diff -r 000000000000 -r 6474c204b198 js/src/jspropertytree.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jspropertytree.h	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,106 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef jspropertytree_h
+#define jspropertytree_h
+
+#include "jsalloc.h"
+#include "jspubtd.h"
+
+#include "js/HashTable.h"
+
+namespace js {
+
+class Shape;
+struct StackShape;
+
+struct ShapeHasher {
+    typedef Shape *Key;
+    typedef StackShape Lookup;
+
+    static inline HashNumber hash(const Lookup &l);
+    static inline bool match(Key k, const Lookup &l);
+};
+
+typedef HashSet<Shape *, ShapeHasher, SystemAllocPolicy> KidsHash;
+
+class KidsPointer {
+  private:
+    enum {
+        SHAPE = 0,
+        HASH  = 1,
+        TAG   = 1
+    };
+
+    uintptr_t w;
+
+  public:
+    bool isNull() const { return !w; }
+    void setNull() { w = 0; }
+
+    bool isShape() const { return (w & TAG) == SHAPE && !isNull(); }
+    Shape *toShape() const {
+        JS_ASSERT(isShape());
+        return reinterpret_cast<Shape *>(w & ~uintptr_t(TAG));
+    }
+    void setShape(Shape *shape) {
+        JS_ASSERT(shape);
+        JS_ASSERT((reinterpret_cast<uintptr_t>(static_cast<Shape *>(shape)) & TAG) == 0);
+        w = reinterpret_cast<uintptr_t>(static_cast<Shape *>(shape)) | SHAPE;
+    }
+
+    bool isHash() const { return (w & TAG) == HASH; }
+    KidsHash *toHash() const {
+        JS_ASSERT(isHash());
+        return reinterpret_cast<KidsHash *>(w & ~uintptr_t(TAG));
+    }
+    void setHash(KidsHash *hash) {
+        JS_ASSERT(hash);
+        JS_ASSERT((reinterpret_cast<uintptr_t>(hash) & TAG) == 0);
+        w = reinterpret_cast<uintptr_t>(hash) | HASH;
+    }
+
+#ifdef DEBUG
+    void checkConsistency(Shape *aKid) const;
+#endif
+};
+
+class PropertyTree
+{
+    friend class ::JSFunction;
+
+    JSCompartment *compartment_;
+
+    bool insertChild(ExclusiveContext *cx, Shape *parent, Shape *child);
+
+    PropertyTree();
+
+  public:
+    /*
+     * Use a lower limit for objects that are accessed using SETELEM (o[x] = y).
+     * These objects are likely used as hashmaps and dictionary mode is more
+     * efficient in this case.
+     */
+    enum {
+        MAX_HEIGHT = 512,
+        MAX_HEIGHT_WITH_ELEMENTS_ACCESS = 128
+    };
+
+    PropertyTree(JSCompartment *comp)
+        : compartment_(comp)
+    {
+    }
+
+    JSCompartment *compartment() { return compartment_; }
+
+    Shape *newShape(ExclusiveContext *cx);
+    Shape *getChild(ExclusiveContext *cx, Shape *parent, StackShape &child);
+    Shape *lookupChild(ThreadSafeContext *cx, Shape *parent, const StackShape &child);
+};
+
+} /* namespace js */
+
+#endif /* jspropertytree_h */