webkitgtk-2.4.11webkitgtk-2.4.11

1 files changed, 22 insertions, 59 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGArrayMode.h b/Source/JavaScriptCore/dfg/DFGArrayMode.h
index a170fe6db..cbb87bd93 100644
--- a/Source/JavaScriptCore/dfg/DFGArrayMode.h
+++ b/Source/JavaScriptCore/dfg/DFGArrayMode.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #ifndef DFGArrayMode_h
 #define DFGArrayMode_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(DFG_JIT)
 
 #include "ArrayProfile.h"
@@ -53,7 +55,6 @@ enum Action {
 
 enum Type {
     SelectUsingPredictions, // Implies that we need predictions to decide. We will never get to the backend in this mode.
-    SelectUsingArguments, // Implies that we use the Node's arguments to decide. We will never get to the backend in this mode.
     Unprofiled, // Implies that array profiling didn't see anything. But that could be because the operands didn't comply with basic type assumptions (base is cell, property is int). This either becomes Generic or ForceExit depending on value profiling.
     ForceExit, // Implies that we have no idea how to execute this operation, so we should just give up.
     Generic,
@@ -66,9 +67,7 @@ enum Type {
     ArrayStorage,
     SlowPutArrayStorage,
     
-    DirectArguments,
-    ScopedArguments,
-    
+    Arguments,
     Int8Array,
     Int16Array,
     Int32Array,
@@ -77,8 +76,7 @@ enum Type {
     Uint16Array,
     Uint32Array,
     Float32Array,
-    Float64Array,
-    AnyTypedArray
+    Float64Array
 };
 
 enum Class {
@@ -91,14 +89,14 @@ enum Class {
 
 enum Speculation {
     SaneChain, // In bounds and the array prototype chain is still intact, i.e. loading a hole doesn't require special treatment.
-    
     InBounds, // In bounds and not loading a hole.
     ToHole, // Potentially storing to a hole.
     OutOfBounds // Out-of-bounds access and anything can happen.
 };
 enum Conversion {
     AsIs,
-    Convert
+    Convert,
+    RageConvert
 };
 } // namespace Array
 
@@ -111,7 +109,6 @@ IndexingType toIndexingShape(Array::Type);
 
 TypedArrayType toTypedArrayType(Array::Type);
 Array::Type toArrayType(TypedArrayType);
-Array::Type refineTypedArrayType(Array::Type, TypedArrayType);
 
 bool permitsBoundsCheckLowering(Array::Type);
 
@@ -176,15 +173,11 @@ public:
         return ArrayMode(type(), arrayClass(), speculation, conversion());
     }
     
-    ArrayMode withArrayClass(Array::Class arrayClass) const
-    {
-        return ArrayMode(type(), arrayClass, speculation(), conversion());
-    }
-    
-    ArrayMode withSpeculationFromProfile(const ConcurrentJITLocker& locker, ArrayProfile* profile, bool makeSafe) const
+    ArrayMode withProfile(const ConcurrentJITLocker& locker, ArrayProfile* profile, bool makeSafe) const
     {
         Array::Speculation mySpeculation;
-
+        Array::Class myArrayClass;
+        
         if (makeSafe)
             mySpeculation = Array::OutOfBounds;
         else if (profile->mayStoreToHole(locker))
@@ -192,13 +185,6 @@ public:
         else
             mySpeculation = Array::InBounds;
         
-        return withSpeculation(mySpeculation);
-    }
-    
-    ArrayMode withProfile(const ConcurrentJITLocker& locker, ArrayProfile* profile, bool makeSafe) const
-    {
-        Array::Class myArrayClass;
-
         if (isJSArray()) {
             if (profile->usesOriginalArrayStructures(locker) && benefitsFromOriginalArray())
                 myArrayClass = Array::OriginalArray;
@@ -207,7 +193,7 @@ public:
         } else
             myArrayClass = arrayClass();
         
-        return withArrayClass(myArrayClass).withSpeculationFromProfile(locker, profile, makeSafe);
+        return ArrayMode(type(), myArrayClass, mySpeculation, conversion());
     }
     
     ArrayMode withType(Array::Type type) const
@@ -225,9 +211,9 @@ public:
         return ArrayMode(type, arrayClass(), speculation(), conversion);
     }
     
-    ArrayMode refine(Graph&, Node*, SpeculatedType base, SpeculatedType index, SpeculatedType value = SpecNone) const;
+    ArrayMode refine(SpeculatedType base, SpeculatedType index, SpeculatedType value = SpecNone, NodeFlags = 0) const;
     
-    bool alreadyChecked(Graph&, Node*, const AbstractValue&) const;
+    bool alreadyChecked(Graph&, Node*, AbstractValue&) const;
     
     void dump(PrintStream&) const;
     
@@ -296,13 +282,10 @@ public:
     {
         switch (type()) {
         case Array::SelectUsingPredictions:
-        case Array::SelectUsingArguments:
         case Array::Unprofiled:
-        case Array::Undecided:
         case Array::ForceExit:
         case Array::Generic:
-        case Array::DirectArguments:
-        case Array::ScopedArguments:
+        case Array::Arguments:
             return false;
         default:
             return true;
@@ -312,6 +295,7 @@ public:
     bool lengthNeedsStorage() const
     {
         switch (type()) {
+        case Array::Undecided:
         case Array::Int32:
         case Array::Double:
         case Array::Contiguous:
@@ -327,9 +311,11 @@ public:
     {
         switch (type()) {
         case Array::String:
-        case Array::DirectArguments:
-        case Array::ScopedArguments:
             return ArrayMode(Array::Generic);
+#if USE(JSVALUE32_64)
+        case Array::Arguments:
+            return ArrayMode(Array::Generic);
+#endif
         default:
             return *this;
         }
@@ -339,10 +325,10 @@ public:
     {
         switch (type()) {
         case Array::SelectUsingPredictions:
-        case Array::SelectUsingArguments:
         case Array::Unprofiled:
         case Array::ForceExit:
         case Array::Generic:
+        case Array::Undecided:
             return false;
         default:
             return true;
@@ -356,16 +342,6 @@ public:
         case Array::Unprofiled:
         case Array::ForceExit:
         case Array::Generic:
-        // TypedArrays do not have a self length property as of ES6.
-        case Array::Int8Array:
-        case Array::Int16Array:
-        case Array::Int32Array:
-        case Array::Uint8Array:
-        case Array::Uint8ClampedArray:
-        case Array::Uint16Array:
-        case Array::Uint32Array:
-        case Array::Float32Array:
-        case Array::Float64Array:
             return false;
         case Array::Int32:
         case Array::Double:
@@ -386,7 +362,6 @@ public:
         case Array::Int32:
         case Array::Double:
         case Array::Contiguous:
-        case Array::Undecided:
         case Array::ArrayStorage:
             return true;
         default:
@@ -422,7 +397,7 @@ public:
         case Array::ArrayStorage:
             return arrayModesWithIndexingShape(ArrayStorageShape);
         case Array::SlowPutArrayStorage:
-            return arrayModesWithIndexingShapes(SlowPutArrayStorageShape, ArrayStorageShape);
+            return arrayModesWithIndexingShape(SlowPutArrayStorageShape);
         default:
             return asArrayModes(NonArray);
         }
@@ -442,11 +417,6 @@ public:
     {
         return toTypedArrayType(type());
     }
-
-    bool isSomeTypedArrayView() const
-    {
-        return type() == Array::AnyTypedArray || isTypedView(typedArrayType());
-    }
     
     bool operator==(const ArrayMode& other) const
     {
@@ -483,14 +453,7 @@ private:
         }
     }
     
-    ArrayModes arrayModesWithIndexingShapes(IndexingType shape1, IndexingType shape2) const
-    {
-        ArrayModes arrayMode1 = arrayModesWithIndexingShape(shape1);
-        ArrayModes arrayMode2 = arrayModesWithIndexingShape(shape2);
-        return arrayMode1 | arrayMode2;
-    }
-
-    bool alreadyChecked(Graph&, Node*, const AbstractValue&, IndexingType shape) const;
+    bool alreadyChecked(Graph&, Node*, AbstractValue&, IndexingType shape) const;
     
     union {
         struct {