Source/JavaScriptCore/ChangeLog

 12014-04-07 Filip Pizlo <fpizlo@apple.com>
 2
 3 Setters are just getters that take an extra argument and don't return a value
 4 https://bugs.webkit.org/show_bug.cgi?id=131336
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 Other than that, they're totally the same thing.
 9
 10 This isn't as dumb as it sounds.
 11
 12 Most of the work in calling an accessor has to do with emitting the necessary checks for
 13 figuring out whether we're calling the accessor we expected, followed by the boilerplate
 14 needed for setting up a call inside of a stub. It makes sense for the code to be totally
 15 common.
 16
 17 * jit/AssemblyHelpers.h:
 18 (JSC::AssemblyHelpers::storeValue):
 19 (JSC::AssemblyHelpers::moveTrustedValue):
 20 * jit/CCallHelpers.h:
 21 (JSC::CCallHelpers::setupResults):
 22 * jit/Repatch.cpp:
 23 (JSC::kindFor):
 24 (JSC::customFor):
 25 (JSC::generateByIdStub):
 26 (JSC::tryCacheGetByID):
 27 (JSC::tryBuildGetByIDList):
 28 (JSC::tryCachePutByID):
 29 (JSC::tryBuildPutByIdList):
 30 (JSC::generateGetByIdStub): Deleted.
 31 (JSC::emitCustomSetterStub): Deleted.
 32 * runtime/JSCJSValue.h:
 33 (JSC::JSValue::asValue):
 34 * runtime/PutPropertySlot.h:
 35 (JSC::PutPropertySlot::cachedOffset):
 36
1372014-04-07 Joseph Pecoraro <pecoraro@apple.com>
238
339 Web Inspector: Hang in debuggable application after receiving WIRPermissionDenied
166901

Source/JavaScriptCore/jit/AssemblyHelpers.h

@@public:
7777 store32(TrustedImm32(JSValue::CellTag), address.withOffset(TagOffset));
7878#endif
7979 }
 80
 81 void storeValue(JSValueRegs regs, Address address)
 82 {
 83#if USE(JSVALUE64)
 84 store64(regs.gpr(), address);
 85#else
 86 store32(regs.payloadGPR(), address.withOffset(PayloadOffset));
 87 store32(regs.tagGPR(), address.withOffset(TagOffset));
 88#endif
 89 }
 90
 91 void moveTrustedValue(JSValue value, JSValueRegs regs)
 92 {
 93#if USE(JSVALUE64)
 94 move(TrustedImm64(JSValue::encode(value)), regs.gpr());
 95#else
 96 move(TrustedImm32(value.tag()), regs.tagGPR());
 97 move(TrustedImm32(value.payload()), regs.payloadGPR());
 98#endif
 99 }
80100
81101#if CPU(X86_64) || CPU(X86)
82102 static size_t prologueStackPointerDelta()
166897

Source/JavaScriptCore/jit/CCallHelpers.h

@@public:
16671667 swap(destA, destB);
16681668 }
16691669
 1670 void setupResults(JSValueRegs regs)
 1671 {
 1672#if USE(JSVALUE64)
 1673 move(GPRInfo::returnValueGPR, regs.gpr());
 1674#else
 1675 setupResults(regs.payloadGPR(), regs.tagGPR());
 1676#endif
 1677 }
 1678
16701679 void jumpToExceptionHandler()
16711680 {
16721681 // genericUnwind() leaves the handler CallFrame* in vm->callFrameForThrow,
166897

Source/JavaScriptCore/jit/Repatch.cpp

@@static void linkRestoreScratch(LinkBuffe
222222 linkRestoreScratch(patchBuffer, needToRestoreScratch, success, fail, failureCases, stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToDone), stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToSlowCase));
223223}
224224
225 static void generateGetByIdStub(
226  ExecState* exec, const PropertySlot& slot, const Identifier& propertyName,
227  StructureStubInfo& stubInfo, StructureChain* chain, size_t count, PropertyOffset offset,
228  Structure* structure, CodeLocationLabel successLabel, CodeLocationLabel slowCaseLabel,
229  RefPtr<JITStubRoutine>& stubRoutine)
 225enum ByIdStubKind {
 226 GetValue,
 227 CallGetter,
 228 CallCustomGetter,
 229 CallSetter,
 230 CallCustomSetter
 231};
 232
 233static ByIdStubKind kindFor(const PropertySlot& slot)
 234{
 235 if (slot.isCacheableValue())
 236 return GetValue;
 237 if (slot.isCacheableCustom())
 238 return CallCustomGetter;
 239 RELEASE_ASSERT(slot.isCacheableGetter());
 240 return CallGetter;
 241}
 242
 243static FunctionPtr customFor(const PropertySlot& slot)
 244{
 245 if (!slot.isCacheableCustom())
 246 return FunctionPtr();
 247 return FunctionPtr(slot.customGetter());
 248}
 249
 250static ByIdStubKind kindFor(const PutPropertySlot& slot)
 251{
 252 RELEASE_ASSERT(!slot.isCacheablePut());
 253 RELEASE_ASSERT(slot.isCacheableCustomProperty());
 254 return CallCustomSetter;
 255}
 256
 257static FunctionPtr customFor(const PutPropertySlot& slot)
 258{
 259 if (!slot.isCacheableCustomProperty())
 260 return FunctionPtr();
 261 return FunctionPtr(slot.customSetter());
 262}
 263
 264static void generateByIdStub(
 265 ExecState* exec, ByIdStubKind kind, const Identifier& propertyName,
 266 FunctionPtr custom, StructureStubInfo& stubInfo, StructureChain* chain, size_t count,
 267 PropertyOffset offset, Structure* structure, CodeLocationLabel successLabel,
 268 CodeLocationLabel slowCaseLabel, RefPtr<JITStubRoutine>& stubRoutine)
230269{
231270 VM* vm = &exec->vm();
232271 GPRReg baseGPR = static_cast<GPRReg>(stubInfo.patch.baseGPR);
 272 JSValueRegs valueRegs = JSValueRegs(
233273#if USE(JSVALUE32_64)
234  GPRReg resultTagGPR = static_cast<GPRReg>(stubInfo.patch.valueTagGPR);
 274 static_cast<GPRReg>(stubInfo.patch.valueTagGPR),
235275#endif
236  GPRReg resultGPR = static_cast<GPRReg>(stubInfo.patch.valueGPR);
 276 static_cast<GPRReg>(stubInfo.patch.valueGPR));
237277 GPRReg scratchGPR = TempRegisterSet(stubInfo.patch.usedRegisters).getFreeGPR();
238278 bool needToRestoreScratch = scratchGPR == InvalidGPRReg;
239  RELEASE_ASSERT(!needToRestoreScratch || slot.isCacheableValue());
 279 RELEASE_ASSERT(!needToRestoreScratch || kind == GetValue);
240280
241281 CCallHelpers stubJit(&exec->vm(), exec->codeBlock());
242282 if (needToRestoreScratch) {
243 #if USE(JSVALUE64)
244  scratchGPR = AssemblyHelpers::selectScratchGPR(baseGPR, resultGPR);
245 #else
246  scratchGPR = AssemblyHelpers::selectScratchGPR(baseGPR, resultGPR, resultTagGPR);
247 #endif
 283 scratchGPR = AssemblyHelpers::selectScratchGPR(
 284 baseGPR, valueRegs.tagGPR(), valueRegs.payloadGPR());
248285 stubJit.pushToSave(scratchGPR);
249286 needToRestoreScratch = true;
250287 }

@@static void generateGetByIdStub(
276313 }
277314 }
278315
279  bool isAccessor = slot.isCacheableGetter() || slot.isCacheableCustom();
 316 bool isAccessor = kind != GetValue;
280317
281318 GPRReg baseForAccessGPR;
282319 if (chain) {

@@static void generateGetByIdStub(
286323 baseForAccessGPR = baseGPR;
287324
288325 GPRReg loadedValueGPR = InvalidGPRReg;
289  if (!slot.isCacheableCustom()) {
290  if (slot.isCacheableValue())
291  loadedValueGPR = resultGPR;
 326 if (kind != CallCustomGetter && kind != CallCustomSetter) {
 327 if (kind == GetValue)
 328 loadedValueGPR = valueRegs.payloadGPR();
292329 else
293330 loadedValueGPR = scratchGPR;
294331

@@static void generateGetByIdStub(
303340#if USE(JSVALUE64)
304341 stubJit.load64(MacroAssembler::Address(storageGPR, offsetRelativeToBase(offset)), loadedValueGPR);
305342#else
306  if (slot.isCacheableValue())
307  stubJit.load32(MacroAssembler::Address(storageGPR, offsetRelativeToBase(offset) + TagOffset), resultTagGPR);
 343 if (kind == GetValue)
 344 stubJit.load32(MacroAssembler::Address(storageGPR, offsetRelativeToBase(offset) + TagOffset), valueRegs.tagGPR());
308345 stubJit.load32(MacroAssembler::Address(storageGPR, offsetRelativeToBase(offset) + PayloadOffset), loadedValueGPR);
309346#endif
310347 }

@@static void generateGetByIdStub(
312349 // Stuff for custom getters.
313350 MacroAssembler::Call operationCall;
314351 MacroAssembler::Call handlerCall;
315  FunctionPtr operationFunction;
316352
317353 // Stuff for JS getters.
318354 MacroAssembler::DataLabelPtr addressOfLinkFunctionCheck;

@@static void generateGetByIdStub(
328364 stubJit.store32(MacroAssembler::TrustedImm32(exec->locationAsRawBits()),
329365 CCallHelpers::tagFor(static_cast<VirtualRegister>(JSStack::ArgumentCount)));
330366
331  if (slot.isCacheableGetter()) {
 367 if (kind == CallGetter || kind == CallSetter) {
332368 // Create a JS call using a JS call inline cache. Assume that:
333369 //
334370 // - SP is aligned and represents the extent of the calling compiler's stack usage.

@@static void generateGetByIdStub(
352388
353389 // There is a 'this' argument but nothing else.
354390 unsigned numberOfParameters = 1;
355 
356  // Get the getter; if there ain't one then the result is jsUndefined().
357  stubJit.loadPtr(
358  MacroAssembler::Address(loadedValueGPR, GetterSetter::offsetOfGetter()),
359  loadedValueGPR);
 391 // ... unless we're calling a setter.
 392 if (kind == CallSetter)
 393 numberOfParameters++;
 394
 395 // Get the accessor; if there ain't one then the result is jsUndefined().
 396 if (kind == CallSetter) {
 397 stubJit.loadPtr(
 398 MacroAssembler::Address(loadedValueGPR, GetterSetter::offsetOfSetter()),
 399 loadedValueGPR);
 400 } else {
 401 stubJit.loadPtr(
 402 MacroAssembler::Address(loadedValueGPR, GetterSetter::offsetOfGetter()),
 403 loadedValueGPR);
 404 }
360405 MacroAssembler::Jump returnUndefined = stubJit.branchTestPtr(
361406 MacroAssembler::Zero, loadedValueGPR);
362407

@@static void generateGetByIdStub(
384429
385430 stubJit.storeCell(
386431 loadedValueGPR, calleeFrame.withOffset(JSStack::Callee * sizeof(Register)));
 432
387433 stubJit.storeCell(
388434 baseGPR,
389435 calleeFrame.withOffset(
390436 virtualRegisterForArgument(0).offset() * sizeof(Register)));
391437
 438 if (kind == CallSetter) {
 439 stubJit.storeValue(
 440 valueRegs,
 441 calleeFrame.withOffset(
 442 virtualRegisterForArgument(1).offset() * sizeof(Register)));
 443 }
 444
392445 MacroAssembler::Jump slowCase = stubJit.branchPtrWithPatch(
393446 MacroAssembler::NotEqual, loadedValueGPR, addressOfLinkFunctionCheck,
394447 MacroAssembler::TrustedImmPtr(0));

@@static void generateGetByIdStub(
405458 stubJit.addPtr(
406459 MacroAssembler::TrustedImm32(alignedNumberOfBytesForCall),
407460 MacroAssembler::stackPointerRegister);
 461 if (kind == CallGetter)
 462 stubJit.setupResults(valueRegs);
408463
409464 done.append(stubJit.jump());
410465 slowCase.link(&stubJit);

@@static void generateGetByIdStub(
419474 stubJit.addPtr(
420475 MacroAssembler::TrustedImm32(alignedNumberOfBytesForCall),
421476 MacroAssembler::stackPointerRegister);
 477 if (kind == CallGetter)
 478 stubJit.setupResults(valueRegs);
422479
423480 done.append(stubJit.jump());
424481 returnUndefined.link(&stubJit);
425482
426 #if USE(JSVALUE64)
427  stubJit.move(
428  MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), resultGPR);
429 #else
430  stubJit.move(MacroAssembler::TrustedImm32(JSValue::UndefinedTag), resultTagGPR);
431  stubJit.move(MacroAssembler::TrustedImm32(0), resultGPR);
432 #endif
 483 if (kind == CallGetter)
 484 stubJit.moveTrustedValue(jsUndefined(), valueRegs);
433485
434486 done.link(&stubJit);
435487 } else {
436  // EncodedJSValue (*GetValueFunc)(ExecState*, JSObject* slotBase, EncodedJSValue thisValue, PropertyName);
 488 // getter: EncodedJSValue (*GetValueFunc)(ExecState*, JSObject* slotBase, EncodedJSValue thisValue, PropertyName);
 489 // setter: void (*PutValueFunc)(ExecState*, JSObject* base, EncodedJSValue thisObject, EncodedJSValue value);
437490#if USE(JSVALUE64)
438  stubJit.setupArgumentsWithExecState(baseForAccessGPR, baseGPR, MacroAssembler::TrustedImmPtr(propertyName.impl()));
 491 if (kind == CallCustomGetter)
 492 stubJit.setupArgumentsWithExecState(baseForAccessGPR, baseGPR, MacroAssembler::TrustedImmPtr(propertyName.impl()));
 493 else
 494 stubJit.setupArgumentsWithExecState(baseForAccessGPR, baseGPR, valueRegs.gpr());
439495#else
440  stubJit.setupArgumentsWithExecState(baseForAccessGPR, baseGPR, MacroAssembler::TrustedImm32(JSValue::CellTag), MacroAssembler::TrustedImmPtr(propertyName.impl()));
 496 if (kind == CallCustomGetter)
 497 stubJit.setupArgumentsWithExecState(baseForAccessGPR, baseGPR, MacroAssembler::TrustedImm32(JSValue::CellTag), MacroAssembler::TrustedImmPtr(propertyName.impl()));
 498 else
 499 stubJit.setupArgumentsWithExecState(baseForAccessGPR, baseGPR, MacroAssembler::TrustedImm32(JSValue::CellTag), valueRegs.payloadGPR(), valueRegs.tagGPR());
441500#endif
442501 stubJit.storePtr(GPRInfo::callFrameRegister, &vm->topCallFrame);
443502
444  operationFunction = FunctionPtr(slot.customGetter());
445 
446503 operationCall = stubJit.call();
447 #if USE(JSVALUE64)
448  stubJit.move(GPRInfo::returnValueGPR, resultGPR);
449 #else
450  stubJit.setupResults(resultGPR, resultTagGPR);
451 #endif
 504 if (kind == CallCustomGetter)
 505 stubJit.setupResults(valueRegs);
452506 MacroAssembler::Jump noException = stubJit.emitExceptionCheck(CCallHelpers::InvertedExceptionCheck);
453507
454508 stubJit.setupArguments(CCallHelpers::TrustedImmPtr(vm), GPRInfo::callFrameRegister);

@@static void generateGetByIdStub(
463517 LinkBuffer patchBuffer(*vm, &stubJit, exec->codeBlock());
464518
465519 linkRestoreScratch(patchBuffer, needToRestoreScratch, success, fail, failureCases, successLabel, slowCaseLabel);
466  if (slot.isCacheableCustom()) {
467  patchBuffer.link(operationCall, operationFunction);
 520 if (kind == CallCustomGetter || kind == CallCustomSetter) {
 521 patchBuffer.link(operationCall, custom);
468522 patchBuffer.link(handlerCall, lookupExceptionHandler);
469  } else if (slot.isCacheableGetter()) {
 523 } else if (kind == CallGetter || kind == CallSetter) {
470524 callLinkInfo->hotPathOther = patchBuffer.locationOfNearCall(fastPathCall);
471525 callLinkInfo->hotPathBegin = patchBuffer.locationOf(addressOfLinkFunctionCheck);
472526 callLinkInfo->callReturnLocation = patchBuffer.locationOfNearCall(slowPathCall);

@@static void generateGetByIdStub(
482536 ("Get access stub for %s, return point %p",
483537 toCString(*exec->codeBlock()).data(), successLabel.executableAddress()));
484538
485  if (slot.isCacheableGetter())
 539 if (kind == CallGetter || kind == CallSetter)
486540 stubRoutine = adoptRef(new AccessorCallJITStubRoutine(code, *vm, std::move(callLinkInfo)));
487541 else
488542 stubRoutine = createJITStubRoutine(code, *vm, codeBlock->ownerExecutable(), true);

@@static bool tryCacheGetByID(ExecState* e
631685 return false;
632686
633687 StructureChain* prototypeChain = structure->prototypeChain(exec);
634  generateGetByIdStub(
635  exec, slot, propertyName, stubInfo, prototypeChain, count, offset, structure,
 688 generateByIdStub(
 689 exec, kindFor(slot), propertyName, customFor(slot), stubInfo, prototypeChain, count,
 690 offset, structure,
636691 stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToDone),
637692 stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToSlowCase),
638693 stubInfo.stubRoutine);

@@static bool tryBuildGetByIDList(ExecStat
712767 }
713768
714769 RefPtr<JITStubRoutine> stubRoutine;
715  generateGetByIdStub(
716  exec, slot, ident, stubInfo, prototypeChain, count, offset, structure,
717  stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToDone),
 770 generateByIdStub(
 771 exec, kindFor(slot), ident, customFor(slot), stubInfo, prototypeChain, count, offset,
 772 structure, stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToDone),
718773 CodeLocationLabel(list->currentSlowPathTarget(stubInfo)), stubRoutine);
719774
720775 GetByIdAccess::AccessType accessType;

@@static void emitPutTransitionStub(
10441099 structure);
10451100}
10461101
1047 static void emitCustomSetterStub(ExecState* exec, const PutPropertySlot& slot,
1048  StructureStubInfo& stubInfo, Structure* structure, StructureChain* prototypeChain,
1049  CodeLocationLabel failureLabel, RefPtr<JITStubRoutine>& stubRoutine)
1050 {
1051  VM* vm = &exec->vm();
1052  ASSERT(stubInfo.patch.spillMode == DontSpill);
1053  GPRReg baseGPR = static_cast<GPRReg>(stubInfo.patch.baseGPR);
1054 #if USE(JSVALUE32_64)
1055  GPRReg valueTagGPR = static_cast<GPRReg>(stubInfo.patch.valueTagGPR);
1056 #endif
1057  GPRReg valueGPR = static_cast<GPRReg>(stubInfo.patch.valueGPR);
1058  TempRegisterSet tempRegisters(stubInfo.patch.usedRegisters);
1059 
1060  CCallHelpers stubJit(vm);
1061  GPRReg scratchGPR = tempRegisters.getFreeGPR();
1062  RELEASE_ASSERT(scratchGPR != InvalidGPRReg);
1063  RELEASE_ASSERT(scratchGPR != baseGPR);
1064  RELEASE_ASSERT(scratchGPR != valueGPR);
1065  MacroAssembler::JumpList failureCases;
1066  failureCases.append(branchStructure(stubJit,
1067  MacroAssembler::NotEqual,
1068  MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()),
1069  structure));
1070 
1071  if (prototypeChain) {
1072  for (WriteBarrier<Structure>* it = prototypeChain->head(); *it; ++it)
1073  addStructureTransitionCheck((*it)->storedPrototype(), exec->codeBlock(), stubInfo, stubJit, failureCases, scratchGPR);
1074  }
1075 
1076  // typedef void (*PutValueFunc)(ExecState*, JSObject* base, EncodedJSValue thisObject, EncodedJSValue value);
1077 #if USE(JSVALUE64)
1078  stubJit.setupArgumentsWithExecState(MacroAssembler::TrustedImmPtr(slot.base()), baseGPR, valueGPR);
1079 #else
1080  stubJit.setupArgumentsWithExecState(MacroAssembler::TrustedImmPtr(slot.base()), baseGPR, MacroAssembler::TrustedImm32(JSValue::CellTag), valueGPR, valueTagGPR);
1081 #endif
1082 
1083  // Need to make sure that whenever this call is made in the future, we remember the
1084  // place that we made it from. It just so happens to be the place that we are at
1085  // right now!
1086  stubJit.store32(MacroAssembler::TrustedImm32(exec->locationAsRawBits()),
1087  CCallHelpers::tagFor(static_cast<VirtualRegister>(JSStack::ArgumentCount)));
1088  stubJit.storePtr(GPRInfo::callFrameRegister, &vm->topCallFrame);
1089 
1090  MacroAssembler::Call setterCall = stubJit.call();
1091 
1092  MacroAssembler::Jump success = stubJit.emitExceptionCheck(CCallHelpers::InvertedExceptionCheck);
1093 
1094  stubJit.setupArguments(CCallHelpers::TrustedImmPtr(vm), GPRInfo::callFrameRegister);
1095 
1096  MacroAssembler::Call handlerCall = stubJit.call();
1097 
1098  stubJit.jumpToExceptionHandler();
1099  LinkBuffer patchBuffer(*vm, &stubJit, exec->codeBlock());
1100 
1101  patchBuffer.link(success, stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToDone));
1102  patchBuffer.link(failureCases, failureLabel);
1103  patchBuffer.link(setterCall, FunctionPtr(slot.customSetter()));
1104  patchBuffer.link(handlerCall, lookupExceptionHandler);
1105 
1106  stubRoutine = FINALIZE_CODE_FOR_GC_AWARE_STUB(
1107  exec->codeBlock(), patchBuffer, true, nullptr,
1108  ("PutById custom setter stub for %s, return point %p",
1109  toCString(*exec->codeBlock()).data(),
1110  stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToDone).executableAddress()));
1111 }
1112 
1113 
11141102static bool tryCachePutByID(ExecState* exec, JSValue baseValue, const Identifier& ident, const PutPropertySlot& slot, StructureStubInfo& stubInfo, PutKind putKind)
11151103{
11161104 if (Options::forceICFailure())

@@static bool tryCachePutByID(ExecState* e
11841172 RefPtr<JITStubRoutine> stubRoutine;
11851173
11861174 StructureChain* prototypeChain = 0;
 1175 PropertyOffset offset = slot.cachedOffset();
 1176 size_t count = 0;
11871177 if (baseValue != slot.base()) {
1188  PropertyOffset offsetIgnored;
1189  if (normalizePrototypeChainForChainAccess(exec, baseCell, slot.base(), ident, offsetIgnored) == InvalidPrototypeChain)
 1178 count = normalizePrototypeChainForChainAccess(exec, baseCell, slot.base(), ident, offset);
 1179 if (count == InvalidPrototypeChain)
11901180 return false;
11911181
11921182 prototypeChain = structure->prototypeChain(exec);

@@static bool tryCachePutByID(ExecState* e
11941184 PolymorphicPutByIdList* list;
11951185 list = PolymorphicPutByIdList::from(putKind, stubInfo);
11961186
1197  emitCustomSetterStub(exec, slot, stubInfo,
1198  structure, prototypeChain,
 1187 generateByIdStub(
 1188 exec, kindFor(slot), ident, customFor(slot), stubInfo, prototypeChain, count,
 1189 offset, structure,
 1190 stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToDone),
11991191 stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToSlowCase),
12001192 stubRoutine);
12011193

@@static bool tryBuildPutByIdList(ExecStat
13081300 if (slot.isCacheableCustomProperty() && stubInfo.patch.spillMode == DontSpill) {
13091301 RefPtr<JITStubRoutine> stubRoutine;
13101302 StructureChain* prototypeChain = 0;
 1303 PropertyOffset offset = slot.cachedOffset();
 1304 size_t count = 0;
13111305 if (baseValue != slot.base()) {
1312  PropertyOffset offsetIgnored;
1313  if (normalizePrototypeChainForChainAccess(exec, baseCell, slot.base(), propertyName, offsetIgnored) == InvalidPrototypeChain)
 1306 count = normalizePrototypeChainForChainAccess(exec, baseCell, slot.base(), propertyName, offset);
 1307 if (count == InvalidPrototypeChain)
13141308 return false;
13151309
13161310 prototypeChain = structure->prototypeChain(exec);

@@static bool tryBuildPutByIdList(ExecStat
13181312 PolymorphicPutByIdList* list;
13191313 list = PolymorphicPutByIdList::from(putKind, stubInfo);
13201314
1321  emitCustomSetterStub(exec, slot, stubInfo,
1322  structure, prototypeChain,
 1315 generateByIdStub(
 1316 exec, kindFor(slot), propertyName, customFor(slot), stubInfo, prototypeChain, count,
 1317 offset, structure,
 1318 stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToDone),
13231319 CodeLocationLabel(list->currentSlowPathTarget()),
13241320 stubRoutine);
13251321
166897

Source/JavaScriptCore/runtime/JSCJSValue.h

@@public:
291291 static ptrdiff_t offsetOfPayload() { return OBJECT_OFFSETOF(JSValue, u.asBits.payload); }
292292 static ptrdiff_t offsetOfTag() { return OBJECT_OFFSETOF(JSValue, u.asBits.tag); }
293293
294 private:
295  template <class T> JSValue(WriteBarrierBase<T>);
296 
297  enum HashTableDeletedValueTag { HashTableDeletedValue };
298  JSValue(HashTableDeletedValueTag);
299 
300  inline const JSValue asValue() const { return *this; }
301  JS_EXPORT_PRIVATE double toNumberSlowCase(ExecState*) const;
302  JS_EXPORT_PRIVATE JSString* toStringSlowCase(ExecState*) const;
303  JS_EXPORT_PRIVATE WTF::String toWTFStringSlowCase(ExecState*) const;
304  JS_EXPORT_PRIVATE JSObject* toObjectSlowCase(ExecState*, JSGlobalObject*) const;
305  JS_EXPORT_PRIVATE JSValue toThisSlowCase(ExecState*, ECMAMode) const;
306 
307294#if USE(JSVALUE32_64)
308295 /*
309296 * On 32-bit platforms USE(JSVALUE32_64) should be defined, and we use a NaN-encoded

@@private:
416403 #define ValueDeleted 0x4ll
417404#endif
418405
 406private:
 407 template <class T> JSValue(WriteBarrierBase<T>);
 408
 409 enum HashTableDeletedValueTag { HashTableDeletedValue };
 410 JSValue(HashTableDeletedValueTag);
 411
 412 inline const JSValue asValue() const { return *this; }
 413 JS_EXPORT_PRIVATE double toNumberSlowCase(ExecState*) const;
 414 JS_EXPORT_PRIVATE JSString* toStringSlowCase(ExecState*) const;
 415 JS_EXPORT_PRIVATE WTF::String toWTFStringSlowCase(ExecState*) const;
 416 JS_EXPORT_PRIVATE JSObject* toObjectSlowCase(ExecState*, JSGlobalObject*) const;
 417 JS_EXPORT_PRIVATE JSValue toThisSlowCase(ExecState*, ECMAMode) const;
 418
419419 EncodedValueDescriptor u;
420420};
421421
166897

Source/JavaScriptCore/runtime/PutPropertySlot.h

@@namespace JSC {
9393
9494 PropertyOffset cachedOffset() const
9595 {
96  ASSERT(isCacheablePut());
9796 return m_offset;
9897 }
9998
166897