1 files changed, 31 insertions, 20 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGOSRExit.h b/Source/JavaScriptCore/dfg/DFGOSRExit.h
index d40efe4e0..d355876ef 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExit.h
+++ b/Source/JavaScriptCore/dfg/DFGOSRExit.h
@@ -23,10 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef DFGOSRExit_h
-#define DFGOSRExit_h
-
-#include <wtf/Platform.h>
+#pragma once
 
 #if ENABLE(DFG_JIT)
 
@@ -34,14 +31,12 @@
 #include "DFGCommon.h"
 #include "DFGExitProfile.h"
 #include "DFGOSRExitBase.h"
-#include "DFGValueRecoveryOverride.h"
 #include "GPRInfo.h"
 #include "MacroAssembler.h"
 #include "MethodOfGettingAValueProfile.h"
 #include "Operands.h"
 #include "ValueProfile.h"
 #include "ValueRecovery.h"
-#include <wtf/Vector.h>
 
 namespace JSC { namespace DFG {
 
@@ -51,8 +46,9 @@ struct Node;
 
 // This enum describes the types of additional recovery that
 // may need be performed should a speculation check fail.
-enum SpeculationRecoveryType {
+enum SpeculationRecoveryType : uint8_t {
     SpeculativeAdd,
+    SpeculativeAddImmediate,
     BooleanSpeculationCheck
 };
 
@@ -63,22 +59,36 @@ enum SpeculationRecoveryType {
 class SpeculationRecovery {
 public:
     SpeculationRecovery(SpeculationRecoveryType type, GPRReg dest, GPRReg src)
-        : m_type(type)
+        : m_src(src)
+        , m_dest(dest)
+        , m_type(type)
+    {
+        ASSERT(m_type == SpeculativeAdd || m_type == BooleanSpeculationCheck);
+    }
+
+    SpeculationRecovery(SpeculationRecoveryType type, GPRReg dest, int32_t immediate)
+        : m_immediate(immediate)
         , m_dest(dest)
-        , m_src(src)
+        , m_type(type)
     {
+        ASSERT(m_type == SpeculativeAddImmediate);
     }
 
     SpeculationRecoveryType type() { return m_type; }
     GPRReg dest() { return m_dest; }
     GPRReg src() { return m_src; }
+    int32_t immediate() { return m_immediate; }
 
 private:
-    // Indicates the type of additional recovery to be performed.
-    SpeculationRecoveryType m_type;
     // different recovery types may required different additional information here.
+    union {
+        GPRReg m_src;
+        int32_t m_immediate;
+    };
     GPRReg m_dest;
-    GPRReg m_src;
+
+    // Indicates the type of additional recovery to be performed.
+    SpeculationRecoveryType m_type;
 };
 
 // === OSRExit ===
@@ -87,33 +97,34 @@ private:
 // going into baseline code.
 struct OSRExit : public OSRExitBase {
     OSRExit(ExitKind, JSValueSource, MethodOfGettingAValueProfile, SpeculativeJIT*, unsigned streamIndex, unsigned recoveryIndex = UINT_MAX);
+
+    unsigned m_patchableCodeOffset { 0 };
     
     MacroAssemblerCodeRef m_code;
     
     JSValueSource m_jsValueSource;
     MethodOfGettingAValueProfile m_valueProfile;
-
-    unsigned m_patchableCodeOffset;
     
     unsigned m_recoveryIndex;
-    
+
     void setPatchableCodeOffset(MacroAssembler::PatchableJump);
     MacroAssembler::Jump getPatchableCodeOffsetAsJump() const;
     CodeLocationJump codeLocationForRepatch(CodeBlock*) const;
     void correctJump(LinkBuffer&);
 
     unsigned m_streamIndex;
-    
-    RefPtr<ValueRecoveryOverride> m_valueRecoveryOverride;
+    void considerAddingAsFrequentExitSite(CodeBlock* profiledCodeBlock)
+    {
+        OSRExitBase::considerAddingAsFrequentExitSite(profiledCodeBlock, ExitFromDFG);
+    }
 };
 
 struct SpeculationFailureDebugInfo {
     CodeBlock* codeBlock;
+    ExitKind kind;
+    unsigned bytecodeOffset;
 };
 
 } } // namespace JSC::DFG
 
 #endif // ENABLE(DFG_JIT)
-
-#endif // DFGOSRExit_h
-