JavaScriptCore-7601.1.46.3.tar.gz

[apple/javascriptcore.git] / runtime / Structure.h

diff --git a/runtime/Structure.h b/runtime/Structure.h
index 451ba3cefe3f5c030ed4e6a01a6e0838d699966e..25a97fedd341a96abcb66d930b88887d93954f0e 100644 (file)
--- a/runtime/Structure.h
+++ b/runtime/Structure.h
@@ -1,5 +1,5 @@
 /*
 /*

- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2012, 2013, 2014 Apple Inc. All rights reserved.

  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions


@@ -10,10 +10,10 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *

- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR


@@ -26,303 +26,598 @@
 #ifndef Structure_h
 #define Structure_h
 
 #ifndef Structure_h
 #define Structure_h
 

-#include "Identifier.h"
+#include "ClassInfo.h"
+#include "ConcurrentJITLock.h"
+#include "IndexingType.h"
+#include "JSCJSValue.h"
+#include "JSCell.h"

 #include "JSType.h"
 #include "JSType.h"

-#include "JSValue.h"
-#include "PropertyMapHashTable.h"
+#include "PropertyName.h"

 #include "PropertyNameArray.h"
 #include "PropertyNameArray.h"

+#include "PropertyOffset.h"

 #include "Protect.h"
 #include "Protect.h"

-#include "StructureChain.h"
+#include "PutPropertySlot.h"
+#include "StructureIDBlob.h"
+#include "StructureRareData.h"

 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"

-#include "UString.h"
-#include "WeakGCPtr.h"
+#include "Watchpoint.h"
+#include "Weak.h"
+#include "WriteBarrierInlines.h"
+#include <wtf/CompilationThread.h>

 #include <wtf/PassRefPtr.h>
 #include <wtf/PassRefPtr.h>

+#include <wtf/PrintStream.h>

 #include <wtf/RefCounted.h>
 
 #include <wtf/RefCounted.h>
 

-#ifndef NDEBUG
-#define DUMP_PROPERTYMAP_STATS 0
-#else
-#define DUMP_PROPERTYMAP_STATS 0
-#endif
+namespace WTF {

 
 

-namespace JSC {
-
-    class MarkStack;
-    class PropertyNameArray;
-    class PropertyNameArrayData;
-
-    enum EnumerationMode {
-        ExcludeDontEnumProperties,
-        IncludeDontEnumProperties
-    };
-
-    class Structure : public RefCounted<Structure> {
-    public:
-        friend class JIT;
-        friend class StructureTransitionTable;
-        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount)
-        {
-            return adoptRef(new Structure(prototype, typeInfo, anonymousSlotCount));
-        }
-
-        static void startIgnoringLeaks();
-        static void stopIgnoringLeaks();
-
-        static void dumpStatistics();
+class UniquedStringImpl;

 
 

-        static PassRefPtr<Structure> addPropertyTransition(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
-        static PassRefPtr<Structure> addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
-        static PassRefPtr<Structure> removePropertyTransition(Structure*, const Identifier& propertyName, size_t& offset);
-        static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValue prototype);
-        static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);
-        static PassRefPtr<Structure> getterSetterTransition(Structure*);
-        static PassRefPtr<Structure> toCacheableDictionaryTransition(Structure*);
-        static PassRefPtr<Structure> toUncacheableDictionaryTransition(Structure*);
+} // namespace WTF

 
 

-        PassRefPtr<Structure> flattenDictionaryStructure(JSObject*);
-
-        ~Structure();
+namespace JSC {

 
 

-        // These should be used with caution.  
-        size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
-        size_t removePropertyWithoutTransition(const Identifier& propertyName);
-        void setPrototypeWithoutTransition(JSValue prototype) { m_prototype = prototype; }
-        
-        bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
-        bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
+class DeferGC;
+class LLIntOffsetsExtractor;
+class PropertyNameArray;
+class PropertyNameArrayData;
+class PropertyTable;
+class StructureChain;
+class StructureShape;
+class SlotVisitor;
+class JSString;
+struct DumpContext;
+
+// The out-of-line property storage capacity to use when first allocating out-of-line
+// storage. Note that all objects start out without having any out-of-line storage;
+// this comes into play only on the first property store that exhausts inline storage.
+static const unsigned initialOutOfLineCapacity = 4;
+
+// The factor by which to grow out-of-line storage when it is exhausted, after the
+// initial allocation.
+static const unsigned outOfLineGrowthFactor = 2;
+
+struct PropertyMapEntry {
+    UniquedStringImpl* key;
+    PropertyOffset offset;
+    unsigned attributes;
+
+    PropertyMapEntry()
+        : key(nullptr)
+        , offset(invalidOffset)
+        , attributes(0)
+    {
+    }
+    
+    PropertyMapEntry(UniquedStringImpl* key, PropertyOffset offset, unsigned attributes)
+        : key(key)
+        , offset(offset)
+        , attributes(attributes)
+    {
+    }
+};

 
 

-        const TypeInfo& typeInfo() const { return m_typeInfo; }
+class Structure final : public JSCell {
+public:
+    friend class StructureTransitionTable;

 
 

-        JSValue storedPrototype() const { return m_prototype; }
-        JSValue prototypeForLookup(ExecState*) const;
-        StructureChain* prototypeChain(ExecState*) const;
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+    
+    static Structure* create(VM&, JSGlobalObject*, JSValue prototype, const TypeInfo&, const ClassInfo*, IndexingType = NonArray, unsigned inlineCapacity = 0);

 
 

-        Structure* previousID() const { return m_previous.get(); }
+    ~Structure();

 
 

-        void growPropertyStorageCapacity();
-        unsigned propertyStorageCapacity() const { return m_propertyStorageCapacity; }
-        unsigned propertyStorageSize() const { return m_anonymousSlotCount + (m_propertyTable ? m_propertyTable->keyCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1); }
-        bool isUsingInlineStorage() const;
+protected:
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+        ASSERT(m_prototype);
+        ASSERT(m_prototype.isObject() || m_prototype.isNull());
+    }

 
 

-        size_t get(const Identifier& propertyName);
-        size_t get(const UString::Rep* rep, unsigned& attributes, JSCell*& specificValue);
-        size_t get(const Identifier& propertyName, unsigned& attributes, JSCell*& specificValue)
-        {
-            ASSERT(!propertyName.isNull());
-            return get(propertyName.ustring().rep(), attributes, specificValue);
-        }
-        bool transitionedFor(const JSCell* specificValue)
-        {
-            return m_specificValueInPrevious == specificValue;
-        }
-        bool hasTransition(UString::Rep*, unsigned attributes);
-        bool hasTransition(const Identifier& propertyName, unsigned attributes)
-        {
-            return hasTransition(propertyName._ustring.rep(), attributes);
-        }
+    void finishCreation(VM& vm, CreatingEarlyCellTag)
+    {
+        Base::finishCreation(vm, this, CreatingEarlyCell);
+        ASSERT(m_prototype);
+        ASSERT(m_prototype.isNull());
+        ASSERT(!vm.structureStructure);
+    }

 
 

-        bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
-        void setHasGetterSetterProperties(bool hasGetterSetterProperties) { m_hasGetterSetterProperties = hasGetterSetterProperties; }
+public:
+    StructureID id() const { return m_blob.structureID(); }
+    int32_t objectInitializationBlob() const { return m_blob.blobExcludingStructureID(); }
+    int64_t idBlob() const { return m_blob.blob(); }

 
 

-        bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
+    bool isProxy() const
+    {
+        JSType type = m_blob.type();
+        return type == ImpureProxyType || type == PureForwardingProxyType;
+    }

 
 

-        bool hasAnonymousSlots() const { return !!m_anonymousSlotCount; }
-        unsigned anonymousSlotCount() const { return m_anonymousSlotCount; }
+    static void dumpStatistics();
+
+    JS_EXPORT_PRIVATE static Structure* addPropertyTransition(VM&, Structure*, PropertyName, unsigned attributes, PropertyOffset&, PutPropertySlot::Context = PutPropertySlot::UnknownContext);
+    static Structure* addPropertyTransitionToExistingStructureConcurrently(Structure*, UniquedStringImpl* uid, unsigned attributes, PropertyOffset&);
+    JS_EXPORT_PRIVATE static Structure* addPropertyTransitionToExistingStructure(Structure*, PropertyName, unsigned attributes, PropertyOffset&);
+    static Structure* removePropertyTransition(VM&, Structure*, PropertyName, PropertyOffset&);
+    JS_EXPORT_PRIVATE static Structure* changePrototypeTransition(VM&, Structure*, JSValue prototype);
+    JS_EXPORT_PRIVATE static Structure* attributeChangeTransition(VM&, Structure*, PropertyName, unsigned attributes);
+    JS_EXPORT_PRIVATE static Structure* toCacheableDictionaryTransition(VM&, Structure*);
+    static Structure* toUncacheableDictionaryTransition(VM&, Structure*);
+    JS_EXPORT_PRIVATE static Structure* sealTransition(VM&, Structure*);
+    JS_EXPORT_PRIVATE static Structure* freezeTransition(VM&, Structure*);
+    static Structure* preventExtensionsTransition(VM&, Structure*);
+    JS_EXPORT_PRIVATE static Structure* nonPropertyTransition(VM&, Structure*, NonPropertyTransition);
+
+    JS_EXPORT_PRIVATE bool isSealed(VM&);
+    JS_EXPORT_PRIVATE bool isFrozen(VM&);
+    bool isExtensible() const { return !preventExtensions(); }
+    bool putWillGrowOutOfLineStorage();
+    size_t suggestedNewOutOfLineStorageCapacity(); 
+
+    JS_EXPORT_PRIVATE Structure* flattenDictionaryStructure(VM&, JSObject*);
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    // These should be used with caution.  
+    JS_EXPORT_PRIVATE PropertyOffset addPropertyWithoutTransition(VM&, PropertyName, unsigned attributes);
+    PropertyOffset removePropertyWithoutTransition(VM&, PropertyName);
+    void setPrototypeWithoutTransition(VM& vm, JSValue prototype) { m_prototype.set(vm, this, prototype); }

         
         

-        bool isEmpty() const { return m_propertyTable ? !m_propertyTable->keyCount : m_offset == noOffset; }
+    bool isDictionary() const { return dictionaryKind() != NoneDictionaryKind; }
+    bool isUncacheableDictionary() const { return dictionaryKind() == UncachedDictionaryKind; }
+  
+    bool propertyAccessesAreCacheable() { return dictionaryKind() != UncachedDictionaryKind && !typeInfo().prohibitsPropertyCaching(); }
+
+    // We use SlowPath in GetByIdStatus for structures that may get new impure properties later to prevent
+    // DFG from inlining property accesses since structures don't transition when a new impure property appears.
+    bool takesSlowPathInDFGForImpureProperty()
+    {
+        return typeInfo().hasImpureGetOwnPropertySlot();
+    }

 
 

-        void despecifyDictionaryFunction(const Identifier& propertyName);
-        void disableSpecificFunctionTracking() { m_specificFunctionThrashCount = maxSpecificFunctionThrashCount; }
+    // Type accessors.
+    TypeInfo typeInfo() const { ASSERT(structure()->classInfo() == info()); return m_blob.typeInfo(m_outOfLineTypeFlags); }
+    bool isObject() const { return typeInfo().isObject(); }

 
 

-        void setEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
-        void clearEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
-        JSPropertyNameIterator* enumerationCache(); // Defined in JSPropertyNameIterator.h.
-        void getPropertyNames(PropertyNameArray&, EnumerationMode mode);
+    IndexingType indexingType() const { return m_blob.indexingType() & AllArrayTypes; }
+    IndexingType indexingTypeIncludingHistory() const { return m_blob.indexingType(); }

         
         

-    private:
-
-        Structure(JSValue prototype, const TypeInfo&, unsigned anonymousSlotCount);
+    bool mayInterceptIndexedAccesses() const
+    {
+        return !!(indexingTypeIncludingHistory() & MayHaveIndexedAccessors);
+    }

         
         

-        typedef enum { 
-            NoneDictionaryKind = 0,
-            CachedDictionaryKind = 1,
-            UncachedDictionaryKind = 2
-        } DictionaryKind;
-        static PassRefPtr<Structure> toDictionaryTransition(Structure*, DictionaryKind);
-
-        size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
-        size_t remove(const Identifier& propertyName);
-
-        void expandPropertyMapHashTable();
-        void rehashPropertyMapHashTable();
-        void rehashPropertyMapHashTable(unsigned newTableSize);
-        void createPropertyMapHashTable();
-        void createPropertyMapHashTable(unsigned newTableSize);
-        void insertIntoPropertyMapHashTable(const PropertyMapEntry&);
-        void checkConsistency();
-
-        bool despecifyFunction(const Identifier&);
-        void despecifyAllFunctions();
-
-        PropertyMapHashTable* copyPropertyTable();
-        void materializePropertyMap();
-        void materializePropertyMapIfNecessary()
-        {
-            if (m_propertyTable || !m_previous)             
-                return;
-            materializePropertyMap();
-        }
-
-        signed char transitionCount() const
-        {
-            // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
-            return m_offset == noOffset ? 0 : m_offset + 1;
-        }
+    bool anyObjectInChainMayInterceptIndexedAccesses() const;
+    bool holesMustForwardToPrototype(VM&) const;

         
         

-        bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
-
-        static const unsigned emptyEntryIndex = 0;
-    
-        static const signed char s_maxTransitionLength = 64;
-
-        static const signed char noOffset = -1;
+    bool needsSlowPutIndexing() const;
+    NonPropertyTransition suggestedArrayStorageTransition() const;
+        
+    JSGlobalObject* globalObject() const { return m_globalObject.get(); }
+    void setGlobalObject(VM& vm, JSGlobalObject* globalObject) { m_globalObject.set(vm, this, globalObject); }
+        
+    JSValue storedPrototype() const { return m_prototype.get(); }
+    JSObject* storedPrototypeObject() const;
+    Structure* storedPrototypeStructure() const;
+    JSValue prototypeForLookup(ExecState*) const;
+    JSValue prototypeForLookup(JSGlobalObject*) const;
+    JSValue prototypeForLookup(CodeBlock*) const;
+    StructureChain* prototypeChain(VM&, JSGlobalObject*) const;
+    StructureChain* prototypeChain(ExecState*) const;
+    static void visitChildren(JSCell*, SlotVisitor&);
+        
+    // Will just the prototype chain intercept this property access?
+    bool prototypeChainMayInterceptStoreTo(VM&, PropertyName);
+        
+    Structure* previousID() const
+    {
+        ASSERT(structure()->classInfo() == info());
+        if (hasRareData())
+            return rareData()->previousID();
+        return previous();
+    }
+    bool transitivelyTransitionedFrom(Structure* structureToFind);

 
 

-        static const unsigned maxSpecificFunctionThrashCount = 3;
+    unsigned outOfLineCapacity() const
+    {
+        ASSERT(checkOffsetConsistency());
+            
+        unsigned outOfLineSize = this->outOfLineSize();

 
 

-        TypeInfo m_typeInfo;
+        if (!outOfLineSize)
+            return 0;

 
 

-        JSValue m_prototype;
-        mutable RefPtr<StructureChain> m_cachedPrototypeChain;
+        if (outOfLineSize <= initialOutOfLineCapacity)
+            return initialOutOfLineCapacity;

 
 

-        RefPtr<Structure> m_previous;
-        RefPtr<UString::Rep> m_nameInPrevious;
-        JSCell* m_specificValueInPrevious;
+        ASSERT(outOfLineSize > initialOutOfLineCapacity);
+        COMPILE_ASSERT(outOfLineGrowthFactor == 2, outOfLineGrowthFactor_is_two);
+        return WTF::roundUpToPowerOfTwo(outOfLineSize);
+    }
+    unsigned outOfLineSize() const
+    {
+        ASSERT(checkOffsetConsistency());
+        ASSERT(structure()->classInfo() == info());
+            
+        return numberOfOutOfLineSlotsForLastOffset(m_offset);
+    }
+    bool hasInlineStorage() const
+    {
+        return !!m_inlineCapacity;
+    }
+    unsigned inlineCapacity() const
+    {
+        return m_inlineCapacity;
+    }
+    unsigned inlineSize() const
+    {
+        return std::min<unsigned>(m_offset + 1, m_inlineCapacity);
+    }
+    unsigned totalStorageSize() const
+    {
+        return numberOfSlotsForLastOffset(m_offset, m_inlineCapacity);
+    }
+    unsigned totalStorageCapacity() const
+    {
+        ASSERT(structure()->classInfo() == info());
+        return outOfLineCapacity() + inlineCapacity();
+    }

 
 

-        StructureTransitionTable table;
+    bool isValidOffset(PropertyOffset offset) const
+    {
+        return JSC::isValidOffset(offset)
+            && offset <= m_offset
+            && (offset < m_inlineCapacity || offset >= firstOutOfLineOffset);
+    }
+    
+    bool couldHaveIndexingHeader() const
+    {
+        return hasIndexedProperties(indexingType())
+            || isTypedView(m_classInfo->typedArrayStorageType);
+    }
+    
+    bool hasIndexingHeader(const JSCell*) const;
+    
+    bool masqueradesAsUndefined(JSGlobalObject* lexicalGlobalObject);

 
 

-        WeakGCPtr<JSPropertyNameIterator> m_enumerationCache;
+    PropertyOffset get(VM&, PropertyName);
+    PropertyOffset get(VM&, PropertyName, unsigned& attributes);

 
 

-        PropertyMapHashTable* m_propertyTable;
+    // This is a somewhat internalish method. It will call your functor while possibly holding the
+    // Structure's lock. There is no guarantee whether the lock is held or not in any particular
+    // call. So, you have to assume the worst. Also, the functor returns true if it wishes for you
+    // to continue or false if it's done.
+    template<typename Functor>
+    void forEachPropertyConcurrently(const Functor&);
+    
+    PropertyOffset getConcurrently(UniquedStringImpl* uid);
+    PropertyOffset getConcurrently(UniquedStringImpl* uid, unsigned& attributes);
+    
+    Vector<PropertyMapEntry> getPropertiesConcurrently();
+    
+    void setHasGetterSetterPropertiesWithProtoCheck(bool is__proto__)
+    {
+        setHasGetterSetterProperties(true);
+        if (!is__proto__)
+            setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
+    }
+    
+    void setContainsReadOnlyProperties() { setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true); }
+    
+    void setHasCustomGetterSetterPropertiesWithProtoCheck(bool is__proto__)
+    {
+        setHasCustomGetterSetterProperties(true);
+        if (!is__proto__)
+            setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
+    }
+    
+    bool isEmpty() const
+    {
+        ASSERT(checkOffsetConsistency());
+        return !JSC::isValidOffset(m_offset);
+    }

 
 

-        uint32_t m_propertyStorageCapacity;
+    void setCachedPropertyNameEnumerator(VM&, JSPropertyNameEnumerator*);
+    JSPropertyNameEnumerator* cachedPropertyNameEnumerator() const;
+    bool canCachePropertyNameEnumerator() const;
+    bool canAccessPropertiesQuickly() const;

 
 

-        // m_offset does not account for anonymous slots
-        signed char m_offset;
+    void getPropertyNamesFromStructure(VM&, PropertyNameArray&, EnumerationMode);

 
 

-        unsigned m_dictionaryKind : 2;
-        bool m_isPinnedPropertyTable : 1;
-        bool m_hasGetterSetterProperties : 1;
-        bool m_hasNonEnumerableProperties : 1;
-#if COMPILER(WINSCW)
-        // Workaround for Symbian WINSCW compiler that cannot resolve unsigned type of the declared 
-        // bitfield, when used as argument in make_pair() function calls in structure.ccp.
-        // This bitfield optimization is insignificant for the Symbian emulator target.
-        unsigned m_attributesInPrevious;
-#else
-        unsigned m_attributesInPrevious : 7;
-#endif
-        unsigned m_specificFunctionThrashCount : 2;
-        unsigned m_anonymousSlotCount : 5;
-        // 5 free bits
-    };
+    JSString* objectToStringValue()
+    {
+        if (!hasRareData())
+            return 0;
+        return rareData()->objectToStringValue();
+    }

 
 

-    inline size_t Structure::get(const Identifier& propertyName)
+    void setObjectToStringValue(VM& vm, JSString* value)

     {
     {

-        ASSERT(!propertyName.isNull());
+        if (!hasRareData())
+            allocateRareData(vm);
+        rareData()->setObjectToStringValue(vm, value);
+    }

 
 

-        materializePropertyMapIfNecessary();
-        if (!m_propertyTable)
-            return WTF::notFound;
+    const ClassInfo* classInfo() const { return m_classInfo; }

 
 

-        UString::Rep* rep = propertyName._ustring.rep();
+    static ptrdiff_t structureIDOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_blob) + StructureIDBlob::structureIDOffset();
+    }

 
 

-        unsigned i = rep->existingHash();
+    static ptrdiff_t prototypeOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_prototype);
+    }

 
 

-#if DUMP_PROPERTYMAP_STATS
-        ++numProbes;
-#endif
+    static ptrdiff_t globalObjectOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_globalObject);
+    }

 
 

-        unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-        if (entryIndex == emptyEntryIndex)
-            return WTF::notFound;
+    static ptrdiff_t classInfoOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_classInfo);
+    }
+        
+    static ptrdiff_t indexingTypeOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_blob) + StructureIDBlob::indexingTypeOffset();
+    }

 
 

-        if (rep == m_propertyTable->entries()[entryIndex - 1].key)
-            return m_propertyTable->entries()[entryIndex - 1].offset;
+    static Structure* createStructure(VM&);
+        
+    bool transitionWatchpointSetHasBeenInvalidated() const
+    {
+        return m_transitionWatchpointSet.hasBeenInvalidated();
+    }
+        
+    bool transitionWatchpointSetIsStillValid() const
+    {
+        return m_transitionWatchpointSet.isStillValid();
+    }
+    
+    bool dfgShouldWatchIfPossible() const
+    {
+        // FIXME: We would like to not watch things that are unprofitable to watch, like
+        // dictionaries. Unfortunately, we can't do such things: a dictionary could get flattened,
+        // in which case it will start to appear watchable and so the DFG will think that it is
+        // watching it. We should come up with a comprehensive story for not watching things that
+        // aren't profitable to watch.
+        // https://bugs.webkit.org/show_bug.cgi?id=133625
+        return true;
+    }
+    
+    bool dfgShouldWatch() const
+    {
+        return dfgShouldWatchIfPossible() && transitionWatchpointSetIsStillValid();
+    }
+        
+    void addTransitionWatchpoint(Watchpoint* watchpoint) const
+    {
+        ASSERT(transitionWatchpointSetIsStillValid());
+        m_transitionWatchpointSet.add(watchpoint);
+    }
+    
+    void didTransitionFromThisStructure() const;
+    
+    InlineWatchpointSet& transitionWatchpointSet() const
+    {
+        return m_transitionWatchpointSet;
+    }
+    
+    WatchpointSet* ensurePropertyReplacementWatchpointSet(VM&, PropertyOffset);
+    void startWatchingPropertyForReplacements(VM& vm, PropertyOffset offset)
+    {
+        ensurePropertyReplacementWatchpointSet(vm, offset);
+    }
+    void startWatchingPropertyForReplacements(VM&, PropertyName);
+    WatchpointSet* propertyReplacementWatchpointSet(PropertyOffset);
+    void didReplaceProperty(PropertyOffset);
+    void didCachePropertyReplacement(VM&, PropertyOffset);
+    
+    void startWatchingInternalPropertiesIfNecessary(VM& vm)
+    {
+        if (LIKELY(didWatchInternalProperties()))
+            return;
+        startWatchingInternalProperties(vm);
+    }
+    
+    void startWatchingInternalPropertiesIfNecessaryForEntireChain(VM& vm)
+    {
+        for (Structure* structure = this; structure; structure = structure->storedPrototypeStructure())
+            structure->startWatchingInternalPropertiesIfNecessary(vm);
+    }

 
 

-#if DUMP_PROPERTYMAP_STATS
-        ++numCollisions;
-#endif
+    PassRefPtr<StructureShape> toStructureShape(JSValue);
+    
+    // Determines if the two structures match enough that this one could be used for allocations
+    // of the other one.
+    bool canUseForAllocationsOf(Structure*);
+    
+    void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dumpBrief(PrintStream&, const CString&) const;
+    
+    static void dumpContextHeader(PrintStream&);
+    
+    DECLARE_EXPORT_INFO;
+
+private:
+    typedef enum { 
+        NoneDictionaryKind = 0,
+        CachedDictionaryKind = 1,
+        UncachedDictionaryKind = 2
+    } DictionaryKind;
+
+public:
+#define DEFINE_BITFIELD(type, lowerName, upperName, width, offset) \
+    static const uint32_t s_##lowerName##Shift = offset;\
+    static const uint32_t s_##lowerName##Mask = ((1 << (width - 1)) | ((1 << (width - 1)) - 1));\
+    type lowerName() const { return static_cast<type>((m_bitField >> offset) & s_##lowerName##Mask); }\
+    void set##upperName(type newValue) \
+    {\
+        m_bitField &= ~(s_##lowerName##Mask << offset);\
+        m_bitField |= (newValue & s_##lowerName##Mask) << offset;\
+    }

 
 

-        unsigned k = 1 | WTF::doubleHash(rep->existingHash());
+    DEFINE_BITFIELD(DictionaryKind, dictionaryKind, DictionaryKind, 2, 0);
+    DEFINE_BITFIELD(bool, isPinnedPropertyTable, IsPinnedPropertyTable, 1, 2);
+    DEFINE_BITFIELD(bool, hasGetterSetterProperties, HasGetterSetterProperties, 1, 3);
+    DEFINE_BITFIELD(bool, hasReadOnlyOrGetterSetterPropertiesExcludingProto, HasReadOnlyOrGetterSetterPropertiesExcludingProto, 1, 4);
+    DEFINE_BITFIELD(bool, hasNonEnumerableProperties, HasNonEnumerableProperties, 1, 5);
+    DEFINE_BITFIELD(unsigned, attributesInPrevious, AttributesInPrevious, 14, 6);
+    DEFINE_BITFIELD(bool, preventExtensions, PreventExtensions, 1, 20);
+    DEFINE_BITFIELD(bool, didTransition, DidTransition, 1, 21);
+    DEFINE_BITFIELD(bool, staticFunctionsReified, StaticFunctionsReified, 1, 22);
+    DEFINE_BITFIELD(bool, hasRareData, HasRareData, 1, 23);
+    DEFINE_BITFIELD(bool, hasBeenFlattenedBefore, HasBeenFlattenedBefore, 1, 24);
+    DEFINE_BITFIELD(bool, hasCustomGetterSetterProperties, HasCustomGetterSetterProperties, 1, 25);
+    DEFINE_BITFIELD(bool, didWatchInternalProperties, DidWatchInternalProperties, 1, 26);
+
+private:
+    friend class LLIntOffsetsExtractor;
+
+    JS_EXPORT_PRIVATE Structure(VM&, JSGlobalObject*, JSValue prototype, const TypeInfo&, const ClassInfo*, IndexingType, unsigned inlineCapacity);
+    Structure(VM&);
+    Structure(VM&, Structure*);
+
+    static Structure* create(VM&, Structure*);
+    
+    static Structure* addPropertyTransitionToExistingStructureImpl(Structure*, UniquedStringImpl* uid, unsigned attributes, PropertyOffset&);

 
 

-        while (1) {
-            i += k;
+    // This will return the structure that has a usable property table, that property table,
+    // and the list of structures that we visited before we got to it. If it returns a
+    // non-null structure, it will also lock the structure that it returns; it is your job
+    // to unlock it.
+    void findStructuresAndMapForMaterialization(Vector<Structure*, 8>& structures, Structure*&, PropertyTable*&);
+    
+    static Structure* toDictionaryTransition(VM&, Structure*, DictionaryKind);

 
 

-#if DUMP_PROPERTYMAP_STATS
-            ++numRehashes;
-#endif
+    PropertyOffset add(VM&, PropertyName, unsigned attributes);
+    PropertyOffset remove(PropertyName);

 
 

-            entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-            if (entryIndex == emptyEntryIndex)
-                return WTF::notFound;
+    void createPropertyMap(const GCSafeConcurrentJITLocker&, VM&, unsigned keyCount = 0);
+    void checkConsistency();

 
 

-            if (rep == m_propertyTable->entries()[entryIndex - 1].key)
-                return m_propertyTable->entries()[entryIndex - 1].offset;
-        }
+    WriteBarrier<PropertyTable>& propertyTable();
+    PropertyTable* takePropertyTableOrCloneIfPinned(VM&);
+    PropertyTable* copyPropertyTable(VM&);
+    PropertyTable* copyPropertyTableForPinning(VM&);
+    JS_EXPORT_PRIVATE void materializePropertyMap(VM&);
+    ALWAYS_INLINE void materializePropertyMapIfNecessary(VM& vm, DeferGC&)
+    {
+        ASSERT(!isCompilationThread());
+        ASSERT(structure()->classInfo() == info());
+        ASSERT(checkOffsetConsistency());
+        if (!propertyTable() && previousID())
+            materializePropertyMap(vm);

     }
     }

-    
-    bool StructureTransitionTable::contains(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+    ALWAYS_INLINE void materializePropertyMapIfNecessary(VM& vm, PropertyTable*& table)

     {
     {

-        if (usingSingleTransitionSlot()) {
-            Structure* existingTransition = singleTransition();
-            return existingTransition && existingTransition->m_nameInPrevious.get() == key.first
-                   && existingTransition->m_attributesInPrevious == key.second
-                   && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0);
+        ASSERT(!isCompilationThread());
+        ASSERT(structure()->classInfo() == info());
+        ASSERT(checkOffsetConsistency());
+        table = propertyTable().get();
+        if (!table && previousID()) {
+            DeferGC deferGC(vm.heap);
+            materializePropertyMap(vm);
+            table = propertyTable().get();

         }
         }

-        TransitionTable::iterator find = table()->find(key);
-        if (find == table()->end())
-            return false;
+    }
+    void materializePropertyMapIfNecessaryForPinning(VM& vm, DeferGC&)
+    {
+        ASSERT(structure()->classInfo() == info());
+        checkOffsetConsistency();
+        if (!propertyTable())
+            materializePropertyMap(vm);
+    }

 
 

-        return find->second.first || find->second.second->transitionedFor(specificValue);
+    void setPreviousID(VM& vm, Structure* structure)
+    {
+        if (hasRareData())
+            rareData()->setPreviousID(vm, structure);
+        else
+            m_previousOrRareData.set(vm, this, structure);

     }
 
     }
 

-    Structure* StructureTransitionTable::get(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const
+    void clearPreviousID()

     {
     {

-        if (usingSingleTransitionSlot()) {
-            Structure* existingTransition = singleTransition();
-            if (existingTransition && existingTransition->m_nameInPrevious.get() == key.first
-                && existingTransition->m_attributesInPrevious == key.second
-                && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0))
-                return existingTransition;
-            return 0;
-        }
+        if (hasRareData())
+            rareData()->clearPreviousID();
+        else
+            m_previousOrRareData.clear();
+    }

 
 

-        Transition transition = table()->get(key);
-        if (transition.second && transition.second->transitionedFor(specificValue))
-            return transition.second;
-        return transition.first;
+    int transitionCount() const
+    {
+        // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
+        return numberOfSlotsForLastOffset(m_offset, m_inlineCapacity);

     }
 
     }
 

-    bool StructureTransitionTable::hasTransition(const StructureTransitionTableHash::Key& key) const
+    bool isValid(JSGlobalObject*, StructureChain* cachedPrototypeChain) const;
+    bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
+        
+    void pin();
+
+    Structure* previous() const

     {
     {

-        if (usingSingleTransitionSlot()) {
-            Structure* transition = singleTransition();
-            return transition && transition->m_nameInPrevious == key.first
-            && transition->m_attributesInPrevious == key.second;
-        }
-        return table()->contains(key);
+        ASSERT(!hasRareData());
+        return static_cast<Structure*>(m_previousOrRareData.get());

     }
     }

-    
-    void StructureTransitionTable::reifySingleTransition()
+
+    StructureRareData* rareData() const

     {
     {

-        ASSERT(usingSingleTransitionSlot());
-        Structure* existingTransition = singleTransition();
-        TransitionTable* transitionTable = new TransitionTable;
-        setTransitionTable(transitionTable);
-        if (existingTransition)
-            add(std::make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
+        ASSERT(hasRareData());
+        return static_cast<StructureRareData*>(m_previousOrRareData.get());

     }
     }

+        
+    bool checkOffsetConsistency() const;
+
+    JS_EXPORT_PRIVATE void allocateRareData(VM&);
+    
+    void startWatchingInternalProperties(VM&);
+
+    static const int s_maxTransitionLength = 64;
+    static const int s_maxTransitionLengthForNonEvalPutById = 512;
+
+    // These need to be properly aligned at the beginning of the 'Structure'
+    // part of the object.
+    StructureIDBlob m_blob;
+    TypeInfo::OutOfLineTypeFlags m_outOfLineTypeFlags;
+
+    WriteBarrier<JSGlobalObject> m_globalObject;
+    WriteBarrier<Unknown> m_prototype;
+    mutable WriteBarrier<StructureChain> m_cachedPrototypeChain;
+
+    WriteBarrier<JSCell> m_previousOrRareData;
+
+    RefPtr<UniquedStringImpl> m_nameInPrevious;
+
+    const ClassInfo* m_classInfo;
+
+    StructureTransitionTable m_transitionTable;
+
+    // Should be accessed through propertyTable(). During GC, it may be set to 0 by another thread.
+    WriteBarrier<PropertyTable> m_propertyTableUnsafe;
+
+    mutable InlineWatchpointSet m_transitionWatchpointSet;
+
+    COMPILE_ASSERT(firstOutOfLineOffset < 256, firstOutOfLineOffset_fits);
+
+    // m_offset does not account for anonymous slots
+    PropertyOffset m_offset;
+
+    uint8_t m_inlineCapacity;
+    
+    ConcurrentJITLock m_lock;
+    
+    uint32_t m_bitField;
+};
+

 } // namespace JSC
 
 #endif // Structure_h
 } // namespace JSC
 
 #endif // Structure_h