptCore/CMakeLists.txt	(revision 198152)
>+++ Source/JavaScriptCore/CMakeLists.txt	(working copy)
>@@ -269,7 +269,6 @@ set(JavaScriptCore_SOURCES
>     dfg/DFGCompilationMode.cpp
>     dfg/DFGConstantFoldingPhase.cpp
>     dfg/DFGConstantHoistingPhase.cpp
>-    dfg/DFGCopyBarrierOptimizationPhase.cpp
>     dfg/DFGCriticalEdgeBreakingPhase.cpp
>     dfg/DFGDCEPhase.cpp
>     dfg/DFGDesiredIdentifiers.cpp
>Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(revision 198152)
>+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(working copy)
>@@ -89,8 +89,6 @@
> 		0F04396E1B03DC0B009598B7 /* DFGCombinedLiveness.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */; };
> 		0F05C3B41683CF9200BAF45B /* DFGArrayifySlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */; };
> 		0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0776BD14FF002800102332 /* JITCompilationEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };
>-		0F0981F71BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0981F51BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp */; };
>-		0F0981F81BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0981F61BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h */; };
> 		0F0A75221B94BFA900110660 /* InferredType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0A75201B94BFA900110660 /* InferredType.cpp */; };
> 		0F0A75231B94BFA900110660 /* InferredType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0A75211B94BFA900110660 /* InferredType.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */; };
>@@ -2248,8 +2246,6 @@
> 		0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCombinedLiveness.h; path = dfg/DFGCombinedLiveness.h; sourceTree = "<group>"; };
> 		0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArrayifySlowPathGenerator.h; path = dfg/DFGArrayifySlowPathGenerator.h; sourceTree = "<group>"; };
> 		0F0776BD14FF002800102332 /* JITCompilationEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCompilationEffort.h; sourceTree = "<group>"; };
>-		0F0981F51BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCopyBarrierOptimizationPhase.cpp; path = dfg/DFGCopyBarrierOptimizationPhase.cpp; sourceTree = "<group>"; };
>-		0F0981F61BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCopyBarrierOptimizationPhase.h; path = dfg/DFGCopyBarrierOptimizationPhase.h; sourceTree = "<group>"; };
> 		0F0A75201B94BFA900110660 /* InferredType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredType.cpp; sourceTree = "<group>"; };
> 		0F0A75211B94BFA900110660 /* InferredType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredType.h; sourceTree = "<group>"; };
> 		0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntThunks.cpp; path = llint/LLIntThunks.cpp; sourceTree = "<group>"; };
>@@ -6138,8 +6134,6 @@
> 				0F3B3A18153E68EF003ED0FF /* DFGConstantFoldingPhase.h */,
> 				0FED67B71B26256D0066CE15 /* DFGConstantHoistingPhase.cpp */,
> 				0FED67B81B26256D0066CE15 /* DFGConstantHoistingPhase.h */,
>-				0F0981F51BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp */,
>-				0F0981F61BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h */,
> 				0FBE0F6B16C1DB010082C5E8 /* DFGCPSRethreadingPhase.cpp */,
> 				0FBE0F6C16C1DB010082C5E8 /* DFGCPSRethreadingPhase.h */,
> 				A7D89CE617A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.cpp */,
>@@ -7206,7 +7200,6 @@
> 				0F38B01A17CFE75500B144D3 /* DFGCompilationMode.h in Headers */,
> 				0F3B3A1B153E68F4003ED0FF /* DFGConstantFoldingPhase.h in Headers */,
> 				0FED67BA1B26256D0066CE15 /* DFGConstantHoistingPhase.h in Headers */,
>-				0F0981F81BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h in Headers */,
> 				0FBE0F7316C1DB050082C5E8 /* DFGCPSRethreadingPhase.h in Headers */,
> 				A7D89CF617A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.h in Headers */,
> 				0FFFC95A14EF90A900C72532 /* DFGCSEPhase.h in Headers */,
>@@ -8770,7 +8763,6 @@
> 				0F38B01917CFE75500B144D3 /* DFGCompilationMode.cpp in Sources */,
> 				0F3B3A1A153E68F2003ED0FF /* DFGConstantFoldingPhase.cpp in Sources */,
> 				0FED67B91B26256D0066CE15 /* DFGConstantHoistingPhase.cpp in Sources */,
>-				0F0981F71BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp in Sources */,
> 				0FBE0F7216C1DB030082C5E8 /* DFGCPSRethreadingPhase.cpp in Sources */,
> 				A7D89CF517A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.cpp in Sources */,
> 				0F6183291C45BF070072450B /* AirCCallingConvention.cpp in Sources */,
>Index: Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h	(working copy)
>@@ -2094,7 +2094,6 @@ bool AbstractInterpreter<AbstractStateTy
>         }
>         break;
>     case GetButterfly:
>-    case GetButterflyReadOnly:
>     case AllocatePropertyStorage:
>     case ReallocatePropertyStorage:
>         forNode(node).clear(); // The result is not a JS value.
>Index: Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2015 Apple Inc. All rights reserved.
>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -192,7 +192,6 @@ private:
>                     break;
>                     
>                 case GetButterfly:
>-                case GetButterflyReadOnly:
>                     // This barely works. The danger is that the GetButterfly is used by something that
>                     // does something escaping to a candidate. Fortunately, the only butterfly-using ops
>                     // that we exempt here also use the candidate directly. If there ever was a
>Index: Source/JavaScriptCore/dfg/DFGClobberize.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGClobberize.h	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGClobberize.h	(working copy)
>@@ -803,13 +803,6 @@ void clobberize(Graph& graph, Node* node
>         def(HeapLocation(ButterflyLoc, JSObject_butterfly, node->child1()), LazyNode(node));
>         return;
> 
>-    case GetButterflyReadOnly:
>-        // This rule is separate to prevent CSE of GetButterfly with GetButterflyReadOnly. But in reality,
>-        // this works because we don't introduce GetButterflyReadOnly until the bitter end of compilation.
>-        read(JSObject_butterfly);
>-        def(HeapLocation(ButterflyReadOnlyLoc, JSObject_butterfly, node->child1()), LazyNode(node));
>-        return;
>-        
>     case Arrayify:
>     case ArrayifyToStructure:
>         read(JSCell_structureID);
>Index: Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.cpp	(working copy)
>@@ -1,133 +0,0 @@
>-/*
>- * Copyright (C) 2015 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>- * THE POSSIBILITY OF SUCH DAMAGE.
>- */
>-
>-#include "config.h"
>-#include "DFGCopyBarrierOptimizationPhase.h"
>-
>-#if ENABLE(DFG_JIT)
>-
>-#include "DFGClobberize.h"
>-#include "DFGDoesGC.h"
>-#include "DFGGraph.h"
>-#include "DFGPhase.h"
>-#include "JSCInlines.h"
>-
>-namespace JSC { namespace DFG {
>-
>-namespace {
>-
>-bool verbose = false;
>-
>-class CopyBarrierOptimizationPhase : public Phase {
>-public:
>-    CopyBarrierOptimizationPhase(Graph& graph)
>-        : Phase(graph, "copy barrier optimization")
>-    {
>-    }
>-    
>-    bool run()
>-    {
>-        if (verbose) {
>-            dataLog("Starting copy barrier optimization:\n");
>-            m_graph.dump();
>-        }
>-
>-        // First convert all GetButterfly nodes into GetButterflyReadOnly.
>-        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
>-            for (Node* node : *block) {
>-                if (node->op() == GetButterfly)
>-                    node->setOp(GetButterflyReadOnly);
>-            }
>-        }
>-
>-        // Anytime we use a GetButterflyReadOnly in a setting that may write to the heap, or if we're in a
>-        // new epoch, convert it to a GetButterfly. The epoch gets incremented at basic block boundaries,
>-        // anytime we GC, and anytime a barrier on the butterfly may be executed. We traverse the program
>-        // in pre-order so that we always see uses after defs. Note that this is a fixpoint because if we
>-        // turn a GetButterflyReadOnly into a GetButterfly, then we've introduced a butterfly reallocation.
>-        bool changed = true;
>-        Epoch currentEpoch = Epoch::first();
>-        m_graph.clearEpochs();
>-        while (changed) {
>-            changed = false;
>-            for (BasicBlock* block : m_graph.blocksInPreOrder()) {
>-                currentEpoch.bump();
>-                for (Node* node : *block) {
>-                    bool writesToHeap = writesOverlap(m_graph, node, Heap);
>-
>-                    bool reallocatesButterfly = false;
>-                    if (doesGC(m_graph, node) || writesOverlap(m_graph, node, JSObject_butterfly))
>-                        reallocatesButterfly = true;
>-                    else {
>-                        // This is not an exhaustive list of things that will execute copy barriers. Most
>-                        // things that execute copy barriers also do GC or have writes that overlap the
>-                        // butterfly heap, and we catch that above.
>-                        switch (node->op()) {
>-                        case GetButterfly:
>-                        case MultiPutByOffset:
>-                            reallocatesButterfly = true;
>-                            break;
>-                        default:
>-                            break;
>-                        }
>-                    }
>-                
>-                    m_graph.doToChildren(
>-                        node,
>-                        [&] (Edge edge) {
>-                            if (edge->op() != GetButterflyReadOnly)
>-                                return;
>-                        
>-                            if (writesToHeap || currentEpoch != edge->epoch()) {
>-                                changed = true;
>-                                edge->setOp(GetButterfly);
>-                            }
>-                        });
>-
>-                    if (reallocatesButterfly)
>-                        currentEpoch.bump();
>-
>-                    node->setEpoch(currentEpoch);
>-                }
>-            }
>-        }
>-        
>-        // This phase always thinks that it changes the graph. That's OK, because it's a late phase.
>-        return true;
>-    }
>-};
>-
>-} // anonymous namespace
>-
>-bool performCopyBarrierOptimization(Graph& graph)
>-{
>-    SamplingRegion samplingRegion("DFG Copy Barrier Optimization Phase");
>-    return runPhase<CopyBarrierOptimizationPhase>(graph);
>-}
>-
>-} } // namespace JSC::DFG
>-
>-#endif // ENABLE(DFG_JIT)
>-
>Index: Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.h	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.h	(working copy)
>@@ -1,44 +0,0 @@
>-/*
>- * Copyright (C) 2015 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>- * THE POSSIBILITY OF SUCH DAMAGE.
>- */
>-
>-#ifndef DFGCopyBarrierOptimizationPhase_h
>-#define DFGCopyBarrierOptimizationPhase_h
>-
>-#if ENABLE(DFG_JIT)
>-
>-namespace JSC { namespace DFG {
>-
>-class Graph;
>-
>-// Converts GetButterfly nodes into GetButterflyReadOnly nodes whenever the butterfly is only used for
>-// read-only operations.
>-bool performCopyBarrierOptimization(Graph&);
>-
>-} } // namespace JSC::DFG
>-
>-#endif // ENABLE(DFG_JIT)
>-
>-#endif // DFGCopyBarrierOptimizationPhase_h
>-
>Index: Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGDoesGC.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGDoesGC.cpp	(working copy)
>@@ -108,7 +108,6 @@ bool doesGC(Graph& graph, Node* node)
>     case CheckStructure:
>     case GetExecutable:
>     case GetButterfly:
>-    case GetButterflyReadOnly:
>     case CheckArray:
>     case GetScope:
>     case SkipScope:
>Index: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(working copy)
>@@ -1151,8 +1151,7 @@ private:
>         case CheckStructure:
>         case CheckCell:
>         case CreateThis:
>-        case GetButterfly:
>-        case GetButterflyReadOnly: {
>+        case GetButterfly: {
>             fixEdge<CellUse>(node->child1());
>             break;
>         }
>Index: Source/JavaScriptCore/dfg/DFGHeapLocation.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGHeapLocation.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGHeapLocation.cpp	(working copy)
>@@ -92,10 +92,6 @@ void printInternal(PrintStream& out, Loc
>         out.print("ButterflyLoc");
>         return;
>         
>-    case ButterflyReadOnlyLoc:
>-        out.print("ButterflyReadOnlyLoc");
>-        return;
>-
>     case CheckTypeInfoFlagsLoc:
>         out.print("CheckTypeInfoFlagsLoc");
>         return;
>Index: Source/JavaScriptCore/dfg/DFGHeapLocation.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGHeapLocation.h	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGHeapLocation.h	(working copy)
>@@ -39,7 +39,6 @@ enum LocationKind {
>     
>     ArrayLengthLoc,
>     ButterflyLoc,
>-    ButterflyReadOnlyLoc,
>     CheckTypeInfoFlagsLoc,
>     OverridesHasInstanceLoc,
>     ClosureVariableLoc,
>Index: Source/JavaScriptCore/dfg/DFGNodeType.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGNodeType.h	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGNodeType.h	(working copy)
>@@ -197,7 +197,6 @@ namespace JSC { namespace DFG {
>     macro(AllocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
>     macro(ReallocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
>     macro(GetButterfly, NodeResultStorage) \
>-    macro(GetButterflyReadOnly, NodeResultStorage) /* A node used to replace GetButterfly at the bitter end of compilation. */\
>     macro(CheckArray, NodeMustGenerate) \
>     macro(Arrayify, NodeMustGenerate) \
>     macro(ArrayifyToStructure, NodeMustGenerate) \
>Index: Source/JavaScriptCore/dfg/DFGOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOperations.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGOperations.cpp	(working copy)
>@@ -1299,22 +1299,6 @@ int32_t JIT_OPERATION operationSwitchStr
>     return exec->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(string->value(exec).impl(), std::numeric_limits<int32_t>::min());
> }
> 
>-char* JIT_OPERATION operationGetButterfly(ExecState* exec, JSCell* cell)
>-{
>-    VM& vm = exec->vm();
>-    NativeCallFrameTracer tracer(&vm, exec);
>-
>-    return bitwise_cast<char*>(jsCast<JSObject*>(cell)->butterfly());
>-}
>-
>-char* JIT_OPERATION operationGetArrayBufferVector(ExecState* exec, JSCell* cell)
>-{
>-    VM& vm = exec->vm();
>-    NativeCallFrameTracer tracer(&vm, exec);
>-
>-    return bitwise_cast<char*>(jsCast<JSArrayBufferView*>(cell)->vector());
>-}
>-
> void JIT_OPERATION operationNotifyWrite(ExecState* exec, WatchpointSet* set)
> {
>     VM& vm = exec->vm();
>Index: Source/JavaScriptCore/dfg/DFGOperations.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOperations.h	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGOperations.h	(working copy)
>@@ -145,8 +145,6 @@ JSCell* JIT_OPERATION operationStrCat3(E
> char* JIT_OPERATION operationFindSwitchImmTargetForDouble(ExecState*, EncodedJSValue, size_t tableIndex);
> char* JIT_OPERATION operationSwitchString(ExecState*, size_t tableIndex, JSString*);
> int32_t JIT_OPERATION operationSwitchStringAndGetBranchOffset(ExecState*, size_t tableIndex, JSString*);
>-char* JIT_OPERATION operationGetButterfly(ExecState*, JSCell*);
>-char* JIT_OPERATION operationGetArrayBufferVector(ExecState*, JSCell*);
> void JIT_OPERATION operationNotifyWrite(ExecState*, WatchpointSet*);
> void JIT_OPERATION operationThrowStackOverflowForVarargs(ExecState*) WTF_INTERNAL;
> int32_t JIT_OPERATION operationSizeOfVarargs(ExecState*, EncodedJSValue arguments, int32_t firstVarArgOffset);
>Index: Source/JavaScriptCore/dfg/DFGPlan.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGPlan.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGPlan.cpp	(working copy)
>@@ -38,7 +38,6 @@
> #include "DFGCleanUpPhase.h"
> #include "DFGConstantFoldingPhase.h"
> #include "DFGConstantHoistingPhase.h"
>-#include "DFGCopyBarrierOptimizationPhase.h"
> #include "DFGCriticalEdgeBreakingPhase.h"
> #include "DFGDCEPhase.h"
> #include "DFGFailedFinalizer.h"
>@@ -357,8 +356,6 @@ Plan::CompilationPath Plan::compileInThr
>         performCleanUp(dfg);
>         performCPSRethreading(dfg);
>         performDCE(dfg);
>-        if (Options::useCopyBarrierOptimization())
>-            performCopyBarrierOptimization(dfg);
>         performPhantomInsertion(dfg);
>         performStackLayout(dfg);
>         performVirtualRegisterAllocation(dfg);
>@@ -439,8 +436,6 @@ Plan::CompilationPath Plan::compileInThr
>             performMovHintRemoval(dfg);
>         performCleanUp(dfg);
>         performDCE(dfg); // We rely on this to kill dead code that won't be recognized as dead by B3.
>-        if (Options::useCopyBarrierOptimization())
>-            performCopyBarrierOptimization(dfg);
>         performStackLayout(dfg);
>         performLivenessAnalysis(dfg);
>         performOSRAvailabilityAnalysis(dfg);
>Index: Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp	(working copy)
>@@ -483,7 +483,6 @@ private:
>         }
>             
>         case GetButterfly:
>-        case GetButterflyReadOnly:
>         case GetIndexedPropertyStorage:
>         case AllocatePropertyStorage:
>         case ReallocatePropertyStorage: {
>Index: Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSafeToExecute.h	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGSafeToExecute.h	(working copy)
>@@ -203,7 +203,6 @@ bool safeToExecute(AbstractStateType& st
>     case CheckStructure:
>     case GetExecutable:
>     case GetButterfly:
>-    case GetButterflyReadOnly:
>     case CheckArray:
>     case Arrayify:
>     case ArrayifyToStructure:
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp	(working copy)
>@@ -4126,7 +4126,6 @@ void SpeculativeJIT::compile(Node* node)
>         break;
>         
>     case GetButterfly:
>-    case GetButterflyReadOnly:
>         compileGetButterfly(node);
>         break;
> 
>@@ -4813,7 +4812,6 @@ void SpeculativeJIT::compile(Node* node)
>         // We use resultPayloadGPR as a temporary here. We have to make sure clobber it after getting the 
>         // value out of indexGPR and enumeratorGPR because resultPayloadGPR could reuse either of those registers.
>         m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), resultPayloadGPR);
>-        slowPath.append(m_jit.branchIfNotToSpace(resultPayloadGPR));
>         int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
>         m_jit.load32(MacroAssembler::BaseIndex(resultPayloadGPR, scratchGPR, MacroAssembler::TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagGPR);
>         m_jit.load32(MacroAssembler::BaseIndex(resultPayloadGPR, scratchGPR, MacroAssembler::TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadGPR);
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(working copy)
>@@ -4147,7 +4147,6 @@ void SpeculativeJIT::compile(Node* node)
>         break;
>         
>     case GetButterfly:
>-    case GetButterflyReadOnly:
>         compileGetButterfly(node);
>         break;
> 
>@@ -4818,7 +4817,6 @@ void SpeculativeJIT::compile(Node* node)
>         // Otherwise it's out of line
>         outOfLineAccess.link(&m_jit);
>         m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), scratch2GPR);
>-        slowPath.append(m_jit.branchIfNotToSpace(scratch2GPR));
>         m_jit.move(indexGPR, scratch1GPR);
>         m_jit.sub32(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), scratch1GPR);
>         m_jit.neg32(scratch1GPR);
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(working copy)
>@@ -5226,10 +5226,7 @@ void SpeculativeJIT::compileGetIndexedPr
>     default:
>         ASSERT(isTypedView(node->arrayMode().typedArrayType()));
> 
>-        JITCompiler::Jump fail = m_jit.loadTypedArrayVector(baseReg, storageReg);
>-
>-        addSlowPathGenerator(
>-            slowPathCall(fail, this, operationGetArrayBufferVector, storageReg, baseReg));
>+        m_jit.loadPtr(JITCompiler::Address(baseReg, JSArrayBufferView::offsetOfVector()), storageReg);
>         break;
>     }
>     
>@@ -5252,13 +5249,7 @@ void SpeculativeJIT::compileGetTypedArra
>         TrustedImm32(WastefulTypedArray));
> 
>     m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), dataGPR);
>-    m_jit.removeSpaceBits(dataGPR);
>     m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfVector()), vectorGPR);
>-    JITCompiler::JumpList vectorReady;
>-    vectorReady.append(m_jit.branchIfToSpace(vectorGPR));
>-    vectorReady.append(m_jit.branchIfNotFastTypedArray(baseGPR));
>-    m_jit.removeSpaceBits(vectorGPR);
>-    vectorReady.link(&m_jit);
>     m_jit.loadPtr(MacroAssembler::Address(dataGPR, Butterfly::offsetOfArrayBuffer()), dataGPR);
>     m_jit.loadPtr(MacroAssembler::Address(dataGPR, ArrayBuffer::offsetOfData()), dataGPR);
>     m_jit.subPtr(dataGPR, vectorGPR);
>@@ -6322,23 +6313,6 @@ void SpeculativeJIT::compileGetButterfly
>     
>     m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::butterflyOffset()), resultGPR);
> 
>-    switch (node->op()) {
>-    case GetButterfly:
>-        addSlowPathGenerator(
>-            slowPathCall(
>-                m_jit.branchIfNotToSpace(resultGPR),
>-                this, operationGetButterfly, resultGPR, baseGPR));
>-        break;
>-
>-    case GetButterflyReadOnly:
>-        m_jit.removeSpaceBits(resultGPR);
>-        break;
>-
>-    default:
>-        DFG_CRASH(m_jit.graph(), node, "Bad node type");
>-        break;
>-    }
>-    
>     storageResult(resultGPR, node);
> }
> 
>Index: Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp	(revision 198152)
>+++ Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp	(working copy)
>@@ -247,7 +247,6 @@ private:
>                 case AllocatePropertyStorage:
>                 case ReallocatePropertyStorage:
>                 case GetButterfly:
>-                case GetButterflyReadOnly:
>                 case GetByVal:
>                 case PutByValDirect:
>                 case PutByVal:
>@@ -326,7 +325,6 @@ private:
>                 case PutStructure:
>                 case ReallocatePropertyStorage:
>                 case GetButterfly:
>-                case GetButterflyReadOnly:
>                 case GetByVal:
>                 case PutByValDirect:
>                 case PutByVal:
>Index: Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLCapabilities.cpp	(revision 198152)
>+++ Source/JavaScriptCore/ftl/FTLCapabilities.cpp	(working copy)
>@@ -69,7 +69,6 @@ inline CapabilityLevel canCompile(Node* 
>     case ArrayifyToStructure:
>     case PutStructure:
>     case GetButterfly:
>-    case GetButterflyReadOnly:
>     case NewObject:
>     case NewArray:
>     case NewArrayBuffer:
>Index: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp	(revision 198152)
>+++ Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp	(working copy)
>@@ -615,9 +615,6 @@ private:
>         case GetButterfly:
>             compileGetButterfly();
>             break;
>-        case GetButterflyReadOnly:
>-            compileGetButterflyReadOnly();
>-            break;
>         case ConstantStoragePointer:
>             compileConstantStoragePointer();
>             break;
>@@ -2394,14 +2391,9 @@ private:
>     
>     void compileGetButterfly()
>     {
>-        setStorage(loadButterflyWithBarrier(lowCell(m_node->child1())));
>+        setStorage(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.JSObject_butterfly));
>     }
> 
>-    void compileGetButterflyReadOnly()
>-    {
>-        setStorage(loadButterflyReadOnly(lowCell(m_node->child1())));
>-    }
>-    
>     void compileConstantStoragePointer()
>     {
>         setStorage(m_out.constIntPtr(m_node->storagePointer()));
>@@ -2434,7 +2426,7 @@ private:
>             return;
>         }
>         
>-        setStorage(loadVectorWithBarrier(cell));
>+        setStorage(m_out.loadPtr(cell, m_heaps.JSArrayBufferView_vector));
>     }
>     
>     void compileCheckArray()
>@@ -2471,8 +2463,8 @@ private:
> 
>         m_out.appendTo(wastefulCase, continuation);
> 
>-        LValue vectorPtr = loadVectorReadOnly(basePtr);
>-        LValue butterflyPtr = loadButterflyReadOnly(basePtr);
>+        LValue vectorPtr = m_out.loadPtr(basePtr, m_heaps.JSArrayBufferView_vector);
>+        LValue butterflyPtr = m_out.loadPtr(basePtr, m_heaps.JSObject_butterfly);
>         LValue arrayBufferPtr = m_out.loadPtr(butterflyPtr, m_heaps.Butterfly_arrayBuffer);
>         LValue dataPtr = m_out.loadPtr(arrayBufferPtr, m_heaps.ArrayBuffer_data);
> 
>@@ -4342,7 +4334,7 @@ private:
>                 else
>                     propertyBase = weakPointer(method.prototype()->value().asCell());
>                 if (!isInlineOffset(method.offset()))
>-                    propertyBase = loadButterflyReadOnly(propertyBase);
>+                    propertyBase = m_out.loadPtr(propertyBase, m_heaps.JSObject_butterfly);
>                 result = loadProperty(
>                     propertyBase, data.identifierNumber, method.offset());
>                 break;
>@@ -4410,7 +4402,7 @@ private:
>                 if (isInlineOffset(variant.offset()))
>                     storage = base;
>                 else
>-                    storage = loadButterflyWithBarrier(base);
>+                    storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
>             } else {
>                 m_graph.m_plan.transitions.addLazily(
>                     codeBlock(), m_node->origin.semantic.codeOriginOwner(),
>@@ -6182,7 +6174,7 @@ private:
>         m_out.jump(continuation);
> 
>         m_out.appendTo(outOfLineLoad, slowCase);
>-        LValue storage = loadButterflyReadOnly(base);
>+        LValue storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
>         LValue realIndex = m_out.signExt32To64(
>             m_out.neg(m_out.sub(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_cachedInlineCapacity))));
>         int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
>@@ -6955,14 +6947,14 @@ private:
>             return object;
>         
>         if (previousStructure->outOfLineCapacity() == nextStructure->outOfLineCapacity())
>-            return loadButterflyWithBarrier(object);
>+            return m_out.loadPtr(object, m_heaps.JSObject_butterfly);
>         
>         LValue result;
>         if (!previousStructure->outOfLineCapacity())
>             result = allocatePropertyStorage(object, previousStructure);
>         else {
>             result = reallocatePropertyStorage(
>-                object, loadButterflyWithBarrier(object),
>+                object, m_out.loadPtr(object, m_heaps.JSObject_butterfly),
>                 previousStructure, nextStructure);
>         }
>         
>@@ -7125,110 +7117,6 @@ private:
>         return patchpoint;
>     }
> 
>-    LValue loadButterflyWithBarrier(LValue object)
>-    {
>-        return copyBarrier(
>-            object, m_out.loadPtr(object, m_heaps.JSObject_butterfly), operationGetButterfly);
>-    }
>-    
>-    LValue loadVectorWithBarrier(LValue object)
>-    {
>-        LValue fastResultValue = m_out.loadPtr(object, m_heaps.JSArrayBufferView_vector);
>-        return copyBarrier(
>-            fastResultValue,
>-            [&] () -> LValue {
>-                LBasicBlock slowPath = m_out.newBlock();
>-                LBasicBlock continuation = m_out.newBlock();
>-
>-                ValueFromBlock fastResult = m_out.anchor(fastResultValue);
>-                m_out.branch(isFastTypedArray(object), rarely(slowPath), usually(continuation));
>-
>-                LBasicBlock lastNext = m_out.appendTo(slowPath, continuation);
>-
>-                LValue slowResultValue = lazySlowPath(
>-                    [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
>-                        return createLazyCallGenerator(
>-                            operationGetArrayBufferVector, locations[0].directGPR(),
>-                            locations[1].directGPR());
>-                    }, object);
>-                ValueFromBlock slowResult = m_out.anchor(slowResultValue);
>-                m_out.jump(continuation);
>-
>-                m_out.appendTo(continuation, lastNext);
>-                return m_out.phi(m_out.intPtr, fastResult, slowResult);
>-            });
>-    }
>-
>-    LValue copyBarrier(LValue object, LValue pointer, P_JITOperation_EC slowPathFunction)
>-    {
>-        return copyBarrier(
>-            pointer,
>-            [&] () -> LValue {
>-                return lazySlowPath(
>-                    [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
>-                        return createLazyCallGenerator(
>-                            slowPathFunction, locations[0].directGPR(), locations[1].directGPR());
>-                    }, object);
>-            });
>-    }
>-
>-    template<typename Functor>
>-    LValue copyBarrier(LValue pointer, const Functor& functor)
>-    {
>-        LBasicBlock slowPath = m_out.newBlock();
>-        LBasicBlock continuation = m_out.newBlock();
>-
>-        ValueFromBlock fastResult = m_out.anchor(pointer);
>-        m_out.branch(isInToSpace(pointer), usually(continuation), rarely(slowPath));
>-
>-        LBasicBlock lastNext = m_out.appendTo(slowPath, continuation);
>-
>-        ValueFromBlock slowResult = m_out.anchor(functor());
>-        m_out.jump(continuation);
>-
>-        m_out.appendTo(continuation, lastNext);
>-        return m_out.phi(m_out.intPtr, fastResult, slowResult);
>-    }
>-
>-    LValue isInToSpace(LValue pointer)
>-    {
>-        return m_out.testIsZeroPtr(pointer, m_out.constIntPtr(CopyBarrierBase::spaceBits));
>-    }
>-
>-    LValue loadButterflyReadOnly(LValue object)
>-    {
>-        return removeSpaceBits(m_out.loadPtr(object, m_heaps.JSObject_butterfly));
>-    }
>-
>-    LValue loadVectorReadOnly(LValue object)
>-    {
>-        LValue fastResultValue = m_out.loadPtr(object, m_heaps.JSArrayBufferView_vector);
>-
>-        LBasicBlock possiblyFromSpace = m_out.newBlock();
>-        LBasicBlock continuation = m_out.newBlock();
>-
>-        ValueFromBlock fastResult = m_out.anchor(fastResultValue);
>-
>-        m_out.branch(isInToSpace(fastResultValue), usually(continuation), rarely(possiblyFromSpace));
>-
>-        LBasicBlock lastNext = m_out.appendTo(possiblyFromSpace, continuation);
>-
>-        LValue slowResultValue = m_out.select(
>-            isFastTypedArray(object), removeSpaceBits(fastResultValue), fastResultValue);
>-        ValueFromBlock slowResult = m_out.anchor(slowResultValue);
>-        m_out.jump(continuation);
>-
>-        m_out.appendTo(continuation, lastNext);
>-        
>-        return m_out.phi(m_out.intPtr, fastResult, slowResult);
>-    }
>-
>-    LValue removeSpaceBits(LValue storage)
>-    {
>-        return m_out.bitAnd(
>-            storage, m_out.constIntPtr(~static_cast<intptr_t>(CopyBarrierBase::spaceBits)));
>-    }
>-
>     LValue isFastTypedArray(LValue object)
>     {
>         return m_out.equal(
>Index: Source/JavaScriptCore/heap/CopyBarrier.h
>===================================================================
>--- Source/JavaScriptCore/heap/CopyBarrier.h	(revision 198152)
>+++ Source/JavaScriptCore/heap/CopyBarrier.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
>+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -30,88 +30,20 @@
> 
> namespace JSC {
> 
>-enum class CopyState {
>-    // The backing store is not planned to get copied in this epoch. If you keep a pointer to the backing
>-    // store on the stack, it will not get copied. If you don't keep it on the stack, it may get copied
>-    // starting at the next handshake (that is, it may transition from ToSpace to CopyPlanned, but
>-    // CopyPlanned means ToSpace prior to the handshake that starts the copy phase).
>-    ToSpace,
>-
>-    // The marking phase has selected this backing store to be copied. If we are not yet in the copying
>-    // phase, this backing store is still in to-space. All that is needed in such a case is to mask off the
>-    // low bits. If we are in the copying phase, this means that the object points to from-space. The
>-    // barrier should first copy the object - or wait for copying to finish - before using the object.
>-    CopyPlanned,
>-
>-    // The object is being copied right now. Anyone wanting to use the object must wait for the object to
>-    // finish being copied. Notifications about copying use the ParkingLot combined with these bits. If the
>-    // state is CopyingAndWaiting, then when the copying finishes, whatever thread was doing it will
>-    // unparkAll() on the address of the CopyBarrierBase. So, to wait for copying to finish, CAS this to
>-    // CopyingAndWaiting and then parkConditionally on the barrier address.
>-    Copying,
>-
>-    // The object is being copied right now, and there are one or more threads parked. Those threads want
>-    // to be unparked when copying is done. So, whichever thread does the copying needs to call unparkAll()
>-    // on the barrier address after copying is done.
>-    CopyingAndWaiting
>-};
>-
> class CopyBarrierBase {
> public:
>-    static const unsigned spaceBits = 3;
>-
>     CopyBarrierBase()
>         : m_value(nullptr)
>     {
>     }
>     
>-    bool operator!() const { return !m_value; }
>-    
>     explicit operator bool() const { return m_value; }
> 
>-    void* getWithoutBarrier() const
>+    void* get() const
>     {
>         return m_value;
>     }
> 
>-    // Use this version of get() if you only want to execute the barrier slow path if some condition
>-    // holds, and you only want to evaluate that condition after first checking the barrier's
>-    // condition. Usually, you just want to use get().
>-    template<typename Functor>
>-    void* getPredicated(const JSCell* owner, const Functor& functor) const
>-    {
>-        void* result = m_value;
>-        if (UNLIKELY(bitwise_cast<uintptr_t>(result) & spaceBits)) {
>-            if (functor())
>-                return Heap::copyBarrier(owner, m_value);
>-        }
>-        return result;
>-    }
>-
>-    // When we are in the concurrent copying phase, this method may lock the barrier object (i.e. the field
>-    // pointing to copied space) and call directly into the owning object's copyBackingStore() method.
>-    void* get(const JSCell* owner) const
>-    {
>-        return getPredicated(owner, [] () -> bool { return true; });
>-    }
>-
>-    CopyState copyState() const
>-    {
>-        return static_cast<CopyState>(bitwise_cast<uintptr_t>(m_value) & spaceBits);
>-    }
>-
>-    // This only works when you know that there is nobody else concurrently messing with this CopyBarrier.
>-    // That's hard to guarantee, though there are a few unusual places where this ends up being safe.
>-    // Usually you want to use CopyBarrier::weakCAS().
>-    void setCopyState(CopyState copyState)
>-    {
>-        WTF::storeStoreFence();
>-        uintptr_t value = bitwise_cast<uintptr_t>(m_value);
>-        value &= ~static_cast<uintptr_t>(spaceBits);
>-        value |= static_cast<uintptr_t>(copyState);
>-        m_value = bitwise_cast<void*>(value);
>-    }
>-
>     void clear() { m_value = nullptr; }
> 
> protected:
>@@ -131,15 +63,6 @@ protected:
>         this->m_value = value;
>     }
> 
>-    bool weakCASWithoutBarrier(
>-        void* oldPointer, CopyState oldCopyState, void* newPointer, CopyState newCopyState)
>-    {
>-        uintptr_t oldValue = bitwise_cast<uintptr_t>(oldPointer) | static_cast<uintptr_t>(oldCopyState);
>-        uintptr_t newValue = bitwise_cast<uintptr_t>(newPointer) | static_cast<uintptr_t>(newCopyState);
>-        return WTF::weakCompareAndSwap(
>-            &m_value, bitwise_cast<void*>(oldValue), bitwise_cast<void*>(newValue));
>-    }
>-
> private:
>     mutable void* m_value;
> };
>@@ -161,22 +84,11 @@ public:
>     {
>     }
> 
>-    T* getWithoutBarrier() const
>-    {
>-        return bitwise_cast<T*>(CopyBarrierBase::getWithoutBarrier());
>-    }
>-    
>-    T* get(const JSCell* owner) const
>+    T* get() const
>     {
>-        return bitwise_cast<T*>(CopyBarrierBase::get(owner));
>+        return bitwise_cast<T*>(CopyBarrierBase::get());
>     }
> 
>-    template<typename Functor>
>-    T* getPredicated(const JSCell* owner, const Functor& functor) const
>-    {
>-        return bitwise_cast<T*>(CopyBarrierBase::getPredicated(owner, functor));
>-    }
>-    
>     void set(VM& vm, const JSCell* owner, T* value)
>     {
>         CopyBarrierBase::set(vm, owner, value);
>@@ -186,11 +98,6 @@ public:
>     {
>         CopyBarrierBase::setWithoutBarrier(value);
>     }
>-
>-    bool weakCASWithoutBarrier(T* oldPointer, CopyState oldCopyState, T* newPointer, CopyState newCopyState)
>-    {
>-        return CopyBarrierBase::weakCASWithoutBarrier(oldPointer, oldCopyState, newPointer, newCopyState);
>-    }
> };
> 
> } // namespace JSC
>Index: Source/JavaScriptCore/heap/Heap.cpp
>===================================================================
>--- Source/JavaScriptCore/heap/Heap.cpp	(revision 198152)
>+++ Source/JavaScriptCore/heap/Heap.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- *  Copyright (C) 2003-2009, 2011, 2013-2015 Apple Inc. All rights reserved.
>+ *  Copyright (C) 2003-2009, 2011, 2013-2016 Apple Inc. All rights reserved.
>  *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
>  *
>  *  This library is free software; you can redistribute it and/or
>@@ -1083,16 +1083,6 @@ void Heap::addToRememberedSet(const JSCe
>     m_slotVisitor.appendToMarkStack(const_cast<JSCell*>(cell));
> }
> 
>-void* Heap::copyBarrier(const JSCell*, void*& pointer)
>-{
>-    // Do nothing for now, except making sure that the low bits are masked off. This helps to
>-    // simulate enough of this barrier that at least we can test the low bits assumptions.
>-    pointer = bitwise_cast<void*>(
>-        bitwise_cast<uintptr_t>(pointer) & ~static_cast<uintptr_t>(CopyBarrierBase::spaceBits));
>-    
>-    return pointer;
>-}
>-
> void Heap::collectAndSweep(HeapOperation collectionType)
> {
>     if (!m_isSafeToCollect)
>Index: Source/JavaScriptCore/heap/Heap.h
>===================================================================
>--- Source/JavaScriptCore/heap/Heap.h	(revision 198152)
>+++ Source/JavaScriptCore/heap/Heap.h	(working copy)
>@@ -1,7 +1,7 @@
> /*
>  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
>  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
>- *  Copyright (C) 2003-2009, 2013-2015 Apple Inc. All rights reserved.
>+ *  Copyright (C) 2003-2009, 2013-2016 Apple Inc. All rights reserved.
>  *
>  *  This library is free software; you can redistribute it and/or
>  *  modify it under the terms of the GNU Lesser General Public
>@@ -112,8 +112,6 @@ public:
>     void writeBarrier(const JSCell*, JSValue);
>     void writeBarrier(const JSCell*, JSCell*);
> 
>-    JS_EXPORT_PRIVATE static void* copyBarrier(const JSCell* owner, void*& copiedSpacePointer);
>-
>     WriteBarrierBuffer& writeBarrierBuffer() { return m_writeBarrierBuffer; }
>     void flushWriteBarrierBuffer(JSCell*);
> 
>Index: Source/JavaScriptCore/jit/AssemblyHelpers.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/AssemblyHelpers.cpp	(revision 198152)
>+++ Source/JavaScriptCore/jit/AssemblyHelpers.cpp	(working copy)
>@@ -148,17 +148,6 @@ AssemblyHelpers::Jump AssemblyHelpers::b
>         TrustedImm32(FastTypedArray));
> }
> 
>-AssemblyHelpers::Jump AssemblyHelpers::loadTypedArrayVector(GPRReg baseGPR, GPRReg resultGPR)
>-{
>-    RELEASE_ASSERT(baseGPR != resultGPR);
>-    
>-    loadPtr(Address(baseGPR, JSArrayBufferView::offsetOfVector()), resultGPR);
>-    Jump ok = branchIfToSpace(resultGPR);
>-    Jump result = branchIfFastTypedArray(baseGPR);
>-    ok.link(this);
>-    return result;
>-}
>-
> void AssemblyHelpers::purifyNaN(FPRReg fpr)
> {
>     MacroAssembler::Jump notNaN = branchDouble(DoubleEqual, fpr, fpr);
>Index: Source/JavaScriptCore/jit/AssemblyHelpers.h
>===================================================================
>--- Source/JavaScriptCore/jit/AssemblyHelpers.h	(revision 198152)
>+++ Source/JavaScriptCore/jit/AssemblyHelpers.h	(working copy)
>@@ -822,28 +822,9 @@ public:
> #endif
>     }
> 
>-    Jump branchIfToSpace(GPRReg storageGPR)
>-    {
>-        return branchTest32(Zero, storageGPR, TrustedImm32(CopyBarrierBase::spaceBits));
>-    }
>-
>-    Jump branchIfNotToSpace(GPRReg storageGPR)
>-    {
>-        return branchTest32(NonZero, storageGPR, TrustedImm32(CopyBarrierBase::spaceBits));
>-    }
>-
>-    void removeSpaceBits(GPRReg storageGPR)
>-    {
>-        andPtr(TrustedImmPtr(~static_cast<uintptr_t>(CopyBarrierBase::spaceBits)), storageGPR);
>-    }
>-
>     Jump branchIfFastTypedArray(GPRReg baseGPR);
>     Jump branchIfNotFastTypedArray(GPRReg baseGPR);
> 
>-    // Returns a jump to slow path for when we need to execute the barrier. Note that baseGPR and
>-    // resultGPR must be different.
>-    Jump loadTypedArrayVector(GPRReg baseGPR, GPRReg resultGPR);
>-    
>     static Address addressForByteOffset(ptrdiff_t byteOffset)
>     {
>         return Address(GPRInfo::callFrameRegister, byteOffset);
>Index: Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(revision 198152)
>+++ Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(working copy)
>@@ -1196,7 +1196,6 @@ void JIT::emit_op_get_direct_pname(Instr
>     // Otherwise it's out of line
>     outOfLineAccess.link(this);
>     loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
>-    addSlowCase(branchIfNotToSpace(regT0));
>     sub32(Address(regT1, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), regT2);
>     neg32(regT2);
>     int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
>@@ -1213,7 +1212,6 @@ void JIT::emitSlow_op_get_direct_pname(I
>     int base = currentInstruction[2].u.operand;
>     linkSlowCaseIfNotJSCell(iter, base);
>     linkSlowCase(iter);
>-    linkSlowCase(iter);
> 
>     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_direct_pname);
>     slowPathCall.call();
>Index: Source/JavaScriptCore/jit/JITOpcodes.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes.cpp	(revision 198152)
>+++ Source/JavaScriptCore/jit/JITOpcodes.cpp	(working copy)
>@@ -1203,7 +1203,6 @@ void JIT::emit_op_get_direct_pname(Instr
>     // Otherwise it's out of line
>     outOfLineAccess.link(this);
>     loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
>-    addSlowCase(branchIfNotToSpace(regT0));
>     sub32(Address(regT2, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), regT1);
>     neg32(regT1);
>     signExtend32ToPtr(regT1, regT1);
>@@ -1220,7 +1219,6 @@ void JIT::emitSlow_op_get_direct_pname(I
>     int base = currentInstruction[2].u.operand;
>     linkSlowCaseIfNotJSCell(iter, base);
>     linkSlowCase(iter);
>-    linkSlowCase(iter);
> 
>     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_direct_pname);
>     slowPathCall.call();
>Index: Source/JavaScriptCore/jit/JITPropertyAccess.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITPropertyAccess.cpp	(revision 198152)
>+++ Source/JavaScriptCore/jit/JITPropertyAccess.cpp	(working copy)
>@@ -165,7 +165,6 @@ JIT::JumpList JIT::emitDoubleLoad(Instru
>     
>     badType = patchableBranch32(NotEqual, regT2, TrustedImm32(DoubleShape));
>     loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
>-    slowCases.append(branchIfNotToSpace(regT2));
>     slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength())));
>     loadDouble(BaseIndex(regT2, regT1, TimesEight), fpRegT0);
>     slowCases.append(branchDouble(DoubleNotEqualOrUnordered, fpRegT0, fpRegT0));
>@@ -179,7 +178,6 @@ JIT::JumpList JIT::emitContiguousLoad(In
>     
>     badType = patchableBranch32(NotEqual, regT2, TrustedImm32(expectedShape));
>     loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
>-    slowCases.append(branchIfNotToSpace(regT2));
>     slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength())));
>     load64(BaseIndex(regT2, regT1, TimesEight), regT0);
>     slowCases.append(branchTest64(Zero, regT0));
>@@ -195,7 +193,6 @@ JIT::JumpList JIT::emitArrayStorageLoad(
>     badType = patchableBranch32(Above, regT3, TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape));
> 
>     loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
>-    slowCases.append(branchIfNotToSpace(regT2));
>     slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, ArrayStorage::vectorLengthOffset())));
> 
>     load64(BaseIndex(regT2, regT1, TimesEight, ArrayStorage::vectorOffset()), regT0);
>@@ -254,7 +251,6 @@ void JIT::emitSlow_op_get_by_val(Instruc
>     notString.link(this);
>     nonCell.link(this);
>     
>-    linkSlowCase(iter); // read barrier
>     linkSlowCase(iter); // vector length check
>     linkSlowCase(iter); // empty value
>     
>@@ -327,7 +323,6 @@ JIT::JumpList JIT::emitGenericContiguous
>     badType = patchableBranch32(NotEqual, regT2, TrustedImm32(indexingShape));
>     
>     loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
>-    slowCases.append(branchIfNotToSpace(regT2));
>     Jump outOfBounds = branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength()));
> 
>     Label storeResult = label();
>@@ -383,7 +378,6 @@ JIT::JumpList JIT::emitArrayStoragePutBy
>     
>     badType = patchableBranch32(NotEqual, regT2, TrustedImm32(ArrayStorageShape));
>     loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
>-    slowCases.append(branchIfNotToSpace(regT2));
>     slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, ArrayStorage::vectorLengthOffset())));
> 
>     Jump empty = branchTest64(Zero, BaseIndex(regT2, regT1, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
>@@ -454,7 +448,6 @@ void JIT::emitSlow_op_put_by_val(Instruc
>     linkSlowCase(iter); // property int32 check
>     linkSlowCase(iter); // base not array check
>     
>-    linkSlowCase(iter); // read barrier
>     linkSlowCase(iter); // out of bounds
>     
>     JITArrayMode mode = chooseArrayMode(profile);
>@@ -786,7 +779,6 @@ void JIT::emit_op_get_from_scope(Instruc
>                 isOutOfLine.link(this);
>             }
>             loadPtr(Address(base, JSObject::butterflyOffset()), scratch);
>-            addSlowCase(branchIfNotToSpace(scratch));
>             neg32(offset);
>             signExtend32ToPtr(offset, offset);
>             load64(BaseIndex(scratch, offset, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)), result);
>@@ -866,10 +858,8 @@ void JIT::emitSlow_op_get_from_scope(Ins
>     if (resolveType == GlobalVar || resolveType == ClosureVar)
>         return;
> 
>-    if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks) {
>+    if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks)
>         linkSlowCase(iter); // bad structure
>-        linkSlowCase(iter); // read barrier
>-    }
> 
>     if (resolveType == GlobalLexicalVarWithVarInjectionChecks) // Var injections check.
>         linkSlowCase(iter);
>@@ -878,7 +868,6 @@ void JIT::emitSlow_op_get_from_scope(Ins
>         // GlobalProperty/GlobalPropertyWithVarInjectionChecks
>         linkSlowCase(iter); // emitLoadWithStructureCheck
>         linkSlowCase(iter); // emitLoadWithStructureCheck
>-        linkSlowCase(iter); // read barrier
>         // GlobalLexicalVar
>         linkSlowCase(iter); // TDZ check.
>         // GlobalLexicalVarWithVarInjectionChecks.
>@@ -932,7 +921,6 @@ void JIT::emit_op_put_to_scope(Instructi
>             emitGetVirtualRegister(value, regT2);
>             
>             loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
>-            addSlowCase(branchIfNotToSpace(regT0));
>             loadPtr(operandSlot, regT1);
>             negPtr(regT1);
>             storePtr(regT2, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)));
>@@ -1026,17 +1014,14 @@ void JIT::emitSlow_op_put_to_scope(Instr
>          || resolveType == LocalClosureVar)
>         && currentInstruction[5].u.watchpointSet->state() != IsInvalidated)
>         linkCount++;
>-    if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks) {
>+    if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks)
>         linkCount++; // bad structure
>-        linkCount++; // read barrier
>-    }
>     if (getPutInfo.initializationMode() != Initialization && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) // TDZ check.
>         linkCount++;
>     if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
>         // GlobalProperty/GlobalPropertyWithVarInjectionsCheck
>         linkCount++; // emitLoadWithStructureCheck
>         linkCount++; // emitLoadWithStructureCheck
>-        linkCount++; // read barrier
> 
>         // GlobalLexicalVar
>         bool needsTDZCheck = getPutInfo.initializationMode() != Initialization;
>@@ -1454,7 +1439,7 @@ JIT::JumpList JIT::emitIntTypedArrayGetB
>     load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
>     badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type)));
>     slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength())));
>-    slowCases.append(loadTypedArrayVector(base, scratch));
>+    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
>     
>     switch (elementSize(type)) {
>     case 1:
>@@ -1525,7 +1510,7 @@ JIT::JumpList JIT::emitFloatTypedArrayGe
>     load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
>     badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type)));
>     slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength())));
>-    slowCases.append(loadTypedArrayVector(base, scratch));
>+    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
>     
>     switch (elementSize(type)) {
>     case 4:
>@@ -1592,7 +1577,7 @@ JIT::JumpList JIT::emitIntTypedArrayPutB
>     
>     // We would be loading this into base as in get_by_val, except that the slow
>     // path expects the base to be unclobbered.
>-    slowCases.append(loadTypedArrayVector(base, lateScratch));
>+    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
>     
>     if (isClamped(type)) {
>         ASSERT(elementSize(type) == 1);
>@@ -1677,7 +1662,7 @@ JIT::JumpList JIT::emitFloatTypedArrayPu
>     
>     // We would be loading this into base as in get_by_val, except that the slow
>     // path expects the base to be unclobbered.
>-    slowCases.append(loadTypedArrayVector(base, lateScratch));
>+    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
>     
>     switch (elementSize(type)) {
>     case 4:
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(revision 198152)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(working copy)
>@@ -1176,10 +1176,9 @@ _llint_op_is_object:
>     dispatch(3)
> 
> 
>-macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value, slow)
>+macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
>     bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
>     loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
>-    copyBarrier(objectAndStorage, slow)
>     negi propertyOffsetAsInt
>     sxi2q propertyOffsetAsInt, propertyOffsetAsInt
>     jmp .ready
>@@ -1190,10 +1189,9 @@ macro loadPropertyAtVariableOffset(prope
> end
> 
> 
>-macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value, slow)
>+macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
>     bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
>     loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
>-    copyBarrier(objectAndStorage, slow)
>     negi propertyOffsetAsInt
>     sxi2q propertyOffsetAsInt, propertyOffsetAsInt
>     jmp .ready
>@@ -1212,7 +1210,7 @@ _llint_op_get_by_id:
>     bineq t2, t1, .opGetByIdSlow
>     loadisFromInstruction(5, t1)
>     loadisFromInstruction(1, t2)
>-    loadPropertyAtVariableOffset(t1, t3, t0, .opGetByIdSlow)
>+    loadPropertyAtVariableOffset(t1, t3, t0)
>     storeq t0, [cfr, t2, 8]
>     valueProfile(t0, 8, t1)
>     dispatch(9)
>@@ -1233,7 +1231,6 @@ _llint_op_get_array_length:
>     btiz t2, IndexingShapeMask, .opGetArrayLengthSlow
>     loadisFromInstruction(1, t1)
>     loadp JSObject::m_butterfly[t3], t0
>-    copyBarrier(t0, .opGetArrayLengthSlow)
>     loadi -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0], t0
>     bilt t0, 0, .opGetArrayLengthSlow
>     orq tagTypeNumber, t0
>@@ -1377,7 +1374,7 @@ _llint_op_put_by_id:
>     loadisFromInstruction(3, t1)
>     loadConstantOrVariable(t1, t2)
>     loadisFromInstruction(5, t1)
>-    storePropertyAtVariableOffset(t1, t0, t2, .opPutByIdSlow)
>+    storePropertyAtVariableOffset(t1, t0, t2)
>     dispatch(9)
> 
> .opPutByIdSlow:
>@@ -1396,7 +1393,6 @@ _llint_op_get_by_val:
>     loadConstantOrVariableInt32(t3, t1, .opGetByValSlow)
>     sxi2q t1, t1
>     loadp JSObject::m_butterfly[t0], t3
>-    copyBarrier(t3, .opGetByValSlow)
>     andi IndexingShapeMask, t2
>     bieq t2, Int32Shape, .opGetByValIsContiguous
>     bineq t2, ContiguousShape, .opGetByValNotContiguous
>@@ -1467,7 +1463,6 @@ macro putByVal(slowPath)
>     loadConstantOrVariableInt32(t0, t3, .opPutByValSlow)
>     sxi2q t3, t3
>     loadp JSObject::m_butterfly[t1], t0
>-    copyBarrier(t0, .opPutByValSlow)
>     andi IndexingShapeMask, t2
>     bineq t2, Int32Shape, .opPutByValNotInt32
>     contiguousPutByVal(
>@@ -1988,9 +1983,9 @@ macro loadWithStructureCheck(operand, sl
>     bpneq t2, t1, slowPath
> end
> 
>-macro getProperty(slow)
>+macro getProperty()
>     loadisFromInstruction(6, t1)
>-    loadPropertyAtVariableOffset(t1, t0, t2, slow)
>+    loadPropertyAtVariableOffset(t1, t0, t2)
>     valueProfile(t2, 7, t0)
>     loadisFromInstruction(1, t0)
>     storeq t2, [cfr, t0, 8]
>@@ -2021,7 +2016,7 @@ _llint_op_get_from_scope:
> #gGlobalProperty:
>     bineq t0, GlobalProperty, .gGlobalVar
>     loadWithStructureCheck(2, .gDynamic)
>-    getProperty(.gDynamic)
>+    getProperty()
>     dispatch(8)
> 
> .gGlobalVar:
>@@ -2046,7 +2041,7 @@ _llint_op_get_from_scope:
> .gGlobalPropertyWithVarInjectionChecks:
>     bineq t0, GlobalPropertyWithVarInjectionChecks, .gGlobalVarWithVarInjectionChecks
>     loadWithStructureCheck(2, .gDynamic)
>-    getProperty(.gDynamic)
>+    getProperty()
>     dispatch(8)
> 
> .gGlobalVarWithVarInjectionChecks:
>@@ -2076,11 +2071,11 @@ _llint_op_get_from_scope:
>     dispatch(8)
> 
> 
>-macro putProperty(slow)
>+macro putProperty()
>     loadisFromInstruction(3, t1)
>     loadConstantOrVariable(t1, t2)
>     loadisFromInstruction(6, t1)
>-    storePropertyAtVariableOffset(t1, t0, t2, slow)
>+    storePropertyAtVariableOffset(t1, t0, t2)
> end
> 
> macro putGlobalVariable()
>@@ -2138,7 +2133,7 @@ _llint_op_put_to_scope:
>     bineq t0, GlobalProperty, .pGlobalVar
>     writeBarrierOnOperands(1, 3)
>     loadWithStructureCheck(1, .pDynamic)
>-    putProperty(.pDynamic)
>+    putProperty()
>     dispatch(7)
> 
> .pGlobalVar:
>@@ -2165,7 +2160,7 @@ _llint_op_put_to_scope:
>     bineq t0, GlobalPropertyWithVarInjectionChecks, .pGlobalVarWithVarInjectionChecks
>     writeBarrierOnOperands(1, 3)
>     loadWithStructureCheck(1, .pDynamic)
>-    putProperty(.pDynamic)
>+    putProperty()
>     dispatch(7)
> 
> .pGlobalVarWithVarInjectionChecks:
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 198152)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(working copy)
>@@ -221,8 +221,6 @@ const PutByIdSecondaryTypeObject = 0x38
> const PutByIdSecondaryTypeObjectOrOther = 0x40
> const PutByIdSecondaryTypeTop = 0x48
> 
>-const CopyBarrierSpaceBits = 3
>-
> const CallOpCodeSize = 9
> 
> if X86_64 or ARM64 or C_LOOP
>@@ -661,10 +659,6 @@ macro preserveReturnAddressAfterCall(des
>     end
> end
> 
>-macro copyBarrier(value, slow)
>-    btpnz value, CopyBarrierSpaceBits, slow
>-end
>-
> macro functionPrologue()
>     if X86 or X86_WIN or X86_64 or X86_64_WIN
>         push cfr
>Index: Source/JavaScriptCore/runtime/DirectArguments.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/DirectArguments.cpp	(revision 198152)
>+++ Source/JavaScriptCore/runtime/DirectArguments.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2015 Apple Inc. All rights reserved.
>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -104,7 +104,7 @@ void DirectArguments::visitChildren(JSCe
>     if (thisObject->m_overrides) {
>         visitor.copyLater(
>             thisObject, DirectArgumentsOverridesCopyToken,
>-            thisObject->m_overrides.getWithoutBarrier(), thisObject->overridesSize());
>+            thisObject->m_overrides.get(), thisObject->overridesSize());
>     }
> }
> 
>@@ -115,7 +115,7 @@ void DirectArguments::copyBackingStore(J
>     
>     RELEASE_ASSERT(token == DirectArgumentsOverridesCopyToken);
>     
>-    void* oldOverrides = thisObject->m_overrides.getWithoutBarrier();
>+    void* oldOverrides = thisObject->m_overrides.get();
>     if (visitor.checkIfShouldCopy(oldOverrides)) {
>         bool* newOverrides = static_cast<bool*>(visitor.allocateNewSpace(thisObject->overridesSize()));
>         memcpy(newOverrides, oldOverrides, thisObject->m_length);
>@@ -154,7 +154,7 @@ void DirectArguments::overrideThingsIfNe
> void DirectArguments::overrideArgument(VM& vm, unsigned index)
> {
>     overrideThingsIfNecessary(vm);
>-    m_overrides.get(this)[index] = true;
>+    m_overrides.get()[index] = true;
> }
> 
> void DirectArguments::copyToArguments(ExecState* exec, VirtualRegister firstElementDest, unsigned offset, unsigned length)
>Index: Source/JavaScriptCore/runtime/DirectArguments.h
>===================================================================
>--- Source/JavaScriptCore/runtime/DirectArguments.h	(revision 198152)
>+++ Source/JavaScriptCore/runtime/DirectArguments.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2015 Apple Inc. All rights reserved.
>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -74,7 +74,7 @@ public:
>     
>     bool canAccessIndexQuickly(uint32_t i) const
>     {
>-        return i < m_length && (!m_overrides || !m_overrides.get(this)[i]);
>+        return i < m_length && (!m_overrides || !m_overrides.get()[i]);
>     }
> 
>     bool canAccessArgumentIndexQuicklyInDFG(uint32_t i) const
>Index: Source/JavaScriptCore/runtime/JSArray.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArray.cpp	(revision 198152)
>+++ Source/JavaScriptCore/runtime/JSArray.cpp	(working copy)
>@@ -1,6 +1,6 @@
> /*
>  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
>- *  Copyright (C) 2003, 2007, 2008, 2009, 2012, 2013, 2015 Apple Inc. All rights reserved.
>+ *  Copyright (C) 2003, 2007, 2008, 2009, 2012, 2013, 2015-2016 Apple Inc. All rights reserved.
>  *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
>  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
>  *
>@@ -391,7 +391,7 @@ bool JSArray::setLengthWithArrayStorage(
> 
> bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException)
> {
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     switch (indexingType()) {
>     case ArrayClass:
>         if (!newLength)
>@@ -452,7 +452,7 @@ bool JSArray::setLength(ExecState* exec,
> 
> JSValue JSArray::pop(ExecState* exec)
> {
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     
>     switch (indexingType()) {
>     case ArrayClass:
>@@ -549,7 +549,7 @@ JSValue JSArray::pop(ExecState* exec)
> //  - pushing to an array of length 2^32-1 stores the property, but throws a range error.
> void JSArray::push(ExecState* exec, JSValue value)
> {
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     
>     switch (indexingType()) {
>     case ArrayClass: {
>@@ -701,9 +701,9 @@ JSArray* JSArray::fastSlice(ExecState& e
> 
>         auto& resultButterfly = *resultArray->butterfly();
>         if (arrayType == ArrayWithDouble)
>-            memcpy(resultButterfly.contiguousDouble().data(), m_butterfly.get(this)->contiguousDouble().data() + startIndex, sizeof(JSValue) * count);
>+            memcpy(resultButterfly.contiguousDouble().data(), m_butterfly.get()->contiguousDouble().data() + startIndex, sizeof(JSValue) * count);
>         else
>-            memcpy(resultButterfly.contiguous().data(), m_butterfly.get(this)->contiguous().data() + startIndex, sizeof(JSValue) * count);
>+            memcpy(resultButterfly.contiguous().data(), m_butterfly.get()->contiguous().data() + startIndex, sizeof(JSValue) * count);
>         resultButterfly.setPublicLength(count);
> 
>         return resultArray;
>@@ -720,8 +720,8 @@ EncodedJSValue JSArray::fastConcatWith(E
>     VM& vm = exec.vm();
>     ASSERT(newArrayType == fastConcatType(vm, *this, otherArray));
> 
>-    unsigned thisArraySize = m_butterfly.get(this)->publicLength();
>-    unsigned otherArraySize = otherArray.m_butterfly.get(this)->publicLength();
>+    unsigned thisArraySize = m_butterfly.get()->publicLength();
>+    unsigned otherArraySize = otherArray.m_butterfly.get()->publicLength();
>     ASSERT(thisArraySize + otherArraySize < MIN_SPARSE_ARRAY_INDEX);
> 
>     Structure* resultStructure = exec.lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(newArrayType);
>@@ -733,11 +733,11 @@ EncodedJSValue JSArray::fastConcatWith(E
>     auto& otherButterfly = *otherArray.butterfly();
>     if (newArrayType == ArrayWithDouble) {
>         auto buffer = resultButterfly.contiguousDouble().data();
>-        memcpy(buffer, m_butterfly.get(this)->contiguousDouble().data(), sizeof(JSValue) * thisArraySize);
>+        memcpy(buffer, m_butterfly.get()->contiguousDouble().data(), sizeof(JSValue) * thisArraySize);
>         memcpy(buffer + thisArraySize, otherButterfly.contiguousDouble().data(), sizeof(JSValue) * otherArraySize);
>     } else {
>         auto buffer = resultButterfly.contiguous().data();
>-        memcpy(buffer, m_butterfly.get(this)->contiguous().data(), sizeof(JSValue) * thisArraySize);
>+        memcpy(buffer, m_butterfly.get()->contiguous().data(), sizeof(JSValue) * thisArraySize);
>         memcpy(buffer + thisArraySize, otherButterfly.contiguous().data(), sizeof(JSValue) * otherArraySize);
>     }
> 
>@@ -810,7 +810,7 @@ bool JSArray::shiftCountWithArrayStorage
>         // Adjust the Butterfly and the index bias. We only need to do this here because we're changing
>         // the start of the Butterfly, which needs to point at the first indexed property in the used
>         // portion of the vector.
>-        Butterfly* butterfly = m_butterfly.get(this)->shift(structure(), count);
>+        Butterfly* butterfly = m_butterfly.get()->shift(structure(), count);
>         m_butterfly.setWithoutBarrier(butterfly);
>         storage = butterfly->arrayStorage();
>         storage->m_indexBias += count;
>@@ -855,7 +855,7 @@ bool JSArray::shiftCountWithAnyIndexingT
>     VM& vm = exec->vm();
>     RELEASE_ASSERT(count > 0);
> 
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     
>     switch (indexingType()) {
>     case ArrayClass:
>@@ -994,7 +994,7 @@ bool JSArray::unshiftCountWithArrayStora
> 
> bool JSArray::unshiftCountWithAnyIndexingType(ExecState* exec, unsigned startIndex, unsigned count)
> {
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     
>     switch (indexingType()) {
>     case ArrayClass:
>@@ -1012,7 +1012,7 @@ bool JSArray::unshiftCountWithAnyIndexin
>             return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
>         
>         ensureLength(exec->vm(), oldLength + count);
>-        butterfly = m_butterfly.get(this);
>+        butterfly = m_butterfly.get();
> 
>         // We have to check for holes before we start moving things around so that we don't get halfway 
>         // through shifting and then realize we should have been in ArrayStorage mode.
>@@ -1045,7 +1045,7 @@ bool JSArray::unshiftCountWithAnyIndexin
>             return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
>         
>         ensureLength(exec->vm(), oldLength + count);
>-        butterfly = m_butterfly.get(this);
>+        butterfly = m_butterfly.get();
>         
>         // We have to check for holes before we start moving things around so that we don't get halfway 
>         // through shifting and then realize we should have been in ArrayStorage mode.
>@@ -1085,7 +1085,7 @@ void JSArray::fillArgList(ExecState* exe
>     unsigned vectorEnd;
>     WriteBarrier<Unknown>* vector;
> 
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     
>     switch (indexingType()) {
>     case ArrayClass:
>@@ -1155,7 +1155,7 @@ void JSArray::copyToArguments(ExecState*
>     // FIXME: What prevents this from being called with a RuntimeArray? The length function will always return 0 in that case.
>     ASSERT(length == this->length());
> 
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     
>     switch (indexingType()) {
>     case ArrayClass:
>Index: Source/JavaScriptCore/runtime/JSArrayBufferView.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArrayBufferView.cpp	(revision 198152)
>+++ Source/JavaScriptCore/runtime/JSArrayBufferView.cpp	(working copy)
>@@ -213,7 +213,7 @@ void JSArrayBufferView::finalize(JSCell*
>     JSArrayBufferView* thisObject = static_cast<JSArrayBufferView*>(cell);
>     ASSERT(thisObject->m_mode == OversizeTypedArray || thisObject->m_mode == WastefulTypedArray);
>     if (thisObject->m_mode == OversizeTypedArray)
>-        fastFree(thisObject->m_vector.getWithoutBarrier());
>+        fastFree(thisObject->m_vector.get());
> }
> 
> } // namespace JSC
>Index: Source/JavaScriptCore/runtime/JSArrayBufferView.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArrayBufferView.h	(revision 198152)
>+++ Source/JavaScriptCore/runtime/JSArrayBufferView.h	(working copy)
>@@ -164,14 +164,7 @@ public:
>     bool isNeutered() { return hasArrayBuffer() && !vector(); }
>     void neuter();
>     
>-    void* vector()
>-    {
>-        return m_vector.getPredicated(
>-            this,
>-            [this] () -> bool {
>-                return mode() == FastTypedArray;
>-            });
>-    }
>+    void* vector() { return m_vector.get(); }
>     
>     unsigned byteOffset();
>     unsigned length() const { return m_length; }
>Index: Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h	(revision 198152)
>+++ Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h	(working copy)
>@@ -422,7 +422,7 @@ void JSGenericTypedArrayView<Adaptor>::v
>     switch (thisObject->m_mode) {
>     case FastTypedArray: {
>         if (thisObject->m_vector)
>-            visitor.copyLater(thisObject, TypedArrayVectorCopyToken, thisObject->m_vector.getWithoutBarrier(), thisObject->byteSize());
>+            visitor.copyLater(thisObject, TypedArrayVectorCopyToken, thisObject->m_vector.get(), thisObject->byteSize());
>         break;
>     }
>         
>@@ -449,7 +449,7 @@ void JSGenericTypedArrayView<Adaptor>::c
>     JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(cell);
>     
>     if (token == TypedArrayVectorCopyToken
>-        && visitor.checkIfShouldCopy(thisObject->m_vector.getWithoutBarrier())) {
>+        && visitor.checkIfShouldCopy(thisObject->m_vector.get())) {
>         ASSERT(thisObject->m_vector);
>         void* oldVector = thisObject->vector();
>         void* newVector = visitor.allocateNewSpace(thisObject->byteSize());
>Index: Source/JavaScriptCore/runtime/JSObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSObject.cpp	(revision 198152)
>+++ Source/JavaScriptCore/runtime/JSObject.cpp	(working copy)
>@@ -216,7 +216,7 @@ void JSObject::visitChildren(JSCell* cel
>     
>     JSCell::visitChildren(thisObject, visitor);
> 
>-    Butterfly* butterfly = thisObject->m_butterfly.getWithoutBarrier();
>+    Butterfly* butterfly = thisObject->m_butterfly.get();
>     if (butterfly)
>         thisObject->visitButterfly(visitor, butterfly, thisObject->structure(visitor.vm()));
> 
>@@ -233,7 +233,7 @@ void JSObject::copyBackingStore(JSCell* 
>     if (token != ButterflyCopyToken)
>         return;
>     
>-    Butterfly* butterfly = thisObject->m_butterfly.getWithoutBarrier();
>+    Butterfly* butterfly = thisObject->m_butterfly.get();
>     if (butterfly)
>         thisObject->copyButterfly(visitor, butterfly, thisObject->structure()->outOfLineSize());
> }
>@@ -250,7 +250,7 @@ void JSObject::heapSnapshot(JSCell* cell
>             builder.appendPropertyNameEdge(thisObject, toValue.asCell(), entry.key);
>     }
> 
>-    Butterfly* butterfly = thisObject->m_butterfly.getWithoutBarrier();
>+    Butterfly* butterfly = thisObject->m_butterfly.get();
>     if (butterfly) {
>         WriteBarrier<Unknown>* data;
>         uint32_t count = 0;
>@@ -389,7 +389,7 @@ bool JSObject::getOwnPropertySlotByIndex
>     }
>         
>     case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
>-        ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
>+        ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
>         if (i >= storage->length())
>             return false;
>         
>@@ -548,7 +548,7 @@ bool JSObject::putByIndex(JSCell* cell, 
>         
>     case NonArrayWithArrayStorage:
>     case ArrayWithArrayStorage: {
>-        ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
>+        ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
>         
>         if (propertyName >= storage->vectorLength())
>             break;
>@@ -570,7 +570,7 @@ bool JSObject::putByIndex(JSCell* cell, 
>         
>     case NonArrayWithSlowPutArrayStorage:
>     case ArrayWithSlowPutArrayStorage: {
>-        ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
>+        ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
>         
>         if (propertyName >= storage->vectorLength())
>             break;
>@@ -652,7 +652,7 @@ void JSObject::enterDictionaryIndexingMo
>             enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, storage);
>         break;
>     case ALL_ARRAY_STORAGE_INDEXING_TYPES:
>-        enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get(this)->arrayStorage());
>+        enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get()->arrayStorage());
>         break;
>         
>     default:
>@@ -682,7 +682,7 @@ Butterfly* JSObject::createInitialIndexe
>     ASSERT(!indexingShouldBeSparse());
>     unsigned vectorLength = std::max(length, BASE_VECTOR_LEN);
>     Butterfly* newButterfly = Butterfly::createOrGrowArrayRight(
>-        m_butterfly.get(this), vm, this, structure(), structure()->outOfLineCapacity(), false, 0,
>+        m_butterfly.get(), vm, this, structure(), structure()->outOfLineCapacity(), false, 0,
>         elementSize * vectorLength);
>     newButterfly->setPublicLength(length);
>     newButterfly->setVectorLength(vectorLength);
>@@ -734,7 +734,7 @@ ArrayStorage* JSObject::createArrayStora
>     IndexingType oldType = indexingType();
>     ASSERT_UNUSED(oldType, !hasIndexedProperties(oldType));
>     Butterfly* newButterfly = Butterfly::createOrGrowArrayRight(
>-        m_butterfly.get(this), vm, this, structure, structure->outOfLineCapacity(), false, 0,
>+        m_butterfly.get(), vm, this, structure, structure->outOfLineCapacity(), false, 0,
>         ArrayStorage::sizeFor(vectorLength));
>     RELEASE_ASSERT(newButterfly);
> 
>@@ -758,32 +758,32 @@ ContiguousJSValues JSObject::convertUnde
> {
>     ASSERT(hasUndecided(indexingType()));
>     setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateInt32));
>-    return m_butterfly.get(this)->contiguousInt32();
>+    return m_butterfly.get()->contiguousInt32();
> }
> 
> ContiguousDoubles JSObject::convertUndecidedToDouble(VM& vm)
> {
>     ASSERT(hasUndecided(indexingType()));
> 
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     for (unsigned i = butterfly->vectorLength(); i--;)
>         butterfly->contiguousDouble()[i] = PNaN;
>     
>     setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateDouble));
>-    return m_butterfly.get(this)->contiguousDouble();
>+    return m_butterfly.get()->contiguousDouble();
> }
> 
> ContiguousJSValues JSObject::convertUndecidedToContiguous(VM& vm)
> {
>     ASSERT(hasUndecided(indexingType()));
>     setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous));
>-    return m_butterfly.get(this)->contiguous();
>+    return m_butterfly.get()->contiguous();
> }
> 
> ArrayStorage* JSObject::constructConvertedArrayStorageWithoutCopyingElements(VM& vm, unsigned neededLength)
> {
>     Structure* structure = this->structure(vm);
>-    unsigned publicLength = m_butterfly.get(this)->publicLength();
>+    unsigned publicLength = m_butterfly.get()->publicLength();
>     unsigned propertyCapacity = structure->outOfLineCapacity();
>     unsigned propertySize = structure->outOfLineSize();
>     
>@@ -792,7 +792,7 @@ ArrayStorage* JSObject::constructConvert
>     
>     memcpy(
>         newButterfly->propertyStorage() - propertySize,
>-        m_butterfly.get(this)->propertyStorage() - propertySize,
>+        m_butterfly.get()->propertyStorage() - propertySize,
>         propertySize * sizeof(EncodedJSValue));
>     
>     ArrayStorage* newStorage = newButterfly->arrayStorage();
>@@ -810,7 +810,7 @@ ArrayStorage* JSObject::convertUndecided
>     DeferGC deferGC(vm.heap);
>     ASSERT(hasUndecided(indexingType()));
> 
>-    unsigned vectorLength = m_butterfly.get(this)->vectorLength();
>+    unsigned vectorLength = m_butterfly.get()->vectorLength();
>     ArrayStorage* storage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
>     // No need to copy elements.
>     
>@@ -828,7 +828,7 @@ ContiguousDoubles JSObject::convertInt32
> {
>     ASSERT(hasInt32(indexingType()));
> 
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     for (unsigned i = butterfly->vectorLength(); i--;) {
>         WriteBarrier<Unknown>* current = &butterfly->contiguousInt32()[i];
>         double* currentAsDouble = bitwise_cast<double*>(current);
>@@ -842,7 +842,7 @@ ContiguousDoubles JSObject::convertInt32
>     }
>     
>     setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateDouble));
>-    return m_butterfly.get(this)->contiguousDouble();
>+    return m_butterfly.get()->contiguousDouble();
> }
> 
> ContiguousJSValues JSObject::convertInt32ToContiguous(VM& vm)
>@@ -850,7 +850,7 @@ ContiguousJSValues JSObject::convertInt3
>     ASSERT(hasInt32(indexingType()));
>     
>     setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous));
>-    return m_butterfly.get(this)->contiguous();
>+    return m_butterfly.get()->contiguous();
> }
> 
> ArrayStorage* JSObject::convertInt32ToArrayStorage(VM& vm, NonPropertyTransition transition)
>@@ -858,9 +858,9 @@ ArrayStorage* JSObject::convertInt32ToAr
>     DeferGC deferGC(vm.heap);
>     ASSERT(hasInt32(indexingType()));
> 
>-    unsigned vectorLength = m_butterfly.get(this)->vectorLength();
>+    unsigned vectorLength = m_butterfly.get()->vectorLength();
>     ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     for (unsigned i = 0; i < butterfly->publicLength(); i++) {
>         JSValue v = butterfly->contiguous()[i].get();
>         if (v) {
>@@ -884,7 +884,7 @@ ContiguousJSValues JSObject::convertDoub
> {
>     ASSERT(hasDouble(indexingType()));
> 
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     for (unsigned i = butterfly->vectorLength(); i--;) {
>         double* current = &butterfly->contiguousDouble()[i];
>         WriteBarrier<Unknown>* currentAsValue = bitwise_cast<WriteBarrier<Unknown>*>(current);
>@@ -898,7 +898,7 @@ ContiguousJSValues JSObject::convertDoub
>     }
>     
>     setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous));
>-    return m_butterfly.get(this)->contiguous();
>+    return m_butterfly.get()->contiguous();
> }
> 
> ArrayStorage* JSObject::convertDoubleToArrayStorage(VM& vm, NonPropertyTransition transition)
>@@ -906,9 +906,9 @@ ArrayStorage* JSObject::convertDoubleToA
>     DeferGC deferGC(vm.heap);
>     ASSERT(hasDouble(indexingType()));
> 
>-    unsigned vectorLength = m_butterfly.get(this)->vectorLength();
>+    unsigned vectorLength = m_butterfly.get()->vectorLength();
>     ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     for (unsigned i = 0; i < butterfly->publicLength(); i++) {
>         double value = butterfly->contiguousDouble()[i];
>         if (value == value) {
>@@ -933,9 +933,9 @@ ArrayStorage* JSObject::convertContiguou
>     DeferGC deferGC(vm.heap);
>     ASSERT(hasContiguous(indexingType()));
> 
>-    unsigned vectorLength = m_butterfly.get(this)->vectorLength();
>+    unsigned vectorLength = m_butterfly.get()->vectorLength();
>     ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     for (unsigned i = 0; i < butterfly->publicLength(); i++) {
>         JSValue v = butterfly->contiguous()[i].get();
>         if (v) {
>@@ -1002,8 +1002,8 @@ void JSObject::convertInt32ForValue(VM& 
> 
> void JSObject::setIndexQuicklyToUndecided(VM& vm, unsigned index, JSValue value)
> {
>-    ASSERT(index < m_butterfly.get(this)->publicLength());
>-    ASSERT(index < m_butterfly.get(this)->vectorLength());
>+    ASSERT(index < m_butterfly.get()->publicLength());
>+    ASSERT(index < m_butterfly.get()->vectorLength());
>     convertUndecidedForValue(vm, value);
>     setIndexQuickly(vm, index, value);
> }
>@@ -1171,7 +1171,7 @@ ArrayStorage* JSObject::ensureArrayStora
>         return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, convertContiguousToArrayStorage(vm));
>         
>     case ALL_ARRAY_STORAGE_INDEXING_TYPES:
>-        return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get(this)->arrayStorage());
>+        return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get()->arrayStorage());
>         
>     default:
>         CRASH();
>@@ -1448,7 +1448,7 @@ bool JSObject::deletePropertyByIndex(JSC
>     }
>         
>     case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
>-        ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
>+        ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
>         
>         if (i < storage->vectorLength()) {
>             WriteBarrier<Unknown>& valueSlot = storage->m_vector[i];
>@@ -1717,7 +1717,7 @@ void JSObject::getOwnPropertyNames(JSObj
>         }
>             
>         case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
>-            ArrayStorage* storage = object->m_butterfly.get(object)->arrayStorage();
>+            ArrayStorage* storage = object->m_butterfly.get()->arrayStorage();
>             
>             unsigned usedVectorLength = std::min(storage->length(), storage->vectorLength());
>             for (unsigned i = 0; i < usedVectorLength; ++i) {
>@@ -1890,7 +1890,7 @@ NEVER_INLINE void JSObject::fillGetterPr
> bool JSObject::putIndexedDescriptor(ExecState* exec, SparseArrayEntry* entryInMap, const PropertyDescriptor& descriptor, PropertyDescriptor& oldDescriptor)
> {
>     VM& vm = exec->vm();
>-    auto map = m_butterfly.get(this)->arrayStorage()->m_sparseMap.get();
>+    auto map = m_butterfly.get()->arrayStorage()->m_sparseMap.get();
> 
>     if (descriptor.isDataDescriptor()) {
>         if (descriptor.value())
>@@ -1950,7 +1950,7 @@ bool JSObject::defineOwnIndexedProperty(
>     if (descriptor.attributes() & (ReadOnly | Accessor))
>         notifyPresenceOfIndexedAccessors(exec->vm());
> 
>-    SparseArrayValueMap* map = m_butterfly.get(this)->arrayStorage()->m_sparseMap.get();
>+    SparseArrayValueMap* map = m_butterfly.get()->arrayStorage()->m_sparseMap.get();
>     RELEASE_ASSERT(map);
> 
>     // 1. Let current be the result of calling the [[GetOwnProperty]] internal method of O with property name P.
>@@ -1982,7 +1982,7 @@ bool JSObject::defineOwnIndexedProperty(
>         entryInMap->get(defaults);
> 
>         putIndexedDescriptor(exec, entryInMap, descriptor, defaults);
>-        Butterfly* butterfly = m_butterfly.get(this);
>+        Butterfly* butterfly = m_butterfly.get();
>         if (index >= butterfly->arrayStorage()->length())
>             butterfly->arrayStorage()->setLength(index + 1);
>         return true;
>@@ -2111,7 +2111,7 @@ bool JSObject::putByIndexBeyondVectorLen
>     ASSERT((indexingType() & IndexingShapeMask) == indexingShape);
>     ASSERT(!indexingShouldBeSparse());
> 
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     
>     // For us to get here, the index is either greater than the public length, or greater than
>     // or equal to the vector length.
>@@ -2132,7 +2132,7 @@ bool JSObject::putByIndexBeyondVectorLen
>     }
> 
>     ensureLength(vm, i + 1);
>-    butterfly = m_butterfly.get(this);
>+    butterfly = m_butterfly.get();
> 
>     RELEASE_ASSERT(i < butterfly->vectorLength());
>     switch (indexingShape) {
>@@ -2415,7 +2415,7 @@ bool JSObject::putDirectIndexBeyondVecto
>         
>     case ALL_INT32_INDEXING_TYPES: {
>         if (attributes) {
>-            if (i < m_butterfly.get(this)->vectorLength())
>+            if (i < m_butterfly.get()->vectorLength())
>                 return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
>             return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertInt32ToArrayStorage(vm));
>         }
>@@ -2429,7 +2429,7 @@ bool JSObject::putDirectIndexBeyondVecto
>         
>     case ALL_DOUBLE_INDEXING_TYPES: {
>         if (attributes) {
>-            if (i < m_butterfly.get(this)->vectorLength())
>+            if (i < m_butterfly.get()->vectorLength())
>                 return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
>             return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertDoubleToArrayStorage(vm));
>         }
>@@ -2448,7 +2448,7 @@ bool JSObject::putDirectIndexBeyondVecto
>         
>     case ALL_CONTIGUOUS_INDEXING_TYPES: {
>         if (attributes) {
>-            if (i < m_butterfly.get(this)->vectorLength())
>+            if (i < m_butterfly.get()->vectorLength())
>                 return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
>             return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertContiguousToArrayStorage(vm));
>         }
>@@ -2458,7 +2458,7 @@ bool JSObject::putDirectIndexBeyondVecto
> 
>     case ALL_ARRAY_STORAGE_INDEXING_TYPES:
>         if (attributes) {
>-            if (i < m_butterfly.get(this)->vectorLength())
>+            if (i < m_butterfly.get()->vectorLength())
>                 return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
>         }
>         return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, arrayStorage());
>@@ -2544,8 +2544,8 @@ ALWAYS_INLINE unsigned JSObject::getNewV
>     unsigned length;
>     
>     if (hasIndexedProperties(indexingType())) {
>-        vectorLength = m_butterfly.get(this)->vectorLength();
>-        length = m_butterfly.get(this)->publicLength();
>+        vectorLength = m_butterfly.get()->vectorLength();
>+        length = m_butterfly.get()->publicLength();
>     } else {
>         vectorLength = 0;
>         length = 0;
>@@ -2651,7 +2651,7 @@ bool JSObject::increaseVectorLength(VM& 
> 
> void JSObject::ensureLengthSlow(VM& vm, unsigned length)
> {
>-    Butterfly* butterfly = m_butterfly.get(this);
>+    Butterfly* butterfly = m_butterfly.get();
>     
>     ASSERT(length < MAX_ARRAY_INDEX);
>     ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
>@@ -2681,11 +2681,11 @@ void JSObject::reallocateAndShrinkButter
>     ASSERT(length < MAX_ARRAY_INDEX);
>     ASSERT(length < MAX_STORAGE_VECTOR_LENGTH);
>     ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
>-    ASSERT(m_butterfly.get(this)->vectorLength() > length);
>-    ASSERT(!m_butterfly.get(this)->indexingHeader()->preCapacity(structure()));
>+    ASSERT(m_butterfly.get()->vectorLength() > length);
>+    ASSERT(!m_butterfly.get()->indexingHeader()->preCapacity(structure()));
> 
>     DeferGC deferGC(vm.heap);
>-    Butterfly* newButterfly = m_butterfly.get(this)->resizeArray(vm, this, structure(), 0, ArrayStorage::sizeFor(length));
>+    Butterfly* newButterfly = m_butterfly.get()->resizeArray(vm, this, structure(), 0, ArrayStorage::sizeFor(length));
>     m_butterfly.set(vm, this, newButterfly);
>     newButterfly->setVectorLength(length);
>     newButterfly->setPublicLength(length);
>@@ -2698,7 +2698,7 @@ Butterfly* JSObject::growOutOfLineStorag
>     // It's important that this function not rely on structure(), for the property
>     // capacity, since we might have already mutated the structure in-place.
> 
>-    return Butterfly::createOrGrowPropertyStorage(m_butterfly.get(this), vm, this, structure(vm), oldSize, newSize);
>+    return Butterfly::createOrGrowPropertyStorage(m_butterfly.get(), vm, this, structure(vm), oldSize, newSize);
> }
> 
> static JSBoundSlotBaseFunction* getBoundSlotBaseFunctionForGetterSetter(ExecState* exec, PropertyName propertyName, JSC::PropertySlot& slot, CustomGetterSetter* getterSetter, JSBoundSlotBaseFunction::Type type)
>@@ -3051,7 +3051,7 @@ uint32_t JSObject::getEnumerableLength(E
>     }
>         
>     case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
>-        ArrayStorage* storage = object->m_butterfly.get(object)->arrayStorage();
>+        ArrayStorage* storage = object->m_butterfly.get()->arrayStorage();
>         if (storage->m_sparseMap.get())
>             return 0;
>         
>Index: Source/JavaScriptCore/runtime/JSObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSObject.h	(revision 198152)
>+++ Source/JavaScriptCore/runtime/JSObject.h	(working copy)
>@@ -162,14 +162,14 @@ public:
>     {
>         if (!hasIndexedProperties(indexingType()))
>             return 0;
>-        return m_butterfly.get(this)->publicLength();
>+        return m_butterfly.get()->publicLength();
>     }
>         
>     unsigned getVectorLength()
>     {
>         if (!hasIndexedProperties(indexingType()))
>             return 0;
>-        return m_butterfly.get(this)->vectorLength();
>+        return m_butterfly.get()->vectorLength();
>     }
>     
>     static bool putInline(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
>@@ -214,7 +214,7 @@ public:
>     
>     bool canGetIndexQuickly(unsigned i)
>     {
>-        Butterfly* butterfly = m_butterfly.get(this);
>+        Butterfly* butterfly = m_butterfly.get();
>         switch (indexingType()) {
>         case ALL_BLANK_INDEXING_TYPES:
>         case ALL_UNDECIDED_INDEXING_TYPES:
>@@ -240,7 +240,7 @@ public:
>         
>     JSValue getIndexQuickly(unsigned i)
>     {
>-        Butterfly* butterfly = m_butterfly.get(this);
>+        Butterfly* butterfly = m_butterfly.get();
>         switch (indexingType()) {
>         case ALL_INT32_INDEXING_TYPES:
>             return jsNumber(butterfly->contiguous()[i].get().asInt32());
>@@ -258,7 +258,7 @@ public:
>         
>     JSValue tryGetIndexQuickly(unsigned i) const
>     {
>-        Butterfly* butterfly = m_butterfly.get(this);
>+        Butterfly* butterfly = m_butterfly.get();
>         switch (indexingType()) {
>         case ALL_BLANK_INDEXING_TYPES:
>         case ALL_UNDECIDED_INDEXING_TYPES:
>@@ -312,7 +312,7 @@ public:
>         
>     bool canSetIndexQuickly(unsigned i)
>     {
>-        Butterfly* butterfly = m_butterfly.get(this);
>+        Butterfly* butterfly = m_butterfly.get();
>         switch (indexingType()) {
>         case ALL_BLANK_INDEXING_TYPES:
>         case ALL_UNDECIDED_INDEXING_TYPES:
>@@ -343,7 +343,7 @@ public:
>         case ALL_DOUBLE_INDEXING_TYPES:
>         case ALL_CONTIGUOUS_INDEXING_TYPES:
>         case ALL_ARRAY_STORAGE_INDEXING_TYPES:
>-            return i < m_butterfly.get(this)->vectorLength();
>+            return i < m_butterfly.get()->vectorLength();
>         default:
>             RELEASE_ASSERT_NOT_REACHED();
>             return false;
>@@ -352,7 +352,7 @@ public:
>         
>     void setIndexQuickly(VM& vm, unsigned i, JSValue v)
>     {
>-        Butterfly* butterfly = m_butterfly.get(this);
>+        Butterfly* butterfly = m_butterfly.get();
>         switch (indexingType()) {
>         case ALL_INT32_INDEXING_TYPES: {
>             ASSERT(i < butterfly->vectorLength());
>@@ -409,7 +409,7 @@ public:
> 
>     void initializeIndex(VM& vm, unsigned i, JSValue v, IndexingType indexingType)
>     {
>-        Butterfly* butterfly = m_butterfly.get(this);
>+        Butterfly* butterfly = m_butterfly.get();
>         switch (indexingType) {
>         case ALL_UNDECIDED_INDEXING_TYPES: {
>             setIndexQuicklyToUndecided(vm, i, v);
>@@ -467,7 +467,7 @@ public:
>         case ALL_CONTIGUOUS_INDEXING_TYPES:
>             return false;
>         case ALL_ARRAY_STORAGE_INDEXING_TYPES:
>-            return !!m_butterfly.get(this)->arrayStorage()->m_sparseMap;
>+            return !!m_butterfly.get()->arrayStorage()->m_sparseMap;
>         default:
>             RELEASE_ASSERT_NOT_REACHED();
>             return false;
>@@ -484,7 +484,7 @@ public:
>         case ALL_CONTIGUOUS_INDEXING_TYPES:
>             return false;
>         case ALL_ARRAY_STORAGE_INDEXING_TYPES:
>-            return m_butterfly.get(this)->arrayStorage()->inSparseMode();
>+            return m_butterfly.get()->arrayStorage()->inSparseMode();
>         default:
>             RELEASE_ASSERT_NOT_REACHED();
>             return false;
>@@ -593,11 +593,11 @@ public:
>         return inlineStorageUnsafe();
>     }
>         
>-    const Butterfly* butterfly() const { return m_butterfly.get(this); }
>-    Butterfly* butterfly() { return m_butterfly.get(this); }
>+    const Butterfly* butterfly() const { return m_butterfly.get(); }
>+    Butterfly* butterfly() { return m_butterfly.get(); }
>         
>-    ConstPropertyStorage outOfLineStorage() const { return m_butterfly.get(this)->propertyStorage(); }
>-    PropertyStorage outOfLineStorage() { return m_butterfly.get(this)->propertyStorage(); }
>+    ConstPropertyStorage outOfLineStorage() const { return m_butterfly.get()->propertyStorage(); }
>+    PropertyStorage outOfLineStorage() { return m_butterfly.get()->propertyStorage(); }
> 
>     const WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset) const
>     {
>@@ -713,7 +713,7 @@ public:
>     ContiguousJSValues ensureInt32(VM& vm)
>     {
>         if (LIKELY(hasInt32(indexingType())))
>-            return m_butterfly.get(this)->contiguousInt32();
>+            return m_butterfly.get()->contiguousInt32();
>             
>         return ensureInt32Slow(vm);
>     }
>@@ -725,7 +725,7 @@ public:
>     ContiguousDoubles ensureDouble(VM& vm)
>     {
>         if (LIKELY(hasDouble(indexingType())))
>-            return m_butterfly.get(this)->contiguousDouble();
>+            return m_butterfly.get()->contiguousDouble();
>             
>         return ensureDoubleSlow(vm);
>     }
>@@ -735,7 +735,7 @@ public:
>     ContiguousJSValues ensureContiguous(VM& vm)
>     {
>         if (LIKELY(hasContiguous(indexingType())))
>-            return m_butterfly.get(this)->contiguous();
>+            return m_butterfly.get()->contiguous();
>             
>         return ensureContiguousSlow(vm);
>     }
>@@ -747,7 +747,7 @@ public:
>     ArrayStorage* ensureArrayStorage(VM& vm)
>     {
>         if (LIKELY(hasAnyArrayStorage(indexingType())))
>-            return m_butterfly.get(this)->arrayStorage();
>+            return m_butterfly.get()->arrayStorage();
> 
>         return ensureArrayStorageSlow(vm);
>     }
>@@ -795,7 +795,7 @@ protected:
>     ArrayStorage* arrayStorage()
>     {
>         ASSERT(hasAnyArrayStorage(indexingType()));
>-        return m_butterfly.get(this)->arrayStorage();
>+        return m_butterfly.get()->arrayStorage();
>     }
>         
>     // Call this if you want to predicate some actions on whether or not the
>@@ -804,7 +804,7 @@ protected:
>     {
>         switch (indexingType()) {
>         case ALL_ARRAY_STORAGE_INDEXING_TYPES:
>-            return m_butterfly.get(this)->arrayStorage();
>+            return m_butterfly.get()->arrayStorage();
>                 
>         default:
>             return 0;
>@@ -869,11 +869,11 @@ protected:
>         ASSERT(length < MAX_ARRAY_INDEX);
>         ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
> 
>-        if (m_butterfly.get(this)->vectorLength() < length)
>+        if (m_butterfly.get()->vectorLength() < length)
>             ensureLengthSlow(vm, length);
>             
>-        if (m_butterfly.get(this)->publicLength() < length)
>-            m_butterfly.get(this)->setPublicLength(length);
>+        if (m_butterfly.get()->publicLength() < length)
>+            m_butterfly.get()->setPublicLength(length);
>     }
>         
>     // Call this if you want to shrink the butterfly backing store, and you're
>@@ -1489,7 +1489,7 @@ inline void JSObject::putDirectWithoutTr
>     DeferGC deferGC(vm.heap);
>     ASSERT(!value.isGetterSetter() && !(attributes & Accessor));
>     ASSERT(!value.isCustomGetterSetter());
>-    Butterfly* newButterfly = m_butterfly.get(this);
>+    Butterfly* newButterfly = m_butterfly.get();
>     if (structure()->putWillGrowOutOfLineStorage())
>         newButterfly = growOutOfLineStorage(vm, structure()->outOfLineCapacity(), structure()->suggestedNewOutOfLineStorageCapacity());
>     Structure* structure = this->structure();
>Index: Source/JavaScriptCore/runtime/MapData.h
>===================================================================
>--- Source/JavaScriptCore/runtime/MapData.h	(revision 198152)
>+++ Source/JavaScriptCore/runtime/MapData.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
>+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -185,7 +185,7 @@ ALWAYS_INLINE bool MapDataImpl<Entry, JS
> {
>     if (!ensureSlot())
>         return false;
>-    Entry* entry = &m_mapData->m_entries.get(m_mapData->m_owner)[m_index];
>+    Entry* entry = &m_mapData->m_entries.get()[m_index];
>     pair = WTF::KeyValuePair<JSValue, JSValue>(entry->key().get(), entry->value().get());
>     m_index += 1;
>     return true;
>@@ -207,7 +207,7 @@ ALWAYS_INLINE int32_t MapDataImpl<Entry,
>     if (isFinished())
>         return m_index;
> 
>-    Entry* entries = m_mapData->m_entries.get(m_mapData->m_owner);
>+    Entry* entries = m_mapData->m_entries.get();
>     size_t end = m_mapData->m_size;
>     while (static_cast<size_t>(m_index) < end && !entries[m_index].key())
>         m_index++;
>Index: Source/JavaScriptCore/runtime/MapDataInlines.h
>===================================================================
>--- Source/JavaScriptCore/runtime/MapDataInlines.h	(revision 198152)
>+++ Source/JavaScriptCore/runtime/MapDataInlines.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2013 Apple Inc. All rights reserved.
>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
>  * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
>  *
>  * Redistribution and use in source and binary forms, with or without
>@@ -60,25 +60,25 @@ inline Entry* MapDataImpl<Entry, JSItera
>         auto iter = m_stringKeyedTable.find(asString(key.value)->value(exec).impl());
>         if (iter == m_stringKeyedTable.end())
>             return 0;
>-        return &m_entries.get(m_owner)[iter->value];
>+        return &m_entries.get()[iter->value];
>     }
>     if (key.value.isSymbol()) {
>         auto iter = m_symbolKeyedTable.find(asSymbol(key.value)->privateName().uid());
>         if (iter == m_symbolKeyedTable.end())
>             return 0;
>-        return &m_entries.get(m_owner)[iter->value];
>+        return &m_entries.get()[iter->value];
>     }
>     if (key.value.isCell()) {
>         auto iter = m_cellKeyedTable.find(key.value.asCell());
>         if (iter == m_cellKeyedTable.end())
>             return 0;
>-        return &m_entries.get(m_owner)[iter->value];
>+        return &m_entries.get()[iter->value];
>     }
> 
>     auto iter = m_valueKeyedTable.find(JSValue::encode(key.value));
>     if (iter == m_valueKeyedTable.end())
>         return 0;
>-    return &m_entries.get(m_owner)[iter->value];
>+    return &m_entries.get()[iter->value];
> }
> 
> template<typename Entry, typename JSIterator>
>@@ -93,14 +93,14 @@ inline Entry* MapDataImpl<Entry, JSItera
> {
>     typename Map::iterator location = map.find(key);
>     if (location != map.end())
>-        return &m_entries.get(m_owner)[location->value];
>+        return &m_entries.get()[location->value];
> 
>     if (!ensureSpaceForAppend(exec, owner))
>         return 0;
> 
>     auto result = map.add(key, m_size);
>     RELEASE_ASSERT(result.isNewEntry);
>-    Entry* entry = &m_entries.get(m_owner)[m_size++];
>+    Entry* entry = &m_entries.get()[m_size++];
>     new (entry) Entry();
>     entry->setKey(exec->vm(), owner, keyValue.value);
>     return entry;
>@@ -164,7 +164,7 @@ inline bool MapDataImpl<Entry, JSIterato
>         location = iter->value;
>         m_valueKeyedTable.remove(iter);
>     }
>-    m_entries.get(m_owner)[location].clear();
>+    m_entries.get()[location].clear();
>     m_deletedCount++;
>     return true;
> }
>@@ -176,7 +176,7 @@ inline void MapDataImpl<Entry, JSIterato
>     int32_t newEnd = 0;
>     RELEASE_ASSERT(newCapacity > 0);
>     for (int32_t i = 0; i < m_size; i++) {
>-        Entry& entry = m_entries.getWithoutBarrier()[i];
>+        Entry& entry = m_entries.get()[i];
>         if (!entry.key()) {
>             m_iterators.forEach([newEnd](JSIterator* iterator, JSIterator*) {
>                 iterator->iteratorData()->didRemoveEntry(newEnd);
>@@ -195,13 +195,13 @@ inline void MapDataImpl<Entry, JSIterato
> 
>     // Fixup for the hashmaps
>     for (auto ptr = m_valueKeyedTable.begin(); ptr != m_valueKeyedTable.end(); ++ptr)
>-        ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
>+        ptr->value = m_entries.get()[ptr->value].key().get().asInt32();
>     for (auto ptr = m_cellKeyedTable.begin(); ptr != m_cellKeyedTable.end(); ++ptr)
>-        ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
>+        ptr->value = m_entries.get()[ptr->value].key().get().asInt32();
>     for (auto ptr = m_stringKeyedTable.begin(); ptr != m_stringKeyedTable.end(); ++ptr)
>-        ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
>+        ptr->value = m_entries.get()[ptr->value].key().get().asInt32();
>     for (auto ptr = m_symbolKeyedTable.begin(); ptr != m_symbolKeyedTable.end(); ++ptr)
>-        ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
>+        ptr->value = m_entries.get()[ptr->value].key().get().asInt32();
> 
>     ASSERT((m_size - newEnd) == m_deletedCount);
>     m_deletedCount = 0;
>@@ -217,7 +217,7 @@ inline void MapDataImpl<Entry, JSIterato
>     ASSERT(!shouldPack());
>     RELEASE_ASSERT(newCapacity > 0);
>     ASSERT(newCapacity >= m_capacity);
>-    memcpy(destination, m_entries.getWithoutBarrier(), sizeof(Entry) * m_size);
>+    memcpy(destination, m_entries.get(), sizeof(Entry) * m_size);
>     m_capacity = newCapacity;
>     m_entries.setWithoutBarrier(destination);
> }
>@@ -236,8 +236,6 @@ inline CheckedBoolean MapDataImpl<Entry,
>         return false;
>     }
>     Entry* newEntries = static_cast<Entry*>(newStorage);
>-    // Do a read barrier to ensure that m_entries points to to-space for the remainder of this GC epoch.
>-    m_entries.get(m_owner); 
>     if (shouldPack())
>         replaceAndPackBackingStore(newEntries, requiredSize);
>     else
>@@ -249,7 +247,7 @@ inline CheckedBoolean MapDataImpl<Entry,
> template<typename Entry, typename JSIterator>
> inline void MapDataImpl<Entry, JSIterator>::visitChildren(JSCell* owner, SlotVisitor& visitor)
> {
>-    Entry* entries = m_entries.getWithoutBarrier();
>+    Entry* entries = m_entries.get();
>     if (!entries)
>         return;
>     if (m_deletedCount) {
>@@ -263,14 +261,14 @@ inline void MapDataImpl<Entry, JSIterato
>         visitor.appendValues(reinterpret_cast<WriteBarrier<Unknown>*>(&entries[0]), m_size * (sizeof(Entry) / sizeof(WriteBarrier<Unknown>)));
>     }
> 
>-    visitor.copyLater(owner, MapBackingStoreCopyToken, m_entries.getWithoutBarrier(), capacityInBytes());
>+    visitor.copyLater(owner, MapBackingStoreCopyToken, m_entries.get(), capacityInBytes());
> }
> 
> template<typename Entry, typename JSIterator>
> inline void MapDataImpl<Entry, JSIterator>::copyBackingStore(CopyVisitor& visitor, CopyToken token)
> {
>-    if (token == MapBackingStoreCopyToken && visitor.checkIfShouldCopy(m_entries.getWithoutBarrier())) {
>-        Entry* oldEntries = m_entries.getWithoutBarrier();
>+    if (token == MapBackingStoreCopyToken && visitor.checkIfShouldCopy(m_entries.get())) {
>+        Entry* oldEntries = m_entries.get();
>         Entry* newEntries = static_cast<Entry*>(visitor.allocateNewSpace(capacityInBytes()));
>         if (shouldPack())
>             replaceAndPackBackingStore(newEntries, m_capacity);
>Index: Source/JavaScriptCore/runtime/Options.h
>===================================================================
>--- Source/JavaScriptCore/runtime/Options.h	(revision 198152)
>+++ Source/JavaScriptCore/runtime/Options.h	(working copy)
>@@ -200,7 +200,6 @@ typedef const char* optionString;
>     v(bool, useMovHintRemoval, true, nullptr) \
>     v(bool, usePutStackSinking, true, nullptr) \
>     v(bool, useObjectAllocationSinking, true, nullptr) \
>-    v(bool, useCopyBarrierOptimization, true, nullptr) \
>     \
>     v(bool, useConcurrentJIT, true, "allows the DFG / FTL compilation in threads other than the executing JS thread") \
>     v(unsigned, numberOfDFGCompilerThreads, computeNumberOfWorkerThreads(2, 2) - 1, nullptr) \
>@@ -371,7 +370,6 @@ enum OptionEquivalence {
>     v(enablePolymorphicCallInlining, usePolymorphicCallInlining, SameOption) \
>     v(enableMovHintRemoval, useMovHintRemoval, SameOption) \
>     v(enableObjectAllocationSinking, useObjectAllocationSinking, SameOption) \
>-    v(enableCopyBarrierOptimization, useCopyBarrierOptimization, SameOption) \
>     v(enableConcurrentJIT, useConcurrentJIT, SameOption) \
>     v(enableProfiler, useProfiler, SameOption) \
>     v(enableArchitectureSpecificOptimizations, useArchitectureSpecificOptimizations, SameOption) \

Actions: View | Formatted Diff | Diff

Attachments on bug 155479: 274059 | 274076 | 274077