Title: [228500] trunk/Source/_javascript_Core
Revision
228500
Author
keith_mil...@apple.com
Date
2018-02-14 18:08:41 -0800 (Wed, 14 Feb 2018)

Log Message

We should be able to jsDynamicCast from JSType when possible
https://bugs.webkit.org/show_bug.cgi?id=182804

Reviewed by Filip Pizlo and Mark Lam.

This patch beefs up jsDynamicCast in some of the cases where we
can use the JSType to quickly determine if a cell is a subclass of
the desired type. Since all JSCells have a range of JSTypes they support,
if there is a range exclusive to a class and all subclasses we can use
that range to quickly determine if the cast should be successful.

Additionally, the JSValue versions of jsCast and jsDynamicCast now
call the JSCell version after checking the value is a cell.

Finally, the casting functions have been moved to a new header,
JSCast.h

* _javascript_Core.xcodeproj/project.pbxproj:
* bytecode/CallVariant.h:
* bytecode/CodeBlock.h:
* bytecode/ExecutableToCodeBlockEdge.h:
* bytecode/TrackedReferences.h:
* bytecode/UnlinkedCodeBlock.h:
* bytecode/UnlinkedFunctionExecutable.h:
* dfg/DFGAbstractValue.h:
* dfg/DFGCommonData.h:
* dfg/DFGFrozenValue.h:
* dfg/DFGStructureAbstractValue.h:
* heap/CellContainerInlines.h:
* heap/ConservativeRoots.cpp:
* heap/GCLogging.cpp:
* heap/HeapInlines.h:
* heap/HeapSnapshotBuilder.cpp:
* heap/MarkedBlock.cpp:
* heap/MarkedBlockInlines.h:
* heap/SubspaceInlines.h:
* heap/WeakInlines.h:
* jit/JITOpcodes.cpp:
* jit/JITOpcodes32_64.cpp:
* llint/LLIntOffsetsExtractor.cpp:
* runtime/ArrayBufferNeuteringWatchpoint.h:
* runtime/BigIntPrototype.cpp:
* runtime/ClassInfo.h:
* runtime/CustomGetterSetter.h:
* runtime/FunctionRareData.h:
* runtime/GetterSetter.h:
* runtime/InferredType.h:
* runtime/InferredTypeTable.h:
* runtime/InferredValue.h:
* runtime/InternalFunction.cpp:
(JSC::InternalFunction::finishCreation):
* runtime/JSAPIValueWrapper.h:
* runtime/JSArray.h:
(JSC::JSArray::finishCreation):
* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::finishCreation):
* runtime/JSCast.h: Added.
(JSC::jsCast):
(JSC::JSCastingHelpers::jsDynamicCastGenericImpl):
(JSC::JSCastingHelpers::jsDynamicCastJSTypeImpl):
(JSC::JSCastingHelpers::JSDynamicCastTraits::cast):
(JSC::jsDynamicCast):
* runtime/JSCell.cpp:
* runtime/JSCell.h:
(JSC::jsCast): Deleted.
(JSC::jsDynamicCast): Deleted.
* runtime/JSCellInlines.h:
* runtime/JSFunction.cpp:
(JSC::JSFunction::finishCreation):
* runtime/JSJob.h:
* runtime/JSObject.h:
(JSC::JSObject::finishCreation):
* runtime/JSPromiseDeferred.h:
* runtime/JSPropertyNameEnumerator.h:
* runtime/NativeStdFunctionCell.h:
* runtime/ScopedArgumentsTable.h:
* runtime/SparseArrayValueMap.h:
* runtime/Structure.h:
* runtime/StructureChain.h:
* runtime/StructureRareData.h:
* tools/CellProfile.h:
* wasm/js/JSWebAssemblyCodeBlock.h:

Modified Paths

Added Paths

Diff

Modified: trunk/Source/_javascript_Core/CMakeLists.txt (228499 => 228500)


--- trunk/Source/_javascript_Core/CMakeLists.txt	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/CMakeLists.txt	2018-02-15 02:08:41 UTC (rev 228500)
@@ -747,6 +747,7 @@
     runtime/JSCJSValueInlines.h
     runtime/JSCPoison.h
     runtime/JSCallee.h
+    runtime/JSCast.h
     runtime/JSCell.h
     runtime/JSCellInlines.h
     runtime/JSDataView.h

Modified: trunk/Source/_javascript_Core/ChangeLog (228499 => 228500)


--- trunk/Source/_javascript_Core/ChangeLog	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/ChangeLog	2018-02-15 02:08:41 UTC (rev 228500)
@@ -1,3 +1,88 @@
+2018-02-14  Keith Miller  <keith_mil...@apple.com>
+
+        We should be able to jsDynamicCast from JSType when possible
+        https://bugs.webkit.org/show_bug.cgi?id=182804
+
+        Reviewed by Filip Pizlo and Mark Lam.
+
+        This patch beefs up jsDynamicCast in some of the cases where we
+        can use the JSType to quickly determine if a cell is a subclass of
+        the desired type. Since all JSCells have a range of JSTypes they support,
+        if there is a range exclusive to a class and all subclasses we can use
+        that range to quickly determine if the cast should be successful.
+
+        Additionally, the JSValue versions of jsCast and jsDynamicCast now
+        call the JSCell version after checking the value is a cell.
+
+        Finally, the casting functions have been moved to a new header,
+        JSCast.h
+
+        * _javascript_Core.xcodeproj/project.pbxproj:
+        * bytecode/CallVariant.h:
+        * bytecode/CodeBlock.h:
+        * bytecode/ExecutableToCodeBlockEdge.h:
+        * bytecode/TrackedReferences.h:
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * dfg/DFGAbstractValue.h:
+        * dfg/DFGCommonData.h:
+        * dfg/DFGFrozenValue.h:
+        * dfg/DFGStructureAbstractValue.h:
+        * heap/CellContainerInlines.h:
+        * heap/ConservativeRoots.cpp:
+        * heap/GCLogging.cpp:
+        * heap/HeapInlines.h:
+        * heap/HeapSnapshotBuilder.cpp:
+        * heap/MarkedBlock.cpp:
+        * heap/MarkedBlockInlines.h:
+        * heap/SubspaceInlines.h:
+        * heap/WeakInlines.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * llint/LLIntOffsetsExtractor.cpp:
+        * runtime/ArrayBufferNeuteringWatchpoint.h:
+        * runtime/BigIntPrototype.cpp:
+        * runtime/ClassInfo.h:
+        * runtime/CustomGetterSetter.h:
+        * runtime/FunctionRareData.h:
+        * runtime/GetterSetter.h:
+        * runtime/InferredType.h:
+        * runtime/InferredTypeTable.h:
+        * runtime/InferredValue.h:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::finishCreation):
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSArray.h:
+        (JSC::JSArray::finishCreation):
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::finishCreation):
+        * runtime/JSCast.h: Added.
+        (JSC::jsCast):
+        (JSC::JSCastingHelpers::jsDynamicCastGenericImpl):
+        (JSC::JSCastingHelpers::jsDynamicCastJSTypeImpl):
+        (JSC::JSCastingHelpers::JSDynamicCastTraits::cast):
+        (JSC::jsDynamicCast):
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::jsCast): Deleted.
+        (JSC::jsDynamicCast): Deleted.
+        * runtime/JSCellInlines.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+        * runtime/JSJob.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::finishCreation):
+        * runtime/JSPromiseDeferred.h:
+        * runtime/JSPropertyNameEnumerator.h:
+        * runtime/NativeStdFunctionCell.h:
+        * runtime/ScopedArgumentsTable.h:
+        * runtime/SparseArrayValueMap.h:
+        * runtime/Structure.h:
+        * runtime/StructureChain.h:
+        * runtime/StructureRareData.h:
+        * tools/CellProfile.h:
+        * wasm/js/JSWebAssemblyCodeBlock.h:
+
 2018-02-14  Michael Saboff  <msab...@apple.com>
 
         Crash: triggerOMGTierUpThunkGenerator() doesn't align the stack pointer before calling C++ code

Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (228499 => 228500)


--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2018-02-15 02:08:41 UTC (rev 228500)
@@ -1020,6 +1020,7 @@
 		53917E7B1B7906FA000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = 53917E7A1B7906E4000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h */; };
 		539FB8BA1C99DA7C00940FA1 /* JSArrayInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 539FB8B91C99DA7C00940FA1 /* JSArrayInlines.h */; };
 		53B4BD121F68B32500D2BEA3 /* WasmOps.h in Headers */ = {isa = PBXBuildFile; fileRef = 533B15DE1DC7F463004D500A /* WasmOps.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		53B601EC2034B8C5006BE667 /* JSCast.h in Headers */ = {isa = PBXBuildFile; fileRef = 53B601EB2034B8C5006BE667 /* JSCast.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		53C6FEEF1E8ADFA900B18425 /* WasmOpcodeOrigin.h in Headers */ = {isa = PBXBuildFile; fileRef = 53C6FEEE1E8ADFA900B18425 /* WasmOpcodeOrigin.h */; };
 		53CA730A1EA533D80076049D /* WasmBBQPlan.h in Headers */ = {isa = PBXBuildFile; fileRef = 53CA73081EA533D80076049D /* WasmBBQPlan.h */; };
 		53D444DC1DAF08AB00B92784 /* B3WasmAddressValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 53D444DB1DAF08AB00B92784 /* B3WasmAddressValue.h */; };
@@ -3427,6 +3428,7 @@
 		53B0BE331E561AC900A8FC29 /* GetterSetterAccessCase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetterSetterAccessCase.cpp; sourceTree = "<group>"; };
 		53B0BE351E561B0900A8FC29 /* ProxyableAccessCase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyableAccessCase.cpp; sourceTree = "<group>"; };
 		53B0BE371E561B2400A8FC29 /* IntrinsicGetterAccessCase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntrinsicGetterAccessCase.cpp; sourceTree = "<group>"; };
+		53B601EB2034B8C5006BE667 /* JSCast.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSCast.h; sourceTree = "<group>"; };
 		53C6FEEE1E8ADFA900B18425 /* WasmOpcodeOrigin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmOpcodeOrigin.h; sourceTree = "<group>"; };
 		53C6FEF01E8AFE0C00B18425 /* WasmOpcodeOrigin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmOpcodeOrigin.cpp; sourceTree = "<group>"; };
 		53CA73071EA533D80076049D /* WasmBBQPlan.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmBBQPlan.cpp; sourceTree = "<group>"; };
@@ -6608,6 +6610,7 @@
 				86FA9E90142BBB2E001773B7 /* JSBoundFunction.h */,
 				657CF45619BF6662004ACBF2 /* JSCallee.cpp */,
 				657CF45719BF6662004ACBF2 /* JSCallee.h */,
+				53B601EB2034B8C5006BE667 /* JSCast.h */,
 				BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */,
 				BC1167D80E19BCC9008066DD /* JSCell.h */,
 				0F97496F1687ADE200A4FF6A /* JSCellInlines.h */,
@@ -8898,6 +8901,7 @@
 				BC18C41B0E16F5CD00B34460 /* JSCallbackObject.h in Headers */,
 				BC18C41C0E16F5CD00B34460 /* JSCallbackObjectFunctions.h in Headers */,
 				657CF45919BF6662004ACBF2 /* JSCallee.h in Headers */,
+				53B601EC2034B8C5006BE667 /* JSCast.h in Headers */,
 				535C24691F7A1624006EC40E /* JSCBuiltins.cpp in Headers */,
 				A7D801A91880D6A80026C39B /* JSCBuiltins.h in Headers */,
 				BC1167DA0E19BCC9008066DD /* JSCell.h in Headers */,

Modified: trunk/Source/_javascript_Core/bytecode/CallVariant.h (228499 => 228500)


--- trunk/Source/_javascript_Core/bytecode/CallVariant.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/bytecode/CallVariant.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -26,7 +26,7 @@
 #pragma once
 
 #include "FunctionExecutable.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSFunction.h"
 #include "NativeExecutable.h"
 

Modified: trunk/Source/_javascript_Core/bytecode/CodeBlock.h (228499 => 228500)


--- trunk/Source/_javascript_Core/bytecode/CodeBlock.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/bytecode/CodeBlock.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -50,7 +50,7 @@
 #include "JITCode.h"
 #include "JITMathICForwards.h"
 #include "JSCPoison.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSGlobalObject.h"
 #include "JumpTable.h"
 #include "LLIntCallLinkInfo.h"

Modified: trunk/Source/_javascript_Core/bytecode/ExecutableToCodeBlockEdge.h (228499 => 228500)


--- trunk/Source/_javascript_Core/bytecode/ExecutableToCodeBlockEdge.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/bytecode/ExecutableToCodeBlockEdge.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -27,7 +27,7 @@
 
 #include "ConcurrentJSLock.h"
 #include "IsoSubspace.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "VM.h"
 
 namespace JSC {

Modified: trunk/Source/_javascript_Core/bytecode/TrackedReferences.h (228499 => 228500)


--- trunk/Source/_javascript_Core/bytecode/TrackedReferences.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/bytecode/TrackedReferences.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -26,7 +26,7 @@
 #pragma once
 
 #include "JSCJSValue.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include <wtf/HashSet.h>
 #include <wtf/PrintStream.h>
 

Modified: trunk/Source/_javascript_Core/bytecode/UnlinkedCodeBlock.h (228499 => 228500)


--- trunk/Source/_javascript_Core/bytecode/UnlinkedCodeBlock.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/bytecode/UnlinkedCodeBlock.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -31,7 +31,7 @@
 #include "ExpressionRangeInfo.h"
 #include "HandlerInfo.h"
 #include "Identifier.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "LockDuringMarking.h"
 #include "ParserModes.h"
 #include "RegExp.h"

Modified: trunk/Source/_javascript_Core/bytecode/UnlinkedFunctionExecutable.h (228499 => 228500)


--- trunk/Source/_javascript_Core/bytecode/UnlinkedFunctionExecutable.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/bytecode/UnlinkedFunctionExecutable.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -31,7 +31,7 @@
 #include "ExpressionRangeInfo.h"
 #include "Identifier.h"
 #include "Intrinsic.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "ParserModes.h"
 #include "RegExp.h"
 #include "SourceCode.h"

Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractValue.h (228499 => 228500)


--- trunk/Source/_javascript_Core/dfg/DFGAbstractValue.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractValue.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -34,7 +34,7 @@
 #include "DFGStructureAbstractValue.h"
 #include "DFGStructureClobberState.h"
 #include "InferredType.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "ResultType.h"
 #include "SpeculatedType.h"
 #include "DumpContext.h"

Modified: trunk/Source/_javascript_Core/dfg/DFGCommonData.h (228499 => 228500)


--- trunk/Source/_javascript_Core/dfg/DFGCommonData.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/dfg/DFGCommonData.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -33,7 +33,7 @@
 #include "DFGJumpReplacement.h"
 #include "DFGOSREntry.h"
 #include "InlineCallFrameSet.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "ProfilerCompilation.h"
 #include <wtf/Bag.h>
 #include <wtf/Noncopyable.h>

Modified: trunk/Source/_javascript_Core/dfg/DFGFrozenValue.h (228499 => 228500)


--- trunk/Source/_javascript_Core/dfg/DFGFrozenValue.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/dfg/DFGFrozenValue.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -28,8 +28,8 @@
 #if ENABLE(DFG_JIT)
 
 #include "DFGValueStrength.h"
-#include "JSCell.h"
 #include "JSCJSValue.h"
+#include "JSCast.h"
 #include "Structure.h"
 
 namespace JSC { namespace DFG {

Modified: trunk/Source/_javascript_Core/dfg/DFGStructureAbstractValue.h (228499 => 228500)


--- trunk/Source/_javascript_Core/dfg/DFGStructureAbstractValue.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/dfg/DFGStructureAbstractValue.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -30,7 +30,7 @@
 #include "DFGRegisteredStructureSet.h"
 #include "DFGTransition.h"
 #include "DumpContext.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "SpeculatedType.h"
 #include "StructureSet.h"
 

Modified: trunk/Source/_javascript_Core/heap/CellContainerInlines.h (228499 => 228500)


--- trunk/Source/_javascript_Core/heap/CellContainerInlines.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/heap/CellContainerInlines.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -26,7 +26,7 @@
 #pragma once
 
 #include "CellContainer.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "LargeAllocation.h"
 #include "MarkedBlock.h"
 #include "VM.h"

Modified: trunk/Source/_javascript_Core/heap/ConservativeRoots.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/heap/ConservativeRoots.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/heap/ConservativeRoots.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -31,7 +31,7 @@
 #include "HeapInlines.h"
 #include "HeapUtil.h"
 #include "JITStubRoutineSet.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSObject.h"
 #include "JSCInlines.h"
 #include "MarkedBlockInlines.h"

Modified: trunk/Source/_javascript_Core/heap/GCLogging.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/heap/GCLogging.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/heap/GCLogging.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -29,7 +29,7 @@
 #include "ClassInfo.h"
 #include "Heap.h"
 #include "HeapIterationScope.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSCellInlines.h"
 #include <wtf/PrintStream.h>
 

Modified: trunk/Source/_javascript_Core/heap/HeapInlines.h (228499 => 228500)


--- trunk/Source/_javascript_Core/heap/HeapInlines.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/heap/HeapInlines.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -30,7 +30,7 @@
 #include "HeapCellInlines.h"
 #include "IndexingHeader.h"
 #include "JSCallee.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "Structure.h"
 #include <type_traits>
 #include <wtf/Assertions.h>

Modified: trunk/Source/_javascript_Core/heap/HeapSnapshotBuilder.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/heap/HeapSnapshotBuilder.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/heap/HeapSnapshotBuilder.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -31,7 +31,7 @@
 #include "HeapProfiler.h"
 #include "HeapSnapshot.h"
 #include "JSCInlines.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "PreventCollectionScope.h"
 #include "VM.h"
 #include <wtf/text/StringBuilder.h>

Modified: trunk/Source/_javascript_Core/heap/MarkedBlock.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/heap/MarkedBlock.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/heap/MarkedBlock.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -29,7 +29,7 @@
 #include "AlignedMemoryAllocator.h"
 #include "BlockDirectoryInlines.h"
 #include "FreeListInlines.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSDestructibleObject.h"
 #include "JSCInlines.h"
 #include "MarkedBlockInlines.h"

Modified: trunk/Source/_javascript_Core/heap/MarkedBlockInlines.h (228499 => 228500)


--- trunk/Source/_javascript_Core/heap/MarkedBlockInlines.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/heap/MarkedBlockInlines.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -26,7 +26,7 @@
 #pragma once
 
 #include "BlockDirectory.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "MarkedBlock.h"
 #include "MarkedSpace.h"
 #include "Operations.h"

Modified: trunk/Source/_javascript_Core/heap/SubspaceInlines.h (228499 => 228500)


--- trunk/Source/_javascript_Core/heap/SubspaceInlines.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/heap/SubspaceInlines.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -26,7 +26,7 @@
 #pragma once
 
 #include "BlockDirectoryInlines.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "MarkedBlock.h"
 #include "MarkedSpace.h"
 #include "Subspace.h"

Modified: trunk/Source/_javascript_Core/heap/WeakInlines.h (228499 => 228500)


--- trunk/Source/_javascript_Core/heap/WeakInlines.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/heap/WeakInlines.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include "JSCell.h"
+#include "JSCast.h"
 #include "WeakSetInlines.h"
 #include <wtf/Assertions.h>
 

Modified: trunk/Source/_javascript_Core/jit/JITOpcodes.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/jit/JITOpcodes.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/jit/JITOpcodes.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -35,7 +35,7 @@
 #include "InterpreterInlines.h"
 #include "JITInlines.h"
 #include "JSArray.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSFunction.h"
 #include "JSPropertyNameEnumerator.h"
 #include "LinkBuffer.h"

Modified: trunk/Source/_javascript_Core/jit/JITOpcodes32_64.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/jit/JITOpcodes32_64.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/jit/JITOpcodes32_64.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -35,7 +35,7 @@
 #include "Exception.h"
 #include "JITInlines.h"
 #include "JSArray.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSFunction.h"
 #include "JSPropertyNameEnumerator.h"
 #include "LinkBuffer.h"

Modified: trunk/Source/_javascript_Core/llint/LLIntOffsetsExtractor.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/llint/LLIntOffsetsExtractor.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/llint/LLIntOffsetsExtractor.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -38,7 +38,7 @@
 #include "Interpreter.h"
 #include "JSArray.h"
 #include "JSArrayBufferView.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSLexicalEnvironment.h"

Modified: trunk/Source/_javascript_Core/runtime/ArrayBufferNeuteringWatchpoint.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/ArrayBufferNeuteringWatchpoint.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/ArrayBufferNeuteringWatchpoint.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include "JSCell.h"
+#include "JSCast.h"
 #include "Watchpoint.h"
 
 namespace JSC {

Modified: trunk/Source/_javascript_Core/runtime/BigIntPrototype.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/BigIntPrototype.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/BigIntPrototype.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -31,7 +31,7 @@
 #include "JSBigInt.h"
 #include "JSCBuiltins.h"
 #include "JSCInlines.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"

Modified: trunk/Source/_javascript_Core/runtime/ClassInfo.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/ClassInfo.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/ClassInfo.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -24,7 +24,7 @@
 
 #include "CallFrame.h"
 #include "ConstructData.h"
-#include "JSCell.h"
+#include "JSCast.h"
 
 namespace WTF {
 class PrintStream;

Modified: trunk/Source/_javascript_Core/runtime/CustomGetterSetter.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/CustomGetterSetter.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/CustomGetterSetter.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -26,7 +26,7 @@
 #pragma once
 
 #include "JSCPoison.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "PropertySlot.h"
 #include "PutPropertySlot.h"
 #include "Structure.h"

Modified: trunk/Source/_javascript_Core/runtime/FunctionRareData.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/FunctionRareData.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/FunctionRareData.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -26,7 +26,7 @@
 #pragma once
 
 #include "InternalFunctionAllocationProfile.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "ObjectAllocationProfile.h"
 #include "Watchpoint.h"
 

Modified: trunk/Source/_javascript_Core/runtime/GetterSetter.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/GetterSetter.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/GetterSetter.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -22,7 +22,7 @@
 
 #pragma once
 
-#include "JSCell.h"
+#include "JSCast.h"
 
 #include "CallFrame.h"
 #include "JSGlobalObject.h"

Modified: trunk/Source/_javascript_Core/runtime/InferredType.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/InferredType.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/InferredType.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -28,7 +28,7 @@
 #include "ConcurrentJSLock.h"
 #include "InferredStructure.h"
 #include "IsoCellSet.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "PropertyName.h"
 #include "PutByIdFlags.h"
 #include "Watchpoint.h"

Modified: trunk/Source/_javascript_Core/runtime/InferredTypeTable.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/InferredTypeTable.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/InferredTypeTable.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -27,7 +27,7 @@
 
 #include "Identifier.h"
 #include "InferredType.h"
-#include "JSCell.h"
+#include "JSCast.h"
 
 namespace JSC {
 

Modified: trunk/Source/_javascript_Core/runtime/InferredValue.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/InferredValue.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/InferredValue.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -26,7 +26,7 @@
 #pragma once
 
 #include "IsoSubspace.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "VM.h"
 #include "Watchpoint.h"
 #include "WriteBarrier.h"

Modified: trunk/Source/_javascript_Core/runtime/InternalFunction.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/InternalFunction.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/InternalFunction.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -48,7 +48,7 @@
 void InternalFunction::finishCreation(VM& vm, const String& name, NameVisibility nameVisibility)
 {
     Base::finishCreation(vm);
-    ASSERT(inherits(vm, info()));
+    ASSERT(jsDynamicCast<InternalFunction*>(vm, this));
     ASSERT(methodTable(vm)->getCallData == InternalFunction::info()->methodTable.getCallData);
     ASSERT(methodTable(vm)->getConstructData == InternalFunction::info()->methodTable.getConstructData);
     ASSERT(type() == InternalFunctionType);

Modified: trunk/Source/_javascript_Core/runtime/JSAPIValueWrapper.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSAPIValueWrapper.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSAPIValueWrapper.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -22,9 +22,9 @@
 
 #pragma once
 
+#include "CallFrame.h"
 #include "JSCJSValue.h"
-#include "JSCell.h"
-#include "CallFrame.h"
+#include "JSCast.h"
 #include "Structure.h"
 
 namespace JSC {

Modified: trunk/Source/_javascript_Core/runtime/JSArray.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSArray.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSArray.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -173,6 +173,7 @@
     void finishCreation(VM& vm)
     {
         Base::finishCreation(vm);
+        ASSERT(jsDynamicCast<JSArray*>(vm, this));
         ASSERT_WITH_MESSAGE(type() == ArrayType || type() == DerivedArrayType, "Instance inheriting JSArray should have either ArrayType or DerivedArrayType");
     }
 

Modified: trunk/Source/_javascript_Core/runtime/JSArrayBufferView.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSArrayBufferView.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSArrayBufferView.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -138,6 +138,7 @@
 void JSArrayBufferView::finishCreation(VM& vm)
 {
     Base::finishCreation(vm);
+    ASSERT(jsDynamicCast<JSArrayBufferView*>(vm, this));
     switch (m_mode) {
     case FastTypedArray:
         return;

Added: trunk/Source/_javascript_Core/runtime/JSCast.h (0 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSCast.h	                        (rev 0)
+++ trunk/Source/_javascript_Core/runtime/JSCast.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2018 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCell.h"
+
+namespace JSC {
+
+template<typename To, typename From>
+inline To jsCast(From* from)
+{
+    static_assert(std::is_base_of<JSCell, typename std::remove_pointer<To>::type>::value && std::is_base_of<JSCell, typename std::remove_pointer<From>::type>::value, "JS casting expects that the types you are casting to/from are subclasses of JSCell");
+    ASSERT_WITH_SECURITY_IMPLICATION(!from || from->JSCell::inherits(*from->JSCell::vm(), std::remove_pointer<To>::type::info()));
+    return static_cast<To>(from);
+}
+
+template<typename To>
+inline To jsCast(JSValue from)
+{
+    static_assert(std::is_base_of<JSCell, typename std::remove_pointer<To>::type>::value, "JS casting expects that the types you are casting to is a subclass of JSCell");
+    ASSERT_WITH_SECURITY_IMPLICATION(from.isCell() && from.asCell()->JSCell::inherits(*from.asCell()->vm(), std::remove_pointer<To>::type::info()));
+    return static_cast<To>(from.asCell());
+}
+
+// Specific type overloads.
+#define FOR_EACH_JS_DYNAMIC_CAST_JS_TYPE_OVERLOAD(macro) \
+    macro(JSObject, JSType::ObjectType, JSType::LastJSCObjectType) \
+    macro(JSFunction, JSType::JSFunctionType, JSType::JSFunctionType) \
+    macro(InternalFunction, JSType::InternalFunctionType, JSType::InternalFunctionType) \
+    macro(JSArray, JSType::ArrayType, JSType::DerivedArrayType) \
+    macro(JSArrayBufferView, FirstTypedArrayType, LastTypedArrayType) \
+
+
+// Forward declare the classes because they may not already exist.
+#define FORWARD_DECLARE_OVERLOAD_CLASS(className, jsType, op) class className;
+FOR_EACH_JS_DYNAMIC_CAST_JS_TYPE_OVERLOAD(FORWARD_DECLARE_OVERLOAD_CLASS)
+#undef FORWARD_DECLARE_OVERLOAD_CLASS
+
+namespace JSCastingHelpers {
+
+template<typename To, typename From>
+inline To jsDynamicCastGenericImpl(VM& vm, From* from)
+{
+    static_assert(!std::is_same<JSObject*, To*>::value, "This ensures our overloads work");
+    static_assert(std::is_base_of<JSCell, typename std::remove_pointer<To>::type>::value && std::is_base_of<JSCell, typename std::remove_pointer<From>::type>::value, "JS casting expects that the types you are casting to/from are subclasses of JSCell");
+    if (LIKELY(from->JSCell::inherits(vm, std::remove_pointer<To>::type::info())))
+        return static_cast<To>(from);
+    return nullptr;
+}
+
+template<typename To, typename From>
+inline To jsDynamicCastJSTypeImpl(VM& vm, From* from, JSType firstType, JSType lastType)
+{
+    bool canCast = firstType <= from->type() && from->type() <= lastType;
+    ASSERT_UNUSED(vm, canCast == jsDynamicCastGenericImpl<To>(vm, from));
+    if (LIKELY(canCast))
+        return static_cast<To>(from);
+    return nullptr;
+}
+
+// C++ has bad syntax so we need to use this struct because C++ doesn't have a
+// way to say that we are overloading just the first type in a template list...
+template<typename to>
+struct JSDynamicCastTraits {
+    template<typename To, typename From>
+    static inline To cast(VM& vm, From* from) { return jsDynamicCastGenericImpl<To>(vm, from); }
+};
+
+#define DEFINE_TRAITS_FOR_JS_TYPE_OVERLOAD(className, firstJSType, lastJSType) \
+    template<> \
+    struct JSDynamicCastTraits<className*> { \
+        template<typename To, typename From> \
+        static inline To cast(VM& vm, From* from) { return jsDynamicCastJSTypeImpl<To>(vm, from, firstJSType, lastJSType); } \
+    }; \
+
+FOR_EACH_JS_DYNAMIC_CAST_JS_TYPE_OVERLOAD(DEFINE_TRAITS_FOR_JS_TYPE_OVERLOAD)
+
+#undef DEFINE_TRAITS_FOR_JS_TYPE_OVERLOAD
+
+} // namespace JSCastingHelpers
+
+template<typename To, typename From>
+To jsDynamicCast(VM& vm, From* from)
+{
+    typedef JSCastingHelpers::JSDynamicCastTraits<typename std::remove_cv<typename std::remove_pointer<To>::type>::type> Dispatcher;
+    return Dispatcher::template cast<To>(vm, from);
+}
+
+template<typename To>
+To jsDynamicCast(VM& vm, JSValue from)
+{
+    if (UNLIKELY(!from.isCell()))
+        return nullptr;
+    return jsDynamicCast<To>(vm, from.asCell());
+}
+
+}

Modified: trunk/Source/_javascript_Core/runtime/JSCell.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSCell.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSCell.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -25,6 +25,7 @@
 
 #include "ArrayBufferView.h"
 #include "JSCInlines.h"
+#include "JSCast.h"
 #include "JSFunction.h"
 #include "JSString.h"
 #include "JSObject.h"

Modified: trunk/Source/_javascript_Core/runtime/JSCell.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSCell.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSCell.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -296,36 +296,6 @@
     JS_EXPORT_PRIVATE void unlockSlow();
 };
 
-template<typename To, typename From>
-inline To jsCast(From* from)
-{
-    ASSERT_WITH_SECURITY_IMPLICATION(!from || from->JSCell::inherits(*from->JSCell::vm(), std::remove_pointer<To>::type::info()));
-    return static_cast<To>(from);
-}
-    
-template<typename To>
-inline To jsCast(JSValue from)
-{
-    ASSERT_WITH_SECURITY_IMPLICATION(from.isCell() && from.asCell()->JSCell::inherits(*from.asCell()->vm(), std::remove_pointer<To>::type::info()));
-    return static_cast<To>(from.asCell());
-}
-
-template<typename To, typename From>
-inline To jsDynamicCast(VM& vm, From* from)
-{
-    if (LIKELY(from->JSCell::inherits(vm, std::remove_pointer<To>::type::info())))
-        return static_cast<To>(from);
-    return nullptr;
-}
-
-template<typename To>
-inline To jsDynamicCast(VM& vm, JSValue from)
-{
-    if (LIKELY(from.isCell() && from.asCell()->inherits(vm, std::remove_pointer<To>::type::info())))
-        return static_cast<To>(from.asCell());
-    return nullptr;
-}
-
 // FIXME: Refer to Subspace by reference.
 // https://bugs.webkit.org/show_bug.cgi?id=166988
 template<typename Type>

Modified: trunk/Source/_javascript_Core/runtime/JSCellInlines.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSCellInlines.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSCellInlines.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -29,7 +29,7 @@
 #include "CallFrame.h"
 #include "DeferGC.h"
 #include "Handle.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSDestructibleObject.h"
 #include "JSObject.h"
 #include "JSString.h"

Modified: trunk/Source/_javascript_Core/runtime/JSFunction.cpp (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSFunction.cpp	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSFunction.cpp	2018-02-15 02:08:41 UTC (rev 228500)
@@ -106,7 +106,7 @@
 void JSFunction::finishCreation(VM& vm)
 {
     Base::finishCreation(vm);
-    ASSERT(inherits(vm, info()));
+    ASSERT(jsDynamicCast<JSFunction*>(vm, this));
     if (isBuiltinFunction() && jsExecutable()->name().isPrivateName()) {
         // This is anonymous builtin function.
         rareData(vm)->setHasReifiedName();

Modified: trunk/Source/_javascript_Core/runtime/JSJob.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSJob.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSJob.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include "JSCell.h"
+#include "JSCast.h"
 #include "Structure.h"
 
 namespace JSC {

Modified: trunk/Source/_javascript_Core/runtime/JSObject.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSObject.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSObject.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -33,7 +33,7 @@
 #include "DOMAttributeGetterSetter.h"
 #include "Heap.h"
 #include "IndexingHeaderInlines.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "ObjectInitializationScope.h"
 #include "PropertySlot.h"
 #include "PropertyStorage.h"
@@ -877,7 +877,7 @@
     void finishCreation(VM& vm)
     {
         Base::finishCreation(vm);
-        ASSERT(inherits(vm, info()));
+        ASSERT(jsDynamicCast<JSObject*>(vm, this));
         ASSERT(structure()->hasPolyProto() || getPrototypeDirect(vm).isNull() || Heap::heap(this) == Heap::heap(getPrototypeDirect(vm)));
         ASSERT(structure()->isObject());
         ASSERT(classInfo(vm));

Modified: trunk/Source/_javascript_Core/runtime/JSPromiseDeferred.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSPromiseDeferred.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSPromiseDeferred.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include "JSCell.h"
+#include "JSCast.h"
 #include "Structure.h"
 
 namespace JSC {

Modified: trunk/Source/_javascript_Core/runtime/JSPropertyNameEnumerator.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSPropertyNameEnumerator.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSPropertyNameEnumerator.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include "JSCell.h"
+#include "JSCast.h"
 #include "Operations.h"
 #include "PropertyNameArray.h"
 #include "Structure.h"

Modified: trunk/Source/_javascript_Core/runtime/JSType.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/JSType.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/JSType.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -66,9 +66,12 @@
     ScopedArgumentsType,
     ClonedArgumentsType,
 
+    // Start JSArray types.
     ArrayType,
     DerivedArrayType,
+    // End JSArray types.
 
+    // Start JSArrayBufferView types.
     Int8ArrayType,
     Uint8ArrayType,
     Uint8ClampedArrayType,
@@ -79,6 +82,7 @@
     Float32ArrayType,
     Float64ArrayType,
     DataViewType,
+    // End JSArrayBufferView types.
 
     GetterSetterType,
 

Modified: trunk/Source/_javascript_Core/runtime/NativeStdFunctionCell.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/NativeStdFunctionCell.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/NativeStdFunctionCell.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSNativeStdFunction.h"
 
 namespace JSC {

Modified: trunk/Source/_javascript_Core/runtime/ScopedArgumentsTable.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/ScopedArgumentsTable.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/ScopedArgumentsTable.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include "JSCell.h"
+#include "JSCast.h"
 #include "ScopeOffset.h"
 #include <wtf/Assertions.h>
 #include <wtf/CagedUniquePtr.h>

Modified: trunk/Source/_javascript_Core/runtime/SparseArrayValueMap.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/SparseArrayValueMap.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/SparseArrayValueMap.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSTypeInfo.h"
 #include "PropertyDescriptor.h"
 #include "PutDirectIndexMode.h"

Modified: trunk/Source/_javascript_Core/runtime/Structure.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/Structure.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/Structure.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -30,7 +30,7 @@
 #include "IndexingType.h"
 #include "InferredTypeTable.h"
 #include "JSCJSValue.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSType.h"
 #include "PropertyName.h"
 #include "PropertyNameArray.h"

Modified: trunk/Source/_javascript_Core/runtime/StructureChain.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/StructureChain.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/StructureChain.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSObject.h"
 #include "Structure.h"
 #include <wtf/StdLibExtras.h>

Modified: trunk/Source/_javascript_Core/runtime/StructureRareData.h (228499 => 228500)


--- trunk/Source/_javascript_Core/runtime/StructureRareData.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/runtime/StructureRareData.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -26,7 +26,7 @@
 #pragma once
 
 #include "ClassInfo.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "JSTypeInfo.h"
 #include "PropertyOffset.h"
 #include "PropertySlot.h"

Modified: trunk/Source/_javascript_Core/tools/CellProfile.h (228499 => 228500)


--- trunk/Source/_javascript_Core/tools/CellProfile.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/tools/CellProfile.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include "JSCell.h"
+#include "JSCast.h"
 #include "Structure.h"
 #include <wtf/MonotonicTime.h>
 #include <wtf/StackTrace.h>

Modified: trunk/Source/_javascript_Core/wasm/js/JSWebAssemblyCodeBlock.h (228499 => 228500)


--- trunk/Source/_javascript_Core/wasm/js/JSWebAssemblyCodeBlock.h	2018-02-15 01:58:44 UTC (rev 228499)
+++ trunk/Source/_javascript_Core/wasm/js/JSWebAssemblyCodeBlock.h	2018-02-15 02:08:41 UTC (rev 228500)
@@ -29,7 +29,7 @@
 
 #include "CallLinkInfo.h"
 #include "JSCPoison.h"
-#include "JSCell.h"
+#include "JSCast.h"
 #include "PromiseDeferredTimer.h"
 #include "Structure.h"
 #include "UnconditionalFinalizer.h"
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to