webkitgtk-2.16.5HEADwebkitgtk-2.16.5master

13 files changed, 955 insertions, 0 deletions

diff --git a/Source/JavaScriptCore/domjit/DOMJITAbstractHeap.cpp b/Source/JavaScriptCore/domjit/DOMJITAbstractHeap.cpp
new file mode 100644
index 000000000..f4855b9d2
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITAbstractHeap.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMJITAbstractHeap.h"
+
+#if ENABLE(JIT)
+
+namespace JSC { namespace DOMJIT {
+
+void AbstractHeap::compute(unsigned begin)
+{
+    unsigned current = begin;
+    // Increment the end of the range.
+    if (m_children.isEmpty()) {
+        m_range = HeapRange(begin, current + 1);
+        return;
+    }
+    for (auto& child : m_children) {
+        child->compute(current);
+        current = child->range().end();
+    }
+    ASSERT(begin < UINT16_MAX);
+    ASSERT(current <= UINT16_MAX);
+    m_range = HeapRange(begin, current);
+}
+
+void AbstractHeap::dump(PrintStream& out) const
+{
+    shallowDump(out);
+    if (m_parent)
+        out.print("->", *m_parent);
+}
+
+void AbstractHeap::shallowDump(PrintStream& out) const
+{
+    out.print(m_name, "<", m_range, ">");
+}
+
+void AbstractHeap::deepDump(PrintStream& out, unsigned indent) const
+{
+    auto printIndent = [&] () {
+        for (unsigned i = indent; i--;)
+            out.print("    ");
+    };
+
+    printIndent();
+    shallowDump(out);
+
+    if (m_children.isEmpty()) {
+        out.print("\n");
+        return;
+    }
+
+    out.print(":\n");
+    for (auto* child : m_children)
+        child->deepDump(out, indent + 1);
+}
+
+} }
+
+#endif
diff --git a/Source/JavaScriptCore/domjit/DOMJITAbstractHeap.h b/Source/JavaScriptCore/domjit/DOMJITAbstractHeap.h
new file mode 100644
index 000000000..be87b0794
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITAbstractHeap.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DOMJITHeapRange.h"
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+#if ENABLE(JIT)
+
+namespace JSC { namespace DOMJIT {
+
+class AbstractHeap {
+public:
+    AbstractHeap(const String& name)
+        : m_name(name)
+    {
+    }
+
+    void setParent(AbstractHeap* parent)
+    {
+        ASSERT(!m_parent);
+        parent->m_children.append(this);
+        m_parent = parent;
+    }
+
+    bool isRoot() const { return !m_parent; }
+
+    JS_EXPORT_PRIVATE void compute(unsigned begin);
+
+    bool isComputed() const { return !!m_range; }
+    HeapRange range() const { return m_range; }
+
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const;
+    JS_EXPORT_PRIVATE void shallowDump(PrintStream&) const;
+    JS_EXPORT_PRIVATE void deepDump(PrintStream&, unsigned indent = 0) const;
+
+private:
+    String m_name;
+    AbstractHeap* m_parent { nullptr };
+    Vector<AbstractHeap*> m_children { };
+    HeapRange m_range;
+};
+
+} }
+
+#endif
diff --git a/Source/JavaScriptCore/domjit/DOMJITCallDOMGetterPatchpoint.h b/Source/JavaScriptCore/domjit/DOMJITCallDOMGetterPatchpoint.h
new file mode 100644
index 000000000..c1c2dd13c
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITCallDOMGetterPatchpoint.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "DOMJITEffect.h"
+#include "DOMJITPatchpoint.h"
+#include "RegisterSet.h"
+
+namespace JSC { namespace DOMJIT {
+
+class CallDOMGetterPatchpoint : public Patchpoint {
+public:
+    static Ref<CallDOMGetterPatchpoint> create()
+    {
+        return adoptRef(*new CallDOMGetterPatchpoint());
+    }
+
+    // To look up DOMWrapper cache, GlobalObject is required.
+    // FIXME: Later, we will extend this patchpoint to represent the result type by DOMJIT::Signature.
+    // And after that, we will automatically pass a global object when the result type includes a DOM wrapper thing.
+    // https://bugs.webkit.org/show_bug.cgi?id=162980
+    bool requireGlobalObject { true };
+
+    Effect effect { };
+
+private:
+    CallDOMGetterPatchpoint() = default;
+};
+
+} }
+
+#endif
diff --git a/Source/JavaScriptCore/domjit/DOMJITEffect.h b/Source/JavaScriptCore/domjit/DOMJITEffect.h
new file mode 100644
index 000000000..61cf3b71a
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITEffect.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DOMJITHeapRange.h"
+#include <wtf/Optional.h>
+
+namespace JSC { namespace DOMJIT {
+
+class Effect {
+public:
+    HeapRange reads { HeapRange::top() };
+    HeapRange writes { HeapRange::top() };
+    HeapRange def { HeapRange::top() };
+
+    constexpr Effect() = default;
+    constexpr Effect(HeapRange reads, HeapRange writes)
+        : reads(reads)
+        , writes(writes)
+    {
+    }
+
+    constexpr Effect(HeapRange reads, HeapRange writes, HeapRange def)
+        : reads(reads)
+        , writes(writes)
+        , def(def)
+    {
+    }
+
+    constexpr static Effect forWrite(HeapRange writeRange)
+    {
+        return Effect(HeapRange::none(), writeRange);
+    }
+
+    constexpr static Effect forRead(HeapRange readRange)
+    {
+        return Effect(readRange, HeapRange::none());
+    }
+
+    constexpr static Effect forReadWrite(HeapRange readRange, HeapRange writeRange)
+    {
+        return Effect(readRange, writeRange);
+    }
+
+    constexpr static Effect forPure()
+    {
+        return Effect(HeapRange::none(), HeapRange::none(), HeapRange::none());
+    }
+
+    constexpr static Effect forDef(HeapRange def)
+    {
+        return Effect(def, HeapRange::none(), def);
+    }
+
+    constexpr static Effect forDef(HeapRange def, HeapRange readRange, HeapRange writeRange)
+    {
+        return Effect(readRange, writeRange, def);
+    }
+
+    constexpr bool mustGenerate() const
+    {
+        return !!writes;
+    }
+};
+
+} }
diff --git a/Source/JavaScriptCore/domjit/DOMJITGetterSetter.h b/Source/JavaScriptCore/domjit/DOMJITGetterSetter.h
new file mode 100644
index 000000000..b94f87aec
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITGetterSetter.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DOMJITCallDOMGetterPatchpoint.h"
+#include "PropertySlot.h"
+#include "PutPropertySlot.h"
+#include "SpeculatedType.h"
+
+namespace JSC { namespace DOMJIT {
+
+class GetterSetter {
+public:
+    typedef PropertySlot::GetValueFunc CustomGetter;
+    typedef PutPropertySlot::PutValueFunc CustomSetter;
+
+    GetterSetter(CustomGetter getter, CustomSetter setter, const ClassInfo* classInfo, SpeculatedType resultType)
+        : m_getter(getter)
+        , m_setter(setter)
+        , m_thisClassInfo(classInfo)
+        , m_resultType(resultType)
+    {
+    }
+
+    virtual ~GetterSetter() { }
+
+    CustomGetter getter() const { return m_getter; }
+    CustomSetter setter() const { return m_setter; }
+    const ClassInfo* thisClassInfo() const { return m_thisClassInfo; }
+    SpeculatedType resultType() const { return m_resultType; }
+
+#if ENABLE(JIT)
+    virtual Ref<DOMJIT::CallDOMGetterPatchpoint> callDOMGetter() = 0;
+    virtual Ref<DOMJIT::Patchpoint> checkDOM() = 0;
+#endif
+
+private:
+    CustomGetter m_getter;
+    CustomSetter m_setter;
+    const ClassInfo* m_thisClassInfo;
+    SpeculatedType m_resultType;
+};
+
+} }
diff --git a/Source/JavaScriptCore/domjit/DOMJITHeapRange.cpp b/Source/JavaScriptCore/domjit/DOMJITHeapRange.cpp
new file mode 100644
index 000000000..9365b2de7
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITHeapRange.cpp
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMJITHeapRange.h"
+
+namespace JSC { namespace DOMJIT {
+
+void HeapRange::dump(PrintStream& out) const
+{
+    out.printf("0x%x-0x%x", static_cast<unsigned>(begin()), static_cast<unsigned>(end()));
+}
+
+} }
diff --git a/Source/JavaScriptCore/domjit/DOMJITHeapRange.h b/Source/JavaScriptCore/domjit/DOMJITHeapRange.h
new file mode 100644
index 000000000..aab02bf01
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITHeapRange.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/MathExtras.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DOMJIT {
+
+class HeapRange {
+public:
+    constexpr HeapRange()
+        : m_begin(UINT16_MAX)
+        , m_end(UINT16_MAX)
+    {
+    }
+
+    HeapRange(uint16_t begin, uint16_t end)
+        : m_begin(begin)
+        , m_end(end)
+    {
+        ASSERT_WITH_MESSAGE(begin <= end, "begin <= end is the invariant of this HeapRange.");
+    }
+
+    enum ConstExprTag { ConstExpr };
+    constexpr HeapRange(ConstExprTag, uint16_t begin, uint16_t end)
+        : m_begin(begin)
+        , m_end(end)
+    {
+    }
+
+    enum RawRepresentationTag { RawRepresentation };
+    explicit constexpr HeapRange(RawRepresentationTag, uint32_t value)
+        : m_raw(value)
+    {
+    }
+
+    constexpr static HeapRange fromRaw(uint32_t value)
+    {
+        return HeapRange(RawRepresentation, value);
+    }
+
+    uint16_t begin() const { return m_begin; }
+    uint16_t end() const { return m_end; }
+    uint32_t rawRepresentation() { return m_raw; }
+
+    constexpr explicit operator bool() const
+    {
+        return m_begin != m_end;
+    }
+
+    constexpr bool operator==(const HeapRange& other) const
+    {
+        return m_begin == other.m_begin && m_end == other.m_end;
+    }
+
+    constexpr bool operator!=(const HeapRange& other) const
+    {
+        return !operator==(other);
+    }
+
+    template<uint16_t begin, uint16_t end>
+    static constexpr HeapRange fromConstant()
+    {
+        static_assert(begin < end || (begin == UINT16_MAX && end == UINT16_MAX), "begin < end or the both are UINT16_MAX is the invariant of this HeapRange.");
+        return HeapRange(ConstExpr, begin, end);
+    }
+
+    static constexpr HeapRange top() { return fromConstant<0, UINT16_MAX>(); }
+    static constexpr HeapRange none() { return fromConstant<UINT16_MAX, UINT16_MAX>(); } // Empty range.
+
+    bool isStrictSubtypeOf(const HeapRange& other) const
+    {
+        if (!*this || !other)
+            return false;
+        if (*this == other)
+            return false;
+        return other.m_begin <= m_begin && m_end <= other.m_end;
+    }
+
+    bool isSubtypeOf(const HeapRange& other) const
+    {
+        if (!*this || !other)
+            return false;
+        if (*this == other)
+            return true;
+        return isStrictSubtypeOf(other);
+    }
+
+    bool overlaps(const HeapRange& other) const
+    {
+        return WTF::rangesOverlap(m_begin, m_end, other.m_begin, other.m_end);
+    }
+
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const;
+
+private:
+    union {
+        struct {
+            uint16_t m_begin;
+            uint16_t m_end;
+        };
+        uint32_t m_raw;
+    };
+};
+
+} }
diff --git a/Source/JavaScriptCore/domjit/DOMJITPatchpoint.h b/Source/JavaScriptCore/domjit/DOMJITPatchpoint.h
new file mode 100644
index 000000000..bb9f5e4f9
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITPatchpoint.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "RegisterSet.h"
+
+namespace JSC { namespace DOMJIT {
+
+class PatchpointParams;
+
+typedef CCallHelpers::JumpList PatchpointGeneratorFunction(CCallHelpers&, PatchpointParams&);
+typedef SharedTask<PatchpointGeneratorFunction> PatchpointGenerator;
+
+// DOMJIT patchpoint is the way to inject an opaque code generator into DFG and FTL.
+// While B3::Patchpoint is self-contained about its compilation information,
+// DOMJIT::Patchpoint depends on which DFG Node invokes. For example, CheckDOM will
+// link returned failureCases to BadType OSRExit, but this information is offered
+// from CheckDOM DFG Node, not from this patchpoint. This patchpoint mainly focuses
+// on injecting a snippet generator that can tell register usage and can be used
+// in both DFG and FTL.
+class Patchpoint : public ThreadSafeRefCounted<Patchpoint> {
+public:
+    static Ref<Patchpoint> create()
+    {
+        return adoptRef(*new Patchpoint());
+    }
+
+    template<typename Functor>
+    void setGenerator(const Functor& functor)
+    {
+        m_generator = createSharedTask<PatchpointGeneratorFunction>(functor);
+    }
+
+    RefPtr<PatchpointGenerator> generator() const { return m_generator; }
+
+    uint8_t numGPScratchRegisters { 0 };
+    uint8_t numFPScratchRegisters { 0 };
+
+protected:
+    Patchpoint() = default;
+
+private:
+    RefPtr<PatchpointGenerator> m_generator;
+};
+
+} }
+
+#endif
diff --git a/Source/JavaScriptCore/domjit/DOMJITPatchpointParams.h b/Source/JavaScriptCore/domjit/DOMJITPatchpointParams.h
new file mode 100644
index 000000000..d83b6b0bf
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITPatchpointParams.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "DOMJITSlowPathCalls.h"
+#include "DOMJITValue.h"
+#include "JITOperations.h"
+#include "RegisterSet.h"
+
+namespace JSC { namespace DOMJIT {
+
+class PatchpointParams {
+WTF_MAKE_NONCOPYABLE(PatchpointParams);
+public:
+    virtual ~PatchpointParams() { }
+
+    unsigned size() const { return m_regs.size(); }
+    const Value& at(unsigned index) const { return m_regs[index]; }
+    const Value& operator[](unsigned index) const { return at(index); }
+
+    GPRReg gpScratch(unsigned index) const { return m_gpScratch[index]; }
+    FPRReg fpScratch(unsigned index) const { return m_fpScratch[index]; }
+
+    PatchpointParams(Vector<Value>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
+        : m_regs(WTFMove(regs))
+        , m_gpScratch(WTFMove(gpScratch))
+        , m_fpScratch(WTFMove(fpScratch))
+    {
+    }
+
+    template<typename FunctionType, typename ResultType, typename... Arguments>
+    void addSlowPathCall(CCallHelpers::JumpList from, CCallHelpers& jit, FunctionType function, ResultType result, Arguments... arguments)
+    {
+        addSlowPathCallImpl(from, jit, function, result, std::make_tuple(arguments...));
+    }
+
+private:
+#define JSC_DEFINE_CALL_OPERATIONS(OperationType, ResultType, ...) JS_EXPORT_PRIVATE virtual void addSlowPathCallImpl(CCallHelpers::JumpList, CCallHelpers&, OperationType, ResultType, std::tuple<__VA_ARGS__> args) = 0;
+    DOMJIT_SLOW_PATH_CALLS(JSC_DEFINE_CALL_OPERATIONS)
+#undef JSC_DEFINE_CALL_OPERATIONS
+
+    Vector<Value> m_regs;
+    Vector<GPRReg> m_gpScratch;
+    Vector<FPRReg> m_fpScratch;
+};
+
+} }
+
+#endif
diff --git a/Source/JavaScriptCore/domjit/DOMJITReg.h b/Source/JavaScriptCore/domjit/DOMJITReg.h
new file mode 100644
index 000000000..ea9eab8cc
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITReg.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Reg.h"
+#include <wtf/Variant.h>
+
+#if ENABLE(JIT)
+
+namespace JSC { namespace DOMJIT {
+
+// It is quite unfortunate that 32 bit environment exists on DFG! This means that JSValueRegs contains 2 registers
+// in such an environment. If we use GPRReg and FPRReg in DOMJITPatchpointParams, DOMJITPatchpointParams may contain
+// different number of registers in 32bit and 64bit environments when we pass JSValueRegs, it is confusing.
+// Therefore, we introduce an abstraction that DOMJIT::Reg, which is a polymorphic register class. It can refer FPRReg,
+// GPRReg, and "JSValueRegs". Note that isGPR() will return false if the target Reg is "JSValueRegs" even if the
+// environment is 64bit.
+//
+// FIXME: Eventually we should move this class into JSC and make is available for other JIT code.
+// https://bugs.webkit.org/show_bug.cgi?id=162990
+class Reg {
+public:
+    enum class Type : uint8_t {
+        GPR = 0,
+        FPR = 1,
+        JSValue = 2,
+    };
+
+    Reg(GPRReg reg)
+        : m_variant(reg)
+    {
+    }
+
+    Reg(FPRReg reg)
+        : m_variant(reg)
+    {
+    }
+
+    Reg(JSValueRegs regs)
+        : m_variant(regs)
+    {
+    }
+
+    bool isGPR() const { return m_variant.index() == static_cast<unsigned>(Type::GPR); }
+    bool isFPR() const { return m_variant.index() == static_cast<unsigned>(Type::FPR); }
+    bool isJSValueRegs() const { return m_variant.index() == static_cast<unsigned>(Type::JSValue); }
+
+    GPRReg gpr() const
+    {
+        ASSERT(isGPR());
+        return WTF::get<GPRReg>(m_variant);
+    }
+    FPRReg fpr() const
+    {
+        ASSERT(isFPR());
+        return WTF::get<FPRReg>(m_variant);
+    }
+    JSValueRegs jsValueRegs() const
+    {
+        ASSERT(isJSValueRegs());
+        return WTF::get<JSValueRegs>(m_variant);
+    }
+
+private:
+    Variant<GPRReg, FPRReg, JSValueRegs> m_variant;
+};
+
+} }
+
+#endif
diff --git a/Source/JavaScriptCore/domjit/DOMJITSignature.h b/Source/JavaScriptCore/domjit/DOMJITSignature.h
new file mode 100644
index 000000000..a37a6fd9a
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITSignature.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ClassInfo.h"
+#include "DOMJITEffect.h"
+#include "SpeculatedType.h"
+
+namespace JSC { namespace DOMJIT {
+
+// FIXME: Currently, we only support functions which arguments are up to 2.
+// Eventually, we should extend this. But possibly, 2 or 3 can cover typical use cases.
+// https://bugs.webkit.org/show_bug.cgi?id=164346
+#define JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS 2
+#define JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS_INCLUDING_THIS (1 + JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS)
+
+class Patchpoint;
+
+typedef Ref<Patchpoint> CheckDOMGeneratorFunction(void);
+
+class Signature {
+public:
+    template<typename... Arguments>
+    constexpr Signature(uintptr_t unsafeFunction, CheckDOMGeneratorFunction* checkDOMGeneratorFunction, const ClassInfo* classInfo, Effect effect, SpeculatedType result, Arguments... arguments)
+        : unsafeFunction(unsafeFunction)
+        , checkDOMGeneratorFunction(checkDOMGeneratorFunction)
+        , classInfo(classInfo)
+        , effect(effect)
+        , result(result)
+        , arguments {static_cast<SpeculatedType>(arguments)...}
+        , argumentCount(sizeof...(Arguments))
+    {
+    }
+
+#if ENABLE(JIT)
+    Ref<Patchpoint> checkDOM() const
+    {
+        return checkDOMGeneratorFunction();
+    }
+#endif
+
+    uintptr_t unsafeFunction;
+    CheckDOMGeneratorFunction* checkDOMGeneratorFunction;
+    const ClassInfo* const classInfo;
+    const Effect effect;
+    const SpeculatedType result;
+    const SpeculatedType arguments[JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS];
+    const unsigned argumentCount;
+};
+
+} }
diff --git a/Source/JavaScriptCore/domjit/DOMJITSlowPathCalls.h b/Source/JavaScriptCore/domjit/DOMJITSlowPathCalls.h
new file mode 100644
index 000000000..cb22b1f33
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITSlowPathCalls.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+// macro(OperationType, ArgType1, ArgType2, ...)
+#define DOMJIT_SLOW_PATH_CALLS(macro) \
+    macro(J_JITOperation_EP, JSValueRegs, GPRReg) \
+    macro(J_JITOperation_EGP, JSValueRegs, GPRReg, GPRReg) \
+
+#endif
diff --git a/Source/JavaScriptCore/domjit/DOMJITValue.h b/Source/JavaScriptCore/domjit/DOMJITValue.h
new file mode 100644
index 000000000..de6cb93fe
--- /dev/null
+++ b/Source/JavaScriptCore/domjit/DOMJITValue.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DOMJITReg.h"
+
+#if ENABLE(JIT)
+
+namespace JSC { namespace DOMJIT {
+
+class Value {
+public:
+    Value(Reg reg)
+        : m_reg(reg)
+    {
+    }
+
+    Value(Reg reg, JSValue value)
+        : m_reg(reg)
+        , m_value(value)
+    {
+    }
+
+    bool isGPR() const { return m_reg.isGPR(); }
+    bool isFPR() const { return m_reg.isFPR(); }
+    bool isJSValueRegs() const { return m_reg.isJSValueRegs(); }
+    GPRReg gpr() const { return m_reg.gpr(); }
+    FPRReg fpr() const { return m_reg.fpr(); }
+    JSValueRegs jsValueRegs() const { return m_reg.jsValueRegs(); }
+
+    Reg reg() const
+    {
+        return m_reg;
+    }
+
+    JSValue value() const
+    {
+        return m_value;
+    }
+
+private:
+    Reg m_reg;
+    JSValue m_value;
+};
+
+} }
+
+#endif