Changeset 278445 in webkit

Timestamp:

Jun 3, 2021 8:10:54 PM (14 months ago)

Author:

Ross Kirsling

Message:

[JSC] Implement JIT ICs for InByVal
​https://bugs.webkit.org/show_bug.cgi?id=226563

Reviewed by Saam Barati.

JSTests:

• microbenchmarks/in-by-val-int32.js: Added.
• microbenchmarks/in-by-val-string-index.js: Added.
• microbenchmarks/in-by-val-symbol.js: Added.

Source/JavaScriptCore:

Until now, InByVal has had few optimizations implemented:
DFG would attempt to convert string index lookups to InById and int32 lookups to HasIndexedProperty,
but there has been no inline caching nor any special handling for symbol lookups.

This has become a more urgent problem now, as #x in obj (i.e. HasPrivateName / HasPrivateBrand)
will need to mimic InByVal's inline caching strategy in order to be deemed performant enough to ship.

This patch thus implements inline caching for InByVal at all JIT tiers.
The result is a night-and-day difference for symbols, a nice boost for string indices, and no change for int32s:

in-by-val-symbol 203.5572+-2.7647 ^{19.1035+-0.7498} definitely 10.6555x faster
in-by-val-string-index 87.0368+-44.7766 45.9971+-32.0007 might be 1.8922x faster
in-by-val-int32 110.9904+-1.7109 ? 111.3431+-1.7558 ?

• JavaScriptCore.xcodeproj/project.pbxproj:
• Sources.txt:
• bytecode/CheckPrivateBrandStatus.cpp:

(JSC::CheckPrivateBrandStatus::singleIdentifier const):

• bytecode/DeleteByStatus.cpp:

(JSC::DeleteByStatus::singleIdentifier const):

• bytecode/GetByStatus.cpp:

(JSC::GetByStatus::singleIdentifier const):

• bytecode/ICStatusMap.h:
• bytecode/ICStatusUtils.h:

(JSC::singleIdentifierForICStatus):

• bytecode/InByIdVariant.cpp:

(JSC::InByIdVariant::InByIdVariant):
(JSC::InByIdVariant::attemptToMerge):
(JSC::InByIdVariant::dumpInContext const):

• bytecode/InByIdVariant.h:

(JSC::InByIdVariant::identifier const):
(JSC::InByIdVariant::overlaps):

• bytecode/InByStatus.cpp: Renamed from Source/JavaScriptCore/bytecode/InByIdStatus.cpp.

(JSC::InByStatus::appendVariant):
(JSC::InByStatus::shrinkToFit):
(JSC::InByStatus::computeFor):
(JSC::InByStatus::computeForStubInfo):
(JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
(JSC::InByStatus::merge):
(JSC::InByStatus::filter):
(JSC::InByStatus::markIfCheap):
(JSC::InByStatus::finalize):
(JSC::InByStatus::singleIdentifier const):
(JSC::InByStatus::dump const):

• bytecode/InByStatus.h: Renamed from Source/JavaScriptCore/bytecode/InByIdStatus.h.
• bytecode/RecordedStatuses.cpp:

(JSC::RecordedStatuses::addInByStatus): Renamed from addInByIdStatus.

• bytecode/RecordedStatuses.h:
• bytecode/SetPrivateBrandStatus.cpp:

(JSC::SetPrivateBrandStatus::singleIdentifier const):

• bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::reset):

• bytecode/StructureStubInfo.h:
• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::filterICStatus):

• dfg/DFGArgumentsEliminationPhase.cpp:
• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleInById):
(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGClobbersExitState.cpp:

(JSC::DFG::clobbersExitState):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::link):

• dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::addInByVal):

• dfg/DFGMayExit.cpp:
• dfg/DFGNode.h:

(JSC::DFG::Node::hasInByStatus): Renamed from hasInByIdStatus.
(JSC::DFG::Node::inByStatus): Renamed from inByIdStatus.

• dfg/DFGNodeType.h:
• dfg/DFGObjectAllocationSinkingPhase.cpp:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileInByVal):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGVarargsForwardingPhase.cpp:
• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileInBy):
(JSC::FTL::DFG::LowerDFGToB3::compileInById):
(JSC::FTL::DFG::LowerDFGToB3::compileInByVal):

• jit/ICStats.h:
• jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::link):

• jit/JIT.h:
• jit/JITInlineCacheGenerator.cpp:

(JSC::JITInByValGenerator::JITInByValGenerator):
(JSC::JITInByValGenerator::generateFastPath):
(JSC::JITInByValGenerator::finalize):
(JSC::JITInByIdGenerator::JITInByIdGenerator):

• jit/JITInlineCacheGenerator.h:

(JSC::JITDelByIdGenerator::slowPathJump const):
(JSC::JITInByValGenerator::JITInByValGenerator):
(JSC::JITInByValGenerator::slowPathJump const):

• jit/JITOperations.cpp:

(JSC::JSC_DEFINE_JIT_OPERATION):

• jit/JITOperations.h:
• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):

• jit/Repatch.cpp:

(JSC::tryCacheInBy): Renamed from tryCacheInByID.
(JSC::repatchInBy): Renamed from repatchInByID.
(JSC::resetInBy): Renamed from resetInByID.

• jit/Repatch.h:
• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• llint/LLIntSlowPaths.h:
• llint/LowLevelInterpreter.asm:
• runtime/CommonSlowPaths.cpp:
• runtime/CommonSlowPaths.h:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/microbenchmarks/in-by-val-int32.js (added)
• JSTests/microbenchmarks/in-by-val-string-index.js (added)
• JSTests/microbenchmarks/in-by-val-symbol.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (modified) (8 diffs)
• Source/JavaScriptCore/Sources.txt (modified) (1 diff)
• Source/JavaScriptCore/bytecode/CheckPrivateBrandStatus.cpp (modified) (1 diff)
• Source/JavaScriptCore/bytecode/DeleteByStatus.cpp (modified) (1 diff)
• Source/JavaScriptCore/bytecode/GetByStatus.cpp (modified) (1 diff)
• Source/JavaScriptCore/bytecode/ICStatusMap.h (modified) (2 diffs)
• Source/JavaScriptCore/bytecode/ICStatusUtils.h (modified) (2 diffs)
• Source/JavaScriptCore/bytecode/InByIdVariant.cpp (modified) (3 diffs)
• Source/JavaScriptCore/bytecode/InByIdVariant.h (modified) (4 diffs)
• Source/JavaScriptCore/bytecode/InByStatus.cpp (moved) (moved from trunk/Source/JavaScriptCore/bytecode/InByIdStatus.cpp) (17 diffs)
• Source/JavaScriptCore/bytecode/InByStatus.h (moved) (moved from trunk/Source/JavaScriptCore/bytecode/InByIdStatus.h) (5 diffs)
• Source/JavaScriptCore/bytecode/RecordedStatuses.cpp (modified) (1 diff)
• Source/JavaScriptCore/bytecode/RecordedStatuses.h (modified) (3 diffs)
• Source/JavaScriptCore/bytecode/SetPrivateBrandStatus.cpp (modified) (1 diff)
• Source/JavaScriptCore/bytecode/StructureStubInfo.cpp (modified) (1 diff)
• Source/JavaScriptCore/bytecode/StructureStubInfo.h (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (modified) (2 diffs)
• Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp (modified) (2 diffs)
• Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (modified) (5 diffs)
• Source/JavaScriptCore/dfg/DFGClobberize.h (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGDoesGC.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGGraph.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGJITCompiler.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGJITCompiler.h (modified) (2 diffs)
• Source/JavaScriptCore/dfg/DFGMayExit.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGNode.h (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGNodeType.h (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp (modified) (2 diffs)
• Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSafeToExecute.h (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp (modified) (2 diffs)
• Source/JavaScriptCore/ftl/FTLCapabilities.cpp (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (modified) (5 diffs)
• Source/JavaScriptCore/jit/ICStats.h (modified) (2 diffs)
• Source/JavaScriptCore/jit/JIT.cpp (modified) (5 diffs)
• Source/JavaScriptCore/jit/JIT.h (modified) (4 diffs)
• Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp (modified) (1 diff)
• Source/JavaScriptCore/jit/JITInlineCacheGenerator.h (modified) (1 diff)
• Source/JavaScriptCore/jit/JITOperations.cpp (modified) (3 diffs)
• Source/JavaScriptCore/jit/JITOperations.h (modified) (1 diff)
• Source/JavaScriptCore/jit/JITPropertyAccess.cpp (modified) (1 diff)
• Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp (modified) (1 diff)
• Source/JavaScriptCore/jit/Repatch.cpp (modified) (3 diffs)
• Source/JavaScriptCore/jit/Repatch.h (modified) (2 diffs)
• Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (modified) (1 diff)
• Source/JavaScriptCore/llint/LLIntSlowPaths.h (modified) (1 diff)
• Source/JavaScriptCore/llint/LowLevelInterpreter.asm (modified) (2 diffs)
• Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (modified) (1 diff)
• Source/JavaScriptCore/runtime/CommonSlowPaths.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-06-03  Ross Kirsling  <ross.kirsling@sony.com>
+
+        [JSC] Implement JIT ICs for InByVal
+        https://bugs.webkit.org/show_bug.cgi?id=226563
+
+        Reviewed by Saam Barati.
+
+        * microbenchmarks/in-by-val-int32.js: Added.
+        * microbenchmarks/in-by-val-string-index.js: Added.
+        * microbenchmarks/in-by-val-symbol.js: Added.
+
 2021-06-03  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-06-03  Ross Kirsling  <ross.kirsling@sony.com>
+
+        [JSC] Implement JIT ICs for InByVal
+        https://bugs.webkit.org/show_bug.cgi?id=226563
+
+        Reviewed by Saam Barati.
+
+        Until now, InByVal has had few optimizations implemented:
+        DFG would attempt to convert string index lookups to InById and int32 lookups to HasIndexedProperty,
+        but there has been no inline caching nor any special handling for symbol lookups.
+
+        This has become a more urgent problem now, as `#x in obj` (i.e. HasPrivateName / HasPrivateBrand)
+        will need to mimic InByVal's inline caching strategy in order to be deemed performant enough to ship.
+
+        This patch thus implements inline caching for InByVal at all JIT tiers.
+        The result is a night-and-day difference for symbols, a nice boost for string indices, and no change for int32s: 
+
+        in-by-val-symbol                  203.5572+-2.7647     ^     19.1035+-0.7498        ^ definitely 10.6555x faster
+        in-by-val-string-index             87.0368+-44.7766          45.9971+-32.0007         might be 1.8922x faster
+        in-by-val-int32                   110.9904+-1.7109     ?    111.3431+-1.7558        ?
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Sources.txt:
+        * bytecode/CheckPrivateBrandStatus.cpp:
+        (JSC::CheckPrivateBrandStatus::singleIdentifier const):
+        * bytecode/DeleteByStatus.cpp:
+        (JSC::DeleteByStatus::singleIdentifier const):
+        * bytecode/GetByStatus.cpp:
+        (JSC::GetByStatus::singleIdentifier const):
+        * bytecode/ICStatusMap.h:
+        * bytecode/ICStatusUtils.h:
+        (JSC::singleIdentifierForICStatus):
+        * bytecode/InByIdVariant.cpp:
+        (JSC::InByIdVariant::InByIdVariant):
+        (JSC::InByIdVariant::attemptToMerge):
+        (JSC::InByIdVariant::dumpInContext const):
+        * bytecode/InByIdVariant.h:
+        (JSC::InByIdVariant::identifier const):
+        (JSC::InByIdVariant::overlaps):
+        * bytecode/InByStatus.cpp: Renamed from Source/JavaScriptCore/bytecode/InByIdStatus.cpp.
+        (JSC::InByStatus::appendVariant):
+        (JSC::InByStatus::shrinkToFit):
+        (JSC::InByStatus::computeFor):
+        (JSC::InByStatus::computeForStubInfo):
+        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
+        (JSC::InByStatus::merge):
+        (JSC::InByStatus::filter):
+        (JSC::InByStatus::markIfCheap):
+        (JSC::InByStatus::finalize):
+        (JSC::InByStatus::singleIdentifier const):
+        (JSC::InByStatus::dump const):
+        * bytecode/InByStatus.h: Renamed from Source/JavaScriptCore/bytecode/InByIdStatus.h.
+        * bytecode/RecordedStatuses.cpp:
+        (JSC::RecordedStatuses::addInByStatus): Renamed from addInByIdStatus.
+        * bytecode/RecordedStatuses.h:
+        * bytecode/SetPrivateBrandStatus.cpp:
+        (JSC::SetPrivateBrandStatus::singleIdentifier const):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::reset):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::filterICStatus):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGClobbersExitState.cpp:
+        (JSC::DFG::clobbersExitState):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addInByVal):
+        * dfg/DFGMayExit.cpp:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasInByStatus): Renamed from hasInByIdStatus.
+        (JSC::DFG::Node::inByStatus): Renamed from inByIdStatus.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInByVal):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVarargsForwardingPhase.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileInBy):
+        (JSC::FTL::DFG::LowerDFGToB3::compileInById):
+        (JSC::FTL::DFG::LowerDFGToB3::compileInByVal):
+        * jit/ICStats.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::link):
+        * jit/JIT.h:
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITInByValGenerator::JITInByValGenerator):
+        (JSC::JITInByValGenerator::generateFastPath):
+        (JSC::JITInByValGenerator::finalize):
+        (JSC::JITInByIdGenerator::JITInByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITDelByIdGenerator::slowPathJump const):
+        (JSC::JITInByValGenerator::JITInByValGenerator):
+        (JSC::JITInByValGenerator::slowPathJump const):
+        * jit/JITOperations.cpp:
+        (JSC::JSC_DEFINE_JIT_OPERATION):
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_in_by_val):
+        (JSC::JIT::emitSlow_op_in_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_in_by_val):
+        (JSC::JIT::emitSlow_op_in_by_val):
+        * jit/Repatch.cpp:
+        (JSC::tryCacheInBy): Renamed from tryCacheInByID.
+        (JSC::repatchInBy): Renamed from repatchInByID.
+        (JSC::resetInBy): Renamed from resetInByID.
+        * jit/Repatch.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/CommonSlowPaths.h:
+
 2021-06-03  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

@@ -1402 +1402 @@
                 A1D793011B43864B004516F5 /* IntlNumberFormatPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A1D792FB1B43864B004516F5 /* IntlNumberFormatPrototype.h */; };
                 A321AA6D2626359B0023ADA2 /* IntlWorkaround.h in Headers */ = {isa = PBXBuildFile; fileRef = A321AA6C2626359B0023ADA2 /* IntlWorkaround.h */; };
+                A382C5312667111D0042CD99 /* InByIdVariant.h in Headers */ = {isa = PBXBuildFile; fileRef = E3305FB120B0F78800CEB82B /* InByIdVariant.h */; settings = {ATTRIBUTES = (Private, ); }; };
                 A38D250E25800D440042BFDD /* JSArrayBufferPrototypeInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = A38D250D25800D430042BFDD /* JSArrayBufferPrototypeInlines.h */; };
+                A38D5BFC2666D3DA00A109A6 /* InByStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = A38D5BFA2666D3DA00A109A6 /* InByStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
                 A3EE8543262514B000FC9B8D /* IntlWorkaround.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A37619402625127C00CBCBA9 /* IntlWorkaround.cpp */; };
                 A3FF9BC72234749100B1A9AB /* YarrFlags.h in Headers */ = {isa = PBXBuildFile; fileRef = A3FF9BC52234746600B1A9AB /* YarrFlags.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4431 +4433 @@
                 A37619402625127C00CBCBA9 /* IntlWorkaround.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntlWorkaround.cpp; sourceTree = "<group>"; };
                 A38D250D25800D430042BFDD /* JSArrayBufferPrototypeInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayBufferPrototypeInlines.h; sourceTree = "<group>"; };
+                A38D5BF92666D3DA00A109A6 /* InByStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InByStatus.cpp; sourceTree = "<group>"; };
+                A38D5BFA2666D3DA00A109A6 /* InByStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InByStatus.h; sourceTree = "<group>"; };
                 A3AFF92B245A3CF900C9BA3B /* IntlLocale.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlLocale.h; sourceTree = "<group>"; };
                 A3AFF92C245A3CFA00C9BA3B /* IntlLocaleConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlLocaleConstructor.h; sourceTree = "<group>"; };
@@ -5059 +5063 @@
                 E3282BBA1FE930A400EDAF71 /* YarrErrorCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrErrorCode.h; path = yarr/YarrErrorCode.h; sourceTree = "<group>"; };
                 E32C3C6823E94C1E00BC97C0 /* UnlinkedCodeBlockGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedCodeBlockGenerator.h; sourceTree = "<group>"; };
-                E3305FAF20B0F78700CEB82B /* InByIdStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InByIdStatus.h; sourceTree = "<group>"; };
                 E3305FB020B0F78700CEB82B /* InByIdVariant.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InByIdVariant.cpp; sourceTree = "<group>"; };
                 E3305FB120B0F78800CEB82B /* InByIdVariant.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InByIdVariant.h; sourceTree = "<group>"; };
-                E3305FB220B0F78800CEB82B /* InByIdStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InByIdStatus.cpp; sourceTree = "<group>"; };
                 E33095DC23210A1400EB7856 /* JSInternalFieldObjectImpl.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSInternalFieldObjectImpl.h; sourceTree = "<group>"; };
                 E334CBB221FD96A8000EB178 /* RegExpGlobalData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpGlobalData.cpp; sourceTree = "<group>"; };
@@ -6283 +6285 @@
                                 72131BF326587EF2007114CF /* JITSafepoint.cpp */,
                                 72131BF526587EF2007114CF /* JITSafepoint.h */,
+                                72131BF426587EF2007114CF /* JITScannable.h */,
                                 52B5100C265EFCD4008970E7 /* JITSizeStatistics.cpp */,
                                 52B5100B265EFCD4008970E7 /* JITSizeStatistics.h */,
-                                72131BF426587EF2007114CF /* JITScannable.h */,
                                 0F766D2615A8CC1B008F363E /* JITStubRoutine.cpp */,
                                 0F766D1C15A5028D008F363E /* JITStubRoutine.h */,
@@ -8578 +8580 @@
                                 0F44A7B520C0BE3F0022B171 /* ICStatusUtils.cpp */,
                                 0FB399BD20AF6B380017E213 /* ICStatusUtils.h */,
-                                E3305FB220B0F78800CEB82B /* InByIdStatus.cpp */,
-                                E3305FAF20B0F78700CEB82B /* InByIdStatus.h */,
                                 E3305FB020B0F78700CEB82B /* InByIdVariant.cpp */,
                                 E3305FB120B0F78800CEB82B /* InByIdVariant.h */,
+                                A38D5BF92666D3DA00A109A6 /* InByStatus.cpp */,
+                                A38D5BFA2666D3DA00A109A6 /* InByStatus.h */,
                                 7905BB661D12050E0019FE57 /* InlineAccess.cpp */,
                                 7905BB671D12050E0019FE57 /* InlineAccess.h */,
@@ -9618 +9620 @@
                                 0F300B7C18AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.h in Headers */,
                                 0F898F321B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.h in Headers */,
-                                52B5100D265EFCDB008970E7 /* JITSizeStatistics.h in Headers */,
                                 0FC97F3E18202119002C9B26 /* DFGInvalidationPointInjectionPhase.h in Headers */,
                                 0FEA0A34170D40BF00BB722C /* DFGJITCode.h in Headers */,
@@ -9921 +9922 @@
                                 8606DDEA18DA44AB00A383D0 /* IdentifierInlines.h in Headers */,
                                 A5FD0076189B038C00633231 /* IdentifiersFactory.h in Headers */,
+                                A382C5312667111D0042CD99 /* InByIdVariant.h in Headers */,
+                                A38D5BFC2666D3DA00A109A6 /* InByStatus.h in Headers */,
                                 C25F8BCE157544A900245B71 /* IncrementalSweeper.h in Headers */,
                                 0FB7F39915ED8E4600F167B2 /* IndexingHeader.h in Headers */,
@@ -10072 +10075 @@
                                 72131BF926587EF2007114CF /* JITSafepoint.h in Headers */,
                                 72131BF826587EF2007114CF /* JITScannable.h in Headers */,
+                                52B5100D265EFCDB008970E7 /* JITSizeStatistics.h in Headers */,
                                 0F766D3115AA8112008F363E /* JITStubRoutine.h in Headers */,
                                 0F766D2C15A8CC3A008F363E /* JITStubRoutineSet.h in Headers */,

trunk/Source/JavaScriptCore/Sources.txt

@@ -240 +240 @@
 bytecode/ICStatusMap.cpp
 bytecode/ICStatusUtils.cpp
-bytecode/InByIdStatus.cpp
+bytecode/InByStatus.cpp
 bytecode/InByIdVariant.cpp
 bytecode/InlineAccess.cpp

trunk/Source/JavaScriptCore/bytecode/CheckPrivateBrandStatus.cpp

@@ -220 +220 @@
 CacheableIdentifier CheckPrivateBrandStatus::singleIdentifier() const
 {
-    if (m_variants.isEmpty())
-        return nullptr;
-
-    CacheableIdentifier result = m_variants.first().identifier();
-    if (!result)
-        return nullptr;
-    for (size_t i = 1; i < m_variants.size(); ++i) {
-        CacheableIdentifier identifier = m_variants[i].identifier();
-        if (!identifier)
-            return nullptr;
-        if (identifier != result)
-            return nullptr;
-    }
-    return result;
+    return singleIdentifierForICStatus(m_variants);
 }
 

trunk/Source/JavaScriptCore/bytecode/DeleteByStatus.cpp

@@ -246 +246 @@
 CacheableIdentifier DeleteByStatus::singleIdentifier() const
 {
-    if (m_variants.isEmpty())
-        return nullptr;
-
-    CacheableIdentifier result = m_variants.first().identifier();
-    if (!result)
-        return nullptr;
-    for (size_t i = 1; i < m_variants.size(); ++i) {
-        CacheableIdentifier identifier = m_variants[i].identifier();
-        if (!identifier)
-            return nullptr;
-        if (identifier != result)
-            return nullptr;
-    }
-    return result;
+    return singleIdentifierForICStatus(m_variants);
 }
 

trunk/Source/JavaScriptCore/bytecode/GetByStatus.cpp

@@ -580 +580 @@
         return m_moduleNamespaceData->m_identifier;
 
-    if (m_variants.isEmpty())
-        return nullptr;
-
-    CacheableIdentifier result = m_variants.first().identifier();
-    if (!result)
-        return nullptr;
-    for (size_t i = 1; i < m_variants.size(); ++i) {
-        CacheableIdentifier identifier = m_variants[i].identifier();
-        if (!identifier)
-            return nullptr;
-        if (identifier != result)
-            return nullptr;
-    }
-    return result;
+    return singleIdentifierForICStatus(m_variants);
 }
 

trunk/Source/JavaScriptCore/bytecode/ICStatusMap.h

@@ -36 +36 @@
 class CodeBlock;
 class GetByStatus;
-class InByIdStatus;
+class InByStatus;
 class PutByIdStatus;
 class DeleteByStatus;
@@ -48 +48 @@
     CallLinkStatus* callStatus { nullptr };
     GetByStatus* getStatus { nullptr };
-    InByIdStatus* inStatus { nullptr };
+    InByStatus* inStatus { nullptr };
     PutByIdStatus* putStatus { nullptr };
     DeleteByStatus* deleteStatus { nullptr };

trunk/Source/JavaScriptCore/bytecode/ICStatusUtils.h

@@ -27 +27 @@
 
 #include "BytecodeIndex.h"
+#include "CacheableIdentifier.h"
 #include "ExitFlag.h"
 
@@ -73 +74 @@
 }
 
+template<typename VariantVectorType>
+CacheableIdentifier singleIdentifierForICStatus(VariantVectorType& variants)
+{
+    if (variants.isEmpty())
+        return nullptr;
+
+    CacheableIdentifier result = variants.first().identifier();
+    if (!result)
+        return nullptr;
+
+    for (size_t i = 1; i < variants.size(); ++i) {
+        CacheableIdentifier identifier = variants[i].identifier();
+        if (!identifier || identifier != result)
+            return nullptr;
+    }
+
+    return result;
+}
+
 ExitFlag hasBadCacheExitSite(CodeBlock* profiledBlock, BytecodeIndex);
 

trunk/Source/JavaScriptCore/bytecode/InByIdVariant.cpp

@@ -28 +28 @@
 #include "InByIdVariant.h"
 
+#include "CacheableIdentifierInlines.h"
+
 namespace JSC {
 
-InByIdVariant::InByIdVariant(const StructureSet& structureSet, PropertyOffset offset, const ObjectPropertyConditionSet& conditionSet)
+InByIdVariant::InByIdVariant(CacheableIdentifier identifier, const StructureSet& structureSet, PropertyOffset offset, const ObjectPropertyConditionSet& conditionSet)
     : m_structureSet(structureSet)
     , m_conditionSet(conditionSet)
     , m_offset(offset)
+    , m_identifier(WTFMove(identifier))
 {
     if (!structureSet.size()) {
@@ -43 +46 @@
 bool InByIdVariant::attemptToMerge(const InByIdVariant& other)
 {
+    if (!!m_identifier != !!other.m_identifier)
+        return false;
+
+    if (m_identifier && (m_identifier != other.m_identifier))
+        return false;
+
     if (m_offset != other.m_offset)
         return false;
@@ -90 +99 @@
 void InByIdVariant::dumpInContext(PrintStream& out, DumpContext* context) const
 {
+    out.print("<id='", m_identifier, "', ");
     if (!isSet()) {
-        out.print("<empty>");
+        out.print("empty>");
         return;
     }
 
-    out.print(
-        "<", inContext(structureSet(), context), ", ", inContext(m_conditionSet, context));
+    out.print(inContext(structureSet(), context), ", ", inContext(m_conditionSet, context));
     out.print(", offset = ", offset());
     out.print(">");

trunk/Source/JavaScriptCore/bytecode/InByIdVariant.h

@@ -27 +27 @@
 #pragma once
 
+#include "CacheableIdentifier.h"
 #include "ObjectPropertyConditionSet.h"
 #include "PropertyOffset.h"
@@ -36 +37 @@
 }
 
-class InByIdStatus;
+class InByStatus;
 struct DumpContext;
 
@@ -42 +43 @@
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    InByIdVariant(const StructureSet& = StructureSet(), PropertyOffset = invalidOffset, const ObjectPropertyConditionSet& = ObjectPropertyConditionSet());
+    InByIdVariant(CacheableIdentifier, const StructureSet& = StructureSet(), PropertyOffset = invalidOffset, const ObjectPropertyConditionSet& = ObjectPropertyConditionSet());
 
     bool isSet() const { return !!m_structureSet.size(); }
@@ -64 +65 @@
     void dumpInContext(PrintStream&, DumpContext*) const;
 
+    CacheableIdentifier identifier() const { return m_identifier; }
+
     bool overlaps(const InByIdVariant& other)
     {
+        if (!!m_identifier != !!other.m_identifier)
+            return true;
+        if (m_identifier) {
+            if (m_identifier != other.m_identifier)
+                return false;
+        }
         return structureSet().overlaps(other.structureSet());
     }
 
 private:
-    friend class InByIdStatus;
+    friend class InByStatus;
 
     StructureSet m_structureSet;
     ObjectPropertyConditionSet m_conditionSet;
     PropertyOffset m_offset;
+    CacheableIdentifier m_identifier;
 };
 

trunk/Source/JavaScriptCore/bytecode/InByStatus.cpp

@@ -26 +26 @@
 
 #include "config.h"
-#include "InByIdStatus.h"
-
+#include "InByStatus.h"
+
+#include "CacheableIdentifierInlines.h"
 #include "CodeBlock.h"
 #include "ComplexGetStatus.h"
@@ -37 +38 @@
 namespace JSC {
 
-bool InByIdStatus::appendVariant(const InByIdVariant& variant)
+bool InByStatus::appendVariant(const InByIdVariant& variant)
 {
     return appendICStatusVariant(m_variants, variant);
 }
 
-void InByIdStatus::shrinkToFit()
+void InByStatus::shrinkToFit()
 {
     m_variants.shrinkToFit();
@@ -48 +49 @@
 
 #if ENABLE(JIT)
-InByIdStatus InByIdStatus::computeFor(CodeBlock* profiledBlock, ICStatusMap& map, BytecodeIndex bytecodeIndex, UniquedStringImpl* uid, ExitFlag didExit)
+InByStatus InByStatus::computeFor(CodeBlock* profiledBlock, ICStatusMap& map, BytecodeIndex bytecodeIndex, ExitFlag didExit)
 {
     ConcurrentJSLocker locker(profiledBlock->m_lock);
 
-    InByIdStatus result;
+    InByStatus result;
 
 #if ENABLE(DFG_JIT)
-    result = computeForStubInfoWithoutExitSiteFeedback(locker, profiledBlock->vm(), map.get(CodeOrigin(bytecodeIndex)).stubInfo, uid);
+    result = computeForStubInfoWithoutExitSiteFeedback(locker, profiledBlock->vm(), map.get(CodeOrigin(bytecodeIndex)).stubInfo);
 
     if (!result.takesSlowPath() && didExit)
-        return InByIdStatus(TakesSlowPath);
+        return InByStatus(TakesSlowPath);
 #else
     UNUSED_PARAM(map);
     UNUSED_PARAM(bytecodeIndex);
-    UNUSED_PARAM(uid);
     UNUSED_PARAM(didExit);
 #endif
@@ -69 +69 @@
 }
 
-InByIdStatus InByIdStatus::computeFor(CodeBlock* profiledBlock, ICStatusMap& map, BytecodeIndex bytecodeIndex, UniquedStringImpl* uid)
-{
-    return computeFor(profiledBlock, map, bytecodeIndex, uid, hasBadCacheExitSite(profiledBlock, bytecodeIndex));
-}
-
-InByIdStatus InByIdStatus::computeFor(
+InByStatus InByStatus::computeFor(CodeBlock* profiledBlock, ICStatusMap& map, BytecodeIndex bytecodeIndex)
+{
+    return computeFor(profiledBlock, map, bytecodeIndex, hasBadCacheExitSite(profiledBlock, bytecodeIndex));
+}
+
+InByStatus InByStatus::computeFor(
     CodeBlock* profiledBlock, ICStatusMap& baselineMap,
-    ICStatusContextStack& contextStack, CodeOrigin codeOrigin, UniquedStringImpl* uid)
+    ICStatusContextStack& contextStack, CodeOrigin codeOrigin)
 {
     BytecodeIndex bytecodeIndex = codeOrigin.bytecodeIndex();
@@ -84 +84 @@
         ICStatus status = context->get(codeOrigin);
         
-        auto bless = [&] (const InByIdStatus& result) -> InByIdStatus {
+        auto bless = [&] (const InByStatus& result) -> InByStatus {
             if (!context->isInlined(codeOrigin)) {
-                InByIdStatus baselineResult = computeFor(
-                    profiledBlock, baselineMap, bytecodeIndex, uid, didExit);
+                InByStatus baselineResult = computeFor(
+                    profiledBlock, baselineMap, bytecodeIndex, didExit);
                 baselineResult.merge(result);
                 return baselineResult;
             }
             if (didExit.isSet(ExitFromInlined))
-                return InByIdStatus(TakesSlowPath);
+                return InByStatus(TakesSlowPath);
             return result;
         };
@@ -98 +98 @@
 #if ENABLE(DFG_JIT)
         if (status.stubInfo) {
-            InByIdStatus result;
+            InByStatus result;
             {
                 ConcurrentJSLocker locker(context->optimizedCodeBlock->m_lock);
-                result = computeForStubInfoWithoutExitSiteFeedback(locker, profiledBlock->vm(), status.stubInfo, uid);
+                result = computeForStubInfoWithoutExitSiteFeedback(locker, profiledBlock->vm(), status.stubInfo);
             }
             if (result.isSet())
@@ -112 +112 @@
     }
     
-    return computeFor(profiledBlock, baselineMap, bytecodeIndex, uid, didExit);
+    return computeFor(profiledBlock, baselineMap, bytecodeIndex, didExit);
 }
 #endif // ENABLE(JIT)
 
 #if ENABLE(DFG_JIT)
-InByIdStatus InByIdStatus::computeForStubInfo(const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo, CodeOrigin codeOrigin, UniquedStringImpl* uid)
-{
-    InByIdStatus result = InByIdStatus::computeForStubInfoWithoutExitSiteFeedback(locker, profiledBlock->vm(), stubInfo, uid);
+InByStatus InByStatus::computeForStubInfo(const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo, CodeOrigin codeOrigin)
+{
+    InByStatus result = InByStatus::computeForStubInfoWithoutExitSiteFeedback(locker, profiledBlock->vm(), stubInfo);
 
     if (!result.takesSlowPath() && hasBadCacheExitSite(profiledBlock, codeOrigin.bytecodeIndex()))
-        return InByIdStatus(TakesSlowPath);
+        return InByStatus(TakesSlowPath);
     return result;
 }
 
-InByIdStatus InByIdStatus::computeForStubInfoWithoutExitSiteFeedback(const ConcurrentJSLocker&, VM& vm, StructureStubInfo* stubInfo, UniquedStringImpl* uid)
+InByStatus InByStatus::computeForStubInfoWithoutExitSiteFeedback(const ConcurrentJSLocker&, VM& vm, StructureStubInfo* stubInfo)
 {
     StubInfoSummary summary = StructureStubInfo::summary(vm, stubInfo);
     if (!isInlineable(summary))
-        return InByIdStatus(summary);
+        return InByStatus(summary);
     
     // Finally figure out if we can derive an access strategy.
-    InByIdStatus result;
+    InByStatus result;
     result.m_state = Simple;
     switch (stubInfo->cacheType()) {
     case CacheType::Unset:
-        return InByIdStatus(NoInformation);
+        return InByStatus(NoInformation);
 
     case CacheType::InByIdSelf: {
         Structure* structure = stubInfo->u.byIdSelf.baseObjectStructure.get();
         if (structure->takesSlowPathInDFGForImpureProperty())
-            return InByIdStatus(TakesSlowPath);
+            return InByStatus(TakesSlowPath);
+        CacheableIdentifier identifier = stubInfo->identifier();
+        UniquedStringImpl* uid = identifier.uid();
+        RELEASE_ASSERT(uid);
+        InByIdVariant variant(WTFMove(identifier));
         unsigned attributes;
-        InByIdVariant variant;
         variant.m_offset = structure->getConcurrently(uid, attributes);
         if (!isValidOffset(variant.m_offset))
-            return InByIdStatus(TakesSlowPath);
+            return InByStatus(TakesSlowPath);
         if (attributes & PropertyAttribute::CustomAccessorOrValue)
-            return InByIdStatus(TakesSlowPath);
+            return InByStatus(TakesSlowPath);
 
         variant.m_structureSet.add(structure);
@@ -162 +165 @@
             const AccessCase& access = list->at(listIndex);
             if (access.viaProxy())
-                return InByIdStatus(TakesSlowPath);
+                return InByStatus(TakesSlowPath);
 
             if (access.usesPolyProto())
-                return InByIdStatus(TakesSlowPath);
+                return InByStatus(TakesSlowPath);
 
             Structure* structure = access.structure();
@@ -175 +178 @@
                 // told us. But, it works well enough. So, our only concern here is to not
                 // crash on null structure.
-                return InByIdStatus(TakesSlowPath);
-            }
-
-            ComplexGetStatus complexGetStatus = ComplexGetStatus::computeFor(structure, access.conditionSet(), uid);
+                return InByStatus(TakesSlowPath);
+            }
+
+            ComplexGetStatus complexGetStatus = ComplexGetStatus::computeFor(structure, access.conditionSet(), access.uid());
             switch (complexGetStatus.kind()) {
             case ComplexGetStatus::ShouldSkip:
@@ -184 +187 @@
 
             case ComplexGetStatus::TakesSlowPath:
-                return InByIdStatus(TakesSlowPath);
+                return InByStatus(TakesSlowPath);
 
             case ComplexGetStatus::Inlineable: {
@@ -192 +195 @@
                     break;
                 default:
-                    return InByIdStatus(TakesSlowPath);
+                    return InByStatus(TakesSlowPath);
                 }
 
                 InByIdVariant variant(
-                    StructureSet(structure), complexGetStatus.offset(),
+                    access.identifier(), StructureSet(structure), complexGetStatus.offset(),
                     complexGetStatus.conditionSet());
 
                 if (!result.appendVariant(variant))
-                    return InByIdStatus(TakesSlowPath);
+                    return InByStatus(TakesSlowPath);
                 break;
             }
@@ -211 +214 @@
 
     default:
-        return InByIdStatus(TakesSlowPath);
+        return InByStatus(TakesSlowPath);
     }
 
     RELEASE_ASSERT_NOT_REACHED();
-    return InByIdStatus();
+    return InByStatus();
 }
 #endif
 
-void InByIdStatus::merge(const InByIdStatus& other)
+void InByStatus::merge(const InByStatus& other)
 {
     if (other.m_state == NoInformation)
@@ -231 +234 @@
     case Simple:
         if (other.m_state != Simple) {
-            *this = InByIdStatus(TakesSlowPath);
+            *this = InByStatus(TakesSlowPath);
             return;
         }
         for (const InByIdVariant& otherVariant : other.m_variants) {
             if (!appendVariant(otherVariant)) {
-                *this = InByIdStatus(TakesSlowPath);
+                *this = InByStatus(TakesSlowPath);
                 return;
             }
@@ -250 +253 @@
 }
 
-void InByIdStatus::filter(const StructureSet& structureSet)
+void InByStatus::filter(const StructureSet& structureSet)
 {
     if (m_state != Simple)
@@ -260 +263 @@
 
 template<typename Visitor>
-void InByIdStatus::markIfCheap(Visitor& visitor)
+void InByStatus::markIfCheap(Visitor& visitor)
 {
     for (InByIdVariant& variant : m_variants)
@@ -266 +269 @@
 }
 
-template void InByIdStatus::markIfCheap(AbstractSlotVisitor&);
-template void InByIdStatus::markIfCheap(SlotVisitor&);
-
-bool InByIdStatus::finalize(VM& vm)
+template void InByStatus::markIfCheap(AbstractSlotVisitor&);
+template void InByStatus::markIfCheap(SlotVisitor&);
+
+bool InByStatus::finalize(VM& vm)
 {
     for (InByIdVariant& variant : m_variants) {
@@ -278 +281 @@
 }
 
-void InByIdStatus::dump(PrintStream& out) const
+CacheableIdentifier InByStatus::singleIdentifier() const
+{
+    return singleIdentifierForICStatus(m_variants);
+}
+
+void InByStatus::dump(PrintStream& out) const
 {
     out.print("(");

trunk/Source/JavaScriptCore/bytecode/InByStatus.h

@@ -40 +40 @@
 class StructureStubInfo;
 
-class InByIdStatus final {
+class InByStatus final {
     WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -53 +53 @@
     };
 
-    InByIdStatus() = default;
+    InByStatus() = default;
 
-    InByIdStatus(State state, const InByIdVariant& variant = InByIdVariant())
+    InByStatus(State state)
         : m_state(state)
     {
-        ASSERT((state == Simple) == variant.isSet());
-        if (variant.isSet())
-            m_variants.append(variant);
+        ASSERT(state != Simple);
     }
 
-    explicit InByIdStatus(StubInfoSummary summary)
+    explicit InByStatus(StubInfoSummary summary)
     {
         switch (summary) {
@@ -81 +79 @@
     }
     
-    static InByIdStatus computeFor(CodeBlock*, ICStatusMap&, BytecodeIndex, UniquedStringImpl* uid);
-    static InByIdStatus computeFor(CodeBlock*, ICStatusMap&, BytecodeIndex, UniquedStringImpl* uid, ExitFlag);
-    static InByIdStatus computeFor(CodeBlock* baselineBlock, ICStatusMap& baselineMap, ICStatusContextStack& contextStack, CodeOrigin, UniquedStringImpl* uid);
+    static InByStatus computeFor(CodeBlock*, ICStatusMap&, BytecodeIndex);
+    static InByStatus computeFor(CodeBlock*, ICStatusMap&, BytecodeIndex, ExitFlag);
+    static InByStatus computeFor(CodeBlock* baselineBlock, ICStatusMap& baselineMap, ICStatusContextStack&, CodeOrigin);
 
 #if ENABLE(DFG_JIT)
-    static InByIdStatus computeForStubInfo(const ConcurrentJSLocker&, CodeBlock* baselineBlock, StructureStubInfo*, CodeOrigin, UniquedStringImpl* uid);
+    static InByStatus computeForStubInfo(const ConcurrentJSLocker&, CodeBlock* baselineBlock, StructureStubInfo*, CodeOrigin);
 #endif
 
@@ -102 +100 @@
     bool takesSlowPath() const { return m_state == TakesSlowPath; }
     
-    void merge(const InByIdStatus&);
+    void merge(const InByStatus&);
 
     // Attempts to reduce the set of variants to fit the given structure set. This may be approximate.
@@ -112 +110 @@
     void dump(PrintStream&) const;
 
+    CacheableIdentifier singleIdentifier() const;
+
 private:
 #if ENABLE(DFG_JIT)
-    static InByIdStatus computeForStubInfoWithoutExitSiteFeedback(const ConcurrentJSLocker&, VM&, StructureStubInfo*, UniquedStringImpl* uid);
+    static InByStatus computeForStubInfoWithoutExitSiteFeedback(const ConcurrentJSLocker&, VM&, StructureStubInfo*);
 #endif
     bool appendVariant(const InByIdVariant&);

trunk/Source/JavaScriptCore/bytecode/RecordedStatuses.cpp

@@ -71 +71 @@
 }
 
-InByIdStatus* RecordedStatuses::addInByIdStatus(const CodeOrigin& codeOrigin, const InByIdStatus& status)
+InByStatus* RecordedStatuses::addInByStatus(const CodeOrigin& codeOrigin, const InByStatus& status)
 {
-    auto statusPtr = makeUnique<InByIdStatus>(status);
-    InByIdStatus* result = statusPtr.get();
+    auto statusPtr = makeUnique<InByStatus>(status);
+    InByStatus* result = statusPtr.get();
     ins.append(std::make_pair(codeOrigin, WTFMove(statusPtr)));
     return result;

trunk/Source/JavaScriptCore/bytecode/RecordedStatuses.h

@@ -30 +30 @@
 #include "DeleteByStatus.h"
 #include "GetByStatus.h"
-#include "InByIdStatus.h"
+#include "InByStatus.h"
 #include "PutByIdStatus.h"
 #include "SetPrivateBrandStatus.h"
@@ -50 +50 @@
     GetByStatus* addGetByStatus(const CodeOrigin&, const GetByStatus&);
     PutByIdStatus* addPutByIdStatus(const CodeOrigin&, const PutByIdStatus&);
-    InByIdStatus* addInByIdStatus(const CodeOrigin&, const InByIdStatus&);
+    InByStatus* addInByStatus(const CodeOrigin&, const InByStatus&);
     DeleteByStatus* addDeleteByStatus(const CodeOrigin&, const DeleteByStatus&);
     CheckPrivateBrandStatus* addCheckPrivateBrandStatus(const CodeOrigin&, const CheckPrivateBrandStatus&);
@@ -78 +78 @@
     Vector<std::pair<CodeOrigin, std::unique_ptr<GetByStatus>>> gets;
     Vector<std::pair<CodeOrigin, std::unique_ptr<PutByIdStatus>>> puts;
-    Vector<std::pair<CodeOrigin, std::unique_ptr<InByIdStatus>>> ins;
+    Vector<std::pair<CodeOrigin, std::unique_ptr<InByStatus>>> ins;
     Vector<std::pair<CodeOrigin, std::unique_ptr<DeleteByStatus>>> deletes;
     Vector<std::pair<CodeOrigin, std::unique_ptr<CheckPrivateBrandStatus>>> checkPrivateBrands;

trunk/Source/JavaScriptCore/bytecode/SetPrivateBrandStatus.cpp

@@ -227 +227 @@
 CacheableIdentifier SetPrivateBrandStatus::singleIdentifier() const
 {
-    if (m_variants.isEmpty())
-        return nullptr;
-
-    CacheableIdentifier result = m_variants.first().identifier();
-    if (!result)
-        return nullptr;
-    for (size_t i = 1; i < m_variants.size(); ++i) {
-        CacheableIdentifier identifier = m_variants[i].identifier();
-        if (!identifier)
-            return nullptr;
-        if (identifier != result)
-            return nullptr;
-    }
-    return result;
+    return singleIdentifierForICStatus(m_variants);
 }
 

trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp

@@ -273 +273 @@
         resetPutByID(codeBlock, *this);
         break;
-    case AccessType::In:
-        resetInByID(codeBlock, *this);
+    case AccessType::InById:
+        resetInBy(codeBlock, *this, InByKind::Normal);
+        break;
+    case AccessType::InByVal:
+        resetInBy(codeBlock, *this, InByKind::NormalByVal);
         break;
     case AccessType::InstanceOf:

trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.h

@@ -56 +56 @@
     GetByVal,
     Put,
-    In,
+    InById,
+    InByVal,
     InstanceOf,
     DeleteByID,

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -4440 +4440 @@
     case FilterGetByStatus:
     case FilterPutByIdStatus:
-    case FilterInByIdStatus:
+    case FilterInByStatus:
     case FilterDeleteByStatus:
     case FilterCheckPrivateBrandStatus:
@@ -4611 +4611 @@
     }
         
-    case FilterInByIdStatus: {
+    case FilterInByStatus: {
         AbstractValue& value = forNode(node->child1());
         if (value.m_structure.isFinite())
-            node->inByIdStatus()->filter(value.m_structure.toStructureSet());
+            node->inByStatus()->filter(value.m_structure.toStructureSet());
         break;
     }

trunk/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp

@@ -405 +405 @@
                 case FilterPutByIdStatus:
                 case FilterCallLinkStatus:
-                case FilterInByIdStatus:
+                case FilterInByStatus:
                 case FilterDeleteByStatus:
                 case FilterCheckPrivateBrandStatus:
@@ -1268 +1268 @@
                 case FilterPutByIdStatus:
                 case FilterCallLinkStatus:
-                case FilterInByIdStatus:
+                case FilterInByStatus:
                 case FilterDeleteByStatus:
                 case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -56 +56 @@
 #include "GetterSetter.h"
 #include "Heap.h"
-#include "InByIdStatus.h"
+#include "InByStatus.h"
 #include "InstanceOfStatus.h"
 #include "JSArrayIterator.h"
@@ -264 +264 @@
     void handleDeleteById(
         VirtualRegister destination, Node* base, CacheableIdentifier, unsigned identifierNumber, DeleteByStatus, ECMAMode);
-    
+
+    void handleInById(VirtualRegister destination, Node* base, CacheableIdentifier, InByStatus);
+
     // Either register a watchpoint or emit a check for this condition. Returns false if the
     // condition no longer holds, and therefore no reasonable check can be emitted.
@@ -4927 +4929 @@
     set(destination, jsConstant(jsBoolean(variant.result())));
     return;
+}
+
+void ByteCodeParser::handleInById(VirtualRegister destination, Node* base, CacheableIdentifier identifier, InByStatus status)
+{
+    if (status.isSimple() && Options::useAccessInlining()) {
+        bool allOK = true;
+        MatchStructureData* data = m_graph.m_matchStructureData.add();
+        for (const InByIdVariant& variant : status.variants()) {
+            if (!check(variant.conditionSet())) {
+                allOK = false;
+                break;
+            }
+            for (Structure* structure : variant.structureSet()) {
+                MatchStructureVariant matchVariant;
+                matchVariant.structure = m_graph.registerStructure(structure);
+                matchVariant.result = variant.isHit();
+
+                data->variants.append(WTFMove(matchVariant));
+            }
+        }
+
+        if (allOK) {
+            addToGraph(FilterInByStatus, OpInfo(m_graph.m_plan.recordedStatuses().addInByStatus(currentCodeOrigin(), status)), base);
+            set(destination, addToGraph(MatchStructure, OpInfo(data), base));
+            return;
+        }
+    }
+
+    set(destination, addToGraph(InById, OpInfo(identifier), base));
 }
 
@@ -8213 +8244 @@
         case op_in_by_val: {
             auto bytecode = currentInstruction->as<OpInByVal>();
-            ArrayMode arrayMode = getArrayMode(bytecode.metadata(codeBlock).m_arrayProfile, Array::Read);
-            set(bytecode.m_dst, addToGraph(InByVal, OpInfo(arrayMode.asWord()), get(bytecode.m_base), get(bytecode.m_property)));
+            Node* base = get(bytecode.m_base);
+            Node* property = get(bytecode.m_property);
+            bool compiledAsInById = false;
+
+            if (!m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadIdent)
+                && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadType)
+                && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadConstantValue)) {
+
+                InByStatus status = InByStatus::computeFor(
+                    m_inlineStackTop->m_profiledBlock, m_inlineStackTop->m_baselineMap,
+                    m_icContextStack, currentCodeOrigin());
+
+                if (CacheableIdentifier identifier = status.singleIdentifier()) {
+                    UniquedStringImpl* uid = identifier.uid();
+                    m_graph.identifiers().ensure(uid);
+                    if (identifier.isCell()) {
+                        FrozenValue* frozen = m_graph.freezeStrong(identifier.cell());
+                        if (identifier.isSymbolCell())
+                            addToGraph(CheckIsConstant, OpInfo(frozen), property);
+                        else
+                            addToGraph(CheckIdent, OpInfo(uid), property);
+                    } else
+                        addToGraph(CheckIdent, OpInfo(uid), property);
+
+                    handleInById(bytecode.m_dst, base, identifier, status);
+                    compiledAsInById = true;
+                }
+            }
+
+            if (!compiledAsInById) {
+                ArrayMode arrayMode = getArrayMode(bytecode.metadata(codeBlock).m_arrayProfile, Array::Read);
+                set(bytecode.m_dst, addToGraph(InByVal, OpInfo(arrayMode.asWord()), base, property));
+            }
             NEXT_OPCODE(op_in_by_val);
         }
@@ -8223 +8285 @@
             unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[bytecode.m_property];
             UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
-
-            InByIdStatus status = InByIdStatus::computeFor(
-                m_inlineStackTop->m_profiledBlock,
-                m_inlineStackTop->m_baselineMap, m_icContextStack,
-                currentCodeOrigin(), uid);
-
-            if (status.isSimple() && Options::useAccessInlining()) {
-                bool allOK = true;
-                MatchStructureData* data = m_graph.m_matchStructureData.add();
-                for (const InByIdVariant& variant : status.variants()) {
-                    if (!check(variant.conditionSet())) {
-                        allOK = false;
-                        break;
-                    }
-                    for (Structure* structure : variant.structureSet()) {
-                        MatchStructureVariant matchVariant;
-                        matchVariant.structure = m_graph.registerStructure(structure);
-                        matchVariant.result = variant.isHit();
-
-                        data->variants.append(WTFMove(matchVariant));
-                    }
-                }
-
-                if (allOK) {
-                    addToGraph(FilterInByIdStatus, OpInfo(m_graph.m_plan.recordedStatuses().addInByIdStatus(currentCodeOrigin(), status)), base);
-
-                    Node* match = addToGraph(MatchStructure, OpInfo(data), base);
-                    set(bytecode.m_dst, match);
-                    NEXT_OPCODE(op_in_by_id);
-                }
-            }
-
-            set(bytecode.m_dst, addToGraph(InById, OpInfo(CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_inlineStackTop->m_profiledBlock, uid)), base));
+            InByStatus status = InByStatus::computeFor(
+                m_inlineStackTop->m_profiledBlock, m_inlineStackTop->m_baselineMap,
+                m_icContextStack, currentCodeOrigin());
+            handleInById(bytecode.m_dst, base, CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_inlineStackTop->m_profiledBlock, uid), status);
             NEXT_OPCODE(op_in_by_id);
         }

trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

@@ -505 +505 @@
     case FilterGetByStatus:
     case FilterPutByIdStatus:
-    case FilterInByIdStatus:
+    case FilterInByStatus:
     case FilterDeleteByStatus:
     case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp

@@ -83 +83 @@
     case FilterGetByStatus:
     case FilterPutByIdStatus:
-    case FilterInByIdStatus:
+    case FilterInByStatus:
     case FilterDeleteByStatus:
     case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

@@ -250 +250 @@
     case FilterGetByStatus:
     case FilterPutByIdStatus:
-    case FilterInByIdStatus:
+    case FilterInByStatus:
     case FilterDeleteByStatus:
     case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -2883 +2883 @@
         case FilterGetByStatus:
         case FilterPutByIdStatus:
-        case FilterInByIdStatus:
+        case FilterInByStatus:
         case FilterDeleteByStatus:
         case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp

@@ -384 +384 @@
     if (node->hasGetByStatus())
         out.print(comma, *node->getByStatus());
-    if (node->hasInByIdStatus())
-        out.print(comma, *node->inByIdStatus());
+    if (node->hasInByStatus())
+        out.print(comma, *node->inByStatus());
     if (node->hasPutByIdStatus())
         out.print(comma, *node->putByIdStatus());

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp

@@ -256 +256 @@
     finalizeInlineCaches(m_delByVals, linkBuffer);
     finalizeInlineCaches(m_inByIds, linkBuffer);
+    finalizeInlineCaches(m_inByVals, linkBuffer);
     finalizeInlineCaches(m_instanceOfs, linkBuffer);
     finalizeInlineCaches(m_privateBrandAccesses, linkBuffer);

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.h

@@ -215 +215 @@
     }
 
+    void addInByVal(const JITInByValGenerator& gen, SlowPathGenerator* slowPath)
+    {
+        m_inByVals.append(InlineCacheWrapper<JITInByValGenerator>(gen, slowPath));
+    }
+
     void addPrivateBrandAccess(const JITPrivateBrandAccessGenerator& gen, SlowPathGenerator* slowPath)
     {
@@ -354 +359 @@
     Vector<InlineCacheWrapper<JITDelByValGenerator>, 4> m_delByVals;
     Vector<InlineCacheWrapper<JITInByIdGenerator>, 4> m_inByIds;
+    Vector<InlineCacheWrapper<JITInByValGenerator>, 4> m_inByVals;
     Vector<InlineCacheWrapper<JITInstanceOfGenerator>, 4> m_instanceOfs;
     Vector<InlineCacheWrapper<JITPrivateBrandAccessGenerator>, 4> m_privateBrandAccesses;

trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp

@@ -108 +108 @@
     case FilterGetByStatus:
     case FilterPutByIdStatus:
-    case FilterInByIdStatus:
+    case FilterInByStatus:
     case FilterDeleteByStatus:
     case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/dfg/DFGNode.h

@@ -3110 +3110 @@
     }
     
-    bool hasInByIdStatus()
-    {
-        return op() == FilterInByIdStatus;
-    }
-    
-    InByIdStatus* inByIdStatus()
-    {
-        ASSERT(hasInByIdStatus());
-        return m_opInfo.as<InByIdStatus*>();
+    bool hasInByStatus()
+    {
+        return op() == FilterInByStatus;
+    }
+    
+    InByStatus* inByStatus()
+    {
+        ASSERT(hasInByStatus());
+        return m_opInfo.as<InByStatus*>();
     }
     

trunk/Source/JavaScriptCore/dfg/DFGNodeType.h

@@ -547 +547 @@
     macro(FilterCallLinkStatus, NodeMustGenerate) \
     macro(FilterGetByStatus, NodeMustGenerate) \
-    macro(FilterInByIdStatus, NodeMustGenerate) \
+    macro(FilterInByStatus, NodeMustGenerate) \
     macro(FilterPutByIdStatus, NodeMustGenerate) \
     macro(FilterDeleteByStatus, NodeMustGenerate) \

trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp

@@ -1260 +1260 @@
         case FilterGetByStatus:
         case FilterPutByIdStatus:
-        case FilterInByIdStatus:
+        case FilterInByStatus:
         case FilterDeleteByStatus:
         case FilterCheckPrivateBrandStatus:
@@ -2617 +2617 @@
                 case FilterGetByStatus:
                 case FilterPutByIdStatus:
-                case FilterInByIdStatus:
+                case FilterInByStatus:
                 case FilterDeleteByStatus:
                 case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

@@ -1452 +1452 @@
         case FilterGetByStatus:
         case FilterPutByIdStatus:
-        case FilterInByIdStatus:
+        case FilterInByStatus:
         case FilterDeleteByStatus:
         case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

@@ -362 +362 @@
     case FilterGetByStatus:
     case FilterPutByIdStatus:
-    case FilterInByIdStatus:
+    case FilterInByStatus:
     case FilterDeleteByStatus:
     case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -1287 +1287 @@
     SpeculateCellOperand base(this, node->child1());
     JSValueOperand key(this, node->child2());
+    JSValueRegsTemporary result(this, Reuse, key);
 
     GPRReg baseGPR = base.gpr();
-    JSValueRegs regs = key.jsValueRegs();
+    JSValueRegs keyRegs = key.jsValueRegs();
+    JSValueRegs resultRegs = result.regs();
 
     base.use();
     key.use();
 
-    flushRegisters();
-    JSValueRegsFlushedCallResult result(this);
-    JSValueRegs resultRegs = result.regs();
-    callOperation(operationInByVal, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, regs);
-    m_jit.exceptionCheck();
+    CodeOrigin codeOrigin = node->origin.semantic;
+    CallSiteIndex callSite = m_jit.recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(codeOrigin, m_stream->size());
+    RegisterSet usedRegisters = this->usedRegisters();
+    JITInByValGenerator gen(
+        m_jit.codeBlock(), codeOrigin, callSite, usedRegisters,
+        JSValueRegs::payloadOnly(baseGPR), keyRegs, resultRegs);
+    gen.generateFastPath(m_jit);
+
+    auto slowPath = slowPathCall(
+        gen.slowPathJump(), this, operationInByValOptimize,
+        NeedToSpill, ExceptionCheckRequirement::CheckNeeded,
+        resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), gen.stubInfo(), nullptr, CCallHelpers::CellValue(baseGPR), keyRegs);
+
+    m_jit.addInByVal(gen, slowPath.get());
+    addSlowPathGenerator(WTFMove(slowPath));
+
     blessedBooleanResult(resultRegs.payloadGPR(), node, UseChildrenCalledExplicitly);
 }

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -4272 +4272 @@
     case FilterGetByStatus:
     case FilterPutByIdStatus:
-    case FilterInByIdStatus:
+    case FilterInByStatus:
     case FilterDeleteByStatus:
     case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -5706 +5706 @@
     case FilterGetByStatus:
     case FilterPutByIdStatus:
-    case FilterInByIdStatus:
+    case FilterInByStatus:
     case FilterDeleteByStatus:
     case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp

@@ -199 +199 @@
             case FilterPutByIdStatus:
             case FilterCallLinkStatus:
-            case FilterInByIdStatus:
+            case FilterInByStatus:
             case FilterDeleteByStatus:
             case FilterCheckPrivateBrandStatus:
@@ -424 +424 @@
             case FilterPutByIdStatus:
             case FilterCallLinkStatus:
-            case FilterInByIdStatus:
+            case FilterInByStatus:
             case FilterDeleteByStatus:
             case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

@@ -410 +410 @@
     case FilterGetByStatus:
     case FilterPutByIdStatus:
-    case FilterInByIdStatus:
+    case FilterInByStatus:
     case FilterDeleteByStatus:
     case FilterCheckPrivateBrandStatus:

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -1653 +1653 @@
         case FilterGetByStatus:
         case FilterPutByIdStatus:
-        case FilterInByIdStatus:
+        case FilterInByStatus:
         case FilterDeleteByStatus:
         case FilterCheckPrivateBrandStatus:
@@ -12214 +12214 @@
         setJSValue(m_out.phi(Int64, results));
     }
-    
-    void compileInByVal()
-    {
-        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_origin.semantic);
-        setJSValue(vmCall(Int64, operationInByVal, weakPointer(globalObject), lowCell(m_node->child1()), lowJSValue(m_node->child2())));
-    }
-    
+
     void compileHasPrivateName()
     {
@@ -12233 +12227 @@
     }
 
-    void compileInById()
-    {
-        Node* node = m_node;
-        CacheableIdentifier identifier = node->cacheableIdentifier();
-        LValue base = lowCell(m_node->child1());
-
+    template<InByKind kind, typename SubscriptKind>
+    void compileInBy(LValue base, SubscriptKind subscriptValue)
+    {
         PatchpointValue* patchpoint = m_out.patchpoint(Int64);
         patchpoint->appendSomeRegister(base);
+        if constexpr (kind != InByKind::Normal)
+            patchpoint->appendSomeRegister(subscriptValue);
         patchpoint->append(m_notCellMask, ValueRep::lateReg(GPRInfo::notCellMaskRegister));
         patchpoint->append(m_numberTag, ValueRep::lateReg(GPRInfo::numberTagRegister));
-
         patchpoint->clobber(RegisterSet::macroScratchRegisters());
 
-        RefPtr<PatchpointExceptionHandle> exceptionHandle =
-            preparePatchpointForExceptions(patchpoint);
+        RefPtr<PatchpointExceptionHandle> exceptionHandle = preparePatchpointForExceptions(patchpoint);
 
         State* state = &m_ftlState;
+        Node* node = m_node;
         patchpoint->setGenerator(
             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
                 AllowMacroScratchRegisterUsage allowScratch(jit);
 
-                CallSiteIndex callSiteIndex =
-                    state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(node->origin.semantic);
+                CallSiteIndex callSiteIndex = state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(node->origin.semantic);
 
                 // This is the direct exit target for operation calls.
-                Box<CCallHelpers::JumpList> exceptions =
-                    exceptionHandle->scheduleExitCreation(params)->jumps(jit);
-
-                auto generator = Box<JITInByIdGenerator>::create(
-                    jit.codeBlock(), node->origin.semantic, callSiteIndex,
-                    params.unavailableRegisters(), identifier, JSValueRegs(params[1].gpr()),
-                    JSValueRegs(params[0].gpr()));
+                Box<CCallHelpers::JumpList> exceptions = exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+
+                auto returnGPR = params[0].gpr();
+                auto base = JSValueRegs(params[1].gpr());
+
+                const auto subscript = [&] {
+                    if constexpr (kind == InByKind::Normal)
+                        return CCallHelpers::TrustedImmPtr(subscriptValue.rawBits());
+                    else
+                        return JSValueRegs(params[2].gpr());
+                }();
+
+                const auto generator = [&] {
+                    if constexpr (kind == InByKind::Normal) {
+                        return Box<JITInByIdGenerator>::create(
+                            jit.codeBlock(), node->origin.semantic, callSiteIndex,
+                            params.unavailableRegisters(), subscriptValue, base,
+                            JSValueRegs(returnGPR));
+                    } else {
+                        return Box<JITInByValGenerator>::create(
+                            jit.codeBlock(), node->origin.semantic, callSiteIndex,
+                            params.unavailableRegisters(), base, subscript,
+                            JSValueRegs(returnGPR));
+                    }
+                }();
 
                 generator->generateFastPath(jit);
@@ -12275 +12284 @@
                         generator->slowPathJump().link(&jit);
                         CCallHelpers::Label slowPathBegin = jit.label();
-                        CCallHelpers::Call slowPathCall = callOperation(
-                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
-                            exceptions.get(), operationInByIdOptimize, params[0].gpr(),
-                            jit.codeBlock()->globalObjectFor(node->origin.semantic),
-                            CCallHelpers::TrustedImmPtr(generator->stubInfo()), params[1].gpr(),
-                            identifier.rawBits()).call();
+                        CCallHelpers::Call slowPathCall;
+                        if constexpr (kind == InByKind::Normal) {
+                            slowPathCall = callOperation(
+                                *state, params.unavailableRegisters(), jit, node->origin.semantic,
+                                exceptions.get(), operationInByIdOptimize, returnGPR,
+                                jit.codeBlock()->globalObjectFor(node->origin.semantic),
+                                CCallHelpers::TrustedImmPtr(generator->stubInfo()),
+                                base, subscript).call();
+                        } else {
+                            slowPathCall = callOperation(
+                                *state, params.unavailableRegisters(), jit, node->origin.semantic,
+                                exceptions.get(), operationInByValOptimize, returnGPR,
+                                jit.codeBlock()->globalObjectFor(node->origin.semantic),
+                                CCallHelpers::TrustedImmPtr(generator->stubInfo()),
+                                CCallHelpers::TrustedImmPtr(nullptr), base, subscript).call();
+                        }
                         jit.jump().linkTo(done, &jit);
 
@@ -12293 +12312 @@
 
         setJSValue(patchpoint);
+    }
+
+    void compileInById()
+    {
+        compileInBy<InByKind::Normal>(lowCell(m_node->child1()), m_node->cacheableIdentifier());
+    }
+
+    void compileInByVal()
+    {
+        compileInBy<InByKind::NormalByVal>(lowCell(m_node->child1()), lowJSValue(m_node->child2()));
     }
 

trunk/Source/JavaScriptCore/jit/ICStats.h

@@ -44 +44 @@
     macro(InAddAccessCase) \
     macro(InReplaceWithJump) \
+    macro(InReplaceWithGeneric) \
     macro(InstanceOfAddAccessCase) \
     macro(InstanceOfReplaceWithJump) \
@@ -53 +54 @@
     macro(OperationGetByIdWithThisOptimize) \
     macro(OperationGenericIn) \
-    macro(OperationInById) \
+    macro(OperationInByIdGeneric) \
     macro(OperationInByIdOptimize) \
     macro(OperationPutByIdStrict) \

trunk/Source/JavaScriptCore/jit/JIT.cpp

@@ -286 +286 @@
 
         switch (opcodeID) {
-        DEFINE_SLOW_OP(in_by_val)
         DEFINE_SLOW_OP(has_private_name)
         DEFINE_SLOW_OP(has_private_brand)
@@ -362 +361 @@
         DEFINE_OP(op_try_get_by_id)
         DEFINE_OP(op_in_by_id)
+        DEFINE_OP(op_in_by_val)
         DEFINE_OP(op_get_by_id)
         DEFINE_OP(op_get_by_id_with_this)
@@ -519 +519 @@
     m_putByIdIndex = 0;
     m_inByIdIndex = 0;
+    m_inByValIndex = 0;
+    m_delByIdIndex = 0;
     m_delByValIndex = 0;
-    m_delByIdIndex = 0;
     m_instanceOfIndex = 0;
     m_privateBrandAccessIndex = 0;
@@ -571 +572 @@
         DEFINE_SLOWCASE_OP(op_try_get_by_id)
         DEFINE_SLOWCASE_OP(op_in_by_id)
+        DEFINE_SLOWCASE_OP(op_in_by_val)
         DEFINE_SLOWCASE_OP(op_get_by_id)
         DEFINE_SLOWCASE_OP(op_get_by_id_with_this)
@@ -920 +922 @@
     finalizeInlineCaches(m_delByVals, patchBuffer);
     finalizeInlineCaches(m_inByIds, patchBuffer);
+    finalizeInlineCaches(m_inByVals, patchBuffer);
     finalizeInlineCaches(m_instanceOfs, patchBuffer);
     finalizeInlineCaches(m_privateBrandAccesses, patchBuffer);

trunk/Source/JavaScriptCore/jit/JIT.h

@@ -566 +566 @@
         void emit_op_get_prototype_of(const Instruction*);
         void emit_op_in_by_id(const Instruction*);
+        void emit_op_in_by_val(const Instruction*);
         void emit_op_init_lazy_reg(const Instruction*);
         void emit_op_overrides_has_instance(const Instruction*);
@@ -699 +700 @@
         void emitSlow_op_get_argument_by_val(const Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_in_by_id(const Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_in_by_val(const Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_instanceof(const Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_instanceof_custom(const Instruction*, Vector<SlowCaseEntry>::iterator&);
@@ -1038 +1040 @@
         Vector<JITPutByIdGenerator> m_putByIds;
         Vector<JITInByIdGenerator> m_inByIds;
+        Vector<JITInByValGenerator> m_inByVals;
         Vector<JITDelByIdGenerator> m_delByIds;
         Vector<JITDelByValGenerator> m_delByVals;
@@ -1064 +1067 @@
         unsigned m_putByIdIndex { UINT_MAX };
         unsigned m_inByIdIndex { UINT_MAX };
+        unsigned m_inByValIndex { UINT_MAX };
         unsigned m_delByValIndex { UINT_MAX };
         unsigned m_delByIdIndex { UINT_MAX };

trunk/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp

@@ -236 +236 @@
 }
 
-JITInByIdGenerator::JITInByIdGenerator(
-    CodeBlock* codeBlock, CodeOrigin codeOrigin, CallSiteIndex callSite, const RegisterSet& usedRegisters,
-    CacheableIdentifier propertyName, JSValueRegs base, JSValueRegs value)
-    : JITByIdGenerator(codeBlock, codeOrigin, callSite, AccessType::In, usedRegisters, base, value)
+JITInByValGenerator::JITInByValGenerator(CodeBlock* codeBlock, CodeOrigin codeOrigin, CallSiteIndex callSiteIndex, const RegisterSet& usedRegisters, JSValueRegs base, JSValueRegs property, JSValueRegs result)
+    : Base(codeBlock, codeOrigin, callSiteIndex, AccessType::InByVal, usedRegisters)
+{
+    m_stubInfo->hasConstantIdentifier = false;
+
+    m_stubInfo->baseGPR = base.payloadGPR();
+    m_stubInfo->regs.propertyGPR = property.payloadGPR();
+    m_stubInfo->valueGPR = result.payloadGPR();
+#if USE(JSVALUE32_64)
+    m_stubInfo->baseTagGPR = base.tagGPR();
+    m_stubInfo->valueTagGPR = result.tagGPR();
+    m_stubInfo->v.propertyTagGPR = property.tagGPR();
+#endif
+}
+
+void JITInByValGenerator::generateFastPath(MacroAssembler& jit)
+{
+    m_start = jit.label();
+    m_slowPathJump = jit.patchableJump();
+    m_done = jit.label();
+}
+
+void JITInByValGenerator::finalize(
+    LinkBuffer& fastPath, LinkBuffer& slowPath)
+{
+    ASSERT(m_start.isSet());
+    Base::finalize(
+        fastPath, slowPath, fastPath.locationOf<JITStubRoutinePtrTag>(m_start));
+}
+
+JITInByIdGenerator::JITInByIdGenerator(CodeBlock* codeBlock, CodeOrigin codeOrigin, CallSiteIndex callSite, const RegisterSet& usedRegisters, CacheableIdentifier propertyName, JSValueRegs base, JSValueRegs value)
+    : JITByIdGenerator(codeBlock, codeOrigin, callSite, AccessType::InById, usedRegisters, base, value)
 {
     // FIXME: We are not supporting fast path for "length" property.

trunk/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h

@@ -196 +196 @@
 };
 
+class JITInByValGenerator : public JITInlineCacheGenerator {
+    using Base = JITInlineCacheGenerator;
+public:
+    JITInByValGenerator() { }
+
+    JITInByValGenerator(
+        CodeBlock*, CodeOrigin, CallSiteIndex, const RegisterSet& usedRegisters,
+        JSValueRegs base, JSValueRegs property, JSValueRegs result);
+
+    MacroAssembler::Jump slowPathJump() const
+    {
+        ASSERT(m_slowPathJump.m_jump.isSet());
+        return m_slowPathJump.m_jump;
+    }
+
+    void finalize(
+        LinkBuffer& fastPathLinkBuffer, LinkBuffer& slowPathLinkBuffer);
+
+    void generateFastPath(MacroAssembler&);
+
+private:
+    MacroAssembler::Label m_start;
+    MacroAssembler::PatchableJump m_slowPathJump;
+};
+
 class JITInByIdGenerator : public JITByIdGenerator {
 public:

trunk/Source/JavaScriptCore/jit/JITOperations.cpp

@@ -395 +395 @@
 }
 
-JSC_DEFINE_JIT_OPERATION(operationInById, EncodedJSValue, (JSGlobalObject* globalObject, StructureStubInfo* stubInfo, EncodedJSValue base, uintptr_t rawCacheableIdentifier))
+JSC_DEFINE_JIT_OPERATION(operationInByIdGeneric, EncodedJSValue, (JSGlobalObject* globalObject, StructureStubInfo* stubInfo, EncodedJSValue base, uintptr_t rawCacheableIdentifier))
 {
     SuperSamplerScope superSamplerScope(false);
@@ -416 +416 @@
     JSObject* baseObject = asObject(baseValue);
 
-    LOG_IC((ICEvent::OperationInById, baseObject->classInfo(vm), ident));
+    LOG_IC((ICEvent::OperationInByIdGeneric, baseObject->classInfo(vm), ident));
 
     scope.release();
@@ -449 +449 @@
     CodeBlock* codeBlock = callFrame->codeBlock();
     if (stubInfo->considerCachingBy(vm, codeBlock, baseObject->structure(vm), identifier))
-        repatchInByID(globalObject, codeBlock, baseObject, identifier, found, slot, *stubInfo);
+        repatchInBy(globalObject, codeBlock, baseObject, identifier, found, slot, *stubInfo, InByKind::Normal);
     return JSValue::encode(jsBoolean(found));
 }
 
-JSC_DEFINE_JIT_OPERATION(operationInByVal, EncodedJSValue, (JSGlobalObject* globalObject, JSCell* base, EncodedJSValue key))
+JSC_DEFINE_JIT_OPERATION(operationInByValOptimize, EncodedJSValue, (JSGlobalObject* globalObject, StructureStubInfo* stubInfo, ArrayProfile* arrayProfile, EncodedJSValue encodedBase, EncodedJSValue encodedKey))
 {
     SuperSamplerScope superSamplerScope(false);
-    
-    VM& vm = globalObject->vm();
-    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
-    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
-
-    return JSValue::encode(jsBoolean(CommonSlowPaths::opInByVal(globalObject, base, JSValue::decode(key))));
+
+    VM& vm = globalObject->vm();
+    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue baseValue = JSValue::decode(encodedBase);
+    if (!baseValue.isObject()) {
+        throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue));
+        return encodedJSValue();
+    }
+    JSObject* baseObject = asObject(baseValue);
+    if (arrayProfile)
+        arrayProfile->observeStructure(baseObject->structure(vm));
+
+    JSValue key = JSValue::decode(encodedKey);
+    uint32_t i;
+    if (key.getUInt32(i)) {
+        // FIXME: InByVal should have inline caching for integer indices too, as GetByVal does.
+        // https://bugs.webkit.org/show_bug.cgi?id=226619
+        if (arrayProfile)
+            arrayProfile->observeIndexedRead(vm, baseObject, i);
+        RELEASE_AND_RETURN(scope, JSValue::encode(jsBoolean(baseObject->hasProperty(globalObject, i))));
+    }
+
+    const Identifier propertyName = key.toPropertyKey(globalObject);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    PropertySlot slot(baseObject, PropertySlot::InternalMethodType::HasProperty);
+    bool found = baseObject->getPropertySlot(globalObject, propertyName, slot);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (CacheableIdentifier::isCacheableIdentifierCell(key) && (key.isSymbol() || !parseIndex(propertyName))) {
+        CodeBlock* codeBlock = callFrame->codeBlock();
+        CacheableIdentifier identifier = CacheableIdentifier::createFromCell(key.asCell());
+        if (stubInfo->considerCachingBy(vm, codeBlock, baseObject->structure(vm), identifier))
+            repatchInBy(globalObject, codeBlock, baseObject, identifier, found, slot, *stubInfo, InByKind::NormalByVal);
+    }
+
+    return JSValue::encode(jsBoolean(found));
+}
+
+JSC_DEFINE_JIT_OPERATION(operationInByValGeneric, EncodedJSValue, (JSGlobalObject* globalObject, StructureStubInfo* stubInfo, ArrayProfile* arrayProfile, EncodedJSValue base, EncodedJSValue key))
+{
+    SuperSamplerScope superSamplerScope(false);
+
+    VM& vm = globalObject->vm();
+    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+
+    stubInfo->tookSlowPath = true;
+    return JSValue::encode(jsBoolean(CommonSlowPaths::opInByVal(globalObject, JSValue::decode(base), JSValue::decode(key), arrayProfile)));
 }
 

trunk/Source/JavaScriptCore/jit/JITOperations.h

@@ -175 +175 @@
 JSC_DECLARE_JIT_OPERATION(operationGetByIdDirectOptimize, EncodedJSValue, (JSGlobalObject*, StructureStubInfo*, EncodedJSValue, uintptr_t));
 
-JSC_DECLARE_JIT_OPERATION(operationInById, EncodedJSValue, (JSGlobalObject*, StructureStubInfo*, EncodedJSValue, uintptr_t));
+JSC_DECLARE_JIT_OPERATION(operationInByIdGeneric, EncodedJSValue, (JSGlobalObject*, StructureStubInfo*, EncodedJSValue, uintptr_t));
 JSC_DECLARE_JIT_OPERATION(operationInByIdOptimize, EncodedJSValue, (JSGlobalObject*, StructureStubInfo*, EncodedJSValue, uintptr_t));
-
-JSC_DECLARE_JIT_OPERATION(operationInByVal, EncodedJSValue, (JSGlobalObject*, JSCell*, EncodedJSValue));
+JSC_DECLARE_JIT_OPERATION(operationInByValGeneric, EncodedJSValue, (JSGlobalObject*, StructureStubInfo*, ArrayProfile*, EncodedJSValue, EncodedJSValue));
+JSC_DECLARE_JIT_OPERATION(operationInByValOptimize, EncodedJSValue, (JSGlobalObject*, StructureStubInfo*, ArrayProfile*, EncodedJSValue, EncodedJSValue));
 JSC_DECLARE_JIT_OPERATION(operationHasPrivateName, EncodedJSValue, (JSGlobalObject*, JSCell*, EncodedJSValue));
 JSC_DECLARE_JIT_OPERATION(operationHasPrivateBrand, EncodedJSValue, (JSGlobalObject*, JSCell*, EncodedJSValue));

trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

@@ -1569 +1569 @@
 
     emitPutVirtualRegister(resultVReg, returnValueGPR);
+#endif // ENABLE(EXTRA_CTI_THUNKS)
+
+    gen.reportSlowPathCall(coldPathBegin, call);
+}
+
+void JIT::emit_op_in_by_val(const Instruction* currentInstruction)
+{
+    auto bytecode = currentInstruction->as<OpInByVal>();
+    VirtualRegister dst = bytecode.m_dst;
+    VirtualRegister base = bytecode.m_base;
+    VirtualRegister property = bytecode.m_property;
+    auto& metadata = bytecode.metadata(m_codeBlock);
+    ArrayProfile* profile = &metadata.m_arrayProfile;
+
+    emitGetVirtualRegister(base, regT0);
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
+    emitGetVirtualRegister(property, regT1);
+    emitArrayProfilingSiteWithCell(regT0, regT2, profile);
+
+    JITInByValGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),
+        JSValueRegs(regT0), JSValueRegs(regT1), JSValueRegs(regT0));
+    gen.generateFastPath(*this);
+    addSlowCase(gen.slowPathJump());
+    m_inByVals.append(gen);
+
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emitSlow_op_in_by_val(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCases(iter);
+
+    auto bytecode = currentInstruction->as<OpInByVal>();
+    VirtualRegister dst = bytecode.m_dst;
+    auto& metadata = bytecode.metadata(m_codeBlock);
+    ArrayProfile* profile = &metadata.m_arrayProfile;
+
+    JITInByValGenerator& gen = m_inByVals[m_inByValIndex++];
+
+    Label coldPathBegin = label();
+
+#if !ENABLE(EXTRA_CTI_THUNKS)
+    Call call = callOperation(operationInByValOptimize, dst, TrustedImmPtr(m_codeBlock->globalObject()), gen.stubInfo(), profile, regT0, regT1);
+#else
+    VM& vm = this->vm();
+    uint32_t bytecodeOffset = m_bytecodeIndex.offset();
+    ASSERT(BytecodeIndex(bytecodeOffset) == m_bytecodeIndex);
+
+    constexpr GPRReg bytecodeOffsetGPR = argumentGPR4;
+    move(TrustedImm32(bytecodeOffset), bytecodeOffsetGPR);
+
+    constexpr GPRReg stubInfoGPR = argumentGPR3;
+    constexpr GPRReg profileGPR = argumentGPR2;
+    constexpr GPRReg baseGPR = regT0;
+    constexpr GPRReg propertyGPR = regT1;
+    static_assert(baseGPR == argumentGPR0 || !isARM64());
+    static_assert(propertyGPR == argumentGPR1);
+
+    move(TrustedImmPtr(gen.stubInfo()), stubInfoGPR);
+    move(TrustedImmPtr(profile), profileGPR);
+    // slow_op_get_by_val_prepareCallGenerator will do exactly what we need.
+    // So, there's no point in creating a duplicate thunk just to give it a different name.
+    static_assert(std::is_same<decltype(operationInByValOptimize), decltype(operationGetByValOptimize)>::value);
+    emitNakedNearCall(vm.getCTIStub(slow_op_get_by_val_prepareCallGenerator).retaggedCode<NoPtrTag>());
+
+    Call call = appendCall(operationInByValOptimize);
+    emitNakedNearCall(vm.getCTIStub(checkExceptionGenerator).retaggedCode<NoPtrTag>());
+
+    emitPutVirtualRegister(dst, returnValueGPR);
 #endif // ENABLE(EXTRA_CTI_THUNKS)
 

trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp

@@ -905 +905 @@
 
     Call call = callOperation(operationInByIdOptimize, resultVReg, m_codeBlock->globalObject(), gen.stubInfo(), JSValueRegs(regT1, regT0), CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_codeBlock, *ident).rawBits());
+
+    gen.reportSlowPathCall(coldPathBegin, call);
+}
+
+void JIT::emit_op_in_by_val(const Instruction* currentInstruction)
+{
+    auto bytecode = currentInstruction->as<OpInByVal>();
+    VirtualRegister dst = bytecode.m_dst;
+    VirtualRegister base = bytecode.m_base;
+    VirtualRegister property = bytecode.m_property;
+    auto& metadata = bytecode.metadata(m_codeBlock);
+    ArrayProfile* profile = &metadata.m_arrayProfile;
+
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    emitArrayProfilingSiteWithCell(regT0, regT4, profile);
+
+    JITInByValGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),
+        JSValueRegs::payloadOnly(regT0), JSValueRegs(regT3, regT2), JSValueRegs(regT1, regT0));
+    gen.generateFastPath(*this);
+    addSlowCase(gen.slowPathJump());
+    m_inByVals.append(gen);
+
+    emitStore(dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_in_by_val(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCases(iter);
+
+    auto bytecode = currentInstruction->as<OpInByVal>();
+    VirtualRegister dst = bytecode.m_dst;
+    auto& metadata = bytecode.metadata(m_codeBlock);
+    ArrayProfile* profile = &metadata.m_arrayProfile;
+
+    JITInByValGenerator& gen = m_inByVals[m_inByValIndex++];
+
+    Label coldPathBegin = label();
+
+    Call call = callOperation(operationInByValOptimize, dst, TrustedImmPtr(m_codeBlock->globalObject()), gen.stubInfo(), profile, JSValueRegs(regT1, regT0), JSValueRegs(regT3, regT2));
 
     gen.reportSlowPathCall(coldPathBegin, call);

trunk/Source/JavaScriptCore/jit/Repatch.cpp

@@ -898 +898 @@
 }
 
-static InlineCacheAction tryCacheInByID(
+static InlineCacheAction tryCacheInBy(
     JSGlobalObject* globalObject, CodeBlock* codeBlock, JSObject* base, CacheableIdentifier propertyName,
     bool wasFound, const PropertySlot& slot, StructureStubInfo& stubInfo)
@@ -1003 +1003 @@
 }
 
-void repatchInByID(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSObject* baseObject, CacheableIdentifier propertyName, bool wasFound, const PropertySlot& slot, StructureStubInfo& stubInfo)
+void repatchInBy(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSObject* baseObject, CacheableIdentifier propertyName, bool wasFound, const PropertySlot& slot, StructureStubInfo& stubInfo, InByKind kind)
 {
     SuperSamplerScope superSamplerScope(false);
-
-    if (tryCacheInByID(globalObject, codeBlock, baseObject, propertyName, wasFound, slot, stubInfo) == GiveUpOnCache)
-        ftlThunkAwareRepatchCall(codeBlock, stubInfo.slowPathCallLocation, operationInById);
+    VM& vm = globalObject->vm();
+
+    if (tryCacheInBy(globalObject, codeBlock, baseObject, propertyName, wasFound, slot, stubInfo) == GiveUpOnCache) {
+        LOG_IC((ICEvent::InReplaceWithGeneric, baseObject->classInfo(globalObject->vm()), Identifier::fromUid(vm, propertyName.uid())));
+        if (kind == InByKind::Normal)
+            ftlThunkAwareRepatchCall(codeBlock, stubInfo.slowPathCallLocation, operationInByIdGeneric);
+        else
+            ftlThunkAwareRepatchCall(codeBlock, stubInfo.slowPathCallLocation, operationInByValGeneric);
+    }
 }
 
@@ -1684 +1690 @@
 }
 
-void resetInByID(CodeBlock* codeBlock, StructureStubInfo& stubInfo)
-{
-    ftlThunkAwareRepatchCall(codeBlock, stubInfo.slowPathCallLocation, operationInByIdOptimize);
+void resetInBy(CodeBlock* codeBlock, StructureStubInfo& stubInfo, InByKind kind)
+{
+    if (kind == InByKind::Normal)
+        ftlThunkAwareRepatchCall(codeBlock, stubInfo.slowPathCallLocation, operationInByIdOptimize);
+    else
+        ftlThunkAwareRepatchCall(codeBlock, stubInfo.slowPathCallLocation, operationInByValOptimize);
     InlineAccess::rewireStubAsJump(stubInfo, stubInfo.slowPathStartLocation);
 }

trunk/Source/JavaScriptCore/jit/Repatch.h

@@ -49 +49 @@
 };
 
+enum class InByKind {
+    Normal,
+    NormalByVal
+};
+
 void repatchArrayGetByVal(JSGlobalObject*, CodeBlock*, JSValue base, JSValue index, StructureStubInfo&);
 void repatchGetBy(JSGlobalObject*, CodeBlock*, JSValue, CacheableIdentifier, const PropertySlot&, StructureStubInfo&, GetByKind);
 void repatchPutByID(JSGlobalObject*, CodeBlock*, JSValue, Structure*, CacheableIdentifier, const PutPropertySlot&, StructureStubInfo&, PutKind);
 void repatchDeleteBy(JSGlobalObject*, CodeBlock*, DeletePropertySlot&, JSValue, Structure*, CacheableIdentifier, StructureStubInfo&, DelByKind, ECMAMode);
-void repatchInByID(JSGlobalObject*, CodeBlock*, JSObject*, CacheableIdentifier, bool wasFound, const PropertySlot&, StructureStubInfo&);
+void repatchInBy(JSGlobalObject*, CodeBlock*, JSObject*, CacheableIdentifier, bool wasFound, const PropertySlot&, StructureStubInfo&, InByKind);
 void repatchCheckPrivateBrand(JSGlobalObject*, CodeBlock*, JSObject*, CacheableIdentifier, StructureStubInfo&);
 void repatchSetPrivateBrand(JSGlobalObject*, CodeBlock*, JSObject*, Structure*, CacheableIdentifier, StructureStubInfo&);
@@ -65 +70 @@
 void resetPutByID(CodeBlock*, StructureStubInfo&);
 void resetDelBy(CodeBlock*, StructureStubInfo&, DelByKind);
-void resetInByID(CodeBlock*, StructureStubInfo&);
+void resetInBy(CodeBlock*, StructureStubInfo&, InByKind);
 void resetInstanceOf(StructureStubInfo&);
 void resetCheckPrivateBrand(CodeBlock*, StructureStubInfo&);

trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

@@ -1425 +1425 @@
 }
 
+LLINT_SLOW_PATH_DECL(slow_path_in_by_val)
+{
+    LLINT_BEGIN();
+    auto bytecode = pc->as<OpInByVal>();
+    auto& metadata = bytecode.metadata(codeBlock);
+    LLINT_RETURN(jsBoolean(CommonSlowPaths::opInByVal(globalObject, getOperand(callFrame, bytecode.m_base), getOperand(callFrame, bytecode.m_property), &metadata.m_arrayProfile)));
+}
+
 LLINT_SLOW_PATH_DECL(slow_path_put_getter_by_id)
 {

trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h

@@ -73 +73 @@
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_by_id);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_in_by_id);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_in_by_val);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_del_by_id);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_by_val);

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

@@ -2011 +2011 @@
 end
 
-slowPathOp(in_by_val)
 slowPathOp(has_private_name)
 slowPathOp(has_private_brand)
@@ -2045 +2044 @@
 
 llintSlowPathOp(in_by_id)
+llintSlowPathOp(in_by_val)
 llintSlowPathOp(del_by_id)
 llintSlowPathOp(del_by_val)

trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

@@ -831 +831 @@
 }
 
-JSC_DEFINE_COMMON_SLOW_PATH(slow_path_in_by_val)
-{
-    BEGIN();
-    auto bytecode = pc->as<OpInByVal>();
-    auto& metadata = bytecode.metadata(codeBlock);
-    RETURN(jsBoolean(CommonSlowPaths::opInByVal(globalObject, GET_C(bytecode.m_base).jsValue(), GET_C(bytecode.m_property).jsValue(), &metadata.m_arrayProfile)));
-}
-
 JSC_DEFINE_COMMON_SLOW_PATH(slow_path_has_private_name)
 {

trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h

@@ -252 +252 @@
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_is_callable);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_is_constructor);
-JSC_DECLARE_COMMON_SLOW_PATH(slow_path_in_by_val);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_has_private_name);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_has_private_brand);