Source/JavaScriptCore/ChangeLog

   1 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
   2
   3         Unreviewed, build fix for Windows debug build after r208738
   4         https://bugs.webkit.org/show_bug.cgi?id=164727
   5
   6         This static member variable can be touched outside of the JSC project
   7         since inlined MacroAssembler member functions read / write it.
   8         So it should be exported.
   9
  10         * assembler/MacroAssemblerX86Common.h:
  11
  12 2016-11-15  Joseph Pecoraro  <pecoraro@apple.com>
  13
  14         Web Inspector: inspector/worker/debugger-pause.html fails on WebKit1
  15         https://bugs.webkit.org/show_bug.cgi?id=164787
  16
  17         Reviewed by Timothy Hatcher.
  18
  19         * inspector/agents/InspectorDebuggerAgent.cpp:
  20         (Inspector::InspectorDebuggerAgent::cancelPauseOnNextStatement):
  21         Clear this DebuggerAgent state when we resume.
  22
  23 2016-11-15  Filip Pizlo  <fpizlo@apple.com>
  24
  25         It should be possible to disable concurrent GC timeslicing
  26         https://bugs.webkit.org/show_bug.cgi?id=164788
  27
  28         Reviewed by Saam Barati.
  29
  30         Collector timeslicing means that the collector will try to pause once every 2ms. This is
  31         great because it throttles the mutator and prevents it from outpacing the collector. But
  32         it reduces some of the efficacy of the collectContinuously=true configuration: while
  33         it's great that collecting continuously means that the collector will also pause more
  34         frequently and so it will test the pausing code, it also means that the collector will
  35         spend less time running concurrently. The primary purpose of collectContinuously is to
  36         maximize the amount of time that the collector is running concurrently to the mutator to
  37         maximize the likelihood that a race will cause a detectable error.
  38
  39         This adds an option to disable collector timeslicing (useCollectorTimeslicing=false).
  40         The idea is that we will usually use this in conjunction with collectContinuously=true
  41         to find race conditions during marking, but we can also use the two options
  42         independently to focus our testing on other things.
  43
  44         * heap/Heap.cpp:
  45         (JSC::Heap::markToFixpoint):
  46         * heap/SlotVisitor.cpp:
  47         (JSC::SlotVisitor::drainInParallel): We should have added this helper ages ago.
  48         * heap/SlotVisitor.h:
  49         * runtime/Options.h:
  50
  51 2016-11-15  Filip Pizlo  <fpizlo@apple.com>
  52
  53         The concurrent GC should have a timeslicing controller
  54         https://bugs.webkit.org/show_bug.cgi?id=164783
  55
  56         Reviewed by Geoffrey Garen.
  57
  58         This adds a simple control system for deciding when the collector should let the mutator run
  59         and when it should stop the mutator. We definitely have to stop the mutator during certain
  60         collector phases, but during marking - which takes the most time - we can go either way.
  61         Normally we want to let the mutator run, but if the heap size starts to grow then we have to
  62         stop the mutator just to make sure it doesn't get too far ahead of the collector. That could
  63         lead to memory exhaustion, so it's better to just stop in that case.
  64
  65         The controller tries to never stop the mutator for longer than short timeslices. It slices on
  66         a 2ms period (configurable via Options). The amount of that period that the collector spends
  67         with the mutator stopped is determined by the fraction of the collector's concurrent headroom
  68         that has been allocated over. The headroom is currently configured at 50% of what was
  69         allocated before the collector started.
  70
  71         This moves a bunch of parameters into Options so that it's easier to play with different
  72         configurations.
  73
  74         I tried these different values for the period:
  75
  76         1ms: 30% worse than 2ms on splay-latency.
  77         2ms: best score on splay-latency: the tick time above the 99.5% percentile is <2ms.
  78         3ms: 40% worse than 2ms on splay-latency.
  79         4ms: 40% worse than 2ms on splay-latency.
  80
  81         I also tried 100% headroom as an alternate to 50% and found it to be a worse.
  82
  83         This patch is a 2x improvement on splay-latency with the default parameters and concurrent GC
  84         enabled. Prior to this change, the GC didn't have a good bound on its pause times, which
  85         would cause these problems. Concurrent GC is now 5.6x better on splay-latency than no
  86         concurrent GC.
  87
  88         * heap/Heap.cpp:
  89         (JSC::Heap::ResumeTheWorldScope::ResumeTheWorldScope):
  90         (JSC::Heap::markToFixpoint):
  91         (JSC::Heap::collectInThread):
  92         * runtime/Options.h:
  93
  94 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
  95
  96         Unreviewed, build fix for CLoop after r208738
  97         https://bugs.webkit.org/show_bug.cgi?id=164727
  98
  99         * jsc.cpp:
 100         (WTF::DOMJITFunctionObject::unsafeFunction):
 101         (WTF::DOMJITFunctionObject::finishCreation):
 102
 103 2016-11-15  Mark Lam  <mark.lam@apple.com>
 104
 105         The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
 106         https://bugs.webkit.org/show_bug.cgi?id=164781
 107         <rdar://problem/28418590>
 108
 109         Reviewed by Geoffrey Garen and Michael Saboff.
 110
 111         * jsc.cpp:
 112         (functionSetImpureGetterDelegate):
 113
 114 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
 115
 116         [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
 117         https://bugs.webkit.org/show_bug.cgi?id=164727
 118
 119         Reviewed by Filip Pizlo.
 120
 121         While CallDOMGetter can use macro assembler scratch registers, we previiously
 122         assumed that CheckDOM code generator does not use macro assembler scratch registers.
 123         It is currently true in x86 environment. But it is not true in the other environments.
 124
 125         We should not limit DOMJIT::Patchpoint's functionality in such a way. We should allow
 126         arbitrary macro assembler operations inside the DOMJIT::Patchpoint. This patch allows
 127         CheckDOM to use macro assembler scratch registers.
 128
 129         * ftl/FTLLowerDFGToB3.cpp:
 130         (JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
 131         * jsc.cpp:
 132         (WTF::DOMJITFunctionObject::DOMJITFunctionObject):
 133         (WTF::DOMJITFunctionObject::createStructure):
 134         (WTF::DOMJITFunctionObject::create):
 135         (WTF::DOMJITFunctionObject::unsafeFunction):
 136         (WTF::DOMJITFunctionObject::safeFunction):
 137         (WTF::DOMJITFunctionObject::checkDOMJITNode):
 138         (WTF::DOMJITFunctionObject::finishCreation):
 139         (GlobalObject::finishCreation):
 140         (functionCreateDOMJITFunctionObject):
 141
 142 2016-11-14  Geoffrey Garen  <ggaren@apple.com>
 143
 144         CodeCache should stop pretending to cache builtins
 145         https://bugs.webkit.org/show_bug.cgi?id=164750
 146
 147         Reviewed by Saam Barati.
 148
 149         We were passing JSParserBuiltinMode to all CodeCache functions, but the
 150         passed-in value was always NotBuiltin.
 151
 152         Let's stop passing it.
 153
 154         * parser/SourceCodeKey.h:
 155         (JSC::SourceCodeFlags::SourceCodeFlags):
 156         (JSC::SourceCodeKey::SourceCodeKey):
 157         * runtime/CodeCache.cpp:
 158         (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
 159         (JSC::CodeCache::getUnlinkedProgramCodeBlock):
 160         (JSC::CodeCache::getUnlinkedGlobalEvalCodeBlock):
 161         (JSC::CodeCache::getUnlinkedModuleProgramCodeBlock):
 162         (JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):
 163         * runtime/CodeCache.h:
 164         (JSC::generateUnlinkedCodeBlock):
 165         * runtime/JSGlobalObject.cpp:
 166         (JSC::JSGlobalObject::createProgramCodeBlock):
 167         (JSC::JSGlobalObject::createLocalEvalCodeBlock):
 168         (JSC::JSGlobalObject::createGlobalEvalCodeBlock):
 169         (JSC::JSGlobalObject::createModuleProgramCodeBlock):
 170
 171 2016-11-15  Filip Pizlo  <fpizlo@apple.com>
 172
 173         REGRESSION (r208711-r208722): ASSERTION FAILED: hasInlineStorage()
 174         https://bugs.webkit.org/show_bug.cgi?id=164775
 175
 176         Reviewed by Mark Lam and Keith Miller.
 177
 178         We were calling inlineStorage() which asserts that inline storage is not empty. But we
 179         were calling it in a context where it could be empty and that's fine. So, we now call
 180         inlineStorageUnsafe().
 181
 182         * runtime/JSObject.h:
 183         (JSC::JSFinalObject::JSFinalObject):
 184
 185 2016-11-14  Csaba Osztrogonác  <ossy@webkit.org>
 186
 187         [ARM] Unreviewed buildfix after r208720.
 188
 189         * assembler/MacroAssemblerARM.h:
 190         (JSC::MacroAssemblerARM::storeFence): Stub function copied from MacroAssemblerARMv7.h.
 191
 192 2016-11-14  Caitlin Potter  <caitp@igalia.com>
 193
 194         [JSC] do not reference AwaitExpression Promises in async function Promise chain
 195         https://bugs.webkit.org/show_bug.cgi?id=164753
 196
 197         Reviewed by Yusuke Suzuki.
 198
 199         Previously, long-running async functions which contained many AwaitExpressions
 200         would allocate and retain references to intermediate Promise objects for each `await`,
 201         resulting in a memory leak.
 202
 203         To mitigate this leak, a reference to the original Promise (and its resolve and reject
 204         functions) associated with the async function are kept, and passed to each call to
 205         @asyncFunctionResume, while intermediate Promises are discarded. This is done by adding
 206         a new Register to the BytecodeGenerator to hold the PromiseCapability object associated
 207         with an async function wrapper. The capability is used to reject the Promise if an
 208         exception is thrown during parameter initialization, and is used to store the resulting
 209         value once the async function has terminated.
 210
 211         * builtins/AsyncFunctionPrototype.js:
 212         (globalPrivate.asyncFunctionResume):
 213         * bytecompiler/BytecodeGenerator.cpp:
 214         (JSC::BytecodeGenerator::BytecodeGenerator):
 215         * bytecompiler/BytecodeGenerator.h:
 216         (JSC::BytecodeGenerator::promiseCapabilityRegister):
 217         * bytecompiler/NodesCodegen.cpp:
 218         (JSC::FunctionNode::emitBytecode):
 219
 220 2016-11-14  Joseph Pecoraro  <pecoraro@apple.com>
 221
 222         Web Inspector: Worker debugging should pause all targets and view call frames in all targets
 223         https://bugs.webkit.org/show_bug.cgi?id=164305
 224         <rdar://problem/29056192>
 225
 226         Reviewed by Timothy Hatcher.
 227
 228         * inspector/InjectedScriptSource.js:
 229         (InjectedScript.prototype._propertyDescriptors):
 230         Accessing __proto__ does a ToThis(...) conversion on the receiver.
 231         In the case of GlobalObjects (such as WorkerGlobalScope when paused)
 232         this would return undefined and throw an exception. We can use
 233         Object.getPrototypeOf to avoid that conversion and possible error.
 234
 235         * inspector/protocol/Debugger.json:
 236         Provide a new way to effectively `resume` + `pause` immediately.
 237         This must be implemented on the backend to correctly synchronize
 238         the resuming and pausing.
 239
 240         * inspector/agents/InspectorDebuggerAgent.h:
 241         * inspector/agents/InspectorDebuggerAgent.cpp:
 242         (Inspector::InspectorDebuggerAgent::continueUntilNextRunLoop):
 243         Treat this as `resume` and `pause`. Resume now, and trigger
 244         a pause if the VM becomes idle and we didn't pause before then
 245         (such as hitting a breakpoint after we resumed).
 246
 247         (Inspector::InspectorDebuggerAgent::pause):
 248         (Inspector::InspectorDebuggerAgent::resume):
 249         (Inspector::InspectorDebuggerAgent::schedulePauseOnNextStatement):
 250         (Inspector::InspectorDebuggerAgent::cancelPauseOnNextStatement):
 251         Clean up and correct pause on next statement logic.
 252
 253         (Inspector::InspectorDebuggerAgent::registerIdleHandler):
 254         (Inspector::InspectorDebuggerAgent::willStepAndMayBecomeIdle):
 255         (Inspector::InspectorDebuggerAgent::didBecomeIdle):
 256         (Inspector::InspectorDebuggerAgent::didBecomeIdleAfterStepping): Deleted.
 257         The idle handler may now also trigger a pause in the case
 258         where continueUntilNextRunLoop resumed and wants to pause.
 259
 260         (Inspector::InspectorDebuggerAgent::didPause):
 261         Eliminate the useless didPause. The DOMDebugger was keeping track
 262         of its own state that was worse then the state in DebuggerAgent.
 263
 264 2016-11-14  Filip Pizlo  <fpizlo@apple.com>
 265
 266         Unreviewed, fix cloop.
 267
 268         * runtime/JSCellInlines.h:
 269
 270 2016-11-14  Filip Pizlo  <fpizlo@apple.com>
 271
 272         The GC should be optionally concurrent and disabled by default
 273         https://bugs.webkit.org/show_bug.cgi?id=164454
 274
 275         Reviewed by Geoffrey Garen.
 276
 277         This started out as a patch to have the GC scan the stack at the end, and then the
 278         outage happened and I decided to pick a more aggresive target: give the GC a concurrent
 279         mode that can be enabled at runtime, and whose only effect is that it turns on the
 280         ResumeTheWorldScope. This gives our GC a really intuitive workflow: by default, the GC
 281         thread is running solo with the world stopped and the parallel markers converged and
 282         waiting. We have a parallel work scope to enable the parallel markers and now we have a
 283         ResumeTheWorldScope that will optionally resume the world and then stop it again.
 284
 285         It's easy to make a concurrent GC that always instantly crashes. I can't promise that
 286         this one won't do that when you run it. I set a specific goal: I wanted to do >10
 287         concurrent GCs in debug mode with generations, optimizing JITs, and parallel marking
 288         disabled.
 289
 290         To reach this milestone, I needed to do a bunch of stuff:
 291
 292         - The mutator needs a separate mark stack for the barrier, since it will mutate this
 293           stack concurrently to the collector's slot visitors.
 294
 295         - The use of CellState to indicate whether an object is being scanned the first time or
 296           a subsequent time was racy. It fails spectacularly when a barrier is fired at the same
 297           time as visitChildren is running or if the barrier runs at the same time as the GC
 298           marks the same object. So, I split SlotVisitor's mark stacks. It's now the case that
 299           you know why you're being scanned by looking at which stack you came off of.
 300
 301         - All of root marking must be in the collector fixpoint. I renamed markRoots to
 302           markToFixpoint. They say concurrency is hard, but the collector looks more intuitive
 303           this way. We never gained anything from forcing people to make a choice between
 304           scanning something in the fixpoint versus outside of it. Because root scanning is
 305           cheap, we can afford to do it repeatedly, which means all root scanning can now do
 306           constraint-based marking (like: I'll mark you if that thing is marked).
 307
 308         - JSObject::visitChildren's scanning of the butterfly raced with property additions,
 309           indexed storage transitions and resizing, and a bunch of miscellaneous dirty butterfly
 310           reshaping functions - like the one that flattens a dictionary and some sneaky
 311           ArrayStorage transformations. Many of these can be fixed by using store-store fences
 312           in the mutator and load-load fences in the collector. I've adopted the rule that the
 313           collector must always see either a butterfly and structure that match or a newer
 314           butterfly with an older structure, where their age is just one transition apart. This
 315           can be achieved with fences. For the cases where it breaks down, I added a lock to
 316           every JSCell. This is a full-fledged WTF lock that we sneak into two available bits in
 317           the indexingType. See the WTF ChangeLog for details.
 318
 319           The mutator fencing rules are as follows:
 320
 321           - Store-store fence before and after setting the butterfly.
 322           - Store-store fence before setting structure if you had changed the shape of the
 323             butterfly.
 324           - Store-store fence after initializing all fields in an allocation.
 325
 326         - A dictionary Structure can change in strange ways while the GC is trying to scan it.
 327           So, JSObject::visitChildren will now grab the object's structure's lock if the
 328           object's structure is a dictionary. Dictionary structures are 1:1 with their object,
 329           so this does not reduce GC parallelism (super unlikely that the GC will simultaneously
 330           scan an object from two threads).
 331
 332         - The GC can blow away a Structure's property table at any time. As a small consolation,
 333           it's now holding the Structure's lock when it does so. But there was tons of code in
 334           Structure that uses DeferGC to prevent the GC from blowing away the property table.
 335           This doesn't work with concurrent GC, since DeferGC only means that the GC won't run
 336           its safepoint (i.e. stop-the-world code) in the DeferGC region. It will still do
 337           marking and it was the Structure::visitChildren that would delete the table. It turns
 338           out that Structure's reliance on the property table not being deleted was the product
 339           of code rot. We already had functions that would materialize the table on demand. We
 340           were simply making the mistake of saying:
 341
 342               structure->materializePropertyMap();
 343               ...
 344               structure->propertyTable()->things
 345
 346           Instead of saying:
 347
 348               PropertyTable* table = structure->ensurePropertyTable();
 349               ...
 350               table->things
 351
 352           Switching the code to use the latter idiom allowed me to simplify the code a lot while
 353           fixing the race.
 354
 355         - The LLInt's get_by_val handling was broken because the indexing shape constants were
 356           wrong. Once I started putting more things into the IndexingType, that started causing
 357           crashes for me. So I fixed LLInt. That turned out to be a lot of work, since that code
 358           had rotted in subtle ways.
 359
 360         This is a speed-up in SunSpider, probably because of the LLInt fix. This is neutral on
 361         Octane and Kraken. It's a smaller slow-down on LongSpider, but I think we can ignore
 362         that (we don't view LongSpider as an official benchmark). By default, the concurrent GC
 363         is disabled: in all of the places where it would have resumed the world to run marking
 364         concurrently to the mutator, it will just skip the resume step. When you enable
 365         concurrent GC (--useConcurrentGC=true), it can sometimes run Octane/splay to completion.
 366         It seems to perform quite well: on my machine, it improves both splay-throughput and
 367         splay-latency. It's probably unstable for other programs.
 368
 369         * API/JSVirtualMachine.mm:
 370         (-[JSVirtualMachine isOldExternalObject:]):
 371         * assembler/MacroAssemblerARMv7.h:
 372         (JSC::MacroAssemblerARMv7::storeFence):
 373         * bytecode/InlineAccess.cpp:
 374         (JSC::InlineAccess::dumpCacheSizesAndCrash):
 375         (JSC::InlineAccess::generateSelfPropertyAccess):
 376         (JSC::InlineAccess::generateArrayLength):
 377         * bytecode/ObjectAllocationProfile.h:
 378         (JSC::ObjectAllocationProfile::offsetOfInlineCapacity):
 379         (JSC::ObjectAllocationProfile::ObjectAllocationProfile):
 380         (JSC::ObjectAllocationProfile::initialize):
 381         (JSC::ObjectAllocationProfile::inlineCapacity):
 382         (JSC::ObjectAllocationProfile::clear):
 383         * bytecode/PolymorphicAccess.cpp:
 384         (JSC::AccessCase::generateWithGuard):
 385         (JSC::AccessCase::generateImpl):
 386         * dfg/DFGArrayifySlowPathGenerator.h:
 387         * dfg/DFGClobberize.h:
 388         (JSC::DFG::clobberize):
 389         * dfg/DFGOSRExitCompiler32_64.cpp:
 390         (JSC::DFG::OSRExitCompiler::compileExit):
 391         * dfg/DFGOSRExitCompiler64.cpp:
 392         (JSC::DFG::OSRExitCompiler::compileExit):
 393         * dfg/DFGOperations.cpp:
 394         * dfg/DFGPlan.cpp:
 395         (JSC::DFG::Plan::markCodeBlocks):
 396         (JSC::DFG::Plan::rememberCodeBlocks):
 397         * dfg/DFGPlan.h:
 398         * dfg/DFGSpeculativeJIT.cpp:
 399         (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
 400         (JSC::DFG::SpeculativeJIT::checkArray):
 401         (JSC::DFG::SpeculativeJIT::arrayify):
 402         (JSC::DFG::SpeculativeJIT::compileMakeRope):
 403         (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
 404         (JSC::DFG::SpeculativeJIT::compileCreateActivation):
 405         (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
 406         (JSC::DFG::SpeculativeJIT::compileSpread):
 407         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
 408         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
 409         (JSC::DFG::SpeculativeJIT::compileNewStringObject):
 410         (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
 411         (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
 412         * dfg/DFGSpeculativeJIT64.cpp:
 413         (JSC::DFG::SpeculativeJIT::compile):
 414         (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
 415         * dfg/DFGTierUpCheckInjectionPhase.cpp:
 416         (JSC::DFG::TierUpCheckInjectionPhase::run):
 417         * dfg/DFGWorklist.cpp:
 418         (JSC::DFG::Worklist::markCodeBlocks):
 419         (JSC::DFG::Worklist::rememberCodeBlocks):
 420         (JSC::DFG::markCodeBlocks):
 421         (JSC::DFG::completeAllPlansForVM):
 422         (JSC::DFG::rememberCodeBlocks):
 423         * dfg/DFGWorklist.h:
 424         * ftl/FTLAbstractHeapRepository.cpp:
 425         (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
 426         (JSC::FTL::AbstractHeapRepository::computeRangesAndDecorateInstructions):
 427         * ftl/FTLAbstractHeapRepository.h:
 428         * ftl/FTLJITCode.cpp:
 429         (JSC::FTL::JITCode::~JITCode):
 430         * ftl/FTLLowerDFGToB3.cpp:
 431         (JSC::FTL::DFG::LowerDFGToB3::compilePutStructure):
 432         (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
 433         (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
 434         (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
 435         (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
 436         (JSC::FTL::DFG::LowerDFGToB3::compileNewObject):
 437         (JSC::FTL::DFG::LowerDFGToB3::compileNewArray):
 438         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
 439         (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
 440         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayBuffer):
 441         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
 442         (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
 443         (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
 444         (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
 445         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
 446         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
 447         (JSC::FTL::DFG::LowerDFGToB3::splatWords):
 448         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
 449         (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
 450         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
 451         (JSC::FTL::DFG::LowerDFGToB3::isArrayType):
 452         (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
 453         (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
 454         (JSC::FTL::DFG::LowerDFGToB3::setButterfly):
 455         * ftl/FTLOSRExitCompiler.cpp:
 456         (JSC::FTL::compileStub):
 457         * ftl/FTLOutput.cpp:
 458         (JSC::FTL::Output::signExt32ToPtr):
 459         (JSC::FTL::Output::fence):
 460         * ftl/FTLOutput.h:
 461         * heap/CellState.h:
 462         * heap/GCSegmentedArray.h:
 463         * heap/Heap.cpp:
 464         (JSC::Heap::ResumeTheWorldScope::ResumeTheWorldScope):
 465         (JSC::Heap::ResumeTheWorldScope::~ResumeTheWorldScope):
 466         (JSC::Heap::Heap):
 467         (JSC::Heap::~Heap):
 468         (JSC::Heap::harvestWeakReferences):
 469         (JSC::Heap::finalizeUnconditionalFinalizers):
 470         (JSC::Heap::completeAllJITPlans):
 471         (JSC::Heap::markToFixpoint):
 472         (JSC::Heap::gatherStackRoots):
 473         (JSC::Heap::beginMarking):
 474         (JSC::Heap::visitConservativeRoots):
 475         (JSC::Heap::visitCompilerWorklistWeakReferences):
 476         (JSC::Heap::updateObjectCounts):
 477         (JSC::Heap::endMarking):
 478         (JSC::Heap::addToRememberedSet):
 479         (JSC::Heap::collectInThread):
 480         (JSC::Heap::stopTheWorld):
 481         (JSC::Heap::resumeTheWorld):
 482         (JSC::Heap::setGCDidJIT):
 483         (JSC::Heap::setNeedFinalize):
 484         (JSC::Heap::setMutatorWaiting):
 485         (JSC::Heap::clearMutatorWaiting):
 486         (JSC::Heap::finalize):
 487         (JSC::Heap::flushWriteBarrierBuffer):
 488         (JSC::Heap::writeBarrierSlowPath):
 489         (JSC::Heap::canCollect):
 490         (JSC::Heap::reportExtraMemoryVisited):
 491         (JSC::Heap::reportExternalMemoryVisited):
 492         (JSC::Heap::notifyIsSafeToCollect):
 493         (JSC::Heap::markRoots): Deleted.
 494         (JSC::Heap::visitExternalRememberedSet): Deleted.
 495         (JSC::Heap::visitSmallStrings): Deleted.
 496         (JSC::Heap::visitProtectedObjects): Deleted.
 497         (JSC::Heap::visitArgumentBuffers): Deleted.
 498         (JSC::Heap::visitException): Deleted.
 499         (JSC::Heap::visitStrongHandles): Deleted.
 500         (JSC::Heap::visitHandleStack): Deleted.
 501         (JSC::Heap::visitSamplingProfiler): Deleted.
 502         (JSC::Heap::visitTypeProfiler): Deleted.
 503         (JSC::Heap::visitShadowChicken): Deleted.
 504         (JSC::Heap::traceCodeBlocksAndJITStubRoutines): Deleted.
 505         (JSC::Heap::visitWeakHandles): Deleted.
 506         (JSC::Heap::flushOldStructureIDTables): Deleted.
 507         (JSC::Heap::stopAllocation): Deleted.
 508         * heap/Heap.h:
 509         (JSC::Heap::collectorSlotVisitor):
 510         (JSC::Heap::mutatorMarkStack):
 511         (JSC::Heap::mutatorShouldBeFenced):
 512         (JSC::Heap::addressOfMutatorShouldBeFenced):
 513         (JSC::Heap::slotVisitor): Deleted.
 514         (JSC::Heap::notifyIsSafeToCollect): Deleted.
 515         (JSC::Heap::barrierShouldBeFenced): Deleted.
 516         (JSC::Heap::addressOfBarrierShouldBeFenced): Deleted.
 517         * heap/MarkStack.cpp:
 518         (JSC::MarkStackArray::transferTo):
 519         * heap/MarkStack.h:
 520         * heap/MarkedAllocator.cpp:
 521         (JSC::MarkedAllocator::tryAllocateIn):
 522         * heap/MarkedBlock.cpp:
 523         (JSC::MarkedBlock::MarkedBlock):
 524         (JSC::MarkedBlock::Handle::specializedSweep):
 525         (JSC::MarkedBlock::Handle::sweep):
 526         (JSC::MarkedBlock::Handle::sweepHelperSelectMarksMode):
 527         (JSC::MarkedBlock::Handle::stopAllocating):
 528         (JSC::MarkedBlock::Handle::resumeAllocating):
 529         (JSC::MarkedBlock::aboutToMarkSlow):
 530         (JSC::MarkedBlock::Handle::didConsumeFreeList):
 531         (JSC::SetNewlyAllocatedFunctor::SetNewlyAllocatedFunctor): Deleted.
 532         (JSC::SetNewlyAllocatedFunctor::operator()): Deleted.
 533         * heap/MarkedBlock.h:
 534         * heap/MarkedSpace.cpp:
 535         (JSC::MarkedSpace::resumeAllocating):
 536         * heap/SlotVisitor.cpp:
 537         (JSC::SlotVisitor::SlotVisitor):
 538         (JSC::SlotVisitor::~SlotVisitor):
 539         (JSC::SlotVisitor::reset):
 540         (JSC::SlotVisitor::clearMarkStacks):
 541         (JSC::SlotVisitor::appendJSCellOrAuxiliary):
 542         (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
 543         (JSC::SlotVisitor::appendToMarkStack):
 544         (JSC::SlotVisitor::appendToMutatorMarkStack):
 545         (JSC::SlotVisitor::visitChildren):
 546         (JSC::SlotVisitor::donateKnownParallel):
 547         (JSC::SlotVisitor::drain):
 548         (JSC::SlotVisitor::drainFromShared):
 549         (JSC::SlotVisitor::containsOpaqueRoot):
 550         (JSC::SlotVisitor::donateAndDrain):
 551         (JSC::SlotVisitor::mergeOpaqueRoots):
 552         (JSC::SlotVisitor::dump):
 553         (JSC::SlotVisitor::clearMarkStack): Deleted.
 554         (JSC::SlotVisitor::opaqueRootCount): Deleted.
 555         * heap/SlotVisitor.h:
 556         (JSC::SlotVisitor::collectorMarkStack):
 557         (JSC::SlotVisitor::mutatorMarkStack):
 558         (JSC::SlotVisitor::isEmpty):
 559         (JSC::SlotVisitor::bytesVisited):
 560         (JSC::SlotVisitor::markStack): Deleted.
 561         (JSC::SlotVisitor::bytesCopied): Deleted.
 562         * heap/SlotVisitorInlines.h:
 563         (JSC::SlotVisitor::reportExtraMemoryVisited):
 564         (JSC::SlotVisitor::reportExternalMemoryVisited):
 565         * jit/AssemblyHelpers.cpp:
 566         (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
 567         * jit/AssemblyHelpers.h:
 568         (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
 569         (JSC::AssemblyHelpers::barrierStoreLoadFence):
 570         (JSC::AssemblyHelpers::mutatorFence):
 571         (JSC::AssemblyHelpers::storeButterfly):
 572         (JSC::AssemblyHelpers::jumpIfMutatorFenceNotNeeded):
 573         (JSC::AssemblyHelpers::emitInitializeInlineStorage):
 574         (JSC::AssemblyHelpers::emitInitializeOutOfLineStorage):
 575         (JSC::AssemblyHelpers::jumpIfBarrierStoreLoadFenceNotNeeded): Deleted.
 576         * jit/JITInlines.h:
 577         (JSC::JIT::emitArrayProfilingSiteWithCell):
 578         * jit/JITOperations.cpp:
 579         * jit/JITPropertyAccess.cpp:
 580         (JSC::JIT::emit_op_put_to_scope):
 581         (JSC::JIT::emit_op_put_to_arguments):
 582         * llint/LLIntData.cpp:
 583         (JSC::LLInt::Data::performAssertions):
 584         * llint/LowLevelInterpreter.asm:
 585         * llint/LowLevelInterpreter64.asm:
 586         * runtime/ButterflyInlines.h:
 587         (JSC::Butterfly::create):
 588         (JSC::Butterfly::createOrGrowPropertyStorage):
 589         * runtime/ConcurrentJITLock.h:
 590         (JSC::GCSafeConcurrentJITLocker::NoDefer::NoDefer): Deleted.
 591         * runtime/GenericArgumentsInlines.h:
 592         (JSC::GenericArguments<Type>::getOwnPropertySlotByIndex):
 593         (JSC::GenericArguments<Type>::putByIndex):
 594         * runtime/IndexingType.h:
 595         * runtime/JSArray.cpp:
 596         (JSC::JSArray::unshiftCountSlowCase):
 597         (JSC::JSArray::unshiftCountWithArrayStorage):
 598         * runtime/JSCell.h:
 599         (JSC::JSCell::InternalLocker::InternalLocker):
 600         (JSC::JSCell::InternalLocker::~InternalLocker):
 601         (JSC::JSCell::atomicCompareExchangeCellStateWeakRelaxed):
 602         (JSC::JSCell::atomicCompareExchangeCellStateStrong):
 603         (JSC::JSCell::indexingTypeAndMiscOffset):
 604         (JSC::JSCell::indexingTypeOffset): Deleted.
 605         * runtime/JSCellInlines.h:
 606         (JSC::JSCell::JSCell):
 607         (JSC::JSCell::finishCreation):
 608         (JSC::JSCell::indexingTypeAndMisc):
 609         (JSC::JSCell::indexingType):
 610         (JSC::JSCell::setStructure):
 611         (JSC::JSCell::callDestructor):
 612         (JSC::JSCell::lockInternalLock):
 613         (JSC::JSCell::unlockInternalLock):
 614         * runtime/JSObject.cpp:
 615         (JSC::JSObject::visitButterfly):
 616         (JSC::JSObject::visitChildren):
 617         (JSC::JSFinalObject::visitChildren):
 618         (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
 619         (JSC::JSObject::createInitialUndecided):
 620         (JSC::JSObject::createInitialInt32):
 621         (JSC::JSObject::createInitialDouble):
 622         (JSC::JSObject::createInitialContiguous):
 623         (JSC::JSObject::createArrayStorage):
 624         (JSC::JSObject::convertUndecidedToArrayStorage):
 625         (JSC::JSObject::convertInt32ToArrayStorage):
 626         (JSC::JSObject::convertDoubleToArrayStorage):
 627         (JSC::JSObject::convertContiguousToArrayStorage):
 628         (JSC::JSObject::deleteProperty):
 629         (JSC::JSObject::defineOwnIndexedProperty):
 630         (JSC::JSObject::increaseVectorLength):
 631         (JSC::JSObject::ensureLengthSlow):
 632         (JSC::JSObject::reallocateAndShrinkButterfly):
 633         (JSC::JSObject::allocateMoreOutOfLineStorage):
 634         (JSC::JSObject::shiftButterflyAfterFlattening):
 635         (JSC::JSObject::growOutOfLineStorage): Deleted.
 636         * runtime/JSObject.h:
 637         (JSC::JSFinalObject::JSFinalObject):
 638         (JSC::JSObject::setButterfly):
 639         (JSC::JSObject::getOwnNonIndexPropertySlot):
 640         (JSC::JSObject::fillCustomGetterPropertySlot):
 641         (JSC::JSObject::getOwnPropertySlot):
 642         (JSC::JSObject::getPropertySlot):
 643         (JSC::JSObject::setStructureAndButterfly): Deleted.
 644         (JSC::JSObject::setButterflyWithoutChangingStructure): Deleted.
 645         (JSC::JSObject::putDirectInternal): Deleted.
 646         (JSC::JSObject::putDirectWithoutTransition): Deleted.
 647         * runtime/JSObjectInlines.h:
 648         (JSC::JSObject::getPropertySlot):
 649         (JSC::JSObject::getNonIndexPropertySlot):
 650         (JSC::JSObject::putDirectWithoutTransition):
 651         (JSC::JSObject::putDirectInternal):
 652         * runtime/Options.h:
 653         * runtime/SparseArrayValueMap.h:
 654         * runtime/Structure.cpp:
 655         (JSC::Structure::dumpStatistics):
 656         (JSC::Structure::findStructuresAndMapForMaterialization):
 657         (JSC::Structure::materializePropertyTable):
 658         (JSC::Structure::addNewPropertyTransition):
 659         (JSC::Structure::changePrototypeTransition):
 660         (JSC::Structure::attributeChangeTransition):
 661         (JSC::Structure::toDictionaryTransition):
 662         (JSC::Structure::takePropertyTableOrCloneIfPinned):
 663         (JSC::Structure::nonPropertyTransition):
 664         (JSC::Structure::isSealed):
 665         (JSC::Structure::isFrozen):
 666         (JSC::Structure::flattenDictionaryStructure):
 667         (JSC::Structure::pin):
 668         (JSC::Structure::pinForCaching):
 669         (JSC::Structure::willStoreValueSlow):
 670         (JSC::Structure::copyPropertyTableForPinning):
 671         (JSC::Structure::add):
 672         (JSC::Structure::remove):
 673         (JSC::Structure::getPropertyNamesFromStructure):
 674         (JSC::Structure::visitChildren):
 675         (JSC::Structure::materializePropertyMap): Deleted.
 676         (JSC::Structure::addPropertyWithoutTransition): Deleted.
 677         (JSC::Structure::removePropertyWithoutTransition): Deleted.
 678         (JSC::Structure::copyPropertyTable): Deleted.
 679         (JSC::Structure::createPropertyMap): Deleted.
 680         (JSC::PropertyTable::checkConsistency): Deleted.
 681         (JSC::Structure::checkConsistency): Deleted.
 682         * runtime/Structure.h:
 683         * runtime/StructureIDBlob.h:
 684         (JSC::StructureIDBlob::StructureIDBlob):
 685         (JSC::StructureIDBlob::indexingTypeIncludingHistory):
 686         (JSC::StructureIDBlob::setIndexingTypeIncludingHistory):
 687         (JSC::StructureIDBlob::indexingTypeIncludingHistoryOffset):
 688         (JSC::StructureIDBlob::indexingType): Deleted.
 689         (JSC::StructureIDBlob::setIndexingType): Deleted.
 690         (JSC::StructureIDBlob::indexingTypeOffset): Deleted.
 691         * runtime/StructureInlines.h:
 692         (JSC::Structure::get):
 693         (JSC::Structure::checkOffsetConsistency):
 694         (JSC::Structure::checkConsistency):
 695         (JSC::Structure::add):
 696         (JSC::Structure::remove):
 697         (JSC::Structure::addPropertyWithoutTransition):
 698         (JSC::Structure::removePropertyWithoutTransition):
 699         (JSC::Structure::setPropertyTable):
 700         (JSC::Structure::putWillGrowOutOfLineStorage): Deleted.
 701         (JSC::Structure::propertyTable): Deleted.
 702         (JSC::Structure::suggestedNewOutOfLineStorageCapacity): Deleted.
 703
 704 2016-11-14  Keith Miller  <keith_miller@apple.com>
 705
 706         Add Wasm select
 707         https://bugs.webkit.org/show_bug.cgi?id=164743
 708
 709         Reviewed by Saam Barati.
 710
 711         Also, this patch fixes an issue with the jsc.cpp test harness where negative numbers would be sign extended
 712         when they shouldn't be.
 713
 714         * jsc.cpp:
 715         (box):
 716         * wasm/WasmB3IRGenerator.cpp:
 717         * wasm/WasmFunctionParser.h:
 718         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 719         * wasm/WasmValidate.cpp:
 720         (JSC::Wasm::Validate::addSelect):
 721
 722 2016-11-11  Geoffrey Garen  <ggaren@apple.com>
 723
 724         JSC should distinguish between local and global eval
 725         https://bugs.webkit.org/show_bug.cgi?id=164628
 726
 727         Reviewed by Saam Barati.
 728
 729         Local use of the 'eval' keyword and invocation of the global window.eval
 730         function are distinct operations in JavaScript.
 731
 732         This patch splits out LocalEvalExecutable vs GlobalEvalExecutable in
 733         order to help distinguish these operations in code.
 734
 735         Our code used to do some silly things for lack of distinguishing these
 736         cases. For example, it would double cache local eval in CodeCache and
 737         EvalCodeCache. This made CodeCache seem more complicated than it really
 738         was.
 739
 740         * CMakeLists.txt:
 741         * JavaScriptCore.xcodeproj/project.pbxproj: Added some files.
 742
 743         * bytecode/CodeBlock.h:
 744
 745         * bytecode/EvalCodeCache.h:
 746         (JSC::EvalCodeCache::tryGet):
 747         (JSC::EvalCodeCache::set):
 748         (JSC::EvalCodeCache::getSlow): Deleted. Moved code generation out of
 749         the cache to avoid tight coupling. Now the cache just caches.
 750
 751         * bytecode/UnlinkedEvalCodeBlock.h:
 752         * bytecode/UnlinkedFunctionExecutable.cpp:
 753         (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
 754         * bytecode/UnlinkedModuleProgramCodeBlock.h:
 755         * bytecode/UnlinkedProgramCodeBlock.h:
 756         * debugger/DebuggerCallFrame.cpp:
 757         (JSC::DebuggerCallFrame::evaluateWithScopeExtension): Updated for interface
 758         changes.
 759
 760         * interpreter/Interpreter.cpp:
 761         (JSC::eval): Moved code generation here so the cache didn't need to build
 762         it in.
 763
 764         * llint/LLIntOffsetsExtractor.cpp:
 765
 766         * runtime/CodeCache.cpp:
 767         (JSC::CodeCache::getUnlinkedGlobalCodeBlock): No need to check for TDZ
 768         variables any more. We only cache global programs, and global variable
 769         access always does TDZ checks.
 770
 771         (JSC::CodeCache::getUnlinkedProgramCodeBlock):
 772         (JSC::CodeCache::getUnlinkedGlobalEvalCodeBlock):
 773         (JSC::CodeCache::getUnlinkedModuleProgramCodeBlock):
 774         (JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):
 775
 776         (JSC::CodeCache::CodeCache): Deleted.
 777         (JSC::CodeCache::~CodeCache): Deleted.
 778         (JSC::CodeCache::getGlobalCodeBlock): Deleted.
 779         (JSC::CodeCache::getProgramCodeBlock): Deleted.
 780         (JSC::CodeCache::getEvalCodeBlock): Deleted.
 781         (JSC::CodeCache::getModuleProgramCodeBlock): Deleted.
 782         (JSC::CodeCache::getFunctionExecutableFromGlobalCode): Deleted.
 783
 784         * runtime/CodeCache.h:
 785         (JSC::CodeCache::clear):
 786         (JSC::generateUnlinkedCodeBlock): Moved unlinked code block creation
 787         out of the CodeCache class and into a stand-alone function because
 788         we need it for local eval, which does not live in CodeCache.
 789
 790         * runtime/EvalExecutable.cpp:
 791         (JSC::EvalExecutable::create): Deleted.
 792         * runtime/EvalExecutable.h:
 793         (): Deleted.
 794         * runtime/GlobalEvalExecutable.cpp: Added.
 795         (JSC::GlobalEvalExecutable::create):
 796         (JSC::GlobalEvalExecutable::GlobalEvalExecutable):
 797         * runtime/GlobalEvalExecutable.h: Added.
 798         * runtime/LocalEvalExecutable.cpp: Added.
 799         (JSC::LocalEvalExecutable::create):
 800         (JSC::LocalEvalExecutable::LocalEvalExecutable):
 801         * runtime/LocalEvalExecutable.h: Added. Split out Local vs Global
 802         EvalExecutable classes to distinguish these operations in code. The key
 803         difference is that LocalEvalExecutable does not live in the CodeCache
 804         and only lives in the EvalCodeCache.
 805
 806         * runtime/JSGlobalObject.cpp:
 807         (JSC::JSGlobalObject::createProgramCodeBlock):
 808         (JSC::JSGlobalObject::createLocalEvalCodeBlock):
 809         (JSC::JSGlobalObject::createGlobalEvalCodeBlock):
 810         (JSC::JSGlobalObject::createModuleProgramCodeBlock):
 811         (JSC::JSGlobalObject::createEvalCodeBlock): Deleted.
 812         * runtime/JSGlobalObject.h:
 813         * runtime/JSGlobalObjectFunctions.cpp:
 814         (JSC::globalFuncEval):
 815
 816         * runtime/JSScope.cpp:
 817         (JSC::JSScope::collectClosureVariablesUnderTDZ):
 818         (JSC::JSScope::collectVariablesUnderTDZ): Deleted. We don't include
 819         global lexical variables in our concept of TDZ scopes anymore. Global
 820         variable access always does TDZ checks unconditionally. So, only closure
 821         scope accesses give specific consideration to TDZ checks.
 822
 823         * runtime/JSScope.h:
 824
 825 2016-11-14  Caitlin Potter  <caitp@igalia.com>
 826
 827         [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
 828         https://bugs.webkit.org/show_bug.cgi?id=164037
 829
 830         Reviewed by Yusuke Suzuki.
 831
 832         This patch introduces new_async_func / new_async_func_exp into DFG and FTL,
 833         in much the same capacity that https://trac.webkit.org/changeset/194216 added
 834         DFG / FTL support for generators: by adding new DFG nodes (NewAsyncFunction and
 835         PhantomNewAsyncFunction), rather than extending the existing NewFunction node type.
 836
 837         Like NewFunction and PhantomNewFunction, and the Generator variants, allocation of
 838         async wrapper functions may be deferred or eliminated during the allocation sinking
 839         phase.
 840
 841         * dfg/DFGAbstractInterpreterInlines.h:
 842         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
 843         * dfg/DFGByteCodeParser.cpp:
 844         (JSC::DFG::ByteCodeParser::parseBlock):
 845         * dfg/DFGCapabilities.cpp:
 846         (JSC::DFG::capabilityLevel):
 847         * dfg/DFGClobberize.h:
 848         (JSC::DFG::clobberize):
 849         * dfg/DFGClobbersExitState.cpp:
 850         (JSC::DFG::clobbersExitState):
 851         * dfg/DFGDoesGC.cpp:
 852         (JSC::DFG::doesGC):
 853         * dfg/DFGFixupPhase.cpp:
 854         (JSC::DFG::FixupPhase::fixupNode):
 855         * dfg/DFGMayExit.cpp:
 856         * dfg/DFGNode.h:
 857         (JSC::DFG::Node::convertToPhantomNewFunction):
 858         (JSC::DFG::Node::convertToPhantomNewAsyncFunction):
 859         (JSC::DFG::Node::hasCellOperand):
 860         (JSC::DFG::Node::isFunctionAllocation):
 861         (JSC::DFG::Node::isPhantomFunctionAllocation):
 862         (JSC::DFG::Node::isPhantomAllocation):
 863         * dfg/DFGNodeType.h:
 864         * dfg/DFGObjectAllocationSinkingPhase.cpp:
 865         * dfg/DFGPredictionPropagationPhase.cpp:
 866         * dfg/DFGSafeToExecute.h:
 867         (JSC::DFG::safeToExecute):
 868         * dfg/DFGSpeculativeJIT.cpp:
 869         (JSC::DFG::SpeculativeJIT::compileNewFunction):
 870         * dfg/DFGSpeculativeJIT32_64.cpp:
 871         (JSC::DFG::SpeculativeJIT::compile):
 872         * dfg/DFGSpeculativeJIT64.cpp:
 873         (JSC::DFG::SpeculativeJIT::compile):
 874         * dfg/DFGStoreBarrierInsertionPhase.cpp:
 875         * dfg/DFGStructureRegistrationPhase.cpp:
 876         (JSC::DFG::StructureRegistrationPhase::run):
 877         * dfg/DFGValidate.cpp:
 878         * ftl/FTLCapabilities.cpp:
 879         (JSC::FTL::canCompile):
 880         * ftl/FTLLowerDFGToB3.cpp:
 881         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
 882         (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
 883         * ftl/FTLOperations.cpp:
 884         (JSC::FTL::operationPopulateObjectInOSR):
 885         (JSC::FTL::operationMaterializeObjectInOSR):
 886         * runtime/JSGlobalObject.cpp:
 887         (JSC::JSGlobalObject::init):
 888         (JSC::JSGlobalObject::visitChildren):
 889         * runtime/JSGlobalObject.h:
 890         (JSC::JSGlobalObject::asyncFunctionPrototype):
 891         (JSC::JSGlobalObject::asyncFunctionStructure):
 892         (JSC::JSGlobalObject::lazyAsyncFunctionStructure): Deleted.
 893         (JSC::JSGlobalObject::asyncFunctionPrototypeConcurrently): Deleted.
 894         (JSC::JSGlobalObject::asyncFunctionStructureConcurrently): Deleted.
 895
 896 2016-11-14  Mark Lam  <mark.lam@apple.com>
 897
 898         Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
 899         https://bugs.webkit.org/show_bug.cgi?id=164701
 900         <rdar://problem/27462104>
 901
 902         Reviewed by Darin Adler.
 903
 904         The characters8(), characters16(), and operator[] in JSString::SafeView converts
 905         the underlying JSString to a StringView via get(), and then uses the StringView
 906         without first checking if an exception was thrown during the conversion.  This is
 907         unsafe because the conversion may have failed.
 908
 909         Instead, we should remove these 3 convenience methods, and make the caller
 910         explicitly call get() and do the appropriate exception checks before using the
 911         StringView.
 912
 913         * runtime/JSGlobalObjectFunctions.cpp:
 914         (JSC::toStringView):
 915         (JSC::encode):
 916         (JSC::decode):
 917         (JSC::globalFuncParseInt):
 918         (JSC::globalFuncEscape):
 919         (JSC::globalFuncUnescape):
 920         (JSC::toSafeView): Deleted.
 921         * runtime/JSONObject.cpp:
 922         (JSC::JSONProtoFuncParse):
 923         * runtime/JSString.h:
 924         (JSC::JSString::SafeView::length):
 925         (JSC::JSString::SafeView::characters8): Deleted.
 926         (JSC::JSString::SafeView::characters16): Deleted.
 927         (JSC::JSString::SafeView::operator[]): Deleted.
 928         * runtime/StringPrototype.cpp:
 929         (JSC::stringProtoFuncRepeatCharacter):
 930         (JSC::stringProtoFuncCharAt):
 931         (JSC::stringProtoFuncCharCodeAt):
 932         (JSC::stringProtoFuncNormalize):
 933
 934 2016-11-14  Mark Lam  <mark.lam@apple.com>
 935
 936         RegExpObject::exec/match should handle errors gracefully.
 937         https://bugs.webkit.org/show_bug.cgi?id=155145
 938         <rdar://problem/27435934>
 939
 940         Reviewed by Keith Miller.
 941
 942         1. Added some missing exception checks to RegExpObject::execInline() and
 943            RegExpObject::matchInline().
 944         2. Updated related code to work with ExceptionScope verification requirements.
 945
 946         * dfg/DFGOperations.cpp:
 947         * runtime/RegExpObjectInlines.h:
 948         (JSC::RegExpObject::execInline):
 949         (JSC::RegExpObject::matchInline):
 950         * runtime/RegExpPrototype.cpp:
 951         (JSC::regExpProtoFuncTestFast):
 952         (JSC::regExpProtoFuncExec):
 953         (JSC::regExpProtoFuncMatchFast):
 954
 955 2016-11-13  Mark Lam  <mark.lam@apple.com>
 956
 957         Add debugging facility to limit the max single allocation size.
 958         https://bugs.webkit.org/show_bug.cgi?id=164681
 959
 960         Reviewed by Keith Miller.
 961
 962         Added JSC option to set FastMalloc's maxSingleAllocationSize for testing purposes.
 963         This option is only available on Debug builds.
 964
 965         * runtime/Options.cpp:
 966         (JSC::Options::isAvailable):
 967         (JSC::recomputeDependentOptions):
 968         * runtime/Options.h:
 969
 970 2016-11-12  Joseph Pecoraro  <pecoraro@apple.com>
 971
 972         Follow-up fix to r208639.
 973
 974         Unreviewed fix. This is a straightfoward change where I forgot to
 975         switch from uncheckedArgument() to argument() in once case after
 976         dropping an argumentCount check. All other cases do this properly.
 977         This addresses an ASSERT seen on the bots running tests.
 978
 979         * runtime/JSDataViewPrototype.cpp:
 980         (JSC::setData):
 981
 982 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
 983
 984         test262: DataView with explicit undefined byteLength should be the same as it not being present
 985         https://bugs.webkit.org/show_bug.cgi?id=164453
 986
 987         Reviewed by Darin Adler.
 988
 989         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
 990         (JSC::constructGenericTypedArrayView):
 991         Handle the special case of DataView construction with an undefined byteLength value.
 992
 993 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
 994
 995         test262: DataView get methods should allow for missing offset, set methods should allow for missing value
 996         https://bugs.webkit.org/show_bug.cgi?id=164451
 997
 998         Reviewed by Darin Adler.
 999
1000         * runtime/JSDataViewPrototype.cpp:
1001         (JSC::getData):
1002         Missing offset is still valid and will be coerced to 0.
1003
1004         (JSC::setData):
1005         Missing value is still valid and will be coerced to 0.
1006
1007 2016-11-11  Saam Barati  <sbarati@apple.com>
1008
1009         We should have a more concise way of determining when we're varargs calling a function using rest parameters
1010         https://bugs.webkit.org/show_bug.cgi?id=164258
1011
1012         Reviewed by Yusuke Suzuki.
1013
1014         This patch adds two new bytecodes and DFG nodes for the following code patterns:
1015
1016         ```
1017         foo(a, b, ...c)
1018         let x = [a, b, ...c];
1019         ```
1020
1021         To do this, I've introduced two new bytecode operations (and their
1022         corresponding DFG nodes):
1023
1024         op_spread and op_new_array_with_spread.
1025
1026         op_spread takes a single input and performs the ES6 iteration protocol on it.
1027         It returns the result of doing the spread inside a new class I've
1028         made called JSFixedArray. JSFixedArray is a cell with a single 'size'
1029         field and a buffer of values allocated inline in the cell. Abstracting
1030         the protocol into a single node is good because it will make IR analysis
1031         in the future much simpler. For now, it's also good because it allows
1032         us to create fast paths for array iteration (which is quite common).
1033         This fast path allows us to emit really good code for array iteration
1034         inside the DFG/FTL.
1035
1036         op_new_array_with_spread is a variable argument bytecode that also
1037         has a bit vector associated with it. The bit vector indicates if
1038         any particular argument is to be spread or not. Arguments that
1039         are spread are known to be JSFixedArray because we must emit an
1040         op_spread before op_new_array_with_spread consumes the value.
1041         For example, for this array:
1042         [a, b, ...c, d, ...e]
1043         we will have this bit vector:
1044         [0, 0, 1, 0, 1]
1045
1046         The reason I've chosen this IR is that it will make eliminating
1047         a rest allocation for this type of code much easier:
1048
1049         ```
1050         function foo(...args) {
1051             return bar(a, b, ...args);
1052         }
1053         ```
1054
1055         It will be easier to analyze the IR now that the operations
1056         will be described at a high level.
1057
1058         This patch is an ~8% speedup on ES6SampleBench on my MBP.
1059
1060         * CMakeLists.txt:
1061         * DerivedSources.make:
1062         * JavaScriptCore.xcodeproj/project.pbxproj:
1063         * builtins/IteratorHelpers.js: Added.
1064         (performIteration):
1065         * bytecode/BytecodeList.json:
1066         * bytecode/BytecodeUseDef.h:
1067         (JSC::computeUsesForBytecodeOffset):
1068         (JSC::computeDefsForBytecodeOffset):
1069         * bytecode/CodeBlock.cpp:
1070         (JSC::CodeBlock::dumpBytecode):
1071         * bytecode/ObjectPropertyConditionSet.cpp:
1072         (JSC::generateConditionForSelfEquivalence):
1073         * bytecode/ObjectPropertyConditionSet.h:
1074         * bytecode/TrackedReferences.cpp:
1075         (JSC::TrackedReferences::check):
1076         * bytecode/UnlinkedCodeBlock.h:
1077         (JSC::UnlinkedCodeBlock::bitVectors):
1078         (JSC::UnlinkedCodeBlock::bitVector):
1079         (JSC::UnlinkedCodeBlock::addBitVector):
1080         (JSC::UnlinkedCodeBlock::shrinkToFit):
1081         * bytecompiler/BytecodeGenerator.cpp:
1082         (JSC::BytecodeGenerator::emitNewArrayWithSpread):
1083         * bytecompiler/BytecodeGenerator.h:
1084         * bytecompiler/NodesCodegen.cpp:
1085         (JSC::ArrayNode::emitBytecode):
1086         * dfg/DFGAbstractInterpreterInlines.h:
1087         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1088         * dfg/DFGByteCodeParser.cpp:
1089         (JSC::DFG::ByteCodeParser::addToGraph):
1090         (JSC::DFG::ByteCodeParser::parseBlock):
1091         * dfg/DFGCapabilities.cpp:
1092         (JSC::DFG::capabilityLevel):
1093         * dfg/DFGClobberize.h:
1094         (JSC::DFG::clobberize):
1095         * dfg/DFGDoesGC.cpp:
1096         (JSC::DFG::doesGC):
1097         * dfg/DFGFixupPhase.cpp:
1098         (JSC::DFG::FixupPhase::fixupNode):
1099         (JSC::DFG::FixupPhase::watchHavingABadTime):
1100         * dfg/DFGGraph.h:
1101         (JSC::DFG::Graph::isWatchingArrayIteratorProtocolWatchpoint):
1102         * dfg/DFGNode.h:
1103         (JSC::DFG::Node::bitVector):
1104         * dfg/DFGNodeType.h:
1105         * dfg/DFGOperations.cpp:
1106         * dfg/DFGOperations.h:
1107         * dfg/DFGPredictionPropagationPhase.cpp:
1108         * dfg/DFGSafeToExecute.h:
1109         (JSC::DFG::safeToExecute):
1110         * dfg/DFGSpeculativeJIT.cpp:
1111         (JSC::DFG::SpeculativeJIT::compileSpread):
1112         (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):
1113         * dfg/DFGSpeculativeJIT.h:
1114         (JSC::DFG::SpeculativeJIT::callOperation):
1115         * dfg/DFGSpeculativeJIT32_64.cpp:
1116         (JSC::DFG::SpeculativeJIT::compile):
1117         * dfg/DFGSpeculativeJIT64.cpp:
1118         (JSC::DFG::SpeculativeJIT::compile):
1119         * dfg/DFGStructureRegistrationPhase.cpp:
1120         (JSC::DFG::StructureRegistrationPhase::run):
1121         * ftl/FTLAbstractHeapRepository.h:
1122         * ftl/FTLCapabilities.cpp:
1123         (JSC::FTL::canCompile):
1124         * ftl/FTLLowerDFGToB3.cpp:
1125         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1126         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
1127         (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
1128         (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
1129         * jit/AssemblyHelpers.h:
1130         (JSC::AssemblyHelpers::emitAllocateVariableSizedCell):
1131         (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
1132         * jit/JIT.cpp:
1133         (JSC::JIT::privateCompileMainPass):
1134         * jit/JIT.h:
1135         * jit/JITOpcodes.cpp:
1136         (JSC::JIT::emit_op_new_array_with_spread):
1137         (JSC::JIT::emit_op_spread):
1138         * jit/JITOperations.h:
1139         * llint/LLIntData.cpp:
1140         (JSC::LLInt::Data::performAssertions):
1141         * llint/LLIntSlowPaths.cpp:
1142         * llint/LowLevelInterpreter.asm:
1143         * runtime/ArrayIteratorAdaptiveWatchpoint.cpp: Added.
1144         (JSC::ArrayIteratorAdaptiveWatchpoint::ArrayIteratorAdaptiveWatchpoint):
1145         (JSC::ArrayIteratorAdaptiveWatchpoint::handleFire):
1146         * runtime/ArrayIteratorAdaptiveWatchpoint.h: Added.
1147         * runtime/CommonSlowPaths.cpp:
1148         (JSC::SLOW_PATH_DECL):
1149         * runtime/CommonSlowPaths.h:
1150         * runtime/IteratorOperations.h:
1151         (JSC::forEachInIterable):
1152         * runtime/JSCInlines.h:
1153         * runtime/JSFixedArray.cpp: Added.
1154         (JSC::JSFixedArray::visitChildren):
1155         * runtime/JSFixedArray.h: Added.
1156         (JSC::JSFixedArray::createStructure):
1157         (JSC::JSFixedArray::createFromArray):
1158         (JSC::JSFixedArray::get):
1159         (JSC::JSFixedArray::buffer):
1160         (JSC::JSFixedArray::size):
1161         (JSC::JSFixedArray::offsetOfSize):
1162         (JSC::JSFixedArray::offsetOfData):
1163         (JSC::JSFixedArray::create):
1164         (JSC::JSFixedArray::JSFixedArray):
1165         (JSC::JSFixedArray::allocationSize):
1166         * runtime/JSGlobalObject.cpp:
1167         (JSC::JSGlobalObject::JSGlobalObject):
1168         (JSC::JSGlobalObject::init):
1169         (JSC::JSGlobalObject::visitChildren):
1170         (JSC::JSGlobalObject::objectPrototypeIsSane): Deleted.
1171         (JSC::JSGlobalObject::arrayPrototypeChainIsSane): Deleted.
1172         (JSC::JSGlobalObject::stringPrototypeChainIsSane): Deleted.
1173         * runtime/JSGlobalObject.h:
1174         (JSC::JSGlobalObject::arrayIteratorProtocolWatchpoint):
1175         (JSC::JSGlobalObject::iteratorProtocolFunction):
1176         * runtime/JSGlobalObjectInlines.h: Added.
1177         (JSC::JSGlobalObject::objectPrototypeIsSane):
1178         (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
1179         (JSC::JSGlobalObject::stringPrototypeChainIsSane):
1180         (JSC::JSGlobalObject::isArrayIteratorProtocolFastAndNonObservable):
1181         * runtime/JSType.h:
1182         * runtime/VM.cpp:
1183         (JSC::VM::VM):
1184         * runtime/VM.h:
1185
1186 2016-11-11  Keith Miller  <keith_miller@apple.com>
1187
1188         Move Wasm tests to JS
1189         https://bugs.webkit.org/show_bug.cgi?id=164611
1190
1191         Reviewed by Geoffrey Garen.
1192
1193         This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
1194         ommited tests were earliest tests, which tested trivial things, like adding two
1195         constants. Some tests are ommited for other reasons, however. These are:
1196
1197         1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
1198         Tests that would validate the memory of the module once wasm was done with it since that's
1199         not really possible in JS.
1200
1201         In order to make such a translation easier this patch also adds some features to the JS
1202         testing api:
1203
1204         1) Blocks can now be done lexically by adding a lambda as the last argument of the block
1205         opcode. For example one can do:
1206             ...
1207             .Block("i32", b => b.I32Const(1) )
1208
1209         and the nested lambda will automatically have an end attached.
1210
1211         2) The JS testing api can now handle inline signature types.
1212
1213         3) Relocate some code to make it easier to follow and prevent 44 space indentation.
1214
1215         4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
1216         wasm.json without being remapped.
1217
1218         5) Add support for Memory and Function sections to the Builder.
1219
1220         6) Add support for local variables.
1221
1222         On the JSC side, we needed to expose a new function to validate the compiled wasm code
1223         behaves the way we expect. At least until the JS Wasm API is finished. The new validation
1224         function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
1225         number of functions in the blob and tests for each of those functions.
1226
1227         * jsc.cpp:
1228         (GlobalObject::finishCreation):
1229         (box):
1230         (callWasmFunction):
1231         (functionTestWasmModuleFunctions):
1232         * testWasm.cpp:
1233         (checkPlan):
1234         (runWasmTests):
1235         * wasm/WasmB3IRGenerator.cpp:
1236         (JSC::Wasm::parseAndCompile):
1237         * wasm/WasmFunctionParser.h:
1238         (JSC::Wasm::FunctionParser<Context>::parse):
1239         (JSC::Wasm::FunctionParser<Context>::parseBody):
1240         (JSC::Wasm::FunctionParser<Context>::parseBlock): Deleted.
1241         * wasm/WasmModuleParser.cpp:
1242         (JSC::Wasm::ModuleParser::parseMemory):
1243         (JSC::Wasm::ModuleParser::parseExport):
1244         * wasm/WasmPlan.cpp:
1245         (JSC::Wasm::Plan::Plan):
1246         (JSC::Wasm::Plan::run):
1247         * wasm/WasmPlan.h:
1248         * wasm/js/WebAssemblyModuleConstructor.cpp:
1249         (JSC::constructJSWebAssemblyModule):
1250
1251 2016-11-11  Saam Barati  <sbarati@apple.com>
1252
1253         Unreviewed try to fix windows build after https://bugs.webkit.org/show_bug.cgi?id=164650
1254
1255         * dfg/DFGByteCodeParser.cpp:
1256         (JSC::DFG::ByteCodeParser::parseBlock):
1257
1258 2016-11-11  Saam Barati  <sbarati@apple.com>
1259
1260         We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
1261         https://bugs.webkit.org/show_bug.cgi?id=164650
1262
1263         Reviewed by Geoffrey Garen.
1264
1265         Some code was incorrectly holding a lock when recursively calling
1266         back into the bytecode parser's via inlining a put_by_val as a put_by_id.
1267         This can cause a deadlock if the inlinee CodeBlock is something we're
1268         already holding a lock for. I've changed the range of the lock holder
1269         to be as narrow as possible.
1270
1271         * dfg/DFGByteCodeParser.cpp:
1272         (JSC::DFG::ByteCodeParser::parseBlock):
1273
1274 2016-11-11  Chris Dumez  <cdumez@apple.com>
1275
1276         Unreviewed, rolling out r208584.
1277
1278         Seems to have regressed Speedometer by 1% on Mac
1279
1280         Reverted changeset:
1281
1282         "We should have a more concise way of determining when we're
1283         varargs calling a function using rest parameters"
1284         https://bugs.webkit.org/show_bug.cgi?id=164258
1285         http://trac.webkit.org/changeset/208584
1286
1287 2016-11-11  Chris Dumez  <cdumez@apple.com>
1288
1289         Unreviewed, rolling out r208117 and r208160.
1290
1291         Regressed Speedometer by >1.5%
1292
1293         Reverted changesets:
1294
1295         "We should have a way of profiling when a get_by_id is pure
1296         and to emit a PureGetById in the DFG/FTL"
1297         https://bugs.webkit.org/show_bug.cgi?id=163305
1298         http://trac.webkit.org/changeset/208117
1299
1300         "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
1301         out"
1302         https://bugs.webkit.org/show_bug.cgi?id=164227
1303         http://trac.webkit.org/changeset/208160
1304
1305 2016-11-11  Saam Barati  <sbarati@apple.com>
1306
1307         We should have a more concise way of determining when we're varargs calling a function using rest parameters
1308         https://bugs.webkit.org/show_bug.cgi?id=164258
1309
1310         Reviewed by Yusuke Suzuki.
1311
1312         This patch adds two new bytecodes and DFG nodes for the following code patterns:
1313
1314         ```
1315         foo(a, b, ...c)
1316         let x = [a, b, ...c];
1317         ```
1318
1319         To do this, I've introduced two new bytecode operations (and their
1320         corresponding DFG nodes):
1321
1322         op_spread and op_new_array_with_spread.
1323
1324         op_spread takes a single input and performs the ES6 iteration protocol on it.
1325         It returns the result of doing the spread inside a new class I've
1326         made called JSFixedArray. JSFixedArray is a cell with a single 'size'
1327         field and a buffer of values allocated inline in the cell. Abstracting
1328         the protocol into a single node is good because it will make IR analysis
1329         in the future much simpler. For now, it's also good because it allows
1330         us to create fast paths for array iteration (which is quite common).
1331         This fast path allows us to emit really good code for array iteration
1332         inside the DFG/FTL.
1333
1334         op_new_array_with_spread is a variable argument bytecode that also
1335         has a bit vector associated with it. The bit vector indicates if
1336         any particular argument is to be spread or not. Arguments that
1337         are spread are known to be JSFixedArray because we must emit an
1338         op_spread before op_new_array_with_spread consumes the value.
1339         For example, for this array:
1340         [a, b, ...c, d, ...e]
1341         we will have this bit vector:
1342         [0, 0, 1, 0, 1]
1343
1344         The reason I've chosen this IR is that it will make eliminating
1345         a rest allocation for this type of code much easier:
1346
1347         ```
1348         function foo(...args) {
1349             return bar(a, b, ...args);
1350         }
1351         ```
1352
1353         It will be easier to analyze the IR now that the operations
1354         will be described at a high level.
1355
1356         This patch is an ~8% speedup on ES6SampleBench on my MBP.
1357
1358         * CMakeLists.txt:
1359         * DerivedSources.make:
1360         * JavaScriptCore.xcodeproj/project.pbxproj:
1361         * builtins/IteratorHelpers.js: Added.
1362         (performIteration):
1363         * bytecode/BytecodeList.json:
1364         * bytecode/BytecodeUseDef.h:
1365         (JSC::computeUsesForBytecodeOffset):
1366         (JSC::computeDefsForBytecodeOffset):
1367         * bytecode/CodeBlock.cpp:
1368         (JSC::CodeBlock::dumpBytecode):
1369         * bytecode/ObjectPropertyConditionSet.cpp:
1370         (JSC::generateConditionForSelfEquivalence):
1371         * bytecode/ObjectPropertyConditionSet.h:
1372         * bytecode/TrackedReferences.cpp:
1373         (JSC::TrackedReferences::check):
1374         * bytecode/UnlinkedCodeBlock.h:
1375         (JSC::UnlinkedCodeBlock::bitVectors):
1376         (JSC::UnlinkedCodeBlock::bitVector):
1377         (JSC::UnlinkedCodeBlock::addBitVector):
1378         (JSC::UnlinkedCodeBlock::shrinkToFit):
1379         * bytecompiler/BytecodeGenerator.cpp:
1380         (JSC::BytecodeGenerator::emitNewArrayWithSpread):
1381         * bytecompiler/BytecodeGenerator.h:
1382         * bytecompiler/NodesCodegen.cpp:
1383         (JSC::ArrayNode::emitBytecode):
1384         * dfg/DFGAbstractInterpreterInlines.h:
1385         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1386         * dfg/DFGByteCodeParser.cpp:
1387         (JSC::DFG::ByteCodeParser::addToGraph):
1388         (JSC::DFG::ByteCodeParser::parseBlock):
1389         * dfg/DFGCapabilities.cpp:
1390         (JSC::DFG::capabilityLevel):
1391         * dfg/DFGClobberize.h:
1392         (JSC::DFG::clobberize):
1393         * dfg/DFGDoesGC.cpp:
1394         (JSC::DFG::doesGC):
1395         * dfg/DFGFixupPhase.cpp:
1396         (JSC::DFG::FixupPhase::fixupNode):
1397         (JSC::DFG::FixupPhase::watchHavingABadTime):
1398         * dfg/DFGGraph.h:
1399         (JSC::DFG::Graph::isWatchingArrayIteratorProtocolWatchpoint):
1400         * dfg/DFGNode.h:
1401         (JSC::DFG::Node::bitVector):
1402         * dfg/DFGNodeType.h:
1403         * dfg/DFGOperations.cpp:
1404         * dfg/DFGOperations.h:
1405         * dfg/DFGPredictionPropagationPhase.cpp:
1406         * dfg/DFGSafeToExecute.h:
1407         (JSC::DFG::safeToExecute):
1408         * dfg/DFGSpeculativeJIT.cpp:
1409         (JSC::DFG::SpeculativeJIT::compileSpread):
1410         (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):
1411         * dfg/DFGSpeculativeJIT.h:
1412         (JSC::DFG::SpeculativeJIT::callOperation):
1413         * dfg/DFGSpeculativeJIT32_64.cpp:
1414         (JSC::DFG::SpeculativeJIT::compile):
1415         * dfg/DFGSpeculativeJIT64.cpp:
1416         (JSC::DFG::SpeculativeJIT::compile):
1417         * dfg/DFGStructureRegistrationPhase.cpp:
1418         (JSC::DFG::StructureRegistrationPhase::run):
1419         * ftl/FTLAbstractHeapRepository.h:
1420         * ftl/FTLCapabilities.cpp:
1421         (JSC::FTL::canCompile):
1422         * ftl/FTLLowerDFGToB3.cpp:
1423         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1424         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
1425         (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
1426         (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
1427         * jit/AssemblyHelpers.h:
1428         (JSC::AssemblyHelpers::emitAllocateVariableSizedCell):
1429         (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
1430         * jit/JIT.cpp:
1431         (JSC::JIT::privateCompileMainPass):
1432         * jit/JIT.h:
1433         * jit/JITOpcodes.cpp:
1434         (JSC::JIT::emit_op_new_array_with_spread):
1435         (JSC::JIT::emit_op_spread):
1436         * jit/JITOperations.h:
1437         * llint/LLIntData.cpp:
1438         (JSC::LLInt::Data::performAssertions):
1439         * llint/LLIntSlowPaths.cpp:
1440         * llint/LowLevelInterpreter.asm:
1441         * runtime/ArrayIteratorAdaptiveWatchpoint.cpp: Added.
1442         (JSC::ArrayIteratorAdaptiveWatchpoint::ArrayIteratorAdaptiveWatchpoint):
1443         (JSC::ArrayIteratorAdaptiveWatchpoint::handleFire):
1444         * runtime/ArrayIteratorAdaptiveWatchpoint.h: Added.
1445         * runtime/CommonSlowPaths.cpp:
1446         (JSC::SLOW_PATH_DECL):
1447         * runtime/CommonSlowPaths.h:
1448         * runtime/IteratorOperations.h:
1449         (JSC::forEachInIterable):
1450         * runtime/JSCInlines.h:
1451         * runtime/JSFixedArray.cpp: Added.
1452         (JSC::JSFixedArray::visitChildren):
1453         * runtime/JSFixedArray.h: Added.
1454         (JSC::JSFixedArray::createStructure):
1455         (JSC::JSFixedArray::createFromArray):
1456         (JSC::JSFixedArray::get):
1457         (JSC::JSFixedArray::buffer):
1458         (JSC::JSFixedArray::size):
1459         (JSC::JSFixedArray::offsetOfSize):
1460         (JSC::JSFixedArray::offsetOfData):
1461         (JSC::JSFixedArray::create):
1462         (JSC::JSFixedArray::JSFixedArray):
1463         (JSC::JSFixedArray::allocationSize):
1464         * runtime/JSGlobalObject.cpp:
1465         (JSC::JSGlobalObject::JSGlobalObject):
1466         (JSC::JSGlobalObject::init):
1467         (JSC::JSGlobalObject::visitChildren):
1468         (JSC::JSGlobalObject::objectPrototypeIsSane): Deleted.
1469         (JSC::JSGlobalObject::arrayPrototypeChainIsSane): Deleted.
1470         (JSC::JSGlobalObject::stringPrototypeChainIsSane): Deleted.
1471         * runtime/JSGlobalObject.h:
1472         (JSC::JSGlobalObject::arrayIteratorProtocolWatchpoint):
1473         (JSC::JSGlobalObject::iteratorProtocolFunction):
1474         * runtime/JSGlobalObjectInlines.h: Added.
1475         (JSC::JSGlobalObject::objectPrototypeIsSane):
1476         (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
1477         (JSC::JSGlobalObject::stringPrototypeChainIsSane):
1478         (JSC::JSGlobalObject::isArrayIteratorProtocolFastAndNonObservable):
1479         * runtime/JSType.h:
1480         * runtime/VM.cpp:
1481         (JSC::VM::VM):
1482         * runtime/VM.h:
1483
1484 2016-11-10  JF Bastien  <jfbastien@apple.com>
1485
1486         ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
1487         https://bugs.webkit.org/show_bug.cgi?id=164597
1488
1489         Reviewed by Keith Miller.
1490
1491         * wasm/WasmParser.h:
1492         (JSC::Wasm::Parser::parseVarUInt32): move closer to other parsers
1493         (JSC::Wasm::Parser::parseVarUInt64): move closer to other parsers
1494
1495 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
1496
1497         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
1498         https://bugs.webkit.org/show_bug.cgi?id=164450
1499
1500         Reviewed by Darin Adler.
1501
1502         * runtime/JSCJSValue.h:
1503         * runtime/JSCJSValueInlines.h:
1504         (JSC::JSValue::toIndex):
1505         Introduce a method for toIndex, which is used by DataView and TypedArrays
1506         to convert an argument to a number with the possibility of throwing
1507         RangeErrors for negative values. We also throw RangeErrors for large
1508         values, because wherever this is used we expect an unsigned.
1509
1510         * runtime/JSArrayBufferConstructor.cpp:
1511         (JSC::constructArrayBuffer):
1512         * runtime/JSDataViewPrototype.cpp:
1513         (JSC::getData):
1514         (JSC::setData):
1515         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
1516         (JSC::constructGenericTypedArrayViewWithArguments):
1517         (JSC::constructGenericTypedArrayView):
1518         Use toIndex instead of toUint32 where required.
1519
1520 2016-11-10  Mark Lam  <mark.lam@apple.com>
1521
1522         A few bits of minor code clean up.
1523         https://bugs.webkit.org/show_bug.cgi?id=164523
1524
1525         Reviewed by Yusuke Suzuki.
1526
1527         * interpreter/StackVisitor.cpp:
1528         (JSC::StackVisitor::Frame::dump):
1529         - Insert a space to make the dump more legible.
1530
1531         * runtime/Options.h:
1532         - Fixed some typos.
1533
1534         * runtime/StringPrototype.cpp:
1535         (JSC::stringProtoFuncReplaceUsingRegExp):
1536         (JSC::stringProtoFuncReplaceUsingStringSearch):
1537         - Use the VM& that is already available.
1538
1539 2016-11-10  Mark Lam  <mark.lam@apple.com>
1540
1541         Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
1542         https://bugs.webkit.org/show_bug.cgi?id=164600
1543         <rdar://problem/28828676>
1544
1545         Reviewed by Filip Pizlo.
1546
1547         Currently, Graph::methodOfGettingAValueProfileFor() assumes that the operand DFG
1548         node that it is provided with always has a different origin than the node that is
1549         using that operand.  For example, in a DFG graph that looks like this:
1550
1551             a: ...
1552             b: ArithAdd(@a, ...)
1553
1554         ... when emitting speculation checks on @a for the ArithAdd node at @b,
1555         Graph::methodOfGettingAValueProfileFor() is passed @a, and expects @a's to
1556         originate from a different bytecode than @b.  The intent here is to get the
1557         profile for @a so that the OSR exit ramp for @b can update @a's profile with the
1558         observed result type from @a so that future type prediction on incoming args for
1559         the ArithAdd node can take this into consideration.
1560
1561         However, op_negate can be compiled into the following series of nodes:
1562
1563             a: ...
1564             b: BooleanToNumber(@a)
1565             c: DoubleRep(@b)
1566             d: ArithNegate(@c)
1567
1568         All 3 nodes @b, @c, and @d maps to the same op_negate bytecode i.e. they have the
1569         same origin.  When the speculativeJIT emits a speculationCheck for DoubleRep, it
1570         calls Graph::methodOfGettingAValueProfileFor() to get the ArithProfile for the
1571         BooleanToNumber node.  But because all 3 nodes have the same origin,
1572         Graph::methodOfGettingAValueProfileFor() erroneously returns the ArithProfile for
1573         the op_negate.  Subsequently, the OSR exit ramp will modify the ArithProfile of
1574         the op_negate and corrupt its profile.  Instead, what the OSR exit ramp should be
1575         doing is update the ArithProfile of op_negate's operand i.e. BooleanToNumber's
1576         operand @a in this case.
1577
1578         The fix is to always pass the current node we're generating code for (in addition
1579         to the operand node) to Graph::methodOfGettingAValueProfileFor().  This way, we
1580         know the profile is valid if and only if the current node and its operand node
1581         does not have the same origin.
1582
1583         In this patch, we also fixed the following:
1584         1. Teach Graph::methodOfGettingAValueProfileFor() to get the profile for
1585            BooleanToNumber's operand if the operand node it is given is BooleanToNumber.
1586         2. Change JITCompiler::appendExceptionHandlingOSRExit() to explicitly pass an
1587            empty MethodOfGettingAValueProfile().  It was implicitly doing this before.
1588         3. Change SpeculativeJIT::emitInvalidationPoint() to pass an empty
1589            MethodOfGettingAValueProfile().  It has no child node.  Hence, it doesn't
1590            make sense to call Graph::methodOfGettingAValueProfileFor() for a child node
1591            that does not exist.
1592
1593         * dfg/DFGGraph.cpp:
1594         (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
1595         * dfg/DFGGraph.h:
1596         * dfg/DFGJITCompiler.cpp:
1597         (JSC::DFG::JITCompiler::appendExceptionHandlingOSRExit):
1598         * dfg/DFGSpeculativeJIT.cpp:
1599         (JSC::DFG::SpeculativeJIT::speculationCheck):
1600         (JSC::DFG::SpeculativeJIT::emitInvalidationPoint):
1601         * ftl/FTLLowerDFGToB3.cpp:
1602         (JSC::FTL::DFG::LowerDFGToB3::appendOSRExitDescriptor):
1603
1604 2016-11-10  Aaron Chu  <aaron_chu@apple.com>
1605
1606         Web Inspector: AXI: clarify button roles (e.g. toggle or popup button)
1607         https://bugs.webkit.org/show_bug.cgi?id=130726
1608         <rdar://problem/16420420>
1609
1610         Reviewed by Brian Burg.
1611
1612         Add the isPopupButton flag to the AccessibilityProperties type.
1613
1614         * inspector/protocol/DOM.json:
1615
1616 2016-11-10  Csaba Osztrogonác  <ossy@webkit.org>
1617
1618         [ARM] Unreviewed buildfix after r208450.
1619
1620         * assembler/MacroAssemblerARM.h:
1621         (JSC::MacroAssemblerARM::load8SignedExtendTo32): Added.
1622
1623 2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1624
1625         [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
1626         https://bugs.webkit.org/show_bug.cgi?id=164502
1627
1628         Reviewed by Saam Barati.
1629
1630         In many builtin functions, we use `arguments` to just get optional parameters.
1631         While FTL argument elimination can drop `arguments` allocations, it leaves
1632         the allocations in LLInt, Baseline, and DFG. And we found that DFG compiled
1633         Array#map is heavily used in ES6SampleBench/Basic. And it always creates
1634         a meaningless ClonedArguments.
1635
1636         Using ES6 default parameter here is not a solution. It increases the number
1637         of parameters of the CodeBlock (not `function.length`). And the optional
1638         parameters in Array.prototype.xxx methods are not typically passed. For
1639         example, we typically do not pass `thisArg` to `Array.prototype.map` function.
1640         In this case, the arity check frequently fails. It requires the additional C
1641         call to fixup arguments and it becomes pure overhead.
1642
1643         To solve this problem, this patch introduces a new bytecode intrinsic @argument().
1644         This offers the way to retrieve the argument value without increasing the
1645         arity of the function. And if the argument is not passed (out of bounds), it
1646         just returns `undefined`. The semantics of this intrinsic is the same to the C++
1647         ExecState::argument(). This operation does not require `arguments` object. And we
1648         can drop the `argument` references even in lower 3 tiers.
1649
1650         We implement op_get_argument for this intrinsic. And later this will be converted
1651         to DFG GetArgument node. All the tiers handles this feature.
1652
1653         This patch improves ES6SampleBench/Basic 13.8% in steady state. And in summary,
1654         it improves 4.5%.
1655
1656         In the future, we can improve the implementation of the default parameters.
1657         Currently, the default parameter always increases the arity of the function. So
1658         if you do not pass the argument, the arity check fails. But since it is the default
1659         parameter, it is likely that we don't pass the argument. Using op_get_argument to
1660         implement the default parameter can decrease the case in which the arity check
1661         frequently fails. And it can change the builtin implementation to use the ES6
1662         default parameters instead of using the special @argument() intrinsic in the future.
1663         And at that case, the user code also receives the benefit.
1664
1665         ES6SampleBench/Basic.
1666             Baseline:
1667                 Running... Basic ( 1  to go)
1668                 firstIteration:     39.38 ms +- 4.48 ms
1669                 averageWorstCase:   20.79 ms +- 0.96 ms
1670                 steadyState:        1959.22 ms +- 65.55 ms
1671
1672             Patched:
1673                 Running... Basic ( 1  to go)
1674                 firstIteration:     37.85 ms +- 4.09 ms
1675                 averageWorstCase:   18.60 ms +- 0.76 ms
1676                 steadyState:        1721.89 ms +- 57.58 ms
1677
1678         All summary.
1679             Baseline:
1680                 summary:            164.34 ms +- 5.01 ms
1681             Patched:
1682                 summary:            157.26 ms +- 5.96 ms
1683
1684         * builtins/ArrayConstructor.js:
1685         * builtins/ArrayPrototype.js:
1686         (reduce):
1687         (reduceRight):
1688         (every):
1689         (forEach):
1690         (filter):
1691         (map):
1692         (some):
1693         (fill):
1694         (find):
1695         (findIndex):
1696         (includes):
1697         (copyWithin):
1698         * builtins/DatePrototype.js:
1699         (toLocaleString):
1700         (toLocaleDateString):
1701         (toLocaleTimeString):
1702         * builtins/MapPrototype.js:
1703         (forEach):
1704         * builtins/NumberPrototype.js:
1705         (toLocaleString):
1706         * builtins/SetPrototype.js:
1707         (forEach):
1708         * builtins/StringPrototype.js:
1709         (padStart):
1710         (padEnd):
1711         (localeCompare):
1712         * builtins/TypedArrayConstructor.js:
1713         * builtins/TypedArrayPrototype.js:
1714         (every):
1715         (fill):
1716         (find):
1717         (findIndex):
1718         (forEach):
1719         (some):
1720         (reduce):
1721         (reduceRight):
1722         (map):
1723         (filter):
1724         * bytecode/BytecodeIntrinsicRegistry.h:
1725         * bytecode/BytecodeList.json:
1726         * bytecode/BytecodeUseDef.h:
1727         (JSC::computeUsesForBytecodeOffset):
1728         (JSC::computeDefsForBytecodeOffset):
1729         * bytecode/CodeBlock.cpp:
1730         (JSC::CodeBlock::dumpBytecode):
1731         (JSC::CodeBlock::finishCreation):
1732         * bytecompiler/BytecodeGenerator.cpp:
1733         (JSC::BytecodeGenerator::emitGetArgument):
1734         * bytecompiler/BytecodeGenerator.h:
1735         * bytecompiler/NodesCodegen.cpp:
1736         (JSC::BytecodeIntrinsicNode::emit_intrinsic_argument):
1737         * dfg/DFGAbstractInterpreterInlines.h:
1738         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1739         * dfg/DFGByteCodeParser.cpp:
1740         (JSC::DFG::ByteCodeParser::parseBlock):
1741         * dfg/DFGCapabilities.cpp:
1742         (JSC::DFG::capabilityLevel):
1743         * dfg/DFGClobberize.h:
1744         (JSC::DFG::clobberize):
1745         * dfg/DFGDoesGC.cpp:
1746         (JSC::DFG::doesGC):
1747         * dfg/DFGFixupPhase.cpp:
1748         (JSC::DFG::FixupPhase::fixupNode):
1749         * dfg/DFGNode.h:
1750         (JSC::DFG::Node::hasHeapPrediction):
1751         (JSC::DFG::Node::hasArgumentIndex):
1752         (JSC::DFG::Node::argumentIndex):
1753         * dfg/DFGNodeType.h:
1754         * dfg/DFGPreciseLocalClobberize.h:
1755         (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
1756         * dfg/DFGPredictionPropagationPhase.cpp:
1757         * dfg/DFGSafeToExecute.h:
1758         (JSC::DFG::safeToExecute):
1759         * dfg/DFGSpeculativeJIT.cpp:
1760         (JSC::DFG::SpeculativeJIT::compileGetArgument):
1761         * dfg/DFGSpeculativeJIT.h:
1762         * dfg/DFGSpeculativeJIT32_64.cpp:
1763         (JSC::DFG::SpeculativeJIT::compile):
1764         * dfg/DFGSpeculativeJIT64.cpp:
1765         (JSC::DFG::SpeculativeJIT::compile):
1766         * ftl/FTLCapabilities.cpp:
1767         (JSC::FTL::canCompile):
1768         * ftl/FTLLowerDFGToB3.cpp:
1769         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1770         (JSC::FTL::DFG::LowerDFGToB3::compileGetArgument):
1771         * jit/JIT.cpp:
1772         (JSC::JIT::privateCompileMainPass):
1773         * jit/JIT.h:
1774         * jit/JITOpcodes.cpp:
1775         (JSC::JIT::emit_op_get_argument):
1776         * jit/JITOpcodes32_64.cpp:
1777         (JSC::JIT::emit_op_get_argument):
1778         * llint/LowLevelInterpreter32_64.asm:
1779         * llint/LowLevelInterpreter64.asm:
1780
1781 2016-11-08  Joseph Pecoraro  <pecoraro@apple.com>
1782
1783         Web Inspector: DebuggerManager.Event.Resumed introduces test flakiness
1784         https://bugs.webkit.org/show_bug.cgi?id=161951
1785         <rdar://problem/28295767>
1786
1787         Reviewed by Brian Burg.
1788
1789         This removes an ambiguity in the protocol when stepping through
1790         JavaScript. Previously, when paused and issuing a Debugger.step*
1791         command the frontend would always receive a Debugger.resumed event and
1792         then, maybe, a Debugger.paused event indicating we paused again (after
1793         stepping). However, this ambiguity means that the frontend needs to
1794         wait for a short period of time to determine if we really resumed
1795         or not. And even still that decision may be incorrect if the step
1796         takes a sufficiently long period of time.
1797
1798         The new approach removes this ambiguity. Now, in response to a
1799         Debugger.step* command the backend MUST send a single Debugger.paused
1800         event or Debugger.resumed event. Now the frontend knows that the
1801         next Debugger event it receives after issuing the step command is
1802         the result (stepped and paused, or stepped and resumed).
1803
1804         To make resuming consistent in all cases, a Debugger.resume command
1805         will always respond with a Debugger.resumed event.
1806
1807         Finally, Debugger.continueToLocation is treated like a "big step"
1808         in cases where we can resolve the location. If we can't resolve the
1809         location it is treated as a resume, maintaining the old behavior.
1810
1811         * inspector/agents/InspectorDebuggerAgent.h:
1812         * inspector/agents/InspectorDebuggerAgent.cpp:
1813         (Inspector::InspectorDebuggerAgent::stepOver):
1814         (Inspector::InspectorDebuggerAgent::stepInto):
1815         (Inspector::InspectorDebuggerAgent::stepOut):
1816         (Inspector::InspectorDebuggerAgent::willStepAndMayBecomeIdle):
1817         (Inspector::InspectorDebuggerAgent::didBecomeIdleAfterStepping):
1818         When stepping register a VM exit observer so that we can issue
1819         a Debugger.resumed event if the step caused us to exit the VM.
1820
1821         (Inspector::InspectorDebuggerAgent::resume):
1822         Set a flag to issue a Debugger.resumed event once we break out
1823         of the nested run loop.
1824
1825         (Inspector::InspectorDebuggerAgent::didPause):
1826         We are issuing Debugger.paused so clear the state to indicate that
1827         we no longer need to issue Debugger.resumed event, we have paused.
1828
1829         (Inspector::InspectorDebuggerAgent::didContinue):
1830         Only issue the Debugger.resumed event if needed (explicitly asked
1831         to resume).
1832
1833         (Inspector::InspectorDebuggerAgent::continueToLocation):
1834         (Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState):
1835         All places that do continueProgram should be audited. In error cases,
1836         if we are paused and continue we should remember to send Debugger.resumed.
1837
1838         * inspector/protocol/Debugger.json:
1839         Clarify in the protocol description the contract of these methods.
1840
1841 2016-11-09  Joseph Pecoraro  <pecoraro@apple.com>
1842
1843         Web Inspector: Associate Worker Resources with the Worker and not the Page
1844         https://bugs.webkit.org/show_bug.cgi?id=164342
1845         <rdar://problem/29075775>
1846
1847         Reviewed by Timothy Hatcher.
1848
1849         * inspector/protocol/Network.json:
1850         * inspector/protocol/Page.json:
1851         Associate Resource data with a target.
1852
1853 2016-11-09  Keith Miller  <keith_miller@apple.com>
1854
1855         jsc CLI should work with the remote inspector
1856         https://bugs.webkit.org/show_bug.cgi?id=164569
1857
1858         Reviewed by Joseph Pecoraro.
1859
1860         This patch enables using the remote inspector on the jsc CLI.
1861         In order to use the remote inspector, jsc users need to pass an option.
1862
1863         * jsc.cpp:
1864         (CommandLine::parseArguments):
1865         (runJSC):
1866
1867 2016-11-09  Saam Barati  <sbarati@apple.com>
1868
1869         Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
1870         https://bugs.webkit.org/show_bug.cgi?id=164464
1871         <rdar://problem/29131452>
1872
1873         Reviewed by Darin Adler.
1874
1875         We were incorrectly matching this pattern inside the bytecode parser
1876         to return NaN. Instead, we must return:
1877           Infinity for Math.min()
1878          -Infinity for Math.max()
1879
1880         * dfg/DFGByteCodeParser.cpp:
1881         (JSC::DFG::ByteCodeParser::handleMinMax):
1882
1883 2016-11-09  Saam Barati  <sbarati@apple.com>
1884
1885         TypeProfiler and running GC collection on another thread don't play nicely with each other
1886         https://bugs.webkit.org/show_bug.cgi?id=164441
1887         <rdar://problem/29132174>
1888
1889         Reviewed by Geoffrey Garen.
1890
1891         This fix here is simple: we now treat the type profiler log as a GC root.
1892         GC will make sure that we mark any values/structures that are in the log.
1893         It's easy to reason about the correctness of this, and it also solves
1894         the problem that we were clearing the log on the GC thread. Clearing the
1895         log on the GC thread was a problem because when we clear the log, we may
1896         allocate, which we're not allowed to do from the GC thread.
1897
1898         * heap/Heap.cpp:
1899         (JSC::Heap::markRoots):
1900         (JSC::Heap::visitTypeProfiler):
1901         (JSC::Heap::collectInThread):
1902         * heap/Heap.h:
1903         * runtime/TypeProfilerLog.cpp:
1904         (JSC::TypeProfilerLog::processLogEntries):
1905         (JSC::TypeProfilerLog::visit):
1906         * runtime/TypeProfilerLog.h:
1907
1908 2016-11-09  JF Bastien  <jfbastien@apple.com>
1909
1910         WebAssembly: Silence noisy warning
1911         https://bugs.webkit.org/show_bug.cgi?id=164459
1912
1913         Reviewed by Yusuke Suzuki.
1914
1915         * wasm/WasmPlan.cpp:
1916         (JSC::Wasm::Plan::Plan):
1917
1918 2016-11-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1919
1920         [JSC] The implementation of 8 bit operation in MacroAssembler should care about uint8_t / int8_t
1921         https://bugs.webkit.org/show_bug.cgi?id=164432
1922
1923         Reviewed by Michael Saboff.
1924
1925         Except for X86, our supported MacroAssemblers do not have native 8bit instructions.
1926         It means that all the 8bit instructions are converted to 32bit operations by using
1927         scratch registers. For example, ARM64 branch8 implementation is the following.
1928
1929             Jump branch8(RelationCondition cord, Address left, TrustedImm32 right)
1930             {
1931                 TrustedImm32 right8(static_cast<int8_t>(right.m_value));
1932                 load8(left, getCachedMemoryTempRegisterIDAndInvalidate());
1933                 return branch32(cone, memoryTempRegister, right8);
1934             }
1935
1936         The problem is that we exclusively use zero-extended load instruction (load8). Even
1937         for signed RelationConditions, we do not perform sign extension. It makes signed
1938         operations with negative numbers incorrect! Consider the |left| address holds `-1`
1939         in int8_t form. However load8 will load it as 255 into 32bit register. On the other hand,
1940         |right| will be sign extended. If you pass 0 as |right| and LessThan condition, this
1941         branch8 should jump based on the answer of `-1 < 0`. But the current MacroAssembler
1942         performs `255 < 0` in int32_t context and returns the incorrect result.
1943
1944         We should follow the x86 model. So we should select the appropriate load operation and masking
1945         operation based on the RelationCondition. This patch introduces mask8OnCondition and load8OnCondition.
1946         And we use them in 8bit operations including branch8, branchTest8, compare8, and test8.
1947
1948         We intentionally do not change anything on x86 assembler since it has the native signed 8bit operations.
1949
1950         * JavaScriptCore.xcodeproj/project.pbxproj:
1951         * assembler/AbstractMacroAssembler.h:
1952         * assembler/MacroAssembler.h:
1953         (JSC::MacroAssembler::isSigned):
1954         (JSC::MacroAssembler::isUnsigned):
1955         (JSC::MacroAssembler::branchTest8):
1956         * assembler/MacroAssemblerARM.h:
1957         (JSC::MacroAssemblerARM::branch8):
1958         (JSC::MacroAssemblerARM::branchTest8):
1959         (JSC::MacroAssemblerARM::compare8):
1960         (JSC::MacroAssemblerARM::test8):
1961         * assembler/MacroAssemblerARM64.h:
1962         (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
1963         (JSC::MacroAssemblerARM64::branch8):
1964         (JSC::MacroAssemblerARM64::branchTest8):
1965         (JSC::MacroAssemblerARM64::compare8):
1966         (JSC::MacroAssemblerARM64::test8):
1967         * assembler/MacroAssemblerARMv7.h:
1968         (JSC::MacroAssemblerARMv7::branch8):
1969         (JSC::MacroAssemblerARMv7::branchTest8):
1970         (JSC::MacroAssemblerARMv7::compare8):
1971         (JSC::MacroAssemblerARMv7::test8):
1972         * assembler/MacroAssemblerHelpers.h: Added.
1973         (JSC::MacroAssemblerHelpers::isSigned):
1974         (JSC::MacroAssemblerHelpers::isUnsigned):
1975         (JSC::MacroAssemblerHelpers::mask8OnCondition):
1976         (JSC::MacroAssemblerHelpers::load8OnCondition):
1977         * assembler/MacroAssemblerMIPS.h:
1978         (JSC::MacroAssemblerMIPS::branch8):
1979         (JSC::MacroAssemblerMIPS::compare8):
1980         (JSC::MacroAssemblerMIPS::branchTest8):
1981         (JSC::MacroAssemblerMIPS::test8):
1982         * assembler/MacroAssemblerSH4.h:
1983         (JSC::MacroAssemblerSH4::branchTest8):
1984         (JSC::MacroAssemblerSH4::branch8):
1985         (JSC::MacroAssemblerSH4::compare8):
1986         (JSC::MacroAssemblerSH4::test8):
1987         * assembler/MacroAssemblerX86_64.h:
1988         (JSC::MacroAssemblerX86_64::branch8):
1989
1990 2016-11-08  Geoffrey Garen  <ggaren@apple.com>
1991
1992         REGRESSION: date-format-tofte.js is super slow
1993         https://bugs.webkit.org/show_bug.cgi?id=164499
1994
1995         Reviewed by Sam Weinig.
1996
1997         * bytecode/EvalCodeCache.h:
1998         (JSC::EvalCodeCache::CacheKey::operator==): Use character comparison,
1999         not pointer comparison. (This function was always wrong, but I started
2000         calling it in more places.)
2001
2002 2016-11-08  Saam Barati  <sbarati@apple.com>
2003
2004         REGRESSION: Crashes in StringImpl destructor during GC when clearing the HasOwnPropertyCache
2005         https://bugs.webkit.org/show_bug.cgi?id=164433
2006
2007         Reviewed by Mark Lam.
2008
2009         Clearing the HasOwnPropertyCache will call deref() on the StringImpls
2010         in the cache. We were doing this from the collector thread, which is
2011         not allowed. It must be done from the mutator thread. We now clear the
2012         cache in Heap::finalize() which happens before the mutator begins
2013         executing JS after a collection happens.
2014
2015         * heap/Heap.cpp:
2016         (JSC::Heap::collectInThread):
2017         (JSC::Heap::finalize):
2018
2019 2016-11-05  Konstantin Tokarev  <annulen@yandex.ru>
2020
2021         Fixed compilation of LLInt with MinGW
2022         https://bugs.webkit.org/show_bug.cgi?id=164449
2023
2024         Reviewed by Michael Catanzaro.
2025
2026         MinGW uses LLIntAssembly.h with GNU assembler syntax, just like GCC on
2027         other platforms.
2028
2029         * llint/LowLevelInterpreter.cpp: Include LLIntAssembly.h with
2030         appropriate preamble.
2031
2032 2016-11-04  Filip Pizlo  <fpizlo@apple.com>
2033
2034         WTF::ParkingLot should stop using std::chrono because std::chrono::duration casts are prone to overflows
2035         https://bugs.webkit.org/show_bug.cgi?id=152045
2036
2037         Reviewed by Andy Estes.
2038
2039         Probably the nicest example of why this patch is a good idea is the change in
2040         AtomicsObject.cpp.
2041
2042         * jit/ICStats.cpp:
2043         (JSC::ICStats::ICStats):
2044         * runtime/AtomicsObject.cpp:
2045         (JSC::atomicsFuncWait):
2046
2047 2016-11-04  JF Bastien  <jfbastien@apple.com>
2048
2049         testWASM should be very sad if no options are provided
2050         https://bugs.webkit.org/show_bug.cgi?id=164444
2051
2052         Reviewed by Saam Barati.
2053
2054         Detect missing or invalid options on the command line.
2055
2056         * testWasm.cpp:
2057         (CommandLine::parseArguments):
2058
2059 2016-11-04  Mark Lam  <mark.lam@apple.com>
2060
2061         Error description code should be able to handle Symbol values.
2062         https://bugs.webkit.org/show_bug.cgi?id=164436
2063         <rdar://problem/29115583>
2064
2065         Reviewed by Filip Pizlo and Saam Barati.
2066
2067         Previously, we try to toString() the Symbol value, resulting in it throwing an
2068         exception in errorDescriptionForValue() which breaks the invariant that
2069         errorDescriptionForValue() should not throw.
2070
2071         We fixed this by making errorDescriptionForValue() aware of the Symbol type, and
2072         not so a toString() on Symbol values.  Also fixed notAFunctionSourceAppender()
2073         to build a nicer message for Symbol values.
2074
2075         * runtime/ExceptionHelpers.cpp:
2076         (JSC::errorDescriptionForValue):
2077         (JSC::notAFunctionSourceAppender):
2078
2079 2016-11-02  Geoffrey Garen  <ggaren@apple.com>
2080
2081         EvalCodeCache should not give up in strict mode and other cases
2082         https://bugs.webkit.org/show_bug.cgi?id=164357
2083
2084         Reviewed by Michael Saboff.
2085
2086         EvalCodeCache gives up in non-trivial cases because generated eval code
2087         can't soundly migrate from, for example, a let scope to a non-let scope.
2088         The number of cases has grown over time.
2089
2090         Instead, let's cache eval code based on the location of the call to
2091         eval(). That way, we never relocate the code, and it's sound to make
2092         normal assumptions about our surrounding scope.
2093
2094         * bytecode/EvalCodeCache.h:
2095         (JSC::EvalCodeCache::CacheKey::CacheKey): Use CallSiteIndex to uniquely
2096         identify the location of our call to eval().
2097
2098         (JSC::EvalCodeCache::CacheKey::hash):
2099         (JSC::EvalCodeCache::CacheKey::operator==):
2100         (JSC::EvalCodeCache::CacheKey::Hash::equal): Use CallSiteIndex instead
2101         of lots of other flags.
2102
2103         (JSC::EvalCodeCache::tryGet): No need to include details that are implied
2104         by our CallSiteIndex.
2105
2106         (JSC::EvalCodeCache::getSlow): No need to skip caching in complex
2107         situations. We promise we'll never relocate the cached code.
2108
2109         (JSC::EvalCodeCache::isCacheableScope): Deleted.
2110         (JSC::EvalCodeCache::isCacheable): Deleted.
2111
2112         * interpreter/Interpreter.cpp:
2113         (JSC::eval): Pass through a CallSiteIndex to uniquely identify this call
2114         to eval().
2115
2116 2016-11-04  Keith Miller  <keith_miller@apple.com>
2117
2118         Add support for Wasm br_table
2119         https://bugs.webkit.org/show_bug.cgi?id=164429
2120
2121         Reviewed by Michael Saboff.
2122
2123         This patch adds support for Wasm br_table. The Wasm br_table
2124         opcode essentially directly maps to B3's switch opcode.
2125
2126         There are also three other minor changes:
2127         1) all non-argument locals should be initialized to zero at function entry.
2128         2) add new setErrorMessage member to WasmFunctionParser.h
2129         3) return does not decode an extra immediate anymore.
2130
2131         * testWasm.cpp:
2132         (runWasmTests):
2133         * wasm/WasmB3IRGenerator.cpp:
2134         * wasm/WasmFunctionParser.h:
2135         (JSC::Wasm::FunctionParser::setErrorMessage):
2136         (JSC::Wasm::FunctionParser<Context>::parseExpression):
2137         (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
2138         (JSC::Wasm::FunctionParser<Context>::popExpressionStack):
2139         * wasm/WasmValidate.cpp:
2140         (JSC::Wasm::Validate::checkBranchTarget):
2141         (JSC::Wasm::Validate::addBranch):
2142         (JSC::Wasm::Validate::addSwitch):
2143
2144 2016-11-04  JF Bastien  <jfbastien@apple.com>
2145
2146         WebAssembly JS API: implement more sections
2147         https://bugs.webkit.org/show_bug.cgi?id=164023
2148
2149         Reviewed by Keith Miller.
2150
2151         On the JSC side:
2152
2153          - Put in parser stubs for all WebAssembly sections.
2154          - Parse Import, Export sections.
2155          - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
2156          - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
2157          - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
2158          - Remove all remainders of polyfill-prototype-1, and update license.
2159          - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
2160
2161         On the Builder.js testing side:
2162
2163          - Implement Type, Import (function only), Export (function only) sections.
2164          - Check section order and uniqueness.
2165          - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
2166          - Allow re-exporting an import.
2167
2168         * CMakeLists.txt: missing auto-genration
2169         * JavaScriptCore.xcodeproj/project.pbxproj: merge conflict
2170         * testWasm.cpp: update for API changes, no functional change
2171         (checkPlan):
2172         (runWasmTests):
2173         * wasm/WasmFormat.cpp: add a dtor which requires extra headers which I'd rather not include in WasmFormat.h
2174         (JSC::Wasm::ModuleInformation::~ModuleInformation):
2175         * wasm/WasmFormat.h: Add External, Import, Functioninformation, Export, ModuleInformation, CompiledFunction, and remove obsolete stuff which was a holdover from the first implementation (all that code is now gone, so remove its license)
2176         (JSC::Wasm::External::isValid):
2177         * wasm/WasmModuleParser.cpp: simplify some, make names consistent with the WebAssembly section names, check memory allocations so they can fail early
2178         (JSC::Wasm::ModuleParser::parse):
2179         (JSC::Wasm::ModuleParser::parseType):
2180         (JSC::Wasm::ModuleParser::parseImport):
2181         (JSC::Wasm::ModuleParser::parseFunction):
2182         (JSC::Wasm::ModuleParser::parseTable):
2183         (JSC::Wasm::ModuleParser::parseMemory):
2184         (JSC::Wasm::ModuleParser::parseGlobal):
2185         (JSC::Wasm::ModuleParser::parseExport):
2186         (JSC::Wasm::ModuleParser::parseStart):
2187         (JSC::Wasm::ModuleParser::parseElement):
2188         (JSC::Wasm::ModuleParser::parseCode): avoid overflow through function size.
2189         (JSC::Wasm::ModuleParser::parseData):
2190         * wasm/WasmModuleParser.h:
2191         (JSC::Wasm::ModuleParser::moduleInformation):
2192         * wasm/WasmParser.h:
2193         (JSC::Wasm::Parser::consumeUTF8String): add as required by spec
2194         (JSC::Wasm::Parser::parseExternalKind): add as per spec
2195         * wasm/WasmPlan.cpp:
2196         (JSC::Wasm::Plan::Plan): fix some ownership, improve some error messages
2197         * wasm/WasmPlan.h: fix some ownership
2198         (JSC::Wasm::Plan::getModuleInformation):
2199         (JSC::Wasm::Plan::getMemory):
2200         (JSC::Wasm::Plan::compiledFunctionCount):
2201         (JSC::Wasm::Plan::compiledFunction):
2202         (JSC::Wasm::Plan::getCompiledFunctions):
2203         * wasm/WasmSections.h: macroize with description, so that error messages are super pretty. This could be auto-generated.
2204         * wasm/js/JSWebAssemblyModule.cpp:
2205         (JSC::JSWebAssemblyModule::create): take module information
2206         (JSC::JSWebAssemblyModule::JSWebAssemblyModule): ditto
2207         * wasm/js/JSWebAssemblyModule.h:
2208         (JSC::JSWebAssemblyModule::moduleInformation):
2209         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2210         (JSC::constructJSWebAssemblyInstance): check that modules with imports are instantiated with an import object, as per spec. This needs to be tested.
2211         * wasm/js/WebAssemblyMemoryConstructor.cpp:
2212         (JSC::constructJSWebAssemblyMemory):
2213         * wasm/js/WebAssemblyModuleConstructor.cpp:
2214         (JSC::constructJSWebAssemblyModule):
2215         * wasm/js/WebAssemblyTableConstructor.cpp:
2216         (JSC::constructJSWebAssemblyTable):
2217
2218 2016-11-03  Mark Lam  <mark.lam@apple.com>
2219
2220         ClonedArguments need to also support haveABadTime mode.
2221         https://bugs.webkit.org/show_bug.cgi?id=164200
2222         <rdar://problem/27211336>
2223
2224         Reviewed by Geoffrey Garen.
2225
2226         For those who are not familiar with the parlance, "have a bad time" in the VM
2227         means that Object.prototype has been modified in such a way that we can no longer
2228         trivially do indexed property accesses without consulting the Object.prototype.
2229         This defeats JIT indexed put optimizations, and hence, makes the VM "have a
2230         bad time".
2231
2232         Once the VM enters haveABadTime mode, all existing objects are converted to use
2233         slow put storage.  Thereafter, JSArrays are always created with slow put storage.
2234         JSObjects are always created with a blank indexing type.  When a new indexed
2235         property is put into the new object, its indexing type will be converted to the
2236         slow put array indexing type just before we perform the put operation.  This is
2237         how we ensure that the objects will also use slow put storage.
2238
2239         However, ClonedArguments is an object which was previously created unconditionally
2240         to use contiguous storage.  Subsequently, if we try to call Object.preventExtensions()
2241         on that ClonedArguments object, Object.preventExtensions() will:
2242         1. make the ClonedArguments enter dictionary indexing mode, which means it will
2243         2. first ensure that the ClonedArguments is using slow put array storage via
2244            JSObject::ensureArrayStorageSlow().
2245
2246         However, JSObject::ensureArrayStorageSlow() expects that we never see an object
2247         with contiguous storage once we're in haveABadTime mode.  Our ClonedArguments
2248         object did not obey this invariant.
2249
2250         The fix is to make the ClonedArguments factories create objects that use slow put
2251         array storage when in haveABadTime mode.  This means:
2252
2253         1. JSGlobalObject::haveABadTime() now changes m_clonedArgumentsStructure to use
2254            its slow put version.
2255
2256            Also the caching of the slow put version of m_regExpMatchesArrayStructure,
2257            because we only need to create it when we are having a bad time.
2258
2259         2. The ClonedArguments factories now allocates a butterfly with slow put array
2260            storage if we're in haveABadTime mode.
2261
2262            Also added some assertions in ClonedArguments' factory methods to ensure that
2263            the created object has the slow put indexing type when it needsSlowPutIndexing().
2264
2265         3. DFGFixupPhase now watches the havingABadTimeWatchpoint because ClonedArguments'
2266            structure will change when having a bad time.
2267
2268         4. DFGArgumentEliminationPhase and DFGVarargsForwardingPhase need not be changed
2269            because it is still valid to eliminate the creation of the arguments object
2270            even having a bad time, as long as the arguments object does not escape.
2271
2272         5. The DFGAbstractInterpreterInlines now checks for haveABadTime, and sets the
2273            predicted type to be SpecObject.
2274
2275         Note: this issue does not apply to DirectArguments and ScopedArguments because
2276         they use a blank indexing type (just like JSObject).
2277
2278         * dfg/DFGAbstractInterpreterInlines.h:
2279         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2280         * dfg/DFGArrayMode.cpp:
2281         (JSC::DFG::ArrayMode::dump):
2282         * dfg/DFGFixupPhase.cpp:
2283         (JSC::DFG::FixupPhase::fixupNode):
2284         * runtime/ClonedArguments.cpp:
2285         (JSC::ClonedArguments::createEmpty):
2286         (JSC::ClonedArguments::createWithInlineFrame):
2287         (JSC::ClonedArguments::createWithMachineFrame):
2288         (JSC::ClonedArguments::createByCopyingFrom):
2289         (JSC::ClonedArguments::createStructure):
2290         (JSC::ClonedArguments::createSlowPutStructure):
2291         * runtime/ClonedArguments.h:
2292         * runtime/JSGlobalObject.cpp:
2293         (JSC::JSGlobalObject::init):
2294         (JSC::JSGlobalObject::haveABadTime):
2295         (JSC::JSGlobalObject::visitChildren):
2296         * runtime/JSGlobalObject.h:
2297
2298 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
2299
2300         DFG plays fast and loose with the shadow values of a Phi
2301         https://bugs.webkit.org/show_bug.cgi?id=164309
2302
2303         Reviewed by Saam Barati.
2304
2305         Oh boy, what an embarrassing mistake! The style of SSA I like to use avoids block/value
2306         tuples as parameters of a Phi, thereby simplifying CFG transformations and making Phi largely
2307         not a special case for most compiler transforms. It does this by introducing another value
2308         called Upsilon, which stores a value into some Phi.
2309
2310         B3 uses this also. The easiest way to understand what Upsilon/Phi behave like is to look at
2311         the B3->Air lowering. Air is not SSA - it has Tmps that you can assign to and use as many
2312         times as you like. B3 allocates one Tmp per Value, and an extra "phiTmp" for Phis, so that
2313         Phis get two Tmps total. Upsilon stores the value into the phiTmp of the Phi, while Phi moves
2314         the value from its phiTmp to its tmp.
2315
2316         This is necessary to support scenarios like this:
2317
2318             a: Phi()
2319             b: Upsilon(@x, ^a)
2320             c: Use(@a)
2321
2322         Here, we want @c to see @a's value before @b. That's a very basic requirement of SSA: that
2323         the a value (like @a) doesn't change during its lifetime.
2324
2325         Unfortunately, DFG's liveness analysis, abstract interpreter, and integer range optimization
2326         all failed to correctly model Upsilon/Phi this way. They would assume that it's accurate to
2327         model the Upsilon as storing into the Phi directly.
2328
2329         Because DFG does flow analysis over SSA, making it correct means enabling it to speak of the
2330         shadow value. This change addresses this problem by introducing the concept of a
2331         NodeFlowProjection. This is a key that lets us speak of both a Node's primary value and its
2332         optional "shadow" value. Liveness, AI, and integer range are now keyed by NodeFlowProjection
2333         rather than Node*. Conceptually this turns out to be a very simple change, but it does touch
2334         a good amount of code.
2335
2336         This looks to be perf-neutral.
2337
2338         Rolled back in after fixing the debug build.
2339
2340         * CMakeLists.txt:
2341         * JavaScriptCore.xcodeproj/project.pbxproj:
2342         * b3/air/AirLiveness.h:
2343         (JSC::B3::Air::TmpLivenessAdapter::numIndices):
2344         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
2345         (JSC::B3::Air::RegLivenessAdapter::numIndices):
2346         (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
2347         (JSC::B3::Air::TmpLivenessAdapter::maxIndex): Deleted.
2348         (JSC::B3::Air::StackSlotLivenessAdapter::maxIndex): Deleted.
2349         (JSC::B3::Air::RegLivenessAdapter::maxIndex): Deleted.
2350         * dfg/DFGAbstractInterpreter.h:
2351         (JSC::DFG::AbstractInterpreter::forNode):
2352         * dfg/DFGAbstractInterpreterInlines.h:
2353         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2354         (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
2355         (JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
2356         * dfg/DFGAtTailAbstractState.cpp:
2357         (JSC::DFG::AtTailAbstractState::createValueForNode):
2358         (JSC::DFG::AtTailAbstractState::forNode):
2359         * dfg/DFGAtTailAbstractState.h:
2360         * dfg/DFGBasicBlock.h:
2361         * dfg/DFGCombinedLiveness.cpp:
2362         (JSC::DFG::liveNodesAtHead):
2363         * dfg/DFGCombinedLiveness.h:
2364         * dfg/DFGFlowIndexing.cpp: Added.
2365         (JSC::DFG::FlowIndexing::FlowIndexing):
2366         (JSC::DFG::FlowIndexing::~FlowIndexing):
2367         (JSC::DFG::FlowIndexing::recompute):
2368         * dfg/DFGFlowIndexing.h: Added.
2369         (JSC::DFG::FlowIndexing::graph):
2370         (JSC::DFG::FlowIndexing::numIndices):
2371         (JSC::DFG::FlowIndexing::index):
2372         (JSC::DFG::FlowIndexing::shadowIndex):
2373         (JSC::DFG::FlowIndexing::nodeProjection):
2374         * dfg/DFGFlowMap.h: Added.
2375         (JSC::DFG::FlowMap::FlowMap):
2376         (JSC::DFG::FlowMap::resize):
2377         (JSC::DFG::FlowMap::graph):
2378         (JSC::DFG::FlowMap::at):
2379         (JSC::DFG::FlowMap::atShadow):
2380         (WTF::printInternal):
2381         * dfg/DFGGraph.cpp:
2382         (JSC::DFG::Graph::Graph):
2383         * dfg/DFGGraph.h:
2384         (JSC::DFG::Graph::abstractValuesCache): Deleted.
2385         * dfg/DFGInPlaceAbstractState.cpp:
2386         (JSC::DFG::InPlaceAbstractState::InPlaceAbstractState):
2387         (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
2388         (JSC::DFG::setLiveValues):
2389         (JSC::DFG::InPlaceAbstractState::endBasicBlock):
2390         (JSC::DFG::InPlaceAbstractState::merge):
2391         * dfg/DFGInPlaceAbstractState.h:
2392         (JSC::DFG::InPlaceAbstractState::createValueForNode):
2393         (JSC::DFG::InPlaceAbstractState::forNode):
2394         * dfg/DFGIntegerRangeOptimizationPhase.cpp:
2395         * dfg/DFGLivenessAnalysisPhase.cpp:
2396         (JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase):
2397         (JSC::DFG::LivenessAnalysisPhase::run):
2398         (JSC::DFG::LivenessAnalysisPhase::processBlock):
2399         (JSC::DFG::LivenessAnalysisPhase::addChildUse): Deleted.
2400         * dfg/DFGNode.h:
2401         (JSC::DFG::NodeComparator::operator()):
2402         (JSC::DFG::nodeListDump):
2403         (JSC::DFG::nodeMapDump):
2404         (JSC::DFG::nodeValuePairListDump):
2405         (JSC::DFG::nodeComparator): Deleted.
2406         * dfg/DFGNodeAbstractValuePair.cpp: Added.
2407         (JSC::DFG::NodeAbstractValuePair::dump):
2408         * dfg/DFGNodeAbstractValuePair.h: Added.
2409         (JSC::DFG::NodeAbstractValuePair::NodeAbstractValuePair):
2410         * dfg/DFGNodeFlowProjection.cpp: Added.
2411         (JSC::DFG::NodeFlowProjection::dump):
2412         * dfg/DFGNodeFlowProjection.h: Added.
2413         (JSC::DFG::NodeFlowProjection::NodeFlowProjection):
2414         (JSC::DFG::NodeFlowProjection::operator bool):
2415         (JSC::DFG::NodeFlowProjection::kind):
2416         (JSC::DFG::NodeFlowProjection::node):
2417         (JSC::DFG::NodeFlowProjection::operator*):
2418         (JSC::DFG::NodeFlowProjection::operator->):
2419         (JSC::DFG::NodeFlowProjection::hash):
2420         (JSC::DFG::NodeFlowProjection::operator==):
2421         (JSC::DFG::NodeFlowProjection::operator!=):
2422         (JSC::DFG::NodeFlowProjection::operator<):
2423         (JSC::DFG::NodeFlowProjection::operator>):
2424         (JSC::DFG::NodeFlowProjection::operator<=):
2425         (JSC::DFG::NodeFlowProjection::operator>=):
2426         (JSC::DFG::NodeFlowProjection::isHashTableDeletedValue):
2427         (JSC::DFG::NodeFlowProjection::isStillValid):
2428         (JSC::DFG::NodeFlowProjection::forEach):
2429         (JSC::DFG::NodeFlowProjectionHash::hash):
2430         (JSC::DFG::NodeFlowProjectionHash::equal):
2431         * dfg/DFGStoreBarrierInsertionPhase.cpp:
2432
2433 2016-11-03  Commit Queue  <commit-queue@webkit.org>
2434
2435         Unreviewed, rolling out r208364.
2436         https://bugs.webkit.org/show_bug.cgi?id=164402
2437
2438         broke the build (Requested by smfr on #webkit).
2439
2440         Reverted changeset:
2441
2442         "DFG plays fast and loose with the shadow values of a Phi"
2443         https://bugs.webkit.org/show_bug.cgi?id=164309
2444         http://trac.webkit.org/changeset/208364
2445
2446 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
2447
2448         DFG plays fast and loose with the shadow values of a Phi
2449         https://bugs.webkit.org/show_bug.cgi?id=164309
2450
2451         Reviewed by Saam Barati.
2452
2453         Oh boy, what an embarrassing mistake! The style of SSA I like to use avoids block/value
2454         tuples as parameters of a Phi, thereby simplifying CFG transformations and making Phi largely
2455         not a special case for most compiler transforms. It does this by introducing another value
2456         called Upsilon, which stores a value into some Phi.
2457
2458         B3 uses this also. The easiest way to understand what Upsilon/Phi behave like is to look at
2459         the B3->Air lowering. Air is not SSA - it has Tmps that you can assign to and use as many
2460         times as you like. B3 allocates one Tmp per Value, and an extra "phiTmp" for Phis, so that
2461         Phis get two Tmps total. Upsilon stores the value into the phiTmp of the Phi, while Phi moves
2462         the value from its phiTmp to its tmp.
2463
2464         This is necessary to support scenarios like this:
2465
2466             a: Phi()
2467             b: Upsilon(@x, ^a)
2468             c: Use(@a)
2469
2470         Here, we want @c to see @a's value before @b. That's a very basic requirement of SSA: that
2471         the a value (like @a) doesn't change during its lifetime.
2472
2473         Unfortunately, DFG's liveness analysis, abstract interpreter, and integer range optimization
2474         all failed to correctly model Upsilon/Phi this way. They would assume that it's accurate to
2475         model the Upsilon as storing into the Phi directly.
2476
2477         Because DFG does flow analysis over SSA, making it correct means enabling it to speak of the
2478         shadow value. This change addresses this problem by introducing the concept of a
2479         NodeFlowProjection. This is a key that lets us speak of both a Node's primary value and its
2480         optional "shadow" value. Liveness, AI, and integer range are now keyed by NodeFlowProjection
2481         rather than Node*. Conceptually this turns out to be a very simple change, but it does touch
2482         a good amount of code.
2483
2484         This looks to be perf-neutral.
2485
2486         * CMakeLists.txt:
2487         * JavaScriptCore.xcodeproj/project.pbxproj:
2488         * b3/air/AirLiveness.h:
2489         (JSC::B3::Air::TmpLivenessAdapter::numIndices):
2490         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
2491         (JSC::B3::Air::RegLivenessAdapter::numIndices):
2492         (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
2493         (JSC::B3::Air::TmpLivenessAdapter::maxIndex): Deleted.
2494         (JSC::B3::Air::StackSlotLivenessAdapter::maxIndex): Deleted.
2495         (JSC::B3::Air::RegLivenessAdapter::maxIndex): Deleted.
2496         * dfg/DFGAbstractInterpreter.h:
2497         (JSC::DFG::AbstractInterpreter::forNode):
2498         * dfg/DFGAbstractInterpreterInlines.h:
2499         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2500         (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
2501         (JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
2502         * dfg/DFGAtTailAbstractState.cpp:
2503         (JSC::DFG::AtTailAbstractState::createValueForNode):
2504         (JSC::DFG::AtTailAbstractState::forNode):
2505         * dfg/DFGAtTailAbstractState.h:
2506         * dfg/DFGBasicBlock.h:
2507         * dfg/DFGCombinedLiveness.cpp:
2508         (JSC::DFG::liveNodesAtHead):
2509         * dfg/DFGCombinedLiveness.h:
2510         * dfg/DFGFlowIndexing.cpp: Added.
2511         (JSC::DFG::FlowIndexing::FlowIndexing):
2512         (JSC::DFG::FlowIndexing::~FlowIndexing):
2513         (JSC::DFG::FlowIndexing::recompute):
2514         * dfg/DFGFlowIndexing.h: Added.
2515         (JSC::DFG::FlowIndexing::graph):
2516         (JSC::DFG::FlowIndexing::numIndices):
2517         (JSC::DFG::FlowIndexing::index):
2518         (JSC::DFG::FlowIndexing::shadowIndex):
2519         (JSC::DFG::FlowIndexing::nodeProjection):
2520         * dfg/DFGFlowMap.h: Added.
2521         (JSC::DFG::FlowMap::FlowMap):
2522         (JSC::DFG::FlowMap::resize):
2523         (JSC::DFG::FlowMap::graph):
2524         (JSC::DFG::FlowMap::at):
2525         (JSC::DFG::FlowMap::atShadow):
2526         (WTF::printInternal):
2527         * dfg/DFGGraph.cpp:
2528         (JSC::DFG::Graph::Graph):
2529         * dfg/DFGGraph.h:
2530         (JSC::DFG::Graph::abstractValuesCache): Deleted.
2531         * dfg/DFGInPlaceAbstractState.cpp:
2532         (JSC::DFG::InPlaceAbstractState::InPlaceAbstractState):
2533         (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
2534         (JSC::DFG::setLiveValues):
2535         (JSC::DFG::InPlaceAbstractState::endBasicBlock):
2536         (JSC::DFG::InPlaceAbstractState::merge):
2537         * dfg/DFGInPlaceAbstractState.h:
2538         (JSC::DFG::InPlaceAbstractState::createValueForNode):
2539         (JSC::DFG::InPlaceAbstractState::forNode):
2540         * dfg/DFGIntegerRangeOptimizationPhase.cpp:
2541         * dfg/DFGLivenessAnalysisPhase.cpp:
2542         (JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase):
2543         (JSC::DFG::LivenessAnalysisPhase::run):
2544         (JSC::DFG::LivenessAnalysisPhase::processBlock):
2545         (JSC::DFG::LivenessAnalysisPhase::addChildUse): Deleted.
2546         * dfg/DFGNode.h:
2547         (JSC::DFG::NodeComparator::operator()):
2548         (JSC::DFG::nodeListDump):
2549         (JSC::DFG::nodeMapDump):
2550         (JSC::DFG::nodeValuePairListDump):
2551         (JSC::DFG::nodeComparator): Deleted.
2552         * dfg/DFGNodeAbstractValuePair.cpp: Added.
2553         (JSC::DFG::NodeAbstractValuePair::dump):
2554         * dfg/DFGNodeAbstractValuePair.h: Added.
2555         (JSC::DFG::NodeAbstractValuePair::NodeAbstractValuePair):
2556         * dfg/DFGNodeFlowProjection.cpp: Added.
2557         (JSC::DFG::NodeFlowProjection::dump):
2558         * dfg/DFGNodeFlowProjection.h: Added.
2559         (JSC::DFG::NodeFlowProjection::NodeFlowProjection):
2560         (JSC::DFG::NodeFlowProjection::operator bool):
2561         (JSC::DFG::NodeFlowProjection::kind):
2562         (JSC::DFG::NodeFlowProjection::node):
2563         (JSC::DFG::NodeFlowProjection::operator*):
2564         (JSC::DFG::NodeFlowProjection::operator->):
2565         (JSC::DFG::NodeFlowProjection::hash):
2566         (JSC::DFG::NodeFlowProjection::operator==):
2567         (JSC::DFG::NodeFlowProjection::operator!=):
2568         (JSC::DFG::NodeFlowProjection::operator<):
2569         (JSC::DFG::NodeFlowProjection::operator>):
2570         (JSC::DFG::NodeFlowProjection::operator<=):
2571         (JSC::DFG::NodeFlowProjection::operator>=):
2572         (JSC::DFG::NodeFlowProjection::isHashTableDeletedValue):
2573         (JSC::DFG::NodeFlowProjection::isStillValid):
2574         (JSC::DFG::NodeFlowProjection::forEach):
2575         (JSC::DFG::NodeFlowProjectionHash::hash):
2576         (JSC::DFG::NodeFlowProjectionHash::equal):
2577         * dfg/DFGStoreBarrierInsertionPhase.cpp:
2578
2579 2016-11-03  Keith Miller  <keith_miller@apple.com>
2580
2581         Unreviewed, changelog fix due to failed git rebase..
2582
2583 2016-11-03  Keith Miller  <keith_miller@apple.com>
2584
2585         Wasm starts a new stack whenever it adds a new block and has return types for blocks.
2586         https://bugs.webkit.org/show_bug.cgi?id=164100
2587
2588         Reviewed by Saam Barati.
2589
2590         This patch overhauls much of the Wasm function parser, validator, and B3 IR generator
2591         to work with block return types. In Wasm, blocks can act as expressions and have a
2592         return value. Most of the control flow operators needed to be rewritten in order to
2593         support this feature. To enable return types the function parser needed to be able
2594         to save and restore the expression stack from previous blocks, which is done via the
2595         control stack.
2596
2597         This patch also removes the lazy continuation block system added previously. It's
2598         not clear if there would be any performance win from such a system. There are likely
2599         many other things with orders of magnitude more impact on B3 IR generation. The
2600         complexity cost of such a system is not worth the effort without sufficient evidence
2601         otherwise.
2602
2603         * testWasm.cpp:
2604         (runWasmTests):
2605         * wasm/WasmB3IRGenerator.cpp:
2606         * wasm/WasmFunctionParser.h:
2607         (JSC::Wasm::FunctionParser<Context>::parseBlock):
2608         (JSC::Wasm::FunctionParser<Context>::addReturn):
2609         (JSC::Wasm::FunctionParser<Context>::parseExpression):
2610         (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
2611         (JSC::Wasm::FunctionParser<Context>::popExpressionStack):
2612         * wasm/WasmValidate.cpp:
2613         (JSC::Wasm::Validate::ControlData::hasNonVoidSignature):
2614         (JSC::Wasm::Validate::addElse):
2615         (JSC::Wasm::Validate::addElseToUnreachable):
2616         (JSC::Wasm::Validate::addBranch):
2617         (JSC::Wasm::Validate::endBlock):
2618         (JSC::Wasm::Validate::addEndToUnreachable):
2619         (JSC::Wasm::Validate::dump):
2620         (JSC::Wasm::validateFunction):
2621         (JSC::Wasm::Validate::isContinuationReachable): Deleted.
2622
2623 2016-11-03  Saam Barati  <sbarati@apple.com>
2624
2625         Asking for a value profile prediction should be defensive against not finding a value profile
2626         https://bugs.webkit.org/show_bug.cgi?id=164306
2627
2628         Reviewed by Mark Lam.
2629
2630         Currently, the code that calls CodeBlock::valueProfilePredictionForBytecodeOffset
2631         in the DFG assumes it will always be at a value producing node. However, this isn't
2632         true if we tail call from an inlined setter. When we're at a tail call, we try
2633         to find the first caller that isn't a tail call to see what value the
2634         tail_call produces. If we inline a setter, however, we will end up finding
2635         the put_by_id as our first non-tail-called "caller", and that won't have a
2636         value profile associated with it since it's not a value producing node.
2637         CodeBlock::valueProfilePredictionForBytecodeOffset should be defensive
2638         against finding a null value profile.
2639
2640         * bytecode/CodeBlock.h:
2641         (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
2642         * dfg/DFGByteCodeParser.cpp:
2643         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
2644
2645 2016-11-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2646
2647         Unreviewed, fix CLoop build after r208320.
2648         https://bugs.webkit.org/show_bug.cgi?id=162980
2649
2650         Add required forward declarations.
2651
2652         * domjit/DOMJITHeapRange.cpp:
2653         * domjit/DOMJITSignature.h:
2654         * runtime/VM.h:
2655
2656 2016-11-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2657
2658         [DOMJIT] Add DOMJIT::Signature
2659         https://bugs.webkit.org/show_bug.cgi?id=162980
2660
2661         Reviewed by Saam Barati and Sam Weinig.
2662
2663         This patch introduces a new mechanism called DOMJIT::Signature. We can annotate the function with DOMJIT::Signature.
2664         DOMJIT::Signature has type information of that function. And it also maintains the effect of the function and the
2665         pointer to the unsafe function. The unsafe function means the function without type and argument count checks.
2666         By using these information, we can separate type and argument count checks from the function. And we can emit
2667         these things as DFG checks and convert the function call itself to CallDOM node. CallDOM node can call the unsafe
2668         function directly without any checks. Furthermore, this CallDOM node can represent its own clobberizing rules based
2669         on DOMJIT::Effect maintained by DOMJIT::Signature. It allows us to make opaque Call node to a CallDOM node that
2670         merely reads some part of heap. These changes (1) can drop duplicate type checks in DFG, (2) offer ability to move
2671         CallDOM node to somewhere, and (3) track more detailed heap reads and writes of CallDOM nodes.
2672
2673         We first emit Call node with DOMJIT::Signature in DFGByteCodeParser. And in the fixup phase, we attempt to lower
2674         Call node to CallDOM node with checks & edge filters. This is because we do not know the type predictions in
2675         DFGByteCodeParser phase. If we always emit CallDOM node in DFGByteCodeParser, if we evaluate `div.getAttribute(true)`
2676         thingy, the Uncountable OSR exits repeatedly happen because AI figures out the abstract value is cleared.
2677
2678         Currently, DOMJIT signature only allows the types that can reside in GPR. This is because the types of the unsafe
2679         function arguments are represented as the sequence of void*. In the future, we will extend to accept other types like
2680         float, double etc.
2681
2682         We annotate several functions in Element. In particular, we annotate Element::getAttribute. This allows us to perform
2683         LICM in Dromaeo dom-attr test. In the Dromaeo dom-attr getAttribute test, we can see 32x improvement. (134974.8 v.s. 4203.4)
2684
2685         * JavaScriptCore.xcodeproj/project.pbxproj:
2686         * bytecode/CallVariant.h:
2687         (JSC::CallVariant::functionExecutable):
2688         (JSC::CallVariant::nativeExecutable):
2689         (JSC::CallVariant::signatureFor):
2690         * bytecode/SpeculatedType.h:
2691         (JSC::isNotStringSpeculation):
2692         (JSC::isNotInt32Speculation):
2693         (JSC::isNotBooleanSpeculation):
2694         * dfg/DFGAbstractInterpreterInlines.h:
2695         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2696         * dfg/DFGByteCodeParser.cpp:
2697         (JSC::DFG::ByteCodeParser::addCall):
2698         (JSC::DFG::ByteCodeParser::handleCall):
2699         (JSC::DFG::ByteCodeParser::attemptToInlineCall):
2700         (JSC::DFG::ByteCodeParser::handleInlining):
2701         (JSC::DFG::ByteCodeParser::handleDOMJITCall):
2702         (JSC::DFG::ByteCodeParser::parseBlock):
2703         * dfg/DFGClobberize.h:
2704         (JSC::DFG::clobberize):
2705         * dfg/DFGDoesGC.cpp:
2706         (JSC::DFG::doesGC):
2707         * dfg/DFGFixupPhase.cpp:
2708         (JSC::DFG::FixupPhase::fixupNode):
2709         (JSC::DFG::FixupPhase::attemptToMakeCallDOM):
2710         (JSC::DFG::FixupPhase::fixupCheckDOM):
2711         (JSC::DFG::FixupPhase::fixupCallDOM):
2712         * dfg/DFGNode.cpp:
2713         (JSC::DFG::Node::convertToCallDOM):
2714         * dfg/DFGNode.h:
2715         (JSC::DFG::Node::hasHeapPrediction):
2716         (JSC::DFG::Node::shouldSpeculateNotInt32):
2717         (JSC::DFG::Node::shouldSpeculateNotBoolean):
2718         (JSC::DFG::Node::shouldSpeculateNotString):
2719         (JSC::DFG::Node::hasSignature):
2720         (JSC::DFG::Node::signature):
2721         * dfg/DFGNodeType.h:
2722         * dfg/DFGPredictionPropagationPhase.cpp:
2723         * dfg/DFGSafeToExecute.h:
2724         (JSC::DFG::safeToExecute):
2725         * dfg/DFGSpeculativeJIT.cpp:
2726         (JSC::DFG::SpeculativeJIT::compileCallDOM):
2727         * dfg/DFGSpeculativeJIT.h:
2728         (JSC::DFG::SpeculativeJIT::callOperation):
2729         * dfg/DFGSpeculativeJIT32_64.cpp:
2730         (JSC::DFG::SpeculativeJIT::compile):
2731         * dfg/DFGSpeculativeJIT64.cpp:
2732         (JSC::DFG::SpeculativeJIT::compile):
2733         * domjit/DOMJITEffect.h:
2734         (JSC::DOMJIT::Effect::Effect):
2735         (JSC::DOMJIT::Effect::forWrite):
2736         (JSC::DOMJIT::Effect::forRead):
2737         (JSC::DOMJIT::Effect::forReadWrite):
2738         (JSC::DOMJIT::Effect::forPure):
2739         (JSC::DOMJIT::Effect::forDef):
2740         (JSC::DOMJIT::Effect::mustGenerate):
2741         In clang, we cannot make this Effect constructor constexpr if we use Optional<HeapRange>.
2742         So we use HeapRange::top() for Nullopt def now.
2743
2744         * domjit/DOMJITHeapRange.h:
2745         (JSC::DOMJIT::HeapRange::fromRaw):
2746         (JSC::DOMJIT::HeapRange::operator bool):
2747         (JSC::DOMJIT::HeapRange::operator==):
2748         (JSC::DOMJIT::HeapRange::operator!=):
2749         (JSC::DOMJIT::HeapRange::fromConstant):
2750         * domjit/DOMJITSignature.h: Copied from Source/JavaScriptCore/domjit/DOMJITEffect.h.
2751         (JSC::DOMJIT::Signature::Signature):
2752         (JSC::DOMJIT::Signature::argumentCount):
2753         (JSC::DOMJIT::Signature::checkDOM):
2754         * ftl/FTLCapabilities.cpp:
2755         (JSC::FTL::canCompile):
2756         * ftl/FTLLowerDFGToB3.cpp:
2757         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
2758         (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
2759         * jit/JITOperations.h:
2760         * jit/JITThunks.cpp:
2761         (JSC::JITThunks::hostFunctionStub):
2762         * jit/JITThunks.h:
2763         * runtime/JSBoundFunction.cpp:
2764         (JSC::JSBoundFunction::create):
2765         * runtime/JSCell.h:
2766         * runtime/JSFunction.cpp:
2767         (JSC::JSFunction::create):
2768         * runtime/JSFunction.h:
2769         * runtime/JSNativeStdFunction.cpp:
2770         (JSC::JSNativeStdFunction::create):
2771         * runtime/JSObject.cpp:
2772         (JSC::JSObject::putDirectNativeFunction):
2773         * runtime/JSObject.h:
2774         * runtime/Lookup.h:
2775         (JSC::HashTableValue::functionLength):
2776         (JSC::HashTableValue::signature):
2777         (JSC::reifyStaticProperty):
2778         * runtime/NativeExecutable.cpp:
2779         (JSC::NativeExecutable::create):
2780         (JSC::NativeExecutable::NativeExecutable):
2781         * runtime/NativeExecutable.h:
2782         * runtime/PropertySlot.h:
2783         * runtime/VM.cpp:
2784         (JSC::VM::getHostFunction):
2785         * runtime/VM.h:
2786
2787 2016-11-02  Andreas Kling  <akling@apple.com>
2788
2789         MarkedSpace should have specialized size classes for popular engine objects.
2790         <https://webkit.org/b/164345>
2791
2792         Reviewed by Filip Pizlo.
2793
2794         The MarkedSpace size classes were recently reworked to minimize wasted space
2795         at the end of MarkedBlocks.
2796
2797         However, we know that some specific objects will be allocated in very high volume.
2798         Adding specialized size classes for those object sizes achieves greater utilization
2799         since we're basically guaranteed to allocate them all the time.
2800
2801         Inject specialized size classes for these four objects:
2802
2803             - FunctionCodeBlock
2804                 560 bytes instead of 624
2805                 28 per block instead of 26 (+2)
2806
2807             - FunctionExecutable
2808                 176 bytes instead of 224
2809                 92 per block instead of 72 (+20)
2810
2811             - UnlinkedFunctionCodeBlock
2812                 256 bytes instead of 320
2813                 63 per block instead of 50 (+13)
2814
2815             - UnlinkedFunctionExecutable
2816                 192 bytes instead of 224
2817                 84 per block instead of 72 (+12)
2818
2819         * heap/MarkedSpace.cpp:
2820
2821 2016-11-02  Geoffrey Garen  <ggaren@apple.com>
2822
2823         One file per class for UnlinkedCodeBlock.h/.cpp
2824         https://bugs.webkit.org/show_bug.cgi?id=164348
2825
2826         Reviewed by Saam Barati.
2827
2828         * CMakeLists.txt:
2829         * JavaScriptCore.xcodeproj/project.pbxproj:
2830         * bytecode/FunctionCodeBlock.h:
2831         * bytecode/ModuleProgramCodeBlock.h:
2832         * bytecode/ProgramCodeBlock.h:
2833         * bytecode/UnlinkedCodeBlock.cpp:
2834         (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
2835         (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
2836         (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
2837         (JSC::UnlinkedModuleProgramCodeBlock::destroy): Deleted.
2838         (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
2839         (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
2840         (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
2841         * bytecode/UnlinkedCodeBlock.h:
2842         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
2843         * bytecode/UnlinkedEvalCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
2844         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
2845         (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
2846         (JSC::UnlinkedCodeBlock::estimatedSize): Deleted.
2847         (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
2848         (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
2849         (JSC::dumpLineColumnEntry): Deleted.
2850         (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
2851         (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
2852         (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
2853         (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
2854         (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
2855         (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
2856         (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
2857         (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
2858         (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
2859         (JSC::UnlinkedModuleProgramCodeBlock::destroy): Deleted.
2860         (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
2861         (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
2862         (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
2863         (JSC::UnlinkedCodeBlock::instructions): Deleted.
2864         (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset): Deleted.
2865         (JSC::UnlinkedCodeBlock::handlerForIndex): Deleted.
2866         (JSC::UnlinkedCodeBlock::applyModification): Deleted.
2867         * bytecode/UnlinkedEvalCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
2868         (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
2869         (JSC::UnlinkedSimpleJumpTable::add): Deleted.
2870         (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
2871         (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
2872         (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
2873         (JSC::UnlinkedCodeBlock::usesEval): Deleted.
2874         (JSC::UnlinkedCodeBlock::parseMode): Deleted.
2875         (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
2876         (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
2877         (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
2878         (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
2879         (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
2880         (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
2881         (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
2882         (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
2883         (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
2884         (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
2885         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
2886         (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
2887         (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
2888         (JSC::UnlinkedCodeBlock::addParameter): Deleted.
2889         (JSC::UnlinkedCodeBlock::numParameters): Deleted.
2890         (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
2891         (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
2892         (JSC::UnlinkedCodeBlock::regexp): Deleted.
2893         (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
2894         (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
2895         (JSC::UnlinkedCodeBlock::identifier): Deleted.
2896         (JSC::UnlinkedCodeBlock::identifiers): Deleted.
2897         (JSC::UnlinkedCodeBlock::addConstant): Deleted.
2898         (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
2899         (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
2900         (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
2901         (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
2902         (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
2903         (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
2904         (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
2905         (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
2906         (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
2907         (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
2908         (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
2909         (JSC::UnlinkedCodeBlock::superBinding): Deleted.
2910         (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
2911         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
2912         (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
2913         (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
2914         (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
2915         (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
2916         (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
2917         (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
2918         (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
2919         (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
2920         (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
2921         (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
2922         (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
2923         (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
2924         (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
2925         (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
2926         (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
2927         (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
2928         (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
2929         (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
2930         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
2931         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
2932         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
2933         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
2934         (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
2935         (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
2936         (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
2937         (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
2938         (JSC::UnlinkedCodeBlock::codeType): Deleted.
2939         (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
2940         (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
2941         (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
2942         (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
2943         (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
2944         (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
2945         (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
2946         (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
2947         (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
2948         (JSC::UnlinkedCodeBlock::recordParse): Deleted.
2949         (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
2950         (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
2951         (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
2952         (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
2953         (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
2954         (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
2955         (JSC::UnlinkedCodeBlock::firstLine): Deleted.
2956         (JSC::UnlinkedCodeBlock::lineCount): Deleted.
2957         (JSC::UnlinkedCodeBlock::startColumn): Deleted.
2958         (JSC::UnlinkedCodeBlock::endColumn): Deleted.
2959         (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
2960         (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
2961         (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
2962         (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
2963         (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
2964         (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
2965         (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
2966         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
2967         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
2968         * bytecode/UnlinkedFunctionCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
2969         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
2970         (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
2971         (JSC::UnlinkedCodeBlock::estimatedSize): Deleted.
2972         (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
2973         (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
2974         (JSC::dumpLineColumnEntry): Deleted.
2975         (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
2976         (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
2977         (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
2978         (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
2979         (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
2980         (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
2981         (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
2982         (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
2983         (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
2984         (JSC::UnlinkedModuleProgramCodeBlock::destroy): Deleted.
2985         (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
2986         (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
2987         (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
2988         (JSC::UnlinkedCodeBlock::instructions): Deleted.
2989         (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset): Deleted.
2990         (JSC::UnlinkedCodeBlock::handlerForIndex): Deleted.
2991         (JSC::UnlinkedCodeBlock::applyModification): Deleted.
2992         * bytecode/UnlinkedFunctionCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
2993         (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
2994         (JSC::UnlinkedSimpleJumpTable::add): Deleted.
2995         (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
2996         (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
2997         (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
2998         (JSC::UnlinkedCodeBlock::usesEval): Deleted.
2999         (JSC::UnlinkedCodeBlock::parseMode): Deleted.
3000         (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
3001         (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
3002         (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
3003         (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
3004         (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
3005         (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
3006         (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
3007         (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
3008         (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
3009         (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
3010         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
3011         (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
3012         (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
3013         (JSC::UnlinkedCodeBlock::addParameter): Deleted.
3014         (JSC::UnlinkedCodeBlock::numParameters): Deleted.
3015         (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
3016         (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
3017         (JSC::UnlinkedCodeBlock::regexp): Deleted.
3018         (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
3019         (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
3020         (JSC::UnlinkedCodeBlock::identifier): Deleted.
3021         (JSC::UnlinkedCodeBlock::identifiers): Deleted.
3022         (JSC::UnlinkedCodeBlock::addConstant): Deleted.
3023         (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
3024         (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
3025         (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
3026         (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
3027         (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
3028         (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
3029         (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
3030         (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
3031         (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
3032         (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
3033         (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
3034         (JSC::UnlinkedCodeBlock::superBinding): Deleted.
3035         (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
3036         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
3037         (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
3038         (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
3039         (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
3040         (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
3041         (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
3042         (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
3043         (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
3044         (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
3045         (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
3046         (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
3047         (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
3048         (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
3049         (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
3050         (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
3051         (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
3052         (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
3053         (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
3054         (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
3055         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
3056         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
3057         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
3058         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
3059         (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
3060         (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
3061         (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
3062         (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
3063         (JSC::UnlinkedCodeBlock::codeType): Deleted.
3064         (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
3065         (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
3066         (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
3067         (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
3068         (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
3069         (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
3070         (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
3071         (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
3072         (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
3073         (JSC::UnlinkedCodeBlock::recordParse): Deleted.
3074         (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
3075         (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
3076         (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
3077         (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
3078         (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
3079         (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
3080         (JSC::UnlinkedCodeBlock::firstLine): Deleted.
3081         (JSC::UnlinkedCodeBlock::lineCount): Deleted.
3082         (JSC::UnlinkedCodeBlock::startColumn): Deleted.
3083         (JSC::UnlinkedCodeBlock::endColumn): Deleted.
3084         (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
3085         (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
3086         (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
3087         (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
3088         (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
3089         (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
3090         (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
3091         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
3092         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
3093         * bytecode/UnlinkedFunctionExecutable.cpp:
3094         (JSC::UnlinkedFunctionExecutable::destroy):
3095         * bytecode/UnlinkedGlobalCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
3096         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock):
3097         (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
3098         (JSC::UnlinkedSimpleJumpTable::add): Deleted.
3099         (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
3100         (): Deleted.
3101         (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
3102         (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
3103         (JSC::UnlinkedCodeBlock::usesEval): Deleted.
3104         (JSC::UnlinkedCodeBlock::parseMode): Deleted.
3105         (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
3106         (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
3107         (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
3108         (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
3109         (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
3110         (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
3111         (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
3112         (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
3113         (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
3114         (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
3115         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
3116         (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
3117         (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
3118         (JSC::UnlinkedCodeBlock::addParameter): Deleted.
3119         (JSC::UnlinkedCodeBlock::numParameters): Deleted.
3120         (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
3121         (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
3122         (JSC::UnlinkedCodeBlock::regexp): Deleted.
3123         (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
3124         (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
3125         (JSC::UnlinkedCodeBlock::identifier): Deleted.
3126         (JSC::UnlinkedCodeBlock::identifiers): Deleted.
3127         (JSC::UnlinkedCodeBlock::addConstant): Deleted.
3128         (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
3129         (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
3130         (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
3131         (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
3132         (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
3133         (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
3134         (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
3135         (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
3136         (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
3137         (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
3138         (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
3139         (JSC::UnlinkedCodeBlock::superBinding): Deleted.
3140         (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
3141         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
3142         (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
3143         (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
3144         (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
3145         (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
3146         (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
3147         (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
3148         (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
3149         (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
3150         (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
3151         (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
3152         (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
3153         (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
3154         (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
3155         (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
3156         (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
3157         (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
3158         (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
3159         (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
3160         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
3161         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
3162         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
3163         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
3164         (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
3165         (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
3166         (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
3167         (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
3168         (JSC::UnlinkedCodeBlock::codeType): Deleted.
3169         (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
3170         (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
3171         (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
3172         (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
3173         (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
3174         (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
3175         (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
3176         (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
3177         (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
3178         (JSC::UnlinkedCodeBlock::recordParse): Deleted.
3179         (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
3180         (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
3181         (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
3182         (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
3183         (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
3184         (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
3185         (JSC::UnlinkedCodeBlock::firstLine): Deleted.
3186         (JSC::UnlinkedCodeBlock::lineCount): Deleted.
3187         (JSC::UnlinkedCodeBlock::startColumn): Deleted.
3188         (JSC::UnlinkedCodeBlock::endColumn): Deleted.
3189         (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
3190         (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
3191         (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
3192         (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
3193         (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
3194         (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
3195         (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
3196         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
3197         * bytecode/UnlinkedModuleProgramCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
3198         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
3199         (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
3200         (JSC::UnlinkedCodeBlock::estimatedSize): Deleted.
3201         (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
3202         (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
3203         (JSC::dumpLineColumnEntry): Deleted.
3204         (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
3205         (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
3206         (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
3207         (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
3208         (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
3209         (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
3210         (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
3211         (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
3212         (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
3213         (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
3214         (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
3215         (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
3216         (JSC::UnlinkedCodeBlock::instructions): Deleted.
3217         (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset): Deleted.
3218         (JSC::UnlinkedCodeBlock::handlerForIndex): Deleted.
3219         (JSC::UnlinkedCodeBlock::applyModification): Deleted.
3220         * bytecode/UnlinkedModuleProgramCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
3221         (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
3222         (JSC::UnlinkedSimpleJumpTable::add): Deleted.
3223         (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
3224         (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
3225         (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
3226         (JSC::UnlinkedCodeBlock::usesEval): Deleted.
3227         (JSC::UnlinkedCodeBlock::parseMode): Deleted.
3228         (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
3229         (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
3230         (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
3231         (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
3232         (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
3233         (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
3234         (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
3235         (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
3236         (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
3237         (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
3238         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
3239         (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
3240         (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
3241         (JSC::UnlinkedCodeBlock::addParameter): Deleted.
3242         (JSC::UnlinkedCodeBlock::numParameters): Deleted.
3243         (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
3244         (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
3245         (JSC::UnlinkedCodeBlock::regexp): Deleted.
3246         (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
3247         (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
3248         (JSC::UnlinkedCodeBlock::identifier): Deleted.
3249         (JSC::UnlinkedCodeBlock::identifiers): Deleted.
3250         (JSC::UnlinkedCodeBlock::addConstant): Deleted.
3251         (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
3252         (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
3253         (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
3254         (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
3255         (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
3256         (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
3257         (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
3258         (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
3259         (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
3260         (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
3261         (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
3262         (JSC::UnlinkedCodeBlock::superBinding): Deleted.
3263         (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
3264         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
3265         (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
3266         (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
3267         (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
3268         (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
3269         (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
3270         (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
3271         (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
3272         (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
3273         (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
3274         (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
3275         (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
3276         (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
3277         (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
3278         (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
3279         (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
3280         (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
3281         (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
3282         (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
3283         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
3284         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
3285         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
3286         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
3287         (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
3288         (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
3289         (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
3290         (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
3291         (JSC::UnlinkedCodeBlock::codeType): Deleted.
3292         (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
3293         (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
3294         (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
3295         (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
3296         (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
3297         (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
3298         (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
3299         (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
3300         (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
3301         (JSC::UnlinkedCodeBlock::recordParse): Deleted.
3302         (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
3303         (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
3304         (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
3305         (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
3306         (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
3307         (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
3308         (JSC::UnlinkedCodeBlock::firstLine): Deleted.
3309         (JSC::UnlinkedCodeBlock::lineCount): Deleted.
3310         (JSC::UnlinkedCodeBlock::startColumn): Deleted.
3311         (JSC::UnlinkedCodeBlock::endColumn): Deleted.
3312         (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
3313         (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
3314         (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
3315         (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
3316         (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
3317         (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
3318         (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
3319         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
3320         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
3321         * bytecode/UnlinkedProgramCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
3322         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
3323         (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
3324         (JSC::UnlinkedCodeBlock::estimatedSize): Deleted.
3325         (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
3326         (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
3327         (JSC::dumpLineColumnEntry): Deleted.
3328         (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
3329         (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
3330         (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
3331         (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
3332         (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
3333         (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
3334         (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
3335         (JSC::UnlinkedModuleProgramCodeBlock::destroy): Deleted.
3336         (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
3337         (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
3338         (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
3339         (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
3340         (JSC::UnlinkedCodeBlock::instructions): Deleted.
3341         (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset): Deleted.
3342         (JSC::UnlinkedCodeBlock::handlerForIndex): Deleted.
3343         (JSC::UnlinkedCodeBlock::applyModification): Deleted.
3344         * bytecode/UnlinkedProgramCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
3345         (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
3346         (JSC::UnlinkedSimpleJumpTable::add): Deleted.
3347         (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
3348         (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
3349         (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
3350         (JSC::UnlinkedCodeBlock::usesEval): Deleted.
3351         (JSC::UnlinkedCodeBlock::parseMode): Deleted.
3352         (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
3353         (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
3354         (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
3355         (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
3356         (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
3357         (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
3358         (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
3359         (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
3360         (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
3361         (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
3362         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
3363         (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
3364         (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
3365         (JSC::UnlinkedCodeBlock::addParameter): Deleted.
3366         (JSC::UnlinkedCodeBlock::numParameters): Deleted.
3367         (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
3368         (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
3369         (JSC::UnlinkedCodeBlock::regexp): Deleted.
3370         (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
3371         (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
3372         (JSC::UnlinkedCodeBlock::identifier): Deleted.
3373         (JSC::UnlinkedCodeBlock::identifiers): Deleted.
3374         (JSC::UnlinkedCodeBlock::addConstant): Deleted.
3375         (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
3376         (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
3377         (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
3378         (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
3379         (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
3380         (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
3381         (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
3382         (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
3383         (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
3384         (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
3385         (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
3386         (JSC::UnlinkedCodeBlock::superBinding): Deleted.
3387         (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
3388         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
3389         (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
3390         (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
3391         (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
3392         (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
3393         (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
3394         (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
3395         (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
3396         (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
3397         (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
3398         (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
3399         (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
3400         (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
3401         (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
3402         (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
3403         (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
3404         (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
3405         (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
3406         (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
3407         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
3408         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
3409         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
3410         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
3411         (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
3412         (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
3413         (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
3414         (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
3415         (JSC::UnlinkedCodeBlock::codeType): Deleted.
3416         (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
3417         (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
3418         (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
3419         (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
3420         (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
3421         (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
3422         (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
3423         (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
3424         (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
3425         (JSC::UnlinkedCodeBlock::recordParse): Deleted.
3426         (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
3427         (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
3428         (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
3429         (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
3430         (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
3431         (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
3432         (JSC::UnlinkedCodeBlock::firstLine): Deleted.
3433         (JSC::UnlinkedCodeBlock::lineCount): Deleted.
3434         (JSC::UnlinkedCodeBlock::startColumn): Deleted.
3435         (JSC::UnlinkedCodeBlock::endColumn): Deleted.
3436         (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
3437         (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
3438         (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
3439         (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
3440         (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
3441         (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
3442         (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
3443         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
3444         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
3445         * bytecompiler/BytecodeGenerator.cpp:
3446         * runtime/CodeCache.cpp:
3447         * runtime/EvalExecutable.h:
3448         * runtime/JSModuleRecord.cpp:
3449
3450 2016-11-02  Saam Barati  <sbarati@apple.com>
3451
3452         Allocation elimination of rest parameter doesn't take into account indexed properties on Array.prototype/Object.prototype
3453         https://bugs.webkit.org/show_bug.cgi?id=164301
3454
3455         Reviewed by Geoffrey Garen.
3456
3457         We weren't taking into account indexed properties on the __proto__
3458         of the rest parameter. This made the code for doing out of bound
3459         accesses incorrect since it just assumed it's safe for the result of
3460         an out of bound access to be undefined. This broke the semantics
3461         of JS code when there was an indexed property on the Array.prototype
3462         or Object.prototype.
3463
3464         This patch makes sure we set up the proper watchpoints for making
3465         sure out of bound accesses are safe to return undefined.
3466
3467         * dfg/DFGArgumentsEliminationPhase.cpp:
3468
3469 2016-11-02  Geoffrey Garen  <ggaren@apple.com>
3470
3471         One file per class for CodeBlock.h/.cpp
3472         https://bugs.webkit.org/show_bug.cgi?id=164343
3473
3474         Reviewed by Andreas Kling.
3475
3476         * CMakeLists.txt:
3477         * JavaScriptCore.xcodeproj/project.pbxproj:
3478         * bytecode/CallLinkInfo.cpp:
3479         * bytecode/CodeBlock.cpp:
3480         (JSC::FunctionCodeBlock::destroy): Deleted.
3481         (JSC::WebAssemblyCodeBlock::destroy): Deleted.
3482         (JSC::ProgramCodeBlock::destroy): Deleted.
3483         (JSC::ModuleProgramCodeBlock::destroy): Deleted.
3484         (JSC::EvalCodeBlock::destroy): Deleted.
3485         * bytecode/CodeBlock.h:
3486         (JSC::GlobalCodeBlock::GlobalCodeBlock): Deleted.
3487         (JSC::ProgramCodeBlock::create): Deleted.
3488         (JSC::ProgramCodeBlock::createStructure): Deleted.
3489         (JSC::ProgramCodeBlock::ProgramCodeBlock): Deleted.
3490         (JSC::ModuleProgramCodeBlock::create): Deleted.
3491         (JSC::ModuleProgramCodeBlock::createStructure): Deleted.
3492         (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock): Deleted.
3493         (JSC::EvalCodeBlock::create): Deleted.
3494         (JSC::EvalCodeBlock::createStructure): Deleted.
3495         (JSC::EvalCodeBlock::variable): Deleted.
3496         (JSC::EvalCodeBlock::numVariables): Deleted.
3497         (JSC::EvalCodeBlock::EvalCodeBlock): Deleted.
3498         (JSC::EvalCodeBlock::unlinkedEvalCodeBlock): Deleted.
3499         (JSC::FunctionCodeBlock::create): Deleted.
3500         (JSC::FunctionCodeBlock::createStructure): Deleted.
3501         (JSC::FunctionCodeBlock::FunctionCodeBlock): Deleted.
3502         (JSC::WebAssemblyCodeBlock::create): Deleted.
3503         (JSC::WebAssemblyCodeBlock::createStructure): Deleted.
3504         (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock): Deleted.
3505         (JSC::ScriptExecutable::forEachCodeBlock): Deleted.
3506         * bytecode/EvalCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/CodeBlock.cpp.
3507         (JSC::FunctionCodeBlock::destroy): Deleted.
3508         (JSC::WebAssemblyCodeBlock::destroy): Deleted.
3509         (JSC::ProgramCodeBlock::destroy): Deleted.
3510         (JSC::ModuleProgramCodeBlock::destroy): Deleted.
3511         (JSC::CodeBlock::inferredName): Deleted.
3512         (JSC::CodeBlock::hasHash): Deleted.
3513         (JSC::CodeBlock::isSafeToComputeHash): Deleted.
3514         (JSC::CodeBlock::hash): Deleted.
3515         (JSC::CodeBlock::sourceCodeForTools): Deleted.
3516         (JSC::CodeBlock::sourceCodeOnOneLine): Deleted.
3517         (JSC::CodeBlock::hashAsStringIfPossible): Deleted.
3518         (JSC::CodeBlock::dumpAssumingJITType): Deleted.
3519         (JSC::CodeBlock::dump): Deleted.
3520         (JSC::idName): Deleted.
3521         (JSC::CodeBlock::registerName): Deleted.
3522         (JSC::CodeBlock::constantName): Deleted.
3523         (JSC::regexpToSourceString): Deleted.
3524         (JSC::regexpName): Deleted.
3525         (JSC::debugHookName): Deleted.
3526         (JSC::CodeBlock::printUnaryOp): Deleted.
3527         (JSC::CodeBlock::printBinaryOp): Deleted.
3528         (JSC::CodeBlock::printConditionalJump): Deleted.
3529         (JSC::CodeBlock::printGetByIdOp): Deleted.
3530         (JSC::dumpStructure): Deleted.
3531         (JSC::dumpChain): Deleted.
3532         (JSC::CodeBlock::printGetByIdCacheStatus): Deleted.
3533         (JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
3534         (JSC::CodeBlock::printCallOp): Deleted.
3535         (JSC::CodeBlock::printPutByIdOp): Deleted.
3536         (JSC::CodeBlock::dumpSource): Deleted.
3537         (JSC::CodeBlock::dumpBytecode): Deleted.
3538         (JSC::CodeBlock::dumpExceptionHandlers): Deleted.
3539         (JSC::CodeBlock::beginDumpProfiling): Deleted.
3540         (JSC::CodeBlock::dumpValueProfiling): Deleted.
3541         (JSC::CodeBlock::dumpArrayProfiling): Deleted.
3542         (JSC::CodeBlock::dumpRareCaseProfile): Deleted.
3543         (JSC::CodeBlock::dumpArithProfile): Deleted.
3544         (JSC::CodeBlock::printLocationAndOp): Deleted.
3545         (JSC::CodeBlock::printLocationOpAndRegisterOperand): Deleted.
3546         (JSC::sizeInBytes): Deleted.
3547         (JSC::CodeBlock::CodeBlock): Deleted.
3548         (JSC::CodeBlock::finishCreation): Deleted.
3549         (JSC::CodeBlock::~CodeBlock): Deleted.
3550         (JSC::CodeBlock::setConstantRegisters): Deleted.
3551         (JSC::CodeBlock::setAlternative): Deleted.
3552         (JSC::CodeBlock::setNumParameters): Deleted.
3553         (JSC::EvalCodeCache::visitAggregate): Deleted.
3554         (JSC::CodeBlock::specialOSREntryBlockOrNull): Deleted.
3555         (JSC::CodeBlock::visitWeakly): Deleted.
3556         (JSC::CodeBlock::estimatedSize): Deleted.
3557         (JSC::CodeBlock::visitChildren): Deleted.
3558         (JSC::CodeBlock::shouldVisitStrongly): Deleted.
3559         (JSC::CodeBlock::shouldJettisonDueToWeakReference): Deleted.
3560         (JSC::timeToLive): Deleted.
3561         (JSC::CodeBlock::shouldJettisonDueToOldAge): Deleted.
3562         (JSC::shouldMarkTransition): Deleted.
3563         (JSC::CodeBlock::propagateTransitions): Deleted.
3564         (JSC::CodeBlock::determineLiveness): Deleted.
3565         (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences): Deleted.
3566         (JSC::CodeBlock::clearLLIntGetByIdCache): Deleted.
3567         (JSC::CodeBlock::finalizeLLIntInlineCaches): Deleted.
3568         (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
3569         (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): Deleted.
3570         (JSC::CodeBlock::getStubInfoMap): Deleted.
3571         (JSC::CodeBlock::getCallLinkInfoMap): Deleted.
3572         (JSC::CodeBlock::getByValInfoMap): Deleted.
3573         (JSC::CodeBlock::addStubInfo): Deleted.
3574         (JSC::CodeBlock::addJITAddIC): Deleted.
3575         (JSC::CodeBlock::addJITMulIC): Deleted.
3576         (JSC::CodeBlock::addJITSubIC): Deleted.
3577         (JSC::CodeBlock::addJITNegIC): Deleted.
3578         (JSC::CodeBlock::findStubInfo): Deleted.
3579         (JSC::CodeBlock::addByValInfo): Deleted.
3580         (JSC::CodeBlock::addCallLinkInfo): Deleted.
3581         (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex): Deleted.
3582         (JSC::CodeBlock::resetJITData): Deleted.
3583         (JSC::CodeBlock::visitOSRExitTargets): Deleted.
3584         (JSC::CodeBlock::stronglyVisitStrongReferences): Deleted.
3585         (JSC::CodeBlock::stronglyVisitWeakReferences): Deleted.
3586         (JSC::CodeBlock::baselineAlternative): Deleted.
3587         (JSC::CodeBlock::baselineVersion): Deleted.
3588         (JSC::CodeBlock::hasOptimizedReplacement): Deleted.
3589         (JSC::CodeBlock::handlerForBytecodeOffset): Deleted.
3590         (JSC::CodeBlock::handlerForIndex): Deleted.
3591         (JSC::CodeBlock::newExceptionHandlingCallSiteIndex): Deleted.
3592         (JSC::CodeBlock::removeExceptionHandlerForCallSite): Deleted.
3593         (JSC::CodeBlock::lineNumberForBytecodeOffset): Deleted.
3594         (JSC::CodeBlock::columnNumberForBytecodeOffset): Deleted.
3595         (JSC::CodeBlock::expressionRangeForBytecodeOffset): Deleted.
3596         (JSC::CodeBlock::hasOpDebugForLineAndColumn): Deleted.
3597         (JSC::CodeBlock::shrinkToFit): Deleted.
3598         (JSC::CodeBlock::linkIncomingCall): Deleted.
3599         (JSC::CodeBlock::linkIncomingPolymorphicCall): Deleted.
3600         (JSC::CodeBlock::unlinkIncomingCalls): Deleted.
3601         (JSC::CodeBlock::newReplacement): Deleted.
3602         (JSC::CodeBlock::replacement): Deleted.
3603         (JSC::CodeBlock::computeCapabilityLevel): Deleted.
3604         (JSC::CodeBlock::jettison): Deleted.
3605         (JSC::CodeBlock::globalObjectFor): Deleted.
3606         (JSC::RecursionCheckFunctor::RecursionCheckFunctor): Deleted.
3607         (JSC::RecursionCheckFunctor::operator()): Deleted.
3608         (JSC::RecursionCheckFunctor::didRecurse): Deleted.
3609         (JSC::CodeBlock::noticeIncomingCall): Deleted.
3610         (JSC::CodeBlock::reoptimizationRetryCounter): Deleted.
3611         (JSC::CodeBlock::setCalleeSaveRegisters): Deleted.
3612         (JSC::roundCalleeSaveSpaceAsVirtualRegisters): Deleted.
3613         (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
3614         (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters): Deleted.
3615         (JSC::CodeBlock::countReoptimization): Deleted.
3616         (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
3617         (JSC::CodeBlock::codeTypeThresholdMultiplier): Deleted.
3618         (JSC::CodeBlock::optimizationThresholdScalingFactor): Deleted.
3619         (JSC::clipThreshold): Deleted.
3620         (JSC::CodeBlock::adjustedCounterValue): Deleted.
3621         (JSC::CodeBlock::checkIfOptimizationThresholdReached): Deleted.
3622         (JSC::CodeBlock::optimizeNextInvocation): Deleted.
3623         (JSC::CodeBlock::dontOptimizeAnytimeSoon): Deleted.
3624         (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
3625         (JSC::CodeBlock::optimizeAfterLongWarmUp): Deleted.
3626         (JSC::CodeBlock::optimizeSoon): Deleted.
3627         (JSC::CodeBlock::forceOptimizationSlowPathConcurrently): Deleted.
3628         (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult): Deleted.
3629         (JSC::CodeBlock::adjustedExitCountThreshold): Deleted.
3630         (JSC::CodeBlock::exitCountThresholdForReoptimization): Deleted.
3631         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): Deleted.
3632         (JSC::CodeBlock::shouldReoptimizeNow): Deleted.
3633         (JSC::CodeBlock::shouldReoptimizeFromLoopNow): Deleted.
3634         (JSC::CodeBlock::getArrayProfile): Deleted.
3635         (JSC::CodeBlock::addArrayProfile): Deleted.
3636         (JSC::CodeBlock::getOrAddArrayProfile): Deleted.
3637         (JSC::CodeBlock::codeOrigins): Deleted.
3638         (JSC::CodeBlock::numberOfDFGIdentifiers): Deleted.
3639         (JSC::CodeBlock::identifier): Deleted.
3640         (JSC::CodeBlock::updateAllPredictionsAndCountLiveness): Deleted.
3641         (JSC::CodeBlock::updateAllValueProfilePredictions): Deleted.
3642         (JSC::CodeBlock::updateAllArrayPredictions): Deleted.
3643         (JSC::CodeBlock::updateAllPredictions): Deleted.
3644         (JSC::CodeBlock::shouldOptimizeNow): Deleted.
3645         (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
3646         (JSC::CodeBlock::dumpValueProfiles): Deleted.
3647         (JSC::CodeBlock::frameRegisterCount): Deleted.
3648         (JSC::CodeBlock::stackPointerOffset): Deleted.
3649         (JSC::CodeBlock::predictedMachineCodeSize): Deleted.
3650         (JSC::CodeBlock::usesOpcode): Deleted.
3651         (JSC::CodeBlock::nameForRegister): Deleted.
3652         (JSC::CodeBlock::valueProfileForBytecodeOffset): Deleted.
3653         (JSC::CodeBlock::validate): Deleted.
3654         (JSC::CodeBlock::beginValidationDidFail): Deleted.
3655         (JSC::CodeBlock::endValidationDidFail): Deleted.
3656         (JSC::CodeBlock::addBreakpoint): Deleted.
3657         (JSC::CodeBlock::setSteppingMode): Deleted.
3658         (JSC::CodeBlock::addRareCaseProfile): Deleted.
3659         (JSC::CodeBlock::rareCaseProfileForBytecodeOffset): Deleted.
3660         (JSC::CodeBlock::rareCaseProfileCountForBytecodeOffset): Deleted.
3661         (JSC::CodeBlock::arithProfileForBytecodeOffset): Deleted.
3662         (JSC::CodeBlock::arithProfileForPC): Deleted.
3663         (JSC::CodeBlock::couldTakeSpecialFastCase): Deleted.
3664         (JSC::CodeBlock::capabilityLevel): Deleted.
3665         (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler): Deleted.
3666         (JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
3667         (JSC::CodeBlock::findPC): Deleted.
3668         (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex): Deleted.
3669         (JSC::CodeBlock::thresholdForJIT): Deleted.
3670         (JSC::CodeBlock::jitAfterWarmUp): Deleted.
3671         (JSC::CodeBlock::jitSoon): Deleted.
3672         (JSC::CodeBlock::dumpMathICStats): Deleted.
3673         (JSC::CodeBlock::livenessAnalysisSlow): Deleted.
3674         * bytecode/EvalCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/CodeBlock.h.
3675         (): Deleted.
3676         (JSC::CodeBlock::unlinkedCodeBlock): Deleted.
3677         (JSC::CodeBlock::numParameters): Deleted.
3678         (JSC::CodeBlock::numCalleeLocals): Deleted.
3679         (JSC::CodeBlock::addressOfNumParameters): Deleted.
3680         (JSC::CodeBlock::offsetOfNumParameters): Deleted.
3681         (JSC::CodeBlock::alternative): Deleted.
3682         (JSC::CodeBlock::forEachRelatedCodeBlock): Deleted.
3683         (JSC::CodeBlock::specializationKind): Deleted.
3684         (JSC::CodeBlock::isStrictMode): Deleted.
3685         (JSC::CodeBlock::ecmaMode): Deleted.
3686         (JSC::CodeBlock::isKnownNotImmediate): Deleted.
3687         (JSC::CodeBlock::isTemporaryRegisterIndex): Deleted.
3688         (JSC::CodeBlock::stubInfoBegin): Deleted.
3689         (JSC::CodeBlock::stubInfoEnd): Deleted.
3690         (JSC::CodeBlock::callLinkInfosBegin): Deleted.
3691         (JSC::CodeBlock::callLinkInfosEnd): Deleted.
3692         (JSC::CodeBlock::setJITCodeMap): Deleted.
3693         (JSC::CodeBlock::jitCodeMap): Deleted.
3694         (JSC::CodeBlock::bytecodeOffset): Deleted.
3695         (JSC::CodeBlock::numberOfInstructions): Deleted.
3696         (JSC::CodeBlock::instructions): Deleted.
3697         (JSC::CodeBlock::instructionCount): Deleted.
3698         (JSC::CodeBlock::setJITCode): Deleted.
3699         (JSC::CodeBlock::jitCode): Deleted.
3700         (JSC::CodeBlock::jitCodeOffset): Deleted.
3701         (JSC::CodeBlock::jitType): Deleted.
3702         (JSC::CodeBlock::hasBaselineJITProfiling): Deleted.
3703         (JSC::CodeBlock::capabilityLevelState): Deleted.
3704         (JSC::CodeBlock::ownerExecutable): Deleted.
3705         (JSC::CodeBlock::ownerScriptExecutable): Deleted.
3706         (JSC::CodeBlock::vm): Deleted.
3707         (JSC::CodeBlock::setThisRegister): Deleted.
3708         (JSC::CodeBlock::thisRegister): Deleted.
3709         (JSC::CodeBlock::usesEval): Deleted.
3710         (JSC::CodeBlock::setScopeRegister): Deleted.
3711         (JSC::CodeBlock::scopeRegister): Deleted.
3712         (JSC::CodeBlock::codeType): Deleted.
3713         (JSC::CodeBlock::putByIdContext): Deleted.
3714         (JSC::CodeBlock::source): Deleted.
3715         (JSC::CodeBlock::sourceOffset): Deleted.
3716         (JSC::CodeBlock::firstLineColumnOffset): Deleted.
3717         (JSC::CodeBlock::numberOfJumpTargets): Deleted.
3718         (JSC::CodeBlock::jumpTarget): Deleted.
3719         (JSC::CodeBlock::numberOfArgumentValueProfiles): Deleted.
3720         (JSC::CodeBlock::valueProfileForArgument): Deleted.
3721         (JSC::CodeBlock::numberOfValueProfiles): Deleted.
3722         (JSC::CodeBlock::valueProfile): Deleted.
3723         (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset): Deleted.
3724         (JSC::CodeBlock::totalNumberOfValueProfiles): Deleted.
3725         (JSC::CodeBlock::getFromAllValueProfiles): Deleted.
3726         (JSC::CodeBlock::numberOfRareCaseProfiles): Deleted.
3727         (JSC::CodeBlock::likelyToTakeSlowCase): Deleted.
3728         (JSC::CodeBlock::couldTakeSlowCase): Deleted.
3729         (JSC::CodeBlock::numberOfArrayProfiles): Deleted.
3730         (JSC::CodeBlock::arrayProfiles): Deleted.
3731         (JSC::CodeBlock::numberOfExceptionHandlers): Deleted.
3732         (JSC::CodeBlock::exceptionHandler): Deleted.
3733         (JSC::CodeBlock::hasExpressionInfo): Deleted.
3734         (JSC::CodeBlock::hasCodeOrigins): Deleted.
3735         (JSC::CodeBlock::canGetCodeOrigin): Deleted.
3736         (JSC::CodeBlock::codeOrigin): Deleted.
3737         (JSC::CodeBlock::addFrequentExitSite): Deleted.
3738         (JSC::CodeBlock::hasExitSite): Deleted.
3739         (JSC::CodeBlock::exitProfile): Deleted.
3740         (JSC::CodeBlock::lazyOperandValueProfiles): Deleted.
3741         (JSC::CodeBlock::numberOfIdentifiers): Deleted.
3742         (JSC::CodeBlock::identifier): Deleted.
3743         (JSC::CodeBlock::constants): Deleted.
3744         (JSC::CodeBlock::constantsSourceCodeRepresentation): Deleted.
3745         (JSC::CodeBlock::addConstant): Deleted.
3746         (JSC::CodeBlock::addConstantLazily): Deleted.
3747         (JSC::CodeBlock::constantRegister): Deleted.
3748         (JSC::CodeBlock::isConstantRegisterIndex): Deleted.
3749         (JSC::CodeBlock::getConstant): Deleted.
3750         (JSC::CodeBlock::constantSourceCodeRepresentation): Deleted.
3751         (JSC::CodeBlock::functionDecl): Deleted.
3752         (JSC::CodeBlock::numberOfFunctionDecls): Deleted.
3753         (JSC::CodeBlock::functionExpr): Deleted.
3754         (JSC::CodeBlock::regexp): Deleted.
3755         (JSC::CodeBlock::numberOfConstantBuffers): Deleted.
3756         (JSC::CodeBlock::addConstantBuffer): Deleted.
3757         (JSC::CodeBlock::constantBufferAsVector): Deleted.
3758         (JSC::CodeBlock::constantBuffer): Deleted.
3759         (JSC::CodeBlock::heap): Deleted.
3760         (JSC::CodeBlock::globalObject): Deleted.
3761         (JSC::CodeBlock::livenessAnalysis): Deleted.
3762         (JSC::CodeBlock::numberOfSwitchJumpTables): Deleted.
3763         (JSC::CodeBlock::addSwitchJumpTable): Deleted.
3764         (JSC::CodeBlock::switchJumpTable): Deleted.
3765         (JSC::CodeBlock::clearSwitchJumpTables): Deleted.
3766         (JSC::CodeBlock::numberOfStringSwitchJumpTables): Deleted.
3767         (JSC::CodeBlock::addStringSwitchJumpTable): Deleted.
3768         (JSC::CodeBlock::stringSwitchJumpTable): Deleted.
3769         (JSC::CodeBlock::evalCodeCache): Deleted.
3770         (JSC::CodeBlock::checkIfJITThresholdReached): Deleted.
3771         (JSC::CodeBlock::dontJITAnytimeSoon): Deleted.
3772         (JSC::CodeBlock::llintExecuteCounter): Deleted.
3773         (JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.
3774         (JSC::CodeBlock::numberOfLLIntBaselineCalleeSaveRegisters): Deleted.
3775         (JSC::CodeBlock::addressOfJITExecuteCounter): Deleted.
3776         (JSC::CodeBlock::offsetOfJITExecuteCounter): Deleted.
3777         (JSC::CodeBlock::offsetOfJITExecutionActiveThreshold): Deleted.
3778         (JSC::CodeBlock::offsetOfJITExecutionTotalCount): Deleted.
3779         (JSC::CodeBlock::jitExecuteCounter): Deleted.
3780         (JSC::CodeBlock::optimizationDelayCounter): Deleted.
3781         (JSC::CodeBlock::osrExitCounter): Deleted.
3782         (JSC::CodeBlock::countOSRExit): Deleted.
3783         (JSC::CodeBlock::addressOfOSRExitCounter): Deleted.
3784         (JSC::CodeBlock::offsetOfOSRExitCounter): Deleted.
3785         (JSC::CodeBlock::calleeSaveRegisters): Deleted.
3786         (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
3787         (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
3788         (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
3789         (JSC::CodeBlock::hasDebuggerRequests): Deleted.
3790         (JSC::CodeBlock::debuggerRequestsAddress): Deleted.
3791         (JSC::CodeBlock::removeBreakpoint): Deleted.
3792         (JSC::CodeBlock::clearDebuggerRequests): Deleted.
3793         (JSC::CodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
3794         (JSC::CodeBlock::clearExceptionHandlers): Deleted.
3795         (JSC::CodeBlock::appendExceptionHandler): Deleted.
3796         (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
3797         (JSC::CodeBlock::replaceConstant): Deleted.