Prepare JSTypes for more Object subtypes

https://bugs.webkit.org/show_bug.cgi?id=68200

Reviewed by Gavin Barraclough.

* dfg/DFGJITCompiler.h:
(JSC::DFG::JITCompiler::branchIfNotObject):
* jit/JITInlineMethods.h:
(JSC::JIT::emitJumpIfNotObject):
* runtime/JSGlobalObject.h:
(JSC::Structure::prototypeForLookup):
* runtime/JSObject.h:
(JSC::JSObject::finishCreation):
* runtime/JSType.h:
* runtime/JSTypeInfo.h:
(JSC::TypeInfo::type):
(JSC::TypeInfo::isObject):
(JSC::TypeInfo::isFinal):
(JSC::TypeInfo::prohibitsPropertyCaching):
* runtime/NativeErrorConstructor.h:
(JSC::NativeErrorConstructor::finishCreation):
* runtime/Operations.cpp:
(JSC::jsIsObjectType):
* runtime/Structure.cpp:
(JSC::Structure::addPropertyTransitionToExistingStructure):
(JSC::Structure::addPropertyTransition):
* runtime/Structure.h:
(JSC::Structure::isObject):
(JSC::JSCell::isObject):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95326 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 0f925f8..071c00f 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,35 @@
+2011-09-15  Sam Weinig  <sam@webkit.org>
+
+        Prepare JSTypes for more Object subtypes
+        https://bugs.webkit.org/show_bug.cgi?id=68200
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::branchIfNotObject):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfNotObject):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSObject.h:
+        (JSC::JSObject::finishCreation):
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::type):
+        (JSC::TypeInfo::isObject):
+        (JSC::TypeInfo::isFinal):
+        (JSC::TypeInfo::prohibitsPropertyCaching):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/Operations.cpp:
+        (JSC::jsIsObjectType):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::isObject):
+        (JSC::JSCell::isObject):
+
 2011-09-16  Geoffrey Garen  <ggaren@apple.com>
 
         Rolled back in r95201 with test failure fixed.

diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.h b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
index 716be4b..e8db501 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.h
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
@@ -187,7 +187,7 @@ public:
 
     Jump branchIfNotObject(GPRReg structureReg)
     {
-        return branch8(NotEqual, Address(structureReg, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+        return branch8(Below, Address(structureReg, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
     }
 
     // Notify the JIT of a call that does not require linking.

diff --git a/Source/JavaScriptCore/jit/JITInlineMethods.h b/Source/JavaScriptCore/jit/JITInlineMethods.h
index 332c3cc..42809a3 100644 (file)
--- a/Source/JavaScriptCore/jit/JITInlineMethods.h
+++ b/Source/JavaScriptCore/jit/JITInlineMethods.h
@@ -315,7 +315,7 @@ ALWAYS_INLINE void JIT::emitJumpSlowToHot(Jump jump, int relativeOffset)
 
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotObject(RegisterID structureReg)
 {
-    return branch8(NotEqual, Address(structureReg, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+    return branch8(Below, Address(structureReg, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
 }
 
 #if ENABLE(SAMPLING_FLAGS)

diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 60a45e6..e8a07e7 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -348,7 +348,7 @@ namespace JSC {
 
     inline JSValue Structure::prototypeForLookup(ExecState* exec) const
     {
-        if (typeInfo().type() == ObjectType)
+        if (isObject())
             return m_prototype.get();
 
         ASSERT(typeInfo().type() == StringType);

diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 97eab41..8403547 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -245,7 +245,7 @@ namespace JSC {
             ASSERT(m_structure->isEmpty());
             ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
             ASSERT_UNUSED(inlineStorage, static_cast<void*>(inlineStorage) == static_cast<void*>(this + 1));
-            ASSERT(m_structure->typeInfo().type() == ObjectType);
+            ASSERT(m_structure->isObject());
         }
 
         static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)

diff --git a/Source/JavaScriptCore/runtime/JSType.h b/Source/JavaScriptCore/runtime/JSType.h
index e705967..39cf324 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSType.h
+++ b/Source/JavaScriptCore/runtime/JSType.h
@@ -36,9 +36,11 @@ namespace JSC {
         LeafType          = 6,
         // The CompoundType value must come before any JSType that may have children
         CompoundType      = 7,
-        ObjectType        = 8,
-        GetterSetterType  = 9,
-        APIValueWrapper   = 10
+        GetterSetterType  = 8,
+        APIValueWrapper   = 9,
+        // The ObjectType value must come before any JSType that is a subclass of JSObject
+        ObjectType        = 10,
+        FinalObjectType   = 11,
     };
 
 } // namespace JSC

diff --git a/Source/JavaScriptCore/runtime/JSTypeInfo.h b/Source/JavaScriptCore/runtime/JSTypeInfo.h
index 1755f49..6ac0990 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/Source/JavaScriptCore/runtime/JSTypeInfo.h
@@ -60,7 +60,8 @@ namespace JSC {
                 m_flags |= ImplementsDefaultHasInstance;
         }
 
-        JSType type() const { return (JSType)m_type; }
+        JSType type() const { return static_cast<JSType>(m_type); }
+        bool isObject() const { return type() >= ObjectType; }
 
         bool masqueradesAsUndefined() const { return m_flags & MasqueradesAsUndefined; }
         bool implementsHasInstance() const { return m_flags & ImplementsHasInstance; }
@@ -69,8 +70,9 @@ namespace JSC {
         bool overridesGetOwnPropertySlot() const { return m_flags & OverridesGetOwnPropertySlot; }
         bool overridesVisitChildren() const { return m_flags & OverridesVisitChildren; }
         bool overridesGetPropertyNames() const { return m_flags & OverridesGetPropertyNames; }
-        unsigned isFinal() const { return m_flags2 & (IsJSFinalObject >> 8); }
-        unsigned prohibitsPropertyCaching() const { return m_flags2 & (ProhibitsPropertyCaching >> 8); }
+        bool isFinal() const { return m_flags2 & (IsJSFinalObject >> 8); }
+        bool prohibitsPropertyCaching() const { return m_flags2 & (ProhibitsPropertyCaching >> 8); }
+        
         unsigned flags() const { return m_flags; }
 
         static ptrdiff_t flagsOffset()

diff --git a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
index a7acc5a..cc4635b 100644 (file)
--- a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
+++ b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
@@ -62,7 +62,7 @@ namespace JSC {
             putDirect(exec->globalData(), exec->propertyNames().prototype, prototype, DontDelete | ReadOnly | DontEnum);
             m_errorStructure.set(exec->globalData(), this, ErrorInstance::createStructure(exec->globalData(), globalObject, prototype));
             ASSERT(m_errorStructure);
-            ASSERT(m_errorStructure->typeInfo().type() == ObjectType);
+            ASSERT(m_errorStructure->isObject());
         }
 
     private:

diff --git a/Source/JavaScriptCore/runtime/Operations.cpp b/Source/JavaScriptCore/runtime/Operations.cpp
index f129a80..c3a306a 100644 (file)
--- a/Source/JavaScriptCore/runtime/Operations.cpp
+++ b/Source/JavaScriptCore/runtime/Operations.cpp
@@ -88,7 +88,7 @@ bool jsIsObjectType(JSValue v)
     JSType type = v.asCell()->structure()->typeInfo().type();
     if (type == NumberType || type == StringType)
         return false;
-    if (type == ObjectType) {
+    if (type >= ObjectType) {
         if (asObject(v)->structure()->typeInfo().masqueradesAsUndefined())
             return false;
         CallData callData;

diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index e35f0c4..64fd660 100644 (file)
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -280,7 +280,7 @@ void Structure::despecifyDictionaryFunction(JSGlobalData& globalData, const Iden
 Structure* Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
     ASSERT(!structure->isDictionary());
-    ASSERT(structure->typeInfo().type() == ObjectType);
+    ASSERT(structure->isObject());
 
     if (Structure* existingTransition = structure->m_transitionTable.get(propertyName.impl(), attributes)) {
         JSCell* specificValueInPrevious = existingTransition->m_specificValueInPrevious.get();
@@ -307,7 +307,7 @@ Structure* Structure::addPropertyTransition(JSGlobalData& globalData, Structure*
         specificValue = 0;
 
     ASSERT(!structure->isDictionary());
-    ASSERT(structure->typeInfo().type() == ObjectType);
+    ASSERT(structure->isObject());
     ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
     
     if (structure->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)

diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index cd3b885..4ae1e50 100644 (file)
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -119,7 +119,10 @@ namespace JSC {
         bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
         bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
 
+        // Type accessors.
         const TypeInfo& typeInfo() const { ASSERT(structure()->classInfo() == &s_info); return m_typeInfo; }
+        bool isObject() const { return typeInfo().isObject(); }
+
 
         JSGlobalObject* globalObject() const { return m_globalObject.get(); }
         void setGlobalObject(JSGlobalData& globalData, JSGlobalObject* globalObject) { m_globalObject.set(globalData, this, globalObject); }
@@ -304,7 +307,7 @@ namespace JSC {
 
     inline bool JSCell::isObject() const
     {
-        return m_structure->typeInfo().type() == ObjectType;
+        return m_structure->isObject();
     }
 
     inline bool JSCell::isString() const