Imported WebKit commit c7503cef7ecb236730d1309676ab9fc723fd061d (http://svn.webkit.org/repository/webkit/trunk@128886)

New snapshot with various build fixes

3 files changed, 31 insertions, 3 deletions

diff --git a/Source/JavaScriptCore/bytecode/ArrayProfile.cpp b/Source/JavaScriptCore/bytecode/ArrayProfile.cpp
index 6b97f7806..9f4e1ce20 100644
--- a/Source/JavaScriptCore/bytecode/ArrayProfile.cpp
+++ b/Source/JavaScriptCore/bytecode/ArrayProfile.cpp
@@ -43,6 +43,11 @@ void ArrayProfile::computeUpdatedPrediction(OperationInProgress operation)
         m_lastSeenStructure = 0;
     }
     
+    if (hasTwoOrMoreBitsSet(m_observedArrayModes)) {
+        m_structureIsPolymorphic = true;
+        m_expectedStructure = 0;
+    }
+    
     if (operation == Collection
         && m_expectedStructure
         && !Heap::isMarked(m_expectedStructure)) {
diff --git a/Source/JavaScriptCore/bytecode/ArrayProfile.h b/Source/JavaScriptCore/bytecode/ArrayProfile.h
index 312473f3c..43818d77d 100644
--- a/Source/JavaScriptCore/bytecode/ArrayProfile.h
+++ b/Source/JavaScriptCore/bytecode/ArrayProfile.h
@@ -36,7 +36,7 @@ namespace JSC {
 class LLIntOffsetsExtractor;
 
 // This is a bitfield where each bit represents an IndexingType that we have seen.
-// There are 17 indexing types (0 to 16, inclusive), so 32 bits is more than enough.
+// There are 32 indexing types, so an unsigned is enough.
 typedef unsigned ArrayModes;
 
 #define asArrayModes(type) \
@@ -44,7 +44,7 @@ typedef unsigned ArrayModes;
 
 inline ArrayModes arrayModeFromStructure(Structure* structure)
 {
-    return asArrayModes(structure->indexingTypeIncludingHistory());
+    return asArrayModes(structure->indexingType());
 }
 
 class ArrayProfile {
@@ -70,6 +70,7 @@ public:
     unsigned bytecodeOffset() const { return m_bytecodeOffset; }
     
     Structure** addressOfLastSeenStructure() { return &m_lastSeenStructure; }
+    ArrayModes* addressOfArrayModes() { return &m_observedArrayModes; }
     
     void observeStructure(Structure* structure)
     {
@@ -79,7 +80,10 @@ public:
     void computeUpdatedPrediction(OperationInProgress operation = NoOperation);
     
     Structure* expectedStructure() const { return m_expectedStructure; }
-    bool structureIsPolymorphic() const { return m_structureIsPolymorphic; }
+    bool structureIsPolymorphic() const
+    {
+        return m_structureIsPolymorphic;
+    }
     bool hasDefiniteStructure() const
     {
         return !structureIsPolymorphic() && m_expectedStructure;
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 07d1e0a06..d0c969c6d 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -1544,6 +1544,25 @@ namespace JSC {
     }
 #endif
 
+    inline JSValue ExecState::argumentAfterCapture(size_t argument)
+    {
+        if (argument >= argumentCount())
+             return jsUndefined();
+
+        if (!codeBlock())
+            return this[argumentOffset(argument)].jsValue();
+
+        if (argument >= static_cast<size_t>(codeBlock()->symbolTable()->parameterCount()))
+            return this[argumentOffset(argument)].jsValue();
+
+        const SlowArgument* slowArguments = codeBlock()->symbolTable()->slowArguments();
+        if (!slowArguments || slowArguments[argument].status == SlowArgument::Normal)
+            return this[argumentOffset(argument)].jsValue();
+
+        ASSERT(slowArguments[argument].status == SlowArgument::Captured);
+        return this[slowArguments[argument].indexIfCaptured].jsValue();
+    }
+
 #if ENABLE(DFG_JIT)
     inline void DFGCodeBlocks::mark(void* candidateCodeBlock)
     {