Attachment 339650 Details for Bug 185287 – more

[patch] more

blah.patch (text/plain), 70.34 KB, created by Filip Pizlo on 2018-05-05 11:15:07 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Filip Pizlo

Created: 2018-05-05 11:15:07 PDT

Size: 70.34 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 231396)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2018-05-05  Filip Pizlo  <fpizlo@apple.com>
>+
>+        DFG AI should have O(1) clobbering
>+        https://bugs.webkit.org/show_bug.cgi?id=185287
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/simple-ai-effect.js: Added.
>+        (bar):
>+        (foo):
>+
> 2018-05-04  Keith Miller  <keith_miller@apple.com>
> 
>         isCacheableArrayLength should return true for undecided arrays
>Index: JSTests/stress/simple-ai-effect.js
>===================================================================
>--- JSTests/stress/simple-ai-effect.js	(nonexistent)
>+++ JSTests/stress/simple-ai-effect.js	(working copy)
>@@ -0,0 +1,39 @@
>+var doEffect = false;
>+var didEffect = false;
>+
>+function bar(o, p)
>+{
>+    if (doEffect) {
>+        delete p.g;
>+        p.__defineGetter__("g", () => {
>+            didEffect = true;
>+            return 42;
>+        });
>+    }
>+}
>+
>+noInline(bar);
>+
>+function foo(o, p) {
>+    var result = o.f + p.g;
>+    bar(o, p);
>+    return result + o.f + p.g;
>+}
>+
>+noInline(foo);
>+
>+var o = {g: 1};
>+o.h = 2;
>+
>+for (var i = 0; i < 10000; ++i) {
>+    var result = foo({f: 1}, {g: 3});
>+    if (result != 8)
>+        throw "Error: bad result in loop: " + result;
>+}
>+
>+doEffect = true;
>+var result = foo({f: 1}, {g: 3});
>+if (result != 47)
>+    throw "Error: bad result at end: " + result;
>+if (!didEffect)
>+    throw "Error: did not do effect";
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 231338)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,91 @@
>+2018-05-05  Filip Pizlo  <fpizlo@apple.com>
>+
>+        DFG AI should have O(1) clobbering
>+        https://bugs.webkit.org/show_bug.cgi?id=185287
>+
>+        Reviewed by NOBODY (OOPS!).
>+        
>+        This fixes an old scalability probem in AI. Previously, if we did clobberWorld(), then we
>+        would traverse all of the state available to the AI at that time and clobber it.
>+        
>+        This changes clobberWorld() to be O(1). It just does some math to a clobber epoch.
>+        
>+        Sadly, this isn't a speed-up on my compile time benchmarks.
>+
>+        * JavaScriptCore.xcodeproj/project.pbxproj:
>+        * Sources.txt:
>+        * dfg/DFGAbstractInterpreter.h:
>+        (JSC::DFG::AbstractInterpreter::forNode):
>+        (JSC::DFG::AbstractInterpreter::setForNode):
>+        (JSC::DFG::AbstractInterpreter::clearForNode):
>+        (JSC::DFG::AbstractInterpreter::variables): Deleted.
>+        * dfg/DFGAbstractInterpreterInlines.h:
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberWorld):
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeDoubleUnaryOpEffects):
>+        * dfg/DFGAbstractValue.cpp:
>+        (JSC::DFG::AbstractValue::fastForwardToSlow):
>+        * dfg/DFGAbstractValue.h:
>+        (JSC::DFG::AbstractValue::fastForwardTo):
>+        (JSC::DFG::AbstractValue::clobberStructuresFor): Deleted.
>+        (JSC::DFG::AbstractValue::observeInvalidationPoint): Deleted.
>+        (JSC::DFG::AbstractValue::observeInvalidationPointFor): Deleted.
>+        * dfg/DFGAbstractValueClobberEpoch.cpp: Added.
>+        (JSC::DFG::AbstractValueClobberEpoch::dump const):
>+        * dfg/DFGAbstractValueClobberEpoch.h: Added.
>+        (JSC::DFG::AbstractValueClobberEpoch::AbstractValueClobberEpoch):
>+        (JSC::DFG::AbstractValueClobberEpoch::first):
>+        (JSC::DFG::AbstractValueClobberEpoch::clobber):
>+        (JSC::DFG::AbstractValueClobberEpoch::observeInvalidationPoint):
>+        (JSC::DFG::AbstractValueClobberEpoch::operator== const):
>+        (JSC::DFG::AbstractValueClobberEpoch::operator!= const):
>+        (JSC::DFG::AbstractValueClobberEpoch::structureClobberState const):
>+        (JSC::DFG::AbstractValueClobberEpoch::clobberEpoch const):
>+        * dfg/DFGAtTailAbstractState.h:
>+        (JSC::DFG::AtTailAbstractState::setForNode):
>+        (JSC::DFG::AtTailAbstractState::clearForNode):
>+        (JSC::DFG::AtTailAbstractState::numberOfArguments const):
>+        (JSC::DFG::AtTailAbstractState::numberOfLocals const):
>+        (JSC::DFG::AtTailAbstractState::operand):
>+        (JSC::DFG::AtTailAbstractState::local):
>+        (JSC::DFG::AtTailAbstractState::argument):
>+        (JSC::DFG::AtTailAbstractState::clobberStructures):
>+        (JSC::DFG::AtTailAbstractState::observeInvalidationPoint):
>+        (JSC::DFG::AtTailAbstractState::variables): Deleted.
>+        * dfg/DFGCFAPhase.cpp:
>+        (JSC::DFG::CFAPhase::performBlockCFA):
>+        * dfg/DFGConstantFoldingPhase.cpp:
>+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
>+        * dfg/DFGFlowMap.h:
>+        (JSC::DFG::FlowMap::at):
>+        (JSC::DFG::FlowMap::atShadow):
>+        (JSC::DFG::FlowMap::at const):
>+        (JSC::DFG::FlowMap::atShadow const):
>+        * dfg/DFGInPlaceAbstractState.cpp:
>+        (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
>+        (JSC::DFG::InPlaceAbstractState::endBasicBlock):
>+        * dfg/DFGInPlaceAbstractState.h:
>+        (JSC::DFG::InPlaceAbstractState::forNode):
>+        (JSC::DFG::InPlaceAbstractState::setForNode):
>+        (JSC::DFG::InPlaceAbstractState::clearForNode):
>+        (JSC::DFG::InPlaceAbstractState::variablesForDebugging):
>+        (JSC::DFG::InPlaceAbstractState::numberOfArguments const):
>+        (JSC::DFG::InPlaceAbstractState::numberOfLocals const):
>+        (JSC::DFG::InPlaceAbstractState::operand):
>+        (JSC::DFG::InPlaceAbstractState::local):
>+        (JSC::DFG::InPlaceAbstractState::argument):
>+        (JSC::DFG::InPlaceAbstractState::variableAt):
>+        (JSC::DFG::InPlaceAbstractState::clobberStructures):
>+        (JSC::DFG::InPlaceAbstractState::observeInvalidationPoint):
>+        (JSC::DFG::InPlaceAbstractState::fastForward):
>+        (JSC::DFG::InPlaceAbstractState::variables): Deleted.
>+        * dfg/DFGSpeculativeJIT64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::compileGetStack):
>+
> 2018-05-03  Filip Pizlo  <fpizlo@apple.com>
> 
>         Make it easy to log compile times for all optimizing tiers
>Index: Source/JavaScriptCore/Sources.txt
>===================================================================
>--- Source/JavaScriptCore/Sources.txt	(revision 231338)
>+++ Source/JavaScriptCore/Sources.txt	(working copy)
>@@ -274,6 +274,7 @@ debugger/DebuggerScope.cpp
> dfg/DFGAbstractHeap.cpp
> dfg/DFGAbstractInterpreterClobberState.cpp
> dfg/DFGAbstractValue.cpp
>+dfg/DFGAbstractValueClobberEpoch.cpp
> dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp
> dfg/DFGAdaptiveStructureWatchpoint.cpp
> dfg/DFGArgumentsEliminationPhase.cpp
>Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(revision 231338)
>+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(working copy)
>@@ -319,6 +319,7 @@
> 		0F4D8C781FCA3CFA001D32AC /* SimpleMarkingConstraint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4D8C771FCA3CF3001D32AC /* SimpleMarkingConstraint.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F4DE1CF1C4C1B54004D6C11 /* AirFixObviousSpills.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4DE1CD1C4C1B54004D6C11 /* AirFixObviousSpills.h */; };
> 		0F4F11E8209BCDAB00709654 /* CompilerTimingScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F11E6209BCDA100709654 /* CompilerTimingScope.h */; };
>+		0F4F11EB209D426600709654 /* DFGAbstractValueClobberEpoch.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F11EA209D426300709654 /* DFGAbstractValueClobberEpoch.h */; };
> 		0F4F29E018B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */; };
> 		0F4F82881E2FFDE00075184C /* JSSegmentedVariableObjectHeapCellType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F82861E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F4F828C1E31B9760075184C /* StochasticSpaceTimeMutatorScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F828A1E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.h */; };
>@@ -2310,6 +2311,8 @@
> 		0F4DE1D01C4D764B004D6C11 /* B3OriginDump.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3OriginDump.cpp; path = b3/B3OriginDump.cpp; sourceTree = "<group>"; };
> 		0F4F11E6209BCDA100709654 /* CompilerTimingScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CompilerTimingScope.h; sourceTree = "<group>"; };
> 		0F4F11E7209BCDA100709654 /* CompilerTimingScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CompilerTimingScope.cpp; sourceTree = "<group>"; };
>+		0F4F11E9209D426300709654 /* DFGAbstractValueClobberEpoch.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAbstractValueClobberEpoch.cpp; path = dfg/DFGAbstractValueClobberEpoch.cpp; sourceTree = "<group>"; };
>+		0F4F11EA209D426300709654 /* DFGAbstractValueClobberEpoch.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAbstractValueClobberEpoch.h; path = dfg/DFGAbstractValueClobberEpoch.h; sourceTree = "<group>"; };
> 		0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStaticExecutionCountEstimationPhase.cpp; path = dfg/DFGStaticExecutionCountEstimationPhase.cpp; sourceTree = "<group>"; };
> 		0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStaticExecutionCountEstimationPhase.h; path = dfg/DFGStaticExecutionCountEstimationPhase.h; sourceTree = "<group>"; };
> 		0F4F82851E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSegmentedVariableObjectHeapCellType.cpp; sourceTree = "<group>"; };
>@@ -7114,6 +7117,8 @@
> 				A704D8FF17A0BAA8006BA554 /* DFGAbstractInterpreterInlines.h */,
> 				0F55C19317276E4600CEABFD /* DFGAbstractValue.cpp */,
> 				0F62016F143FCD2F0068B77C /* DFGAbstractValue.h */,
>+				0F4F11E9209D426300709654 /* DFGAbstractValueClobberEpoch.cpp */,
>+				0F4F11EA209D426300709654 /* DFGAbstractValueClobberEpoch.h */,
> 				0FD3E3FF1B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.cpp */,
> 				0FD3E4001B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.h */,
> 				0F18D3CD1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.cpp */,
>@@ -9040,6 +9045,7 @@
> 				A513E5C2185BFACC007E95AD /* JSInjectedScriptHostPrototype.h in Headers */,
> 				0F2B66F817B6B5AB00A7AE3F /* JSInt16Array.h in Headers */,
> 				0F2B66F917B6B5AB00A7AE3F /* JSInt32Array.h in Headers */,
>+				0F4F11EB209D426600709654 /* DFGAbstractValueClobberEpoch.h in Headers */,
> 				0F2B66F717B6B5AB00A7AE3F /* JSInt8Array.h in Headers */,
> 				A76C51761182748D00715B05 /* JSInterfaceJIT.h in Headers */,
> 				E33F50811B8429A400413856 /* JSInternalPromise.h in Headers */,
>Index: Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h	(revision 231338)
>+++ Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -41,21 +41,38 @@ public:
>     AbstractInterpreter(Graph&, AbstractStateType&);
>     ~AbstractInterpreter();
>     
>-    AbstractValue& forNode(NodeFlowProjection node)
>+    ALWAYS_INLINE AbstractValue& forNode(NodeFlowProjection node)
>     {
>         return m_state.forNode(node);
>     }
>     
>-    AbstractValue& forNode(Edge edge)
>+    ALWAYS_INLINE AbstractValue& forNode(Edge edge)
>     {
>         return forNode(edge.node());
>     }
>     
>-    Operands<AbstractValue>& variables()
>+    template<typename ValueType>
>+    ALWAYS_INLINE void setForNode(NodeFlowProjection node, ValueType&& value)
>     {
>-        return m_state.variables();
>+        m_state.setForNode(node, std::forward<ValueType>(value));
>     }
>     
>+    template<typename ValueType>
>+    ALWAYS_INLINE void setForNode(Edge edge, ValueType&& value)
>+    {
>+        setForNode(edge.node(), std::forward<ValueType>(value));
>+    }
>+    
>+    ALWAYS_INLINE void clearForNode(NodeFlowProjection node)
>+    {
>+        m_state.clearForNode(node);
>+    }
>+    
>+    ALWAYS_INLINE void clearForNode(Edge edge)
>+    {
>+        clearForNode(edge.node());
>+    }
>+
>     bool needsTypeCheck(Node* node, SpeculatedType typesPassedThrough)
>     {
>         return !forNode(node).isType(typesPassedThrough);
>@@ -149,13 +166,13 @@ public:
>     PhiChildren* phiChildren() { return m_phiChildren.get(); }
>     
> private:
>-    void clobberWorld(const CodeOrigin&, unsigned indexInBlock);
>+    void clobberWorld();
>     void didFoldClobberWorld();
>     
>     template<typename Functor>
>     void forAllValues(unsigned indexInBlock, Functor&);
>     
>-    void clobberStructures(unsigned indexInBlock);
>+    void clobberStructures();
>     void didFoldClobberStructures();
>     
>     void observeTransition(unsigned indexInBlock, RegisteredStructure from, RegisteredStructure to);
>@@ -190,7 +207,7 @@ private:
>     
>     void verifyEdge(Node*, Edge);
>     void verifyEdges(Node*);
>-    void executeDoubleUnaryOpEffects(Node*, unsigned clobberLimit, double(*equivalentFunction)(double));
>+    void executeDoubleUnaryOpEffects(Node*, double(*equivalentFunction)(double));
>     
>     CodeBlock* m_codeBlock;
>     Graph& m_graph;
>Index: Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h	(revision 231338)
>+++ Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h	(working copy)
>@@ -235,7 +235,7 @@ bool AbstractInterpreter<AbstractStateTy
> 
>     case IdentityWithProfile:
>     case Identity: {
>-        forNode(node) = forNode(node->child1());
>+        setForNode(node, forNode(node->child1()));
>         if (forNode(node).value())
>             m_state.setFoundConstants(true);
>         break;
>@@ -249,33 +249,33 @@ bool AbstractInterpreter<AbstractStateTy
>             
>     case GetLocal: {
>         VariableAccessData* variableAccessData = node->variableAccessData();
>-        AbstractValue value = m_state.variables().operand(variableAccessData->local().offset());
>+        AbstractValue value = m_state.operand(variableAccessData->local().offset());
>         // The value in the local should already be checked.
>         DFG_ASSERT(m_graph, node, value.isType(typeFilterFor(variableAccessData->flushFormat())));
>         if (value.value())
>             m_state.setFoundConstants(true);
>-        forNode(node) = value;
>+        setForNode(node, value);
>         break;
>     }
>         
>     case GetStack: {
>         StackAccessData* data = node->stackAccessData();
>-        AbstractValue value = m_state.variables().operand(data->local);
>+        AbstractValue value = m_state.operand(data->local);
>         // The value in the local should already be checked.
>         DFG_ASSERT(m_graph, node, value.isType(typeFilterFor(data->format)));
>         if (value.value())
>             m_state.setFoundConstants(true);
>-        forNode(node) = value;
>+        setForNode(node, value);
>         break;
>     }
>         
>     case SetLocal: {
>-        m_state.variables().operand(node->local()) = forNode(node->child1());
>+        m_state.operand(node->local()) = forNode(node->child1());
>         break;
>     }
>         
>     case PutStack: {
>-        m_state.variables().operand(node->stackAccessData()->local) = forNode(node->child1());
>+        m_state.operand(node->stackAccessData()->local) = forNode(node->child1());
>         break;
>     }
>         
>@@ -296,14 +296,14 @@ bool AbstractInterpreter<AbstractStateTy
>         // Assert that the state of arguments has been set. SetArgument means that someone set
>         // the argument values out-of-band, and currently this always means setting to a
>         // non-clear value.
>-        ASSERT(!m_state.variables().operand(node->local()).isClear());
>+        ASSERT(!m_state.operand(node->local()).isClear());
>         break;
> 
>     case InitializeEntrypointArguments: {
>         unsigned entrypointIndex = node->entrypointIndex();
>         const Vector<FlushFormat>& argumentFormats = m_graph.m_argumentFormats[entrypointIndex];
>         for (unsigned argument = 0; argument < argumentFormats.size(); ++argument) {
>-            AbstractValue& value = m_state.variables().argument(argument);
>+            AbstractValue& value = m_state.argument(argument);
>             switch (argumentFormats[argument]) {
>             case FlushedInt32:
>                 value.setType(SpecInt32Only);
>@@ -332,7 +332,7 @@ bool AbstractInterpreter<AbstractStateTy
>         // https://bugs.webkit.org/show_bug.cgi?id=143071
>         switch (node->op()) {
>         case LoadVarargs:
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             break;
>         case ForwardVarargs:
>             break;
>@@ -341,9 +341,9 @@ bool AbstractInterpreter<AbstractStateTy
>             break;
>         }
>         LoadVarargsData* data = node->loadVarargsData();
>-        m_state.variables().operand(data->count).setType(SpecInt32Only);
>+        m_state.operand(data->count).setType(SpecInt32Only);
>         for (unsigned i = data->limit - 1; i--;)
>-            m_state.variables().operand(data->start.offset() + i).makeHeapTop();
>+            m_state.operand(data->start.offset() + i).makeHeapTop();
>         break;
>     }
>             
>@@ -354,7 +354,7 @@ bool AbstractInterpreter<AbstractStateTy
>     case BitLShift:
>     case BitURShift: {
>         if (node->child1().useKind() == UntypedUse || node->child2().useKind() == UntypedUse) {
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             forNode(node).setType(m_graph, SpecInt32Only);
>             break;
>         }
>@@ -555,7 +555,7 @@ bool AbstractInterpreter<AbstractStateTy
>         
>     case ValueAdd: {
>         ASSERT(node->binaryUseKind() == UntypedUse);
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).setType(m_graph, SpecString | SpecBytecodeNumber);
>         break;
>     }
>@@ -611,7 +611,7 @@ bool AbstractInterpreter<AbstractStateTy
>         
>     case AtomicsIsLockFree: {
>         if (node->child1().useKind() != Int32Use)
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>         forNode(node).setType(SpecBoolInt32);
>         break;
>     }
>@@ -636,7 +636,7 @@ bool AbstractInterpreter<AbstractStateTy
>         case KnownInt32Use:
>             break;
>         default:
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             break;
>         }
>         forNode(node).setType(SpecInt32Only);
>@@ -674,12 +674,12 @@ bool AbstractInterpreter<AbstractStateTy
>             m_state.setFoundConstants(true);
>             if (numberOfRemovedChildren == numberOfChildren) {
>                 // Propagate the last child. This is the way taken in the constant folding phase.
>-                forNode(node) = forNode(node->children.child(numberOfChildren - 1));
>+                setForNode(node, forNode(node->children.child(numberOfChildren - 1)));
>                 break;
>             }
>             if ((numberOfRemovedChildren + 1) == numberOfChildren) {
>                 ASSERT(nonEmptyIndex);
>-                forNode(node) = forNode(node->children.child(nonEmptyIndex.value()));
>+                setForNode(node, forNode(node->children.child(nonEmptyIndex.value())));
>                 break;
>             }
>         }
>@@ -725,7 +725,7 @@ bool AbstractInterpreter<AbstractStateTy
>                     forNode(node->child1()).m_type, forNode(node->child2()).m_type));
>             break;
>         case UntypedUse:
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             forNode(node).setType(m_graph, SpecBytecodeNumber);
>             break;
>         default:
>@@ -783,7 +783,7 @@ bool AbstractInterpreter<AbstractStateTy
>             break;
>         default:
>             DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind());
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             forNode(node).setType(SpecBytecodeNumber);
>             break;
>         }
>@@ -834,7 +834,7 @@ bool AbstractInterpreter<AbstractStateTy
>                     forNode(node->child1()).m_type, forNode(node->child2()).m_type));
>             break;
>         case UntypedUse:
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             forNode(node).setType(m_graph, SpecBytecodeNumber);
>             break;
>         default:
>@@ -873,7 +873,7 @@ bool AbstractInterpreter<AbstractStateTy
>                     forNode(node->child1()).m_type, forNode(node->child2()).m_type));
>             break;
>         case UntypedUse:
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             forNode(node).setType(m_graph, SpecBytecodeNumber);
>             break;
>         default:
>@@ -998,7 +998,7 @@ bool AbstractInterpreter<AbstractStateTy
>             break;
>         default:
>             DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind());
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             forNode(node).setType(SpecFullNumber);
>             break;
>         }
>@@ -1078,22 +1078,22 @@ bool AbstractInterpreter<AbstractStateTy
>                 forNode(node).setType(typeOfDoubleRounding(forNode(node->child1()).m_type));
>         } else {
>             DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind());
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             forNode(node).setType(SpecFullNumber);
>         }
>         break;
>     }
>             
>     case ArithSqrt:
>-        executeDoubleUnaryOpEffects(node, clobberLimit, sqrt);
>+        executeDoubleUnaryOpEffects(node, sqrt);
>         break;
> 
>     case ArithFRound:
>-        executeDoubleUnaryOpEffects(node, clobberLimit, [](double value) -> double { return static_cast<float>(value); });
>+        executeDoubleUnaryOpEffects(node, [](double value) -> double { return static_cast<float>(value); });
>         break;
>         
>     case ArithUnary:
>-        executeDoubleUnaryOpEffects(node, clobberLimit, arithUnaryFunction(node->arithUnaryType()));
>+        executeDoubleUnaryOpEffects(node, arithUnaryFunction(node->arithUnaryType()));
>         break;
>             
>     case LogicalNot: {
>@@ -1668,7 +1668,7 @@ bool AbstractInterpreter<AbstractStateTy
>         }
> 
>         if (isClobbering)
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>         forNode(node).setType(SpecBoolean);
>         break;
>     }
>@@ -1762,7 +1762,7 @@ bool AbstractInterpreter<AbstractStateTy
>         case Int32Use:
>             break;
>         case UntypedUse:
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             break;
>         default:
>             DFG_CRASH(m_graph, node, "Bad use kind");
>@@ -1786,7 +1786,7 @@ bool AbstractInterpreter<AbstractStateTy
>     case AtomicsSub:
>     case AtomicsXor: {
>         if (node->op() != GetByVal)
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>         switch (node->arrayMode().type()) {
>         case Array::SelectUsingPredictions:
>         case Array::Unprofiled:
>@@ -1806,7 +1806,7 @@ bool AbstractInterpreter<AbstractStateTy
>             break;
>         }
>         case Array::Generic:
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             forNode(node).makeHeapTop();
>             break;
>         case Array::String:
>@@ -1821,7 +1821,7 @@ bool AbstractInterpreter<AbstractStateTy
>                 // implies an in-bounds access). None of this feels like it's worth it,
>                 // so we're going with TOP for now. The same thing applies to
>                 // clobbering the world.
>-                clobberWorld(node->origin.semantic, clobberLimit);
>+                clobberWorld();
>                 forNode(node).makeHeapTop();
>             } else
>                 forNode(node).set(m_graph, m_vm.stringStructure.get());
>@@ -1829,19 +1829,19 @@ bool AbstractInterpreter<AbstractStateTy
>         case Array::DirectArguments:
>         case Array::ScopedArguments:
>             if (node->arrayMode().isOutOfBounds())
>-                clobberWorld(node->origin.semantic, clobberLimit);
>+                clobberWorld();
>             forNode(node).makeHeapTop();
>             break;
>         case Array::Int32:
>             if (node->arrayMode().isOutOfBounds()) {
>-                clobberWorld(node->origin.semantic, clobberLimit);
>+                clobberWorld();
>                 forNode(node).makeHeapTop();
>             } else
>                 forNode(node).setType(SpecInt32Only);
>             break;
>         case Array::Double:
>             if (node->arrayMode().isOutOfBounds()) {
>-                clobberWorld(node->origin.semantic, clobberLimit);
>+                clobberWorld();
>                 forNode(node).makeHeapTop();
>             } else if (node->arrayMode().isSaneChain())
>                 forNode(node).setType(SpecBytecodeDouble);
>@@ -1852,7 +1852,7 @@ bool AbstractInterpreter<AbstractStateTy
>         case Array::ArrayStorage:
>         case Array::SlowPutArrayStorage:
>             if (node->arrayMode().isOutOfBounds())
>-                clobberWorld(node->origin.semantic, clobberLimit);
>+                clobberWorld();
>             forNode(node).makeHeapTop();
>             break;
>         case Array::Int8Array:
>@@ -1902,24 +1902,24 @@ bool AbstractInterpreter<AbstractStateTy
>             m_state.setIsValid(false);
>             break;
>         case Array::Generic:
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             break;
>         case Array::Int32:
>             if (node->arrayMode().isOutOfBounds())
>-                clobberWorld(node->origin.semantic, clobberLimit);
>+                clobberWorld();
>             break;
>         case Array::Double:
>             if (node->arrayMode().isOutOfBounds())
>-                clobberWorld(node->origin.semantic, clobberLimit);
>+                clobberWorld();
>             break;
>         case Array::Contiguous:
>         case Array::ArrayStorage:
>             if (node->arrayMode().isOutOfBounds())
>-                clobberWorld(node->origin.semantic, clobberLimit);
>+                clobberWorld();
>             break;
>         case Array::SlowPutArrayStorage:
>             if (node->arrayMode().mayStoreToHole())
>-                clobberWorld(node->origin.semantic, clobberLimit);
>+                clobberWorld();
>             break;
>         default:
>             break;
>@@ -1928,7 +1928,7 @@ bool AbstractInterpreter<AbstractStateTy
>     }
>             
>     case ArrayPush:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).setType(SpecBytecodeNumber);
>         break;
> 
>@@ -1952,7 +1952,7 @@ bool AbstractInterpreter<AbstractStateTy
>     }
>             
>     case ArrayPop:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).makeHeapTop();
>         break;
>         
>@@ -1972,14 +1972,14 @@ bool AbstractInterpreter<AbstractStateTy
>             if (argumentIndexChecked.safeGet(argumentIndex) != CheckedState::DidOverflow) {
>                 if (inlineCallFrame) {
>                     if (argumentIndex < inlineCallFrame->argumentCountIncludingThis - 1) {
>-                        forNode(node) = m_state.variables().operand(
>-                            virtualRegisterForArgument(argumentIndex + 1) + inlineCallFrame->stackOffset);
>+                        setForNode(node, m_state.operand(
>+                            virtualRegisterForArgument(argumentIndex + 1) + inlineCallFrame->stackOffset));
>                         m_state.setFoundConstants(true);
>                         break;
>                     }
>                 } else {
>-                    if (argumentIndex < m_state.variables().numberOfArguments() - 1) {
>-                        forNode(node) = m_state.variables().argument(argumentIndex + 1);
>+                    if (argumentIndex < m_state.numberOfArguments() - 1) {
>+                        setForNode(node, m_state.argument(argumentIndex + 1));
>                         m_state.setFoundConstants(true);
>                         break;
>                     }
>@@ -1993,7 +1993,7 @@ bool AbstractInterpreter<AbstractStateTy
>             AbstractValue result;
>             for (unsigned i = 1 + node->numberOfArgumentsToSkip(); i < inlineCallFrame->argumentCountIncludingThis; ++i) {
>                 result.merge(
>-                    m_state.variables().operand(
>+                    m_state.operand(
>                         virtualRegisterForArgument(i) + inlineCallFrame->stackOffset));
>             }
>             
>@@ -2003,7 +2003,7 @@ bool AbstractInterpreter<AbstractStateTy
>             if (result.value())
>                 m_state.setFoundConstants(true);
>             
>-            forNode(node) = result;
>+            setForNode(node, result);
>             break;
>         }
>         
>@@ -2016,7 +2016,7 @@ bool AbstractInterpreter<AbstractStateTy
>         if (node->op() == RegExpExec) {
>             // Even if we've proven known input types as RegExpObject and String,
>             // accessing lastIndex is effectful if it's a global regexp.
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>         }
> 
>         if (JSValue globalObjectValue = forNode(node->child1()).m_value) {
>@@ -2038,7 +2038,7 @@ bool AbstractInterpreter<AbstractStateTy
>     case RegExpTest:
>         // Even if we've proven known input types as RegExpObject and String,
>         // accessing lastIndex is effectful if it's a global regexp.
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).setType(SpecBoolean);
>         break;
> 
>@@ -2060,7 +2060,7 @@ bool AbstractInterpreter<AbstractStateTy
>             && node->child3().useKind() == StringUse) {
>             // This doesn't clobber the world. It just reads and writes regexp state.
>         } else
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>         forNode(node).set(m_graph, m_vm.stringStructure.get());
>         break;
> 
>@@ -2105,7 +2105,7 @@ bool AbstractInterpreter<AbstractStateTy
>     case DirectTailCall:
>     case TailCallVarargs:
>     case TailCallForwardVarargs:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         m_state.setIsValid(false);
>         break;
>         
>@@ -2122,11 +2122,11 @@ bool AbstractInterpreter<AbstractStateTy
>         if (!(forNode(node->child1()).m_type & ~(SpecFullNumber | SpecBoolean | SpecString | SpecSymbol | SpecBigInt))) {
>             m_state.setFoundConstants(true);
>             didFoldClobberWorld();
>-            forNode(node) = forNode(node->child1());
>+            setForNode(node, forNode(node->child1()));
>             break;
>         }
>         
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         
>         forNode(node).setType(m_graph, SpecHeapTop & ~SpecObject);
>         break;
>@@ -2145,11 +2145,11 @@ bool AbstractInterpreter<AbstractStateTy
>         if (!(forNode(node->child1()).m_type & ~SpecBytecodeNumber)) {
>             m_state.setFoundConstants(true);
>             didFoldClobberWorld();
>-            forNode(node) = forNode(node->child1());
>+            setForNode(node, forNode(node->child1()));
>             break;
>         }
> 
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).setType(m_graph, SpecBytecodeNumber);
>         break;
>     }
>@@ -2172,7 +2172,7 @@ bool AbstractInterpreter<AbstractStateTy
>             break;
>         case CellUse:
>         case UntypedUse:
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             break;
>         default:
>             RELEASE_ASSERT_NOT_REACHED();
>@@ -2193,7 +2193,7 @@ bool AbstractInterpreter<AbstractStateTy
>                 break;
>             }
>         }
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get());
>         break;
>     }
>@@ -2238,7 +2238,7 @@ bool AbstractInterpreter<AbstractStateTy
>             break;
>         default:
>             if (!m_graph.canDoFastSpread(node, forNode(node->child1())))
>-                clobberWorld(node->origin.semantic, clobberLimit);
>+                clobberWorld();
>             else
>                 didFoldClobberWorld();
>             break;
>@@ -2263,7 +2263,7 @@ bool AbstractInterpreter<AbstractStateTy
>         case Int32Use:
>             break;
>         case UntypedUse:
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             break;
>         default:
>             RELEASE_ASSERT_NOT_REACHED();
>@@ -2332,7 +2332,7 @@ bool AbstractInterpreter<AbstractStateTy
>                 }
>             }
>         }
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).setType(m_graph, SpecFinalObject);
>         break;
>     }
>@@ -2356,7 +2356,7 @@ bool AbstractInterpreter<AbstractStateTy
>         }
> 
>         if (node->op() == ToObject)
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>         forNode(node).setType(m_graph, SpecObject);
>         break;
>     }
>@@ -2605,14 +2605,14 @@ bool AbstractInterpreter<AbstractStateTy
>             }
>         }
> 
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).makeHeapTop();
>         break;
>     }
> 
>     case GetByValWithThis:
>     case GetByIdWithThis:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).makeHeapTop();
>         break;
>             
>@@ -2636,7 +2636,7 @@ bool AbstractInterpreter<AbstractStateTy
>     case DeleteByVal: {
>         // FIXME: This could decide if the delete will be successful based on the set of structures that
>         // we get from our base value. https://bugs.webkit.org/show_bug.cgi?id=156611
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).setType(SpecBoolean);
>         break;
>     }
>@@ -2747,7 +2747,7 @@ bool AbstractInterpreter<AbstractStateTy
>         // nobody would currently benefit from having that information. But it's a bug nonetheless.
>         if (node->op() == NukeStructureAndSetButterfly)
>             didFoldClobberStructures();
>-        forNode(node).clear(); // The result is not a JS value.
>+        clearForNode(node); // The result is not a JS value.
>         break;
>     case CheckSubClass: {
>         JSValue constant = forNode(node->child1()).value();
>@@ -2771,7 +2771,7 @@ bool AbstractInterpreter<AbstractStateTy
>         CallDOMGetterData* callDOMGetterData = node->callDOMGetterData();
>         DOMJIT::CallDOMGetterSnippet* snippet = callDOMGetterData->snippet;
>         if (!snippet || snippet->effect.writes)
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>         if (callDOMGetterData->domJIT)
>             forNode(node).setType(m_graph, callDOMGetterData->domJIT->resultType());
>         else
>@@ -2781,7 +2781,7 @@ bool AbstractInterpreter<AbstractStateTy
>     case CallDOM: {
>         const DOMJIT::Signature* signature = node->signature();
>         if (signature->effect.writes)
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>         forNode(node).setType(m_graph, signature->result);
>         break;
>     }
>@@ -2851,7 +2851,7 @@ bool AbstractInterpreter<AbstractStateTy
>             break;
>         }
>         ASSERT(node->arrayMode().conversion() == Array::Convert);
>-        clobberStructures(clobberLimit);
>+        clobberStructures();
>         filterArrayModes(node->child1(), node->arrayMode().arrayModesThatPassFiltering());
>         break;
>     }
>@@ -2859,7 +2859,7 @@ bool AbstractInterpreter<AbstractStateTy
>         AbstractValue& value = forNode(node->child1());
>         if (value.m_structure.isSubsetOf(RegisteredStructureSet(node->structure())))
>             m_state.setFoundConstants(true);
>-        clobberStructures(clobberLimit);
>+        clobberStructures();
>         
>         // We have a bunch of options of how to express the abstract set at this point. Let set S
>         // be the set of structures that the value had before clobbering and assume that all of
>@@ -2888,7 +2888,7 @@ bool AbstractInterpreter<AbstractStateTy
>         // Note that it's tempting to simply say that the resulting value is BOTTOM because of
>         // the contradiction. That would be wrong, since we haven't hit an invalidation point,
>         // yet.
>-        value.set(m_graph, node->structure());
>+        forNode(node->child1()).set(m_graph, node->structure());
>         break;
>     }
>     case GetIndexedPropertyStorage: {
>@@ -2896,11 +2896,11 @@ bool AbstractInterpreter<AbstractStateTy
>             forNode(node->child1()).m_value, node->arrayMode());
>         if (view)
>             m_state.setFoundConstants(true);
>-        forNode(node).clear();
>+        clearForNode(node);
>         break;
>     }
>     case ConstantStoragePointer: {
>-        forNode(node).clear();
>+        clearForNode(node);
>         break; 
>     }
>         
>@@ -2958,7 +2958,7 @@ bool AbstractInterpreter<AbstractStateTy
>         case FinalObjectUse:
>             break;
>         default:
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             break;
>         }
>         forNode(node).setType(m_graph, SpecObject | SpecOther);
>@@ -2987,7 +2987,7 @@ bool AbstractInterpreter<AbstractStateTy
>         if (value.isClear())
>             m_state.setIsValid(false);
> 
>-        forNode(node) = value;
>+        setForNode(node, value);
>         if (value.m_value)
>             m_state.setFoundConstants(true);
>         break;
>@@ -3058,7 +3058,7 @@ bool AbstractInterpreter<AbstractStateTy
>         if (forNode(node->child1()).changeStructure(m_graph, baseSet) == Contradiction)
>             m_state.setIsValid(false);
>         
>-        forNode(node) = result;
>+        setForNode(node, result);
>         break;
>     }
>             
>@@ -3108,7 +3108,7 @@ bool AbstractInterpreter<AbstractStateTy
>         observeTransitions(clobberLimit, transitions);
>         if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction)
>             m_state.setIsValid(false);
>-        forNode(node->child2()) = resultingValue;
>+        setForNode(node->child2(),  resultingValue);
>         if (!!originalValue && !resultingValue)
>             m_state.setIsValid(false);
>         break;
>@@ -3219,13 +3219,13 @@ bool AbstractInterpreter<AbstractStateTy
>             }
>         }
>         
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         break;
>     }
> 
>     case PutByValWithThis:
>     case PutByIdWithThis:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         break;
> 
>     case PutGetterById:
>@@ -3233,25 +3233,25 @@ bool AbstractInterpreter<AbstractStateTy
>     case PutGetterSetterById:
>     case PutGetterByVal:
>     case PutSetterByVal: {
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         break;
>     }
> 
>     case DefineDataProperty:
>     case DefineAccessorProperty:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         break;
>         
>     case In: {
>         // FIXME: We can determine when the property definitely exists based on abstract
>         // value information.
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).setType(SpecBoolean);
>         break;
>     }
> 
>     case HasOwnProperty: {
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).setType(SpecBoolean);
>         break;
>     }
>@@ -3262,12 +3262,12 @@ bool AbstractInterpreter<AbstractStateTy
>     }
>     case HasGenericProperty: {
>         forNode(node).setType(SpecBoolean);
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         break;
>     }
>     case HasStructureProperty: {
>         forNode(node).setType(SpecBoolean);
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         break;
>     }
>     case HasIndexedProperty: {
>@@ -3280,7 +3280,7 @@ bool AbstractInterpreter<AbstractStateTy
>             break;
>         }
>         default: {
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             break;
>         }
>         }
>@@ -3288,13 +3288,13 @@ bool AbstractInterpreter<AbstractStateTy
>         break;
>     }
>     case GetDirectPname: {
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).makeHeapTop();
>         break;
>     }
>     case GetPropertyEnumerator: {
>         forNode(node).setType(m_graph, SpecCell);
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         break;
>     }
>     case GetEnumeratorStructurePname: {
>@@ -3319,21 +3319,21 @@ bool AbstractInterpreter<AbstractStateTy
>         break;
> 
>     case GetDynamicVar:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).makeBytecodeTop();
>         break;
> 
>     case PutDynamicVar:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         break;
> 
>     case ResolveScope:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).setType(m_graph, SpecObject);
>         break;
> 
>     case ResolveScopeForHoistingFuncDeclInEval:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).makeBytecodeTop();
>         break;
> 
>@@ -3351,13 +3351,13 @@ bool AbstractInterpreter<AbstractStateTy
>         break;
> 
>     case InstanceOfCustom:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).setType(SpecBoolean);
>         break;
>             
>     case Phi:
>         RELEASE_ASSERT(m_graph.m_form == SSA);
>-        forNode(node) = forNode(NodeFlowProjection(node, NodeFlowProjection::Shadow));
>+        setForNode(node, forNode(NodeFlowProjection(node, NodeFlowProjection::Shadow)));
>         // The state of this node would have already been decided, but it may have become a
>         // constant, in which case we'd like to know.
>         if (forNode(node).m_value)
>@@ -3368,7 +3368,7 @@ bool AbstractInterpreter<AbstractStateTy
>         NodeFlowProjection shadow(node->phi(), NodeFlowProjection::Shadow);
>         if (shadow.isStillValid()) {
>             m_state.createValueForNode(shadow);
>-            forNode(shadow) = forNode(node->child1());
>+            setForNode(shadow, forNode(node->child1()));
>         }
>         break;
>     }
>@@ -3390,7 +3390,7 @@ bool AbstractInterpreter<AbstractStateTy
>     case DirectCall:
>     case DirectConstruct:
>     case DirectTailCallInlinedCaller:
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         forNode(node).makeHeapTop();
>         break;
> 
>@@ -3400,8 +3400,8 @@ bool AbstractInterpreter<AbstractStateTy
>         break;
>         
>     case InvalidationPoint:
>-        forAllValues(clobberLimit, AbstractValue::observeInvalidationPointFor);
>         m_state.setStructureClobberState(StructuresAreWatched);
>+        m_state.observeInvalidationPoint();
>         break;
> 
>     case CPUIntrinsic: 
>@@ -3447,7 +3447,7 @@ bool AbstractInterpreter<AbstractStateTy
>         }
> 
>         if (node->child1().useKind() == UntypedUse)
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>         forNode(node).setType(m_graph, SpecBytecodeNumber);
>         break;
>     }
>@@ -3455,7 +3455,7 @@ bool AbstractInterpreter<AbstractStateTy
>     case CreateRest:
>         if (!m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
>             // This means we're already having a bad time.
>-            clobberWorld(node->origin.semantic, clobberLimit);
>+            clobberWorld();
>             forNode(node).setType(m_graph, SpecArray);
>             break;
>         }
>@@ -3477,7 +3477,7 @@ bool AbstractInterpreter<AbstractStateTy
>     }
> 
>     case SetFunctionName: {
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>         break;
>     }
> 
>@@ -3537,10 +3537,9 @@ bool AbstractInterpreter<AbstractStateTy
> }
> 
> template<typename AbstractStateType>
>-void AbstractInterpreter<AbstractStateType>::clobberWorld(
>-    const CodeOrigin&, unsigned clobberLimit)
>+void AbstractInterpreter<AbstractStateType>::clobberWorld()
> {
>-    clobberStructures(clobberLimit);
>+    clobberStructures();
> }
> 
> template<typename AbstractStateType>
>@@ -3572,16 +3571,16 @@ void AbstractInterpreter<AbstractStateTy
>                 functor(forNode(node));
>         }
>     }
>-    for (size_t i = m_state.variables().numberOfArguments(); i--;)
>-        functor(m_state.variables().argument(i));
>-    for (size_t i = m_state.variables().numberOfLocals(); i--;)
>-        functor(m_state.variables().local(i));
>+    for (size_t i = m_state.numberOfArguments(); i--;)
>+        functor(m_state.argument(i));
>+    for (size_t i = m_state.numberOfLocals(); i--;)
>+        functor(m_state.local(i));
> }
> 
> template<typename AbstractStateType>
>-void AbstractInterpreter<AbstractStateType>::clobberStructures(unsigned clobberLimit)
>+void AbstractInterpreter<AbstractStateType>::clobberStructures()
> {
>-    forAllValues(clobberLimit, AbstractValue::clobberStructuresFor);
>+    m_state.clobberStructures();
>     m_state.mergeClobberState(AbstractInterpreterClobberState::ClobberedStructures);
>     m_state.setStructureClobberState(StructuresAreClobbered);
> }
>@@ -3716,7 +3715,7 @@ FiltrationResult AbstractInterpreter<Abs
> }
> 
> template<typename AbstractStateType>
>-void AbstractInterpreter<AbstractStateType>::executeDoubleUnaryOpEffects(Node* node, unsigned clobberLimit, double(*equivalentFunction)(double))
>+void AbstractInterpreter<AbstractStateType>::executeDoubleUnaryOpEffects(Node* node, double(*equivalentFunction)(double))
> {
>     JSValue child = forNode(node->child1()).value();
>     if (std::optional<double> number = child.toNumberFromPrimitive()) {
>@@ -3729,7 +3728,7 @@ void AbstractInterpreter<AbstractStateTy
>     if (node->child1().useKind() == DoubleRepUse)
>         type = typeOfDoubleUnaryOp(forNode(node->child1()).m_type);
>     else
>-        clobberWorld(node->origin.semantic, clobberLimit);
>+        clobberWorld();
>     forNode(node).setType(type);
> }
> 
>Index: Source/JavaScriptCore/dfg/DFGAbstractValue.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractValue.cpp	(revision 231338)
>+++ Source/JavaScriptCore/dfg/DFGAbstractValue.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -556,6 +556,7 @@ void AbstractValue::dumpInContext(PrintS
>     }
>     if (!!m_value)
>         out.print(", ", inContext(m_value, context));
>+    out.print(", ", m_effectEpoch);
>     out.print(")");
> }
> 
>@@ -574,6 +575,20 @@ void AbstractValue::ensureCanInitializeW
> }
> #endif
> 
>+void AbstractValue::fastForwardToSlow(AbstractValueClobberEpoch newEpoch)
>+{
>+    ASSERT(newEpoch != m_effectEpoch);
>+    
>+    if (newEpoch.clobberEpoch() != m_effectEpoch.clobberEpoch())
>+        clobberStructures();
>+    if (newEpoch.structureClobberState() == StructuresAreWatched)
>+        m_structure.observeInvalidationPoint();
>+    
>+    m_effectEpoch = newEpoch;
>+    
>+    checkConsistency();
>+}
>+
> } } // namespace JSC::DFG
> 
> #endif // ENABLE(DFG_JIT)
>Index: Source/JavaScriptCore/dfg/DFGAbstractValue.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractValue.h	(revision 231338)
>+++ Source/JavaScriptCore/dfg/DFGAbstractValue.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2011-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -28,6 +28,7 @@
> #if ENABLE(DFG_JIT)
> 
> #include "ArrayProfile.h"
>+#include "DFGAbstractValueClobberEpoch.h"
> #include "DFGFiltrationResult.h"
> #include "DFGFrozenValue.h"
> #include "DFGNodeFlags.h"
>@@ -103,20 +104,10 @@ struct AbstractValue {
>         checkConsistency();
>     }
>     
>-    static void clobberStructuresFor(AbstractValue& value)
>+    ALWAYS_INLINE void fastForwardTo(AbstractValueClobberEpoch newEpoch)
>     {
>-        value.clobberStructures();
>-    }
>-    
>-    void observeInvalidationPoint()
>-    {
>-        m_structure.observeInvalidationPoint();
>-        checkConsistency();
>-    }
>-    
>-    static void observeInvalidationPointFor(AbstractValue& value)
>-    {
>-        value.observeInvalidationPoint();
>+        if (newEpoch != m_effectEpoch)
>+            fastForwardToSlow(newEpoch);
>     }
>     
>     void observeTransition(RegisteredStructure from, RegisteredStructure to)
>@@ -397,6 +388,10 @@ struct AbstractValue {
>     // effect that makes non-obvious changes to the heap.
>     ArrayModes m_arrayModes;
>     
>+    // The epoch.
>+    // FIXME: Explain this. (OOPS!!)
>+    AbstractValueClobberEpoch m_effectEpoch;
>+    
>     // This is a proven constraint on the possible values that this value can
>     // have now or any time in the future, unless it is reassigned. Note that this
>     // implies nothing about the structure. Oddly, JSValue() (i.e. the empty value)
>@@ -455,6 +450,8 @@ private:
>         checkConsistency();
>     }
>     
>+    void fastForwardToSlow(AbstractValueClobberEpoch);
>+    
>     void filterValueByType();
>     void filterArrayModesByType();
> 
>Index: Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.cpp	(nonexistent)
>+++ Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.cpp	(working copy)
>@@ -0,0 +1,41 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "DFGAbstractValueClobberEpoch.h"
>+
>+#if ENABLE(DFG_JIT)
>+
>+namespace JSC { namespace DFG {
>+
>+void AbstractValueClobberEpoch::dump(PrintStream& out) const
>+{
>+    out.print(clobberEpoch(), ":", structureClobberState());
>+}
>+
>+} } // namespae JSC::DFG
>+
>+#endif // ENABLE(DFG_JIT)
>+
>Index: Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.h	(nonexistent)
>+++ Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.h	(working copy)
>@@ -0,0 +1,99 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#pragma once
>+
>+#if ENABLE(DFG_JIT)
>+
>+#include "DFGEpoch.h"
>+#include "DFGStructureClobberState.h"
>+#include <wtf/PrintStream.h>
>+
>+namespace JSC { namespace DFG {
>+
>+class AbstractValueClobberEpoch {
>+public:
>+    AbstractValueClobberEpoch()
>+    {
>+    }
>+    
>+    static AbstractValueClobberEpoch first(StructureClobberState clobberState)
>+    {
>+        AbstractValueClobberEpoch result;
>+        result.m_value = Epoch::first().toUnsigned() << epochShift;
>+        switch (clobberState) {
>+        case StructuresAreWatched:
>+            result.m_value |= watchedFlag;
>+            break;
>+        case StructuresAreClobbered:
>+            break;
>+        }
>+        return result;
>+    }
>+    
>+    void clobber()
>+    {
>+        m_value += step;
>+        m_value &= ~watchedFlag;
>+    }
>+    
>+    void observeInvalidationPoint()
>+    {
>+        m_value |= watchedFlag;
>+    }
>+    
>+    bool operator==(const AbstractValueClobberEpoch& other) const
>+    {
>+        return m_value == other.m_value;
>+    }
>+    
>+    bool operator!=(const AbstractValueClobberEpoch& other) const
>+    {
>+        return !(*this == other);
>+    }
>+    
>+    StructureClobberState structureClobberState() const
>+    {
>+        return m_value & watchedFlag ? StructuresAreWatched : StructuresAreClobbered;
>+    }
>+    
>+    Epoch clobberEpoch() const
>+    {
>+        return Epoch::fromUnsigned(m_value >> epochShift);
>+    }
>+    
>+    void dump(PrintStream&) const;
>+    
>+private:
>+    static constexpr unsigned step = 2;
>+    static constexpr unsigned watchedFlag = 1;
>+    static constexpr unsigned epochShift = 1;
>+    
>+    unsigned m_value { 0 };
>+};
>+
>+} } // namespace JSC::DFG
>+
>+#endif // ENABLE(DFG_JIT)
>Index: Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h	(revision 231338)
>+++ Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h	(working copy)
>@@ -52,7 +52,45 @@ public:
>     void createValueForNode(NodeFlowProjection);
>     AbstractValue& forNode(NodeFlowProjection);
>     AbstractValue& forNode(Edge edge) { return forNode(edge.node()); }
>-    Operands<AbstractValue>& variables() { return m_block->valuesAtTail; }
>+    
>+    template<typename ValueType>
>+    ALWAYS_INLINE void setForNode(NodeFlowProjection node, ValueType&& value)
>+    {
>+        forNode(node) = std::forward<ValueType>(value);
>+    }
>+    
>+    template<typename ValueType>
>+    ALWAYS_INLINE void setForNode(Edge edge, ValueType&& value)
>+    {
>+        setForNode(edge.node(), std::forward<ValueType>(value));
>+    }
>+    
>+    ALWAYS_INLINE void clearForNode(NodeFlowProjection node)
>+    {
>+        forNode(node).clear();
>+    }
>+    
>+    ALWAYS_INLINE void clearForNode(Edge edge)
>+    {
>+        clearForNode(edge.node());
>+    }
>+    
>+    unsigned numberOfArguments() const { return m_block->valuesAtTail.numberOfArguments(); }
>+    unsigned numberOfLocals() const { return m_block->valuesAtTail.numberOfLocals(); }
>+    AbstractValue& operand(int operand) { return m_block->valuesAtTail.operand(operand); }
>+    AbstractValue& operand(VirtualRegister operand) { return m_block->valuesAtTail.operand(operand); }
>+    AbstractValue& local(size_t index) { return m_block->valuesAtTail.local(index); }
>+    AbstractValue& argument(size_t index) { return m_block->valuesAtTail.argument(index); }
>+    
>+    void clobberStructures()
>+    {
>+        UNREACHABLE_FOR_PLATFORM();
>+    }
>+    
>+    void observeInvalidationPoint()
>+    {
>+        UNREACHABLE_FOR_PLATFORM();
>+    }
>     
>     BasicBlock* block() const { return m_block; }
>     
>Index: Source/JavaScriptCore/dfg/DFGCFAPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGCFAPhase.cpp	(revision 231338)
>+++ Source/JavaScriptCore/dfg/DFGCFAPhase.cpp	(working copy)
>@@ -171,7 +171,7 @@ private:
>                 if (!safeToExecute(m_state, m_graph, node))
>                     dataLog("(UNSAFE) ");
>                 
>-                dataLog(m_state.variables(), " ", m_interpreter);
>+                dataLog(m_state.variablesForDebugging(), " ", m_interpreter);
>                 
>                 dataLogF("\n");
>             }
>Index: Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp	(revision 231338)
>+++ Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp	(working copy)
>@@ -378,7 +378,7 @@ private:
>                     if (index >= inlineCallFrame->argumentCountIncludingThis - 1)
>                         break;
>                 } else {
>-                    if (index >= m_state.variables().numberOfArguments() - 1)
>+                    if (index >= m_state.numberOfArguments() - 1)
>                         break;
>                 }
>                 
>Index: Source/JavaScriptCore/dfg/DFGFlowMap.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGFlowMap.h	(revision 231338)
>+++ Source/JavaScriptCore/dfg/DFGFlowMap.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2016 Apple Inc. All Rights Reserved.
>+ * Copyright (C) 2016-2018 Apple Inc. All Rights Reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -55,27 +55,27 @@ public:
>     
>     Graph& graph() const { return m_graph; }
>     
>-    T& at(unsigned nodeIndex)
>+    ALWAYS_INLINE T& at(unsigned nodeIndex)
>     {
>         return m_map[nodeIndex];
>     }
>     
>-    T& at(Node* node)
>+    ALWAYS_INLINE T& at(Node* node)
>     {
>         return at(node->index());
>     }
>     
>-    T& atShadow(unsigned nodeIndex)
>+    ALWAYS_INLINE T& atShadow(unsigned nodeIndex)
>     {
>         return m_shadowMap[nodeIndex];
>     }
>     
>-    T& atShadow(Node* node)
>+    ALWAYS_INLINE T& atShadow(Node* node)
>     {
>         return atShadow(node->index());
>     }
>     
>-    T& at(unsigned nodeIndex, NodeFlowProjection::Kind kind)
>+    ALWAYS_INLINE T& at(unsigned nodeIndex, NodeFlowProjection::Kind kind)
>     {
>         switch (kind) {
>         case NodeFlowProjection::Primary:
>@@ -87,23 +87,23 @@ public:
>         return *bitwise_cast<T*>(nullptr);
>     }
>     
>-    T& at(Node* node, NodeFlowProjection::Kind kind)
>+    ALWAYS_INLINE T& at(Node* node, NodeFlowProjection::Kind kind)
>     {
>         return at(node->index(), kind);
>     }
>     
>-    T& at(NodeFlowProjection projection)
>+    ALWAYS_INLINE T& at(NodeFlowProjection projection)
>     {
>         return at(projection.node(), projection.kind());
>     }
>     
>-    const T& at(unsigned nodeIndex) const { return const_cast<FlowMap*>(this)->at(nodeIndex); }
>-    const T& at(Node* node) const { return const_cast<FlowMap*>(this)->at(node); }
>-    const T& atShadow(unsigned nodeIndex) const { return const_cast<FlowMap*>(this)->atShadow(nodeIndex); }
>-    const T& atShadow(Node* node) const { return const_cast<FlowMap*>(this)->atShadow(node); }
>-    const T& at(unsigned nodeIndex, NodeFlowProjection::Kind kind) const { return const_cast<FlowMap*>(this)->at(nodeIndex, kind); }
>-    const T& at(Node* node, NodeFlowProjection::Kind kind) const { return const_cast<FlowMap*>(this)->at(node, kind); }
>-    const T& at(NodeFlowProjection projection) const { return const_cast<FlowMap*>(this)->at(projection); }
>+    ALWAYS_INLINE const T& at(unsigned nodeIndex) const { return const_cast<FlowMap*>(this)->at(nodeIndex); }
>+    ALWAYS_INLINE const T& at(Node* node) const { return const_cast<FlowMap*>(this)->at(node); }
>+    ALWAYS_INLINE const T& atShadow(unsigned nodeIndex) const { return const_cast<FlowMap*>(this)->atShadow(nodeIndex); }
>+    ALWAYS_INLINE const T& atShadow(Node* node) const { return const_cast<FlowMap*>(this)->atShadow(node); }
>+    ALWAYS_INLINE const T& at(unsigned nodeIndex, NodeFlowProjection::Kind kind) const { return const_cast<FlowMap*>(this)->at(nodeIndex, kind); }
>+    ALWAYS_INLINE const T& at(Node* node, NodeFlowProjection::Kind kind) const { return const_cast<FlowMap*>(this)->at(node, kind); }
>+    ALWAYS_INLINE const T& at(NodeFlowProjection projection) const { return const_cast<FlowMap*>(this)->at(projection); }
>     
> private:
>     Graph& m_graph;
>Index: Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp	(revision 231338)
>+++ Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -60,20 +60,22 @@ void InPlaceAbstractState::beginBasicBlo
>     ASSERT(basicBlock->variablesAtHead.numberOfLocals() == basicBlock->variablesAtTail.numberOfLocals());
> 
>     m_abstractValues.resize();
>+    m_effectEpoch = AbstractValueClobberEpoch::first(basicBlock->cfaStructureClobberStateAtHead);
>     
>     for (size_t i = 0; i < basicBlock->size(); i++) {
>         NodeFlowProjection::forEach(
>             basicBlock->at(i), [&] (NodeFlowProjection nodeProjection) {
>-                forNode(nodeProjection).clear();
>+                clearForNode(nodeProjection);
>             });
>     }
> 
>-    m_variables = basicBlock->valuesAtHead;
>+    for (size_t i = m_variables.size(); i--;)
>+        variableAt(i) = basicBlock->valuesAtHead[i];
>     
>     if (m_graph.m_form == SSA) {
>         for (NodeAbstractValuePair& entry : basicBlock->ssa->valuesAtHead) {
>             if (entry.node.isStillValid())
>-                forNode(entry.node) = entry.value;
>+                setForNode(entry.node, entry.value);
>         }
>     }
>     basicBlock->cfaShouldRevisit = false;
>@@ -201,19 +203,19 @@ bool InPlaceAbstractState::endBasicBlock
>     case ThreadedCPS: {
>         for (size_t argument = 0; argument < block->variablesAtTail.numberOfArguments(); ++argument) {
>             AbstractValue& destination = block->valuesAtTail.argument(argument);
>-            mergeStateAtTail(destination, m_variables.argument(argument), block->variablesAtTail.argument(argument));
>+            mergeStateAtTail(destination, this->argument(argument), block->variablesAtTail.argument(argument));
>         }
> 
>         for (size_t local = 0; local < block->variablesAtTail.numberOfLocals(); ++local) {
>             AbstractValue& destination = block->valuesAtTail.local(local);
>-            mergeStateAtTail(destination, m_variables.local(local), block->variablesAtTail.local(local));
>+            mergeStateAtTail(destination, this->local(local), block->variablesAtTail.local(local));
>         }
>         break;
>     }
> 
>     case SSA: {
>         for (size_t i = 0; i < block->valuesAtTail.size(); ++i)
>-            block->valuesAtTail[i].merge(m_variables[i]);
>+            block->valuesAtTail[i].merge(variableAt(i));
> 
>         for (NodeAbstractValuePair& valueAtTail : block->ssa->valuesAtTail) {
>             AbstractValue& valueAtNode = forNode(valueAtTail.node);
>Index: Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h	(revision 231338)
>+++ Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h	(working copy)
>@@ -47,21 +47,48 @@ public:
>     
>     void createValueForNode(NodeFlowProjection) { }
>     
>-    AbstractValue& forNode(NodeFlowProjection node)
>+    ALWAYS_INLINE AbstractValue& forNode(NodeFlowProjection node)
>     {
>-        return m_abstractValues.at(node);
>+        return fastForward(m_abstractValues.at(node));
>     }
>     
>-    AbstractValue& forNode(Edge edge)
>+    ALWAYS_INLINE AbstractValue& forNode(Edge edge)
>     {
>         return forNode(edge.node());
>     }
>     
>-    Operands<AbstractValue>& variables()
>+    template<typename ValueType>
>+    ALWAYS_INLINE void setForNode(NodeFlowProjection node, ValueType&& value)
>     {
>-        return m_variables;
>+        m_abstractValues.at(node) = std::forward<ValueType>(value);
>     }
>     
>+    template<typename ValueType>
>+    ALWAYS_INLINE void setForNode(Edge edge, ValueType&& value)
>+    {
>+        setForNode(edge.node(), std::forward<ValueType>(value));
>+    }
>+    
>+    ALWAYS_INLINE void clearForNode(NodeFlowProjection node)
>+    {
>+        m_abstractValues.at(node).clear();
>+    }
>+    
>+    ALWAYS_INLINE void clearForNode(Edge edge)
>+    {
>+        clearForNode(edge.node());
>+    }
>+    
>+    Operands<AbstractValue>& variablesForDebugging() { return m_variables; }
>+
>+    unsigned numberOfArguments() const { return m_variables.numberOfArguments(); }
>+    unsigned numberOfLocals() const { return m_variables.numberOfLocals(); }
>+    AbstractValue& operand(int operand) { return fastForward(m_variables.operand(operand)); }
>+    AbstractValue& operand(VirtualRegister operand) { return fastForward(m_variables.operand(operand)); }
>+    AbstractValue& local(size_t index) { return fastForward(m_variables.local(index)); }
>+    AbstractValue& argument(size_t index) { return fastForward(m_variables.argument(index)); }
>+    AbstractValue& variableAt(size_t index) { return fastForward(m_variables[index]); }
>+    
>     // Call this before beginning CFA to initialize the abstract values of
>     // arguments, and to indicate which blocks should be listed for CFA
>     // execution.
>@@ -119,6 +146,10 @@ public:
>     // MergeToSuccessors.
>     bool mergeToSuccessors(BasicBlock*);
>     
>+    void clobberStructures() { m_effectEpoch.clobber(); }
>+    
>+    void observeInvalidationPoint() { m_effectEpoch.observeInvalidationPoint(); }
>+    
>     // Methods intended to be called from AbstractInterpreter.
>     void setClobberState(AbstractInterpreterClobberState state) { m_clobberState = state; }
>     void mergeClobberState(AbstractInterpreterClobberState state) { m_clobberState = mergeClobberStates(m_clobberState, state); }
>@@ -139,6 +170,12 @@ public:
>     }
> 
> private:
>+    AbstractValue& fastForward(AbstractValue& value)
>+    {
>+        value.fastForwardTo(m_effectEpoch);
>+        return value;
>+    }
>+    
>     void mergeStateAtTail(AbstractValue& destination, AbstractValue& inVariable, Node*);
> 
>     static bool mergeVariableBetweenBlocks(AbstractValue& destination, AbstractValue& source, Node* destinationNode, Node* sourceNode);
>@@ -154,6 +191,7 @@ private:
>     bool m_isValid;
>     AbstractInterpreterClobberState m_clobberState;
>     StructureClobberState m_structureClobberState;
>+    AbstractValueClobberEpoch m_effectEpoch;
>     
>     BranchDirection m_branchDirection; // This is only set for blocks that end in Branch and that execute to completion (i.e. m_isValid == true).
> };
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(revision 231338)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(working copy)
>@@ -1932,7 +1932,7 @@ void SpeculativeJIT::compile(Node* node)
>     }
> 
>     case GetLocal: {
>-        AbstractValue& value = m_state.variables().operand(node->local());
>+        AbstractValue& value = m_state.operand(node->local());
> 
>         // If the CFA is tracking this variable and it found that the variable
>         // cannot have been assigned, then don't attempt to proceed.
>Index: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp	(revision 231338)
>+++ Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp	(working copy)
>@@ -1685,7 +1685,7 @@ private:
>     void compileGetStack()
>     {
>         StackAccessData* data = m_node->stackAccessData();
>-        AbstractValue& value = m_state.variables().operand(data->local);
>+        AbstractValue& value = m_state.operand(data->local);
>         
>         DFG_ASSERT(m_graph, m_node, isConcrete(data->format), data->format);
>         DFG_ASSERT(m_graph, m_node, data->format != FlushedDouble, data->format); // This just happens to not arise for GetStacks, right now. It would be trivial to support.

Flags:

ews-watchlist: commit-queue-

Actions: View | Formatted Diff | Diff

Attachments on bug 185287: 339509 | 339620 | 339623 | 339650 | 339661 | 339662 | 339663 | 339687