https://bugs.webkit.org/show_bug.cgi?id=117377

Source/JavaScriptCore:

Reviewed by Geoffrey Garen.

Previously if you did self accesses and then wanted to do a prototype access, you'd
have a bad time: the prototype accesses would be forced to take slow path because
the self list wouldn't allow prototype accesses. Likewise if you did prototype (or
chain) accesses and then wanted to do a self access, similar stupidity would ensue.

This fixes the stupidity.

I believe that this was introduced way back in the days of the old interpreter,
where distinguishing between self lists, proto lists, and chain lists was meaningful
for interpreter performance: it meant fewer branches to evaluate those lists. Then
it got mostly carried over to the old JIT since the old JIT was just initially an
optimized version of the old interpreter, and then later it got carried over to the
DFG because I didn't know any better at the time. Now I do know better and I'm
fixing it.

* bytecode/PolymorphicAccessStructureList.h:
(JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
* bytecode/StructureStubInfo.h:
(JSC::StructureStubInfo::initGetByIdSelfList):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGRepatch.cpp:
(JSC::DFG::tryCacheGetByID):
(JSC::DFG::getPolymorphicStructureList):
(DFG):
(JSC::DFG::patchJumpToGetByIdStub):
(JSC::DFG::tryBuildGetByIDList):
(JSC::DFG::dfgBuildGetByIDList):

LayoutTests:

Reviewed by Geoffrey Garen.

Add tests that show why this is important. These tests speed up by more than 3x.

* fast/js/regress/get-by-id-proto-or-self-expected.txt: Added.
* fast/js/regress/get-by-id-proto-or-self.html: Added.
* fast/js/regress/get-by-id-self-or-proto-expected.txt: Added.
* fast/js/regress/get-by-id-self-or-proto.html: Added.
* fast/js/regress/script-tests/get-by-id-proto-or-self.js: Added.
(foo):
(bar):
(Foo):
* fast/js/regress/script-tests/get-by-id-self-or-proto.js: Added.
(foo):
(bar):
(Foo):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153217 268f45cc-cd09-0410-ab3c-d52691b4dbfc