Attachment 286517 Details for Bug 160989 – WIP

[patch] WIP

c-backup.diff (text/plain), 87.54 KB, created by Saam Barati on 2016-08-19 19:27:06 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2016-08-19 19:27:06 PDT

Size: 87.54 KB

patch

obsolete

>Index: PerformanceTests/ES6SampleBench/cli.js
>===================================================================
>--- PerformanceTests/ES6SampleBench/cli.js	(nonexistent)
>+++ PerformanceTests/ES6SampleBench/cli.js	(working copy)
>@@ -0,0 +1,7 @@
>+load("driver.js");
>+load("results.js");
>+load("stats.js");
>+
>+load("cli_air.js");
>+load("cli_basic.js");
>+load("glue.js");
>Index: PerformanceTests/ES6SampleBench/cli_air.js
>===================================================================
>--- PerformanceTests/ES6SampleBench/cli_air.js	(nonexistent)
>+++ PerformanceTests/ES6SampleBench/cli_air.js	(working copy)
>@@ -0,0 +1,78 @@
>+/*
>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+"use strict";
>+
>+let __loadedAir = false;
>+if (!__loadedAir) {
>+    __loadedAir = true;
>+
>+    load("Air/symbols.js");
>+    load("Air/tmp_base.js");
>+    load("Air/arg.js");
>+    load("Air/basic_block.js");
>+    load("Air/code.js");
>+    load("Air/frequented_block.js");
>+    load("Air/inst.js");
>+    load("Air/opcode.js");
>+    load("Air/reg.js");
>+    load("Air/stack_slot.js");
>+    load("Air/tmp.js");
>+    load("Air/util.js");
>+    load("Air/custom.js");
>+    load("Air/liveness.js");
>+    load("Air/insertion_set.js");
>+    load("Air/allocate_stack.js");
>+    load("Air/payload-gbemu-executeIteration.js");
>+    load("Air/payload-imaging-gaussian-blur-gaussianBlur.js");
>+    load("Air/payload-airjs-ACLj8C.js");
>+    load("Air/payload-typescript-scanIdentifier.js");
>+    load("Air/benchmark.js");
>+}
>+
>+function run() {
>+    var results = [];
>+    var benchmark = new AirBenchmark();
>+    var numIterations = 200;
>+    for (var i = 0; i < numIterations; ++i) {
>+        var before = currentTime();
>+        benchmark.runIteration();
>+        var after = currentTime();
>+        results.push(after - before);
>+    }
>+
>+    reportResult(results);
>+}
>+
>+const AirBenchmarkRunner = {
>+    run: run,
>+    name: "Air",
>+    cells: {
>+        //firstIteration: document.getElementById("AirFirstIteration"),
>+        //averageWorstCase: document.getElementById("AirAverageWorstCase"),
>+        //steadyState: document.getElementById("AirSteadyState"),
>+        //message: document.getElementById("AirMessage")
>+    }
>+};
>+
>Index: PerformanceTests/ES6SampleBench/cli_basic.js
>===================================================================
>--- PerformanceTests/ES6SampleBench/cli_basic.js	(nonexistent)
>+++ PerformanceTests/ES6SampleBench/cli_basic.js	(working copy)
>@@ -0,0 +1,34 @@
>+load("Basic/ast.js");
>+load("Basic/basic.js");
>+load("Basic/caseless_map.js");
>+load("Basic/lexer.js");
>+load("Basic/number.js");
>+load("Basic/parser.js");
>+load("Basic/random.js");
>+load("Basic/state.js");
>+load("Basic/util.js");
>+load("Basic/benchmark.js");
>+
>+function run() {
>+    var results = [];
>+    var benchmark = new BasicBenchmark();
>+    var numIterations = 200;
>+    for (var i = 0; i < numIterations; ++i) {
>+        var before = currentTime();
>+        benchmark.runIteration();
>+        var after = currentTime();
>+        results.push(after - before);
>+    }
>+    reportResult(results);
>+}
>+
>+const BasicBenchmarkRunner = {
>+    run: run,
>+    name: "Basic",
>+    cells: {
>+        //firstIteration: document.getElementById("BasicFirstIteration"),
>+        //averageWorstCase: document.getElementById("BasicAverageWorstCase"),
>+        //steadyState: document.getElementById("BasicSteadyState"),
>+        //message: document.getElementById("BasicMessage")
>+    }
>+};
>Index: PerformanceTests/ES6SampleBench/driver.js
>===================================================================
>--- PerformanceTests/ES6SampleBench/driver.js	(revision 204652)
>+++ PerformanceTests/ES6SampleBench/driver.js	(working copy)
>@@ -22,7 +22,7 @@
>  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>  */
>-"use strict";
>+//"use strict";
> 
> class Driver {
>     constructor(triggerCell, triggerLink, magicCell, summaryCell, key)
>@@ -34,7 +34,7 @@ class Driver {
>         this._summary = new Stats(summaryCell);
>         this._key = key;
>         this._hadErrors = false;
>-        window[key] = this;
>+        //window[key] = this;
>     }
>     
>     addBenchmark(benchmark)
>@@ -57,6 +57,7 @@ class Driver {
>     
>     reportResult(...args)
>     {
>+        print(this._benchmark.name);
>         this._benchmarks.get(this._benchmark).reportResult(...args);
>         this._recomputeSummary();
>         this._iterate();
>@@ -117,9 +118,10 @@ class Driver {
>         this._benchmark = this._iterator ? this._iterator.next().value : null;
>         if (!this._benchmark) {
>             if (!this._numIterations) {
>-                this._triggerCell.innerHTML =
>-                    (this._hadErrors ? "Failures encountered!" : "Success!") +
>-                    ` <a href="${this._triggerLink}">Restart Benchmark</a>`;
>+                print(this._hadErrors ? "Failures encountered!" : "Success!");
>+                //this._triggerCell.innerHTML =
>+                //     +
>+                //    ` <a href="${this._triggerLink}">Restart Benchmark</a>`;
>                 return;
>             }
>             this._numIterations--;
>@@ -130,31 +132,39 @@ class Driver {
>         
>         this._benchmarks.get(this._benchmark).reportRunning();
>         
>-        window.setTimeout(() => {
>+        let benchmark = this._benchmark;
>+        Promise.resolve(20).then(() => {
>             if (!this._isRunning)
>                 return;
>             
>-            this._magicCell.contentDocument.body.textContent = "";
>-            this._magicCell.contentDocument.body.innerHTML = "<iframe id=\"magicFrame\" frameborder=\"0\">";
>-            
>-            let magicFrame = this._magicCell.contentDocument.getElementById("magicFrame");
>-            magicFrame.contentDocument.open();
>-            magicFrame.contentDocument.write(
>-                `<!DOCTYPE html><head><title>benchmark payload</title></head><body><script>` +
>-                `window.onerror = top.${this._key}.reportError;\n` +
>-                `function reportResult()\n` +
>-                `{\n` +
>-                `    var driver = top.${this._key};\n` +
>-                `    driver.reportResult.apply(driver, arguments);\n` +
>-                `}\n` +
>-                `</script>\n` +
>-                `${this._benchmark.code}</body></html>`);
>-        }, 100);
>+            benchmark.run();
>+        });
>+        //window.setTimeout(() => {
>+        //    if (!this._isRunning)
>+        //        return;
>+        //    
>+        //    this._magicCell.contentDocument.body.textContent = "";
>+        //    this._magicCell.contentDocument.body.innerHTML = "<iframe id=\"magicFrame\" frameborder=\"0\">";
>+        //    
>+        //    let magicFrame = this._magicCell.contentDocument.getElementById("magicFrame");
>+        //    magicFrame.contentDocument.open();
>+        //    magicFrame.contentDocument.write(
>+        //        `<!DOCTYPE html><head><title>benchmark payload</title></head><body><script>` +
>+        //        `window.onerror = top.${this._key}.reportError;\n` +
>+        //        `function reportResult()\n` +
>+        //        `{\n` +
>+        //        `    var driver = top.${this._key};\n` +
>+        //        `    driver.reportResult.apply(driver, arguments);\n` +
>+        //        `}\n` +
>+        //        `</script>\n` +
>+        //        `${this._benchmark.code}</body></html>`);
>+        //}, 100);
>     }
>     
>     _updateIterations()
>     {
>-        this._triggerCell.innerHTML = "Running... (" + (this._numIterations + 1) + " to go)";
>+        //this._triggerCell.innerHTML = "Running... (" + (this._numIterations + 1) + " to go)";
>+        print("Running... (" + (this._numIterations + 1) + " to go)");
>     }
> }
> 
>Index: PerformanceTests/ES6SampleBench/glue.js
>===================================================================
>--- PerformanceTests/ES6SampleBench/glue.js	(revision 204652)
>+++ PerformanceTests/ES6SampleBench/glue.js	(working copy)
>@@ -25,11 +25,16 @@
> "use strict";
> 
> const driver = new Driver(
>-    document.getElementById("trigger"),
>+    this.document ? document.getElementById("trigger") : null,
>     "driver.start(10)",
>-    document.getElementById("magic"),
>-    document.getElementById("Geomean"),
>+    this.document ? document.getElementById("magic") : null,
>+    this.document ? document.getElementById("Geomean") : null,
>     "sampleBench");
> 
>-driver.addBenchmark(AirBenchmark);
>-driver.addBenchmark(BasicBenchmark);
>+//driver.addBenchmark(AirBenchmarkRunner);
>+driver.addBenchmark(BasicBenchmarkRunner);
>+driver.start(5);
>+function reportResult(...args) {
>+    driver.reportResult(...args);
>+}
>+//driver.addBenchmark(BasicBenchmark);
>Index: PerformanceTests/ES6SampleBench/results.js
>===================================================================
>--- PerformanceTests/ES6SampleBench/results.js	(revision 204652)
>+++ PerformanceTests/ES6SampleBench/results.js	(working copy)
>@@ -42,12 +42,12 @@ class Results {
>     
>     reportRunning()
>     {
>-        this._benchmark.cells.message.innerHTML = "Running...";
>+        //this._benchmark.cells.message.innerHTML = "Running...";
>     }
>     
>     reportDone()
>     {
>-        this._benchmark.cells.message.innerHTML = "";
>+        //this._benchmark.cells.message.innerHTML = "";
>     }
>     
>     reportResult(times)
>@@ -99,7 +99,7 @@ class Results {
>     {
>         for (let subResult of Results.subResults)
>             this[subResult].reportResult(Stats.error);
>-        this._benchmark.cells.message.innerHTML = url + ":" + lineNumber + ": " + message;
>+        //this._benchmark.cells.message.innerHTML = url + ":" + lineNumber + ": " + message;
>     }
> }
> 
>Index: PerformanceTests/ES6SampleBench/stats.js
>===================================================================
>--- PerformanceTests/ES6SampleBench/stats.js	(revision 204652)
>+++ PerformanceTests/ES6SampleBench/stats.js	(working copy)
>@@ -90,16 +90,23 @@ class Stats {
>         if (result.mean != result.mean)
>             return "ERROR";
>         
>-        if ("interval" in result)
>-            return `${result.mean.toFixed(2)} ms &plusmn; ${result.interval.toFixed(2)} ms`;
>+        if ("interval" in result) {
>+            return `${result.mean.toFixed(2)} ms += ${result.interval.toFixed(2)} ms`;
>+        }
> 
>         return `${result.mean.toFixed(2)} ms`;
>     }
>     
>     _update()
>     {
>-        if (this._cell)
>+        if (this.window && this._cell) {
>+            this._magicCell.contentDocument.body.textContent = "";
>+            this._magicCell.contentDocument.body.innerHTML = "<iframe id=\"magicFrame\" frameborder=\"0\">";
>+            
>+            let magicFrame = this._magicCell.contentDocument.getElementById("magicFrame");
>             this._cell.innerHTML = this.toString();
>+        } else
>+            print(this.toString());
>     }
> }
> 
>Index: PerformanceTests/ES6SampleBench/Air/benchmark.js
>===================================================================
>--- PerformanceTests/ES6SampleBench/Air/benchmark.js	(revision 204652)
>+++ PerformanceTests/ES6SampleBench/Air/benchmark.js	(working copy)
>@@ -24,7 +24,7 @@
>  */
> "use strict";
> 
>-class Benchmark {
>+class AirBenchmark {
>     constructor(verbose = 0)
>     {
>         this._verbose = verbose;
>Index: PerformanceTests/ES6SampleBench/Air/util.js
>===================================================================
>--- PerformanceTests/ES6SampleBench/Air/util.js	(revision 204652)
>+++ PerformanceTests/ES6SampleBench/Air/util.js	(working copy)
>@@ -169,7 +169,7 @@ function bubbleSort(array, lessThan)
>     }
> }
> 
>-let currentTime;
>+var currentTime;
> if (this.performance && performance.now)
>     currentTime = function() { return performance.now() };
> else if (this.preciseTime)
>Index: PerformanceTests/ES6SampleBench/Basic/benchmark.js
>===================================================================
>--- PerformanceTests/ES6SampleBench/Basic/benchmark.js	(revision 204652)
>+++ PerformanceTests/ES6SampleBench/Basic/benchmark.js	(working copy)
>@@ -24,7 +24,7 @@
>  */
> "use strict";
> 
>-class Benchmark {
>+class BasicBenchmark {
>     constructor(verbose = 0)
>     {
>         this._verbose = verbose;
>Index: PerformanceTests/ES6SampleBench/Basic/util.js
>===================================================================
>--- PerformanceTests/ES6SampleBench/Basic/util.js	(revision 204652)
>+++ PerformanceTests/ES6SampleBench/Basic/util.js	(working copy)
>@@ -24,7 +24,7 @@
>  */
> "use strict";
> 
>-let currentTime;
>+var currentTime;
> if (this.performance && performance.now)
>     currentTime = function() { return performance.now() };
> else if (this.preciseTime)
>Index: Source/JavaScriptCore/DerivedSources.make
>===================================================================
>--- Source/JavaScriptCore/DerivedSources.make	(revision 204652)
>+++ Source/JavaScriptCore/DerivedSources.make	(working copy)
>@@ -96,6 +96,7 @@ JavaScriptCore_BUILTINS_SOURCES = \
>     $(JavaScriptCore)/builtins/InspectorInstrumentationObject.js \
>     $(JavaScriptCore)/builtins/InternalPromiseConstructor.js \
>     $(JavaScriptCore)/builtins/IteratorPrototype.js \
>+    $(JavaScriptCore)/builtins/MapIteratorPrototype.js \
>     $(JavaScriptCore)/builtins/MapPrototype.js \
>     $(JavaScriptCore)/builtins/ModuleLoaderPrototype.js \
>     $(JavaScriptCore)/builtins/NumberConstructor.js \
>@@ -146,6 +147,7 @@ OBJECT_LUT_HEADERS = \
>     JSONObject.lut.h \
>     JSPromisePrototype.lut.h \
>     JSPromiseConstructor.lut.h \
>+    MapIteratorPrototype.lut.h \
>     MapPrototype.lut.h \
>     ModuleLoaderPrototype.lut.h \
>     NumberConstructor.lut.h \
>Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(revision 204652)
>+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(working copy)
>@@ -1200,7 +1200,7 @@
> 		53F40E8D1D5901F20099A1B6 /* WASMParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E8C1D5901F20099A1B6 /* WASMParser.h */; };
> 		53F40E8F1D5902820099A1B6 /* WASMB3IRGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53F40E8E1D5902820099A1B6 /* WASMB3IRGenerator.cpp */; };
> 		53F40E911D5903020099A1B6 /* WASMOps.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E901D5903020099A1B6 /* WASMOps.h */; };
>-                53F40E931D5A4AB30099A1B6 /* WASMB3IRGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E921D5A4AB30099A1B6 /* WASMB3IRGenerator.h */; };
>+		53F40E931D5A4AB30099A1B6 /* WASMB3IRGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E921D5A4AB30099A1B6 /* WASMB3IRGenerator.h */; };
> 		53F40E951D5A7AEF0099A1B6 /* WASMModuleParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E941D5A7AEF0099A1B6 /* WASMModuleParser.h */; };
> 		53F40E971D5A7BEC0099A1B6 /* WASMModuleParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53F40E961D5A7BEC0099A1B6 /* WASMModuleParser.cpp */; };
> 		53F6BF6D1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F6BF6C1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -3391,7 +3391,7 @@
> 		53F40E8C1D5901F20099A1B6 /* WASMParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WASMParser.h; sourceTree = "<group>"; };
> 		53F40E8E1D5902820099A1B6 /* WASMB3IRGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WASMB3IRGenerator.cpp; sourceTree = "<group>"; };
> 		53F40E901D5903020099A1B6 /* WASMOps.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WASMOps.h; sourceTree = "<group>"; };
>-                53F40E921D5A4AB30099A1B6 /* WASMB3IRGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WASMB3IRGenerator.h; sourceTree = "<group>"; };
>+		53F40E921D5A4AB30099A1B6 /* WASMB3IRGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WASMB3IRGenerator.h; sourceTree = "<group>"; };
> 		53F40E941D5A7AEF0099A1B6 /* WASMModuleParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WASMModuleParser.h; sourceTree = "<group>"; };
> 		53F40E961D5A7BEC0099A1B6 /* WASMModuleParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WASMModuleParser.cpp; sourceTree = "<group>"; };
> 		53F6BF6C1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InternalFunctionAllocationProfile.h; sourceTree = "<group>"; };
>@@ -3525,6 +3525,7 @@
> 		72AAF7CB1D0D318B005E60BE /* JSCustomGetterSetterFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCustomGetterSetterFunction.cpp; sourceTree = "<group>"; };
> 		72AAF7CC1D0D318B005E60BE /* JSCustomGetterSetterFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCustomGetterSetterFunction.h; sourceTree = "<group>"; };
> 		77B25CB2C3094A92A38E1DB3 /* JSModuleLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSModuleLoader.h; sourceTree = "<group>"; };
>+		790107371D66974C00580422 /* MapIteratorPrototype.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = MapIteratorPrototype.js; sourceTree = "<group>"; };
> 		7905BB661D12050E0019FE57 /* InlineAccess.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InlineAccess.cpp; sourceTree = "<group>"; };
> 		7905BB671D12050E0019FE57 /* InlineAccess.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InlineAccess.h; sourceTree = "<group>"; };
> 		79160DBB1C8E3EC8008C085A /* ProxyRevoke.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyRevoke.cpp; sourceTree = "<group>"; };
>@@ -5566,7 +5567,7 @@
> 				53F40E901D5903020099A1B6 /* WASMOps.h */,
> 				7BC547D21B69599B00959B58 /* WASMFormat.h */,
> 				53F40E8E1D5902820099A1B6 /* WASMB3IRGenerator.cpp */,
>-                                53F40E921D5A4AB30099A1B6 /* WASMB3IRGenerator.h */,
>+				53F40E921D5A4AB30099A1B6 /* WASMB3IRGenerator.h */,
> 				53F40E8A1D5901BB0099A1B6 /* WASMFunctionParser.h */,
> 				53F40E961D5A7BEC0099A1B6 /* WASMModuleParser.cpp */,
> 				53F40E941D5A7AEF0099A1B6 /* WASMModuleParser.h */,
>@@ -7013,6 +7014,7 @@
> 				E33F50881B844A1A00413856 /* InternalPromiseConstructor.js */,
> 				7CF9BC5B1B65D9A3009DB1EF /* IteratorPrototype.js */,
> 				7035587C1C418419004BD7BF /* MapPrototype.js */,
>+				790107371D66974C00580422 /* MapIteratorPrototype.js */,
> 				E30677971B8BC6F5003F87F0 /* ModuleLoaderPrototype.js */,
> 				A52704861D027C8800354C37 /* NumberConstructor.js */,
> 				A15DE5C51C0FBF8D0089133D /* NumberPrototype.js */,
>@@ -7956,7 +7958,7 @@
> 				0FB5467714F59B5C002C2989 /* LazyOperandValueProfile.h in Headers */,
> 				99DA00B01BD5994E00F4575C /* lazywriter.py in Headers */,
> 				BC18C4310E16F5CD00B34460 /* Lexer.h in Headers */,
>-                                53F40E931D5A4AB30099A1B6 /* WASMB3IRGenerator.h in Headers */,
>+				53F40E931D5A4AB30099A1B6 /* WASMB3IRGenerator.h in Headers */,
> 				BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */,
> 				DCF3D56B1CD29472003D5C65 /* LazyClassStructureInlines.h in Headers */,
> 				FE187A021BFBE5610038BBCA /* JITMulGenerator.h in Headers */,
>Index: Source/JavaScriptCore/builtins/BuiltinNames.h
>===================================================================
>--- Source/JavaScriptCore/builtins/BuiltinNames.h	(revision 204652)
>+++ Source/JavaScriptCore/builtins/BuiltinNames.h	(working copy)
>@@ -91,8 +91,6 @@ namespace JSC {
>     macro(capabilities) \
>     macro(starDefault) \
>     macro(InspectorInstrumentation) \
>-    macro(get) \
>-    macro(set) \
>     macro(shift) \
>     macro(allocateTypedArray) \
>     macro(Int8Array) \
>@@ -134,7 +132,6 @@ namespace JSC {
>     macro(predictFinalLengthFromArgumunts) \
>     macro(print) \
>     macro(isSet) \
>-    macro(isMap) \
>     macro(regExpCreate) \
>     macro(SetIterator) \
>     macro(setIteratorNext) \
>@@ -158,7 +155,15 @@ namespace JSC {
>     macro(regExpTestFast) \
>     macro(stringIncludesInternal) \
>     macro(stringSplitFast) \
>-    macro(stringSubstrInternal)
>+    macro(stringSubstrInternal) \
>+    macro(mapHead) \
>+    macro(mapTail) \
>+    macro(mapTable) \
>+    macro(mapHash) \
>+    macro(mapSize) \
>+    macro(mapDeleteCount) \
>+    macro(mapBucket) \
>+    macro(mapIterationKind) \
> 
> 
> #define INITIALIZE_PRIVATE_TO_PUBLIC_ENTRY(name) m_privateToPublicMap.add(m_##name##PrivateName.impl(), &m_##name);
>Index: Source/JavaScriptCore/builtins/MapIteratorPrototype.js
>===================================================================
>--- Source/JavaScriptCore/builtins/MapIteratorPrototype.js	(nonexistent)
>+++ Source/JavaScriptCore/builtins/MapIteratorPrototype.js	(working copy)
>@@ -0,0 +1,46 @@
>+/*
>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+function next()
>+{
>+    let lastMapBucket = this.@mapBucket;
>+    if (!lastMapBucket)
>+        throw new @TypeError("Cannot call MapIterator.next() on a non-MapIterator object");
>+
>+    let listNext = lastMapBucket.listNext;
>+    while (listNext && listNext.deleted)
>+        listNext = listNext.listNext;
>+
>+    if (listNext) {
>+        this.@mapBucket = listNext;
>+        if (this.@mapIterationKind === @iterationKindKeyValue)
>+            return {done: false, value: [listNext.key, listNext.value]};
>+        if (this.@mapIterationKind === @iterationKindKey)
>+            return {done: false, value: listNext.key};
>+        // Value
>+        return {done: false, value: listNext.value};
>+    }
>+    return {done: true};
>+}
>Index: Source/JavaScriptCore/builtins/MapPrototype.js
>===================================================================
>--- Source/JavaScriptCore/builtins/MapPrototype.js	(revision 204652)
>+++ Source/JavaScriptCore/builtins/MapPrototype.js	(working copy)
>@@ -1,5 +1,6 @@
> /*
>  * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -27,7 +28,7 @@ function forEach(callback /*, thisArg */
> {
>     "use strict";
> 
>-    if (!@isMap(this))
>+    if (!@isJSMap(this))
>         throw new @TypeError("Map operation called on non-Map object");
> 
>     if (typeof callback !== 'function')
>@@ -44,3 +45,196 @@ function forEach(callback /*, thisArg */
>         callback.@call(thisArg, value[1], value[0], this);
>     }
> }
>+
>+function get(key)
>+{
>+    "use strict";
>+
>+    if (!@isJSMap(this))
>+        throw new @TypeError("Map operation called on non-Map object");
>+
>+    let table = this.@mapTable;
>+    let tableLen = table.length; 
>+    let mask = tableLen - 1;
>+    let hash = @jsMapHash(key) & mask;
>+    let bucket = table[hash];
>+    //let adder = 1;
>+    while (bucket) {
>+        if (bucket.key === key && !bucket.deleted)
>+            return bucket.value;
>+        hash = (hash + 1) & mask;
>+        //hash = (hash + adder**2) & mask;
>+        bucket = table[hash];
>+        //adder++;
>+    }
>+    return @undefined;
>+}
>+
>+function has(key)
>+{
>+    "use strict";
>+
>+    if (!@isJSMap(this))
>+        throw new @TypeError("Map operation called on non-Map object");
>+
>+    let table = this.@mapTable;
>+    let tableLen = table.length; 
>+    let mask = tableLen - 1;
>+    let hash = @jsMapHash(key) & mask;
>+    let bucket = table[hash];
>+    //let adder = 1;
>+    while (bucket) {
>+        if (bucket.key === key && !bucket.deleted)
>+            return true;
>+        //hash = (hash + adder**2) & mask;
>+        hash = (hash + 1) & mask;
>+        bucket = table[hash];
>+        //adder++;
>+    }
>+    return false;
>+}
>+
>+function delete(key)
>+{
>+    "use strict";
>+
>+    if (!@isJSMap(this))
>+        throw new @TypeError("Map operation called on non-Map object");
>+
>+    let table = this.@mapTable;
>+    let tableLen = table.length; 
>+    let mask = tableLen - 1;
>+    let hash = @jsMapHash(key) & mask;
>+    let bucket = table[hash];
>+    //let adder = 1;
>+    while (bucket) {
>+        if (bucket.key === key && !bucket.deleted) {
>+            bucket.deleted = true;
>+            bucket.listNext.listPrev = bucket.listPrev;
>+            bucket.listPrev.listNext = bucket.listNext;
>+            ++this.@mapDeleteCount;
>+            return true;
>+        }
>+        //hash = (hash + adder**2) & mask;
>+        hash = (hash + 1) & mask;
>+        bucket = table[hash];
>+        //adder++;
>+    }
>+    return false;
>+
>+}
>+
>+@globalPrivate
>+function jsMapRehash(map, oldLen)
>+{
>+    this.@mapSize = this.@mapSize - this.@mapDeleteCount;
>+    this.@mapDeleteCount = 0;
>+    let newSize = oldLen * 2;
>+    let table = new @Array(newSize);
>+    for (let i = 0; i < table.length; i++)
>+        table[i] = @undefined;
>+    map.@mapTable = table;
>+    let mask = newSize - 1;
>+    let node = map.@mapHead.listNext;
>+    let nextNode = node.listNext;
>+    while (nextNode) {
>+        let key = node.key;
>+        let hash = @jsMapHash(key) & mask;
>+        let bucket = table[hash];
>+        //let adder = 1;
>+        while (bucket) {
>+            //hash = (hash + adder**2) & mask;
>+            hash = (hash + 1) & mask;
>+            bucket = table[hash];
>+            //adder++;
>+        }
>+
>+        table[hash] = node;
>+        node = nextNode;
>+        nextNode = nextNode.listNext;
>+    }
>+}
>+
>+function set(key, value)
>+{
>+    "use strict";
>+
>+    if (!@isJSMap(this))
>+        throw new @TypeError("Map operation called on non-Map object");
>+
>+    let table = this.@mapTable;
>+    let tableLen = table.length; 
>+    let mask = tableLen - 1;
>+    let hash = @jsMapHash(key) & mask;
>+    let bucket = table[hash];
>+    //let adder = 1;
>+    while (bucket) {
>+        if (bucket.key === key) {
>+            bucket.value = value;
>+            bucket.deleted = false; // Maybe we were deleted before, but we are not anymore.
>+            ++this.@mapSize;
>+            --this.@mapDeleteCount;
>+            return;
>+        }
>+        //hash = (hash + adder**2) & mask;
>+        hash = (hash + 1) & mask;
>+        bucket = table[hash];
>+        //adder++;
>+    }
>+
>+    let mapTail = this.@mapTail;
>+    let newItem = {
>+        listNext: mapTail,
>+        listPrev: mapTail.listPrev,
>+        key: key,
>+        value: value,
>+        deleted: false
>+    };
>+    mapTail.listPrev = newItem;
>+    newItem.listPrev.listNext = newItem;
>+
>+    table[hash] = newItem;
>+
>+    let newSize = ++this.@mapSize;
>+    if (2 * newSize > tableLen) { // Do int muls and compare. This is just checking if we're filled up more than 1/2.
>+        @jsMapRehash(this, tableLen);
>+    } 
>+}
>+
>+function clear(key, value)
>+{
>+    "use strict";
>+
>+    if (!@isJSMap(this))
>+        throw new @TypeError("Map operation called on non-Map object");
>+
>+    this.@mapTable = @newArrayWithSize(4);
>+    this.@mapTail.listPrev = this.@mapHead;
>+    this.@mapHead.listNext = this.@mapTail;
>+    this.@mapSize = 0;
>+    this.@mapDeleteCount = 0;
>+}
>+
>+function listAsArray()
>+{
>+    "use strict";
>+
>+    if (!@isJSMap(this))
>+        throw new @TypeError("Map operation called on non-Map object");
>+
>+    let result = [];
>+
>+    let bucket = this.@mapHead;
>+    while (bucket) {
>+        result.push({
>+            key: bucket.key || "EMPTY",
>+            value: bucket.value || "EMPTY"
>+        });
>+        bucket = bucket.listNext;
>+    }
>+    return {
>+        tableLength: this.@mapTable.length,
>+        mapSize: this.@mapSize,
>+        array: result
>+    };
>+}
>Index: Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h	(revision 204652)
>+++ Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h	(working copy)
>@@ -49,6 +49,8 @@ class Identifier;
>     macro(toNumber) \
>     macro(toString) \
>     macro(newArrayWithSize) \
>+    macro(jsMapHash) \
>+    macro(isJSMap) \
> 
> #define JSC_COMMON_BYTECODE_INTRINSIC_CONSTANTS_EACH_NAME(macro) \
>     macro(undefined) \
>Index: Source/JavaScriptCore/bytecode/BytecodeList.json
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeList.json	(revision 204652)
>+++ Source/JavaScriptCore/bytecode/BytecodeList.json	(working copy)
>@@ -57,6 +57,7 @@
>             { "name" : "op_is_number", "length" : 3 },
>             { "name" : "op_is_string", "length" : 3 },
>             { "name" : "op_is_jsarray", "length" : 3 },
>+            { "name" : "op_is_jsmap", "length" : 3 },
>             { "name" : "op_is_object", "length" : 3 },
>             { "name" : "op_is_object_or_null", "length" : 3 },
>             { "name" : "op_is_function", "length" : 3 },
>@@ -147,7 +148,8 @@
>             { "name" : "op_resume", "length" : 3 },
>             { "name" : "op_watchdog", "length" : 1 },
>             { "name" : "op_log_shadow_chicken_prologue", "length" : 2},
>-            { "name" : "op_log_shadow_chicken_tail", "length" : 3}
>+            { "name" : "op_log_shadow_chicken_tail", "length" : 3},
>+            { "name" : "op_jsmap_hash", "length" : 3 }
>         ]
>     },
>     {
>Index: Source/JavaScriptCore/bytecode/BytecodeUseDef.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(revision 204652)
>+++ Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(working copy)
>@@ -171,6 +171,7 @@ void computeUsesForBytecodeOffset(
>     case op_is_number:
>     case op_is_string:
>     case op_is_jsarray:
>+    case op_is_jsmap:
>     case op_is_object:
>     case op_is_object_or_null:
>     case op_is_function:
>@@ -190,6 +191,7 @@ void computeUsesForBytecodeOffset(
>     case op_get_parent_scope:
>     case op_create_scoped_arguments:
>     case op_create_rest:
>+    case op_jsmap_hash:
>     case op_get_from_arguments: {
>         ASSERT(opcodeLengths[opcodeID] > 2);
>         functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
>@@ -419,6 +421,7 @@ void computeDefsForBytecodeOffset(CodeBl
>     case op_is_number:
>     case op_is_string:
>     case op_is_jsarray:
>+    case op_is_jsmap:
>     case op_is_object:
>     case op_is_object_or_null:
>     case op_is_function:
>@@ -464,6 +467,7 @@ void computeDefsForBytecodeOffset(CodeBl
>     case op_unsigned:
>     case op_get_from_arguments: 
>     case op_create_rest:
>+    case op_jsmap_hash:
>     case op_get_rest_length: {
>         ASSERT(opcodeLengths[opcodeID] > 1);
>         functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
>Index: Source/JavaScriptCore/bytecode/CodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.cpp	(revision 204652)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.cpp	(working copy)
>@@ -1119,6 +1119,14 @@ void CodeBlock::dumpBytecode(
>             printUnaryOp(out, exec, location, it, "is_jsarray");
>             break;
>         }
>+        case op_is_jsmap: {
>+            printUnaryOp(out, exec, location, it, "is_jsmap");
>+            break;
>+        }
>+        case op_jsmap_hash: {
>+            printUnaryOp(out, exec, location, it, "jsmap_hash");
>+            break;
>+        }
>         case op_is_object: {
>             printUnaryOp(out, exec, location, it, "is_object");
>             break;
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(revision 204652)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(working copy)
>@@ -629,6 +629,8 @@ namespace JSC {
>         RegisterID* emitToIndexString(RegisterID* dst, RegisterID* index);
> 
>         RegisterID* emitIsJSArray(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_is_jsarray, dst, src); }
>+        RegisterID* emitIsJSMap(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_is_jsmap, dst, src); }
>+        RegisterID* emitJSMapHash(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_jsmap_hash, dst, src); }
>         RegisterID* emitIsObject(RegisterID* dst, RegisterID* src);
>         RegisterID* emitIsUndefined(RegisterID* dst, RegisterID* src);
>         RegisterID* emitIsEmpty(RegisterID* dst, RegisterID* src);
>Index: Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(revision 204652)
>+++ Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(working copy)
>@@ -964,6 +964,27 @@ RegisterID* BytecodeIntrinsicNode::emit_
>     return finalDestination.get();
> }
> 
>+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_jsMapHash(JSC::BytecodeGenerator& generator, JSC::RegisterID* dst)
>+{
>+    ArgumentListNode* node = m_args->m_listNode;
>+    RefPtr<RegisterID> size = generator.emitNode(node);
>+    ASSERT(!node->m_next);
>+
>+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst);
>+    generator.emitJSMapHash(finalDestination.get(), size.get());
>+    return finalDestination.get();
>+}
>+
>+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_isJSMap(JSC::BytecodeGenerator& generator, JSC::RegisterID* dst)
>+{
>+    ArgumentListNode* node = m_args->m_listNode;
>+    RefPtr<RegisterID> size = generator.emitNode(node);
>+    ASSERT(!node->m_next);
>+
>+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst);
>+    generator.emitIsJSMap(finalDestination.get(), size.get());
>+    return finalDestination.get();
>+}
> 
> #define JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS(name) \
>     RegisterID* BytecodeIntrinsicNode::emit_intrinsic_##name(BytecodeGenerator& generator, RegisterID* dst) \
>Index: Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h	(working copy)
>@@ -1020,6 +1020,11 @@ bool AbstractInterpreter<AbstractStateTy
>         break;
>     }
> 
>+    case JSMapHash: {
>+        forNode(node).setType(SpecInt32Only);
>+        break;
>+    }
>+
>     case IsEmpty:
>     case IsJSArray:
>     case IsUndefined:
>@@ -1030,6 +1035,7 @@ bool AbstractInterpreter<AbstractStateTy
>     case IsObjectOrNull:
>     case IsFunction:
>     case IsRegExpObject:
>+    case IsJSMap:
>     case IsTypedArrayView: {
>         AbstractValue child = forNode(node->child1());
>         if (child.value()) {
>@@ -1038,6 +1044,9 @@ bool AbstractInterpreter<AbstractStateTy
>             case IsJSArray:
>                 setConstant(node, jsBoolean(child.value().isObject() && child.value().getObject()->type() == ArrayType));
>                 break;
>+            case IsJSMap:
>+                setConstant(node, jsBoolean(child.value().isObject() && child.value().getObject()->type() == JSMapType));
>+                break;
>             case IsUndefined:
>                 setConstant(node, jsBoolean(
>                     child.value().isCell()
>@@ -1279,6 +1288,9 @@ bool AbstractInterpreter<AbstractStateTy
>             }
>             break;
> 
>+        case IsJSMap:
>+            break;
>+
>         default:
>             break;
>         }
>Index: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(working copy)
>@@ -3948,6 +3948,18 @@ bool ByteCodeParser::parseBlock(unsigned
>             NEXT_OPCODE(op_is_jsarray);
>         }
> 
>+        case op_is_jsmap: {
>+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
>+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsJSMap, value));
>+            NEXT_OPCODE(op_is_jsmap);
>+        }
>+
>+        case op_jsmap_hash: {
>+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
>+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(JSMapHash, value));
>+            NEXT_OPCODE(op_jsmap_hash);
>+        }
>+
>         case op_is_object: {
>             Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
>             set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsObject, value));
>Index: Source/JavaScriptCore/dfg/DFGCapabilities.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(working copy)
>@@ -138,6 +138,7 @@ CapabilityLevel capabilityLevel(OpcodeID
>     case op_is_number:
>     case op_is_string:
>     case op_is_jsarray:
>+    case op_is_jsmap:
>     case op_is_object:
>     case op_is_object_or_null:
>     case op_is_function:
>@@ -241,6 +242,7 @@ CapabilityLevel capabilityLevel(OpcodeID
>     case op_log_shadow_chicken_tail:
>     case op_put_to_scope:
>     case op_resolve_scope:
>+    case op_jsmap_hash:
>         return CanCompileAndInline;
> 
>     case op_new_regexp:
>Index: Source/JavaScriptCore/dfg/DFGClobberize.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGClobberize.h	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGClobberize.h	(working copy)
>@@ -166,6 +166,7 @@ void clobberize(Graph& graph, Node* node
>     case CompareStrictEq:
>     case CompareEqPtr:
>     case IsJSArray:
>+    case IsJSMap:
>     case IsEmpty:
>     case IsUndefined:
>     case IsBoolean:
>@@ -190,6 +191,11 @@ void clobberize(Graph& graph, Node* node
>         def(PureValue(node));
>         return;
> 
>+    // FIXME: consider what happens when we resolve a rope here.
>+    case JSMapHash:
>+        def(PureValue(node));
>+        return;
>+
>     case BitAnd:
>     case BitOr:
>     case BitXor:
>Index: Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGDoesGC.cpp	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGDoesGC.cpp	(working copy)
>@@ -157,6 +157,7 @@ bool doesGC(Graph& graph, Node* node)
>     case InstanceOf:
>     case InstanceOfCustom:
>     case IsJSArray:
>+    case IsJSMap:
>     case IsEmpty:
>     case IsUndefined:
>     case IsBoolean:
>@@ -185,6 +186,7 @@ bool doesGC(Graph& graph, Node* node)
>     case ForceOSRExit:
>     case CheckWatchdogTimer:
>     case StringFromCharCode:
>+    case JSMapHash:
>     case Unreachable:
>     case ExtractOSREntryLocal:
>     case CheckTierUpInLoop:
>Index: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(working copy)
>@@ -1523,6 +1523,12 @@ private:
>             break;
>         }
> 
>+        case IsJSMap: {
>+            if (node->child1()->shouldSpeculateCell())
>+                fixEdge<CellUse>(node->child1());
>+            break;
>+        }
>+
> #if !ASSERT_DISABLED
>         // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.
>         case SetArgument:
>@@ -1594,6 +1600,7 @@ private:
>         case PutByValWithThis:
>         case GetByValWithThis:
>         case CompareEqPtr:
>+        case JSMapHash:
>             break;
>             
>             break;
>Index: Source/JavaScriptCore/dfg/DFGNodeType.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGNodeType.h	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGNodeType.h	(working copy)
>@@ -309,6 +309,7 @@ namespace JSC { namespace DFG {
>     macro(InstanceOfCustom, NodeMustGenerate | NodeResultBoolean) \
>     \
>     macro(IsJSArray, NodeResultBoolean) \
>+    macro(IsJSMap, NodeResultBoolean) \
>     macro(IsEmpty, NodeResultBoolean) \
>     macro(IsUndefined, NodeResultBoolean) \
>     macro(IsBoolean, NodeResultBoolean) \
>@@ -388,7 +389,9 @@ namespace JSC { namespace DFG {
>     macro(GetPropertyEnumerator, NodeMustGenerate | NodeResultJS) \
>     macro(GetEnumeratorStructurePname, NodeMustGenerate | NodeResultJS) \
>     macro(GetEnumeratorGenericPname, NodeMustGenerate | NodeResultJS) \
>-    macro(ToIndexString, NodeResultJS)
>+    macro(ToIndexString, NodeResultJS) \
>+    /* Hashing for JSMap */ \
>+    macro(JSMapHash, NodeResultInt32) \
> 
> // This enum generates a monotonically increasing id for all Node types,
> // and is used by the subsequent enum to fill out the id (as accessed via the NodeIdMask).
>Index: Source/JavaScriptCore/dfg/DFGOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOperations.cpp	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGOperations.cpp	(working copy)
>@@ -50,6 +50,7 @@
> #include "JSCInlines.h"
> #include "JSGenericTypedArrayViewConstructorInlines.h"
> #include "JSLexicalEnvironment.h"
>+#include "JSMap.h"
> #include "ObjectConstructor.h"
> #include "Repatch.h"
> #include "ScopedArguments.h"
>@@ -1719,6 +1720,17 @@ void JIT_OPERATION operationPutDynamicVa
>     scope->methodTable()->put(scope, exec, ident, JSValue::decode(value), slot);
> }
> 
>+int32_t JIT_OPERATION operationJSMapHash(ExecState* exec, EncodedJSValue input)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+
>+    JSValue result = jsMapHash(exec, JSValue::decode(input));
>+    if (vm.exception())
>+        return 0;
>+    return result.asInt32();
>+}
>+
> extern "C" void JIT_OPERATION triggerReoptimizationNow(CodeBlock* codeBlock, OSRExitBase* exit)
> {
>     // It's sort of preferable that we don't GC while in here. Anyways, doing so wouldn't
>Index: Source/JavaScriptCore/dfg/DFGOperations.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOperations.h	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGOperations.h	(working copy)
>@@ -180,6 +180,8 @@ void JIT_OPERATION debugOperationPrintSp
> 
> void JIT_OPERATION triggerReoptimizationNow(CodeBlock*, OSRExitBase*) WTF_INTERNAL;
> 
>+int32_t JIT_OPERATION operationJSMapHash(ExecState*, EncodedJSValue input);
>+
> #if USE(JSVALUE32_64)
> double JIT_OPERATION operationRandom(JSGlobalObject*);
> #endif
>Index: Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp	(working copy)
>@@ -744,6 +744,11 @@ private:
>             break;
>         }
> 
>+        case JSMapHash: {
>+            setPrediction(SpecInt32Only);
>+            break;
>+        }
>+
>         case GetRestLength: {
>             setPrediction(SpecInt32Only);
>             break;
>@@ -787,6 +792,7 @@ private:
>         case InstanceOf:
>         case InstanceOfCustom:
>         case IsJSArray:
>+        case IsJSMap:
>         case IsEmpty:
>         case IsUndefined:
>         case IsBoolean:
>Index: Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSafeToExecute.h	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGSafeToExecute.h	(working copy)
>@@ -258,6 +258,7 @@ bool safeToExecute(AbstractStateType& st
>     case InstanceOf:
>     case InstanceOfCustom:
>     case IsJSArray:
>+    case IsJSMap:
>     case IsEmpty:
>     case IsUndefined:
>     case IsBoolean:
>@@ -355,6 +356,7 @@ bool safeToExecute(AbstractStateType& st
>     case GetDynamicVar:
>     case PutDynamicVar:
>     case ResolveScope:
>+    case JSMapHash:
>         return true;
> 
>     case BottomValue:
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(working copy)
>@@ -4667,6 +4667,16 @@ void SpeculativeJIT::compile(Node* node)
>         break;
>     }
> 
>+    case IsJSMap: {
>+        compileIsJSMap(node);
>+        break;
>+    }
>+
>+    case JSMapHash: {
>+        compileJSMapHash(node);
>+        break;
>+    }
>+
>     case IsObject: {
>         JSValueOperand value(this, node->child1());
>         GPRTemporary result(this, Reuse, value);
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(working copy)
>@@ -3610,6 +3610,84 @@ void SpeculativeJIT::compileIsJSArray(No
>     blessedBooleanResult(resultGPR, node);
> }
> 
>+void SpeculativeJIT::compileIsJSMap(Node* node)
>+{
>+    ASSERT(node->type() == IsJSMap);
>+    if (node->child1().useKind() == CellUse) {
>+        SpeculateCellOperand value(this, node->child1());
>+        GPRTemporary result(this);
>+
>+        GPRReg valueGPR = value.gpr();
>+        GPRReg resultGPR = result.gpr();
>+
>+        m_jit.compare8(JITCompiler::Equal,
>+            JITCompiler::Address(valueGPR, JSCell::typeInfoTypeOffset()),
>+            TrustedImm32(JSMapType),
>+            resultGPR);
>+        blessBoolean(resultGPR);
>+        blessedBooleanResult(resultGPR, node);
>+        return;
>+    }
>+
>+    RELEASE_ASSERT(node->child1().useKind() == UntypedUse);
>+    JSValueOperand value(this, node->child1());
>+    GPRFlushedCallResult result(this);
>+
>+    JSValueRegs valueRegs = value.jsValueRegs();
>+    GPRReg resultGPR = result.gpr();
>+
>+    JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(valueRegs);
>+
>+    m_jit.compare8(JITCompiler::Equal,
>+        JITCompiler::Address(valueRegs.payloadGPR(), JSCell::typeInfoTypeOffset()),
>+        TrustedImm32(JSMapType),
>+        resultGPR);
>+    blessBoolean(resultGPR);
>+    JITCompiler::Jump done = m_jit.jump();
>+
>+    isNotCell.link(&m_jit);
>+    moveFalseTo(resultGPR);
>+
>+    done.link(&m_jit);
>+    blessedBooleanResult(resultGPR, node);
>+}
>+
>+void SpeculativeJIT::compileJSMapHash(Node* node)
>+{
>+    ASSERT(node->type() == JSMapHash);
>+
>+    JSValueOperand input(this, node->child1());
>+    GPRTemporary result(this);
>+
>+    GPRReg inputGPR = input.gpr();
>+    GPRReg resultGPR = result.gpr();
>+
>+    MacroAssembler::JumpList straightHash;
>+    auto isNotCell = m_jit.branchIfNotCell(inputGPR);
>+    MacroAssembler::JumpList slowPath;
>+    slowPath.append(m_jit.branch8(MacroAssembler::Equal, MacroAssembler::Address(inputGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
>+    straightHash.append(m_jit.jump());
>+
>+    isNotCell.link(&m_jit);
>+    straightHash.append(m_jit.branchIfNotNumber(inputGPR));
>+    straightHash.append(m_jit.branchIfInt32(JSValueRegs(inputGPR)));
>+    slowPath.append(m_jit.jump());
>+
>+    straightHash.link(&m_jit);
>+    m_jit.jsMapHash(inputGPR, resultGPR);
>+    m_jit.move(inputGPR, resultGPR);
>+    auto done = m_jit.jump();
>+
>+    slowPath.link(&m_jit);
>+    silentSpillAllRegisters(resultGPR);
>+    callOperation(operationJSMapHash, resultGPR, inputGPR);
>+    silentFillAllRegisters(resultGPR);
>+    m_jit.exceptionCheck();
>+
>+    done.link(&m_jit);
>+    int32Result(resultGPR, node);
>+}
>+
> void SpeculativeJIT::compileIsRegExpObject(Node* node)
> {
>     JSValueOperand value(this, node->child1());
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h	(revision 204652)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h	(working copy)
>@@ -756,6 +756,8 @@ public:
>     void compileInstanceOfCustom(Node*);
> 
>     void compileIsJSArray(Node*);
>+    void compileIsJSMap(Node*);
>+    void compileJSMapHash(Node*);
>     void compileIsRegExpObject(Node*);
>     void compileIsTypedArrayView(Node*);
> 
>@@ -1671,6 +1673,12 @@ public:
>         return appendCall(operation);
>     }
> 
>+    JITCompiler::Call callOperation(Z_JITOperation_EJ operation, GPRReg result, GPRReg arg1)
>+    {
>+        m_jit.setupArgumentsWithExecState(arg1);
>+        return appendCallSetResult(operation, result);
>+    }
>+
>     JITCompiler::Call callOperation(Z_JITOperation_EJZZ operation, GPRReg result, GPRReg arg1, unsigned arg2, unsigned arg3)
>     {
>         m_jit.setupArgumentsWithExecState(arg1, TrustedImm32(arg2), TrustedImm32(arg3));
>Index: Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLCapabilities.cpp	(revision 204652)
>+++ Source/JavaScriptCore/ftl/FTLCapabilities.cpp	(working copy)
>@@ -180,6 +180,8 @@ inline CapabilityLevel canCompile(Node* 
>     case ThrowReferenceError:
>     case Unreachable:
>     case IsJSArray:
>+    case IsJSMap:
>+    case JSMapHash:
>     case IsEmpty:
>     case IsUndefined:
>     case IsBoolean:
>Index: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp	(revision 204652)
>+++ Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp	(working copy)
>@@ -897,6 +897,12 @@ private:
>         case IsJSArray:
>             compileIsJSArray();
>             break;
>+        case IsJSMap:
>+            compileIsJSMap();
>+            break;
>+        case JSMapHash:
>+            compileJSMapHash();
>+            break;
>         case IsObject:
>             compileIsObject();
>             break;
>@@ -6264,6 +6270,114 @@ private:
>         setBoolean(m_out.phi(Int32, notCellResult, cellResult));
>     }
> 
>+    void compileJSMapHash()
>+    {
>+        LValue value = lowJSValue(m_node->child1());
>+
>+        LBasicBlock isCellCase = m_out.newBlock();
>+        LBasicBlock notCell = m_out.newBlock();
>+        LBasicBlock slowCase = m_out.newBlock();
>+        LBasicBlock straightHash = m_out.newBlock();
>+        LBasicBlock isNumberCase = m_out.newBlock();
>+        LBasicBlock continuation = m_out.newBlock();
>+
>+        m_out.branch(
>+            isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(notCell));
>+
>+        LBasicBlock lastNext = m_out.appendTo(isCellCase, notCell);
>+        LValue isString = m_out.equal(m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoType), m_out.constInt32(StringType));
>+        m_out.branch(
>+            isString, unsure(slowCase), unsure(straightHash));
>+
>+        m_out.appendTo(notCell, isNumberCase);
>+        m_out.branch(
>+            isNumber(value), unsure(isNumberCase), unsure(straightHash));
>+
>+        m_out.appendTo(isNumberCase, straightHash);
>+        m_out.branch(
>+            isInt32(value), unsure(straightHash), unsure(slowCase));
>+
>+        m_out.appendTo(straightHash, slowCase);
>+        // key += ~(key << 32);
>+        LValue key = value;
>+        LValue temp = key;
>+        temp = m_out.shl(temp, m_out.constInt32(32));
>+        temp = m_out.bitNot(temp);
>+        key = m_out.add(key, temp);
>+        // key ^= (key >> 22);
>+        temp = key;
>+        temp = m_out.lShr(temp, m_out.constInt32(22));
>+        key = m_out.bitXor(key, temp);
>+        // key += ~(key << 13);
>+        temp = key;
>+        temp = m_out.shl(temp, m_out.constInt32(13));
>+        temp = m_out.bitNot(temp);
>+        key = m_out.add(key, temp);
>+        // key ^= (key >> 8);
>+        temp = key;
>+        temp = m_out.lShr(temp, m_out.constInt32(8));
>+        key = m_out.bitXor(key, temp);
>+        // key += (key << 3);
>+        temp = key;
>+        temp = m_out.shl(temp, m_out.constInt32(3));
>+        key = m_out.add(key, temp);
>+        // key ^= (key >> 15);
>+        temp = key;
>+        temp = m_out.lShr(temp, m_out.constInt32(15));
>+        key = m_out.bitXor(key, temp);
>+        // key += ~(key << 27);
>+        temp = key;
>+        temp = m_out.shl(temp, m_out.constInt32(27));
>+        temp = m_out.bitNot(temp);
>+        key = m_out.add(key, temp);
>+        // key ^= (key >> 31);
>+        temp = key;
>+        temp = m_out.lShr(temp, m_out.constInt32(31));
>+        key = m_out.bitXor(key, temp);
>+        key = m_out.castToInt32(key);
>+
>+        ValueFromBlock fastResult = m_out.anchor(key);
>+        m_out.jump(continuation);
>+
>+        m_out.appendTo(slowCase, continuation);
>+        ValueFromBlock slowResult = m_out.anchor(
>+            vmCall(Int32, m_out.operation(operationJSMapHash), m_callFrame, value));
>+        m_out.jump(continuation);
>+
>+        m_out.appendTo(continuation, lastNext);
>+        setInt32(m_out.phi(Int32, fastResult, slowResult));
>+    }
>+
>+    void compileIsJSMap()
>+    {
>+        if (m_node->child1().useKind() == CellUse) {
>+            LValue value = lowCell(m_node->child1());
>+            setBoolean(m_out.equal(
>+                m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoType),
>+                m_out.constInt32(JSMapType)));
>+            return;
>+        }
>+
>+        RELEASE_ASSERT(m_node->child1().useKind() == UntypedUse);
>+        LValue value = lowJSValue(m_node->child1());
>+
>+        LBasicBlock isCellCase = m_out.newBlock();
>+        LBasicBlock continuation = m_out.newBlock();
>+
>+        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
>+        m_out.branch(
>+            isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(continuation));
>+
>+        LBasicBlock lastNext = m_out.appendTo(isCellCase, continuation);
>+        ValueFromBlock cellResult = m_out.anchor(m_out.equal(
>+            m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoType),
>+            m_out.constInt32(JSMapType)));
>+        m_out.jump(continuation);
>+
>+        m_out.appendTo(continuation, lastNext);
>+        setBoolean(m_out.phi(Int32, notCellResult, cellResult));
>+    }
>+
>     void compileIsObjectOrNull()
>     {
>         JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
>Index: Source/JavaScriptCore/jit/AssemblyHelpers.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/AssemblyHelpers.cpp	(revision 204652)
>+++ Source/JavaScriptCore/jit/AssemblyHelpers.cpp	(working copy)
>@@ -626,6 +626,49 @@ void AssemblyHelpers::emitDumbVirtualCal
>         });
> }
> 
>+void AssemblyHelpers::jsMapHash(GPRReg inputAndResult, GPRReg scratch)
>+{
>+    GPRReg input = inputAndResult;
>+    // key += ~(key << 32);
>+    move(input, scratch);
>+    lshift64(TrustedImm32(32), scratch);
>+    not64(scratch);
>+    add64(scratch, input);
>+    // key ^= (key >> 22);
>+    move(input, scratch);
>+    urshift64(TrustedImm32(22), scratch);
>+    xor64(scratch, input);
>+    // key += ~(key << 13);
>+    move(input, scratch);
>+    lshift64(TrustedImm32(13), scratch);
>+    not64(scratch);
>+    add64(scratch, input);
>+    // key ^= (key >> 8);
>+    move(input, scratch);
>+    urshift64(TrustedImm32(8), scratch);
>+    xor64(scratch, input);
>+    // key += (key << 3);
>+    move(input, scratch);
>+    lshift64(TrustedImm32(3), scratch);
>+    add64(scratch, input);
>+    // key ^= (key >> 15);
>+    move(input, scratch);
>+    urshift64(TrustedImm32(15), scratch);
>+    xor64(scratch, input);
>+    // key += ~(key << 27);
>+    move(input, scratch);
>+    lshift64(TrustedImm32(27), scratch);
>+    not64(scratch);
>+    add64(scratch, input);
>+    // key ^= (key >> 31);
>+    move(input, scratch);
>+    urshift64(TrustedImm32(31), scratch);
>+    xor64(scratch, input);
>+
>+    // static_cast<unsigned>(result)
>+    and64(TrustedImm32(std::numeric_limits<uint32_t>::max()), inputAndResult);
>+}
>+
> } // namespace JSC
> 
> #endif // ENABLE(JIT)
>Index: Source/JavaScriptCore/jit/AssemblyHelpers.h
>===================================================================
>--- Source/JavaScriptCore/jit/AssemblyHelpers.h	(revision 204652)
>+++ Source/JavaScriptCore/jit/AssemblyHelpers.h	(working copy)
>@@ -61,6 +61,8 @@ public:
>             ASSERT(m_baselineCodeBlock->jitType() == JITCode::None || JITCode::isBaselineCode(m_baselineCodeBlock->jitType()));
>         }
>     }
>+
>+    void jsMapHash(GPRReg inputAndResult, GPRReg scratch);
>     
>     CodeBlock* codeBlock() { return m_codeBlock; }
>     VM* vm() { return m_vm; }
>Index: Source/JavaScriptCore/jit/JIT.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.cpp	(revision 204652)
>+++ Source/JavaScriptCore/jit/JIT.cpp	(working copy)
>@@ -263,6 +263,7 @@ void JIT::privateCompileMainPass()
>         DEFINE_OP(op_is_number)
>         DEFINE_OP(op_is_string)
>         DEFINE_OP(op_is_jsarray)
>+        DEFINE_OP(op_is_jsmap)
>         DEFINE_OP(op_is_object)
>         DEFINE_OP(op_jeq_null)
>         DEFINE_OP(op_jfalse)
>@@ -353,6 +354,7 @@ void JIT::privateCompileMainPass()
>             
>         DEFINE_OP(op_log_shadow_chicken_prologue)
>         DEFINE_OP(op_log_shadow_chicken_tail)
>+        DEFINE_OP(op_jsmap_hash)
>         default:
>             RELEASE_ASSERT_NOT_REACHED();
>         }
>Index: Source/JavaScriptCore/jit/JIT.h
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.h	(revision 204652)
>+++ Source/JavaScriptCore/jit/JIT.h	(working copy)
>@@ -525,6 +525,7 @@ namespace JSC {
>         void emit_op_is_number(Instruction*);
>         void emit_op_is_string(Instruction*);
>         void emit_op_is_jsarray(Instruction*);
>+        void emit_op_is_jsmap(Instruction*);
>         void emit_op_is_object(Instruction*);
>         void emit_op_jeq_null(Instruction*);
>         void emit_op_jfalse(Instruction*);
>@@ -607,6 +608,7 @@ namespace JSC {
>         void emit_op_to_index_string(Instruction*);
>         void emit_op_log_shadow_chicken_prologue(Instruction*);
>         void emit_op_log_shadow_chicken_tail(Instruction*);
>+        void emit_op_jsmap_hash(Instruction*);
> 
>         void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
>         void emitSlow_op_bitand(Instruction*, Vector<SlowCaseEntry>::iterator&);
>Index: Source/JavaScriptCore/jit/JITOpcodes.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes.cpp	(revision 204652)
>+++ Source/JavaScriptCore/jit/JITOpcodes.cpp	(working copy)
>@@ -278,6 +278,55 @@ void JIT::emit_op_is_jsarray(Instruction
>     emitPutVirtualRegister(dst);
> }
> 
>+void JIT::emit_op_is_jsmap(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int value = currentInstruction[2].u.operand;
>+
>+    emitGetVirtualRegister(value, regT0);
>+    Jump isNotCell = emitJumpIfNotJSCell(regT0);
>+
>+    compare8(Equal, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(JSMapType), regT0);
>+    emitTagBool(regT0);
>+    Jump done = jump();
>+
>+    isNotCell.link(this);
>+    move(TrustedImm32(ValueFalse), regT0);
>+
>+    done.link(this);
>+    emitPutVirtualRegister(dst);
>+}
>+
>+void JIT::emit_op_jsmap_hash(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int value = currentInstruction[2].u.operand;
>+
>+    JumpList straightHash;
>+    emitGetVirtualRegister(value, regT0);
>+    Jump isNotCell = emitJumpIfNotJSCell(regT0);
>+    JumpList slowPath;
>+    slowPath.append(branch8(Equal, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
>+    straightHash.append(jump());
>+
>+    isNotCell.link(this);
>+    straightHash.append(branchIfNotNumber(regT0));
>+    straightHash.append(branchIfInt32(JSValueRegs(regT0)));
>+    slowPath.append(jump());
>+
>+    straightHash.link(this);
>+
>+    jsMapHash(regT0, regT1);
>+    boxInt32(regT0, JSValueRegs(regT0));
>+    emitPutVirtualRegister(dst);
>+    Jump done = jump();
>+
>+    slowPath.link(this);
>+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_jsmap_hash);
>+    slowPathCall.call();
>+    done.link(this);
>+}
>+
> void JIT::emit_op_is_object(Instruction* currentInstruction)
> {
>     int dst = currentInstruction[1].u.operand;
>Index: Source/JavaScriptCore/llint/LLIntData.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntData.cpp	(revision 204652)
>+++ Source/JavaScriptCore/llint/LLIntData.cpp	(working copy)
>@@ -160,6 +160,7 @@ void Data::performAssertions(VM& vm)
>     STATIC_ASSERT(FinalObjectType == 21);
>     STATIC_ASSERT(JSFunctionType == 23);
>     STATIC_ASSERT(ArrayType == 29);
>+    STATIC_ASSERT(JSMapType == 117);
>     STATIC_ASSERT(Int8ArrayType == 100);
>     STATIC_ASSERT(Int16ArrayType == 101);
>     STATIC_ASSERT(Int32ArrayType == 102);
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(revision 204652)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(working copy)
>@@ -1490,7 +1490,6 @@ LLINT_SLOW_PATH_DECL(slow_path_debug)
>     LLINT_BEGIN();
>     int debugHookID = pc[1].u.operand;
>     vm.interpreter->debug(exec, static_cast<DebugHookID>(debugHookID));
>-    
>     LLINT_END();
> }
> 
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(revision 204652)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(working copy)
>@@ -1199,20 +1199,100 @@ _llint_op_is_string:
>     storeq ValueFalse, [cfr, t2, 8]
>     dispatch(3)
> 
>-
>-_llint_op_is_jsarray:
>-    traceExecution()
>+macro emitIsCertainJSType(type)
>     loadisFromInstruction(2, t1)
>     loadisFromInstruction(1, t2)
>     loadConstantOrVariable(t1, t0)
>-    btqnz t0, tagMask, .opIsJSArrayNotCell
>-    cbeq JSCell::m_type[t0], ArrayType, t1
>+    btqnz t0, tagMask, .jsTypeNotCell
>+    cbeq JSCell::m_type[t0], type, t1
>     orq ValueFalse, t1
>     storeq t1, [cfr, t2, 8]
>     dispatch(3)
>-.opIsJSArrayNotCell:
>+.jsTypeNotCell:
>     storeq ValueFalse, [cfr, t2, 8]
>     dispatch(3)
>+end
>+
>+_llint_op_is_jsarray:
>+    traceExecution()
>+    emitIsCertainJSType(ArrayType)
>+
>+
>+_llint_op_is_jsmap:
>+    traceExecution()
>+    emitIsCertainJSType(JSMapType)
>+
>+_llint_op_jsmap_hash:
>+    traceExecution()
>+    loadisFromInstruction(2, t1)
>+    loadConstantOrVariable(t1, t0)
>+    btqnz t0, tagMask, .jsMapHashNotCell
>+    bbneq JSCell::m_type[t0], StringType, .straightHash
>+    callOpcodeSlowPath(_slow_path_jsmap_hash)
>+    dispatch(3)
>+.jsMapHashNotCell:
>+    bqb t0, tagTypeNumber, .op1NotInt
>+    jmp .straightHash
>+.op1NotInt:
>+    btqz t0, tagTypeNumber, .straightHash
>+    # FIXME make double case fast
>+    callOpcodeSlowPath(_slow_path_jsmap_hash)
>+    dispatch(3)
>+.straightHash:
>+    move t0, t1
>+# key += ~(key << 32);
>+    lshiftp 32, t1
>+    notq t1
>+    addq t1, t0
>+# key ^= (key >> 22);
>+    move t0, t1
>+    urshiftp 22, t1
>+    xorq t1, t0
>+# key += ~(key << 13);
>+    move t0, t1
>+    lshiftp 13, t1
>+    notq t1
>+    addq t1, t0
>+# key ^= (key >> 8);
>+    move t0, t1
>+    urshiftp 8, t1
>+    xorq t1, t0
>+# key += (key << 3);
>+    move t0, t1
>+    lshiftp 3, t1
>+    addq t1, t0
>+# key ^= (key >> 15);
>+    move t0, t1
>+    urshiftp 15, t1
>+    xorq t1, t0
>+# key += ~(key << 27);
>+    move t0, t1
>+    lshiftp 27, t1
>+    notq t1
>+    addq t1, t0
>+# key ^= (key >> 31);
>+    move t0, t1
>+    urshiftp 31, t1
>+    xorq t1, t0
>+
>+    andq 4294967295, t0 # static_cast<unsigned>(result)
>+    orq tagTypeNumber, t0
>+    loadisFromInstruction(1, t2)
>+    storeq t0, [cfr, t2, 8]
>+    dispatch(3)
>+
>+
>+#    loadisFromInstruction(2, t1)
>+#    loadisFromInstruction(1, t2)
>+#    loadConstantOrVariable(t1, t0)
>+#    btqnz t0, tagMask, .opIsJSArrayNotCell
>+#    cbeq JSCell::m_type[t0], ArrayType, t1
>+#    orq ValueFalse, t1
>+#    storeq t1, [cfr, t2, 8]
>+#    dispatch(3)
>+#.opIsJSArrayNotCell:
>+#    storeq ValueFalse, [cfr, t2, 8]
>+#    dispatch(3)
> 
> 
> _llint_op_is_object:
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 204652)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(working copy)
>@@ -347,6 +347,7 @@ const ObjectType = 20
> const FinalObjectType = 21
> const JSFunctionType = 23
> const ArrayType = 29
>+const JSMapType = 117
> 
> # The typed array types need to be numbered in a particular order because of the manually written
> # switch statement in get_by_val and put_by_val.
>Index: Source/JavaScriptCore/offlineasm/instructions.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/instructions.rb	(revision 204652)
>+++ Source/JavaScriptCore/offlineasm/instructions.rb	(working copy)
>@@ -41,6 +41,7 @@ MACRO_INSTRUCTIONS =
>      "negp",
>      "negq",
>      "noti",
>+     "notq",
>      "ori",
>      "rshifti",
>      "urshifti",
>Index: Source/JavaScriptCore/offlineasm/x86.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/x86.rb	(revision 204652)
>+++ Source/JavaScriptCore/offlineasm/x86.rb	(working copy)
>@@ -901,6 +901,8 @@ class Instruction
>             $asm.puts "neg#{x86Suffix(:quad)} #{x86Operands(:quad)}"
>         when "noti"
>             $asm.puts "not#{x86Suffix(:int)} #{x86Operands(:int)}"
>+        when "notq"
>+            $asm.puts "not#{x86Suffix(:quad)} #{x86Operands(:quad)}"
>         when "ori"
>             handleX86Op("or#{x86Suffix(:int)}", :int)
>         when "orp"
>Index: Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/CommonSlowPaths.cpp	(revision 204652)
>+++ Source/JavaScriptCore/runtime/CommonSlowPaths.cpp	(working copy)
>@@ -46,6 +46,7 @@
> #include "JSCJSValue.h"
> #include "JSGlobalObjectFunctions.h"
> #include "JSLexicalEnvironment.h"
>+#include "JSMap.h"
> #include "JSPropertyNameEnumerator.h"
> #include "JSString.h"
> #include "JSWithScope.h"
>@@ -933,4 +934,11 @@ SLOW_PATH_DECL(slow_path_put_by_val_with
>     END();
> }
> 
>+SLOW_PATH_DECL(slow_path_jsmap_hash)
>+{
>+    BEGIN();
>+    JSValue valueToHash = OP_C(2).jsValue();
>+    RETURN(jsMapHash(exec, valueToHash));
>+}
>+
> } // namespace JSC
>Index: Source/JavaScriptCore/runtime/CommonSlowPaths.h
>===================================================================
>--- Source/JavaScriptCore/runtime/CommonSlowPaths.h	(revision 204652)
>+++ Source/JavaScriptCore/runtime/CommonSlowPaths.h	(working copy)
>@@ -258,6 +258,7 @@ SLOW_PATH_HIDDEN_DECL(slow_path_get_by_i
> SLOW_PATH_HIDDEN_DECL(slow_path_get_by_val_with_this);
> SLOW_PATH_HIDDEN_DECL(slow_path_put_by_id_with_this);
> SLOW_PATH_HIDDEN_DECL(slow_path_put_by_val_with_this);
>+SLOW_PATH_HIDDEN_DECL(slow_path_jsmap_hash);
> 
> } // namespace JSC
> 
>Index: Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObject.cpp	(revision 204652)
>+++ Source/JavaScriptCore/runtime/JSGlobalObject.cpp	(working copy)
>@@ -725,7 +725,6 @@ putDirectWithoutTransition(vm, vm.proper
>         GlobalPropertyInfo(vm.propertyNames->builtinNames().isSetPrivateName(), JSFunction::create(vm, this, 1, String(), privateFuncIsSet), DontEnum | DontDelete | ReadOnly),
>         GlobalPropertyInfo(vm.propertyNames->builtinNames().SetIteratorPrivateName(), JSFunction::create(vm, this, 1, String(), privateFuncSetIterator), DontEnum | DontDelete | ReadOnly),
>         GlobalPropertyInfo(vm.propertyNames->builtinNames().setIteratorNextPrivateName(), JSFunction::create(vm, this, 0, String(), privateFuncSetIteratorNext), DontEnum | DontDelete | ReadOnly),
>-        GlobalPropertyInfo(vm.propertyNames->builtinNames().isMapPrivateName(), JSFunction::create(vm, this, 1, String(), privateFuncIsMap), DontEnum | DontDelete | ReadOnly),
>         GlobalPropertyInfo(vm.propertyNames->builtinNames().isArrayPrivateName(), arrayConstructor->getDirect(vm, vm.propertyNames->isArray), DontEnum | DontDelete | ReadOnly),
>         GlobalPropertyInfo(vm.propertyNames->builtinNames().isArrayConstructorPrivateName(), privateFuncIsArrayConstructor, DontEnum | DontDelete | ReadOnly),
>         GlobalPropertyInfo(vm.propertyNames->builtinNames().concatMemcpyPrivateName(), privateFuncConcatMemcpy, DontEnum | DontDelete | ReadOnly),
>Index: Source/JavaScriptCore/runtime/JSMap.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSMap.cpp	(revision 204652)
>+++ Source/JavaScriptCore/runtime/JSMap.cpp	(working copy)
>@@ -26,10 +26,15 @@
> #include "config.h"
> #include "JSMap.h"
> 
>+#include "BuiltinNames.h"
>+#include "CommonIdentifiers.h"
> #include "CopiedBlockInlines.h"
>+#include "IdentifierInlines.h"
> #include "JSCJSValueInlines.h"
>+#include "JSArray.h"
> #include "JSMapIterator.h"
> #include "MapDataInlines.h"
>+#include "ObjectConstructor.h"
> #include "SlotVisitorInlines.h"
> #include "StructureInlines.h"
> 
>@@ -37,6 +42,46 @@ namespace JSC {
> 
> const ClassInfo JSMap::s_info = { "Map", &Base::s_info, 0, CREATE_METHOD_TABLE(JSMap) };
> 
>+void JSMap::finishCreation(VM& vm, JSGlobalObject* globalObject)
>+{
>+    Base::finishCreation(vm);
>+
>+    static_assert(BASE_VECTOR_LEN == 4, "assumed here to be a power of 2");
>+    JSArray* array = JSArray::create(vm, globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous), BASE_VECTOR_LEN);
>+    RELEASE_ASSERT(array);
>+    RELEASE_ASSERT(array->length() == BASE_VECTOR_LEN);
>+
>+    for (unsigned i = 0; i < BASE_VECTOR_LEN; i++)
>+        array->putByIndexInline(globalObject->globalExec(), i, jsUndefined(), false);
>+
>+    JSObject* head = constructEmptyObject(globalObject->globalExec());
>+    JSObject* tail = constructEmptyObject(globalObject->globalExec());
>+    auto makeShape = [&] (JSObject* obj, JSValue listNext, JSValue listPrev) {
>+        /*
>+        listNext: mapTail,
>+        listPrev: mapTail.listPrev,
>+        key: key,
>+        value: value,
>+        deleted: false
>+        */
>+
>+        obj->putDirect(vm, Identifier::fromString(&vm, "listNext"), listNext, 0);
>+        obj->putDirect(vm, Identifier::fromString(&vm, "listPrev"), listPrev, 0);
>+        obj->putDirect(vm, Identifier::fromString(&vm, "key"), jsNull(), 0);
>+        obj->putDirect(vm, Identifier::fromString(&vm, "value"), jsNull(), 0);
>+        obj->putDirect(vm, Identifier::fromString(&vm, "deleted"), jsBoolean(true), 0);
>+        
>+    };
>+
>+    makeShape(head, tail, jsNull());
>+    makeShape(tail, jsNull(), head);
>+
>+    putDirect(vm, vm.propertyNames->builtinNames().mapHeadPrivateName(), head, DontEnum);
>+    putDirect(vm, vm.propertyNames->builtinNames().mapTailPrivateName(), tail, DontEnum);
>+    putDirect(vm, vm.propertyNames->builtinNames().mapTablePrivateName(), array, DontEnum);
>+    putDirect(vm, vm.propertyNames->builtinNames().mapSizePrivateName(), jsNumber(0), DontEnum);
>+}
>+
> void JSMap::destroy(JSCell* cell)
> {
>     JSMap* thisObject = jsCast<JSMap*>(cell);
>Index: Source/JavaScriptCore/runtime/JSMap.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSMap.h	(revision 204652)
>+++ Source/JavaScriptCore/runtime/JSMap.h	(working copy)
>@@ -92,16 +92,18 @@ public:
> 
>     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
>     {
>-        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
>+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSMapType, StructureFlags), info());
>     }
> 
>     static JSMap* create(VM& vm, Structure* structure)
>     {
>         JSMap* instance = new (NotNull, allocateCell<JSMap>(vm.heap)) JSMap(vm, structure);
>-        instance->finishCreation(vm);
>+        instance->finishCreation(vm, structure->globalObject());
>         return instance;
>     }
> 
>+    JS_EXPORT_PRIVATE void finishCreation(VM&, JSGlobalObject*);
>+
>     static JSMap* create(ExecState* exec, Structure* structure)
>     {
>         return create(exec->vm(), structure);
>@@ -129,6 +131,27 @@ private:
>     MapData m_mapData;
> };
> 
>+ALWAYS_INLINE JSValue jsMapHash(ExecState* exec, JSValue value)
>+{
>+    if (value.isDouble()) {
>+        double d = value.asDouble();
>+        if (!std::isnan(d)) {
>+            int i = static_cast<int>(d);
>+            if (i == d)
>+                value = jsNumber(i);
>+        }
>+    }
>+    if (value.isString()) {
>+        JSString* string = asString(value);
>+        const String& wtfString = string->value(exec);
>+        if (exec->hadException())
>+            return JSValue();
>+        return JSValue(wtfString.impl()->hash());
>+    }
>+    uint64_t rawValue = JSValue::encode(value);
>+    return JSValue(WTF::intHash(rawValue));
>+}
>+
> }
> 
> #endif // !defined(JSMap_h)
>Index: Source/JavaScriptCore/runtime/JSMapIterator.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSMapIterator.cpp	(revision 204652)
>+++ Source/JavaScriptCore/runtime/JSMapIterator.cpp	(working copy)
>@@ -26,6 +26,9 @@
> #include "config.h"
> #include "JSMapIterator.h"
> 
>+#include "BuiltinNames.h"
>+#include "CommonIdentifiers.h"
>+#include "IdentifierInlines.h"
> #include "JSCJSValueInlines.h"
> #include "JSCellInlines.h"
> #include "JSMap.h"
>@@ -41,6 +44,9 @@ void JSMapIterator::finishCreation(VM& v
> {
>     Base::finishCreation(vm);
>     m_map.set(vm, this, iteratedObject);
>+    JSObject* listHead = jsCast<JSObject*>(iteratedObject->getDirect(vm, vm.propertyNames->builtinNames().mapHeadPrivateName()));
>+    putDirect(vm, vm.propertyNames->builtinNames().mapBucketPrivateName(), listHead, DontEnum);
>+    putDirect(vm, vm.propertyNames->builtinNames().mapIterationKindPrivateName(), jsNumber(static_cast<uint32_t>(m_kind)), DontEnum);
> }
> 
> void JSMapIterator::visitChildren(JSCell* cell, SlotVisitor& visitor)
>Index: Source/JavaScriptCore/runtime/JSType.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSType.h	(revision 204652)
>+++ Source/JavaScriptCore/runtime/JSType.h	(working copy)
>@@ -82,8 +82,9 @@ enum JSType : uint8_t {
>     ModuleEnvironmentType,
>     RegExpObjectType,
>     ProxyObjectType,
>+    JSMapType,
> 
>-    LastJSCObjectType = ProxyObjectType,
>+    LastJSCObjectType = JSMapType,
> };
> 
> COMPILE_ASSERT(sizeof(JSType) == sizeof(uint8_t), sizeof_jstype_is_one_byte);
>Index: Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp	(revision 204652)
>+++ Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp	(working copy)
>@@ -32,34 +32,44 @@
> #include "JSMapIterator.h"
> #include "StructureInlines.h"
> 
>+#include "MapIteratorPrototype.lut.h"
>+
>+/* Source for MapIteratorPrototype.lut.h
>+@begin mapIteratorPrototypeTable
>+  next      JSBuiltin  DontEnum|Function 0
>+@end
>+*/
>+
> namespace JSC {
> 
>-const ClassInfo MapIteratorPrototype::s_info = { "Map Iterator", &Base::s_info, 0, CREATE_METHOD_TABLE(MapIteratorPrototype) };
>+const ClassInfo MapIteratorPrototype::s_info = { "Map Iterator", &Base::s_info, &mapIteratorPrototypeTable, CREATE_METHOD_TABLE(MapIteratorPrototype) };
> 
>-static EncodedJSValue JSC_HOST_CALL MapIteratorPrototypeFuncNext(ExecState*);
>+//static EncodedJSValue JSC_HOST_CALL MapIteratorPrototypeFuncNext(ExecState*);
> 
> void MapIteratorPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
> {
>+    UNUSED_PARAM(globalObject);
>+
>     Base::finishCreation(vm);
>     ASSERT(inherits(info()));
>     vm.prototypeMap.addPrototype(this);
> 
>-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->next, MapIteratorPrototypeFuncNext, DontEnum, 0);
>+    //JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->next, MapIteratorPrototypeFuncNext, DontEnum, 0);
>     putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Map Iterator"), DontEnum | ReadOnly);
> }
> 
>-EncodedJSValue JSC_HOST_CALL MapIteratorPrototypeFuncNext(CallFrame* callFrame)
>-{
>-    JSMapIterator* iterator = jsDynamicCast<JSMapIterator*>(callFrame->thisValue());
>-    if (!iterator)
>-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral("Cannot call MapIterator.next() on a non-MapIterator object")));
>-
>-    JSValue result;
>-    if (iterator->next(callFrame, result))
>-        return JSValue::encode(createIteratorResultObject(callFrame, result, false));
>-    iterator->finish();
>-    return JSValue::encode(createIteratorResultObject(callFrame, jsUndefined(), true));
>-}
>+//EncodedJSValue JSC_HOST_CALL MapIteratorPrototypeFuncNext(CallFrame* callFrame)
>+//{
>+//    JSMapIterator* iterator = jsDynamicCast<JSMapIterator*>(callFrame->thisValue());
>+//    if (!iterator)
>+//        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral("Cannot call MapIterator.next() on a non-MapIterator object")));
>+//
>+//    JSValue result;
>+//    if (iterator->next(callFrame, result))
>+//        return JSValue::encode(createIteratorResultObject(callFrame, result, false));
>+//    iterator->finish();
>+//    return JSValue::encode(createIteratorResultObject(callFrame, jsUndefined(), true));
>+//}
> 
> 
> }
>Index: Source/JavaScriptCore/runtime/MapIteratorPrototype.h
>===================================================================
>--- Source/JavaScriptCore/runtime/MapIteratorPrototype.h	(revision 204652)
>+++ Source/JavaScriptCore/runtime/MapIteratorPrototype.h	(working copy)
>@@ -34,6 +34,8 @@ class MapIteratorPrototype : public JSNo
> public:
>     typedef JSNonFinalObject Base;
> 
>+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
>+
>     static MapIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
>     {
>         MapIteratorPrototype* prototype = new (NotNull, allocateCell<MapIteratorPrototype>(vm.heap)) MapIteratorPrototype(vm, structure);
>Index: Source/JavaScriptCore/runtime/MapPrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/MapPrototype.cpp	(revision 204652)
>+++ Source/JavaScriptCore/runtime/MapPrototype.cpp	(working copy)
>@@ -48,14 +48,20 @@ const ClassInfo MapPrototype::s_info = {
> /* Source for MapPrototype.lut.h
> @begin mapPrototypeTable
>   forEach   JSBuiltin  DontEnum|Function 0
>+  get       JSBuiltin  DontEnum|Function 1
>+  set       JSBuiltin  DontEnum|Function 2
>+  delete    JSBuiltin  DontEnum|Function 1
>+  has       JSBuiltin  DontEnum|Function 1
>+  clear     JSBuiltin  DontEnum|Function 0
>+  listAsArray       JSBuiltin  DontEnum|Function 0
> @end
> */
> 
>-static EncodedJSValue JSC_HOST_CALL mapProtoFuncClear(ExecState*);
>-static EncodedJSValue JSC_HOST_CALL mapProtoFuncDelete(ExecState*);
>-static EncodedJSValue JSC_HOST_CALL mapProtoFuncGet(ExecState*);
>-static EncodedJSValue JSC_HOST_CALL mapProtoFuncHas(ExecState*);
>-static EncodedJSValue JSC_HOST_CALL mapProtoFuncSet(ExecState*);
>+//static EncodedJSValue JSC_HOST_CALL mapProtoFuncClear(ExecState*);
>+//static EncodedJSValue JSC_HOST_CALL mapProtoFuncDelete(ExecState*);
>+//static EncodedJSValue JSC_HOST_CALL mapProtoFuncGet(ExecState*);
>+//static EncodedJSValue JSC_HOST_CALL mapProtoFuncHas(ExecState*);
>+//static EncodedJSValue JSC_HOST_CALL mapProtoFuncSet(ExecState*);
> static EncodedJSValue JSC_HOST_CALL mapProtoFuncKeys(ExecState*);
> static EncodedJSValue JSC_HOST_CALL mapProtoFuncValues(ExecState*);
> static EncodedJSValue JSC_HOST_CALL mapProtoFuncEntries(ExecState*);
>@@ -68,17 +74,18 @@ void MapPrototype::finishCreation(VM& vm
>     ASSERT(inherits(info()));
>     vm.prototypeMap.addPrototype(this);
> 
>-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, mapProtoFuncClear, DontEnum, 0);
>-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, mapProtoFuncDelete, DontEnum, 1);
>-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->get, mapProtoFuncGet, DontEnum, 1);
>-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, mapProtoFuncHas, DontEnum, 1);
>-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->set, mapProtoFuncSet, DontEnum, 2);
>+    //JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, mapProtoFuncClear, DontEnum, 0);
>+    //JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, mapProtoFuncDelete, DontEnum, 1);
>+    //JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->get, mapProtoFuncGet, DontEnum, 1);
>+    //JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, mapProtoFuncHas, DontEnum, 1);
>+    //JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->set, mapProtoFuncSet, DontEnum, 2);
>     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().keysPublicName(), mapProtoFuncKeys, DontEnum, 0);
>     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().valuesPublicName(), mapProtoFuncValues, DontEnum, 0);
> 
>-    // Private get / set operations.
>-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getPrivateName(), mapProtoFuncGet, DontEnum, 1);
>-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().setPrivateName(), mapProtoFuncSet, DontEnum, 2);
>+    JSFunction* getFunction = JSFunction::createBuiltinFunction(vm, mapPrototypeGetCodeGenerator(vm), globalObject, "get");
>+    JSFunction* setFunction = JSFunction::createBuiltinFunction(vm, mapPrototypeSetCodeGenerator(vm), globalObject, "set");
>+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().getPrivateName(), getFunction, DontEnum);
>+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().setPrivateName(), setFunction, DontEnum);
> 
>     JSFunction* entries = JSFunction::create(vm, globalObject, 0, vm.propertyNames->builtinNames().entriesPublicName().string(), mapProtoFuncEntries);
>     putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().entriesPublicName(), entries, DontEnum);
>@@ -102,55 +109,60 @@ ALWAYS_INLINE static JSMap* getMap(CallF
>     return map;
> }
> 
>-EncodedJSValue JSC_HOST_CALL mapProtoFuncClear(CallFrame* callFrame)
>-{
>-    JSMap* map = getMap(callFrame, callFrame->thisValue());
>-    if (!map)
>-        return JSValue::encode(jsUndefined());
>-    map->clear(callFrame);
>-    return JSValue::encode(jsUndefined());
>-}
>-
>-EncodedJSValue JSC_HOST_CALL mapProtoFuncDelete(CallFrame* callFrame)
>-{
>-    JSMap* map = getMap(callFrame, callFrame->thisValue());
>-    if (!map)
>-        return JSValue::encode(jsUndefined());
>-    return JSValue::encode(jsBoolean(map->remove(callFrame, callFrame->argument(0))));
>-}
>-
>-EncodedJSValue JSC_HOST_CALL mapProtoFuncGet(CallFrame* callFrame)
>-{
>-    JSMap* map = getMap(callFrame, callFrame->thisValue());
>-    if (!map)
>-        return JSValue::encode(jsUndefined());
>-    return JSValue::encode(map->get(callFrame, callFrame->argument(0)));
>-}
>-
>-EncodedJSValue JSC_HOST_CALL mapProtoFuncHas(CallFrame* callFrame)
>-{
>-    JSMap* map = getMap(callFrame, callFrame->thisValue());
>-    if (!map)
>-        return JSValue::encode(jsUndefined());
>-    return JSValue::encode(jsBoolean(map->has(callFrame, callFrame->argument(0))));
>-}
>-
>-EncodedJSValue JSC_HOST_CALL mapProtoFuncSet(CallFrame* callFrame)
>-{
>-    JSValue thisValue = callFrame->thisValue();
>-    JSMap* map = getMap(callFrame, thisValue);
>-    if (!map)
>-        return JSValue::encode(jsUndefined());
>-    map->set(callFrame, callFrame->argument(0), callFrame->argument(1));
>-    return JSValue::encode(thisValue);
>-}
>+//EncodedJSValue JSC_HOST_CALL mapProtoFuncClear(CallFrame* callFrame)
>+//{
>+//    JSMap* map = getMap(callFrame, callFrame->thisValue());
>+//    if (!map)
>+//        return JSValue::encode(jsUndefined());
>+//    map->clear(callFrame);
>+//    return JSValue::encode(jsUndefined());
>+//}
>+
>+//EncodedJSValue JSC_HOST_CALL mapProtoFuncDelete(CallFrame* callFrame)
>+//{
>+//    JSMap* map = getMap(callFrame, callFrame->thisValue());
>+//    if (!map)
>+//        return JSValue::encode(jsUndefined());
>+//    return JSValue::encode(jsBoolean(map->remove(callFrame, callFrame->argument(0))));
>+//}
>+
>+//EncodedJSValue JSC_HOST_CALL mapProtoFuncGet(CallFrame* callFrame)
>+//{
>+//    JSMap* map = getMap(callFrame, callFrame->thisValue());
>+//    if (!map)
>+//        return JSValue::encode(jsUndefined());
>+//    return JSValue::encode(map->get(callFrame, callFrame->argument(0)));
>+//}
>+
>+//EncodedJSValue JSC_HOST_CALL mapProtoFuncHas(CallFrame* callFrame)
>+//{
>+//    JSMap* map = getMap(callFrame, callFrame->thisValue());
>+//    if (!map)
>+//        return JSValue::encode(jsUndefined());
>+//    return JSValue::encode(jsBoolean(map->has(callFrame, callFrame->argument(0))));
>+//}
>+
>+//EncodedJSValue JSC_HOST_CALL mapProtoFuncSet(CallFrame* callFrame)
>+//{
>+//    JSValue thisValue = callFrame->thisValue();
>+//    JSMap* map = getMap(callFrame, thisValue);
>+//    if (!map)
>+//        return JSValue::encode(jsUndefined());
>+//    map->set(callFrame, callFrame->argument(0), callFrame->argument(1));
>+//    return JSValue::encode(thisValue);
>+//}
> 
> EncodedJSValue JSC_HOST_CALL mapProtoFuncSize(CallFrame* callFrame)
> {
>     JSMap* map = getMap(callFrame, callFrame->thisValue());
>     if (!map)
>         return JSValue::encode(jsUndefined());
>-    return JSValue::encode(jsNumber(map->size(callFrame)));
>+    VM& vm = callFrame->vm();
>+    JSValue mapSize = map->getDirect(vm, vm.propertyNames->builtinNames().mapSizePrivateName());
>+    JSValue deleteCount = map->getDirect(vm, vm.propertyNames->builtinNames().mapDeleteCountPrivateName());
>+    ASSERT(mapSize.asUInt32() >= deleteCount.asUInt32());
>+    unsigned numElements = mapSize.asUInt32() - deleteCount.asUInt32();
>+    return JSValue::encode(jsNumber(numElements));
> }
> 
> EncodedJSValue JSC_HOST_CALL mapProtoFuncValues(CallFrame* callFrame)
>@@ -177,11 +189,6 @@ EncodedJSValue JSC_HOST_CALL mapProtoFun
>     return JSValue::encode(JSMapIterator::create(callFrame->vm(), callFrame->callee()->globalObject()->mapIteratorStructure(), thisObj, IterateKey));
> }
> 
>-EncodedJSValue JSC_HOST_CALL privateFuncIsMap(ExecState* exec)
>-{
>-    return JSValue::encode(jsBoolean(jsDynamicCast<JSMap*>(exec->uncheckedArgument(0))));
>-}
>-
> EncodedJSValue JSC_HOST_CALL privateFuncMapIterator(ExecState* exec)
> {
>     ASSERT(jsDynamicCast<JSMap*>(exec->uncheckedArgument(0)));
>Index: Source/JavaScriptCore/runtime/MapPrototype.h
>===================================================================
>--- Source/JavaScriptCore/runtime/MapPrototype.h	(revision 204652)
>+++ Source/JavaScriptCore/runtime/MapPrototype.h	(working copy)
>@@ -58,7 +58,6 @@ private:
>     void finishCreation(VM&, JSGlobalObject*);
> };
> 
>-EncodedJSValue JSC_HOST_CALL privateFuncIsMap(ExecState*);
> EncodedJSValue JSC_HOST_CALL privateFuncMapIterator(ExecState*);
> EncodedJSValue JSC_HOST_CALL privateFuncMapIteratorNext(ExecState*);
>

Actions: View | Formatted Diff | Diff

Attachments on bug 160989: 286435 | 286517 | 286940 | 286953 | 287064 | 287143 | 287367 | 287466 | 287475 | 287592 | 287687 | 287700 | 287702 | 287714 | 287782 | 287802 | 287803 | 288038 | 288041 | 288057