Attachment #246834 for bug #141640

View Details Raw Unified Return to Bug 141640

| Differences between



2015-02-18  Yusuke Suzuki  <utatane.tea@gmail.com>

        Constructor returning null should construct an object instead of null
        https://bugs.webkit.org/show_bug.cgi?id=141640

        Reviewed by NOBODY (OOPS!).

        * JavaScriptCore.order:
        * bytecode/BytecodeList.json:
        * bytecode/BytecodeUseDef.h:
        (JSC::computeUsesForBytecodeOffset):
        (JSC::computeDefsForBytecodeOffset):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::dumpBytecode):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::emitEqualityOp):
        (JSC::BytecodeGenerator::emitReturn):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::capabilityLevel):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGHeapLocation.cpp:
        (WTF::printInternal):
        * dfg/DFGHeapLocation.h:
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        (JSC::DFG::PredictionPropagationPhase::propagate):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToLLVM.cpp:
        (JSC::FTL::LowerDFGToLLVM::compileNode):
        (JSC::FTL::LowerDFGToLLVM::compileToString):
        (JSC::FTL::LowerDFGToLLVM::compileIsObject):
        (JSC::FTL::LowerDFGToLLVM::compileIsObjectOrNull):
        (JSC::FTL::LowerDFGToLLVM::speculateTruthyObject):
        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
        (JSC::FTL::LowerDFGToLLVM::isObject):
        (JSC::FTL::LowerDFGToLLVM::isNotObject):
        (JSC::FTL::LowerDFGToLLVM::isNotString):
        (JSC::FTL::LowerDFGToLLVM::speculateNonNullObject):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        * jit/JIT.h:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_is_string):
        (JSC::JIT::emit_op_is_object):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_is_object):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/CommonSlowPaths.cpp:
        (JSC::SLOW_PATH_DECL):
        * runtime/CommonSlowPaths.h:
        * runtime/Operations.cpp:
        (JSC::jsIsObjectTypeOrNull):
        (JSC::jsIsObjectType): Deleted.
        * runtime/Operations.h:

2015-02-18  Csaba Osztrogonác  <ossy@webkit.org>

        URTBF after r180258 to fix Windows build.



__ZN3JSC11PostfixNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
__ZN3JSC11PostfixNode11emitResolveERNS_17BytecodeGeneratorEPNS_10RegisterIDE
__ZN3JSC17BytecodeGenerator7emitIncEPNS_10RegisterIDE
__ZN3JSC14jsIsObjectTypeEPNS_9ExecStateENS_7JSValueE
__ZN3JSC6JSCell11getCallDataEPS0_RNS_8CallDataE
__ZN3JSC8JSObject16getPropertyNamesEPS0_PNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
__ZN3JSC8JSObject19getOwnPropertyNamesEPS0_PNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE

__ZN3JSCL8getByValEPNS_9ExecStateENS_7JSValueES2_NS_16ReturnAddressPtrE
_cti_op_stricteq
_cti_op_jtrue
_cti_op_is_object_or_null
__ZN3JSC8JSString12toThisObjectEPNS_6JSCellEPNS_9ExecStateE
__ZN3JSC12StringObjectC1ERNS_2VMEPNS_9StructureE
__ZNK3JSC6JSCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE

__ZN3WTF6VectorIPN3JSC8JSObjectELm4ENS_15CrashOnOverflowEE15reserveCapacityEm
__ZN3WTF15BinarySemaphore4waitEd
__ZN3WTF15BinarySemaphore6signalEv
_JSValueIsObject
__ZN3JSCL19arrayProtoFuncShiftEPNS_9ExecStateE
__ZN3JSC5shiftILNS_7JSArray14ShiftCountModeE0EEEvPNS_9ExecStateEPNS_8JSObjectEjjjj
__ZN3JSC7JSArray26shiftCountWithArrayStorageEjjPNS_12ArrayStorageE

__ZN3JSC8JSObject20ensureContiguousSlowERNS_2VME
__ZN3JSC8JSObject20ensureContiguousSlowERNS_2VMENS0_22DoubleToContiguousModeE
_operationMakeRope3
_operationIsObject
__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPFxPNS_9ExecStateExPNS_7JSArrayEENS0_11NoResultTagENS_12X86Registers10RegisterIDESE_SE_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_T4_NS0_18SpillRegistersModeE
__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateExPNS_7JSArrayEENS_12X86Registers10RegisterIDES9_S9_
_operationArrayPush

_llint_slow_path_check_has_instance
_llint_slow_path_instanceof
_llint_slow_path_typeof
_llint_slow_path_is_object_or_null
_llint_slow_path_is_function
_llint_slow_path_in
_llint_slow_path_resolve

_llint_op_greatereq
_llint_op_mod
_llint_op_typeof
_llint_op_is_object_or_null
_llint_op_is_function
_llint_op_in
_llint_op_put_to_base_variable

Lines 53-58 a/Source/JavaScriptCore/bytecode/BytecodeList.json_sec1
- a/Source/JavaScriptCore/bytecode/BytecodeList.json +1 lines
53	{ "name" : "op_is_number", "length" : 3 },	53	{ "name" : "op_is_number", "length" : 3 },
54	{ "name" : "op_is_string", "length" : 3 },	54	{ "name" : "op_is_string", "length" : 3 },
55	{ "name" : "op_is_object", "length" : 3 },	55	{ "name" : "op_is_object", "length" : 3 },
		56	{ "name" : "op_is_object_or_null", "length" : 3 },
56	{ "name" : "op_is_function", "length" : 3 },	57	{ "name" : "op_is_function", "length" : 3 },
57	{ "name" : "op_in", "length" : 4 },	58	{ "name" : "op_in", "length" : 4 },
58	{ "name" : "op_init_global_const_nop", "length" : 5 },	59	{ "name" : "op_init_global_const_nop", "length" : 5 },



    case op_is_number:
    case op_is_string:
    case op_is_object:
    case op_is_object_or_null:
    case op_is_function:
    case op_to_number:
    case op_negate:

    case op_is_number:
    case op_is_string:
    case op_is_object:
    case op_is_object_or_null:
    case op_is_function:
    case op_in:
    case op_to_number:

Lines 1008-1013 void CodeBlock::dumpBytecode( a/Source/JavaScriptCore/bytecode/CodeBlock.cpp_sec1
- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp +4 lines
1008	printUnaryOp(out, exec, location, it, "is_object");	1008	printUnaryOp(out, exec, location, it, "is_object");
1009	break;	1009	break;
1010	}	1010	}
		1011	case op_is_object_or_null: {
		1012	printUnaryOp(out, exec, location, it, "is_object_or_null");
		1013	break;
		1014	}
1011	case op_is_function: {	1015	case op_is_function: {
1012	printUnaryOp(out, exec, location, it, "is_function");	1016	printUnaryOp(out, exec, location, it, "is_function");
1013	break;	1017	break;



            }
            if (value == "object") {
                rewindUnaryOp();
                emitOpcode(op_is_object_or_null);
                instructions().append(dst->index());
                instructions().append(srcIndex);
                return dst;

        instructions().append(isObjectRegister->index());
        instructions().append(isObjectLabel->bind(begin, instructions().size()));

        emitOpcode(op_is_function);
        instructions().append(isObjectRegister->index());
        instructions().append(src->index());

        begin = instructions().size();
        emitOpcode(op_jtrue);
        instructions().append(isObjectRegister->index());
        instructions().append(isObjectLabel->bind(begin, instructions().size()));

        emitUnaryNoDstOp(op_ret, &m_thisRegister);

        emitLabel(isObjectLabel.get());



    case IsNumber:
    case IsString:
    case IsObject:
    case IsObjectOrNull:
    case IsFunction: {
        JSValue child = forNode(node->child1()).value();
        if (child) {

            case IsString:
                setConstant(node, jsBoolean(isJSString(child)));
                break;
            case IsObjectOrNull:
                if (child.isNull() || !child.isObject()) {
                    setConstant(node, jsBoolean(child.isNull()));
                    break;

Lines 2668-2673 bool ByteCodeParser::parseBlock(unsigned limit) a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp_sec1
- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp +6 lines
2668	NEXT_OPCODE(op_is_object);	2668	NEXT_OPCODE(op_is_object);
2669	}	2669	}
2670		2670
		2671	case op_is_object_or_null: {
		2672	Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
		2673	set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsObjectOrNull, value));
		2674	NEXT_OPCODE(op_is_object_or_null);
		2675	}
		2676
2671	case op_is_function: {	2677	case op_is_function: {
2672	Node* value = get(VirtualRegister(currentInstruction[2].u.operand));	2678	Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
2673	set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsFunction, value));	2679	set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsFunction, value));

Lines 130-135 CapabilityLevel capabilityLevel(OpcodeID opcodeID, CodeBlock* codeBlock, Instruc a/Source/JavaScriptCore/dfg/DFGCapabilities.cpp_sec1
- a/Source/JavaScriptCore/dfg/DFGCapabilities.cpp +1 lines
130	case op_is_number:	130	case op_is_number:
131	case op_is_string:	131	case op_is_string:
132	case op_is_object:	132	case op_is_object:
		133	case op_is_object_or_null:
133	case op_is_function:	134	case op_is_function:
134	case op_not:	135	case op_not:
135	case op_less:	136	case op_less:

Lines 344-349 void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu a/Source/JavaScriptCore/dfg/DFGClobberize.h_sec1
- a/Source/JavaScriptCore/dfg/DFGClobberize.h +5 lines
344	read(MiscFields);	344	read(MiscFields);
345	def(HeapLocation(IsObjectLoc, MiscFields, node->child1()), node);	345	def(HeapLocation(IsObjectLoc, MiscFields, node->child1()), node);
346	return;	346	return;
		347
		348	case IsObjectOrNull:
		349	read(MiscFields);
		350	def(HeapLocation(IsObjectOrNullLoc, MiscFields, node->child1()), node);
		351	return;
347		352
348	case IsFunction:	353	case IsFunction:
349	read(MiscFields);	354	read(MiscFields);

Lines 131-136 bool doesGC(Graph& graph, Node* node) a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp_sec1
- a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp +1 lines
131	case IsNumber:	131	case IsNumber:
132	case IsString:	132	case IsString:
133	case IsObject:	133	case IsObject:
		134	case IsObjectOrNull:
134	case IsFunction:	135	case IsFunction:
135	case TypeOf:	136	case TypeOf:
136	case LogicalNot:	137	case LogicalNot:

Lines 1227-1232 class FixupPhase : public Phase { a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp_sec1
- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp +1 lines
1227	case IsBoolean:	1227	case IsBoolean:
1228	case IsNumber:	1228	case IsNumber:
1229	case IsObject:	1229	case IsObject:
		1230	case IsObjectOrNull:
1230	case IsFunction:	1231	case IsFunction:
1231	case CreateArguments:	1232	case CreateArguments:
1232	case PhantomArguments:	1233	case PhantomArguments:

Lines 63-69 void printInternal(PrintStream& out, LocationKind kind) a/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp_sec1
- a/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp -1 / +5 lines
63	case IsObjectLoc:	63	case IsObjectLoc:
64	out.print("IsObjectLoc");	64	out.print("IsObjectLoc");
65	return;	65	return;
66		66
		67	case IsObjectOrNullLoc:
		68	out.print("IsObjectOrNullLoc");
		69	return;
		70
67	case IsFunctionLoc:	71	case IsFunctionLoc:
68	out.print("IsFunctionLoc");	72	out.print("IsFunctionLoc");
69	return;	73	return;

Lines 51-56 enum LocationKind { a/Source/JavaScriptCore/dfg/DFGHeapLocation.h_sec1
- a/Source/JavaScriptCore/dfg/DFGHeapLocation.h +1 lines
51	InvalidationPointLoc,	51	InvalidationPointLoc,
52	IsFunctionLoc,	52	IsFunctionLoc,
53	IsObjectLoc,	53	IsObjectLoc,
		54	IsObjectOrNullLoc,
54	MyArgumentByValLoc,	55	MyArgumentByValLoc,
55	MyArgumentsLengthLoc,	56	MyArgumentsLengthLoc,
56	NamedPropertyLoc,	57	NamedPropertyLoc,

Lines 246-251 a/Source/JavaScriptCore/dfg/DFGNodeType.h_sec1
- a/Source/JavaScriptCore/dfg/DFGNodeType.h +1 lines
246	macro(IsNumber, NodeResultBoolean) \	246	macro(IsNumber, NodeResultBoolean) \
247	macro(IsString, NodeResultBoolean) \	247	macro(IsString, NodeResultBoolean) \
248	macro(IsObject, NodeResultBoolean) \	248	macro(IsObject, NodeResultBoolean) \
		249	macro(IsObjectOrNull, NodeResultBoolean) \
249	macro(IsFunction, NodeResultBoolean) \	250	macro(IsFunction, NodeResultBoolean) \
250	macro(TypeOf, NodeResultJS) \	251	macro(TypeOf, NodeResultJS) \
251	macro(LogicalNot, NodeResultBoolean) \	252	macro(LogicalNot, NodeResultBoolean) \



    return JSFunction::create(vm, static_cast<FunctionExecutable*>(functionExecutable), scope);
}

size_t JIT_OPERATION operationIsObjectOrNull(ExecState* exec, EncodedJSValue value)
{
    return jsIsObjectTypeOrNull(exec, JSValue::decode(value));
}

size_t JIT_OPERATION operationIsFunction(EncodedJSValue value)

Lines 102-108 a/Source/JavaScriptCore/dfg/DFGOperations.h_sec1
- a/Source/JavaScriptCore/dfg/DFGOperations.h -1 / +1 lines
102	EncodedJSValue JIT_OPERATION operationGetArgumentByVal(ExecState*, int32_t, int32_t) WTF_INTERNAL;	102	EncodedJSValue JIT_OPERATION operationGetArgumentByVal(ExecState*, int32_t, int32_t) WTF_INTERNAL;
103	JSCell* JIT_OPERATION operationNewFunctionNoCheck(ExecState, JSScope, JSCell*) WTF_INTERNAL;	103	JSCell* JIT_OPERATION operationNewFunctionNoCheck(ExecState, JSScope, JSCell*) WTF_INTERNAL;
104	double JIT_OPERATION operationFModOnInts(int32_t, int32_t) WTF_INTERNAL;	104	double JIT_OPERATION operationFModOnInts(int32_t, int32_t) WTF_INTERNAL;
105	size_t JIT_OPERATION operationIsObject(ExecState*, EncodedJSValue) WTF_INTERNAL;	105	size_t JIT_OPERATION operationIsObjectOrNull(ExecState*, EncodedJSValue) WTF_INTERNAL;
106	size_t JIT_OPERATION operationIsFunction(EncodedJSValue) WTF_INTERNAL;	106	size_t JIT_OPERATION operationIsFunction(EncodedJSValue) WTF_INTERNAL;
107	JSCell* JIT_OPERATION operationTypeOf(ExecState, JSCell) WTF_INTERNAL;	107	JSCell* JIT_OPERATION operationTypeOf(ExecState, JSCell) WTF_INTERNAL;
108	char* JIT_OPERATION operationAllocatePropertyStorageWithInitialCapacity(ExecState*) WTF_INTERNAL;	108	char* JIT_OPERATION operationAllocatePropertyStorageWithInitialCapacity(ExecState*) WTF_INTERNAL;

Lines 355-360 class PredictionPropagationPhase : public Phase { a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp_sec1
- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp +1 lines
355	case IsNumber:	355	case IsNumber:
356	case IsString:	356	case IsString:
357	case IsObject:	357	case IsObject:
		358	case IsObjectOrNull:
358	case IsFunction: {	359	case IsFunction: {
359	changed \|= setPrediction(SpecBoolean);	360	changed \|= setPrediction(SpecBoolean);
360	break;	361	break;

Lines 206-211 bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node) a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h_sec1
- a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h +1 lines
206	case IsNumber:	206	case IsNumber:
207	case IsString:	207	case IsString:
208	case IsObject:	208	case IsObject:
		209	case IsObjectOrNull:
209	case IsFunction:	210	case IsFunction:
210	case TypeOf:	211	case TypeOf:
211	case LogicalNot:	212	case LogicalNot:




    case IsObject: {
        JSValueOperand value(this, node->child1());
        GPRTemporary result(this, Reuse, value, TagWord);

        JITCompiler::Jump isNotCell = branchNotCell(value.jsValueRegs());

        m_jit.compare8(JITCompiler::AboveOrEqual,
            JITCompiler::Address(value.payloadGPR(), JSCell::typeInfoTypeOffset()),
            TrustedImm32(ObjectType),
            result.gpr());
        JITCompiler::Jump done = m_jit.jump();

        isNotCell.link(&m_jit);
        m_jit.move(TrustedImm32(0), result.gpr());

        done.link(&m_jit);
        booleanResult(result.gpr(), node);
        break;
    }

    case IsObjectOrNull: {
        JSValueOperand value(this, node->child1());
        GPRReg valueTagGPR = value.tagGPR();
        GPRReg valuePayloadGPR = value.payloadGPR();
        GPRFlushedCallResult result(this);
        GPRReg resultGPR = result.gpr();
        flushRegisters();
        callOperation(operationIsObjectOrNull, resultGPR, valueTagGPR, valuePayloadGPR);
        booleanResult(result.gpr(), node);
        break;
    }



        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
        break;
    }

    case IsObject: {
        JSValueOperand value(this, node->child1());
        GPRTemporary result(this, Reuse, value);

        JITCompiler::Jump isNotCell = branchNotCell(value.jsValueRegs());

        m_jit.compare8(JITCompiler::AboveOrEqual,
            JITCompiler::Address(value.gpr(), JSCell::typeInfoTypeOffset()),
            TrustedImm32(ObjectType),
            result.gpr());
        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
        JITCompiler::Jump done = m_jit.jump();

        isNotCell.link(&m_jit);
        m_jit.move(TrustedImm32(ValueFalse), result.gpr());

        done.link(&m_jit);
        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
        break;
    }

    case IsObjectOrNull: {
        JSValueOperand value(this, node->child1());
        GPRReg valueGPR = value.gpr();
        GPRFlushedCallResult result(this);
        GPRReg resultGPR = result.gpr();
        flushRegisters();
        callOperation(operationIsObjectOrNull, resultGPR, valueGPR);
        m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
        break;

Lines 152-157 inline CapabilityLevel canCompile(Node* node) a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp_sec1
- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp +1 lines
152	case IsNumber:	152	case IsNumber:
153	case IsString:	153	case IsString:
154	case IsObject:	154	case IsObject:
		155	case IsObjectOrNull:
155	case IsFunction:	156	case IsFunction:
156	case CheckHasInstance:	157	case CheckHasInstance:
157	case InstanceOf:	158	case InstanceOf:

Lines 744-749 class LowerDFGToLLVM { a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec1
- a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp -28 / +41 lines
744	case IsObject:	744	case IsObject:
745	compileIsObject();	745	compileIsObject();
746	break;	746	break;
		747	case IsObjectOrNull:
		748	compileIsObjectOrNull();
		749	break;
747	case IsFunction:	750	case IsFunction:
748	compileIsFunction();	751	compileIsFunction();
749	break;	752	break;
Lines 3060-3068 class LowerDFGToLLVM { a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec2
3060	ValueFromBlock simpleResult = m_out.anchor(value);	3063	ValueFromBlock simpleResult = m_out.anchor(value);
3061	LValue isStringPredicate;	3064	LValue isStringPredicate;
3062	if (m_node->child1()->prediction() & SpecString) {	3065	if (m_node->child1()->prediction() & SpecString) {
3063	isStringPredicate = m_out.equal(	3066	isStringPredicate = isString(value);
3064	m_out.load32(value, m_heaps.JSCell_structureID),
3065	m_out.constInt32(vm().stringStructure->id()));
3066	} else	3067	} else
3067	isStringPredicate = m_out.booleanFalse;	3068	isStringPredicate = m_out.booleanFalse;
3068	m_out.branch(isStringPredicate, unsure(continuation), unsure(notString));	3069	m_out.branch(isStringPredicate, unsure(continuation), unsure(notString));
Lines 4087-4097 class LowerDFGToLLVM { a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec3
4087	m_out.appendTo(continuation, lastNext);	4088	m_out.appendTo(continuation, lastNext);
4088	setBoolean(m_out.phi(m_out.boolean, notCellResult, cellResult));	4089	setBoolean(m_out.phi(m_out.boolean, notCellResult, cellResult));
4089	}	4090	}
4090		4091
4091	void compileIsObject()	4092	void compileIsObject()
4092	{	4093	{
		4094	LValue value = lowJSValue(m_node->child1());
		4095
		4096	LBasicBlock isCellCase = FTL_NEW_BLOCK(m_out, ("IsObject cell case"));
		4097	LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("IsObject continuation"));
		4098
		4099	ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
		4100	m_out.branch(isCell(value), unsure(isCellCase), unsure(continuation));
		4101
		4102	LBasicBlock lastNext = m_out.appendTo(isCellCase, continuation);
		4103	ValueFromBlock cellResult = m_out.anchor(isObject(value));
		4104	m_out.jump(continuation);
		4105
		4106	m_out.appendTo(continuation, lastNext);
		4107	setBoolean(m_out.phi(m_out.boolean, notCellResult, cellResult));
		4108	}
		4109
		4110	void compileIsObjectOrNull()
		4111	{
4093	LValue pointerResult = vmCall(	4112	LValue pointerResult = vmCall(
4094	m_out.operation(operationIsObject), m_callFrame, lowJSValue(m_node->child1()));	4113	m_out.operation(operationIsObjectOrNull), m_callFrame, lowJSValue(m_node->child1()));
4095	setBoolean(m_out.notNull(pointerResult));	4114	setBoolean(m_out.notNull(pointerResult));
4096	}	4115	}
4097		4116
Lines 5013-5022 class LowerDFGToLLVM { a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec4
5013	return;	5032	return;
5014	}	5033	}
5015		5034
5016	LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);	5035	FTL_TYPE_CHECK(jsValueValue(cell), edge, filter, isNotObject(cell));
5017	FTL_TYPE_CHECK(
5018	jsValueValue(cell), edge, filter,
5019	m_out.equal(structureID, m_out.constInt32(vm().stringStructure->id())));
5020	speculate(	5036	speculate(
5021	BadType, jsValueValue(cell), edge.node(),	5037	BadType, jsValueValue(cell), edge.node(),
5022	m_out.testNonZero8(	5038	m_out.testNonZero8(
Lines 5326-5335 class LowerDFGToLLVM { a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec5
5326	break;	5342	break;
5327	case CellCaseSpeculatesObject:	5343	case CellCaseSpeculatesObject:
5328	FTL_TYPE_CHECK(	5344	FTL_TYPE_CHECK(
5329	jsValueValue(value), edge, (~SpecCell) \| SpecObject,	5345	jsValueValue(value), edge, (~SpecCell) \| SpecObject, isNotObject(value));
5330	m_out.equal(
5331	m_out.load32(value, m_heaps.JSCell_structureID),
5332	m_out.constInt32(vm().stringStructure->id())));
5333	break;	5346	break;
5334	}	5347	}
5335		5348
Lines 6156-6169 class LowerDFGToLLVM { a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec6
6156		6169
6157	LValue isObject(LValue cell)	6170	LValue isObject(LValue cell)
6158	{	6171	{
6159	return m_out.notEqual(	6172	return m_out.aboveOrEqual(
6160	m_out.load32(cell, m_heaps.JSCell_structureID),	6173	m_out.load8(cell, m_heaps.JSCell_typeInfoType),
6161	m_out.constInt32(vm().stringStructure->id()));	6174	m_out.constInt8(ObjectType));
6162	}	6175	}
6163		6176
		6177	LValue isNotObject(LValue cell)
		6178	{
		6179	return m_out.below(
		6180	m_out.load8(cell, m_heaps.JSCell_typeInfoType),
		6181	m_out.constInt8(ObjectType));
		6182	}
		6183
6164	LValue isNotString(LValue cell)	6184	LValue isNotString(LValue cell)
6165	{	6185	{
6166	return isObject(cell);	6186	return m_out.notEqual(
		6187	m_out.load32(cell, m_heaps.JSCell_structureID),
		6188	m_out.constInt32(vm().stringStructure->id()));
6167	}	6189	}
6168		6190
6169	LValue isString(LValue cell)	6191	LValue isString(LValue cell)
Lines 6173-6183 class LowerDFGToLLVM { a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec7
6173	m_out.constInt32(vm().stringStructure->id()));	6195	m_out.constInt32(vm().stringStructure->id()));
6174	}	6196	}
6175		6197
6176	LValue isNotObject(LValue cell)
6177	{
6178	return isString(cell);
6179	}
6180
6181	LValue isArrayType(LValue cell, ArrayMode arrayMode)	6198	LValue isArrayType(LValue cell, ArrayMode arrayMode)
6182	{	6199	{
6183	switch (arrayMode.type()) {	6200	switch (arrayMode.type()) {
Lines 6375-6385 class LowerDFGToLLVM { a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp_sec8
6375		6392
6376	void speculateNonNullObject(Edge edge, LValue cell)	6393	void speculateNonNullObject(Edge edge, LValue cell)
6377	{	6394	{
6378	FTL_TYPE_CHECK(	6395	FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecObject, isNotObject(cell));
6379	jsValueValue(cell), edge, SpecObject,
6380	m_out.equal(
6381	m_out.load32(cell, m_heaps.JSCell_structureID),
6382	m_out.constInt32(vm().stringStructure->id())));
6383	if (masqueradesAsUndefinedWatchpointIsStillValid())	6396	if (masqueradesAsUndefinedWatchpointIsStillValid())
6384	return;	6397	return;
6385		6398



        DEFINE_SLOW_OP(greater)
        DEFINE_SLOW_OP(greatereq)
        DEFINE_SLOW_OP(is_function)
        DEFINE_SLOW_OP(is_object_or_null)
        DEFINE_SLOW_OP(typeof)

        DEFINE_OP(op_touch_entry)

        DEFINE_OP(op_is_boolean)
        DEFINE_OP(op_is_number)
        DEFINE_OP(op_is_string)
        DEFINE_OP(op_is_object)
        DEFINE_OP(op_jeq_null)
        DEFINE_OP(op_jfalse)
        DEFINE_OP(op_jmp)

Lines 489-494 a/Source/JavaScriptCore/jit/JIT.h_sec1
- a/Source/JavaScriptCore/jit/JIT.h +1 lines
489	void emit_op_is_boolean(Instruction*);	489	void emit_op_is_boolean(Instruction*);
490	void emit_op_is_number(Instruction*);	490	void emit_op_is_number(Instruction*);
491	void emit_op_is_string(Instruction*);	491	void emit_op_is_string(Instruction*);
		492	void emit_op_is_object(Instruction*);
492	void emit_op_jeq_null(Instruction*);	493	void emit_op_jeq_null(Instruction*);
493	void emit_op_jfalse(Instruction*);	494	void emit_op_jfalse(Instruction*);
494	void emit_op_jmp(Instruction*);	495	void emit_op_jmp(Instruction*);



    emitPutVirtualRegister(dst);
}

void JIT::emit_op_is_object(Instruction* currentInstruction)
{
    int dst = currentInstruction[1].u.operand;
    int value = currentInstruction[2].u.operand;

    emitGetVirtualRegister(value, regT0);
    Jump isNotCell = emitJumpIfNotJSCell(regT0);

    compare8(AboveOrEqual, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType), regT0);
    emitTagAsBoolImmediate(regT0);
    Jump done = jump();

    isNotCell.link(this);
    move(TrustedImm32(ValueFalse), regT0);

    done.link(this);
    emitPutVirtualRegister(dst);
}

void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
{
    int arguments = currentInstruction[1].u.operand;



    emitStoreBool(dst, regT0);
}

void JIT::emit_op_is_object(Instruction* currentInstruction)
{
    int dst = currentInstruction[1].u.operand;
    int value = currentInstruction[2].u.operand;

    emitLoad(value, regT1, regT0);
    Jump isNotCell = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));

    compare8(AboveOrEqual, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType), regT0);
    Jump done = jump();

    isNotCell.link(this);
    move(TrustedImm32(0), regT0);

    done.link(this);
    emitStoreBool(dst, regT0);
}

void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
{
    VirtualRegister arguments = VirtualRegister(currentInstruction[1].u.operand);



    dispatch(3)


_llint_op_is_object_or_null:
    traceExecution()
    callSlowPath(_slow_path_is_object_or_null)
    dispatch(3)


_llint_op_is_function:
    traceExecution()
    callSlowPath(_slow_path_is_function)



    dispatch(3)


_llint_op_is_object:
    traceExecution()
    loadi 8[PC], t1
    loadi 4[PC], t2
    loadConstantOrVariable(t1, t0, t3)
    storei BooleanTag, TagOffset[cfr, t2, 8]
    bineq t0, CellTag, .opIsObjectNotCell
    cbaeq JSCell::m_type[t3], ObjectType, t1
    storei t1, PayloadOffset[cfr, t2, 8]
    dispatch(3)
.opIsObjectNotCell:
    storep 0, PayloadOffset[cfr, t2, 8]
    dispatch(3)


macro loadPropertyAtVariableOffsetKnownNotInline(propertyOffset, objectAndStorage, tag, payload)
    assert(macro (ok) bigteq propertyOffset, firstOutOfLineOffset, ok end)
    negi propertyOffset



    dispatch(3)


_llint_op_is_object:
    traceExecution()
    loadisFromInstruction(2, t1)
    loadisFromInstruction(1, t2)
    loadConstantOrVariable(t1, t0)
    btqnz t0, tagMask, .opIsObjectNotCell
    cbaeq JSCell::m_type[t0], ObjectType, t1
    orq ValueFalse, t1
    storeq t1, [cfr, t2, 8]
    dispatch(3)
.opIsObjectNotCell:
    storeq ValueFalse, [cfr, t2, 8]
    dispatch(3)


macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
    bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
    loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage



    RETURN(jsTypeStringForValue(exec, OP_C(2).jsValue()));
}

SLOW_PATH_DECL(slow_path_is_object_or_null)
{
    BEGIN();
    RETURN(jsBoolean(jsIsObjectTypeOrNull(exec, OP_C(2).jsValue())));
}

SLOW_PATH_DECL(slow_path_is_function)

Lines 214-219 inline void decodeResult(SlowPathReturnType result, void& a, void& b) a/Source/JavaScriptCore/runtime/CommonSlowPaths.h_sec1
- a/Source/JavaScriptCore/runtime/CommonSlowPaths.h +1 lines
214	SLOW_PATH_HIDDEN_DECL(slow_path_bitxor);	214	SLOW_PATH_HIDDEN_DECL(slow_path_bitxor);
215	SLOW_PATH_HIDDEN_DECL(slow_path_typeof);	215	SLOW_PATH_HIDDEN_DECL(slow_path_typeof);
216	SLOW_PATH_HIDDEN_DECL(slow_path_is_object);	216	SLOW_PATH_HIDDEN_DECL(slow_path_is_object);
		217	SLOW_PATH_HIDDEN_DECL(slow_path_is_object_or_null);
217	SLOW_PATH_HIDDEN_DECL(slow_path_is_function);	218	SLOW_PATH_HIDDEN_DECL(slow_path_is_function);
218	SLOW_PATH_HIDDEN_DECL(slow_path_in);	219	SLOW_PATH_HIDDEN_DECL(slow_path_in);
219	SLOW_PATH_HIDDEN_DECL(slow_path_del_by_val);	220	SLOW_PATH_HIDDEN_DECL(slow_path_del_by_val);

Lines 85-91 JSValue jsTypeStringForValue(CallFrame* callFrame, JSValue v) a/Source/JavaScriptCore/runtime/Operations.cpp_sec1
- a/Source/JavaScriptCore/runtime/Operations.cpp -1 / +1 lines
85	return jsTypeStringForValue(callFrame->vm(), callFrame->lexicalGlobalObject(), v);	85	return jsTypeStringForValue(callFrame->vm(), callFrame->lexicalGlobalObject(), v);
86	}	86	}
87		87
88	bool jsIsObjectType(CallFrame* callFrame, JSValue v)	88	bool jsIsObjectTypeOrNull(CallFrame* callFrame, JSValue v)
89	{	89	{
90	if (!v.isCell())	90	if (!v.isCell())
91	return v.isNull();	91	return v.isNull();

Lines 31-37 a/Source/JavaScriptCore/runtime/Operations.h_sec1
- a/Source/JavaScriptCore/runtime/Operations.h -1 / +1 lines
31	NEVER_INLINE JSValue jsAddSlowCase(CallFrame*, JSValue, JSValue);	31	NEVER_INLINE JSValue jsAddSlowCase(CallFrame*, JSValue, JSValue);
32	JSValue jsTypeStringForValue(CallFrame*, JSValue);	32	JSValue jsTypeStringForValue(CallFrame*, JSValue);
33	JSValue jsTypeStringForValue(VM&, JSGlobalObject*, JSValue);	33	JSValue jsTypeStringForValue(VM&, JSGlobalObject*, JSValue);
34	bool jsIsObjectType(CallFrame*, JSValue);	34	bool jsIsObjectTypeOrNull(CallFrame*, JSValue);
35	bool jsIsFunctionType(JSValue);	35	bool jsIsFunctionType(JSValue);
36		36
37	ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, JSString* s2)	37	ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, JSString* s2)

Return to Bug 141640

Lines 1083-1089 RegisterID* BytecodeGenerator::emitEqualityOp(OpcodeID opcodeID, RegisterID* dst a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp_sec1
- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp -10 / +1 lines
1083	}	1083	}
1084	if (value == "object") {	1084	if (value == "object") {
1085	rewindUnaryOp();	1085	rewindUnaryOp();
1086	emitOpcode(op_is_object);	1086	emitOpcode(op_is_object_or_null);
1087	instructions().append(dst->index());	1087	instructions().append(dst->index());
1088	instructions().append(srcIndex);	1088	instructions().append(srcIndex);
1089	return dst;	1089	return dst;
Lines 1945-1959 RegisterID* BytecodeGenerator::emitReturn(RegisterID* src) a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp_sec2
1945	instructions().append(isObjectRegister->index());	1945	instructions().append(isObjectRegister->index());
1946	instructions().append(isObjectLabel->bind(begin, instructions().size()));	1946	instructions().append(isObjectLabel->bind(begin, instructions().size()));
1947		1947
1948	emitOpcode(op_is_function);
1949	instructions().append(isObjectRegister->index());
1950	instructions().append(src->index());
1951
1952	begin = instructions().size();
1953	emitOpcode(op_jtrue);
1954	instructions().append(isObjectRegister->index());
1955	instructions().append(isObjectLabel->bind(begin, instructions().size()));
1956
1957	emitUnaryNoDstOp(op_ret, &m_thisRegister);	1948	emitUnaryNoDstOp(op_ret, &m_thisRegister);
1958		1949
1959	emitLabel(isObjectLabel.get());	1950	emitLabel(isObjectLabel.get());

Lines 789-794 a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec1
- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h -1 / +2 lines
789	case IsNumber:	789	case IsNumber:
790	case IsString:	790	case IsString:
791	case IsObject:	791	case IsObject:
		792	case IsObjectOrNull:
792	case IsFunction: {	793	case IsFunction: {
793	JSValue child = forNode(node->child1()).value();	794	JSValue child = forNode(node->child1()).value();
794	if (child) {	795	if (child) {
Lines 809-815 a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h_sec2
809	case IsString:	810	case IsString:
810	setConstant(node, jsBoolean(isJSString(child)));	811	setConstant(node, jsBoolean(isJSString(child)));
811	break;	812	break;
812	case IsObject:	813	case IsObjectOrNull:
813	if (child.isNull() \|\| !child.isObject()) {	814	if (child.isNull() \|\| !child.isObject()) {
814	setConstant(node, jsBoolean(child.isNull()));	815	setConstant(node, jsBoolean(child.isNull()));
815	break;	816	break;

Lines 808-816 JSCell* JIT_OPERATION operationNewFunctionNoCheck(ExecState* exec, JSScope* scop a/Source/JavaScriptCore/dfg/DFGOperations.cpp_sec1
- a/Source/JavaScriptCore/dfg/DFGOperations.cpp -2 / +2 lines
808	return JSFunction::create(vm, static_cast<FunctionExecutable*>(functionExecutable), scope);	808	return JSFunction::create(vm, static_cast<FunctionExecutable*>(functionExecutable), scope);
809	}	809	}
810		810
811	size_t JIT_OPERATION operationIsObject(ExecState* exec, EncodedJSValue value)	811	size_t JIT_OPERATION operationIsObjectOrNull(ExecState* exec, EncodedJSValue value)
812	{	812	{
813	return jsIsObjectType(exec, JSValue::decode(value));	813	return jsIsObjectTypeOrNull(exec, JSValue::decode(value));
814	}	814	}
815		815
816	size_t JIT_OPERATION operationIsFunction(EncodedJSValue value)	816	size_t JIT_OPERATION operationIsFunction(EncodedJSValue value)

Lines 4132-4145 void SpeculativeJIT::compile(Node* node) a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp_sec1
- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp -2 / +23 lines
4132	jsValueResult(result.gpr(), node, DataFormatJSBoolean);	4132	jsValueResult(result.gpr(), node, DataFormatJSBoolean);
4133	break;	4133	break;
4134	}	4134	}
4135		4135
4136	case IsObject: {	4136	case IsObject: {
4137	JSValueOperand value(this, node->child1());	4137	JSValueOperand value(this, node->child1());
		4138	GPRTemporary result(this, Reuse, value);
		4139
		4140	JITCompiler::Jump isNotCell = branchNotCell(value.jsValueRegs());
		4141
		4142	m_jit.compare8(JITCompiler::AboveOrEqual,
		4143	JITCompiler::Address(value.gpr(), JSCell::typeInfoTypeOffset()),
		4144	TrustedImm32(ObjectType),
		4145	result.gpr());
		4146	m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
		4147	JITCompiler::Jump done = m_jit.jump();
		4148
		4149	isNotCell.link(&m_jit);
		4150	m_jit.move(TrustedImm32(ValueFalse), result.gpr());
		4151
		4152	done.link(&m_jit);
		4153	jsValueResult(result.gpr(), node, DataFormatJSBoolean);
		4154	break;
		4155	}
		4156
		4157	case IsObjectOrNull: {
		4158	JSValueOperand value(this, node->child1());
4138	GPRReg valueGPR = value.gpr();	4159	GPRReg valueGPR = value.gpr();
4139	GPRFlushedCallResult result(this);	4160	GPRFlushedCallResult result(this);
4140	GPRReg resultGPR = result.gpr();	4161	GPRReg resultGPR = result.gpr();
4141	flushRegisters();	4162	flushRegisters();
4142	callOperation(operationIsObject, resultGPR, valueGPR);	4163	callOperation(operationIsObjectOrNull, resultGPR, valueGPR);
4143	m_jit.or32(TrustedImm32(ValueFalse), resultGPR);	4164	m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
4144	jsValueResult(result.gpr(), node, DataFormatJSBoolean);	4165	jsValueResult(result.gpr(), node, DataFormatJSBoolean);
4145	break;	4166	break;

Lines 983-994 _llint_op_typeof: a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm_sec1
- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm -3 / +2 lines
983	dispatch(3)	983	dispatch(3)
984		984
985		985
986	_llint_op_is_object:	986	_llint_op_is_object_or_null:
987	traceExecution()	987	traceExecution()
988	callSlowPath(_slow_path_is_object)	988	callSlowPath(_slow_path_is_object_or_null)
989	dispatch(3)	989	dispatch(3)
990		990
991
992	_llint_op_is_function:	991	_llint_op_is_function:
993	traceExecution()	992	traceExecution()
994	callSlowPath(_slow_path_is_function)	993	callSlowPath(_slow_path_is_function)

Lines 1-3 a/Source/JavaScriptCore/ChangeLog_sec1
- a/Source/JavaScriptCore/ChangeLog +75 lines
		1	2015-02-18 Yusuke Suzuki <utatane.tea@gmail.com>
		2
		3	Constructor returning null should construct an object instead of null
		4	https://bugs.webkit.org/show_bug.cgi?id=141640
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* JavaScriptCore.order:
		9	* bytecode/BytecodeList.json:
		10	* bytecode/BytecodeUseDef.h:
		11	(JSC::computeUsesForBytecodeOffset):
		12	(JSC::computeDefsForBytecodeOffset):
		13	* bytecode/CodeBlock.cpp:
		14	(JSC::CodeBlock::dumpBytecode):
		15	* bytecompiler/BytecodeGenerator.cpp:
		16	(JSC::BytecodeGenerator::emitEqualityOp):
		17	(JSC::BytecodeGenerator::emitReturn):
		18	* dfg/DFGAbstractInterpreterInlines.h:
		19	(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
		20	* dfg/DFGByteCodeParser.cpp:
		21	(JSC::DFG::ByteCodeParser::parseBlock):
		22	* dfg/DFGCapabilities.cpp:
		23	(JSC::DFG::capabilityLevel):
		24	* dfg/DFGClobberize.h:
		25	(JSC::DFG::clobberize):
		26	* dfg/DFGDoesGC.cpp:
		27	(JSC::DFG::doesGC):
		28	* dfg/DFGFixupPhase.cpp:
		29	(JSC::DFG::FixupPhase::fixupNode):
		30	* dfg/DFGHeapLocation.cpp:
		31	(WTF::printInternal):
		32	* dfg/DFGHeapLocation.h:
		33	* dfg/DFGNodeType.h:
		34	* dfg/DFGOperations.cpp:
		35	* dfg/DFGOperations.h:
		36	* dfg/DFGPredictionPropagationPhase.cpp:
		37	(JSC::DFG::PredictionPropagationPhase::propagate):
		38	* dfg/DFGSafeToExecute.h:
		39	(JSC::DFG::safeToExecute):
		40	* dfg/DFGSpeculativeJIT32_64.cpp:
		41	(JSC::DFG::SpeculativeJIT::compile):
		42	* dfg/DFGSpeculativeJIT64.cpp:
		43	(JSC::DFG::SpeculativeJIT::compile):
		44	* ftl/FTLCapabilities.cpp:
		45	(JSC::FTL::canCompile):
		46	* ftl/FTLLowerDFGToLLVM.cpp:
		47	(JSC::FTL::LowerDFGToLLVM::compileNode):
		48	(JSC::FTL::LowerDFGToLLVM::compileToString):
		49	(JSC::FTL::LowerDFGToLLVM::compileIsObject):
		50	(JSC::FTL::LowerDFGToLLVM::compileIsObjectOrNull):
		51	(JSC::FTL::LowerDFGToLLVM::speculateTruthyObject):
		52	(JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
		53	(JSC::FTL::LowerDFGToLLVM::isObject):
		54	(JSC::FTL::LowerDFGToLLVM::isNotObject):
		55	(JSC::FTL::LowerDFGToLLVM::isNotString):
		56	(JSC::FTL::LowerDFGToLLVM::speculateNonNullObject):
		57	* jit/JIT.cpp:
		58	(JSC::JIT::privateCompileMainPass):
		59	* jit/JIT.h:
		60	* jit/JITOpcodes.cpp:
		61	(JSC::JIT::emit_op_is_string):
		62	(JSC::JIT::emit_op_is_object):
		63	* jit/JITOpcodes32_64.cpp:
		64	(JSC::JIT::emit_op_is_object):
65	* llint/LowLevelInterpreter.asm:
66	* llint/LowLevelInterpreter32_64.asm:
67	* llint/LowLevelInterpreter64.asm:
68	* runtime/CommonSlowPaths.cpp:
69	(JSC::SLOW_PATH_DECL):
70	* runtime/CommonSlowPaths.h:
71	* runtime/Operations.cpp:
72	(JSC::jsIsObjectTypeOrNull):
73	(JSC::jsIsObjectType): Deleted.
74	* runtime/Operations.h:
75
1	2015-02-18 Csaba Osztrogonác <ossy@webkit.org>	76	2015-02-18 Csaba Osztrogonác <ossy@webkit.org>
2		77
3	URTBF after r180258 to fix Windows build.	78	URTBF after r180258 to fix Windows build.

Lines 1349-1355 __ZN3JSC17BytecodeGenerator20emitNextPropertyNameEPNS_10RegisterIDES2_S2_S2_S2_P a/Source/JavaScriptCore/JavaScriptCore.order_sec1
- a/Source/JavaScriptCore/JavaScriptCore.order -6 / +3 lines
1349	__ZN3JSC11PostfixNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE	1349	__ZN3JSC11PostfixNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
1350	__ZN3JSC11PostfixNode11emitResolveERNS_17BytecodeGeneratorEPNS_10RegisterIDE	1350	__ZN3JSC11PostfixNode11emitResolveERNS_17BytecodeGeneratorEPNS_10RegisterIDE
1351	__ZN3JSC17BytecodeGenerator7emitIncEPNS_10RegisterIDE	1351	__ZN3JSC17BytecodeGenerator7emitIncEPNS_10RegisterIDE
1352	__ZN3JSC14jsIsObjectTypeEPNS_9ExecStateENS_7JSValueE
1353	__ZN3JSC6JSCell11getCallDataEPS0_RNS_8CallDataE	1352	__ZN3JSC6JSCell11getCallDataEPS0_RNS_8CallDataE
1354	__ZN3JSC8JSObject16getPropertyNamesEPS0_PNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE	1353	__ZN3JSC8JSObject16getPropertyNamesEPS0_PNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
1355	__ZN3JSC8JSObject19getOwnPropertyNamesEPS0_PNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE	1354	__ZN3JSC8JSObject19getOwnPropertyNamesEPS0_PNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
Lines 1666-1672 _cti_op_get_by_val_generic a/Source/JavaScriptCore/JavaScriptCore.order_sec2
1666	__ZN3JSCL8getByValEPNS_9ExecStateENS_7JSValueES2_NS_16ReturnAddressPtrE	1665	__ZN3JSCL8getByValEPNS_9ExecStateENS_7JSValueES2_NS_16ReturnAddressPtrE
1667	_cti_op_stricteq	1666	_cti_op_stricteq
1668	_cti_op_jtrue	1667	_cti_op_jtrue
1669	_cti_op_is_object	1668	_cti_op_is_object_or_null
1670	__ZN3JSC8JSString12toThisObjectEPNS_6JSCellEPNS_9ExecStateE	1669	__ZN3JSC8JSString12toThisObjectEPNS_6JSCellEPNS_9ExecStateE
1671	__ZN3JSC12StringObjectC1ERNS_2VMEPNS_9StructureE	1670	__ZN3JSC12StringObjectC1ERNS_2VMEPNS_9StructureE
1672	__ZNK3JSC6JSCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE	1671	__ZNK3JSC6JSCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
Lines 2964-2970 __ZN3JSC6ParserINS_5LexerItEEE19parseBreakStatementINS_10ASTBuilderEEENT_9Statem a/Source/JavaScriptCore/JavaScriptCore.order_sec3
2964	__ZN3WTF6VectorIPN3JSC8JSObjectELm4ENS_15CrashOnOverflowEE15reserveCapacityEm	2963	__ZN3WTF6VectorIPN3JSC8JSObjectELm4ENS_15CrashOnOverflowEE15reserveCapacityEm
2965	__ZN3WTF15BinarySemaphore4waitEd	2964	__ZN3WTF15BinarySemaphore4waitEd
2966	__ZN3WTF15BinarySemaphore6signalEv	2965	__ZN3WTF15BinarySemaphore6signalEv
2967	_JSValueIsObject
2968	__ZN3JSCL19arrayProtoFuncShiftEPNS_9ExecStateE	2966	__ZN3JSCL19arrayProtoFuncShiftEPNS_9ExecStateE
2969	__ZN3JSC5shiftILNS_7JSArray14ShiftCountModeE0EEEvPNS_9ExecStateEPNS_8JSObjectEjjjj	2967	__ZN3JSC5shiftILNS_7JSArray14ShiftCountModeE0EEEvPNS_9ExecStateEPNS_8JSObjectEjjjj
2970	__ZN3JSC7JSArray26shiftCountWithArrayStorageEjjPNS_12ArrayStorageE	2968	__ZN3JSC7JSArray26shiftCountWithArrayStorageEjjPNS_12ArrayStorageE
Lines 3391-3397 _operationEnsureContiguous a/Source/JavaScriptCore/JavaScriptCore.order_sec4
3391	__ZN3JSC8JSObject20ensureContiguousSlowERNS_2VME	3389	__ZN3JSC8JSObject20ensureContiguousSlowERNS_2VME
3392	__ZN3JSC8JSObject20ensureContiguousSlowERNS_2VMENS0_22DoubleToContiguousModeE	3390	__ZN3JSC8JSObject20ensureContiguousSlowERNS_2VMENS0_22DoubleToContiguousModeE
3393	_operationMakeRope3	3391	_operationMakeRope3
3394	_operationIsObject
3395	__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPFxPNS_9ExecStateExPNS_7JSArrayEENS0_11NoResultTagENS_12X86Registers10RegisterIDESE_SE_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_T4_NS0_18SpillRegistersModeE	3392	__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPFxPNS_9ExecStateExPNS_7JSArrayEENS0_11NoResultTagENS_12X86Registers10RegisterIDESE_SE_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_T4_NS0_18SpillRegistersModeE
3396	__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateExPNS_7JSArrayEENS_12X86Registers10RegisterIDES9_S9_	3393	__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateExPNS_7JSArrayEENS_12X86Registers10RegisterIDES9_S9_
3397	_operationArrayPush	3394	_operationArrayPush
Lines 4898-4904 _llint_slow_path_bitxor a/Source/JavaScriptCore/JavaScriptCore.order_sec5
4898	_llint_slow_path_check_has_instance	4895	_llint_slow_path_check_has_instance
4899	_llint_slow_path_instanceof	4896	_llint_slow_path_instanceof
4900	_llint_slow_path_typeof	4897	_llint_slow_path_typeof
4901	_llint_slow_path_is_object	4898	_llint_slow_path_is_object_or_null
4902	_llint_slow_path_is_function	4899	_llint_slow_path_is_function
4903	_llint_slow_path_in	4900	_llint_slow_path_in
4904	_llint_slow_path_resolve	4901	_llint_slow_path_resolve
Lines 5036-5042 _llint_op_greater a/Source/JavaScriptCore/JavaScriptCore.order_sec6
5036	_llint_op_greatereq	5033	_llint_op_greatereq
5037	_llint_op_mod	5034	_llint_op_mod
5038	_llint_op_typeof	5035	_llint_op_typeof
5039	_llint_op_is_object	5036	_llint_op_is_object_or_null
5040	_llint_op_is_function	5037	_llint_op_is_function
5041	_llint_op_in	5038	_llint_op_in
5042	_llint_op_put_to_base_variable	5039	_llint_op_put_to_base_variable

Lines 4066-4077 void SpeculativeJIT::compile(Node* node) a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp_sec1
- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp -1 / +21 lines
4066		4066
4067	case IsObject: {	4067	case IsObject: {
4068	JSValueOperand value(this, node->child1());	4068	JSValueOperand value(this, node->child1());
		4069	GPRTemporary result(this, Reuse, value, TagWord);
		4070
		4071	JITCompiler::Jump isNotCell = branchNotCell(value.jsValueRegs());
		4072
		4073	m_jit.compare8(JITCompiler::AboveOrEqual,
		4074	JITCompiler::Address(value.payloadGPR(), JSCell::typeInfoTypeOffset()),
		4075	TrustedImm32(ObjectType),
		4076	result.gpr());
		4077	JITCompiler::Jump done = m_jit.jump();
		4078
		4079	isNotCell.link(&m_jit);
		4080	m_jit.move(TrustedImm32(0), result.gpr());
		4081
		4082	done.link(&m_jit);
		4083	booleanResult(result.gpr(), node);
		4084	break;
		4085	}
		4086
		4087	case IsObjectOrNull: {
		4088	JSValueOperand value(this, node->child1());
4069	GPRReg valueTagGPR = value.tagGPR();	4089	GPRReg valueTagGPR = value.tagGPR();
4070	GPRReg valuePayloadGPR = value.payloadGPR();	4090	GPRReg valuePayloadGPR = value.payloadGPR();
4071	GPRFlushedCallResult result(this);	4091	GPRFlushedCallResult result(this);
4072	GPRReg resultGPR = result.gpr();	4092	GPRReg resultGPR = result.gpr();
4073	flushRegisters();	4093	flushRegisters();
4074	callOperation(operationIsObject, resultGPR, valueTagGPR, valuePayloadGPR);	4094	callOperation(operationIsObjectOrNull, resultGPR, valueTagGPR, valuePayloadGPR);
4075	booleanResult(result.gpr(), node);	4095	booleanResult(result.gpr(), node);
4076	break;	4096	break;
4077	}	4097	}

Lines 185-191 void JIT::privateCompileMainPass() a/Source/JavaScriptCore/jit/JIT.cpp_sec1
- a/Source/JavaScriptCore/jit/JIT.cpp -1 / +2 lines
185	DEFINE_SLOW_OP(greater)	185	DEFINE_SLOW_OP(greater)
186	DEFINE_SLOW_OP(greatereq)	186	DEFINE_SLOW_OP(greatereq)
187	DEFINE_SLOW_OP(is_function)	187	DEFINE_SLOW_OP(is_function)
188	DEFINE_SLOW_OP(is_object)	188	DEFINE_SLOW_OP(is_object_or_null)
189	DEFINE_SLOW_OP(typeof)	189	DEFINE_SLOW_OP(typeof)
190		190
191	DEFINE_OP(op_touch_entry)	191	DEFINE_OP(op_touch_entry)
Lines 225-230 void JIT::privateCompileMainPass() a/Source/JavaScriptCore/jit/JIT.cpp_sec2
225	DEFINE_OP(op_is_boolean)	225	DEFINE_OP(op_is_boolean)
226	DEFINE_OP(op_is_number)	226	DEFINE_OP(op_is_number)
227	DEFINE_OP(op_is_string)	227	DEFINE_OP(op_is_string)
		228	DEFINE_OP(op_is_object)
228	DEFINE_OP(op_jeq_null)	229	DEFINE_OP(op_jeq_null)
229	DEFINE_OP(op_jfalse)	230	DEFINE_OP(op_jfalse)
230	DEFINE_OP(op_jmp)	231	DEFINE_OP(op_jmp)

Lines 225-230 void JIT::emit_op_is_string(Instruction* currentInstruction) a/Source/JavaScriptCore/jit/JITOpcodes.cpp_sec1
- a/Source/JavaScriptCore/jit/JITOpcodes.cpp +19 lines
225	emitPutVirtualRegister(dst);	225	emitPutVirtualRegister(dst);
226	}	226	}
227		227
		228	void JIT::emit_op_is_object(Instruction* currentInstruction)
		229	{
		230	int dst = currentInstruction[1].u.operand;
		231	int value = currentInstruction[2].u.operand;
		232
		233	emitGetVirtualRegister(value, regT0);
		234	Jump isNotCell = emitJumpIfNotJSCell(regT0);
		235
		236	compare8(AboveOrEqual, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType), regT0);
		237	emitTagAsBoolImmediate(regT0);
		238	Jump done = jump();
		239
		240	isNotCell.link(this);
		241	move(TrustedImm32(ValueFalse), regT0);
		242
		243	done.link(this);
		244	emitPutVirtualRegister(dst);
		245	}
		246
228	void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)	247	void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
229	{	248	{
230	int arguments = currentInstruction[1].u.operand;	249	int arguments = currentInstruction[1].u.operand;

Lines 331-336 void JIT::emit_op_is_string(Instruction* currentInstruction) a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp_sec1
- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp +18 lines
331	emitStoreBool(dst, regT0);	331	emitStoreBool(dst, regT0);
332	}	332	}
333		333
		334	void JIT::emit_op_is_object(Instruction* currentInstruction)
		335	{
		336	int dst = currentInstruction[1].u.operand;
		337	int value = currentInstruction[2].u.operand;
		338
		339	emitLoad(value, regT1, regT0);
		340	Jump isNotCell = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
		341
		342	compare8(AboveOrEqual, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType), regT0);
		343	Jump done = jump();
		344
		345	isNotCell.link(this);
		346	move(TrustedImm32(0), regT0);
		347
		348	done.link(this);
		349	emitStoreBool(dst, regT0);
		350	}
		351
334	void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)	352	void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
335	{	353	{
336	VirtualRegister arguments = VirtualRegister(currentInstruction[1].u.operand);	354	VirtualRegister arguments = VirtualRegister(currentInstruction[1].u.operand);

Lines 1333-1338 _llint_op_is_string: a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm_sec1
- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm +15 lines
1333	dispatch(3)	1333	dispatch(3)
1334		1334
1335		1335
		1336	_llint_op_is_object:
		1337	traceExecution()
		1338	loadi 8[PC], t1
		1339	loadi 4[PC], t2
		1340	loadConstantOrVariable(t1, t0, t3)
		1341	storei BooleanTag, TagOffset[cfr, t2, 8]
		1342	bineq t0, CellTag, .opIsObjectNotCell
		1343	cbaeq JSCell::m_type[t3], ObjectType, t1
		1344	storei t1, PayloadOffset[cfr, t2, 8]
		1345	dispatch(3)
		1346	.opIsObjectNotCell:
		1347	storep 0, PayloadOffset[cfr, t2, 8]
		1348	dispatch(3)
		1349
		1350
1336	macro loadPropertyAtVariableOffsetKnownNotInline(propertyOffset, objectAndStorage, tag, payload)	1351	macro loadPropertyAtVariableOffsetKnownNotInline(propertyOffset, objectAndStorage, tag, payload)
1337	assert(macro (ok) bigteq propertyOffset, firstOutOfLineOffset, ok end)	1352	assert(macro (ok) bigteq propertyOffset, firstOutOfLineOffset, ok end)
1338	negi propertyOffset	1353	negi propertyOffset

Lines 1206-1211 _llint_op_is_string: a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm_sec1
- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm +15 lines
1206	dispatch(3)	1206	dispatch(3)
1207		1207
1208		1208
		1209	_llint_op_is_object:
		1210	traceExecution()
		1211	loadisFromInstruction(2, t1)
		1212	loadisFromInstruction(1, t2)
		1213	loadConstantOrVariable(t1, t0)
		1214	btqnz t0, tagMask, .opIsObjectNotCell
		1215	cbaeq JSCell::m_type[t0], ObjectType, t1
		1216	orq ValueFalse, t1
		1217	storeq t1, [cfr, t2, 8]
		1218	dispatch(3)
		1219	.opIsObjectNotCell:
		1220	storeq ValueFalse, [cfr, t2, 8]
		1221	dispatch(3)
		1222
		1223
1209	macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)	1224	macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
1210	bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline	1225	bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
1211	loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage	1226	loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage

Lines 455-464 static CommonSlowPaths::ArityCheckData* setupArityCheckData(VM& vm, int slotsToA a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp_sec1
- a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp -2 / +2 lines
455	RETURN(jsTypeStringForValue(exec, OP_C(2).jsValue()));	455	RETURN(jsTypeStringForValue(exec, OP_C(2).jsValue()));
456	}	456	}
457		457
458	SLOW_PATH_DECL(slow_path_is_object)	458	SLOW_PATH_DECL(slow_path_is_object_or_null)
459	{	459	{
460	BEGIN();	460	BEGIN();
461	RETURN(jsBoolean(jsIsObjectType(exec, OP_C(2).jsValue())));	461	RETURN(jsBoolean(jsIsObjectTypeOrNull(exec, OP_C(2).jsValue())));
462	}	462	}
463		463
464	SLOW_PATH_DECL(slow_path_is_function)	464	SLOW_PATH_DECL(slow_path_is_function)