Changeset 205507 in webkit


Ignore:
Timestamp:
Sep 6, 2016 2:35:24 PM (8 years ago)
Author:
Ryan Haddad
Message:

Unreviewed, rolling out r205504.
https://bugs.webkit.org/show_bug.cgi?id=161645

Broke the iOS device build (Requested by ryanhaddad on
#webkit).

Reverted changeset:

"Make JSMap and JSSet faster"
https://bugs.webkit.org/show_bug.cgi?id=160989
http://trac.webkit.org/changeset/205504

Patch by Commit Queue <commit-queue@webkit.org> on 2016-09-06

Location:
trunk
Files:
15 deleted
64 edited

Legend:

Unmodified
Added
Removed
  • trunk/JSTests/ChangeLog

    r205504 r205507  
     12016-09-06  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r205504.
     4        https://bugs.webkit.org/show_bug.cgi?id=161645
     5
     6        Broke the iOS device build (Requested by ryanhaddad on
     7        #webkit).
     8
     9        Reverted changeset:
     10
     11        "Make JSMap and JSSet faster"
     12        https://bugs.webkit.org/show_bug.cgi?id=160989
     13        http://trac.webkit.org/changeset/205504
     14
    1152016-09-06  Saam Barati  <sbarati@apple.com>
    216
  • trunk/Source/JavaScriptCore/CMakeLists.txt

    r205504 r205507  
    673673    runtime/GeneratorPrototype.cpp
    674674    runtime/GetterSetter.cpp
    675     runtime/HashMapImpl.cpp
    676675    runtime/Identifier.cpp
    677676    runtime/IndexingType.cpp
     
    759758    runtime/LiteralParser.cpp
    760759    runtime/Lookup.cpp
    761     runtime/MapBase.cpp
    762760    runtime/MapConstructor.cpp
    763761    runtime/MapIteratorPrototype.cpp
  • trunk/Source/JavaScriptCore/ChangeLog

    r205504 r205507  
     12016-09-06  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r205504.
     4        https://bugs.webkit.org/show_bug.cgi?id=161645
     5
     6        Broke the iOS device build (Requested by ryanhaddad on
     7        #webkit).
     8
     9        Reverted changeset:
     10
     11        "Make JSMap and JSSet faster"
     12        https://bugs.webkit.org/show_bug.cgi?id=160989
     13        http://trac.webkit.org/changeset/205504
     14
    1152016-09-06  Saam Barati  <sbarati@apple.com>
    216
  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r205504 r205507  
    13191319                792CB3491C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 792CB3471C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp */; };
    13201320                792CB34A1C4EED5C00D13AF3 /* PCToCodeOriginMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 792CB3481C4EED5C00D13AF3 /* PCToCodeOriginMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
    1321                 795B19971D78BE3500262FA0 /* MapBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 795B19951D78BE3500262FA0 /* MapBase.cpp */; };
    1322                 795B19981D78BE3500262FA0 /* MapBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 795B19961D78BE3500262FA0 /* MapBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
    13231321                7964656A1B952FF0003059EE /* GetPutInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 796465681B952FF0003059EE /* GetPutInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
    13241322                797E07A91B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 797E07A71B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp */; };
    13251323                797E07AA1B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = 797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; };
    13261324                799EF7C41C56ED96002B0534 /* B3PCToOriginMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 799EF7C31C56ED96002B0534 /* B3PCToOriginMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
    1327                 79A0907F1D768465008B889B /* HashMapImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79A0907D1D768465008B889B /* HashMapImpl.cpp */; };
    1328                 79A090801D768465008B889B /* HashMapImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 79A0907E1D768465008B889B /* HashMapImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
    13291325                79A228351D35D71E00D8E067 /* ArithProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79A228331D35D71E00D8E067 /* ArithProfile.cpp */; };
    13301326                79A228361D35D71F00D8E067 /* ArithProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 79A228341D35D71E00D8E067 /* ArithProfile.h */; };
     
    35743570                792CB3471C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PCToCodeOriginMap.cpp; sourceTree = "<group>"; };
    35753571                792CB3481C4EED5C00D13AF3 /* PCToCodeOriginMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PCToCodeOriginMap.h; sourceTree = "<group>"; };
    3576                 795B19951D78BE3500262FA0 /* MapBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MapBase.cpp; sourceTree = "<group>"; };
    3577                 795B19961D78BE3500262FA0 /* MapBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapBase.h; sourceTree = "<group>"; };
    35783572                796465681B952FF0003059EE /* GetPutInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetPutInfo.h; sourceTree = "<group>"; };
    35793573                797E07A71B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalLexicalEnvironment.cpp; sourceTree = "<group>"; };
    35803574                797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalLexicalEnvironment.h; sourceTree = "<group>"; };
    35813575                799EF7C31C56ED96002B0534 /* B3PCToOriginMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3PCToOriginMap.h; path = b3/B3PCToOriginMap.h; sourceTree = "<group>"; };
    3582                 79A0907D1D768465008B889B /* HashMapImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HashMapImpl.cpp; sourceTree = "<group>"; };
    3583                 79A0907E1D768465008B889B /* HashMapImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashMapImpl.h; sourceTree = "<group>"; };
    35843576                79A228331D35D71E00D8E067 /* ArithProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArithProfile.cpp; sourceTree = "<group>"; };
    35853577                79A228341D35D71E00D8E067 /* ArithProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArithProfile.h; sourceTree = "<group>"; };
     
    58345826                                BC02E9B80E184545000F9297 /* GetterSetter.cpp */,
    58355827                                BC337BDE0E1AF0B80076918A /* GetterSetter.h */,
    5836                                 79A0907D1D768465008B889B /* HashMapImpl.cpp */,
    5837                                 79A0907E1D768465008B889B /* HashMapImpl.h */,
    58385828                                933A349D038AE80F008635CE /* Identifier.cpp */,
    58395829                                933A349A038AE7C6008635CE /* Identifier.h */,
     
    60466036                                F692A8680255597D01FF60F7 /* Lookup.cpp */,
    60476037                                F692A8690255597D01FF60F7 /* Lookup.h */,
    6048                                 795B19951D78BE3500262FA0 /* MapBase.cpp */,
    6049                                 795B19961D78BE3500262FA0 /* MapBase.h */,
    60506038                                A700873717CBE85300C3E643 /* MapConstructor.cpp */,
    60516039                                A700873817CBE85300C3E643 /* MapConstructor.h */,
     
    73397327                                1429D8DE0ED2205B00B89619 /* CallFrame.h in Headers */,
    73407328                                62EC9BB71B7EB07C00303AD1 /* CallFrameShuffleData.h in Headers */,
    7341                                 795B19981D78BE3500262FA0 /* MapBase.h in Headers */,
    73427329                                62D755D71B84FB4A001801FA /* CallFrameShuffler.h in Headers */,
    73437330                                0F0B83B114BCF71800885B4F /* CallLinkInfo.h in Headers */,
     
    75077494                                A7D89CF817A0B8CC00773AD8 /* DFGFlushFormat.h in Headers */,
    75087495                                0F2DD8151AB3D8BE00BBB8E8 /* DFGForAllKills.h in Headers */,
    7509                                 79A090801D768465008B889B /* HashMapImpl.h in Headers */,
    75107496                                0F69CC89193AC60A0045759E /* DFGFrozenValue.h in Headers */,
    75117497                                86EC9DC61328DF82002B2AD7 /* DFGGenerationInfo.h in Headers */,
     
    92409226                                0FB105851675480F00F8AB6E /* ExitKind.cpp in Sources */,
    92419227                                0FEA0A1C1708B00700BB722C /* FTLAbstractHeap.cpp in Sources */,
    9242                                 79A0907F1D768465008B889B /* HashMapImpl.cpp in Sources */,
    92439228                                0FEA0A1E1708B00700BB722C /* FTLAbstractHeapRepository.cpp in Sources */,
    92449229                                0F93274D1C1F66AA00CF6564 /* GPRInfo.cpp in Sources */,
     
    92859270                                FE4BFF2B1AD476E700088F87 /* FunctionOverrides.cpp in Sources */,
    92869271                                147F39CC107EC37600427A48 /* FunctionPrototype.cpp in Sources */,
    9287                                 795B19971D78BE3500262FA0 /* MapBase.cpp in Sources */,
    92889272                                62D2D38F1ADF103F000206C1 /* FunctionRareData.cpp in Sources */,
    92899273                                2AACE63C18CA5A0300ED0191 /* GCActivityCallback.cpp in Sources */,
  • trunk/Source/JavaScriptCore/bytecode/SpeculatedType.cpp

    r205504 r205507  
    3131
    3232#include "DirectArguments.h"
    33 #include "JSCInlines.h"
    3433#include "JSArray.h"
    3534#include "JSFunction.h"
    36 #include "JSMap.h"
    37 #include "JSSet.h"
     35#include "JSCInlines.h"
    3836#include "ScopedArguments.h"
    3937#include "StringObject.h"
     
    349347    if (classInfo == RegExpObject::info())
    350348        return SpecRegExpObject;
    351 
    352     if (classInfo == JSMap::info())
    353         return SpecMapObject;
    354 
    355     if (classInfo == JSSet::info())
    356         return SpecSetObject;
    357349   
    358350    if (classInfo->isSubClassOf(JSFunction::info()))
  • trunk/Source/JavaScriptCore/bytecode/SpeculatedType.h

    r205504 r205507  
    4040typedef uint64_t SpeculatedType;
    4141static const SpeculatedType SpecNone               = 0; // We don't know anything yet.
    42 static const SpeculatedType SpecFinalObject        = 1ull << 0; // It's definitely a JSFinalObject.
    43 static const SpeculatedType SpecArray              = 1ull << 1; // It's definitely a JSArray.
    44 static const SpeculatedType SpecFunction           = 1ull << 2; // It's definitely a JSFunction.
    45 static const SpeculatedType SpecInt8Array          = 1ull << 3; // It's definitely an Int8Array or one of its subclasses.
    46 static const SpeculatedType SpecInt16Array         = 1ull << 4; // It's definitely an Int16Array or one of its subclasses.
    47 static const SpeculatedType SpecInt32Array         = 1ull << 5; // It's definitely an Int32Array or one of its subclasses.
    48 static const SpeculatedType SpecUint8Array         = 1ull << 6; // It's definitely an Uint8Array or one of its subclasses.
    49 static const SpeculatedType SpecUint8ClampedArray  = 1ull << 7; // It's definitely an Uint8ClampedArray or one of its subclasses.
    50 static const SpeculatedType SpecUint16Array        = 1ull << 8; // It's definitely an Uint16Array or one of its subclasses.
    51 static const SpeculatedType SpecUint32Array        = 1ull << 9; // It's definitely an Uint32Array or one of its subclasses.
    52 static const SpeculatedType SpecFloat32Array       = 1ull << 10; // It's definitely an Uint16Array or one of its subclasses.
    53 static const SpeculatedType SpecFloat64Array       = 1ull << 11; // It's definitely an Uint16Array or one of its subclasses.
     42static const SpeculatedType SpecFinalObject        = 1u << 0; // It's definitely a JSFinalObject.
     43static const SpeculatedType SpecArray              = 1u << 1; // It's definitely a JSArray.
     44static const SpeculatedType SpecFunction           = 1u << 2; // It's definitely a JSFunction.
     45static const SpeculatedType SpecInt8Array          = 1u << 3; // It's definitely an Int8Array or one of its subclasses.
     46static const SpeculatedType SpecInt16Array         = 1u << 4; // It's definitely an Int16Array or one of its subclasses.
     47static const SpeculatedType SpecInt32Array         = 1u << 5; // It's definitely an Int32Array or one of its subclasses.
     48static const SpeculatedType SpecUint8Array         = 1u << 6; // It's definitely an Uint8Array or one of its subclasses.
     49static const SpeculatedType SpecUint8ClampedArray  = 1u << 7; // It's definitely an Uint8ClampedArray or one of its subclasses.
     50static const SpeculatedType SpecUint16Array        = 1u << 8; // It's definitely an Uint16Array or one of its subclasses.
     51static const SpeculatedType SpecUint32Array        = 1u << 9; // It's definitely an Uint32Array or one of its subclasses.
     52static const SpeculatedType SpecFloat32Array       = 1u << 10; // It's definitely an Uint16Array or one of its subclasses.
     53static const SpeculatedType SpecFloat64Array       = 1u << 11; // It's definitely an Uint16Array or one of its subclasses.
    5454static const SpeculatedType SpecTypedArrayView     = SpecInt8Array | SpecInt16Array | SpecInt32Array | SpecUint8Array | SpecUint8ClampedArray | SpecUint16Array | SpecUint32Array | SpecFloat32Array | SpecFloat64Array;
    55 static const SpeculatedType SpecDirectArguments    = 1ull << 12; // It's definitely a DirectArguments object.
    56 static const SpeculatedType SpecScopedArguments    = 1ull << 13; // It's definitely a ScopedArguments object.
    57 static const SpeculatedType SpecStringObject       = 1ull << 14; // It's definitely a StringObject.
    58 static const SpeculatedType SpecRegExpObject       = 1ull << 15; // It's definitely a RegExpObject (and not any subclass of RegExpObject).
    59 static const SpeculatedType SpecMapObject          = 1ull << 16; // It's definitely Map object (can it be a subclass? FIXME).
    60 static const SpeculatedType SpecSetObject          = 1ull << 17; // It's definitely s Set object (can it be a subclass? FIXME).
    61 static const SpeculatedType SpecObjectOther        = 1ull << 18; // It's definitely an object but not JSFinalObject, JSArray, or JSFunction.
    62 static const SpeculatedType SpecObject             = SpecFinalObject | SpecArray | SpecFunction | SpecTypedArrayView | SpecDirectArguments | SpecScopedArguments | SpecStringObject | SpecRegExpObject | SpecMapObject | SpecSetObject | SpecObjectOther; // Bitmask used for testing for any kind of object prediction.
    63 static const SpeculatedType SpecStringIdent        = 1ull << 19; // It's definitely a JSString, and it's an identifier.
    64 static const SpeculatedType SpecStringVar          = 1ull << 20; // It's definitely a JSString, and it's not an identifier.
     55static const SpeculatedType SpecDirectArguments    = 1u << 12; // It's definitely a DirectArguments object.
     56static const SpeculatedType SpecScopedArguments    = 1u << 13; // It's definitely a ScopedArguments object.
     57static const SpeculatedType SpecStringObject       = 1u << 14; // It's definitely a StringObject.
     58static const SpeculatedType SpecRegExpObject       = 1u << 15; // It's definitely a RegExpObject (and not any subclass of RegExpObject).
     59static const SpeculatedType SpecObjectOther        = 1u << 16; // It's definitely an object but not JSFinalObject, JSArray, or JSFunction.
     60static const SpeculatedType SpecObject             = SpecFinalObject | SpecArray | SpecFunction | SpecTypedArrayView | SpecDirectArguments | SpecScopedArguments | SpecStringObject | SpecRegExpObject | SpecObjectOther; // Bitmask used for testing for any kind of object prediction.
     61static const SpeculatedType SpecStringIdent        = 1u << 17; // It's definitely a JSString, and it's an identifier.
     62static const SpeculatedType SpecStringVar          = 1u << 18; // It's definitely a JSString, and it's not an identifier.
    6563static const SpeculatedType SpecString             = SpecStringIdent | SpecStringVar; // It's definitely a JSString.
    66 static const SpeculatedType SpecSymbol             = 1ull << 21; // It's definitely a Symbol.
    67 static const SpeculatedType SpecCellOther          = 1ull << 22; // It's definitely a JSCell but not a subclass of JSObject and definitely not a JSString or a Symbol. FIXME: This shouldn't be part of heap-top or bytecode-top. https://bugs.webkit.org/show_bug.cgi?id=133078
     64static const SpeculatedType SpecSymbol             = 1u << 19; // It's definitely a Symbol.
     65static const SpeculatedType SpecCellOther          = 1u << 20; // It's definitely a JSCell but not a subclass of JSObject and definitely not a JSString or a Symbol. FIXME: This shouldn't be part of heap-top or bytecode-top. https://bugs.webkit.org/show_bug.cgi?id=133078
    6866static const SpeculatedType SpecCell               = SpecObject | SpecString | SpecSymbol | SpecCellOther; // It's definitely a JSCell.
    69 static const SpeculatedType SpecBoolInt32          = 1ull << 23; // It's definitely an Int32 with value 0 or 1.
    70 static const SpeculatedType SpecNonBoolInt32       = 1ull << 24; // It's definitely an Int32 with value other than 0 or 1.
     67static const SpeculatedType SpecBoolInt32          = 1u << 21; // It's definitely an Int32 with value 0 or 1.
     68static const SpeculatedType SpecNonBoolInt32       = 1u << 22; // It's definitely an Int32 with value other than 0 or 1.
    7169static const SpeculatedType SpecInt32Only          = SpecBoolInt32 | SpecNonBoolInt32; // It's definitely an Int32.
    72 static const SpeculatedType SpecInt52Only          = 1ull << 25; // It's definitely an Int52 and we intend it to unbox it. It's also definitely not an Int32.
     70static const SpeculatedType SpecInt52Only          = 1u << 23; // It's definitely an Int52 and we intend it to unbox it. It's also definitely not an Int32.
    7371static const SpeculatedType SpecAnyInt             = SpecInt32Only | SpecInt52Only; // It's something that we can do machine int arithmetic on.
    74 static const SpeculatedType SpecAnyIntAsDouble     = 1ull << 26; // It's definitely an Int52 and it's inside a double.
    75 static const SpeculatedType SpecNonIntAsDouble     = 1ull << 27; // It's definitely not an Int52 but it's a real number and it's a double.
     72static const SpeculatedType SpecAnyIntAsDouble     = 1u << 24; // It's definitely an Int52 and it's inside a double.
     73static const SpeculatedType SpecNonIntAsDouble     = 1u << 25; // It's definitely not an Int52 but it's a real number and it's a double.
    7674static const SpeculatedType SpecDoubleReal         = SpecNonIntAsDouble | SpecAnyIntAsDouble; // It's definitely a non-NaN double.
    77 static const SpeculatedType SpecDoublePureNaN      = 1ull << 28; // It's definitely a NaN that is sae to tag (i.e. pure).
    78 static const SpeculatedType SpecDoubleImpureNaN    = 1ull << 29; // It's definitely a NaN that is unsafe to tag (i.e. impure).
     75static const SpeculatedType SpecDoublePureNaN      = 1u << 26; // It's definitely a NaN that is sae to tag (i.e. pure).
     76static const SpeculatedType SpecDoubleImpureNaN    = 1u << 27; // It's definitely a NaN that is unsafe to tag (i.e. impure).
    7977static const SpeculatedType SpecDoubleNaN          = SpecDoublePureNaN | SpecDoubleImpureNaN; // It's definitely some kind of NaN.
    8078static const SpeculatedType SpecBytecodeDouble     = SpecDoubleReal | SpecDoublePureNaN; // It's either a non-NaN or a NaN double, but it's definitely not impure NaN.
     
    8482static const SpeculatedType SpecBytecodeNumber     = SpecInt32Only | SpecBytecodeDouble; // It's either an Int32 or a Double, and the Double cannot be an impure NaN.
    8583static const SpeculatedType SpecFullNumber         = SpecAnyInt | SpecFullDouble; // It's either an Int32, Int52, or a Double, and the Double can be impure NaN.
    86 static const SpeculatedType SpecBoolean            = 1ull << 30; // It's definitely a Boolean.
    87 static const SpeculatedType SpecOther              = 1ull << 31; // It's definitely either Null or Undefined.
     84static const SpeculatedType SpecBoolean            = 1u << 28; // It's definitely a Boolean.
     85static const SpeculatedType SpecOther              = 1u << 29; // It's definitely either Null or Undefined.
    8886static const SpeculatedType SpecMisc               = SpecBoolean | SpecOther; // It's definitely either a boolean, Null, or Undefined.
    8987static const SpeculatedType SpecHeapTop            = SpecCell | SpecBytecodeNumber | SpecMisc; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN.
    9088static const SpeculatedType SpecPrimitive          = SpecString | SpecSymbol | SpecBytecodeNumber | SpecMisc; // It's any non-Object JSValue.
    91 static const SpeculatedType SpecEmpty              = 1ull << 32; // It's definitely an empty value marker.
     89static const SpeculatedType SpecEmpty              = 1u << 30; // It's definitely an empty value marker.
    9290static const SpeculatedType SpecBytecodeTop        = SpecHeapTop | SpecEmpty; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN. Corresponds to what could be found in a bytecode local.
    9391static const SpeculatedType SpecFullTop            = SpecBytecodeTop | SpecFullNumber; // It can be anything that bytecode could see plus exotic encodings of numbers.
  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r205504 r205507  
    977977        break;
    978978    }
    979 
    980     case MapHash:
    981         forNode(node).setType(SpecInt32Only);
    982         break;
    983 
    984     case LoadFromJSMapBucket:
    985         forNode(node).makeHeapTop();
    986         break;
    987 
    988     case GetMapBucket:
    989         forNode(node).setType(m_graph, SpecCellOther);
    990         break;
    991 
    992     case IsNonEmptyMapBucket:
    993         forNode(node).setType(SpecBoolean);
    994         break;
    995979
    996980    case IsEmpty:
     
    29002884{
    29012885    Node* node = m_state.block()->at(indexInBlock);
    2902 
     2886   
    29032887    startExecuting();
    29042888    executeEdges(node);
  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r205504 r205507  
    25392539        return true;
    25402540    }
    2541 
    2542     case JSMapGetIntrinsic: {
    2543         if (argumentCountIncludingThis != 2)
    2544             return false;
    2545 
    2546         insertChecks();
    2547         Node* map = get(virtualRegisterForArgument(0, registerOffset));
    2548         Node* key = get(virtualRegisterForArgument(1, registerOffset));
    2549         Node* hash = addToGraph(MapHash, key);
    2550         Node* bucket = addToGraph(GetMapBucket, Edge(map, MapObjectUse), Edge(key), Edge(hash));
    2551         Node* result = addToGraph(LoadFromJSMapBucket, OpInfo(), OpInfo(prediction), bucket);
    2552         set(VirtualRegister(resultOperand), result);
    2553         return true;
    2554     }
    2555 
    2556     case JSSetHasIntrinsic:
    2557     case JSMapHasIntrinsic: {
    2558         if (argumentCountIncludingThis != 2)
    2559             return false;
    2560 
    2561         insertChecks();
    2562         Node* mapOrSet = get(virtualRegisterForArgument(0, registerOffset));
    2563         Node* key = get(virtualRegisterForArgument(1, registerOffset));
    2564         Node* hash = addToGraph(MapHash, key);
    2565         UseKind useKind = intrinsic == JSSetHasIntrinsic ? SetObjectUse : MapObjectUse;
    2566         Node* bucket = addToGraph(GetMapBucket, OpInfo(0), Edge(mapOrSet, useKind), Edge(key), Edge(hash));
    2567         Node* result = addToGraph(IsNonEmptyMapBucket, bucket);
    2568         set(VirtualRegister(resultOperand), result);
    2569         return true;
    2570     }
    2571 
     2541       
    25722542    default:
    25732543        return false;
  • trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

    r205504 r205507  
    12441244        write(SideState);
    12451245        return;
    1246 
    1247     case MapHash:
    1248         def(PureValue(node));
    1249         return;
    1250     case GetMapBucket: {
    1251         read(MiscFields);
    1252         Edge& mapEdge = node->child1();
    1253         Edge& keyEdge = node->child2();
    1254         def(HeapLocation(MapBucketLoc, MiscFields, mapEdge, keyEdge), LazyNode(node));
    1255         return;
    1256     }
    1257     case LoadFromJSMapBucket: {
    1258         read(MiscFields);
    1259         Edge& bucketEdge = node->child1();
    1260         def(HeapLocation(JSMapGetLoc, MiscFields, bucketEdge), LazyNode(node));
    1261         return;
    1262     }
    1263     case IsNonEmptyMapBucket:
    1264         read(MiscFields);
    1265         def(HeapLocation(MapHasLoc, MiscFields, node->child1()), LazyNode(node));
    1266         return;
    12671246       
    12681247    case LastNodeType:
  • trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

    r205504 r205507  
    186186    case CheckWatchdogTimer:
    187187    case StringFromCharCode:
    188     case MapHash:
    189     case GetMapBucket:
    190     case LoadFromJSMapBucket:
    191     case IsNonEmptyMapBucket:
    192188    case Unreachable:
    193189    case ExtractOSREntryLocal:
  • trunk/Source/JavaScriptCore/dfg/DFGEdge.h

    r205504 r205507  
    190190   
    191191#if USE(JSVALUE64)
    192     static constexpr uint32_t shift() { return 8; }
     192    static uint32_t shift() { return 7; }
    193193   
    194194    static uintptr_t makeWord(Node* node, UseKind useKind, ProofStatus proofStatus, KillStatus killStatus)
     
    198198        ASSERT((shiftedValue >> shift()) == bitwise_cast<uintptr_t>(node));
    199199        ASSERT(useKind >= 0 && useKind < LastUseKind);
    200         static_assert((static_cast<uintptr_t>(LastUseKind) << 2) < (static_cast<uintptr_t>(1) << shift()), "We rely on this being true to not clobber the node pointer.");
    201         uintptr_t result = shiftedValue | (static_cast<uintptr_t>(useKind) << 2) | (DFG::doesKill(killStatus) << 1) | static_cast<uintptr_t>(DFG::isProved(proofStatus));
    202         if (!ASSERT_DISABLED) {
    203             union U {
    204                 U() { word = 0; }
    205                 uintptr_t word;
    206                 Edge edge;
    207             } u;
    208             u.word = result;
    209             ASSERT(u.edge.useKindUnchecked() == useKind);
    210             ASSERT(u.edge.node() == node);
    211             ASSERT(u.edge.proofStatusUnchecked() == proofStatus);
    212             ASSERT(u.edge.killStatusUnchecked() == killStatus);
    213         }
    214         return result;
     200        ASSERT((static_cast<uintptr_t>(LastUseKind) << 2) <= (static_cast<uintptr_t>(2) << shift()));
     201        return shiftedValue | (static_cast<uintptr_t>(useKind) << 2) | (DFG::doesKill(killStatus) << 1) | static_cast<uintptr_t>(DFG::isProved(proofStatus));
    215202    }
    216203   
  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r205504 r205507  
    15451545            break;
    15461546        }
    1547 
    1548         case GetMapBucket:
    1549             if (node->child1().useKind() == MapObjectUse)
    1550                 fixEdge<MapObjectUse>(node->child1());
    1551             else if (node->child1().useKind() == SetObjectUse)
    1552                 fixEdge<SetObjectUse>(node->child1());
    1553             else
    1554                 RELEASE_ASSERT_NOT_REACHED();
    1555             fixEdge<UntypedUse>(node->child2());
    1556             fixEdge<Int32Use>(node->child3());
    1557             break;
    1558 
    1559         case LoadFromJSMapBucket:
    1560             fixEdge<KnownCellUse>(node->child1());
    1561             break;
    1562 
    1563         case IsNonEmptyMapBucket:
    1564             fixEdge<KnownCellUse>(node->child1());
    1565             break;
    1566 
    1567         case MapHash:
    1568             fixEdge<UntypedUse>(node->child1());
    1569             break;
    15701547
    15711548#if !ASSERT_DISABLED
  • trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp

    r205504 r205507  
    144144        out.print("RegExpObjectLastIndexLoc");
    145145        return;
    146     case MapBucketLoc:
    147         out.print("MapBucketLoc");
    148         return;
    149     case JSMapGetLoc:
    150         out.print("JSMapGetLoc");
    151         return;
    152     case MapHasLoc:
    153         out.print("MapHasLoc");
    154         return;
    155146    }
    156147   
  • trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.h

    r205504 r205507  
    5959    TypedArrayByteOffsetLoc,
    6060    StackLoc,
    61     StackPayloadLoc,
    62     MapBucketLoc,
    63     JSMapGetLoc,
    64     MapHasLoc
     61    StackPayloadLoc
    6562};
    6663
  • trunk/Source/JavaScriptCore/dfg/DFGNode.h

    r205504 r205507  
    14221422        case StringReplaceRegExp:
    14231423        case ToNumber:
    1424         case LoadFromJSMapBucket:
    14251424            return true;
    14261425        default:
  • trunk/Source/JavaScriptCore/dfg/DFGNodeType.h

    r205504 r205507  
    389389    macro(GetEnumeratorStructurePname, NodeMustGenerate | NodeResultJS) \
    390390    macro(GetEnumeratorGenericPname, NodeMustGenerate | NodeResultJS) \
    391     macro(ToIndexString, NodeResultJS) \
    392     /* Nodes for JSMap and JSSet */ \
    393     macro(MapHash, NodeResultInt32) \
    394     macro(GetMapBucket, NodeResultJS) \
    395     macro(LoadFromJSMapBucket, NodeResultJS) \
    396     macro(IsNonEmptyMapBucket, NodeResultBoolean) \
     391    macro(ToIndexString, NodeResultJS)
    397392
    398393// This enum generates a monotonically increasing id for all Node types,
  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r205504 r205507  
    5151#include "JSGenericTypedArrayViewConstructorInlines.h"
    5252#include "JSLexicalEnvironment.h"
    53 #include "JSMap.h"
    54 #include "JSSet.h"
    5553#include "ObjectConstructor.h"
    5654#include "Repatch.h"
     
    18181816}
    18191817
    1820 int32_t JIT_OPERATION operationMapHash(ExecState* exec, EncodedJSValue input)
    1821 {
    1822     VM& vm = exec->vm();
    1823     NativeCallFrameTracer tracer(&vm, exec);
    1824 
    1825     return jsMapHash(exec, vm, normalizeMapKey(JSValue::decode(input)));
    1826 }
    1827 
    1828 JSCell* JIT_OPERATION operationJSMapFindBucket(ExecState* exec, JSCell* map, EncodedJSValue key, int32_t hash)
    1829 {
    1830     VM& vm = exec->vm();
    1831     NativeCallFrameTracer tracer(&vm, exec);
    1832     JSMap::BucketType** bucket = jsCast<JSMap*>(map)->findBucket(exec, normalizeMapKey(JSValue::decode(key)), hash);
    1833     if (!bucket)
    1834         return nullptr;
    1835     return *bucket;
    1836 }
    1837 
    1838 JSCell* JIT_OPERATION operationJSSetFindBucket(ExecState* exec, JSCell* map, EncodedJSValue key, int32_t hash)
    1839 {
    1840     VM& vm = exec->vm();
    1841     NativeCallFrameTracer tracer(&vm, exec);
    1842     JSSet::BucketType** bucket = jsCast<JSSet*>(map)->findBucket(exec, normalizeMapKey(JSValue::decode(key)), hash);
    1843     if (!bucket)
    1844         return nullptr;
    1845     return *bucket;
    1846 }
    1847 
    18481818extern "C" void JIT_OPERATION triggerReoptimizationNow(CodeBlock* codeBlock, OSRExitBase* exit)
    18491819{
  • trunk/Source/JavaScriptCore/dfg/DFGOperations.h

    r205504 r205507  
    143143JSString* JIT_OPERATION operationSingleCharacterString(ExecState*, int32_t);
    144144
    145 int32_t JIT_OPERATION operationMapHash(ExecState*, EncodedJSValue input);
    146 JSCell* JIT_OPERATION operationJSMapFindBucket(ExecState*, JSCell*, EncodedJSValue, int32_t);
    147 JSCell* JIT_OPERATION operationJSSetFindBucket(ExecState*, JSCell*, EncodedJSValue, int32_t);
    148 
    149145JSCell* JIT_OPERATION operationNewStringObject(ExecState*, JSString*, Structure*);
    150146JSCell* JIT_OPERATION operationToStringOnCell(ExecState*, JSCell*);
  • trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r205504 r205507  
    709709        case GetClosureVar:
    710710        case GetFromArguments:
    711         case LoadFromJSMapBucket:
    712711        case ToNumber: {
    713712            setPrediction(m_currentNode->getHeapPrediction());
     
    739738            break;
    740739        }
    741 
    742         case MapHash:
    743             setPrediction(SpecInt32Only);
    744             break;
    745         case GetMapBucket:
    746             setPrediction(SpecCellOther);
    747             break;
    748         case IsNonEmptyMapBucket:
    749             setPrediction(SpecBoolean);
    750             break;
    751740
    752741        case GetRestLength: {
  • trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r205504 r205507  
    5959        case FinalObjectUse:
    6060        case RegExpObjectUse:
    61         case MapObjectUse:
    62         case SetObjectUse:
    6361        case ObjectOrOtherUse:
    6462        case StringIdentUse:
     
    358356    case PutDynamicVar:
    359357    case ResolveScope:
    360     case MapHash:
    361     case GetMapBucket:
    362     case LoadFromJSMapBucket:
    363     case IsNonEmptyMapBucket:
    364358        return true;
    365359
  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r205504 r205507  
    74087408}
    74097409
    7410 void SpeculativeJIT::speculateMapObject(Edge edge, GPRReg cell)
    7411 {
    7412     speculateCellType(edge, cell, SpecMapObject, JSMapType);
    7413 }
    7414 
    7415 void SpeculativeJIT::speculateMapObject(Edge edge)
    7416 {
    7417     if (!needsTypeCheck(edge, SpecMapObject))
    7418         return;
    7419 
    7420     SpeculateCellOperand operand(this, edge);
    7421     speculateMapObject(edge, operand.gpr());
    7422 }
    7423 
    7424 void SpeculativeJIT::speculateSetObject(Edge edge, GPRReg cell)
    7425 {
    7426     speculateCellType(edge, cell, SpecSetObject, JSSetType);
    7427 }
    7428 
    7429 void SpeculativeJIT::speculateSetObject(Edge edge)
    7430 {
    7431     if (!needsTypeCheck(edge, SpecSetObject))
    7432         return;
    7433 
    7434     SpeculateCellOperand operand(this, edge);
    7435     speculateSetObject(edge, operand.gpr());
    7436 }
    7437 
    74387410void SpeculativeJIT::speculateObjectOrOther(Edge edge)
    74397411{
     
    77227694    case RegExpObjectUse:
    77237695        speculateRegExpObject(edge);
    7724         break;
    7725     case MapObjectUse:
    7726         speculateMapObject(edge);
    7727         break;
    7728     case SetObjectUse:
    7729         speculateSetObject(edge);
    77307696        break;
    77317697    case ObjectOrOtherUse:
  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r205504 r205507  
    13121312#if USE(JSVALUE64)
    13131313
    1314     JITCompiler::Call callOperation(C_JITOperation_ECJZ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
    1315     {
    1316         m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
    1317         return appendCallSetResult(operation, result);
    1318     }
    1319 
    13201314    JITCompiler::Call callOperation(J_JITOperation_EJJMic operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2, TrustedImmPtr mathIC)
    13211315    {
     
    16981692    }
    16991693
    1700     JITCompiler::Call callOperation(Z_JITOperation_EJ operation, GPRReg result, GPRReg arg1)
    1701     {
    1702         m_jit.setupArgumentsWithExecState(arg1);
    1703         return appendCallSetResult(operation, result);
    1704     }
    1705 
    17061694    JITCompiler::Call callOperation(Z_JITOperation_EJZZ operation, GPRReg result, GPRReg arg1, unsigned arg2, unsigned arg3)
    17071695    {
     
    17511739    }
    17521740#else // USE(JSVALUE32_64)
    1753 
    1754     JITCompiler::Call callOperation(C_JITOperation_ECJZ operation, GPRReg result, GPRReg arg1, JSValueRegs arg2, GPRReg arg3)
    1755     {
    1756         m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR(), arg3);
    1757         return appendCallSetResult(operation, result);
    1758     }
    1759 
    1760     JITCompiler::Call callOperation(Z_JITOperation_EJ operation, GPRReg result, JSValueRegs arg1)
    1761     {
    1762         m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR());
    1763         return appendCallSetResult(operation, result);
    1764     }
    17651741
    17661742    JITCompiler::Call callOperation(J_JITOperation_EJJMic operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2, TrustedImmPtr mathIC)
     
    26792655    void speculateRegExpObject(Edge, GPRReg cell);
    26802656    void speculateRegExpObject(Edge);
    2681     void speculateMapObject(Edge);
    2682     void speculateMapObject(Edge, GPRReg cell);
    2683     void speculateSetObject(Edge);
    2684     void speculateSetObject(Edge, GPRReg cell);
    26852657    void speculateObjectOrOther(Edge);
    26862658    void speculateString(Edge edge, GPRReg cell);
  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r205504 r205507  
    3838#include "DirectArguments.h"
    3939#include "GetterSetter.h"
    40 #include "HashMapImpl.h"
    4140#include "JSEnvironmentRecord.h"
    4241#include "JSLexicalEnvironment.h"
     
    47214720    }
    47224721
    4723     case MapHash: {
    4724         JSValueOperand input(this, node->child1());
    4725 
    4726         JSValueRegs inputRegs = input.jsValueRegs();
    4727 
    4728         GPRFlushedCallResult result(this);
    4729         GPRReg resultGPR = result.gpr();
    4730 
    4731         flushRegisters();
    4732         callOperation(operationMapHash, resultGPR, inputRegs);
    4733         m_jit.exceptionCheck();
    4734         int32Result(resultGPR, node);
    4735         break;
    4736     }
    4737 
    4738     case GetMapBucket: {
    4739         SpeculateCellOperand map(this, node->child1());
    4740         JSValueOperand key(this, node->child2());
    4741         SpeculateInt32Operand hash(this, node->child3());
    4742         GPRFlushedCallResult result(this);
    4743 
    4744         GPRReg mapGPR = map.gpr();
    4745         JSValueRegs keyRegs = key.jsValueRegs();
    4746         GPRReg hashGPR = hash.gpr();
    4747         GPRReg resultGPR = result.gpr();
    4748 
    4749         if (node->child1().useKind() == MapObjectUse)
    4750             speculateMapObject(node->child1(), mapGPR);
    4751         else if (node->child1().useKind() == SetObjectUse)
    4752             speculateSetObject(node->child1(), mapGPR);
    4753         else
    4754             RELEASE_ASSERT_NOT_REACHED();
    4755 
    4756         flushRegisters();
    4757         if (node->child1().useKind() == MapObjectUse)
    4758             callOperation(operationJSMapFindBucket, resultGPR, mapGPR, keyRegs, hashGPR);
    4759         else
    4760             callOperation(operationJSSetFindBucket, resultGPR, mapGPR, keyRegs, hashGPR);
    4761         m_jit.exceptionCheck();
    4762         cellResult(resultGPR, node);
    4763         break;
    4764     }
    4765 
    4766     case LoadFromJSMapBucket: {
    4767         SpeculateCellOperand bucket(this, node->child1());
    4768         GPRTemporary resultPayload(this);
    4769         GPRTemporary resultTag(this);
    4770 
    4771         GPRReg bucketGPR = bucket.gpr();
    4772         GPRReg resultPayloadGPR = resultPayload.gpr();
    4773         GPRReg resultTagGPR = resultTag.gpr();
    4774 
    4775         auto notBucket = m_jit.branchTestPtr(MacroAssembler::Zero, bucketGPR);
    4776         m_jit.loadValue(MacroAssembler::Address(bucketGPR, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfValue()), JSValueRegs(resultTagGPR, resultPayloadGPR));
    4777         auto done = m_jit.jump();
    4778 
    4779         notBucket.link(&m_jit);
    4780         m_jit.move(TrustedImm32(JSValue::UndefinedTag), resultTagGPR);
    4781         m_jit.move(TrustedImm32(0), resultPayloadGPR);
    4782         done.link(&m_jit);
    4783         jsValueResult(resultTagGPR, resultPayloadGPR, node);
    4784         break;
    4785     }
    4786 
    4787     case IsNonEmptyMapBucket: {
    4788         SpeculateCellOperand bucket(this, node->child1());
    4789         GPRTemporary result(this);
    4790 
    4791         GPRReg bucketGPR = bucket.gpr();
    4792         GPRReg resultGPR = result.gpr();
    4793 
    4794         m_jit.comparePtr(MacroAssembler::NotEqual, bucketGPR, TrustedImm32(0), resultGPR);
    4795         booleanResult(resultGPR, node);
    4796         break;
    4797     }
    4798 
    47994722    case Flush:
    48004723        break;
  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r205504 r205507  
    4040#include "JSEnvironmentRecord.h"
    4141#include "JSLexicalEnvironment.h"
    42 #include "JSMap.h"
    4342#include "JSPropertyNameEnumerator.h"
    44 #include "JSSet.h"
    4543#include "ObjectPrototype.h"
    4644#include "SetupVarargsFrame.h"
     
    46184616    }
    46194617
    4620     case MapHash: {
    4621         JSValueOperand input(this, node->child1());
    4622         GPRTemporary temp(this);
    4623         GPRTemporary result(this);
    4624 
    4625         GPRReg inputGPR = input.gpr();
    4626         GPRReg resultGPR = result.gpr();
    4627         GPRReg tempGPR = temp.gpr();
    4628 
    4629         MacroAssembler::JumpList straightHash;
    4630         MacroAssembler::JumpList done;
    4631         auto isNotCell = m_jit.branchIfNotCell(inputGPR);
    4632         MacroAssembler::JumpList slowPath;
    4633         straightHash.append(m_jit.branch8(MacroAssembler::NotEqual, MacroAssembler::Address(inputGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
    4634         m_jit.loadPtr(MacroAssembler::Address(inputGPR, JSString::offsetOfValue()), resultGPR);
    4635         slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, resultGPR));
    4636         m_jit.load32(MacroAssembler::Address(resultGPR, StringImpl::flagsOffset()), resultGPR);
    4637         m_jit.urshift64(MacroAssembler::TrustedImm32(StringImpl::s_flagCount), resultGPR);
    4638         slowPath.append(m_jit.branchTest32(MacroAssembler::Zero, resultGPR));
    4639         done.append(m_jit.jump());
    4640 
    4641         isNotCell.link(&m_jit);
    4642         straightHash.append(m_jit.branchIfNotNumber(inputGPR));
    4643         straightHash.append(m_jit.branchIfInt32(JSValueRegs(inputGPR)));
    4644         slowPath.append(m_jit.jump());
    4645 
    4646         straightHash.link(&m_jit);
    4647         m_jit.move(inputGPR, resultGPR);
    4648         m_jit.wangsInt64Hash(resultGPR, tempGPR);
    4649         done.append(m_jit.jump());
    4650 
    4651         slowPath.link(&m_jit);
    4652         silentSpillAllRegisters(resultGPR);
    4653         callOperation(operationMapHash, resultGPR, inputGPR);
    4654         silentFillAllRegisters(resultGPR);
    4655         m_jit.exceptionCheck();
    4656 
    4657         done.link(&m_jit);
    4658         int32Result(resultGPR, node);
    4659         break;
    4660     }
    4661     case GetMapBucket: {
    4662         SpeculateCellOperand map(this, node->child1());
    4663         JSValueOperand key(this, node->child2());
    4664         SpeculateInt32Operand hash(this, node->child3());
    4665         GPRTemporary mask(this);
    4666         GPRTemporary index(this);
    4667         GPRTemporary buffer(this);
    4668         GPRTemporary bucket(this);
    4669         GPRTemporary result(this);
    4670 
    4671         GPRReg hashGPR = hash.gpr();
    4672         GPRReg mapGPR = map.gpr();
    4673         GPRReg maskGPR = mask.gpr();
    4674         GPRReg indexGPR = index.gpr();
    4675         GPRReg bufferGPR = buffer.gpr();
    4676         GPRReg bucketGPR = bucket.gpr();
    4677         GPRReg keyGPR = key.gpr();
    4678         GPRReg resultGPR = result.gpr();
    4679 
    4680         if (node->child1().useKind() == MapObjectUse)
    4681             speculateMapObject(node->child1(), mapGPR);
    4682         else if (node->child1().useKind() == SetObjectUse)
    4683             speculateSetObject(node->child1(), mapGPR);
    4684         else
    4685             RELEASE_ASSERT_NOT_REACHED();
    4686 
    4687         m_jit.loadPtr(MacroAssembler::Address(mapGPR, node->child1().useKind() == MapObjectUse ? JSMap::offsetOfHashMapImpl() : JSSet::offsetOfHashMapImpl()), bufferGPR);
    4688         m_jit.load32(MacroAssembler::Address(bufferGPR, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfCapacity()), maskGPR);
    4689         m_jit.loadPtr(MacroAssembler::Address(bufferGPR, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfBuffer()), bufferGPR);
    4690         m_jit.sub32(TrustedImm32(1), maskGPR);
    4691         m_jit.move(hashGPR, indexGPR);
    4692 
    4693         MacroAssembler::Label loop = m_jit.label();
    4694         MacroAssembler::JumpList done;
    4695         MacroAssembler::JumpList slowPathCases;
    4696         MacroAssembler::JumpList loopAround;
    4697 
    4698         m_jit.and32(maskGPR, indexGPR);
    4699         m_jit.loadPtr(MacroAssembler::BaseIndex(bufferGPR, indexGPR, MacroAssembler::TimesEight), bucketGPR);
    4700         m_jit.move(bucketGPR, resultGPR);
    4701         auto notPresentInTable = m_jit.branchPtr(MacroAssembler::Equal,
    4702             bucketGPR, TrustedImmPtr(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::emptyValue()));
    4703         loopAround.append(m_jit.branchPtr(MacroAssembler::Equal,
    4704             bucketGPR, TrustedImmPtr(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::deletedValue())));
    4705 
    4706         m_jit.load64(MacroAssembler::Address(bucketGPR, HashMapBucket<HashMapBucketDataKey>::offsetOfKey()), bucketGPR);
    4707 
    4708         // Perform Object.is()
    4709         done.append(m_jit.branch64(MacroAssembler::Equal, bucketGPR, keyGPR)); // They're definitely the same value, we found the bucket we were looking for!
    4710         auto oneIsntCell = m_jit.branchIfNotCell(JSValueRegs(bucketGPR));
    4711         // first is a cell here.
    4712         loopAround.append(m_jit.branchIfNotCell(JSValueRegs(keyGPR)));
    4713         // Both are cells here.
    4714         loopAround.append(m_jit.branch8(JITCompiler::NotEqual,
    4715             JITCompiler::Address(bucketGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
    4716         // The first is a string here.
    4717         slowPathCases.append(m_jit.branch8(JITCompiler::Equal,
    4718             JITCompiler::Address(keyGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
    4719         // The first is a string, but the second is not, we continue to loop around.
    4720         loopAround.append(m_jit.jump());
    4721 
    4722         oneIsntCell.link(&m_jit);
    4723         // We've already done a 64-bit compare at this point, so if one is not a number, they're definitely not equal.
    4724         loopAround.append(m_jit.branchIfNotNumber(bucketGPR));
    4725         loopAround.append(m_jit.branchIfNotNumber(keyGPR));
    4726         // Both are definitely numbers. If we see a double, we go to the slow path.
    4727         slowPathCases.append(m_jit.branchIfNotInt32(bucketGPR));
    4728         slowPathCases.append(m_jit.branchIfNotInt32(keyGPR));
    4729        
    4730         loopAround.link(&m_jit);
    4731         m_jit.add32(TrustedImm32(1), indexGPR);
    4732         m_jit.jump().linkTo(loop, &m_jit);
    4733 
    4734         slowPathCases.link(&m_jit);
    4735         silentSpillAllRegisters(indexGPR);
    4736         if (node->child1().useKind() == MapObjectUse)
    4737             callOperation(operationJSMapFindBucket, resultGPR, mapGPR, keyGPR, hashGPR);
    4738         else
    4739             callOperation(operationJSSetFindBucket, resultGPR, mapGPR, keyGPR, hashGPR);
    4740         silentFillAllRegisters(indexGPR);
    4741         m_jit.exceptionCheck();
    4742         done.append(m_jit.jump());
    4743 
    4744         notPresentInTable.link(&m_jit);
    4745         m_jit.move(TrustedImmPtr(nullptr), resultGPR);
    4746         done.link(&m_jit);
    4747         cellResult(resultGPR, node);
    4748         break;
    4749     }
    4750 
    4751     case LoadFromJSMapBucket: {
    4752         SpeculateCellOperand bucket(this, node->child1());
    4753         GPRTemporary result(this);
    4754 
    4755         GPRReg bucketGPR = bucket.gpr();
    4756         GPRReg resultGPR = result.gpr();
    4757 
    4758         auto notBucket = m_jit.branchTestPtr(MacroAssembler::Zero, bucketGPR);
    4759         m_jit.load64(MacroAssembler::Address(bucketGPR, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfValue()), resultGPR);
    4760         auto done = m_jit.jump();
    4761 
    4762         notBucket.link(&m_jit);
    4763         m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), resultGPR);
    4764         done.link(&m_jit);
    4765         jsValueResult(resultGPR, node);
    4766         break;
    4767     }
    4768 
    4769     case IsNonEmptyMapBucket: {
    4770         SpeculateCellOperand bucket(this, node->child1());
    4771         GPRTemporary result(this);
    4772 
    4773         GPRReg bucketGPR = bucket.gpr();
    4774         GPRReg resultGPR = result.gpr();
    4775 
    4776         m_jit.comparePtr(MacroAssembler::NotEqual, bucketGPR, TrustedImm32(0), resultGPR);
    4777         m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
    4778         jsValueResult(resultGPR, node, DataFormatJSBoolean);
    4779         break;
    4780     }
    4781 
    47824618    case IsObject: {
    47834619        JSValueOperand value(this, node->child1());
  • trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp

    r205504 r205507  
    9595        out.print("RegExpObject");
    9696        return;
    97     case MapObjectUse:
    98         out.print("MapObjectUse");
    99         return;
    100     case SetObjectUse:
    101         out.print("SetObjectUse");
    102         return;
    10397    case ObjectOrOtherUse:
    10498        out.print("ObjectOrOther");
  • trunk/Source/JavaScriptCore/dfg/DFGUseKind.h

    r205504 r205507  
    6464    KnownPrimitiveUse, // This bizarre type arises for op_strcat, which has a bytecode guarantee that it will only see primitives (i.e. not objects).
    6565    SymbolUse,
    66     MapObjectUse,
    67     SetObjectUse,
    6866    StringObjectUse,
    6967    StringOrStringObjectUse,
     
    137135    case SymbolUse:
    138136        return SpecSymbol;
    139     case MapObjectUse:
    140         return SpecMapObject;
    141     case SetObjectUse:
    142         return SpecSetObject;
    143137    case StringObjectUse:
    144138        return SpecStringObject;
     
    228222    case StringObjectUse:
    229223    case StringOrStringObjectUse:
    230     case MapObjectUse:
    231     case SetObjectUse:
    232224        return true;
    233225    default:
  • trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h

    r205504 r205507  
    3333#include "FTLAbstractHeap.h"
    3434#include "IndexingType.h"
    35 #include "JSMap.h"
    36 #include "JSSet.h"
    3735
    3836namespace JSC { namespace FTL {
     
    104102    macro(Structure_globalObject, Structure::globalObjectOffset()) \
    105103    macro(Structure_prototype, Structure::prototypeOffset()) \
    106     macro(Structure_structureID, Structure::structureIDOffset()) \
    107     macro(JSMap_hashMapImpl, JSMap::offsetOfHashMapImpl()) \
    108     macro(JSSet_hashMapImpl, JSSet::offsetOfHashMapImpl()) \
    109     macro(HashMapImpl_capacity, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfCapacity()) \
    110     macro(HashMapImpl_buffer,  HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfBuffer()) \
    111     macro(HashMapBucket_value, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfValue()) \
    112     macro(HashMapBucket_key, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfKey()) \
     104    macro(Structure_structureID, Structure::structureIDOffset())
    113105
    114106#define FOR_EACH_INDEXED_ABSTRACT_HEAP(macro) \
  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r205504 r205507  
    182182    case In:
    183183    case IsJSArray:
    184     case MapHash:
    185     case GetMapBucket:
    186     case LoadFromJSMapBucket:
    187     case IsNonEmptyMapBucket:
    188184    case IsEmpty:
    189185    case IsUndefined:
     
    430426                case StringOrStringObjectUse:
    431427                case SymbolUse:
    432                 case MapObjectUse:
    433                 case SetObjectUse:
    434428                case FinalObjectUse:
    435429                case RegExpObjectUse:
  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r205504 r205507  
    7171#include "JSGeneratorFunction.h"
    7272#include "JSLexicalEnvironment.h"
    73 #include "JSMap.h"
    7473#include "OperandsInlines.h"
    7574#include "ScopedArguments.h"
     
    899898        case IsJSArray:
    900899            compileIsJSArray();
    901             break;
    902         case MapHash:
    903             compileMapHash();
    904             break;
    905         case GetMapBucket:
    906             compileGetMapBucket();
    907             break;
    908         case LoadFromJSMapBucket:
    909             compileLoadFromJSMapBucket();
    910             break;
    911         case IsNonEmptyMapBucket:
    912             compileIsNonEmptyMapBucket();
    913900            break;
    914901        case IsObject:
     
    63016288        m_out.appendTo(continuation, lastNext);
    63026289        setBoolean(m_out.phi(Int32, notCellResult, cellResult));
    6303     }
    6304 
    6305     void compileMapHash()
    6306     {
    6307         LValue value = lowJSValue(m_node->child1());
    6308 
    6309         LBasicBlock isCellCase = m_out.newBlock();
    6310         LBasicBlock notCell = m_out.newBlock();
    6311         LBasicBlock slowCase = m_out.newBlock();
    6312         LBasicBlock straightHash = m_out.newBlock();
    6313         LBasicBlock isNumberCase = m_out.newBlock();
    6314         LBasicBlock isStringCase = m_out.newBlock();
    6315         LBasicBlock nonEmptyStringCase = m_out.newBlock();
    6316         LBasicBlock continuation = m_out.newBlock();
    6317 
    6318         m_out.branch(
    6319             isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(notCell));
    6320 
    6321         LBasicBlock lastNext = m_out.appendTo(isCellCase, isStringCase);
    6322         LValue isString = m_out.equal(m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoType), m_out.constInt32(StringType));
    6323         m_out.branch(
    6324             isString, unsure(isStringCase), unsure(straightHash));
    6325 
    6326         m_out.appendTo(isStringCase, nonEmptyStringCase);
    6327         LValue stringImpl = m_out.loadPtr(value, m_heaps.JSString_value);
    6328         m_out.branch(
    6329             m_out.equal(stringImpl, m_out.constIntPtr(0)), rarely(slowCase), usually(nonEmptyStringCase));
    6330 
    6331         m_out.appendTo(nonEmptyStringCase, notCell);
    6332         LValue hash = m_out.lShr(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
    6333         ValueFromBlock nonEmptyStringHashResult = m_out.anchor(hash);
    6334         m_out.branch(m_out.equal(hash, m_out.constInt32(0)),
    6335             rarely(slowCase), usually(continuation));
    6336 
    6337         m_out.appendTo(notCell, isNumberCase);
    6338         m_out.branch(
    6339             isNumber(value), unsure(isNumberCase), unsure(straightHash));
    6340 
    6341         m_out.appendTo(isNumberCase, straightHash);
    6342         m_out.branch(
    6343             isInt32(value), unsure(straightHash), unsure(slowCase));
    6344 
    6345         m_out.appendTo(straightHash, slowCase);
    6346         // key += ~(key << 32);
    6347         LValue key = value;
    6348         LValue temp = key;
    6349         temp = m_out.shl(temp, m_out.constInt32(32));
    6350         temp = m_out.bitNot(temp);
    6351         key = m_out.add(key, temp);
    6352         // key ^= (key >> 22);
    6353         temp = key;
    6354         temp = m_out.lShr(temp, m_out.constInt32(22));
    6355         key = m_out.bitXor(key, temp);
    6356         // key += ~(key << 13);
    6357         temp = key;
    6358         temp = m_out.shl(temp, m_out.constInt32(13));
    6359         temp = m_out.bitNot(temp);
    6360         key = m_out.add(key, temp);
    6361         // key ^= (key >> 8);
    6362         temp = key;
    6363         temp = m_out.lShr(temp, m_out.constInt32(8));
    6364         key = m_out.bitXor(key, temp);
    6365         // key += (key << 3);
    6366         temp = key;
    6367         temp = m_out.shl(temp, m_out.constInt32(3));
    6368         key = m_out.add(key, temp);
    6369         // key ^= (key >> 15);
    6370         temp = key;
    6371         temp = m_out.lShr(temp, m_out.constInt32(15));
    6372         key = m_out.bitXor(key, temp);
    6373         // key += ~(key << 27);
    6374         temp = key;
    6375         temp = m_out.shl(temp, m_out.constInt32(27));
    6376         temp = m_out.bitNot(temp);
    6377         key = m_out.add(key, temp);
    6378         // key ^= (key >> 31);
    6379         temp = key;
    6380         temp = m_out.lShr(temp, m_out.constInt32(31));
    6381         key = m_out.bitXor(key, temp);
    6382         key = m_out.castToInt32(key);
    6383 
    6384         ValueFromBlock fastResult = m_out.anchor(key);
    6385         m_out.jump(continuation);
    6386 
    6387         m_out.appendTo(slowCase, continuation);
    6388         ValueFromBlock slowResult = m_out.anchor(
    6389             vmCall(Int32, m_out.operation(operationMapHash), m_callFrame, value));
    6390         m_out.jump(continuation);
    6391 
    6392         m_out.appendTo(continuation, lastNext);
    6393         setInt32(m_out.phi(Int32, fastResult, slowResult, nonEmptyStringHashResult));
    6394     }
    6395 
    6396     void compileGetMapBucket()
    6397     {
    6398         LBasicBlock loopStart = m_out.newBlock();
    6399         LBasicBlock loopAround = m_out.newBlock();
    6400         LBasicBlock slowPath = m_out.newBlock();
    6401         LBasicBlock notPresentInTable = m_out.newBlock();
    6402         LBasicBlock notEmptyValue = m_out.newBlock();
    6403         LBasicBlock notDeletedValue = m_out.newBlock();
    6404         LBasicBlock notBitEqual = m_out.newBlock();
    6405         LBasicBlock bucketKeyNotCell = m_out.newBlock();
    6406         LBasicBlock bucketKeyIsCell = m_out.newBlock();
    6407         LBasicBlock bothAreCells = m_out.newBlock();
    6408         LBasicBlock bucketKeyIsString = m_out.newBlock();
    6409         LBasicBlock bucketKeyIsNumber = m_out.newBlock();
    6410         LBasicBlock bothAreNumbers = m_out.newBlock();
    6411         LBasicBlock bucketKeyIsInt32 = m_out.newBlock();
    6412         LBasicBlock continuation = m_out.newBlock();
    6413 
    6414         LBasicBlock lastNext = m_out.insertNewBlocksBefore(loopStart);
    6415 
    6416         LValue map;
    6417         if (m_node->child1().useKind() == MapObjectUse)
    6418             map = lowMapObject(m_node->child1());
    6419         else if (m_node->child1().useKind() == SetObjectUse)
    6420             map = lowSetObject(m_node->child1());
    6421         else
    6422             RELEASE_ASSERT_NOT_REACHED();
    6423 
    6424         LValue key = lowJSValue(m_node->child2());
    6425         LValue hash = lowInt32(m_node->child3());
    6426 
    6427         LValue hashMapImpl = m_out.loadPtr(map, m_node->child1().useKind() == MapObjectUse ? m_heaps.JSMap_hashMapImpl : m_heaps.JSSet_hashMapImpl);
    6428         LValue buffer = m_out.loadPtr(hashMapImpl, m_heaps.HashMapImpl_buffer);
    6429         LValue mask = m_out.sub(m_out.load32(hashMapImpl, m_heaps.HashMapImpl_capacity), m_out.int32One);
    6430 
    6431         ValueFromBlock indexStart = m_out.anchor(hash);
    6432         m_out.jump(loopStart);
    6433 
    6434         m_out.appendTo(loopStart, notEmptyValue);
    6435         LValue unmaskedIndex = m_out.phi(Int32, indexStart);
    6436         LValue index = m_out.bitAnd(mask, unmaskedIndex);
    6437         LValue hashMapBucket = m_out.load64(m_out.baseIndex(m_heaps.properties.atAnyNumber(), buffer, m_out.zeroExt(index, Int64), ScaleEight));
    6438         ValueFromBlock bucketResult = m_out.anchor(hashMapBucket);
    6439         m_out.branch(m_out.equal(hashMapBucket, m_out.constIntPtr(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::emptyValue())),
    6440             unsure(notPresentInTable), unsure(notEmptyValue));
    6441 
    6442         m_out.appendTo(notEmptyValue, notDeletedValue);
    6443         m_out.branch(m_out.equal(hashMapBucket, m_out.constIntPtr(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::deletedValue())),
    6444             unsure(loopAround), unsure(notDeletedValue));
    6445 
    6446         m_out.appendTo(notDeletedValue, notBitEqual);
    6447         LValue bucketKey = m_out.load64(hashMapBucket, m_heaps.HashMapBucket_key);
    6448         // Perform Object.is()
    6449         m_out.branch(m_out.equal(key, bucketKey),
    6450             unsure(continuation), unsure(notBitEqual));
    6451 
    6452         m_out.appendTo(notBitEqual, bucketKeyIsCell);
    6453         m_out.branch(isCell(bucketKey),
    6454             unsure(bucketKeyIsCell), unsure(bucketKeyNotCell));
    6455 
    6456         m_out.appendTo(bucketKeyIsCell, bothAreCells);
    6457         m_out.branch(isCell(key),
    6458             unsure(bothAreCells), unsure(loopAround));
    6459 
    6460         m_out.appendTo(bothAreCells, bucketKeyIsString);
    6461         m_out.branch(isString(bucketKey),
    6462             unsure(bucketKeyIsString), unsure(loopAround));
    6463 
    6464         m_out.appendTo(bucketKeyIsString, bucketKeyNotCell);
    6465         m_out.branch(isString(key),
    6466             unsure(slowPath), unsure(loopAround));
    6467 
    6468         m_out.appendTo(bucketKeyNotCell, bucketKeyIsNumber);
    6469         m_out.branch(isNotNumber(bucketKey),
    6470             unsure(loopAround), unsure(bucketKeyIsNumber));
    6471 
    6472         m_out.appendTo(bucketKeyIsNumber, bothAreNumbers);
    6473         m_out.branch(isNotNumber(key),
    6474             unsure(loopAround), unsure(bothAreNumbers));
    6475 
    6476         m_out.appendTo(bothAreNumbers, bucketKeyIsInt32);
    6477         m_out.branch(isNotInt32(bucketKey),
    6478             unsure(slowPath), unsure(bucketKeyIsInt32));
    6479 
    6480         m_out.appendTo(bucketKeyIsInt32, loopAround);
    6481         m_out.branch(isNotInt32(key),
    6482             unsure(slowPath), unsure(loopAround));
    6483 
    6484         m_out.appendTo(loopAround, slowPath);
    6485         m_out.addIncomingToPhi(unmaskedIndex, m_out.anchor(m_out.add(index, m_out.int32One)));
    6486         m_out.jump(loopStart);
    6487 
    6488         m_out.appendTo(slowPath, notPresentInTable);
    6489         ValueFromBlock slowPathResult = m_out.anchor(vmCall(pointerType(),
    6490             m_out.operation(m_node->child1().useKind() == MapObjectUse ? operationJSMapFindBucket : operationJSSetFindBucket), m_callFrame, map, key, hash));
    6491         m_out.jump(continuation);
    6492 
    6493         m_out.appendTo(notPresentInTable, continuation);
    6494         ValueFromBlock notPresentResult = m_out.anchor(m_out.constIntPtr(0));
    6495         m_out.jump(continuation);
    6496 
    6497         m_out.appendTo(continuation, lastNext);
    6498         setMapBucket(m_out.phi(pointerType(), bucketResult, slowPathResult, notPresentResult));
    6499     }
    6500 
    6501     void compileLoadFromJSMapBucket()
    6502     {
    6503         LValue mapBucket = lowMapBucket(m_node->child1());
    6504 
    6505         LBasicBlock continuation = m_out.newBlock();
    6506         LBasicBlock hasBucket = m_out.newBlock();
    6507 
    6508         ValueFromBlock noBucketResult = m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined())));
    6509 
    6510         m_out.branch(m_out.equal(mapBucket, m_out.constIntPtr(0)),
    6511             unsure(continuation), unsure(hasBucket));
    6512 
    6513         LBasicBlock lastNext = m_out.appendTo(hasBucket, continuation);
    6514         ValueFromBlock bucketResult = m_out.anchor(m_out.load64(mapBucket, m_heaps.HashMapBucket_value));
    6515         m_out.jump(continuation);
    6516 
    6517         m_out.appendTo(continuation, lastNext);
    6518         setJSValue(m_out.phi(Int64, noBucketResult, bucketResult));
    6519     }
    6520 
    6521     void compileIsNonEmptyMapBucket()
    6522     {
    6523         LValue bucket = lowMapBucket(m_node->child1());
    6524         LValue result = m_out.notEqual(bucket, m_out.constIntPtr(0));
    6525         setBoolean(result);
    65266290    }
    65276291
     
    102169980        return result;
    102179981    }
    10218 
    10219     LValue lowMapObject(Edge edge)
    10220     {
    10221         LValue result = lowCell(edge);
    10222         speculateMapObject(edge, result);
    10223         return result;
    10224     }
    10225 
    10226     LValue lowSetObject(Edge edge)
    10227     {
    10228         LValue result = lowCell(edge);
    10229         speculateSetObject(edge, result);
    10230         return result;
    10231     }
    102329982   
    102339983    LValue lowString(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
     
    1035310103        return result;
    1035410104    }
    10355 
    10356     LValue lowMapBucket(Edge edge)
    10357     {
    10358         LoweredNodeValue value = m_mapBucketValues.get(edge.node());
    10359         if (isValid(value))
    10360             return value.value();
    10361        
    10362         LValue result = lowCell(edge);
    10363         setStorage(edge.node(), result);
    10364         return result;
    10365     }
    1036610105   
    1036710106    LValue strictInt52ToInt32(Edge edge, LValue value)
     
    1066610405        case RegExpObjectUse:
    1066710406            speculateRegExpObject(edge);
    10668             break;
    10669         case MapObjectUse:
    10670             speculateMapObject(edge);
    10671             break;
    10672         case SetObjectUse:
    10673             speculateSetObject(edge);
    1067410407            break;
    1067510408        case StringUse:
     
    1100110734        speculateRegExpObject(edge, lowCell(edge));
    1100210735    }
    11003 
    11004     void speculateMapObject(Edge edge, LValue cell)
    11005     {
    11006         FTL_TYPE_CHECK(
    11007             jsValueValue(cell), edge, SpecMapObject, isNotType(cell, JSMapType));
    11008     }
    11009 
    11010     void speculateMapObject(Edge edge)
    11011     {
    11012         speculateMapObject(edge, lowCell(edge));
    11013     }
    11014 
    11015     void speculateSetObject(Edge edge, LValue cell)
    11016     {
    11017         FTL_TYPE_CHECK(
    11018             jsValueValue(cell), edge, SpecSetObject, isNotType(cell, JSSetType));
    11019     }
    11020 
    11021     void speculateSetObject(Edge edge)
    11022     {
    11023         speculateSetObject(edge, lowCell(edge));
    11024     }
    1102510736   
    1102610737    void speculateString(Edge edge, LValue cell)
     
    1179111502        m_storageValues.set(node, LoweredNodeValue(value, m_highBlock));
    1179211503    }
    11793     void setMapBucket(Node* node, LValue value)
    11794     {
    11795         m_mapBucketValues.set(node, LoweredNodeValue(value, m_highBlock));
    11796     }
    1179711504    void setDouble(Node* node, LValue value)
    1179811505    {
     
    1182711534    {
    1182811535        setStorage(m_node, value);
    11829     }
    11830     void setMapBucket(LValue value)
    11831     {
    11832         setMapBucket(m_node, value);
    1183311536    }
    1183411537    void setDouble(LValue value)
     
    1201511718    HashMap<Node*, LoweredNodeValue> m_booleanValues;
    1201611719    HashMap<Node*, LoweredNodeValue> m_storageValues;
    12017     HashMap<Node*, LoweredNodeValue> m_mapBucketValues;
    1201811720    HashMap<Node*, LoweredNodeValue> m_doubleValues;
    1201911721   
  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp

    r205504 r205507  
    627627}
    628628
    629 #if USE(JSVALUE64)
    630 void AssemblyHelpers::wangsInt64Hash(GPRReg inputAndResult, GPRReg scratch)
    631 {
    632     GPRReg input = inputAndResult;
    633     // key += ~(key << 32);
    634     move(input, scratch);
    635     lshift64(TrustedImm32(32), scratch);
    636     not64(scratch);
    637     add64(scratch, input);
    638     // key ^= (key >> 22);
    639     move(input, scratch);
    640     urshift64(TrustedImm32(22), scratch);
    641     xor64(scratch, input);
    642     // key += ~(key << 13);
    643     move(input, scratch);
    644     lshift64(TrustedImm32(13), scratch);
    645     not64(scratch);
    646     add64(scratch, input);
    647     // key ^= (key >> 8);
    648     move(input, scratch);
    649     urshift64(TrustedImm32(8), scratch);
    650     xor64(scratch, input);
    651     // key += (key << 3);
    652     move(input, scratch);
    653     lshift64(TrustedImm32(3), scratch);
    654     add64(scratch, input);
    655     // key ^= (key >> 15);
    656     move(input, scratch);
    657     urshift64(TrustedImm32(15), scratch);
    658     xor64(scratch, input);
    659     // key += ~(key << 27);
    660     move(input, scratch);
    661     lshift64(TrustedImm32(27), scratch);
    662     not64(scratch);
    663     add64(scratch, input);
    664     // key ^= (key >> 31);
    665     move(input, scratch);
    666     urshift64(TrustedImm32(31), scratch);
    667     xor64(scratch, input);
    668 
    669     // return static_cast<unsigned>(result)
    670     void* mask = bitwise_cast<void*>(static_cast<uintptr_t>(UINT_MAX));
    671     and64(TrustedImmPtr(mask), inputAndResult);
    672 }
    673 #endif // USE(JSVALUE64)
    674 
    675629} // namespace JSC
    676630
  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h

    r205504 r205507  
    6262        }
    6363    }
    64 
     64   
    6565    CodeBlock* codeBlock() { return m_codeBlock; }
    6666    VM* vm() { return m_vm; }
     
    15291529        storePtr(TrustedImmPtr(structure->classInfo()), Address(resultGPR, JSDestructibleObject::classInfoOffset()));
    15301530    }
    1531 
    1532 #if USE(JSVALUE64)
    1533     void wangsInt64Hash(GPRReg inputAndResult, GPRReg scratch);
    1534 #endif
    15351531   
    15361532protected:
  • trunk/Source/JavaScriptCore/jit/JITOperations.h

    r205504 r205507  
    206206typedef JSCell* (JIT_OPERATION *C_JITOperation_EZ)(ExecState*, int32_t);
    207207typedef JSCell* (JIT_OPERATION *C_JITOperation_EJscI)(ExecState*, JSScope*, UniquedStringImpl*);
    208 typedef JSCell* (JIT_OPERATION *C_JITOperation_ECJZ)(ExecState*, JSCell*, EncodedJSValue, int32_t);
    209208typedef double (JIT_OPERATION *D_JITOperation_D)(double);
    210209typedef double (JIT_OPERATION *D_JITOperation_G)(JSGlobalObject*);
  • trunk/Source/JavaScriptCore/parser/ModuleAnalyzer.cpp

    r205504 r205507  
    3838ModuleAnalyzer::ModuleAnalyzer(ExecState* exec, const Identifier& moduleKey, const SourceCode& sourceCode, const VariableEnvironment& declaredVariables, const VariableEnvironment& lexicalVariables)
    3939    : m_vm(&exec->vm())
    40     , m_moduleRecord(exec->vm(), JSModuleRecord::create(exec, exec->vm(), exec->lexicalGlobalObject()->moduleRecordStructure(), moduleKey, sourceCode, declaredVariables, lexicalVariables))
     40    , m_moduleRecord(exec->vm(), JSModuleRecord::create(exec->vm(), exec->lexicalGlobalObject()->moduleRecordStructure(), moduleKey, sourceCode, declaredVariables, lexicalVariables))
    4141{
    4242}
  • trunk/Source/JavaScriptCore/runtime/Intrinsic.h

    r205504 r205507  
    6363    IsTypedArrayViewIntrinsic,
    6464    BoundThisNoArgsFunctionCallIntrinsic,
    65     JSMapGetIntrinsic,
    66     JSMapHasIntrinsic,
    67     JSSetHasIntrinsic,
    6865
    6966    // Getter intrinsics.
  • trunk/Source/JavaScriptCore/runtime/JSCJSValue.h

    r205504 r205507  
    607607bool isThisValueAltered(const PutPropertySlot&, JSObject* baseObject);
    608608
    609 // See section 7.2.9: https://tc39.github.io/ecma262/#sec-samevalue
    610 bool sameValue(ExecState*, JSValue a, JSValue b);
    611 
    612609} // namespace JSC
    613610
  • trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h

    r205504 r205507  
    10591059}
    10601060
    1061 // See section 7.2.9: https://tc39.github.io/ecma262/#sec-samevalue
    1062 ALWAYS_INLINE bool sameValue(ExecState* exec, JSValue a, JSValue b)
    1063 {
    1064     if (!a.isNumber())
    1065         return JSValue::strictEqual(exec, a, b);
    1066     if (!b.isNumber())
    1067         return false;
    1068     double x = a.asNumber();
    1069     double y = b.asNumber();
    1070     bool xIsNaN = std::isnan(x);
    1071     bool yIsNaN = std::isnan(y);
    1072     if (xIsNaN || yIsNaN)
    1073         return xIsNaN && yIsNaN;
    1074     return bitwise_cast<uint64_t>(x) == bitwise_cast<uint64_t>(y);
    1075 }
    1076 
    10771061} // namespace JSC
    10781062
  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

    r205504 r205507  
    642642
    643643    m_moduleLoaderStructure.set(vm, this, JSModuleLoader::createStructure(vm, this, m_moduleLoaderPrototype.get()));
    644     m_moduleLoader.set(vm, this, JSModuleLoader::create(globalExec(), vm, this, m_moduleLoaderStructure.get()));
     644    m_moduleLoader.set(vm, this, JSModuleLoader::create(vm, this, m_moduleLoaderStructure.get()));
    645645    if (Options::exposeInternalModuleLoader())
    646646        putDirectWithoutTransition(vm, vm.propertyNames->Loader, m_moduleLoader.get(), DontEnum);
  • trunk/Source/JavaScriptCore/runtime/JSMap.cpp

    r205504 r205507  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
     
    2727#include "JSMap.h"
    2828
    29 #include "JSCInlines.h"
     29#include "CopiedBlockInlines.h"
     30#include "JSCJSValueInlines.h"
     31#include "JSMapIterator.h"
     32#include "MapDataInlines.h"
     33#include "SlotVisitorInlines.h"
     34#include "StructureInlines.h"
    3035
    3136namespace JSC {
    3237
    3338const ClassInfo JSMap::s_info = { "Map", &Base::s_info, 0, CREATE_METHOD_TABLE(JSMap) };
     39
     40void JSMap::destroy(JSCell* cell)
     41{
     42    JSMap* thisObject = jsCast<JSMap*>(cell);
     43    thisObject->JSMap::~JSMap();
     44}
     45
     46size_t JSMap::estimatedSize(JSCell* cell)
     47{
     48    JSMap* thisObject = jsCast<JSMap*>(cell);
     49    size_t mapDataSize = thisObject->m_mapData.capacityInBytes();
     50    return Base::estimatedSize(cell) + mapDataSize;
     51}
    3452
    3553String JSMap::toStringName(const JSObject*, ExecState*)
     
    3856}
    3957
     58void JSMap::visitChildren(JSCell* cell, SlotVisitor& visitor)
     59{
     60    Base::visitChildren(cell, visitor);
     61    jsCast<JSMap*>(cell)->m_mapData.visitChildren(cell, visitor);
    4062}
     63
     64void JSMap::copyBackingStore(JSCell* cell, CopyVisitor& visitor, CopyToken token)
     65{
     66    Base::copyBackingStore(cell, visitor, token);
     67    jsCast<JSMap*>(cell)->m_mapData.copyBackingStore(visitor, token);
     68}
     69
     70bool JSMap::has(ExecState* exec, JSValue key)
     71{
     72    return m_mapData.contains(exec, key);
     73}
     74
     75size_t JSMap::size(ExecState* exec)
     76{
     77    return m_mapData.size(exec);
     78}
     79
     80JSValue JSMap::get(ExecState* exec, JSValue key)
     81{
     82    JSValue result = m_mapData.get(exec, key);
     83    if (!result)
     84        return jsUndefined();
     85    return result;
     86}
     87
     88void JSMap::set(ExecState* exec, JSValue key, JSValue value)
     89{
     90    m_mapData.set(exec, this, key, value);
     91}
     92
     93void JSMap::clear(ExecState*)
     94{
     95    m_mapData.clear();
     96}
     97
     98bool JSMap::remove(ExecState* exec, JSValue key)
     99{
     100    return m_mapData.remove(exec, key);
     101}
     102
     103}
  • trunk/Source/JavaScriptCore/runtime/JSMap.h

    r205504 r205507  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
     
    2727#define JSMap_h
    2828
     29#include "JSDestructibleObject.h"
    2930#include "JSObject.h"
    30 #include "MapBase.h"
     31#include "MapData.h"
    3132
    3233namespace JSC {
     
    3435class JSMapIterator;
    3536
    36 class JSMap : public MapBase<HashMapBucket<HashMapBucketDataKeyValue>> {
    37     typedef MapBase<HashMapBucket<HashMapBucketDataKeyValue>> Base;
     37class JSMap : public JSDestructibleObject {
    3838public:
     39    typedef JSDestructibleObject Base;
     40
    3941    friend class JSMapIterator;
     42
     43    // Our marking functions expect Entry to maintain this layout, and have all
     44    // fields be WriteBarrier<Unknown>
     45    class Entry {
     46    private:
     47        WriteBarrier<Unknown> m_key;
     48        WriteBarrier<Unknown> m_value;
     49
     50    public:
     51        const WriteBarrier<Unknown>& key() const
     52        {
     53            return m_key;
     54        }
     55
     56        const WriteBarrier<Unknown>& value() const
     57        {
     58            return m_value;
     59        }
     60
     61        void visitChildren(SlotVisitor& visitor)
     62        {
     63            visitor.append(&m_key);
     64            visitor.append(&m_value);
     65        }
     66
     67        void setKey(VM& vm, const JSCell* owner, JSValue key)
     68        {
     69            m_key.set(vm, owner, key);
     70        }
     71
     72        void setKeyWithoutWriteBarrier(JSValue key)
     73        {
     74            m_key.setWithoutWriteBarrier(key);
     75        }
     76
     77        void setValue(VM& vm, const JSCell* owner, JSValue value)
     78        {
     79            m_value.set(vm, owner, value);
     80        }
     81
     82        void clear()
     83        {
     84            m_key.clear();
     85            m_value.clear();
     86        }
     87    };
     88
     89    typedef MapDataImpl<Entry, JSMapIterator> MapData;
    4090
    4191    DECLARE_EXPORT_INFO;
     
    4393    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
    4494    {
    45         return Structure::create(vm, globalObject, prototype, TypeInfo(JSMapType, StructureFlags), info());
     95        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
    4696    }
    4797
    48     static JSMap* create(ExecState* exec, VM& vm, Structure* structure)
     98    static JSMap* create(VM& vm, Structure* structure)
    4999    {
    50100        JSMap* instance = new (NotNull, allocateCell<JSMap>(vm.heap)) JSMap(vm, structure);
    51         instance->finishCreation(exec, vm);
     101        instance->finishCreation(vm);
    52102        return instance;
    53103    }
    54104
    55     ALWAYS_INLINE JSValue get(ExecState* exec, JSValue key)
     105    static JSMap* create(ExecState* exec, Structure* structure)
    56106    {
    57         return m_map->get(exec, key);
     107        return create(exec->vm(), structure);
    58108    }
    59109
    60     ALWAYS_INLINE void set(ExecState* exec, JSValue key, JSValue value)
    61     {
    62         m_map->add(exec, key, value);
    63     }
     110    bool has(ExecState*, JSValue);
     111    size_t size(ExecState*);
     112    JSValue get(ExecState*, JSValue);
     113    JS_EXPORT_PRIVATE void set(ExecState*, JSValue key, JSValue value);
     114    void clear(ExecState*);
     115    bool remove(ExecState*, JSValue);
    64116
    65117private:
    66118    JSMap(VM& vm, Structure* structure)
    67119        : Base(vm, structure)
     120        , m_mapData(vm, this)
    68121    {
    69122    }
    70123
     124    static void destroy(JSCell*);
     125    static size_t estimatedSize(JSCell*);
     126    static void visitChildren(JSCell*, SlotVisitor&);
     127    static void copyBackingStore(JSCell*, CopyVisitor&, CopyToken);
    71128    static String toStringName(const JSObject*, ExecState*);
     129
     130    MapData m_mapData;
    72131};
    73132
  • trunk/Source/JavaScriptCore/runtime/JSMapIterator.cpp

    r205504 r205507  
    3939    Base::finishCreation(vm);
    4040    m_map.set(vm, this, iteratedObject);
    41     setIterator(vm, m_map->impl()->head());
    4241}
    4342
     
    4847    Base::visitChildren(thisObject, visitor);
    4948    visitor.append(&thisObject->m_map);
    50     visitor.append(&thisObject->m_iter);
    5149}
    5250
     
    6260JSMapIterator* JSMapIterator::clone(ExecState* exec)
    6361{
    64     VM& vm = exec->vm();
    65     auto clone = JSMapIterator::create(vm, exec->callee()->globalObject()->mapIteratorStructure(), m_map.get(), m_kind);
    66     clone->setIterator(vm, m_iter.get());
     62    auto clone = JSMapIterator::create(exec->vm(), exec->callee()->globalObject()->mapIteratorStructure(), m_map.get(), m_kind);
     63    clone->m_iterator = m_iterator;
    6764    return clone;
    6865}
  • trunk/Source/JavaScriptCore/runtime/JSMapIterator.h

    r205504 r205507  
    11/*
    2  * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
     2 * Copyright (C) 2013 Apple, Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
     
    3535
    3636class JSMapIterator : public JSNonFinalObject {
    37     typedef HashMapBucket<HashMapBucketDataKeyValue> HashMapBucketType;
    3837public:
    3938    typedef JSNonFinalObject Base;
     
    5352    }
    5453
    55     ALWAYS_INLINE HashMapBucketType* advanceIter(ExecState* exec)
     54    bool next(CallFrame* callFrame, JSValue& value)
    5655    {
    57         HashMapBucketType* prev = m_iter.get();
    58         if (!prev)
    59             return nullptr;
    60         HashMapBucketType* bucket = m_iter->next();
    61         while (bucket && bucket->deleted()) {
    62             prev = bucket;
    63             bucket = bucket->next();
    64         }
    65         if (!bucket) {
    66             setIterator(exec->vm(), nullptr);
    67             return nullptr;
    68         }
    69         setIterator(exec->vm(), bucket); // We keep m_iter on the last value since the first thing we do in this function is call next().
    70         return bucket;
    71     }
    72     bool next(ExecState* exec, JSValue& value)
    73     {
    74         HashMapBucketType* bucket = advanceIter(exec);
    75         if (!bucket)
     56        WTF::KeyValuePair<JSValue, JSValue> pair;
     57        if (!m_iterator.next(pair))
    7658            return false;
    7759
    7860        if (m_kind == IterateValue)
    79             value = bucket->value();
     61            value = pair.value;
    8062        else if (m_kind == IterateKey)
    81             value = bucket->key();
     63            value = pair.key;
    8264        else
    83             value = createPair(exec, bucket->key(), bucket->value());
     65            value = createPair(callFrame, pair.key, pair.value);
    8466        return true;
    8567    }
    8668
    87     bool nextKeyValue(ExecState* exec, JSValue& key, JSValue& value)
     69    bool nextKeyValue(JSValue& key, JSValue& value)
    8870    {
    89         HashMapBucketType* bucket = advanceIter(exec);
    90         if (!bucket)
     71        WTF::KeyValuePair<JSValue, JSValue> pair;
     72        if (!m_iterator.next(pair))
    9173            return false;
    9274
    93         key = bucket->key();
    94         value = bucket->value();
     75        key = pair.key;
     76        value = pair.value;
    9577        return true;
     78    }
     79
     80    void finish()
     81    {
     82        m_iterator.finish();
    9683    }
    9784
     
    10087    JSMapIterator* clone(ExecState*);
    10188
     89    JSMap::MapData::IteratorData* iteratorData()
     90    {
     91        return &m_iterator;
     92    }
     93
    10294private:
    103     JSMapIterator(VM& vm, Structure* structure, JSMap*, IterationKind kind)
     95    JSMapIterator(VM& vm, Structure* structure, JSMap* iteratedObject, IterationKind kind)
    10496        : Base(vm, structure)
     97        , m_iterator(iteratedObject->m_mapData.createIteratorData(this))
    10598        , m_kind(kind)
    106     { }
    107 
    108     void setIterator(VM& vm, HashMapBucketType* bucket)
    10999    {
    110         m_iter.setMayBeNull(vm, this, bucket);
    111100    }
    112101
     
    116105
    117106    WriteBarrier<JSMap> m_map;
    118     WriteBarrier<HashMapBucketType> m_iter;
     107    JSMap::MapData::IteratorData m_iterator;
    119108    IterationKind m_kind;
    120109};
  • trunk/Source/JavaScriptCore/runtime/JSModuleLoader.cpp

    r205504 r205507  
    5656}
    5757
    58 void JSModuleLoader::finishCreation(ExecState* exec, VM& vm, JSGlobalObject* globalObject)
     58void JSModuleLoader::finishCreation(VM& vm, JSGlobalObject* globalObject)
    5959{
    6060    Base::finishCreation(vm);
    6161    ASSERT(inherits(info()));
    62     auto scope = DECLARE_THROW_SCOPE(vm);
    63     JSMap* map = JSMap::create(exec, vm, globalObject->mapStructure());
    64     RELEASE_ASSERT(!scope.exception());
    65     putDirect(vm, Identifier::fromString(&vm, "registry"), map);
     62    putDirect(vm, Identifier::fromString(&vm, "registry"), JSMap::create(vm, globalObject->mapStructure()));
    6663}
    6764
  • trunk/Source/JavaScriptCore/runtime/JSModuleLoader.h

    r205504 r205507  
    4848    };
    4949
    50     static JSModuleLoader* create(ExecState* exec, VM& vm, JSGlobalObject* globalObject, Structure* structure)
     50    static JSModuleLoader* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
    5151    {
    5252        JSModuleLoader* object = new (NotNull, allocateCell<JSModuleLoader>(vm.heap)) JSModuleLoader(vm, structure);
    53         object->finishCreation(exec, vm, globalObject);
     53        object->finishCreation(vm, globalObject);
    5454        return object;
    5555    }
     
    7878
    7979protected:
    80     void finishCreation(ExecState*, VM&, JSGlobalObject*);
     80    void finishCreation(VM&, JSGlobalObject*);
    8181};
    8282
  • trunk/Source/JavaScriptCore/runtime/JSModuleRecord.cpp

    r205504 r205507  
    4545}
    4646
    47 void JSModuleRecord::finishCreation(ExecState* exec, VM& vm)
     47void JSModuleRecord::finishCreation(VM& vm)
    4848{
    4949    Base::finishCreation(vm);
     
    5252    putDirect(vm, Identifier::fromString(&vm, ASCIILiteral("evaluated")), jsBoolean(false));
    5353
    54     auto scope = DECLARE_THROW_SCOPE(vm);
    55     JSMap* map = JSMap::create(exec, vm, globalObject()->mapStructure());
    56     RELEASE_ASSERT(!scope.exception());
    57     m_dependenciesMap.set(vm, this, map);
     54    m_dependenciesMap.set(vm, this, JSMap::create(vm, globalObject()->mapStructure()));
    5855    putDirect(vm, Identifier::fromString(&vm, ASCIILiteral("dependenciesMap")), m_dependenciesMap.get());
    5956}
  • trunk/Source/JavaScriptCore/runtime/JSModuleRecord.h

    r205504 r205507  
    8888    }
    8989
    90     static JSModuleRecord* create(ExecState* exec, VM& vm, Structure* structure, const Identifier& moduleKey, const SourceCode& sourceCode, const VariableEnvironment& declaredVariables, const VariableEnvironment& lexicalVariables)
     90    static JSModuleRecord* create(VM& vm, Structure* structure, const Identifier& moduleKey, const SourceCode& sourceCode, const VariableEnvironment& declaredVariables, const VariableEnvironment& lexicalVariables)
    9191    {
    9292        JSModuleRecord* instance = new (NotNull, allocateCell<JSModuleRecord>(vm.heap)) JSModuleRecord(vm, structure, moduleKey, sourceCode, declaredVariables, lexicalVariables);
    93         instance->finishCreation(exec, vm);
     93        instance->finishCreation(vm);
    9494        return instance;
    9595    }
     
    153153    }
    154154
    155     void finishCreation(ExecState*, VM&);
     155    void finishCreation(VM&);
    156156
    157157    JSModuleNamespaceObject* getModuleNamespace(ExecState*);
  • trunk/Source/JavaScriptCore/runtime/JSSet.cpp

    r205504 r205507  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
     
    2727#include "JSSet.h"
    2828
    29 #include "JSCInlines.h"
     29#include "CopiedBlockInlines.h"
     30#include "JSCJSValueInlines.h"
     31#include "JSSetIterator.h"
     32#include "MapDataInlines.h"
     33#include "SlotVisitorInlines.h"
     34#include "StructureInlines.h"
    3035
    3136namespace JSC {
    3237
    3338const ClassInfo JSSet::s_info = { "Set", &Base::s_info, 0, CREATE_METHOD_TABLE(JSSet) };
     39
     40void JSSet::destroy(JSCell* cell)
     41{
     42    JSSet* thisObject = jsCast<JSSet*>(cell);
     43    thisObject->JSSet::~JSSet();
     44}
    3445
    3546String JSSet::toStringName(const JSObject*, ExecState*)
     
    3849}
    3950
     51size_t JSSet::estimatedSize(JSCell* cell)
     52{
     53    JSSet* thisObject = jsCast<JSSet*>(cell);
     54    size_t setDataSize = thisObject->m_setData.capacityInBytes();
     55    return Base::estimatedSize(cell) + setDataSize;
    4056}
     57
     58void JSSet::visitChildren(JSCell* cell, SlotVisitor& visitor)
     59{
     60    Base::visitChildren(cell, visitor);
     61    jsCast<JSSet*>(cell)->m_setData.visitChildren(cell, visitor);
     62}
     63
     64void JSSet::copyBackingStore(JSCell* cell, CopyVisitor& visitor, CopyToken token)
     65{
     66    Base::copyBackingStore(cell, visitor, token);
     67    jsCast<JSSet*>(cell)->m_setData.copyBackingStore(visitor, token);
     68}
     69
     70bool JSSet::has(ExecState* exec, JSValue value)
     71{
     72    return m_setData.contains(exec, value);
     73}
     74
     75size_t JSSet::size(ExecState* exec)
     76{
     77    return m_setData.size(exec);
     78}
     79
     80void JSSet::add(ExecState* exec, JSValue value)
     81{
     82    m_setData.set(exec, this, value, value);
     83}
     84
     85void JSSet::clear(ExecState*)
     86{
     87    m_setData.clear();
     88}
     89
     90bool JSSet::remove(ExecState* exec, JSValue value)
     91{
     92    return m_setData.remove(exec, value);
     93}
     94
     95}
  • trunk/Source/JavaScriptCore/runtime/JSSet.h

    r205504 r205507  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
     
    2727#define JSSet_h
    2828
     29#include "JSDestructibleObject.h"
    2930#include "JSObject.h"
    30 #include "MapBase.h"
     31#include "MapData.h"
    3132
    3233namespace JSC {
     
    3435class JSSetIterator;
    3536
    36 class JSSet : public MapBase<HashMapBucket<HashMapBucketDataKey>> {
    37     typedef MapBase<HashMapBucket<HashMapBucketDataKey>> Base;
     37class JSSet : public JSDestructibleObject {
    3838public:
     39    typedef JSDestructibleObject Base;
    3940
    4041    friend class JSSetIterator;
     42
     43    // Our marking functions expect Entry to maintain this layout, and have all
     44    // fields be WriteBarrier<Unknown>
     45    class Entry {
     46    private:
     47        WriteBarrier<Unknown> m_key;
     48
     49    public:
     50        const WriteBarrier<Unknown>& key() const
     51        {
     52            return m_key;
     53        }
     54
     55        const WriteBarrier<Unknown>& value() const
     56        {
     57            return m_key;
     58        }
     59
     60        void visitChildren(SlotVisitor& visitor)
     61        {
     62            visitor.append(&m_key);
     63        }
     64
     65        void setKey(VM& vm, const JSCell* owner, JSValue key)
     66        {
     67            m_key.set(vm, owner, key);
     68        }
     69
     70        void setKeyWithoutWriteBarrier(JSValue key)
     71        {
     72            m_key.setWithoutWriteBarrier(key);
     73        }
     74
     75        void setValue(VM&, const JSCell*, JSValue)
     76        {
     77        }
     78
     79        void clear()
     80        {
     81            m_key.clear();
     82        }
     83    };
     84
     85    typedef MapDataImpl<Entry, JSSetIterator> SetData;
    4186
    4287    DECLARE_EXPORT_INFO;
     
    4489    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
    4590    {
    46         return Structure::create(vm, globalObject, prototype, TypeInfo(JSSetType, StructureFlags), info());
     91        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
    4792    }
    4893
    49     static JSSet* create(ExecState* exec, VM& vm, Structure* structure)
     94    static JSSet* create(VM& vm, Structure* structure)
    5095    {
    5196        JSSet* instance = new (NotNull, allocateCell<JSSet>(vm.heap)) JSSet(vm, structure);
    52         instance->finishCreation(exec, vm);
     97        instance->finishCreation(vm);
    5398        return instance;
    5499    }
    55100
    56     ALWAYS_INLINE void add(ExecState* exec, JSValue key)
     101    static JSSet* create(ExecState* exec, Structure* structure)
    57102    {
    58         m_map->add(exec, key);
     103        return create(exec->vm(), structure);
    59104    }
     105
     106    bool has(ExecState*, JSValue);
     107    size_t size(ExecState*);
     108    JS_EXPORT_PRIVATE void add(ExecState*, JSValue);
     109    void clear(ExecState*);
     110    bool remove(ExecState*, JSValue);
    60111
    61112private:
    62113    JSSet(VM& vm, Structure* structure)
    63114        : Base(vm, structure)
     115        , m_setData(vm, this)
    64116    {
    65117    }
    66118
     119    static void destroy(JSCell*);
     120    static size_t estimatedSize(JSCell*);
     121    static void visitChildren(JSCell*, SlotVisitor&);
     122    static void copyBackingStore(JSCell*, CopyVisitor&, CopyToken);
    67123    static String toStringName(const JSObject*, ExecState*);
     124
     125    SetData m_setData;
    68126};
    69127
  • trunk/Source/JavaScriptCore/runtime/JSSetIterator.cpp

    r205504 r205507  
    3939    Base::finishCreation(vm);
    4040    m_set.set(vm, this, iteratedObject);
    41     setIterator(vm, m_set->impl()->head());
    4241}
    4342
     
    4847    Base::visitChildren(thisObject, visitor);
    4948    visitor.append(&thisObject->m_set);
    50     visitor.append(&thisObject->m_iter);
    5149}
    5250
     
    6260JSSetIterator* JSSetIterator::clone(ExecState* exec)
    6361{
    64     VM& vm = exec->vm();
    65     auto clone = JSSetIterator::create(vm, exec->callee()->globalObject()->setIteratorStructure(), m_set.get(), m_kind);
    66     clone->setIterator(vm, m_iter.get());
     62    auto clone = JSSetIterator::create(exec->vm(), exec->callee()->globalObject()->setIteratorStructure(), m_set.get(), m_kind);
     63    clone->m_iterator = m_iterator;
    6764    return clone;
    6865}
  • trunk/Source/JavaScriptCore/runtime/JSSetIterator.h

    r205504 r205507  
    11/*
    2  * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
     2 * Copyright (C) 2013 Apple, Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
     
    3636
    3737class JSSetIterator : public JSNonFinalObject {
    38     typedef HashMapBucket<HashMapBucketDataKey> HashMapBucketType;
    3938public:
    4039    typedef JSNonFinalObject Base;
     
    5453    }
    5554
    56     ALWAYS_INLINE HashMapBucketType* advanceIter(ExecState* exec)
     55    bool next(CallFrame* callFrame, JSValue& value)
    5756    {
    58         HashMapBucketType* prev = m_iter.get();
    59         if (!prev)
    60             return nullptr;
    61         HashMapBucketType* bucket = m_iter->next();
    62         while (bucket && bucket->deleted()) {
    63             prev = bucket;
    64             bucket = bucket->next();
    65         }
    66         if (!bucket) {
    67             setIterator(exec->vm(), nullptr);
    68             return nullptr;
    69         }
    70         setIterator(exec->vm(), bucket); // We keep m_iter on the last value since the first thing we do in this function is call next().
    71         return bucket;
     57        WTF::KeyValuePair<JSValue, JSValue> pair;
     58        if (!m_iterator.next(pair))
     59            return false;
     60        if (m_kind == IterateValue || m_kind == IterateKey)
     61            value = pair.key;
     62        else
     63            value = createPair(callFrame, pair.key, pair.key);
     64        return true;
    7265    }
    7366
    74     bool next(ExecState* exec, JSValue& value)
     67    void finish()
    7568    {
    76         HashMapBucketType* bucket = advanceIter(exec);
    77         if (!bucket)
    78             return false;
    79 
    80         if (m_kind == IterateValue || m_kind == IterateKey)
    81             value = bucket->key();
    82         else
    83             value = createPair(exec, bucket->key(), bucket->key());
    84         return true;
     69        m_iterator.finish();
    8570    }
    8671
     
    8974    JSSetIterator* clone(ExecState*);
    9075
     76    JSSet::SetData::IteratorData* iteratorData()
     77    {
     78        return &m_iterator;
     79    }
     80
    9181private:
    92     JSSetIterator(VM& vm, Structure* structure, JSSet*, IterationKind kind)
     82    JSSetIterator(VM& vm, Structure* structure, JSSet* iteratedObject, IterationKind kind)
    9383        : Base(vm, structure)
     84        , m_iterator(iteratedObject->m_setData.createIteratorData(this))
    9485        , m_kind(kind)
    9586    {
    96     }
    97 
    98     void setIterator(VM& vm, HashMapBucketType* bucket)
    99     {
    100         m_iter.setMayBeNull(vm, this, bucket);
    10187    }
    10288
     
    10692
    10793    WriteBarrier<JSSet> m_set;
    108     WriteBarrier<HashMapBucketType> m_iter;
     94    JSSet::SetData::IteratorData m_iterator;
    10995    IterationKind m_kind;
    11096};
  • trunk/Source/JavaScriptCore/runtime/JSType.h

    r205504 r205507  
    8383    RegExpObjectType,
    8484    ProxyObjectType,
    85     JSMapType,
    86     JSSetType,
    8785
    88     LastJSCObjectType = JSSetType,
     86    LastJSCObjectType = ProxyObjectType,
    8987};
    9088
  • trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp

    r205504 r205507  
    6262    JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
    6363    Structure* mapStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->mapStructure());
    64     if (UNLIKELY(scope.exception()))
     64    if (exec->hadException())
    6565        return JSValue::encode(JSValue());
    66     JSMap* map = JSMap::create(exec, vm, mapStructure);
    67     if (UNLIKELY(scope.exception()))
    68         return JSValue::encode(JSValue());
     66    JSMap* map = JSMap::create(exec, mapStructure);
    6967    JSValue iterable = exec->argument(0);
    7068    if (iterable.isUndefinedOrNull())
  • trunk/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp

    r205504 r205507  
    5959    if (iterator->next(callFrame, result))
    6060        return JSValue::encode(createIteratorResultObject(callFrame, result, false));
     61    iterator->finish();
    6162    return JSValue::encode(createIteratorResultObject(callFrame, jsUndefined(), true));
    6263}
  • trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp

    r205504 r205507  
    6969    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, mapProtoFuncClear, DontEnum, 0);
    7070    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, mapProtoFuncDelete, DontEnum, 1);
    71     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->get, mapProtoFuncGet, DontEnum, 1, JSMapGetIntrinsic);
    72     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, mapProtoFuncHas, DontEnum, 1, JSMapHasIntrinsic);
     71    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->get, mapProtoFuncGet, DontEnum, 1);
     72    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, mapProtoFuncHas, DontEnum, 1);
    7373    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->set, mapProtoFuncSet, DontEnum, 2);
    7474    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().keysPublicName(), mapProtoFuncKeys, DontEnum, 0);
    7575    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().valuesPublicName(), mapProtoFuncValues, DontEnum, 0);
    7676
    77     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getPrivateName(), mapProtoFuncGet, DontEnum, 1, JSMapGetIntrinsic);
     77    // Private get / set operations.
     78    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getPrivateName(), mapProtoFuncGet, DontEnum, 1);
    7879    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().setPrivateName(), mapProtoFuncSet, DontEnum, 2);
    7980
     
    9192    auto scope = DECLARE_THROW_SCOPE(vm);
    9293
    93     if (UNLIKELY(!thisValue.isCell())) {
     94    if (!thisValue.isObject()) {
    9495        throwVMError(callFrame, scope, createNotAnObjectError(callFrame, thisValue));
    9596        return nullptr;
    9697    }
    97 
    98     if (LIKELY(thisValue.asCell()->type() == JSMapType))
    99         return jsCast<JSMap*>(thisValue);
    100     throwTypeError(callFrame, scope, ASCIILiteral("Map operation called on non-Map object"));
    101     return nullptr;
    102 }
    103 
    104 EncodedJSValue JSC_HOST_CALL privateFuncIsMap(ExecState* exec)
    105 {
    106     JSValue value = exec->uncheckedArgument(0);
    107     return JSValue::encode(jsBoolean(value.isCell() && value.asCell()->type() == JSMapType));
     98    JSMap* map = jsDynamicCast<JSMap*>(thisValue);
     99    if (!map) {
     100        throwTypeError(callFrame, scope, ASCIILiteral("Map operation called on non-Map object"));
     101        return nullptr;
     102    }
     103    return map;
    108104}
    109105
     
    192188}
    193189
     190EncodedJSValue JSC_HOST_CALL privateFuncIsMap(ExecState* exec)
     191{
     192    return JSValue::encode(jsBoolean(jsDynamicCast<JSMap*>(exec->uncheckedArgument(0))));
     193}
     194
    194195EncodedJSValue JSC_HOST_CALL privateFuncMapIterator(ExecState* exec)
    195196{
     
    204205    JSMapIterator* iterator = jsCast<JSMapIterator*>(exec->thisValue());
    205206    JSValue key, value;
    206     if (iterator->nextKeyValue(exec, key, value)) {
     207    if (iterator->nextKeyValue(key, value)) {
    207208        JSArray* resultArray = jsCast<JSArray*>(exec->uncheckedArgument(0));
    208209        resultArray->putDirectIndex(exec, 0, key);
     
    210211        return JSValue::encode(jsBoolean(false));
    211212    }
     213    iterator->finish();
    212214    return JSValue::encode(jsBoolean(true));
    213215}
  • trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp

    r205504 r205507  
    192192}
    193193
     194// See ES5.1 9.12
     195bool sameValue(ExecState* exec, JSValue a, JSValue b)
     196{
     197    if (!a.isNumber())
     198        return JSValue::strictEqual(exec, a, b);
     199    if (!b.isNumber())
     200        return false;
     201    double x = a.asNumber();
     202    double y = b.asNumber();
     203    bool xIsNaN = std::isnan(x);
     204    bool yIsNaN = std::isnan(y);
     205    if (xIsNaN || yIsNaN)
     206        return xIsNaN && yIsNaN;
     207    return bitwise_cast<uint64_t>(x) == bitwise_cast<uint64_t>(y);
     208}
     209
    194210bool PropertyDescriptor::equalTo(ExecState* exec, const PropertyDescriptor& other) const
    195211{
  • trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.h

    r205504 r205507  
    3232
    3333class GetterSetter;
     34
     35// See ES5.1 9.12
     36bool sameValue(ExecState*, JSValue, JSValue);
    3437
    3538class PropertyDescriptor {
  • trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp

    r205504 r205507  
    6363    JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
    6464    Structure* setStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->setStructure());
    65     if (UNLIKELY(scope.exception()))
     65    if (exec->hadException())
    6666        return JSValue::encode(JSValue());
    67     JSSet* set = JSSet::create(exec, vm, setStructure);
    68     if (UNLIKELY(scope.exception()))
    69         return JSValue::encode(JSValue());
     67    JSSet* set = JSSet::create(exec, setStructure);
    7068    JSValue iterable = exec->argument(0);
    7169    if (iterable.isUndefinedOrNull())
  • trunk/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp

    r205504 r205507  
    5959    if (iterator->next(callFrame, result))
    6060        return JSValue::encode(createIteratorResultObject(callFrame, result, false));
     61    iterator->finish();
    6162    return JSValue::encode(createIteratorResultObject(callFrame, jsUndefined(), true));
    6263}
  • trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp

    r205504 r205507  
    6969    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, setProtoFuncClear, DontEnum, 0);
    7070    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, setProtoFuncDelete, DontEnum, 1);
    71     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, setProtoFuncHas, DontEnum, 1, JSSetHasIntrinsic);
     71    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, setProtoFuncHas, DontEnum, 1);
    7272    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().entriesPublicName(), setProtoFuncEntries, DontEnum, 0);
    7373
     
    8686    auto scope = DECLARE_THROW_SCOPE(vm);
    8787
    88     if (UNLIKELY(!thisValue.isCell())) {
     88    if (!thisValue.isObject()) {
    8989        throwVMError(callFrame, scope, createNotAnObjectError(callFrame, thisValue));
    9090        return nullptr;
    9191    }
    92     if (LIKELY(thisValue.asCell()->type() == JSSetType))
    93         return jsCast<JSSet*>(thisValue);
    94     throwTypeError(callFrame, scope, ASCIILiteral("Set operation called on non-Set object"));
    95     return nullptr;
     92    JSSet* set = jsDynamicCast<JSSet*>(thisValue);
     93    if (!set) {
     94        throwTypeError(callFrame, scope, ASCIILiteral("Set operation called on non-Set object"));
     95        return nullptr;
     96    }
     97    return set;
    9698}
    9799
     
    183185        return JSValue::encode(jsBoolean(false));
    184186    }
     187    iterator->finish();
    185188    return JSValue::encode(jsBoolean(true));
    186189}
  • trunk/Source/JavaScriptCore/runtime/VM.cpp

    r205504 r205507  
    6666#include "JSLexicalEnvironment.h"
    6767#include "JSLock.h"
    68 #include "JSMap.h"
    6968#include "JSPromiseDeferred.h"
    7069#include "JSPropertyNameEnumerator.h"
     
    255254    webAssemblyCodeBlockStructure.set(*this, WebAssemblyCodeBlock::createStructure(*this, 0, jsNull()));
    256255#endif
    257     hashMapBucketSetStructure.set(*this, HashMapBucket<HashMapBucketDataKey>::createStructure(*this, 0, jsNull()));
    258     hashMapBucketMapStructure.set(*this, HashMapBucket<HashMapBucketDataKeyValue>::createStructure(*this, 0, jsNull()));
    259     hashMapImplSetStructure.set(*this, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::createStructure(*this, 0, jsNull()));
    260     hashMapImplMapStructure.set(*this, HashMapImpl<HashMapBucket<HashMapBucketDataKeyValue>>::createStructure(*this, 0, jsNull()));
    261256
    262257    iterationTerminator.set(*this, JSFinalObject::create(*this, JSFinalObject::createStructure(*this, 0, jsNull(), 1)));
  • trunk/Source/JavaScriptCore/runtime/VM.h

    r205504 r205507  
    335335    Strong<Structure> functionCodeBlockStructure;
    336336    Strong<Structure> webAssemblyCodeBlockStructure;
    337     Strong<Structure> hashMapBucketSetStructure;
    338     Strong<Structure> hashMapBucketMapStructure;
    339     Strong<Structure> hashMapImplSetStructure;
    340     Strong<Structure> hashMapImplMapStructure;
    341337
    342338    Strong<JSCell> iterationTerminator;
  • trunk/Source/WTF/ChangeLog

    r205504 r205507  
     12016-09-06  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r205504.
     4        https://bugs.webkit.org/show_bug.cgi?id=161645
     5
     6        Broke the iOS device build (Requested by ryanhaddad on
     7        #webkit).
     8
     9        Reverted changeset:
     10
     11        "Make JSMap and JSSet faster"
     12        https://bugs.webkit.org/show_bug.cgi?id=160989
     13        http://trac.webkit.org/changeset/205504
     14
    1152016-09-06  Saam Barati  <sbarati@apple.com>
    216
  • trunk/Source/WTF/wtf/text/StringImpl.h

    r205504 r205507  
    149149
    150150    // The bottom 6 bits in the hash are flags.
    151 public:
    152151    static const unsigned s_flagCount = 6;
    153 private:
    154152    static const unsigned s_flagMask = (1u << s_flagCount) - 1;
    155153    COMPILE_ASSERT(s_flagCount <= StringHasher::flagCount, StringHasher_reserves_enough_bits_for_StringImpl_flags);
  • trunk/Source/WebCore/ChangeLog

    r205506 r205507  
     12016-09-06  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r205504.
     4        https://bugs.webkit.org/show_bug.cgi?id=161645
     5
     6        Broke the iOS device build (Requested by ryanhaddad on
     7        #webkit).
     8
     9        Reverted changeset:
     10
     11        "Make JSMap and JSSet faster"
     12        https://bugs.webkit.org/show_bug.cgi?id=160989
     13        http://trac.webkit.org/changeset/205504
     14
    1152016-09-06  Zalan Bujtas  <zalan@apple.com>
    216
  • trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp

    r205504 r205507  
    13691369                JSMapIterator* iterator = mapIteratorStack.last();
    13701370                JSValue key, value;
    1371                 if (!iterator->nextKeyValue(m_exec, key, value)) {
     1371                if (!iterator->nextKeyValue(key, value)) {
    13721372                    mapIteratorStack.removeLast();
    13731373                    JSObject* object = inputObjectStack.last();
     
    25462546            if (outputObjectStack.size() > maximumFilterRecursion)
    25472547                return std::make_pair(JSValue(), StackOverflowError);
    2548             JSMap* map = JSMap::create(m_exec, m_exec->vm(), m_globalObject->mapStructure());
    2549             if (UNLIKELY(m_exec->hadException()))
    2550                 goto error;
     2548            JSMap* map = JSMap::create(m_exec->vm(), m_globalObject->mapStructure());
    25512549            m_gcBuffer.append(map);
    25522550            outputObjectStack.append(map);
     
    25772575            if (outputObjectStack.size() > maximumFilterRecursion)
    25782576                return std::make_pair(JSValue(), StackOverflowError);
    2579             JSSet* set = JSSet::create(m_exec, m_exec->vm(), m_globalObject->setStructure());
    2580             if (UNLIKELY(m_exec->hadException()))
    2581                 goto error;
     2577            JSSet* set = JSSet::create(m_exec->vm(), m_globalObject->setStructure());
    25822578            m_gcBuffer.append(set);
    25832579            outputObjectStack.append(set);
Note: See TracChangeset for help on using the changeset viewer.