1 files changed, 31 insertions, 37 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h b/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h
index f0f2a46d5..9f94cfee8 100644
--- a/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h
+++ b/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,32 +23,32 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef DFGInPlaceAbstractState_h
-#define DFGInPlaceAbstractState_h
-
-#include <wtf/Platform.h>
+#pragma once
 
 #if ENABLE(DFG_JIT)
 
 #include "DFGAbstractValue.h"
 #include "DFGBranchDirection.h"
+#include "DFGFlowMap.h"
 #include "DFGGraph.h"
-#include "DFGMergeMode.h"
 #include "DFGNode.h"
 
 namespace JSC { namespace DFG {
 
 class InPlaceAbstractState {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
-    InPlaceAbstractState(Graph& graph);
+    InPlaceAbstractState(Graph&);
     
     ~InPlaceAbstractState();
     
-    void createValueForNode(Node*) { }
+    explicit operator bool() const { return true; }
+    
+    void createValueForNode(NodeFlowProjection) { }
     
-    AbstractValue& forNode(Node* node)
+    AbstractValue& forNode(NodeFlowProjection node)
     {
-        return node->value;
+        return m_abstractValues.at(node);
     }
     
     AbstractValue& forNode(Edge edge)
@@ -77,26 +77,14 @@ public:
     // Finish abstractly executing a basic block. If MergeToTail or
     // MergeToSuccessors is passed, then this merges everything we have
     // learned about how the state changes during this block's execution into
-    // the block's data structures. There are three return modes, depending
-    // on the value of mergeMode:
-    //
-    // DontMerge:
-    //    Always returns false.
+    // the block's data structures.
     //
-    // MergeToTail:
-    //    Returns true if the state of the block at the tail was changed.
-    //    This means that you must call mergeToSuccessors(), and if that
-    //    returns true, then you must revisit (at least) the successor
-    //    blocks. False will always be returned if the block is terminal
-    //    (i.e. ends in Throw or Return, or has a ForceOSRExit inside it).
-    //
-    // MergeToSuccessors:
-    //    Returns true if the state of the block at the tail was changed,
-    //    and, if the state at the heads of successors was changed.
-    //    A true return means that you must revisit (at least) the successor
-    //    blocks. This also sets cfaShouldRevisit to true for basic blocks
-    //    that must be visited next.
-    bool endBasicBlock(MergeMode);
+    // Returns true if the state of the block at the tail was changed,
+    // and, if the state at the heads of successors was changed.
+    // A true return means that you must revisit (at least) the successor
+    // blocks. This also sets cfaShouldRevisit to true for basic blocks
+    // that must be visited next.
+    bool endBasicBlock();
     
     // Reset the AbstractState. This throws away any results, and at this point
     // you can safely call beginBasicBlock() on any basic block.
@@ -105,6 +93,9 @@ public:
     // Did the last executed node clobber the world?
     bool didClobber() const { return m_didClobber; }
     
+    // Are structures currently clobbered?
+    StructureClobberState structureClobberState() const { return m_structureClobberState; }
+    
     // Is the execution state still valid? This will be false if execute() has
     // returned false previously.
     bool isValid() const { return m_isValid; }
@@ -124,27 +115,33 @@ public:
     
     // Methods intended to be called from AbstractInterpreter.
     void setDidClobber(bool didClobber) { m_didClobber = didClobber; }
+    void setStructureClobberState(StructureClobberState value) { m_structureClobberState = value; }
     void setIsValid(bool isValid) { m_isValid = isValid; }
     void setBranchDirection(BranchDirection branchDirection) { m_branchDirection = branchDirection; }
+    
+    // This method is evil - it causes a huge maintenance headache and there is a gross amount of
+    // code devoted to it. It would be much nicer to just always run the constant folder on each
+    // block. But, the last time we did it, it was a 1% SunSpider regression:
+    // https://bugs.webkit.org/show_bug.cgi?id=133947
+    // So, we should probably keep this method.
     void setFoundConstants(bool foundConstants) { m_foundConstants = foundConstants; }
-    bool haveStructures() const { return m_haveStructures; } // It's always safe to return true.
-    void setHaveStructures(bool haveStructures) { m_haveStructures = haveStructures; }
 
 private:
-    bool mergeStateAtTail(AbstractValue& destination, AbstractValue& inVariable, Node*);
+    void mergeStateAtTail(AbstractValue& destination, AbstractValue& inVariable, Node*);
 
     static bool mergeVariableBetweenBlocks(AbstractValue& destination, AbstractValue& source, Node* destinationNode, Node* sourceNode);
     
     Graph& m_graph;
-    
+
+    FlowMap<AbstractValue>& m_abstractValues;
     Operands<AbstractValue> m_variables;
     BasicBlock* m_block;
     
-    bool m_haveStructures;
     bool m_foundConstants;
     
     bool m_isValid;
     bool m_didClobber;
+    StructureClobberState m_structureClobberState;
     
     BranchDirection m_branchDirection; // This is only set for blocks that end in Branch and that execute to completion (i.e. m_isValid == true).
 };
@@ -152,6 +149,3 @@ private:
 } } // namespace JSC::DFG
 
 #endif // ENABLE(DFG_JIT)
-
-#endif // DFGInPlaceAbstractState_h
-