Unreviewed, rolling out r194135.
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 16 Dec 2015 12:47:55 +0000 (12:47 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 16 Dec 2015 12:47:55 +0000 (12:47 +0000)
https://bugs.webkit.org/show_bug.cgi?id=152333

due to missing OSR exit materialization support in FTL
(Requested by yusukesuzuki on #webkit).

Reverted changeset:

"[ES6] Handle new_generator_func / new_generator_func_exp in
DFG / FTL"
https://bugs.webkit.org/show_bug.cgi?id=152227
http://trac.webkit.org/changeset/194135

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194141 268f45cc-cd09-0410-ab3c-d52691b4dbfc

30 files changed:
LayoutTests/ChangeLog
LayoutTests/js/regress/script-tests/generator-function-create.js
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Source/JavaScriptCore/dfg/DFGCapabilities.cpp
Source/JavaScriptCore/dfg/DFGClobberize.h
Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp
Source/JavaScriptCore/dfg/DFGDoesGC.cpp
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGMayExit.cpp
Source/JavaScriptCore/dfg/DFGNode.h
Source/JavaScriptCore/dfg/DFGNodeType.h
Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
Source/JavaScriptCore/dfg/DFGSafeToExecute.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp
Source/JavaScriptCore/dfg/DFGStructureRegistrationPhase.cpp
Source/JavaScriptCore/ftl/FTLCapabilities.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
Source/JavaScriptCore/tests/stress/generator-function-create-optimized.js [deleted file]
Source/JavaScriptCore/tests/stress/generator-function-declaration-sinking-no-double-allocate.js [deleted file]
Source/JavaScriptCore/tests/stress/generator-function-declaration-sinking-osrexit.js [deleted file]
Source/JavaScriptCore/tests/stress/generator-function-declaration-sinking-put.js [deleted file]
Source/JavaScriptCore/tests/stress/generator-function-expression-sinking-no-double-allocate.js [deleted file]
Source/JavaScriptCore/tests/stress/generator-function-expression-sinking-osrexit.js [deleted file]
Source/JavaScriptCore/tests/stress/generator-function-expression-sinking-put.js [deleted file]

index 101e616..b0da42e 100644 (file)
@@ -1,3 +1,18 @@
+2015-12-16  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r194135.
+        https://bugs.webkit.org/show_bug.cgi?id=152333
+
+        due to missing OSR exit materialization support in FTL
+        (Requested by yusukesuzuki on #webkit).
+
+        Reverted changeset:
+
+        "[ES6] Handle new_generator_func / new_generator_func_exp in
+        DFG / FTL"
+        https://bugs.webkit.org/show_bug.cgi?id=152227
+        http://trac.webkit.org/changeset/194135
+
 2015-12-16  Youenn Fablet  <youenn.fablet@crf.canon.fr>
 
         Align WebKit testharness.js with WPT testharness.js
index ae4eb9e..d10c137 100644 (file)
@@ -7,12 +7,6 @@ function createGeneratorFunction()
     }
     return gen;
 }
-function test()
-{
-    for (var i = 0; i < 500; ++i)
-        createGeneratorFunction();
-}
-noInline(test);
-
+noInline(createGeneratorFunction);
 for (var i = 0; i < 1e4; ++i)
-    test();
+    createGeneratorFunction();
index aa98def..ace5017 100644 (file)
@@ -1,3 +1,18 @@
+2015-12-16  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r194135.
+        https://bugs.webkit.org/show_bug.cgi?id=152333
+
+        due to missing OSR exit materialization support in FTL
+        (Requested by yusukesuzuki on #webkit).
+
+        Reverted changeset:
+
+        "[ES6] Handle new_generator_func / new_generator_func_exp in
+        DFG / FTL"
+        https://bugs.webkit.org/show_bug.cgi?id=152227
+        http://trac.webkit.org/changeset/194135
+
 2015-12-16  Youenn Fablet  <youenn.fablet@crf.canon.fr>
 
         [Fetch API] Add fetch API compile time flag
index fbaeca0..31b548b 100644 (file)
@@ -1760,12 +1760,7 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
         forNode(node).set(
             m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->arrowFunctionStructure());
         break;
-
-    case NewGeneratorFunction:
-        forNode(node).set(
-            m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->generatorFunctionStructure());
-        break;
-
+            
     case NewFunction:
         forNode(node).set(
             m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->functionStructure());
index 6ad2143..66193be 100644 (file)
@@ -4557,27 +4557,23 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             NEXT_OPCODE(op_put_to_arguments);
         }
             
-        case op_new_func:
-        case op_new_generator_func: {
+        case op_new_func: {
             FunctionExecutable* decl = m_inlineStackTop->m_profiledBlock->functionDecl(currentInstruction[3].u.operand);
             FrozenValue* frozen = m_graph.freezeStrong(decl);
-            NodeType op = (opcodeID == op_new_generator_func) ? NewGeneratorFunction : NewFunction;
-            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(op, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
-            static_assert(OPCODE_LENGTH(op_new_func) == OPCODE_LENGTH(op_new_generator_func), "The length of op_new_func should eqaual to one of op_new_generator_func");
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(NewFunction, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
             NEXT_OPCODE(op_new_func);
         }
 
         case op_new_func_exp:
-        case op_new_generator_func_exp:
         case op_new_arrow_func_exp: {
             FunctionExecutable* expr = m_inlineStackTop->m_profiledBlock->functionExpr(currentInstruction[3].u.operand);
             FrozenValue* frozen = m_graph.freezeStrong(expr);
-            NodeType op = (opcodeID == op_new_generator_func_exp) ? NewGeneratorFunction : NewFunction;
-            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(op, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(NewFunction, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
             
-            if (opcodeID == op_new_func_exp || opcodeID == op_new_generator_func_exp) {
+            if (opcodeID == op_new_func_exp) {
                 // Curly braces are necessary
-                static_assert(OPCODE_LENGTH(op_new_func_exp) == OPCODE_LENGTH(op_new_generator_func_exp), "The length of op_new_func_exp should eqaual to one of op_new_generator_func_exp");
                 NEXT_OPCODE(op_new_func_exp);
             } else {
                 // Curly braces are necessary
index d1c9bce..bb5b1d1 100644 (file)
@@ -215,8 +215,6 @@ CapabilityLevel capabilityLevel(OpcodeID opcodeID, CodeBlock* codeBlock, Instruc
     case op_to_index_string:
     case op_new_func:
     case op_new_func_exp:
-    case op_new_generator_func:
-    case op_new_generator_func_exp:
     case op_new_arrow_func_exp:
     case op_create_lexical_environment:
     case op_get_parent_scope:
index b5d5d2a..ba7bf72 100644 (file)
@@ -1033,7 +1033,6 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
     
     case NewArrowFunction:
     case NewFunction:
-    case NewGeneratorFunction:
         if (node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid())
             write(Watchpoint_fire);
         read(HeapObjectCount);
index b69fc5f..54dde1f 100644 (file)
@@ -77,7 +77,6 @@ bool clobbersExitState(Graph& graph, Node* node)
 
     case NewArrowFunction:
     case NewFunction:
-    case NewGeneratorFunction:
         // Like above, but with the JSFunction allocation caveat.
         return node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid();
 
index 5eff2b0..db4fc21 100644 (file)
@@ -247,7 +247,6 @@ bool doesGC(Graph& graph, Node* node)
     case MakeRope:
     case NewArrowFunction:
     case NewFunction:
-    case NewGeneratorFunction:
     case NewTypedArray:
     case ThrowReferenceError:
     case GetPropertyEnumerator:
index 5c1d412..82fa48d 100644 (file)
@@ -1387,8 +1387,7 @@ private:
 
         case CreateScopedArguments:
         case CreateActivation:
-        case NewFunction:
-        case NewGeneratorFunction: {
+        case NewFunction: {
             fixEdge<CellUse>(node->child1());
             break;
         }
index daa2933..d1e21ed 100644 (file)
@@ -143,7 +143,6 @@ ExitMode mayExit(Graph& graph, Node* node)
     case MaterializeNewObject:
     case NewFunction:
     case NewArrowFunction:
-    case NewGeneratorFunction:
     case NewStringObject:
     case CreateActivation:
         result = ExitsForExceptions;
index 11eeba5..1b3083b 100644 (file)
@@ -585,7 +585,7 @@ struct Node {
 
     void convertToPhantomNewFunction()
     {
-        ASSERT(m_op == NewFunction || m_op == NewArrowFunction || m_op == NewGeneratorFunction);
+        ASSERT(m_op == NewFunction || m_op == NewArrowFunction);
         m_op = PhantomNewFunction;
         m_flags |= NodeMustGenerate;
         m_opInfo = 0;
@@ -1356,7 +1356,6 @@ struct Node {
         case CheckCell:
         case NewFunction:
         case NewArrowFunction:
-        case NewGeneratorFunction:
         case CreateActivation:
         case MaterializeCreateActivation:
             return true;
@@ -1575,7 +1574,6 @@ struct Node {
         switch (op()) {
         case NewArrowFunction:
         case NewFunction:
-        case NewGeneratorFunction:
             return true;
         default:
             return false;
index d4a9271..ac699e1 100644 (file)
@@ -312,7 +312,6 @@ namespace JSC { namespace DFG {
     macro(NewFunction, NodeResultJS) \
     \
     macro(NewArrowFunction, NodeResultJS) \
-    macro(NewGeneratorFunction, NodeResultJS) \
     \
     /* These aren't terminals but always exit */ \
     macro(Throw, NodeMustGenerate) \
index fbb0af2..12ab163 100644 (file)
@@ -139,7 +139,7 @@ public:
     // once it is escaped if it still has pointers to it in order to
     // replace any use of those pointers by the corresponding
     // materialization
-    enum class Kind { Escaped, Object, Activation, Function, ArrowFunction, GeneratorFunction };
+    enum class Kind { Escaped, Object, Activation, Function, NewArrowFunction };
 
     explicit Allocation(Node* identifier = nullptr, Kind kind = Kind::Escaped)
         : m_identifier(identifier)
@@ -233,7 +233,12 @@ public:
 
     bool isFunctionAllocation() const
     {
-        return m_kind == Kind::Function || m_kind == Kind::ArrowFunction || m_kind == Kind::GeneratorFunction;
+        return m_kind == Kind::Function || m_kind == Kind::NewArrowFunction;
+    }
+    
+    bool isArrowFunctionAllocation() const
+    {
+        return m_kind == Kind::NewArrowFunction;
     }
 
     bool operator==(const Allocation& other) const
@@ -269,12 +274,8 @@ public:
             out.print("Function");
             break;
                 
-        case Kind::ArrowFunction:
-            out.print("ArrowFunction");
-            break;
-
-        case Kind::GeneratorFunction:
-            out.print("GeneratorFunction");
+        case Kind::NewArrowFunction:
+            out.print("NewArrowFunction");
             break;
 
         case Kind::Activation:
@@ -836,19 +837,13 @@ private:
             break;
 
         case NewFunction:
-        case NewArrowFunction:
-        case NewGeneratorFunction: {
+        case NewArrowFunction: {
             if (node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid()) {
                 m_heap.escape(node->child1().node());
                 break;
             }
             
-            if (node->op() == NewGeneratorFunction)
-                target = &m_heap.newAllocation(node, Allocation::Kind::GeneratorFunction);
-            else if (node->op() == NewArrowFunction)
-                target = &m_heap.newAllocation(node, Allocation::Kind::ArrowFunction);
-            else
-                target = &m_heap.newAllocation(node, Allocation::Kind::Function);
+            target = &m_heap.newAllocation(node, Allocation::Kind::Function);
             writes.add(FunctionExecutablePLoc, LazyNode(node->cellOperand()));
             writes.add(FunctionActivationPLoc, LazyNode(node->child1().node()));
             break;
@@ -1451,14 +1446,11 @@ private:
                 OpInfo(set), OpInfo(data), 0, 0);
         }
 
-        case Allocation::Kind::ArrowFunction:
-        case Allocation::Kind::GeneratorFunction:
+        case Allocation::Kind::NewArrowFunction:
         case Allocation::Kind::Function: {
             FrozenValue* executable = allocation.identifier()->cellOperand();
             
-            NodeType nodeType =
-                allocation.kind() == Allocation::Kind::ArrowFunction ? NewArrowFunction :
-                allocation.kind() == Allocation::Kind::GeneratorFunction ? NewGeneratorFunction : NewFunction;
+            NodeType nodeType = allocation.kind() == Allocation::Kind::NewArrowFunction ? NewArrowFunction : NewFunction;
             
             return m_graph.addNode(
                 allocation.identifier()->prediction(), nodeType,
@@ -1790,7 +1782,6 @@ private:
 
                     case NewArrowFunction:
                     case NewFunction:
-                    case NewGeneratorFunction:
                         node->convertToPhantomNewFunction();
                         break;
 
@@ -2042,8 +2033,7 @@ private:
         }
         
         case NewFunction:
-        case NewArrowFunction:
-        case NewGeneratorFunction: {
+        case NewArrowFunction: {
             Vector<PromotedHeapLocation> locations = m_locationsForAllocation.get(escapee);
             ASSERT(locations.size() == 2);
                 
index 6127716..413bf89 100644 (file)
@@ -209,8 +209,7 @@ private:
         case GetSetter:
         case GetCallee:
         case NewArrowFunction:
-        case NewFunction:
-        case NewGeneratorFunction: {
+        case NewFunction: {
             changed |= setPrediction(SpecFunction);
             break;
         }
index b28cfc5..0f456c9 100644 (file)
@@ -268,7 +268,6 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
     case PutToArguments:
     case NewArrowFunction:
     case NewFunction:
-    case NewGeneratorFunction:
     case Jump:
     case Branch:
     case Switch:
index 02ff82d..f644220 100755 (executable)
@@ -50,7 +50,6 @@
 #include "JSArrowFunction.h"
 #include "JSCInlines.h"
 #include "JSEnvironmentRecord.h"
-#include "JSGeneratorFunction.h"
 #include "JSLexicalEnvironment.h"
 #include "LinkBuffer.h"
 #include "ScopedArguments.h"
@@ -5373,7 +5372,7 @@ template <typename ClassType> void SpeculativeJIT::compileNewFunctionCommon(GPRR
 void SpeculativeJIT::compileNewFunction(Node* node)
 {
     NodeType nodeType = node->op();
-    ASSERT(nodeType == NewFunction || nodeType == NewArrowFunction || nodeType == NewGeneratorFunction);
+    ASSERT(nodeType == NewFunction || nodeType == NewArrowFunction);
     
     SpeculateCellOperand scope(this, node->child1());
 #if USE(JSVALUE64)
@@ -5411,8 +5410,6 @@ void SpeculativeJIT::compileNewFunction(Node* node)
 #else
             callOperation(operationNewArrowFunction, resultGPR, scopeGPR, executable, thisValueTagGPR, thisValuePayloadGPR);
 #endif
-        else if (nodeType == NewGeneratorFunction)
-            callOperation(operationNewGeneratorFunction, resultGPR, scopeGPR, executable);
         else
             callOperation(operationNewFunction, resultGPR, scopeGPR, executable);
         m_jit.exceptionCheck();
@@ -5420,10 +5417,9 @@ void SpeculativeJIT::compileNewFunction(Node* node)
         return;
     }
 
-    Structure* structure =
-        nodeType == NewArrowFunction ? m_jit.graph().globalObjectFor(node->origin.semantic)->arrowFunctionStructure() :
-        nodeType == NewGeneratorFunction ? m_jit.graph().globalObjectFor(node->origin.semantic)->generatorFunctionStructure() :
-        m_jit.graph().globalObjectFor(node->origin.semantic)->functionStructure();
+    Structure* structure = nodeType == NewArrowFunction
+        ? m_jit.graph().globalObjectFor(node->origin.semantic)->arrowFunctionStructure()
+        : m_jit.graph().globalObjectFor(node->origin.semantic)->functionStructure();
     
     GPRTemporary result(this);
     GPRTemporary scratch1(this);
@@ -5440,12 +5436,6 @@ void SpeculativeJIT::compileNewFunction(Node* node)
             
         addSlowPathGenerator(slowPathCall(slowPath, this, operationNewFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable));
     }
-
-    if (nodeType == NewGeneratorFunction) {
-        compileNewFunctionCommon<JSGeneratorFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSGeneratorFunction::allocationSize(0), executable, JSGeneratorFunction::offsetOfScopeChain(), JSGeneratorFunction::offsetOfExecutable(), JSGeneratorFunction::offsetOfRareData());
-
-        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable));
-    }
     
     if (nodeType == NewArrowFunction) {
         compileNewFunctionCommon<JSArrowFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSArrowFunction::allocationSize(0), executable, JSArrowFunction::offsetOfScopeChain(), JSArrowFunction::offsetOfExecutable(), JSArrowFunction::offsetOfRareData());
index 527374a..2f1d76f 100644 (file)
@@ -4408,7 +4408,6 @@ void SpeculativeJIT::compile(Node* node)
 
     case NewFunction:
     case NewArrowFunction:
-    case NewGeneratorFunction:
         compileNewFunction(node);
         break;
 
index b93e869..b491161 100644 (file)
@@ -4397,7 +4397,6 @@ void SpeculativeJIT::compile(Node* node)
 
     case NewFunction:
     case NewArrowFunction:
-    case NewGeneratorFunction:
         compileNewFunction(node);
         break;
 
index 72f2200..d736efe 100644 (file)
@@ -306,7 +306,6 @@ private:
             case CreateClonedArguments:
             case NewArrowFunction:
             case NewFunction:
-            case NewGeneratorFunction:
                 // Nodes that allocate get to set their epoch because for those nodes we know
                 // that they will be the newest object in the heap.
                 m_node->setEpoch(m_currentEpoch);
index 4345ff2..e39372b 100644 (file)
@@ -146,9 +146,6 @@ public:
                 case NewFunction:
                     registerStructure(m_graph.globalObjectFor(node->origin.semantic)->functionStructure());
                     break;
-                case NewGeneratorFunction:
-                    registerStructure(m_graph.globalObjectFor(node->origin.semantic)->generatorFunctionStructure());
-                    break;
                     
                 default:
                     break;
index fbebb75..5c3b81c 100644 (file)
@@ -111,7 +111,6 @@ inline CapabilityLevel canCompile(Node* node)
     case CreateActivation:
     case NewArrowFunction:
     case NewFunction:
-    case NewGeneratorFunction:
     case GetClosureVar:
     case PutClosureVar:
     case CreateDirectArguments:
index 6369147..06b5bc0 100644 (file)
@@ -52,7 +52,6 @@
 #include "FTLWeightedTarget.h"
 #include "JSArrowFunction.h"
 #include "JSCInlines.h"
-#include "JSGeneratorFunction.h"
 #include "JSLexicalEnvironment.h"
 #include "OperandsInlines.h"
 #include "ScopedArguments.h"
@@ -755,7 +754,6 @@ private:
             break;
         case NewFunction:
         case NewArrowFunction:
-        case NewGeneratorFunction:
             compileNewFunction();
             break;
         case CreateDirectArguments:
@@ -3562,37 +3560,34 @@ private:
     
     void compileNewFunction()
     {
-        ASSERT(m_node->op() == NewFunction || m_node->op() == NewArrowFunction || m_node->op() == NewGeneratorFunction);
+        ASSERT(m_node->op() == NewFunction || m_node->op() == NewArrowFunction);
+        
         bool isArrowFunction = m_node->op() == NewArrowFunction;
-        bool isGeneratorFunction = m_node->op() == NewGeneratorFunction;
         
         LValue scope = lowCell(m_node->child1());
         LValue thisValue = isArrowFunction ? lowCell(m_node->child2()) : nullptr;
         
         FunctionExecutable* executable = m_node->castOperand<FunctionExecutable*>();
         if (executable->singletonFunction()->isStillValid()) {
-            LValue callResult =
-                isArrowFunction ? vmCall(m_out.int64, m_out.operation(operationNewArrowFunction), m_callFrame, scope, weakPointer(executable), thisValue) :
-                isGeneratorFunction ? vmCall(m_out.int64, m_out.operation(operationNewGeneratorFunction), m_callFrame, scope, weakPointer(executable)) :
-                vmCall(m_out.int64, m_out.operation(operationNewFunction), m_callFrame, scope, weakPointer(executable));
+            LValue callResult = isArrowFunction
+                ? vmCall(m_out.int64, m_out.operation(operationNewArrowFunction), m_callFrame, scope, weakPointer(executable), thisValue)
+                : vmCall(m_out.int64, m_out.operation(operationNewFunction), m_callFrame, scope, weakPointer(executable));
             setJSValue(callResult);
             return;
         }
         
-        Structure* structure =
-            isArrowFunction ? m_graph.globalObjectFor(m_node->origin.semantic)->arrowFunctionStructure() :
-            isGeneratorFunction ? m_graph.globalObjectFor(m_node->origin.semantic)->generatorFunctionStructure() :
-            m_graph.globalObjectFor(m_node->origin.semantic)->functionStructure();
+        Structure* structure = isArrowFunction
+            ? m_graph.globalObjectFor(m_node->origin.semantic)->arrowFunctionStructure()
+            : m_graph.globalObjectFor(m_node->origin.semantic)->functionStructure();
         
         LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("NewFunction slow path"));
         LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("NewFunction continuation"));
         
         LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
         
-        LValue fastObject =
-            isArrowFunction ? allocateObject<JSArrowFunction>(structure, m_out.intPtrZero, slowPath) :
-            isGeneratorFunction ? allocateObject<JSGeneratorFunction>(structure, m_out.intPtrZero, slowPath) :
-            allocateObject<JSFunction>(structure, m_out.intPtrZero, slowPath);
+        LValue fastObject = isArrowFunction
+            ? allocateObject<JSArrowFunction>(structure, m_out.intPtrZero, slowPath)
+            : allocateObject<JSFunction>(structure, m_out.intPtrZero, slowPath);
         
         
         // We don't need memory barriers since we just fast-created the function, so it
@@ -3622,12 +3617,6 @@ private:
                         locations[0].directGPR(), locations[1].directGPR(),
                         CCallHelpers::TrustedImmPtr(executable), locations[2].directGPR());
                 }
-                if (isGeneratorFunction) {
-                    return createLazyCallGenerator(
-                        operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint,
-                        locations[0].directGPR(), locations[1].directGPR(),
-                        CCallHelpers::TrustedImmPtr(executable));
-                }
                 return createLazyCallGenerator(
                     operationNewFunctionWithInvalidatedReallocationWatchpoint,
                     locations[0].directGPR(), locations[1].directGPR(),
diff --git a/Source/JavaScriptCore/tests/stress/generator-function-create-optimized.js b/Source/JavaScriptCore/tests/stress/generator-function-create-optimized.js
deleted file mode 100644 (file)
index 9f4f409..0000000
+++ /dev/null
@@ -1,33 +0,0 @@
-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-
-
-function *g() { }
-var GeneratorFunctionPrototype = g.__proto__;
-
-function test()
-{
-    return function *gen()
-    {
-        yield 42;
-    };
-}
-noInline(test);
-
-function test2()
-{
-    function *gen()
-    {
-        yield 42;
-    }
-
-    return gen;
-}
-noInline(test2);
-
-for (var i = 0; i < 1e4; ++i) {
-    shouldBe(test().__proto__, GeneratorFunctionPrototype);
-    shouldBe(test2().__proto__, GeneratorFunctionPrototype);
-}
diff --git a/Source/JavaScriptCore/tests/stress/generator-function-declaration-sinking-no-double-allocate.js b/Source/JavaScriptCore/tests/stress/generator-function-declaration-sinking-no-double-allocate.js
deleted file mode 100644 (file)
index 412bdbf..0000000
+++ /dev/null
@@ -1,36 +0,0 @@
-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-var GeneratorFunctionPrototype = (function*(){}).__proto__;
-
-function call(o) { o.x = 3; }
-noInline(call);
-
-function sink (p, q) {
-    function *f() { };
-    if (p) {
-        call(f); // Force allocation of f
-        if (q) {
-            OSRExit();
-        }
-        return f;
-    }
-    return { 'x': 2 };
-}
-noInline(sink);
-
-for (var i = 0; i < 100000; ++i) {
-    var o = sink(true, false);
-    shouldBe(o.__proto__, GeneratorFunctionPrototype);
-    if (o.x != 3)
-        throw "Error: expected o.x to be 2 but is " + result;
-}
-
-// At this point, the function should be compiled down to the FTL
-
-// Check that the function is properly allocated on OSR exit
-var f = sink(true, true);
-shouldBe(f.__proto__, GeneratorFunctionPrototype);
-if (f.x != 3)
-    throw "Error: expected o.x to be 3 but is " + result;
diff --git a/Source/JavaScriptCore/tests/stress/generator-function-declaration-sinking-osrexit.js b/Source/JavaScriptCore/tests/stress/generator-function-declaration-sinking-osrexit.js
deleted file mode 100644 (file)
index 3be9e31..0000000
+++ /dev/null
@@ -1,30 +0,0 @@
-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-var GeneratorFunctionPrototype = (function*(){}).__proto__;
-
-function sink (p, q) {
-    function *g(x) { return x; };
-    if (p) { if (q) OSRExit(); return g; }
-    function *f(x) { return x; };
-    return f;
-}
-noInline(sink);
-
-for (var i = 0; i < 10000; ++i) {
-    var f = sink(true, false);
-    shouldBe(f.__proto__, GeneratorFunctionPrototype);
-    var result = f(42);
-    if (result.next().value != 42)
-    throw "Error: expected 42 but got " + result;
-}
-
-// At this point, the function should be compiled down to the FTL
-
-// Check that the function is properly allocated on OSR exit
-var f = sink(true, true);
-shouldBe(f.__proto__, GeneratorFunctionPrototype);
-var result = f(42);
-if (result.next().value != 42)
-    throw "Error: expected 42 but got " + result;
diff --git a/Source/JavaScriptCore/tests/stress/generator-function-declaration-sinking-put.js b/Source/JavaScriptCore/tests/stress/generator-function-declaration-sinking-put.js
deleted file mode 100644 (file)
index 3deca57..0000000
+++ /dev/null
@@ -1,38 +0,0 @@
-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-var GeneratorFunctionPrototype = (function*(){}).__proto__;
-
-function sink (p, q) {
-    function *g(x) { return x; };
-    if (p) { if (q) g.inner = 42; return g; }
-    function *f(x) { return x; };
-    return f;
-}
-noInline(sink);
-
-for (var i = 0; i < 10000; ++i) {
-    var f = sink(true, true);
-    shouldBe(f.__proto__, GeneratorFunctionPrototype);
-    var result = f(42);
-    if (result.next().value != 42)
-    throw "Error: expected 42 but got " + result;
-}
-
-// At this point, the function should be compiled down to the FTL
-
-// Test the allocation on the implicit inner else branch
-var f = sink(true, false);
-shouldBe(f.__proto__, GeneratorFunctionPrototype);
-var result = f(12);
-if (result.next().value != 12)
-    // This shouldn't matter as it should be either correct or completely crash
-    throw "Error: expected 12 but got " + result;
-
-// Check that the allocation did not sink beyond the property assignment
-var f = sink(true, true);
-shouldBe(f.__proto__, GeneratorFunctionPrototype);
-var result = f.inner;
-if (result != 42)
-    throw "Error: inner should be 42 but is " + result;
diff --git a/Source/JavaScriptCore/tests/stress/generator-function-expression-sinking-no-double-allocate.js b/Source/JavaScriptCore/tests/stress/generator-function-expression-sinking-no-double-allocate.js
deleted file mode 100644 (file)
index 020e6f0..0000000
+++ /dev/null
@@ -1,36 +0,0 @@
-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-var GeneratorFunctionPrototype = (function*(){}).__proto__;
-
-function call(o) { o.x = 3; }
-noInline(call);
-
-function sink (p, q) {
-    var f = function *() { };
-    if (p) {
-        call(f); // Force allocation of f
-        if (q) {
-            OSRExit();
-        }
-        return f;
-    }
-    return { 'x': 2 };
-}
-noInline(sink);
-
-for (var i = 0; i < 100000; ++i) {
-    var o = sink(true, false);
-    shouldBe(o.__proto__, GeneratorFunctionPrototype);
-    if (o.x != 3)
-        throw "Error: expected o.x to be 2 but is " + result;
-}
-
-// At this point, the function should be compiled down to the FTL
-
-// Check that the function is properly allocated on OSR exit
-var f = sink(true, true);
-shouldBe(f.__proto__, GeneratorFunctionPrototype);
-if (f.x != 3)
-    throw "Error: expected o.x to be 3 but is " + result;
diff --git a/Source/JavaScriptCore/tests/stress/generator-function-expression-sinking-osrexit.js b/Source/JavaScriptCore/tests/stress/generator-function-expression-sinking-osrexit.js
deleted file mode 100644 (file)
index d836581..0000000
+++ /dev/null
@@ -1,29 +0,0 @@
-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-var GeneratorFunctionPrototype = (function*(){}).__proto__;
-
-function sink (p, q) {
-    var g = function *(x) { return x; };
-    if (p) { if (q) OSRExit(); return g; }
-    return function *(x) { return x; };
-}
-noInline(sink);
-
-for (var i = 0; i < 10000; ++i) {
-    var f = sink(true, false);
-    shouldBe(f.__proto__, GeneratorFunctionPrototype);
-    var result = f(42);
-    if (result.next().value != 42)
-    throw "Error: expected 42 but got " + result;
-}
-
-// At this point, the function should be compiled down to the FTL
-
-// Check that the function is properly allocated on OSR exit
-var f = sink(true, true);
-shouldBe(f.__proto__, GeneratorFunctionPrototype);
-var result = f(42);
-if (result.next().value != 42)
-    throw "Error: expected 42 but got " + result;
diff --git a/Source/JavaScriptCore/tests/stress/generator-function-expression-sinking-put.js b/Source/JavaScriptCore/tests/stress/generator-function-expression-sinking-put.js
deleted file mode 100644 (file)
index 43f5091..0000000
+++ /dev/null
@@ -1,37 +0,0 @@
-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-var GeneratorFunctionPrototype = (function*(){}).__proto__;
-
-function sink (p, q) {
-    var g = function *(x) { return x; };
-    if (p) { if (q) g.inner = 42; return g; }
-    return function *(x) { return x; };
-}
-noInline(sink);
-
-for (var i = 0; i < 10000; ++i) {
-    var f = sink(true, true);
-    shouldBe(f.__proto__, GeneratorFunctionPrototype);
-    var result = f(42);
-    if (result.next().value != 42)
-    throw "Error: expected 42 but got " + result;
-}
-
-// At this point, the function should be compiled down to the FTL
-
-// Test the allocation on the implicit inner else branch
-var f = sink(true, false);
-shouldBe(f.__proto__, GeneratorFunctionPrototype);
-var result = f(12);
-if (result.next().value != 12)
-    // This shouldn't matter as it should be either correct or completely crash
-    throw "Error: expected 12 but got " + result;
-
-// Check that the allocation did not sink beyond the property assignment
-var f = sink(true, true);
-shouldBe(f.__proto__, GeneratorFunctionPrototype);
-var result = f.inner;
-if (result != 42)
-    throw "Error: inner should be 42 but is " + result;