Ignore:
Timestamp:
Jul 26, 2014, 12:06:44 PM (11 years ago)
Author:
[email protected]
Message:

Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
reland later.

Source/JavaScriptCore:

  • CMakeLists.txt:
  • JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
  • JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • bytecode/BytecodeList.json:
  • bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::printPutByIdCacheStatus): Deleted.

  • bytecode/CodeBlock.h:
  • bytecode/GetByIdStatus.cpp:

(JSC::GetByIdStatus::computeForStubInfo):
(JSC::GetByIdStatus::computeFor):

  • bytecode/GetByIdStatus.h:
  • bytecode/GetByIdVariant.cpp:

(JSC::GetByIdVariant::dumpInContext):

  • bytecode/GetByIdVariant.h:

(JSC::GetByIdVariant::structureSet):

  • bytecode/Instruction.h:
  • bytecode/PutByIdStatus.cpp:

(JSC::PutByIdStatus::appendVariant):
(JSC::PutByIdStatus::computeForStubInfo):
(JSC::PutByIdStatus::computeFor):

  • bytecode/PutByIdStatus.h:
  • bytecode/PutByIdVariant.cpp:

(JSC::PutByIdVariant::dumpInContext):
(JSC::PutByIdVariant::oldStructureForTransition): Deleted.
(JSC::PutByIdVariant::writesStructures): Deleted.
(JSC::PutByIdVariant::reallocatesStorage): Deleted.
(JSC::PutByIdVariant::attemptToMerge): Deleted.
(JSC::PutByIdVariant::attemptToMergeTransitionWithReplace): Deleted.

  • bytecode/PutByIdVariant.h:

(JSC::PutByIdVariant::PutByIdVariant):
(JSC::PutByIdVariant::replace):
(JSC::PutByIdVariant::transition):
(JSC::PutByIdVariant::structure):
(JSC::PutByIdVariant::oldStructure):
(JSC::PutByIdVariant::newStructure):
(JSC::PutByIdVariant::constantChecks):

  • bytecode/StructureSet.cpp:

(JSC::StructureSet::filter): Deleted.
(JSC::StructureSet::filterArrayModes): Deleted.

  • bytecode/StructureSet.h:

(JSC::StructureSet::onlyStructure):

  • bytecode/ToThisStatus.cpp: Removed.
  • bytecode/ToThisStatus.h: Removed.
  • bytecode/TypeLocation.h: Removed.
  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitMove):
(JSC::BytecodeGenerator::emitPutToScope):
(JSC::BytecodeGenerator::emitPutById):
(JSC::BytecodeGenerator::emitPutByVal):
(JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity): Deleted.

  • bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity): Deleted.

  • bytecompiler/NodesCodegen.cpp:

(JSC::PostfixNode::emitResolve):
(JSC::PrefixNode::emitResolve):
(JSC::ReadModifyResolveNode::emitBytecode):
(JSC::AssignResolveNode::emitBytecode):
(JSC::ConstDeclNode::emitCodeSingle):
(JSC::ForInNode::emitBytecode):

  • debugger/DebuggerActivation.cpp: Added.

(JSC::DebuggerActivation::DebuggerActivation):
(JSC::DebuggerActivation::finishCreation):
(JSC::DebuggerActivation::visitChildren):
(JSC::DebuggerActivation::className):
(JSC::DebuggerActivation::getOwnPropertySlot):
(JSC::DebuggerActivation::put):
(JSC::DebuggerActivation::deleteProperty):
(JSC::DebuggerActivation::getOwnPropertyNames):
(JSC::DebuggerActivation::defineOwnProperty):

  • debugger/DebuggerActivation.h: Added.

(JSC::DebuggerActivation::create):
(JSC::DebuggerActivation::createStructure):

  • debugger/DebuggerScope.cpp: Removed.
  • debugger/DebuggerScope.h: Removed.
  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):

  • dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::changeStructure): Deleted.
(JSC::DFG::AbstractValue::contains): Deleted.

  • dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::couldBeType):
(JSC::DFG::AbstractValue::isType):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::parseBlock):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
(JSC::DFG::ConstantFoldingPhase::addBaseCheck): Deleted.
(JSC::DFG::ConstantFoldingPhase::addChecks): Deleted.

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGGraph.cpp:

(JSC::DFG::Graph::visitChildren):
(JSC::DFG::Graph::freezeStrong):

  • dfg/DFGGraph.h:
  • dfg/DFGNode.cpp:

(JSC::DFG::MultiPutByOffsetData::writesStructures):
(JSC::DFG::MultiPutByOffsetData::reallocatesStorage):

  • dfg/DFGNode.h:

(JSC::DFG::Node::convertToPutByOffset):
(JSC::DFG::Node::hasTransition):
(JSC::DFG::Node::convertToMultiGetByOffset): Deleted.
(JSC::DFG::Node::convertToMultiPutByOffset): Deleted.

  • dfg/DFGNodeType.h:
  • dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGStructureAbstractValue.cpp:

(JSC::DFG::StructureAbstractValue::observeTransition):
(JSC::DFG::StructureAbstractValue::observeTransitions):

  • dfg/DFGStructureAbstractValue.h:

(JSC::DFG::StructureAbstractValue::onlyStructure):
(JSC::DFG::StructureAbstractValue::operator=): Deleted.
(JSC::DFG::StructureAbstractValue::set): Deleted.

  • dfg/DFGValidate.cpp:

(JSC::DFG::Validate::validate):

  • dfg/DFGWatchableStructureWatchingPhase.cpp:

(JSC::DFG::WatchableStructureWatchingPhase::run):

  • ftl/FTLAbbreviations.h:

(JSC::FTL::getLinkage): Deleted.

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
(JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
(JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):

  • heap/Heap.cpp:

(JSC::Heap::collect):

  • inspector/agents/InspectorRuntimeAgent.cpp:

(Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange): Deleted.

  • inspector/agents/InspectorRuntimeAgent.h:
  • inspector/protocol/Runtime.json:
  • jsc.cpp:

(GlobalObject::finishCreation):
(functionDumpTypesForAllVariables): Deleted.

  • llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::putToScopeCommon): Deleted.

  • llint/LLIntSlowPaths.h:
  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
  • runtime/ArrayBufferNeuteringWatchpoint.cpp:

(JSC::ArrayBufferNeuteringWatchpoint::createStructure):

  • runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

  • runtime/Executable.h:

(JSC::ExecutableBase::createStructure):
(JSC::NativeExecutable::createStructure):

  • runtime/HighFidelityLog.cpp: Removed.
  • runtime/HighFidelityLog.h: Removed.
  • runtime/HighFidelityTypeProfiler.cpp: Removed.
  • runtime/HighFidelityTypeProfiler.h: Removed.
  • runtime/JSObject.cpp:

(JSC::JSObject::putDirectCustomAccessor):
(JSC::JSObject::putDirectNonIndexAccessor):
(JSC::JSObject::reifyStaticFunctionsForDelete):

  • runtime/JSPromiseDeferred.h:

(JSC::JSPromiseDeferred::createStructure):

  • runtime/JSPromiseReaction.h:

(JSC::JSPromiseReaction::createStructure):

  • runtime/JSPropertyNameIterator.h:

(JSC::JSPropertyNameIterator::createStructure):

  • runtime/JSType.h:
  • runtime/JSTypeInfo.h:

(JSC::TypeInfo::TypeInfo):

  • runtime/MapData.h:

(JSC::MapData::createStructure):

  • runtime/Options.h:
  • runtime/PropertyMapHashTable.h:

(JSC::PropertyTable::createStructure):

  • runtime/RegExp.h:

(JSC::RegExp::createStructure):

  • runtime/SparseArrayValueMap.cpp:

(JSC::SparseArrayValueMap::createStructure):

  • runtime/Structure.cpp:

(JSC::StructureTransitionTable::contains):
(JSC::StructureTransitionTable::get):
(JSC::StructureTransitionTable::add):
(JSC::Structure::Structure):
(JSC::Structure::materializePropertyMap):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::freezeTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::takePropertyTableOrCloneIfPinned):
(JSC::Structure::nonPropertyTransition):
(JSC::Structure::flattenDictionaryStructure):
(JSC::Structure::addPropertyWithoutTransition):
(JSC::Structure::pin):
(JSC::Structure::allocateRareData):
(JSC::Structure::cloneRareDataFrom):
(JSC::Structure::getConcurrently):
(JSC::Structure::putSpecificValue):
(JSC::Structure::getPropertyNamesFromStructure):
(JSC::Structure::visitChildren):
(JSC::Structure::checkConsistency):
(JSC::Structure::toStructureShape): Deleted.

  • runtime/Structure.h:

(JSC::Structure::isExtensible):
(JSC::Structure::didTransition):
(JSC::Structure::isDictionary):
(JSC::Structure::isUncacheableDictionary):
(JSC::Structure::hasBeenFlattenedBefore):
(JSC::Structure::propertyAccessesAreCacheable):
(JSC::Structure::previousID):
(JSC::Structure::hasGetterSetterProperties):
(JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
(JSC::Structure::setHasGetterSetterProperties):
(JSC::Structure::hasCustomGetterSetterProperties):
(JSC::Structure::setHasCustomGetterSetterProperties):
(JSC::Structure::setContainsReadOnlyProperties):
(JSC::Structure::hasNonEnumerableProperties):
(JSC::Structure::disableSpecificFunctionTracking):
(JSC::Structure::objectToStringValue):
(JSC::Structure::setObjectToStringValue):
(JSC::Structure::staticFunctionsReified):
(JSC::Structure::setStaticFunctionsReified):
(JSC::Structure::transitionWatchpointSet):
(JSC::Structure::setPreviousID):
(JSC::Structure::clearPreviousID):
(JSC::Structure::previous):
(JSC::Structure::rareData):
(JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck): Deleted.
(JSC::Structure::setHasCustomGetterSetterPropertiesWithProtoCheck): Deleted.

  • runtime/StructureChain.h:

(JSC::StructureChain::createStructure):

  • runtime/StructureInlines.h:

(JSC::Structure::setEnumerationCache):
(JSC::Structure::enumerationCache):
(JSC::Structure::checkOffsetConsistency):

  • runtime/StructureRareData.cpp:

(JSC::StructureRareData::createStructure):

  • runtime/SymbolTable.cpp:

(JSC::SymbolTable::SymbolTable):
(JSC::SymbolTable::cloneCapturedNames):
(JSC::SymbolTable::uniqueIDForVariable): Deleted.
(JSC::SymbolTable::uniqueIDForRegister): Deleted.
(JSC::SymbolTable::globalTypeSetForRegister): Deleted.
(JSC::SymbolTable::globalTypeSetForVariable): Deleted.

  • runtime/SymbolTable.h:

(JSC::SymbolTable::createStructure):
(JSC::SymbolTable::add):
(JSC::SymbolTable::set):

  • runtime/TypeSet.cpp: Removed.
  • runtime/TypeSet.h: Removed.
  • runtime/VM.cpp:

(JSC::VM::VM):
(JSC::VM::getTypesForVariableInRange): Deleted.
(JSC::VM::updateHighFidelityTypeProfileState): Deleted.
(JSC::VM::dumpHighFidelityProfilingTypes): Deleted.

  • runtime/VM.h:

(JSC::VM::isProfilingTypesWithHighFidelity): Deleted.
(JSC::VM::highFidelityLog): Deleted.
(JSC::VM::highFidelityTypeProfiler): Deleted.
(JSC::VM::nextLocation): Deleted.
(JSC::VM::getNextUniqueVariableID): Deleted.

  • runtime/WeakMapData.h:

(JSC::WeakMapData::createStructure):

  • tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Removed.
  • tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Removed.
  • tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Removed.

Source/WebCore:

  • ForwardingHeaders/debugger/DebuggerActivation.h: Added.

Source/WebKit/mac:

  • WebView/WebScriptDebugDelegate.mm:

Source/WTF:

  • wtf/text/WTFString.h:

LayoutTests:

  • js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Removed.
  • js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Removed.
  • js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Removed.
  • js/regress/fold-get-by-id-to-multi-get-by-offset.html: Removed.
  • js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Removed.
  • js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Removed.
  • js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Removed.
  • js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Removed.
  • js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Removed.
  • js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Removed.
  • js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Removed.
  • js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Removed.
  • js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Removed.
  • js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Removed.
  • js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Removed.
  • js/regress/fold-put-by-id-to-multi-put-by-offset.html: Removed.
  • js/regress/fold-put-structure-expected.txt: Removed.
  • js/regress/fold-put-structure.html: Removed.
  • js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Removed.
  • js/regress/hoist-poly-check-structure-effectful-loop.html: Removed.
  • js/regress/hoist-poly-check-structure-expected.txt: Removed.
  • js/regress/hoist-poly-check-structure.html: Removed.
  • js/regress/put-by-id-replace-and-transition-expected.txt: Removed.
  • js/regress/put-by-id-replace-and-transition.html: Removed.
  • js/regress/put-by-id-slightly-polymorphic-expected.txt: Removed.
  • js/regress/put-by-id-slightly-polymorphic.html: Removed.
  • js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Removed.
  • js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Removed.
  • js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Removed.
  • js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Removed.
  • js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Removed.
  • js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Removed.
  • js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Removed.
  • js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Removed.
  • js/regress/script-tests/fold-put-structure.js: Removed.
  • js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Removed.
  • js/regress/script-tests/hoist-poly-check-structure.js: Removed.
  • js/regress/script-tests/put-by-id-replace-and-transition.js: Removed.
  • js/regress/script-tests/put-by-id-slightly-polymorphic.js: Removed.
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

    r171641 r171648  
    133133            }
    134134               
    135             case PutStructure: {
    136                 if (m_state.forNode(node->child1()).m_structure.onlyStructure() != node->transition()->next)
    137                     break;
    138                
    139                 node->convertToPhantom();
    140                 eliminated = true;
    141                 break;
    142             }
    143                
    144135            case CheckFunction: {
    145136                if (m_state.forNode(node->child1()).value() != node->function()->value())
    … …  
    164155               
    165156            case MultiGetByOffset: {
    166                 Edge baseEdge = node->child1();
    167                 Node* base = baseEdge.node();
     157                Edge childEdge = node->child1();
     158                Node* child = childEdge.node();
    168159                MultiGetByOffsetData& data = node->multiGetByOffsetData();
    169160
    170                 // First prune the variants, then check if the MultiGetByOffset can be
    171                 // strength-reduced to a GetByOffset.
    172                
    173                 AbstractValue baseValue = m_state.forNode(base);
    174                
    175                 m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
    176                 eliminated = true; // Don't allow the default constant folder to do things to this.
    177                
    178                 for (unsigned i = 0; i < data.variants.size(); ++i) {
    179                     GetByIdVariant& variant = data.variants[i];
    180                     variant.structureSet().filter(baseValue);
    181                     if (variant.structureSet().isEmpty()) {
    182                         data.variants[i--] = data.variants.last();
    183                         data.variants.removeLast();
    184                     }
     161                Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
     162                if (!structure)
     163                    break;
     164               
     165                for (unsigned i = data.variants.size(); i--;) {
     166                    const GetByIdVariant& variant = data.variants[i];
     167                    if (!variant.structureSet().contains(structure))
     168                        continue;
     169                   
     170                    if (variant.alternateBase())
     171                        break;
     172                   
     173                    emitGetByOffset(indexInBlock, node, structure, variant, data.identifierNumber);
     174                    eliminated = true;
     175                    break;
    185176                }
    186                
    187                 if (data.variants.size() != 1)
    188                     break;
    189                
    190                 emitGetByOffset(
    191                     indexInBlock, node, baseValue, data.variants[0], data.identifierNumber);
    192177                break;
    193178            }
    194179               
    195180            case MultiPutByOffset: {
    196                 Edge baseEdge = node->child1();
    197                 Node* base = baseEdge.node();
     181                Edge childEdge = node->child1();
     182                Node* child = childEdge.node();
    198183                MultiPutByOffsetData& data = node->multiPutByOffsetData();
    199                
    200                 AbstractValue baseValue = m_state.forNode(base);
    201 
    202                 m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
    203                 eliminated = true; // Don't allow the default constant folder to do things to this.
    204                
    205 
    206                 for (unsigned i = 0; i < data.variants.size(); ++i) {
    207                     PutByIdVariant& variant = data.variants[i];
    208                     variant.oldStructure().filter(baseValue);
     184
     185                Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
     186                if (!structure)
     187                    break;
     188               
     189                for (unsigned i = data.variants.size(); i--;) {
     190                    const PutByIdVariant& variant = data.variants[i];
     191                    if (variant.oldStructure() != structure)
     192                        continue;
    209193                   
    210                     if (variant.oldStructure().isEmpty()) {
    211                         data.variants[i--] = data.variants.last();
    212                         data.variants.removeLast();
    213                         continue;
    214                     }
    215                    
    216                     if (variant.kind() == PutByIdVariant::Transition
    217                         && variant.oldStructure().onlyStructure() == variant.newStructure()) {
    218                         variant = PutByIdVariant::replace(
    219                             variant.oldStructure(),
    220                             variant.offset());
    221                     }
     194                    emitPutByOffset(indexInBlock, node, structure, variant, data.identifierNumber);
     195                    eliminated = true;
     196                    break;
    222197                }
    223 
    224                 if (data.variants.size() != 1)
    225                     break;
    226                
    227                 emitPutByOffset(
    228                     indexInBlock, node, baseValue, data.variants[0], data.identifierNumber);
    229198                break;
    230199            }
    … …  
    236205                unsigned identifierNumber = node->identifierNumber();
    237206               
    238                 AbstractValue baseValue = m_state.forNode(child);
    239 
    240                 m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
    241                 eliminated = true; // Don't allow the default constant folder to do things to this.
    242 
    243                 if (baseValue.m_structure.isTop() || baseValue.m_structure.isClobbered()
    244                     || (node->child1().useKind() == UntypedUse || (baseValue.m_type & ~SpecCell)))
    245                     break;
    246                
     207                if (childEdge.useKind() != CellUse)
     208                    break;
     209               
     210                Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
     211                if (!structure)
     212                    break;
     213
    247214                GetByIdStatus status = GetByIdStatus::computeFor(
    248                     vm(), baseValue.m_structure.set(), m_graph.identifiers()[identifierNumber]);
    249                 if (!status.isSimple())
    250                     break;
    251                
    252                 for (unsigned i = status.numVariants(); i--;) {
    253                     if (!status[i].constantChecks().isEmpty()
    254                         || status[i].alternateBase()) {
    255                         // FIXME: We could handle prototype cases.
    256                         // https://bugs.webkit.org/show_bug.cgi?id=110386
    257                         break;
    258                     }
     215                    vm(), structure, m_graph.identifiers()[identifierNumber]);
     216               
     217                if (!status.isSimple() || status.numVariants() != 1 ||
     218                    !status[0].constantChecks().isEmpty() || status[0].alternateBase()) {
     219                    // FIXME: We could handle prototype cases.
     220                    // https://bugs.webkit.org/show_bug.cgi?id=110386
     221                    break;
    259222                }
    260223               
    261                 if (status.numVariants() == 1) {
    262                     emitGetByOffset(indexInBlock, node, baseValue, status[0], identifierNumber);
    263                     break;
    264                 }
    265                
    266                 if (!isFTL(m_graph.m_plan.mode))
    267                     break;
    268                
    269                 MultiGetByOffsetData* data = m_graph.m_multiGetByOffsetData.add();
    270                 data->variants = status.variants();
    271                 data->identifierNumber = identifierNumber;
    272                 node->convertToMultiGetByOffset(data);
     224                emitGetByOffset(indexInBlock, node, structure, status[0], identifierNumber);
     225                eliminated = true;
    273226                break;
    274227            }
    275228               
    276229            case PutById:
    277             case PutByIdDirect:
    278             case PutByIdFlush: {
     230            case PutByIdDirect: {
    279231                NodeOrigin origin = node->origin;
    280232                Edge childEdge = node->child1();
    … …  
    284236                ASSERT(childEdge.useKind() == CellUse);
    285237               
    286                 AbstractValue baseValue = m_state.forNode(child);
    287 
    288                 m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
    289                 eliminated = true; // Don't allow the default constant folder to do things to this.
    290 
    291                 if (baseValue.m_structure.isTop() || baseValue.m_structure.isClobbered())
     238                Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
     239                if (!structure)
    292240                    break;
    293241               
    … …  
    295243                    vm(),
    296244                    m_graph.globalObjectFor(origin.semantic),
    297                     baseValue.m_structure.set(),
     245                    structure,
    298246                    m_graph.identifiers()[identifierNumber],
    299247                    node->op() == PutByIdDirect);
    … …  
    301249                if (!status.isSimple())
    302250                    break;
    303                
    304                 for (unsigned i = status.numVariants(); i--;)
    305                     addChecks(origin, indexInBlock, status[i].constantChecks());
    306                
    307                 if (status.numVariants() == 1) {
    308                     emitPutByOffset(indexInBlock, node, baseValue, status[0], identifierNumber);
    309                     break;
    310                 }
    311                
    312                 if (!isFTL(m_graph.m_plan.mode))
    313                     break;
    314 
    315                 MultiPutByOffsetData* data = m_graph.m_multiPutByOffsetData.add();
    316                 data->variants = status.variants();
    317                 data->identifierNumber = identifierNumber;
    318                 node->convertToMultiPutByOffset(data);
     251                if (status.numVariants() != 1)
     252                    break;
     253               
     254                emitPutByOffset(indexInBlock, node, structure, status[0], identifierNumber);
     255                eliminated = true;
    319256                break;
    320257            }
    … …  
    407344    }
    408345       
    409     void emitGetByOffset(unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const GetByIdVariant& variant, unsigned identifierNumber)
     346    void emitGetByOffset(unsigned indexInBlock, Node* node, Structure* structure, const GetByIdVariant& variant, unsigned identifierNumber)
    410347    {
    411348        NodeOrigin origin = node->origin;
    … …  
    413350        Node* child = childEdge.node();
    414351
    415         addBaseCheck(indexInBlock, node, baseValue, variant.structureSet());
     352        bool needsCellCheck = m_state.forNode(child).m_type & ~SpecCell;
     353       
     354        ASSERT(!variant.alternateBase());
     355        ASSERT_UNUSED(structure, variant.structureSet().contains(structure));
     356       
     357        // Now before we do anything else, push the CFA forward over the GetById
     358        // and make sure we signal to the loop that it should continue and not
     359        // do any eliminations.
     360        m_interpreter.execute(indexInBlock);
     361       
     362        if (needsCellCheck) {
     363            m_insertionSet.insertNode(
     364                indexInBlock, SpecNone, Phantom, origin, childEdge);
     365        }
    416366       
    417367        if (variant.specificValue()) {
    … …  
    420370        }
    421371       
    422         if (variant.alternateBase()) {
    423             child = m_insertionSet.insertConstant(indexInBlock, origin, variant.alternateBase());
    424             childEdge = Edge(child, KnownCellUse);
    425         } else
    426             childEdge.setUseKind(KnownCellUse);
     372        childEdge.setUseKind(KnownCellUse);
    427373       
    428374        Edge propertyStorage;
    … …  
    443389    }
    444390
    445     void emitPutByOffset(unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const PutByIdVariant& variant, unsigned identifierNumber)
     391    void emitPutByOffset(unsigned indexInBlock, Node* node, Structure* structure, const PutByIdVariant& variant, unsigned identifierNumber)
    446392    {
    447393        NodeOrigin origin = node->origin;
    448394        Edge childEdge = node->child1();
    449        
    450         addBaseCheck(indexInBlock, node, baseValue, variant.oldStructure());
     395        Node* child = childEdge.node();
     396
     397        ASSERT(variant.oldStructure() == structure);
     398       
     399        bool needsCellCheck = m_state.forNode(child).m_type & ~SpecCell;
     400       
     401        // Now before we do anything else, push the CFA forward over the PutById
     402        // and make sure we signal to the loop that it should continue and not
     403        // do any eliminations.
     404        m_interpreter.execute(indexInBlock);
     405
     406        if (needsCellCheck) {
     407            m_insertionSet.insertNode(
     408                indexInBlock, SpecNone, Phantom, origin, childEdge);
     409        }
    451410
    452411        childEdge.setUseKind(KnownCellUse);
    … …  
    454413        Transition* transition = 0;
    455414        if (variant.kind() == PutByIdVariant::Transition) {
    456             transition = m_graph.m_transitions.add(
    457                 variant.oldStructureForTransition(), variant.newStructure());
     415            transition = m_graph.m_transitions.add(structure, variant.newStructure());
     416
     417            for (unsigned i = 0; i < variant.constantChecks().size(); ++i) {
     418                addStructureTransitionCheck(
     419                    origin, indexInBlock,
     420                    variant.constantChecks()[i].constant(),
     421                    variant.constantChecks()[i].structure());
     422            }
    458423        }
    459424
    … …  
    462427        if (isInlineOffset(variant.offset()))
    463428            propertyStorage = childEdge;
    464         else if (!variant.reallocatesStorage()) {
     429        else if (
     430            variant.kind() == PutByIdVariant::Replace
     431            || structure->outOfLineCapacity() == variant.newStructure()->outOfLineCapacity()) {
    465432            propertyStorage = Edge(m_insertionSet.insertNode(
    466433                indexInBlock, SpecNone, GetButterfly, origin, childEdge));
    467         } else if (!variant.oldStructureForTransition()->outOfLineCapacity()) {
     434        } else if (!structure->outOfLineCapacity()) {
    468435            ASSERT(variant.newStructure()->outOfLineCapacity());
    469436            ASSERT(!isInlineOffset(variant.offset()));
    … …  
    474441            propertyStorage = Edge(allocatePropertyStorage);
    475442        } else {
    476             ASSERT(variant.oldStructureForTransition()->outOfLineCapacity());
    477             ASSERT(variant.newStructure()->outOfLineCapacity() > variant.oldStructureForTransition()->outOfLineCapacity());
     443            ASSERT(structure->outOfLineCapacity());
     444            ASSERT(variant.newStructure()->outOfLineCapacity() > structure->outOfLineCapacity());
    478445            ASSERT(!isInlineOffset(variant.offset()));
    479446
    … …  
    503470        m_graph.m_storageAccessData.append(storageAccessData);
    504471    }
    505    
    506     void addBaseCheck(
    507         unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const StructureSet& set)
    508     {
    509         if (!baseValue.m_structure.isSubsetOf(set)) {
    510             // Arises when we prune MultiGetByOffset. We could have a
    511             // MultiGetByOffset with a single variant that checks for structure S,
    512             // and the input has structures S and T, for example.
    513             m_insertionSet.insertNode(
    514                 indexInBlock, SpecNone, CheckStructure, node->origin,
    515                 OpInfo(m_graph.addStructureSet(set)), node->child1());
    516             return;
    517         }
    518        
    519         if (baseValue.m_type & ~SpecCell) {
    520             m_insertionSet.insertNode(
    521                 indexInBlock, SpecNone, Phantom, node->origin, node->child1());
    522         }
    523     }
    524    
    525     void addChecks(
    526         NodeOrigin origin, unsigned indexInBlock, const ConstantStructureCheckVector& checks)
    527     {
    528         for (unsigned i = 0; i < checks.size(); ++i) {
    529             addStructureTransitionCheck(
    530                 origin, indexInBlock, checks[i].constant(), checks[i].structure());
    531         }
    532     }
    533472
    534473    void addStructureTransitionCheck(NodeOrigin origin, unsigned indexInBlock, JSCell* cell, Structure* structure)
Note: See TracChangeset for help on using the changeset viewer.