2dbcc93bbae000f7075903cc393d4e5ef6c67545
[WebKit-https.git] / Source / JavaScriptCore / ChangeLog
1 2018-05-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2
3         Remove std::random_shuffle
4         https://bugs.webkit.org/show_bug.cgi?id=185292
5
6         Reviewed by Darin Adler.
7
8         std::random_shuffle is deprecated in C++14 and removed in C++17,
9         since std::random_shuffle relies on rand and srand.
10         Use std::shuffle instead.
11
12         * jit/BinarySwitch.cpp:
13         (JSC::RandomNumberGenerator::RandomNumberGenerator):
14         (JSC::RandomNumberGenerator::operator()):
15         (JSC::RandomNumberGenerator::min):
16         (JSC::RandomNumberGenerator::max):
17         (JSC::BinarySwitch::build):
18
19 2018-05-03  Saam Barati  <sbarati@apple.com>
20
21         Don't prevent CreateThis being folded to NewObject when the structure is poly proto
22         https://bugs.webkit.org/show_bug.cgi?id=185177
23
24         Reviewed by Filip Pizlo.
25
26         This patch teaches the DFG/FTL how to constant fold CreateThis with
27         a known poly proto Structure to NewObject. We do it by emitting a NewObject
28         followed by a PutByOffset for the prototype value.
29         
30         We make it so that ObjectAllocationProfile holds the prototype value.
31         This is sound because JSFunction clears that profile when its 'prototype'
32         field changes.
33         
34         This patch also renames underscoreProtoPrivateName to polyProtoName since
35         that name was nonsensical: it was only used for poly proto.
36         
37         This is a 2x speedup on the get_callee_polymorphic microbenchmark. I had
38         regressed that benchmark when I first introduced poly proto.
39
40         * builtins/BuiltinNames.cpp:
41         * builtins/BuiltinNames.h:
42         (JSC::BuiltinNames::BuiltinNames):
43         (JSC::BuiltinNames::polyProtoName const):
44         (JSC::BuiltinNames::underscoreProtoPrivateName const): Deleted.
45         * bytecode/ObjectAllocationProfile.h:
46         (JSC::ObjectAllocationProfile::prototype):
47         (JSC::ObjectAllocationProfile::clear):
48         (JSC::ObjectAllocationProfile::visitAggregate):
49         * bytecode/ObjectAllocationProfileInlines.h:
50         (JSC::ObjectAllocationProfile::initializeProfile):
51         * dfg/DFGAbstractInterpreterInlines.h:
52         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
53         * dfg/DFGByteCodeParser.cpp:
54         (JSC::DFG::ByteCodeParser::parseBlock):
55         * dfg/DFGConstantFoldingPhase.cpp:
56         (JSC::DFG::ConstantFoldingPhase::foldConstants):
57         * dfg/DFGOperations.cpp:
58         * runtime/CommonSlowPaths.cpp:
59         (JSC::SLOW_PATH_DECL):
60         * runtime/FunctionRareData.h:
61         * runtime/Structure.cpp:
62         (JSC::Structure::create):
63
64 2018-05-03  Michael Saboff  <msaboff@apple.com>
65
66         OSR entry pruning of Program Bytecodes doesn't take into account try/catch
67         https://bugs.webkit.org/show_bug.cgi?id=185281
68
69         Reviewed by Saam Barati.
70
71         When we compute bytecode block reachability, we need to take into account blocks
72         containing try/catch.
73
74         * jit/JIT.cpp:
75         (JSC::JIT::privateCompileMainPass):
76
77 2018-05-03  Dominik Infuehr  <dinfuehr@igalia.com>
78
79         ARM: Wrong offset for operand rt in disassembler
80         https://bugs.webkit.org/show_bug.cgi?id=184083
81
82         Reviewed by Yusuke Suzuki.
83
84         * disassembler/ARMv7/ARMv7DOpcode.h:
85         (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVDoublePrecision::rt):
86         (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVSinglePrecision::rt):
87
88 2018-05-03  Dominik Infuehr  <dinfuehr@igalia.com>
89
90         ARM: Support vstr in disassembler
91         https://bugs.webkit.org/show_bug.cgi?id=184084
92
93         Reviewed by Yusuke Suzuki.
94
95         * disassembler/ARMv7/ARMv7DOpcode.cpp:
96         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDRSTR::format):
97         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::format): Deleted.
98         * disassembler/ARMv7/ARMv7DOpcode.h:
99         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDRSTR::opName):
100         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::condition): Deleted.
101         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::uBit): Deleted.
102         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::rn): Deleted.
103         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::vd): Deleted.
104         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::doubleReg): Deleted.
105         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::immediate8): Deleted.
106
107 2018-05-03  Dominik Infuehr  <dinfuehr@igalia.com>
108
109         Invoke ensureArrayStorage for all arguments
110         https://bugs.webkit.org/show_bug.cgi?id=185247
111
112         Reviewed by Yusuke Suzuki.
113
114         ensureArrayStorage was only invoked for first argument in each loop iteration.
115
116         * jsc.cpp:
117         (functionEnsureArrayStorage):
118
119 2018-05-03  Filip Pizlo  <fpizlo@apple.com>
120
121         Make it easy to log compile times for all optimizing tiers
122         https://bugs.webkit.org/show_bug.cgi?id=185270
123
124         Reviewed by Keith Miller.
125         
126         This makes --logPhaseTimes=true enable logging of phase times for DFG and B3 using a common
127         helper class, CompilerTimingScope. This used to be called B3::TimingScope and only B3 used
128         it.
129         
130         This should help us reduce compile times by telling us where to look. So, far, it looks like
131         CFA is the worst.
132
133         * JavaScriptCore.xcodeproj/project.pbxproj:
134         * Sources.txt:
135         * b3/B3Common.cpp:
136         (JSC::B3::shouldMeasurePhaseTiming): Deleted.
137         * b3/B3Common.h:
138         * b3/B3TimingScope.cpp: Removed.
139         * b3/B3TimingScope.h:
140         (JSC::B3::TimingScope::TimingScope):
141         * dfg/DFGPhase.h:
142         (JSC::DFG::runAndLog):
143         * dfg/DFGPlan.cpp:
144         (JSC::DFG::Plan::compileInThread):
145         * tools/CompilerTimingScope.cpp: Added.
146         (JSC::CompilerTimingScope::CompilerTimingScope):
147         (JSC::CompilerTimingScope::~CompilerTimingScope):
148         * tools/CompilerTimingScope.h: Added.
149         * runtime/Options.cpp:
150         (JSC::recomputeDependentOptions):
151         * runtime/Options.h:
152
153 2018-05-03  Filip Pizlo  <fpizlo@apple.com>
154
155         Strings should not be allocated in a gigacage
156         https://bugs.webkit.org/show_bug.cgi?id=185218
157
158         Reviewed by Saam Barati.
159
160         * runtime/JSBigInt.cpp:
161         (JSC::JSBigInt::toStringGeneric):
162         * runtime/JSString.cpp:
163         (JSC::JSRopeString::resolveRopeToAtomicString const):
164         (JSC::JSRopeString::resolveRope const):
165         * runtime/JSString.h:
166         (JSC::JSString::create):
167         (JSC::JSString::createHasOtherOwner):
168         * runtime/VM.h:
169         (JSC::VM::gigacageAuxiliarySpace):
170
171 2018-05-03  Keith Miller  <keith_miller@apple.com>
172
173         Unreviewed, fix 32-bit profile offset for change in bytecode
174         length of the get_by_id and get_array_length opcodes.
175
176         * llint/LowLevelInterpreter32_64.asm:
177
178 2018-05-03  Michael Saboff  <msaboff@apple.com>
179
180         WebContent crash loading page on seas.upenn.edu @ JavaScriptCore: vmEntryToJavaScript
181         https://bugs.webkit.org/show_bug.cgi?id=185231
182
183         Reviewed by Saam Barati.
184
185         We weren't clearing the scratch register cache when switching back and forth between 
186         allowing scratch register usage.  We disallow scratch register usage when we are in
187         code that will freely allocate and use any register.  Such usage can change the
188         contents of scratch registers.  For ARM64, where we cache the contents of scratch
189         registers to reuse some or all of the contained values, we need to invalidate these
190         caches.  We do this when re-enabling scratch register usage, that is when we transition
191         from disallow to allow scratch register usage.
192
193         Added a new Air regression test.
194
195         * assembler/AllowMacroScratchRegisterUsage.h:
196         (JSC::AllowMacroScratchRegisterUsage::AllowMacroScratchRegisterUsage):
197         * assembler/AllowMacroScratchRegisterUsageIf.h:
198         (JSC::AllowMacroScratchRegisterUsageIf::AllowMacroScratchRegisterUsageIf):
199         * assembler/DisallowMacroScratchRegisterUsage.h:
200         (JSC::DisallowMacroScratchRegisterUsage::~DisallowMacroScratchRegisterUsage):
201         * b3/air/testair.cpp:
202
203 2018-05-03  Keith Miller  <keith_miller@apple.com>
204
205         Remove the prototype caching for get_by_id in the LLInt
206         https://bugs.webkit.org/show_bug.cgi?id=185226
207
208         Reviewed by Michael Saboff.
209
210         There is no evidence that this is actually a speedup and we keep
211         getting bugs with it. At this point it seems like we should just
212         remove this code.
213
214         * CMakeLists.txt:
215         * JavaScriptCore.xcodeproj/project.pbxproj:
216         * Sources.txt:
217         * bytecode/BytecodeDumper.cpp:
218         (JSC::BytecodeDumper<Block>::printGetByIdOp):
219         (JSC::BytecodeDumper<Block>::printGetByIdCacheStatus):
220         (JSC::BytecodeDumper<Block>::dumpBytecode):
221         * bytecode/BytecodeList.json:
222         * bytecode/BytecodeUseDef.h:
223         (JSC::computeUsesForBytecodeOffset):
224         (JSC::computeDefsForBytecodeOffset):
225         * bytecode/CodeBlock.cpp:
226         (JSC::CodeBlock::finalizeLLIntInlineCaches):
227         * bytecode/CodeBlock.h:
228         (JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.
229         * bytecode/GetByIdStatus.cpp:
230         (JSC::GetByIdStatus::computeFromLLInt):
231         * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp: Removed.
232         * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h: Removed.
233         * bytecompiler/BytecodeGenerator.cpp:
234         (JSC::BytecodeGenerator::emitGetById):
235         * dfg/DFGByteCodeParser.cpp:
236         (JSC::DFG::ByteCodeParser::parseBlock):
237         * dfg/DFGCapabilities.cpp:
238         (JSC::DFG::capabilityLevel):
239         * jit/JIT.cpp:
240         (JSC::JIT::privateCompileMainPass):
241         (JSC::JIT::privateCompileSlowCases):
242         * llint/LLIntSlowPaths.cpp:
243         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
244         (JSC::LLInt::setupGetByIdPrototypeCache): Deleted.
245         * llint/LowLevelInterpreter32_64.asm:
246         * llint/LowLevelInterpreter64.asm:
247         * runtime/Options.h:
248
249 2018-05-03  Ryan Haddad  <ryanhaddad@apple.com>
250
251         Unreviewed, rolling out r231197.
252
253         The test added with this change crashes on the 32-bit JSC bot.
254
255         Reverted changeset:
256
257         "Correctly detect string overflow when using the 'Function'
258         constructor"
259         https://bugs.webkit.org/show_bug.cgi?id=184883
260         https://trac.webkit.org/changeset/231197
261
262 2018-05-03  Dominik Infuehr  <dinfuehr@igalia.com>
263
264         Disable usage of fused multiply-add instructions for JSC with compiler flag
265         https://bugs.webkit.org/show_bug.cgi?id=184909
266
267         Reviewed by Yusuke Suzuki.
268
269         Adds -ffp-contract as compiler flag for building JSC. This ensures that functions
270         like parseInt() do not return slightly different results depending on whether the
271         compiler was able to use fused multiply-add instructions or not.
272
273         * CMakeLists.txt:
274
275 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
276
277         Unreviewed, fix build failure in ARM, ARMv7 and MIPS
278         https://bugs.webkit.org/show_bug.cgi?id=185192
279
280         compareDouble relies on MacroAssembler::invert function.
281
282         * assembler/MacroAssembler.h:
283         (JSC::MacroAssembler::compareDouble):
284         * assembler/MacroAssemblerARM.h:
285         (JSC::MacroAssemblerARM::compareDouble): Deleted.
286         * assembler/MacroAssemblerARMv7.h:
287         (JSC::MacroAssemblerARMv7::compareDouble): Deleted.
288         * assembler/MacroAssemblerMIPS.h:
289         (JSC::MacroAssemblerMIPS::compareDouble): Deleted.
290
291 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
292
293         [JSC] Add MacroAssembler::and16 and store16
294         https://bugs.webkit.org/show_bug.cgi?id=185188
295
296         Reviewed by Mark Lam.
297
298         r231129 requires and16(ImplicitAddress, RegisterID) and store16(RegisterID, ImplicitAddress) implementations.
299         This patch adds these methods for ARM.
300
301         * assembler/MacroAssemblerARM.h:
302         (JSC::MacroAssemblerARM::and16):
303         (JSC::MacroAssemblerARM::store16):
304
305 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
306
307         [DFG] Unify compare related code in 32bit and 64bit
308         https://bugs.webkit.org/show_bug.cgi?id=185189
309
310         Reviewed by Mark Lam.
311
312         This patch unifies some part of compare related code in 32bit and 64bit
313         to reduce the size of 32bit specific DFG code.
314
315         * dfg/DFGSpeculativeJIT.cpp:
316         (JSC::DFG::SpeculativeJIT::compileInt32Compare):
317         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
318         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
319         * dfg/DFGSpeculativeJIT32_64.cpp:
320         (JSC::DFG::SpeculativeJIT::compileObjectEquality): Deleted.
321         (JSC::DFG::SpeculativeJIT::compileInt32Compare): Deleted.
322         (JSC::DFG::SpeculativeJIT::compileDoubleCompare): Deleted.
323         * dfg/DFGSpeculativeJIT64.cpp:
324         (JSC::DFG::SpeculativeJIT::compileObjectEquality): Deleted.
325         (JSC::DFG::SpeculativeJIT::compileInt32Compare): Deleted.
326         (JSC::DFG::SpeculativeJIT::compileDoubleCompare): Deleted.
327
328 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
329
330         [JSC] Add compareDouble and compareFloat for ARM64, X86, and X86_64
331         https://bugs.webkit.org/show_bug.cgi?id=185192
332
333         Reviewed by Mark Lam.
334
335         Now Object.is starts using compareDouble. So we would like to have
336         efficient implementation for compareDouble and compareFloat for
337         major architectures, ARM64, X86, and X86_64.
338
339         This patch adds compareDouble and compareFloat implementations for
340         these architectures. And generic implementation is moved to each
341         architecture's MacroAssembler implementation.
342
343         We also add tests for them in testmasm. To implement this test
344         easily, we also add loadFloat(TrustedImmPtr, FPRegisterID) for the
345         major architectures.
346
347         * assembler/MacroAssembler.h:
348         (JSC::MacroAssembler::compareDouble): Deleted.
349         (JSC::MacroAssembler::compareFloat): Deleted.
350         * assembler/MacroAssemblerARM.h:
351         (JSC::MacroAssemblerARM::compareDouble):
352         * assembler/MacroAssemblerARM64.h:
353         (JSC::MacroAssemblerARM64::compareDouble):
354         (JSC::MacroAssemblerARM64::compareFloat):
355         (JSC::MacroAssemblerARM64::loadFloat):
356         (JSC::MacroAssemblerARM64::floatingPointCompare):
357         * assembler/MacroAssemblerARMv7.h:
358         (JSC::MacroAssemblerARMv7::compareDouble):
359         * assembler/MacroAssemblerMIPS.h:
360         (JSC::MacroAssemblerMIPS::compareDouble):
361         * assembler/MacroAssemblerX86Common.h:
362         (JSC::MacroAssemblerX86Common::loadFloat):
363         (JSC::MacroAssemblerX86Common::compareDouble):
364         (JSC::MacroAssemblerX86Common::compareFloat):
365         (JSC::MacroAssemblerX86Common::floatingPointCompare):
366         * assembler/X86Assembler.h:
367         (JSC::X86Assembler::movss_mr):
368         (JSC::X86Assembler::movss_rm):
369         * assembler/testmasm.cpp:
370         (JSC::floatOperands):
371         (JSC::testCompareFloat):
372         (JSC::run):
373
374 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
375
376         Unreviewed, fix 32bit DFG code
377         https://bugs.webkit.org/show_bug.cgi?id=185065
378
379         * dfg/DFGSpeculativeJIT.cpp:
380         (JSC::DFG::SpeculativeJIT::compileSameValue):
381
382 2018-05-02  Filip Pizlo  <fpizlo@apple.com>
383
384         JSC should know how to cache custom getter accesses on the prototype chain
385         https://bugs.webkit.org/show_bug.cgi?id=185213
386
387         Reviewed by Keith Miller.
388
389         This was a simple fix after the work I did for bug 185174. >4x speed-up on the new get-custom-getter.js test.
390
391         * jit/Repatch.cpp:
392         (JSC::tryCacheGetByID):
393
394 2018-05-01  Filip Pizlo  <fpizlo@apple.com>
395
396         JSC should be able to cache custom setter calls on the prototype chain
397         https://bugs.webkit.org/show_bug.cgi?id=185174
398
399         Reviewed by Saam Barati.
400
401         We broke custom-setter-on-the-prototype-chain caching when we fixed a bug involving the conditionSet.isEmpty()
402         condition being used to determine if we have an alternateBase. The fix in r222671 incorrectly tried to add
403         impossible-to-validate conditions to the conditionSet by calling generateConditionsForPrototypePropertyHit() instead
404         of generateConditionsForPrototypePropertyHitCustom(). The problem is that the former function will always fail for
405         custom accessors because it won't find the custom property in the structure.
406
407         The fix is to add a virtual hasAlternateBase() function and use that instead of conditionSet.isEmpty().
408
409         This is a 4x speed-up on assign-custom-setter.js.
410
411         * bytecode/AccessCase.cpp:
412         (JSC::AccessCase::hasAlternateBase const):
413         (JSC::AccessCase::alternateBase const):
414         (JSC::AccessCase::generateImpl):
415         * bytecode/AccessCase.h:
416         (JSC::AccessCase::alternateBase const): Deleted.
417         * bytecode/GetterSetterAccessCase.cpp:
418         (JSC::GetterSetterAccessCase::hasAlternateBase const):
419         (JSC::GetterSetterAccessCase::alternateBase const):
420         * bytecode/GetterSetterAccessCase.h:
421         * bytecode/ObjectPropertyConditionSet.cpp:
422         (JSC::generateConditionsForPrototypePropertyHitCustom):
423         * bytecode/ObjectPropertyConditionSet.h:
424         * jit/Repatch.cpp:
425         (JSC::tryCacheGetByID):
426         (JSC::tryCachePutByID):
427
428 2018-05-02  Dominik Infuehr  <dinfuehr@igalia.com>
429
430         [MIPS] Implement and16 and store16 for MacroAssemblerMIPS
431         https://bugs.webkit.org/show_bug.cgi?id=185195
432
433         Reviewed by Mark Lam.
434
435         This implements the given function for MIPS, such that it builds again.
436
437         * assembler/MacroAssemblerMIPS.h:
438         (JSC::MacroAssemblerMIPS::and16):
439         (JSC::MacroAssemblerMIPS::store16):
440
441 2018-05-02  Rick Waldron  <waldron.rick@gmail.com>
442
443         Expose "$262.agent.monotonicNow()" for use in testing Atomic operation timeouts
444         https://bugs.webkit.org/show_bug.cgi?id=185043
445
446         Reviewed by Filip Pizlo.
447
448         * jsc.cpp:
449         (GlobalObject::finishCreation):
450         (functionDollarAgentMonotonicNow):
451
452 2018-05-02  Dominik Infuehr  <dinfuehr@igalia.com>
453
454         [ARM] Implement and16 and store16 for MacroAssemblerARMv7
455         https://bugs.webkit.org/show_bug.cgi?id=185196
456
457         Reviewed by Mark Lam.
458
459         This implements and16 and store16 for MacroAssemblerARMv7 such that JSC builds again.
460
461         * assembler/MacroAssemblerARMv7.h:
462         (JSC::MacroAssemblerARMv7::and16):
463         (JSC::MacroAssemblerARMv7::store16):
464
465 2018-05-02  Robin Morisset  <rmorisset@apple.com>
466
467         emitCodeToGetArgumentsArrayLength should not crash on PhantomNewArrayWithSpread
468         https://bugs.webkit.org/show_bug.cgi?id=183172
469
470         Reviewed by Filip Pizlo.
471
472         DFGArgumentsEliminationPhase.cpp currently believes that allocations of NewArrayWithSpread can be deleted if they are only used by GetArrayLength,
473         but when it then calls emitCodeToGetArgumentsArrayLength, the latter has no idea what to do with GetArrayLength.
474
475         I fix the problem by teaching emitCodeToGetArgumentsArrayLength how to deal with GetArrayLength.
476         Because this requires emitting an Add that can overflow and thus exit, we also tell DFGArgumentsEliminationPhase to give up on eliminating
477         a NewArrayWithSpread when it is used by a GetArrayLength that is not allowed to exit.
478
479         * dfg/DFGArgumentsEliminationPhase.cpp:
480         * dfg/DFGArgumentsUtilities.cpp:
481         (JSC::DFG::emitCodeToGetArgumentsArrayLength):
482
483 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
484
485         Unreviewed, stackPointer signature is different from declaration
486         https://bugs.webkit.org/show_bug.cgi?id=184790
487
488         * runtime/MachineContext.h:
489         (JSC::MachineContext::stackPointer):
490
491 2018-05-01  Yusuke Suzuki  <utatane.tea@gmail.com>
492
493         [JSC] Add SameValue DFG node
494         https://bugs.webkit.org/show_bug.cgi?id=185065
495
496         Reviewed by Saam Barati.
497
498         This patch adds Object.is handling in DFG and FTL. Object.is is converted to SameValue DFG node.
499         And DFG fixup phase attempts to convert SameValue node to CompareStrictEq with type filter edges
500         if possible. Since SameValue(Untyped, Untyped) and SameValue(Double, Double) have different semantics
501         from CompareStrictEq, we do not convert SameValue to CompareStrictEq for them. DFG and FTL have
502         implementations for these SameValue nodes.
503
504         This old MacroAssemblerX86Common::compareDouble was dead code since the derived class, "MacroAssembler"
505         has a generalized compareDouble, which just uses branchDouble. Since this was not used, this function
506         was broken. This patch fixes issues and move compareDouble to MacroAssemblerX86Common, and remove a
507         generalized compareDouble for x86 arch to use this specialized efficient version instead. The fixes are
508         correctly using set32 to zero-extending the result, and setting the initial value of `dest` register
509         correctly for DoubleEqual and DoubleNotEqualOrUnordered cases.
510
511         Added microbenchmark shows performance improvement.
512
513             object-is           651.0053+-38.8204    ^    241.3467+-15.8753       ^ definitely 2.6974x faster
514
515         * assembler/MacroAssembler.h:
516         * assembler/MacroAssemblerX86Common.h:
517         (JSC::MacroAssemblerX86Common::compareDouble):
518         * assembler/MacroAssemblerX86_64.h:
519         (JSC::MacroAssemblerX86_64::compareDouble): Deleted.
520         * assembler/testmasm.cpp:
521         (JSC::doubleOperands):
522         (JSC::testCompareDouble):
523         (JSC::run):
524         * dfg/DFGAbstractInterpreterInlines.h:
525         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
526         * dfg/DFGByteCodeParser.cpp:
527         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
528         * dfg/DFGClobberize.h:
529         (JSC::DFG::clobberize):
530         * dfg/DFGConstantFoldingPhase.cpp:
531         (JSC::DFG::ConstantFoldingPhase::foldConstants):
532         * dfg/DFGDoesGC.cpp:
533         (JSC::DFG::doesGC):
534         * dfg/DFGFixupPhase.cpp:
535         (JSC::DFG::FixupPhase::fixupNode):
536         (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):
537         * dfg/DFGNodeType.h:
538         * dfg/DFGOperations.cpp:
539         * dfg/DFGOperations.h:
540         * dfg/DFGPredictionPropagationPhase.cpp:
541         * dfg/DFGSafeToExecute.h:
542         (JSC::DFG::safeToExecute):
543         * dfg/DFGSpeculativeJIT.cpp:
544         (JSC::DFG::SpeculativeJIT::compileSameValue):
545         * dfg/DFGSpeculativeJIT.h:
546         * dfg/DFGSpeculativeJIT32_64.cpp:
547         (JSC::DFG::SpeculativeJIT::compile):
548         * dfg/DFGSpeculativeJIT64.cpp:
549         (JSC::DFG::SpeculativeJIT::compile):
550         * dfg/DFGValidate.cpp:
551         * ftl/FTLCapabilities.cpp:
552         (JSC::FTL::canCompile):
553         * ftl/FTLLowerDFGToB3.cpp:
554         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
555         (JSC::FTL::DFG::LowerDFGToB3::compileSameValue):
556         * runtime/Intrinsic.cpp:
557         (JSC::intrinsicName):
558         * runtime/Intrinsic.h:
559         * runtime/ObjectConstructor.cpp:
560
561 2018-04-30  Filip Pizlo  <fpizlo@apple.com>
562
563         B3::demoteValues should be able to handle patchpoint terminals
564         https://bugs.webkit.org/show_bug.cgi?id=185151
565
566         Reviewed by Saam Barati.
567         
568         If we try to demote a patchpoint terminal then prior to this change we would append a Set to
569         the basic block that the patchpoint terminated. That's wrong because then the terminal is no
570         longer the last thing in the block.
571         
572         Air encounters this problem in spilling and solves it by doing a fixup afterwards. We can't
573         really do that because demotion happens as a prerequisite to other transformations.
574         
575         One solution might have been to make demoteValues insert a basic block whenever it encounters
576         this problem. But that would break clients that do CFG analysis before demoteValues and use
577         the results of the CFG analysis after demoteValues. Taildup does this. Fortunately, taildup
578         also runs breakCriticalEdges. Probably anyone using demoteValues will use breakCriticalEdges,
579         so it's not bad to introduce that requirement.
580         
581         So, this patch solves the problem by ensuring that breakCriticalEdges treats any patchpoint
582         terminal as if it had multiple successors. This means that a patchpoint terminal's successors
583         will only have it as their predecessor. Then, demoteValues just prepends the Set to the
584         successors of the patchpoint terminal.
585         
586         This was probably asymptomatic. It's hard to write a JS test that triggers this, so I added
587         a unit test in testb3.
588
589         * b3/B3BreakCriticalEdges.cpp:
590         (JSC::B3::breakCriticalEdges):
591         * b3/B3BreakCriticalEdges.h:
592         * b3/B3FixSSA.cpp:
593         (JSC::B3::demoteValues):
594         (JSC::B3::fixSSA):
595         * b3/B3FixSSA.h:
596         * b3/B3Value.cpp:
597         (JSC::B3::Value::foldIdentity const):
598         (JSC::B3::Value::performSubstitution):
599         * b3/B3Value.h:
600         * b3/testb3.cpp:
601         (JSC::B3::testDemotePatchpointTerminal):
602         (JSC::B3::run):
603
604 2018-05-01  Robin Morisset  <rmorisset@apple.com>
605
606         Use CheckedArithmetic for length computation in JSArray::unshiftCountWithAnyIndexingType
607         https://bugs.webkit.org/show_bug.cgi?id=184772
608         <rdar://problem/39146327>
609
610         Reviewed by Filip Pizlo.
611
612         Related to https://bugs.webkit.org/show_bug.cgi?id=183657 (<rdar://problem/38464399), where a check was missing.
613         This patch now makes sure that the check correctly detects if there is an integer overflow.
614
615         * runtime/JSArray.cpp:
616         (JSC::JSArray::unshiftCountWithAnyIndexingType):
617
618 2018-05-01  Robin Morisset  <rmorisset@apple.com>
619
620         Correctly detect string overflow when using the 'Function' constructor
621         https://bugs.webkit.org/show_bug.cgi?id=184883
622         <rdar://problem/36320331>
623
624         Reviewed by Filip Pizlo.
625
626         The 'Function' constructor creates a string containing the source code of the new function through repeated string concatenation.
627         Because there was no way for the string concatenation routines in WTF to return an error, they just crashed in that case.
628
629         I added new tryAppend methods alongside the old append methods, that return a boolean (true means success, false means an overflow happened).
630         In this way, it becomes possible for the Function constructor to just throw a proper JS exception when asked to create a string > 4GB.
631         I made new methods instead of just adapting the existing ones (and reverted such a change on appendQuotedJSONString) so that callers that rely on the old behaviour (a hard CRASH() on overflow) don't silently start failing.
632
633         * runtime/FunctionConstructor.cpp:
634         (JSC::constructFunctionSkippingEvalEnabledCheck):
635         * runtime/JSONObject.cpp:
636         (JSC::Stringifier::appendStringifiedValue):
637
638 2018-05-01  Robin Morisset  <rmorisset@apple.com>
639
640         IntlObject.cpp::removeUnicodeLocaleExtension() should not touch locales that end in '-u'
641         https://bugs.webkit.org/show_bug.cgi?id=185162
642
643         Reviewed by Filip Pizlo.
644
645         * runtime/IntlObject.cpp:
646         (JSC::removeUnicodeLocaleExtension):
647
648 2018-05-01  Dominik Infuehr  <dinfuehr@igalia.com>
649
650         Add SetCallee as DFG-Operation
651         https://bugs.webkit.org/show_bug.cgi?id=184582
652
653         Reviewed by Filip Pizlo.
654
655         For recursive tail calls not only the argument count can change but also the
656         callee. Add SetCallee to DFG that sets the callee slot in the current call frame.
657         Also update the callee when optimizing a recursive tail call.
658         Enable recursive tail call optimization also for closures.
659
660         * dfg/DFGAbstractInterpreterInlines.h:
661         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
662         * dfg/DFGByteCodeParser.cpp:
663         (JSC::DFG::ByteCodeParser::handleRecursiveTailCall):
664         (JSC::DFG::ByteCodeParser::handleCallVariant):
665         * dfg/DFGClobberize.h:
666         (JSC::DFG::clobberize):
667         * dfg/DFGDoesGC.cpp:
668         (JSC::DFG::doesGC):
669         * dfg/DFGFixupPhase.cpp:
670         (JSC::DFG::FixupPhase::fixupNode):
671         * dfg/DFGMayExit.cpp:
672         * dfg/DFGNodeType.h:
673         * dfg/DFGPredictionPropagationPhase.cpp:
674         * dfg/DFGSafeToExecute.h:
675         (JSC::DFG::safeToExecute):
676         * dfg/DFGSpeculativeJIT.cpp:
677         (JSC::DFG::SpeculativeJIT::compileSetCallee):
678         * dfg/DFGSpeculativeJIT.h:
679         * dfg/DFGSpeculativeJIT32_64.cpp:
680         (JSC::DFG::SpeculativeJIT::compile):
681         * dfg/DFGSpeculativeJIT64.cpp:
682         (JSC::DFG::SpeculativeJIT::compile):
683         * ftl/FTLCapabilities.cpp:
684         (JSC::FTL::canCompile):
685         * ftl/FTLLowerDFGToB3.cpp:
686         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
687         (JSC::FTL::DFG::LowerDFGToB3::compileSetCallee):
688
689 2018-05-01  Oleksandr Skachkov  <gskachkov@gmail.com>
690
691         WebAssembly: add support for stream APIs - JavaScript API
692         https://bugs.webkit.org/show_bug.cgi?id=183442
693
694         Reviewed by Yusuke Suzuki and JF Bastien.
695
696         Add WebAssembly stream API. Current patch only add functions
697         WebAssembly.compileStreaming and WebAssembly.instantiateStreaming but,
698         does not add streaming way of the implementation. So in current version it
699         only wait for load whole module, than start to parse.
700
701         * CMakeLists.txt:
702         * Configurations/FeatureDefines.xcconfig:
703         * DerivedSources.make:
704         * JavaScriptCore.xcodeproj/project.pbxproj:
705         * builtins/BuiltinNames.h:
706         * builtins/WebAssemblyPrototype.js: Copied from Source/JavaScriptCore/wasm/js/WebAssemblyPrototype.h.
707         (compileStreaming):
708         (instantiateStreaming):
709         * jsc.cpp:
710         * runtime/JSGlobalObject.cpp:
711         (JSC::JSGlobalObject::init):
712         * runtime/JSGlobalObject.h:
713         * runtime/Options.h:
714         * runtime/PromiseDeferredTimer.cpp:
715         (JSC::PromiseDeferredTimer::hasPendingPromise):
716         (JSC::PromiseDeferredTimer::hasDependancyInPendingPromise):
717         * runtime/PromiseDeferredTimer.h:
718         * wasm/js/WebAssemblyPrototype.cpp:
719         (JSC::webAssemblyModuleValidateAsyncInternal):
720         (JSC::webAssemblyCompileFunc):
721         (JSC::WebAssemblyPrototype::webAssemblyModuleValidateAsync):
722         (JSC::webAssemblyModuleInstantinateAsyncInternal):
723         (JSC::WebAssemblyPrototype::webAssemblyModuleInstantinateAsync):
724         (JSC::webAssemblyCompileStreamingInternal):
725         (JSC::webAssemblyInstantiateStreamingInternal):
726         (JSC::WebAssemblyPrototype::create):
727         (JSC::WebAssemblyPrototype::finishCreation):
728         * wasm/js/WebAssemblyPrototype.h:
729
730 2018-04-30  Saam Barati  <sbarati@apple.com>
731
732         ToString constant folds without preserving checks, causing us to break assumptions that the code would OSR exit
733         https://bugs.webkit.org/show_bug.cgi?id=185149
734         <rdar://problem/39455917>
735
736         Reviewed by Filip Pizlo.
737
738         The bug was that we were deleting checks that we shouldn't have deleted.
739         This patch makes a helper inside strength reduction that converts to
740         a LazyJSConstant while maintaining checks, and switches users of the
741         node API inside strength reduction to instead call the helper function.
742         
743         This patch also fixes a potential bug where StringReplace and
744         StringReplaceRegExp may not preserve all their checks.
745
746
747         * dfg/DFGStrengthReductionPhase.cpp:
748         (JSC::DFG::StrengthReductionPhase::handleNode):
749         (JSC::DFG::StrengthReductionPhase::convertToLazyJSValue):
750
751 2018-04-29  Filip Pizlo  <fpizlo@apple.com>
752
753         LICM shouldn't hoist nodes if hoisted nodes exited in that code block
754         https://bugs.webkit.org/show_bug.cgi?id=185126
755
756         Reviewed by Saam Barati.
757         
758         This change is just restoring functionality that we've already had for a while. It had been
759         accidentally broken due to an unrelated CodeBlock refactoring.
760
761         * dfg/DFGLICMPhase.cpp:
762         (JSC::DFG::LICMPhase::attemptHoist):
763
764 2018-04-30  Mark Lam  <mark.lam@apple.com>
765
766         Apply PtrTags to the MetaAllocator and friends.
767         https://bugs.webkit.org/show_bug.cgi?id=185110
768         <rdar://problem/39533895>
769
770         Reviewed by Saam Barati.
771
772         1. LinkBuffer now takes a MacroAssemblerCodePtr instead of a void* pointer.
773         2. Apply pointer tagging to the boundary pointers of the FixedExecutableMemoryPool,
774            and add a sanity check to verify that allocated code buffers are within those
775            bounds.
776
777         * assembler/LinkBuffer.cpp:
778         (JSC::LinkBuffer::finalizeCodeWithoutDisassemblyImpl):
779         (JSC::LinkBuffer::copyCompactAndLinkCode):
780         (JSC::LinkBuffer::linkCode):
781         (JSC::LinkBuffer::allocate):
782         * assembler/LinkBuffer.h:
783         (JSC::LinkBuffer::LinkBuffer):
784         (JSC::LinkBuffer::debugAddress):
785         (JSC::LinkBuffer::code):
786         * assembler/MacroAssemblerCodeRef.h:
787         (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
788         * bytecode/InlineAccess.cpp:
789         (JSC::linkCodeInline):
790         (JSC::InlineAccess::rewireStubAsJump):
791         * dfg/DFGJITCode.cpp:
792         (JSC::DFG::JITCode::findPC):
793         * ftl/FTLJITCode.cpp:
794         (JSC::FTL::JITCode::findPC):
795         * jit/ExecutableAllocator.cpp:
796         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
797         (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
798         (JSC::ExecutableAllocator::allocate):
799         * jit/ExecutableAllocator.h:
800         (JSC::isJITPC):
801         (JSC::performJITMemcpy):
802         * jit/JIT.cpp:
803         (JSC::JIT::link):
804         * jit/JITMathIC.h:
805         (JSC::isProfileEmpty):
806         * runtime/JSCPtrTag.h:
807         * wasm/WasmCallee.cpp:
808         (JSC::Wasm::Callee::Callee):
809         * wasm/WasmFaultSignalHandler.cpp:
810         (JSC::Wasm::trapHandler):
811
812 2018-04-30  Keith Miller  <keith_miller@apple.com>
813
814         Move the MayBePrototype JSCell header bit to InlineTypeFlags
815         https://bugs.webkit.org/show_bug.cgi?id=185143
816
817         Reviewed by Mark Lam.
818
819         * runtime/IndexingType.h:
820         * runtime/JSCellInlines.h:
821         (JSC::JSCell::setStructure):
822         (JSC::JSCell::mayBePrototype const):
823         (JSC::JSCell::didBecomePrototype):
824         * runtime/JSTypeInfo.h:
825         (JSC::TypeInfo::mayBePrototype):
826         (JSC::TypeInfo::mergeInlineTypeFlags):
827
828 2018-04-30  Keith Miller  <keith_miller@apple.com>
829
830         Remove unneeded exception check from String.fromCharCode
831         https://bugs.webkit.org/show_bug.cgi?id=185083
832
833         Reviewed by Mark Lam.
834
835         * runtime/StringConstructor.cpp:
836         (JSC::stringFromCharCode):
837
838 2018-04-30  Keith Miller  <keith_miller@apple.com>
839
840         Move StructureIsImmortal to out of line flags.
841         https://bugs.webkit.org/show_bug.cgi?id=185101
842
843         Reviewed by Saam Barati.
844
845         This will free up a bit in the inline flags where we can move the
846         isPrototype bit to. This will, in turn, free a bit for use in
847         implementing copy on write butterflies.
848
849         Also, this patch removes an assertion from Structure::typeInfo()
850         that inadvertently makes the function invalid to call while
851         cleaning up the vm.
852
853         * heap/HeapCellType.cpp:
854         (JSC::DefaultDestroyFunc::operator() const):
855         * runtime/JSCell.h:
856         * runtime/JSCellInlines.h:
857         (JSC::JSCell::callDestructor): Deleted.
858         * runtime/JSTypeInfo.h:
859         (JSC::TypeInfo::hasStaticPropertyTable):
860         (JSC::TypeInfo::structureIsImmortal const):
861         * runtime/Structure.h:
862
863 2018-04-30  Yusuke Suzuki  <utatane.tea@gmail.com>
864
865         [JSC] Remove arity fixup check if the number of parameters is 1
866         https://bugs.webkit.org/show_bug.cgi?id=183984
867
868         Reviewed by Mark Lam.
869
870         If the number of parameters is one (|this|), we never hit arity fixup check.
871         We do not need to emit arity fixup check code.
872
873         * dfg/DFGDriver.cpp:
874         (JSC::DFG::compileImpl):
875         * dfg/DFGJITCompiler.cpp:
876         (JSC::DFG::JITCompiler::compileFunction):
877         * dfg/DFGJITCompiler.h:
878         * ftl/FTLLink.cpp:
879         (JSC::FTL::link):
880         * jit/JIT.cpp:
881         (JSC::JIT::compileWithoutLinking):
882
883 2018-04-30  Yusuke Suzuki  <utatane.tea@gmail.com>
884
885         Use WordLock instead of std::mutex for Threading
886         https://bugs.webkit.org/show_bug.cgi?id=185121
887
888         Reviewed by Geoffrey Garen.
889
890         ThreadGroup starts using WordLock.
891
892         * heap/MachineStackMarker.h:
893         (JSC::MachineThreads::getLock):
894
895 2018-04-29  Filip Pizlo  <fpizlo@apple.com>
896
897         B3 should run tail duplication at the bitter end
898         https://bugs.webkit.org/show_bug.cgi?id=185123
899
900         Reviewed by Geoffrey Garen.
901         
902         Also added an option to disable taildup. This appears to be a 1% AsmBench speed-up. It's neutral
903         everywhere else.
904         
905         The goal of this change is to allow us to run path specialization after switch lowering but
906         before tail duplication.
907
908         * b3/B3Generate.cpp:
909         (JSC::B3::generateToAir):
910         * runtime/Options.h:
911
912 2018-04-29  Commit Queue  <commit-queue@webkit.org>
913
914         Unreviewed, rolling out r231137.
915         https://bugs.webkit.org/show_bug.cgi?id=185118
916
917         It is breaking Test262 language/expressions/multiplication
918         /order-of-evaluation.js (Requested by caiolima on #webkit).
919
920         Reverted changeset:
921
922         "[ESNext][BigInt] Implement support for "*" operation"
923         https://bugs.webkit.org/show_bug.cgi?id=183721
924         https://trac.webkit.org/changeset/231137
925
926 2018-04-28  Saam Barati  <sbarati@apple.com>
927
928         We don't model regexp effects properly
929         https://bugs.webkit.org/show_bug.cgi?id=185059
930         <rdar://problem/39736150>
931
932         Reviewed by Filip Pizlo.
933
934         RegExp exec/test can do arbitrary effects when toNumbering the lastIndex if
935         the regexp is global.
936
937         * dfg/DFGAbstractInterpreterInlines.h:
938         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
939         * dfg/DFGClobberize.h:
940         (JSC::DFG::clobberize):
941
942 2018-04-28  Rick Waldron  <waldron.rick@gmail.com>
943
944         Token misspelled "tocken" in error message string
945         https://bugs.webkit.org/show_bug.cgi?id=185030
946
947         Reviewed by Saam Barati.
948
949         * parser/Parser.cpp: Fix typo "tocken" => "token" in SyntaxError message string
950         (JSC::Parser<LexerType>::Parser):
951         (JSC::Parser<LexerType>::didFinishParsing):
952         (JSC::Parser<LexerType>::parseSourceElements):
953         (JSC::Parser<LexerType>::parseAsyncGeneratorFunctionSourceElements):
954         (JSC::Parser<LexerType>::parseVariableDeclaration):
955         (JSC::Parser<LexerType>::parseWhileStatement):
956         (JSC::Parser<LexerType>::parseVariableDeclarationList):
957         (JSC::Parser<LexerType>::createBindingPattern):
958         (JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBodySourceElements):
959         (JSC::Parser<LexerType>::parseObjectRestElement):
960         (JSC::Parser<LexerType>::parseDestructuringPattern):
961         (JSC::Parser<LexerType>::parseForStatement):
962         (JSC::Parser<LexerType>::parseBreakStatement):
963         (JSC::Parser<LexerType>::parseContinueStatement):
964         (JSC::Parser<LexerType>::parseThrowStatement):
965         (JSC::Parser<LexerType>::parseWithStatement):
966         (JSC::Parser<LexerType>::parseSwitchStatement):
967         (JSC::Parser<LexerType>::parseSwitchClauses):
968         (JSC::Parser<LexerType>::parseTryStatement):
969         (JSC::Parser<LexerType>::parseBlockStatement):
970         (JSC::Parser<LexerType>::parseFormalParameters):
971         (JSC::Parser<LexerType>::parseFunctionParameters):
972         (JSC::Parser<LexerType>::parseFunctionInfo):
973         (JSC::Parser<LexerType>::parseExpressionOrLabelStatement):
974         (JSC::Parser<LexerType>::parseExpressionStatement):
975         (JSC::Parser<LexerType>::parseIfStatement):
976         (JSC::Parser<LexerType>::parseAssignmentExpression):
977         (JSC::Parser<LexerType>::parseConditionalExpression):
978         (JSC::Parser<LexerType>::parseBinaryExpression):
979         (JSC::Parser<LexerType>::parseObjectLiteral):
980         (JSC::Parser<LexerType>::parseStrictObjectLiteral):
981         (JSC::Parser<LexerType>::parseArrayLiteral):
982         (JSC::Parser<LexerType>::parseArguments):
983         (JSC::Parser<LexerType>::parseMemberExpression):
984         (JSC::operatorString):
985         (JSC::Parser<LexerType>::parseUnaryExpression):
986         (JSC::Parser<LexerType>::printUnexpectedTokenText):
987
988 2018-04-28  Caio Lima  <ticaiolima@gmail.com>
989
990         [ESNext][BigInt] Implement support for "*" operation
991         https://bugs.webkit.org/show_bug.cgi?id=183721
992
993         Reviewed by Saam Barati.
994
995         Added BigInt support into times binary operator into LLInt and on
996         JITOperations profiledMul and unprofiledMul. We are also replacing all
997         uses of int to unsigned when there is no negative values for
998         variables.
999
1000         * dfg/DFGConstantFoldingPhase.cpp:
1001         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1002         * jit/JITOperations.cpp:
1003         * runtime/CommonSlowPaths.cpp:
1004         (JSC::SLOW_PATH_DECL):
1005         * runtime/JSBigInt.cpp:
1006         (JSC::JSBigInt::JSBigInt):
1007         (JSC::JSBigInt::allocationSize):
1008         (JSC::JSBigInt::createWithLength):
1009         (JSC::JSBigInt::toString):
1010         (JSC::JSBigInt::multiply):
1011         (JSC::JSBigInt::digitDiv):
1012         (JSC::JSBigInt::internalMultiplyAdd):
1013         (JSC::JSBigInt::multiplyAccumulate):
1014         (JSC::JSBigInt::equals):
1015         (JSC::JSBigInt::absoluteDivSmall):
1016         (JSC::JSBigInt::calculateMaximumCharactersRequired):
1017         (JSC::JSBigInt::toStringGeneric):
1018         (JSC::JSBigInt::rightTrim):
1019         (JSC::JSBigInt::allocateFor):
1020         (JSC::JSBigInt::parseInt):
1021         (JSC::JSBigInt::digit):
1022         (JSC::JSBigInt::setDigit):
1023         * runtime/JSBigInt.h:
1024         * runtime/Operations.h:
1025         (JSC::jsMul):
1026
1027 2018-04-28  Commit Queue  <commit-queue@webkit.org>
1028
1029         Unreviewed, rolling out r231131.
1030         https://bugs.webkit.org/show_bug.cgi?id=185112
1031
1032         It is breaking Debug build due to unchecked exception
1033         (Requested by caiolima on #webkit).
1034
1035         Reverted changeset:
1036
1037         "[ESNext][BigInt] Implement support for "*" operation"
1038         https://bugs.webkit.org/show_bug.cgi?id=183721
1039         https://trac.webkit.org/changeset/231131
1040
1041 2018-04-27  Caio Lima  <ticaiolima@gmail.com>
1042
1043         [ESNext][BigInt] Implement support for "*" operation
1044         https://bugs.webkit.org/show_bug.cgi?id=183721
1045
1046         Reviewed by Saam Barati.
1047
1048         Added BigInt support into times binary operator into LLInt and on
1049         JITOperations profiledMul and unprofiledMul. We are also replacing all
1050         uses of int to unsigned when there is no negative values for
1051         variables.
1052
1053         * dfg/DFGConstantFoldingPhase.cpp:
1054         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1055         * jit/JITOperations.cpp:
1056         * runtime/CommonSlowPaths.cpp:
1057         (JSC::SLOW_PATH_DECL):
1058         * runtime/JSBigInt.cpp:
1059         (JSC::JSBigInt::JSBigInt):
1060         (JSC::JSBigInt::allocationSize):
1061         (JSC::JSBigInt::createWithLength):
1062         (JSC::JSBigInt::toString):
1063         (JSC::JSBigInt::multiply):
1064         (JSC::JSBigInt::digitDiv):
1065         (JSC::JSBigInt::internalMultiplyAdd):
1066         (JSC::JSBigInt::multiplyAccumulate):
1067         (JSC::JSBigInt::equals):
1068         (JSC::JSBigInt::absoluteDivSmall):
1069         (JSC::JSBigInt::calculateMaximumCharactersRequired):
1070         (JSC::JSBigInt::toStringGeneric):
1071         (JSC::JSBigInt::rightTrim):
1072         (JSC::JSBigInt::allocateFor):
1073         (JSC::JSBigInt::parseInt):
1074         (JSC::JSBigInt::digit):
1075         (JSC::JSBigInt::setDigit):
1076         * runtime/JSBigInt.h:
1077         * runtime/Operations.h:
1078         (JSC::jsMul):
1079
1080 2018-04-27  JF Bastien  <jfbastien@apple.com>
1081
1082         Make the first 64 bits of JSString look like a double JSValue
1083         https://bugs.webkit.org/show_bug.cgi?id=185081
1084
1085         Reviewed by Filip Pizlo.
1086
1087         We can be clever about how we lay out JSString so that, were it
1088         reinterpreted as a JSValue, it would look like a double.
1089
1090         * assembler/MacroAssemblerX86Common.h:
1091         (JSC::MacroAssemblerX86Common::and16):
1092         * assembler/X86Assembler.h:
1093         (JSC::X86Assembler::andw_mr):
1094         * dfg/DFGSpeculativeJIT.cpp:
1095         (JSC::DFG::SpeculativeJIT::compileMakeRope):
1096         * ftl/FTLLowerDFGToB3.cpp:
1097         (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
1098         * ftl/FTLOutput.h:
1099         (JSC::FTL::Output::store32As8):
1100         (JSC::FTL::Output::store32As16):
1101         * runtime/JSString.h:
1102         (JSC::JSString::JSString):
1103
1104 2018-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1105
1106         [JSC][ARM64][Linux] Add collectCPUFeatures using auxiliary vector
1107         https://bugs.webkit.org/show_bug.cgi?id=185055
1108
1109         Reviewed by JF Bastien.
1110
1111         This patch is paving the way to emitting jscvt instruction if possible.
1112         To do that, we need to determine jscvt instruction is supported in the
1113         given CPU.
1114
1115         We add a function collectCPUFeatures, which is responsible to collect
1116         CPU features if necessary. In Linux, we can use auxiliary vector to get
1117         the information without parsing /proc/cpuinfo.
1118
1119         Currently, nobody calls this function. It is later called when we emit
1120         jscvt instruction. To make it possible, we also need to add disassembler
1121         support too.
1122
1123         * assembler/AbstractMacroAssembler.h:
1124         * assembler/MacroAssemblerARM64.cpp:
1125         (JSC::MacroAssemblerARM64::collectCPUFeatures):
1126         * assembler/MacroAssemblerARM64.h:
1127         * assembler/MacroAssemblerX86Common.h:
1128
1129 2018-04-26  Filip Pizlo  <fpizlo@apple.com>
1130
1131         Also run foldPathConstants before mussing up SSA
1132         https://bugs.webkit.org/show_bug.cgi?id=185069
1133
1134         Reviewed by Saam Barati.
1135         
1136         This isn't needed now, but will be once I implement the phase in bug 185060.
1137         
1138         This could be a speed-up, or a slow-down, independent of that phase. Most likely it's neutral.
1139         Local testing seems to suggest that it's neutral. Anyway, whatever it ends up being, I want it to
1140         be landed separately and measured separately from that phase.
1141         
1142         It's probably nice for sanity to have this and reduceStrength run before tail duplication and
1143         another round of reduceStrength, since that make for something that is closer to a fixpoint. But
1144         it will increase FTL compile times. So, there's no way to guess if this change is good, bad, or
1145         neutral. It all depends on what programs typically look like.
1146
1147         * b3/B3Generate.cpp:
1148         (JSC::B3::generateToAir):
1149
1150 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
1151
1152         Unreviewed, rolling out r231086.
1153
1154         Caused JSC test failures due to an unchecked exception.
1155
1156         Reverted changeset:
1157
1158         "[ESNext][BigInt] Implement support for "*" operation"
1159         https://bugs.webkit.org/show_bug.cgi?id=183721
1160         https://trac.webkit.org/changeset/231086
1161
1162 2018-04-26  Caio Lima  <ticaiolima@gmail.com>
1163
1164         [ESNext][BigInt] Implement support for "*" operation
1165         https://bugs.webkit.org/show_bug.cgi?id=183721
1166
1167         Reviewed by Saam Barati.
1168
1169         Added BigInt support into times binary operator into LLInt and on
1170         JITOperations profiledMul and unprofiledMul. We are also replacing all
1171         uses of int to unsigned when there is no negative values for
1172         variables.
1173
1174         * dfg/DFGConstantFoldingPhase.cpp:
1175         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1176         * jit/JITOperations.cpp:
1177         * runtime/CommonSlowPaths.cpp:
1178         (JSC::SLOW_PATH_DECL):
1179         * runtime/JSBigInt.cpp:
1180         (JSC::JSBigInt::JSBigInt):
1181         (JSC::JSBigInt::allocationSize):
1182         (JSC::JSBigInt::createWithLength):
1183         (JSC::JSBigInt::toString):
1184         (JSC::JSBigInt::multiply):
1185         (JSC::JSBigInt::digitDiv):
1186         (JSC::JSBigInt::internalMultiplyAdd):
1187         (JSC::JSBigInt::multiplyAccumulate):
1188         (JSC::JSBigInt::equals):
1189         (JSC::JSBigInt::absoluteDivSmall):
1190         (JSC::JSBigInt::calculateMaximumCharactersRequired):
1191         (JSC::JSBigInt::toStringGeneric):
1192         (JSC::JSBigInt::rightTrim):
1193         (JSC::JSBigInt::allocateFor):
1194         (JSC::JSBigInt::parseInt):
1195         (JSC::JSBigInt::digit):
1196         (JSC::JSBigInt::setDigit):
1197         * runtime/JSBigInt.h:
1198         * runtime/Operations.h:
1199         (JSC::jsMul):
1200
1201 2018-04-26  Mark Lam  <mark.lam@apple.com>
1202
1203         Gardening: Speculative build fix for Windows.
1204         https://bugs.webkit.org/show_bug.cgi?id=184976
1205         <rdar://problem/39723901>
1206
1207         Not reviewed.
1208
1209         * runtime/JSCPtrTag.h:
1210
1211 2018-04-26  Mark Lam  <mark.lam@apple.com>
1212
1213         Gardening: Windows build fix.
1214
1215         Not reviewed.
1216
1217         * runtime/Options.cpp:
1218
1219 2018-04-26  Jer Noble  <jer.noble@apple.com>
1220
1221         WK_COCOA_TOUCH all the things.
1222         https://bugs.webkit.org/show_bug.cgi?id=185006
1223         <rdar://problem/39736025>
1224
1225         Reviewed by Tim Horton.
1226
1227         * Configurations/Base.xcconfig:
1228
1229 2018-04-26  Per Arne Vollan  <pvollan@apple.com>
1230
1231         Disable content filtering in minimal simulator mode
1232         https://bugs.webkit.org/show_bug.cgi?id=185027
1233         <rdar://problem/39736091>
1234
1235         Reviewed by Jer Noble.
1236
1237         * Configurations/FeatureDefines.xcconfig:
1238
1239 2018-04-26  Andy VanWagoner  <thetalecrafter@gmail.com>
1240
1241         [INTL] Implement Intl.PluralRules
1242         https://bugs.webkit.org/show_bug.cgi?id=184312
1243
1244         Reviewed by JF Bastien.
1245
1246         Use UNumberFormat to enforce formatting, and then UPluralRules to find
1247         the correct plural rule for the given number. Relies on ICU v59+ for
1248         resolvedOptions().pluralCategories and trailing 0 detection.
1249         Behind the useIntlPluralRules option and INTL_PLURAL_RULES flag.
1250
1251         * CMakeLists.txt:
1252         * Configurations/FeatureDefines.xcconfig:
1253         * DerivedSources.make:
1254         * JavaScriptCore.xcodeproj/project.pbxproj:
1255         * Sources.txt:
1256         * builtins/BuiltinNames.h:
1257         * runtime/BigIntObject.cpp:
1258         (JSC::BigIntObject::create): Moved to ensure complete JSGlobalObject definition.
1259         * runtime/BigIntObject.h:
1260         * runtime/CommonIdentifiers.h:
1261         * runtime/IntlObject.cpp:
1262         (JSC::IntlObject::finishCreation):
1263         * runtime/IntlObject.h:
1264         * runtime/IntlPluralRules.cpp: Added.
1265         (JSC::IntlPluralRules::UPluralRulesDeleter::operator() const):
1266         (JSC::IntlPluralRules::UNumberFormatDeleter::operator() const):
1267         (JSC::UEnumerationDeleter::operator() const):
1268         (JSC::IntlPluralRules::create):
1269         (JSC::IntlPluralRules::createStructure):
1270         (JSC::IntlPluralRules::IntlPluralRules):
1271         (JSC::IntlPluralRules::finishCreation):
1272         (JSC::IntlPluralRules::destroy):
1273         (JSC::IntlPluralRules::visitChildren):
1274         (JSC::IntlPRInternal::localeData):
1275         (JSC::IntlPluralRules::initializePluralRules):
1276         (JSC::IntlPluralRules::resolvedOptions):
1277         (JSC::IntlPluralRules::select):
1278         * runtime/IntlPluralRules.h: Added.
1279         * runtime/IntlPluralRulesConstructor.cpp: Added.
1280         (JSC::IntlPluralRulesConstructor::create):
1281         (JSC::IntlPluralRulesConstructor::createStructure):
1282         (JSC::IntlPluralRulesConstructor::IntlPluralRulesConstructor):
1283         (JSC::IntlPluralRulesConstructor::finishCreation):
1284         (JSC::constructIntlPluralRules):
1285         (JSC::callIntlPluralRules):
1286         (JSC::IntlPluralRulesConstructorFuncSupportedLocalesOf):
1287         (JSC::IntlPluralRulesConstructor::visitChildren):
1288         * runtime/IntlPluralRulesConstructor.h: Added.
1289         * runtime/IntlPluralRulesPrototype.cpp: Added.
1290         (JSC::IntlPluralRulesPrototype::create):
1291         (JSC::IntlPluralRulesPrototype::createStructure):
1292         (JSC::IntlPluralRulesPrototype::IntlPluralRulesPrototype):
1293         (JSC::IntlPluralRulesPrototype::finishCreation):
1294         (JSC::IntlPluralRulesPrototypeFuncSelect):
1295         (JSC::IntlPluralRulesPrototypeFuncResolvedOptions):
1296         * runtime/IntlPluralRulesPrototype.h: Added.
1297         * runtime/JSGlobalObject.cpp:
1298         (JSC::JSGlobalObject::init):
1299         (JSC::JSGlobalObject::intlPluralRulesAvailableLocales):
1300         * runtime/JSGlobalObject.h:
1301         * runtime/Options.h:
1302         * runtime/RegExpPrototype.cpp: Added inlines header.
1303         * runtime/VM.cpp:
1304         (JSC::VM::VM):
1305         * runtime/VM.h:
1306
1307 2018-04-26  Dominik Infuehr  <dinfuehr@igalia.com>
1308
1309         [MIPS] Fix branch offsets in branchNeg32
1310         https://bugs.webkit.org/show_bug.cgi?id=185025
1311
1312         Reviewed by Yusuke Suzuki.
1313
1314         Two nops were removed in branch(Not)Equal in #183130 but the offset wasn't adjusted.
1315
1316         * assembler/MacroAssemblerMIPS.h:
1317         (JSC::MacroAssemblerMIPS::branchNeg32):
1318
1319 2018-04-25  Robin Morisset  <rmorisset@apple.com>
1320
1321         In FTLLowerDFGToB3.cpp::compileCreateRest, always use a contiguous array as the indexing type when under isWatchingHavingABadTimeWatchpoint
1322         https://bugs.webkit.org/show_bug.cgi?id=184773
1323         <rdar://problem/37773612>
1324
1325         Reviewed by Filip Pizlo.
1326
1327         We were calling restParameterStructure(), which returns arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous).
1328         arrayStructureForIndexingTypeDuringAllocation uses m_arrayStructureForIndexingShapeDuringAllocation, which is set to SlowPutArrayStorage when we are 'having a bad time'.
1329         This is problematic, because the structure is then passed to allocateUninitializedContiguousJSArray, which ASSERTs that the indexing type is contiguous (or int32).
1330         We solve the problem by using originalArrayStructureForIndexingType which always returns a structure with the right indexing type (contiguous), even if we are having a bad time.
1331         This is safe, as we are under isWatchingHavingABadTimeWatchpoint, so if we have a bad time, the code we generate will never be installed.
1332
1333         * ftl/FTLLowerDFGToB3.cpp:
1334         (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
1335
1336 2018-04-25  Mark Lam  <mark.lam@apple.com>
1337
1338         Push the definition of PtrTag down to the WTF layer.
1339         https://bugs.webkit.org/show_bug.cgi?id=184976
1340         <rdar://problem/39723901>
1341
1342         Reviewed by Saam Barati.
1343
1344         * CMakeLists.txt:
1345         * JavaScriptCore.xcodeproj/project.pbxproj:
1346         * assembler/ARM64Assembler.h:
1347         * assembler/AbstractMacroAssembler.h:
1348         * assembler/MacroAssemblerCodeRef.cpp:
1349         * assembler/MacroAssemblerCodeRef.h:
1350         * b3/B3MathExtras.cpp:
1351         * bytecode/LLIntCallLinkInfo.h:
1352         * disassembler/Disassembler.h:
1353         * ftl/FTLJITCode.cpp:
1354         * interpreter/InterpreterInlines.h:
1355         * jit/ExecutableAllocator.h:
1356         * jit/JITOperations.cpp:
1357         * jit/ThunkGenerator.h:
1358         * jit/ThunkGenerators.h:
1359         * llint/LLIntOffsetsExtractor.cpp:
1360         * llint/LLIntPCRanges.h:
1361         * runtime/JSCPtrTag.h: Added.
1362         * runtime/NativeFunction.h:
1363         * runtime/PtrTag.h: Removed.
1364         * runtime/VMTraps.cpp:
1365
1366 2018-04-25  Keith Miller  <keith_miller@apple.com>
1367
1368         getUnlinkedGlobalFunctionExecutable should only save things to the code cache if the option is set
1369         https://bugs.webkit.org/show_bug.cgi?id=184998
1370
1371         Reviewed by Saam Barati.
1372
1373         * runtime/CodeCache.cpp:
1374         (JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):
1375
1376 2018-04-25  Keith Miller  <keith_miller@apple.com>
1377
1378         Add missing scope release to functionProtoFuncToString
1379         https://bugs.webkit.org/show_bug.cgi?id=184995
1380
1381         Reviewed by Saam Barati.
1382
1383         * runtime/FunctionPrototype.cpp:
1384         (JSC::functionProtoFuncToString):
1385
1386 2018-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1387
1388         REGRESSION(r230748) [GTK][ARM] no matching function for call to 'JSC::CCallHelpers::swap(JSC::ARMRegisters::FPRegisterID&, JSC::ARMRegisters::FPRegisterID&)'
1389         https://bugs.webkit.org/show_bug.cgi?id=184730
1390
1391         Reviewed by Mark Lam.
1392
1393         Add swap(FPRegisterID, FPRegisterID) implementation using ARMRegisters::SD0 (temporary register in MacroAssemblerARM).
1394         And we now use dataTempRegister, addressTempRegister, and fpTempRegister instead of using S0, S1, and SD0.
1395
1396         We also change swap(RegisterID, RegisterID) implementation to use moves and temporaries simply. This is aligned to
1397         ARMv7 implementation.
1398
1399         * assembler/ARMAssembler.h:
1400         * assembler/MacroAssemblerARM.h:
1401         (JSC::MacroAssemblerARM::add32):
1402         (JSC::MacroAssemblerARM::and32):
1403         (JSC::MacroAssemblerARM::lshift32):
1404         (JSC::MacroAssemblerARM::mul32):
1405         (JSC::MacroAssemblerARM::or32):
1406         (JSC::MacroAssemblerARM::rshift32):
1407         (JSC::MacroAssemblerARM::urshift32):
1408         (JSC::MacroAssemblerARM::sub32):
1409         (JSC::MacroAssemblerARM::xor32):
1410         (JSC::MacroAssemblerARM::load8):
1411         (JSC::MacroAssemblerARM::abortWithReason):
1412         (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
1413         (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
1414         (JSC::MacroAssemblerARM::store8):
1415         (JSC::MacroAssemblerARM::store32):
1416         (JSC::MacroAssemblerARM::push):
1417         (JSC::MacroAssemblerARM::swap):
1418         (JSC::MacroAssemblerARM::branch8):
1419         (JSC::MacroAssemblerARM::branchPtr):
1420         (JSC::MacroAssemblerARM::branch32):
1421         (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
1422         (JSC::MacroAssemblerARM::branchTest8):
1423         (JSC::MacroAssemblerARM::branchTest32):
1424         (JSC::MacroAssemblerARM::jump):
1425         (JSC::MacroAssemblerARM::branchAdd32):
1426         (JSC::MacroAssemblerARM::mull32):
1427         (JSC::MacroAssemblerARM::branchMul32):
1428         (JSC::MacroAssemblerARM::patchableBranch32):
1429         (JSC::MacroAssemblerARM::nearCall):
1430         (JSC::MacroAssemblerARM::compare32):
1431         (JSC::MacroAssemblerARM::compare8):
1432         (JSC::MacroAssemblerARM::test32):
1433         (JSC::MacroAssemblerARM::test8):
1434         (JSC::MacroAssemblerARM::add64):
1435         (JSC::MacroAssemblerARM::load32):
1436         (JSC::MacroAssemblerARM::call):
1437         (JSC::MacroAssemblerARM::branchPtrWithPatch):
1438         (JSC::MacroAssemblerARM::branch32WithPatch):
1439         (JSC::MacroAssemblerARM::storePtrWithPatch):
1440         (JSC::MacroAssemblerARM::loadDouble):
1441         (JSC::MacroAssemblerARM::storeDouble):
1442         (JSC::MacroAssemblerARM::addDouble):
1443         (JSC::MacroAssemblerARM::divDouble):
1444         (JSC::MacroAssemblerARM::subDouble):
1445         (JSC::MacroAssemblerARM::mulDouble):
1446         (JSC::MacroAssemblerARM::convertInt32ToDouble):
1447         (JSC::MacroAssemblerARM::branchDouble):
1448         (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
1449         (JSC::MacroAssemblerARM::truncateDoubleToInt32):
1450         (JSC::MacroAssemblerARM::truncateDoubleToUint32):
1451         (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
1452         (JSC::MacroAssemblerARM::branchDoubleNonZero):
1453         (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
1454         (JSC::MacroAssemblerARM::call32):
1455         (JSC::MacroAssemblerARM::internalCompare32):
1456
1457 2018-04-25  Ross Kirsling  <ross.kirsling@sony.com>
1458
1459         [WinCairo] Fix js/regexp-unicode.html crash.
1460         https://bugs.webkit.org/show_bug.cgi?id=184891
1461
1462         Reviewed by Yusuke Suzuki.
1463
1464         On Win64, register RDI is "considered nonvolatile and must be saved and restored by a function that uses [it]".
1465         RDI is being used as a scratch register for JIT_UNICODE_EXPRESSIONS, not just YARR_JIT_ALL_PARENS_EXPRESSIONS.
1466
1467         * yarr/YarrJIT.cpp:
1468         (JSC::Yarr::YarrGenerator::generateEnter):
1469         (JSC::Yarr::YarrGenerator::generateReturn):
1470         Unconditionally save and restore RDI on 64-bit Windows.
1471
1472 2018-04-25  Michael Catanzaro  <mcatanzaro@igalia.com>
1473
1474         [GTK] Miscellaneous build cleanups
1475         https://bugs.webkit.org/show_bug.cgi?id=184399
1476
1477         Reviewed by Žan Doberšek.
1478
1479         * PlatformGTK.cmake:
1480
1481 2018-04-24  Keith Miller  <keith_miller@apple.com>
1482
1483         fromCharCode is missing some exception checks
1484         https://bugs.webkit.org/show_bug.cgi?id=184952
1485
1486         Reviewed by Saam Barati.
1487
1488         I also removed the pointless slow path function and moved it into the
1489         main function.
1490
1491         * runtime/StringConstructor.cpp:
1492         (JSC::stringFromCharCode):
1493         (JSC::stringFromCharCodeSlowCase): Deleted.
1494
1495 2018-04-24  Filip Pizlo  <fpizlo@apple.com>
1496
1497         MultiByOffset should emit one fewer branches in the case that the set of structures is proved already
1498         https://bugs.webkit.org/show_bug.cgi?id=184923
1499
1500         Reviewed by Saam Barati.
1501         
1502         If we have a MultiGetByOffset or MultiPutByOffset over a structure set that we've already proved
1503         (i.e. we know that the object has one of those structures), then previously we would still emit a
1504         switch with a case per structure along with a default case. That would mean one extra redundant
1505         branch to check that whatever structure we wound up with belongs to the set. In that case, we
1506         were already making the default case be an Oops.
1507         
1508         One possible solution would be to say that the default case being Oops means that B3 doesn't need
1509         to emit the extra branch. But that would require having B3 exploit the fact that Oops is known to
1510         be unreachable. Although B3 IR semantics (webkit.org/docs/b3/intermediate-representation.html)
1511         seem to allow this, I don't particularly like that style of optimization. I like Oops to mean
1512         trap.
1513         
1514         So, this patch makes FTL lowering turn one of the cases into the default, explicitly removing the
1515         extra branch.
1516         
1517         This is not a speed-up. But it makes the B3 IR for MultiByOffset a lot simpler, which should make
1518         it easier to implement B3-level optimizations for MultiByOffset. It also makes the IR easier to
1519         read.
1520
1521         * ftl/FTLLowerDFGToB3.cpp:
1522         (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
1523         (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
1524         (JSC::FTL::DFG::LowerDFGToB3::emitSwitchForMultiByOffset):
1525
1526 2018-04-24  Filip Pizlo  <fpizlo@apple.com>
1527
1528         DFG CSE should know how to decay a MultiGetByOffset
1529         https://bugs.webkit.org/show_bug.cgi?id=159859
1530
1531         Reviewed by Keith Miller.
1532         
1533         This teaches Node::remove() how to decay a MultiGetByOffset to a CheckStructure, so that
1534         clobberize() can report a def() for MultiGetByOffset.
1535         
1536         This is a slight improvement to codegen in splay because splay is a heavy user of
1537         MultiGetByOffset. It uses it redundantly in one of its hot functions (the function called
1538         "splay_"). I don't see a net speed-up in the benchmark. However, this is just a first step to
1539         removing MultiXByOffset-related redundancies, which by my estimates account for 16% of
1540         splay's time.
1541
1542         * dfg/DFGClobberize.h:
1543         (JSC::DFG::clobberize):
1544         * dfg/DFGNode.cpp:
1545         (JSC::DFG::Node::remove):
1546         (JSC::DFG::Node::removeWithoutChecks):
1547         (JSC::DFG::Node::replaceWith):
1548         (JSC::DFG::Node::replaceWithWithoutChecks):
1549         * dfg/DFGNode.h:
1550         (JSC::DFG::Node::convertToMultiGetByOffset):
1551         (JSC::DFG::Node::replaceWith): Deleted.
1552         * dfg/DFGNodeType.h:
1553         * dfg/DFGObjectAllocationSinkingPhase.cpp:
1554
1555 2018-04-24  Keith Miller  <keith_miller@apple.com>
1556
1557         Update API docs with information on which run loop the VM will use
1558         https://bugs.webkit.org/show_bug.cgi?id=184900
1559         <rdar://problem/39166054>
1560
1561         Reviewed by Mark Lam.
1562
1563         * API/JSContextRef.h:
1564         * API/JSVirtualMachine.h:
1565
1566 2018-04-24  Filip Pizlo  <fpizlo@apple.com>
1567
1568         $vm.totalGCTime() should be a thing
1569         https://bugs.webkit.org/show_bug.cgi?id=184916
1570
1571         Reviewed by Sam Weinig.
1572         
1573         When debugging regressions in tests that are GC heavy, it's nice to be able to query the total
1574         time spent in GC to determine if the regression is because the GC got slower.
1575         
1576         This adds $vm.totalGCTime(), which tells you the total time spent in GC, in seconds.
1577
1578         * heap/Heap.cpp:
1579         (JSC::Heap::runEndPhase):
1580         * heap/Heap.h:
1581         (JSC::Heap::totalGCTime const):
1582         * tools/JSDollarVM.cpp:
1583         (JSC::functionTotalGCTime):
1584         (JSC::JSDollarVM::finishCreation):
1585
1586 2018-04-23  Zalan Bujtas  <zalan@apple.com>
1587
1588         [LayoutFormattingContext] Initial commit.
1589         https://bugs.webkit.org/show_bug.cgi?id=184896
1590
1591         Reviewed by Antti Koivisto.
1592
1593         * Configurations/FeatureDefines.xcconfig:
1594
1595 2018-04-23  Filip Pizlo  <fpizlo@apple.com>
1596
1597         Unreviewed, revert accidental change to verbose flag.
1598
1599         * dfg/DFGByteCodeParser.cpp:
1600
1601 2018-04-23  Filip Pizlo  <fpizlo@apple.com>
1602
1603         Roll out r226655 because it broke OSR entry when the pre-header is inadequately profiled.
1604
1605         Rubber stamped by Saam Barati.
1606         
1607         This is a >2x speed-up in SunSpider/bitops-bitwise-and. We don't really care about SunSpider
1608         anymore, but r226655 didn't result in any benchmark wins and just regressed this test by a lot.
1609         Seems sensible to just roll it out.
1610
1611         * dfg/DFGByteCodeParser.cpp:
1612         (JSC::DFG::ByteCodeParser::addToGraph):
1613         (JSC::DFG::ByteCodeParser::parse):
1614
1615 2018-04-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1616
1617         [JSC] Remove ModuleLoaderPrototype
1618         https://bugs.webkit.org/show_bug.cgi?id=184784
1619
1620         Reviewed by Mark Lam.
1621
1622         When we introduce ModuleLoaderPrototype, ModuleLoader may be created by users and exposed to users.
1623         However, the loader spec is abandoned. So we do not need to have ModuleLoaderPrototype and JSModuleLoader.
1624         This patch merges ModuleLoaderPrototype's functionality into JSModuleLoader.
1625
1626         * CMakeLists.txt:
1627         * DerivedSources.make:
1628         * JavaScriptCore.xcodeproj/project.pbxproj:
1629         * Sources.txt:
1630         * builtins/ModuleLoader.js: Renamed from Source/JavaScriptCore/builtins/ModuleLoaderPrototype.js.
1631         * runtime/JSGlobalObject.cpp:
1632         (JSC::JSGlobalObject::init):
1633         (JSC::JSGlobalObject::visitChildren):
1634         * runtime/JSGlobalObject.h:
1635         (JSC::JSGlobalObject::proxyRevokeStructure const):
1636         (JSC::JSGlobalObject::moduleLoaderStructure const): Deleted.
1637         * runtime/JSModuleLoader.cpp:
1638         (JSC::moduleLoaderParseModule):
1639         (JSC::moduleLoaderRequestedModules):
1640         (JSC::moduleLoaderModuleDeclarationInstantiation):
1641         (JSC::moduleLoaderResolve):
1642         (JSC::moduleLoaderResolveSync):
1643         (JSC::moduleLoaderFetch):
1644         (JSC::moduleLoaderGetModuleNamespaceObject):
1645         (JSC::moduleLoaderEvaluate):
1646         * runtime/JSModuleLoader.h:
1647         * runtime/ModuleLoaderPrototype.cpp: Removed.
1648         * runtime/ModuleLoaderPrototype.h: Removed.
1649
1650 2018-04-20  Carlos Garcia Campos  <cgarcia@igalia.com>
1651
1652         [GLIB] All API tests fail in debug builds
1653         https://bugs.webkit.org/show_bug.cgi?id=184813
1654
1655         Reviewed by Mark Lam.
1656
1657         This is because of a conflict of ExceptionHandler class used in tests and ExceptionHandler struct defined in
1658         JSCContext.cpp. This patch renames the ExceptionHandler struct as JSCContextExceptionHandler.
1659
1660         * API/glib/JSCContext.cpp:
1661         (JSCContextExceptionHandler::JSCContextExceptionHandler):
1662         (JSCContextExceptionHandler::~JSCContextExceptionHandler):
1663         (jscContextConstructed):
1664         (ExceptionHandler::ExceptionHandler): Deleted.
1665         (ExceptionHandler::~ExceptionHandler): Deleted.
1666
1667 2018-04-20  Tim Horton  <timothy_horton@apple.com>
1668
1669         Adjust geolocation feature flag
1670         https://bugs.webkit.org/show_bug.cgi?id=184856
1671
1672         Reviewed by Wenson Hsieh.
1673
1674         * Configurations/FeatureDefines.xcconfig:
1675
1676 2018-04-20  Brian Burg  <bburg@apple.com>
1677
1678         Web Inspector: remove some dead code in IdentifiersFactory
1679         https://bugs.webkit.org/show_bug.cgi?id=184839
1680
1681         Reviewed by Timothy Hatcher.
1682
1683         This was never used on non-Chrome ports, so the identifier always has a
1684         prefix of '0.'. We may change this in the future, but for now remove this.
1685         Using a PID for this purpose is problematic anyway.
1686
1687         * inspector/IdentifiersFactory.cpp:
1688         (Inspector::addPrefixToIdentifier):
1689         (Inspector::IdentifiersFactory::createIdentifier):
1690         (Inspector::IdentifiersFactory::requestId):
1691         (Inspector::IdentifiersFactory::addProcessIdPrefixTo): Deleted.
1692         * inspector/IdentifiersFactory.h:
1693
1694 2018-04-20  Mark Lam  <mark.lam@apple.com>
1695
1696         Add the ability to use a hash for setting PtrTag enum values.
1697         https://bugs.webkit.org/show_bug.cgi?id=184852
1698         <rdar://problem/39613891>
1699
1700         Reviewed by Saam Barati.
1701
1702         * runtime/PtrTag.h:
1703
1704 2018-04-20  Mark Lam  <mark.lam@apple.com>
1705
1706         Some JSEntryPtrTags should actually be JSInternalPtrTags.
1707         https://bugs.webkit.org/show_bug.cgi?id=184712
1708         <rdar://problem/39507381>
1709
1710         Reviewed by Michael Saboff.
1711
1712         1. Convert some uses of JSEntryPtrTag into JSInternalPtrTags.
1713         2. Tag all LLInt bytecodes consistently with BytecodePtrTag now and retag them
1714            only when needed.
1715
1716         * bytecode/AccessCase.cpp:
1717         (JSC::AccessCase::generateImpl):
1718         * bytecode/ByValInfo.h:
1719         (JSC::ByValInfo::ByValInfo):
1720         * bytecode/CallLinkInfo.cpp:
1721         (JSC::CallLinkInfo::callReturnLocation):
1722         (JSC::CallLinkInfo::patchableJump):
1723         (JSC::CallLinkInfo::hotPathBegin):
1724         (JSC::CallLinkInfo::slowPathStart):
1725         * bytecode/CallLinkInfo.h:
1726         (JSC::CallLinkInfo::setCallLocations):
1727         (JSC::CallLinkInfo::hotPathOther):
1728         * bytecode/PolymorphicAccess.cpp:
1729         (JSC::PolymorphicAccess::regenerate):
1730         * bytecode/StructureStubInfo.h:
1731         (JSC::StructureStubInfo::doneLocation):
1732         * dfg/DFGJITCompiler.cpp:
1733         (JSC::DFG::JITCompiler::link):
1734         * dfg/DFGOSRExit.cpp:
1735         (JSC::DFG::reifyInlinedCallFrames):
1736         * ftl/FTLLazySlowPath.cpp:
1737         (JSC::FTL::LazySlowPath::initialize):
1738         * ftl/FTLLazySlowPath.h:
1739         (JSC::FTL::LazySlowPath::done const):
1740         * ftl/FTLLowerDFGToB3.cpp:
1741         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
1742         (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
1743         (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
1744         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
1745         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
1746         (JSC::FTL::DFG::LowerDFGToB3::compileIn):
1747         (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
1748         * jit/JIT.cpp:
1749         (JSC::JIT::link):
1750         * jit/JITExceptions.cpp:
1751         (JSC::genericUnwind):
1752         * jit/JITMathIC.h:
1753         (JSC::isProfileEmpty):
1754         * llint/LLIntData.cpp:
1755         (JSC::LLInt::initialize):
1756         * llint/LLIntData.h:
1757         (JSC::LLInt::getCodePtr):
1758         (JSC::LLInt::getExecutableAddress): Deleted.
1759         * llint/LLIntExceptions.cpp:
1760         (JSC::LLInt::callToThrow):
1761         * llint/LLIntSlowPaths.cpp:
1762         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1763         * wasm/js/WasmToJS.cpp:
1764         (JSC::Wasm::wasmToJS):
1765
1766 2018-04-18  Jer Noble  <jer.noble@apple.com>
1767
1768         Don't put build products into WK_ALTERNATE_WEBKIT_SDK_PATH for engineering builds
1769         https://bugs.webkit.org/show_bug.cgi?id=184762
1770
1771         Reviewed by Dan Bernstein.
1772
1773         * Configurations/Base.xcconfig:
1774         * JavaScriptCore.xcodeproj/project.pbxproj:
1775
1776 2018-04-20  Daniel Bates  <dabates@apple.com>
1777
1778         Remove code for compilers that did not support NSDMI for aggregates
1779         https://bugs.webkit.org/show_bug.cgi?id=184599
1780
1781         Reviewed by Per Arne Vollan.
1782
1783         Remove workaround for earlier Visual Studio versions that did not support non-static data
1784         member initializers (NSDMI) for aggregates. We have since updated all the build.webkit.org
1785         and EWS bots to a newer version that supports this feature.
1786
1787         * domjit/DOMJITEffect.h:
1788         (JSC::DOMJIT::Effect::Effect): Deleted.
1789         * runtime/HasOwnPropertyCache.h:
1790         (JSC::HasOwnPropertyCache::Entry::Entry): Deleted.
1791         * wasm/WasmFormat.h:
1792         (JSC::Wasm::WasmToWasmImportableFunction::WasmToWasmImportableFunction): Deleted.
1793
1794 2018-04-20  Mark Lam  <mark.lam@apple.com>
1795
1796         Build fix for internal builds after r230826.
1797         https://bugs.webkit.org/show_bug.cgi?id=184790
1798         <rdar://problem/39301369>
1799
1800         Not reviewed.
1801
1802         * runtime/Options.cpp:
1803         (JSC::overrideDefaults):
1804         * tools/SigillCrashAnalyzer.cpp:
1805         (JSC::SignalContext::dump):
1806
1807 2018-04-19  Tadeu Zagallo  <tzagallo@apple.com>
1808
1809         REGRESSION(r227340): ArrayBuffers were not being serialized when sent via MessagePorts
1810         https://bugs.webkit.org/show_bug.cgi?id=184254
1811         <rdar://problem/39140200>
1812
1813         Reviewed by Daniel Bates.
1814
1815         Expose an extra constructor of ArrayBufferContents in order to be able to decode SerializedScriptValues.
1816
1817         * runtime/ArrayBuffer.h:
1818         (JSC::ArrayBufferContents::ArrayBufferContents):
1819
1820 2018-04-19  Mark Lam  <mark.lam@apple.com>
1821
1822         Apply pointer profiling to Signal pointers.
1823         https://bugs.webkit.org/show_bug.cgi?id=184790
1824         <rdar://problem/39301369>
1825
1826         Reviewed by Michael Saboff.
1827
1828         1. Change stackPointer, framePointer, and instructionPointer accessors to
1829            be a pair of getter/setter functions.
1830         2. Add support for USE(PLATFORM_REGISTERS_WITH_PROFILE) to allow use of a
1831            a pointer profiling variants of these accessors.
1832         3. Also add a linkRegister accessor only for ARM64 on OS(DARWIN).
1833
1834         * JavaScriptCorePrefix.h:
1835         * runtime/MachineContext.h:
1836         (JSC::MachineContext::stackPointerImpl):
1837         (JSC::MachineContext::stackPointer):
1838         (JSC::MachineContext::setStackPointer):
1839         (JSC::MachineContext::framePointerImpl):
1840         (JSC::MachineContext::framePointer):
1841         (JSC::MachineContext::setFramePointer):
1842         (JSC::MachineContext::instructionPointerImpl):
1843         (JSC::MachineContext::instructionPointer):
1844         (JSC::MachineContext::setInstructionPointer):
1845         (JSC::MachineContext::linkRegisterImpl):
1846         (JSC::MachineContext::linkRegister):
1847         (JSC::MachineContext::setLinkRegister):
1848         * runtime/SamplingProfiler.cpp:
1849         (JSC::SamplingProfiler::takeSample):
1850         * runtime/VMTraps.cpp:
1851         (JSC::SignalContext::SignalContext):
1852         (JSC::VMTraps::tryInstallTrapBreakpoints):
1853         * tools/CodeProfiling.cpp:
1854         (JSC::profilingTimer):
1855         * tools/SigillCrashAnalyzer.cpp:
1856         (JSC::SignalContext::dump):
1857         (JSC::installCrashHandler):
1858         (JSC::SigillCrashAnalyzer::analyze):
1859         * wasm/WasmFaultSignalHandler.cpp:
1860         (JSC::Wasm::trapHandler):
1861
1862 2018-04-19  David Kilzer  <ddkilzer@apple.com>
1863
1864         Enable Objective-C weak references
1865         <https://webkit.org/b/184789>
1866         <rdar://problem/39571716>
1867
1868         Reviewed by Dan Bernstein.
1869
1870         * Configurations/Base.xcconfig:
1871         (CLANG_ENABLE_OBJC_WEAK): Enable.
1872         * Configurations/ToolExecutable.xcconfig:
1873         (CLANG_ENABLE_OBJC_ARC): Simplify.
1874
1875 2018-04-17  Filip Pizlo  <fpizlo@apple.com>
1876
1877         The InternalFunction hierarchy should be in IsoSubspaces
1878         https://bugs.webkit.org/show_bug.cgi?id=184721
1879
1880         Reviewed by Saam Barati.
1881         
1882         This moves InternalFunction into a IsoSubspace. It also moves all subclasses into IsoSubspaces,
1883         but subclasses that are the same size as InternalFunction share its subspace. I did this
1884         because the subclasses appear to just override methods, which are called dynamically via the
1885         structure or class of the object. So, I don't see a type confusion risk if UAF is used to
1886         allocate one kind of InternalFunction over another.
1887
1888         * API/JSBase.h:
1889         * API/JSCallbackFunction.h:
1890         * API/ObjCCallbackFunction.h:
1891         (JSC::ObjCCallbackFunction::subspaceFor):
1892         * CMakeLists.txt:
1893         * JavaScriptCore.xcodeproj/project.pbxproj:
1894         * Sources.txt:
1895         * heap/IsoSubspacePerVM.cpp: Added.
1896         (JSC::IsoSubspacePerVM::AutoremovingIsoSubspace::AutoremovingIsoSubspace):
1897         (JSC::IsoSubspacePerVM::AutoremovingIsoSubspace::~AutoremovingIsoSubspace):
1898         (JSC::IsoSubspacePerVM::IsoSubspacePerVM):
1899         (JSC::IsoSubspacePerVM::~IsoSubspacePerVM):
1900         (JSC::IsoSubspacePerVM::forVM):
1901         * heap/IsoSubspacePerVM.h: Added.
1902         (JSC::IsoSubspacePerVM::SubspaceParameters::SubspaceParameters):
1903         * runtime/Error.h:
1904         * runtime/ErrorConstructor.h:
1905         * runtime/InternalFunction.h:
1906         (JSC::InternalFunction::subspaceFor):
1907         * runtime/IntlCollatorConstructor.h:
1908         * runtime/IntlDateTimeFormatConstructor.h:
1909         * runtime/IntlNumberFormatConstructor.h:
1910         * runtime/JSArrayBufferConstructor.h:
1911         * runtime/NativeErrorConstructor.h:
1912         * runtime/ProxyRevoke.h:
1913         * runtime/RegExpConstructor.h:
1914         * runtime/VM.cpp:
1915         (JSC::VM::VM):
1916         * runtime/VM.h:
1917
1918 2018-04-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1919
1920         Unreviewed, Fix jsc shell
1921         https://bugs.webkit.org/show_bug.cgi?id=184600
1922
1923         WebAssembly module loading does not finish with drainMicrotasks().
1924         So JSNativeStdFunction's capturing variables become invalid.
1925         This patch fixes this issue.
1926
1927         * jsc.cpp:
1928         (functionDollarAgentStart):
1929         (runWithOptions):
1930         (runJSC):
1931         (jscmain):
1932
1933 2018-04-18  Ross Kirsling  <ross.kirsling@sony.com>
1934
1935         REGRESSION(r230748) [WinCairo] 'JSC::JIT::appendCallWithSlowPathReturnType': function does not take 1 arguments
1936         https://bugs.webkit.org/show_bug.cgi?id=184725
1937
1938         Reviewed by Mark Lam.
1939
1940         * jit/JIT.h:
1941
1942 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1943
1944         [WebAssembly][Modules] Import tables in wasm modules
1945         https://bugs.webkit.org/show_bug.cgi?id=184738
1946
1947         Reviewed by JF Bastien.
1948
1949         This patch simply allows wasm modules to import table from wasm modules / js re-exporting.
1950         Basically moving JSWebAssemblyInstance's table linking code to WebAssemblyModuleRecord::link
1951         just works.
1952
1953         * wasm/js/JSWebAssemblyInstance.cpp:
1954         (JSC::JSWebAssemblyInstance::create):
1955         * wasm/js/WebAssemblyModuleRecord.cpp:
1956         (JSC::WebAssemblyModuleRecord::link):
1957
1958 2018-04-18  Dominik Infuehr  <dinfuehr@igalia.com>
1959
1960         [ARM] Fix build error and crash after PtrTag change
1961         https://bugs.webkit.org/show_bug.cgi?id=184732
1962
1963         Reviewed by Mark Lam.
1964
1965         Do not pass NoPtrTag in callOperation and fix misspelled JSEntryPtrTag. Use
1966         MacroAssemblerCodePtr::createFromExecutableAddress to avoid tagging a pointer
1967         twice with ARM-Thumb2.
1968
1969         * assembler/MacroAssemblerCodeRef.h:
1970         (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
1971         * jit/JITPropertyAccess32_64.cpp:
1972         (JSC::JIT::emitSlow_op_put_by_val):
1973         * jit/Repatch.cpp:
1974         (JSC::linkPolymorphicCall):
1975
1976 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1977
1978         [WebAssembly][Modules] Import globals from wasm modules
1979         https://bugs.webkit.org/show_bug.cgi?id=184736
1980
1981         Reviewed by JF Bastien.
1982
1983         This patch implements a feature importing globals to/from wasm modules.
1984         Since we are not supporting mutable globals now, we can just copy the
1985         global data when importing. Currently we do not support importing/exporting
1986         i64 globals. This will be supported once (1) mutable global bindings are
1987         specified and (2) BigInt based i64 importing/exporting is specified.
1988
1989         * wasm/js/JSWebAssemblyInstance.cpp:
1990         (JSC::JSWebAssemblyInstance::create):
1991         * wasm/js/WebAssemblyModuleRecord.cpp:
1992         (JSC::WebAssemblyModuleRecord::link):
1993
1994 2018-04-18  Tomas Popela  <tpopela@redhat.com>
1995
1996         Unreviewed, fix build on ARM
1997
1998         * assembler/MacroAssemblerARM.h:
1999         (JSC::MacroAssemblerARM::readCallTarget):
2000
2001 2018-04-18  Tomas Popela  <tpopela@redhat.com>
2002
2003         Unreviewed, fix build with GCC
2004
2005         * assembler/LinkBuffer.h:
2006         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
2007
2008 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
2009
2010         Unreviewed, reland r230697, r230720, and r230724.
2011         https://bugs.webkit.org/show_bug.cgi?id=184600
2012
2013         With CatchScope check.
2014
2015         * JavaScriptCore.xcodeproj/project.pbxproj:
2016         * builtins/ModuleLoaderPrototype.js:
2017         (globalPrivate.newRegistryEntry):
2018         (requestInstantiate):
2019         (link):
2020         * jsc.cpp:
2021         (convertShebangToJSComment):
2022         (fillBufferWithContentsOfFile):
2023         (fetchModuleFromLocalFileSystem):
2024         (GlobalObject::moduleLoaderFetch):
2025         (functionDollarAgentStart):
2026         (checkException):
2027         (runWithOptions):
2028         * parser/NodesAnalyzeModule.cpp:
2029         (JSC::ImportDeclarationNode::analyzeModule):
2030         * parser/SourceProvider.h:
2031         (JSC::WebAssemblySourceProvider::create):
2032         (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
2033         * runtime/AbstractModuleRecord.cpp:
2034         (JSC::AbstractModuleRecord::hostResolveImportedModule):
2035         (JSC::AbstractModuleRecord::resolveImport):
2036         (JSC::AbstractModuleRecord::link):
2037         (JSC::AbstractModuleRecord::evaluate):
2038         (JSC::identifierToJSValue): Deleted.
2039         * runtime/AbstractModuleRecord.h:
2040         (JSC::AbstractModuleRecord::moduleEnvironmentMayBeNull):
2041         (JSC::AbstractModuleRecord::ImportEntry::isNamespace const): Deleted.
2042         * runtime/JSModuleEnvironment.cpp:
2043         (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
2044         * runtime/JSModuleLoader.cpp:
2045         (JSC::JSModuleLoader::evaluate):
2046         * runtime/JSModuleRecord.cpp:
2047         (JSC::JSModuleRecord::link):
2048         (JSC::JSModuleRecord::instantiateDeclarations):
2049         * runtime/JSModuleRecord.h:
2050         * runtime/ModuleLoaderPrototype.cpp:
2051         (JSC::moduleLoaderPrototypeParseModule):
2052         (JSC::moduleLoaderPrototypeRequestedModules):
2053         (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
2054         * wasm/WasmCreationMode.h: Copied from Source/JavaScriptCore/wasm/js/WebAssemblyPrototype.h.
2055         * wasm/js/JSWebAssemblyHelpers.h:
2056         (JSC::getWasmBufferFromValue):
2057         (JSC::createSourceBufferFromValue):
2058         * wasm/js/JSWebAssemblyInstance.cpp:
2059         (JSC::JSWebAssemblyInstance::finalizeCreation):
2060         (JSC::JSWebAssemblyInstance::createPrivateModuleKey):
2061         (JSC::JSWebAssemblyInstance::create):
2062         * wasm/js/JSWebAssemblyInstance.h:
2063         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2064         (JSC::constructJSWebAssemblyInstance):
2065         * wasm/js/WebAssemblyModuleRecord.cpp:
2066         (JSC::WebAssemblyModuleRecord::prepareLink):
2067         (JSC::WebAssemblyModuleRecord::link):
2068         * wasm/js/WebAssemblyModuleRecord.h:
2069         * wasm/js/WebAssemblyPrototype.cpp:
2070         (JSC::resolve):
2071         (JSC::instantiate):
2072         (JSC::compileAndInstantiate):
2073         (JSC::WebAssemblyPrototype::instantiate):
2074         (JSC::webAssemblyInstantiateFunc):
2075         (JSC::webAssemblyValidateFunc):
2076         * wasm/js/WebAssemblyPrototype.h:
2077
2078 2018-04-17  Carlos Garcia Campos  <cgarcia@igalia.com>
2079
2080         [GLIB] Make it possible to handle JSCClass external properties not added to the prototype
2081         https://bugs.webkit.org/show_bug.cgi?id=184687
2082
2083         Reviewed by Michael Catanzaro.
2084
2085         Add JSCClassVTable that can be optionally passed to jsc_context_register_class() to provide implmentations for
2086         JSClassDefinition. This is required to implement dynamic properties that can't be added with
2087         jsc_class_add_property() for example to implement something like imports object in seed/gjs.
2088
2089         * API/glib/JSCClass.cpp:
2090         (VTableExceptionHandler::VTableExceptionHandler): Helper class to handle the exceptions in vtable functions that
2091         can throw exceptions.
2092         (VTableExceptionHandler::~VTableExceptionHandler):
2093         (getProperty): Iterate the class chain to call get_property function.
2094         (setProperty): Iterate the class chain to call set_property function.
2095         (hasProperty): Iterate the class chain to call has_property function.
2096         (deleteProperty): Iterate the class chain to call delete_property function.
2097         (getPropertyNames): Iterate the class chain to call enumerate_properties function.
2098         (jsc_class_class_init): Remove constructed implementation, since we need to initialize the JSClassDefinition in
2099         jscClassCreate now.
2100         (jscClassCreate): Receive an optional JSCClassVTable that is used to initialize the JSClassDefinition.
2101         * API/glib/JSCClass.h:
2102         * API/glib/JSCClassPrivate.h:
2103         * API/glib/JSCContext.cpp:
2104         (jscContextGetRegisteredClass): Helper to get the JSCClass for a given JSClassRef.
2105         (jsc_context_register_class): Add JSCClassVTable parameter.
2106         * API/glib/JSCContext.h:
2107         * API/glib/JSCContextPrivate.h:
2108         * API/glib/JSCWrapperMap.cpp:
2109         (JSC::WrapperMap::registeredClass const): Get the JSCClass for a given JSClassRef.
2110         * API/glib/JSCWrapperMap.h:
2111         * API/glib/docs/jsc-glib-4.0-sections.txt: Add new symbols.
2112
2113 2018-04-17  Mark Lam  <mark.lam@apple.com>
2114
2115         Templatize CodePtr/Refs/FunctionPtrs with PtrTags.
2116         https://bugs.webkit.org/show_bug.cgi?id=184702
2117         <rdar://problem/35391681>
2118
2119         Reviewed by Filip Pizlo and Saam Barati.
2120
2121         1. Templatized MacroAssemblerCodePtr/Ref, FunctionPtr, and CodeLocation variants
2122            to take a PtrTag template argument.
2123         2. Replaced some uses of raw pointers with the equivalent CodePtr / FunctionPtr.
2124
2125         * assembler/AbstractMacroAssembler.h:
2126         (JSC::AbstractMacroAssembler::differenceBetweenCodePtr):
2127         (JSC::AbstractMacroAssembler::linkJump):
2128         (JSC::AbstractMacroAssembler::linkPointer):
2129         (JSC::AbstractMacroAssembler::getLinkerAddress):
2130         (JSC::AbstractMacroAssembler::repatchJump):
2131         (JSC::AbstractMacroAssembler::repatchJumpToNop):
2132         (JSC::AbstractMacroAssembler::repatchNearCall):
2133         (JSC::AbstractMacroAssembler::repatchCompact):
2134         (JSC::AbstractMacroAssembler::repatchInt32):
2135         (JSC::AbstractMacroAssembler::repatchPointer):
2136         (JSC::AbstractMacroAssembler::readPointer):
2137         (JSC::AbstractMacroAssembler::replaceWithLoad):
2138         (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
2139         * assembler/CodeLocation.h:
2140         (JSC::CodeLocationCommon:: const):
2141         (JSC::CodeLocationCommon::CodeLocationCommon):
2142         (JSC::CodeLocationInstruction::CodeLocationInstruction):
2143         (JSC::CodeLocationLabel::CodeLocationLabel):
2144         (JSC::CodeLocationLabel::retagged):
2145         (JSC::CodeLocationLabel:: const):
2146         (JSC::CodeLocationJump::CodeLocationJump):
2147         (JSC::CodeLocationJump::retagged):
2148         (JSC::CodeLocationCall::CodeLocationCall):
2149         (JSC::CodeLocationCall::retagged):
2150         (JSC::CodeLocationNearCall::CodeLocationNearCall):
2151         (JSC::CodeLocationDataLabel32::CodeLocationDataLabel32):
2152         (JSC::CodeLocationDataLabelCompact::CodeLocationDataLabelCompact):
2153         (JSC::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
2154         (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad):
2155         (JSC::CodeLocationCommon<tag>::instructionAtOffset):
2156         (JSC::CodeLocationCommon<tag>::labelAtOffset):
2157         (JSC::CodeLocationCommon<tag>::jumpAtOffset):
2158         (JSC::CodeLocationCommon<tag>::callAtOffset):
2159         (JSC::CodeLocationCommon<tag>::nearCallAtOffset):
2160         (JSC::CodeLocationCommon<tag>::dataLabelPtrAtOffset):
2161         (JSC::CodeLocationCommon<tag>::dataLabel32AtOffset):
2162         (JSC::CodeLocationCommon<tag>::dataLabelCompactAtOffset):
2163         (JSC::CodeLocationCommon<tag>::convertibleLoadAtOffset):
2164         (JSC::CodeLocationCommon::instructionAtOffset): Deleted.
2165         (JSC::CodeLocationCommon::labelAtOffset): Deleted.
2166         (JSC::CodeLocationCommon::jumpAtOffset): Deleted.
2167         (JSC::CodeLocationCommon::callAtOffset): Deleted.
2168         (JSC::CodeLocationCommon::nearCallAtOffset): Deleted.
2169         (JSC::CodeLocationCommon::dataLabelPtrAtOffset): Deleted.
2170         (JSC::CodeLocationCommon::dataLabel32AtOffset): Deleted.
2171         (JSC::CodeLocationCommon::dataLabelCompactAtOffset): Deleted.
2172         (JSC::CodeLocationCommon::convertibleLoadAtOffset): Deleted.
2173         * assembler/LinkBuffer.cpp:
2174         (JSC::LinkBuffer::finalizeCodeWithoutDisassemblyImpl):
2175         (JSC::LinkBuffer::finalizeCodeWithDisassemblyImpl):
2176         (JSC::LinkBuffer::finalizeCodeWithoutDisassembly): Deleted.
2177         (JSC::LinkBuffer::finalizeCodeWithDisassembly): Deleted.
2178         * assembler/LinkBuffer.h:
2179         (JSC::LinkBuffer::link):
2180         (JSC::LinkBuffer::patch):
2181         (JSC::LinkBuffer::entrypoint):
2182         (JSC::LinkBuffer::locationOf):
2183         (JSC::LinkBuffer::locationOfNearCall):
2184         (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
2185         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
2186         (JSC::LinkBuffer::trampolineAt):
2187         * assembler/MacroAssemblerARM.h:
2188         (JSC::MacroAssemblerARM::readCallTarget):
2189         (JSC::MacroAssemblerARM::replaceWithJump):
2190         (JSC::MacroAssemblerARM::startOfPatchableBranch32WithPatchOnAddress):
2191         (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatchOnAddress):
2192         (JSC::MacroAssemblerARM::startOfBranchPtrWithPatchOnRegister):
2193         (JSC::MacroAssemblerARM::revertJumpReplacementToBranchPtrWithPatch):
2194         (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranch32WithPatch):
2195         (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranchPtrWithPatch):
2196         (JSC::MacroAssemblerARM::repatchCall):
2197         (JSC::MacroAssemblerARM::linkCall):
2198         * assembler/MacroAssemblerARM64.h:
2199         (JSC::MacroAssemblerARM64::readCallTarget):
2200         (JSC::MacroAssemblerARM64::replaceWithVMHalt):
2201         (JSC::MacroAssemblerARM64::replaceWithJump):
2202         (JSC::MacroAssemblerARM64::startOfBranchPtrWithPatchOnRegister):
2203         (JSC::MacroAssemblerARM64::startOfPatchableBranchPtrWithPatchOnAddress):
2204         (JSC::MacroAssemblerARM64::startOfPatchableBranch32WithPatchOnAddress):
2205         (JSC::MacroAssemblerARM64::revertJumpReplacementToBranchPtrWithPatch):
2206         (JSC::MacroAssemblerARM64::revertJumpReplacementToPatchableBranchPtrWithPatch):
2207         (JSC::MacroAssemblerARM64::revertJumpReplacementToPatchableBranch32WithPatch):
2208         (JSC::MacroAssemblerARM64::repatchCall):
2209         (JSC::MacroAssemblerARM64::linkCall):
2210         * assembler/MacroAssemblerARMv7.h:
2211         (JSC::MacroAssemblerARMv7::replaceWithJump):
2212         (JSC::MacroAssemblerARMv7::readCallTarget):
2213         (JSC::MacroAssemblerARMv7::startOfBranchPtrWithPatchOnRegister):
2214         (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
2215         (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatchOnAddress):
2216         (JSC::MacroAssemblerARMv7::startOfPatchableBranch32WithPatchOnAddress):
2217         (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
2218         (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranch32WithPatch):
2219         (JSC::MacroAssemblerARMv7::repatchCall):
2220         (JSC::MacroAssemblerARMv7::linkCall):
2221         * assembler/MacroAssemblerCodeRef.cpp:
2222         (JSC::MacroAssemblerCodePtrBase::dumpWithName):
2223         (JSC::MacroAssemblerCodeRefBase::tryToDisassemble):
2224         (JSC::MacroAssemblerCodeRefBase::disassembly):
2225         (JSC::MacroAssemblerCodePtr::createLLIntCodePtr): Deleted.
2226         (JSC::MacroAssemblerCodePtr::dumpWithName const): Deleted.
2227         (JSC::MacroAssemblerCodePtr::dump const): Deleted.
2228         (JSC::MacroAssemblerCodeRef::createLLIntCodeRef): Deleted.
2229         (JSC::MacroAssemblerCodeRef::tryToDisassemble const): Deleted.
2230         (JSC::MacroAssemblerCodeRef::disassembly const): Deleted.
2231         (JSC::MacroAssemblerCodeRef::dump const): Deleted.
2232         * assembler/MacroAssemblerCodeRef.h:
2233         (JSC::FunctionPtr::FunctionPtr):
2234         (JSC::FunctionPtr::retagged const):
2235         (JSC::FunctionPtr::retaggedExecutableAddress const):
2236         (JSC::FunctionPtr::operator== const):
2237         (JSC::FunctionPtr::operator!= const):
2238         (JSC::ReturnAddressPtr::ReturnAddressPtr):
2239         (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
2240         (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
2241         (JSC::MacroAssemblerCodePtr::retagged const):
2242         (JSC::MacroAssemblerCodePtr:: const):
2243         (JSC::MacroAssemblerCodePtr::dumpWithName const):
2244         (JSC::MacroAssemblerCodePtr::dump const):
2245         (JSC::MacroAssemblerCodePtrHash::hash):
2246         (JSC::MacroAssemblerCodePtrHash::equal):
2247         (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
2248         (JSC::MacroAssemblerCodeRef::createSelfManagedCodeRef):
2249         (JSC::MacroAssemblerCodeRef::code const):
2250         (JSC::MacroAssemblerCodeRef::retaggedCode const):
2251         (JSC::MacroAssemblerCodeRef::retagged const):
2252         (JSC::MacroAssemblerCodeRef::tryToDisassemble const):
2253         (JSC::MacroAssemblerCodeRef::disassembly const):
2254         (JSC::MacroAssemblerCodeRef::dump const):
2255         (JSC::FunctionPtr<tag>::FunctionPtr):
2256         * assembler/MacroAssemblerMIPS.h:
2257         (JSC::MacroAssemblerMIPS::readCallTarget):
2258         (JSC::MacroAssemblerMIPS::replaceWithJump):
2259         (JSC::MacroAssemblerMIPS::startOfPatchableBranch32WithPatchOnAddress):
2260         (JSC::MacroAssemblerMIPS::startOfBranchPtrWithPatchOnRegister):
2261         (JSC::MacroAssemblerMIPS::revertJumpReplacementToBranchPtrWithPatch):
2262         (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatchOnAddress):
2263         (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranch32WithPatch):
2264         (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranchPtrWithPatch):
2265         (JSC::MacroAssemblerMIPS::repatchCall):
2266         (JSC::MacroAssemblerMIPS::linkCall):
2267         * assembler/MacroAssemblerX86.h:
2268         (JSC::MacroAssemblerX86::readCallTarget):
2269         (JSC::MacroAssemblerX86::startOfBranchPtrWithPatchOnRegister):
2270         (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatchOnAddress):
2271         (JSC::MacroAssemblerX86::startOfPatchableBranch32WithPatchOnAddress):
2272         (JSC::MacroAssemblerX86::revertJumpReplacementToBranchPtrWithPatch):
2273         (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranchPtrWithPatch):
2274         (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranch32WithPatch):
2275         (JSC::MacroAssemblerX86::repatchCall):
2276         (JSC::MacroAssemblerX86::linkCall):
2277         * assembler/MacroAssemblerX86Common.h:
2278         (JSC::MacroAssemblerX86Common::repatchCompact):
2279         (JSC::MacroAssemblerX86Common::replaceWithVMHalt):
2280         (JSC::MacroAssemblerX86Common::replaceWithJump):
2281         * assembler/MacroAssemblerX86_64.h:
2282         (JSC::MacroAssemblerX86_64::readCallTarget):
2283         (JSC::MacroAssemblerX86_64::startOfBranchPtrWithPatchOnRegister):
2284         (JSC::MacroAssemblerX86_64::startOfBranch32WithPatchOnRegister):
2285         (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatchOnAddress):
2286         (JSC::MacroAssemblerX86_64::startOfPatchableBranch32WithPatchOnAddress):
2287         (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranchPtrWithPatch):
2288         (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranch32WithPatch):
2289         (JSC::MacroAssemblerX86_64::revertJumpReplacementToBranchPtrWithPatch):
2290         (JSC::MacroAssemblerX86_64::repatchCall):
2291         (JSC::MacroAssemblerX86_64::linkCall):
2292         * assembler/testmasm.cpp:
2293         (JSC::compile):
2294         (JSC::invoke):
2295         (JSC::testProbeModifiesProgramCounter):
2296         * b3/B3Compilation.cpp:
2297         (JSC::B3::Compilation::Compilation):
2298         * b3/B3Compilation.h:
2299         (JSC::B3::Compilation::code const):
2300         (JSC::B3::Compilation::codeRef const):
2301         * b3/B3Compile.cpp:
2302         (JSC::B3::compile):
2303         * b3/B3LowerMacros.cpp:
2304         * b3/air/AirDisassembler.cpp:
2305         (JSC::B3::Air::Disassembler::dump):
2306         * b3/air/testair.cpp:
2307         * b3/testb3.cpp:
2308         (JSC::B3::invoke):
2309         (JSC::B3::testInterpreter):
2310         (JSC::B3::testEntrySwitchSimple):
2311         (JSC::B3::testEntrySwitchNoEntrySwitch):
2312         (JSC::B3::testEntrySwitchWithCommonPaths):
2313         (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
2314         (JSC::B3::testEntrySwitchLoop):
2315         * bytecode/AccessCase.cpp:
2316         (JSC::AccessCase::generateImpl):
2317         * bytecode/AccessCaseSnippetParams.cpp:
2318         (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
2319         * bytecode/ByValInfo.h:
2320         (JSC::ByValInfo::ByValInfo):
2321         * bytecode/CallLinkInfo.cpp:
2322         (JSC::CallLinkInfo::callReturnLocation):
2323         (JSC::CallLinkInfo::patchableJump):
2324         (JSC::CallLinkInfo::hotPathBegin):
2325         (JSC::CallLinkInfo::slowPathStart):
2326         * bytecode/CallLinkInfo.h:
2327         (JSC::CallLinkInfo::setCallLocations):
2328         (JSC::CallLinkInfo::hotPathOther):
2329         * bytecode/CodeBlock.cpp:
2330         (JSC::CodeBlock::finishCreation):
2331         * bytecode/GetByIdStatus.cpp:
2332         (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
2333         * bytecode/GetByIdVariant.cpp:
2334         (JSC::GetByIdVariant::GetByIdVariant):
2335         (JSC::GetByIdVariant::dumpInContext const):
2336         * bytecode/GetByIdVariant.h:
2337         (JSC::GetByIdVariant::customAccessorGetter const):
2338         * bytecode/GetterSetterAccessCase.cpp:
2339         (JSC::GetterSetterAccessCase::create):
2340         (JSC::GetterSetterAccessCase::GetterSetterAccessCase):
2341         (JSC::GetterSetterAccessCase::dumpImpl const):
2342         * bytecode/GetterSetterAccessCase.h:
2343         (JSC::GetterSetterAccessCase::customAccessor const):
2344         (): Deleted.
2345         * bytecode/HandlerInfo.h:
2346         (JSC::HandlerInfo::initialize):
2347         * bytecode/InlineAccess.cpp:
2348         (JSC::linkCodeInline):
2349         (JSC::InlineAccess::rewireStubAsJump):
2350         * bytecode/InlineAccess.h:
2351         * bytecode/JumpTable.h:
2352         (JSC::StringJumpTable::ctiForValue):
2353         (JSC::SimpleJumpTable::ctiForValue):
2354         * bytecode/LLIntCallLinkInfo.h:
2355         (JSC::LLIntCallLinkInfo::unlink):
2356         * bytecode/PolymorphicAccess.cpp:
2357         (JSC::AccessGenerationState::emitExplicitExceptionHandler):
2358         (JSC::PolymorphicAccess::regenerate):
2359         * bytecode/PolymorphicAccess.h:
2360         (JSC::AccessGenerationResult::AccessGenerationResult):
2361         (JSC::AccessGenerationResult::code const):
2362         * bytecode/StructureStubInfo.h:
2363         (JSC::StructureStubInfo::slowPathCallLocation):
2364         (JSC::StructureStubInfo::doneLocation):
2365         (JSC::StructureStubInfo::slowPathStartLocation):
2366         (JSC::StructureStubInfo::patchableJumpForIn):
2367         * dfg/DFGCommonData.h:
2368         (JSC::DFG::CommonData::appendCatchEntrypoint):
2369         * dfg/DFGDisassembler.cpp:
2370         (JSC::DFG::Disassembler::dumpDisassembly):
2371         * dfg/DFGDriver.h:
2372         * dfg/DFGJITCompiler.cpp:
2373         (JSC::DFG::JITCompiler::linkOSRExits):
2374         (JSC::DFG::JITCompiler::compileExceptionHandlers):
2375         (JSC::DFG::JITCompiler::link):
2376         (JSC::DFG::JITCompiler::compileFunction):
2377         (JSC::DFG::JITCompiler::noticeCatchEntrypoint):
2378         * dfg/DFGJITCompiler.h:
2379         (JSC::DFG::CallLinkRecord::CallLinkRecord):
2380         (JSC::DFG::JITCompiler::appendCall):
2381         (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
2382         (JSC::DFG::JITCompiler::JSDirectCallRecord::JSDirectCallRecord):
2383         (JSC::DFG::JITCompiler::JSDirectTailCallRecord::JSDirectTailCallRecord):
2384         * dfg/DFGJITFinalizer.cpp:
2385         (JSC::DFG::JITFinalizer::JITFinalizer):
2386         (JSC::DFG::JITFinalizer::finalize):
2387         (JSC::DFG::JITFinalizer::finalizeFunction):
2388         * dfg/DFGJITFinalizer.h:
2389         * dfg/DFGJumpReplacement.h:
2390         (JSC::DFG::JumpReplacement::JumpReplacement):
2391         * dfg/DFGNode.h:
2392         * dfg/DFGOSREntry.cpp:
2393         (JSC::DFG::prepareOSREntry):
2394         (JSC::DFG::prepareCatchOSREntry):
2395         * dfg/DFGOSREntry.h:
2396         (JSC::DFG::prepareOSREntry):
2397         * dfg/DFGOSRExit.cpp:
2398         (JSC::DFG::OSRExit::executeOSRExit):
2399         (JSC::DFG::reifyInlinedCallFrames):
2400         (JSC::DFG::adjustAndJumpToTarget):
2401         (JSC::DFG::OSRExit::codeLocationForRepatch const):
2402         (JSC::DFG::OSRExit::emitRestoreArguments):
2403         (JSC::DFG::OSRExit::compileOSRExit):
2404         * dfg/DFGOSRExit.h:
2405         * dfg/DFGOSRExitCompilerCommon.cpp:
2406         (JSC::DFG::handleExitCounts):
2407         (JSC::DFG::reifyInlinedCallFrames):
2408         (JSC::DFG::osrWriteBarrier):
2409         (JSC::DFG::adjustAndJumpToTarget):
2410         * dfg/DFGOperations.cpp:
2411         * dfg/DFGSlowPathGenerator.h:
2412         (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::CallResultAndArgumentsSlowPathGenerator):
2413         (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::unpackAndGenerate):
2414         (JSC::DFG::slowPathCall):
2415         * dfg/DFGSpeculativeJIT.cpp:
2416         (JSC::DFG::SpeculativeJIT::compileMathIC):
2417         (JSC::DFG::SpeculativeJIT::compileCallDOM):
2418         (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
2419         (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
2420         (JSC::DFG::SpeculativeJIT::emitSwitchImm):
2421         (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
2422         (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
2423         (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
2424         (JSC::DFG::SpeculativeJIT::cachedPutById):
2425         * dfg/DFGSpeculativeJIT.h:
2426         (JSC::DFG::SpeculativeJIT::callOperation):
2427         (JSC::DFG::SpeculativeJIT::appendCall):
2428         (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnException):
2429         (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnExceptionSetResult):
2430         (JSC::DFG::SpeculativeJIT::appendCallSetResult):
2431         * dfg/DFGSpeculativeJIT64.cpp:
2432         (JSC::DFG::SpeculativeJIT::cachedGetById):
2433         (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
2434         (JSC::DFG::SpeculativeJIT::compile):
2435         * dfg/DFGThunks.cpp:
2436         (JSC::DFG::osrExitThunkGenerator):
2437         (JSC::DFG::osrExitGenerationThunkGenerator):
2438         (JSC::DFG::osrEntryThunkGenerator):
2439         * dfg/DFGThunks.h:
2440         * disassembler/ARM64Disassembler.cpp:
2441         (JSC::tryToDisassemble):
2442         * disassembler/ARMv7Disassembler.cpp:
2443         (JSC::tryToDisassemble):
2444         * disassembler/Disassembler.cpp:
2445         (JSC::disassemble):
2446         (JSC::disassembleAsynchronously):
2447         * disassembler/Disassembler.h:
2448         (JSC::tryToDisassemble):
2449         * disassembler/UDis86Disassembler.cpp:
2450         (JSC::tryToDisassembleWithUDis86):
2451         * disassembler/UDis86Disassembler.h:
2452         (JSC::tryToDisassembleWithUDis86):
2453         * disassembler/X86Disassembler.cpp:
2454         (JSC::tryToDisassemble):
2455         * ftl/FTLCompile.cpp:
2456         (JSC::FTL::compile):
2457         * ftl/FTLExceptionTarget.cpp:
2458         (JSC::FTL::ExceptionTarget::label):
2459         (JSC::FTL::ExceptionTarget::jumps):
2460         * ftl/FTLExceptionTarget.h:
2461         * ftl/FTLGeneratedFunction.h:
2462         * ftl/FTLJITCode.cpp:
2463         (JSC::FTL::JITCode::initializeB3Code):
2464         (JSC::FTL::JITCode::initializeAddressForCall):
2465         (JSC::FTL::JITCode::initializeArityCheckEntrypoint):
2466         (JSC::FTL::JITCode::addressForCall):
2467         (JSC::FTL::JITCode::executableAddressAtOffset):
2468         * ftl/FTLJITCode.h:
2469         (JSC::FTL::JITCode::b3Code const):
2470         * ftl/FTLJITFinalizer.cpp:
2471         (JSC::FTL::JITFinalizer::finalizeCommon):
2472         * ftl/FTLLazySlowPath.cpp:
2473         (JSC::FTL::LazySlowPath::initialize):
2474         (JSC::FTL::LazySlowPath::generate):
2475         * ftl/FTLLazySlowPath.h:
2476         (JSC::FTL::LazySlowPath::patchableJump const):
2477         (JSC::FTL::LazySlowPath::done const):
2478         (JSC::FTL::LazySlowPath::stub const):
2479         * ftl/FTLLazySlowPathCall.h:
2480         (JSC::FTL::createLazyCallGenerator):
2481         * ftl/FTLLink.cpp:
2482         (JSC::FTL::link):
2483         * ftl/FTLLowerDFGToB3.cpp:
2484         (JSC::FTL::DFG::LowerDFGToB3::lower):
2485         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
2486         (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
2487         (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
2488         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
2489         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
2490         (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
2491         (JSC::FTL::DFG::LowerDFGToB3::compileInvalidationPoint):
2492         (JSC::FTL::DFG::LowerDFGToB3::compileIn):
2493         (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
2494         (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
2495         (JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):
2496         (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
2497         * ftl/FTLOSRExit.cpp:
2498         (JSC::FTL::OSRExit::codeLocationForRepatch const):
2499         * ftl/FTLOSRExit.h:
2500         * ftl/FTLOSRExitCompiler.cpp:
2501         (JSC::FTL::compileStub):
2502         (JSC::FTL::compileFTLOSRExit):
2503         * ftl/FTLOSRExitHandle.cpp:
2504         (JSC::FTL::OSRExitHandle::emitExitThunk):
2505         * ftl/FTLOperations.cpp:
2506         (JSC::FTL::compileFTLLazySlowPath):
2507         * ftl/FTLPatchpointExceptionHandle.cpp:
2508         (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreationForUnwind):
2509         * ftl/FTLSlowPathCall.cpp:
2510         (JSC::FTL::SlowPathCallContext::keyWithTarget const):
2511         (JSC::FTL::SlowPathCallContext::makeCall):
2512         * ftl/FTLSlowPathCall.h:
2513         (JSC::FTL::callOperation):
2514         * ftl/FTLSlowPathCallKey.cpp:
2515         (JSC::FTL::SlowPathCallKey::dump const):
2516         * ftl/FTLSlowPathCallKey.h:
2517         (JSC::FTL::SlowPathCallKey::SlowPathCallKey):
2518         (JSC::FTL::SlowPathCallKey::callTarget const):
2519         (JSC::FTL::SlowPathCallKey::withCallTarget):
2520         (JSC::FTL::SlowPathCallKey::hash const):
2521         (JSC::FTL::SlowPathCallKey::callPtrTag const): Deleted.
2522         * ftl/FTLState.cpp:
2523         (JSC::FTL::State::State):
2524         * ftl/FTLThunks.cpp:
2525         (JSC::FTL::genericGenerationThunkGenerator):
2526         (JSC::FTL::osrExitGenerationThunkGenerator):
2527         (JSC::FTL::lazySlowPathGenerationThunkGenerator):
2528         (JSC::FTL::slowPathCallThunkGenerator):
2529         * ftl/FTLThunks.h:
2530         (JSC::FTL::generateIfNecessary):
2531         (JSC::FTL::keyForThunk):
2532         (JSC::FTL::Thunks::getSlowPathCallThunk):
2533         (JSC::FTL::Thunks::keyForSlowPathCallThunk):
2534         * interpreter/InterpreterInlines.h:
2535         (JSC::Interpreter::getOpcodeID):
2536         * jit/AssemblyHelpers.cpp:
2537         (JSC::AssemblyHelpers::callExceptionFuzz):
2538         (JSC::AssemblyHelpers::emitDumbVirtualCall):
2539         (JSC::AssemblyHelpers::debugCall):
2540         * jit/CCallHelpers.cpp:
2541         (JSC::CCallHelpers::ensureShadowChickenPacket):
2542         * jit/ExecutableAllocator.cpp:
2543         (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
2544         (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
2545         * jit/ExecutableAllocator.h:
2546         (JSC::performJITMemcpy):
2547         * jit/GCAwareJITStubRoutine.cpp:
2548         (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
2549         (JSC::MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine):
2550         (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler):
2551         (JSC::createJITStubRoutine):
2552         * jit/GCAwareJITStubRoutine.h:
2553         (JSC::createJITStubRoutine):
2554         * jit/JIT.cpp:
2555         (JSC::ctiPatchCallByReturnAddress):
2556         (JSC::JIT::compileWithoutLinking):
2557         (JSC::JIT::link):
2558         (JSC::JIT::privateCompileExceptionHandlers):
2559         * jit/JIT.h:
2560         (JSC::CallRecord::CallRecord):
2561         * jit/JITArithmetic.cpp:
2562         (JSC::JIT::emitMathICFast):
2563         (JSC::JIT::emitMathICSlow):
2564         * jit/JITCall.cpp:
2565         (JSC::JIT::compileOpCallSlowCase):
2566         * jit/JITCall32_64.cpp:
2567         (JSC::JIT::compileOpCallSlowCase):
2568         * jit/JITCode.cpp:
2569         (JSC::JITCodeWithCodeRef::JITCodeWithCodeRef):
2570         (JSC::JITCodeWithCodeRef::executableAddressAtOffset):
2571         (JSC::DirectJITCode::DirectJITCode):
2572         (JSC::DirectJITCode::initializeCodeRef):
2573         (JSC::DirectJITCode::addressForCall):
2574         (JSC::NativeJITCode::NativeJITCode):
2575         (JSC::NativeJITCode::initializeCodeRef):
2576         (JSC::NativeJITCode::addressForCall):
2577         * jit/JITCode.h:
2578         * jit/JITCodeMap.h:
2579         (JSC::JITCodeMap::Entry::Entry):
2580         (JSC::JITCodeMap::Entry::codeLocation):
2581         (JSC::JITCodeMap::append):
2582         (JSC::JITCodeMap::find const):
2583         * jit/JITDisassembler.cpp:
2584         (JSC::JITDisassembler::dumpDisassembly):
2585         * jit/JITExceptions.cpp:
2586         (JSC::genericUnwind):
2587         * jit/JITInlineCacheGenerator.cpp:
2588         (JSC::JITByIdGenerator::finalize):
2589         * jit/JITInlines.h:
2590         (JSC::JIT::emitNakedCall):
2591         (JSC::JIT::emitNakedTailCall):
2592         (JSC::JIT::appendCallWithExceptionCheck):
2593         (JSC::JIT::appendCallWithExceptionCheckAndSlowPathReturnType):
2594         (JSC::JIT::appendCallWithCallFrameRollbackOnException):
2595         (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult):
2596         (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
2597         * jit/JITMathIC.h:
2598         (JSC::isProfileEmpty):
2599         * jit/JITOpcodes.cpp:
2600         (JSC::JIT::emit_op_catch):
2601         (JSC::JIT::emit_op_switch_imm):
2602         (JSC::JIT::emit_op_switch_char):
2603         (JSC::JIT::emit_op_switch_string):
2604         (JSC::JIT::privateCompileHasIndexedProperty):
2605         (JSC::JIT::emitSlow_op_has_indexed_property):
2606         * jit/JITOpcodes32_64.cpp:
2607         (JSC::JIT::privateCompileHasIndexedProperty):
2608         * jit/JITOperations.cpp:
2609         (JSC::getByVal):
2610         * jit/JITPropertyAccess.cpp:
2611         (JSC::JIT::stringGetByValStubGenerator):
2612         (JSC::JIT::emitGetByValWithCachedId):
2613         (JSC::JIT::emitSlow_op_get_by_val):
2614         (JSC::JIT::emitPutByValWithCachedId):
2615         (JSC::JIT::emitSlow_op_put_by_val):
2616         (JSC::JIT::emitSlow_op_try_get_by_id):
2617         (JSC::JIT::emitSlow_op_get_by_id_direct):
2618         (JSC::JIT::emitSlow_op_get_by_id):
2619         (JSC::JIT::emitSlow_op_get_by_id_with_this):
2620         (JSC::JIT::emitSlow_op_put_by_id):
2621         (JSC::JIT::privateCompileGetByVal):
2622         (JSC::JIT::privateCompileGetByValWithCachedId):
2623         (JSC::JIT::privateCompilePutByVal):
2624         (JSC::JIT::privateCompilePutByValWithCachedId):
2625         * jit/JITPropertyAccess32_64.cpp:
2626         (JSC::JIT::stringGetByValStubGenerator):
2627         (JSC::JIT::emitSlow_op_get_by_val):
2628         (JSC::JIT::emitSlow_op_put_by_val):
2629         * jit/JITStubRoutine.h:
2630         (JSC::JITStubRoutine::JITStubRoutine):
2631         (JSC::JITStubRoutine::createSelfManagedRoutine):
2632         (JSC::JITStubRoutine::code const):
2633         (JSC::JITStubRoutine::asCodePtr):
2634         * jit/JITThunks.cpp:
2635         (JSC::JITThunks::ctiNativeCall):
2636         (JSC::JITThunks::ctiNativeConstruct):
2637         (JSC::JITThunks::ctiNativeTailCall):
2638         (JSC::JITThunks::ctiNativeTailCallWithoutSavedTags):
2639         (JSC::JITThunks::ctiInternalFunctionCall):
2640         (JSC::JITThunks::ctiInternalFunctionConstruct):
2641         (JSC::JITThunks::ctiStub):
2642         (JSC::JITThunks::existingCTIStub):
2643         (JSC::JITThunks::hostFunctionStub):
2644         * jit/JITThunks.h:
2645         * jit/PCToCodeOriginMap.cpp:
2646         (JSC::PCToCodeOriginMap::PCToCodeOriginMap):
2647         * jit/PCToCodeOriginMap.h:
2648         * jit/PolymorphicCallStubRoutine.cpp:
2649         (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
2650         * jit/PolymorphicCallStubRoutine.h:
2651         * jit/Repatch.cpp:
2652         (JSC::readPutICCallTarget):
2653         (JSC::ftlThunkAwareRepatchCall):
2654         (JSC::appropriateOptimizingGetByIdFunction):
2655         (JSC::appropriateGetByIdFunction):
2656         (JSC::tryCacheGetByID):
2657         (JSC::repatchGetByID):
2658         (JSC::tryCachePutByID):
2659         (JSC::repatchPutByID):
2660         (JSC::tryCacheIn):
2661         (JSC::repatchIn):
2662         (JSC::linkSlowFor):
2663         (JSC::linkFor):
2664         (JSC::linkDirectFor):
2665         (JSC::revertCall):
2666         (JSC::unlinkFor):
2667         (JSC::linkVirtualFor):
2668         (JSC::linkPolymorphicCall):
2669         (JSC::resetGetByID):
2670         (JSC::resetPutByID):
2671         * jit/Repatch.h:
2672         * jit/SlowPathCall.h:
2673         (JSC::JITSlowPathCall::call):
2674         * jit/SpecializedThunkJIT.h:
2675         (JSC::SpecializedThunkJIT::finalize):
2676         (JSC::SpecializedThunkJIT::callDoubleToDouble):
2677         (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
2678         * jit/ThunkGenerator.h:
2679         * jit/ThunkGenerators.cpp:
2680         (JSC::throwExceptionFromCallSlowPathGenerator):
2681         (JSC::slowPathFor):
2682         (JSC::linkCallThunkGenerator):
2683         (JSC::linkPolymorphicCallThunkGenerator):
2684         (JSC::virtualThunkFor):
2685         (JSC::nativeForGenerator):
2686         (JSC::nativeCallGenerator):
2687         (JSC::nativeTailCallGenerator):
2688         (JSC::nativeTailCallWithoutSavedTagsGenerator):
2689         (JSC::nativeConstructGenerator):
2690         (JSC::internalFunctionCallGenerator):
2691         (JSC::internalFunctionConstructGenerator):
2692         (JSC::arityFixupGenerator):
2693         (JSC::unreachableGenerator):
2694         (JSC::charCodeAtThunkGenerator):
2695         (JSC::charAtThunkGenerator):
2696         (JSC::fromCharCodeThunkGenerator):
2697         (JSC::clz32ThunkGenerator):
2698         (JSC::sqrtThunkGenerator):
2699         (JSC::floorThunkGenerator):
2700         (JSC::ceilThunkGenerator):
2701         (JSC::truncThunkGenerator):
2702         (JSC::roundThunkGenerator):
2703         (JSC::expThunkGenerator):
2704         (JSC::logThunkGenerator):
2705         (JSC::absThunkGenerator):
2706         (JSC::imulThunkGenerator):
2707         (JSC::randomThunkGenerator):
2708         (JSC::boundThisNoArgsFunctionCallGenerator):
2709         * jit/ThunkGenerators.h:
2710         * llint/LLIntData.cpp:
2711         (JSC::LLInt::initialize):
2712         * llint/LLIntData.h:
2713         (JSC::LLInt::getExecutableAddress):
2714         (JSC::LLInt::getCodePtr):
2715         (JSC::LLInt::getCodeRef):
2716         (JSC::LLInt::getCodeFunctionPtr):
2717         * llint/LLIntEntrypoint.cpp:
2718         (JSC::LLInt::setFunctionEntrypoint):
2719         (JSC::LLInt::setEvalEntrypoint):
2720         (JSC::LLInt::setProgramEntrypoint):
2721         (JSC::LLInt::setModuleProgramEntrypoint):
2722         * llint/LLIntExceptions.cpp:
2723         (JSC::LLInt::callToThrow):
2724         * llint/LLIntSlowPaths.cpp:
2725         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2726         (JSC::LLInt::setUpCall):
2727         * llint/LLIntThunks.cpp:
2728         (JSC::vmEntryToWasm):
2729         (JSC::LLInt::generateThunkWithJumpTo):
2730         (JSC::LLInt::functionForCallEntryThunkGenerator):
2731         (JSC::LLInt::functionForConstructEntryThunkGenerator):
2732         (JSC::LLInt::functionForCallArityCheckThunkGenerator):
2733         (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
2734         (JSC::LLInt::evalEntryThunkGenerator):
2735         (JSC::LLInt::programEntryThunkGenerator):
2736         (JSC::LLInt::moduleProgramEntryThunkGenerator):
2737         * llint/LLIntThunks.h:
2738         * llint/LowLevelInterpreter.asm:
2739         * llint/LowLevelInterpreter32_64.asm:
2740         * llint/LowLevelInterpreter64.asm:
2741         * profiler/ProfilerCompilation.cpp:
2742         (JSC::Profiler::Compilation::addOSRExitSite):
2743         * profiler/ProfilerCompilation.h:
2744         * profiler/ProfilerOSRExitSite.cpp:
2745         (JSC::Profiler::OSRExitSite::toJS const):
2746         * profiler/ProfilerOSRExitSite.h:
2747         (JSC::Profiler::OSRExitSite::OSRExitSite):
2748         (JSC::Profiler::OSRExitSite::codeAddress const):
2749         (JSC::Profiler::OSRExitSite:: const): Deleted.
2750         * runtime/ExecutableBase.cpp:
2751         (JSC::ExecutableBase::clearCode):
2752         * runtime/ExecutableBase.h:
2753         (JSC::ExecutableBase::entrypointFor):
2754         * runtime/NativeExecutable.cpp:
2755         (JSC::NativeExecutable::finishCreation):
2756         * runtime/NativeFunction.h:
2757         (JSC::TaggedNativeFunction::TaggedNativeFunction):
2758         (JSC::TaggedNativeFunction::operator NativeFunction):
2759         * runtime/PtrTag.h:
2760         (JSC::tagCodePtr):
2761         (JSC::untagCodePtr):
2762         (JSC::retagCodePtr):
2763         (JSC::tagCFunctionPtr):
2764         (JSC::untagCFunctionPtr):
2765         (JSC::nextPtrTagID): Deleted.
2766         * runtime/PutPropertySlot.h:
2767         (JSC::PutPropertySlot::PutPropertySlot):
2768         (JSC::PutPropertySlot::setCustomValue):
2769         (JSC::PutPropertySlot::setCustomAccessor):
2770         (JSC::PutPropertySlot::customSetter const):
2771         * runtime/ScriptExecutable.cpp:
2772         (JSC::ScriptExecutable::installCode):
2773         * runtime/VM.cpp:
2774         (JSC::VM::getHostFunction):
2775         (JSC::VM::getCTIInternalFunctionTrampolineFor):
2776         * runtime/VM.h:
2777         (JSC::VM::getCTIStub):
2778         * wasm/WasmB3IRGenerator.cpp:
2779         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
2780         (JSC::Wasm::B3IRGenerator::emitExceptionCheck):
2781         (JSC::Wasm::B3IRGenerator::emitTierUpCheck):
2782         (JSC::Wasm::B3IRGenerator::addCall):
2783         (JSC::Wasm::B3IRGenerator::addCallIndirect):
2784         * wasm/WasmBBQPlan.cpp:
2785         (JSC::Wasm::BBQPlan::prepare):
2786         (JSC::Wasm::BBQPlan::complete):
2787         * wasm/WasmBBQPlan.h:
2788         * wasm/WasmBinding.cpp:
2789         (JSC::Wasm::wasmToWasm):
2790         * wasm/WasmBinding.h:
2791         * wasm/WasmCallee.h:
2792         (JSC::Wasm::Callee::entrypoint const):
2793         * wasm/WasmCallingConvention.h:
2794         (JSC::Wasm::CallingConvention::setupFrameInPrologue const):
2795         * wasm/WasmCodeBlock.h:
2796         (JSC::Wasm::CodeBlock::entrypointLoadLocationFromFunctionIndexSpace):
2797         * wasm/WasmFaultSignalHandler.cpp:
2798         (JSC::Wasm::trapHandler):
2799         * wasm/WasmFormat.h:
2800         * wasm/WasmInstance.h:
2801         * wasm/WasmOMGPlan.cpp:
2802         (JSC::Wasm::OMGPlan::work):
2803         * wasm/WasmThunks.cpp:
2804         (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
2805         (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
2806         (JSC::Wasm::triggerOMGTierUpThunkGenerator):
2807         (JSC::Wasm::Thunks::stub):
2808         (JSC::Wasm::Thunks::existingStub):
2809         * wasm/WasmThunks.h:
2810         * wasm/js/JSToWasm.cpp:
2811         (JSC::Wasm::createJSToWasmWrapper):
2812         * wasm/js/JSWebAssemblyCodeBlock.h:
2813         * wasm/js/WasmToJS.cpp:
2814         (JSC::Wasm::handleBadI64Use):
2815         (JSC::Wasm::wasmToJS):
2816         * wasm/js/WasmToJS.h:
2817         * wasm/js/WebAssemblyFunction.h:
2818         * yarr/YarrJIT.cpp:
2819         (JSC::Yarr::YarrGenerator::loadFromFrameAndJump):
2820         (JSC::Yarr::YarrGenerator::BacktrackingState::linkDataLabels):
2821         (JSC::Yarr::YarrGenerator::compile):
2822         * yarr/YarrJIT.h:
2823         (JSC::Yarr::YarrCodeBlock::set8BitCode):
2824         (JSC::Yarr::YarrCodeBlock::set16BitCode):
2825         (JSC::Yarr::YarrCodeBlock::set8BitCodeMatchOnly):
2826         (JSC::Yarr::YarrCodeBlock::set16BitCodeMatchOnly):
2827         (JSC::Yarr::YarrCodeBlock::execute):
2828         (JSC::Yarr::YarrCodeBlock::clear):
2829
2830 2018-04-17  Commit Queue  <commit-queue@webkit.org>
2831
2832         Unreviewed, rolling out r230697, r230720, and r230724.
2833         https://bugs.webkit.org/show_bug.cgi?id=184717
2834
2835         These caused multiple failures on the Test262 testers.
2836         (Requested by mlewis13 on #webkit).
2837
2838         Reverted changesets:
2839
2840         "[WebAssembly][Modules] Prototype wasm import"
2841         https://bugs.webkit.org/show_bug.cgi?id=184600
2842         https://trac.webkit.org/changeset/230697
2843
2844         "[WebAssembly][Modules] Implement function import from wasm
2845         modules"
2846         https://bugs.webkit.org/show_bug.cgi?id=184689
2847         https://trac.webkit.org/changeset/230720
2848
2849         "[JSC] Rename runWebAssembly to runWebAssemblySuite"
2850         https://bugs.webkit.org/show_bug.cgi?id=184703
2851         https://trac.webkit.org/changeset/230724
2852
2853 2018-04-17  JF Bastien  <jfbastien@apple.com>
2854
2855         A put is not an ExistingProperty put when we transition a structure because of an attributes change
2856         https://bugs.webkit.org/show_bug.cgi?id=184706
2857         <rdar://problem/38871451>
2858
2859         Reviewed by Saam Barati.
2860
2861         When putting a property on a structure and the slot is a different
2862         type, the slot can't be said to have already been existing.
2863
2864         * runtime/JSObjectInlines.h:
2865         (JSC::JSObject::putDirectInternal):
2866
2867 2018-04-17  Filip Pizlo  <fpizlo@apple.com>
2868
2869         JSGenericTypedArrayView<>::visitChildren has a race condition reading m_mode and m_vector
2870         https://bugs.webkit.org/show_bug.cgi?id=184705
2871
2872         Reviewed by Michael Saboff.
2873         
2874         My old multisocket Mac Pro is amazing at catching race conditions in the GC. Earlier today
2875         while testing an unrelated patch, a concurrent GC thread crashed inside
2876         JSGenericTypedArrayView<>::visitChildren() calling markAuxiliary(). I'm pretty sure it's
2877         because a typed array became wasteful concurrently to the GC. So, visitChildren() read one
2878         mode and another vector.
2879         
2880         The fix is to lock inside visitChildren and anyone who changes those fields.
2881         
2882         I'm not even going to try to write a test. I think it's super lucky that my Mac Pro caught
2883         this.
2884
2885         * runtime/JSArrayBufferView.cpp:
2886         (JSC::JSArrayBufferView::neuter):
2887         * runtime/JSGenericTypedArrayViewInlines.h:
2888         (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
2889         (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
2890
2891 2018-04-16  Filip Pizlo  <fpizlo@apple.com>
2892
2893         PutStackSinkingPhase should know that KillStack means ConflictingFlush
2894         https://bugs.webkit.org/show_bug.cgi?id=184672
2895
2896         Reviewed by Michael Saboff.
2897
2898         We've had a long history of KillStack and PutStackSinkingPhase having problems. We kept changing the meaning of
2899         KillStack, and at some point we removed reasoning about KillStack from PutStackSinkingPhase. I tried doing some
2900         archeology - but I'm still not sure why that phase ignores KillStack entirely. Maybe it's an oversight or maybe it's
2901         intentional - I don't know.
2902
2903         Whatever the history, it's clear from the attached test case that ignoring KillStack is not correct. The outcome of
2904         doing so is that we will sometimes sink a PutStack below a KillStack. That's wrong because then, OSR exit will use
2905         the value from the PutStack instead of using the value from the MovHint that is associated with the KillStack. So,
2906         KillStack must be seen as a special kind of clobber of the stack slot. OSRAvailabiity uses ConflictingFlush. I think
2907         that's correct here, too. If we used DeadFlush and that was merged with another control flow path that had a
2908         specific flush format, then we would think that we could sink the flush from that path. That's not right, since that
2909         could still lead to sinking a PutStack past the KillStack in the sense that a PutStack will appear after the
2910         KillStack along one path through the CFG. Also, the definition of DeadFlush and ConflictingFlush in the comment
2911         inside PutStackSinkingPhase seems to suggest that KillStack is a ConflictingFlush, since DeadFlush means that we
2912         have done some PutStack and their values are still valid. KillStack is not a PutStack and it means that previous
2913         values are not valid. The definition of ConflictingFlush is that "we know, via forward flow, that there isn't any
2914         value in the given local that anyone should have been relying on" - which exactly matches KillStack's definition.
2915
2916         This also means that we cannot eliminate arguments allocations that are live over KillStacks, since if we eliminated
2917         them then we would have a GetStack after a KillStack. One easy way to fix this is to say that KillStack writes to
2918         its stack slot for the purpose of clobberize.
2919
2920         * dfg/DFGClobberize.h: KillStack "writes" to its stack slot.
2921         * dfg/DFGPutStackSinkingPhase.cpp: Fix the bug.
2922         * ftl/FTLLowerDFGToB3.cpp: Add better assertion failure.
2923         (JSC::FTL::DFG::LowerDFGToB3::buildExitArguments):
2924
2925 2018-04-17  Filip Pizlo  <fpizlo@apple.com>
2926
2927         JSWebAssemblyCodeBlock should be in an IsoSubspace
2928         https://bugs.webkit.org/show_bug.cgi?id=184704
2929
2930         Reviewed by Mark Lam.
2931         
2932         Previously it was in a CompleteSubspace, which is pretty good, but also quite wasteful.
2933         CompleteSubspace means about 4KB of data to track the size-allocator mapping. IsoSubspace
2934         shortcircuits this. Also, IsoSubspace uses the iso allocator, so it provides stronger UAF
2935         protection.
2936
2937         * runtime/VM.cpp:
2938         (JSC::VM::VM):
2939         * runtime/VM.h:
2940         * wasm/js/JSWebAssemblyCodeBlock.h:
2941
2942 2018-04-17  Jer Noble  <jer.noble@apple.com>
2943
2944         Only enable useSeparatedWXHeap on ARM64.
2945         https://bugs.webkit.org/show_bug.cgi?id=184697
2946
2947         Reviewed by Saam Barati.
2948
2949         * runtime/Options.cpp:
2950         (JSC::recomputeDependentOptions):
2951
2952 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2953
2954         [WebAssembly][Modules] Implement function import from wasm modules
2955         https://bugs.webkit.org/show_bug.cgi?id=184689
2956
2957         Reviewed by JF Bastien.
2958
2959         This patch implements function import from wasm modules. We move function importing part
2960         from JSWebAssemblyInstance's creation function to WebAssemblyModuleRecord::link. This
2961         is because linking these functions requires that all the dependent modules are created.
2962         While we want to move all the linking functionality from JSWebAssemblyInstance to
2963         WebAssemblyModuleRecord::link, we do not that in this patch.  In this patch, we move only
2964         function importing part because efficient compilation of WebAssembly needs to know
2965         the type of WebAssemblyMemory (signaling or bound checking). This needs to know imported
2966         or attached WebAssembly memory object. So we cannot defer this linking to
2967         WebAssemblyModuleRecord::link now.
2968
2969         The largest difference from JS module linking is that WebAssembly module linking links
2970         function from the module by snapshotting. When you have a cyclic module graph like this,
2971
2972         -> JS1 (export "fun") -> Wasm1 (import "fun from JS1) -+
2973             ^                                                  |
2974             +--------------------------------------------------+
2975
2976         we fail to link this since "fun" is not instantiated when Wasm1 is first linked. This behavior
2977         is described in [1], and tested in this patch.
2978
2979         [1]: https://github.com/WebAssembly/esm-integration/tree/master/proposals/esm-integration#js---wasm-cycle-where-js-is-higher-in-the-module-graph
2980
2981         * JavaScriptCore.xcodeproj/project.pbxproj:
2982         * jsc.cpp:
2983         (functionDollarAgentStart):
2984         (checkException):
2985         (runWithOptions):
2986         Small fixes for wasm module loading.
2987
2988         * parser/NodesAnalyzeModule.cpp:
2989         (JSC::ImportDeclarationNode::analyzeModule):
2990         * runtime/AbstractModuleRecord.cpp:
2991         (JSC::AbstractModuleRecord::resolveImport):
2992         (JSC::AbstractModuleRecord::link):
2993         * runtime/AbstractModuleRecord.h:
2994         (JSC::AbstractModuleRecord::moduleEnvironmentMayBeNull):
2995         (JSC::AbstractModuleRecord::ImportEntry::isNamespace const): Deleted.
2996         Now, wasm modules can have import which is named "*". So this function does not work.
2997         Since wasm modules never have namespace importing, we check this in JS's module analyzer.
2998
2999         * runtime/JSModuleEnvironment.cpp:
3000         (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
3001         * runtime/JSModuleRecord.cpp:
3002         (JSC::JSModuleRecord::instantiateDeclarations):
3003         * wasm/WasmCreationMode.h: Added.
3004         * wasm/js/JSWebAssemblyInstance.cpp:
3005         (JSC::JSWebAssemblyInstance::finalizeCreation):
3006         (JSC::JSWebAssemblyInstance::create):
3007         * wasm/js/JSWebAssemblyInstance.h:
3008         * wasm/js/WebAssemblyInstanceConstructor.cpp:
3009         (JSC::constructJSWebAssemblyInstance):
3010         * wasm/js/WebAssemblyModuleRecord.cpp:
3011         (JSC::WebAssemblyModuleRecord::link):
3012         * wasm/js/WebAssemblyModuleRecord.h:
3013         * wasm/js/WebAssemblyPrototype.cpp:
3014         (JSC::resolve):
3015         (JSC::instantiate):
3016         (JSC::compileAndInstantiate):
3017         (JSC::WebAssemblyPrototype::instantiate):
3018         (JSC::webAssemblyInstantiateFunc):
3019
3020 2018-04-17  Dominik Infuehr  <dinfuehr@igalia.com>
3021
3022         Implement setupArgumentsImpl for ARM and MIPS
3023         https://bugs.webkit.org/show_bug.cgi?id=183786
3024
3025         Reviewed by Yusuke Suzuki.
3026
3027         Implement setupArgumentsImpl for ARM (hardfp and softfp) and MIPS calling convention. Added
3028         numCrossSources and extraGPRArgs to ArgCollection to keep track of extra
3029         registers used for 64-bit values on 32-bit architectures. numCrossSources
3030         keeps track of assignments from FPR to GPR registers as happens e.g. on MIPS.
3031
3032         * assembler/MacroAssemblerARMv7.h:
3033         (JSC::MacroAssemblerARMv7::moveDouble):
3034         * assembler/MacroAssemblerMIPS.h:
3035         (JSC::MacroAssemblerMIPS::moveDouble):
3036         * jit/CCallHelpers.h:
3037         (JSC::CCallHelpers::setupStubCrossArgs):
3038         (JSC::CCallHelpers::ArgCollection::ArgCollection):
3039         (JSC::CCallHelpers::ArgCollection::pushRegArg):
3040         (JSC::CCallHelpers::ArgCollection::pushExtraRegArg):
3041         (JSC::CCallHelpers::ArgCollection::addGPRArg):
3042         (JSC::CCallHelpers::ArgCollection::addGPRExtraArg):
3043         (JSC::CCallHelpers::ArgCollection::addStackArg):
3044         (JSC::CCallHelpers::ArgCollection::addPoke):
3045         (JSC::CCallHelpers::ArgCollection::argCount):
3046         (JSC::CCallHelpers::calculatePokeOffset):
3047         (JSC::CCallHelpers::pokeForArgument):
3048         (JSC::CCallHelpers::stackAligned):
3049         (JSC::CCallHelpers::marshallArgumentRegister):
3050         (JSC::CCallHelpers::setupArgumentsImpl):
3051         (JSC::CCallHelpers::pokeArgumentsAligned):
3052         (JSC::CCallHelpers::std::is_integral<CURRENT_ARGUMENT_TYPE>::value):
3053         (JSC::CCallHelpers::std::is_pointer<CURRENT_ARGUMENT_TYPE>::value):
3054         (JSC::CCallHelpers::setupArguments):
3055         * jit/FPRInfo.h:
3056         (JSC::FPRInfo::toArgumentRegister):
3057
3058 2018-04-17  Saam Barati  <sbarati@apple.com>
3059
3060         Add system trace points for process launch and for initializeWebProcess
3061         https://bugs.webkit.org/show_bug.cgi?id=184669
3062
3063         Reviewed by Simon Fraser.
3064
3065         * runtime/VMEntryScope.cpp:
3066         (JSC::VMEntryScope::VMEntryScope):
3067         (JSC::VMEntryScope::~VMEntryScope):
3068
3069 2018-04-17  Jer Noble  <jer.noble@apple.com>
3070
3071         Fix duplicate symbol errors when building JavaScriptCore with non-empty WK_ALTERNATE_WEBKIT_SDK_PATH
3072         https://bugs.webkit.org/show_bug.cgi?id=184602
3073
3074         Reviewed by Beth Dakin.
3075
3076         * JavaScriptCore.xcodeproj/project.pbxproj:
3077
3078 2018-04-17  Carlos Garcia Campos  <cgarcia@igalia.com>
3079
3080         [GLIB] Add API to clear JSCContext uncaught exception
3081         https://bugs.webkit.org/show_bug.cgi?id=184685
3082
3083         Reviewed by Žan Doberšek.
3084
3085         Add jsc_context_clear_exception() to clear any possible uncaught exception in a JSCContext.
3086
3087         * API/glib/JSCContext.cpp:
3088         (jsc_context_clear_exception):
3089         * API/glib/JSCContext.h:
3090         * API/glib/docs/jsc-glib-4.0-sections.txt:
3091
3092 2018-04-17  Carlos Garcia Campos  <cgarcia@igalia.com>
3093
3094         [GLIB] Add API to query, delete and enumerate properties
3095         https://bugs.webkit.org/show_bug.cgi?id=184647
3096
3097         Reviewed by Michael Catanzaro.
3098
3099         Add jsc_value_object_has_property(), jsc_value_object_delete_property() and jsc_value_object_enumerate_properties().
3100
3101         * API/glib/JSCValue.cpp:
3102         (jsc_value_object_has_property):
3103         (jsc_value_object_delete_property):
3104         (jsc_value_object_enumerate_properties):
3105         * API/glib/JSCValue.h:
3106         * API/glib/docs/jsc-glib-4.0-sections.txt:
3107
3108 2018-04-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3109
3110         [WebAssembly][Modules] Prototype wasm import
3111         https://bugs.webkit.org/show_bug.cgi?id=184600
3112
3113         Reviewed by JF Bastien.
3114
3115         This patch is an initial attempt to implement Wasm loading in module pipeline.
3116         Currently,
3117
3118         1. We only support Wasm loading in the JSC shell. Once loading mechanism is specified
3119            in whatwg HTML, we should integrate this into WebCore.
3120
3121         2. We only support exporting values from Wasm. Wasm module cannot import anything from
3122            the other modules now.
3123
3124         When loading a file, JSC shell checks wasm magic. If the wasm magic is found, JSC shell
3125         loads the file with WebAssemblySourceProvider. It is wrapped into JSSourceCode and
3126         module loader pipeline just handles it as the same to JS. When parsing a module, we
3127         checks the type of JSSourceCode. If the source code is Wasm source code, we create a
3128         WebAssemblyModuleRecord instead of JSModuleRecord. Our module pipeline handles
3129         AbstractModuleRecord and Wasm module is instantiated, linked, and evaluated.
3130
3131         * builtins/ModuleLoaderPrototype.js:
3132         (globalPrivate.newRegistryEntry):
3133         (requestInstantiate):
3134         (link):
3135         * jsc.cpp:
3136         (convertShebangToJSComment):
3137         (fillBufferWithContentsOfFile):
3138         (fetchModuleFromLocalFileSystem):
3139         (GlobalObject::moduleLoaderFetch):
3140         * parser/SourceProvider.h:
3141         (JSC::WebAssemblySourceProvider::create):
3142         (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
3143         * runtime/AbstractModuleRecord.cpp:
3144         (JSC::AbstractModuleRecord::hostResolveImportedModule):
3145         (JSC::AbstractModuleRecord::link):
3146         (JSC::AbstractModuleRecord::evaluate):
3147         (JSC::identifierToJSValue): Deleted.
3148         * runtime/AbstractModuleRecord.h:
3149         * runtime/JSModuleLoader.cpp:
3150         (JSC::JSModuleLoader::evaluate):
3151         * runtime/JSModuleRecord.cpp:
3152         (JSC::JSModuleRecord::link):
3153         (JSC::JSModuleRecord::instantiateDeclarations):
3154         * runtime/JSModuleRecord.h:
3155         * runtime/ModuleLoaderPrototype.cpp:
3156         (JSC::moduleLoaderPrototypeParseModule):
3157         (JSC::moduleLoaderPrototypeRequestedModules):
3158         (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
3159         * wasm/js/JSWebAssemblyHelpers.h:
3160         (JSC::getWasmBufferFromValue):
3161         (JSC::createSourceBufferFromValue):
3162         * wasm/js/JSWebAssemblyInstance.cpp:
3163         (JSC::JSWebAssemblyInstance::finalizeCreation):
3164         (JSC::JSWebAssemblyInstance::createPrivateModuleKey):
3165         (JSC::JSWebAssemblyInstance::create):
3166         * wasm/js/JSWebAssemblyInstance.h:
3167         * wasm/js/WebAssemblyInstanceConstructor.cpp:
3168         (JSC::constructJSWebAssemblyInstance):
3169         * wasm/js/WebAssemblyModuleRecord.cpp:
3170         (JSC::WebAssemblyModuleRecord::prepareLink):
3171         (JSC::WebAssemblyModuleRecord::link):
3172         * wasm/js/WebAssemblyModuleRecord.h:
3173         * wasm/js/WebAssemblyPrototype.cpp:
3174         (JSC::resolve):
3175         (JSC::instantiate):
3176         (JSC::compileAndInstantiate):
3177         (JSC::WebAssemblyPrototype::instantiate):
3178         (JSC::webAssemblyInstantiateFunc):
3179         (JSC::webAssemblyValidateFunc):
3180         * wasm/js/WebAssemblyPrototype.h:
3181
3182 2018-04-14  Filip Pizlo  <fpizlo@apple.com>
3183
3184         Function.prototype.caller shouldn't return generator bodies
3185         https://bugs.webkit.org/show_bug.cgi?id=184630
3186
3187         Reviewed by Yusuke Suzuki.
3188         
3189         Function.prototype.caller no longer returns generator bodies. Those are meant to be
3190         private.
3191         
3192         Also added some builtin debugging tools so that it's easier to do the investigation that I
3193         did.
3194
3195         * builtins/BuiltinNames.h:
3196         * runtime/JSFunction.cpp:
3197         (JSC::JSFunction::callerGetter):
3198         * runtime/JSGlobalObject.cpp:
3199         (JSC::JSGlobalObject::init):
3200         * runtime/JSGlobalObjectFunctions.cpp:
3201         (JSC::globalFuncBuiltinDescribe):
3202         * runtime/JSGlobalObjectFunctions.h:
3203
3204 2018-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3205
3206         [DFG] Remove duplicate 32bit ProfileType implementation
3207         https://bugs.webkit.org/show_bug.cgi?id=184536
3208
3209         Reviewed by Saam Barati.
3210
3211         This patch removes duplicate 32bit ProfileType implementation by unifying 32/64 implementations.
3212
3213         * dfg/DFGSpeculativeJIT.cpp:
3214         (JSC::DFG::SpeculativeJIT::compileProfileType):
3215         * dfg/DFGSpeculativeJIT.h:
3216         * dfg/DFGSpeculativeJIT32_64.cpp:
3217         (JSC::DFG::SpeculativeJIT::compile):
3218         * dfg/DFGSpeculativeJIT64.cpp:
3219         (JSC::DFG::SpeculativeJIT::compile):
3220         * jit/AssemblyHelpers.h:
3221         (JSC::AssemblyHelpers::branchIfUndefined):
3222         (JSC::AssemblyHelpers::branchIfNull):
3223
3224 2018-04-12  Mark Lam  <mark.lam@apple.com>
3225
3226         Consolidate some PtrTags.
3227         https://bugs.webkit.org/show_bug.cgi?id=184552
3228         <rdar://problem/39389404>
3229
3230         Reviewed by Filip Pizlo.
3231
3232         Consolidate CodeEntryPtrTag and CodeEntryWithArityCheckPtrTag into CodePtrTag.
3233         Consolidate NearCallPtrTag and NearJumpPtrTag into NearCodePtrTag.
3234
3235         * assembler/AbstractMacroAssembler.h:
3236         (JSC::AbstractMacroAssembler::repatchNearCall):
3237         * assembler/MacroAssemblerARM.h:
3238         (JSC::MacroAssemblerARM::readCallTarget):
3239         * assembler/MacroAssemblerARMv7.h:
3240         (JSC::MacroAssemblerARMv7::readCallTarget):
3241         * assembler/MacroAssemblerMIPS.h:
3242         (JSC::MacroAssemblerMIPS::readCallTarget):
3243         * assembler/MacroAssemblerX86.h:
3244         (JSC::MacroAssemblerX86::readCallTarget):
3245         * assembler/MacroAssemblerX86_64.h:
3246         (JSC::MacroAssemblerX86_64::readCallTarget):
3247         * bytecode/AccessCase.cpp:
3248         (JSC::AccessCase::generateImpl):
3249         * bytecode/InlineAccess.cpp:
3250         (JSC::InlineAccess::rewireStubAsJump):
3251         * bytecode/PolymorphicAccess.cpp:
3252         (JSC::PolymorphicAccess::regenerate):
3253         * dfg/DFGJITCompiler.cpp:
3254         (JSC::DFG::JITCompiler::linkOSRExits):
3255         (JSC::DFG::JITCompiler::link):
3256         (JSC::DFG::JITCompiler::compileFunction):
3257         * dfg/DFGJITFinalizer.cpp:
3258         (JSC::DFG::JITFinalizer::finalize):
3259         (JSC::DFG::JITFinalizer::finalizeFunction):
3260         * dfg/DFGOSREntry.cpp:
3261         (JSC::DFG::prepareOSREntry):
3262         * dfg/DFGOSRExit.cpp:
3263         (JSC::DFG::OSRExit::executeOSRExit):
3264         (JSC::DFG::adjustAndJumpToTarget):
3265         (JSC::DFG::OSRExit::compileOSRExit):
3266         * dfg/DFGOSRExitCompilerCommon.cpp:
3267         (JSC::DFG::adjustAndJumpToTarget):
3268         * dfg/DFGOperations.cpp:
3269         * ftl/FTLJITCode.cpp:
3270         (JSC::FTL::JITCode::executableAddressAtOffset):
3271         * ftl/FTLJITFinalizer.cpp:
3272         (JSC::FTL::JITFinalizer::finalizeCommon):
3273         * ftl/FTLLazySlowPath.cpp:
3274         (JSC::FTL::LazySlowPath::generate):
3275         * ftl/FTLLink.cpp:
3276         (JSC::FTL::link):
3277         * ftl/FTLLowerDFGToB3.cpp:
3278         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
3279         (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
3280         (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
3281         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
3282         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
3283         (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
3284         * ftl/FTLOSRExitCompiler.cpp:
3285         (JSC::FTL::compileFTLOSRExit):
3286         * ftl/FTLOSRExitHandle.cpp:
3287         (JSC::FTL::OSRExitHandle::emitExitThunk):
3288         * jit/AssemblyHelpers.cpp:
3289         (JSC::AssemblyHelpers::emitDumbVirtualCall):
3290         * jit/JIT.cpp:
3291         (JSC::JIT::compileWithoutLinking):
3292         (JSC::JIT::link):
3293         * jit/JITCall.cpp:
3294         (JSC::JIT::compileOpCallSlowCase):
3295         * jit/JITCode.cpp:
3296         (JSC::JITCodeWithCodeRef::executableAddressAtOffset):
3297         (JSC::NativeJITCode::addressForCall):
3298         * jit/JITInlines.h:
3299         (JSC::JIT::emitNakedCall):
3300         (JSC::JIT::emitNakedTailCall):
3301         * jit/JITMathIC.h:
3302         (JSC::isProfileEmpty):
3303         * jit/JITOpcodes.cpp:
3304         (JSC::JIT::privateCompileHasIndexedProperty):
3305         * jit/JITOperations.cpp:
3306         * jit/JITPropertyAccess.cpp:
3307         (JSC::JIT::stringGetByValStubGenerator):
3308         (JSC::JIT::privateCompileGetByVal):
3309         (JSC::JIT::privateCompileGetByValWithCachedId):
3310         (JSC::JIT::privateCompilePutByVal):
3311         (JSC::JIT::privateCompilePutByValWithCachedId):
3312         * jit/JITThunks.cpp:
3313         (JSC::JITThunks::hostFunctionStub):
3314         * jit/Repatch.cpp:
3315         (JSC::linkSlowFor):
3316         (JSC::linkFor):
3317         (JSC::linkPolymorphicCall):
3318         * jit/SpecializedThunkJIT.h:
3319         (JSC::SpecializedThunkJIT::finalize):
3320         * jit/ThunkGenerators.cpp:
3321         (JSC::virtualThunkFor):
3322         (JSC::nativeForGenerator):
3323         (JSC::boundThisNoArgsFunctionCallGenerator):
3324         * llint/LLIntData.cpp:
3325         (JSC::LLInt::initialize):
3326         * llint/LLIntEntrypoint.cpp:
3327         (JSC::LLInt::setEvalEntrypoint):
3328         (JSC::LLInt::setProgramEntrypoint):
3329         (JSC::LLInt::setModuleProgramEntrypoint):
3330         * llint/LLIntSlowPaths.cpp:
3331         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3332         (JSC::LLInt::setUpCall):
3333         * llint/LLIntThunks.cpp:
3334         (JSC::LLInt::generateThunkWithJumpTo):
3335         (JSC::LLInt::functionForCallEntryThunkGenerator):
3336         (JSC::LLInt::functionForConstructEntryThunkGenerator):
3337         (JSC::LLInt::functionForCallArityCheckThunkGenerator):
3338         (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
3339         (JSC::LLInt::evalEntryThunkGenerator):
3340         (JSC::LLInt::programEntryThunkGenerator):
3341         (JSC::LLInt::moduleProgramEntryThunkGenerator):
3342         * llint/LowLevelInterpreter.asm:
3343         * llint/LowLevelInterpreter64.asm:
3344         * runtime/NativeExecutable.cpp:
3345         (JSC::NativeExecutable::finishCreation):
3346         * runtime/NativeFunction.h:
3347         (JSC::TaggedNativeFunction::TaggedNativeFunction):
3348         (JSC::TaggedNativeFunction::operator NativeFunction):
3349         * runtime/PtrTag.h:
3350         * wasm/WasmBBQPlan.cpp:
3351         (JSC::Wasm::BBQPlan::complete):
3352         * wasm/WasmOMGPlan.cpp:
3353         (JSC::Wasm::OMGPlan::work):
3354         * wasm/WasmThunks.cpp:
3355         (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
3356         (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
3357         (JSC::Wasm::triggerOMGTierUpThunkGenerator):
3358         * wasm/js/WasmToJS.cpp:
3359         (JSC::Wasm::wasmToJS):
3360         * wasm/js/WebAssemblyFunction.h:
3361         * yarr/YarrJIT.cpp:
3362         (JSC::Yarr::YarrGenerator::compile):
3363
3364 2018-04-12  Michael Catanzaro  <mcatanzaro@igalia.com>
3365
3366         [WPE] Move libWPEWebInspectorResources.so to pkglibdir
3367         https://bugs.webkit.org/show_bug.cgi?id=184379
3368
3369         Reviewed by Žan Doberšek.
3370
3371         Load the module from the new location.
3372
3373         * PlatformWPE.cmake:
3374         * inspector/remote/glib/RemoteInspectorUtils.cpp:
3375         (Inspector::backendCommands):
3376
3377 2018-04-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3378
3379         [DFG] Remove compileBigIntEquality in DFG 32bit
3380         https://bugs.webkit.org/show_bug.cgi?id=184535
3381
3382         Reviewed by Saam Barati.
3383
3384         We can have the unified implementation for compileBigIntEquality.
3385
3386         * dfg/DFGSpeculativeJIT.cpp:
3387         (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
3388         * dfg/DFGSpeculativeJIT32_64.cpp:
3389         (JSC::DFG::SpeculativeJIT::compileBigIntEquality): Deleted.
3390         * dfg/DFGSpeculativeJIT64.cpp:
3391         (JSC::DFG::SpeculativeJIT::compileBigIntEquality): Deleted.
3392
3393 2018-04-12  Michael Catanzaro  <mcatanzaro@igalia.com>
3394
3395         [WPE] Improve include hierarchy
3396         https://bugs.webkit.org/show_bug.cgi?id=184376
3397
3398         Reviewed by Žan Doberšek.
3399
3400         Install JSC headers under /usr/include/wpe-webkit-0.1/jsc instead of
3401         /usr/include/wpe-0.1/WPE/jsc.
3402
3403         * PlatformWPE.cmake:
3404
3405 2018-04-11  Carlos Garcia Campos  <cgarcia@igalia.com>
3406
3407         [GLIB] Handle strings containing null characters
3408         https://bugs.webkit.org/show_bug.cgi?id=184450
3409
3410         Reviewed by Michael Catanzaro.
3411
3412         We should be able to evaluate scripts containing null characters and to handle strings that contains them
3413         too. In JavaScript strings are not null-terminated, they can contain null characters. This patch adds a length
3414         parameter to jsc_context_valuate() to pass the script length (or -1 if it's null terminated), and new functions
3415         jsc_value_new_string_from_bytes() and jsc_value_to_string_as_bytes() using GBytes to store strings that might
3416         contain null characters.
3417
3418         * API/OpaqueJSString.cpp:
3419         (OpaqueJSString::create): Add a create constructor that takes the String.
3420         * API/OpaqueJSString.h:
3421         (OpaqueJSString::OpaqueJSString): Add a constructor that takes the String.
3422         * API/glib/JSCContext.cpp:
3423         (jsc_context_evaluate): Add length parameter.
3424         (jsc_context_evaluate_with_source_uri): Ditto.
3425         * API/glib/JSCContext.h:
3426         * API/glib/JSCValue.cpp:
3427         (jsc_value_new_string_from_bytes):
3428         (jsc_value_to_string):
3429         (jsc_value_to_string_as_bytes):
3430         (jsc_value_object_is_instance_of): Pass length to evaluate.
3431         * API/glib/JSCValue.h:
3432         * API/glib/docs/jsc-glib-4.0-sections.txt:
3433
3434 2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3435
3436         [JSC] Add CCallHelpers::CellValue to wrap JSCell GPR to convert it to EncodedJSValue
3437         https://bugs.webkit.org/show_bug.cgi?id=184500
3438
3439         Reviewed by Mark Lam.
3440
3441         Instead of passing JSValue::JSCellTag to callOperation meta-program to convert
3442         JSCell GPR to EncodedJSValue in 32bit code, we add CallHelpers::CellValue.
3443         It is a wrapper for GPRReg, like TrustedImmPtr for pointer value. When poking
3444         CellValue, 32bit code emits JSValue::CellTag automatically. In 64bit, we just
3445         poke held GPR. The benefit from this CellValue is that we can use the same code
3446         for 32bit and 64bit. This patch removes several ifdefs.
3447
3448         * bytecode/AccessCase.cpp:
3449         (JSC::AccessCase::generateImpl):
3450         * dfg/DFGSpeculativeJIT.cpp:
3451         (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
3452         (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
3453         (JSC::DFG::SpeculativeJIT::cachedPutById):
3454         * dfg/DFGSpeculativeJIT32_64.cpp:
3455         (JSC::DFG::SpeculativeJIT::cachedGetById):
3456         (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
3457         * jit/CCallHelpers.h:
3458         (JSC::CCallHelpers::CellValue::CellValue):
3459         (JSC::CCallHelpers::CellValue::gpr const):
3460         (JSC::CCallHelpers::setupArgumentsImpl):
3461
3462 2018-04-11  Mark Lam  <mark.lam@apple.com>
3463
3464         [Build fix] Replace CompactJITCodeMap with JITCodeMap.
3465         https://bugs.webkit.org/show_bug.cgi?id=184512
3466         <rdar://problem/35391728>
3467
3468         Not reviewed.
3469
3470         * bytecode/CodeBlock.h:
3471         * jit/JITCodeMap.h:
3472
3473 2018-04-11  Mark Lam  <mark.lam@apple.com>
3474
3475         Replace CompactJITCodeMap with JITCodeMap.
3476         https://bugs.webkit.org/show_bug.cgi?id=184512
3477         <rdar://problem/35391728>
3478
3479         Reviewed by Filip Pizlo.
3480
3481         * CMakeLists.txt:
3482         * JavaScriptCore.xcodeproj/project.pbxproj:
3483         * bytecode/CodeBlock.h:
3484         (JSC::CodeBlock::setJITCodeMap):
3485         (JSC::CodeBlock::jitCodeMap const):
3486         (JSC::CodeBlock::jitCodeMap): Deleted.
3487         * dfg/DFGOSRExit.cpp:
3488         (JSC::DFG::OSRExit::executeOSRExit):
3489         * dfg/DFGOSRExitCompilerCommon.cpp:
3490         (JSC::DFG::adjustAndJumpToTarget):
3491         * jit/AssemblyHelpers.cpp:
3492         (JSC::AssemblyHelpers::decodedCodeMapFor): Deleted.
3493         * jit/AssemblyHelpers.h:
3494         * jit/CompactJITCodeMap.h: Removed.
3495         * jit/JIT.cpp:
3496         (JSC::JIT::link):
3497         * jit/JITCodeMap.h: Added.
3498         (JSC::JITCodeMap::Entry::Entry):
3499         (JSC::JITCodeMap::Entry::bytecodeIndex const):
3500         (JSC::JITCodeMap::Entry::codeLocation):
3501         (JSC::JITCodeMap::append):
3502         (JSC::JITCodeMap::finish):
3503         (JSC::JITCodeMap::find const):
3504         (JSC::JITCodeMap::operator bool const):
3505         * llint/LLIntSlowPaths.cpp:
3506         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3507
3508 2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3509
3510         [DFG] Remove CompareSlowPathGenerator
3511         https://bugs.webkit.org/show_bug.cgi?id=184492
3512
3513         Reviewed by Mark Lam.
3514
3515         Now CompareSlowPathGenerator is just calling a specified function.
3516         This can be altered with slowPathCall. This patch removes CompareSlowPathGenerator.
3517
3518         We also remove some of unnecessary USE(JSVALUE32_64) / USE(JSVALUE64) ifdefs by
3519         introducing a new constructor for GPRTemporary.
3520
3521         * JavaScriptCore.xcodeproj/project.pbxproj:
3522         * dfg/DFGCompareSlowPathGenerator.h: Removed.
3523         * dfg/DFGSpeculativeJIT.cpp:
3524         (JSC::DFG::GPRTemporary::GPRTemporary):
3525         (JSC::DFG::SpeculativeJIT::compileIsCellWithType):
3526         (JSC::DFG::SpeculativeJIT::compileIsTypedArrayView):
3527         (JSC::DFG::SpeculativeJIT::compileToObjectOrCallObjectConstructor):
3528         (JSC::DFG::SpeculativeJIT::compileIsObject):
3529         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
3530         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
3531         * dfg/DFGSpeculativeJIT.h:
3532         (JSC::DFG::GPRTemporary::GPRTemporary):
3533         * dfg/DFGSpeculativeJIT64.cpp:
3534         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
3535
3536 2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3537
3538         Unreviewed, build fix for 32bit
3539         https://bugs.webkit.org/show_bug.cgi?id=184236
3540
3541         * dfg/DFGSpeculativeJIT.cpp:
3542         (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
3543
3544 2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3545
3546         [DFG] Remove duplicate 32bit code more
3547         https://bugs.webkit.org/show_bug.cgi?id=184236
3548
3549         Reviewed by Mark Lam.
3550
3551         Remove duplicate 32bit code more aggressively part 2.
3552
3553         * JavaScriptCore.xcodeproj/project.pbxproj:
3554         * dfg/DFGCompareSlowPathGenerator.h: Added.
3555         (JSC::DFG::CompareSlowPathGenerator::CompareSlowPathGenerator):
3556         Drop boxing part. Use unblessedBooleanResult in DFGSpeculativeJIT side instead.
3557
3558         * dfg/DFGOperations.cpp:
3559         * dfg/DFGOperations.h:
3560         * dfg/DFGSpeculativeJIT.cpp:
3561         (JSC::DFG::SpeculativeJIT::compileOverridesHasInstance):
3562         (JSC::DFG::SpeculativeJIT::compileLoadVarargs):
3563         (JSC::DFG::SpeculativeJIT::compileIsObject):
3564         (JSC::DFG::SpeculativeJIT::compileCheckNotEmpty):
3565         (JSC::DFG::SpeculativeJIT::compilePutByIdFlush):
3566         (JSC::DFG::SpeculativeJIT::compilePutById):
3567         (JSC::DFG::SpeculativeJIT::compilePutByIdDirect):
3568         (JSC::DFG::SpeculativeJIT::compileNewArrayWithSize):
3569         (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
3570         (JSC::DFG::SpeculativeJIT::emitInitializeButterfly):
3571         (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
3572         (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
3573         (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
3574         (JSC::DFG::SpeculativeJIT::compileExtractCatchLocal):
3575         (JSC::DFG::SpeculativeJIT::cachedPutById):
3576         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
3577         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
3578         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare): Deleted.
3579         * dfg/DFGSpeculativeJIT.h:
3580         (JSC::DFG::SpeculativeJIT::selectScratchGPR): Deleted.
3581         * dfg/DFGSpeculativeJIT32_64.cpp:
3582         (JSC::DFG::SpeculativeJIT::compile):
3583         (JSC::DFG::SpeculativeJIT::cachedPutById): Deleted.
3584         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch): Deleted.
3585         (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator): Deleted.
3586         (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::generateInternal): Deleted.
3587         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare): Deleted.
3588         (JSC::DFG::SpeculativeJIT::compileMiscStrictEq): Deleted.
3589         (JSC::DFG::SpeculativeJIT::emitInitializeButterfly): Deleted.
3590         (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): Deleted.
3591         * dfg/DFGSpeculativeJIT64.cpp:
3592         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
3593         (JSC::DFG::SpeculativeJIT::compile):
3594         (JSC::DFG::SpeculativeJIT::cachedPutById): Deleted.
3595         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch): Deleted.
3596         (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator): Deleted.
3597         (): Deleted.
3598         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare): Deleted.
3599         (JSC::DFG::SpeculativeJIT::compileMiscStrictEq): Deleted.
3600         (JSC::DFG::SpeculativeJIT::emitInitializeButterfly): Deleted.
3601         (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): Deleted.
3602         * ftl/FTLLowerDFGToB3.cpp:
3603         (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
3604         operationHasIndexedPropertyByInt starts returning unblessed boolean with size_t.
3605
3606         * jit/AssemblyHelpers.h:
3607         (JSC::AssemblyHelpers::loadValue):
3608         (JSC::AssemblyHelpers::selectScratchGPR):
3609         (JSC::AssemblyHelpers::constructRegisterSet):
3610         * jit/RegisterSet.h:
3611         (JSC::RegisterSet::setAny):
3612         Clean up selectScratchGPR code to pass JSValueRegs.
3613
3614 2018-04-10  Caio Lima  <ticaiolima@gmail.com>
3615
3616         [ESNext][BigInt] Add support for BigInt in SpeculatedType
3617         https://bugs.webkit.org/show_bug.cgi?id=182470
3618
3619         Reviewed by Saam Barati.
3620
3621         This patch introduces the SpecBigInt type to DFG to enable BigInt
3622         speculation into DFG and FTL.
3623
3624         With SpecBigInt introduction, we can then specialize "===" operations
3625         to BigInts. As we are doing for some cells, we first check if operands
3626         are pointing to the same JSCell, and if it is false, we
3627         fallback to "operationCompareStrictEqCell". The idea in further
3628         patches is to implement BigInt equality check directly in
3629         assembly.
3630
3631         We are also adding support for BigInt constant folding into
3632         TypeOf operation.
3633
3634         * bytecode/SpeculatedType.cpp:
3635         (JSC::dumpSpeculation):
3636         (JSC::speculationFromClassInfo):
3637         (JSC::speculationFromStructure):
3638         (JSC::speculationFromJSType):
3639         (JSC::speculationFromString):
3640         * bytecode/SpeculatedType.h:
3641         (JSC::isBigIntSpeculation):
3642         * dfg/DFGAbstractInterpreterInlines.h:
3643         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3644         * dfg/DFGAbstractValue.cpp:
3645         (JSC::DFG::AbstractValue::set):
3646         * dfg/DFGConstantFoldingPhase.cpp:
3647         (JSC::DFG::ConstantFoldingPhase::foldConstants):
3648         * dfg/DFGFixupPhase.cpp:
3649         (JSC::DFG::FixupPhase::fixupNode):
3650         (JSC::DFG::FixupPhase::fixupToThis):
3651         (JSC::DFG::FixupPhase::observeUseKindOnNode):
3652         * dfg/DFGInferredTypeCheck.cpp:
3653         (JSC::DFG::insertInferredTypeCheck):
3654         * dfg/DFGNode.h:
3655         (JSC::DFG::Node::shouldSpeculateBigInt):
3656         * dfg/DFGPredictionPropagationPhase.cpp:
3657         * dfg/DFGSafeToExecute.h:
3658         (JSC::DFG::SafeToExecuteEdge::operator()):
3659         * dfg/DFGSpeculativeJIT.cpp:
3660         (JSC::DFG::SpeculativeJIT::compileStrictEq):
3661         (JSC::DFG::SpeculativeJIT::speculateBigInt):
3662         (JSC::DFG::SpeculativeJIT::speculate):
3663         * dfg/DFGSpeculativeJIT.h:
3664         * dfg/DFGSpeculativeJIT32_64.cpp:
3665         (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
3666         * dfg/DFGSpeculativeJIT64.cpp:
3667         (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
3668         * dfg/DFGUseKind.cpp:
3669         (WTF::printInternal):
3670         * dfg/DFGUseKind.h:
3671         (JSC::DFG::typeFilterFor):
3672         (JSC::DFG::isCell):
3673         * ftl/FTLCapabilities.cpp:
3674         (JSC::FTL::canCompile):
3675         * ftl/FTLLowerDFGToB3.cpp:
3676         (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
3677         (JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
3678         (JSC::FTL::DFG::LowerDFGToB3::speculate):
3679         (JSC::FTL::DFG::LowerDFGToB3::isNotBigInt):
3680         (JSC::FTL::DFG::LowerDFGToB3::speculateBigInt):
3681         * jit/AssemblyHelpers.cpp:
3682         (JSC::AssemblyHelpers::branchIfNotType):
3683         * jit/AssemblyHelpers.h:
3684         (JSC::AssemblyHelpers::branchIfBigInt):
3685         (JSC::AssemblyHelpers::branchIfNotBigInt):
3686         * runtime/InferredType.cpp:
3687         (JSC::InferredType::Descriptor::forValue):
3688         (JSC::InferredType::Descriptor::putByIdFlags const):
3689         (JSC::InferredType::Descriptor::merge):
3690         (WTF::printInternal):
3691         * runtime/InferredType.h:
3692         * runtime/JSBigInt.h:
3693
3694 2018-04-10  Filip Pizlo  <fpizlo@apple.com>
3695
3696         Unreviewed, fix cloop build.
3697
3698         * dfg/DFGAbstractInterpreterClobberState.cpp:
3699
3700 2018-04-10  Mark Lam  <mark.lam@apple.com>
3701
3702         Make the ASSERT in MarkedSpace::sizeClassToIndex() a RELEASE_ASSERT.
3703         https://bugs.webkit.org/show_bug.cgi?id=184464
3704         <rdar://problem/39323947>
3705
3706         Reviewed by Saam Barati.
3707
3708         * heap/MarkedSpace.h:
3709         (JSC::MarkedSpace::sizeClassToIndex):
3710
3711 2018-04-09  Filip Pizlo  <fpizlo@apple.com>
3712
3713         DFG AI and clobberize should agree with each other
3714         https://bugs.webkit.org/show_bug.cgi?id=184440
3715
3716         Reviewed by Saam Barati.
3717         
3718         One way to fix bugs involving underapproximation in AI or clobberize is to assert that they
3719         agree with each other. That's what this patch does: it adds an assertion that AI's structure
3720         state tracking must be equivalent to JSCell_structureID being clobbered.
3721         
3722         One subtlety is that AI sometimes folds away structure clobbering using information that
3723         clobberize doesn't have. So, we track this wuth special kinds of AI states (FoldedClobber and
3724         ObservedTransitions).
3725         
3726         This fixes a bunch of cases of AI missing clobberStructures/clobberWorld and one case of
3727         clobberize missing a write(Heap).
3728         
3729         This also makes some cases more precise in order to appease the assertion. Making things more
3730         precise might make things faster, but I didn't measure it because that wasn't the goal.
3731
3732         * JavaScriptCore.xcodeproj/project.pbxproj:
3733         * Sources.txt:
3734         * dfg/DFGAbstractInterpreter.h:
3735         * dfg/DFGAbstractInterpreterClobberState.cpp: Added.
3736         (WTF::printInternal):
3737         * dfg/DFGAbstractInterpreterClobberState.h: Added.
3738         (JSC::DFG::mergeClobberStates):
3739         * dfg/DFGAbstractInterpreterInlines.h:
3740         (JSC::DFG::AbstractInterpreter<AbstractStateType>::startExecuting):
3741         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3742         (JSC::DFG::AbstractInterpreter<AbstractStateType>::didFoldClobberWorld):
3743         (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):
3744         (JSC::DFG::AbstractInterpreter<AbstractStateType>::didFoldClobberStructures):
3745         (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
3746         (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
3747         (JSC::DFG::AbstractInterpreter<AbstractStateType>::setDidClobber): Deleted.
3748         * dfg/DFGAtTailAbstractState.h:
3749         (JSC::DFG::AtTailAbstractState::setClobberState):
3750         (JSC::DFG::AtTailAbstractState::mergeClobberState):
3751         (JSC::DFG::AtTailAbstractState::setDidClobber): Deleted.
3752         * dfg/DFGCFAPhase.cpp:
3753         (JSC::DFG::CFAPhase::performBlockCFA):
3754         * dfg/DFGClobberSet.cpp:
3755         (JSC::DFG::writeSet):
3756         * dfg/DFGClobberSet.h:
3757         * dfg/DFGClobberize.h:
3758         (JSC::DFG::clobberize):
3759         * dfg/DFGConstantFoldingPhase.cpp:
3760         (JSC::DFG::ConstantFoldingPhase::foldConstants):
3761         * dfg/DFGInPlaceAbstractState.h:
3762         (JSC::DFG::InPlaceAbstractState::clobberState const):
3763         (JSC::DFG::InPlaceAbstractState::didClobberOrFolded const):
3764         (JSC::DFG::InPlaceAbstractState::didClobber const):
3765         (JSC::DFG::InPlaceAbstractState::setClobberState):
3766         (JSC::DFG::InPlaceAbstractState::mergeClobberState):
3767         (JSC::DFG::InPlaceAbstractState::setDidClobber): Deleted.
3768
3769 2018-04-10  Filip Pizlo  <fpizlo@apple.com>
3770
3771         ExecutableToCodeBlockEdge::visitChildren() should be cool with m_codeBlock being null since we clear it in finalizeUnconditionally()
3772         https://bugs.webkit.org/show_bug.cgi?id=184460
3773         <rdar://problem/37610966>
3774
3775         Reviewed by Mark Lam.
3776
3777         * bytecode/ExecutableToCodeBlockEdge.cpp:
3778         (JSC::ExecutableToCodeBlockEdge::visitChildren):
3779
3780 2018-04-10  Filip Pizlo  <fpizlo@apple.com>
3781
3782         REGRESSION(r227341 and r227742): AI and clobberize should be precise and consistent about the effectfulness of CompareEq
3783         https://bugs.webkit.org/show_bug.cgi?id=184455
3784
3785         Reviewed by Michael Saboff.
3786         
3787         LICM is sort of an assertion that AI is as precise as clobberize about effects. If clobberize
3788         says that something is not effectful, then LICM will try to hoist it. But LICM's AI hack
3789         (AtTailAbstractState) cannot handle hoisting of things that have effects. So, if AI thinks that
3790         the thing being hoisted does have effects, then we get a crash.
3791         
3792         In r227341, we incorrectly told AI that CompareEq(Untyped:, _) is effectful. In fact, only
3793         ComapreEq(Untyped:, Untyped:) is effectful, and clobberize knew this already. As a result, LICM
3794         would blow up if we hoisted CompareEq(Untyped:, Other:), which clobberize knew wasn't
3795         effectful.
3796         
3797         Instead of fixing this by making AI precise, in r227742 we made matters worse by then breaking
3798         clobberize to also think that CompareEq(Untyped:, _) is effectful.
3799         
3800         This fixes the whole situation by teaching both clobberize and AI that the only effectful form
3801         of CompareEq is ComapreEq(Untyped:, Untyped:).
3802
3803         * dfg/DFGAbstractInterpreterInlines.h:
3804         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3805         * dfg/DFGClobberize.h:
3806         (JSC::DFG::clobberize):
3807
3808 2018-04-09  Filip Pizlo  <fpizlo@apple.com>
3809
3810         Executing known edge types may reveal a contradiction causing us to emit an exit at a node that is not allowed to exit
3811         https://bugs.webkit.org/show_bug.cgi?id=184372
3812
3813         Reviewed by Saam Barati.
3814         
3815         We do a pretty good job of not emitting checks for KnownBlah edges, since those mean that we
3816         have already proved, using techniques that are more precise than AI, that the edge has type
3817         Blah. Unfortunately, we do not handle this case gracefully when AI state becomes bottom,
3818         because we have a bad habit of treating terminate/terminateSpeculativeExecution as something
3819         other than a check - so we think we can call those just because we should have already
3820         bailed. It's better to think of them as the result of folding a check. Therefore, we should
3821         only do it if there had been a check to begin with.
3822
3823         * dfg/DFGSpeculativeJIT64.cpp:
3824         (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
3825         (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
3826         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
3827         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
3828         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
3829         * ftl/FTLLowerDFGToB3.cpp:
3830         (JSC::FTL::DFG::LowerDFGToB3::lowInt32):
3831         (JSC::FTL::DFG::LowerDFGToB3::lowInt52):
3832         (JSC::FTL::DFG::LowerDFGToB3::lowCell):
3833         (JSC::FTL::DFG::LowerDFGToB3::lowBoolean):
3834         (JSC::FTL::DFG::LowerDFGToB3::lowDouble):
3835         (JSC::FTL::DFG::LowerDFGToB3::speculate):
3836         (JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
3837         (JSC::FTL::DFG::LowerDFGToB3::speculateStringOrOther):
3838
3839 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3840
3841         [JSC] Introduce @putByIdDirectPrivate
3842         https://bugs.webkit.org/show_bug.cgi?id=184400
3843
3844         Reviewed by Saam Barati.
3845
3846         This patch adds @putByIdDirectPrivate() to use it for builtin JS.
3847         @getByIdDirectPrivate and @putByIdDirectPrivate are pair of intrinsics
3848         accessing to ECMAScript internal fields.
3849
3850         This change removes accidental [[Put]] operation to an object whose [[Prototype]]
3851         has internal fields (not direct properties). By using @getByIdDirectPrivate() and
3852         @putByIdDirectPrivate(), we strongly keep the semantics of the ECMAScript internal
3853         fields that accessing to the internal fields does not traverse prototype chains.
3854
3855         * builtins/ArrayIteratorPrototype.js:
3856         (globalPrivate.arrayIteratorValueNext):
3857         (globalPrivate.arrayIteratorKeyNext):
3858         (globalPrivate.arrayIteratorKeyValueNext):
3859         * builtins/ArrayPrototype.js:
3860         (globalPrivate.createArrayIterator):
3861         * builtins/AsyncFromSyncIteratorPrototype.js:
3862         (globalPrivate.AsyncFromSyncIteratorConstructor):
3863         * builtins/AsyncFunctionPrototype.js:
3864         (globalPrivate.asyncFunctionResume):
3865         * builtins/AsyncGeneratorPrototype.js:
3866         (globalPrivate.asyncGeneratorQueueEnqueue):
3867         (globalPrivate.asyncGeneratorQueueDequeue):
3868         (asyncGeneratorYieldAwaited):
3869         (globalPrivate.asyncGeneratorYield):
3870         (globalPrivate.doAsyncGeneratorBodyCall):
3871         (globalPrivate.asyncGeneratorResumeNext):
3872         * builtins/GeneratorPrototype.js:
3873         (globalPrivate.generatorResume):
3874         * builtins/MapIteratorPrototype.js:
3875         (globalPrivate.mapIteratorNext):
3876         * builtins/MapPrototype.js:
3877         (globalPrivate.createMapIterator):
3878         * builtins/ModuleLoaderPrototype.js:
3879         (forceFulfillPromise):
3880         * builtins/PromiseOperations.js:
3881         (globalPrivate.newHandledRejectedPromise):
3882         (globalPrivate.rejectPromise):
3883         (globalPrivate.fulfillPromise):
3884         (globalPrivate.initializePromise):
3885         * builtins/PromisePrototype.js:
3886         (then):
3887         * builtins/SetIteratorPrototype.js:
3888         (globalPrivate.setIteratorNext):
3889         * builtins/SetPrototype.js:
3890         (globalPrivate.createSetIterator):
3891         * builtins/StringIteratorPrototype.js:
3892         (next):
3893         * bytecode/BytecodeIntrinsicRegistry.h:
3894         * bytecompiler/NodesCodegen.cpp:
3895         (JSC::BytecodeIntrinsicNode::emit_intrinsic_putByIdDirect):
3896         (JSC::BytecodeIntrinsicNode::emit_intrinsic_putByIdDirectPrivate):
3897
3898 2018-04-09  Mark Lam  <mark.lam@apple.com>
3899
3900         Decorate method table entries to support pointer profiling.
3901         https://bugs.webkit.org/show_bug.cgi?id=184430
3902         <rdar://problem/39296190>
3903
3904         Reviewed by Saam Barati.
3905
3906         * runtime/ClassInfo.h:
3907
3908 2018-04-09  Michael Catanzaro  <mcatanzaro@igalia.com>
3909
3910         [WPE] Don't install JSC C API headers
3911         https://bugs.webkit.org/show_bug.cgi?id=184375
3912
3913         Reviewed by Žan Doberšek.
3914
3915         None of the functions declared in these headers are exported in WPE. Use the new jsc API
3916         instead.
3917
3918         * PlatformWPE.cmake:
3919
3920 2018-04-08  Mark Lam  <mark.lam@apple.com>
3921
3922         Add pointer profiling to the FTL and supporting code.
3923         https://bugs.webkit.org/show_bug.cgi?id=184395
3924         <rdar://problem/39264019>
3925
3926         Reviewed by Michael Saboff and Filip Pizlo.
3927
3928         * assembler/CodeLocation.h:
3929         (JSC::CodeLocationLabel::retagged):
3930         (JSC::CodeLocationJump::retagged):
3931         * assembler/LinkBuffer.h:
3932         (JSC::LinkBuffer::locationOf):
3933         * dfg/DFGJITCompiler.cpp:
3934         (JSC::DFG::JITCompiler::linkOSRExits):
3935         (JSC::DFG::JITCompiler::link):
3936         * ftl/FTLCompile.cpp:
3937         (JSC::FTL::compile):
3938         * ftl/FTLExceptionTarget.cpp:
3939         (JSC::FTL::ExceptionTarget::label):
3940         (JSC::FTL::ExceptionTarget::jumps):
3941         * ftl/FTLExceptionTarget.h:
3942         * ftl/FTLJITCode.cpp:
3943         (JSC::FTL::JITCode::executableAddressAtOffset):
3944         * ftl/FTLLazySlowPath.cpp:
3945         (JSC::FTL::LazySlowPath::~LazySlowPath):
3946         (JSC::FTL::LazySlowPath::initialize):
3947         (JSC::FTL::LazySlowPath::generate):
3948         (JSC::FTL::LazySlowPath::LazySlowPath): Deleted.
3949         * ftl/FTLLazySlowPath.h:
3950         * ftl/FTLLink.cpp:
3951         (JSC::FTL::link):
3952         * ftl/FTLLowerDFGToB3.cpp:
3953         (JSC::FTL::DFG::LowerDFGToB3::lower):
3954         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
3955         (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
3956         (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
3957         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
3958         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
3959         (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
3960         (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
3961         * ftl/FTLOSRExitCompiler.cpp:
3962         (JSC::FTL::compileStub):
3963         (JSC::FTL::compileFTLOSRExit):
3964         * ftl/FTLOSRExitHandle.cpp:
3965         (JSC::FTL::OSRExitHandle::emitExitThunk):
3966         * ftl/FTLOperations.cpp:
3967         (JSC::FTL::compileFTLLazySlowPath):
3968         * ftl/FTLOutput.h:
3969         (JSC::FTL::Output::callWithoutSideEffects):