Attachment 359196 Details for Bug 190906 – patch for landing

[patch] patch for landing

b-backup.diff (text/plain), 174.09 KB, created by Saam Barati on 2019-01-15 13:08:44 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2019-01-15 13:08:44 PST

Size: 174.09 KB

patch

obsolete

>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 239969)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,119 @@
>+2019-01-14  Saam Barati  <sbarati@apple.com>
>+
>+        Try ripping out inferred types because it might be a performance improvement
>+        https://bugs.webkit.org/show_bug.cgi?id=190906
>+
>+        Reviewed by Yusuke Suzuki.
>+	
>+        This patch removes inferred types from JSC. Initial evidence shows that
>+        this might be around a ~1% speedup on Speedometer2 and JetStream2.
>+
>+        * JavaScriptCore.xcodeproj/project.pbxproj:
>+        * Sources.txt:
>+        * bytecode/AccessCase.cpp:
>+        (JSC::AccessCase::generateImpl):
>+        * bytecode/Fits.h:
>+        * bytecode/PutByIdFlags.cpp:
>+        (WTF::printInternal):
>+        * bytecode/PutByIdFlags.h:
>+        * bytecode/PutByIdStatus.cpp:
>+        (JSC::PutByIdStatus::computeFromLLInt):
>+        (JSC::PutByIdStatus::computeForStubInfo):
>+        (JSC::PutByIdStatus::computeFor):
>+        * bytecode/PutByIdVariant.cpp:
>+        (JSC::PutByIdVariant::operator=):
>+        (JSC::PutByIdVariant::replace):
>+        (JSC::PutByIdVariant::transition):
>+        (JSC::PutByIdVariant::setter):
>+        (JSC::PutByIdVariant::attemptToMerge):
>+        (JSC::PutByIdVariant::dumpInContext const):
>+        * bytecode/PutByIdVariant.h:
>+        (JSC::PutByIdVariant::requiredType const): Deleted.
>+        * dfg/DFGAbstractInterpreterInlines.h:
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
>+        * dfg/DFGAbstractValue.cpp:
>+        (JSC::DFG::AbstractValue::isType const): Deleted.
>+        * dfg/DFGAbstractValue.h:
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
>+        (JSC::DFG::ByteCodeParser::handlePutByOffset):
>+        (JSC::DFG::ByteCodeParser::load):
>+        (JSC::DFG::ByteCodeParser::store):
>+        (JSC::DFG::ByteCodeParser::handlePutById):
>+        (JSC::DFG::ByteCodeParser::parseBlock):
>+        * dfg/DFGConstantFoldingPhase.cpp:
>+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
>+        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
>+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
>+        * dfg/DFGDesiredInferredType.h: Removed.
>+        * dfg/DFGDesiredWatchpoints.cpp:
>+        (JSC::DFG::DesiredWatchpoints::reallyAdd):
>+        (JSC::DFG::DesiredWatchpoints::areStillValid const):
>+        (JSC::DFG::DesiredWatchpoints::dumpInContext const):
>+        (JSC::DFG::InferredTypeAdaptor::add): Deleted.
>+        * dfg/DFGDesiredWatchpoints.h:
>+        (JSC::DFG::DesiredWatchpoints::isWatched):
>+        (JSC::DFG::InferredTypeAdaptor::hasBeenInvalidated): Deleted.
>+        (JSC::DFG::InferredTypeAdaptor::dumpInContext): Deleted.
>+        * dfg/DFGFixupPhase.cpp:
>+        (JSC::DFG::FixupPhase::fixupNode):
>+        * dfg/DFGGraph.cpp:
>+        (JSC::DFG::Graph::dump):
>+        (JSC::DFG::Graph::inferredValueForProperty):
>+        (JSC::DFG::Graph::inferredTypeFor): Deleted.
>+        * dfg/DFGGraph.h:
>+        (JSC::DFG::Graph::registerInferredType): Deleted.
>+        (JSC::DFG::Graph::inferredTypeForProperty): Deleted.
>+        * dfg/DFGInferredTypeCheck.cpp: Removed.
>+        * dfg/DFGInferredTypeCheck.h: Removed.
>+        * dfg/DFGNode.h:
>+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
>+        * dfg/DFGSafeToExecute.h:
>+        (JSC::DFG::safeToExecute):
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
>+        (JSC::FTL::DFG::LowerDFGToB3::checkInferredType): Deleted.
>+        * generator/DSL.rb:
>+        * heap/Heap.cpp:
>+        (JSC::Heap::finalizeUnconditionalFinalizers):
>+        * jit/AssemblyHelpers.cpp:
>+        (JSC::AssemblyHelpers::branchIfNotType): Deleted.
>+        * jit/AssemblyHelpers.h:
>+        * jit/Repatch.cpp:
>+        (JSC::tryCachePutByID):
>+        * llint/LLIntOffsetsExtractor.cpp:
>+        * llint/LLIntSlowPaths.cpp:
>+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
>+        * llint/LowLevelInterpreter.asm:
>+        * llint/LowLevelInterpreter32_64.asm:
>+        * llint/LowLevelInterpreter64.asm:
>+        * runtime/InferredStructure.cpp:
>+        (JSC::InferredStructure::InferredStructure): Deleted.
>+        * runtime/InferredStructure.h:
>+        (): Deleted.
>+        * runtime/InferredStructureWatchpoint.cpp:
>+        (JSC::InferredStructureWatchpoint::fireInternal): Deleted.
>+        * runtime/InferredType.cpp: Removed.
>+        * runtime/InferredType.h: Removed.
>+        * runtime/InferredTypeInlines.h: Removed.
>+        * runtime/InferredTypeTable.cpp: Removed.
>+        * runtime/InferredTypeTable.h: Removed.
>+        * runtime/JSObjectInlines.h:
>+        (JSC::JSObject::putDirectInternal):
>+        * runtime/Structure.cpp:
>+        (JSC::Structure::materializePropertyTable):
>+        (JSC::Structure::addNewPropertyTransition):
>+        (JSC::Structure::removePropertyTransition):
>+        (JSC::Structure::willStoreValueSlow):
>+        (JSC::Structure::visitChildren):
>+        * runtime/Structure.h:
>+        (JSC::PropertyMapEntry::PropertyMapEntry):
>+        * runtime/StructureInlines.h:
>+        (JSC::Structure::get):
>+        * runtime/VM.cpp:
>+        (JSC::VM::VM):
>+        * runtime/VM.h:
>+
> 2019-01-14  Michael Saboff  <msaboff@apple.com>
> 
>         Add option to JSC to dump memory footprint on script completion
>Index: Source/JavaScriptCore/CMakeLists.txt
>===================================================================
>--- Source/JavaScriptCore/CMakeLists.txt	(revision 239966)
>+++ Source/JavaScriptCore/CMakeLists.txt	(working copy)
>@@ -793,10 +793,6 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEA
>     runtime/IndexingHeader.h
>     runtime/IndexingHeaderInlines.h
>     runtime/IndexingType.h
>-    runtime/InferredStructure.h
>-    runtime/InferredStructureWatchpoint.h
>-    runtime/InferredType.h
>-    runtime/InferredTypeTable.h
>     runtime/InferredValue.h
>     runtime/InitializeThreading.h
>     runtime/Int16Array.h
>Index: Source/JavaScriptCore/Sources.txt
>===================================================================
>--- Source/JavaScriptCore/Sources.txt	(revision 239966)
>+++ Source/JavaScriptCore/Sources.txt	(working copy)
>@@ -344,7 +344,6 @@ dfg/DFGGraph.cpp
> dfg/DFGGraphSafepoint.cpp
> dfg/DFGHeapLocation.cpp
> dfg/DFGInPlaceAbstractState.cpp
>-dfg/DFGInferredTypeCheck.cpp
> dfg/DFGInsertionSet.cpp
> dfg/DFGIntegerCheckCombiningPhase.cpp
> dfg/DFGIntegerRangeOptimizationPhase.cpp
>@@ -768,10 +767,6 @@ runtime/HashMapImpl.cpp
> runtime/Identifier.cpp
> runtime/IndexingType.cpp
> runtime/IndirectEvalExecutable.cpp
>-runtime/InferredStructure.cpp
>-runtime/InferredStructureWatchpoint.cpp
>-runtime/InferredType.cpp
>-runtime/InferredTypeTable.cpp
> runtime/InferredValue.cpp
> runtime/InitializeThreading.cpp
> runtime/InspectorInstrumentationObject.cpp
>Index: Source/JavaScriptCore/UnifiedSources-input.xcfilelist
>===================================================================
>--- Source/JavaScriptCore/UnifiedSources-input.xcfilelist	(revision 239966)
>+++ Source/JavaScriptCore/UnifiedSources-input.xcfilelist	(working copy)
>@@ -323,7 +323,6 @@ $(SRCROOT)/dfg/DFGGraph.cpp
> $(SRCROOT)/dfg/DFGGraphSafepoint.cpp
> $(SRCROOT)/dfg/DFGHeapLocation.cpp
> $(SRCROOT)/dfg/DFGInPlaceAbstractState.cpp
>-$(SRCROOT)/dfg/DFGInferredTypeCheck.cpp
> $(SRCROOT)/dfg/DFGInsertionSet.cpp
> $(SRCROOT)/dfg/DFGIntegerCheckCombiningPhase.cpp
> $(SRCROOT)/dfg/DFGIntegerRangeOptimizationPhase.cpp
>@@ -732,10 +731,6 @@ $(SRCROOT)/runtime/HashMapImpl.cpp
> $(SRCROOT)/runtime/Identifier.cpp
> $(SRCROOT)/runtime/IndexingType.cpp
> $(SRCROOT)/runtime/IndirectEvalExecutable.cpp
>-$(SRCROOT)/runtime/InferredStructure.cpp
>-$(SRCROOT)/runtime/InferredStructureWatchpoint.cpp
>-$(SRCROOT)/runtime/InferredType.cpp
>-$(SRCROOT)/runtime/InferredTypeTable.cpp
> $(SRCROOT)/runtime/InferredValue.cpp
> $(SRCROOT)/runtime/InitializeThreading.cpp
> $(SRCROOT)/runtime/InspectorInstrumentationObject.cpp
>Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(revision 239966)
>+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(working copy)
>@@ -113,7 +113,6 @@
> 		0F070A491D543A93006E7232 /* HeapCellInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F070A441D543A89006E7232 /* HeapCellInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F070A4B1D543A98006E7232 /* LargeAllocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F070A461D543A89006E7232 /* LargeAllocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0776BD14FF002800102332 /* JITCompilationEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };
>-		0F0A75231B94BFA900110660 /* InferredType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0A75211B94BFA900110660 /* InferredType.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F0B286B1EB8E6CF000EB5D2 /* JSWeakPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B286A1EB8E6CD000EB5D2 /* JSWeakPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F0B286D1EB8E6D5000EB5D2 /* JSMarkingConstraintPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B28681EB8E6CD000EB5D2 /* JSMarkingConstraintPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B839814BCF45A00885B4F /* LLIntThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -508,7 +507,6 @@
> 		0FB4677F1FDDA6E9003FCB09 /* AtomIndices.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4677E1FDDA6E5003FCB09 /* AtomIndices.h */; };
> 		0FB467801FDDA6F1003FCB09 /* IsoCellSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4677D1FDDA6D9003FCB09 /* IsoCellSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0FB467811FDDA6F7003FCB09 /* IsoCellSetInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4677B1FDDA6D8003FCB09 /* IsoCellSetInlines.h */; };
>-		0FB467851FDFB454003FCB09 /* InferredTypeInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB467841FDFB452003FCB09 /* InferredTypeInlines.h */; };
> 		0FB4767E1D99AEA9008EA6CB /* GCDeferralContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4767C1D99AEA7008EA6CB /* GCDeferralContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0FB4767F1D99AEAD008EA6CB /* GCDeferralContextInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4767D1D99AEA7008EA6CB /* GCDeferralContextInlines.h */; };
> 		0FB4FB741BC843140025CA5A /* FTLLazySlowPath.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4FB711BC843140025CA5A /* FTLLazySlowPath.h */; };
>@@ -534,8 +532,6 @@
> 		0FBE0F7516C1DB0B0082C5E8 /* DFGPredictionInjectionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBE0F6E16C1DB010082C5E8 /* DFGPredictionInjectionPhase.h */; };
> 		0FBE0F7716C1DB120082C5E8 /* DFGUnificationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBE0F7016C1DB010082C5E8 /* DFGUnificationPhase.h */; };
> 		0FBF158D19B7A53100695DD0 /* DFGBlockSetInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBF158B19B7A53100695DD0 /* DFGBlockSetInlines.h */; };
>-		0FBF92B91FD76FFF00AC28A8 /* InferredStructure.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBF92B81FD76FFC00AC28A8 /* InferredStructure.h */; settings = {ATTRIBUTES = (Private, ); }; };
>-		0FBF92BA1FD7700400AC28A8 /* InferredStructureWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBF92B71FD76FFC00AC28A8 /* InferredStructureWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0FC0976A1468A6F700CF2442 /* DFGOSRExit.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC097681468A6EF00CF2442 /* DFGOSRExit.h */; };
> 		0FC097A2146B28CC00CF2442 /* DFGThunks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC097A0146B28C700CF2442 /* DFGThunks.h */; };
> 		0FC20CB61852E2C600C9E954 /* DFGStrengthReductionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC20CB41852E2C600C9E954 /* DFGStrengthReductionPhase.h */; };
>@@ -548,7 +544,6 @@
> 		0FC712DF17CD877C008CC93C /* DeferredCompilationCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC712DD17CD8778008CC93C /* DeferredCompilationCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0FC712E317CD8793008CC93C /* JITToDFGDeferredCompilationCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC712E117CD878F008CC93C /* JITToDFGDeferredCompilationCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0FC8150A14043BF500CFA603 /* WriteBarrierSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC8150914043BD200CFA603 /* WriteBarrierSupport.h */; settings = {ATTRIBUTES = (Private, ); }; };
>-		0FC841691BA8C3210061837D /* DFGInferredTypeCheck.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC841671BA8C3210061837D /* DFGInferredTypeCheck.h */; };
> 		0FC97F34182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC97F30182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0FC97F3E18202119002C9B26 /* DFGInvalidationPointInjectionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC97F3818202119002C9B26 /* DFGInvalidationPointInjectionPhase.h */; };
> 		0FC97F4018202119002C9B26 /* DFGJumpReplacement.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC97F3A18202119002C9B26 /* DFGJumpReplacement.h */; };
>@@ -736,8 +731,6 @@
> 		0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 65987F2C167FE84B003C2F8D /* DFGOSRExitCompilationInfo.h */; };
> 		0FFB921D16D02F300055A5DB /* DFGSlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1E3A501537C2CB000F9456 /* DFGSlowPathGenerator.h */; };
> 		0FFB922016D033B70055A5DB /* NodeConstructors.h in Headers */ = {isa = PBXBuildFile; fileRef = 930DAD030FB1EB1A0082D205 /* NodeConstructors.h */; settings = {ATTRIBUTES = (Private, ); }; };
>-		0FFC92121B94D4DF0071DD66 /* InferredTypeTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFC92101B94D4DF0071DD66 /* InferredTypeTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
>-		0FFC92141B94E83E0071DD66 /* DFGDesiredInferredType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFC92131B94E83E0071DD66 /* DFGDesiredInferredType.h */; };
> 		0FFC92161B94FB3E0071DD66 /* DFGPropertyTypeKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFC92151B94FB3E0071DD66 /* DFGPropertyTypeKey.h */; };
> 		0FFC99D1184EC8AD009C10AB /* ConstantMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFC99D0184EC8AD009C10AB /* ConstantMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0FFC99D5184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFC99D3184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -2050,8 +2043,6 @@
> 		0F070A451D543A89006E7232 /* LargeAllocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LargeAllocation.cpp; sourceTree = "<group>"; };
> 		0F070A461D543A89006E7232 /* LargeAllocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LargeAllocation.h; sourceTree = "<group>"; };
> 		0F0776BD14FF002800102332 /* JITCompilationEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCompilationEffort.h; sourceTree = "<group>"; };
>-		0F0A75201B94BFA900110660 /* InferredType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredType.cpp; sourceTree = "<group>"; };
>-		0F0A75211B94BFA900110660 /* InferredType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredType.h; sourceTree = "<group>"; };
> 		0F0B28671EB8E6CD000EB5D2 /* JSMarkingConstraintPrivate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMarkingConstraintPrivate.cpp; sourceTree = "<group>"; };
> 		0F0B28681EB8E6CD000EB5D2 /* JSMarkingConstraintPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMarkingConstraintPrivate.h; sourceTree = "<group>"; };
> 		0F0B28691EB8E6CD000EB5D2 /* JSWeakPrivate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakPrivate.cpp; sourceTree = "<group>"; };
>@@ -2706,7 +2697,6 @@
> 		0FB4677C1FDDA6D9003FCB09 /* IsoCellSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IsoCellSet.cpp; sourceTree = "<group>"; };
> 		0FB4677D1FDDA6D9003FCB09 /* IsoCellSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IsoCellSet.h; sourceTree = "<group>"; };
> 		0FB4677E1FDDA6E5003FCB09 /* AtomIndices.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AtomIndices.h; sourceTree = "<group>"; };
>-		0FB467841FDFB452003FCB09 /* InferredTypeInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredTypeInlines.h; sourceTree = "<group>"; };
> 		0FB4767C1D99AEA7008EA6CB /* GCDeferralContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCDeferralContext.h; sourceTree = "<group>"; };
> 		0FB4767D1D99AEA7008EA6CB /* GCDeferralContextInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCDeferralContextInlines.h; sourceTree = "<group>"; };
> 		0FB4B51016B3A964003F696B /* DFGMinifiedID.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMinifiedID.h; path = dfg/DFGMinifiedID.h; sourceTree = "<group>"; };
>@@ -2746,10 +2736,6 @@
> 		0FBE0F7016C1DB010082C5E8 /* DFGUnificationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGUnificationPhase.h; path = dfg/DFGUnificationPhase.h; sourceTree = "<group>"; };
> 		0FBF158A19B7A53100695DD0 /* DFGBlockSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGBlockSet.cpp; path = dfg/DFGBlockSet.cpp; sourceTree = "<group>"; };
> 		0FBF158B19B7A53100695DD0 /* DFGBlockSetInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBlockSetInlines.h; path = dfg/DFGBlockSetInlines.h; sourceTree = "<group>"; };
>-		0FBF92B51FD76FFC00AC28A8 /* InferredStructureWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredStructureWatchpoint.cpp; sourceTree = "<group>"; };
>-		0FBF92B61FD76FFC00AC28A8 /* InferredStructure.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredStructure.cpp; sourceTree = "<group>"; };
>-		0FBF92B71FD76FFC00AC28A8 /* InferredStructureWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredStructureWatchpoint.h; sourceTree = "<group>"; };
>-		0FBF92B81FD76FFC00AC28A8 /* InferredStructure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredStructure.h; sourceTree = "<group>"; };
> 		0FC097681468A6EF00CF2442 /* DFGOSRExit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExit.h; path = dfg/DFGOSRExit.h; sourceTree = "<group>"; };
> 		0FC0977E1469EBC400CF2442 /* DFGCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCommon.h; path = dfg/DFGCommon.h; sourceTree = "<group>"; };
> 		0FC0978E146A6F6300CF2442 /* DFGOSRExit.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExit.cpp; path = dfg/DFGOSRExit.cpp; sourceTree = "<group>"; };
>@@ -2772,8 +2758,6 @@
> 		0FC712E117CD878F008CC93C /* JITToDFGDeferredCompilationCallback.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JITToDFGDeferredCompilationCallback.h; sourceTree = "<group>"; };
> 		0FC8150814043BCA00CFA603 /* WriteBarrierSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WriteBarrierSupport.cpp; sourceTree = "<group>"; };
> 		0FC8150914043BD200CFA603 /* WriteBarrierSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrierSupport.h; sourceTree = "<group>"; };
>-		0FC841661BA8C3210061837D /* DFGInferredTypeCheck.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGInferredTypeCheck.cpp; path = dfg/DFGInferredTypeCheck.cpp; sourceTree = "<group>"; };
>-		0FC841671BA8C3210061837D /* DFGInferredTypeCheck.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInferredTypeCheck.h; path = dfg/DFGInferredTypeCheck.h; sourceTree = "<group>"; };
> 		0FC97F2F182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeBlockJettisoningWatchpoint.cpp; sourceTree = "<group>"; };
> 		0FC97F30182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeBlockJettisoningWatchpoint.h; sourceTree = "<group>"; };
> 		0FC97F3718202119002C9B26 /* DFGInvalidationPointInjectionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGInvalidationPointInjectionPhase.cpp; path = dfg/DFGInvalidationPointInjectionPhase.cpp; sourceTree = "<group>"; };
>@@ -3089,9 +3073,6 @@
> 		0FFB6C361AF48DDC00DB1BF7 /* TypeofType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypeofType.cpp; sourceTree = "<group>"; };
> 		0FFB6C371AF48DDC00DB1BF7 /* TypeofType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeofType.h; sourceTree = "<group>"; };
> 		0FFB80BB20A794700006AAF6 /* JITCodeInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCodeInlines.h; sourceTree = "<group>"; };
>-		0FFC920F1B94D4DF0071DD66 /* InferredTypeTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredTypeTable.cpp; sourceTree = "<group>"; };
>-		0FFC92101B94D4DF0071DD66 /* InferredTypeTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredTypeTable.h; sourceTree = "<group>"; };
>-		0FFC92131B94E83E0071DD66 /* DFGDesiredInferredType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDesiredInferredType.h; path = dfg/DFGDesiredInferredType.h; sourceTree = "<group>"; };
> 		0FFC92151B94FB3E0071DD66 /* DFGPropertyTypeKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPropertyTypeKey.h; path = dfg/DFGPropertyTypeKey.h; sourceTree = "<group>"; };
> 		0FFC99D0184EC8AD009C10AB /* ConstantMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstantMode.h; sourceTree = "<group>"; };
> 		0FFC99D2184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayBufferNeuteringWatchpoint.cpp; sourceTree = "<group>"; };
>@@ -6747,15 +6728,6 @@
> 				0FB7F38F15ED8E3800F167B2 /* IndexingType.h */,
> 				14386A761DD6989C008652C4 /* IndirectEvalExecutable.cpp */,
> 				14386A771DD6989C008652C4 /* IndirectEvalExecutable.h */,
>-				0FBF92B61FD76FFC00AC28A8 /* InferredStructure.cpp */,
>-				0FBF92B81FD76FFC00AC28A8 /* InferredStructure.h */,
>-				0FBF92B51FD76FFC00AC28A8 /* InferredStructureWatchpoint.cpp */,
>-				0FBF92B71FD76FFC00AC28A8 /* InferredStructureWatchpoint.h */,
>-				0F0A75201B94BFA900110660 /* InferredType.cpp */,
>-				0F0A75211B94BFA900110660 /* InferredType.h */,
>-				0FB467841FDFB452003FCB09 /* InferredTypeInlines.h */,
>-				0FFC920F1B94D4DF0071DD66 /* InferredTypeTable.cpp */,
>-				0FFC92101B94D4DF0071DD66 /* InferredTypeTable.h */,
> 				0FF8BDE81AD4CF7100DFE884 /* InferredValue.cpp */,
> 				0FF8BDE91AD4CF7100DFE884 /* InferredValue.h */,
> 				0F4AE0421FE0D25400E20839 /* InferredValueInlines.h */,
>@@ -7374,7 +7346,6 @@
> 				E3BFA5CD21E853A1009C0EBA /* DFGDesiredGlobalProperty.h */,
> 				0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */,
> 				0F8F2B98172F04FD007DBDA5 /* DFGDesiredIdentifiers.h */,
>-				0FFC92131B94E83E0071DD66 /* DFGDesiredInferredType.h */,
> 				C2C0F7CB17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp */,
> 				C2C0F7CC17BBFC5B00464FE4 /* DFGDesiredTransitions.h */,
> 				0FE853491723CDA500B618F5 /* DFGDesiredWatchpoints.cpp */,
>@@ -7419,8 +7390,6 @@
> 				0F2FCCF318A60070001A27F8 /* DFGGraphSafepoint.h */,
> 				0FB1765C196B8F9E0091052A /* DFGHeapLocation.cpp */,
> 				0FB1765D196B8F9E0091052A /* DFGHeapLocation.h */,
>-				0FC841661BA8C3210061837D /* DFGInferredTypeCheck.cpp */,
>-				0FC841671BA8C3210061837D /* DFGInferredTypeCheck.h */,
> 				0FB14E201812570B009B6B4D /* DFGInlineCacheWrapper.h */,
> 				0FB14E2218130955009B6B4D /* DFGInlineCacheWrapperInlines.h */,
> 				A704D90017A0BAA8006BA554 /* DFGInPlaceAbstractState.cpp */,
>@@ -8761,7 +8730,6 @@
> 				0F2FC77316E12F740038D976 /* DFGDCEPhase.h in Headers */,
> 				E3BFA5D021E853A1009C0EBA /* DFGDesiredGlobalProperty.h in Headers */,
> 				0F8F2B9A172F0501007DBDA5 /* DFGDesiredIdentifiers.h in Headers */,
>-				0FFC92141B94E83E0071DD66 /* DFGDesiredInferredType.h in Headers */,
> 				C2C0F7CE17BBFC5B00464FE4 /* DFGDesiredTransitions.h in Headers */,
> 				0FE8534C1723CDA500B618F5 /* DFGDesiredWatchpoints.h in Headers */,
> 				C2981FD917BAEE4B00A3BC98 /* DFGDesiredWeakReferences.h in Headers */,
>@@ -8789,7 +8757,6 @@
> 				86EC9DC81328DF82002B2AD7 /* DFGGraph.h in Headers */,
> 				0F2FCCFA18A60070001A27F8 /* DFGGraphSafepoint.h in Headers */,
> 				0FB17661196B8F9E0091052A /* DFGHeapLocation.h in Headers */,
>-				0FC841691BA8C3210061837D /* DFGInferredTypeCheck.h in Headers */,
> 				0FB14E211812570B009B6B4D /* DFGInlineCacheWrapper.h in Headers */,
> 				0FB14E2318130955009B6B4D /* DFGInlineCacheWrapperInlines.h in Headers */,
> 				A704D90617A0BAA8006BA554 /* DFGInPlaceAbstractState.h in Headers */,
>@@ -9091,11 +9058,6 @@
> 				0FB7F39A15ED8E4600F167B2 /* IndexingHeaderInlines.h in Headers */,
> 				0FB7F39B15ED8E4600F167B2 /* IndexingType.h in Headers */,
> 				14386A791DD6989C008652C4 /* IndirectEvalExecutable.h in Headers */,
>-				0FBF92B91FD76FFF00AC28A8 /* InferredStructure.h in Headers */,
>-				0FBF92BA1FD7700400AC28A8 /* InferredStructureWatchpoint.h in Headers */,
>-				0F0A75231B94BFA900110660 /* InferredType.h in Headers */,
>-				0FB467851FDFB454003FCB09 /* InferredTypeInlines.h in Headers */,
>-				0FFC92121B94D4DF0071DD66 /* InferredTypeTable.h in Headers */,
> 				0FF8BDEB1AD4CF7100DFE884 /* InferredValue.h in Headers */,
> 				0F4AE0431FE0D25700E20839 /* InferredValueInlines.h in Headers */,
> 				BC18C4100E16F5CD00B34460 /* InitializeThreading.h in Headers */,
>Index: Source/JavaScriptCore/bytecode/AccessCase.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/AccessCase.cpp	(revision 239966)
>+++ Source/JavaScriptCore/bytecode/AccessCase.cpp	(working copy)
>@@ -1019,14 +1019,6 @@ void AccessCase::generateImpl(AccessGene
>     }
> 
>     case Replace: {
>-        if (InferredType* type = structure()->inferredTypeFor(ident.impl())) {
>-            if (AccessCaseInternal::verbose)
>-                dataLog("Have type: ", type->descriptor(), "\n");
>-            state.failAndRepatch.append(
>-                jit.branchIfNotType(valueRegs, scratchGPR, type->descriptor()));
>-        } else if (AccessCaseInternal::verbose)
>-            dataLog("Don't have type.\n");
>-
>         if (isInlineOffset(m_offset)) {
>             jit.storeValue(
>                 valueRegs,
>@@ -1049,14 +1041,6 @@ void AccessCase::generateImpl(AccessGene
>         // AccessCase::transition() should have returned null if this wasn't true.
>         RELEASE_ASSERT(GPRInfo::numberOfRegisters >= 6 || !structure()->outOfLineCapacity() || structure()->outOfLineCapacity() == newStructure()->outOfLineCapacity());
> 
>-        if (InferredType* type = newStructure()->inferredTypeFor(ident.impl())) {
>-            if (AccessCaseInternal::verbose)
>-                dataLog("Have type: ", type->descriptor(), "\n");
>-            state.failAndRepatch.append(
>-                jit.branchIfNotType(valueRegs, scratchGPR, type->descriptor()));
>-        } else if (AccessCaseInternal::verbose)
>-            dataLog("Don't have type.\n");
>-
>         // NOTE: This logic is duplicated in AccessCase::doesCalls(). It's important that doesCalls() knows
>         // exactly when this would make calls.
>         bool allocating = newStructure()->outOfLineCapacity() != structure()->outOfLineCapacity();
>Index: Source/JavaScriptCore/bytecode/BytecodeList.rb
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeList.rb	(revision 239966)
>+++ Source/JavaScriptCore/bytecode/BytecodeList.rb	(working copy)
>@@ -474,11 +474,7 @@ op :put_by_id,
>         oldStructure: StructureID,
>         offset: unsigned,
>         newStructure: StructureID,
>-        flags: PutByIdFlags,
>         structureChain: WriteBarrierBase[StructureChain],
>-    },
>-    metadata_initializers: {
>-        flags: :flags
>     }
> 
> op :put_by_id_with_this,
>Index: Source/JavaScriptCore/bytecode/Fits.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/Fits.h	(revision 239966)
>+++ Source/JavaScriptCore/bytecode/Fits.h	(working copy)
>@@ -30,6 +30,7 @@
> #include "Label.h"
> #include "OpcodeSize.h"
> #include "ProfileTypeBytecodeFlag.h"
>+#include "PutByIdFlags.h"
> #include "ResultType.h"
> #include "SpecialPointer.h"
> #include "VirtualRegister.h"
>Index: Source/JavaScriptCore/bytecode/PutByIdFlags.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/PutByIdFlags.cpp	(revision 239966)
>+++ Source/JavaScriptCore/bytecode/PutByIdFlags.cpp	(working copy)
>@@ -26,7 +26,6 @@
> #include "config.h"
> #include "PutByIdFlags.h"
> 
>-#include "InferredType.h"
> #include <wtf/CommaPrinter.h>
> #include <wtf/PrintStream.h>
> #include <wtf/StringPrintStream.h>
>@@ -39,11 +38,6 @@ void printInternal(PrintStream& out, Put
>     CommaPrinter comma("|");
>     if (flags & PutByIdIsDirect)
>         out.print(comma, "IsDirect");
>-
>-    InferredType::Kind kind = InferredType::kindForFlags(flags);
>-    out.print(comma, kind);
>-    if (InferredType::hasStructure(kind))
>-        out.print(":", bitwise_cast<int32_t>(decodeStructureID(flags)));
> }
> 
> } // namespace WTF
>Index: Source/JavaScriptCore/bytecode/PutByIdFlags.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/PutByIdFlags.h	(revision 239966)
>+++ Source/JavaScriptCore/bytecode/PutByIdFlags.h	(working copy)
>@@ -36,60 +36,8 @@ enum PutByIdFlags : int32_t {
>     // checking if the prototype chain has a setter.
>     PutByIdIsDirect = 0x1,
>     PutByIdPersistentFlagsMask = 0x1,
>-
>-    // NOTE: The values below must be in sync with what is in LowLevelInterpreter.asm.
>-
>-    // Determining the required inferred type involves first checking the primary type mask, and then
>-    // using that to figure out the meaning of the secondary mask:
>-    // switch (flags & PutByIdPrimaryTypeMask) {
>-    // case PutByIdPrimaryTypeSecondary:
>-    //     switch (flags & PutByIdSecondaryTypeMask) {
>-    //     ...
>-    //     }
>-    //     break;
>-    // case PutByIdPrimaryTypeObjectWithStructure:
>-    // case PutByIdPrimaryTypeObjectWithStructureOrOther:
>-    //     StructureID structureID = decodeStructureID(flags);
>-    //     break;
>-    // }
>-    PutByIdPrimaryTypeMask = 0x6,
>-    PutByIdPrimaryTypeSecondary = 0x0, // Need to check the secondary type mask for the type.
>-    PutByIdPrimaryTypeObjectWithStructure = 0x2, // Secondary type has structure ID.
>-    PutByIdPrimaryTypeObjectWithStructureOrOther = 0x4, // Secondary type has structure ID.
>-
>-    PutByIdSecondaryTypeMask = -0x8,
>-    PutByIdSecondaryTypeBottom = 0x0,
>-    PutByIdSecondaryTypeBoolean = 0x8,
>-    PutByIdSecondaryTypeOther = 0x10,
>-    PutByIdSecondaryTypeInt32 = 0x18,
>-    PutByIdSecondaryTypeNumber = 0x20,
>-    PutByIdSecondaryTypeString = 0x28,
>-    PutByIdSecondaryTypeSymbol = 0x30,
>-    PutByIdSecondaryTypeObject = 0x38,
>-    PutByIdSecondaryTypeObjectOrOther = 0x40,
>-    PutByIdSecondaryTypeTop = 0x48
> };
> 
>-inline PutByIdFlags encodeStructureID(StructureID id)
>-{
>-#if USE(JSVALUE64)
>-    return static_cast<PutByIdFlags>(static_cast<PutByIdFlags>(id) << 3);
>-#else
>-    PutByIdFlags result = bitwise_cast<PutByIdFlags>(id);
>-    ASSERT(!(result & ~PutByIdSecondaryTypeMask));
>-    return result;
>-#endif
>-}
>-
>-inline StructureID decodeStructureID(PutByIdFlags flags)
>-{
>-#if USE(JSVALUE64)
>-    return static_cast<StructureID>(flags >> 3);
>-#else
>-    return bitwise_cast<StructureID>(flags & PutByIdSecondaryTypeMask);
>-#endif
>-}
>-
> } // namespace JSC
> 
> namespace WTF {
>Index: Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/PutByIdStatus.cpp	(revision 239966)
>+++ Source/JavaScriptCore/bytecode/PutByIdStatus.cpp	(working copy)
>@@ -52,7 +52,8 @@ PutByIdStatus PutByIdStatus::computeFrom
>     VM& vm = *profiledBlock->vm();
>     
>     auto instruction = profiledBlock->instructions().at(bytecodeIndex);
>-    auto& metadata = instruction->as<OpPutById>().metadata(profiledBlock);
>+    auto bytecode = instruction->as<OpPutById>();
>+    auto& metadata = bytecode.metadata(profiledBlock);
> 
>     StructureID structureID = metadata.oldStructure;
>     if (!structureID)
>@@ -66,7 +67,7 @@ PutByIdStatus PutByIdStatus::computeFrom
>         if (!isValidOffset(offset))
>             return PutByIdStatus(NoInformation);
>         
>-        return PutByIdVariant::replace(structure, offset, structure->inferredTypeDescriptorFor(uid));
>+        return PutByIdVariant::replace(structure, offset);
>     }
> 
>     Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
>@@ -78,7 +79,7 @@ PutByIdStatus PutByIdStatus::computeFrom
>         return PutByIdStatus(NoInformation);
>     
>     ObjectPropertyConditionSet conditionSet;
>-    if (!(metadata.flags & PutByIdIsDirect)) {
>+    if (!(bytecode.flags & PutByIdIsDirect)) {
>         conditionSet =
>             generateConditionsForPropertySetterMissConcurrently(
>                 vm, profiledBlock->globalObject(), structure, uid);
>@@ -87,7 +88,7 @@ PutByIdStatus PutByIdStatus::computeFrom
>     }
>     
>     return PutByIdVariant::transition(
>-        structure, newStructure, conditionSet, offset, newStructure->inferredTypeDescriptorFor(uid));
>+        structure, newStructure, conditionSet, offset);
> }
> 
> #if ENABLE(JIT)
>@@ -142,7 +143,7 @@ PutByIdStatus PutByIdStatus::computeForS
>             stubInfo->u.byIdSelf.baseObjectStructure->getConcurrently(uid);
>         if (isValidOffset(offset)) {
>             return PutByIdVariant::replace(
>-                stubInfo->u.byIdSelf.baseObjectStructure.get(), offset, InferredType::Top);
>+                stubInfo->u.byIdSelf.baseObjectStructure.get(), offset);
>         }
>         return PutByIdStatus(JSC::slowVersion(summary));
>     }
>@@ -169,7 +170,7 @@ PutByIdStatus PutByIdStatus::computeForS
>                 if (!isValidOffset(offset))
>                     return PutByIdStatus(JSC::slowVersion(summary));
>                 variant = PutByIdVariant::replace(
>-                    structure, offset, structure->inferredTypeDescriptorFor(uid));
>+                    structure, offset);
>                 break;
>             }
>                 
>@@ -182,8 +183,7 @@ PutByIdStatus PutByIdStatus::computeForS
>                 if (!conditionSet.structuresEnsureValidity())
>                     return PutByIdStatus(JSC::slowVersion(summary));
>                 variant = PutByIdVariant::transition(
>-                    access.structure(), access.newStructure(), conditionSet, offset,
>-                    access.newStructure()->inferredTypeDescriptorFor(uid));
>+                    access.structure(), access.newStructure(), conditionSet, offset);
>                 break;
>             }
>                 
>@@ -315,7 +315,7 @@ PutByIdStatus PutByIdStatus::computeFor(
>             }
> 
>             PutByIdVariant variant =
>-                PutByIdVariant::replace(structure, offset, structure->inferredTypeDescriptorFor(uid));
>+                PutByIdVariant::replace(structure, offset);
>             if (!result.appendVariant(variant))
>                 return PutByIdStatus(TakesSlowPath);
>             continue;
>@@ -350,8 +350,7 @@ PutByIdStatus PutByIdStatus::computeFor(
>     
>         bool didAppend = result.appendVariant(
>             PutByIdVariant::transition(
>-                structure, transition, conditionSet, offset,
>-                transition->inferredTypeDescriptorFor(uid)));
>+                structure, transition, conditionSet, offset));
>         if (!didAppend)
>             return PutByIdStatus(TakesSlowPath);
>     }
>Index: Source/JavaScriptCore/bytecode/PutByIdVariant.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/PutByIdVariant.cpp	(revision 239966)
>+++ Source/JavaScriptCore/bytecode/PutByIdVariant.cpp	(working copy)
>@@ -45,7 +45,6 @@ PutByIdVariant& PutByIdVariant::operator
>     m_newStructure = other.m_newStructure;
>     m_conditionSet = other.m_conditionSet;
>     m_offset = other.m_offset;
>-    m_requiredType = other.m_requiredType;
>     if (other.m_callLinkStatus)
>         m_callLinkStatus = std::make_unique<CallLinkStatus>(*other.m_callLinkStatus);
>     else
>@@ -54,20 +53,18 @@ PutByIdVariant& PutByIdVariant::operator
> }
> 
> PutByIdVariant PutByIdVariant::replace(
>-    const StructureSet& structure, PropertyOffset offset, const InferredType::Descriptor& requiredType)
>+    const StructureSet& structure, PropertyOffset offset)
> {
>     PutByIdVariant result;
>     result.m_kind = Replace;
>     result.m_oldStructure = structure;
>     result.m_offset = offset;
>-    result.m_requiredType = requiredType;
>     return result;
> }
> 
> PutByIdVariant PutByIdVariant::transition(
>     const StructureSet& oldStructure, Structure* newStructure,
>-    const ObjectPropertyConditionSet& conditionSet, PropertyOffset offset,
>-    const InferredType::Descriptor& requiredType)
>+    const ObjectPropertyConditionSet& conditionSet, PropertyOffset offset)
> {
>     PutByIdVariant result;
>     result.m_kind = Transition;
>@@ -75,7 +72,6 @@ PutByIdVariant PutByIdVariant::transitio
>     result.m_newStructure = newStructure;
>     result.m_conditionSet = conditionSet;
>     result.m_offset = offset;
>-    result.m_requiredType = requiredType;
>     return result;
> }
> 
>@@ -90,7 +86,6 @@ PutByIdVariant PutByIdVariant::setter(
>     result.m_conditionSet = conditionSet;
>     result.m_offset = offset;
>     result.m_callLinkStatus = WTFMove(callLinkStatus);
>-    result.m_requiredType = InferredType::Top;
>     return result;
> }
> 
>@@ -159,9 +154,6 @@ bool PutByIdVariant::attemptToMerge(cons
>     if (m_offset != other.m_offset)
>         return false;
> 
>-    if (m_requiredType != other.m_requiredType)
>-        return false;
>-    
>     switch (m_kind) {
>     case NotSet:
>         RELEASE_ASSERT_NOT_REACHED();
>@@ -305,16 +297,14 @@ void PutByIdVariant::dumpInContext(Print
>         
>     case Replace:
>         out.print(
>-            "<Replace: ", inContext(structure(), context), ", offset = ", offset(), ", ",
>-            inContext(requiredType(), context), ">");
>+            "<Replace: ", inContext(structure(), context), ", offset = ", offset(), ", ", ">");
>         return;
>         
>     case Transition:
>         out.print(
>             "<Transition: ", inContext(oldStructure(), context), " to ",
>             pointerDumpInContext(newStructure(), context), ", [",
>-            inContext(m_conditionSet, context), "], offset = ", offset(), ", ",
>-            inContext(requiredType(), context), ">");
>+            inContext(m_conditionSet, context), "], offset = ", offset(), ", ", ">");
>         return;
>         
>     case Setter:
>Index: Source/JavaScriptCore/bytecode/PutByIdVariant.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/PutByIdVariant.h	(revision 239966)
>+++ Source/JavaScriptCore/bytecode/PutByIdVariant.h	(working copy)
>@@ -52,11 +52,11 @@ public:
>     PutByIdVariant(const PutByIdVariant&);
>     PutByIdVariant& operator=(const PutByIdVariant&);
> 
>-    static PutByIdVariant replace(const StructureSet&, PropertyOffset, const InferredType::Descriptor&);
>+    static PutByIdVariant replace(const StructureSet&, PropertyOffset);
>     
>     static PutByIdVariant transition(
>         const StructureSet& oldStructure, Structure* newStructure,
>-        const ObjectPropertyConditionSet&, PropertyOffset, const InferredType::Descriptor&);
>+        const ObjectPropertyConditionSet&, PropertyOffset);
>     
>     static PutByIdVariant setter(
>         const StructureSet&, PropertyOffset, const ObjectPropertyConditionSet&,
>@@ -105,11 +105,6 @@ public:
>     
>     void fixTransitionToReplaceIfNecessary();
> 
>-    InferredType::Descriptor requiredType() const
>-    {
>-        return m_requiredType;
>-    }
>-
>     bool writesStructures() const;
>     bool reallocatesStorage() const;
>     bool makesCalls() const;
>@@ -150,7 +145,6 @@ private:
>     Structure* m_newStructure { nullptr };
>     ObjectPropertyConditionSet m_conditionSet;
>     PropertyOffset m_offset;
>-    InferredType::Descriptor m_requiredType;
>     std::unique_ptr<CallLinkStatus> m_callLinkStatus;
> };
> 
>Index: Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h	(working copy)
>@@ -2918,8 +2918,9 @@ bool AbstractInterpreter<AbstractStateTy
> 
>                     result.merge(
>                         m_graph.inferredValueForProperty(
>-                            value, uid, status[i].offset(), m_state.structureClobberState()));
>+                            value, status[i].offset(), m_state.structureClobberState()));
>                 }
>+            
>                 m_state.setFoundConstants(true);
>                 didFoldClobberWorld();
>                 forNode(node) = result;
>@@ -3292,7 +3293,6 @@ bool AbstractInterpreter<AbstractStateTy
>         
>     case GetByOffset: {
>         StorageAccessData& data = node->storageAccessData();
>-        UniquedStringImpl* uid = m_graph.identifiers()[data.identifierNumber];
> 
>         // FIXME: The part of this that handles inferred property types relies on AI knowing the structure
>         // right now. That's probably not optimal. In some cases, we may perform an optimization (usually
>@@ -3300,12 +3300,7 @@ bool AbstractInterpreter<AbstractStateTy
>         // at the point where GetByOffset runs. Currently, when that happens, we'll have to rely entirely
>         // on the type that ByteCodeParser was able to prove.
>         AbstractValue value = m_graph.inferredValueForProperty(
>-            forNode(node->child2()), uid, data.offset, m_state.structureClobberState());
>-
>-        // It's possible that the type that ByteCodeParser came up with is better.
>-        AbstractValue typeFromParsing;
>-        typeFromParsing.set(m_graph, data.inferredType, m_state.structureClobberState());
>-        value.filter(typeFromParsing);
>+            forNode(node->child2()), data.offset, m_state.structureClobberState());
> 
>         // If we decide that there does not exist any value that this can return, then it's probably
>         // because the compilation was already invalidated.
>@@ -3344,8 +3339,6 @@ bool AbstractInterpreter<AbstractStateTy
>         // because of the effect on compile times, but this node is FTL-only.
>         m_state.setFoundConstants(true);
>         
>-        UniquedStringImpl* uid = m_graph.identifiers()[node->multiGetByOffsetData().identifierNumber];
>-
>         AbstractValue base = forNode(node->child1());
>         RegisteredStructureSet baseSet;
>         AbstractValue result;
>@@ -3367,13 +3360,6 @@ bool AbstractInterpreter<AbstractStateTy
>                 break;
>             }
> 
>-            case GetByOffsetMethod::Load: {
>-                result.merge(
>-                    m_graph.inferredValueForProperty(
>-                        set, uid, m_state.structureClobberState()));
>-                break;
>-            }
>-
>             default: {
>                 result.makeHeapTop();
>                 break;
>@@ -3414,7 +3400,6 @@ bool AbstractInterpreter<AbstractStateTy
>                 continue;
> 
>             AbstractValue thisValue = originalValue;
>-            thisValue.filter(m_graph, variant.requiredType());
>             resultingValue.merge(thisValue);
>             
>             if (variant.kind() == PutByIdVariant::Transition) {
>Index: Source/JavaScriptCore/dfg/DFGAbstractValue.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractValue.cpp	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGAbstractValue.cpp	(working copy)
>@@ -126,62 +126,6 @@ void AbstractValue::setType(Graph& graph
>     checkConsistency();
> }
> 
>-void AbstractValue::set(Graph& graph, const InferredType::Descriptor& descriptor)
>-{
>-    switch (descriptor.kind()) {
>-    case InferredType::Bottom:
>-        clear();
>-        return;
>-    case InferredType::Boolean:
>-        setNonCellType(SpecBoolean);
>-        return;
>-    case InferredType::Other:
>-        setNonCellType(SpecOther);
>-        return;
>-    case InferredType::Int32:
>-        setNonCellType(SpecInt32Only);
>-        return;
>-    case InferredType::Number:
>-        setNonCellType(SpecBytecodeNumber);
>-        return;
>-    case InferredType::String:
>-        set(graph, graph.m_vm.stringStructure.get());
>-        return;
>-    case InferredType::Symbol:
>-        set(graph, graph.m_vm.symbolStructure.get());
>-        return;
>-    case InferredType::BigInt:
>-        set(graph, graph.m_vm.bigIntStructure.get());
>-        return;
>-    case InferredType::ObjectWithStructure:
>-        set(graph, descriptor.structure());
>-        return;
>-    case InferredType::ObjectWithStructureOrOther:
>-        set(graph, descriptor.structure());
>-        merge(SpecOther);
>-        return;
>-    case InferredType::Object:
>-        setType(graph, SpecObject);
>-        return;
>-    case InferredType::ObjectOrOther:
>-        setType(graph, SpecObject | SpecOther);
>-        return;
>-    case InferredType::Top:
>-        makeHeapTop();
>-        return;
>-    }
>-
>-    RELEASE_ASSERT_NOT_REACHED();
>-}
>-
>-void AbstractValue::set(
>-    Graph& graph, const InferredType::Descriptor& descriptor, StructureClobberState clobberState)
>-{
>-    set(graph, descriptor);
>-    if (clobberState == StructuresAreClobbered)
>-        clobberStructures();
>-}
>-
> void AbstractValue::fixTypeForRepresentation(Graph& graph, NodeFlags representation, Node* node)
> {
>     if (representation == NodeResultDouble) {
>@@ -253,17 +197,6 @@ bool AbstractValue::mergeOSREntryValue(G
>     return oldMe != *this;
> }
> 
>-bool AbstractValue::isType(Graph& graph, const InferredType::Descriptor& inferredType) const
>-{
>-    AbstractValue typeValue;
>-    typeValue.set(graph, inferredType);
>-
>-    AbstractValue mergedValue = *this;
>-    mergedValue.merge(typeValue);
>-
>-    return mergedValue == typeValue;
>-}
>-
> FiltrationResult AbstractValue::filter(
>     Graph& graph, const RegisteredStructureSet& other, SpeculatedType admittedTypes)
> {
>@@ -402,13 +335,6 @@ FiltrationResult AbstractValue::filter(c
>     return Contradiction;
> }
> 
>-FiltrationResult AbstractValue::filter(Graph& graph, const InferredType::Descriptor& descriptor)
>-{
>-    AbstractValue filterValue;
>-    filterValue.set(graph, descriptor);
>-    return filter(filterValue);
>-}
>-
> void AbstractValue::filterValueByType()
> {
>     // We could go further, and ensure that if the futurePossibleStructure contravenes
>Index: Source/JavaScriptCore/dfg/DFGAbstractValue.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractValue.h	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGAbstractValue.h	(working copy)
>@@ -34,7 +34,6 @@
> #include "DFGNodeFlags.h"
> #include "DFGStructureAbstractValue.h"
> #include "DFGStructureClobberState.h"
>-#include "InferredType.h"
> #include "JSCast.h"
> #include "ResultType.h"
> #include "SpeculatedType.h"
>@@ -249,9 +248,6 @@ struct AbstractValue {
>         checkConsistency();
>     }
> 
>-    void set(Graph&, const InferredType::Descriptor&);
>-    void set(Graph&, const InferredType::Descriptor&, StructureClobberState);
>-
>     void fixTypeForRepresentation(Graph&, NodeFlags representation, Node* = nullptr);
>     void fixTypeForRepresentation(Graph&, Node*);
>     
>@@ -318,8 +314,6 @@ struct AbstractValue {
>         return !(m_type & ~desiredType);
>     }
> 
>-    bool isType(Graph&, const InferredType::Descriptor&) const;
>-
>     // Filters the value using the given structure set. If the admittedTypes argument is not passed, this
>     // implicitly filters by the types implied by the structure set, which are usually a subset of
>     // SpecCell. Hence, after this call, the value will no longer have any non-cell members. But, you can
>@@ -354,8 +348,6 @@ struct AbstractValue {
>     FiltrationResult filter(const AbstractValue&);
>     FiltrationResult filterClassInfo(Graph&, const ClassInfo*);
> 
>-    FiltrationResult filter(Graph&, const InferredType::Descriptor&);
>-    
>     ALWAYS_INLINE FiltrationResult fastForwardToAndFilterUnproven(AbstractValueClobberEpoch newEpoch, SpeculatedType type)
>     {
>         if (m_type & SpecCell)
>Index: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(working copy)
>@@ -185,8 +185,8 @@ private:
>     bool handleTypedArrayConstructor(VirtualRegister result, InternalFunction*, int registerOffset, int argumentCountIncludingThis, TypedArrayType, const ChecksFunctor& insertChecks);
>     template<typename ChecksFunctor>
>     bool handleConstantInternalFunction(Node* callTargetNode, VirtualRegister result, InternalFunction*, int registerOffset, int argumentCountIncludingThis, CodeSpecializationKind, SpeculatedType, const ChecksFunctor& insertChecks);
>-    Node* handlePutByOffset(Node* base, unsigned identifier, PropertyOffset, const InferredType::Descriptor&, Node* value);
>-    Node* handleGetByOffset(SpeculatedType, Node* base, unsigned identifierNumber, PropertyOffset, const InferredType::Descriptor&, NodeType = GetByOffset);
>+    Node* handlePutByOffset(Node* base, unsigned identifier, PropertyOffset, Node* value);
>+    Node* handleGetByOffset(SpeculatedType, Node* base, unsigned identifierNumber, PropertyOffset, NodeType = GetByOffset);
>     bool handleDOMJITGetter(VirtualRegister result, const GetByIdVariant&, Node* thisNode, unsigned identifierNumber, SpeculatedType prediction);
>     bool handleModuleNamespaceLoad(VirtualRegister result, SpeculatedType, Node* base, GetByIdStatus);
> 
>@@ -3772,8 +3772,7 @@ bool ByteCodeParser::handleConstantInter
> }
> 
> Node* ByteCodeParser::handleGetByOffset(
>-    SpeculatedType prediction, Node* base, unsigned identifierNumber, PropertyOffset offset,
>-    const InferredType::Descriptor& inferredType, NodeType op)
>+    SpeculatedType prediction, Node* base, unsigned identifierNumber, PropertyOffset offset, NodeType op)
> {
>     Node* propertyStorage;
>     if (isInlineOffset(offset))
>@@ -3784,8 +3783,6 @@ Node* ByteCodeParser::handleGetByOffset(
>     StorageAccessData* data = m_graph.m_storageAccessData.add();
>     data->offset = offset;
>     data->identifierNumber = identifierNumber;
>-    data->inferredType = inferredType;
>-    m_graph.registerInferredType(inferredType);
>     
>     Node* getByOffset = addToGraph(op, OpInfo(data), OpInfo(prediction), propertyStorage, base);
> 
>@@ -3793,7 +3790,7 @@ Node* ByteCodeParser::handleGetByOffset(
> }
> 
> Node* ByteCodeParser::handlePutByOffset(
>-    Node* base, unsigned identifier, PropertyOffset offset, const InferredType::Descriptor& inferredType,
>+    Node* base, unsigned identifier, PropertyOffset offset,
>     Node* value)
> {
>     Node* propertyStorage;
>@@ -3805,8 +3802,6 @@ Node* ByteCodeParser::handlePutByOffset(
>     StorageAccessData* data = m_graph.m_storageAccessData.add();
>     data->offset = offset;
>     data->identifierNumber = identifier;
>-    data->inferredType = inferredType;
>-    m_graph.registerInferredType(inferredType);
>     
>     Node* result = addToGraph(PutByOffset, OpInfo(data), propertyStorage, base, value);
>     
>@@ -3979,7 +3974,7 @@ Node* ByteCodeParser::load(
>     case GetByOffsetMethod::LoadFromPrototype: {
>         Node* baseNode = addToGraph(JSConstant, OpInfo(method.prototype()));
>         return handleGetByOffset(
>-            prediction, baseNode, identifierNumber, method.offset(), InferredType::Top, op);
>+            prediction, baseNode, identifierNumber, method.offset(), op);
>     }
>     case GetByOffsetMethod::Load:
>         // Will never see this from planLoad().
>@@ -4172,17 +4167,8 @@ Node* ByteCodeParser::load(
>                 return weakJSConstant(constant);
>         }
> 
>-        InferredType::Descriptor inferredType;
>-        if (needStructureCheck) {
>-            for (Structure* structure : variant.structureSet()) {
>-                InferredType::Descriptor thisType = m_graph.inferredTypeForProperty(structure, uid);
>-                inferredType.merge(thisType);
>-            }
>-        } else
>-            inferredType = InferredType::Top;
>-        
>         loadedValue = handleGetByOffset(
>-            loadPrediction, base, identifierNumber, variant.offset(), inferredType, loadOp);
>+            loadPrediction, base, identifierNumber, variant.offset(), loadOp);
>     }
> 
>     return loadedValue;
>@@ -4193,7 +4179,7 @@ Node* ByteCodeParser::store(Node* base, 
>     RELEASE_ASSERT(variant.kind() == PutByIdVariant::Replace);
> 
>     checkPresenceLike(base, m_graph.identifiers()[identifier], variant.offset(), variant.structure());
>-    return handlePutByOffset(base, identifier, variant.offset(), variant.requiredType(), value);
>+    return handlePutByOffset(base, identifier, variant.offset(), value);
> }
> 
> void ByteCodeParser::handleGetById(
>@@ -4428,7 +4414,6 @@ void ByteCodeParser::handlePutById(
>         addToGraph(FilterPutByIdStatus, OpInfo(m_graph.m_plan.recordedStatuses().addPutByIdStatus(currentCodeOrigin(), putByIdStatus)), base);
> 
>         for (const PutByIdVariant& variant : putByIdStatus.variants()) {
>-            m_graph.registerInferredType(variant.requiredType());
>             for (Structure* structure : variant.oldStructure())
>                 m_graph.registerStructure(structure);
>             if (variant.kind() == PutByIdVariant::Transition)
>@@ -4494,8 +4479,6 @@ void ByteCodeParser::handlePutById(
>         StorageAccessData* data = m_graph.m_storageAccessData.add();
>         data->offset = variant.offset();
>         data->identifierNumber = identifierNumber;
>-        data->inferredType = variant.requiredType();
>-        m_graph.registerInferredType(data->inferredType);
>         
>         // NOTE: We could GC at this point because someone could insert an operation that GCs.
>         // That's fine because:
>@@ -4807,9 +4790,6 @@ void ByteCodeParser::parseBlock(unsigned
>                                 StorageAccessData* data = m_graph.m_storageAccessData.add();
>                                 data->offset = knownPolyProtoOffset;
>                                 data->identifierNumber = m_graph.identifiers().ensure(m_graph.m_vm.propertyNames->builtinNames().polyProtoName().impl());
>-                                InferredType::Descriptor inferredType = InferredType::Top;
>-                                data->inferredType = inferredType;
>-                                m_graph.registerInferredType(inferredType);
>                                 ASSERT(isInlineOffset(knownPolyProtoOffset));
>                                 addToGraph(PutByOffset, OpInfo(data), object, object, weakJSConstant(prototype));
>                             }
>@@ -5550,7 +5530,7 @@ void ByteCodeParser::parseBlock(unsigned
>             Node* value = get(bytecode.value);
>             Node* base = get(bytecode.base);
>             unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[bytecode.property];
>-            bool direct = bytecode.metadata(codeBlock).flags & PutByIdIsDirect;
>+            bool direct = !!(bytecode.flags & PutByIdIsDirect);
> 
>             PutByIdStatus putByIdStatus = PutByIdStatus::computeFor(
>                 m_inlineStackTop->m_profiledBlock,
>Index: Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp	(working copy)
>@@ -34,7 +34,6 @@
> #include "DFGBasicBlockInlines.h"
> #include "DFGGraph.h"
> #include "DFGInPlaceAbstractState.h"
>-#include "DFGInferredTypeCheck.h"
> #include "DFGInsertionSet.h"
> #include "DFGPhase.h"
> #include "GetByIdStatus.h"
>@@ -477,8 +476,7 @@ private:
>                         && variant.oldStructure().onlyStructure() == variant.newStructure()) {
>                         variant = PutByIdVariant::replace(
>                             variant.oldStructure(),
>-                            variant.offset(),
>-                            variant.requiredType());
>+                            variant.offset());
>                         changed = true;
>                     }
>                 }
>@@ -727,10 +725,6 @@ private:
>                                         StorageAccessData* data = m_graph.m_storageAccessData.add();
>                                         data->offset = knownPolyProtoOffset;
>                                         data->identifierNumber = m_graph.identifiers().ensure(m_graph.m_vm.propertyNames->builtinNames().polyProtoName().impl());
>-                                        InferredType::Descriptor inferredType = InferredType::Top;
>-                                        data->inferredType = inferredType;
>-                                        m_graph.registerInferredType(inferredType);
>-
>                                         NodeOrigin origin = node->origin.withInvalidExit();
>                                         Node* prototypeNode = m_insertionSet.insertConstant(
>                                             indexInBlock + 1, origin, m_graph.freeze(prototype));
>@@ -1074,7 +1068,7 @@ private:
>     
>     void emitGetByOffset(
>         unsigned indexInBlock, Node* node, Edge childEdge, unsigned identifierNumber,
>-        PropertyOffset offset, const InferredType::Descriptor& inferredType = InferredType::Top)
>+        PropertyOffset offset)
>     {
>         childEdge.setUseKind(KnownCellUse);
>         
>@@ -1090,7 +1084,6 @@ private:
>         StorageAccessData& data = *m_graph.m_storageAccessData.add();
>         data.offset = offset;
>         data.identifierNumber = identifierNumber;
>-        data.inferredType = inferredType;
>         
>         node->convertToGetByOffset(data, propertyStorage, childEdge);
>     }
>@@ -1101,8 +1094,6 @@ private:
>         Edge childEdge = node->child1();
> 
>         addBaseCheck(indexInBlock, node, baseValue, variant.oldStructure());
>-        insertInferredTypeCheck(
>-            m_insertionSet, indexInBlock, origin, node->child2().node(), variant.requiredType());
> 
>         node->child1().setUseKind(KnownCellUse);
>         childEdge.setUseKind(KnownCellUse);
>Index: Source/JavaScriptCore/dfg/DFGDesiredInferredType.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGDesiredInferredType.h	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGDesiredInferredType.h	(nonexistent)
>@@ -1,128 +0,0 @@
>-/*
>- * Copyright (C) 2015 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#pragma once
>-
>-#if ENABLE(DFG_JIT)
>-
>-#include "InferredType.h"
>-#include <wtf/HashMap.h>
>-
>-namespace JSC { namespace DFG {
>-
>-// This documents the DFG's expectation for an InferredType: specifically, that we want it to have a live
>-// InferredType object and that this object has the type that we originally saw.
>-
>-class DesiredInferredType {
>-public:
>-    DesiredInferredType()
>-        : m_object(nullptr)
>-    {
>-    }
>-    
>-    DesiredInferredType(InferredType* object, const InferredType::Descriptor& expected)
>-        : m_object(object)
>-        , m_expected(expected)
>-    {
>-    }
>-
>-    DesiredInferredType(WTF::HashTableDeletedValueType)
>-        : m_object(nullptr)
>-        , m_expected(InferredType::Top)
>-    {
>-    }
>-
>-    explicit operator bool() const { return m_object && m_expected; }
>-
>-    InferredType* object() const { return m_object; }
>-    InferredType::Descriptor expected() const { return m_expected; }
>-
>-    bool isStillValid() const
>-    {
>-        return m_object->canWatch(m_expected);
>-    }
>-
>-    void add(Watchpoint* watchpoint) const
>-    {
>-        m_object->addWatchpoint(watchpoint);
>-    }
>-
>-    bool operator==(const DesiredInferredType& other) const
>-    {
>-        return m_object == other.m_object
>-            && m_expected == other.m_expected;
>-    }
>-
>-    bool operator!=(const DesiredInferredType& other) const
>-    {
>-        return !(*this == other);
>-    }
>-
>-    bool isHashTableDeletedValue() const
>-    {
>-        return !m_object && m_expected == InferredType::Top;
>-    }
>-
>-    unsigned hash() const
>-    {
>-        return WTF::PtrHash<InferredType*>::hash(m_object) + m_expected.hash() * 7;
>-    }
>-
>-    void dumpInContext(PrintStream& out, DumpContext* context) const
>-    {
>-        out.print(inContext(m_expected, context), " for ", RawPointer(m_object));
>-    }
>-
>-    void dump(PrintStream& out) const
>-    {
>-        dumpInContext(out, nullptr);
>-    }
>-
>-private:
>-    InferredType* m_object;
>-    InferredType::Descriptor m_expected;
>-};
>-
>-struct DesiredInferredTypeHash {
>-    static unsigned hash(const DesiredInferredType& key) { return key.hash(); }
>-    static bool equal(const DesiredInferredType& a, const DesiredInferredType& b) { return a == b; }
>-    static const bool safeToCompareToEmptyOrDeleted = true;
>-};
>-
>-} } // namespace JSC::DFG
>-
>-namespace WTF {
>-
>-template<typename T> struct DefaultHash;
>-template<> struct DefaultHash<JSC::DFG::DesiredInferredType> {
>-    typedef JSC::DFG::DesiredInferredTypeHash Hash;
>-};
>-
>-template<typename T> struct HashTraits;
>-template<> struct HashTraits<JSC::DFG::DesiredInferredType> : SimpleClassHashTraits<JSC::DFG::DesiredInferredType> { };
>-
>-} // namespace WTF
>-
>-#endif // ENABLE(DFG_JIT)
>Index: Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp	(working copy)
>@@ -69,11 +69,6 @@ void AdaptiveStructureWatchpointAdaptor:
>     }
> }
> 
>-void InferredTypeAdaptor::add(CodeBlock* codeBlock, const DesiredInferredType& key, CommonData& common)
>-{
>-    key.add(common.watchpoints.add(codeBlock));
>-}
>-
> DesiredWatchpoints::DesiredWatchpoints() { }
> DesiredWatchpoints::~DesiredWatchpoints() { }
> 
>@@ -102,11 +97,6 @@ void DesiredWatchpoints::addLazily(const
>     m_adaptiveStructureSets.addLazily(key);
> }
> 
>-void DesiredWatchpoints::addLazily(const DesiredInferredType& key)
>-{
>-    m_inferredTypes.addLazily(key);
>-}
>-
> bool DesiredWatchpoints::consider(Structure* structure)
> {
>     if (!structure->dfgShouldWatch())
>@@ -122,7 +112,6 @@ void DesiredWatchpoints::reallyAdd(CodeB
>     m_inferredValues.reallyAdd(codeBlock, commonData);
>     m_bufferViews.reallyAdd(codeBlock, commonData);
>     m_adaptiveStructureSets.reallyAdd(codeBlock, commonData);
>-    m_inferredTypes.reallyAdd(codeBlock, commonData);
> }
> 
> bool DesiredWatchpoints::areStillValid() const
>@@ -131,8 +120,7 @@ bool DesiredWatchpoints::areStillValid()
>         && m_inlineSets.areStillValid()
>         && m_inferredValues.areStillValid()
>         && m_bufferViews.areStillValid()
>-        && m_adaptiveStructureSets.areStillValid()
>-        && m_inferredTypes.areStillValid();
>+        && m_adaptiveStructureSets.areStillValid();
> }
> 
> void DesiredWatchpoints::dumpInContext(PrintStream& out, DumpContext* context) const
>@@ -143,7 +131,6 @@ void DesiredWatchpoints::dumpInContext(P
>     out.print("    Inferred values: ", inContext(m_inferredValues, context), "\n");
>     out.print("    Buffer views: ", inContext(m_bufferViews, context), "\n");
>     out.print("    Object property conditions: ", inContext(m_adaptiveStructureSets, context), "\n");
>-    out.print("    Inferred types: ", inContext(m_inferredTypes, context), "\n");
> }
> 
> } } // namespace JSC::DFG
>Index: Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h	(working copy)
>@@ -28,7 +28,6 @@
> #if ENABLE(DFG_JIT)
> 
> #include "DFGCommonData.h"
>-#include "DFGDesiredInferredType.h"
> #include "InferredValue.h"
> #include "JSArrayBufferView.h"
> #include "ObjectPropertyCondition.h"
>@@ -93,18 +92,6 @@ struct AdaptiveStructureWatchpointAdapto
>     }
> };
> 
>-struct InferredTypeAdaptor {
>-    static void add(CodeBlock*, const DesiredInferredType&, CommonData&);
>-    static bool hasBeenInvalidated(const DesiredInferredType& key)
>-    {
>-        return !key.isStillValid();
>-    }
>-    static void dumpInContext(PrintStream& out, const DesiredInferredType& key, DumpContext* context)
>-    {
>-        out.print(inContext(key, context));
>-    }
>-};
>-
> template<typename WatchpointSetType, typename Adaptor = SetPointerAdaptor<WatchpointSetType>>
> class GenericDesiredWatchpoints {
> #if !ASSERT_DISABLED
>@@ -173,10 +160,6 @@ public:
>     // It's recommended that you don't call this directly. Use Graph::watchCondition(), which does
>     // the required GC magic as well as some other bookkeeping.
>     void addLazily(const ObjectPropertyCondition&);
>-
>-    // It's recommended that you don't call this directly. Use Graph::inferredTypeFor(), which does
>-    // the required GC magic.
>-    void addLazily(const DesiredInferredType&);
>     
>     bool consider(Structure*);
>     
>@@ -204,11 +187,6 @@ public:
>     {
>         return m_adaptiveStructureSets.isWatched(key);
>     }
>-    bool isWatched(const DesiredInferredType& key)
>-    {
>-        return m_inferredTypes.isWatched(key);
>-    }
>-
>     void dumpInContext(PrintStream&, DumpContext*) const;
>     void dump(PrintStream&) const;
>     
>@@ -218,7 +196,6 @@ private:
>     GenericDesiredWatchpoints<InferredValue*, InferredValueAdaptor> m_inferredValues;
>     GenericDesiredWatchpoints<JSArrayBufferView*, ArrayBufferViewWatchpointAdaptor> m_bufferViews;
>     GenericDesiredWatchpoints<ObjectPropertyCondition, AdaptiveStructureWatchpointAdaptor> m_adaptiveStructureSets;
>-    GenericDesiredWatchpoints<DesiredInferredType, InferredTypeAdaptor> m_inferredTypes;
> };
> 
> } } // namespace JSC::DFG
>Index: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(working copy)
>@@ -30,7 +30,6 @@
> 
> #include "ArrayPrototype.h"
> #include "DFGGraph.h"
>-#include "DFGInferredTypeCheck.h"
> #include "DFGInsertionSet.h"
> #include "DFGPhase.h"
> #include "DFGPredictionPropagationPhase.h"
>@@ -1633,10 +1632,6 @@ private:
>             if (!node->child1()->hasStorageResult())
>                 fixEdge<KnownCellUse>(node->child1());
>             fixEdge<KnownCellUse>(node->child2());
>-            unsigned index = indexForChecks();
>-            insertInferredTypeCheck(
>-                m_insertionSet, index, originForCheck(index), node->child3().node(),
>-                node->storageAccessData().inferredType);
>             speculateForBarrier(node->child3());
>             break;
>         }
>Index: Source/JavaScriptCore/dfg/DFGGraph.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGGraph.cpp	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGGraph.cpp	(working copy)
>@@ -281,7 +281,6 @@ void Graph::dump(PrintStream& out, const
>         StorageAccessData& storageAccessData = node->storageAccessData();
>         out.print(comma, "id", storageAccessData.identifierNumber, "{", identifiers()[storageAccessData.identifierNumber], "}");
>         out.print(", ", static_cast<ptrdiff_t>(storageAccessData.offset));
>-        out.print(", inferredType = ", inContext(storageAccessData.inferredType, context));
>     }
>     if (node->hasMultiGetByOffsetData()) {
>         MultiGetByOffsetData& data = node->multiGetByOffsetData();
>@@ -1059,38 +1058,6 @@ bool Graph::isSafeToLoad(JSObject* base,
>     return m_safeToLoad.contains(std::make_pair(base, offset));
> }
> 
>-InferredType::Descriptor Graph::inferredTypeFor(const PropertyTypeKey& key)
>-{
>-    assertIsRegistered(key.structure());
>-    
>-    auto iter = m_inferredTypes.find(key);
>-    if (iter != m_inferredTypes.end())
>-        return iter->value;
>-
>-    InferredType* typeObject = key.structure()->inferredTypeFor(key.uid());
>-    if (!typeObject) {
>-        m_inferredTypes.add(key, InferredType::Top);
>-        return InferredType::Top;
>-    }
>-
>-    InferredType::Descriptor typeDescriptor = typeObject->descriptor();
>-    if (typeDescriptor.kind() == InferredType::Top) {
>-        m_inferredTypes.add(key, InferredType::Top);
>-        return InferredType::Top;
>-    }
>-    
>-    m_inferredTypes.add(key, typeDescriptor);
>-
>-    m_plan.weakReferences().addLazily(typeObject);
>-    registerInferredType(typeDescriptor);
>-
>-    // Note that we may already be watching this desired inferred type, because multiple structures may
>-    // point to the same InferredType instance.
>-    m_plan.watchpoints().addLazily(DesiredInferredType(typeObject, typeDescriptor));
>-
>-    return typeDescriptor;
>-}
>-
> FullBytecodeLiveness& Graph::livenessFor(CodeBlock* codeBlock)
> {
>     HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>>::iterator iter = m_bytecodeLiveness.find(codeBlock);
>@@ -1320,22 +1287,7 @@ JSValue Graph::tryGetConstantProperty(co
> }
> 
> AbstractValue Graph::inferredValueForProperty(
>-    const RegisteredStructureSet& base, UniquedStringImpl* uid, StructureClobberState clobberState)
>-{
>-    AbstractValue result;
>-    base.forEach(
>-        [&] (RegisteredStructure structure) {
>-            AbstractValue value;
>-            value.set(*this, inferredTypeForProperty(structure.get(), uid));
>-            result.merge(value);
>-        });
>-    if (clobberState == StructuresAreClobbered)
>-        result.clobberStructures();
>-    return result;
>-}
>-
>-AbstractValue Graph::inferredValueForProperty(
>-    const AbstractValue& base, UniquedStringImpl* uid, PropertyOffset offset,
>+    const AbstractValue& base, PropertyOffset offset,
>     StructureClobberState clobberState)
> {
>     if (JSValue value = tryGetConstantProperty(base, offset)) {
>@@ -1344,9 +1296,6 @@ AbstractValue Graph::inferredValueForPro
>         return result;
>     }
> 
>-    if (base.m_structure.isFinite())
>-        return inferredValueForProperty(base.m_structure.set(), uid, clobberState);
>-
>     return AbstractValue::heapTop();
> }
> 
>Index: Source/JavaScriptCore/dfg/DFGGraph.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGGraph.h	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGGraph.h	(working copy)
>@@ -797,26 +797,10 @@ public:
>     // computed by tracking which conditions we track with watchCondition().
>     bool isSafeToLoad(JSObject* base, PropertyOffset);
> 
>-    void registerInferredType(const InferredType::Descriptor& type)
>-    {
>-        if (type.structure())
>-            registerStructure(type.structure());
>-    }
>-
>-    // Tells us what inferred type we are able to prove the property to have now and in the future.
>-    InferredType::Descriptor inferredTypeFor(const PropertyTypeKey&);
>-    InferredType::Descriptor inferredTypeForProperty(Structure* structure, UniquedStringImpl* uid)
>-    {
>-        return inferredTypeFor(PropertyTypeKey(structure, uid));
>-    }
>-
>-    AbstractValue inferredValueForProperty(
>-        const RegisteredStructureSet& base, UniquedStringImpl* uid, StructureClobberState = StructuresAreWatched);
>-
>     // This uses either constant property inference or property type inference to derive a good abstract
>     // value for some property accessed with the given abstract value base.
>     AbstractValue inferredValueForProperty(
>-        const AbstractValue& base, UniquedStringImpl* uid, PropertyOffset, StructureClobberState);
>+        const AbstractValue& base, PropertyOffset, StructureClobberState);
>     
>     FullBytecodeLiveness& livenessFor(CodeBlock*);
>     FullBytecodeLiveness& livenessFor(InlineCallFrame*);
>@@ -1065,7 +1049,6 @@ public:
>     HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
>     HashMap<CodeBlock*, std::unique_ptr<BytecodeKills>> m_bytecodeKills;
>     HashSet<std::pair<JSObject*, PropertyOffset>> m_safeToLoad;
>-    HashMap<PropertyTypeKey, InferredType::Descriptor> m_inferredTypes;
>     Vector<Ref<Snippet>> m_domJITSnippets;
>     std::unique_ptr<CPSDominators> m_cpsDominators;
>     std::unique_ptr<SSADominators> m_ssaDominators;
>Index: Source/JavaScriptCore/dfg/DFGInferredTypeCheck.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGInferredTypeCheck.cpp	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGInferredTypeCheck.cpp	(nonexistent)
>@@ -1,106 +0,0 @@
>-/*
>- * Copyright (C) 2015 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>- */
>-
>-#include "config.h"
>-#include "DFGInferredTypeCheck.h"
>-
>-#if ENABLE(DFG_JIT)
>-
>-#include "JSCInlines.h"
>-
>-namespace JSC { namespace DFG {
>-
>-void insertInferredTypeCheck(
>-    InsertionSet& insertionSet, unsigned nodeIndex, NodeOrigin origin, Node* baseNode,
>-    const InferredType::Descriptor& type)
>-{
>-    insertionSet.graph().registerInferredType(type);
>-    
>-    switch (type.kind()) {
>-    case InferredType::Bottom:
>-        insertionSet.insertNode(nodeIndex, SpecNone, ForceOSRExit, origin);
>-        return;
>-
>-    case InferredType::Boolean:
>-        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, BooleanUse));
>-        return;
>-
>-    case InferredType::Other:
>-        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, OtherUse));
>-        return;
>-
>-    case InferredType::Int32:
>-        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, Int32Use));
>-        return;
>-
>-    case InferredType::Number:
>-        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, NumberUse));
>-        return;
>-
>-    case InferredType::String:
>-        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, StringUse));
>-        return;
>-
>-    case InferredType::Symbol:
>-        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, SymbolUse));
>-        return;
>-
>-    case InferredType::BigInt:
>-        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, BigIntUse));
>-        return;
>-
>-    case InferredType::ObjectWithStructure:
>-        insertionSet.insertNode(
>-            nodeIndex, SpecNone, CheckStructure, origin,
>-            OpInfo(insertionSet.graph().addStructureSet(type.structure())),
>-            Edge(baseNode, CellUse));
>-        return;
>-
>-    case InferredType::ObjectWithStructureOrOther:
>-        insertionSet.insertNode(
>-            nodeIndex, SpecNone, CheckStructure, origin,
>-            OpInfo(insertionSet.graph().addStructureSet(type.structure())),
>-            Edge(baseNode, CellOrOtherUse));
>-        return;
>-
>-    case InferredType::Object:
>-        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, ObjectUse));
>-        return;
>-
>-    case InferredType::ObjectOrOther:
>-        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, ObjectOrOtherUse));
>-        return;
>-
>-    case InferredType::Top:
>-        return;
>-    }
>-
>-    DFG_CRASH(insertionSet.graph(), baseNode, "Bad inferred type");
>-}
>-
>-} } // namespace JSC::DFG
>-
>-#endif // ENABLE(DFG_JIT)
>-
>Index: Source/JavaScriptCore/dfg/DFGInferredTypeCheck.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGInferredTypeCheck.h	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGInferredTypeCheck.h	(nonexistent)
>@@ -1,41 +0,0 @@
>-/*
>- * Copyright (C) 2015 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>- */
>-
>-#pragma once
>-
>-#if ENABLE(DFG_JIT)
>-
>-#include "DFGInsertionSet.h"
>-#include "InferredType.h"
>-
>-namespace JSC { namespace DFG {
>-
>-// Inserts a type check that ensures that baseNode has the given inferred type.
>-void insertInferredTypeCheck(
>-    InsertionSet&, unsigned nodeIndex, NodeOrigin, Node* baseNode, const InferredType::Descriptor&);
>-
>-} } // namespace JSC::DFG
>-
>-#endif // ENABLE(DFG_JIT)
>Index: Source/JavaScriptCore/dfg/DFGNode.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGNode.h	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGNode.h	(working copy)
>@@ -81,11 +81,6 @@ struct BasicBlock;
> struct StorageAccessData {
>     PropertyOffset offset;
>     unsigned identifierNumber;
>-
>-    // This needs to know the inferred type. For puts, this is necessary because we need to remember
>-    // what check is needed. For gets, this is necessary because otherwise AI might forget what type is
>-    // guaranteed.
>-    InferredType::Descriptor inferredType;
> };
> 
> struct MultiPutByOffsetData {
>Index: Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp	(working copy)
>@@ -2294,14 +2294,14 @@ private:
>                         // at this point, we can simply trust that the incoming value has the right type
>                         // for whatever structure we are using.
>                         data->variants.append(
>-                            PutByIdVariant::replace(currentSet, currentOffset, InferredType::Top));
>+                            PutByIdVariant::replace(currentSet, currentOffset));
>                         currentOffset = offset;
>                         currentSet.clear();
>                     }
>                     currentSet.add(structure.get());
>                 }
>                 data->variants.append(
>-                    PutByIdVariant::replace(currentSet, currentOffset, InferredType::Top));
>+                    PutByIdVariant::replace(currentSet, currentOffset));
>             }
> 
>             return m_graph.addNode(
>Index: Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSafeToExecute.h	(revision 239966)
>+++ Source/JavaScriptCore/dfg/DFGSafeToExecute.h	(working copy)
>@@ -541,31 +541,10 @@ bool safeToExecute(AbstractStateType& st
>     case PutByOffset: {
>         StorageAccessData& data = node->storageAccessData();
>         PropertyOffset offset = data.offset;
>-        UniquedStringImpl* uid = graph.identifiers()[data.identifierNumber];
>-
>-        InferredType::Descriptor inferredType;
>-        switch (node->op()) {
>-        case GetByOffset:
>-        case GetGetterSetterByOffset:
>-            inferredType = data.inferredType;
>-            break;
>-        case PutByOffset:
>-            // PutByOffset knows about inferred types because it's the enforcer of that type rather
>-            // than the consumer of that type. Therefore, PutByOffset expects TOP for the purpose of
>-            // safe-to-execute in the sense that it will be happy with anything as general as TOP
>-            // (so any type).
>-            inferredType = InferredType::Top;
>-            break;
>-        default:
>-            DFG_CRASH(graph, node, "Bad opcode");
>-            break;
>-        }
>-
>         // Graph::isSafeToLoad() is all about proofs derived from PropertyConditions. Those don't
>         // know anything about inferred types. But if we have a proof derived from watching a
>         // structure that has a type proof, then the next case below will deal with it.
>-        if (state.structureClobberState() == StructuresAreWatched
>-            && inferredType.kind() == InferredType::Top) {
>+        if (state.structureClobberState() == StructuresAreWatched) {
>             if (JSObject* knownBase = node->child1()->dynamicCastConstant<JSObject*>(graph.m_vm)) {
>                 if (graph.isSafeToLoad(knownBase, offset))
>                     return true;
>@@ -579,12 +558,6 @@ bool safeToExecute(AbstractStateType& st
>             Structure* thisStructure = value[i].get();
>             if (!thisStructure->isValidOffset(offset))
>                 return false;
>-            if (inferredType.kind() != InferredType::Top) {
>-                InferredType::Descriptor thisInferredType =
>-                    graph.inferredTypeForProperty(thisStructure, uid);
>-                if (!inferredType.subsumes(thisInferredType))
>-                    return false;
>-            }
>         }
>         return true;
>     }
>Index: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp	(revision 239966)
>+++ Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp	(working copy)
>@@ -6920,8 +6920,6 @@ private:
>             
>             PutByIdVariant variant = data.variants[i];
> 
>-            checkInferredType(m_node->child2(), value, variant.requiredType());
>-            
>             LValue storage;
>             if (variant.kind() == PutByIdVariant::Replace) {
>                 if (isInlineOffset(variant.offset()))
>@@ -11530,148 +11528,6 @@ private:
>         return m_out.phi(Int32, results);
>     }
> 
>-    void checkInferredType(Edge edge, LValue value, const InferredType::Descriptor& type)
>-    {
>-        // This cannot use FTL_TYPE_CHECK or typeCheck() because it is called partially, as in a node like:
>-        //
>-        //     MultiPutByOffset(...)
>-        //
>-        // may be lowered to:
>-        //
>-        //     switch (object->structure) {
>-        //     case 42:
>-        //         checkInferredType(..., type1);
>-        //         ...
>-        //         break;
>-        //     case 43:
>-        //         checkInferredType(..., type2);
>-        //         ...
>-        //         break;
>-        //     }
>-        //
>-        // where type1 and type2 are different. Using typeCheck() would mean that the edge would be
>-        // filtered by type1 & type2, instead of type1 | type2.
>-        
>-        switch (type.kind()) {
>-        case InferredType::Bottom:
>-            speculate(BadType, jsValueValue(value), edge.node(), m_out.booleanTrue);
>-            return;
>-
>-        case InferredType::Boolean:
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotBoolean(value, provenType(edge)));
>-            return;
>-
>-        case InferredType::Other:
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotOther(value, provenType(edge)));
>-            return;
>-
>-        case InferredType::Int32:
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotInt32(value, provenType(edge)));
>-            return;
>-
>-        case InferredType::Number:
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotNumber(value, provenType(edge)));
>-            return;
>-
>-        case InferredType::String:
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotCell(value, provenType(edge)));
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotString(value, provenType(edge)));
>-            return;
>-
>-        case InferredType::Symbol:
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotCell(value, provenType(edge)));
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotSymbol(value, provenType(edge)));
>-            return;
>-
>-        case InferredType::BigInt:
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotCell(value, provenType(edge)));
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotBigInt(value, provenType(edge)));
>-            return;
>-
>-        case InferredType::ObjectWithStructure: {
>-            RegisteredStructure structure = m_graph.registerStructure(type.structure());
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotCell(value, provenType(edge)));
>-            if (!abstractValue(edge).m_structure.isSubsetOf(RegisteredStructureSet(structure))) {
>-                speculate(
>-                    BadType, jsValueValue(value), edge.node(),
>-                    m_out.notEqual(
>-                        m_out.load32(value, m_heaps.JSCell_structureID),
>-                        weakStructureID(structure)));
>-            }
>-            return;
>-        }
>-
>-        case InferredType::ObjectWithStructureOrOther: {
>-            LBasicBlock cellCase = m_out.newBlock();
>-            LBasicBlock notCellCase = m_out.newBlock();
>-            LBasicBlock continuation = m_out.newBlock();
>-
>-            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));
>-
>-            LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
>-
>-            RegisteredStructure structure = m_graph.registerStructure(type.structure());
>-            if (!abstractValue(edge).m_structure.isSubsetOf(RegisteredStructureSet(structure))) {
>-                speculate(
>-                    BadType, jsValueValue(value), edge.node(),
>-                    m_out.notEqual(
>-                        m_out.load32(value, m_heaps.JSCell_structureID),
>-                        weakStructureID(structure)));
>-            }
>-
>-            m_out.jump(continuation);
>-
>-            m_out.appendTo(notCellCase, continuation);
>-
>-            speculate(
>-                BadType, jsValueValue(value), edge.node(),
>-                isNotOther(value, provenType(edge) & ~SpecCell));
>-
>-            m_out.jump(continuation);
>-
>-            m_out.appendTo(continuation, lastNext);
>-            return;
>-        }
>-
>-        case InferredType::Object:
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotCell(value, provenType(edge)));
>-            speculate(BadType, jsValueValue(value), edge.node(), isNotObject(value, provenType(edge)));
>-            return;
>-
>-        case InferredType::ObjectOrOther: {
>-            LBasicBlock cellCase = m_out.newBlock();
>-            LBasicBlock notCellCase = m_out.newBlock();
>-            LBasicBlock continuation = m_out.newBlock();
>-
>-            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));
>-
>-            LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
>-
>-            speculate(
>-                BadType, jsValueValue(value), edge.node(),
>-                isNotObject(value, provenType(edge) & SpecCell));
>-
>-            m_out.jump(continuation);
>-
>-            m_out.appendTo(notCellCase, continuation);
>-
>-            speculate(
>-                BadType, jsValueValue(value), edge.node(),
>-                isNotOther(value, provenType(edge) & ~SpecCell));
>-
>-            m_out.jump(continuation);
>-
>-            m_out.appendTo(continuation, lastNext);
>-            return;
>-        }
>-
>-        case InferredType::Top:
>-            return;
>-        }
>-
>-        DFG_CRASH(m_graph, m_node, "Bad inferred type");
>-    }
>-    
>     LValue loadProperty(LValue storage, unsigned identifierNumber, PropertyOffset offset)
>     {
>         return m_out.load64(addressOfProperty(storage, identifierNumber, offset));
>Index: Source/JavaScriptCore/generator/DSL.rb
>===================================================================
>--- Source/JavaScriptCore/generator/DSL.rb	(revision 239966)
>+++ Source/JavaScriptCore/generator/DSL.rb	(working copy)
>@@ -123,6 +123,8 @@ module DSL
> #include "GetByIdMetadata.h"
> #include "Instruction.h"
> #include "Opcode.h"
>+#include "PutByIdStatus.h"
>+#include "PutByIdFlags.h"
> #include "ToThisStatus.h"
> 
> namespace JSC {
>Index: Source/JavaScriptCore/heap/Heap.cpp
>===================================================================
>--- Source/JavaScriptCore/heap/Heap.cpp	(revision 239966)
>+++ Source/JavaScriptCore/heap/Heap.cpp	(working copy)
>@@ -41,7 +41,6 @@
> #include "HeapSnapshot.h"
> #include "HeapVerifier.h"
> #include "IncrementalSweeper.h"
>-#include "InferredTypeInlines.h"
> #include "InferredValueInlines.h"
> #include "Interpreter.h"
> #include "IsoCellSetInlines.h"
>@@ -586,7 +585,6 @@ void Heap::finalizeMarkedUnconditionalFi
> 
> void Heap::finalizeUnconditionalFinalizers()
> {
>-    finalizeMarkedUnconditionalFinalizers<InferredType>(vm()->inferredTypesWithFinalizers);
>     finalizeMarkedUnconditionalFinalizers<InferredValue>(vm()->inferredValuesWithFinalizers);
>     vm()->forEachCodeBlockSpace(
>         [&] (auto& space) {
>Index: Source/JavaScriptCore/jit/AssemblyHelpers.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/AssemblyHelpers.cpp	(revision 239966)
>+++ Source/JavaScriptCore/jit/AssemblyHelpers.cpp	(working copy)
>@@ -50,88 +50,6 @@ ExecutableBase* AssemblyHelpers::executa
>     return codeOrigin.inlineCallFrame->baselineCodeBlock->ownerExecutable();
> }
> 
>-AssemblyHelpers::JumpList AssemblyHelpers::branchIfNotType(
>-    JSValueRegs regs, GPRReg tempGPR, const InferredType::Descriptor& descriptor, TagRegistersMode mode)
>-{
>-    AssemblyHelpers::JumpList result;
>-
>-    switch (descriptor.kind()) {
>-    case InferredType::Bottom:
>-        result.append(jump());
>-        break;
>-
>-    case InferredType::Boolean:
>-        result.append(branchIfNotBoolean(regs, tempGPR));
>-        break;
>-
>-    case InferredType::Other:
>-        result.append(branchIfNotOther(regs, tempGPR));
>-        break;
>-
>-    case InferredType::Int32:
>-        result.append(branchIfNotInt32(regs, mode));
>-        break;
>-
>-    case InferredType::Number:
>-        result.append(branchIfNotNumber(regs, tempGPR, mode));
>-        break;
>-
>-    case InferredType::String:
>-        result.append(branchIfNotCell(regs, mode));
>-        result.append(branchIfNotString(regs.payloadGPR()));
>-        break;
>-
>-    case InferredType::Symbol:
>-        result.append(branchIfNotCell(regs, mode));
>-        result.append(branchIfNotSymbol(regs.payloadGPR()));
>-        break;
>-
>-    case InferredType::BigInt:
>-        result.append(branchIfNotCell(regs, mode));
>-        result.append(branchIfNotBigInt(regs.payloadGPR()));
>-        break;
>-
>-    case InferredType::ObjectWithStructure:
>-        result.append(branchIfNotCell(regs, mode));
>-        result.append(
>-            branchStructure(
>-                NotEqual,
>-                Address(regs.payloadGPR(), JSCell::structureIDOffset()),
>-                descriptor.structure()));
>-        break;
>-
>-    case InferredType::ObjectWithStructureOrOther: {
>-        Jump ok = branchIfOther(regs, tempGPR);
>-        result.append(branchIfNotCell(regs, mode));
>-        result.append(
>-            branchStructure(
>-                NotEqual,
>-                Address(regs.payloadGPR(), JSCell::structureIDOffset()),
>-                descriptor.structure()));
>-        ok.link(this);
>-        break;
>-    }
>-
>-    case InferredType::Object:
>-        result.append(branchIfNotCell(regs, mode));
>-        result.append(branchIfNotObject(regs.payloadGPR()));
>-        break;
>-
>-    case InferredType::ObjectOrOther: {
>-        Jump ok = branchIfOther(regs, tempGPR);
>-        result.append(branchIfNotCell(regs, mode));
>-        result.append(branchIfNotObject(regs.payloadGPR()));
>-        ok.link(this);
>-        break;
>-    }
>-
>-    case InferredType::Top:
>-        break;
>-    }
>-
>-    return result;
>-}
>-
> AssemblyHelpers::Jump AssemblyHelpers::branchIfFastTypedArray(GPRReg baseGPR)
> {
>     return branch32(
>Index: Source/JavaScriptCore/jit/AssemblyHelpers.h
>===================================================================
>--- Source/JavaScriptCore/jit/AssemblyHelpers.h	(revision 239966)
>+++ Source/JavaScriptCore/jit/AssemblyHelpers.h	(working copy)
>@@ -1052,10 +1052,6 @@ public:
> #endif
>     }
> 
>-    JumpList branchIfNotType(
>-        JSValueRegs, GPRReg tempGPR, const InferredType::Descriptor&,
>-        TagRegistersMode = HaveTagRegisters);
>-
>     template<typename T>
>     Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)
>     {
>Index: Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp	(revision 239966)
>+++ Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp	(working copy)
>@@ -661,10 +661,9 @@ void JIT::emit_op_put_by_id(const Instru
>     // such that the Structure & offset are always at the same distance from this.
>     
>     auto bytecode = currentInstruction->as<OpPutById>();
>-    auto& metadata = bytecode.metadata(m_codeBlock);
>     int base = bytecode.base.offset();
>     int value = bytecode.value.offset();
>-    int direct = metadata.flags & PutByIdIsDirect;
>+    bool direct = !!(bytecode.flags & PutByIdIsDirect);
>     
>     emitLoad2(base, regT1, regT0, value, regT3, regT2);
>     
>Index: Source/JavaScriptCore/jit/JITPropertyAccess.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITPropertyAccess.cpp	(revision 239966)
>+++ Source/JavaScriptCore/jit/JITPropertyAccess.cpp	(working copy)
>@@ -659,10 +659,9 @@ void JIT::emitSlow_op_get_by_id_with_thi
> void JIT::emit_op_put_by_id(const Instruction* currentInstruction)
> {
>     auto bytecode = currentInstruction->as<OpPutById>();
>-    auto& metadata = bytecode.metadata(m_codeBlock);
>     int baseVReg = bytecode.base.offset();
>     int valueVReg = bytecode.value.offset();
>-    unsigned direct = metadata.flags & PutByIdIsDirect;
>+    bool direct = !!(bytecode.flags & PutByIdIsDirect);
> 
>     // In order to be able to patch both the Structure, and the object offset, we store one pointer,
>     // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
>Index: Source/JavaScriptCore/jit/Repatch.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/Repatch.cpp	(revision 239966)
>+++ Source/JavaScriptCore/jit/Repatch.cpp	(working copy)
>@@ -470,8 +470,7 @@ static InlineCacheAction tryCachePutByID
>             
>                 if (stubInfo.cacheType == CacheType::Unset
>                     && InlineAccess::canGenerateSelfPropertyReplace(stubInfo, slot.cachedOffset())
>-                    && !structure->needImpurePropertyWatchpoint()
>-                    && !structure->inferredTypeFor(ident.impl())) {
>+                    && !structure->needImpurePropertyWatchpoint()) {
>                     
>                     bool generatedCodeInline = InlineAccess::generateSelfPropertyReplace(stubInfo, structure, slot.cachedOffset());
>                     if (generatedCodeInline) {
>Index: Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp	(revision 239966)
>+++ Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp	(working copy)
>@@ -56,6 +56,7 @@
> #include "MarkedSpace.h"
> #include "MaxFrameExtentForSlowPathCall.h"
> #include "NativeExecutable.h"
>+#include "PutByIdFlags.h"
> #include "ProtoCallFrame.h"
> #include "ShadowChicken.h"
> #include "Structure.h"
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(revision 239966)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(working copy)
>@@ -846,7 +846,7 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id
>     
>     JSValue baseValue = LLINT_OP_C(bytecode.base).jsValue();
>     PutPropertySlot slot(baseValue, codeBlock->isStrictMode(), codeBlock->putByIdContext());
>-    if (metadata.flags & PutByIdIsDirect)
>+    if (bytecode.flags & PutByIdIsDirect)
>         CommonSlowPaths::putDirectWithReify(vm, exec, asObject(baseValue), ident, LLINT_OP_C(bytecode.value).jsValue(), slot);
>     else
>         baseValue.putInline(exec, ident, LLINT_OP_C(bytecode.value).jsValue(), slot);
>@@ -876,7 +876,6 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id
>         metadata.offset = 0;
>         metadata.newStructure = 0;
>         metadata.structureChain.clear();
>-        metadata.flags = static_cast<PutByIdFlags>(metadata.flags & PutByIdPersistentFlagsMask);
>         
>         JSCell* baseCell = baseValue.asCell();
>         Structure* structure = baseCell->structure(vm);
>@@ -900,23 +899,17 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id
>                         metadata.oldStructure = structure->previousID()->id();
>                         metadata.offset = slot.cachedOffset();
>                         metadata.newStructure = structure->id();
>-                        if (!(metadata.flags & PutByIdIsDirect)) {
>+                        if (!(bytecode.flags & PutByIdIsDirect)) {
>                             StructureChain* chain = structure->prototypeChain(exec, asObject(baseCell));
>                             ASSERT(chain);
>                             metadata.structureChain.set(vm, codeBlock, chain);
>                         }
>-                        metadata.flags = static_cast<PutByIdFlags>(
>-                            metadata.flags |
>-                            structure->inferredTypeDescriptorFor(ident.impl()).putByIdFlags());
>                     }
>                 }
>             } else {
>                 structure->didCachePropertyReplacement(vm, slot.cachedOffset());
>                 metadata.oldStructure = structure->id();
>                 metadata.offset = slot.cachedOffset();
>-                metadata.flags = static_cast<PutByIdFlags>(
>-                    metadata.flags |
>-                    structure->inferredTypeDescriptorFor(ident.impl()).putByIdFlags());
>             }
>         }
>     }
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(revision 239966)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(working copy)
>@@ -1408,83 +1408,6 @@ llintOpWithMetadata(op_put_by_id, OpPutB
>     # t0 -> object base
>     # We will lose currentStructureID in the shenanigans below.
> 
>-    get(value, t1)
>-    loadConstantOrVariable(size, t1, t2, t3)
>-    loadi OpPutById::Metadata::flags[t5], t1
>-
>-    # At this point, we have:
>-    # t0 -> object base
>-    # t1 -> put by id flags
>-    # t2 -> value tag
>-    # t3 -> value payload
>-
>-    btinz t1, PutByIdPrimaryTypeMask, .opPutByIdTypeCheckObjectWithStructureOrOther
>-
>-    # We have one of the non-structure type checks. Find out which one.
>-    andi PutByIdSecondaryTypeMask, t1
>-    bilt t1, PutByIdSecondaryTypeString, .opPutByIdTypeCheckLessThanString
>-
>-    # We are one of the following: String, Symbol, Object, ObjectOrOther, Top
>-    bilt t1, PutByIdSecondaryTypeObjectOrOther, .opPutByIdTypeCheckLessThanObjectOrOther
>-
>-    # We are either ObjectOrOther or Top.
>-    bieq t1, PutByIdSecondaryTypeTop, .opPutByIdDoneCheckingTypes
>-
>-    # Check if we are ObjectOrOther.
>-    bieq t2, CellTag, .opPutByIdTypeCheckObject
>-.opPutByIdTypeCheckOther:
>-    bieq t2, NullTag, .opPutByIdDoneCheckingTypes
>-    bieq t2, UndefinedTag, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckLessThanObjectOrOther:
>-    # We are either String, Symbol or Object.
>-    bineq t2, CellTag, .opPutByIdSlow
>-    bieq t1, PutByIdSecondaryTypeObject, .opPutByIdTypeCheckObject
>-    bieq t1, PutByIdSecondaryTypeSymbol, .opPutByIdTypeCheckSymbol
>-    bbeq JSCell::m_type[t3], StringType, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-.opPutByIdTypeCheckObject:
>-    bbaeq JSCell::m_type[t3], ObjectType, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-.opPutByIdTypeCheckSymbol:
>-    bbeq JSCell::m_type[t3], SymbolType, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckLessThanString:
>-    # We are one of the following: Bottom, Boolean, Other, Int32, Number.
>-    bilt t1, PutByIdSecondaryTypeInt32, .opPutByIdTypeCheckLessThanInt32
>-
>-    # We are either Int32 or Number.
>-    bieq t1, PutByIdSecondaryTypeNumber, .opPutByIdTypeCheckNumber
>-
>-    bieq t2, Int32Tag, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckNumber:
>-    bib t2, LowestTag + 1, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckLessThanInt32:
>-    # We are one of the following: Bottom, Boolean, Other
>-    bineq t1, PutByIdSecondaryTypeBoolean, .opPutByIdTypeCheckBottomOrOther
>-    bieq t2, BooleanTag, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckBottomOrOther:
>-    bieq t1, PutByIdSecondaryTypeOther, .opPutByIdTypeCheckOther
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckObjectWithStructureOrOther:
>-    bieq t2, CellTag, .opPutByIdTypeCheckObjectWithStructure
>-    btinz t1, PutByIdPrimaryTypeObjectWithStructureOrOther, .opPutByIdTypeCheckOther
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckObjectWithStructure:
>-    andi PutByIdSecondaryTypeMask, t1
>-    bineq t1, JSCell::m_structureID[t3], .opPutByIdSlow
>-
>-.opPutByIdDoneCheckingTypes:
>     loadi OpPutById::Metadata::newStructure[t5], t1
> 
>     btiz t1, .opPutByIdNotTransition
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(revision 239966)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(working copy)
>@@ -1344,92 +1344,11 @@ llintOpWithMetadata(op_put_by_id, OpPutB
>     bineq t2, JSCell::m_structureID[t0], .opPutByIdSlow
> 
>     # At this point, we have:
>-    # t5 -> metadata
>-    # t2 -> current structure ID
>     # t0 -> object base
>-
>-    get(value, t1)
>-    loadConstantOrVariable(size, t1, t3)
>-
>-    loadi OpPutById::Metadata::flags[t5], t1
>-
>-    # At this point, we have:
>-    # t0 -> object base
>-    # t1 -> put by id flags
>     # t2 -> current structure ID
>-    # t3 -> value to put
>     # t5 -> metadata
> 
>-    btpnz t1, PutByIdPrimaryTypeMask, .opPutByIdTypeCheckObjectWithStructureOrOther
>-
>-    # We have one of the non-structure type checks. Find out which one.
>-    andp PutByIdSecondaryTypeMask, t1
>-    bplt t1, PutByIdSecondaryTypeString, .opPutByIdTypeCheckLessThanString
>-
>-    # We are one of the following: String, Symbol, Object, ObjectOrOther, Top
>-    bplt t1, PutByIdSecondaryTypeObjectOrOther, .opPutByIdTypeCheckLessThanObjectOrOther
>-
>-    # We are either ObjectOrOther or Top.
>-    bpeq t1, PutByIdSecondaryTypeTop, .opPutByIdDoneCheckingTypes
>-
>-    # Check if we are ObjectOrOther.
>-    btqz t3, tagMask, .opPutByIdTypeCheckObject
>-.opPutByIdTypeCheckOther:
>-    andq ~TagBitUndefined, t3
>-    bqeq t3, ValueNull, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckLessThanObjectOrOther:
>-    # We are either String, Symbol or Object.
>-    btqnz t3, tagMask, .opPutByIdSlow
>-    bpeq t1, PutByIdSecondaryTypeObject, .opPutByIdTypeCheckObject
>-    bpeq t1, PutByIdSecondaryTypeSymbol, .opPutByIdTypeCheckSymbol
>-    bbeq JSCell::m_type[t3], StringType, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-.opPutByIdTypeCheckObject:
>-    bbaeq JSCell::m_type[t3], ObjectType, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-.opPutByIdTypeCheckSymbol:
>-    bbeq JSCell::m_type[t3], SymbolType, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckLessThanString:
>-    # We are one of the following: Bottom, Boolean, Other, Int32, Number
>-    bplt t1, PutByIdSecondaryTypeInt32, .opPutByIdTypeCheckLessThanInt32
>-
>-    # We are either Int32 or Number.
>-    bpeq t1, PutByIdSecondaryTypeNumber, .opPutByIdTypeCheckNumber
>-
>-    bqaeq t3, tagTypeNumber, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckNumber:
>-    btqnz t3, tagTypeNumber, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckLessThanInt32:
>-    # We are one of the following: Bottom, Boolean, Other.
>-    bpneq t1, PutByIdSecondaryTypeBoolean, .opPutByIdTypeCheckBottomOrOther
>-    xorq ValueFalse, t3
>-    btqz t3, ~1, .opPutByIdDoneCheckingTypes
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckBottomOrOther:
>-    bpeq t1, PutByIdSecondaryTypeOther, .opPutByIdTypeCheckOther
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckObjectWithStructureOrOther:
>-    btqz t3, tagMask, .opPutByIdTypeCheckObjectWithStructure
>-    btpnz t1, PutByIdPrimaryTypeObjectWithStructureOrOther, .opPutByIdTypeCheckOther
>-    jmp .opPutByIdSlow
>-
>-.opPutByIdTypeCheckObjectWithStructure:
>-    urshiftp 3, t1
>-    bineq t1, JSCell::m_structureID[t3], .opPutByIdSlow
>-
>-.opPutByIdDoneCheckingTypes:
>     loadi OpPutById::Metadata::newStructure[t5], t1
>-    
>     btiz t1, .opPutByIdNotTransition
> 
>     # This is the transition case. t1 holds the new structureID. t2 holds the old structure ID.
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 239966)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(working copy)
>@@ -204,23 +204,6 @@ else
>     const LowestTag = constexpr JSValue::LowestTag
> end
> 
>-# PutByIdFlags data
>-const PutByIdPrimaryTypeMask = constexpr PutByIdPrimaryTypeMask
>-const PutByIdPrimaryTypeSecondary = constexpr PutByIdPrimaryTypeSecondary
>-const PutByIdPrimaryTypeObjectWithStructure = constexpr PutByIdPrimaryTypeObjectWithStructure
>-const PutByIdPrimaryTypeObjectWithStructureOrOther = constexpr PutByIdPrimaryTypeObjectWithStructureOrOther
>-const PutByIdSecondaryTypeMask = constexpr PutByIdSecondaryTypeMask
>-const PutByIdSecondaryTypeBottom = constexpr PutByIdSecondaryTypeBottom
>-const PutByIdSecondaryTypeBoolean = constexpr PutByIdSecondaryTypeBoolean
>-const PutByIdSecondaryTypeOther = constexpr PutByIdSecondaryTypeOther
>-const PutByIdSecondaryTypeInt32 = constexpr PutByIdSecondaryTypeInt32
>-const PutByIdSecondaryTypeNumber = constexpr PutByIdSecondaryTypeNumber
>-const PutByIdSecondaryTypeString = constexpr PutByIdSecondaryTypeString
>-const PutByIdSecondaryTypeSymbol = constexpr PutByIdSecondaryTypeSymbol
>-const PutByIdSecondaryTypeObject = constexpr PutByIdSecondaryTypeObject
>-const PutByIdSecondaryTypeObjectOrOther = constexpr PutByIdSecondaryTypeObjectOrOther
>-const PutByIdSecondaryTypeTop = constexpr PutByIdSecondaryTypeTop
>-
> const CallOpCodeSize = constexpr op_call_length
> 
> const maxFrameExtentForSlowPathCall = constexpr maxFrameExtentForSlowPathCall
>Index: Source/JavaScriptCore/runtime/InferredStructure.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/InferredStructure.cpp	(revision 239966)
>+++ Source/JavaScriptCore/runtime/InferredStructure.cpp	(nonexistent)
>@@ -1,45 +0,0 @@
>-/*
>- * Copyright (C) 2017 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#include "config.h"
>-#include "InferredStructure.h"
>-
>-#include "JSCInlines.h"
>-#include <wtf/IsoMallocInlines.h>
>-
>-namespace JSC {
>-
>-WTF_MAKE_ISO_ALLOCATED_IMPL(InferredStructure);
>-
>-InferredStructure::InferredStructure(VM& vm, InferredType* parent, Structure* structure)
>-    : parent(parent)
>-    , structure(vm, parent, structure)
>-{
>-    structure->addTransitionWatchpoint(&watchpoint);
>-}
>-
>-} // namespace JSC
>-
>-
>Index: Source/JavaScriptCore/runtime/InferredStructure.h
>===================================================================
>--- Source/JavaScriptCore/runtime/InferredStructure.h	(revision 239966)
>+++ Source/JavaScriptCore/runtime/InferredStructure.h	(nonexistent)
>@@ -1,49 +0,0 @@
>-/*
>- * Copyright (C) 2017 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#pragma once
>-
>-#include "InferredStructureWatchpoint.h"
>-#include "WriteBarrier.h"
>-#include <wtf/IsoMalloc.h>
>-
>-namespace JSC {
>-
>-class InferredType;
>-class Structure;
>-
>-class InferredStructure final {
>-    WTF_MAKE_ISO_ALLOCATED(InferredStructure);
>-public:
>-    InferredStructure(VM&, InferredType* parent, Structure*);
>-
>-    InferredType* parent;
>-    WriteBarrier<Structure> structure;
>-    
>-    InferredStructureWatchpoint watchpoint;
>-};
>-
>-} // namespace JSC
>-
>Index: Source/JavaScriptCore/runtime/InferredStructureWatchpoint.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/InferredStructureWatchpoint.cpp	(revision 239966)
>+++ Source/JavaScriptCore/runtime/InferredStructureWatchpoint.cpp	(nonexistent)
>@@ -1,48 +0,0 @@
>-/*
>- * Copyright (C) 2017 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#include "config.h"
>-#include "InferredStructureWatchpoint.h"
>-
>-#include "InferredType.h"
>-
>-namespace JSC {
>-
>-void InferredStructureWatchpoint::fireInternal(VM& vm, const FireDetail&)
>-{
>-    InferredStructure* inferredStructure =
>-        bitwise_cast<InferredStructure*>(
>-            bitwise_cast<char*>(this) - OBJECT_OFFSETOF(InferredStructure, watchpoint));
>-
>-    InferredType* inferredType = inferredStructure->parent;
>-    
>-    if (!inferredType->isLive())
>-        return;
>-    
>-    inferredType->removeStructure(vm);
>-}
>-
>-} // namespace JSC
>-
>Index: Source/JavaScriptCore/runtime/InferredStructureWatchpoint.h
>===================================================================
>--- Source/JavaScriptCore/runtime/InferredStructureWatchpoint.h	(revision 239966)
>+++ Source/JavaScriptCore/runtime/InferredStructureWatchpoint.h	(nonexistent)
>@@ -1,38 +0,0 @@
>-/*
>- * Copyright (C) 2017 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#pragma once
>-
>-#include "Watchpoint.h"
>-
>-namespace JSC {
>-
>-class InferredStructureWatchpoint : public Watchpoint {
>-protected:
>-    void fireInternal(VM&, const FireDetail&) override;
>-};
>-
>-} // namespace JSC
>-
>Index: Source/JavaScriptCore/runtime/InferredType.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/InferredType.cpp	(revision 239966)
>+++ Source/JavaScriptCore/runtime/InferredType.cpp	(nonexistent)
>@@ -1,563 +0,0 @@
>-/*
>- * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#include "config.h"
>-#include "InferredType.h"
>-
>-#include "IsoCellSetInlines.h"
>-#include "JSCInlines.h"
>-
>-namespace JSC {
>-
>-class InferredTypeFireDetail : public FireDetail {
>-public:
>-    InferredTypeFireDetail(
>-        InferredType* inferredType, UniquedStringImpl* uid,
>-        const InferredType::Descriptor& oldDescriptor, const InferredType::Descriptor& newDescriptor,
>-        JSValue offendingValue)
>-        : m_inferredType(inferredType)
>-        , m_uid(uid)
>-        , m_oldDescriptor(oldDescriptor)
>-        , m_newDescriptor(newDescriptor)
>-        , m_offendingValue(offendingValue)
>-    {
>-    }
>-
>-protected:
>-    void dump(PrintStream& out) const override
>-    {
>-        out.print(
>-            "Inferred type changed on ", RawPointer(m_inferredType), " for property ", m_uid, ": "
>-            "old type was ", m_oldDescriptor, " while desired type is ", m_newDescriptor);
>-        if (m_offendingValue)
>-            out.print(" due to ", m_offendingValue);
>-    }
>-
>-private:
>-    InferredType* m_inferredType;
>-    RefPtr<UniquedStringImpl> m_uid;
>-    InferredType::Descriptor m_oldDescriptor;
>-    InferredType::Descriptor m_newDescriptor;
>-    JSValue m_offendingValue;
>-};
>-
>-const ClassInfo InferredType::s_info = { "InferredType", nullptr, nullptr, nullptr, CREATE_METHOD_TABLE(InferredType) };
>-
>-InferredType* InferredType::create(VM& vm)
>-{
>-    InferredType* result = new (NotNull, allocateCell<InferredType>(vm.heap)) InferredType(vm);
>-    result->finishCreation(vm);
>-    return result;
>-}
>-
>-void InferredType::destroy(JSCell* cell)
>-{
>-    InferredType* inferredType = static_cast<InferredType*>(cell);
>-    inferredType->InferredType::~InferredType();
>-}
>-
>-Structure* InferredType::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
>-{
>-    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
>-}
>-
>-void InferredType::visitChildren(JSCell* cell, SlotVisitor& visitor)
>-{
>-    InferredType* inferredType = jsCast<InferredType*>(cell);
>-    Base::visitChildren(cell, visitor);
>-    if (inferredType->m_structure)
>-        visitor.vm().inferredTypesWithFinalizers.add(inferredType);
>-}
>-
>-InferredType::Kind InferredType::kindForFlags(PutByIdFlags flags)
>-{
>-    switch (flags & PutByIdPrimaryTypeMask) {
>-    case PutByIdPrimaryTypeSecondary:
>-        switch (flags & PutByIdSecondaryTypeMask) {
>-        case PutByIdSecondaryTypeBottom:
>-            return Bottom;
>-        case PutByIdSecondaryTypeBoolean:
>-            return Boolean;
>-        case PutByIdSecondaryTypeOther:
>-            return Other;
>-        case PutByIdSecondaryTypeInt32:
>-            return Int32;
>-        case PutByIdSecondaryTypeNumber:
>-            return Number;
>-        case PutByIdSecondaryTypeString:
>-            return String;
>-        case PutByIdSecondaryTypeSymbol:
>-            return Symbol;
>-        case PutByIdSecondaryTypeObject:
>-            return Object;
>-        case PutByIdSecondaryTypeObjectOrOther:
>-            return ObjectOrOther;
>-        case PutByIdSecondaryTypeTop:
>-            return Top;
>-        default:
>-            RELEASE_ASSERT_NOT_REACHED();
>-            return Bottom;
>-        }
>-    case PutByIdPrimaryTypeObjectWithStructure:
>-        return ObjectWithStructure;
>-    case PutByIdPrimaryTypeObjectWithStructureOrOther:
>-        return ObjectWithStructureOrOther;
>-    default:
>-        RELEASE_ASSERT_NOT_REACHED();
>-        return Bottom;
>-    }
>-}
>-
>-InferredType::Descriptor InferredType::Descriptor::forValue(JSValue value)
>-{
>-    if (value.isBoolean())
>-        return Boolean;
>-    if (value.isUndefinedOrNull())
>-        return Other;
>-    if (value.isInt32())
>-        return Int32;
>-    if (value.isNumber())
>-        return Number;
>-    if (value.isCell()) {
>-        JSCell* cell = value.asCell();
>-        if (cell->isString())
>-            return String;
>-        if (cell->isSymbol())
>-            return Symbol;
>-        if (cell->isBigInt())
>-            return BigInt;
>-        if (cell->isObject()) {
>-            if (cell->structure()->transitionWatchpointSetIsStillValid())
>-                return Descriptor(ObjectWithStructure, cell->structure());
>-            return Object;
>-        }
>-    }
>-    return Top;
>-}
>-
>-InferredType::Descriptor InferredType::Descriptor::forFlags(VM& vm, PutByIdFlags flags)
>-{
>-    Kind kind = kindForFlags(flags);
>-    Structure* structure;
>-    if (hasStructure(kind))
>-        structure = vm.heap.structureIDTable().get(decodeStructureID(flags));
>-    else
>-        structure = nullptr;
>-    return Descriptor(kind, structure);
>-}
>-
>-PutByIdFlags InferredType::Descriptor::putByIdFlags() const
>-{
>-    switch (m_kind) {
>-    case Bottom:
>-        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeBottom);
>-    case Boolean:
>-        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeBoolean);
>-    case Other:
>-        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeOther);
>-    case Int32:
>-        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeInt32);
>-    case Number:
>-        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeNumber);
>-    case String:
>-        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeString);
>-    case Symbol:
>-        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeSymbol);
>-    case Object:
>-        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeObject);
>-    case BigInt:
>-    case ObjectOrOther:
>-        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeObjectOrOther);
>-    case Top:
>-        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeTop);
>-    case ObjectWithStructure:
>-        return static_cast<PutByIdFlags>(
>-            PutByIdPrimaryTypeObjectWithStructure | encodeStructureID(m_structure->id()));
>-    case ObjectWithStructureOrOther:
>-        return static_cast<PutByIdFlags>(
>-            PutByIdPrimaryTypeObjectWithStructureOrOther | encodeStructureID(m_structure->id()));
>-    }
>-    RELEASE_ASSERT_NOT_REACHED();
>-    return PutByIdNone;
>-}
>-
>-void InferredType::Descriptor::merge(const Descriptor& other)
>-{
>-    // Filter out common things to simplify the switch statement below.
>-    if (*this == other)
>-        return;
>-    if (other.m_kind == Bottom)
>-        return;
>-
>-    switch (m_kind) {
>-    case Bottom:
>-        *this = other;
>-        return;
>-    case Boolean:
>-    case String:
>-    case Symbol:
>-    case BigInt:
>-        *this = Top;
>-        return;
>-    case Other:
>-        switch (other.m_kind) {
>-        case ObjectWithStructure:
>-        case ObjectWithStructureOrOther:
>-            *this = Descriptor(ObjectWithStructureOrOther, other.structure());
>-            return;
>-        case Object:
>-        case ObjectOrOther:
>-            *this = ObjectOrOther;
>-            return;
>-        default:
>-            *this = Top;
>-            return;
>-        }
>-    case Int32:
>-        switch (other.m_kind) {
>-        case Number:
>-            *this = Number;
>-            return;
>-        default:
>-            *this = Top;
>-            return;
>-        }
>-    case Number:
>-        switch (other.m_kind) {
>-        case Int32:
>-            return;
>-        default:
>-            *this = Top;
>-            return;
>-        }
>-    case ObjectWithStructure:
>-        switch (other.m_kind) {
>-        case ObjectWithStructure: // If we see this here, then we know that the structures didn't match.
>-        case Object:
>-            *this = Object;
>-            return;
>-        case ObjectWithStructureOrOther:
>-            if (m_structure == other.m_structure) {
>-                *this = other;
>-                return;
>-            }
>-            *this = ObjectOrOther;
>-            return;
>-        case ObjectOrOther:
>-            *this = ObjectOrOther;
>-            return;
>-        case Other:
>-            m_kind = ObjectWithStructureOrOther;
>-            return;
>-        default:
>-            *this = Top;
>-            return;
>-        }
>-    case ObjectWithStructureOrOther:
>-        switch (other.m_kind) {
>-        case ObjectWithStructure:
>-            if (m_structure == other.m_structure)
>-                return;
>-            *this = ObjectOrOther;
>-            return;
>-        case Object:
>-        case ObjectWithStructureOrOther: // If we see this here, then we know that the structures didn't match.
>-        case ObjectOrOther:
>-            *this = ObjectOrOther;
>-            return;
>-        case Other:
>-            return;
>-        default:
>-            *this = Top;
>-            return;
>-        }
>-    case Object:
>-        switch (other.m_kind) {
>-        case ObjectWithStructure:
>-            return;
>-        case ObjectWithStructureOrOther:
>-        case ObjectOrOther:
>-        case Other:
>-            *this = ObjectOrOther;
>-            return;
>-        default:
>-            *this = Top;
>-            return;
>-        }
>-    case ObjectOrOther:
>-        switch (other.m_kind) {
>-        case ObjectWithStructure:
>-        case ObjectWithStructureOrOther:
>-        case Object:
>-        case Other:
>-            return;
>-        default:
>-            *this = Top;
>-            return;
>-        }
>-    case Top:
>-        return;
>-    }
>-
>-    RELEASE_ASSERT_NOT_REACHED();
>-}
>-
>-void InferredType::Descriptor::removeStructure()
>-{
>-    switch (m_kind) {
>-    case ObjectWithStructure:
>-        *this = Object;
>-        return;
>-    case ObjectWithStructureOrOther:
>-        *this = ObjectOrOther;
>-        return;
>-    default:
>-        return;
>-    }
>-}
>-
>-bool InferredType::Descriptor::subsumes(const Descriptor& other) const
>-{
>-    Descriptor merged = *this;
>-    merged.merge(other);
>-    return *this == merged;
>-}
>-
>-void InferredType::Descriptor::dumpInContext(PrintStream& out, DumpContext* context) const
>-{
>-    out.print(m_kind);
>-    if (m_structure)
>-        out.print(":", inContext(*m_structure, context));
>-}
>-
>-void InferredType::Descriptor::dump(PrintStream& out) const
>-{
>-    dumpInContext(out, nullptr);
>-}
>-
>-InferredType::InferredType(VM& vm)
>-    : Base(vm, vm.inferredTypeStructure.get())
>-    , m_watchpointSet(ClearWatchpoint)
>-{
>-}
>-
>-InferredType::~InferredType()
>-{
>-}
>-
>-bool InferredType::canWatch(const ConcurrentJSLocker& locker, const Descriptor& expected)
>-{
>-    if (expected.kind() == Top)
>-        return false;
>-    
>-    return descriptor(locker) == expected;
>-}
>-
>-bool InferredType::canWatch(const Descriptor& expected)
>-{
>-    ConcurrentJSLocker locker(m_lock);
>-    return canWatch(locker, expected);
>-}
>-
>-void InferredType::addWatchpoint(const ConcurrentJSLocker& locker, Watchpoint* watchpoint)
>-{
>-    RELEASE_ASSERT(descriptor(locker).kind() != Top);
>-
>-    m_watchpointSet.add(watchpoint);
>-}
>-
>-void InferredType::addWatchpoint(Watchpoint* watchpoint)
>-{
>-    ConcurrentJSLocker locker(m_lock);
>-    addWatchpoint(locker, watchpoint);
>-}
>-
>-void InferredType::dump(PrintStream& out) const
>-{
>-    out.print(RawPointer(this), ":", descriptor());
>-}
>-
>-bool InferredType::willStoreValueSlow(VM& vm, PropertyName propertyName, JSValue value)
>-{
>-    Descriptor oldType;
>-    Descriptor myType;
>-    bool result;
>-    {
>-        ConcurrentJSLocker locker(m_lock);
>-        oldType = descriptor(locker);
>-        myType = Descriptor::forValue(value);
>-
>-        myType.merge(oldType);
>-        
>-        ASSERT(oldType != myType); // The type must have changed if we're on the slow path.
>-
>-        bool setResult = set(locker, vm, myType);
>-        result = kind(locker) != Top;
>-        if (!setResult)
>-            return result;
>-    }
>-    
>-    InferredTypeFireDetail detail(this, propertyName.uid(), oldType, myType, value);
>-    m_watchpointSet.fireAll(vm, detail);
>-    return result;
>-}
>-
>-void InferredType::makeTopSlow(VM& vm, PropertyName propertyName)
>-{
>-    Descriptor oldType;
>-    {
>-        ConcurrentJSLocker locker(m_lock);
>-        oldType = descriptor(locker);
>-        if (!set(locker, vm, Top))
>-            return;
>-    }
>-
>-    InferredTypeFireDetail detail(this, propertyName.uid(), oldType, Top, JSValue());
>-    m_watchpointSet.fireAll(vm, detail);
>-}
>-
>-bool InferredType::set(const ConcurrentJSLocker& locker, VM& vm, Descriptor newDescriptor)
>-{
>-    // Be defensive: if we're not really changing the type, then we don't have to do anything.
>-    if (descriptor(locker) == newDescriptor)
>-        return false;
>-
>-    bool shouldFireWatchpointSet = false;
>-    
>-    // The new descriptor must be more general than the previous one.
>-    ASSERT(newDescriptor.subsumes(descriptor(locker)));
>-
>-    // If the new descriptors have different structures, then it can only be because one is null.
>-    if (descriptor(locker).structure() != newDescriptor.structure())
>-        ASSERT(!descriptor(locker).structure() || !newDescriptor.structure());
>-
>-    // We are changing the type, so make sure that if anyone was watching, they find out about it now. If
>-    // anyone is watching, we make sure to go to Top so that we don't do this sort of thing again.
>-    if (m_watchpointSet.state() != ClearWatchpoint) {
>-        // We cannot have been invalidated, since if we were, then we'd already be at Top.
>-        ASSERT(m_watchpointSet.state() != IsInvalidated);
>-
>-        // We're about to do expensive things because some compiler thread decided to watch this type and
>-        // then the type changed. Assume that this property is crazy, and don't ever do any more things for
>-        // it.
>-        newDescriptor = Top;
>-
>-        shouldFireWatchpointSet = true;
>-    }
>-
>-    if (!newDescriptor.structure())
>-        m_structure = nullptr;
>-    else {
>-        if (m_structure)
>-            ASSERT(newDescriptor.structure() == m_structure->structure.get());
>-        else
>-            m_structure = std::make_unique<InferredStructure>(vm, this, newDescriptor.structure());
>-    }
>-
>-    // Finally, set the descriptor kind.
>-    m_kind = newDescriptor.kind();
>-
>-    // Assert that we did things.
>-    ASSERT(descriptor(locker) == newDescriptor);
>-
>-    return shouldFireWatchpointSet;
>-}
>-
>-void InferredType::removeStructure(VM& vm)
>-{
>-    // FIXME: Find an elegant and cheap way to thread information about why we got here into the fire
>-    // detail in set().
>-    
>-    Descriptor oldDescriptor;
>-    Descriptor newDescriptor;
>-    {
>-        ConcurrentJSLocker locker(m_lock);
>-        oldDescriptor = descriptor(locker);
>-        newDescriptor = oldDescriptor;
>-        newDescriptor.removeStructure();
>-        
>-        if (!set(locker, vm, newDescriptor))
>-            return;
>-    }
>-
>-    InferredTypeFireDetail detail(this, nullptr, oldDescriptor, newDescriptor, JSValue());
>-    m_watchpointSet.fireAll(vm, detail);
>-}
>-
>-} // namespace JSC
>-
>-namespace WTF {
>-
>-using namespace JSC;
>-
>-void printInternal(PrintStream& out, InferredType::Kind kind)
>-{
>-    switch (kind) {
>-    case InferredType::Bottom:
>-        out.print("Bottom");
>-        return;
>-    case InferredType::Boolean:
>-        out.print("Boolean");
>-        return;
>-    case InferredType::Other:
>-        out.print("Other");
>-        return;
>-    case InferredType::Int32:
>-        out.print("Int32");
>-        return;
>-    case InferredType::Number:
>-        out.print("Number");
>-        return;
>-    case InferredType::String:
>-        out.print("String");
>-        return;
>-    case InferredType::Symbol:
>-        out.print("Symbol");
>-        return;
>-    case InferredType::BigInt:
>-        out.print("BigInt");
>-        return;
>-    case InferredType::ObjectWithStructure:
>-        out.print("ObjectWithStructure");
>-        return;
>-    case InferredType::ObjectWithStructureOrOther:
>-        out.print("ObjectWithStructureOrOther");
>-        return;
>-    case InferredType::Object:
>-        out.print("Object");
>-        return;
>-    case InferredType::ObjectOrOther:
>-        out.print("ObjectOrOther");
>-        return;
>-    case InferredType::Top:
>-        out.print("Top");
>-        return;
>-    }
>-
>-    RELEASE_ASSERT_NOT_REACHED();
>-}
>-
>-} // namespace WTF
>-
>Index: Source/JavaScriptCore/runtime/InferredType.h
>===================================================================
>--- Source/JavaScriptCore/runtime/InferredType.h	(revision 239966)
>+++ Source/JavaScriptCore/runtime/InferredType.h	(nonexistent)
>@@ -1,275 +0,0 @@
>-/*
>- * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#pragma once
>-
>-#include "ConcurrentJSLock.h"
>-#include "InferredStructure.h"
>-#include "IsoCellSet.h"
>-#include "JSCast.h"
>-#include "PropertyName.h"
>-#include "PutByIdFlags.h"
>-#include "Watchpoint.h"
>-#include <wtf/ThreadSafeRefCounted.h>
>-
>-namespace JSC {
>-
>-// This is an object used for the inference of the types of object properties.
>-
>-class InferredType final : public JSCell {
>-public:
>-    typedef JSCell Base;
>-
>-    template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>-    {
>-        return &vm.inferredTypeSpace;
>-    }
>-
>-    static InferredType* create(VM&);
>-
>-    static const bool needsDestruction = true;
>-    static void destroy(JSCell*);
>-
>-    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
>-    
>-    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
>-
>-    static void visitChildren(JSCell*, SlotVisitor&);
>-
>-    DECLARE_INFO;
>-
>-    enum Kind : uint8_t {
>-        Bottom,
>-        Boolean,
>-        Other,
>-        Int32,
>-        Number,
>-        String,
>-        Symbol,
>-        BigInt,
>-        ObjectWithStructure,
>-        ObjectWithStructureOrOther,
>-        Object,
>-        ObjectOrOther,
>-        Top
>-    };
>-
>-    static Kind kindForFlags(PutByIdFlags);
>-    
>-    static bool hasStructure(Kind kind)
>-    {
>-        switch (kind) {
>-        case ObjectWithStructure:
>-        case ObjectWithStructureOrOther:
>-            return true;
>-        default:
>-            return false;
>-        }
>-    }
>-
>-    class Descriptor {
>-    public:
>-        Descriptor()
>-            : m_kind(Bottom)
>-            , m_structure(nullptr)
>-        {
>-        }
>-
>-        Descriptor(Kind kind, Structure* structure = nullptr)
>-            : m_kind(kind)
>-            , m_structure(structure)
>-        {
>-            if (hasStructure(kind))
>-                ASSERT(structure);
>-        }
>-
>-        static Descriptor forValue(JSValue);
>-
>-        static Descriptor forFlags(VM&, PutByIdFlags);
>-
>-        explicit operator bool() const
>-        {
>-            return m_kind != Bottom || m_structure;
>-        }
>-
>-        Kind kind() const { return m_kind; }
>-        Structure* structure() const { return m_structure; }
>-
>-        PutByIdFlags putByIdFlags() const;
>-
>-        ALWAYS_INLINE bool includesValue(JSValue value)
>-        {
>-            switch (m_kind) {
>-            case Bottom:
>-                return false;
>-            case Boolean:
>-                return value.isBoolean();
>-            case Other:
>-                return value.isUndefinedOrNull();
>-            case Int32:
>-                return value.isInt32();
>-            case Number:
>-                return value.isNumber();
>-            case String:
>-                return value.isString();
>-            case Symbol:
>-                return value.isSymbol();
>-            case BigInt:
>-                return value.isBigInt();
>-            case ObjectWithStructure:
>-                return value.isCell() && value.asCell()->structure() == m_structure;
>-            case ObjectWithStructureOrOther:
>-                return value.isUndefinedOrNull()
>-                    || (value.isCell() && value.asCell()->structure() == m_structure);
>-            case Object:
>-                return value.isObject();
>-            case ObjectOrOther:
>-                return value.isUndefinedOrNull() || value.isObject();
>-            case Top:
>-                return true;
>-            }
>-
>-            RELEASE_ASSERT_NOT_REACHED();
>-        }
>-
>-        bool operator==(const Descriptor& other) const
>-        {
>-            return m_kind == other.m_kind
>-                && m_structure == other.m_structure;
>-        }
>-
>-        bool operator!=(const Descriptor& other) const
>-        {
>-            return !(*this == other);
>-        }
>-
>-        unsigned hash() const
>-        {
>-            return WTF::PtrHash<Structure*>::hash(m_structure) ^ static_cast<unsigned>(m_kind);
>-        }
>-    
>-        void merge(const Descriptor&);
>-        void removeStructure();
>-
>-        // Returns true if this descriptor is more general than the other one.
>-        bool subsumes(const Descriptor&) const;
>-
>-        void dumpInContext(PrintStream&, DumpContext*) const;
>-        void dump(PrintStream&) const;
>-
>-    private:
>-        Kind m_kind;
>-        Structure* m_structure;
>-    };
>-
>-    ConcurrentJSLock& lock() const { return m_lock; }
>-
>-    Descriptor descriptorMainThread() const
>-    {
>-        return Descriptor(m_kind, m_structure ? m_structure->structure.get() : nullptr);
>-    }
>-    
>-    Descriptor descriptor(const ConcurrentJSLocker&) const
>-    {
>-        return descriptorMainThread();
>-    }
>-    Descriptor descriptor() const
>-    {
>-        ConcurrentJSLocker locker(m_lock);
>-        return descriptor(locker);
>-    }
>-    
>-    Kind kind(const ConcurrentJSLocker& locker) const { return descriptor(locker).kind(); }
>-
>-    bool isTop() const { return m_kind == Top; }
>-    bool isRelevant() const { return m_kind != Top; }
>-
>-    // Returns true if the InferredType is still relevant after the store. It's not relevant if it's Top.
>-    ALWAYS_INLINE bool willStoreValue(VM& vm, PropertyName propertyName, JSValue value)
>-    {
>-        Descriptor currentDescriptor = descriptorMainThread();
>-        if (currentDescriptor.includesValue(value))
>-            return currentDescriptor.kind() != Top;
>-        return willStoreValueSlow(vm, propertyName, value);
>-    }
>-
>-    // Immediately makes this type irrelevant.
>-    void makeTop(VM& vm, PropertyName propertyName)
>-    {
>-        if (isTop())
>-            return;
>-        makeTopSlow(vm, propertyName);
>-    }
>-
>-    // Returns true if it currently makes sense to watch this InferredType for this descriptor. Note that
>-    // this will always return false for Top.
>-    bool canWatch(const ConcurrentJSLocker&, const Descriptor&);
>-    bool canWatch(const Descriptor&);
>-    
>-    void addWatchpoint(const ConcurrentJSLocker&, Watchpoint*);
>-    void addWatchpoint(Watchpoint*);
>-
>-    void dump(PrintStream&) const;
>-    
>-    void finalizeUnconditionally(VM&);
>-
>-private:
>-    InferredType(VM&);
>-    ~InferredType();
>-
>-    bool willStoreValueSlow(VM&, PropertyName, JSValue);
>-    void makeTopSlow(VM&, PropertyName);
>-
>-    // Helper for willStoreValueSlow() and makeTopSlow(). This returns true if we should fire the
>-    // watchpoint set.
>-    bool set(const ConcurrentJSLocker&, VM&, Descriptor);
>-    
>-    void removeStructure(VM&);
>-    
>-    friend class InferredStructure;
>-    friend class InferredStructureWatchpoint;
>-
>-    mutable ConcurrentJSLock m_lock;
>-    
>-    Kind m_kind { Bottom };
>-
>-    // FIXME: This should be Poisoned.
>-    // https://bugs.webkit.org/show_bug.cgi?id=180715
>-    std::unique_ptr<InferredStructure> m_structure;
>-
>-    // NOTE: If this is being watched, we transform to Top because that implies that it wouldn't be
>-    // profitable to watch it again. Also, this set is initialized clear, and is never exposed to the DFG
>-    // thread. The DFG will use the InferredType as the thing that it watches.
>-    InlineWatchpointSet m_watchpointSet;
>-};
>-
>-} // namespace JSC
>-
>-namespace WTF {
>-
>-void printInternal(PrintStream&, JSC::InferredType::Kind);
>-
>-} // namespace WTF
>Index: Source/JavaScriptCore/runtime/InferredTypeInlines.h
>===================================================================
>--- Source/JavaScriptCore/runtime/InferredTypeInlines.h	(revision 239966)
>+++ Source/JavaScriptCore/runtime/InferredTypeInlines.h	(nonexistent)
>@@ -1,47 +0,0 @@
>-/*
>- * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#pragma once
>-
>-#include "InferredType.h"
>-
>-namespace JSC {
>-
>-inline void InferredType::finalizeUnconditionally(VM& vm)
>-{
>-    ASSERT(Heap::isMarked(this));
>-    
>-    if (m_structure) {
>-        if (Heap::isMarked(m_structure->structure.get()))
>-            return;
>-        
>-        removeStructure(vm);
>-    }
>-    
>-    vm.inferredTypesWithFinalizers.remove(this);
>-}
>-
>-} // namespace JSC
>-
>Index: Source/JavaScriptCore/runtime/InferredTypeTable.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/InferredTypeTable.cpp	(revision 239966)
>+++ Source/JavaScriptCore/runtime/InferredTypeTable.cpp	(nonexistent)
>@@ -1,185 +0,0 @@
>-/*
>- * Copyright (C) 2015 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#include "config.h"
>-#include "InferredTypeTable.h"
>-
>-#include "JSCInlines.h"
>-
>-namespace JSC {
>-
>-const ClassInfo InferredTypeTable::s_info = { "InferredTypeTable", nullptr, nullptr, nullptr, CREATE_METHOD_TABLE(InferredTypeTable) };
>-
>-InferredTypeTable* InferredTypeTable::create(VM& vm)
>-{
>-    InferredTypeTable* result = new (NotNull, allocateCell<InferredTypeTable>(vm.heap)) InferredTypeTable(vm);
>-    result->finishCreation(vm);
>-    return result;
>-}
>-
>-void InferredTypeTable::destroy(JSCell* cell)
>-{
>-    InferredTypeTable* inferredTypeTable = static_cast<InferredTypeTable*>(cell);
>-    inferredTypeTable->InferredTypeTable::~InferredTypeTable();
>-}
>-
>-Structure* InferredTypeTable::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
>-{
>-    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
>-}
>-
>-void InferredTypeTable::visitChildren(JSCell* cell, SlotVisitor& visitor)
>-{
>-    InferredTypeTable* inferredTypeTable = jsCast<InferredTypeTable*>(cell);
>-    Base::visitChildren(cell, visitor);
>-
>-    auto locker = holdLock(inferredTypeTable->cellLock());
>-    
>-    for (auto& entry : inferredTypeTable->m_table) {
>-        auto entryValue = entry.value;
>-
>-        if (!entryValue)
>-            continue;
>-        if (entryValue->isRelevant())
>-            visitor.append(entryValue);
>-        else
>-            entry.value.clear();
>-    }
>-}
>-
>-InferredType* InferredTypeTable::get(const AbstractLocker&, UniquedStringImpl* uid)
>-{
>-    auto iter = m_table.find(uid);
>-    if (iter == m_table.end())
>-        return nullptr;
>-
>-    InferredType* entryValue = iter->value.get();
>-    if (!entryValue)
>-        return nullptr;
>-
>-    // Take this opportunity to prune invalidated types.
>-    if (!entryValue->isRelevant()) {
>-        iter->value.clear();
>-        return nullptr;
>-    }
>-
>-    return entryValue;
>-}
>-
>-InferredType* InferredTypeTable::get(UniquedStringImpl* uid)
>-{
>-    auto locker = holdLock(cellLock());
>-    return get(locker, uid);
>-}
>-
>-InferredType* InferredTypeTable::get(PropertyName propertyName)
>-{
>-    return get(propertyName.uid());
>-}
>-
>-bool InferredTypeTable::willStoreValue(
>-    VM& vm, PropertyName propertyName, JSValue value, StoredPropertyAge age)
>-{
>-    // The algorithm here relies on the fact that only one thread modifies the hash map.
>-    
>-    if (age == StoredPropertyAge::OldProperty) {
>-        TableType::iterator iter = m_table.find(propertyName.uid());
>-        if (iter == m_table.end())
>-            return false; // Absence on replace => top.
>-
>-        InferredType* entryValue = iter->value.get();
>-        if (!entryValue)
>-            return false;
>-        
>-        if (entryValue->willStoreValue(vm, propertyName, value))
>-            return true;
>-        
>-        iter->value.clear();
>-        return false;
>-    }
>-
>-    TableType::AddResult result;
>-    {
>-        auto locker = holdLock(cellLock());
>-        result = m_table.add(propertyName.uid(), WriteBarrier<InferredType>());
>-    }
>-    InferredType* entryValue = result.iterator->value.get();
>-
>-    if (result.isNewEntry) {
>-        InferredType* inferredType = InferredType::create(vm);
>-        WTF::storeStoreFence();
>-        result.iterator->value.set(vm, this, inferredType);
>-        entryValue = inferredType;
>-    } else if (!entryValue)
>-        return false;
>-    
>-    if (entryValue->willStoreValue(vm, propertyName, value))
>-        return true;
>-    
>-    result.iterator->value.clear();
>-    return false;
>-}
>-
>-void InferredTypeTable::makeTop(VM& vm, PropertyName propertyName, StoredPropertyAge age)
>-{
>-    // The algorithm here relies on the fact that only one thread modifies the hash map.
>-    if (age == StoredPropertyAge::OldProperty) {
>-        TableType::iterator iter = m_table.find(propertyName.uid());
>-        if (iter == m_table.end())
>-            return; // Absence on replace => top.
>-
>-        InferredType* entryValue = iter->value.get();
>-
>-        if (!entryValue)
>-            return;
>-
>-        entryValue->makeTop(vm, propertyName);
>-        iter->value.clear();
>-        return;
>-    }
>-
>-    TableType::AddResult result;
>-    {
>-        auto locker = holdLock(cellLock());
>-        result = m_table.add(propertyName.uid(), WriteBarrier<InferredType>());
>-    }
>-    if (!result.iterator->value)
>-        return;
>-    
>-    result.iterator->value->makeTop(vm, propertyName);
>-    result.iterator->value.clear();
>-}
>-
>-InferredTypeTable::InferredTypeTable(VM& vm)
>-    : Base(vm, vm.inferredTypeTableStructure.get())
>-{
>-}
>-
>-InferredTypeTable::~InferredTypeTable()
>-{
>-}
>-
>-} // namespace JSC
>-
>Index: Source/JavaScriptCore/runtime/InferredTypeTable.h
>===================================================================
>--- Source/JavaScriptCore/runtime/InferredTypeTable.h	(revision 239966)
>+++ Source/JavaScriptCore/runtime/InferredTypeTable.h	(nonexistent)
>@@ -1,98 +0,0 @@
>-/*
>- * Copyright (C) 2015 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#pragma once
>-
>-#include "Identifier.h"
>-#include "InferredType.h"
>-#include "JSCast.h"
>-
>-namespace JSC {
>-
>-// A table of inferred types for some structure. This is a JSCell because that simplifies the Structure
>-// destructor and makes lifetime easier to manage. For example, since it's a cell, we know that this thing
>-// cannot be deleted while the DFG is running. This is separate from PropertyTable because most properties
>-// will not have an InferredType, since most properties are in dictionaries (if you think of "a property"
>-// as being "a property in some Structure"). Also, this will happily conflate the types of properties from
>-// different structures even if the structures represent disjoint sets of objects.
>-
>-class InferredTypeTable final : public JSCell {
>-public:
>-    typedef JSCell Base;
>-
>-    static InferredTypeTable* create(VM&);
>-
>-    static const bool needsDestruction = true;
>-    static void destroy(JSCell*);
>-
>-    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
>-    
>-    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
>-
>-    static void visitChildren(JSCell*, SlotVisitor&);
>-
>-    DECLARE_INFO;
>-
>-    // Get the current inferred type. Returns nullptr for both Top and Bottom. Null means Bottom if the
>-    // owning Structure doesn't know about the property.
>-    InferredType* get(const AbstractLocker&, UniquedStringImpl*);
>-    InferredType* get(UniquedStringImpl*);
>-    InferredType* get(PropertyName);
>-
>-    enum class StoredPropertyAge { NewProperty, OldProperty };
>-    
>-    // Returns true if the InferredType for this property is still relevant after the store. It's not
>-    // relevant if it's Top. Note that this table will internally prune Top entries.
>-    bool willStoreValue(VM&, PropertyName, JSValue, StoredPropertyAge);
>-
>-    // Invalidates the type for the property. Useful if we detect a store in a reflective context.
>-    void makeTop(VM&, PropertyName, StoredPropertyAge);
>-
>-private:
>-    InferredTypeTable(VM&);
>-    ~InferredTypeTable();
>-
>-    // Bottom: absence from table.
>-    // Top: null value in table, !value->isRelevant(), or absence from table.
>-    //
>-    // We know how to determine if absence from the table is bottom or top depending on whether the
>-    // property is present in the owning structure. Hence, depending on the structure, absence may have
>-    // different meanings. The way that this class determines if the owning structure knows of the property
>-    // is that we differentiate between actions: replace or transition. If we're adding a new property
>-    // (transition), then absence means bottom. If we're storing to an existing property (replace), then
>-    // absence means top. To make this work, we have to watch out for the case where two structures, S1 and
>-    // S2, share the same InferredTypeTable and neither of them initially know about property P. S1 may
>-    // want to add P without a type, while S2 may want to add P with a type. If S1 added P and used absence
>-    // to indicate Top, then S2 would use that absence to mean Bottom and would end up creating a non-Top
>-    // entry in the table. Then S1 would forget that it wanted Top, and would use S2's type. Clearly,
>-    // that's bad. We avoid such confusion by ensuring that a transition always adds an entry. Hence,
>-    // absence-means-bottom only comes into play for properties added before the InferredTypeTable was
>-    // created.
>-    using TableType = HashMap<RefPtr<UniquedStringImpl>, WriteBarrier<InferredType>, IdentifierRepHash>;
>-
>-    TableType m_table;
>-};
>-
>-} // namespace JSC
>Index: Source/JavaScriptCore/runtime/JSModuleLoader.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSModuleLoader.h	(revision 239966)
>+++ Source/JavaScriptCore/runtime/JSModuleLoader.h	(working copy)
>@@ -32,6 +32,7 @@ namespace JSC {
> 
> class JSInternalPromise;
> class JSModuleNamespaceObject;
>+class JSModuleRecord;
> class SourceCode;
> 
> class JSModuleLoader final : public JSNonFinalObject {
>Index: Source/JavaScriptCore/runtime/JSObjectInlines.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSObjectInlines.h	(revision 239966)
>+++ Source/JavaScriptCore/runtime/JSObjectInlines.h	(working copy)
>@@ -185,8 +185,6 @@ inline void JSObject::putDirectWithoutTr
>     StructureID structureID = this->structureID();
>     Structure* structure = vm.heap.structureIDTable().get(structureID);
>     PropertyOffset offset = prepareToPutDirectWithoutTransition(vm, propertyName, attributes, structureID, structure);
>-    bool shouldOptimize = false;
>-    structure->willStoreValueForNewTransition(vm, propertyName, value, shouldOptimize);
>     putDirect(vm, offset, value);
>     if (attributes & PropertyAttribute::ReadOnly)
>         structure->setContainsReadOnlyProperties();
>@@ -281,7 +279,6 @@ ALWAYS_INLINE bool JSObject::putDirectIn
>     Structure* structure = vm.heap.structureIDTable().get(structureID);
>     if (structure->isDictionary()) {
>         ASSERT(!isCopyOnWrite(indexingMode()));
>-        ASSERT(!structure->hasInferredTypes());
>         
>         unsigned currentAttributes;
>         PropertyOffset offset = structure->get(vm, propertyName, currentAttributes);
>@@ -318,9 +315,6 @@ ALWAYS_INLINE bool JSObject::putDirectIn
>     Structure* newStructure = Structure::addPropertyTransitionToExistingStructure(
>         structure, propertyName, attributes, offset);
>     if (newStructure) {
>-        newStructure->willStoreValueForExistingTransition(
>-            vm, propertyName, value, slot.context() == PutPropertySlot::PutById);
>-        
>         Butterfly* newButterfly = butterfly();
>         if (currentCapacity != newStructure->outOfLineCapacity()) {
>             ASSERT(newStructure != this->structure(vm));
>@@ -341,18 +335,12 @@ ALWAYS_INLINE bool JSObject::putDirectIn
>     }
> 
>     unsigned currentAttributes;
>-    bool hasInferredType;
>-    offset = structure->get(vm, propertyName, currentAttributes, hasInferredType);
>+    offset = structure->get(vm, propertyName, currentAttributes);
>     if (offset != invalidOffset) {
>         if ((mode == PutModePut) && currentAttributes & PropertyAttribute::ReadOnly)
>             return false;
> 
>         structure->didReplaceProperty(offset);
>-        if (UNLIKELY(hasInferredType)) {
>-            structure->willStoreValueForReplace(
>-                vm, propertyName, value, slot.context() == PutPropertySlot::PutById);
>-        }
>-
>         putDirect(vm, offset, value);
> 
>         if ((attributes & PropertyAttribute::Accessor) != (currentAttributes & PropertyAttribute::Accessor) || (attributes & PropertyAttribute::CustomAccessorOrValue) != (currentAttributes & PropertyAttribute::CustomAccessorOrValue)) {
>@@ -374,8 +362,6 @@ ALWAYS_INLINE bool JSObject::putDirectIn
>     
>     newStructure = Structure::addNewPropertyTransition(
>         vm, structure, propertyName, attributes, offset, slot.context(), &deferredWatchpointFire);
>-    newStructure->willStoreValueForNewTransition(
>-        vm, propertyName, value, slot.context() == PutPropertySlot::PutById);
>     
>     validateOffset(offset);
>     ASSERT(newStructure->isValidOffset(offset));
>Index: Source/JavaScriptCore/runtime/Structure.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/Structure.cpp	(revision 239966)
>+++ Source/JavaScriptCore/runtime/Structure.cpp	(working copy)
>@@ -371,15 +371,11 @@ PropertyTable* Structure::materializePro
>     if (setPropertyTable)
>         this->setPropertyTable(vm, table);
> 
>-    InferredTypeTable* typeTable = m_inferredTypeTable.get();
>-
>     for (size_t i = structures.size(); i--;) {
>         structure = structures[i];
>         if (!structure->m_nameInPrevious)
>             continue;
>         PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->attributesInPrevious());
>-        if (typeTable && typeTable->get(structure->m_nameInPrevious.get()))
>-            entry.hasInferredType = true;
>         table->add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);
>     }
>     
>@@ -503,7 +499,6 @@ Structure* Structure::addNewPropertyTran
>     transition->setAttributesInPrevious(attributes);
>     transition->setPropertyTable(vm, structure->takePropertyTableOrCloneIfPinned(vm));
>     transition->m_offset = structure->m_offset;
>-    transition->m_inferredTypeTable.setMayBeNull(vm, transition, structure->m_inferredTypeTable.get());
> 
>     offset = transition->add(vm, propertyName, attributes);
> 
>@@ -536,12 +531,6 @@ Structure* Structure::removePropertyTran
>     //   structure that had a pinned table. That logic would also have to be changed to handle cached
>     //   removals.
>     //
>-    // - InferredTypeTable assumes that removal has never happened. This is important since if we could
>-    //   remove a property and then re-add it later, then the "absence means top" optimization wouldn't
>-    //   work anymore, unless removal also either poisoned type inference (by doing something equivalent to
>-    //   hasBeenDictionary) or by strongly marking the entry as Top by ensuring that it is not absent, but
>-    //   instead, has a null entry.
>-    
>     ASSERT(!structure->isUncacheableDictionary());
> 
>     Structure* transition = toUncacheableDictionaryTransition(vm, structure);
>@@ -892,43 +881,6 @@ void Structure::startWatchingInternalPro
>     setDidWatchInternalProperties(true);
> }
> 
>-void Structure::willStoreValueSlow(
>-    VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize,
>-    InferredTypeTable::StoredPropertyAge age)
>-{
>-    ASSERT(!isCompilationThread());
>-    ASSERT(structure(vm)->classInfo() == info());
>-    ASSERT(!hasBeenDictionary());
>-
>-    ASSERT_WITH_MESSAGE(VM::canUseJIT(), "We don't want to use memory for inferred types unless we're using the JIT.");
>-
>-    // Create the inferred type table before doing anything else, so that we don't GC after we have already
>-    // grabbed a pointer into the property map.
>-    InferredTypeTable* table = m_inferredTypeTable.get();
>-    if (!table) {
>-        table = InferredTypeTable::create(vm);
>-        WTF::storeStoreFence();
>-        m_inferredTypeTable.set(vm, this, table);
>-    }
>-
>-    // This only works if we've got a property table.
>-    PropertyTable* propertyTable = ensurePropertyTable(vm);
>-    
>-    // We must be calling this after having created the given property or confirmed that it was present
>-    // already, so the property must be present.
>-    PropertyMapEntry* entry = propertyTable->get(propertyName.uid());
>-    ASSERT(entry);
>-    
>-    if (shouldOptimize)
>-        entry->hasInferredType = table->willStoreValue(vm, propertyName, value, age);
>-    else {
>-        table->makeTop(vm, propertyName, age);
>-        entry->hasInferredType = false;
>-    }
>-    
>-    propertyTable->use(); // This makes it safe to use entry above.
>-}
>-
> #if DUMP_PROPERTYMAP_STATS
> 
> PropertyMapHashTableStats* propertyMapHashTableStats = 0;
>@@ -1099,8 +1051,6 @@ void Structure::visitChildren(JSCell* ce
>         visitor.append(thisObject->m_propertyTableUnsafe);
>     else if (thisObject->m_propertyTableUnsafe)
>         thisObject->m_propertyTableUnsafe.clear();
>-
>-    visitor.append(thisObject->m_inferredTypeTable);
> }
> 
> bool Structure::isCheapDuringGC()
>Index: Source/JavaScriptCore/runtime/Structure.h
>===================================================================
>--- Source/JavaScriptCore/runtime/Structure.h	(revision 239966)
>+++ Source/JavaScriptCore/runtime/Structure.h	(working copy)
>@@ -28,7 +28,6 @@
> #include "ClassInfo.h"
> #include "ConcurrentJSLock.h"
> #include "IndexingType.h"
>-#include "InferredTypeTable.h"
> #include "JSCJSValue.h"
> #include "JSCast.h"
> #include "JSType.h"
>@@ -76,13 +75,11 @@ struct PropertyMapEntry {
>     UniquedStringImpl* key;
>     PropertyOffset offset;
>     uint8_t attributes;
>-    bool hasInferredType; // This caches whether or not a property has an inferred type in the inferred type table, and is used for a fast check in JSObject::putDirectInternal().
> 
>     PropertyMapEntry()
>         : key(nullptr)
>         , offset(invalidOffset)
>         , attributes(0)
>-        , hasInferredType(false)
>     {
>     }
>     
>@@ -90,7 +87,6 @@ struct PropertyMapEntry {
>         : key(key)
>         , offset(offset)
>         , attributes(attributes)
>-        , hasInferredType(false)
>     {
>         ASSERT(this->attributes == attributes);
>     }
>@@ -435,7 +431,6 @@ public:
> 
>     PropertyOffset get(VM&, PropertyName);
>     PropertyOffset get(VM&, PropertyName, unsigned& attributes);
>-    PropertyOffset get(VM&, PropertyName, unsigned& attributes, bool& hasInferredType);
> 
>     // This is a somewhat internalish method. It will call your functor while possibly holding the
>     // Structure's lock. There is no guarantee whether the lock is held or not in any particular
>@@ -605,55 +600,6 @@ public:
>         startWatchingInternalProperties(vm);
>     }
>     
>-    bool hasInferredTypes() const
>-    {
>-        return !!m_inferredTypeTable;
>-    }
>-
>-    InferredType* inferredTypeFor(UniquedStringImpl* uid)
>-    {
>-        if (InferredTypeTable* table = m_inferredTypeTable.get())
>-            return table->get(uid);
>-        return nullptr;
>-    }
>-
>-    InferredType::Descriptor inferredTypeDescriptorFor(UniquedStringImpl* uid)
>-    {
>-        if (InferredType* result = inferredTypeFor(uid))
>-            return result->descriptor();
>-        return InferredType::Top;
>-    }
>-
>-    // Call this when we know that this is a brand new property. Note that it's not enough for the
>-    // property to be brand new to some object. It has to be brand new to the Structure.
>-    ALWAYS_INLINE void willStoreValueForNewTransition(
>-        VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize)
>-    {
>-        if (hasBeenDictionary() || (!shouldOptimize && !m_inferredTypeTable) || !VM::canUseJIT())
>-            return;
>-        willStoreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::StoredPropertyAge::NewProperty);
>-    }
>-
>-    // Call this when we know that this is a new property for the object, but not new for the
>-    // structure. Therefore, under the InferredTypeTable's rules, absence of the property from the
>-    // table means Top rather than Bottom.
>-    ALWAYS_INLINE void willStoreValueForExistingTransition(
>-        VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize)
>-    {
>-        if (hasBeenDictionary() || !m_inferredTypeTable || !VM::canUseJIT())
>-            return;
>-        willStoreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::StoredPropertyAge::NewProperty);
>-    }
>-
>-    // Call this when we know that the inferred type table exists and has an entry for this property.
>-    ALWAYS_INLINE void willStoreValueForReplace(
>-        VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize)
>-    {
>-        if (hasBeenDictionary() || !VM::canUseJIT())
>-            return;
>-        willStoreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::StoredPropertyAge::OldProperty);
>-    }
>-
>     Ref<StructureShape> toStructureShape(JSValue, bool& sawPolyProtoStructure);
>     
>     void dump(PrintStream&) const;
>@@ -800,9 +746,6 @@ private:
>     
>     void startWatchingInternalProperties(VM&);
> 
>-    JS_EXPORT_PRIVATE void willStoreValueSlow(
>-        VM&, PropertyName, JSValue, bool, InferredTypeTable::StoredPropertyAge);
>-
>     static const int s_maxTransitionLength = 64;
>     static const int s_maxTransitionLengthForNonEvalPutById = 512;
> 
>@@ -833,8 +776,6 @@ private:
>     // During a Heap Snapshot GC we avoid clearing the table so it is safe to use.
>     WriteBarrier<PropertyTable> m_propertyTableUnsafe;
> 
>-    WriteBarrier<InferredTypeTable> m_inferredTypeTable;
>-
>     mutable InlineWatchpointSet m_transitionWatchpointSet;
> 
>     COMPILE_ASSERT(firstOutOfLineOffset < 256, firstOutOfLineOffset_fits);
>Index: Source/JavaScriptCore/runtime/StructureInlines.h
>===================================================================
>--- Source/JavaScriptCore/runtime/StructureInlines.h	(revision 239966)
>+++ Source/JavaScriptCore/runtime/StructureInlines.h	(working copy)
>@@ -120,18 +120,11 @@ ALWAYS_INLINE Structure* Structure::stor
> ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName)
> {
>     unsigned attributes;
>-    bool hasInferredType;
>-    return get(vm, propertyName, attributes, hasInferredType);
>+    return get(vm, propertyName, attributes);
> }
>     
> ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes)
> {
>-    bool hasInferredType;
>-    return get(vm, propertyName, attributes, hasInferredType);
>-}
>-
>-ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes, bool& hasInferredType)
>-{
>     ASSERT(!isCompilationThread());
>     ASSERT(structure(vm)->classInfo() == info());
> 
>@@ -144,7 +137,6 @@ ALWAYS_INLINE PropertyOffset Structure::
>         return invalidOffset;
> 
>     attributes = entry->attributes;
>-    hasInferredType = entry->hasInferredType;
>     return entry->offset;
> }
> 
>Index: Source/JavaScriptCore/runtime/VM.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/VM.cpp	(revision 239966)
>+++ Source/JavaScriptCore/runtime/VM.cpp	(working copy)
>@@ -63,7 +63,6 @@
> #include "Identifier.h"
> #include "IncrementalSweeper.h"
> #include "IndirectEvalExecutable.h"
>-#include "InferredTypeTable.h"
> #include "InferredValue.h"
> #include "Interpreter.h"
> #include "IntlCollatorConstructor.h"
>@@ -303,7 +302,6 @@ VM::VM(VMType vmType, HeapType heapType)
>     , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellDangerousBitsHeapCellType.get(), ExecutableToCodeBlockEdge)
>     , functionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSFunction)
>     , generatorFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSGeneratorFunction)
>-    , inferredTypeSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), InferredType)
>     , inferredValueSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), InferredValue)
>     , internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction)
> #if ENABLE(INTL)
>@@ -334,7 +332,6 @@ VM::VM(VMType vmType, HeapType heapType)
> #endif
>     , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
>     , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
>-    , inferredTypesWithFinalizers(inferredTypeSpace)
>     , inferredValuesWithFinalizers(inferredValueSpace)
>     , evalCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), EvalCodeBlock)
>     , functionCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionCodeBlock)
>@@ -427,8 +424,6 @@ VM::VM(VMType vmType, HeapType heapType)
>     unlinkedFunctionCodeBlockStructure.set(*this, UnlinkedFunctionCodeBlock::createStructure(*this, 0, jsNull()));
>     unlinkedModuleProgramCodeBlockStructure.set(*this, UnlinkedModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
>     propertyTableStructure.set(*this, PropertyTable::createStructure(*this, 0, jsNull()));
>-    inferredTypeStructure.set(*this, InferredType::createStructure(*this, 0, jsNull()));
>-    inferredTypeTableStructure.set(*this, InferredTypeTable::createStructure(*this, 0, jsNull()));
>     inferredValueStructure.set(*this, InferredValue::createStructure(*this, 0, jsNull()));
>     functionRareDataStructure.set(*this, FunctionRareData::createStructure(*this, 0, jsNull()));
>     exceptionStructure.set(*this, Exception::createStructure(*this, 0, jsNull()));
>Index: Source/JavaScriptCore/runtime/VM.h
>===================================================================
>--- Source/JavaScriptCore/runtime/VM.h	(revision 239966)
>+++ Source/JavaScriptCore/runtime/VM.h	(working copy)
>@@ -377,7 +377,6 @@ public:
>     IsoSubspace executableToCodeBlockEdgeSpace;
>     IsoSubspace functionSpace;
>     IsoSubspace generatorFunctionSpace;
>-    IsoSubspace inferredTypeSpace;
>     IsoSubspace inferredValueSpace;
>     IsoSubspace internalFunctionSpace;
> #if ENABLE(INTL)
>@@ -409,7 +408,6 @@ public:
>     
>     IsoCellSet executableToCodeBlockEdgesWithConstraints;
>     IsoCellSet executableToCodeBlockEdgesWithFinalizers;
>-    IsoCellSet inferredTypesWithFinalizers;
>     IsoCellSet inferredValuesWithFinalizers;
>     
>     struct SpaceAndFinalizerSet {
>@@ -551,8 +549,6 @@ public:
>     Strong<Structure> unlinkedFunctionCodeBlockStructure;
>     Strong<Structure> unlinkedModuleProgramCodeBlockStructure;
>     Strong<Structure> propertyTableStructure;
>-    Strong<Structure> inferredTypeStructure;
>-    Strong<Structure> inferredTypeTableStructure;
>     Strong<Structure> inferredValueStructure;
>     Strong<Structure> functionRareDataStructure;
>     Strong<Structure> exceptionStructure;

Flags:

commit-queue: commit-queue-

Actions: View | Formatted Diff | Diff

Attachments on bug 190906: 353310 | 359121 | 359187 | 359196 | 359228