Title: [206779] trunk
Revision
206779
Author
utatane....@gmail.com
Date
2016-10-04 12:34:52 -0700 (Tue, 04 Oct 2016)

Log Message

[DOMJIT] Introduce DOMJIT::GetterSetter to tell JIT information
https://bugs.webkit.org/show_bug.cgi?id=162916

Reviewed by Filip Pizlo.

Source/_javascript_Core:

In this patch, we introduce DOMJIT::GetterSetter.
This class maintains information required to emit JIT code in DFG and FTL.
DOMJIT::GetterSetter has 2 virtual functions: checkDOM and callDOM.
These functions can return a DOMJIT::Patchpoint that allows us to inject
appropriate machine code during DFG and FTL phases. DFG and FTL will invoke
these functions to get a patchpoint. And this patchpoint will be used to
emit code corresponding to CheckDOM and CallDOM DFG nodes, which will be added
in subsqeunt patch.

We propagate DOMJIT::GetterSetter through PropertySlot, AccessCase, GetByIdVariant,
and GetByIdStatus along with CustomGetter to teach DFG that this custom access
code has a chance to be inlined with this DOMJIT::GetterSetter information.
Instead of propagating CustomGetterSetter holding DOMJIT::GetterSetter and CustomGetter,
we propagate CustomGetter and DOMJIT::GetterSetter. This is because of the current
CustomGetterSetter design that we reify CustomGetterSetters only when we need to reify
all the properties. This design allows us to avoid frequent CustomGetterSetter allocations
and structure transitions.

Currently, domJIT field is always nullptr since there is no DOMJITAttribute user.
When we add this, we will add code handling this DOMJIT::GetterSetter in DFG::ByteCodeParser.

* CMakeLists.txt:
* _javascript_Core.xcodeproj/project.pbxproj:
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
* bytecode/GetByIdVariant.cpp:
(JSC::GetByIdVariant::GetByIdVariant):
(JSC::GetByIdVariant::operator=):
(JSC::GetByIdVariant::attemptToMerge):
(JSC::GetByIdVariant::dumpInContext):
* bytecode/GetByIdVariant.h:
(JSC::GetByIdVariant::domJIT):
(JSC::GetByIdVariant::intrinsic): Deleted.
* bytecode/PolymorphicAccess.cpp:
(JSC::AccessCase::get):
(JSC::AccessCase::clone):
* bytecode/PolymorphicAccess.h:
(JSC::AccessCase::domJIT):
(JSC::AccessCase::RareData::RareData):
* dfg/DFGNode.h:
* domjit/DOMJITGetterSetter.h: Added.
(JSC::DOMJIT::GetterSetter::GetterSetter):
(JSC::DOMJIT::GetterSetter::~GetterSetter):
(JSC::DOMJIT::GetterSetter::getter):
(JSC::DOMJIT::GetterSetter::setter):
(JSC::DOMJIT::GetterSetter::thisClassInfo):
* domjit/DOMJITPatchpoint.h: Added.
(JSC::DOMJIT::Patchpoint::create):
(JSC::DOMJIT::Patchpoint::setGenerator):
(JSC::DOMJIT::Patchpoint::generator):
* jit/Repatch.cpp:
(JSC::tryCacheGetByID):
* runtime/CustomGetterSetter.h:
* runtime/JSObject.h:
(JSC::JSObject::fillCustomGetterPropertySlot):
* runtime/Lookup.h:
(JSC::HashTableValue::domJIT):
(JSC::getStaticPropertySlotFromTable):
(JSC::putEntry):
(JSC::reifyStaticProperty):
* runtime/PropertySlot.h:
(JSC::PropertySlot::domJIT):
(JSC::PropertySlot::setCacheableCustom):

Source/WebCore:

* ForwardingHeaders/domjit/DOMJITGetterSetter.h: Added.
* PlatformEfl.cmake:
* PlatformGTK.cmake:
* PlatformMac.cmake:
* PlatformWin.cmake:

Source/WebKit2:

* CMakeLists.txt:

Tools:

* DumpRenderTree/CMakeLists.txt:

Modified Paths

Added Paths

Diff

Modified: trunk/Source/_javascript_Core/CMakeLists.txt (206778 => 206779)


--- trunk/Source/_javascript_Core/CMakeLists.txt	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/CMakeLists.txt	2016-10-04 19:34:52 UTC (rev 206779)
@@ -18,6 +18,7 @@
     "${_javascript_CORE_DIR}/dfg"
     "${_javascript_CORE_DIR}/disassembler"
     "${_javascript_CORE_DIR}/disassembler/udis86"
+    "${_javascript_CORE_DIR}/domjit"
     "${_javascript_CORE_DIR}/ftl"
     "${_javascript_CORE_DIR}/heap"
     "${_javascript_CORE_DIR}/debugger"
@@ -1095,6 +1096,7 @@
     debugger
     dfg
     disassembler
+    domjit
     heap
     inspector
     interpreter

Modified: trunk/Source/_javascript_Core/ChangeLog (206778 => 206779)


--- trunk/Source/_javascript_Core/ChangeLog	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-10-04 19:34:52 UTC (rev 206779)
@@ -1,3 +1,74 @@
+2016-10-04  Yusuke Suzuki  <utatane....@gmail.com>
+
+        [DOMJIT] Introduce DOMJIT::GetterSetter to tell JIT information
+        https://bugs.webkit.org/show_bug.cgi?id=162916
+
+        Reviewed by Filip Pizlo.
+
+        In this patch, we introduce DOMJIT::GetterSetter.
+        This class maintains information required to emit JIT code in DFG and FTL.
+        DOMJIT::GetterSetter has 2 virtual functions: checkDOM and callDOM.
+        These functions can return a DOMJIT::Patchpoint that allows us to inject
+        appropriate machine code during DFG and FTL phases. DFG and FTL will invoke
+        these functions to get a patchpoint. And this patchpoint will be used to
+        emit code corresponding to CheckDOM and CallDOM DFG nodes, which will be added
+        in subsqeunt patch.
+
+        We propagate DOMJIT::GetterSetter through PropertySlot, AccessCase, GetByIdVariant,
+        and GetByIdStatus along with CustomGetter to teach DFG that this custom access
+        code has a chance to be inlined with this DOMJIT::GetterSetter information.
+        Instead of propagating CustomGetterSetter holding DOMJIT::GetterSetter and CustomGetter,
+        we propagate CustomGetter and DOMJIT::GetterSetter. This is because of the current
+        CustomGetterSetter design that we reify CustomGetterSetters only when we need to reify
+        all the properties. This design allows us to avoid frequent CustomGetterSetter allocations
+        and structure transitions.
+
+        Currently, domJIT field is always nullptr since there is no DOMJITAttribute user.
+        When we add this, we will add code handling this DOMJIT::GetterSetter in DFG::ByteCodeParser.
+
+        * CMakeLists.txt:
+        * _javascript_Core.xcodeproj/project.pbxproj:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        * bytecode/GetByIdVariant.cpp:
+        (JSC::GetByIdVariant::GetByIdVariant):
+        (JSC::GetByIdVariant::operator=):
+        (JSC::GetByIdVariant::attemptToMerge):
+        (JSC::GetByIdVariant::dumpInContext):
+        * bytecode/GetByIdVariant.h:
+        (JSC::GetByIdVariant::domJIT):
+        (JSC::GetByIdVariant::intrinsic): Deleted.
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::get):
+        (JSC::AccessCase::clone):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::domJIT):
+        (JSC::AccessCase::RareData::RareData):
+        * dfg/DFGNode.h:
+        * domjit/DOMJITGetterSetter.h: Added.
+        (JSC::DOMJIT::GetterSetter::GetterSetter):
+        (JSC::DOMJIT::GetterSetter::~GetterSetter):
+        (JSC::DOMJIT::GetterSetter::getter):
+        (JSC::DOMJIT::GetterSetter::setter):
+        (JSC::DOMJIT::GetterSetter::thisClassInfo):
+        * domjit/DOMJITPatchpoint.h: Added.
+        (JSC::DOMJIT::Patchpoint::create):
+        (JSC::DOMJIT::Patchpoint::setGenerator):
+        (JSC::DOMJIT::Patchpoint::generator):
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        * runtime/CustomGetterSetter.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::fillCustomGetterPropertySlot):
+        * runtime/Lookup.h:
+        (JSC::HashTableValue::domJIT):
+        (JSC::getStaticPropertySlotFromTable):
+        (JSC::putEntry):
+        (JSC::reifyStaticProperty):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::domJIT):
+        (JSC::PropertySlot::setCacheableCustom):
+
 2016-09-27  Yusuke Suzuki  <utatane....@gmail.com>
 
         [JSC] Add a new byte code op_define_property instead of calling defineProperty

Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (206778 => 206779)


--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2016-10-04 19:34:52 UTC (rev 206779)
@@ -271,7 +271,7 @@
 		0F2DD8141AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2DD80F1AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.h */; };
 		0F2DD8151AB3D8BE00BBB8E8 /* DFGForAllKills.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2DD8101AB3D8BE00BBB8E8 /* DFGForAllKills.h */; };
 		0F2E892C16D028AD009E4FD2 /* UnusedPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 65987F2F16828A7E003C2F8D /* UnusedPointer.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51016B3A964003F696B /* DFGMinifiedID.h */; };
+		0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51016B3A964003F696B /* DFGMinifiedID.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F2FC77216E12F710038D976 /* DFGDCEPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */; };
 		0F2FC77316E12F740038D976 /* DFGDCEPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */; };
 		0F2FCCF918A60070001A27F8 /* DFGGraphSafepoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */; };
@@ -2067,6 +2067,9 @@
 		E18E3A590DF9278C00D90B34 /* VM.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18E3A570DF9278C00D90B34 /* VM.cpp */; };
 		E318CBC01B8AEF5100A2929D /* JSModuleNamespaceObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E318CBBE1B8AEF5100A2929D /* JSModuleNamespaceObject.cpp */; };
 		E318CBC11B8AEF5100A2929D /* JSModuleNamespaceObject.h in Headers */ = {isa = PBXBuildFile; fileRef = E318CBBF1B8AEF5100A2929D /* JSModuleNamespaceObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E328C6C71DA4304500D255FD /* MaxFrameExtentForSlowPathCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 65860177185A8F5E00030EEE /* MaxFrameExtentForSlowPathCall.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E328C6C81DA4306100D255FD /* RegisterAtOffsetList.h in Headers */ = {isa = PBXBuildFile; fileRef = 6540C79D1B82D99D000F6B79 /* RegisterAtOffsetList.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E328C6C91DA432F900D255FD /* RegisterAtOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 6540C79F1B82D9CE000F6B79 /* RegisterAtOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E328DAE71D38D004001A2529 /* BytecodeGeneratorification.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3D264261D38C042000BE174 /* BytecodeGeneratorification.cpp */; };
 		E328DAE81D38D005001A2529 /* BytecodeGeneratorification.h in Headers */ = {isa = PBXBuildFile; fileRef = E3D264271D38C042000BE174 /* BytecodeGeneratorification.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E328DAE91D38D005001A2529 /* BytecodeGraph.h in Headers */ = {isa = PBXBuildFile; fileRef = E3D264281D38C042000BE174 /* BytecodeGraph.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2100,10 +2103,12 @@
 		E39DA4A61B7E8B7C0084F33A /* JSModuleRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E39DA4A41B7E8B7C0084F33A /* JSModuleRecord.cpp */; };
 		E39DA4A71B7E8B7C0084F33A /* JSModuleRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = E39DA4A51B7E8B7C0084F33A /* JSModuleRecord.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E3A421431D6F58930007C617 /* PreciseJumpTargetsInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = E3A421421D6F588F0007C617 /* PreciseJumpTargetsInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3C08E3C1DA41B810039478F /* DOMJITPatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = E3C08E3B1DA41B7B0039478F /* DOMJITPatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E3D239C81B829C1C00BBEF67 /* JSModuleEnvironment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3D239C61B829C1C00BBEF67 /* JSModuleEnvironment.cpp */; };
 		E3D239C91B829C1C00BBEF67 /* JSModuleEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = E3D239C71B829C1C00BBEF67 /* JSModuleEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E3EF88741B66DF23003F26CB /* JSPropertyNameIterator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3EF88721B66DF23003F26CB /* JSPropertyNameIterator.cpp */; };
 		E3EF88751B66DF23003F26CB /* JSPropertyNameIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = E3EF88731B66DF23003F26CB /* JSPropertyNameIterator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3FF75331D9CEA1800C7E16D /* DOMJITGetterSetter.h in Headers */ = {isa = PBXBuildFile; fileRef = E3FF752F1D9CEA1200C7E16D /* DOMJITGetterSetter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E49DC15512EF277200184A1F /* SourceProviderCache.cpp */; };
 		E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC15112EF272200184A1F /* SourceProviderCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4397,6 +4402,7 @@
 		E39DA4A41B7E8B7C0084F33A /* JSModuleRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSModuleRecord.cpp; sourceTree = "<group>"; };
 		E39DA4A51B7E8B7C0084F33A /* JSModuleRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSModuleRecord.h; sourceTree = "<group>"; };
 		E3A421421D6F588F0007C617 /* PreciseJumpTargetsInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PreciseJumpTargetsInlines.h; sourceTree = "<group>"; };
+		E3C08E3B1DA41B7B0039478F /* DOMJITPatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITPatchpoint.h; sourceTree = "<group>"; };
 		E3D239C61B829C1C00BBEF67 /* JSModuleEnvironment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSModuleEnvironment.cpp; sourceTree = "<group>"; };
 		E3D239C71B829C1C00BBEF67 /* JSModuleEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSModuleEnvironment.h; sourceTree = "<group>"; };
 		E3D264261D38C042000BE174 /* BytecodeGeneratorification.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BytecodeGeneratorification.cpp; sourceTree = "<group>"; };
@@ -4406,6 +4412,7 @@
 		E3D2642A1D38C042000BE174 /* BytecodeRewriter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeRewriter.h; sourceTree = "<group>"; };
 		E3EF88721B66DF23003F26CB /* JSPropertyNameIterator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPropertyNameIterator.cpp; sourceTree = "<group>"; };
 		E3EF88731B66DF23003F26CB /* JSPropertyNameIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPropertyNameIterator.h; sourceTree = "<group>"; };
+		E3FF752F1D9CEA1200C7E16D /* DOMJITGetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITGetterSetter.h; sourceTree = "<group>"; };
 		E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCacheItem.h; sourceTree = "<group>"; };
 		E49DC15112EF272200184A1F /* SourceProviderCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCache.h; sourceTree = "<group>"; };
 		E49DC15512EF277200184A1F /* SourceProviderCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SourceProviderCache.cpp; sourceTree = "<group>"; };
@@ -4664,6 +4671,7 @@
 				650FDF8D09D0FCA700769E54 /* Derived Sources */,
 				86EC9DB31328DF44002B2AD7 /* dfg */,
 				0FF4272E158EBCCE004CB9FF /* disassembler */,
+				E3FF752D1D9CE9EA00C7E16D /* domjit */,
 				0867D69AFE84028FC02AAC07 /* Frameworks */,
 				0FEA09FC1705137F00BB722C /* ftl */,
 				142E312A134FF0A600AFADB5 /* heap */,
@@ -7170,6 +7178,15 @@
 			path = codegen;
 			sourceTree = "<group>";
 		};
+		E3FF752D1D9CE9EA00C7E16D /* domjit */ = {
+			isa = PBXGroup;
+			children = (
+				E3FF752F1D9CEA1200C7E16D /* DOMJITGetterSetter.h */,
+				E3C08E3B1DA41B7B0039478F /* DOMJITPatchpoint.h */,
+			);
+			path = domjit;
+			sourceTree = "<group>";
+		};
 /* End PBXGroup section */
 
 /* Begin PBXHeadersBuildPhase section */
@@ -7228,6 +7245,7 @@
 				0FEC858A1BDACDC70080FF74 /* AirSpillEverything.h in Headers */,
 				0FEC858C1BDACDC70080FF74 /* AirStackSlot.h in Headers */,
 				0FEC858E1BDACDC70080FF74 /* AirTmp.h in Headers */,
+				E328C6C81DA4306100D255FD /* RegisterAtOffsetList.h in Headers */,
 				0FEC858F1BDACDC70080FF74 /* AirTmpInlines.h in Headers */,
 				0FEC85911BDACDC70080FF74 /* AirValidate.h in Headers */,
 				A5EA70E919F5B1010098F5EC /* AlternateDispatchableAgent.h in Headers */,
@@ -7454,6 +7472,7 @@
 				0F2DD8121AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.h in Headers */,
 				0F2DD8141AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.h in Headers */,
 				0F485322187750560083B687 /* DFGArithMode.h in Headers */,
+				E3C08E3C1DA41B810039478F /* DOMJITPatchpoint.h in Headers */,
 				0F05C3B41683CF9200BAF45B /* DFGArrayifySlowPathGenerator.h in Headers */,
 				0F63948515E4811B006A597C /* DFGArrayMode.h in Headers */,
 				A7D9A29517A0BC7400EE2618 /* DFGAtTailAbstractState.h in Headers */,
@@ -7615,6 +7634,7 @@
 				0FC20CBA18556A3500C9E954 /* DFGSSALoweringPhase.h in Headers */,
 				0F9FB4F517FCB91700CB67F8 /* DFGStackLayoutPhase.h in Headers */,
 				0F4F29E018B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h in Headers */,
+				E3FF75331D9CEA1800C7E16D /* DOMJITGetterSetter.h in Headers */,
 				0F9E32641B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.h in Headers */,
 				0FC20CB61852E2C600C9E954 /* DFGStrengthReductionPhase.h in Headers */,
 				0F63947815DCE34B006A597C /* DFGStructureAbstractValue.h in Headers */,
@@ -7839,6 +7859,7 @@
 				A57D23E61890CEBF0031C7FA /* InspectorDebuggerAgent.h in Headers */,
 				A5D0A1BB1862301B00C7B496 /* InspectorEnvironment.h in Headers */,
 				A5945595182479EB00CC3843 /* InspectorFrontendChannel.h in Headers */,
+				E328C6C71DA4304500D255FD /* MaxFrameExtentForSlowPathCall.h in Headers */,
 				A532438A18568335002ED692 /* InspectorFrontendDispatchers.h in Headers */,
 				99F1A7011B98FBEC00463B26 /* InspectorFrontendRouter.h in Headers */,
 				A5339EC61BB399A60054F005 /* InspectorHeapAgent.h in Headers */,
@@ -8175,6 +8196,7 @@
 				0FCCAE4516D0CF7400D0C65B /* ParserError.h in Headers */,
 				DCF3D56A1CD29470003D5C65 /* LazyClassStructure.h in Headers */,
 				A77F1825164192C700640A47 /* ParserModes.h in Headers */,
+				E328C6C91DA432F900D255FD /* RegisterAtOffset.h in Headers */,
 				65303D641447B9E100D3F904 /* ParserTokens.h in Headers */,
 				0FF9CE741B9CD6D0004EDCA6 /* PolymorphicAccess.h in Headers */,
 				0FE834181A6EF97B00D04847 /* PolymorphicCallStubRoutine.h in Headers */,

Modified: trunk/Source/_javascript_Core/bytecode/GetByIdStatus.cpp (206778 => 206779)


--- trunk/Source/_javascript_Core/bytecode/GetByIdStatus.cpp	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/bytecode/GetByIdStatus.cpp	2016-10-04 19:34:52 UTC (rev 206779)
@@ -37,6 +37,9 @@
 #include <wtf/ListDump.h>
 
 namespace JSC {
+namespace DOMJIT {
+class GetterSetter;
+}
 
 bool GetByIdStatus::appendVariant(const GetByIdVariant& variant)
 {
@@ -215,6 +218,7 @@
             case ComplexGetStatus::Inlineable: {
                 std::unique_ptr<CallLinkStatus> callLinkStatus;
                 JSFunction* intrinsicFunction = nullptr;
+                DOMJIT::GetterSetter* domJIT = nullptr;
 
                 switch (access.type()) {
                 case AccessCase::Load:
@@ -234,6 +238,12 @@
                     }
                     break;
                 }
+                case AccessCase::CustomAccessorGetter: {
+                    domJIT = access.domJIT();
+                    if (!domJIT)
+                        return GetByIdStatus(slowPathState, true);
+                    break;
+                }
                 default: {
                     // FIXME: It would be totally sweet to support more of these at some point in the
                     // future. https://bugs.webkit.org/show_bug.cgi?id=133052
@@ -244,7 +254,8 @@
                 GetByIdVariant variant(
                     StructureSet(structure), complexGetStatus.offset(),
                     complexGetStatus.conditionSet(), WTFMove(callLinkStatus),
-                    intrinsicFunction);
+                    intrinsicFunction,
+                    domJIT);
 
                 if (!result.appendVariant(variant))
                     return GetByIdStatus(slowPathState, true);

Modified: trunk/Source/_javascript_Core/bytecode/GetByIdVariant.cpp (206778 => 206779)


--- trunk/Source/_javascript_Core/bytecode/GetByIdVariant.cpp	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/bytecode/GetByIdVariant.cpp	2016-10-04 19:34:52 UTC (rev 206779)
@@ -36,12 +36,14 @@
     const StructureSet& structureSet, PropertyOffset offset,
     const ObjectPropertyConditionSet& conditionSet,
     std::unique_ptr<CallLinkStatus> callLinkStatus,
-    JSFunction* intrinsicFunction)
+    JSFunction* intrinsicFunction,
+    DOMJIT::GetterSetter* domJIT)
     : m_structureSet(structureSet)
     , m_conditionSet(conditionSet)
     , m_offset(offset)
     , m_callLinkStatus(WTFMove(callLinkStatus))
     , m_intrinsicFunction(intrinsicFunction)
+    , m_domJIT(domJIT)
 {
     if (!structureSet.size()) {
         ASSERT(offset == invalidOffset);
@@ -65,6 +67,7 @@
     m_conditionSet = other.m_conditionSet;
     m_offset = other.m_offset;
     m_intrinsicFunction = other.m_intrinsicFunction;
+    m_domJIT = other.m_domJIT;
     if (other.m_callLinkStatus)
         m_callLinkStatus = std::make_unique<CallLinkStatus>(*other.m_callLinkStatus);
     else
@@ -103,6 +106,9 @@
     if (!canMergeIntrinsicStructures(other))
         return false;
 
+    if (m_domJIT != other.m_domJIT)
+        return false;
+
     if (m_conditionSet.isEmpty() != other.m_conditionSet.isEmpty())
         return false;
     
@@ -138,6 +144,8 @@
         out.print(", call = ", *m_callLinkStatus);
     if (m_intrinsicFunction)
         out.print(", intrinsic = ", *m_intrinsicFunction);
+    if (m_domJIT)
+        out.print(", domjit = ", RawPointer(m_domJIT));
     out.print(">");
 }
 

Modified: trunk/Source/_javascript_Core/bytecode/GetByIdVariant.h (206778 => 206779)


--- trunk/Source/_javascript_Core/bytecode/GetByIdVariant.h	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/bytecode/GetByIdVariant.h	2016-10-04 19:34:52 UTC (rev 206779)
@@ -32,6 +32,9 @@
 #include "StructureSet.h"
 
 namespace JSC {
+namespace DOMJIT {
+class GetterSetter;
+}
 
 class CallLinkStatus;
 class GetByIdStatus;
@@ -43,7 +46,8 @@
         const StructureSet& structureSet = StructureSet(), PropertyOffset offset = invalidOffset,
         const ObjectPropertyConditionSet& = ObjectPropertyConditionSet(),
         std::unique_ptr<CallLinkStatus> = nullptr,
-        JSFunction* = nullptr);
+        JSFunction* = nullptr,
+        DOMJIT::GetterSetter* = nullptr);
 
     ~GetByIdVariant();
     
@@ -62,6 +66,7 @@
     CallLinkStatus* callLinkStatus() const { return m_callLinkStatus.get(); }
     JSFunction* intrinsicFunction() const { return m_intrinsicFunction; }
     Intrinsic intrinsic() const { return m_intrinsicFunction ? m_intrinsicFunction->intrinsic() : NoIntrinsic; }
+    DOMJIT::GetterSetter* domJIT() const { return m_domJIT; }
 
     bool isPropertyUnset() const { return offset() == invalidOffset; }
 
@@ -80,6 +85,7 @@
     PropertyOffset m_offset;
     std::unique_ptr<CallLinkStatus> m_callLinkStatus;
     JSFunction* m_intrinsicFunction;
+    DOMJIT::GetterSetter* m_domJIT;
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.cpp (206778 => 206779)


--- trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.cpp	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.cpp	2016-10-04 19:34:52 UTC (rev 206779)
@@ -220,7 +220,7 @@
 std::unique_ptr<AccessCase> AccessCase::get(
     VM& vm, JSCell* owner, AccessType type, PropertyOffset offset, Structure* structure,
     const ObjectPropertyConditionSet& conditionSet, bool viaProxy, WatchpointSet* additionalSet,
-    PropertySlot::GetValueFunc customGetter, JSObject* customSlotBase)
+    PropertySlot::GetValueFunc customGetter, JSObject* customSlotBase, DOMJIT::GetterSetter* domJIT)
 {
     std::unique_ptr<AccessCase> result(new AccessCase());
 
@@ -229,12 +229,13 @@
     result->m_structure.set(vm, owner, structure);
     result->m_conditionSet = conditionSet;
 
-    if (viaProxy || additionalSet || result->doesCalls() || customGetter || customSlotBase) {
+    if (viaProxy || additionalSet || result->doesCalls() || customGetter || customSlotBase || domJIT) {
         result->m_rareData = std::make_unique<RareData>();
         result->m_rareData->viaProxy = viaProxy;
         result->m_rareData->additionalSet = additionalSet;
         result->m_rareData->customAccessor.getter = customGetter;
         result->m_rareData->customSlotBase.setMayBeNull(vm, owner, customSlotBase);
+        result->m_rareData->domJIT = domJIT;
     }
 
     return result;
@@ -385,6 +386,7 @@
         result->m_rareData->customAccessor.opaque = rareData->customAccessor.opaque;
         result->m_rareData->customSlotBase = rareData->customSlotBase;
         result->m_rareData->intrinsicFunction = rareData->intrinsicFunction;
+        result->m_rareData->domJIT = rareData->domJIT;
     }
     return result;
 }

Modified: trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.h (206778 => 206779)


--- trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.h	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.h	2016-10-04 19:34:52 UTC (rev 206779)
@@ -37,6 +37,9 @@
 #include <wtf/Vector.h>
 
 namespace JSC {
+namespace DOMJIT {
+class GetterSetter;
+}
 
 class CodeBlock;
 class PolymorphicAccess;
@@ -130,7 +133,8 @@
         bool viaProxy = false,
         WatchpointSet* additionalSet = nullptr,
         PropertySlot::GetValueFunc = nullptr,
-        JSObject* customSlotBase = nullptr);
+        JSObject* customSlotBase = nullptr,
+        DOMJIT::GetterSetter* = nullptr);
     
     static std::unique_ptr<AccessCase> megamorphicLoad(VM&, JSCell* owner);
     
@@ -186,6 +190,12 @@
         return intrinsicFunction()->intrinsic();
     }
 
+    DOMJIT::GetterSetter* domJIT() const
+    {
+        ASSERT(m_rareData);
+        return m_rareData->domJIT;
+    }
+
     WatchpointSet* additionalSet() const
     {
         return m_rareData ? m_rareData->additionalSet.get() : nullptr;
@@ -284,6 +294,7 @@
     public:
         RareData()
             : viaProxy(false)
+            , domJIT(nullptr)
         {
             customAccessor.opaque = nullptr;
         }
@@ -300,6 +311,7 @@
         } customAccessor;
         WriteBarrier<JSObject> customSlotBase;
         WriteBarrier<JSFunction> intrinsicFunction;
+        DOMJIT::GetterSetter* domJIT;
     };
 
     std::unique_ptr<RareData> m_rareData;

Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (206778 => 206779)


--- trunk/Source/_javascript_Core/dfg/DFGNode.h	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h	2016-10-04 19:34:52 UTC (rev 206779)
@@ -58,6 +58,10 @@
 
 namespace JSC {
 
+namespace DOMJIT {
+class GetterSetter;
+}
+
 namespace Profiler {
 class ExecutionCounter;
 }

Added: trunk/Source/_javascript_Core/domjit/DOMJITGetterSetter.h (0 => 206779)


--- trunk/Source/_javascript_Core/domjit/DOMJITGetterSetter.h	                        (rev 0)
+++ trunk/Source/_javascript_Core/domjit/DOMJITGetterSetter.h	2016-10-04 19:34:52 UTC (rev 206779)
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DOMJITPatchpoint.h"
+#include "PropertySlot.h"
+#include "PutPropertySlot.h"
+#include "SpeculatedType.h"
+
+namespace JSC { namespace DOMJIT {
+
+class GetterSetter {
+public:
+    typedef PropertySlot::GetValueFunc CustomGetter;
+    typedef PutPropertySlot::PutValueFunc CustomSetter;
+
+    GetterSetter(CustomGetter getter, CustomSetter setter, const ClassInfo* classInfo)
+        : m_getter(getter)
+        , m_setter(setter)
+        , m_thisClassInfo(classInfo)
+    {
+    }
+
+    virtual ~GetterSetter() { }
+
+    CustomGetter getter() const { return m_getter; }
+    CustomSetter setter() const { return m_setter; }
+    const ClassInfo* thisClassInfo() const { return m_thisClassInfo; }
+
+#if ENABLE(JIT)
+    virtual Ref<DOMJIT::Patchpoint> callDOM() = 0;
+    virtual Ref<DOMJIT::Patchpoint> checkDOM() = 0;
+#endif
+
+private:
+    CustomGetter m_getter;
+    CustomSetter m_setter;
+    const ClassInfo* m_thisClassInfo;
+};
+
+} }

Added: trunk/Source/_javascript_Core/domjit/DOMJITPatchpoint.h (0 => 206779)


--- trunk/Source/_javascript_Core/domjit/DOMJITPatchpoint.h	                        (rev 0)
+++ trunk/Source/_javascript_Core/domjit/DOMJITPatchpoint.h	2016-10-04 19:34:52 UTC (rev 206779)
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "RegisterSet.h"
+
+namespace JSC { namespace DOMJIT {
+
+class PatchpointParams;
+
+typedef CCallHelpers::JumpList PatchpointGeneratorFunction(CCallHelpers&, const PatchpointParams&);
+typedef SharedTask<PatchpointGeneratorFunction> PatchpointGenerator;
+
+// DOMJIT patchpoint is the way to inject an opaque code generator into DFG and FTL.
+// While B3::Patchpoint is self-contained about its compilation information,
+// DOMJIT::Patchpoint depends on which DFG Node invokes. For example, CheckDOM will
+// link returned failureCases to BadType OSRExit, but this information is offered
+// from CheckDOM DFG Node, not from this patchpoint. This patchpoint mainly focuses
+// on injecting a snippet generator that can tell register usage and can be used
+// in both DFG and FTL.
+class Patchpoint : public ThreadSafeRefCounted<Patchpoint> {
+public:
+    static Ref<Patchpoint> create()
+    {
+        return adoptRef(*new Patchpoint());
+    }
+
+    template<typename Functor>
+    void setGenerator(const Functor& functor)
+    {
+        m_generator = createSharedTask<PatchpointGeneratorFunction>(functor);
+    }
+
+    RefPtr<PatchpointGenerator> generator() const { return m_generator; }
+
+    uint8_t numGPScratchRegisters { 0 };
+    uint8_t numFPScratchRegisters { 0 };
+
+private:
+    Patchpoint() = default;
+
+    RefPtr<PatchpointGenerator> m_generator;
+};
+
+} }
+
+#endif

Modified: trunk/Source/_javascript_Core/jit/Repatch.cpp (206778 => 206779)


--- trunk/Source/_javascript_Core/jit/Repatch.cpp	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/jit/Repatch.cpp	2016-10-04 19:34:52 UTC (rev 206779)
@@ -33,6 +33,7 @@
 #include "CallFrameShuffler.h"
 #include "DFGOperations.h"
 #include "DFGSpeculativeJIT.h"
+#include "DOMJITGetterSetter.h"
 #include "DirectArguments.h"
 #include "FTLThunks.h"
 #include "GCAwareJITStubRoutine.h"
@@ -260,6 +261,10 @@
         if (slot.isCacheableGetter())
             getter = jsDynamicCast<JSFunction*>(slot.getterSetter()->getter());
 
+        DOMJIT::GetterSetter* domJIT = nullptr;
+        if (slot.isCacheableCustom() && slot.domJIT())
+            domJIT = slot.domJIT();
+
         if (kind == GetByIDKind::Pure) {
             AccessCase::AccessType type;
             if (slot.isCacheableValue())
@@ -290,7 +295,8 @@
             newCase = AccessCase::get(
                 vm, codeBlock, type, offset, structure, conditionSet, loadTargetFromProxy,
                 slot.watchpointSet(), slot.isCacheableCustom() ? slot.customGetter() : nullptr,
-                slot.isCacheableCustom() ? slot.slotBase() : nullptr);
+                slot.isCacheableCustom() ? slot.slotBase() : nullptr,
+                domJIT);
         }
     }
 

Modified: trunk/Source/_javascript_Core/runtime/CustomGetterSetter.h (206778 => 206779)


--- trunk/Source/_javascript_Core/runtime/CustomGetterSetter.h	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/runtime/CustomGetterSetter.h	2016-10-04 19:34:52 UTC (rev 206779)
@@ -31,6 +31,9 @@
 #include "Structure.h"
 
 namespace JSC {
+namespace DOMJIT {
+class GetterSetter;
+}
 
 class CustomGetterSetter final : public JSCell {
 public:
@@ -40,9 +43,9 @@
     typedef PropertySlot::GetValueFunc CustomGetter;
     typedef PutPropertySlot::PutValueFunc CustomSetter;
 
-    static CustomGetterSetter* create(VM& vm, CustomGetter customGetter, CustomSetter customSetter)
+    static CustomGetterSetter* create(VM& vm, CustomGetter customGetter, CustomSetter customSetter, DOMJIT::GetterSetter* domJIT = nullptr)
     {
-        CustomGetterSetter* customGetterSetter = new (NotNull, allocateCell<CustomGetterSetter>(vm.heap)) CustomGetterSetter(vm, customGetter, customSetter);
+        CustomGetterSetter* customGetterSetter = new (NotNull, allocateCell<CustomGetterSetter>(vm.heap)) CustomGetterSetter(vm, customGetter, customSetter, domJIT);
         customGetterSetter->finishCreation(vm);
         return customGetterSetter;
     }
@@ -49,6 +52,7 @@
 
     CustomGetterSetter::CustomGetter getter() const { return m_getter; }
     CustomGetterSetter::CustomSetter setter() const { return m_setter; }
+    DOMJIT::GetterSetter* domJIT() const { return m_domJIT; }
 
     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
     {
@@ -58,15 +62,17 @@
     DECLARE_EXPORT_INFO;
 
 private:
-    CustomGetterSetter(VM& vm, CustomGetter getter, CustomSetter setter)
+    CustomGetterSetter(VM& vm, CustomGetter getter, CustomSetter setter, DOMJIT::GetterSetter* domJIT)
         : JSCell(vm, vm.customGetterSetterStructure.get())
         , m_getter(getter)
         , m_setter(setter)
+        , m_domJIT(domJIT)
     {
     }
 
     CustomGetter m_getter;
     CustomSetter m_setter;
+    DOMJIT::GetterSetter* m_domJIT;
 };
 
 JS_EXPORT_PRIVATE bool callCustomSetter(ExecState*, CustomGetterSetter::CustomSetter, bool isAccessor, JSValue thisValue, JSValue);

Modified: trunk/Source/_javascript_Core/runtime/JSObject.h (206778 => 206779)


--- trunk/Source/_javascript_Core/runtime/JSObject.h	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/runtime/JSObject.h	2016-10-04 19:34:52 UTC (rev 206779)
@@ -1290,7 +1290,7 @@
 
     // This access is cacheable because Structure requires an attributeChangedTransition
     // if this property stops being an accessor.
-    slot.setCacheableCustom(this, attributes, jsCast<CustomGetterSetter*>(customGetterSetter)->getter());
+    slot.setCacheableCustom(this, attributes, jsCast<CustomGetterSetter*>(customGetterSetter)->getter(), jsCast<CustomGetterSetter*>(customGetterSetter)->domJIT());
 }
 
 // It may seem crazy to inline a function this large, especially a virtual function,

Modified: trunk/Source/_javascript_Core/runtime/Lookup.h (206778 => 206779)


--- trunk/Source/_javascript_Core/runtime/Lookup.h	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/runtime/Lookup.h	2016-10-04 19:34:52 UTC (rev 206779)
@@ -23,6 +23,7 @@
 #include "BatchedTransitionOptimizer.h"
 #include "CallFrame.h"
 #include "CustomGetterSetter.h"
+#include "DOMJITGetterSetter.h"
 #include "Identifier.h"
 #include "IdentifierInlines.h"
 #include "Intrinsic.h"
@@ -46,6 +47,7 @@
 typedef PutPropertySlot::PutValueFunc PutFunction;
 typedef FunctionExecutable* (*BuiltinGenerator)(VM&);
 typedef JSValue (*LazyPropertyCallback)(VM&, JSObject*);
+typedef DOMJIT::GetterSetter* (*DOMJITGetterSetterGenerator)(void);
 
 // Hash table generated by the create_hash_table script.
 struct HashTableValue {
@@ -78,6 +80,8 @@
     GetFunction propertyGetter() const { ASSERT(!(m_attributes & BuiltinOrFunctionOrAccessorOrLazyPropertyOrConstant)); return reinterpret_cast<GetFunction>(m_values.value1); }
     PutFunction propertyPutter() const { ASSERT(!(m_attributes & BuiltinOrFunctionOrAccessorOrLazyPropertyOrConstant)); return reinterpret_cast<PutFunction>(m_values.value2); }
 
+    DOMJIT::GetterSetter* domJIT() const { ASSERT(m_attributes & DOMJITAttribute); return reinterpret_cast<DOMJITGetterSetterGenerator>(m_values.value1)(); }
+
     NativeFunction accessorGetter() const { ASSERT(m_attributes & Accessor); return reinterpret_cast<NativeFunction>(m_values.value1); }
     NativeFunction accessorSetter() const { ASSERT(m_attributes & Accessor); return reinterpret_cast<NativeFunction>(m_values.value2); }
     BuiltinGenerator builtinAccessorGetterGenerator() const;
@@ -224,6 +228,12 @@
         return true;
     }
 
+    if (entry->attributes() & DOMJITAttribute) {
+        DOMJIT::GetterSetter* domJIT = entry->domJIT();
+        slot.setCacheableCustom(thisObject, attributesForStructure(entry->attributes()), domJIT->getter(), domJIT);
+        return true;
+    }
+
     slot.setCacheableCustom(thisObject, attributesForStructure(entry->attributes()), entry->propertyGetter());
     return true;
 }
@@ -259,6 +269,7 @@
         return reject(exec, slot.isStrictMode(), StrictModeReadonlyPropertyWriteError);
 
     if (!(entry->attributes() & ReadOnly)) {
+        ASSERT_WITH_MESSAGE(!(entry->attributes() & DOMJITAttribute), "DOMJITAttribute supports readonly attributes currently.");
         bool isAccessor = entry->attributes() & CustomAccessor;
         JSValue updateThisValue = entry->attributes() & CustomAccessor ? slot.thisValue() : JSValue(base);
         bool result = callCustomSetter(exec, entry->propertyPutter(), isAccessor, updateThisValue, value);
@@ -336,6 +347,13 @@
         return;
     }
 
+    if (value.attributes() & DOMJITAttribute) {
+        DOMJIT::GetterSetter* domJIT = value.domJIT();
+        CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, domJIT->getter(), domJIT->setter(), domJIT);
+        thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
+        return;
+    }
+
     CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, value.propertyGetter(), value.propertyPutter());
     thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
 }

Modified: trunk/Source/_javascript_Core/runtime/PropertySlot.h (206778 => 206779)


--- trunk/Source/_javascript_Core/runtime/PropertySlot.h	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/_javascript_Core/runtime/PropertySlot.h	2016-10-04 19:34:52 UTC (rev 206779)
@@ -26,7 +26,9 @@
 #include <wtf/Assertions.h>
 
 namespace JSC {
-
+namespace DOMJIT {
+class GetterSetter;
+}
 class ExecState;
 class GetterSetter;
 class JSObject;
@@ -48,6 +50,7 @@
     CellProperty      = 1 << 11, // property is a lazy property - only used by static hashtables
     ClassStructure    = 1 << 12, // property is a lazy class structure - only used by static hashtables
     PropertyCallback  = 1 << 13, // property that is a lazy property callback - only used by static hashtables
+    DOMJITAttribute   = 1 << 14, // property is a DOM JIT attribute - only used by static hashtables
     BuiltinOrFunction = Builtin | Function, // helper only used by static hashtables
     BuiltinOrFunctionOrLazyProperty = Builtin | Function | CellProperty | ClassStructure | PropertyCallback, // helper only used by static hashtables
     BuiltinOrFunctionOrAccessorOrLazyProperty = Builtin | Function | Accessor | CellProperty | ClassStructure | PropertyCallback, // helper only used by static hashtables
@@ -157,6 +160,11 @@
         return m_watchpointSet;
     }
 
+    DOMJIT::GetterSetter* domJIT() const
+    {
+        return m_domJIT;
+    }
+
     void setValue(JSObject* slotBase, unsigned attributes, JSValue value)
     {
         ASSERT(attributes == attributesForStructure(attributes));
@@ -211,7 +219,7 @@
         m_offset = invalidOffset;
     }
     
-    void setCacheableCustom(JSObject* slotBase, unsigned attributes, GetValueFunc getValue)
+    void setCacheableCustom(JSObject* slotBase, unsigned attributes, GetValueFunc getValue, DOMJIT::GetterSetter* domJIT = nullptr)
     {
         ASSERT(attributes == attributesForStructure(attributes));
         
@@ -223,6 +231,7 @@
         m_slotBase = slotBase;
         m_propertyType = TypeCustom;
         m_offset = !invalidOffset;
+        m_domJIT = domJIT;
     }
 
     void setCustomGetterSetter(JSObject* slotBase, unsigned attributes, CustomGetterSetter* getterSetter)
@@ -318,6 +327,7 @@
     CacheabilityType m_cacheability;
     PropertyType m_propertyType;
     InternalMethodType m_internalMethodType;
+    DOMJIT::GetterSetter* m_domJIT { nullptr };
     bool m_isTaintedByOpaqueObject;
 };
 

Modified: trunk/Source/WebCore/ChangeLog (206778 => 206779)


--- trunk/Source/WebCore/ChangeLog	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/WebCore/ChangeLog	2016-10-04 19:34:52 UTC (rev 206779)
@@ -1,3 +1,16 @@
+2016-10-04  Yusuke Suzuki  <utatane....@gmail.com>
+
+        [DOMJIT] Introduce DOMJIT::GetterSetter to tell JIT information
+        https://bugs.webkit.org/show_bug.cgi?id=162916
+
+        Reviewed by Filip Pizlo.
+
+        * ForwardingHeaders/domjit/DOMJITGetterSetter.h: Added.
+        * PlatformEfl.cmake:
+        * PlatformGTK.cmake:
+        * PlatformMac.cmake:
+        * PlatformWin.cmake:
+
 2016-10-04  Chris Dumez  <cdu...@apple.com>
 
         Return null when window.open() is popup blocked

Added: trunk/Source/WebCore/ForwardingHeaders/domjit/DOMJITGetterSetter.h (0 => 206779)


--- trunk/Source/WebCore/ForwardingHeaders/domjit/DOMJITGetterSetter.h	                        (rev 0)
+++ trunk/Source/WebCore/ForwardingHeaders/domjit/DOMJITGetterSetter.h	2016-10-04 19:34:52 UTC (rev 206779)
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_DOMJITGetterSetter_h
+#define WebCore_FWD_DOMJITGetterSetter_h
+#include <_javascript_Core/DOMJITGetterSetter.h>
+#endif

Modified: trunk/Source/WebCore/PlatformEfl.cmake (206778 => 206779)


--- trunk/Source/WebCore/PlatformEfl.cmake	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/WebCore/PlatformEfl.cmake	2016-10-04 19:34:52 UTC (rev 206779)
@@ -14,6 +14,7 @@
     "${_javascript_CORE_DIR}/bytecompiler"
     "${_javascript_CORE_DIR}/dfg"
     "${_javascript_CORE_DIR}/disassembler"
+    "${_javascript_CORE_DIR}/domjit"
     "${_javascript_CORE_DIR}/heap"
     "${_javascript_CORE_DIR}/debugger"
     "${_javascript_CORE_DIR}/interpreter"

Modified: trunk/Source/WebCore/PlatformGTK.cmake (206778 => 206779)


--- trunk/Source/WebCore/PlatformGTK.cmake	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/WebCore/PlatformGTK.cmake	2016-10-04 19:34:52 UTC (rev 206779)
@@ -19,6 +19,7 @@
     "${_javascript_CORE_DIR}/bytecompiler"
     "${_javascript_CORE_DIR}/dfg"
     "${_javascript_CORE_DIR}/disassembler"
+    "${_javascript_CORE_DIR}/domjit"
     "${_javascript_CORE_DIR}/heap"
     "${_javascript_CORE_DIR}/debugger"
     "${_javascript_CORE_DIR}/interpreter"

Modified: trunk/Source/WebCore/PlatformMac.cmake (206778 => 206779)


--- trunk/Source/WebCore/PlatformMac.cmake	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/WebCore/PlatformMac.cmake	2016-10-04 19:34:52 UTC (rev 206779)
@@ -79,6 +79,7 @@
     "${WEBCORE_DIR}/ForwardingHeaders"
     "${WEBCORE_DIR}/ForwardingHeaders/bindings"
     "${WEBCORE_DIR}/ForwardingHeaders/bytecode"
+    "${WEBCORE_DIR}/ForwardingHeaders/domjit"
     "${WEBCORE_DIR}/ForwardingHeaders/debugger"
     "${WEBCORE_DIR}/ForwardingHeaders/heap"
     "${WEBCORE_DIR}/ForwardingHeaders/inspector"

Modified: trunk/Source/WebCore/PlatformWin.cmake (206778 => 206779)


--- trunk/Source/WebCore/PlatformWin.cmake	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/WebCore/PlatformWin.cmake	2016-10-04 19:34:52 UTC (rev 206779)
@@ -15,6 +15,7 @@
     "${DERIVED_SOURCES_DIR}/ForwardingHeaders/_javascript_Core/bytecompiler"
     "${DERIVED_SOURCES_DIR}/ForwardingHeaders/_javascript_Core/dfg"
     "${DERIVED_SOURCES_DIR}/ForwardingHeaders/_javascript_Core/disassembler"
+    "${DERIVED_SOURCES_DIR}/ForwardingHeaders/_javascript_Core/domjit"
     "${DERIVED_SOURCES_DIR}/ForwardingHeaders/_javascript_Core/heap"
     "${DERIVED_SOURCES_DIR}/ForwardingHeaders/_javascript_Core/debugger"
     "${DERIVED_SOURCES_DIR}/ForwardingHeaders/_javascript_Core/interpreter"

Modified: trunk/Source/WebKit2/CMakeLists.txt (206778 => 206779)


--- trunk/Source/WebKit2/CMakeLists.txt	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/WebKit2/CMakeLists.txt	2016-10-04 19:34:52 UTC (rev 206779)
@@ -149,6 +149,7 @@
     "${_javascript_CORE_DIR}/collector/handles"
     "${_javascript_CORE_DIR}/dfg"
     "${_javascript_CORE_DIR}/disassembler"
+    "${_javascript_CORE_DIR}/domjit"
     "${_javascript_CORE_DIR}/heap"
     "${_javascript_CORE_DIR}/interpreter"
     "${_javascript_CORE_DIR}/jit"

Modified: trunk/Source/WebKit2/ChangeLog (206778 => 206779)


--- trunk/Source/WebKit2/ChangeLog	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Source/WebKit2/ChangeLog	2016-10-04 19:34:52 UTC (rev 206779)
@@ -1,3 +1,12 @@
+2016-10-04  Yusuke Suzuki  <utatane....@gmail.com>
+
+        [DOMJIT] Introduce DOMJIT::GetterSetter to tell JIT information
+        https://bugs.webkit.org/show_bug.cgi?id=162916
+
+        Reviewed by Filip Pizlo.
+
+        * CMakeLists.txt:
+
 2016-10-04  Carlos Garcia Campos  <cgar...@igalia.com>
 
         [SOUP] Remove SSLPolicyFlags from SoupNetworkSession

Modified: trunk/Tools/ChangeLog (206778 => 206779)


--- trunk/Tools/ChangeLog	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Tools/ChangeLog	2016-10-04 19:34:52 UTC (rev 206779)
@@ -1,3 +1,12 @@
+2016-10-04  Yusuke Suzuki  <utatane....@gmail.com>
+
+        [DOMJIT] Introduce DOMJIT::GetterSetter to tell JIT information
+        https://bugs.webkit.org/show_bug.cgi?id=162916
+
+        Reviewed by Filip Pizlo.
+
+        * DumpRenderTree/CMakeLists.txt:
+
 2016-10-04  Wenson Hsieh  <wenson_hs...@apple.com>
 
         Media controls are displayed in the incorrect state momentarily after switching between tabs playing media

Modified: trunk/Tools/DumpRenderTree/CMakeLists.txt (206778 => 206779)


--- trunk/Tools/DumpRenderTree/CMakeLists.txt	2016-10-04 19:31:24 UTC (rev 206778)
+++ trunk/Tools/DumpRenderTree/CMakeLists.txt	2016-10-04 19:34:52 UTC (rev 206779)
@@ -57,6 +57,7 @@
     ${_javascript_CORE_DIR}/bytecode
     ${_javascript_CORE_DIR}/dfg
     ${_javascript_CORE_DIR}/disassembler
+    ${_javascript_CORE_DIR}/domjit
     ${_javascript_CORE_DIR}/heap
     ${_javascript_CORE_DIR}/interpreter
     ${_javascript_CORE_DIR}/jit
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to