1 2016-04-18 Yusuke Suzuki <utatane.tea@gmail.com>
3 [ES7] yield star should not return if the inner iterator.throw returns { done: true }
4 https://bugs.webkit.org/show_bug.cgi?id=156576
6 Reviewed by Saam Barati.
8 This is slight generator fix in ES7. When calling generator.throw(),
9 the yield-star should call the throw() of the inner generator. At that
10 time, when the result of throw() is { done: true}, the generator should
15 yield * (function * () {
20 // Continue executing.
26 shouldBe(g.throw().value, 42);
29 * builtins/GeneratorPrototype.js:
34 * bytecode/BytecodeIntrinsicRegistry.cpp:
35 (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
36 * bytecode/BytecodeIntrinsicRegistry.h:
37 * bytecompiler/BytecodeGenerator.cpp:
38 (JSC::BytecodeGenerator::emitDelegateYield):
39 * runtime/JSGeneratorFunction.h:
40 * tests/stress/generator-yield-star.js:
42 * tests/stress/yield-star-throw-continue.js: Added.
47 2016-04-17 Jeremy Huddleston Sequoia <jeremyhu@apple.com>
49 Fix incorrect assumption that APPLE implies Mac.
50 https://bugs.webkit.org/show_bug.cgi?id=156683
52 Addresses build failure introduced in r199094
54 Reviewed by Alex Christensen.
58 2016-04-17 Benjamin Poulain <bpoulain@apple.com>
60 [JSC] ReduceDoubleToFloat should work accross Phis
61 https://bugs.webkit.org/show_bug.cgi?id=156603
62 <rdar://problem/25736205>
64 Reviewed by Saam Barati and Filip Pizlo.
66 This patch extends B3's ReduceDoubleToFloat phase to work accross
67 Upsilon-Phis. This is important to optimize loops and some crazy cases.
69 In its simplest form, we can have conversion propagated from something
72 Float @2 = DoubleToFloat(@1)
74 When that happens, we just need to propagate that the result only
75 need float precision accross all values coming to this Phi.
78 There are more complicated cases when the value produced is effectively Float
79 but the user of the value does not do DoubleToFloat.
81 Typically, we have something like:
86 @3 = FloatToDouble(@x)
90 @6 = Add(@5, @somethingFloat)
91 @7 = DoubleToFloat(@6)
93 Here with a Phi-Upsilon that is a Double but can be represented
94 as Float without loss of precision.
96 It is valuable to convert such Phis to float if and only if the value
97 is used as float. Otherwise, you may be just adding useless conversions
98 (for example, two double constants that flow into a double Add should not
99 turn into two float constant flowing into a FloatToDouble then Add).
102 ReduceDoubleToFloat do two analysis passes to gather the necessary
103 meta information. Then we have a simplify() phase to actually reduce
104 operation. Finally, the cleanup() pass put the graph into a valid
107 The two analysis passes work by disproving that something is float.
108 -findCandidates() accumulates anything used as Double.
109 -findPhisContainingFloat() accumulates phis that would lose precision
110 by converting the input to float.
112 With this change, Unity3D improves by ~1.5%, box2d-f32 improves
113 by ~2.8% (on Haswell).
115 * b3/B3ReduceDoubleToFloat.cpp:
116 (JSC::B3::reduceDoubleToFloat):
118 (JSC::B3::testCompareTwoFloatToDouble):
119 (JSC::B3::testCompareOneFloatToDouble):
120 (JSC::B3::testCompareFloatToDoubleThroughPhi):
121 (JSC::B3::testDoubleToFloatThroughPhi):
122 (JSC::B3::testDoubleProducerPhiToFloatConversion):
123 (JSC::B3::testDoubleProducerPhiToFloatConversionWithDoubleConsumer):
124 (JSC::B3::testDoubleProducerPhiWithNonFloatConst):
125 (JSC::B3::testStoreDoubleConstantAsFloat):
127 * tests/stress/double-compare-to-float.js: Added.
128 (canSimplifyToFloat):
129 (canSimplifyToFloatWithConstant):
132 * tests/stress/double-to-float.js: Added.
133 (upsilonReferencingItsPhi):
134 (upsilonReferencingItsPhiAllFloat):
135 (upsilonReferencingItsPhiWithoutConversion):
136 (conversionPropagages):
137 (chainedUpsilonBothConvert):
138 (chainedUpsilonFirstConvert):
140 2016-04-17 Yusuke Suzuki <utatane.tea@gmail.com>
142 [ES6] Use @isObject to check Object Type instead of using instanceof
143 https://bugs.webkit.org/show_bug.cgi?id=156676
145 Reviewed by Darin Adler.
147 Use @isObject instead of `instanceof @Object`.
148 The `instanceof` check is not enough to check Object Type.
149 For example, given 2 realms, the object created in one realm does not inherit the Object of another realm.
150 Another example is that the object which does not inherit Object.
151 This object can be easily created by calling `Object.create(null)`.
153 * builtins/RegExpPrototype.js:
156 (GlobalObject::finishCreation):
157 (functionCreateGlobalObject):
158 * tests/stress/regexp-match-in-other-realm-should-work.js: Added.
160 * tests/stress/regexp-match-should-work-with-objects-not-inheriting-object-prototype.js: Added.
164 2016-04-17 Darin Adler <darin@apple.com>
166 Remove more uses of Deprecated::ScriptXXX
167 https://bugs.webkit.org/show_bug.cgi?id=156660
169 Reviewed by Antti Koivisto.
171 * bindings/ScriptFunctionCall.cpp:
172 (Deprecated::ScriptCallArgumentHandler::appendArgument): Deleted
173 unneeded overloads that take a ScriptObject and ScriptValue.
174 * bindings/ScriptFunctionCall.h: Ditto.
176 * bindings/ScriptObject.h: Added operator so this can change
177 itself into a JSObject*. Helps while phasing this class out.
179 * bindings/ScriptValue.h: Export toInspectorValue so it can be
182 * inspector/InjectedScriptManager.cpp:
183 (Inspector::InjectedScriptManager::createInjectedScript): Changed
184 return value from Deprecated::ScriptObject to JSObject*.
185 (Inspector::InjectedScriptManager::injectedScriptFor): Updated for
186 the return value change above.
187 * inspector/InjectedScriptManager.h: Ditto.
189 2016-04-16 Benjamin Poulain <bpoulain@webkit.org>
191 [JSC] DFG should support relational comparisons of Number and Other
192 https://bugs.webkit.org/show_bug.cgi?id=156669
194 Reviewed by Darin Adler.
196 In Sunspider/3d-raytrace, DFG falls back to JSValue in some important
197 relational compare because profiling sees "undefined" from time to time.
199 This case is fairly common outside Sunspider too because of out-of-bounds array access.
200 Unfortunately for us, our fallback for compare is really inefficient.
202 Fortunately, relational comparison with null/undefined/true/false are trival.
203 We can just convert both side to Double. That's what this patch adds.
205 I also extended constant folding for those cases because I noticed
206 a bunch of "undefined" constant going through DoubleRep at runtime.
208 * dfg/DFGAbstractInterpreterInlines.h:
209 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
210 * dfg/DFGFixupPhase.cpp:
211 (JSC::DFG::FixupPhase::fixupNode):
212 * tests/stress/compare-number-and-other.js: Added.
214 (let.operator.of.operators.eval.testPolymorphic):
215 (let.operator.of.operators.let.left.of.typeCases.let.right.of.typeCases.eval.testMonomorphic):
216 (let.operator.of.operators.let.left.of.typeCases.let.right.of.typeCases.testMonomorphicLeftConstant):
217 (let.operator.of.operators.let.left.of.typeCases.let.right.of.typeCases.testMonomorphicRightConstant):
218 (let.operator.of.operators.let.left.of.typeCases.let.right.of.typeCases.i.testPolymorphic):
220 2016-04-16 Benjamin Poulain <bpoulain@apple.com>
222 [JSC] FRound/Negate can produce an impure NaN out of a pure NaN
223 https://bugs.webkit.org/show_bug.cgi?id=156528
225 Reviewed by Filip Pizlo.
227 If you fround a double with the bits 0xfff7000000000000
228 you get 0xfffe000000000000. The first is a pure NaN, the second isn't.
230 This is without test because I could not find a way to create a 0xfff7000000000000
231 while convincing DFG that its pure.
232 When we purify NaNs from typed array, we use a specific value of NaN if the input
233 is any NaN, making testing tricky.
235 * bytecode/SpeculatedType.cpp:
236 (JSC::typeOfDoubleNegation):
238 2016-04-16 Konstantin Tokarev <annulen@yandex.ru>
240 JS::DFG::nodeValuePairListDump does not compile with libstdc++ 4.8
241 https://bugs.webkit.org/show_bug.cgi?id=156670
243 Reviewed by Darin Adler.
246 (JSC::DFG::nodeValuePairListDump): Modified to use lambda as comparator.
248 2016-04-16 Konstantin Tokarev <annulen@yandex.ru>
250 [mips] Implemented moveZeroToDouble.
251 https://bugs.webkit.org/show_bug.cgi?id=155429
253 Reviewed by Darin Adler.
255 This function is required to fix compilation after r197687.
257 * assembler/MacroAssemblerMIPS.h:
258 (JSC::MacroAssemblerMIPS::moveZeroToDouble):
260 2016-04-15 Darin Adler <darin@apple.com>
262 Reduce use of Deprecated::ScriptXXX classes
263 https://bugs.webkit.org/show_bug.cgi?id=156632
265 Reviewed by Alex Christensen.
267 * bindings/ScriptFunctionCall.cpp:
268 (Deprecated::ScriptCallArgumentHandler::appendArgument): Deleted version that takes a Deprecated::ScriptValue.
269 (Deprecated::ScriptFunctionCall::call): Changed to return a JSValue.
270 * bindings/ScriptFunctionCall.h: Updated for the above.
272 * bindings/ScriptValue.cpp:
273 (Inspector::jsToInspectorValue): Moved from Deprecated namespace to Inspector namespace. Later, we should
274 move this to another source file in the inspector directory.
275 (Inspector::toInspectorValue): Added.
276 (Deprecated::ScriptValue::toInspectorValue): Updated for change to underlying function.
277 * bindings/ScriptValue.h: Update for the above.
279 * inspector/InjectedScript.cpp:
280 (Inspector::InjectedScript::evaluateOnCallFrame): Changed arguments and return values from
281 Deprecated::ScriptValue to JSC::JSValue.
282 (Inspector::InjectedScript::functionDetails): Ditto.
283 (Inspector::InjectedScript::wrapCallFrames): Ditto.
284 (Inspector::InjectedScript::wrapObject): Ditto.
285 (Inspector::InjectedScript::wrapTable): Ditto.
286 (Inspector::InjectedScript::previewValue): Ditto.
287 (Inspector::InjectedScript::setExceptionValue): Ditto.
288 (Inspector::InjectedScript::findObjectById): Ditto.
289 (Inspector::InjectedScript::inspectObject): Ditto.
290 * inspector/InjectedScript.h: Ditto.
291 * inspector/InjectedScriptBase.cpp:
292 (Inspector::InjectedScriptBase::callFunctionWithEvalEnabled): Ditto.
293 (Inspector::InjectedScriptBase::makeCall): Ditto.
294 * inspector/InjectedScriptBase.h: Ditto.
295 * inspector/InjectedScriptModule.cpp:
296 (Inspector::InjectedScriptModule::ensureInjected): Ditto.
297 * inspector/ScriptDebugListener.h: Ditto.
298 * inspector/ScriptDebugServer.cpp:
299 (Inspector::ScriptDebugServer::evaluateBreakpointAction): Ditto.
300 (Inspector::ScriptDebugServer::dispatchDidPause): Ditto.
301 (Inspector::ScriptDebugServer::dispatchBreakpointActionProbe): Ditto.
302 (Inspector::ScriptDebugServer::exceptionOrCaughtValue): Ditto.
303 * inspector/ScriptDebugServer.h: Ditto.
304 * inspector/agents/InspectorDebuggerAgent.cpp:
305 (Inspector::InspectorDebuggerAgent::buildExceptionPauseReason): Ditto.
306 (Inspector::InspectorDebuggerAgent::didPause): Ditto.
307 (Inspector::InspectorDebuggerAgent::breakpointActionProbe): Ditto.
308 (Inspector::InspectorDebuggerAgent::didContinue): Ditto.
309 (Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState): Ditto.
310 * inspector/agents/InspectorDebuggerAgent.h: Ditto.
311 * inspector/agents/InspectorHeapAgent.cpp:
312 (Inspector::InspectorHeapAgent::getPreview): Ditto.
313 (Inspector::InspectorHeapAgent::getRemoteObject): Ditto.
315 2016-04-15 Keith Miller <keith_miller@apple.com>
317 Some JIT/DFG operations need NativeCallFrameTracers
318 https://bugs.webkit.org/show_bug.cgi?id=156650
320 Reviewed by Michael Saboff.
322 Some of our operation functions did not have native call frame
323 tracers. This meant that we would crash occasionally on some
324 of our tests when they triggered a GC in one of the functions
325 without a tracer. In particular, this was exemplified by another
326 upcoming patch when calling operationSetFunctionName.
328 This patch does not add tests since this happens consistently in
329 the patch adding delete_by_id to the DFG.
331 * dfg/DFGOperations.cpp:
332 * jit/JITOperations.cpp:
334 2016-04-15 Joseph Pecoraro <pecoraro@apple.com>
336 Web Inspector: sourceMappingURL not used when sourceURL is set
337 https://bugs.webkit.org/show_bug.cgi?id=156021
338 <rdar://problem/25438417>
340 Reviewed by Timothy Hatcher.
342 Clean up Debugger.sourceParsed to separately include:
344 - url ("resource URL", "source url" in JSC APIs)
345 - sourceURL - //# sourceURL directive
347 By always having the resource URL the Web Inspector frontend
348 can better match this Script to a Resource of the same URL,
349 and decide to use the sourceURL if it is available when
352 * inspector/protocol/Debugger.json:
353 * inspector/agents/InspectorDebuggerAgent.cpp:
354 (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
355 (Inspector::InspectorDebuggerAgent::didParseSource):
356 Send the new sourceParsed parameters.
358 2016-04-14 Joseph Pecoraro <pecoraro@apple.com>
360 Web Inspector: Cleanup inspector/debugger tests
361 https://bugs.webkit.org/show_bug.cgi?id=156619
363 Reviewed by Brian Burg.
365 While cleaning up the tests it exposed the fact that breakpoints
366 were not getting disabled when the inspector closes. This means
367 that opening the inspector, with breakpoints, and closing the
368 inspector, would leave the JSC::Debugger thinking breakpoints
369 are active. The JSC::Debugger should be reset.
371 * inspector/agents/InspectorDebuggerAgent.cpp:
372 (Inspector::InspectorDebuggerAgent::disable):
374 2016-04-14 Geoffrey Garen <ggaren@apple.com>
376 CopiedBlock should be 64kB
378 Reviewed by Benjamin Poulain.
380 Let's try another value.
382 This is 25% faster on kraken-audio-beat-detection on Mac Pro.
384 * heap/CopiedBlock.h:
386 2016-04-15 Zan Dobersek <zdobersek@igalia.com>
388 Tail call optimizations lead to crashes on ARM Thumb + Linux
389 https://bugs.webkit.org/show_bug.cgi?id=150083
391 Reviewed by Csaba Osztrogonác.
393 * assembler/AbstractMacroAssembler.h:
394 (JSC::AbstractMacroAssembler::repatchNearCall): In case of a tail call relink to the
395 data location of the destination, and not the executable address. This is needed for
396 the ARM Thumb2 platform where both the source and destination addresses of a jump relink
397 must not have the bottom bit decorated, as asserted in ARMv7Assembler::relinkJump().
399 (JSC::linkPolymorphicCall): Similarly, when linking a tail call we must link to the
400 address that has a non-decorated bottom bit, as asserted in ARMv7Assembler::linkJumpAbsolute().
402 2016-04-14 Geoffrey Garen <ggaren@apple.com>
404 Unreviewed, rolling out r199567.
406 performance regression on kraken on macbook*
410 "CopiedBlock should be 8kB"
411 https://bugs.webkit.org/show_bug.cgi?id=156610
412 http://trac.webkit.org/changeset/199567
414 2016-04-14 Geoffrey Garen <ggaren@apple.com>
416 CopiedBlock should be 8kB
417 https://bugs.webkit.org/show_bug.cgi?id=156610
419 Reviewed by Michael Saboff.
423 15% faster on kraken-audio-beat-detection
425 5% faster on v8-splay
427 Hopefully, this will be OK on MacBook* bots as well.
429 32kB is the full size of L1 cache on x86. So, allocating and zero-filling
430 a 32kB CopiedBlock would basically flush the L1 cache. We can ameliorate
431 this problem by using smaller blocks -- or, if that doesn't work, we can
432 use larger blocks to amortize the cost.
434 * heap/CopiedBlock.h:
436 2016-04-14 Filip Pizlo <fpizlo@apple.com>
438 PolymorphicAccess should try to generate a stub only once
439 https://bugs.webkit.org/show_bug.cgi?id=156555
441 Reviewed by Geoffrey Garen.
443 This changes the PolymorphicAccess heuristics to reduce the amount of code generation even
444 more than before. We used to always generate a monomorphic stub for the first case we saw.
445 This change disables that. This change also increases the buffering countdown to match the
446 cool-down repatch count. This means that we will allow for ten slow paths for adding cases,
447 then we will generate a stub, and then we will go into cool-down and the repatching slow
448 paths will not even attempt repatching for a while. After we emerge from cool-down - which
449 requires a bunch of slow path calls - we will again wait for ten slow paths to get new
450 cases. Note that it only takes 13 cases to cause the stub to give up on future repatching
451 entirely. Also, most stubs don't ever get to 10 cases. Therefore, for most stubs this change
452 means that each IC will repatch once. If they make it to two repatching, then the likelihood
453 of a third becomes infinitesimal because of all of the rules that come into play at that
454 point (the size limit being 13, the fact that we go into exponential cool-down every time we
455 generate code, and the fact that if we have lots of self cases then we will create a
456 catch-all megamorphic load case).
458 This also undoes a change to the megamorphic optimization that I think was unintentional.
459 As in the change that originally introduced megamorphic loads, we want to do this only if we
460 would otherwise exhaust the max size of the IC. This is because megamorphic loads are pretty
461 expensive and it's best to use them only if we know that the alternative is giving up on
464 This is neutral on JS benchmarks, but looks like it's another speed-up for page loading.
466 * bytecode/PolymorphicAccess.cpp:
467 (JSC::AccessCase::canBeReplacedByMegamorphicLoad):
468 (JSC::AccessCase::canReplace):
469 (JSC::AccessCase::dump):
470 (JSC::PolymorphicAccess::regenerate):
471 * bytecode/StructureStubInfo.cpp:
472 (JSC::StructureStubInfo::StructureStubInfo):
475 2016-04-14 Mark Lam <mark.lam@apple.com>
477 Update treatment of invoking RegExp.prototype methods on RegExp.prototype.
478 https://bugs.webkit.org/show_bug.cgi?id=155922
480 Reviewed by Keith Miller.
482 According to the TC39 committee, when invoking the following RegExp.prototype
483 methods on the RegExp.prototype:
484 1. RegExp.prototype.flags yields ""
485 2. RegExp.prototype.global yields undefined
486 3. RegExp.prototype.ignoreCase yields undefined
487 4. RegExp.prototype.multiline yields undefined
488 5. RegExp.prototype.unicode yields undefined
489 6. RegExp.prototype.source yields "(?:)"
490 7. RegExp.prototype.sticky yields undefined
491 8. RegExp.prototype.toString() yields "/(?:)/"
493 and RegExp.prototype is still NOT an instance of RegExp. The above behavior
494 changes is a special dispensation applicable only to RegExp.prototype. The ES6
495 spec of throwing errors still applies if those methods are applied to anything =
496 else that is not a RegExp object.
498 * runtime/RegExpPrototype.cpp:
499 (JSC::regExpProtoGetterGlobal):
500 (JSC::regExpProtoGetterIgnoreCase):
501 (JSC::regExpProtoGetterMultiline):
502 (JSC::regExpProtoGetterSticky):
503 (JSC::regExpProtoGetterUnicode):
504 (JSC::regExpProtoGetterFlags):
505 (JSC::regExpProtoGetterSource):
506 - Implemented new behavior.
508 * tests/es6/miscellaneous_built-in_prototypes_are_not_instances.js:
510 - Updated to match current kangax test.
512 2016-04-14 Geoffrey Garen <ggaren@apple.com>
514 Some imported ES6 tests are missing __createIterableObject
515 https://bugs.webkit.org/show_bug.cgi?id=156584
517 Reviewed by Keith Miller.
519 These tests were failing because I neglected to include __createIterableObject
520 when I first imported them. Now they pass.
523 * tests/es6/Array_static_methods_Array.from_generic_iterables.js:
525 (iterable.Symbol.iterator):
526 (__createIterableObject):
528 * tests/es6/Array_static_methods_Array.from_instances_of_generic_iterables.js:
530 (iterable.Symbol.iterator):
531 (__createIterableObject):
533 * tests/es6/Array_static_methods_Array.from_iterator_closing.js:
535 (iterable.Symbol.iterator):
536 (__createIterableObject):
537 * tests/es6/Array_static_methods_Array.from_map_function_generic_iterables.js:
539 (iterable.Symbol.iterator):
540 (__createIterableObject):
542 * tests/es6/Array_static_methods_Array.from_map_function_instances_of_iterables.js:
544 (iterable.Symbol.iterator):
545 (__createIterableObject):
547 * tests/es6/Map_iterator_closing.js:
549 (iterable.Symbol.iterator):
550 (__createIterableObject):
551 * tests/es6/Promise_Promise.all_generic_iterables.js:
553 (iterable.Symbol.iterator):
554 (__createIterableObject):
555 (test.asyncTestPassed):
556 * tests/es6/Promise_Promise.race_generic_iterables.js:
558 (iterable.Symbol.iterator):
559 (__createIterableObject):
560 (test.asyncTestPassed):
561 * tests/es6/Set_iterator_closing.js:
563 (iterable.Symbol.iterator):
564 (__createIterableObject):
565 * tests/es6/WeakMap_iterator_closing.js:
567 (iterable.Symbol.iterator):
568 (__createIterableObject):
569 * tests/es6/WeakSet_iterator_closing.js:
571 (iterable.Symbol.iterator):
572 (__createIterableObject):
573 * tests/es6/destructuring_iterator_closing.js:
575 (iterable.Symbol.iterator):
576 (__createIterableObject):
577 * tests/es6/destructuring_with_generic_iterables.js:
579 (iterable.Symbol.iterator):
580 (__createIterableObject):
582 * tests/es6/destructuring_with_instances_of_generic_iterables.js:
584 (iterable.Symbol.iterator):
585 (__createIterableObject):
587 * tests/es6/for..of_loops_iterator_closing_break.js:
589 (iterable.Symbol.iterator):
590 (__createIterableObject):
591 * tests/es6/for..of_loops_iterator_closing_throw.js:
593 (iterable.Symbol.iterator):
594 (__createIterableObject):
595 * tests/es6/for..of_loops_with_generic_iterables.js:
597 (iterable.Symbol.iterator):
598 (__createIterableObject):
600 * tests/es6/for..of_loops_with_instances_of_generic_iterables.js:
602 (iterable.Symbol.iterator):
603 (__createIterableObject):
605 * tests/es6/generators_yield_star_generic_iterables.js:
607 (iterable.Symbol.iterator):
608 (__createIterableObject):
609 * tests/es6/generators_yield_star_iterator_closing_via_throw.js:
611 (iterable.Symbol.iterator):
612 (__createIterableObject):
613 * tests/es6/spread_..._operator_with_generic_iterables_in_arrays.js:
615 (iterable.Symbol.iterator):
616 (__createIterableObject):
618 * tests/es6/spread_..._operator_with_generic_iterables_in_calls.js:
620 (iterable.Symbol.iterator):
621 (__createIterableObject):
623 * tests/es6/spread_..._operator_with_instances_of_iterables_in_arrays.js:
625 (iterable.Symbol.iterator):
626 (__createIterableObject):
628 * tests/es6/spread_..._operator_with_instances_of_iterables_in_calls.js:
630 (iterable.Symbol.iterator):
631 (__createIterableObject):
634 2016-04-13 Alex Christensen <achristensen@webkit.org>
636 CMake MiniBrowser should be an app bundle
637 https://bugs.webkit.org/show_bug.cgi?id=156521
639 Reviewed by Brent Fulgham.
642 Unreviewed build fix. Define __STDC_WANT_LIB_EXT1__ so we can find memset_s.
644 2016-04-13 Joseph Pecoraro <pecoraro@apple.com>
646 JSContext Inspector: Improve Class instances and JSC API Exported Values view in Console / ObjectTree
647 https://bugs.webkit.org/show_bug.cgi?id=156566
648 <rdar://problem/16392365>
650 Reviewed by Timothy Hatcher.
652 * inspector/InjectedScriptSource.js:
653 (InjectedScript.RemoteObject.prototype._appendPropertyPreviews):
654 Treat non-basic object types as not lossless so they can be expanded.
655 Show non-enumerable native getters in Object previews.
657 2016-04-13 Michael Saboff <msaboff@apple.com>
659 Some tests fail with ES6 `u` (Unicode) flag for regular expressions
660 https://bugs.webkit.org/show_bug.cgi?id=151597
662 Reviewed by Geoffrey Garen.
664 Added two new tables to handle the anomolies of \w and \W CharacterClassEscapes
665 when specified in RegExp's with both the unicode and ignoreCase flags. Given the
666 case folding rules described in the standard vie the meta function Canonicalize(),
667 which allow cross ASCII case folding when unicode is specified, the unicode characters
668 \u017f (small sharp s) and \u212a (kelvin symbol) are part of the \w (word) characterClassEscape.
669 This is true because they case fold to 's' and 'k' respectively. Because they case fold
670 to lower case letters, the corresponding letters, 'k', 'K', 's' and 'S', are also matched with
671 \W with the unicode and ignoreCase flags.
673 * create_regex_tables:
674 * yarr/YarrPattern.cpp:
675 (JSC::Yarr::YarrPatternConstructor::atomBuiltInCharacterClass):
676 (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBuiltIn):
677 (JSC::Yarr::YarrPattern::YarrPattern):
678 * yarr/YarrPattern.h:
679 (JSC::Yarr::YarrPattern::wordcharCharacterClass):
680 (JSC::Yarr::YarrPattern::wordUnicodeIgnoreCaseCharCharacterClass):
681 (JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
682 (JSC::Yarr::YarrPattern::nonwordUnicodeIgnoreCaseCharCharacterClass):
684 2016-04-13 Commit Queue <commit-queue@webkit.org>
686 Unreviewed, rolling out r199502 and r199511.
687 https://bugs.webkit.org/show_bug.cgi?id=156557
689 Appears to have in-browser perf regression (Requested by mlam
694 "ES6: Implement String.prototype.split and
695 RegExp.prototype[@@split]."
696 https://bugs.webkit.org/show_bug.cgi?id=156013
697 http://trac.webkit.org/changeset/199502
699 "ES6: Implement RegExp.prototype[@@search]."
700 https://bugs.webkit.org/show_bug.cgi?id=156331
701 http://trac.webkit.org/changeset/199511
703 2016-04-13 Keith Miller <keith_miller@apple.com>
705 isJSArray should use ArrayType rather than the ClassInfo
706 https://bugs.webkit.org/show_bug.cgi?id=156551
708 Reviewed by Filip Pizlo.
710 Using the JSType rather than the ClassInfo should be slightly faster
711 since the type is inline on the cell whereas the ClassInfo is only
717 2016-04-13 Mark Lam <mark.lam@apple.com>
719 ES6: Implement RegExp.prototype[@@search].
720 https://bugs.webkit.org/show_bug.cgi?id=156331
722 Reviewed by Keith Miller.
725 1. Implemented search builtin in RegExpPrototype.js.
726 The native path is now used as a fast path.
727 2. Added DFG support for an IsRegExpObjectIntrinsic (modelled after the
729 3. Renamed @isRegExp to @isRegExpObject to match the new IsRegExpObjectIntrinsic.
730 4. Change the esSpecIsRegExpObject() implementation to check if the object's
731 JSType is RegExpObjectType instead of walking the classinfo chain.
733 * builtins/RegExpPrototype.js:
735 * builtins/StringPrototype.js:
737 - fixed some indentation.
739 * dfg/DFGAbstractInterpreterInlines.h:
740 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
741 * dfg/DFGByteCodeParser.cpp:
742 (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
743 * dfg/DFGClobberize.h:
744 (JSC::DFG::clobberize):
747 * dfg/DFGFixupPhase.cpp:
748 (JSC::DFG::FixupPhase::fixupNode):
750 * dfg/DFGPredictionPropagationPhase.cpp:
751 (JSC::DFG::PredictionPropagationPhase::propagate):
752 * dfg/DFGSafeToExecute.h:
753 (JSC::DFG::safeToExecute):
754 * dfg/DFGSpeculativeJIT.cpp:
755 (JSC::DFG::SpeculativeJIT::compileIsArrayConstructor):
756 (JSC::DFG::SpeculativeJIT::compileIsRegExpObject):
757 (JSC::DFG::SpeculativeJIT::compileCallObjectConstructor):
758 * dfg/DFGSpeculativeJIT.h:
759 * dfg/DFGSpeculativeJIT32_64.cpp:
760 (JSC::DFG::SpeculativeJIT::compile):
761 * dfg/DFGSpeculativeJIT64.cpp:
762 (JSC::DFG::SpeculativeJIT::compile):
763 * ftl/FTLCapabilities.cpp:
764 (JSC::FTL::canCompile):
765 * ftl/FTLLowerDFGToB3.cpp:
766 (JSC::FTL::DFG::LowerDFGToB3::compileNode):
767 (JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
768 (JSC::FTL::DFG::LowerDFGToB3::compileIsRegExpObject):
769 (JSC::FTL::DFG::LowerDFGToB3::compileTypeOf):
770 (JSC::FTL::DFG::LowerDFGToB3::isExoticForTypeof):
771 (JSC::FTL::DFG::LowerDFGToB3::isRegExpObject):
772 (JSC::FTL::DFG::LowerDFGToB3::isType):
773 * runtime/Intrinsic.h:
774 - Added IsRegExpObjectIntrinsic.
776 * runtime/CommonIdentifiers.h:
778 * runtime/ECMAScriptSpecInternalFunctions.cpp:
779 (JSC::esSpecIsConstructor):
780 - Changed to use uncheckedArgument since this is only called from internal code.
781 (JSC::esSpecIsRegExpObject):
782 (JSC::esSpecIsRegExp): Deleted.
783 * runtime/ECMAScriptSpecInternalFunctions.h:
784 - Changed to check the object for a JSType of RegExpObjectType.
786 * runtime/JSGlobalObject.cpp:
787 (JSC::JSGlobalObject::init):
788 - Added split fast path.
790 * runtime/RegExpPrototype.cpp:
791 (JSC::RegExpPrototype::finishCreation):
792 (JSC::regExpProtoFuncSearchFast):
793 (JSC::regExpProtoFuncSearch): Deleted.
794 * runtime/RegExpPrototype.h:
797 * tests/stress/regexp-search.js:
800 2016-04-12 Filip Pizlo <fpizlo@apple.com>
802 PolymorphicAccess::regenerate() shouldn't have to clone non-generated AccessCases
803 https://bugs.webkit.org/show_bug.cgi?id=156493
805 Reviewed by Geoffrey Garen.
807 Cloning AccessCases is only necessary if they hold some artifacts that are used by code that
808 they already generated. So, if the state is not Generated, we don't have to bother with
811 This should speed up PolymorphicAccess regeneration a bit more.
813 * bytecode/PolymorphicAccess.cpp:
814 (JSC::AccessCase::commit):
815 (JSC::PolymorphicAccess::regenerate):
817 2016-04-13 Mark Lam <mark.lam@apple.com>
819 ES6: Implement String.prototype.split and RegExp.prototype[@@split].
820 https://bugs.webkit.org/show_bug.cgi?id=156013
822 Reviewed by Keith Miller.
824 Re-landing r199393 now that the shadow chicken crash has been fixed.
827 * JavaScriptCore.xcodeproj/project.pbxproj:
828 * builtins/GlobalObject.js:
829 (speciesConstructor):
830 * builtins/PromisePrototype.js:
831 - refactored to use the @speciesConstructor internal function.
833 * builtins/RegExpPrototype.js:
834 (advanceStringIndex):
835 - refactored from @advanceStringIndexUnicode() to be match the spec.
836 Benchmarks show that there's no advantage in doing the unicode check outside
837 of the advanceStringIndexUnicode part. So, I simplified the code to match the
838 spec (especially since @@split needs to call advanceStringIndex from more than
841 - Removed an unnecessary call to @Object because it was already proven above.
842 - Changed to use advanceStringIndex instead of advanceStringIndexUnicode.
843 Again, there's no perf regression for this.
845 (hasObservableSideEffectsForRegExpSplit):
847 (advanceStringIndexUnicode): Deleted.
849 * builtins/StringPrototype.js:
851 - Modified to use RegExp.prototype[@@split].
853 * bytecode/BytecodeIntrinsicRegistry.cpp:
854 (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
855 (JSC::BytecodeIntrinsicRegistry::lookup):
856 * bytecode/BytecodeIntrinsicRegistry.h:
857 - Added the @@split symbol.
859 * runtime/CommonIdentifiers.h:
860 * runtime/ECMAScriptSpecInternalFunctions.cpp: Added.
861 (JSC::esSpecIsConstructor):
862 (JSC::esSpecIsRegExp):
863 * runtime/ECMAScriptSpecInternalFunctions.h: Added.
865 * runtime/JSGlobalObject.cpp:
866 (JSC::getGetterById):
867 (JSC::JSGlobalObject::init):
869 * runtime/PropertyDescriptor.cpp:
870 (JSC::PropertyDescriptor::setDescriptor):
871 - Removed an assert that is no longer valid.
873 * runtime/RegExpObject.h:
874 - Made advanceStringUnicode() public so that it can be re-used by the regexp split
877 * runtime/RegExpPrototype.cpp:
878 (JSC::RegExpPrototype::finishCreation):
879 (JSC::regExpProtoFuncExec):
880 (JSC::regExpProtoFuncSearch):
881 (JSC::advanceStringIndex):
882 (JSC::regExpProtoFuncSplitFast):
883 * runtime/RegExpPrototype.h:
885 * runtime/StringObject.h:
886 (JSC::jsStringWithReuse):
888 - Hoisted some utility functions from StringPrototype.cpp so that they can be
889 reused by the regexp split fast path.
891 * runtime/StringPrototype.cpp:
892 (JSC::StringPrototype::finishCreation):
893 (JSC::stringProtoFuncSplitFast):
894 (JSC::stringProtoFuncSubstr):
895 (JSC::builtinStringSubstrInternal):
896 (JSC::stringProtoFuncSubstring):
897 (JSC::stringIncludesImpl):
898 (JSC::stringProtoFuncIncludes):
899 (JSC::builtinStringIncludesInternal):
900 (JSC::jsStringWithReuse): Deleted.
901 (JSC::jsSubstring): Deleted.
902 (JSC::stringProtoFuncSplit): Deleted.
903 * runtime/StringPrototype.h:
907 2016-04-13 Mark Lam <mark.lam@apple.com>
909 ShadowChicken::visitChildren() should not visit tailMarkers and throwMarkers.
910 https://bugs.webkit.org/show_bug.cgi?id=156532
912 Reviewed by Saam Barati and Filip Pizlo.
914 ShadowChicken can store tailMarkers and throwMarkers in its log, specifically in
915 the callee field of a log packet. However, ShadowChicken::visitChildren()
916 unconditionally visits the callee field of each packet as if they are real
917 objects. If visitChildren() encounters one of these markers in the log, we get a
920 This crash was observed in the v8-v6/v8-regexp.js stress test running with shadow
921 chicken when r199393 landed. r199393 introduced tail calls to a RegExp split
922 fast path, and the v8-regexp.js test exercised this fast path a lot. Throw in
923 some timely GCs, and we get a crash party.
925 The fix is to have ShadowChicken::visitChildren() filter out the tailMarker and
928 Alternatively, if perf is an issue, we can allocate 2 dedicated objects for
929 these markers so that ShadowChicken can continue to visit them. For now, I'm
930 going with the filter.
932 * interpreter/ShadowChicken.cpp:
933 (JSC::ShadowChicken::visitChildren):
935 2016-04-13 Yusuke Suzuki <utatane.tea@gmail.com>
937 [ES6] Add @@toStringTag to GeneratorFunction
938 https://bugs.webkit.org/show_bug.cgi?id=156499
940 Reviewed by Mark Lam.
942 GeneratorFunction.prototype has @@toStringTag property, "GeneratorFunction".
943 https://tc39.github.io/ecma262/#sec-generatorfunction.prototype-@@tostringtag
945 * runtime/GeneratorFunctionPrototype.cpp:
946 (JSC::GeneratorFunctionPrototype::finishCreation):
948 * tests/es6/well-known_symbols_Symbol.toStringTag_new_built-ins.js: Added.
951 2016-04-13 Alberto Garcia <berto@igalia.com>
953 Fix build in glibc-based BSD systems
954 https://bugs.webkit.org/show_bug.cgi?id=156533
956 Reviewed by Carlos Garcia Campos.
958 Change the order of the #elif conditionals so glibc-based BSD
959 systems (e.g. Debian GNU/kFreeBSD) use the code inside the
962 * heap/MachineStackMarker.cpp:
963 (JSC::MachineThreads::Thread::Registers::stackPointer):
964 (JSC::MachineThreads::Thread::Registers::framePointer):
965 (JSC::MachineThreads::Thread::Registers::instructionPointer):
966 (JSC::MachineThreads::Thread::Registers::llintPC):
968 2016-04-12 Keith Miller <keith_miller@apple.com>
970 Unreviewed undo change from ArrayClass to ArrayWithUndecided, which
971 was not intedend to land with r199397.
973 * runtime/ArrayPrototype.h:
974 (JSC::ArrayPrototype::createStructure):
976 2016-04-12 Mark Lam <mark.lam@apple.com>
978 Rollout: ES6: Implement String.prototype.split and RegExp.prototype[@@split].
979 https://bugs.webkit.org/show_bug.cgi?id=156013
981 Speculative rollout to fix 32-bit shadow-chicken.yaml/tests/v8-v6/v8-regexp.js.shadow-chicken test failure.
986 * JavaScriptCore.xcodeproj/project.pbxproj:
987 * builtins/GlobalObject.js:
989 (speciesConstructor): Deleted.
990 * builtins/PromisePrototype.js:
991 * builtins/RegExpPrototype.js:
992 (advanceStringIndexUnicode):
994 (advanceStringIndex): Deleted.
995 (regExpExec): Deleted.
996 (hasObservableSideEffectsForRegExpSplit): Deleted.
998 * builtins/StringPrototype.js:
1001 * bytecode/BytecodeIntrinsicRegistry.cpp:
1002 (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
1003 (JSC::BytecodeIntrinsicRegistry::lookup):
1004 * bytecode/BytecodeIntrinsicRegistry.h:
1005 * runtime/CommonIdentifiers.h:
1006 * runtime/ECMAScriptSpecInternalFunctions.cpp: Removed.
1007 * runtime/ECMAScriptSpecInternalFunctions.h: Removed.
1008 * runtime/JSGlobalObject.cpp:
1009 (JSC::JSGlobalObject::setGlobalThis):
1010 (JSC::JSGlobalObject::init):
1011 (JSC::getGetterById): Deleted.
1012 * runtime/PropertyDescriptor.cpp:
1013 (JSC::PropertyDescriptor::setDescriptor):
1014 * runtime/RegExpObject.h:
1015 (JSC::RegExpObject::offsetOfLastIndexIsWritable):
1016 * runtime/RegExpPrototype.cpp:
1017 (JSC::RegExpPrototype::finishCreation):
1018 (JSC::regExpProtoFuncExec):
1019 (JSC::regExpProtoFuncSearch):
1020 (JSC::advanceStringIndex): Deleted.
1021 (JSC::regExpProtoFuncSplitFast): Deleted.
1022 * runtime/RegExpPrototype.h:
1023 * runtime/StringObject.h:
1024 (JSC::jsStringWithReuse): Deleted.
1025 (JSC::jsSubstring): Deleted.
1026 * runtime/StringPrototype.cpp:
1027 (JSC::StringPrototype::finishCreation):
1028 (JSC::jsStringWithReuse):
1030 (JSC::substituteBackreferencesSlow):
1031 (JSC::splitStringByOneCharacterImpl):
1032 (JSC::stringProtoFuncSplit):
1033 (JSC::stringProtoFuncSubstr):
1034 (JSC::stringProtoFuncSubstring):
1035 (JSC::stringProtoFuncEndsWith):
1036 (JSC::stringProtoFuncIncludes):
1037 (JSC::stringProtoFuncIterator):
1038 (JSC::stringProtoFuncSplitFast): Deleted.
1039 (JSC::builtinStringSubstrInternal): Deleted.
1040 (JSC::stringIncludesImpl): Deleted.
1041 (JSC::builtinStringIncludesInternal): Deleted.
1042 * runtime/StringPrototype.h:
1045 2016-04-12 Mark Lam <mark.lam@apple.com>
1047 Remove 2 unused JSC options.
1048 https://bugs.webkit.org/show_bug.cgi?id=156526
1050 Reviewed by Benjamin Poulain.
1052 The options JSC_assertICSizing and JSC_dumpFailedICSizing are no longer in use
1053 now that we have B3.
1055 * runtime/Options.h:
1057 2016-04-12 Keith Miller <keith_miller@apple.com>
1059 [ES6] Add support for Symbol.isConcatSpreadable.
1060 https://bugs.webkit.org/show_bug.cgi?id=155351
1062 Reviewed by Saam Barati.
1064 This patch adds support for Symbol.isConcatSpreadable. In order to do so it was necessary to move the
1065 Array.prototype.concat function to JS. A number of different optimizations were needed to make such the move to
1066 a builtin performant. First, four new DFG intrinsics were added.
1068 1) IsArrayObject (I would have called it IsArray but we use the same name for an IndexingType): an intrinsic of
1069 the Array.isArray function.
1070 2) IsJSArray: checks the first child is a JSArray object.
1071 3) IsArrayConstructor: checks the first child is an instance of ArrayConstructor.
1072 4) CallObjectConstructor: an intrinsic of the Object constructor.
1074 IsActualObject, IsJSArray, and CallObjectConstructor can all be converted into constants in the abstract interpreter if
1075 we are able to prove that the first child is an Array or for ToObject an Object.
1077 In order to further improve the perfomance we also now cover more indexing types in our fast path memcpy
1078 code. Before we would only memcpy Arrays if they had the same indexing type and did not have Array storage and
1079 were not undecided. Now the memcpy code covers the following additional two cases: One array is undecided and
1080 the other is a non-array storage and the case where one array is Int32 and the other is contiguous (we map this
1081 into a contiguous array).
1083 This patch also adds a new fast path for concat with more than one array argument by using memcpy to append
1084 values onto the result array. This works roughly the same as the two array fast path using the same methodology
1085 to decide if we can memcpy the other butterfly into the result butterfly.
1087 Two new debugging tools are also added to the jsc cli. One is a version of the print function with a private
1088 name so it can be used for debugging builtins. The other is dumpDataLog, which takes a JSValue and runs our
1089 dataLog function on it.
1091 Finally, this patch add a new constructor to JSValueRegsTemporary that allows it to reuse the the registers of a
1092 JSValueOperand if the operand's use count is one.
1094 * JavaScriptCore.xcodeproj/project.pbxproj:
1095 * builtins/ArrayPrototype.js:
1098 * bytecode/BytecodeIntrinsicRegistry.cpp:
1099 (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
1100 * bytecode/BytecodeIntrinsicRegistry.h:
1101 * dfg/DFGAbstractInterpreterInlines.h:
1102 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1103 * dfg/DFGByteCodeParser.cpp:
1104 (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
1105 (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
1106 * dfg/DFGClobberize.h:
1107 (JSC::DFG::clobberize):
1108 * dfg/DFGDoesGC.cpp:
1110 * dfg/DFGFixupPhase.cpp:
1111 (JSC::DFG::FixupPhase::fixupNode):
1112 * dfg/DFGNodeType.h:
1113 * dfg/DFGOperations.cpp:
1114 * dfg/DFGOperations.h:
1115 * dfg/DFGPredictionPropagationPhase.cpp:
1116 (JSC::DFG::PredictionPropagationPhase::propagate):
1117 * dfg/DFGSafeToExecute.h:
1118 (JSC::DFG::safeToExecute):
1119 * dfg/DFGSpeculativeJIT.cpp:
1120 (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
1121 (JSC::DFG::SpeculativeJIT::compileIsJSArray):
1122 (JSC::DFG::SpeculativeJIT::compileIsArrayObject):
1123 (JSC::DFG::SpeculativeJIT::compileIsArrayConstructor):
1124 (JSC::DFG::SpeculativeJIT::compileCallObjectConstructor):
1125 * dfg/DFGSpeculativeJIT.h:
1126 (JSC::DFG::SpeculativeJIT::callOperation):
1127 * dfg/DFGSpeculativeJIT32_64.cpp:
1128 (JSC::DFG::SpeculativeJIT::compile):
1129 * dfg/DFGSpeculativeJIT64.cpp:
1130 (JSC::DFG::SpeculativeJIT::compile):
1131 * ftl/FTLCapabilities.cpp:
1132 (JSC::FTL::canCompile):
1133 * ftl/FTLLowerDFGToB3.cpp:
1134 (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1135 (JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor):
1136 (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayObject):
1137 (JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray):
1138 (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayConstructor):
1139 (JSC::FTL::DFG::LowerDFGToB3::isArray):
1140 * jit/JITOperations.h:
1142 (GlobalObject::finishCreation):
1143 (functionDataLogValue):
1144 * runtime/ArrayConstructor.cpp:
1145 (JSC::ArrayConstructor::finishCreation):
1146 (JSC::arrayConstructorPrivateFuncIsArrayConstructor):
1147 * runtime/ArrayConstructor.h:
1148 (JSC::isArrayConstructor):
1149 * runtime/ArrayPrototype.cpp:
1150 (JSC::ArrayPrototype::finishCreation):
1151 (JSC::arrayProtoPrivateFuncIsJSArray):
1152 (JSC::moveElements):
1153 (JSC::arrayProtoPrivateFuncConcatMemcpy):
1154 (JSC::arrayProtoPrivateFuncAppendMemcpy):
1155 (JSC::arrayProtoFuncConcat): Deleted.
1156 * runtime/ArrayPrototype.h:
1157 (JSC::ArrayPrototype::createStructure):
1158 * runtime/CommonIdentifiers.h:
1159 * runtime/Intrinsic.h:
1160 * runtime/JSArray.cpp:
1161 (JSC::JSArray::appendMemcpy):
1162 (JSC::JSArray::fastConcatWith): Deleted.
1163 * runtime/JSArray.h:
1164 (JSC::JSArray::createStructure):
1165 (JSC::JSArray::fastConcatType): Deleted.
1166 * runtime/JSArrayInlines.h: Added.
1167 (JSC::JSArray::memCopyWithIndexingType):
1168 (JSC::JSArray::canFastCopy):
1169 * runtime/JSGlobalObject.cpp:
1170 (JSC::JSGlobalObject::init):
1172 * runtime/ObjectConstructor.h:
1173 (JSC::constructObject):
1175 * tests/stress/array-concat-spread-object.js: Added.
1177 * tests/stress/array-concat-spread-proxy-exception-check.js: Added.
1179 * tests/stress/array-concat-spread-proxy.js: Added.
1181 * tests/stress/array-concat-with-slow-indexingtypes.js: Added.
1183 * tests/stress/array-species-config-array-constructor.js:
1185 2016-04-12 Saam barati <sbarati@apple.com>
1187 Lets not iterate over the constant pool twice every time we link a code block
1188 https://bugs.webkit.org/show_bug.cgi?id=156517
1190 Reviewed by Mark Lam.
1192 I introduced a second iteration over the constant pool when I implemented
1193 block scoping. I did this because we must clone all the symbol tables when
1194 we link a CodeBlock. We can just do this cloning when setting the constant
1195 registers for the first time. There is no need to iterate over the constant
1198 * bytecode/CodeBlock.cpp:
1199 (JSC::CodeBlock::finishCreation):
1200 (JSC::CodeBlock::~CodeBlock):
1201 (JSC::CodeBlock::setConstantRegisters):
1202 (JSC::CodeBlock::setAlternative):
1203 * bytecode/CodeBlock.h:
1204 (JSC::CodeBlock::replaceConstant):
1205 (JSC::CodeBlock::setConstantRegisters): Deleted.
1207 2016-04-12 Mark Lam <mark.lam@apple.com>
1209 ES6: Implement String.prototype.split and RegExp.prototype[@@split].
1210 https://bugs.webkit.org/show_bug.cgi?id=156013
1212 Reviewed by Keith Miller.
1215 * JavaScriptCore.xcodeproj/project.pbxproj:
1216 * builtins/GlobalObject.js:
1217 (speciesConstructor):
1218 * builtins/PromisePrototype.js:
1219 - refactored to use the @speciesConstructor internal function.
1221 * builtins/RegExpPrototype.js:
1222 (advanceStringIndex):
1223 - refactored from @advanceStringIndexUnicode() to be match the spec.
1224 Benchmarks show that there's no advantage in doing the unicode check outside
1225 of the advanceStringIndexUnicode part. So, I simplified the code to match the
1226 spec (especially since @@split needs to call advanceStringIndex from more than
1229 - Removed an unnecessary call to @Object because it was already proven above.
1230 - Changed to use advanceStringIndex instead of advanceStringIndexUnicode.
1231 Again, there's no perf regression for this.
1233 (hasObservableSideEffectsForRegExpSplit):
1235 (advanceStringIndexUnicode): Deleted.
1237 * builtins/StringPrototype.js:
1239 - Modified to use RegExp.prototype[@@split].
1241 * bytecode/BytecodeIntrinsicRegistry.cpp:
1242 (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
1243 (JSC::BytecodeIntrinsicRegistry::lookup):
1244 * bytecode/BytecodeIntrinsicRegistry.h:
1245 - Added the @@split symbol.
1247 * runtime/CommonIdentifiers.h:
1248 * runtime/ECMAScriptSpecInternalFunctions.cpp: Added.
1249 (JSC::esSpecIsConstructor):
1250 (JSC::esSpecIsRegExp):
1251 * runtime/ECMAScriptSpecInternalFunctions.h: Added.
1253 * runtime/JSGlobalObject.cpp:
1254 (JSC::getGetterById):
1255 (JSC::JSGlobalObject::init):
1257 * runtime/PropertyDescriptor.cpp:
1258 (JSC::PropertyDescriptor::setDescriptor):
1259 - Removed an assert that is no longer valid.
1261 * runtime/RegExpObject.h:
1262 - Made advanceStringUnicode() public so that it can be re-used by the regexp split
1265 * runtime/RegExpPrototype.cpp:
1266 (JSC::RegExpPrototype::finishCreation):
1267 (JSC::regExpProtoFuncExec):
1268 (JSC::regExpProtoFuncSearch):
1269 (JSC::advanceStringIndex):
1270 (JSC::regExpProtoFuncSplitFast):
1271 * runtime/RegExpPrototype.h:
1273 * runtime/StringObject.h:
1274 (JSC::jsStringWithReuse):
1276 - Hoisted some utility functions from StringPrototype.cpp so that they can be
1277 reused by the regexp split fast path.
1279 * runtime/StringPrototype.cpp:
1280 (JSC::StringPrototype::finishCreation):
1281 (JSC::stringProtoFuncSplitFast):
1282 (JSC::stringProtoFuncSubstr):
1283 (JSC::builtinStringSubstrInternal):
1284 (JSC::stringProtoFuncSubstring):
1285 (JSC::stringIncludesImpl):
1286 (JSC::stringProtoFuncIncludes):
1287 (JSC::builtinStringIncludesInternal):
1288 (JSC::jsStringWithReuse): Deleted.
1289 (JSC::jsSubstring): Deleted.
1290 (JSC::stringProtoFuncSplit): Deleted.
1291 * runtime/StringPrototype.h:
1295 2016-04-12 Keith Miller <keith_miller@apple.com>
1297 AbstractValue should use the result type to filter structures
1298 https://bugs.webkit.org/show_bug.cgi?id=156516
1300 Reviewed by Geoffrey Garen.
1302 When filtering an AbstractValue with a SpeculatedType we would not use the merged type when
1303 filtering out the valid structures (despite what the comment directly above said). This
1304 would cause us to crash if our structure-set was Top and the two speculated types were
1305 different kinds of cells.
1307 * dfg/DFGAbstractValue.cpp:
1308 (JSC::DFG::AbstractValue::filter):
1309 * tests/stress/ai-consistency-filter-cells.js: Added.
1311 (attribute.value.get record):
1312 (attribute.attrs.get this):
1314 (let.thisValue.return.serialize):
1315 (let.thisValue.transformFor):
1317 2016-04-12 Filip Pizlo <fpizlo@apple.com>
1319 Unreviewed, remove FIXME for https://bugs.webkit.org/show_bug.cgi?id=156457 and replace it
1320 with a comment that describes what we do now.
1322 * bytecode/PolymorphicAccess.h:
1324 2016-04-12 Saam barati <sbarati@apple.com>
1326 isLocked() assertion broke builds because ConcurrentJITLock isn't always a real lock.
1328 Rubber-stamped by Filip Pizlo.
1330 * bytecode/CodeBlock.cpp:
1331 (JSC::CodeBlock::resultProfileForBytecodeOffset):
1332 (JSC::CodeBlock::ensureResultProfile):
1334 2016-04-11 Filip Pizlo <fpizlo@apple.com>
1336 PolymorphicAccess should buffer AccessCases before regenerating
1337 https://bugs.webkit.org/show_bug.cgi?id=156457
1339 Reviewed by Benjamin Poulain.
1341 Prior to this change, whenever we added an AccessCase to a PolymorphicAccess, we would
1342 regenerate the whole stub. That meant that we'd do O(N^2) work for N access cases.
1344 One way to fix this is to have each AccessCase generate a stub just for itself, which
1345 cascades down to the already-generated cases. But that removes the binary switch
1346 optimization, which makes the IC perform great even when there are many cases.
1348 This change fixes the issue by buffering access cases. When we take slow path and try to add
1349 a new case, the StructureStubInfo will usually just buffer the new case without generating
1350 new code. We simply guarantee that after we buffer a case, we will take at most
1351 Options::repatchBufferingCountdown() slow path calls before generating code for it. That
1352 option is currently 7. Taking 7 more slow paths means that we have 7 more opportunities to
1353 gather more access cases, or to realize that this IC is too crazy to bother with.
1355 This change ensures that the DFG still gets the same kind of profiling. This is because the
1356 buffered AccessCases are still part of PolymorphicAccess and so are still scanned by
1357 GetByIdStatus and PutByIdStatus. The fact that the AccessCases hadn't been generated and so
1358 hadn't executed doesn't change much. Mainly, it increases the likelihood that the DFG will
1359 see an access case that !couldStillSucceed(). The DFG's existing profile parsing logic can
1360 handle this just fine.
1362 There are a bunch of algorithmic changes here. StructureStubInfo now caches the set of
1363 structures that it has seen as a guard to prevent adding lots of redundant cases, in case
1364 we see the same 7 cases after buffering the first one. This cache means we won't wastefully
1365 allocate 7 identical AccessCase instances. PolymorphicAccess is now restructured around
1366 having separate addCase() and regenerate() calls. That means a bit more moving data around.
1367 So far that seems OK for performance, probably since it's O(N) work rather than O(N^2) work.
1368 There is room for improvement for future patches, to be sure.
1370 This is benchmarking as slightly positive or neutral on JS benchmarks. It's meant to reduce
1371 pathologies I saw in page loads.
1373 * bytecode/GetByIdStatus.cpp:
1374 (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
1375 * bytecode/PolymorphicAccess.cpp:
1376 (JSC::PolymorphicAccess::PolymorphicAccess):
1377 (JSC::PolymorphicAccess::~PolymorphicAccess):
1378 (JSC::PolymorphicAccess::addCases):
1379 (JSC::PolymorphicAccess::addCase):
1380 (JSC::PolymorphicAccess::visitWeak):
1381 (JSC::PolymorphicAccess::dump):
1382 (JSC::PolymorphicAccess::commit):
1383 (JSC::PolymorphicAccess::regenerate):
1384 (JSC::PolymorphicAccess::aboutToDie):
1385 (WTF::printInternal):
1386 (JSC::PolymorphicAccess::regenerateWithCases): Deleted.
1387 (JSC::PolymorphicAccess::regenerateWithCase): Deleted.
1388 * bytecode/PolymorphicAccess.h:
1389 (JSC::AccessCase::isGetter):
1390 (JSC::AccessCase::callLinkInfo):
1391 (JSC::AccessGenerationResult::AccessGenerationResult):
1392 (JSC::AccessGenerationResult::madeNoChanges):
1393 (JSC::AccessGenerationResult::gaveUp):
1394 (JSC::AccessGenerationResult::buffered):
1395 (JSC::AccessGenerationResult::generatedNewCode):
1396 (JSC::AccessGenerationResult::generatedFinalCode):
1397 (JSC::AccessGenerationResult::shouldGiveUpNow):
1398 (JSC::AccessGenerationResult::generatedSomeCode):
1399 (JSC::PolymorphicAccess::isEmpty):
1400 (JSC::PolymorphicAccess::size):
1401 (JSC::PolymorphicAccess::at):
1402 * bytecode/PutByIdStatus.cpp:
1403 (JSC::PutByIdStatus::computeForStubInfo):
1404 * bytecode/StructureStubInfo.cpp:
1405 (JSC::StructureStubInfo::StructureStubInfo):
1406 (JSC::StructureStubInfo::addAccessCase):
1407 (JSC::StructureStubInfo::reset):
1408 (JSC::StructureStubInfo::visitWeakReferences):
1409 * bytecode/StructureStubInfo.h:
1410 (JSC::StructureStubInfo::considerCaching):
1411 (JSC::StructureStubInfo::willRepatch): Deleted.
1412 (JSC::StructureStubInfo::willCoolDown): Deleted.
1413 * jit/JITOperations.cpp:
1415 (JSC::tryCacheGetByID):
1416 (JSC::repatchGetByID):
1417 (JSC::tryCachePutByID):
1418 (JSC::repatchPutByID):
1419 (JSC::tryRepatchIn):
1421 * runtime/JSCJSValue.h:
1422 * runtime/JSCJSValueInlines.h:
1423 (JSC::JSValue::putByIndex):
1424 (JSC::JSValue::structureOrNull):
1425 (JSC::JSValue::structureOrUndefined):
1426 * runtime/Options.h:
1428 2016-04-12 Saam barati <sbarati@apple.com>
1430 There is a race with the compiler thread and the main thread with result profiles
1431 https://bugs.webkit.org/show_bug.cgi?id=156503
1433 Reviewed by Filip Pizlo.
1435 The compiler thread should not be asking for a result
1436 profile while the execution thread is creating one.
1437 We must guard against such races with a lock.
1439 * bytecode/CodeBlock.cpp:
1440 (JSC::CodeBlock::resultProfileForBytecodeOffset):
1441 (JSC::CodeBlock::ensureResultProfile):
1442 (JSC::CodeBlock::capabilityLevel):
1443 * bytecode/CodeBlock.h:
1444 (JSC::CodeBlock::couldTakeSlowCase):
1445 (JSC::CodeBlock::numberOfResultProfiles):
1446 (JSC::CodeBlock::specialFastCaseProfileCountForBytecodeOffset):
1447 (JSC::CodeBlock::ensureResultProfile): Deleted.
1449 2016-04-12 Commit Queue <commit-queue@webkit.org>
1451 Unreviewed, rolling out r199339.
1452 https://bugs.webkit.org/show_bug.cgi?id=156505
1454 memset_s is indeed necessary (Requested by alexchristensen_ on
1459 "Build fix after r199299."
1460 https://bugs.webkit.org/show_bug.cgi?id=155508
1461 http://trac.webkit.org/changeset/199339
1463 2016-04-12 Guillaume Emont <guijemont@igalia.com>
1465 MIPS: add MacroAssemblerMIPS::store8(TrustedImm32,ImplicitAddress)
1466 https://bugs.webkit.org/show_bug.cgi?id=156481
1468 This method with this signature is used by r199075, and therefore
1469 WebKit doesn't build on MIPS since then.
1471 Reviewed by Mark Lam.
1473 * assembler/MacroAssemblerMIPS.h:
1474 (JSC::MacroAssemblerMIPS::store8):
1476 2016-04-12 Saam barati <sbarati@apple.com>
1478 We incorrectly parse arrow function expressions
1479 https://bugs.webkit.org/show_bug.cgi?id=156373
1481 Reviewed by Mark Lam.
1483 This patch removes the notion of "isEndOfArrowFunction".
1484 This was a very weird function and it was incorrect.
1485 It checked that the arrow functions with concise body
1486 grammar production "had a valid ending". "had a valid
1487 ending" is in quotes because concise body arrow functions
1488 have a valid ending as long as their body has a valid
1489 assignment expression. I've removed all notion of this
1490 function because it was wrong and was causing us
1491 to throw syntax errors on valid programs.
1494 (JSC::Lexer<T>::nextTokenIsColon):
1495 (JSC::Lexer<T>::lex):
1496 (JSC::Lexer<T>::setTokenPosition): Deleted.
1498 (JSC::Lexer::setIsReparsingFunction):
1499 (JSC::Lexer::isReparsingFunction):
1500 (JSC::Lexer::lineNumber):
1501 * parser/Parser.cpp:
1502 (JSC::Parser<LexerType>::parseInner):
1503 (JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBodySourceElements):
1504 (JSC::Parser<LexerType>::parseFunctionInfo):
1506 (JSC::Parser::matchIdentifierOrKeyword):
1507 (JSC::Parser::tokenStart):
1508 (JSC::Parser::autoSemiColon):
1509 (JSC::Parser::canRecurse):
1510 (JSC::Parser::isEndOfArrowFunction): Deleted.
1511 (JSC::Parser::setEndOfStatement): Deleted.
1512 * tests/stress/arrowfunction-others.js:
1514 (simpleArrowFunction):
1518 2016-04-12 Yusuke Suzuki <utatane.tea@gmail.com>
1520 [JSC] addStaticGlobals should emit SymbolTableEntry watchpoints to encourage constant folding in DFG
1521 https://bugs.webkit.org/show_bug.cgi?id=155110
1523 Reviewed by Saam Barati.
1525 `addStaticGlobals` does not emit SymbolTableEntry watchpoints for the added entries.
1526 So, all the global variable lookups pointing to these static globals are not converted
1527 into constants in DFGBytecodeGenerator: this fact leaves these lookups as GetGlobalVar.
1528 Such thing avoids constant folding chance and emits CheckCell for @privateFunction inlining.
1529 This operation is pure overhead.
1531 Static globals are not configurable, and they are typically non-writable.
1532 So they are constants in almost all the cases.
1534 This patch initializes watchpoints for these static globals.
1535 These watchpoints allow DFG to convert these nodes into constants in DFG BytecodeParser.
1536 These watchpoints includes many builtin operations and `undefined`.
1538 The microbenchmark, many-foreach-calls shows 5 - 7% improvement since it removes unnecessary CheckCell.
1540 * bytecode/VariableWriteFireDetail.h:
1541 * runtime/JSGlobalObject.cpp:
1542 (JSC::JSGlobalObject::addGlobalVar):
1543 (JSC::JSGlobalObject::addStaticGlobals):
1544 * runtime/JSSymbolTableObject.h:
1545 (JSC::symbolTablePutTouchWatchpointSet):
1546 (JSC::symbolTablePutInvalidateWatchpointSet):
1547 (JSC::symbolTablePut):
1548 (JSC::symbolTablePutWithAttributesTouchWatchpointSet): Deleted.
1549 * runtime/SymbolTable.h:
1550 (JSC::SymbolTableEntry::SymbolTableEntry):
1551 (JSC::SymbolTableEntry::operator=):
1552 (JSC::SymbolTableEntry::swap):
1554 2016-04-12 Alex Christensen <achristensen@webkit.org>
1556 Build fix after r199299.
1557 https://bugs.webkit.org/show_bug.cgi?id=155508
1559 * jit/ExecutableAllocatorFixedVMPool.cpp:
1560 (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
1561 memset_s is not defined. __STDC_WANT_LIB_EXT1__ is not defined anywhere.
1562 Since the return value is unused and set_constraint_handler_s is never called
1563 I'm chaning it to memset.
1565 2016-04-11 Benjamin Poulain <bpoulain@apple.com>
1567 [JSC] B3 can use undefined bits or not defined required bits when spilling
1568 https://bugs.webkit.org/show_bug.cgi?id=156486
1570 Reviewed by Filip Pizlo.
1572 Spilling had issues when replacing arguments in place.
1575 1) If we have a 32bit stackslot, a x86 instruction could still try to load 64bits from it.
1576 2) If we have a 64bit stackslot, Move32 would only set half the bits.
1577 3) We were reducing Move to Move32 even if the top bits are read from the stack slot.
1579 The case 1 appear with something like this:
1581 Op64 %tmp1, %tmp2, %tmp3
1582 When we spill %tmp1, the stack slot is 32bit, Move32 sets 32bits
1583 but Op64 supports addressing for %tmp1. When we substitute %tmp1 in Op64,
1584 we are creating a 64bit read for a 32bit stack slot.
1586 The case 2 is an other common one. If we have:
1596 We have a stack slot of 64bits. When spilling %tmp1 in #1, we are
1597 effectively doing a 32bit store on the stack slot, leaving the top bits undefined.
1599 Case 3 is pretty much the same as 2 but we create the Move32 ourself
1600 because the source is a 32bit with ZDef.
1602 Case (1) is solved by requiring that the stack slot is at least as large as the largest
1603 use/def of that tmp.
1605 Case (2) and (3) are solved by not replacing a Tmp by an Address if the Def
1606 is smaller than the stack slot.
1608 * b3/air/AirIteratedRegisterCoalescing.cpp:
1610 (JSC::B3::testSpillDefSmallerThanUse):
1611 (JSC::B3::testSpillUseLargerThanDef):
1614 2016-04-11 Brian Burg <bburg@apple.com>
1616 Web Inspector: get rid of InspectorBasicValue and InspectorString subclasses
1617 https://bugs.webkit.org/show_bug.cgi?id=156407
1618 <rdar://problem/25627659>
1620 Reviewed by Joseph Pecoraro.
1622 There's no point having these subclasses as they don't save any space.
1623 Add a StringImpl to the union and merge some implementations of writeJSON.
1625 Rename m_data to m_map and explicitly name the union as InspectorValue::m_value.
1626 If the value is a string and the string is not empty or null (i.e., it has a
1627 StringImpl), then we need to ref() and deref() the string as the InspectorValue
1628 is created or destroyed.
1630 Move uses of the subclass to InspectorValue and delete redundant methods.
1631 Now, most InspectorValue methods are non-virtual so they can be templated.
1633 * bindings/ScriptValue.cpp:
1634 (Deprecated::jsToInspectorValue):
1635 * inspector/InjectedScriptBase.cpp:
1636 (Inspector::InjectedScriptBase::makeCall):
1637 Don't used deleted subclasses.
1639 * inspector/InspectorValues.cpp:
1640 (Inspector::InspectorValue::null):
1641 (Inspector::InspectorValue::create):
1642 (Inspector::InspectorValue::asValue):
1643 (Inspector::InspectorValue::asBoolean):
1644 (Inspector::InspectorValue::asDouble):
1645 (Inspector::InspectorValue::asInteger):
1646 (Inspector::InspectorValue::asString):
1647 These only need one implementation now.
1649 (Inspector::InspectorValue::writeJSON):
1650 Still a virtual method since Object and Array need their members.
1652 (Inspector::InspectorObjectBase::InspectorObjectBase):
1653 (Inspector::InspectorBasicValue::asBoolean): Deleted.
1654 (Inspector::InspectorBasicValue::asDouble): Deleted.
1655 (Inspector::InspectorBasicValue::asInteger): Deleted.
1656 (Inspector::InspectorBasicValue::writeJSON): Deleted.
1657 (Inspector::InspectorString::asString): Deleted.
1658 (Inspector::InspectorString::writeJSON): Deleted.
1659 (Inspector::InspectorString::create): Deleted.
1660 (Inspector::InspectorBasicValue::create): Deleted.
1662 * inspector/InspectorValues.h:
1663 (Inspector::InspectorObjectBase::find):
1664 (Inspector::InspectorObjectBase::setBoolean):
1665 (Inspector::InspectorObjectBase::setInteger):
1666 (Inspector::InspectorObjectBase::setDouble):
1667 (Inspector::InspectorObjectBase::setString):
1668 (Inspector::InspectorObjectBase::setValue):
1669 (Inspector::InspectorObjectBase::setObject):
1670 (Inspector::InspectorObjectBase::setArray):
1671 (Inspector::InspectorArrayBase::pushBoolean):
1672 (Inspector::InspectorArrayBase::pushInteger):
1673 (Inspector::InspectorArrayBase::pushDouble):
1674 (Inspector::InspectorArrayBase::pushString):
1675 (Inspector::InspectorArrayBase::pushValue):
1676 (Inspector::InspectorArrayBase::pushObject):
1677 (Inspector::InspectorArrayBase::pushArray):
1678 Use new factory methods.
1680 * replay/EncodedValue.cpp:
1681 (JSC::ScalarEncodingTraits<bool>::encodeValue):
1682 (JSC::ScalarEncodingTraits<double>::encodeValue):
1683 (JSC::ScalarEncodingTraits<float>::encodeValue):
1684 (JSC::ScalarEncodingTraits<int32_t>::encodeValue):
1685 (JSC::ScalarEncodingTraits<int64_t>::encodeValue):
1686 (JSC::ScalarEncodingTraits<uint32_t>::encodeValue):
1687 (JSC::ScalarEncodingTraits<uint64_t>::encodeValue):
1688 * replay/EncodedValue.h:
1689 Use new factory methods.
1691 2016-04-11 Filip Pizlo <fpizlo@apple.com>
1693 It should be possible to edit StructureStubInfo without recompiling the world
1694 https://bugs.webkit.org/show_bug.cgi?id=156470
1696 Reviewed by Keith Miller.
1698 This change makes it less painful to make changes to the IC code. It used to be that any
1699 change to StructureStubInfo caused every JIT-related file to get recompiled. Now only a
1700 smaller set of files - ones that actually peek into StructureStubInfo - will recompile. This
1701 is mainly because CodeBlock.h no longer includes StructureStubInfo.h.
1703 * bytecode/ByValInfo.h:
1704 * bytecode/CodeBlock.cpp:
1705 * bytecode/CodeBlock.h:
1706 * bytecode/GetByIdStatus.cpp:
1707 * bytecode/GetByIdStatus.h:
1708 * bytecode/PutByIdStatus.cpp:
1709 * bytecode/PutByIdStatus.h:
1710 * bytecode/StructureStubInfo.h:
1711 (JSC::getStructureStubInfoCodeOrigin):
1712 * dfg/DFGByteCodeParser.cpp:
1713 * dfg/DFGJITCompiler.cpp:
1714 * dfg/DFGOSRExitCompilerCommon.cpp:
1715 * dfg/DFGSpeculativeJIT.h:
1716 * ftl/FTLLowerDFGToB3.cpp:
1717 * ftl/FTLSlowPathCall.h:
1718 * jit/IntrinsicEmitter.cpp:
1719 * jit/JITInlineCacheGenerator.cpp:
1720 * jit/JITInlineCacheGenerator.h:
1721 * jit/JITOperations.cpp:
1722 * jit/JITPropertyAccess.cpp:
1723 * jit/JITPropertyAccess32_64.cpp:
1725 2016-04-11 Skachkov Oleksandr <gskachkov@gmail.com>
1727 Remove NewArrowFunction from DFG IR
1728 https://bugs.webkit.org/show_bug.cgi?id=156439
1730 Reviewed by Saam Barati.
1732 It seems that NewArrowFunction was left in DFG IR during refactoring by mistake.
1734 * dfg/DFGAbstractInterpreterInlines.h:
1735 * dfg/DFGClobberize.h:
1736 (JSC::DFG::clobberize):
1737 * dfg/DFGClobbersExitState.cpp:
1738 * dfg/DFGDoesGC.cpp:
1739 * dfg/DFGFixupPhase.cpp:
1740 * dfg/DFGMayExit.cpp:
1742 (JSC::DFG::Node::convertToPhantomNewFunction):
1743 * dfg/DFGNodeType.h:
1744 * dfg/DFGObjectAllocationSinkingPhase.cpp:
1745 * dfg/DFGPredictionPropagationPhase.cpp:
1746 * dfg/DFGSafeToExecute.h:
1747 * dfg/DFGSpeculativeJIT.cpp:
1748 (JSC::DFG::SpeculativeJIT::compileNewFunction):
1749 * dfg/DFGSpeculativeJIT32_64.cpp:
1750 * dfg/DFGSpeculativeJIT64.cpp:
1751 * dfg/DFGStoreBarrierInsertionPhase.cpp:
1752 * dfg/DFGStructureRegistrationPhase.cpp:
1753 * ftl/FTLCapabilities.cpp:
1754 * ftl/FTLLowerDFGToB3.cpp:
1755 (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
1757 2016-04-05 Oliver Hunt <oliver@apple.com>
1759 Remove compile time define for SEPARATED_HEAP
1760 https://bugs.webkit.org/show_bug.cgi?id=155508
1762 Reviewed by Mark Lam.
1764 Remove the SEPARATED_HEAP compile time flag. The separated
1765 heap is available, but off by default, on x86_64, ARMv7, and
1768 Working through the issues that happened last time essentially
1769 required implementing the ARMv7 path for the separated heap
1770 just so I could find all the ways it was going wrong.
1772 We fixed all the logic by making the branch and jump logic in
1773 the linker and assemblers take two parameters, the location to
1774 write to, and the location we'll actually be writing to. We
1775 need to do this because it's no longer sufficient to compute
1776 jumps relative to region the linker is writing to.
1778 The repatching jump, branch, and call functions only need the
1779 executable address as the patching is performed directly using
1780 performJITMemcpy function which works in terms of the executable
1783 There is no performance impact on jsc-benchmarks with the separate
1784 heap either emabled or disabled.
1786 * Configurations/FeatureDefines.xcconfig:
1787 * assembler/ARM64Assembler.h:
1788 (JSC::ARM64Assembler::linkJump):
1789 (JSC::ARM64Assembler::linkCall):
1790 (JSC::ARM64Assembler::relinkJump):
1791 (JSC::ARM64Assembler::relinkCall):
1792 (JSC::ARM64Assembler::link):
1793 (JSC::ARM64Assembler::linkJumpOrCall):
1794 (JSC::ARM64Assembler::linkCompareAndBranch):
1795 (JSC::ARM64Assembler::linkConditionalBranch):
1796 (JSC::ARM64Assembler::linkTestAndBranch):
1797 (JSC::ARM64Assembler::relinkJumpOrCall):
1798 * assembler/ARMv7Assembler.h:
1799 (JSC::ARMv7Assembler::revertJumpTo_movT3movtcmpT2):
1800 (JSC::ARMv7Assembler::revertJumpTo_movT3):
1801 (JSC::ARMv7Assembler::link):
1802 (JSC::ARMv7Assembler::linkJump):
1803 (JSC::ARMv7Assembler::relinkJump):
1804 (JSC::ARMv7Assembler::repatchCompact):
1805 (JSC::ARMv7Assembler::replaceWithJump):
1806 (JSC::ARMv7Assembler::replaceWithLoad):
1807 (JSC::ARMv7Assembler::replaceWithAddressComputation):
1808 (JSC::ARMv7Assembler::setInt32):
1809 (JSC::ARMv7Assembler::setUInt7ForLoad):
1810 (JSC::ARMv7Assembler::isB):
1811 (JSC::ARMv7Assembler::isBX):
1812 (JSC::ARMv7Assembler::isMOV_imm_T3):
1813 (JSC::ARMv7Assembler::isMOVT):
1814 (JSC::ARMv7Assembler::isNOP_T1):
1815 (JSC::ARMv7Assembler::isNOP_T2):
1816 (JSC::ARMv7Assembler::linkJumpT1):
1817 (JSC::ARMv7Assembler::linkJumpT2):
1818 (JSC::ARMv7Assembler::linkJumpT3):
1819 (JSC::ARMv7Assembler::linkJumpT4):
1820 (JSC::ARMv7Assembler::linkConditionalJumpT4):
1821 (JSC::ARMv7Assembler::linkBX):
1822 (JSC::ARMv7Assembler::linkConditionalBX):
1823 (JSC::ARMv7Assembler::linkJumpAbsolute):
1824 * assembler/LinkBuffer.cpp:
1825 (JSC::LinkBuffer::copyCompactAndLinkCode):
1826 * assembler/MacroAssemblerARM64.h:
1827 (JSC::MacroAssemblerARM64::link):
1828 * assembler/MacroAssemblerARMv7.h:
1829 (JSC::MacroAssemblerARMv7::link):
1830 * jit/ExecutableAllocator.h:
1831 (JSC::performJITMemcpy):
1832 * jit/ExecutableAllocatorFixedVMPool.cpp:
1833 (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
1834 (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
1835 (JSC::FixedVMPoolExecutableAllocator::genericWriteToJITRegion):
1836 (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator): Deleted.
1837 * runtime/Options.cpp:
1838 (JSC::recomputeDependentOptions):
1839 * runtime/Options.h:
1841 2016-04-10 Filip Pizlo <fpizlo@apple.com>
1843 Clean up how we reason about the states of AccessCases
1844 https://bugs.webkit.org/show_bug.cgi?id=156454
1846 Reviewed by Mark Lam.
1848 Currently when we add an AccessCase to a PolymorphicAccess stub, we regenerate the stub.
1849 That means that as we grow a stub to have N cases, we will do O(N^2) generation work. I want
1850 to explore buffering AccessCases so that we can do O(N) generation work instead. But to
1851 before I go there, I want to make sure that the statefulness of AccessCase makes sense. So,
1852 I broke it down into three different states and added assertions about the transitions. I
1853 also broke out a separate operation called AccessCase::commit(), which is the work that
1854 cannot be buffered since there cannot be any JS effects between when the AccessCase was
1855 created and when we do the work in commit().
1857 This opens up a fairly obvious path to buffering AccessCases: add them to the list without
1858 regenerating. Then when we do eventually trigger regeneration, those cases will get cloned
1859 and generated automagically. This patch doesn't implement this technique yet, but gives us
1860 an opportunity to independently test the scaffolding necessary to do it.
1862 This is perf-neutral on lots of tests.
1864 * bytecode/PolymorphicAccess.cpp:
1865 (JSC::AccessGenerationResult::dump):
1866 (JSC::AccessCase::clone):
1867 (JSC::AccessCase::commit):
1868 (JSC::AccessCase::guardedByStructureCheck):
1869 (JSC::AccessCase::dump):
1870 (JSC::AccessCase::generateWithGuard):
1871 (JSC::AccessCase::generate):
1872 (JSC::AccessCase::generateImpl):
1873 (JSC::PolymorphicAccess::regenerateWithCases):
1874 (JSC::PolymorphicAccess::regenerate):
1875 (WTF::printInternal):
1876 * bytecode/PolymorphicAccess.h:
1877 (JSC::AccessCase::type):
1878 (JSC::AccessCase::state):
1879 (JSC::AccessCase::offset):
1880 (JSC::AccessCase::viaProxy):
1881 (JSC::AccessCase::callLinkInfo):
1882 * bytecode/StructureStubInfo.cpp:
1883 (JSC::StructureStubInfo::addAccessCase):
1884 * bytecode/Watchpoint.h:
1885 * dfg/DFGOperations.cpp:
1887 (JSC::repatchGetByID):
1888 (JSC::repatchPutByID):
1891 (JSC::VM::dumpRegExpTrace):
1892 (JSC::VM::ensureWatchpointSetForImpureProperty):
1893 (JSC::VM::registerWatchpointForImpureProperty):
1894 (JSC::VM::addImpureProperty):
1897 2016-04-11 Fujii Hironori <Hironori.Fujii@jp.sony.com>
1899 [CMake] Make FOLDER property INHERITED
1900 https://bugs.webkit.org/show_bug.cgi?id=156460
1902 Reviewed by Brent Fulgham.
1905 * shell/CMakeLists.txt:
1906 * shell/PlatformWin.cmake:
1907 Set FOLDER property as a directory property not a target property
1909 2016-04-09 Keith Miller <keith_miller@apple.com>
1911 tryGetById should be supported by the DFG/FTL
1912 https://bugs.webkit.org/show_bug.cgi?id=156378
1914 Reviewed by Filip Pizlo.
1916 This patch adds support for tryGetById in the DFG/FTL. It adds a new DFG node
1917 TryGetById, which acts similarly to the normal GetById DFG node. One key
1918 difference between GetById and TryGetById is that in the LLInt and Baseline
1919 we do not profile the result type. This profiling is unnessary for the current
1920 use case of tryGetById, which is expected to be a strict equality comparision
1921 against a specific object or undefined. In either case other DFG optimizations
1922 will make this equally fast with or without the profiling information.
1924 Additionally, this patch adds new reuse modes for JSValueRegsTemporary that take
1925 an operand and attempt to reuse the registers for that operand if they are free
1926 after the current DFG node.
1928 * bytecode/GetByIdStatus.cpp:
1929 (JSC::GetByIdStatus::computeFromLLInt):
1930 (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
1931 * dfg/DFGAbstractInterpreterInlines.h:
1932 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1933 * dfg/DFGByteCodeParser.cpp:
1934 (JSC::DFG::ByteCodeParser::handleGetById):
1935 (JSC::DFG::ByteCodeParser::parseBlock):
1936 * dfg/DFGCapabilities.cpp:
1937 (JSC::DFG::capabilityLevel):
1938 * dfg/DFGClobberize.h:
1939 (JSC::DFG::clobberize):
1940 * dfg/DFGDoesGC.cpp:
1942 * dfg/DFGFixupPhase.cpp:
1943 (JSC::DFG::FixupPhase::fixupNode):
1945 (JSC::DFG::Node::hasIdentifier):
1946 * dfg/DFGNodeType.h:
1947 * dfg/DFGPredictionPropagationPhase.cpp:
1948 (JSC::DFG::PredictionPropagationPhase::propagate):
1949 * dfg/DFGSafeToExecute.h:
1950 (JSC::DFG::safeToExecute):
1951 * dfg/DFGSpeculativeJIT.cpp:
1952 (JSC::DFG::SpeculativeJIT::compileTryGetById):
1953 (JSC::DFG::JSValueRegsTemporary::JSValueRegsTemporary):
1954 * dfg/DFGSpeculativeJIT.h:
1955 (JSC::DFG::GPRTemporary::operator=):
1956 * dfg/DFGSpeculativeJIT32_64.cpp:
1957 (JSC::DFG::SpeculativeJIT::cachedGetById):
1958 (JSC::DFG::SpeculativeJIT::compile):
1959 * dfg/DFGSpeculativeJIT64.cpp:
1960 (JSC::DFG::SpeculativeJIT::cachedGetById):
1961 (JSC::DFG::SpeculativeJIT::compile):
1962 * ftl/FTLCapabilities.cpp:
1963 (JSC::FTL::canCompile):
1964 * ftl/FTLLowerDFGToB3.cpp:
1965 (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1966 (JSC::FTL::DFG::LowerDFGToB3::compileGetById):
1967 (JSC::FTL::DFG::LowerDFGToB3::getById):
1968 * jit/JITOperations.cpp:
1969 * jit/JITOperations.h:
1970 * tests/stress/try-get-by-id.js:
1971 (tryGetByIdTextStrict):
1973 (let.get createBuiltin):
1975 (getCaller.obj.1.throw.new.Error): Deleted.
1977 2016-04-09 Saam barati <sbarati@apple.com>
1979 Allocation sinking SSA Defs are allowed to have replacements
1980 https://bugs.webkit.org/show_bug.cgi?id=156444
1982 Reviewed by Filip Pizlo.
1984 Consider the following program and the annotations that explain why
1985 the SSA defs we create in allocation sinking can have replacements.
1988 let o1 = {x: 20, y: 50};
1989 let o2 = {y: 40, o1: o1};
1992 // We're Defing a new variable here, call it o3_field.
1993 // o3_field is defing the value that is the result of
1994 // a GetByOffset that gets eliminated through allocation sinking.
1999 // This control flow is here to not allow the phase to consult
2000 // its local SSA mapping (which properly handles replacements)
2001 // for the value of o3_field.
2008 // Here, we ask for the reaching def of o3_field, and assert
2009 // it doesn't have a replacement. It does have a replacement
2010 // though. The original Def was the GetByOffset. We replaced
2011 // that GetByOffset with the value of the o1_y variable.
2012 let value = o3.field;
2013 assert(value === 50);
2016 * dfg/DFGObjectAllocationSinkingPhase.cpp:
2017 * tests/stress/allocation-sinking-defs-may-have-replacements.js: Added.
2022 2016-04-09 Commit Queue <commit-queue@webkit.org>
2024 Unreviewed, rolling out r199242.
2025 https://bugs.webkit.org/show_bug.cgi?id=156442
2027 Caused many many leaks (Requested by ap on #webkit).
2031 "Web Inspector: get rid of InspectorBasicValue and
2032 InspectorString subclasses"
2033 https://bugs.webkit.org/show_bug.cgi?id=156407
2034 http://trac.webkit.org/changeset/199242
2036 2016-04-09 Filip Pizlo <fpizlo@apple.com>
2038 Debug JSC test failure: stress/multi-put-by-offset-reallocation-butterfly-cse.js.ftl-no-cjit-small-pool
2039 https://bugs.webkit.org/show_bug.cgi?id=156406
2041 Reviewed by Saam Barati.
2043 The failure was because the GC ran from within the butterfly allocation call in a put_by_id
2044 transition AccessCase that had to deal with indexing storage. When the GC runs in a call from a stub,
2045 then we need to be extra careful:
2047 1) The GC may reset the IC and delete the stub. So, the stub needs to tell the GC that it might be on
2048 the stack during GC, so that the GC keeps it alive if it's currently running.
2050 2) If the stub uses (dereferences or stores) some object after the call, then we need to ensure that
2051 the stub routine knows about that object independently of the IC.
2053 In the case of put_by_id transitions that use a helper to allocate the butterfly, we have both
2054 issues. A long time ago, we had to deal with (2), and we still had code to handle that case, although
2055 it appears to be dead. This change revives that code and glues it together with PolymorphicAccess.
2057 * bytecode/PolymorphicAccess.cpp:
2058 (JSC::AccessCase::alternateBase):
2059 (JSC::AccessCase::doesCalls):
2060 (JSC::AccessCase::couldStillSucceed):
2061 (JSC::AccessCase::generate):
2062 (JSC::PolymorphicAccess::regenerate):
2063 * bytecode/PolymorphicAccess.h:
2064 (JSC::AccessCase::customSlotBase):
2065 (JSC::AccessCase::isGetter):
2066 (JSC::AccessCase::doesCalls): Deleted.
2067 * jit/GCAwareJITStubRoutine.cpp:
2068 (JSC::GCAwareJITStubRoutine::markRequiredObjectsInternal):
2069 (JSC::MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine):
2070 (JSC::MarkingGCAwareJITStubRoutine::~MarkingGCAwareJITStubRoutine):
2071 (JSC::MarkingGCAwareJITStubRoutine::markRequiredObjectsInternal):
2072 (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler):
2073 (JSC::createJITStubRoutine):
2074 (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject): Deleted.
2075 (JSC::MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject): Deleted.
2076 (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal): Deleted.
2077 * jit/GCAwareJITStubRoutine.h:
2078 (JSC::createJITStubRoutine):
2080 2016-04-08 Joseph Pecoraro <pecoraro@apple.com>
2082 Web Inspector: XHRs and Web Worker scripts are not searchable
2083 https://bugs.webkit.org/show_bug.cgi?id=154214
2084 <rdar://problem/24643587>
2086 Reviewed by Timothy Hatcher.
2088 * inspector/protocol/Page.json:
2089 Add optional requestId to search results properties and search
2090 parameters for when the frameId and url are not enough. XHR
2091 resources, and "Other" resources will use this.
2093 2016-04-08 Guillaume Emont <guijemont@igalia.com>
2095 MIPS: support Signed cond in branchTest32()
2096 https://bugs.webkit.org/show_bug.cgi?id=156260
2098 This is needed since r197688 makes use of it.
2100 Reviewed by Mark Lam.
2102 * assembler/MacroAssemblerMIPS.h:
2103 (JSC::MacroAssemblerMIPS::branchTest32):
2105 2016-04-08 Alex Christensen <achristensen@webkit.org>
2107 Progress towards running CMake WebKit2 on Mac
2108 https://bugs.webkit.org/show_bug.cgi?id=156426
2110 Reviewed by Tim Horton.
2112 * PlatformMac.cmake:
2114 2016-04-08 Saam barati <sbarati@apple.com>
2116 Debugger may dereference m_currentCallFrame even after the VM has gone idle
2117 https://bugs.webkit.org/show_bug.cgi?id=156413
2119 Reviewed by Mark Lam.
2121 There is a bug where the debugger may dereference its m_currentCallFrame
2122 pointer after that pointer becomes invalid to read from. This happens like so:
2124 We may step over an instruction which causes the end of execution for the
2125 current program. This causes the VM to exit. Then, we perform a GC which
2126 causes us to collect the global object. The global object being collected
2127 causes us to detach the debugger. In detaching, we think we still have a
2128 valid m_currentCallFrame, we dereference it, and crash. The solution is to
2129 make sure we're paused when dereferencing this pointer inside ::detach().
2131 * debugger/Debugger.cpp:
2132 (JSC::Debugger::detach):
2134 2016-04-08 Brian Burg <bburg@apple.com>
2136 Web Inspector: get rid of InspectorBasicValue and InspectorString subclasses
2137 https://bugs.webkit.org/show_bug.cgi?id=156407
2138 <rdar://problem/25627659>
2140 Reviewed by Timothy Hatcher.
2142 There's no point having these subclasses as they don't save any space.
2143 Add m_stringValue to the union and merge some implementations of writeJSON.
2144 Move uses of the subclass to InspectorValue and delete redundant methods.
2145 Now, most InspectorValue methods are non-virtual so they can be templated.
2147 * bindings/ScriptValue.cpp:
2148 (Deprecated::jsToInspectorValue):
2149 * inspector/InjectedScriptBase.cpp:
2150 (Inspector::InjectedScriptBase::makeCall):
2151 Don't used deleted subclasses.
2153 * inspector/InspectorValues.cpp:
2154 (Inspector::InspectorValue::null):
2155 (Inspector::InspectorValue::create):
2156 (Inspector::InspectorValue::asValue):
2157 (Inspector::InspectorValue::asBoolean):
2158 (Inspector::InspectorValue::asDouble):
2159 (Inspector::InspectorValue::asInteger):
2160 (Inspector::InspectorValue::asString):
2161 These only need one implementation now.
2163 (Inspector::InspectorValue::writeJSON):
2164 Still a virtual method since Object and Array need their members.
2166 (Inspector::InspectorObjectBase::InspectorObjectBase):
2167 (Inspector::InspectorBasicValue::asBoolean): Deleted.
2168 (Inspector::InspectorBasicValue::asDouble): Deleted.
2169 (Inspector::InspectorBasicValue::asInteger): Deleted.
2170 (Inspector::InspectorBasicValue::writeJSON): Deleted.
2171 (Inspector::InspectorString::asString): Deleted.
2172 (Inspector::InspectorString::writeJSON): Deleted.
2173 (Inspector::InspectorString::create): Deleted.
2174 (Inspector::InspectorBasicValue::create): Deleted.
2176 * inspector/InspectorValues.h:
2177 (Inspector::InspectorObjectBase::setBoolean):
2178 (Inspector::InspectorObjectBase::setInteger):
2179 (Inspector::InspectorObjectBase::setDouble):
2180 (Inspector::InspectorObjectBase::setString):
2181 (Inspector::InspectorArrayBase::pushBoolean):
2182 (Inspector::InspectorArrayBase::pushInteger):
2183 (Inspector::InspectorArrayBase::pushDouble):
2184 (Inspector::InspectorArrayBase::pushString):
2185 Use new factory methods.
2187 * replay/EncodedValue.cpp:
2188 (JSC::ScalarEncodingTraits<bool>::encodeValue):
2189 (JSC::ScalarEncodingTraits<double>::encodeValue):
2190 (JSC::ScalarEncodingTraits<float>::encodeValue):
2191 (JSC::ScalarEncodingTraits<int32_t>::encodeValue):
2192 (JSC::ScalarEncodingTraits<int64_t>::encodeValue):
2193 (JSC::ScalarEncodingTraits<uint32_t>::encodeValue):
2194 (JSC::ScalarEncodingTraits<uint64_t>::encodeValue):
2195 * replay/EncodedValue.h:
2196 Use new factory methods.
2198 2016-04-08 Filip Pizlo <fpizlo@apple.com>
2200 Add IC support for arguments.length
2201 https://bugs.webkit.org/show_bug.cgi?id=156389
2203 Reviewed by Geoffrey Garen.
2205 This adds support for caching accesses to arguments.length for both DirectArguments and
2206 ScopedArguments. In strict mode, we already cached these accesses since they were just
2209 Amazingly, we also already supported caching of overridden arguments.length in both
2210 DirectArguments and ScopedArguments. This is because when you override, the property gets
2211 materialized as a normal JS property and the structure is changed.
2213 This patch painstakingly preserves our previous caching of overridden length while
2214 introducing caching of non-overridden length (i.e. the common case). In fact, we even cache
2215 the case where it could either be overridden or not, since we just end up with an AccessCase
2216 for each and they cascade to each other.
2218 This is a >3x speed-up on microbenchmarks that do arguments.length in a polymorphic context.
2219 Entirely monomorphic accesses were already handled by the DFG.
2221 * bytecode/PolymorphicAccess.cpp:
2222 (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
2223 (JSC::AccessCase::guardedByStructureCheck):
2224 (JSC::AccessCase::generateWithGuard):
2225 (JSC::AccessCase::generate):
2226 (WTF::printInternal):
2227 * bytecode/PolymorphicAccess.h:
2229 * jit/JITOperations.cpp:
2231 (JSC::tryCacheGetByID):
2232 (JSC::tryCachePutByID):
2233 (JSC::tryRepatchIn):
2234 * tests/stress/direct-arguments-override-length-then-access-normal-length.js: Added.
2239 2016-04-08 Benjamin Poulain <bpoulain@apple.com>
2241 UInt32ToNumber should have an Int52 path
2242 https://bugs.webkit.org/show_bug.cgi?id=125704
2244 Reviewed by Filip Pizlo.
2246 When dealing with big numbers, fall back to Int52 instead
2247 of double when possible.
2249 * dfg/DFGAbstractInterpreterInlines.h:
2250 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2251 * dfg/DFGFixupPhase.cpp:
2252 (JSC::DFG::FixupPhase::fixupNode):
2253 * dfg/DFGPredictionPropagationPhase.cpp:
2254 (JSC::DFG::PredictionPropagationPhase::propagate):
2255 * dfg/DFGSpeculativeJIT.cpp:
2256 (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
2257 * ftl/FTLLowerDFGToB3.cpp:
2258 (JSC::FTL::DFG::LowerDFGToB3::compileUInt32ToNumber):
2260 2016-04-08 Brian Burg <bburg@apple.com>
2262 Web Inspector: protocol generator should emit an error when 'type' is used instead of '$ref'
2263 https://bugs.webkit.org/show_bug.cgi?id=156275
2264 <rdar://problem/25569331>
2266 Reviewed by Darin Adler.
2268 * inspector/protocol/Heap.json: Fix a mistake that's now caught by the protocol generator.
2270 * inspector/scripts/codegen/models.py:
2271 (TypeReference.__init__): Check here if type_kind is on a whitelist of primitive types.
2272 (TypeReference.referenced_name): Update comment.
2274 Add a new test specifically for the case when the type would otherwise be resolved. Rebaseline.
2276 * inspector/scripts/tests/expected/fail-on-type-reference-as-primitive-type.json-error: Added.
2277 * inspector/scripts/tests/expected/fail-on-unknown-type-reference-in-type-declaration.json-error:
2278 * inspector/scripts/tests/fail-on-type-reference-as-primitive-type.json: Added.
2280 2016-04-07 Joseph Pecoraro <pecoraro@apple.com>
2282 Remove ENABLE(ENABLE_ES6_CLASS_SYNTAX) guards
2283 https://bugs.webkit.org/show_bug.cgi?id=156384
2285 Reviewed by Ryosuke Niwa.
2287 * Configurations/FeatureDefines.xcconfig:
2288 * features.json: Mark as Done.
2289 * parser/Parser.cpp:
2290 (JSC::Parser<LexerType>::parseExportDeclaration):
2291 (JSC::Parser<LexerType>::parseStatementListItem):
2292 (JSC::Parser<LexerType>::parsePrimaryExpression):
2293 (JSC::Parser<LexerType>::parseMemberExpression):
2295 2016-04-07 Filip Pizlo <fpizlo@apple.com>
2297 Implementing caching transition puts that need to reallocate with indexing storage
2298 https://bugs.webkit.org/show_bug.cgi?id=130914
2300 Reviewed by Saam Barati.
2302 This enables the IC's put_by_id path to handle reallocating the out-of-line storage even if
2303 the butterfly has indexing storage. Like the DFG, we do this by calling operations that
2304 reallocate the butterfly. Those use JSObject API and do all of the nasty work for us, like
2305 triggering a barrier.
2307 This does a bunch of refactoring to how PolymorphicAccess makes calls. It's a lot easier to
2308 do it now because the hard work is hidden under AccessGenerationState methods. This means
2309 that custom accessors now share logic with put_by_id transitions.
2311 * bytecode/PolymorphicAccess.cpp:
2312 (JSC::AccessGenerationState::succeed):
2313 (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
2314 (JSC::AccessGenerationState::preserveLiveRegistersToStackForCall):
2315 (JSC::AccessGenerationState::originalCallSiteIndex):
2316 (JSC::AccessGenerationState::emitExplicitExceptionHandler):
2317 (JSC::AccessCase::AccessCase):
2318 (JSC::AccessCase::transition):
2319 (JSC::AccessCase::generate):
2320 (JSC::PolymorphicAccess::regenerate):
2321 * bytecode/PolymorphicAccess.h:
2322 (JSC::AccessGenerationState::needsToRestoreRegistersIfException):
2323 (JSC::AccessGenerationState::liveRegistersToPreserveAtExceptionHandlingCallSite):
2324 * dfg/DFGOperations.cpp:
2325 * dfg/DFGOperations.h:
2326 * jit/JITOperations.cpp:
2327 * jit/JITOperations.h:
2329 2016-04-07 Joseph Pecoraro <pecoraro@apple.com>
2331 Remote Inspector: When disallowing remote inspection on a debuggable, a listing is still sent to debuggers
2332 https://bugs.webkit.org/show_bug.cgi?id=156380
2333 <rdar://problem/25323727>
2335 Reviewed by Timothy Hatcher.
2337 * inspector/remote/RemoteInspector.mm:
2338 (Inspector::RemoteInspector::updateTarget):
2339 (Inspector::RemoteInspector::updateAutomaticInspectionCandidate):
2340 When a target has been updated and it no longer generates a listing,
2341 we should remove the old listing as that is now stale and should
2342 not be sent. Not generating a listing means this target is no
2343 longer allowed to be debugged.
2345 2016-04-07 Joseph Pecoraro <pecoraro@apple.com>
2347 Web Inspector: Not necessary to validate webinspectord connection on iOS
2348 https://bugs.webkit.org/show_bug.cgi?id=156377
2349 <rdar://problem/25612460>
2351 Reviewed by Simon Fraser.
2353 * inspector/remote/RemoteInspectorXPCConnection.h:
2354 * inspector/remote/RemoteInspectorXPCConnection.mm:
2355 (Inspector::RemoteInspectorXPCConnection::handleEvent):
2357 2016-04-07 Keith Miller <keith_miller@apple.com>
2359 Rename ArrayMode::supportsLength to supportsSelfLength
2360 https://bugs.webkit.org/show_bug.cgi?id=156374
2362 Reviewed by Filip Pizlo.
2364 The name supportsLength is confusing because TypedArray have a
2365 length function however it is on the prototype and not on the
2366 instance. supportsSelfLength makes more sense since we use the
2367 function during fixup to tell if we can intrinsic the length
2368 property lookup on self accesses.
2370 * dfg/DFGArrayMode.h:
2371 (JSC::DFG::ArrayMode::supportsSelfLength):
2372 (JSC::DFG::ArrayMode::supportsLength): Deleted.
2373 * dfg/DFGFixupPhase.cpp:
2374 (JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):
2376 2016-04-07 Joseph Pecoraro <pecoraro@apple.com>
2378 Web Inspector: ProfileView source links are off by 1 line, worse in pretty printed code
2379 https://bugs.webkit.org/show_bug.cgi?id=156371
2381 Reviewed by Timothy Hatcher.
2383 * inspector/protocol/ScriptProfiler.json:
2384 Clarify that these locations are 1-based.
2386 2016-04-07 Jon Davis <jond@apple.com>
2388 Add Web Animations API to Feature Status Page
2389 https://bugs.webkit.org/show_bug.cgi?id=156360
2391 Reviewed by Timothy Hatcher.
2395 2016-04-07 Saam barati <sbarati@apple.com>
2397 Invalid assertion inside DebuggerScope::getOwnPropertySlot
2398 https://bugs.webkit.org/show_bug.cgi?id=156357
2400 Reviewed by Keith Miller.
2402 The Type Profiler might profile JS code that uses DebuggerScope and accesses properties
2403 on it. Therefore, it may have a DebuggerScope object in its log. Objects in the log
2404 are subject to having their getOwnPropertySlot method called. Therefore, the DebuggerScope
2405 might not always be in a valid state when its getOwnPropertySlot method is called.
2406 Therefore, the assertion invalid.
2408 * debugger/DebuggerScope.cpp:
2409 (JSC::DebuggerScope::getOwnPropertySlot):
2411 2016-04-07 Saam barati <sbarati@apple.com>
2413 Initial implementation of annex b.3.3 behavior was incorrect
2414 https://bugs.webkit.org/show_bug.cgi?id=156276
2416 Reviewed by Keith Miller.
2418 I almost got annex B.3.3 correct in my first implementation.
2419 There is a subtlety here I got wrong. We always create a local binding for
2420 a function at the very beginning of execution of a block scope. So we
2421 hoist function declarations to their local binding within a given
2422 block scope. When we actually evaluate the function declaration statement
2423 itself, we must lookup the binding in the current scope, and bind the
2424 value to the binding in the "var" scope. We perform the following
2425 abstract operations when executing a function declaration statement.
2427 f = lookupBindingInCurrentScope("func")
2428 store(varScope, "func", f)
2430 I got this wrong by performing the store to the var binding at the beginning
2431 of the block scope instead of when we evaluate the function declaration statement.
2432 This behavior is observable. For example, a program could change the value
2433 of "func" before the actual function declaration statement executes.
2434 Consider the following two functions:
2437 // func === undefined
2439 // typeof func === "function"
2440 function func() { } // Executing this statement binds the local "func" binding to the implicit "func" var binding.
2441 func = 20 // This sets the local "func" binding to 20.
2443 // typeof func === "function"
2447 // func === undefined
2449 // typeof func === "function"
2450 func = 20 // This sets the local "func" binding to 20.
2451 function func() { } // Executing this statement binds the local "func" binding to the implicit "func" var binding.
2457 * bytecompiler/BytecodeGenerator.cpp:
2458 (JSC::BytecodeGenerator::initializeBlockScopedFunctions):
2459 (JSC::BytecodeGenerator::hoistSloppyModeFunctionIfNecessary):
2460 * bytecompiler/BytecodeGenerator.h:
2461 (JSC::BytecodeGenerator::emitNodeForLeftHandSide):
2462 * bytecompiler/NodesCodegen.cpp:
2463 (JSC::FuncDeclNode::emitBytecode):
2464 * tests/stress/sloppy-mode-function-hoisting.js:
2469 (test.switch.case.0):
2471 (test.switch.capFoo2):
2475 2016-04-07 Alex Christensen <achristensen@webkit.org>
2477 Build fix after r199170
2481 2016-04-07 Keith Miller <keith_miller@apple.com>
2483 We should support the ability to do a non-effectful getById
2484 https://bugs.webkit.org/show_bug.cgi?id=156116
2486 Reviewed by Benjamin Poulain.
2488 Currently, there is no way in JS to do a non-effectful getById. A non-effectful getById is
2489 useful because it enables us to take different code paths based on values that we would
2490 otherwise not be able to have knowledge of. This patch adds this new feature called
2491 try_get_by_id that will attempt to do as much of a get_by_id as possible without performing
2492 an effectful behavior. Thus, try_get_by_id will return the value if the slot is a value, the
2493 GetterSetter object if the slot is a normal accessor (not a CustomGetterSetter) and
2494 undefined if the slot is unset. If the slot is proxied or any other cases then the result
2495 is null. In theory, if we ever wanted to check for null we could add a sentinal object to
2496 the global object that indicates we could not get the result.
2498 In order to implement this feature we add a new enum GetByIdKind that indicates what to do
2499 for accessor properties in PolymorphicAccess. If the GetByIdKind is pure then we treat the
2500 get_by_id the same way we would for load and return the value at the appropriate offset.
2501 Additionally, in order to make sure the we can properly compare the GetterSetter object
2502 with === GetterSetters are now JSObjects. This comes at the cost of eight extra bytes on the
2503 GetterSetter object but it vastly simplifies the patch. Additionally, the extra bytes are
2504 likely to have little to no impact on memory usage as normal accessors are generally rare.
2506 * JavaScriptCore.xcodeproj/project.pbxproj:
2507 * builtins/BuiltinExecutableCreator.cpp: Added.
2508 (JSC::createBuiltinExecutable):
2509 * builtins/BuiltinExecutableCreator.h: Copied from Source/JavaScriptCore/builtins/BuiltinExecutables.h.
2510 * builtins/BuiltinExecutables.cpp:
2511 (JSC::BuiltinExecutables::createDefaultConstructor):
2512 (JSC::BuiltinExecutables::createBuiltinExecutable):
2513 (JSC::createBuiltinExecutable):
2514 (JSC::BuiltinExecutables::createExecutable):
2515 (JSC::createExecutableInternal): Deleted.
2516 * builtins/BuiltinExecutables.h:
2517 * bytecode/BytecodeIntrinsicRegistry.h:
2518 * bytecode/BytecodeList.json:
2519 * bytecode/BytecodeUseDef.h:
2520 (JSC::computeUsesForBytecodeOffset):
2521 (JSC::computeDefsForBytecodeOffset):
2522 * bytecode/CodeBlock.cpp:
2523 (JSC::CodeBlock::dumpBytecode):
2524 * bytecode/PolymorphicAccess.cpp:
2525 (JSC::AccessCase::tryGet):
2526 (JSC::AccessCase::generate):
2527 (WTF::printInternal):
2528 * bytecode/PolymorphicAccess.h:
2529 (JSC::AccessCase::isGet): Deleted.
2530 (JSC::AccessCase::isPut): Deleted.
2531 (JSC::AccessCase::isIn): Deleted.
2532 * bytecode/StructureStubInfo.cpp:
2533 (JSC::StructureStubInfo::reset):
2534 * bytecode/StructureStubInfo.h:
2535 * bytecompiler/BytecodeGenerator.cpp:
2536 (JSC::BytecodeGenerator::emitTryGetById):
2537 * bytecompiler/BytecodeGenerator.h:
2538 * bytecompiler/NodesCodegen.cpp:
2539 (JSC::BytecodeIntrinsicNode::emit_intrinsic_tryGetById):
2540 * dfg/DFGSpeculativeJIT32_64.cpp:
2541 (JSC::DFG::SpeculativeJIT::cachedGetById):
2542 * dfg/DFGSpeculativeJIT64.cpp:
2543 (JSC::DFG::SpeculativeJIT::cachedGetById):
2544 * ftl/FTLLowerDFGToB3.cpp:
2545 (JSC::FTL::DFG::LowerDFGToB3::getById):
2547 (JSC::JIT::privateCompileMainPass):
2548 (JSC::JIT::privateCompileSlowCases):
2550 * jit/JITInlineCacheGenerator.cpp:
2551 (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
2552 * jit/JITInlineCacheGenerator.h:
2554 (JSC::JIT::callOperation):
2555 * jit/JITOperations.cpp:
2556 * jit/JITOperations.h:
2557 * jit/JITPropertyAccess.cpp:
2558 (JSC::JIT::emitGetByValWithCachedId):
2559 (JSC::JIT::emit_op_try_get_by_id):
2560 (JSC::JIT::emitSlow_op_try_get_by_id):
2561 (JSC::JIT::emit_op_get_by_id):
2562 * jit/JITPropertyAccess32_64.cpp:
2563 (JSC::JIT::emitGetByValWithCachedId):
2564 (JSC::JIT::emit_op_try_get_by_id):
2565 (JSC::JIT::emitSlow_op_try_get_by_id):
2566 (JSC::JIT::emit_op_get_by_id):
2568 (JSC::repatchByIdSelfAccess):
2569 (JSC::appropriateOptimizingGetByIdFunction):
2570 (JSC::appropriateGenericGetByIdFunction):
2571 (JSC::tryCacheGetByID):
2572 (JSC::repatchGetByID):
2573 (JSC::resetGetByID):
2576 (GlobalObject::finishCreation):
2577 (functionGetGetterSetter):
2578 (functionCreateBuiltin):
2579 * llint/LLIntData.cpp:
2580 (JSC::LLInt::Data::performAssertions):
2581 * llint/LLIntSlowPaths.cpp:
2582 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2583 * llint/LLIntSlowPaths.h:
2584 * llint/LowLevelInterpreter.asm:
2585 * runtime/GetterSetter.cpp:
2586 * runtime/GetterSetter.h:
2588 * runtime/PropertySlot.cpp:
2589 (JSC::PropertySlot::getPureResult):
2590 * runtime/PropertySlot.h:
2591 * runtime/ProxyObject.cpp:
2592 (JSC::ProxyObject::getOwnPropertySlotCommon):
2593 * tests/stress/try-get-by-id.js: Added.
2595 (getCaller.obj.1.throw.new.Error.let.func):
2596 (getCaller.obj.1.throw.new.Error):
2597 (throw.new.Error.get let):
2599 (throw.new.Error.let.get createBuiltin):
2601 (let.get createBuiltin):
2606 2016-04-07 Filip Pizlo <fpizlo@apple.com>
2608 Rationalize the makeSpaceForCCall stuff
2609 https://bugs.webkit.org/show_bug.cgi?id=156352
2611 Reviewed by Mark Lam.
2613 I want to add more code to PolymorphicAccess that makes C calls, so that I can finally fix
2614 https://bugs.webkit.org/show_bug.cgi?id=130914 (allow transition caches to handle indexing
2617 When trying to understand what it takes to make a C call, I came across code that was making
2618 room on the stack for spilled arguments. This logic was guarded with some complicated
2619 condition. At first, I tried to just refactor the code so that the same ugly condition
2620 wouldn't have to be copy-pasted everywhere that we made C calls. But then I started thinking
2621 about the condition, and realized that it was probably wrong: if the outer PolymorphicAccess
2622 harness decides to reuse a register for the scratchGPR then the top of the stack will store
2623 the old value of scratchGPR, but the condition wouldn't necessarily trigger. So if the call
2624 then overwrote something on the stack, we'd have a bad time.
2626 Making room on the stack for a call is a cheap operation. It's orders of magnitude cheaper
2627 than the rest of the call. Therefore, I think that it's best to just unconditionally make
2630 This patch makes us do just that. I also made the relevant helpers not inline, because I
2631 think that we have too many inline methods in our assemblers. Now it's much easier to make
2632 C calls from PolymorphicAccess because you just call the AssemblyHelper methods for making
2633 space. There are no special conditions or anything like that.
2635 * bytecode/PolymorphicAccess.cpp:
2636 (JSC::AccessCase::generate):
2637 * jit/AssemblyHelpers.cpp:
2638 (JSC::AssemblyHelpers::emitLoadStructure):
2639 (JSC::AssemblyHelpers::makeSpaceOnStackForCCall):
2640 (JSC::AssemblyHelpers::reclaimSpaceOnStackForCCall):
2641 (JSC::emitRandomThunkImpl):
2642 * jit/AssemblyHelpers.h:
2643 (JSC::AssemblyHelpers::makeSpaceOnStackForCCall): Deleted.
2644 (JSC::AssemblyHelpers::reclaimSpaceOnStackForCCall): Deleted.
2646 2016-04-07 Commit Queue <commit-queue@webkit.org>
2648 Unreviewed, rolling out r199128 and r199141.
2649 https://bugs.webkit.org/show_bug.cgi?id=156348
2651 Causes crashes on multiple webpages (Requested by keith_mi_ on
2654 Reverted changesets:
2656 "[ES6] Add support for Symbol.isConcatSpreadable."
2657 https://bugs.webkit.org/show_bug.cgi?id=155351
2658 http://trac.webkit.org/changeset/199128
2660 "Unreviewed, uncomment accidentally commented line in test."
2661 http://trac.webkit.org/changeset/199141
2663 2016-04-07 Filip Pizlo <fpizlo@apple.com>
2665 Rationalize the handling of PutById transitions a bit
2666 https://bugs.webkit.org/show_bug.cgi?id=156330
2668 Reviewed by Mark Lam.
2670 * bytecode/PolymorphicAccess.cpp:
2671 (JSC::AccessCase::generate): Get rid of the specialized slow calls. We can just use the failAndIgnore jump target. We just need to make sure that we don't make observable effects until we're done with all of the fast path checks.
2672 * bytecode/StructureStubInfo.cpp:
2673 (JSC::StructureStubInfo::addAccessCase): MadeNoChanges indicates that we should keep trying to repatch. Currently PutById transitions might trigger the case that addAccessCase() sees null, if the transition involves an indexing header. Doing repatching in that case is probably not good. But, we should just fix this the right way eventually.
2675 2016-04-07 Per Arne Vollan <peavo@outlook.com>
2677 [Win] Fix for JSC stress test failures.
2678 https://bugs.webkit.org/show_bug.cgi?id=156343
2680 Reviewed by Filip Pizlo.
2682 We need to make it clear to MSVC that the method loadPtr(ImplicitAddress address, RegisterID dest)
2683 should be used, and not loadPtr(const void* address, RegisterID dest).
2685 * jit/CCallHelpers.cpp:
2686 (JSC::CCallHelpers::setupShadowChickenPacket):
2688 2016-04-06 Benjamin Poulain <bpoulain@apple.com>
2690 [JSC] UInt32ToNumber should be NodeMustGenerate
2691 https://bugs.webkit.org/show_bug.cgi?id=156329
2693 Reviewed by Filip Pizlo.
2695 It exits on negative numbers on the integer path.
2697 * dfg/DFGFixupPhase.cpp:
2698 (JSC::DFG::FixupPhase::fixupNode):
2699 * dfg/DFGNodeType.h:
2701 2016-04-04 Geoffrey Garen <ggaren@apple.com>
2703 Unreviewed, rolling out r199016.
2704 https://bugs.webkit.org/show_bug.cgi?id=156140
2706 "Perf bots are down, so I can't re-land this right now."
2710 CopiedBlock should be 16kB
2711 https://bugs.webkit.org/show_bug.cgi?id=156168
2712 http://trac.webkit.org/changeset/199016
2714 2016-04-06 Mark Lam <mark.lam@apple.com>
2716 String.prototype.match() should be calling internal function RegExpCreate.
2717 https://bugs.webkit.org/show_bug.cgi?id=156318
2719 Reviewed by Filip Pizlo.
2721 RegExpCreate is not the same as the RegExp constructor. The current implementation
2722 invokes new @RegExp which calls the constructor. This results in failures in
2723 es6/Proxy_internal_get_calls_String.prototype.match.js, and
2724 es6/Proxy_internal_get_calls_String.prototype.search.js due to observable side
2727 This patch fixes this by factoring out the part of the RegExp constructor that
2728 makes the RegExpCreate function, and changing String's match and search to call
2729 RegExpCreate instead in accordance with the ES6 spec.
2731 * builtins/StringPrototype.js:
2734 * runtime/CommonIdentifiers.h:
2735 * runtime/JSGlobalObject.cpp:
2736 (JSC::JSGlobalObject::init):
2737 * runtime/RegExpConstructor.cpp:
2739 (JSC::regExpCreate):
2740 (JSC::constructRegExp):
2741 (JSC::esSpecRegExpCreate):
2742 (JSC::constructWithRegExpConstructor):
2743 * runtime/RegExpConstructor.h:
2746 2016-04-06 Keith Miller <keith_miller@apple.com>
2748 Unreviewed, uncomment accidentally commented line in test.
2750 * tests/stress/array-concat-spread-object.js:
2752 2016-04-06 Filip Pizlo <fpizlo@apple.com>
2754 JSC should have a simple way of gathering IC statistics
2755 https://bugs.webkit.org/show_bug.cgi?id=156317
2757 Reviewed by Benjamin Poulain.
2759 This adds a cheap, runtime-enabled way of gathering statistics about why we take the slow
2760 paths for inline caches. This is complementary to our existing bytecode profiler. Eventually
2761 we may want to combine the two things.
2763 This is not a slow-down on anything because we only do extra work on IC slow paths and if
2764 it's disabled it's just a load-and-branch to skip the stats gathering code.
2767 * JavaScriptCore.xcodeproj/project.pbxproj:
2768 * jit/ICStats.cpp: Added.
2769 * jit/ICStats.h: Added.
2770 * jit/JITOperations.cpp:
2771 * runtime/JSCJSValue.h:
2772 * runtime/JSCJSValueInlines.h:
2773 (JSC::JSValue::inherits):
2774 (JSC::JSValue::classInfoOrNull):
2775 (JSC::JSValue::toThis):
2776 * runtime/Options.h:
2778 2016-04-06 Filip Pizlo <fpizlo@apple.com>
2780 32-bit JSC stress/multi-put-by-offset-multiple-transitions.js failing
2781 https://bugs.webkit.org/show_bug.cgi?id=156292
2783 Reviewed by Benjamin Poulain.
2785 Make sure that we stash the callsite index before calling operationReallocateStorageAndFinishPut.
2787 * bytecode/PolymorphicAccess.cpp:
2788 (JSC::AccessCase::generate):
2790 2016-04-06 Filip Pizlo <fpizlo@apple.com>
2792 JSC test stress/arrowfunction-lexical-bind-superproperty.js failing
2793 https://bugs.webkit.org/show_bug.cgi?id=156309
2795 Reviewed by Saam Barati.
2797 Just be honest about the fact that the ArgumentCount and Callee parts of inline callframe runtime
2798 meta-data can be read at any time.
2800 We only have to say this for the inline callframe forms of ArgumentCount and Callee because we don't
2801 sink any part of the machine prologue. This change just prevents us from sinking the pseudoprologue
2802 of inlined varargs or closure calls.
2804 Shockingly, this is not a regression on anything.
2806 * dfg/DFGClobberize.h:
2807 (JSC::DFG::clobberize):
2809 2016-03-29 Keith Miller <keith_miller@apple.com>
2811 [ES6] Add support for Symbol.isConcatSpreadable.
2812 https://bugs.webkit.org/show_bug.cgi?id=155351
2814 Reviewed by Saam Barati.
2816 This patch adds support for Symbol.isConcatSpreadable. In order to do so it was necessary to move the
2817 Array.prototype.concat function to JS. A number of different optimizations were needed to make such the move to
2818 a builtin performant. First, four new DFG intrinsics were added.
2820 1) IsArrayObject (I would have called it IsArray but we use the same name for an IndexingType): an intrinsic of
2821 the Array.isArray function.
2822 2) IsJSArray: checks the first child is a JSArray object.
2823 3) IsArrayConstructor: checks the first child is an instance of ArrayConstructor.
2824 4) CallObjectConstructor: an intrinsic of the Object constructor.
2826 IsActualObject, IsJSArray, and CallObjectConstructor can all be converted into constants in the abstract interpreter if
2827 we are able to prove that the first child is an Array or for ToObject an Object.
2829 In order to further improve the perfomance we also now cover more indexing types in our fast path memcpy
2830 code. Before we would only memcpy Arrays if they had the same indexing type and did not have Array storage and
2831 were not undecided. Now the memcpy code covers the following additional two cases: One array is undecided and
2832 the other is a non-array storage and the case where one array is Int32 and the other is contiguous (we map this
2833 into a contiguous array).
2835 This patch also adds a new fast path for concat with more than one array argument by using memcpy to append
2836 values onto the result array. This works roughly the same as the two array fast path using the same methodology
2837 to decide if we can memcpy the other butterfly into the result butterfly.
2839 Two new debugging tools are also added to the jsc cli. One is a version of the print function with a private
2840 name so it can be used for debugging builtins. The other is dumpDataLog, which takes a JSValue and runs our
2841 dataLog function on it.
2843 Finally, this patch add a new constructor to JSValueRegsTemporary that allows it to reuse the the registers of a
2844 JSValueOperand if the operand's use count is one.
2846 * JavaScriptCore.xcodeproj/project.pbxproj:
2847 * builtins/ArrayPrototype.js:
2850 * bytecode/BytecodeIntrinsicRegistry.cpp:
2851 (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
2852 * bytecode/BytecodeIntrinsicRegistry.h:
2853 * dfg/DFGAbstractInterpreterInlines.h:
2854 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2855 * dfg/DFGByteCodeParser.cpp:
2856 (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
2857 (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
2858 * dfg/DFGClobberize.h:
2859 (JSC::DFG::clobberize):
2860 * dfg/DFGDoesGC.cpp:
2862 * dfg/DFGFixupPhase.cpp:
2863 (JSC::DFG::FixupPhase::fixupNode):
2864 * dfg/DFGNodeType.h:
2865 * dfg/DFGOperations.cpp:
2866 * dfg/DFGOperations.h:
2867 * dfg/DFGPredictionPropagationPhase.cpp:
2868 (JSC::DFG::PredictionPropagationPhase::propagate):
2869 * dfg/DFGSafeToExecute.h:
2870 (JSC::DFG::safeToExecute):
2871 * dfg/DFGSpeculativeJIT.cpp:
2872 (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
2873 (JSC::DFG::SpeculativeJIT::compileIsJSArray):
2874 (JSC::DFG::SpeculativeJIT::compileIsArrayObject):
2875 (JSC::DFG::SpeculativeJIT::compileIsArrayConstructor):
2876 (JSC::DFG::SpeculativeJIT::compileCallObjectConstructor):
2877 * dfg/DFGSpeculativeJIT.h:
2878 (JSC::DFG::SpeculativeJIT::callOperation):
2879 * dfg/DFGSpeculativeJIT32_64.cpp:
2880 (JSC::DFG::SpeculativeJIT::compile):
2881 * dfg/DFGSpeculativeJIT64.cpp:
2882 (JSC::DFG::SpeculativeJIT::compile):
2883 * ftl/FTLCapabilities.cpp:
2884 (JSC::FTL::canCompile):
2885 * ftl/FTLLowerDFGToB3.cpp:
2886 (JSC::FTL::DFG::LowerDFGToB3::compileNode):
2887 (JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor):
2888 (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayObject):
2889 (JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray):
2890 (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayConstructor):
2891 (JSC::FTL::DFG::LowerDFGToB3::isArray):
2892 * jit/JITOperations.h:
2894 (WTF::RuntimeArray::createStructure):
2895 (GlobalObject::finishCreation):
2897 (functionDataLogValue):
2898 * runtime/ArrayConstructor.cpp:
2899 (JSC::ArrayConstructor::finishCreation):
2900 (JSC::arrayConstructorPrivateFuncIsArrayConstructor):
2901 * runtime/ArrayConstructor.h:
2902 (JSC::isArrayConstructor):
2903 * runtime/ArrayPrototype.cpp:
2904 (JSC::ArrayPrototype::finishCreation):
2905 (JSC::arrayProtoPrivateFuncIsJSArray):
2906 (JSC::moveElements):
2907 (JSC::arrayProtoPrivateFuncConcatMemcpy):
2908 (JSC::arrayProtoPrivateFuncAppendMemcpy):
2909 (JSC::arrayProtoFuncConcat): Deleted.
2910 * runtime/ArrayPrototype.h:
2911 (JSC::ArrayPrototype::createStructure):
2912 * runtime/CommonIdentifiers.h:
2913 * runtime/Intrinsic.h:
2914 * runtime/JSArray.cpp:
2915 (JSC::JSArray::appendMemcpy):
2916 (JSC::JSArray::fastConcatWith): Deleted.
2917 * runtime/JSArray.h:
2918 (JSC::JSArray::createStructure):
2919 (JSC::JSArray::fastConcatType): Deleted.
2920 * runtime/JSArrayInlines.h: Added.
2921 (JSC::JSArray::memCopyWithIndexingType):
2922 (JSC::JSArray::canFastCopy):
2923 * runtime/JSGlobalObject.cpp:
2924 (JSC::JSGlobalObject::init):
2926 * runtime/ObjectConstructor.h:
2927 (JSC::constructObject):
2929 * tests/stress/array-concat-spread-object.js: Added.
2931 * tests/stress/array-concat-spread-proxy-exception-check.js: Added.
2933 * tests/stress/array-concat-spread-proxy.js: Added.
2935 * tests/stress/array-concat-with-slow-indexingtypes.js: Added.
2937 * tests/stress/array-species-config-array-constructor.js:
2939 2016-04-06 Commit Queue <commit-queue@webkit.org>
2941 Unreviewed, rolling out r199070.
2942 https://bugs.webkit.org/show_bug.cgi?id=156324
2944 "It didn't fix the timeout" (Requested by saamyjoon on
2949 "jsc-layout-tests.yaml/js/script-tests/regress-141098.js
2950 failing on Yosemite Debug after r198989"
2951 https://bugs.webkit.org/show_bug.cgi?id=156187
2952 http://trac.webkit.org/changeset/199070
2954 2016-04-06 Geoffrey Garen <ggaren@apple.com>
2956 Unreviewed, rolling in r199016.
2957 https://bugs.webkit.org/show_bug.cgi?id=156140
2959 It might work this time without regression because 16kB aligned requests
2960 now take the allocation fast path.
2964 CopiedBlock should be 16kB
2965 https://bugs.webkit.org/show_bug.cgi?id=156168
2966 http://trac.webkit.org/changeset/199016
2968 2016-04-06 Mark Lam <mark.lam@apple.com>
2970 Update es6.yaml to expect es6/Proxy_internal_get_calls_RegExp_constructor.js to pass.
2971 https://bugs.webkit.org/show_bug.cgi?id=156314
2973 Reviewed by Saam Barati.
2977 2016-04-06 Commit Queue <commit-queue@webkit.org>
2979 Unreviewed, rolling out r199104.
2980 https://bugs.webkit.org/show_bug.cgi?id=156301
2982 Still breaks internal builds (Requested by keith_miller on
2987 "We should support the ability to do a non-effectful getById"
2988 https://bugs.webkit.org/show_bug.cgi?id=156116
2989 http://trac.webkit.org/changeset/199104
2991 2016-04-06 Keith Miller <keith_miller@apple.com>
2993 RegExp constructor should use Symbol.match and other properties
2994 https://bugs.webkit.org/show_bug.cgi?id=155873
2996 Reviewed by Michael Saboff.
2998 This patch updates the behavior of the RegExp constructor. Now the constructor
2999 should get the Symbol.match property and check if it exists to decide if something
3000 should be constructed like a regexp object.
3002 * runtime/RegExpConstructor.cpp:
3004 (JSC::constructRegExp):
3005 (JSC::constructWithRegExpConstructor):
3006 (JSC::callRegExpConstructor):
3007 * runtime/RegExpConstructor.h:
3008 * tests/stress/regexp-constructor.js: Added.
3010 (throw.new.Error.get let):
3012 (throw.new.Error.get re):
3014 2016-04-06 Keith Miller <keith_miller@apple.com>
3016 We should support the ability to do a non-effectful getById
3017 https://bugs.webkit.org/show_bug.cgi?id=156116
3019 Reviewed by Benjamin Poulain.
3021 Currently, there is no way in JS to do a non-effectful getById. A non-effectful getById is
3022 useful because it enables us to take different code paths based on values that we would
3023 otherwise not be able to have knowledge of. This patch adds this new feature called
3024 try_get_by_id that will attempt to do as much of a get_by_id as possible without performing
3025 an effectful behavior. Thus, try_get_by_id will return the value if the slot is a value, the
3026 GetterSetter object if the slot is a normal accessor (not a CustomGetterSetter) and
3027 undefined if the slot is unset. If the slot is proxied or any other cases then the result
3028 is null. In theory, if we ever wanted to check for null we could add a sentinal object to
3029 the global object that indicates we could not get the result.
3031 In order to implement this feature we add a new enum GetByIdKind that indicates what to do
3032 for accessor properties in PolymorphicAccess. If the GetByIdKind is pure then we treat the
3033 get_by_id the same way we would for load and return the value at the appropriate offset.
3034 Additionally, in order to make sure the we can properly compare the GetterSetter object
3035 with === GetterSetters are now JSObjects. This comes at the cost of eight extra bytes on the
3036 GetterSetter object but it vastly simplifies the patch. Additionally, the extra bytes are
3037 likely to have little to no impact on memory usage as normal accessors are generally rare.
3039 * builtins/BuiltinExecutables.cpp:
3040 (JSC::BuiltinExecutables::createDefaultConstructor):
3041 (JSC::BuiltinExecutables::createBuiltinExecutable):
3042 (JSC::createBuiltinExecutable):
3043 (JSC::BuiltinExecutables::createExecutable):
3044 (JSC::createExecutableInternal): Deleted.
3045 * builtins/BuiltinExecutables.h:
3046 * bytecode/BytecodeIntrinsicRegistry.h:
3047 * bytecode/BytecodeList.json:
3048 * bytecode/BytecodeUseDef.h:
3049 (JSC::computeUsesForBytecodeOffset):
3050 (JSC::computeDefsForBytecodeOffset):
3051 * bytecode/CodeBlock.cpp:
3052 (JSC::CodeBlock::dumpBytecode):
3053 * bytecode/PolymorphicAccess.cpp:
3054 (JSC::AccessCase::tryGet):
3055 (JSC::AccessCase::generate):
3056 (WTF::printInternal):
3057 * bytecode/PolymorphicAccess.h:
3058 (JSC::AccessCase::isGet): Deleted.
3059 (JSC::AccessCase::isPut): Deleted.
3060 (JSC::AccessCase::isIn): Deleted.
3061 * bytecode/StructureStubInfo.cpp:
3062 (JSC::StructureStubInfo::reset):
3063 * bytecode/StructureStubInfo.h:
3064 * bytecompiler/BytecodeGenerator.cpp:
3065 (JSC::BytecodeGenerator::emitTryGetById):
3066 * bytecompiler/BytecodeGenerator.h:
3067 * bytecompiler/NodesCodegen.cpp:
3068 (JSC::BytecodeIntrinsicNode::emit_intrinsic_tryGetById):
3069 * dfg/DFGSpeculativeJIT32_64.cpp:
3070 (JSC::DFG::SpeculativeJIT::cachedGetById):
3071 * dfg/DFGSpeculativeJIT64.cpp:
3072 (JSC::DFG::SpeculativeJIT::cachedGetById):
3073 * ftl/FTLLowerDFGToB3.cpp:
3074 (JSC::FTL::DFG::LowerDFGToB3::getById):
3076 (JSC::JIT::privateCompileMainPass):
3077 (JSC::JIT::privateCompileSlowCases):
3079 * jit/JITInlineCacheGenerator.cpp:
3080 (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
3081 * jit/JITInlineCacheGenerator.h:
3083 (JSC::JIT::callOperation):
3084 * jit/JITOperations.cpp:
3085 * jit/JITOperations.h:
3086 * jit/JITPropertyAccess.cpp:
3087 (JSC::JIT::emitGetByValWithCachedId):
3088 (JSC::JIT::emit_op_try_get_by_id):
3089 (JSC::JIT::emitSlow_op_try_get_by_id):
3090 (JSC::JIT::emit_op_get_by_id):
3091 * jit/JITPropertyAccess32_64.cpp:
3092 (JSC::JIT::emitGetByValWithCachedId):
3093 (JSC::JIT::emit_op_try_get_by_id):
3094 (JSC::JIT::emitSlow_op_try_get_by_id):
3095 (JSC::JIT::emit_op_get_by_id):
3097 (JSC::repatchByIdSelfAccess):
3098 (JSC::appropriateOptimizingGetByIdFunction):
3099 (JSC::appropriateGenericGetByIdFunction):
3100 (JSC::tryCacheGetByID):
3101 (JSC::repatchGetByID):
3102 (JSC::resetGetByID):
3105 (GlobalObject::finishCreation):
3106 (functionGetGetterSetter):
3107 (functionCreateBuiltin):
3108 * llint/LLIntData.cpp:
3109 (JSC::LLInt::Data::performAssertions):
3110 * llint/LLIntSlowPaths.cpp:
3111 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3112 * llint/LLIntSlowPaths.h:
3113 * llint/LowLevelInterpreter.asm:
3114 * runtime/GetterSetter.cpp:
3115 * runtime/GetterSetter.h:
3117 * runtime/PropertySlot.cpp:
3118 (JSC::PropertySlot::getPureResult):
3119 * runtime/PropertySlot.h:
3120 * runtime/ProxyObject.cpp:
3121 (JSC::ProxyObject::getOwnPropertySlotCommon):
3122 * tests/stress/try-get-by-id.js: Added.
3124 (getCaller.obj.1.throw.new.Error.let.func):
3125 (getCaller.obj.1.throw.new.Error):
3126 (throw.new.Error.get let):
3128 (throw.new.Error.let.get createBuiltin):
3130 (let.get createBuiltin):
3135 2016-04-05 Chris Dumez <cdumez@apple.com>
3137 Add support for [EnabledAtRuntime] operations on DOMWindow
3138 https://bugs.webkit.org/show_bug.cgi?id=156272
3140 Reviewed by Alex Christensen.
3142 Add identifier for 'fetch' so it can be used from the generated
3145 * runtime/CommonIdentifiers.h:
3147 2016-04-05 Alex Christensen <achristensen@webkit.org>
3149 Make CMake-generated binaries on Mac able to run
3150 https://bugs.webkit.org/show_bug.cgi?id=156268
3152 Reviewed by Daniel Bates.
3156 2016-04-05 Filip Pizlo <fpizlo@apple.com>
3158 Improve some other cases of context-sensitive inlining
3159 https://bugs.webkit.org/show_bug.cgi?id=156277
3161 Reviewed by Benjamin Poulain.
3163 This implements some improvements for inlining:
3165 - We no longer do guarded inlining when the profiling doesn't come from a stub. Doing so would have
3166 been risky, and according to benchmarks, it wasn't common enough to matter. I think it's better to
3167 err on the side of not inlining.
3169 - The jneq_ptr pattern for variadic calls no longer breaks the basic block. Not breaking the block
3170 increases the chances of the parser seeing the callee constant. While inlining doesn't require a
3171 callee constant, sometimes it makes a difference. Note that we were previously breaking the block
3172 for no reason at all: if the boundary after jneq_ptr is a jump target from some other jump, then
3173 the parser will automatically break the block for us. There is no reason to add any block breaking
3174 ourselves since we implement jneq_ptr by ignoring the affirmative jump destination and inserting a
3175 check and falling through.
3177 - get_by_id handling now tries to apply some common sense to its status object. In particular, if
3178 the source is a NewObject and there was no interfering operation that could clobber the structure,
3179 then we know which case of a polymorphic GetByIdStatus we would take. This arises in some
3180 constructor patterns.
3182 Long term, we should address all of these cases comprehensively by having a late inliner. The inliner
3183 being part of the bytecode parser means that there is a lot of complexity in the parser and it
3184 prevents us from inlining upon learning new information from static analysis. But for now, I think
3185 it's fine to experiment with one-off hacks, if only to learn what the possibilities are.
3187 This is a 14% speed-up on Octane/raytrace.
3189 * bytecode/CallLinkStatus.cpp:
3190 (JSC::CallLinkStatus::dump):
3191 * bytecode/CallLinkStatus.h:
3192 (JSC::CallLinkStatus::couldTakeSlowPath):
3193 (JSC::CallLinkStatus::setCouldTakeSlowPath):
3194 (JSC::CallLinkStatus::variants):
3195 (JSC::CallLinkStatus::size):
3196 (JSC::CallLinkStatus::at):
3197 * bytecode/GetByIdStatus.cpp:
3198 (JSC::GetByIdStatus::makesCalls):
3199 (JSC::GetByIdStatus::filter):
3200 (JSC::GetByIdStatus::dump):
3201 * bytecode/GetByIdStatus.h:
3202 (JSC::GetByIdStatus::wasSeenInJIT):
3203 * dfg/DFGByteCodeParser.cpp:
3204 (JSC::DFG::ByteCodeParser::handleCall):
3205 (JSC::DFG::ByteCodeParser::refineStatically):
3206 (JSC::DFG::ByteCodeParser::handleVarargsCall):
3207 (JSC::DFG::ByteCodeParser::handleInlining):
3208 (JSC::DFG::ByteCodeParser::handleGetById):
3209 (JSC::DFG::ByteCodeParser::parseBlock):
3210 * runtime/Options.h:
3212 2016-04-05 Saam barati <sbarati@apple.com>
3214 JSC SamplingProfiler: Use a thread + sleep loop instead of WTF::WorkQueue for taking samples
3215 https://bugs.webkit.org/show_bug.cgi?id=154017
3217 Reviewed by Geoffrey Garen.
3219 By moving to an explicitly created seperate thread + sample-then-sleep
3220 loop, we can remove a lot of the crufty code around WorkQueue.
3221 We're also getting sample rates that are much closer to what we're
3222 asking the OS for. When the sampling handler was built off of WorkQueue,
3223 we'd often get sample rates much higher than the 1ms we asked for. On Kraken,
3224 we would average about 1.7ms sample rates, even though we'd ask for a 1ms rate.
3225 Now, on Kraken, we're getting about 1.2ms rates. Because we're getting
3226 higher rates, this patch is a performance regression. It's slower because
3227 we're sampling more frequently.
3229 Before this patch, the sampling profiler had the following overhead:
3234 With this patch, the sampling profiler has the following overhead:
3239 Comparatively, this new patch has the following overhead over the old sampling profiler:
3242 - 13% slower on AsmBench
3244 * inspector/agents/InspectorScriptProfilerAgent.cpp:
3245 (Inspector::InspectorScriptProfilerAgent::trackingComplete):
3246 * runtime/SamplingProfiler.cpp:
3247 (JSC::SamplingProfiler::SamplingProfiler):
3248 (JSC::SamplingProfiler::~SamplingProfiler):
3249 (JSC::SamplingProfiler::createThreadIfNecessary):
3250 (JSC::SamplingProfiler::timerLoop):
3251 (JSC::SamplingProfiler::takeSample):
3252 (JSC::tryGetBytecodeIndex):
3253 (JSC::SamplingProfiler::shutdown):
3254 (JSC::SamplingProfiler::start):
3255 (JSC::SamplingProfiler::pause):
3256 (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread):
3257 (JSC::SamplingProfiler::noticeJSLockAcquisition):
3258 (JSC::SamplingProfiler::noticeVMEntry):
3259 (JSC::SamplingProfiler::clearData):
3260 (JSC::SamplingProfiler::stop): Deleted.
3261 (JSC::SamplingProfiler::dispatchIfNecessary): Deleted.
3262 (JSC::SamplingProfiler::dispatchFunction): Deleted.
3263 * runtime/SamplingProfiler.h:
3264 (JSC::SamplingProfiler::setTimingInterval):
3265 (JSC::SamplingProfiler::setStopWatch):
3269 2016-04-05 Commit Queue <commit-queue@webkit.org>
3271 Unreviewed, rolling out r199073.
3272 https://bugs.webkit.org/show_bug.cgi?id=156261
3274 This change broke internal Mac builds (Requested by ryanhaddad
3279 "We should support the ability to do a non-effectful getById"
3280 https://bugs.webkit.org/show_bug.cgi?id=156116
3281 http://trac.webkit.org/changeset/199073
3283 2016-04-05 Youenn Fablet <youenn.fablet@crf.canon.fr>
3285 [Fetch API] Add a runtime flag to fetch API and related constructs
3286 https://bugs.webkit.org/show_bug.cgi?id=156113
3288 Reviewed by Alex Christensen.
3290 Add a fetch API runtime flag based on preferences.
3291 Disable fetch API by default.
3293 * runtime/CommonIdentifiers.h:
3295 2016-04-05 Filip Pizlo <fpizlo@apple.com>
3297 Unreviewed, fix cloop some more.
3299 * runtime/RegExpInlines.h:
3300 (JSC::RegExp::hasCodeFor):
3301 (JSC::RegExp::hasMatchOnlyCodeFor):
3303 2016-04-05 Filip Pizlo <fpizlo@apple.com>
3305 Unreviewed, fix cloop.
3307 * jit/CCallHelpers.cpp:
3309 2016-03-18 Filip Pizlo <fpizlo@apple.com>
3311 JSC should use a shadow stack version of CHICKEN so that debuggers have the option of retrieving tail-deleted frames
3312 https://bugs.webkit.org/show_bug.cgi?id=155598
3314 Reviewed by Saam Barati.
3316 JSC is the first JSVM to have proper tail calls. This means that error.stack and the
3317 debugger will appear to "delete" strict mode stack frames, if the call that this frame made
3318 was in tail position. This is exactly what functional programmers expect - they don't want
3319 the VM to waste resources on tail-deleted frames to ensure that it's legal to loop forever
3320 using tail calls. It's also something that non-functional programmers fear. It's not clear
3321 that tail-deleted frames would actually degrade the debugging experience, but the fear is
3322 real, so it's worthwhile to do something about it.
3324 It turns out that there is at least one tail call implementation that doesn't suffer from
3325 this problem. It implements proper tail calls in the sense that you won't run out of memory
3326 by tail-looping. It also has the power to show you tail-deleted frames in a backtrace, so
3327 long as you haven't yet run out of memory. It's called CHICKEN Scheme, and it's one of my
3330 http://www.more-magic.net/posts/internals-gc.html
3332 CHICKEN does many awesome things. The intuition from CHICKEN that we use here is a simple
3333 one: what if a tail call still kept the tail-deleted frame, and the GC actually deleted that
3334 frame only once we proved that there was insufficient memory to keep it around.
3336 CHICKEN does this by reshaping the C stack with longjmp/setjmp. We can't do that because we
3337 can have arbitrary native code, and that native code does not have relocatable stack frames.
3339 But we can do something almost like CHICKEN on a shadow stack. It's a common trick to have a
3340 VM maintain two stacks - the actual execution stack plus a shadow stack that has some extra
3341 information. The shadow stack can be reshaped, moved, etc, since the VM tightly controls its
3342 layout. The main stack can then continue to obey ABI rules.
3344 This patch implements a mechanism for being able to display stack traces that include
3345 tail-deleted frames. It uses a shadow stack that behaves like a CHICKEN stack: it has all
3346 frames all the time, though we will collect the tail-deleted ones if the stack gets too big.
3347 This new mechanism is called ShadowChicken, obviously: it's CHICKEN on a shadow stack.
3349 ShadowChicken is always on, but individual CodeBlocks may make their own choices about
3350 whether to opt into it. They will do that at bytecompile time based on the debugger mode on
3351 their global object.
3353 When no CodeBlock opts in, there is no overhead, since ShadowChicken ends up doing nothing
3354 in that case. Well, except when exceptions are thrown. Then it might do some work, but it's
git://git.webkit.org / WebKit-https.git / blob