1 2018-05-03 Yusuke Suzuki <utatane.tea@gmail.com>
3 Remove std::random_shuffle
4 https://bugs.webkit.org/show_bug.cgi?id=185292
6 Reviewed by Darin Adler.
8 std::random_shuffle is deprecated in C++14 and removed in C++17,
9 since std::random_shuffle relies on rand and srand.
10 Use std::shuffle instead.
12 * jit/BinarySwitch.cpp:
13 (JSC::RandomNumberGenerator::RandomNumberGenerator):
14 (JSC::RandomNumberGenerator::operator()):
15 (JSC::RandomNumberGenerator::min):
16 (JSC::RandomNumberGenerator::max):
17 (JSC::BinarySwitch::build):
19 2018-05-03 Saam Barati <sbarati@apple.com>
21 Don't prevent CreateThis being folded to NewObject when the structure is poly proto
22 https://bugs.webkit.org/show_bug.cgi?id=185177
24 Reviewed by Filip Pizlo.
26 This patch teaches the DFG/FTL how to constant fold CreateThis with
27 a known poly proto Structure to NewObject. We do it by emitting a NewObject
28 followed by a PutByOffset for the prototype value.
30 We make it so that ObjectAllocationProfile holds the prototype value.
31 This is sound because JSFunction clears that profile when its 'prototype'
34 This patch also renames underscoreProtoPrivateName to polyProtoName since
35 that name was nonsensical: it was only used for poly proto.
37 This is a 2x speedup on the get_callee_polymorphic microbenchmark. I had
38 regressed that benchmark when I first introduced poly proto.
40 * builtins/BuiltinNames.cpp:
41 * builtins/BuiltinNames.h:
42 (JSC::BuiltinNames::BuiltinNames):
43 (JSC::BuiltinNames::polyProtoName const):
44 (JSC::BuiltinNames::underscoreProtoPrivateName const): Deleted.
45 * bytecode/ObjectAllocationProfile.h:
46 (JSC::ObjectAllocationProfile::prototype):
47 (JSC::ObjectAllocationProfile::clear):
48 (JSC::ObjectAllocationProfile::visitAggregate):
49 * bytecode/ObjectAllocationProfileInlines.h:
50 (JSC::ObjectAllocationProfile::initializeProfile):
51 * dfg/DFGAbstractInterpreterInlines.h:
52 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
53 * dfg/DFGByteCodeParser.cpp:
54 (JSC::DFG::ByteCodeParser::parseBlock):
55 * dfg/DFGConstantFoldingPhase.cpp:
56 (JSC::DFG::ConstantFoldingPhase::foldConstants):
57 * dfg/DFGOperations.cpp:
58 * runtime/CommonSlowPaths.cpp:
59 (JSC::SLOW_PATH_DECL):
60 * runtime/FunctionRareData.h:
61 * runtime/Structure.cpp:
62 (JSC::Structure::create):
64 2018-05-03 Michael Saboff <msaboff@apple.com>
66 OSR entry pruning of Program Bytecodes doesn't take into account try/catch
67 https://bugs.webkit.org/show_bug.cgi?id=185281
69 Reviewed by Saam Barati.
71 When we compute bytecode block reachability, we need to take into account blocks
75 (JSC::JIT::privateCompileMainPass):
77 2018-05-03 Dominik Infuehr <dinfuehr@igalia.com>
79 ARM: Wrong offset for operand rt in disassembler
80 https://bugs.webkit.org/show_bug.cgi?id=184083
82 Reviewed by Yusuke Suzuki.
84 * disassembler/ARMv7/ARMv7DOpcode.h:
85 (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVDoublePrecision::rt):
86 (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVSinglePrecision::rt):
88 2018-05-03 Dominik Infuehr <dinfuehr@igalia.com>
90 ARM: Support vstr in disassembler
91 https://bugs.webkit.org/show_bug.cgi?id=184084
93 Reviewed by Yusuke Suzuki.
95 * disassembler/ARMv7/ARMv7DOpcode.cpp:
96 (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDRSTR::format):
97 (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::format): Deleted.
98 * disassembler/ARMv7/ARMv7DOpcode.h:
99 (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDRSTR::opName):
100 (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::condition): Deleted.
101 (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::uBit): Deleted.
102 (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::rn): Deleted.
103 (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::vd): Deleted.
104 (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::doubleReg): Deleted.
105 (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::immediate8): Deleted.
107 2018-05-03 Dominik Infuehr <dinfuehr@igalia.com>
109 Invoke ensureArrayStorage for all arguments
110 https://bugs.webkit.org/show_bug.cgi?id=185247
112 Reviewed by Yusuke Suzuki.
114 ensureArrayStorage was only invoked for first argument in each loop iteration.
117 (functionEnsureArrayStorage):
119 2018-05-03 Filip Pizlo <fpizlo@apple.com>
121 Make it easy to log compile times for all optimizing tiers
122 https://bugs.webkit.org/show_bug.cgi?id=185270
124 Reviewed by Keith Miller.
126 This makes --logPhaseTimes=true enable logging of phase times for DFG and B3 using a common
127 helper class, CompilerTimingScope. This used to be called B3::TimingScope and only B3 used
130 This should help us reduce compile times by telling us where to look. So, far, it looks like
133 * JavaScriptCore.xcodeproj/project.pbxproj:
136 (JSC::B3::shouldMeasurePhaseTiming): Deleted.
138 * b3/B3TimingScope.cpp: Removed.
139 * b3/B3TimingScope.h:
140 (JSC::B3::TimingScope::TimingScope):
142 (JSC::DFG::runAndLog):
144 (JSC::DFG::Plan::compileInThread):
145 * tools/CompilerTimingScope.cpp: Added.
146 (JSC::CompilerTimingScope::CompilerTimingScope):
147 (JSC::CompilerTimingScope::~CompilerTimingScope):
148 * tools/CompilerTimingScope.h: Added.
149 * runtime/Options.cpp:
150 (JSC::recomputeDependentOptions):
153 2018-05-03 Filip Pizlo <fpizlo@apple.com>
155 Strings should not be allocated in a gigacage
156 https://bugs.webkit.org/show_bug.cgi?id=185218
158 Reviewed by Saam Barati.
160 * runtime/JSBigInt.cpp:
161 (JSC::JSBigInt::toStringGeneric):
162 * runtime/JSString.cpp:
163 (JSC::JSRopeString::resolveRopeToAtomicString const):
164 (JSC::JSRopeString::resolveRope const):
165 * runtime/JSString.h:
166 (JSC::JSString::create):
167 (JSC::JSString::createHasOtherOwner):
169 (JSC::VM::gigacageAuxiliarySpace):
171 2018-05-03 Keith Miller <keith_miller@apple.com>
173 Unreviewed, fix 32-bit profile offset for change in bytecode
174 length of the get_by_id and get_array_length opcodes.
176 * llint/LowLevelInterpreter32_64.asm:
178 2018-05-03 Michael Saboff <msaboff@apple.com>
180 WebContent crash loading page on seas.upenn.edu @ JavaScriptCore: vmEntryToJavaScript
181 https://bugs.webkit.org/show_bug.cgi?id=185231
183 Reviewed by Saam Barati.
185 We weren't clearing the scratch register cache when switching back and forth between
186 allowing scratch register usage. We disallow scratch register usage when we are in
187 code that will freely allocate and use any register. Such usage can change the
188 contents of scratch registers. For ARM64, where we cache the contents of scratch
189 registers to reuse some or all of the contained values, we need to invalidate these
190 caches. We do this when re-enabling scratch register usage, that is when we transition
191 from disallow to allow scratch register usage.
193 Added a new Air regression test.
195 * assembler/AllowMacroScratchRegisterUsage.h:
196 (JSC::AllowMacroScratchRegisterUsage::AllowMacroScratchRegisterUsage):
197 * assembler/AllowMacroScratchRegisterUsageIf.h:
198 (JSC::AllowMacroScratchRegisterUsageIf::AllowMacroScratchRegisterUsageIf):
199 * assembler/DisallowMacroScratchRegisterUsage.h:
200 (JSC::DisallowMacroScratchRegisterUsage::~DisallowMacroScratchRegisterUsage):
201 * b3/air/testair.cpp:
203 2018-05-03 Keith Miller <keith_miller@apple.com>
205 Remove the prototype caching for get_by_id in the LLInt
206 https://bugs.webkit.org/show_bug.cgi?id=185226
208 Reviewed by Michael Saboff.
210 There is no evidence that this is actually a speedup and we keep
211 getting bugs with it. At this point it seems like we should just
215 * JavaScriptCore.xcodeproj/project.pbxproj:
217 * bytecode/BytecodeDumper.cpp:
218 (JSC::BytecodeDumper<Block>::printGetByIdOp):
219 (JSC::BytecodeDumper<Block>::printGetByIdCacheStatus):
220 (JSC::BytecodeDumper<Block>::dumpBytecode):
221 * bytecode/BytecodeList.json:
222 * bytecode/BytecodeUseDef.h:
223 (JSC::computeUsesForBytecodeOffset):
224 (JSC::computeDefsForBytecodeOffset):
225 * bytecode/CodeBlock.cpp:
226 (JSC::CodeBlock::finalizeLLIntInlineCaches):
227 * bytecode/CodeBlock.h:
228 (JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.
229 * bytecode/GetByIdStatus.cpp:
230 (JSC::GetByIdStatus::computeFromLLInt):
231 * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp: Removed.
232 * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h: Removed.
233 * bytecompiler/BytecodeGenerator.cpp:
234 (JSC::BytecodeGenerator::emitGetById):
235 * dfg/DFGByteCodeParser.cpp:
236 (JSC::DFG::ByteCodeParser::parseBlock):
237 * dfg/DFGCapabilities.cpp:
238 (JSC::DFG::capabilityLevel):
240 (JSC::JIT::privateCompileMainPass):
241 (JSC::JIT::privateCompileSlowCases):
242 * llint/LLIntSlowPaths.cpp:
243 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
244 (JSC::LLInt::setupGetByIdPrototypeCache): Deleted.
245 * llint/LowLevelInterpreter32_64.asm:
246 * llint/LowLevelInterpreter64.asm:
249 2018-05-03 Ryan Haddad <ryanhaddad@apple.com>
251 Unreviewed, rolling out r231197.
253 The test added with this change crashes on the 32-bit JSC bot.
257 "Correctly detect string overflow when using the 'Function'
259 https://bugs.webkit.org/show_bug.cgi?id=184883
260 https://trac.webkit.org/changeset/231197
262 2018-05-03 Dominik Infuehr <dinfuehr@igalia.com>
264 Disable usage of fused multiply-add instructions for JSC with compiler flag
265 https://bugs.webkit.org/show_bug.cgi?id=184909
267 Reviewed by Yusuke Suzuki.
269 Adds -ffp-contract as compiler flag for building JSC. This ensures that functions
270 like parseInt() do not return slightly different results depending on whether the
271 compiler was able to use fused multiply-add instructions or not.
275 2018-05-02 Yusuke Suzuki <utatane.tea@gmail.com>
277 Unreviewed, fix build failure in ARM, ARMv7 and MIPS
278 https://bugs.webkit.org/show_bug.cgi?id=185192
280 compareDouble relies on MacroAssembler::invert function.
282 * assembler/MacroAssembler.h:
283 (JSC::MacroAssembler::compareDouble):
284 * assembler/MacroAssemblerARM.h:
285 (JSC::MacroAssemblerARM::compareDouble): Deleted.
286 * assembler/MacroAssemblerARMv7.h:
287 (JSC::MacroAssemblerARMv7::compareDouble): Deleted.
288 * assembler/MacroAssemblerMIPS.h:
289 (JSC::MacroAssemblerMIPS::compareDouble): Deleted.
291 2018-05-02 Yusuke Suzuki <utatane.tea@gmail.com>
293 [JSC] Add MacroAssembler::and16 and store16
294 https://bugs.webkit.org/show_bug.cgi?id=185188
296 Reviewed by Mark Lam.
298 r231129 requires and16(ImplicitAddress, RegisterID) and store16(RegisterID, ImplicitAddress) implementations.
299 This patch adds these methods for ARM.
301 * assembler/MacroAssemblerARM.h:
302 (JSC::MacroAssemblerARM::and16):
303 (JSC::MacroAssemblerARM::store16):
305 2018-05-02 Yusuke Suzuki <utatane.tea@gmail.com>
307 [DFG] Unify compare related code in 32bit and 64bit
308 https://bugs.webkit.org/show_bug.cgi?id=185189
310 Reviewed by Mark Lam.
312 This patch unifies some part of compare related code in 32bit and 64bit
313 to reduce the size of 32bit specific DFG code.
315 * dfg/DFGSpeculativeJIT.cpp:
316 (JSC::DFG::SpeculativeJIT::compileInt32Compare):
317 (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
318 (JSC::DFG::SpeculativeJIT::compileObjectEquality):
319 * dfg/DFGSpeculativeJIT32_64.cpp:
320 (JSC::DFG::SpeculativeJIT::compileObjectEquality): Deleted.
321 (JSC::DFG::SpeculativeJIT::compileInt32Compare): Deleted.
322 (JSC::DFG::SpeculativeJIT::compileDoubleCompare): Deleted.
323 * dfg/DFGSpeculativeJIT64.cpp:
324 (JSC::DFG::SpeculativeJIT::compileObjectEquality): Deleted.
325 (JSC::DFG::SpeculativeJIT::compileInt32Compare): Deleted.
326 (JSC::DFG::SpeculativeJIT::compileDoubleCompare): Deleted.
328 2018-05-02 Yusuke Suzuki <utatane.tea@gmail.com>
330 [JSC] Add compareDouble and compareFloat for ARM64, X86, and X86_64
331 https://bugs.webkit.org/show_bug.cgi?id=185192
333 Reviewed by Mark Lam.
335 Now Object.is starts using compareDouble. So we would like to have
336 efficient implementation for compareDouble and compareFloat for
337 major architectures, ARM64, X86, and X86_64.
339 This patch adds compareDouble and compareFloat implementations for
340 these architectures. And generic implementation is moved to each
341 architecture's MacroAssembler implementation.
343 We also add tests for them in testmasm. To implement this test
344 easily, we also add loadFloat(TrustedImmPtr, FPRegisterID) for the
347 * assembler/MacroAssembler.h:
348 (JSC::MacroAssembler::compareDouble): Deleted.
349 (JSC::MacroAssembler::compareFloat): Deleted.
350 * assembler/MacroAssemblerARM.h:
351 (JSC::MacroAssemblerARM::compareDouble):
352 * assembler/MacroAssemblerARM64.h:
353 (JSC::MacroAssemblerARM64::compareDouble):
354 (JSC::MacroAssemblerARM64::compareFloat):
355 (JSC::MacroAssemblerARM64::loadFloat):
356 (JSC::MacroAssemblerARM64::floatingPointCompare):
357 * assembler/MacroAssemblerARMv7.h:
358 (JSC::MacroAssemblerARMv7::compareDouble):
359 * assembler/MacroAssemblerMIPS.h:
360 (JSC::MacroAssemblerMIPS::compareDouble):
361 * assembler/MacroAssemblerX86Common.h:
362 (JSC::MacroAssemblerX86Common::loadFloat):
363 (JSC::MacroAssemblerX86Common::compareDouble):
364 (JSC::MacroAssemblerX86Common::compareFloat):
365 (JSC::MacroAssemblerX86Common::floatingPointCompare):
366 * assembler/X86Assembler.h:
367 (JSC::X86Assembler::movss_mr):
368 (JSC::X86Assembler::movss_rm):
369 * assembler/testmasm.cpp:
370 (JSC::floatOperands):
371 (JSC::testCompareFloat):
374 2018-05-02 Yusuke Suzuki <utatane.tea@gmail.com>
376 Unreviewed, fix 32bit DFG code
377 https://bugs.webkit.org/show_bug.cgi?id=185065
379 * dfg/DFGSpeculativeJIT.cpp:
380 (JSC::DFG::SpeculativeJIT::compileSameValue):
382 2018-05-02 Filip Pizlo <fpizlo@apple.com>
384 JSC should know how to cache custom getter accesses on the prototype chain
385 https://bugs.webkit.org/show_bug.cgi?id=185213
387 Reviewed by Keith Miller.
389 This was a simple fix after the work I did for bug 185174. >4x speed-up on the new get-custom-getter.js test.
392 (JSC::tryCacheGetByID):
394 2018-05-01 Filip Pizlo <fpizlo@apple.com>
396 JSC should be able to cache custom setter calls on the prototype chain
397 https://bugs.webkit.org/show_bug.cgi?id=185174
399 Reviewed by Saam Barati.
401 We broke custom-setter-on-the-prototype-chain caching when we fixed a bug involving the conditionSet.isEmpty()
402 condition being used to determine if we have an alternateBase. The fix in r222671 incorrectly tried to add
403 impossible-to-validate conditions to the conditionSet by calling generateConditionsForPrototypePropertyHit() instead
404 of generateConditionsForPrototypePropertyHitCustom(). The problem is that the former function will always fail for
405 custom accessors because it won't find the custom property in the structure.
407 The fix is to add a virtual hasAlternateBase() function and use that instead of conditionSet.isEmpty().
409 This is a 4x speed-up on assign-custom-setter.js.
411 * bytecode/AccessCase.cpp:
412 (JSC::AccessCase::hasAlternateBase const):
413 (JSC::AccessCase::alternateBase const):
414 (JSC::AccessCase::generateImpl):
415 * bytecode/AccessCase.h:
416 (JSC::AccessCase::alternateBase const): Deleted.
417 * bytecode/GetterSetterAccessCase.cpp:
418 (JSC::GetterSetterAccessCase::hasAlternateBase const):
419 (JSC::GetterSetterAccessCase::alternateBase const):
420 * bytecode/GetterSetterAccessCase.h:
421 * bytecode/ObjectPropertyConditionSet.cpp:
422 (JSC::generateConditionsForPrototypePropertyHitCustom):
423 * bytecode/ObjectPropertyConditionSet.h:
425 (JSC::tryCacheGetByID):
426 (JSC::tryCachePutByID):
428 2018-05-02 Dominik Infuehr <dinfuehr@igalia.com>
430 [MIPS] Implement and16 and store16 for MacroAssemblerMIPS
431 https://bugs.webkit.org/show_bug.cgi?id=185195
433 Reviewed by Mark Lam.
435 This implements the given function for MIPS, such that it builds again.
437 * assembler/MacroAssemblerMIPS.h:
438 (JSC::MacroAssemblerMIPS::and16):
439 (JSC::MacroAssemblerMIPS::store16):
441 2018-05-02 Rick Waldron <waldron.rick@gmail.com>
443 Expose "$262.agent.monotonicNow()" for use in testing Atomic operation timeouts
444 https://bugs.webkit.org/show_bug.cgi?id=185043
446 Reviewed by Filip Pizlo.
449 (GlobalObject::finishCreation):
450 (functionDollarAgentMonotonicNow):
452 2018-05-02 Dominik Infuehr <dinfuehr@igalia.com>
454 [ARM] Implement and16 and store16 for MacroAssemblerARMv7
455 https://bugs.webkit.org/show_bug.cgi?id=185196
457 Reviewed by Mark Lam.
459 This implements and16 and store16 for MacroAssemblerARMv7 such that JSC builds again.
461 * assembler/MacroAssemblerARMv7.h:
462 (JSC::MacroAssemblerARMv7::and16):
463 (JSC::MacroAssemblerARMv7::store16):
465 2018-05-02 Robin Morisset <rmorisset@apple.com>
467 emitCodeToGetArgumentsArrayLength should not crash on PhantomNewArrayWithSpread
468 https://bugs.webkit.org/show_bug.cgi?id=183172
470 Reviewed by Filip Pizlo.
472 DFGArgumentsEliminationPhase.cpp currently believes that allocations of NewArrayWithSpread can be deleted if they are only used by GetArrayLength,
473 but when it then calls emitCodeToGetArgumentsArrayLength, the latter has no idea what to do with GetArrayLength.
475 I fix the problem by teaching emitCodeToGetArgumentsArrayLength how to deal with GetArrayLength.
476 Because this requires emitting an Add that can overflow and thus exit, we also tell DFGArgumentsEliminationPhase to give up on eliminating
477 a NewArrayWithSpread when it is used by a GetArrayLength that is not allowed to exit.
479 * dfg/DFGArgumentsEliminationPhase.cpp:
480 * dfg/DFGArgumentsUtilities.cpp:
481 (JSC::DFG::emitCodeToGetArgumentsArrayLength):
483 2018-05-02 Yusuke Suzuki <utatane.tea@gmail.com>
485 Unreviewed, stackPointer signature is different from declaration
486 https://bugs.webkit.org/show_bug.cgi?id=184790
488 * runtime/MachineContext.h:
489 (JSC::MachineContext::stackPointer):
491 2018-05-01 Yusuke Suzuki <utatane.tea@gmail.com>
493 [JSC] Add SameValue DFG node
494 https://bugs.webkit.org/show_bug.cgi?id=185065
496 Reviewed by Saam Barati.
498 This patch adds Object.is handling in DFG and FTL. Object.is is converted to SameValue DFG node.
499 And DFG fixup phase attempts to convert SameValue node to CompareStrictEq with type filter edges
500 if possible. Since SameValue(Untyped, Untyped) and SameValue(Double, Double) have different semantics
501 from CompareStrictEq, we do not convert SameValue to CompareStrictEq for them. DFG and FTL have
502 implementations for these SameValue nodes.
504 This old MacroAssemblerX86Common::compareDouble was dead code since the derived class, "MacroAssembler"
505 has a generalized compareDouble, which just uses branchDouble. Since this was not used, this function
506 was broken. This patch fixes issues and move compareDouble to MacroAssemblerX86Common, and remove a
507 generalized compareDouble for x86 arch to use this specialized efficient version instead. The fixes are
508 correctly using set32 to zero-extending the result, and setting the initial value of `dest` register
509 correctly for DoubleEqual and DoubleNotEqualOrUnordered cases.
511 Added microbenchmark shows performance improvement.
513 object-is 651.0053+-38.8204 ^ 241.3467+-15.8753 ^ definitely 2.6974x faster
515 * assembler/MacroAssembler.h:
516 * assembler/MacroAssemblerX86Common.h:
517 (JSC::MacroAssemblerX86Common::compareDouble):
518 * assembler/MacroAssemblerX86_64.h:
519 (JSC::MacroAssemblerX86_64::compareDouble): Deleted.
520 * assembler/testmasm.cpp:
521 (JSC::doubleOperands):
522 (JSC::testCompareDouble):
524 * dfg/DFGAbstractInterpreterInlines.h:
525 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
526 * dfg/DFGByteCodeParser.cpp:
527 (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
528 * dfg/DFGClobberize.h:
529 (JSC::DFG::clobberize):
530 * dfg/DFGConstantFoldingPhase.cpp:
531 (JSC::DFG::ConstantFoldingPhase::foldConstants):
534 * dfg/DFGFixupPhase.cpp:
535 (JSC::DFG::FixupPhase::fixupNode):
536 (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):
538 * dfg/DFGOperations.cpp:
539 * dfg/DFGOperations.h:
540 * dfg/DFGPredictionPropagationPhase.cpp:
541 * dfg/DFGSafeToExecute.h:
542 (JSC::DFG::safeToExecute):
543 * dfg/DFGSpeculativeJIT.cpp:
544 (JSC::DFG::SpeculativeJIT::compileSameValue):
545 * dfg/DFGSpeculativeJIT.h:
546 * dfg/DFGSpeculativeJIT32_64.cpp:
547 (JSC::DFG::SpeculativeJIT::compile):
548 * dfg/DFGSpeculativeJIT64.cpp:
549 (JSC::DFG::SpeculativeJIT::compile):
550 * dfg/DFGValidate.cpp:
551 * ftl/FTLCapabilities.cpp:
552 (JSC::FTL::canCompile):
553 * ftl/FTLLowerDFGToB3.cpp:
554 (JSC::FTL::DFG::LowerDFGToB3::compileNode):
555 (JSC::FTL::DFG::LowerDFGToB3::compileSameValue):
556 * runtime/Intrinsic.cpp:
557 (JSC::intrinsicName):
558 * runtime/Intrinsic.h:
559 * runtime/ObjectConstructor.cpp:
561 2018-04-30 Filip Pizlo <fpizlo@apple.com>
563 B3::demoteValues should be able to handle patchpoint terminals
564 https://bugs.webkit.org/show_bug.cgi?id=185151
566 Reviewed by Saam Barati.
568 If we try to demote a patchpoint terminal then prior to this change we would append a Set to
569 the basic block that the patchpoint terminated. That's wrong because then the terminal is no
570 longer the last thing in the block.
572 Air encounters this problem in spilling and solves it by doing a fixup afterwards. We can't
573 really do that because demotion happens as a prerequisite to other transformations.
575 One solution might have been to make demoteValues insert a basic block whenever it encounters
576 this problem. But that would break clients that do CFG analysis before demoteValues and use
577 the results of the CFG analysis after demoteValues. Taildup does this. Fortunately, taildup
578 also runs breakCriticalEdges. Probably anyone using demoteValues will use breakCriticalEdges,
579 so it's not bad to introduce that requirement.
581 So, this patch solves the problem by ensuring that breakCriticalEdges treats any patchpoint
582 terminal as if it had multiple successors. This means that a patchpoint terminal's successors
583 will only have it as their predecessor. Then, demoteValues just prepends the Set to the
584 successors of the patchpoint terminal.
586 This was probably asymptomatic. It's hard to write a JS test that triggers this, so I added
587 a unit test in testb3.
589 * b3/B3BreakCriticalEdges.cpp:
590 (JSC::B3::breakCriticalEdges):
591 * b3/B3BreakCriticalEdges.h:
593 (JSC::B3::demoteValues):
597 (JSC::B3::Value::foldIdentity const):
598 (JSC::B3::Value::performSubstitution):
601 (JSC::B3::testDemotePatchpointTerminal):
604 2018-05-01 Robin Morisset <rmorisset@apple.com>
606 Use CheckedArithmetic for length computation in JSArray::unshiftCountWithAnyIndexingType
607 https://bugs.webkit.org/show_bug.cgi?id=184772
608 <rdar://problem/39146327>
610 Reviewed by Filip Pizlo.
612 Related to https://bugs.webkit.org/show_bug.cgi?id=183657 (<rdar://problem/38464399), where a check was missing.
613 This patch now makes sure that the check correctly detects if there is an integer overflow.
615 * runtime/JSArray.cpp:
616 (JSC::JSArray::unshiftCountWithAnyIndexingType):
618 2018-05-01 Robin Morisset <rmorisset@apple.com>
620 Correctly detect string overflow when using the 'Function' constructor
621 https://bugs.webkit.org/show_bug.cgi?id=184883
622 <rdar://problem/36320331>
624 Reviewed by Filip Pizlo.
626 The 'Function' constructor creates a string containing the source code of the new function through repeated string concatenation.
627 Because there was no way for the string concatenation routines in WTF to return an error, they just crashed in that case.
629 I added new tryAppend methods alongside the old append methods, that return a boolean (true means success, false means an overflow happened).
630 In this way, it becomes possible for the Function constructor to just throw a proper JS exception when asked to create a string > 4GB.
631 I made new methods instead of just adapting the existing ones (and reverted such a change on appendQuotedJSONString) so that callers that rely on the old behaviour (a hard CRASH() on overflow) don't silently start failing.
633 * runtime/FunctionConstructor.cpp:
634 (JSC::constructFunctionSkippingEvalEnabledCheck):
635 * runtime/JSONObject.cpp:
636 (JSC::Stringifier::appendStringifiedValue):
638 2018-05-01 Robin Morisset <rmorisset@apple.com>
640 IntlObject.cpp::removeUnicodeLocaleExtension() should not touch locales that end in '-u'
641 https://bugs.webkit.org/show_bug.cgi?id=185162
643 Reviewed by Filip Pizlo.
645 * runtime/IntlObject.cpp:
646 (JSC::removeUnicodeLocaleExtension):
648 2018-05-01 Dominik Infuehr <dinfuehr@igalia.com>
650 Add SetCallee as DFG-Operation
651 https://bugs.webkit.org/show_bug.cgi?id=184582
653 Reviewed by Filip Pizlo.
655 For recursive tail calls not only the argument count can change but also the
656 callee. Add SetCallee to DFG that sets the callee slot in the current call frame.
657 Also update the callee when optimizing a recursive tail call.
658 Enable recursive tail call optimization also for closures.
660 * dfg/DFGAbstractInterpreterInlines.h:
661 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
662 * dfg/DFGByteCodeParser.cpp:
663 (JSC::DFG::ByteCodeParser::handleRecursiveTailCall):
664 (JSC::DFG::ByteCodeParser::handleCallVariant):
665 * dfg/DFGClobberize.h:
666 (JSC::DFG::clobberize):
669 * dfg/DFGFixupPhase.cpp:
670 (JSC::DFG::FixupPhase::fixupNode):
671 * dfg/DFGMayExit.cpp:
673 * dfg/DFGPredictionPropagationPhase.cpp:
674 * dfg/DFGSafeToExecute.h:
675 (JSC::DFG::safeToExecute):
676 * dfg/DFGSpeculativeJIT.cpp:
677 (JSC::DFG::SpeculativeJIT::compileSetCallee):
678 * dfg/DFGSpeculativeJIT.h:
679 * dfg/DFGSpeculativeJIT32_64.cpp:
680 (JSC::DFG::SpeculativeJIT::compile):
681 * dfg/DFGSpeculativeJIT64.cpp:
682 (JSC::DFG::SpeculativeJIT::compile):
683 * ftl/FTLCapabilities.cpp:
684 (JSC::FTL::canCompile):
685 * ftl/FTLLowerDFGToB3.cpp:
686 (JSC::FTL::DFG::LowerDFGToB3::compileNode):
687 (JSC::FTL::DFG::LowerDFGToB3::compileSetCallee):
689 2018-05-01 Oleksandr Skachkov <gskachkov@gmail.com>
691 WebAssembly: add support for stream APIs - JavaScript API
692 https://bugs.webkit.org/show_bug.cgi?id=183442
694 Reviewed by Yusuke Suzuki and JF Bastien.
696 Add WebAssembly stream API. Current patch only add functions
697 WebAssembly.compileStreaming and WebAssembly.instantiateStreaming but,
698 does not add streaming way of the implementation. So in current version it
699 only wait for load whole module, than start to parse.
702 * Configurations/FeatureDefines.xcconfig:
703 * DerivedSources.make:
704 * JavaScriptCore.xcodeproj/project.pbxproj:
705 * builtins/BuiltinNames.h:
706 * builtins/WebAssemblyPrototype.js: Copied from Source/JavaScriptCore/wasm/js/WebAssemblyPrototype.h.
708 (instantiateStreaming):
710 * runtime/JSGlobalObject.cpp:
711 (JSC::JSGlobalObject::init):
712 * runtime/JSGlobalObject.h:
714 * runtime/PromiseDeferredTimer.cpp:
715 (JSC::PromiseDeferredTimer::hasPendingPromise):
716 (JSC::PromiseDeferredTimer::hasDependancyInPendingPromise):
717 * runtime/PromiseDeferredTimer.h:
718 * wasm/js/WebAssemblyPrototype.cpp:
719 (JSC::webAssemblyModuleValidateAsyncInternal):
720 (JSC::webAssemblyCompileFunc):
721 (JSC::WebAssemblyPrototype::webAssemblyModuleValidateAsync):
722 (JSC::webAssemblyModuleInstantinateAsyncInternal):
723 (JSC::WebAssemblyPrototype::webAssemblyModuleInstantinateAsync):
724 (JSC::webAssemblyCompileStreamingInternal):
725 (JSC::webAssemblyInstantiateStreamingInternal):
726 (JSC::WebAssemblyPrototype::create):
727 (JSC::WebAssemblyPrototype::finishCreation):
728 * wasm/js/WebAssemblyPrototype.h:
730 2018-04-30 Saam Barati <sbarati@apple.com>
732 ToString constant folds without preserving checks, causing us to break assumptions that the code would OSR exit
733 https://bugs.webkit.org/show_bug.cgi?id=185149
734 <rdar://problem/39455917>
736 Reviewed by Filip Pizlo.
738 The bug was that we were deleting checks that we shouldn't have deleted.
739 This patch makes a helper inside strength reduction that converts to
740 a LazyJSConstant while maintaining checks, and switches users of the
741 node API inside strength reduction to instead call the helper function.
743 This patch also fixes a potential bug where StringReplace and
744 StringReplaceRegExp may not preserve all their checks.
747 * dfg/DFGStrengthReductionPhase.cpp:
748 (JSC::DFG::StrengthReductionPhase::handleNode):
749 (JSC::DFG::StrengthReductionPhase::convertToLazyJSValue):
751 2018-04-29 Filip Pizlo <fpizlo@apple.com>
753 LICM shouldn't hoist nodes if hoisted nodes exited in that code block
754 https://bugs.webkit.org/show_bug.cgi?id=185126
756 Reviewed by Saam Barati.
758 This change is just restoring functionality that we've already had for a while. It had been
759 accidentally broken due to an unrelated CodeBlock refactoring.
761 * dfg/DFGLICMPhase.cpp:
762 (JSC::DFG::LICMPhase::attemptHoist):
764 2018-04-30 Mark Lam <mark.lam@apple.com>
766 Apply PtrTags to the MetaAllocator and friends.
767 https://bugs.webkit.org/show_bug.cgi?id=185110
768 <rdar://problem/39533895>
770 Reviewed by Saam Barati.
772 1. LinkBuffer now takes a MacroAssemblerCodePtr instead of a void* pointer.
773 2. Apply pointer tagging to the boundary pointers of the FixedExecutableMemoryPool,
774 and add a sanity check to verify that allocated code buffers are within those
777 * assembler/LinkBuffer.cpp:
778 (JSC::LinkBuffer::finalizeCodeWithoutDisassemblyImpl):
779 (JSC::LinkBuffer::copyCompactAndLinkCode):
780 (JSC::LinkBuffer::linkCode):
781 (JSC::LinkBuffer::allocate):
782 * assembler/LinkBuffer.h:
783 (JSC::LinkBuffer::LinkBuffer):
784 (JSC::LinkBuffer::debugAddress):
785 (JSC::LinkBuffer::code):
786 * assembler/MacroAssemblerCodeRef.h:
787 (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
788 * bytecode/InlineAccess.cpp:
789 (JSC::linkCodeInline):
790 (JSC::InlineAccess::rewireStubAsJump):
791 * dfg/DFGJITCode.cpp:
792 (JSC::DFG::JITCode::findPC):
793 * ftl/FTLJITCode.cpp:
794 (JSC::FTL::JITCode::findPC):
795 * jit/ExecutableAllocator.cpp:
796 (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
797 (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
798 (JSC::ExecutableAllocator::allocate):
799 * jit/ExecutableAllocator.h:
801 (JSC::performJITMemcpy):
805 (JSC::isProfileEmpty):
806 * runtime/JSCPtrTag.h:
807 * wasm/WasmCallee.cpp:
808 (JSC::Wasm::Callee::Callee):
809 * wasm/WasmFaultSignalHandler.cpp:
810 (JSC::Wasm::trapHandler):
812 2018-04-30 Keith Miller <keith_miller@apple.com>
814 Move the MayBePrototype JSCell header bit to InlineTypeFlags
815 https://bugs.webkit.org/show_bug.cgi?id=185143
817 Reviewed by Mark Lam.
819 * runtime/IndexingType.h:
820 * runtime/JSCellInlines.h:
821 (JSC::JSCell::setStructure):
822 (JSC::JSCell::mayBePrototype const):
823 (JSC::JSCell::didBecomePrototype):
824 * runtime/JSTypeInfo.h:
825 (JSC::TypeInfo::mayBePrototype):
826 (JSC::TypeInfo::mergeInlineTypeFlags):
828 2018-04-30 Keith Miller <keith_miller@apple.com>
830 Remove unneeded exception check from String.fromCharCode
831 https://bugs.webkit.org/show_bug.cgi?id=185083
833 Reviewed by Mark Lam.
835 * runtime/StringConstructor.cpp:
836 (JSC::stringFromCharCode):
838 2018-04-30 Keith Miller <keith_miller@apple.com>
840 Move StructureIsImmortal to out of line flags.
841 https://bugs.webkit.org/show_bug.cgi?id=185101
843 Reviewed by Saam Barati.
845 This will free up a bit in the inline flags where we can move the
846 isPrototype bit to. This will, in turn, free a bit for use in
847 implementing copy on write butterflies.
849 Also, this patch removes an assertion from Structure::typeInfo()
850 that inadvertently makes the function invalid to call while
853 * heap/HeapCellType.cpp:
854 (JSC::DefaultDestroyFunc::operator() const):
856 * runtime/JSCellInlines.h:
857 (JSC::JSCell::callDestructor): Deleted.
858 * runtime/JSTypeInfo.h:
859 (JSC::TypeInfo::hasStaticPropertyTable):
860 (JSC::TypeInfo::structureIsImmortal const):
861 * runtime/Structure.h:
863 2018-04-30 Yusuke Suzuki <utatane.tea@gmail.com>
865 [JSC] Remove arity fixup check if the number of parameters is 1
866 https://bugs.webkit.org/show_bug.cgi?id=183984
868 Reviewed by Mark Lam.
870 If the number of parameters is one (|this|), we never hit arity fixup check.
871 We do not need to emit arity fixup check code.
874 (JSC::DFG::compileImpl):
875 * dfg/DFGJITCompiler.cpp:
876 (JSC::DFG::JITCompiler::compileFunction):
877 * dfg/DFGJITCompiler.h:
881 (JSC::JIT::compileWithoutLinking):
883 2018-04-30 Yusuke Suzuki <utatane.tea@gmail.com>
885 Use WordLock instead of std::mutex for Threading
886 https://bugs.webkit.org/show_bug.cgi?id=185121
888 Reviewed by Geoffrey Garen.
890 ThreadGroup starts using WordLock.
892 * heap/MachineStackMarker.h:
893 (JSC::MachineThreads::getLock):
895 2018-04-29 Filip Pizlo <fpizlo@apple.com>
897 B3 should run tail duplication at the bitter end
898 https://bugs.webkit.org/show_bug.cgi?id=185123
900 Reviewed by Geoffrey Garen.
902 Also added an option to disable taildup. This appears to be a 1% AsmBench speed-up. It's neutral
905 The goal of this change is to allow us to run path specialization after switch lowering but
906 before tail duplication.
909 (JSC::B3::generateToAir):
912 2018-04-29 Commit Queue <commit-queue@webkit.org>
914 Unreviewed, rolling out r231137.
915 https://bugs.webkit.org/show_bug.cgi?id=185118
917 It is breaking Test262 language/expressions/multiplication
918 /order-of-evaluation.js (Requested by caiolima on #webkit).
922 "[ESNext][BigInt] Implement support for "*" operation"
923 https://bugs.webkit.org/show_bug.cgi?id=183721
924 https://trac.webkit.org/changeset/231137
926 2018-04-28 Saam Barati <sbarati@apple.com>
928 We don't model regexp effects properly
929 https://bugs.webkit.org/show_bug.cgi?id=185059
930 <rdar://problem/39736150>
932 Reviewed by Filip Pizlo.
934 RegExp exec/test can do arbitrary effects when toNumbering the lastIndex if
935 the regexp is global.
937 * dfg/DFGAbstractInterpreterInlines.h:
938 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
939 * dfg/DFGClobberize.h:
940 (JSC::DFG::clobberize):
942 2018-04-28 Rick Waldron <waldron.rick@gmail.com>
944 Token misspelled "tocken" in error message string
945 https://bugs.webkit.org/show_bug.cgi?id=185030
947 Reviewed by Saam Barati.
949 * parser/Parser.cpp: Fix typo "tocken" => "token" in SyntaxError message string
950 (JSC::Parser<LexerType>::Parser):
951 (JSC::Parser<LexerType>::didFinishParsing):
952 (JSC::Parser<LexerType>::parseSourceElements):
953 (JSC::Parser<LexerType>::parseAsyncGeneratorFunctionSourceElements):
954 (JSC::Parser<LexerType>::parseVariableDeclaration):
955 (JSC::Parser<LexerType>::parseWhileStatement):
956 (JSC::Parser<LexerType>::parseVariableDeclarationList):
957 (JSC::Parser<LexerType>::createBindingPattern):
958 (JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBodySourceElements):
959 (JSC::Parser<LexerType>::parseObjectRestElement):
960 (JSC::Parser<LexerType>::parseDestructuringPattern):
961 (JSC::Parser<LexerType>::parseForStatement):
962 (JSC::Parser<LexerType>::parseBreakStatement):
963 (JSC::Parser<LexerType>::parseContinueStatement):
964 (JSC::Parser<LexerType>::parseThrowStatement):
965 (JSC::Parser<LexerType>::parseWithStatement):
966 (JSC::Parser<LexerType>::parseSwitchStatement):
967 (JSC::Parser<LexerType>::parseSwitchClauses):
968 (JSC::Parser<LexerType>::parseTryStatement):
969 (JSC::Parser<LexerType>::parseBlockStatement):
970 (JSC::Parser<LexerType>::parseFormalParameters):
971 (JSC::Parser<LexerType>::parseFunctionParameters):
972 (JSC::Parser<LexerType>::parseFunctionInfo):
973 (JSC::Parser<LexerType>::parseExpressionOrLabelStatement):
974 (JSC::Parser<LexerType>::parseExpressionStatement):
975 (JSC::Parser<LexerType>::parseIfStatement):
976 (JSC::Parser<LexerType>::parseAssignmentExpression):
977 (JSC::Parser<LexerType>::parseConditionalExpression):
978 (JSC::Parser<LexerType>::parseBinaryExpression):
979 (JSC::Parser<LexerType>::parseObjectLiteral):
980 (JSC::Parser<LexerType>::parseStrictObjectLiteral):
981 (JSC::Parser<LexerType>::parseArrayLiteral):
982 (JSC::Parser<LexerType>::parseArguments):
983 (JSC::Parser<LexerType>::parseMemberExpression):
984 (JSC::operatorString):
985 (JSC::Parser<LexerType>::parseUnaryExpression):
986 (JSC::Parser<LexerType>::printUnexpectedTokenText):
988 2018-04-28 Caio Lima <ticaiolima@gmail.com>
990 [ESNext][BigInt] Implement support for "*" operation
991 https://bugs.webkit.org/show_bug.cgi?id=183721
993 Reviewed by Saam Barati.
995 Added BigInt support into times binary operator into LLInt and on
996 JITOperations profiledMul and unprofiledMul. We are also replacing all
997 uses of int to unsigned when there is no negative values for
1000 * dfg/DFGConstantFoldingPhase.cpp:
1001 (JSC::DFG::ConstantFoldingPhase::foldConstants):
1002 * jit/JITOperations.cpp:
1003 * runtime/CommonSlowPaths.cpp:
1004 (JSC::SLOW_PATH_DECL):
1005 * runtime/JSBigInt.cpp:
1006 (JSC::JSBigInt::JSBigInt):
1007 (JSC::JSBigInt::allocationSize):
1008 (JSC::JSBigInt::createWithLength):
1009 (JSC::JSBigInt::toString):
1010 (JSC::JSBigInt::multiply):
1011 (JSC::JSBigInt::digitDiv):
1012 (JSC::JSBigInt::internalMultiplyAdd):
1013 (JSC::JSBigInt::multiplyAccumulate):
1014 (JSC::JSBigInt::equals):
1015 (JSC::JSBigInt::absoluteDivSmall):
1016 (JSC::JSBigInt::calculateMaximumCharactersRequired):
1017 (JSC::JSBigInt::toStringGeneric):
1018 (JSC::JSBigInt::rightTrim):
1019 (JSC::JSBigInt::allocateFor):
1020 (JSC::JSBigInt::parseInt):
1021 (JSC::JSBigInt::digit):
1022 (JSC::JSBigInt::setDigit):
1023 * runtime/JSBigInt.h:
1024 * runtime/Operations.h:
1027 2018-04-28 Commit Queue <commit-queue@webkit.org>
1029 Unreviewed, rolling out r231131.
1030 https://bugs.webkit.org/show_bug.cgi?id=185112
1032 It is breaking Debug build due to unchecked exception
1033 (Requested by caiolima on #webkit).
1037 "[ESNext][BigInt] Implement support for "*" operation"
1038 https://bugs.webkit.org/show_bug.cgi?id=183721
1039 https://trac.webkit.org/changeset/231131
1041 2018-04-27 Caio Lima <ticaiolima@gmail.com>
1043 [ESNext][BigInt] Implement support for "*" operation
1044 https://bugs.webkit.org/show_bug.cgi?id=183721
1046 Reviewed by Saam Barati.
1048 Added BigInt support into times binary operator into LLInt and on
1049 JITOperations profiledMul and unprofiledMul. We are also replacing all
1050 uses of int to unsigned when there is no negative values for
1053 * dfg/DFGConstantFoldingPhase.cpp:
1054 (JSC::DFG::ConstantFoldingPhase::foldConstants):
1055 * jit/JITOperations.cpp:
1056 * runtime/CommonSlowPaths.cpp:
1057 (JSC::SLOW_PATH_DECL):
1058 * runtime/JSBigInt.cpp:
1059 (JSC::JSBigInt::JSBigInt):
1060 (JSC::JSBigInt::allocationSize):
1061 (JSC::JSBigInt::createWithLength):
1062 (JSC::JSBigInt::toString):
1063 (JSC::JSBigInt::multiply):
1064 (JSC::JSBigInt::digitDiv):
1065 (JSC::JSBigInt::internalMultiplyAdd):
1066 (JSC::JSBigInt::multiplyAccumulate):
1067 (JSC::JSBigInt::equals):
1068 (JSC::JSBigInt::absoluteDivSmall):
1069 (JSC::JSBigInt::calculateMaximumCharactersRequired):
1070 (JSC::JSBigInt::toStringGeneric):
1071 (JSC::JSBigInt::rightTrim):
1072 (JSC::JSBigInt::allocateFor):
1073 (JSC::JSBigInt::parseInt):
1074 (JSC::JSBigInt::digit):
1075 (JSC::JSBigInt::setDigit):
1076 * runtime/JSBigInt.h:
1077 * runtime/Operations.h:
1080 2018-04-27 JF Bastien <jfbastien@apple.com>
1082 Make the first 64 bits of JSString look like a double JSValue
1083 https://bugs.webkit.org/show_bug.cgi?id=185081
1085 Reviewed by Filip Pizlo.
1087 We can be clever about how we lay out JSString so that, were it
1088 reinterpreted as a JSValue, it would look like a double.
1090 * assembler/MacroAssemblerX86Common.h:
1091 (JSC::MacroAssemblerX86Common::and16):
1092 * assembler/X86Assembler.h:
1093 (JSC::X86Assembler::andw_mr):
1094 * dfg/DFGSpeculativeJIT.cpp:
1095 (JSC::DFG::SpeculativeJIT::compileMakeRope):
1096 * ftl/FTLLowerDFGToB3.cpp:
1097 (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
1099 (JSC::FTL::Output::store32As8):
1100 (JSC::FTL::Output::store32As16):
1101 * runtime/JSString.h:
1102 (JSC::JSString::JSString):
1104 2018-04-27 Yusuke Suzuki <utatane.tea@gmail.com>
1106 [JSC][ARM64][Linux] Add collectCPUFeatures using auxiliary vector
1107 https://bugs.webkit.org/show_bug.cgi?id=185055
1109 Reviewed by JF Bastien.
1111 This patch is paving the way to emitting jscvt instruction if possible.
1112 To do that, we need to determine jscvt instruction is supported in the
1115 We add a function collectCPUFeatures, which is responsible to collect
1116 CPU features if necessary. In Linux, we can use auxiliary vector to get
1117 the information without parsing /proc/cpuinfo.
1119 Currently, nobody calls this function. It is later called when we emit
1120 jscvt instruction. To make it possible, we also need to add disassembler
1123 * assembler/AbstractMacroAssembler.h:
1124 * assembler/MacroAssemblerARM64.cpp:
1125 (JSC::MacroAssemblerARM64::collectCPUFeatures):
1126 * assembler/MacroAssemblerARM64.h:
1127 * assembler/MacroAssemblerX86Common.h:
1129 2018-04-26 Filip Pizlo <fpizlo@apple.com>
1131 Also run foldPathConstants before mussing up SSA
1132 https://bugs.webkit.org/show_bug.cgi?id=185069
1134 Reviewed by Saam Barati.
1136 This isn't needed now, but will be once I implement the phase in bug 185060.
1138 This could be a speed-up, or a slow-down, independent of that phase. Most likely it's neutral.
1139 Local testing seems to suggest that it's neutral. Anyway, whatever it ends up being, I want it to
1140 be landed separately and measured separately from that phase.
1142 It's probably nice for sanity to have this and reduceStrength run before tail duplication and
1143 another round of reduceStrength, since that make for something that is closer to a fixpoint. But
1144 it will increase FTL compile times. So, there's no way to guess if this change is good, bad, or
1145 neutral. It all depends on what programs typically look like.
1147 * b3/B3Generate.cpp:
1148 (JSC::B3::generateToAir):
1150 2018-04-27 Ryan Haddad <ryanhaddad@apple.com>
1152 Unreviewed, rolling out r231086.
1154 Caused JSC test failures due to an unchecked exception.
1158 "[ESNext][BigInt] Implement support for "*" operation"
1159 https://bugs.webkit.org/show_bug.cgi?id=183721
1160 https://trac.webkit.org/changeset/231086
1162 2018-04-26 Caio Lima <ticaiolima@gmail.com>
1164 [ESNext][BigInt] Implement support for "*" operation
1165 https://bugs.webkit.org/show_bug.cgi?id=183721
1167 Reviewed by Saam Barati.
1169 Added BigInt support into times binary operator into LLInt and on
1170 JITOperations profiledMul and unprofiledMul. We are also replacing all
1171 uses of int to unsigned when there is no negative values for
1174 * dfg/DFGConstantFoldingPhase.cpp:
1175 (JSC::DFG::ConstantFoldingPhase::foldConstants):
1176 * jit/JITOperations.cpp:
1177 * runtime/CommonSlowPaths.cpp:
1178 (JSC::SLOW_PATH_DECL):
1179 * runtime/JSBigInt.cpp:
1180 (JSC::JSBigInt::JSBigInt):
1181 (JSC::JSBigInt::allocationSize):
1182 (JSC::JSBigInt::createWithLength):
1183 (JSC::JSBigInt::toString):
1184 (JSC::JSBigInt::multiply):
1185 (JSC::JSBigInt::digitDiv):
1186 (JSC::JSBigInt::internalMultiplyAdd):
1187 (JSC::JSBigInt::multiplyAccumulate):
1188 (JSC::JSBigInt::equals):
1189 (JSC::JSBigInt::absoluteDivSmall):
1190 (JSC::JSBigInt::calculateMaximumCharactersRequired):
1191 (JSC::JSBigInt::toStringGeneric):
1192 (JSC::JSBigInt::rightTrim):
1193 (JSC::JSBigInt::allocateFor):
1194 (JSC::JSBigInt::parseInt):
1195 (JSC::JSBigInt::digit):
1196 (JSC::JSBigInt::setDigit):
1197 * runtime/JSBigInt.h:
1198 * runtime/Operations.h:
1201 2018-04-26 Mark Lam <mark.lam@apple.com>
1203 Gardening: Speculative build fix for Windows.
1204 https://bugs.webkit.org/show_bug.cgi?id=184976
1205 <rdar://problem/39723901>
1209 * runtime/JSCPtrTag.h:
1211 2018-04-26 Mark Lam <mark.lam@apple.com>
1213 Gardening: Windows build fix.
1217 * runtime/Options.cpp:
1219 2018-04-26 Jer Noble <jer.noble@apple.com>
1221 WK_COCOA_TOUCH all the things.
1222 https://bugs.webkit.org/show_bug.cgi?id=185006
1223 <rdar://problem/39736025>
1225 Reviewed by Tim Horton.
1227 * Configurations/Base.xcconfig:
1229 2018-04-26 Per Arne Vollan <pvollan@apple.com>
1231 Disable content filtering in minimal simulator mode
1232 https://bugs.webkit.org/show_bug.cgi?id=185027
1233 <rdar://problem/39736091>
1235 Reviewed by Jer Noble.
1237 * Configurations/FeatureDefines.xcconfig:
1239 2018-04-26 Andy VanWagoner <thetalecrafter@gmail.com>
1241 [INTL] Implement Intl.PluralRules
1242 https://bugs.webkit.org/show_bug.cgi?id=184312
1244 Reviewed by JF Bastien.
1246 Use UNumberFormat to enforce formatting, and then UPluralRules to find
1247 the correct plural rule for the given number. Relies on ICU v59+ for
1248 resolvedOptions().pluralCategories and trailing 0 detection.
1249 Behind the useIntlPluralRules option and INTL_PLURAL_RULES flag.
1252 * Configurations/FeatureDefines.xcconfig:
1253 * DerivedSources.make:
1254 * JavaScriptCore.xcodeproj/project.pbxproj:
1256 * builtins/BuiltinNames.h:
1257 * runtime/BigIntObject.cpp:
1258 (JSC::BigIntObject::create): Moved to ensure complete JSGlobalObject definition.
1259 * runtime/BigIntObject.h:
1260 * runtime/CommonIdentifiers.h:
1261 * runtime/IntlObject.cpp:
1262 (JSC::IntlObject::finishCreation):
1263 * runtime/IntlObject.h:
1264 * runtime/IntlPluralRules.cpp: Added.
1265 (JSC::IntlPluralRules::UPluralRulesDeleter::operator() const):
1266 (JSC::IntlPluralRules::UNumberFormatDeleter::operator() const):
1267 (JSC::UEnumerationDeleter::operator() const):
1268 (JSC::IntlPluralRules::create):
1269 (JSC::IntlPluralRules::createStructure):
1270 (JSC::IntlPluralRules::IntlPluralRules):
1271 (JSC::IntlPluralRules::finishCreation):
1272 (JSC::IntlPluralRules::destroy):
1273 (JSC::IntlPluralRules::visitChildren):
1274 (JSC::IntlPRInternal::localeData):
1275 (JSC::IntlPluralRules::initializePluralRules):
1276 (JSC::IntlPluralRules::resolvedOptions):
1277 (JSC::IntlPluralRules::select):
1278 * runtime/IntlPluralRules.h: Added.
1279 * runtime/IntlPluralRulesConstructor.cpp: Added.
1280 (JSC::IntlPluralRulesConstructor::create):
1281 (JSC::IntlPluralRulesConstructor::createStructure):
1282 (JSC::IntlPluralRulesConstructor::IntlPluralRulesConstructor):
1283 (JSC::IntlPluralRulesConstructor::finishCreation):
1284 (JSC::constructIntlPluralRules):
1285 (JSC::callIntlPluralRules):
1286 (JSC::IntlPluralRulesConstructorFuncSupportedLocalesOf):
1287 (JSC::IntlPluralRulesConstructor::visitChildren):
1288 * runtime/IntlPluralRulesConstructor.h: Added.
1289 * runtime/IntlPluralRulesPrototype.cpp: Added.
1290 (JSC::IntlPluralRulesPrototype::create):
1291 (JSC::IntlPluralRulesPrototype::createStructure):
1292 (JSC::IntlPluralRulesPrototype::IntlPluralRulesPrototype):
1293 (JSC::IntlPluralRulesPrototype::finishCreation):
1294 (JSC::IntlPluralRulesPrototypeFuncSelect):
1295 (JSC::IntlPluralRulesPrototypeFuncResolvedOptions):
1296 * runtime/IntlPluralRulesPrototype.h: Added.
1297 * runtime/JSGlobalObject.cpp:
1298 (JSC::JSGlobalObject::init):
1299 (JSC::JSGlobalObject::intlPluralRulesAvailableLocales):
1300 * runtime/JSGlobalObject.h:
1301 * runtime/Options.h:
1302 * runtime/RegExpPrototype.cpp: Added inlines header.
1307 2018-04-26 Dominik Infuehr <dinfuehr@igalia.com>
1309 [MIPS] Fix branch offsets in branchNeg32
1310 https://bugs.webkit.org/show_bug.cgi?id=185025
1312 Reviewed by Yusuke Suzuki.
1314 Two nops were removed in branch(Not)Equal in #183130 but the offset wasn't adjusted.
1316 * assembler/MacroAssemblerMIPS.h:
1317 (JSC::MacroAssemblerMIPS::branchNeg32):
1319 2018-04-25 Robin Morisset <rmorisset@apple.com>
1321 In FTLLowerDFGToB3.cpp::compileCreateRest, always use a contiguous array as the indexing type when under isWatchingHavingABadTimeWatchpoint
1322 https://bugs.webkit.org/show_bug.cgi?id=184773
1323 <rdar://problem/37773612>
1325 Reviewed by Filip Pizlo.
1327 We were calling restParameterStructure(), which returns arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous).
1328 arrayStructureForIndexingTypeDuringAllocation uses m_arrayStructureForIndexingShapeDuringAllocation, which is set to SlowPutArrayStorage when we are 'having a bad time'.
1329 This is problematic, because the structure is then passed to allocateUninitializedContiguousJSArray, which ASSERTs that the indexing type is contiguous (or int32).
1330 We solve the problem by using originalArrayStructureForIndexingType which always returns a structure with the right indexing type (contiguous), even if we are having a bad time.
1331 This is safe, as we are under isWatchingHavingABadTimeWatchpoint, so if we have a bad time, the code we generate will never be installed.
1333 * ftl/FTLLowerDFGToB3.cpp:
1334 (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
1336 2018-04-25 Mark Lam <mark.lam@apple.com>
1338 Push the definition of PtrTag down to the WTF layer.
1339 https://bugs.webkit.org/show_bug.cgi?id=184976
1340 <rdar://problem/39723901>
1342 Reviewed by Saam Barati.
1345 * JavaScriptCore.xcodeproj/project.pbxproj:
1346 * assembler/ARM64Assembler.h:
1347 * assembler/AbstractMacroAssembler.h:
1348 * assembler/MacroAssemblerCodeRef.cpp:
1349 * assembler/MacroAssemblerCodeRef.h:
1350 * b3/B3MathExtras.cpp:
1351 * bytecode/LLIntCallLinkInfo.h:
1352 * disassembler/Disassembler.h:
1353 * ftl/FTLJITCode.cpp:
1354 * interpreter/InterpreterInlines.h:
1355 * jit/ExecutableAllocator.h:
1356 * jit/JITOperations.cpp:
1357 * jit/ThunkGenerator.h:
1358 * jit/ThunkGenerators.h:
1359 * llint/LLIntOffsetsExtractor.cpp:
1360 * llint/LLIntPCRanges.h:
1361 * runtime/JSCPtrTag.h: Added.
1362 * runtime/NativeFunction.h:
1363 * runtime/PtrTag.h: Removed.
1364 * runtime/VMTraps.cpp:
1366 2018-04-25 Keith Miller <keith_miller@apple.com>
1368 getUnlinkedGlobalFunctionExecutable should only save things to the code cache if the option is set
1369 https://bugs.webkit.org/show_bug.cgi?id=184998
1371 Reviewed by Saam Barati.
1373 * runtime/CodeCache.cpp:
1374 (JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):
1376 2018-04-25 Keith Miller <keith_miller@apple.com>
1378 Add missing scope release to functionProtoFuncToString
1379 https://bugs.webkit.org/show_bug.cgi?id=184995
1381 Reviewed by Saam Barati.
1383 * runtime/FunctionPrototype.cpp:
1384 (JSC::functionProtoFuncToString):
1386 2018-04-25 Yusuke Suzuki <utatane.tea@gmail.com>
1388 REGRESSION(r230748) [GTK][ARM] no matching function for call to 'JSC::CCallHelpers::swap(JSC::ARMRegisters::FPRegisterID&, JSC::ARMRegisters::FPRegisterID&)'
1389 https://bugs.webkit.org/show_bug.cgi?id=184730
1391 Reviewed by Mark Lam.
1393 Add swap(FPRegisterID, FPRegisterID) implementation using ARMRegisters::SD0 (temporary register in MacroAssemblerARM).
1394 And we now use dataTempRegister, addressTempRegister, and fpTempRegister instead of using S0, S1, and SD0.
1396 We also change swap(RegisterID, RegisterID) implementation to use moves and temporaries simply. This is aligned to
1397 ARMv7 implementation.
1399 * assembler/ARMAssembler.h:
1400 * assembler/MacroAssemblerARM.h:
1401 (JSC::MacroAssemblerARM::add32):
1402 (JSC::MacroAssemblerARM::and32):
1403 (JSC::MacroAssemblerARM::lshift32):
1404 (JSC::MacroAssemblerARM::mul32):
1405 (JSC::MacroAssemblerARM::or32):
1406 (JSC::MacroAssemblerARM::rshift32):
1407 (JSC::MacroAssemblerARM::urshift32):
1408 (JSC::MacroAssemblerARM::sub32):
1409 (JSC::MacroAssemblerARM::xor32):
1410 (JSC::MacroAssemblerARM::load8):
1411 (JSC::MacroAssemblerARM::abortWithReason):
1412 (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
1413 (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
1414 (JSC::MacroAssemblerARM::store8):
1415 (JSC::MacroAssemblerARM::store32):
1416 (JSC::MacroAssemblerARM::push):
1417 (JSC::MacroAssemblerARM::swap):
1418 (JSC::MacroAssemblerARM::branch8):
1419 (JSC::MacroAssemblerARM::branchPtr):
1420 (JSC::MacroAssemblerARM::branch32):
1421 (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
1422 (JSC::MacroAssemblerARM::branchTest8):
1423 (JSC::MacroAssemblerARM::branchTest32):
1424 (JSC::MacroAssemblerARM::jump):
1425 (JSC::MacroAssemblerARM::branchAdd32):
1426 (JSC::MacroAssemblerARM::mull32):
1427 (JSC::MacroAssemblerARM::branchMul32):
1428 (JSC::MacroAssemblerARM::patchableBranch32):
1429 (JSC::MacroAssemblerARM::nearCall):
1430 (JSC::MacroAssemblerARM::compare32):
1431 (JSC::MacroAssemblerARM::compare8):
1432 (JSC::MacroAssemblerARM::test32):
1433 (JSC::MacroAssemblerARM::test8):
1434 (JSC::MacroAssemblerARM::add64):
1435 (JSC::MacroAssemblerARM::load32):
1436 (JSC::MacroAssemblerARM::call):
1437 (JSC::MacroAssemblerARM::branchPtrWithPatch):
1438 (JSC::MacroAssemblerARM::branch32WithPatch):
1439 (JSC::MacroAssemblerARM::storePtrWithPatch):
1440 (JSC::MacroAssemblerARM::loadDouble):
1441 (JSC::MacroAssemblerARM::storeDouble):
1442 (JSC::MacroAssemblerARM::addDouble):
1443 (JSC::MacroAssemblerARM::divDouble):
1444 (JSC::MacroAssemblerARM::subDouble):
1445 (JSC::MacroAssemblerARM::mulDouble):
1446 (JSC::MacroAssemblerARM::convertInt32ToDouble):
1447 (JSC::MacroAssemblerARM::branchDouble):
1448 (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
1449 (JSC::MacroAssemblerARM::truncateDoubleToInt32):
1450 (JSC::MacroAssemblerARM::truncateDoubleToUint32):
1451 (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
1452 (JSC::MacroAssemblerARM::branchDoubleNonZero):
1453 (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
1454 (JSC::MacroAssemblerARM::call32):
1455 (JSC::MacroAssemblerARM::internalCompare32):
1457 2018-04-25 Ross Kirsling <ross.kirsling@sony.com>
1459 [WinCairo] Fix js/regexp-unicode.html crash.
1460 https://bugs.webkit.org/show_bug.cgi?id=184891
1462 Reviewed by Yusuke Suzuki.
1464 On Win64, register RDI is "considered nonvolatile and must be saved and restored by a function that uses [it]".
1465 RDI is being used as a scratch register for JIT_UNICODE_EXPRESSIONS, not just YARR_JIT_ALL_PARENS_EXPRESSIONS.
1468 (JSC::Yarr::YarrGenerator::generateEnter):
1469 (JSC::Yarr::YarrGenerator::generateReturn):
1470 Unconditionally save and restore RDI on 64-bit Windows.
1472 2018-04-25 Michael Catanzaro <mcatanzaro@igalia.com>
1474 [GTK] Miscellaneous build cleanups
1475 https://bugs.webkit.org/show_bug.cgi?id=184399
1477 Reviewed by Žan Doberšek.
1479 * PlatformGTK.cmake:
1481 2018-04-24 Keith Miller <keith_miller@apple.com>
1483 fromCharCode is missing some exception checks
1484 https://bugs.webkit.org/show_bug.cgi?id=184952
1486 Reviewed by Saam Barati.
1488 I also removed the pointless slow path function and moved it into the
1491 * runtime/StringConstructor.cpp:
1492 (JSC::stringFromCharCode):
1493 (JSC::stringFromCharCodeSlowCase): Deleted.
1495 2018-04-24 Filip Pizlo <fpizlo@apple.com>
1497 MultiByOffset should emit one fewer branches in the case that the set of structures is proved already
1498 https://bugs.webkit.org/show_bug.cgi?id=184923
1500 Reviewed by Saam Barati.
1502 If we have a MultiGetByOffset or MultiPutByOffset over a structure set that we've already proved
1503 (i.e. we know that the object has one of those structures), then previously we would still emit a
1504 switch with a case per structure along with a default case. That would mean one extra redundant
1505 branch to check that whatever structure we wound up with belongs to the set. In that case, we
1506 were already making the default case be an Oops.
1508 One possible solution would be to say that the default case being Oops means that B3 doesn't need
1509 to emit the extra branch. But that would require having B3 exploit the fact that Oops is known to
1510 be unreachable. Although B3 IR semantics (webkit.org/docs/b3/intermediate-representation.html)
1511 seem to allow this, I don't particularly like that style of optimization. I like Oops to mean
1514 So, this patch makes FTL lowering turn one of the cases into the default, explicitly removing the
1517 This is not a speed-up. But it makes the B3 IR for MultiByOffset a lot simpler, which should make
1518 it easier to implement B3-level optimizations for MultiByOffset. It also makes the IR easier to
1521 * ftl/FTLLowerDFGToB3.cpp:
1522 (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
1523 (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
1524 (JSC::FTL::DFG::LowerDFGToB3::emitSwitchForMultiByOffset):
1526 2018-04-24 Filip Pizlo <fpizlo@apple.com>
1528 DFG CSE should know how to decay a MultiGetByOffset
1529 https://bugs.webkit.org/show_bug.cgi?id=159859
1531 Reviewed by Keith Miller.
1533 This teaches Node::remove() how to decay a MultiGetByOffset to a CheckStructure, so that
1534 clobberize() can report a def() for MultiGetByOffset.
1536 This is a slight improvement to codegen in splay because splay is a heavy user of
1537 MultiGetByOffset. It uses it redundantly in one of its hot functions (the function called
1538 "splay_"). I don't see a net speed-up in the benchmark. However, this is just a first step to
1539 removing MultiXByOffset-related redundancies, which by my estimates account for 16% of
1542 * dfg/DFGClobberize.h:
1543 (JSC::DFG::clobberize):
1545 (JSC::DFG::Node::remove):
1546 (JSC::DFG::Node::removeWithoutChecks):
1547 (JSC::DFG::Node::replaceWith):
1548 (JSC::DFG::Node::replaceWithWithoutChecks):
1550 (JSC::DFG::Node::convertToMultiGetByOffset):
1551 (JSC::DFG::Node::replaceWith): Deleted.
1552 * dfg/DFGNodeType.h:
1553 * dfg/DFGObjectAllocationSinkingPhase.cpp:
1555 2018-04-24 Keith Miller <keith_miller@apple.com>
1557 Update API docs with information on which run loop the VM will use
1558 https://bugs.webkit.org/show_bug.cgi?id=184900
1559 <rdar://problem/39166054>
1561 Reviewed by Mark Lam.
1563 * API/JSContextRef.h:
1564 * API/JSVirtualMachine.h:
1566 2018-04-24 Filip Pizlo <fpizlo@apple.com>
1568 $vm.totalGCTime() should be a thing
1569 https://bugs.webkit.org/show_bug.cgi?id=184916
1571 Reviewed by Sam Weinig.
1573 When debugging regressions in tests that are GC heavy, it's nice to be able to query the total
1574 time spent in GC to determine if the regression is because the GC got slower.
1576 This adds $vm.totalGCTime(), which tells you the total time spent in GC, in seconds.
1579 (JSC::Heap::runEndPhase):
1581 (JSC::Heap::totalGCTime const):
1582 * tools/JSDollarVM.cpp:
1583 (JSC::functionTotalGCTime):
1584 (JSC::JSDollarVM::finishCreation):
1586 2018-04-23 Zalan Bujtas <zalan@apple.com>
1588 [LayoutFormattingContext] Initial commit.
1589 https://bugs.webkit.org/show_bug.cgi?id=184896
1591 Reviewed by Antti Koivisto.
1593 * Configurations/FeatureDefines.xcconfig:
1595 2018-04-23 Filip Pizlo <fpizlo@apple.com>
1597 Unreviewed, revert accidental change to verbose flag.
1599 * dfg/DFGByteCodeParser.cpp:
1601 2018-04-23 Filip Pizlo <fpizlo@apple.com>
1603 Roll out r226655 because it broke OSR entry when the pre-header is inadequately profiled.
1605 Rubber stamped by Saam Barati.
1607 This is a >2x speed-up in SunSpider/bitops-bitwise-and. We don't really care about SunSpider
1608 anymore, but r226655 didn't result in any benchmark wins and just regressed this test by a lot.
1609 Seems sensible to just roll it out.
1611 * dfg/DFGByteCodeParser.cpp:
1612 (JSC::DFG::ByteCodeParser::addToGraph):
1613 (JSC::DFG::ByteCodeParser::parse):
1615 2018-04-22 Yusuke Suzuki <utatane.tea@gmail.com>
1617 [JSC] Remove ModuleLoaderPrototype
1618 https://bugs.webkit.org/show_bug.cgi?id=184784
1620 Reviewed by Mark Lam.
1622 When we introduce ModuleLoaderPrototype, ModuleLoader may be created by users and exposed to users.
1623 However, the loader spec is abandoned. So we do not need to have ModuleLoaderPrototype and JSModuleLoader.
1624 This patch merges ModuleLoaderPrototype's functionality into JSModuleLoader.
1627 * DerivedSources.make:
1628 * JavaScriptCore.xcodeproj/project.pbxproj:
1630 * builtins/ModuleLoader.js: Renamed from Source/JavaScriptCore/builtins/ModuleLoaderPrototype.js.
1631 * runtime/JSGlobalObject.cpp:
1632 (JSC::JSGlobalObject::init):
1633 (JSC::JSGlobalObject::visitChildren):
1634 * runtime/JSGlobalObject.h:
1635 (JSC::JSGlobalObject::proxyRevokeStructure const):
1636 (JSC::JSGlobalObject::moduleLoaderStructure const): Deleted.
1637 * runtime/JSModuleLoader.cpp:
1638 (JSC::moduleLoaderParseModule):
1639 (JSC::moduleLoaderRequestedModules):
1640 (JSC::moduleLoaderModuleDeclarationInstantiation):
1641 (JSC::moduleLoaderResolve):
1642 (JSC::moduleLoaderResolveSync):
1643 (JSC::moduleLoaderFetch):
1644 (JSC::moduleLoaderGetModuleNamespaceObject):
1645 (JSC::moduleLoaderEvaluate):
1646 * runtime/JSModuleLoader.h:
1647 * runtime/ModuleLoaderPrototype.cpp: Removed.
1648 * runtime/ModuleLoaderPrototype.h: Removed.
1650 2018-04-20 Carlos Garcia Campos <cgarcia@igalia.com>
1652 [GLIB] All API tests fail in debug builds
1653 https://bugs.webkit.org/show_bug.cgi?id=184813
1655 Reviewed by Mark Lam.
1657 This is because of a conflict of ExceptionHandler class used in tests and ExceptionHandler struct defined in
1658 JSCContext.cpp. This patch renames the ExceptionHandler struct as JSCContextExceptionHandler.
1660 * API/glib/JSCContext.cpp:
1661 (JSCContextExceptionHandler::JSCContextExceptionHandler):
1662 (JSCContextExceptionHandler::~JSCContextExceptionHandler):
1663 (jscContextConstructed):
1664 (ExceptionHandler::ExceptionHandler): Deleted.
1665 (ExceptionHandler::~ExceptionHandler): Deleted.
1667 2018-04-20 Tim Horton <timothy_horton@apple.com>
1669 Adjust geolocation feature flag
1670 https://bugs.webkit.org/show_bug.cgi?id=184856
1672 Reviewed by Wenson Hsieh.
1674 * Configurations/FeatureDefines.xcconfig:
1676 2018-04-20 Brian Burg <bburg@apple.com>
1678 Web Inspector: remove some dead code in IdentifiersFactory
1679 https://bugs.webkit.org/show_bug.cgi?id=184839
1681 Reviewed by Timothy Hatcher.
1683 This was never used on non-Chrome ports, so the identifier always has a
1684 prefix of '0.'. We may change this in the future, but for now remove this.
1685 Using a PID for this purpose is problematic anyway.
1687 * inspector/IdentifiersFactory.cpp:
1688 (Inspector::addPrefixToIdentifier):
1689 (Inspector::IdentifiersFactory::createIdentifier):
1690 (Inspector::IdentifiersFactory::requestId):
1691 (Inspector::IdentifiersFactory::addProcessIdPrefixTo): Deleted.
1692 * inspector/IdentifiersFactory.h:
1694 2018-04-20 Mark Lam <mark.lam@apple.com>
1696 Add the ability to use a hash for setting PtrTag enum values.
1697 https://bugs.webkit.org/show_bug.cgi?id=184852
1698 <rdar://problem/39613891>
1700 Reviewed by Saam Barati.
1704 2018-04-20 Mark Lam <mark.lam@apple.com>
1706 Some JSEntryPtrTags should actually be JSInternalPtrTags.
1707 https://bugs.webkit.org/show_bug.cgi?id=184712
1708 <rdar://problem/39507381>
1710 Reviewed by Michael Saboff.
1712 1. Convert some uses of JSEntryPtrTag into JSInternalPtrTags.
1713 2. Tag all LLInt bytecodes consistently with BytecodePtrTag now and retag them
1716 * bytecode/AccessCase.cpp:
1717 (JSC::AccessCase::generateImpl):
1718 * bytecode/ByValInfo.h:
1719 (JSC::ByValInfo::ByValInfo):
1720 * bytecode/CallLinkInfo.cpp:
1721 (JSC::CallLinkInfo::callReturnLocation):
1722 (JSC::CallLinkInfo::patchableJump):
1723 (JSC::CallLinkInfo::hotPathBegin):
1724 (JSC::CallLinkInfo::slowPathStart):
1725 * bytecode/CallLinkInfo.h:
1726 (JSC::CallLinkInfo::setCallLocations):
1727 (JSC::CallLinkInfo::hotPathOther):
1728 * bytecode/PolymorphicAccess.cpp:
1729 (JSC::PolymorphicAccess::regenerate):
1730 * bytecode/StructureStubInfo.h:
1731 (JSC::StructureStubInfo::doneLocation):
1732 * dfg/DFGJITCompiler.cpp:
1733 (JSC::DFG::JITCompiler::link):
1734 * dfg/DFGOSRExit.cpp:
1735 (JSC::DFG::reifyInlinedCallFrames):
1736 * ftl/FTLLazySlowPath.cpp:
1737 (JSC::FTL::LazySlowPath::initialize):
1738 * ftl/FTLLazySlowPath.h:
1739 (JSC::FTL::LazySlowPath::done const):
1740 * ftl/FTLLowerDFGToB3.cpp:
1741 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
1742 (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
1743 (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
1744 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
1745 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
1746 (JSC::FTL::DFG::LowerDFGToB3::compileIn):
1747 (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
1750 * jit/JITExceptions.cpp:
1751 (JSC::genericUnwind):
1753 (JSC::isProfileEmpty):
1754 * llint/LLIntData.cpp:
1755 (JSC::LLInt::initialize):
1756 * llint/LLIntData.h:
1757 (JSC::LLInt::getCodePtr):
1758 (JSC::LLInt::getExecutableAddress): Deleted.
1759 * llint/LLIntExceptions.cpp:
1760 (JSC::LLInt::callToThrow):
1761 * llint/LLIntSlowPaths.cpp:
1762 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1763 * wasm/js/WasmToJS.cpp:
1764 (JSC::Wasm::wasmToJS):
1766 2018-04-18 Jer Noble <jer.noble@apple.com>
1768 Don't put build products into WK_ALTERNATE_WEBKIT_SDK_PATH for engineering builds
1769 https://bugs.webkit.org/show_bug.cgi?id=184762
1771 Reviewed by Dan Bernstein.
1773 * Configurations/Base.xcconfig:
1774 * JavaScriptCore.xcodeproj/project.pbxproj:
1776 2018-04-20 Daniel Bates <dabates@apple.com>
1778 Remove code for compilers that did not support NSDMI for aggregates
1779 https://bugs.webkit.org/show_bug.cgi?id=184599
1781 Reviewed by Per Arne Vollan.
1783 Remove workaround for earlier Visual Studio versions that did not support non-static data
1784 member initializers (NSDMI) for aggregates. We have since updated all the build.webkit.org
1785 and EWS bots to a newer version that supports this feature.
1787 * domjit/DOMJITEffect.h:
1788 (JSC::DOMJIT::Effect::Effect): Deleted.
1789 * runtime/HasOwnPropertyCache.h:
1790 (JSC::HasOwnPropertyCache::Entry::Entry): Deleted.
1791 * wasm/WasmFormat.h:
1792 (JSC::Wasm::WasmToWasmImportableFunction::WasmToWasmImportableFunction): Deleted.
1794 2018-04-20 Mark Lam <mark.lam@apple.com>
1796 Build fix for internal builds after r230826.
1797 https://bugs.webkit.org/show_bug.cgi?id=184790
1798 <rdar://problem/39301369>
1802 * runtime/Options.cpp:
1803 (JSC::overrideDefaults):
1804 * tools/SigillCrashAnalyzer.cpp:
1805 (JSC::SignalContext::dump):
1807 2018-04-19 Tadeu Zagallo <tzagallo@apple.com>
1809 REGRESSION(r227340): ArrayBuffers were not being serialized when sent via MessagePorts
1810 https://bugs.webkit.org/show_bug.cgi?id=184254
1811 <rdar://problem/39140200>
1813 Reviewed by Daniel Bates.
1815 Expose an extra constructor of ArrayBufferContents in order to be able to decode SerializedScriptValues.
1817 * runtime/ArrayBuffer.h:
1818 (JSC::ArrayBufferContents::ArrayBufferContents):
1820 2018-04-19 Mark Lam <mark.lam@apple.com>
1822 Apply pointer profiling to Signal pointers.
1823 https://bugs.webkit.org/show_bug.cgi?id=184790
1824 <rdar://problem/39301369>
1826 Reviewed by Michael Saboff.
1828 1. Change stackPointer, framePointer, and instructionPointer accessors to
1829 be a pair of getter/setter functions.
1830 2. Add support for USE(PLATFORM_REGISTERS_WITH_PROFILE) to allow use of a
1831 a pointer profiling variants of these accessors.
1832 3. Also add a linkRegister accessor only for ARM64 on OS(DARWIN).
1834 * JavaScriptCorePrefix.h:
1835 * runtime/MachineContext.h:
1836 (JSC::MachineContext::stackPointerImpl):
1837 (JSC::MachineContext::stackPointer):
1838 (JSC::MachineContext::setStackPointer):
1839 (JSC::MachineContext::framePointerImpl):
1840 (JSC::MachineContext::framePointer):
1841 (JSC::MachineContext::setFramePointer):
1842 (JSC::MachineContext::instructionPointerImpl):
1843 (JSC::MachineContext::instructionPointer):
1844 (JSC::MachineContext::setInstructionPointer):
1845 (JSC::MachineContext::linkRegisterImpl):
1846 (JSC::MachineContext::linkRegister):
1847 (JSC::MachineContext::setLinkRegister):
1848 * runtime/SamplingProfiler.cpp:
1849 (JSC::SamplingProfiler::takeSample):
1850 * runtime/VMTraps.cpp:
1851 (JSC::SignalContext::SignalContext):
1852 (JSC::VMTraps::tryInstallTrapBreakpoints):
1853 * tools/CodeProfiling.cpp:
1854 (JSC::profilingTimer):
1855 * tools/SigillCrashAnalyzer.cpp:
1856 (JSC::SignalContext::dump):
1857 (JSC::installCrashHandler):
1858 (JSC::SigillCrashAnalyzer::analyze):
1859 * wasm/WasmFaultSignalHandler.cpp:
1860 (JSC::Wasm::trapHandler):
1862 2018-04-19 David Kilzer <ddkilzer@apple.com>
1864 Enable Objective-C weak references
1865 <https://webkit.org/b/184789>
1866 <rdar://problem/39571716>
1868 Reviewed by Dan Bernstein.
1870 * Configurations/Base.xcconfig:
1871 (CLANG_ENABLE_OBJC_WEAK): Enable.
1872 * Configurations/ToolExecutable.xcconfig:
1873 (CLANG_ENABLE_OBJC_ARC): Simplify.
1875 2018-04-17 Filip Pizlo <fpizlo@apple.com>
1877 The InternalFunction hierarchy should be in IsoSubspaces
1878 https://bugs.webkit.org/show_bug.cgi?id=184721
1880 Reviewed by Saam Barati.
1882 This moves InternalFunction into a IsoSubspace. It also moves all subclasses into IsoSubspaces,
1883 but subclasses that are the same size as InternalFunction share its subspace. I did this
1884 because the subclasses appear to just override methods, which are called dynamically via the
1885 structure or class of the object. So, I don't see a type confusion risk if UAF is used to
1886 allocate one kind of InternalFunction over another.
1889 * API/JSCallbackFunction.h:
1890 * API/ObjCCallbackFunction.h:
1891 (JSC::ObjCCallbackFunction::subspaceFor):
1893 * JavaScriptCore.xcodeproj/project.pbxproj:
1895 * heap/IsoSubspacePerVM.cpp: Added.
1896 (JSC::IsoSubspacePerVM::AutoremovingIsoSubspace::AutoremovingIsoSubspace):
1897 (JSC::IsoSubspacePerVM::AutoremovingIsoSubspace::~AutoremovingIsoSubspace):
1898 (JSC::IsoSubspacePerVM::IsoSubspacePerVM):
1899 (JSC::IsoSubspacePerVM::~IsoSubspacePerVM):
1900 (JSC::IsoSubspacePerVM::forVM):
1901 * heap/IsoSubspacePerVM.h: Added.
1902 (JSC::IsoSubspacePerVM::SubspaceParameters::SubspaceParameters):
1904 * runtime/ErrorConstructor.h:
1905 * runtime/InternalFunction.h:
1906 (JSC::InternalFunction::subspaceFor):
1907 * runtime/IntlCollatorConstructor.h:
1908 * runtime/IntlDateTimeFormatConstructor.h:
1909 * runtime/IntlNumberFormatConstructor.h:
1910 * runtime/JSArrayBufferConstructor.h:
1911 * runtime/NativeErrorConstructor.h:
1912 * runtime/ProxyRevoke.h:
1913 * runtime/RegExpConstructor.h:
1918 2018-04-19 Yusuke Suzuki <utatane.tea@gmail.com>
1920 Unreviewed, Fix jsc shell
1921 https://bugs.webkit.org/show_bug.cgi?id=184600
1923 WebAssembly module loading does not finish with drainMicrotasks().
1924 So JSNativeStdFunction's capturing variables become invalid.
1925 This patch fixes this issue.
1928 (functionDollarAgentStart):
1933 2018-04-18 Ross Kirsling <ross.kirsling@sony.com>
1935 REGRESSION(r230748) [WinCairo] 'JSC::JIT::appendCallWithSlowPathReturnType': function does not take 1 arguments
1936 https://bugs.webkit.org/show_bug.cgi?id=184725
1938 Reviewed by Mark Lam.
1942 2018-04-18 Yusuke Suzuki <utatane.tea@gmail.com>
1944 [WebAssembly][Modules] Import tables in wasm modules
1945 https://bugs.webkit.org/show_bug.cgi?id=184738
1947 Reviewed by JF Bastien.
1949 This patch simply allows wasm modules to import table from wasm modules / js re-exporting.
1950 Basically moving JSWebAssemblyInstance's table linking code to WebAssemblyModuleRecord::link
1953 * wasm/js/JSWebAssemblyInstance.cpp:
1954 (JSC::JSWebAssemblyInstance::create):
1955 * wasm/js/WebAssemblyModuleRecord.cpp:
1956 (JSC::WebAssemblyModuleRecord::link):
1958 2018-04-18 Dominik Infuehr <dinfuehr@igalia.com>
1960 [ARM] Fix build error and crash after PtrTag change
1961 https://bugs.webkit.org/show_bug.cgi?id=184732
1963 Reviewed by Mark Lam.
1965 Do not pass NoPtrTag in callOperation and fix misspelled JSEntryPtrTag. Use
1966 MacroAssemblerCodePtr::createFromExecutableAddress to avoid tagging a pointer
1967 twice with ARM-Thumb2.
1969 * assembler/MacroAssemblerCodeRef.h:
1970 (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
1971 * jit/JITPropertyAccess32_64.cpp:
1972 (JSC::JIT::emitSlow_op_put_by_val):
1974 (JSC::linkPolymorphicCall):
1976 2018-04-18 Yusuke Suzuki <utatane.tea@gmail.com>
1978 [WebAssembly][Modules] Import globals from wasm modules
1979 https://bugs.webkit.org/show_bug.cgi?id=184736
1981 Reviewed by JF Bastien.
1983 This patch implements a feature importing globals to/from wasm modules.
1984 Since we are not supporting mutable globals now, we can just copy the
1985 global data when importing. Currently we do not support importing/exporting
1986 i64 globals. This will be supported once (1) mutable global bindings are
1987 specified and (2) BigInt based i64 importing/exporting is specified.
1989 * wasm/js/JSWebAssemblyInstance.cpp:
1990 (JSC::JSWebAssemblyInstance::create):
1991 * wasm/js/WebAssemblyModuleRecord.cpp:
1992 (JSC::WebAssemblyModuleRecord::link):
1994 2018-04-18 Tomas Popela <tpopela@redhat.com>
1996 Unreviewed, fix build on ARM
1998 * assembler/MacroAssemblerARM.h:
1999 (JSC::MacroAssemblerARM::readCallTarget):
2001 2018-04-18 Tomas Popela <tpopela@redhat.com>
2003 Unreviewed, fix build with GCC
2005 * assembler/LinkBuffer.h:
2006 (JSC::LinkBuffer::finalizeCodeWithDisassembly):
2008 2018-04-18 Yusuke Suzuki <utatane.tea@gmail.com>
2010 Unreviewed, reland r230697, r230720, and r230724.
2011 https://bugs.webkit.org/show_bug.cgi?id=184600
2013 With CatchScope check.
2015 * JavaScriptCore.xcodeproj/project.pbxproj:
2016 * builtins/ModuleLoaderPrototype.js:
2017 (globalPrivate.newRegistryEntry):
2018 (requestInstantiate):
2021 (convertShebangToJSComment):
2022 (fillBufferWithContentsOfFile):
2023 (fetchModuleFromLocalFileSystem):
2024 (GlobalObject::moduleLoaderFetch):
2025 (functionDollarAgentStart):
2028 * parser/NodesAnalyzeModule.cpp:
2029 (JSC::ImportDeclarationNode::analyzeModule):
2030 * parser/SourceProvider.h:
2031 (JSC::WebAssemblySourceProvider::create):
2032 (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
2033 * runtime/AbstractModuleRecord.cpp:
2034 (JSC::AbstractModuleRecord::hostResolveImportedModule):
2035 (JSC::AbstractModuleRecord::resolveImport):
2036 (JSC::AbstractModuleRecord::link):
2037 (JSC::AbstractModuleRecord::evaluate):
2038 (JSC::identifierToJSValue): Deleted.
2039 * runtime/AbstractModuleRecord.h:
2040 (JSC::AbstractModuleRecord::moduleEnvironmentMayBeNull):
2041 (JSC::AbstractModuleRecord::ImportEntry::isNamespace const): Deleted.
2042 * runtime/JSModuleEnvironment.cpp:
2043 (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
2044 * runtime/JSModuleLoader.cpp:
2045 (JSC::JSModuleLoader::evaluate):
2046 * runtime/JSModuleRecord.cpp:
2047 (JSC::JSModuleRecord::link):
2048 (JSC::JSModuleRecord::instantiateDeclarations):
2049 * runtime/JSModuleRecord.h:
2050 * runtime/ModuleLoaderPrototype.cpp:
2051 (JSC::moduleLoaderPrototypeParseModule):
2052 (JSC::moduleLoaderPrototypeRequestedModules):
2053 (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
2054 * wasm/WasmCreationMode.h: Copied from Source/JavaScriptCore/wasm/js/WebAssemblyPrototype.h.
2055 * wasm/js/JSWebAssemblyHelpers.h:
2056 (JSC::getWasmBufferFromValue):
2057 (JSC::createSourceBufferFromValue):
2058 * wasm/js/JSWebAssemblyInstance.cpp:
2059 (JSC::JSWebAssemblyInstance::finalizeCreation):
2060 (JSC::JSWebAssemblyInstance::createPrivateModuleKey):
2061 (JSC::JSWebAssemblyInstance::create):
2062 * wasm/js/JSWebAssemblyInstance.h:
2063 * wasm/js/WebAssemblyInstanceConstructor.cpp:
2064 (JSC::constructJSWebAssemblyInstance):
2065 * wasm/js/WebAssemblyModuleRecord.cpp:
2066 (JSC::WebAssemblyModuleRecord::prepareLink):
2067 (JSC::WebAssemblyModuleRecord::link):
2068 * wasm/js/WebAssemblyModuleRecord.h:
2069 * wasm/js/WebAssemblyPrototype.cpp:
2072 (JSC::compileAndInstantiate):
2073 (JSC::WebAssemblyPrototype::instantiate):
2074 (JSC::webAssemblyInstantiateFunc):
2075 (JSC::webAssemblyValidateFunc):
2076 * wasm/js/WebAssemblyPrototype.h:
2078 2018-04-17 Carlos Garcia Campos <cgarcia@igalia.com>
2080 [GLIB] Make it possible to handle JSCClass external properties not added to the prototype
2081 https://bugs.webkit.org/show_bug.cgi?id=184687
2083 Reviewed by Michael Catanzaro.
2085 Add JSCClassVTable that can be optionally passed to jsc_context_register_class() to provide implmentations for
2086 JSClassDefinition. This is required to implement dynamic properties that can't be added with
2087 jsc_class_add_property() for example to implement something like imports object in seed/gjs.
2089 * API/glib/JSCClass.cpp:
2090 (VTableExceptionHandler::VTableExceptionHandler): Helper class to handle the exceptions in vtable functions that
2091 can throw exceptions.
2092 (VTableExceptionHandler::~VTableExceptionHandler):
2093 (getProperty): Iterate the class chain to call get_property function.
2094 (setProperty): Iterate the class chain to call set_property function.
2095 (hasProperty): Iterate the class chain to call has_property function.
2096 (deleteProperty): Iterate the class chain to call delete_property function.
2097 (getPropertyNames): Iterate the class chain to call enumerate_properties function.
2098 (jsc_class_class_init): Remove constructed implementation, since we need to initialize the JSClassDefinition in
2100 (jscClassCreate): Receive an optional JSCClassVTable that is used to initialize the JSClassDefinition.
2101 * API/glib/JSCClass.h:
2102 * API/glib/JSCClassPrivate.h:
2103 * API/glib/JSCContext.cpp:
2104 (jscContextGetRegisteredClass): Helper to get the JSCClass for a given JSClassRef.
2105 (jsc_context_register_class): Add JSCClassVTable parameter.
2106 * API/glib/JSCContext.h:
2107 * API/glib/JSCContextPrivate.h:
2108 * API/glib/JSCWrapperMap.cpp:
2109 (JSC::WrapperMap::registeredClass const): Get the JSCClass for a given JSClassRef.
2110 * API/glib/JSCWrapperMap.h:
2111 * API/glib/docs/jsc-glib-4.0-sections.txt: Add new symbols.
2113 2018-04-17 Mark Lam <mark.lam@apple.com>
2115 Templatize CodePtr/Refs/FunctionPtrs with PtrTags.
2116 https://bugs.webkit.org/show_bug.cgi?id=184702
2117 <rdar://problem/35391681>
2119 Reviewed by Filip Pizlo and Saam Barati.
2121 1. Templatized MacroAssemblerCodePtr/Ref, FunctionPtr, and CodeLocation variants
2122 to take a PtrTag template argument.
2123 2. Replaced some uses of raw pointers with the equivalent CodePtr / FunctionPtr.
2125 * assembler/AbstractMacroAssembler.h:
2126 (JSC::AbstractMacroAssembler::differenceBetweenCodePtr):
2127 (JSC::AbstractMacroAssembler::linkJump):
2128 (JSC::AbstractMacroAssembler::linkPointer):
2129 (JSC::AbstractMacroAssembler::getLinkerAddress):
2130 (JSC::AbstractMacroAssembler::repatchJump):
2131 (JSC::AbstractMacroAssembler::repatchJumpToNop):
2132 (JSC::AbstractMacroAssembler::repatchNearCall):
2133 (JSC::AbstractMacroAssembler::repatchCompact):
2134 (JSC::AbstractMacroAssembler::repatchInt32):
2135 (JSC::AbstractMacroAssembler::repatchPointer):
2136 (JSC::AbstractMacroAssembler::readPointer):
2137 (JSC::AbstractMacroAssembler::replaceWithLoad):
2138 (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
2139 * assembler/CodeLocation.h:
2140 (JSC::CodeLocationCommon:: const):
2141 (JSC::CodeLocationCommon::CodeLocationCommon):
2142 (JSC::CodeLocationInstruction::CodeLocationInstruction):
2143 (JSC::CodeLocationLabel::CodeLocationLabel):
2144 (JSC::CodeLocationLabel::retagged):
2145 (JSC::CodeLocationLabel:: const):
2146 (JSC::CodeLocationJump::CodeLocationJump):
2147 (JSC::CodeLocationJump::retagged):
2148 (JSC::CodeLocationCall::CodeLocationCall):
2149 (JSC::CodeLocationCall::retagged):
2150 (JSC::CodeLocationNearCall::CodeLocationNearCall):
2151 (JSC::CodeLocationDataLabel32::CodeLocationDataLabel32):
2152 (JSC::CodeLocationDataLabelCompact::CodeLocationDataLabelCompact):
2153 (JSC::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
2154 (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad):
2155 (JSC::CodeLocationCommon<tag>::instructionAtOffset):
2156 (JSC::CodeLocationCommon<tag>::labelAtOffset):
2157 (JSC::CodeLocationCommon<tag>::jumpAtOffset):
2158 (JSC::CodeLocationCommon<tag>::callAtOffset):
2159 (JSC::CodeLocationCommon<tag>::nearCallAtOffset):
2160 (JSC::CodeLocationCommon<tag>::dataLabelPtrAtOffset):
2161 (JSC::CodeLocationCommon<tag>::dataLabel32AtOffset):
2162 (JSC::CodeLocationCommon<tag>::dataLabelCompactAtOffset):
2163 (JSC::CodeLocationCommon<tag>::convertibleLoadAtOffset):
2164 (JSC::CodeLocationCommon::instructionAtOffset): Deleted.
2165 (JSC::CodeLocationCommon::labelAtOffset): Deleted.
2166 (JSC::CodeLocationCommon::jumpAtOffset): Deleted.
2167 (JSC::CodeLocationCommon::callAtOffset): Deleted.
2168 (JSC::CodeLocationCommon::nearCallAtOffset): Deleted.
2169 (JSC::CodeLocationCommon::dataLabelPtrAtOffset): Deleted.
2170 (JSC::CodeLocationCommon::dataLabel32AtOffset): Deleted.
2171 (JSC::CodeLocationCommon::dataLabelCompactAtOffset): Deleted.
2172 (JSC::CodeLocationCommon::convertibleLoadAtOffset): Deleted.
2173 * assembler/LinkBuffer.cpp:
2174 (JSC::LinkBuffer::finalizeCodeWithoutDisassemblyImpl):
2175 (JSC::LinkBuffer::finalizeCodeWithDisassemblyImpl):
2176 (JSC::LinkBuffer::finalizeCodeWithoutDisassembly): Deleted.
2177 (JSC::LinkBuffer::finalizeCodeWithDisassembly): Deleted.
2178 * assembler/LinkBuffer.h:
2179 (JSC::LinkBuffer::link):
2180 (JSC::LinkBuffer::patch):
2181 (JSC::LinkBuffer::entrypoint):
2182 (JSC::LinkBuffer::locationOf):
2183 (JSC::LinkBuffer::locationOfNearCall):
2184 (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
2185 (JSC::LinkBuffer::finalizeCodeWithDisassembly):
2186 (JSC::LinkBuffer::trampolineAt):
2187 * assembler/MacroAssemblerARM.h:
2188 (JSC::MacroAssemblerARM::readCallTarget):
2189 (JSC::MacroAssemblerARM::replaceWithJump):
2190 (JSC::MacroAssemblerARM::startOfPatchableBranch32WithPatchOnAddress):
2191 (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatchOnAddress):
2192 (JSC::MacroAssemblerARM::startOfBranchPtrWithPatchOnRegister):
2193 (JSC::MacroAssemblerARM::revertJumpReplacementToBranchPtrWithPatch):
2194 (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranch32WithPatch):
2195 (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranchPtrWithPatch):
2196 (JSC::MacroAssemblerARM::repatchCall):
2197 (JSC::MacroAssemblerARM::linkCall):
2198 * assembler/MacroAssemblerARM64.h:
2199 (JSC::MacroAssemblerARM64::readCallTarget):
2200 (JSC::MacroAssemblerARM64::replaceWithVMHalt):
2201 (JSC::MacroAssemblerARM64::replaceWithJump):
2202 (JSC::MacroAssemblerARM64::startOfBranchPtrWithPatchOnRegister):
2203 (JSC::MacroAssemblerARM64::startOfPatchableBranchPtrWithPatchOnAddress):
2204 (JSC::MacroAssemblerARM64::startOfPatchableBranch32WithPatchOnAddress):
2205 (JSC::MacroAssemblerARM64::revertJumpReplacementToBranchPtrWithPatch):
2206 (JSC::MacroAssemblerARM64::revertJumpReplacementToPatchableBranchPtrWithPatch):
2207 (JSC::MacroAssemblerARM64::revertJumpReplacementToPatchableBranch32WithPatch):
2208 (JSC::MacroAssemblerARM64::repatchCall):
2209 (JSC::MacroAssemblerARM64::linkCall):
2210 * assembler/MacroAssemblerARMv7.h:
2211 (JSC::MacroAssemblerARMv7::replaceWithJump):
2212 (JSC::MacroAssemblerARMv7::readCallTarget):
2213 (JSC::MacroAssemblerARMv7::startOfBranchPtrWithPatchOnRegister):
2214 (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
2215 (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatchOnAddress):
2216 (JSC::MacroAssemblerARMv7::startOfPatchableBranch32WithPatchOnAddress):
2217 (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
2218 (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranch32WithPatch):
2219 (JSC::MacroAssemblerARMv7::repatchCall):
2220 (JSC::MacroAssemblerARMv7::linkCall):
2221 * assembler/MacroAssemblerCodeRef.cpp:
2222 (JSC::MacroAssemblerCodePtrBase::dumpWithName):
2223 (JSC::MacroAssemblerCodeRefBase::tryToDisassemble):
2224 (JSC::MacroAssemblerCodeRefBase::disassembly):
2225 (JSC::MacroAssemblerCodePtr::createLLIntCodePtr): Deleted.
2226 (JSC::MacroAssemblerCodePtr::dumpWithName const): Deleted.
2227 (JSC::MacroAssemblerCodePtr::dump const): Deleted.
2228 (JSC::MacroAssemblerCodeRef::createLLIntCodeRef): Deleted.
2229 (JSC::MacroAssemblerCodeRef::tryToDisassemble const): Deleted.
2230 (JSC::MacroAssemblerCodeRef::disassembly const): Deleted.
2231 (JSC::MacroAssemblerCodeRef::dump const): Deleted.
2232 * assembler/MacroAssemblerCodeRef.h:
2233 (JSC::FunctionPtr::FunctionPtr):
2234 (JSC::FunctionPtr::retagged const):
2235 (JSC::FunctionPtr::retaggedExecutableAddress const):
2236 (JSC::FunctionPtr::operator== const):
2237 (JSC::FunctionPtr::operator!= const):
2238 (JSC::ReturnAddressPtr::ReturnAddressPtr):
2239 (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
2240 (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
2241 (JSC::MacroAssemblerCodePtr::retagged const):
2242 (JSC::MacroAssemblerCodePtr:: const):
2243 (JSC::MacroAssemblerCodePtr::dumpWithName const):
2244 (JSC::MacroAssemblerCodePtr::dump const):
2245 (JSC::MacroAssemblerCodePtrHash::hash):
2246 (JSC::MacroAssemblerCodePtrHash::equal):
2247 (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
2248 (JSC::MacroAssemblerCodeRef::createSelfManagedCodeRef):
2249 (JSC::MacroAssemblerCodeRef::code const):
2250 (JSC::MacroAssemblerCodeRef::retaggedCode const):
2251 (JSC::MacroAssemblerCodeRef::retagged const):
2252 (JSC::MacroAssemblerCodeRef::tryToDisassemble const):
2253 (JSC::MacroAssemblerCodeRef::disassembly const):
2254 (JSC::MacroAssemblerCodeRef::dump const):
2255 (JSC::FunctionPtr<tag>::FunctionPtr):
2256 * assembler/MacroAssemblerMIPS.h:
2257 (JSC::MacroAssemblerMIPS::readCallTarget):
2258 (JSC::MacroAssemblerMIPS::replaceWithJump):
2259 (JSC::MacroAssemblerMIPS::startOfPatchableBranch32WithPatchOnAddress):
2260 (JSC::MacroAssemblerMIPS::startOfBranchPtrWithPatchOnRegister):
2261 (JSC::MacroAssemblerMIPS::revertJumpReplacementToBranchPtrWithPatch):
2262 (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatchOnAddress):
2263 (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranch32WithPatch):
2264 (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranchPtrWithPatch):
2265 (JSC::MacroAssemblerMIPS::repatchCall):
2266 (JSC::MacroAssemblerMIPS::linkCall):
2267 * assembler/MacroAssemblerX86.h:
2268 (JSC::MacroAssemblerX86::readCallTarget):
2269 (JSC::MacroAssemblerX86::startOfBranchPtrWithPatchOnRegister):
2270 (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatchOnAddress):
2271 (JSC::MacroAssemblerX86::startOfPatchableBranch32WithPatchOnAddress):
2272 (JSC::MacroAssemblerX86::revertJumpReplacementToBranchPtrWithPatch):
2273 (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranchPtrWithPatch):
2274 (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranch32WithPatch):
2275 (JSC::MacroAssemblerX86::repatchCall):
2276 (JSC::MacroAssemblerX86::linkCall):
2277 * assembler/MacroAssemblerX86Common.h:
2278 (JSC::MacroAssemblerX86Common::repatchCompact):
2279 (JSC::MacroAssemblerX86Common::replaceWithVMHalt):
2280 (JSC::MacroAssemblerX86Common::replaceWithJump):
2281 * assembler/MacroAssemblerX86_64.h:
2282 (JSC::MacroAssemblerX86_64::readCallTarget):
2283 (JSC::MacroAssemblerX86_64::startOfBranchPtrWithPatchOnRegister):
2284 (JSC::MacroAssemblerX86_64::startOfBranch32WithPatchOnRegister):
2285 (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatchOnAddress):
2286 (JSC::MacroAssemblerX86_64::startOfPatchableBranch32WithPatchOnAddress):
2287 (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranchPtrWithPatch):
2288 (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranch32WithPatch):
2289 (JSC::MacroAssemblerX86_64::revertJumpReplacementToBranchPtrWithPatch):
2290 (JSC::MacroAssemblerX86_64::repatchCall):
2291 (JSC::MacroAssemblerX86_64::linkCall):
2292 * assembler/testmasm.cpp:
2295 (JSC::testProbeModifiesProgramCounter):
2296 * b3/B3Compilation.cpp:
2297 (JSC::B3::Compilation::Compilation):
2298 * b3/B3Compilation.h:
2299 (JSC::B3::Compilation::code const):
2300 (JSC::B3::Compilation::codeRef const):
2303 * b3/B3LowerMacros.cpp:
2304 * b3/air/AirDisassembler.cpp:
2305 (JSC::B3::Air::Disassembler::dump):
2306 * b3/air/testair.cpp:
2309 (JSC::B3::testInterpreter):
2310 (JSC::B3::testEntrySwitchSimple):
2311 (JSC::B3::testEntrySwitchNoEntrySwitch):
2312 (JSC::B3::testEntrySwitchWithCommonPaths):
2313 (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
2314 (JSC::B3::testEntrySwitchLoop):
2315 * bytecode/AccessCase.cpp:
2316 (JSC::AccessCase::generateImpl):
2317 * bytecode/AccessCaseSnippetParams.cpp:
2318 (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
2319 * bytecode/ByValInfo.h:
2320 (JSC::ByValInfo::ByValInfo):
2321 * bytecode/CallLinkInfo.cpp:
2322 (JSC::CallLinkInfo::callReturnLocation):
2323 (JSC::CallLinkInfo::patchableJump):
2324 (JSC::CallLinkInfo::hotPathBegin):
2325 (JSC::CallLinkInfo::slowPathStart):
2326 * bytecode/CallLinkInfo.h:
2327 (JSC::CallLinkInfo::setCallLocations):
2328 (JSC::CallLinkInfo::hotPathOther):
2329 * bytecode/CodeBlock.cpp:
2330 (JSC::CodeBlock::finishCreation):
2331 * bytecode/GetByIdStatus.cpp:
2332 (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
2333 * bytecode/GetByIdVariant.cpp:
2334 (JSC::GetByIdVariant::GetByIdVariant):
2335 (JSC::GetByIdVariant::dumpInContext const):
2336 * bytecode/GetByIdVariant.h:
2337 (JSC::GetByIdVariant::customAccessorGetter const):
2338 * bytecode/GetterSetterAccessCase.cpp:
2339 (JSC::GetterSetterAccessCase::create):
2340 (JSC::GetterSetterAccessCase::GetterSetterAccessCase):
2341 (JSC::GetterSetterAccessCase::dumpImpl const):
2342 * bytecode/GetterSetterAccessCase.h:
2343 (JSC::GetterSetterAccessCase::customAccessor const):
2345 * bytecode/HandlerInfo.h:
2346 (JSC::HandlerInfo::initialize):
2347 * bytecode/InlineAccess.cpp:
2348 (JSC::linkCodeInline):
2349 (JSC::InlineAccess::rewireStubAsJump):
2350 * bytecode/InlineAccess.h:
2351 * bytecode/JumpTable.h:
2352 (JSC::StringJumpTable::ctiForValue):
2353 (JSC::SimpleJumpTable::ctiForValue):
2354 * bytecode/LLIntCallLinkInfo.h:
2355 (JSC::LLIntCallLinkInfo::unlink):
2356 * bytecode/PolymorphicAccess.cpp:
2357 (JSC::AccessGenerationState::emitExplicitExceptionHandler):
2358 (JSC::PolymorphicAccess::regenerate):
2359 * bytecode/PolymorphicAccess.h:
2360 (JSC::AccessGenerationResult::AccessGenerationResult):
2361 (JSC::AccessGenerationResult::code const):
2362 * bytecode/StructureStubInfo.h:
2363 (JSC::StructureStubInfo::slowPathCallLocation):
2364 (JSC::StructureStubInfo::doneLocation):
2365 (JSC::StructureStubInfo::slowPathStartLocation):
2366 (JSC::StructureStubInfo::patchableJumpForIn):
2367 * dfg/DFGCommonData.h:
2368 (JSC::DFG::CommonData::appendCatchEntrypoint):
2369 * dfg/DFGDisassembler.cpp:
2370 (JSC::DFG::Disassembler::dumpDisassembly):
2372 * dfg/DFGJITCompiler.cpp:
2373 (JSC::DFG::JITCompiler::linkOSRExits):
2374 (JSC::DFG::JITCompiler::compileExceptionHandlers):
2375 (JSC::DFG::JITCompiler::link):
2376 (JSC::DFG::JITCompiler::compileFunction):
2377 (JSC::DFG::JITCompiler::noticeCatchEntrypoint):
2378 * dfg/DFGJITCompiler.h:
2379 (JSC::DFG::CallLinkRecord::CallLinkRecord):
2380 (JSC::DFG::JITCompiler::appendCall):
2381 (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
2382 (JSC::DFG::JITCompiler::JSDirectCallRecord::JSDirectCallRecord):
2383 (JSC::DFG::JITCompiler::JSDirectTailCallRecord::JSDirectTailCallRecord):
2384 * dfg/DFGJITFinalizer.cpp:
2385 (JSC::DFG::JITFinalizer::JITFinalizer):
2386 (JSC::DFG::JITFinalizer::finalize):
2387 (JSC::DFG::JITFinalizer::finalizeFunction):
2388 * dfg/DFGJITFinalizer.h:
2389 * dfg/DFGJumpReplacement.h:
2390 (JSC::DFG::JumpReplacement::JumpReplacement):
2392 * dfg/DFGOSREntry.cpp:
2393 (JSC::DFG::prepareOSREntry):
2394 (JSC::DFG::prepareCatchOSREntry):
2395 * dfg/DFGOSREntry.h:
2396 (JSC::DFG::prepareOSREntry):
2397 * dfg/DFGOSRExit.cpp:
2398 (JSC::DFG::OSRExit::executeOSRExit):
2399 (JSC::DFG::reifyInlinedCallFrames):
2400 (JSC::DFG::adjustAndJumpToTarget):
2401 (JSC::DFG::OSRExit::codeLocationForRepatch const):
2402 (JSC::DFG::OSRExit::emitRestoreArguments):
2403 (JSC::DFG::OSRExit::compileOSRExit):
2405 * dfg/DFGOSRExitCompilerCommon.cpp:
2406 (JSC::DFG::handleExitCounts):
2407 (JSC::DFG::reifyInlinedCallFrames):
2408 (JSC::DFG::osrWriteBarrier):
2409 (JSC::DFG::adjustAndJumpToTarget):
2410 * dfg/DFGOperations.cpp:
2411 * dfg/DFGSlowPathGenerator.h:
2412 (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::CallResultAndArgumentsSlowPathGenerator):
2413 (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::unpackAndGenerate):
2414 (JSC::DFG::slowPathCall):
2415 * dfg/DFGSpeculativeJIT.cpp:
2416 (JSC::DFG::SpeculativeJIT::compileMathIC):
2417 (JSC::DFG::SpeculativeJIT::compileCallDOM):
2418 (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
2419 (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
2420 (JSC::DFG::SpeculativeJIT::emitSwitchImm):
2421 (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
2422 (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
2423 (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
2424 (JSC::DFG::SpeculativeJIT::cachedPutById):
2425 * dfg/DFGSpeculativeJIT.h:
2426 (JSC::DFG::SpeculativeJIT::callOperation):
2427 (JSC::DFG::SpeculativeJIT::appendCall):
2428 (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnException):
2429 (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnExceptionSetResult):
2430 (JSC::DFG::SpeculativeJIT::appendCallSetResult):
2431 * dfg/DFGSpeculativeJIT64.cpp:
2432 (JSC::DFG::SpeculativeJIT::cachedGetById):
2433 (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
2434 (JSC::DFG::SpeculativeJIT::compile):
2435 * dfg/DFGThunks.cpp:
2436 (JSC::DFG::osrExitThunkGenerator):
2437 (JSC::DFG::osrExitGenerationThunkGenerator):
2438 (JSC::DFG::osrEntryThunkGenerator):
2440 * disassembler/ARM64Disassembler.cpp:
2441 (JSC::tryToDisassemble):
2442 * disassembler/ARMv7Disassembler.cpp:
2443 (JSC::tryToDisassemble):
2444 * disassembler/Disassembler.cpp:
2446 (JSC::disassembleAsynchronously):
2447 * disassembler/Disassembler.h:
2448 (JSC::tryToDisassemble):
2449 * disassembler/UDis86Disassembler.cpp:
2450 (JSC::tryToDisassembleWithUDis86):
2451 * disassembler/UDis86Disassembler.h:
2452 (JSC::tryToDisassembleWithUDis86):
2453 * disassembler/X86Disassembler.cpp:
2454 (JSC::tryToDisassemble):
2455 * ftl/FTLCompile.cpp:
2456 (JSC::FTL::compile):
2457 * ftl/FTLExceptionTarget.cpp:
2458 (JSC::FTL::ExceptionTarget::label):
2459 (JSC::FTL::ExceptionTarget::jumps):
2460 * ftl/FTLExceptionTarget.h:
2461 * ftl/FTLGeneratedFunction.h:
2462 * ftl/FTLJITCode.cpp:
2463 (JSC::FTL::JITCode::initializeB3Code):
2464 (JSC::FTL::JITCode::initializeAddressForCall):
2465 (JSC::FTL::JITCode::initializeArityCheckEntrypoint):
2466 (JSC::FTL::JITCode::addressForCall):
2467 (JSC::FTL::JITCode::executableAddressAtOffset):
2469 (JSC::FTL::JITCode::b3Code const):
2470 * ftl/FTLJITFinalizer.cpp:
2471 (JSC::FTL::JITFinalizer::finalizeCommon):
2472 * ftl/FTLLazySlowPath.cpp:
2473 (JSC::FTL::LazySlowPath::initialize):
2474 (JSC::FTL::LazySlowPath::generate):
2475 * ftl/FTLLazySlowPath.h:
2476 (JSC::FTL::LazySlowPath::patchableJump const):
2477 (JSC::FTL::LazySlowPath::done const):
2478 (JSC::FTL::LazySlowPath::stub const):
2479 * ftl/FTLLazySlowPathCall.h:
2480 (JSC::FTL::createLazyCallGenerator):
2483 * ftl/FTLLowerDFGToB3.cpp:
2484 (JSC::FTL::DFG::LowerDFGToB3::lower):
2485 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
2486 (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
2487 (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
2488 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
2489 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
2490 (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
2491 (JSC::FTL::DFG::LowerDFGToB3::compileInvalidationPoint):
2492 (JSC::FTL::DFG::LowerDFGToB3::compileIn):
2493 (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
2494 (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
2495 (JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):
2496 (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
2497 * ftl/FTLOSRExit.cpp:
2498 (JSC::FTL::OSRExit::codeLocationForRepatch const):
2500 * ftl/FTLOSRExitCompiler.cpp:
2501 (JSC::FTL::compileStub):
2502 (JSC::FTL::compileFTLOSRExit):
2503 * ftl/FTLOSRExitHandle.cpp:
2504 (JSC::FTL::OSRExitHandle::emitExitThunk):
2505 * ftl/FTLOperations.cpp:
2506 (JSC::FTL::compileFTLLazySlowPath):
2507 * ftl/FTLPatchpointExceptionHandle.cpp:
2508 (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreationForUnwind):
2509 * ftl/FTLSlowPathCall.cpp:
2510 (JSC::FTL::SlowPathCallContext::keyWithTarget const):
2511 (JSC::FTL::SlowPathCallContext::makeCall):
2512 * ftl/FTLSlowPathCall.h:
2513 (JSC::FTL::callOperation):
2514 * ftl/FTLSlowPathCallKey.cpp:
2515 (JSC::FTL::SlowPathCallKey::dump const):
2516 * ftl/FTLSlowPathCallKey.h:
2517 (JSC::FTL::SlowPathCallKey::SlowPathCallKey):
2518 (JSC::FTL::SlowPathCallKey::callTarget const):
2519 (JSC::FTL::SlowPathCallKey::withCallTarget):
2520 (JSC::FTL::SlowPathCallKey::hash const):
2521 (JSC::FTL::SlowPathCallKey::callPtrTag const): Deleted.
2523 (JSC::FTL::State::State):
2524 * ftl/FTLThunks.cpp:
2525 (JSC::FTL::genericGenerationThunkGenerator):
2526 (JSC::FTL::osrExitGenerationThunkGenerator):
2527 (JSC::FTL::lazySlowPathGenerationThunkGenerator):
2528 (JSC::FTL::slowPathCallThunkGenerator):
2530 (JSC::FTL::generateIfNecessary):
2531 (JSC::FTL::keyForThunk):
2532 (JSC::FTL::Thunks::getSlowPathCallThunk):
2533 (JSC::FTL::Thunks::keyForSlowPathCallThunk):
2534 * interpreter/InterpreterInlines.h:
2535 (JSC::Interpreter::getOpcodeID):
2536 * jit/AssemblyHelpers.cpp:
2537 (JSC::AssemblyHelpers::callExceptionFuzz):
2538 (JSC::AssemblyHelpers::emitDumbVirtualCall):
2539 (JSC::AssemblyHelpers::debugCall):
2540 * jit/CCallHelpers.cpp:
2541 (JSC::CCallHelpers::ensureShadowChickenPacket):
2542 * jit/ExecutableAllocator.cpp:
2543 (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
2544 (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
2545 * jit/ExecutableAllocator.h:
2546 (JSC::performJITMemcpy):
2547 * jit/GCAwareJITStubRoutine.cpp:
2548 (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
2549 (JSC::MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine):
2550 (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler):
2551 (JSC::createJITStubRoutine):
2552 * jit/GCAwareJITStubRoutine.h:
2553 (JSC::createJITStubRoutine):
2555 (JSC::ctiPatchCallByReturnAddress):
2556 (JSC::JIT::compileWithoutLinking):
2558 (JSC::JIT::privateCompileExceptionHandlers):
2560 (JSC::CallRecord::CallRecord):
2561 * jit/JITArithmetic.cpp:
2562 (JSC::JIT::emitMathICFast):
2563 (JSC::JIT::emitMathICSlow):
2565 (JSC::JIT::compileOpCallSlowCase):
2566 * jit/JITCall32_64.cpp:
2567 (JSC::JIT::compileOpCallSlowCase):
2569 (JSC::JITCodeWithCodeRef::JITCodeWithCodeRef):
2570 (JSC::JITCodeWithCodeRef::executableAddressAtOffset):
2571 (JSC::DirectJITCode::DirectJITCode):
2572 (JSC::DirectJITCode::initializeCodeRef):
2573 (JSC::DirectJITCode::addressForCall):
2574 (JSC::NativeJITCode::NativeJITCode):
2575 (JSC::NativeJITCode::initializeCodeRef):
2576 (JSC::NativeJITCode::addressForCall):
2579 (JSC::JITCodeMap::Entry::Entry):
2580 (JSC::JITCodeMap::Entry::codeLocation):
2581 (JSC::JITCodeMap::append):
2582 (JSC::JITCodeMap::find const):
2583 * jit/JITDisassembler.cpp:
2584 (JSC::JITDisassembler::dumpDisassembly):
2585 * jit/JITExceptions.cpp:
2586 (JSC::genericUnwind):
2587 * jit/JITInlineCacheGenerator.cpp:
2588 (JSC::JITByIdGenerator::finalize):
2590 (JSC::JIT::emitNakedCall):
2591 (JSC::JIT::emitNakedTailCall):
2592 (JSC::JIT::appendCallWithExceptionCheck):
2593 (JSC::JIT::appendCallWithExceptionCheckAndSlowPathReturnType):
2594 (JSC::JIT::appendCallWithCallFrameRollbackOnException):
2595 (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult):
2596 (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
2598 (JSC::isProfileEmpty):
2599 * jit/JITOpcodes.cpp:
2600 (JSC::JIT::emit_op_catch):
2601 (JSC::JIT::emit_op_switch_imm):
2602 (JSC::JIT::emit_op_switch_char):
2603 (JSC::JIT::emit_op_switch_string):
2604 (JSC::JIT::privateCompileHasIndexedProperty):
2605 (JSC::JIT::emitSlow_op_has_indexed_property):
2606 * jit/JITOpcodes32_64.cpp:
2607 (JSC::JIT::privateCompileHasIndexedProperty):
2608 * jit/JITOperations.cpp:
2610 * jit/JITPropertyAccess.cpp:
2611 (JSC::JIT::stringGetByValStubGenerator):
2612 (JSC::JIT::emitGetByValWithCachedId):
2613 (JSC::JIT::emitSlow_op_get_by_val):
2614 (JSC::JIT::emitPutByValWithCachedId):
2615 (JSC::JIT::emitSlow_op_put_by_val):
2616 (JSC::JIT::emitSlow_op_try_get_by_id):
2617 (JSC::JIT::emitSlow_op_get_by_id_direct):
2618 (JSC::JIT::emitSlow_op_get_by_id):
2619 (JSC::JIT::emitSlow_op_get_by_id_with_this):
2620 (JSC::JIT::emitSlow_op_put_by_id):
2621 (JSC::JIT::privateCompileGetByVal):
2622 (JSC::JIT::privateCompileGetByValWithCachedId):
2623 (JSC::JIT::privateCompilePutByVal):
2624 (JSC::JIT::privateCompilePutByValWithCachedId):
2625 * jit/JITPropertyAccess32_64.cpp:
2626 (JSC::JIT::stringGetByValStubGenerator):
2627 (JSC::JIT::emitSlow_op_get_by_val):
2628 (JSC::JIT::emitSlow_op_put_by_val):
2629 * jit/JITStubRoutine.h:
2630 (JSC::JITStubRoutine::JITStubRoutine):
2631 (JSC::JITStubRoutine::createSelfManagedRoutine):
2632 (JSC::JITStubRoutine::code const):
2633 (JSC::JITStubRoutine::asCodePtr):
2634 * jit/JITThunks.cpp:
2635 (JSC::JITThunks::ctiNativeCall):
2636 (JSC::JITThunks::ctiNativeConstruct):
2637 (JSC::JITThunks::ctiNativeTailCall):
2638 (JSC::JITThunks::ctiNativeTailCallWithoutSavedTags):
2639 (JSC::JITThunks::ctiInternalFunctionCall):
2640 (JSC::JITThunks::ctiInternalFunctionConstruct):
2641 (JSC::JITThunks::ctiStub):
2642 (JSC::JITThunks::existingCTIStub):
2643 (JSC::JITThunks::hostFunctionStub):
2645 * jit/PCToCodeOriginMap.cpp:
2646 (JSC::PCToCodeOriginMap::PCToCodeOriginMap):
2647 * jit/PCToCodeOriginMap.h:
2648 * jit/PolymorphicCallStubRoutine.cpp:
2649 (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
2650 * jit/PolymorphicCallStubRoutine.h:
2652 (JSC::readPutICCallTarget):
2653 (JSC::ftlThunkAwareRepatchCall):
2654 (JSC::appropriateOptimizingGetByIdFunction):
2655 (JSC::appropriateGetByIdFunction):
2656 (JSC::tryCacheGetByID):
2657 (JSC::repatchGetByID):
2658 (JSC::tryCachePutByID):
2659 (JSC::repatchPutByID):
2664 (JSC::linkDirectFor):
2667 (JSC::linkVirtualFor):
2668 (JSC::linkPolymorphicCall):
2669 (JSC::resetGetByID):
2670 (JSC::resetPutByID):
2672 * jit/SlowPathCall.h:
2673 (JSC::JITSlowPathCall::call):
2674 * jit/SpecializedThunkJIT.h:
2675 (JSC::SpecializedThunkJIT::finalize):
2676 (JSC::SpecializedThunkJIT::callDoubleToDouble):
2677 (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
2678 * jit/ThunkGenerator.h:
2679 * jit/ThunkGenerators.cpp:
2680 (JSC::throwExceptionFromCallSlowPathGenerator):
2682 (JSC::linkCallThunkGenerator):
2683 (JSC::linkPolymorphicCallThunkGenerator):
2684 (JSC::virtualThunkFor):
2685 (JSC::nativeForGenerator):
2686 (JSC::nativeCallGenerator):
2687 (JSC::nativeTailCallGenerator):
2688 (JSC::nativeTailCallWithoutSavedTagsGenerator):
2689 (JSC::nativeConstructGenerator):
2690 (JSC::internalFunctionCallGenerator):
2691 (JSC::internalFunctionConstructGenerator):
2692 (JSC::arityFixupGenerator):
2693 (JSC::unreachableGenerator):
2694 (JSC::charCodeAtThunkGenerator):
2695 (JSC::charAtThunkGenerator):
2696 (JSC::fromCharCodeThunkGenerator):
2697 (JSC::clz32ThunkGenerator):
2698 (JSC::sqrtThunkGenerator):
2699 (JSC::floorThunkGenerator):
2700 (JSC::ceilThunkGenerator):
2701 (JSC::truncThunkGenerator):
2702 (JSC::roundThunkGenerator):
2703 (JSC::expThunkGenerator):
2704 (JSC::logThunkGenerator):
2705 (JSC::absThunkGenerator):
2706 (JSC::imulThunkGenerator):
2707 (JSC::randomThunkGenerator):
2708 (JSC::boundThisNoArgsFunctionCallGenerator):
2709 * jit/ThunkGenerators.h:
2710 * llint/LLIntData.cpp:
2711 (JSC::LLInt::initialize):
2712 * llint/LLIntData.h:
2713 (JSC::LLInt::getExecutableAddress):
2714 (JSC::LLInt::getCodePtr):
2715 (JSC::LLInt::getCodeRef):
2716 (JSC::LLInt::getCodeFunctionPtr):
2717 * llint/LLIntEntrypoint.cpp:
2718 (JSC::LLInt::setFunctionEntrypoint):
2719 (JSC::LLInt::setEvalEntrypoint):
2720 (JSC::LLInt::setProgramEntrypoint):
2721 (JSC::LLInt::setModuleProgramEntrypoint):
2722 * llint/LLIntExceptions.cpp:
2723 (JSC::LLInt::callToThrow):
2724 * llint/LLIntSlowPaths.cpp:
2725 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2726 (JSC::LLInt::setUpCall):
2727 * llint/LLIntThunks.cpp:
2728 (JSC::vmEntryToWasm):
2729 (JSC::LLInt::generateThunkWithJumpTo):
2730 (JSC::LLInt::functionForCallEntryThunkGenerator):
2731 (JSC::LLInt::functionForConstructEntryThunkGenerator):
2732 (JSC::LLInt::functionForCallArityCheckThunkGenerator):
2733 (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
2734 (JSC::LLInt::evalEntryThunkGenerator):
2735 (JSC::LLInt::programEntryThunkGenerator):
2736 (JSC::LLInt::moduleProgramEntryThunkGenerator):
2737 * llint/LLIntThunks.h:
2738 * llint/LowLevelInterpreter.asm:
2739 * llint/LowLevelInterpreter32_64.asm:
2740 * llint/LowLevelInterpreter64.asm:
2741 * profiler/ProfilerCompilation.cpp:
2742 (JSC::Profiler::Compilation::addOSRExitSite):
2743 * profiler/ProfilerCompilation.h:
2744 * profiler/ProfilerOSRExitSite.cpp:
2745 (JSC::Profiler::OSRExitSite::toJS const):
2746 * profiler/ProfilerOSRExitSite.h:
2747 (JSC::Profiler::OSRExitSite::OSRExitSite):
2748 (JSC::Profiler::OSRExitSite::codeAddress const):
2749 (JSC::Profiler::OSRExitSite:: const): Deleted.
2750 * runtime/ExecutableBase.cpp:
2751 (JSC::ExecutableBase::clearCode):
2752 * runtime/ExecutableBase.h:
2753 (JSC::ExecutableBase::entrypointFor):
2754 * runtime/NativeExecutable.cpp:
2755 (JSC::NativeExecutable::finishCreation):
2756 * runtime/NativeFunction.h:
2757 (JSC::TaggedNativeFunction::TaggedNativeFunction):
2758 (JSC::TaggedNativeFunction::operator NativeFunction):
2761 (JSC::untagCodePtr):
2762 (JSC::retagCodePtr):
2763 (JSC::tagCFunctionPtr):
2764 (JSC::untagCFunctionPtr):
2765 (JSC::nextPtrTagID): Deleted.
2766 * runtime/PutPropertySlot.h:
2767 (JSC::PutPropertySlot::PutPropertySlot):
2768 (JSC::PutPropertySlot::setCustomValue):
2769 (JSC::PutPropertySlot::setCustomAccessor):
2770 (JSC::PutPropertySlot::customSetter const):
2771 * runtime/ScriptExecutable.cpp:
2772 (JSC::ScriptExecutable::installCode):
2774 (JSC::VM::getHostFunction):
2775 (JSC::VM::getCTIInternalFunctionTrampolineFor):
2777 (JSC::VM::getCTIStub):
2778 * wasm/WasmB3IRGenerator.cpp:
2779 (JSC::Wasm::B3IRGenerator::B3IRGenerator):
2780 (JSC::Wasm::B3IRGenerator::emitExceptionCheck):
2781 (JSC::Wasm::B3IRGenerator::emitTierUpCheck):
2782 (JSC::Wasm::B3IRGenerator::addCall):
2783 (JSC::Wasm::B3IRGenerator::addCallIndirect):
2784 * wasm/WasmBBQPlan.cpp:
2785 (JSC::Wasm::BBQPlan::prepare):
2786 (JSC::Wasm::BBQPlan::complete):
2787 * wasm/WasmBBQPlan.h:
2788 * wasm/WasmBinding.cpp:
2789 (JSC::Wasm::wasmToWasm):
2790 * wasm/WasmBinding.h:
2791 * wasm/WasmCallee.h:
2792 (JSC::Wasm::Callee::entrypoint const):
2793 * wasm/WasmCallingConvention.h:
2794 (JSC::Wasm::CallingConvention::setupFrameInPrologue const):
2795 * wasm/WasmCodeBlock.h:
2796 (JSC::Wasm::CodeBlock::entrypointLoadLocationFromFunctionIndexSpace):
2797 * wasm/WasmFaultSignalHandler.cpp:
2798 (JSC::Wasm::trapHandler):
2799 * wasm/WasmFormat.h:
2800 * wasm/WasmInstance.h:
2801 * wasm/WasmOMGPlan.cpp:
2802 (JSC::Wasm::OMGPlan::work):
2803 * wasm/WasmThunks.cpp:
2804 (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
2805 (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
2806 (JSC::Wasm::triggerOMGTierUpThunkGenerator):
2807 (JSC::Wasm::Thunks::stub):
2808 (JSC::Wasm::Thunks::existingStub):
2809 * wasm/WasmThunks.h:
2810 * wasm/js/JSToWasm.cpp:
2811 (JSC::Wasm::createJSToWasmWrapper):
2812 * wasm/js/JSWebAssemblyCodeBlock.h:
2813 * wasm/js/WasmToJS.cpp:
2814 (JSC::Wasm::handleBadI64Use):
2815 (JSC::Wasm::wasmToJS):
2816 * wasm/js/WasmToJS.h:
2817 * wasm/js/WebAssemblyFunction.h:
2819 (JSC::Yarr::YarrGenerator::loadFromFrameAndJump):
2820 (JSC::Yarr::YarrGenerator::BacktrackingState::linkDataLabels):
2821 (JSC::Yarr::YarrGenerator::compile):
2823 (JSC::Yarr::YarrCodeBlock::set8BitCode):
2824 (JSC::Yarr::YarrCodeBlock::set16BitCode):
2825 (JSC::Yarr::YarrCodeBlock::set8BitCodeMatchOnly):
2826 (JSC::Yarr::YarrCodeBlock::set16BitCodeMatchOnly):
2827 (JSC::Yarr::YarrCodeBlock::execute):
2828 (JSC::Yarr::YarrCodeBlock::clear):
2830 2018-04-17 Commit Queue <commit-queue@webkit.org>
2832 Unreviewed, rolling out r230697, r230720, and r230724.
2833 https://bugs.webkit.org/show_bug.cgi?id=184717
2835 These caused multiple failures on the Test262 testers.
2836 (Requested by mlewis13 on #webkit).
2838 Reverted changesets:
2840 "[WebAssembly][Modules] Prototype wasm import"
2841 https://bugs.webkit.org/show_bug.cgi?id=184600
2842 https://trac.webkit.org/changeset/230697
2844 "[WebAssembly][Modules] Implement function import from wasm
2846 https://bugs.webkit.org/show_bug.cgi?id=184689
2847 https://trac.webkit.org/changeset/230720
2849 "[JSC] Rename runWebAssembly to runWebAssemblySuite"
2850 https://bugs.webkit.org/show_bug.cgi?id=184703
2851 https://trac.webkit.org/changeset/230724
2853 2018-04-17 JF Bastien <jfbastien@apple.com>
2855 A put is not an ExistingProperty put when we transition a structure because of an attributes change
2856 https://bugs.webkit.org/show_bug.cgi?id=184706
2857 <rdar://problem/38871451>
2859 Reviewed by Saam Barati.
2861 When putting a property on a structure and the slot is a different
2862 type, the slot can't be said to have already been existing.
2864 * runtime/JSObjectInlines.h:
2865 (JSC::JSObject::putDirectInternal):
2867 2018-04-17 Filip Pizlo <fpizlo@apple.com>
2869 JSGenericTypedArrayView<>::visitChildren has a race condition reading m_mode and m_vector
2870 https://bugs.webkit.org/show_bug.cgi?id=184705
2872 Reviewed by Michael Saboff.
2874 My old multisocket Mac Pro is amazing at catching race conditions in the GC. Earlier today
2875 while testing an unrelated patch, a concurrent GC thread crashed inside
2876 JSGenericTypedArrayView<>::visitChildren() calling markAuxiliary(). I'm pretty sure it's
2877 because a typed array became wasteful concurrently to the GC. So, visitChildren() read one
2878 mode and another vector.
2880 The fix is to lock inside visitChildren and anyone who changes those fields.
2882 I'm not even going to try to write a test. I think it's super lucky that my Mac Pro caught
2885 * runtime/JSArrayBufferView.cpp:
2886 (JSC::JSArrayBufferView::neuter):
2887 * runtime/JSGenericTypedArrayViewInlines.h:
2888 (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
2889 (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
2891 2018-04-16 Filip Pizlo <fpizlo@apple.com>
2893 PutStackSinkingPhase should know that KillStack means ConflictingFlush
2894 https://bugs.webkit.org/show_bug.cgi?id=184672
2896 Reviewed by Michael Saboff.
2898 We've had a long history of KillStack and PutStackSinkingPhase having problems. We kept changing the meaning of
2899 KillStack, and at some point we removed reasoning about KillStack from PutStackSinkingPhase. I tried doing some
2900 archeology - but I'm still not sure why that phase ignores KillStack entirely. Maybe it's an oversight or maybe it's
2901 intentional - I don't know.
2903 Whatever the history, it's clear from the attached test case that ignoring KillStack is not correct. The outcome of
2904 doing so is that we will sometimes sink a PutStack below a KillStack. That's wrong because then, OSR exit will use
2905 the value from the PutStack instead of using the value from the MovHint that is associated with the KillStack. So,
2906 KillStack must be seen as a special kind of clobber of the stack slot. OSRAvailabiity uses ConflictingFlush. I think
2907 that's correct here, too. If we used DeadFlush and that was merged with another control flow path that had a
2908 specific flush format, then we would think that we could sink the flush from that path. That's not right, since that
2909 could still lead to sinking a PutStack past the KillStack in the sense that a PutStack will appear after the
2910 KillStack along one path through the CFG. Also, the definition of DeadFlush and ConflictingFlush in the comment
2911 inside PutStackSinkingPhase seems to suggest that KillStack is a ConflictingFlush, since DeadFlush means that we
2912 have done some PutStack and their values are still valid. KillStack is not a PutStack and it means that previous
2913 values are not valid. The definition of ConflictingFlush is that "we know, via forward flow, that there isn't any
2914 value in the given local that anyone should have been relying on" - which exactly matches KillStack's definition.
2916 This also means that we cannot eliminate arguments allocations that are live over KillStacks, since if we eliminated
2917 them then we would have a GetStack after a KillStack. One easy way to fix this is to say that KillStack writes to
2918 its stack slot for the purpose of clobberize.
2920 * dfg/DFGClobberize.h: KillStack "writes" to its stack slot.
2921 * dfg/DFGPutStackSinkingPhase.cpp: Fix the bug.
2922 * ftl/FTLLowerDFGToB3.cpp: Add better assertion failure.
2923 (JSC::FTL::DFG::LowerDFGToB3::buildExitArguments):
2925 2018-04-17 Filip Pizlo <fpizlo@apple.com>
2927 JSWebAssemblyCodeBlock should be in an IsoSubspace
2928 https://bugs.webkit.org/show_bug.cgi?id=184704
2930 Reviewed by Mark Lam.
2932 Previously it was in a CompleteSubspace, which is pretty good, but also quite wasteful.
2933 CompleteSubspace means about 4KB of data to track the size-allocator mapping. IsoSubspace
2934 shortcircuits this. Also, IsoSubspace uses the iso allocator, so it provides stronger UAF
2940 * wasm/js/JSWebAssemblyCodeBlock.h:
2942 2018-04-17 Jer Noble <jer.noble@apple.com>
2944 Only enable useSeparatedWXHeap on ARM64.
2945 https://bugs.webkit.org/show_bug.cgi?id=184697
2947 Reviewed by Saam Barati.
2949 * runtime/Options.cpp:
2950 (JSC::recomputeDependentOptions):
2952 2018-04-17 Yusuke Suzuki <utatane.tea@gmail.com>
2954 [WebAssembly][Modules] Implement function import from wasm modules
2955 https://bugs.webkit.org/show_bug.cgi?id=184689
2957 Reviewed by JF Bastien.
2959 This patch implements function import from wasm modules. We move function importing part
2960 from JSWebAssemblyInstance's creation function to WebAssemblyModuleRecord::link. This
2961 is because linking these functions requires that all the dependent modules are created.
2962 While we want to move all the linking functionality from JSWebAssemblyInstance to
2963 WebAssemblyModuleRecord::link, we do not that in this patch. In this patch, we move only
2964 function importing part because efficient compilation of WebAssembly needs to know
2965 the type of WebAssemblyMemory (signaling or bound checking). This needs to know imported
2966 or attached WebAssembly memory object. So we cannot defer this linking to
2967 WebAssemblyModuleRecord::link now.
2969 The largest difference from JS module linking is that WebAssembly module linking links
2970 function from the module by snapshotting. When you have a cyclic module graph like this,
2972 -> JS1 (export "fun") -> Wasm1 (import "fun from JS1) -+
2974 +--------------------------------------------------+
2976 we fail to link this since "fun" is not instantiated when Wasm1 is first linked. This behavior
2977 is described in [1], and tested in this patch.
2979 [1]: https://github.com/WebAssembly/esm-integration/tree/master/proposals/esm-integration#js---wasm-cycle-where-js-is-higher-in-the-module-graph
2981 * JavaScriptCore.xcodeproj/project.pbxproj:
2983 (functionDollarAgentStart):
2986 Small fixes for wasm module loading.
2988 * parser/NodesAnalyzeModule.cpp:
2989 (JSC::ImportDeclarationNode::analyzeModule):
2990 * runtime/AbstractModuleRecord.cpp:
2991 (JSC::AbstractModuleRecord::resolveImport):
2992 (JSC::AbstractModuleRecord::link):
2993 * runtime/AbstractModuleRecord.h:
2994 (JSC::AbstractModuleRecord::moduleEnvironmentMayBeNull):
2995 (JSC::AbstractModuleRecord::ImportEntry::isNamespace const): Deleted.
2996 Now, wasm modules can have import which is named "*". So this function does not work.
2997 Since wasm modules never have namespace importing, we check this in JS's module analyzer.
2999 * runtime/JSModuleEnvironment.cpp:
3000 (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
3001 * runtime/JSModuleRecord.cpp:
3002 (JSC::JSModuleRecord::instantiateDeclarations):
3003 * wasm/WasmCreationMode.h: Added.
3004 * wasm/js/JSWebAssemblyInstance.cpp:
3005 (JSC::JSWebAssemblyInstance::finalizeCreation):
3006 (JSC::JSWebAssemblyInstance::create):
3007 * wasm/js/JSWebAssemblyInstance.h:
3008 * wasm/js/WebAssemblyInstanceConstructor.cpp:
3009 (JSC::constructJSWebAssemblyInstance):
3010 * wasm/js/WebAssemblyModuleRecord.cpp:
3011 (JSC::WebAssemblyModuleRecord::link):
3012 * wasm/js/WebAssemblyModuleRecord.h:
3013 * wasm/js/WebAssemblyPrototype.cpp:
3016 (JSC::compileAndInstantiate):
3017 (JSC::WebAssemblyPrototype::instantiate):
3018 (JSC::webAssemblyInstantiateFunc):
3020 2018-04-17 Dominik Infuehr <dinfuehr@igalia.com>
3022 Implement setupArgumentsImpl for ARM and MIPS
3023 https://bugs.webkit.org/show_bug.cgi?id=183786
3025 Reviewed by Yusuke Suzuki.
3027 Implement setupArgumentsImpl for ARM (hardfp and softfp) and MIPS calling convention. Added
3028 numCrossSources and extraGPRArgs to ArgCollection to keep track of extra
3029 registers used for 64-bit values on 32-bit architectures. numCrossSources
3030 keeps track of assignments from FPR to GPR registers as happens e.g. on MIPS.
3032 * assembler/MacroAssemblerARMv7.h:
3033 (JSC::MacroAssemblerARMv7::moveDouble):
3034 * assembler/MacroAssemblerMIPS.h:
3035 (JSC::MacroAssemblerMIPS::moveDouble):
3036 * jit/CCallHelpers.h:
3037 (JSC::CCallHelpers::setupStubCrossArgs):
3038 (JSC::CCallHelpers::ArgCollection::ArgCollection):
3039 (JSC::CCallHelpers::ArgCollection::pushRegArg):
3040 (JSC::CCallHelpers::ArgCollection::pushExtraRegArg):
3041 (JSC::CCallHelpers::ArgCollection::addGPRArg):
3042 (JSC::CCallHelpers::ArgCollection::addGPRExtraArg):
3043 (JSC::CCallHelpers::ArgCollection::addStackArg):
3044 (JSC::CCallHelpers::ArgCollection::addPoke):
3045 (JSC::CCallHelpers::ArgCollection::argCount):
3046 (JSC::CCallHelpers::calculatePokeOffset):
3047 (JSC::CCallHelpers::pokeForArgument):
3048 (JSC::CCallHelpers::stackAligned):
3049 (JSC::CCallHelpers::marshallArgumentRegister):
3050 (JSC::CCallHelpers::setupArgumentsImpl):
3051 (JSC::CCallHelpers::pokeArgumentsAligned):
3052 (JSC::CCallHelpers::std::is_integral<CURRENT_ARGUMENT_TYPE>::value):
3053 (JSC::CCallHelpers::std::is_pointer<CURRENT_ARGUMENT_TYPE>::value):
3054 (JSC::CCallHelpers::setupArguments):
3056 (JSC::FPRInfo::toArgumentRegister):
3058 2018-04-17 Saam Barati <sbarati@apple.com>
3060 Add system trace points for process launch and for initializeWebProcess
3061 https://bugs.webkit.org/show_bug.cgi?id=184669
3063 Reviewed by Simon Fraser.
3065 * runtime/VMEntryScope.cpp:
3066 (JSC::VMEntryScope::VMEntryScope):
3067 (JSC::VMEntryScope::~VMEntryScope):
3069 2018-04-17 Jer Noble <jer.noble@apple.com>
3071 Fix duplicate symbol errors when building JavaScriptCore with non-empty WK_ALTERNATE_WEBKIT_SDK_PATH
3072 https://bugs.webkit.org/show_bug.cgi?id=184602
3074 Reviewed by Beth Dakin.
3076 * JavaScriptCore.xcodeproj/project.pbxproj:
3078 2018-04-17 Carlos Garcia Campos <cgarcia@igalia.com>
3080 [GLIB] Add API to clear JSCContext uncaught exception
3081 https://bugs.webkit.org/show_bug.cgi?id=184685
3083 Reviewed by Žan Doberšek.
3085 Add jsc_context_clear_exception() to clear any possible uncaught exception in a JSCContext.
3087 * API/glib/JSCContext.cpp:
3088 (jsc_context_clear_exception):
3089 * API/glib/JSCContext.h:
3090 * API/glib/docs/jsc-glib-4.0-sections.txt:
3092 2018-04-17 Carlos Garcia Campos <cgarcia@igalia.com>
3094 [GLIB] Add API to query, delete and enumerate properties
3095 https://bugs.webkit.org/show_bug.cgi?id=184647
3097 Reviewed by Michael Catanzaro.
3099 Add jsc_value_object_has_property(), jsc_value_object_delete_property() and jsc_value_object_enumerate_properties().
3101 * API/glib/JSCValue.cpp:
3102 (jsc_value_object_has_property):
3103 (jsc_value_object_delete_property):
3104 (jsc_value_object_enumerate_properties):
3105 * API/glib/JSCValue.h:
3106 * API/glib/docs/jsc-glib-4.0-sections.txt:
3108 2018-04-16 Yusuke Suzuki <utatane.tea@gmail.com>
3110 [WebAssembly][Modules] Prototype wasm import
3111 https://bugs.webkit.org/show_bug.cgi?id=184600
3113 Reviewed by JF Bastien.
3115 This patch is an initial attempt to implement Wasm loading in module pipeline.
3118 1. We only support Wasm loading in the JSC shell. Once loading mechanism is specified
3119 in whatwg HTML, we should integrate this into WebCore.
3121 2. We only support exporting values from Wasm. Wasm module cannot import anything from
3122 the other modules now.
3124 When loading a file, JSC shell checks wasm magic. If the wasm magic is found, JSC shell
3125 loads the file with WebAssemblySourceProvider. It is wrapped into JSSourceCode and
3126 module loader pipeline just handles it as the same to JS. When parsing a module, we
3127 checks the type of JSSourceCode. If the source code is Wasm source code, we create a
3128 WebAssemblyModuleRecord instead of JSModuleRecord. Our module pipeline handles
3129 AbstractModuleRecord and Wasm module is instantiated, linked, and evaluated.
3131 * builtins/ModuleLoaderPrototype.js:
3132 (globalPrivate.newRegistryEntry):
3133 (requestInstantiate):
3136 (convertShebangToJSComment):
3137 (fillBufferWithContentsOfFile):
3138 (fetchModuleFromLocalFileSystem):
3139 (GlobalObject::moduleLoaderFetch):
3140 * parser/SourceProvider.h:
3141 (JSC::WebAssemblySourceProvider::create):
3142 (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
3143 * runtime/AbstractModuleRecord.cpp:
3144 (JSC::AbstractModuleRecord::hostResolveImportedModule):
3145 (JSC::AbstractModuleRecord::link):
3146 (JSC::AbstractModuleRecord::evaluate):
3147 (JSC::identifierToJSValue): Deleted.
3148 * runtime/AbstractModuleRecord.h:
3149 * runtime/JSModuleLoader.cpp:
3150 (JSC::JSModuleLoader::evaluate):
3151 * runtime/JSModuleRecord.cpp:
3152 (JSC::JSModuleRecord::link):
3153 (JSC::JSModuleRecord::instantiateDeclarations):
3154 * runtime/JSModuleRecord.h:
3155 * runtime/ModuleLoaderPrototype.cpp:
3156 (JSC::moduleLoaderPrototypeParseModule):
3157 (JSC::moduleLoaderPrototypeRequestedModules):
3158 (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
3159 * wasm/js/JSWebAssemblyHelpers.h:
3160 (JSC::getWasmBufferFromValue):
3161 (JSC::createSourceBufferFromValue):
3162 * wasm/js/JSWebAssemblyInstance.cpp:
3163 (JSC::JSWebAssemblyInstance::finalizeCreation):
3164 (JSC::JSWebAssemblyInstance::createPrivateModuleKey):
3165 (JSC::JSWebAssemblyInstance::create):
3166 * wasm/js/JSWebAssemblyInstance.h:
3167 * wasm/js/WebAssemblyInstanceConstructor.cpp:
3168 (JSC::constructJSWebAssemblyInstance):
3169 * wasm/js/WebAssemblyModuleRecord.cpp:
3170 (JSC::WebAssemblyModuleRecord::prepareLink):
3171 (JSC::WebAssemblyModuleRecord::link):
3172 * wasm/js/WebAssemblyModuleRecord.h:
3173 * wasm/js/WebAssemblyPrototype.cpp:
3176 (JSC::compileAndInstantiate):
3177 (JSC::WebAssemblyPrototype::instantiate):
3178 (JSC::webAssemblyInstantiateFunc):
3179 (JSC::webAssemblyValidateFunc):
3180 * wasm/js/WebAssemblyPrototype.h:
3182 2018-04-14 Filip Pizlo <fpizlo@apple.com>
3184 Function.prototype.caller shouldn't return generator bodies
3185 https://bugs.webkit.org/show_bug.cgi?id=184630
3187 Reviewed by Yusuke Suzuki.
3189 Function.prototype.caller no longer returns generator bodies. Those are meant to be
3192 Also added some builtin debugging tools so that it's easier to do the investigation that I
3195 * builtins/BuiltinNames.h:
3196 * runtime/JSFunction.cpp:
3197 (JSC::JSFunction::callerGetter):
3198 * runtime/JSGlobalObject.cpp:
3199 (JSC::JSGlobalObject::init):
3200 * runtime/JSGlobalObjectFunctions.cpp:
3201 (JSC::globalFuncBuiltinDescribe):
3202 * runtime/JSGlobalObjectFunctions.h:
3204 2018-04-13 Yusuke Suzuki <utatane.tea@gmail.com>
3206 [DFG] Remove duplicate 32bit ProfileType implementation
3207 https://bugs.webkit.org/show_bug.cgi?id=184536
3209 Reviewed by Saam Barati.
3211 This patch removes duplicate 32bit ProfileType implementation by unifying 32/64 implementations.
3213 * dfg/DFGSpeculativeJIT.cpp:
3214 (JSC::DFG::SpeculativeJIT::compileProfileType):
3215 * dfg/DFGSpeculativeJIT.h:
3216 * dfg/DFGSpeculativeJIT32_64.cpp:
3217 (JSC::DFG::SpeculativeJIT::compile):
3218 * dfg/DFGSpeculativeJIT64.cpp:
3219 (JSC::DFG::SpeculativeJIT::compile):
3220 * jit/AssemblyHelpers.h:
3221 (JSC::AssemblyHelpers::branchIfUndefined):
3222 (JSC::AssemblyHelpers::branchIfNull):
3224 2018-04-12 Mark Lam <mark.lam@apple.com>
3226 Consolidate some PtrTags.
3227 https://bugs.webkit.org/show_bug.cgi?id=184552
3228 <rdar://problem/39389404>
3230 Reviewed by Filip Pizlo.
3232 Consolidate CodeEntryPtrTag and CodeEntryWithArityCheckPtrTag into CodePtrTag.
3233 Consolidate NearCallPtrTag and NearJumpPtrTag into NearCodePtrTag.
3235 * assembler/AbstractMacroAssembler.h:
3236 (JSC::AbstractMacroAssembler::repatchNearCall):
3237 * assembler/MacroAssemblerARM.h:
3238 (JSC::MacroAssemblerARM::readCallTarget):
3239 * assembler/MacroAssemblerARMv7.h:
3240 (JSC::MacroAssemblerARMv7::readCallTarget):
3241 * assembler/MacroAssemblerMIPS.h:
3242 (JSC::MacroAssemblerMIPS::readCallTarget):
3243 * assembler/MacroAssemblerX86.h:
3244 (JSC::MacroAssemblerX86::readCallTarget):
3245 * assembler/MacroAssemblerX86_64.h:
3246 (JSC::MacroAssemblerX86_64::readCallTarget):
3247 * bytecode/AccessCase.cpp:
3248 (JSC::AccessCase::generateImpl):
3249 * bytecode/InlineAccess.cpp:
3250 (JSC::InlineAccess::rewireStubAsJump):
3251 * bytecode/PolymorphicAccess.cpp:
3252 (JSC::PolymorphicAccess::regenerate):
3253 * dfg/DFGJITCompiler.cpp:
3254 (JSC::DFG::JITCompiler::linkOSRExits):
3255 (JSC::DFG::JITCompiler::link):
3256 (JSC::DFG::JITCompiler::compileFunction):
3257 * dfg/DFGJITFinalizer.cpp:
3258 (JSC::DFG::JITFinalizer::finalize):
3259 (JSC::DFG::JITFinalizer::finalizeFunction):
3260 * dfg/DFGOSREntry.cpp:
3261 (JSC::DFG::prepareOSREntry):
3262 * dfg/DFGOSRExit.cpp:
3263 (JSC::DFG::OSRExit::executeOSRExit):
3264 (JSC::DFG::adjustAndJumpToTarget):
3265 (JSC::DFG::OSRExit::compileOSRExit):
3266 * dfg/DFGOSRExitCompilerCommon.cpp:
3267 (JSC::DFG::adjustAndJumpToTarget):
3268 * dfg/DFGOperations.cpp:
3269 * ftl/FTLJITCode.cpp:
3270 (JSC::FTL::JITCode::executableAddressAtOffset):
3271 * ftl/FTLJITFinalizer.cpp:
3272 (JSC::FTL::JITFinalizer::finalizeCommon):
3273 * ftl/FTLLazySlowPath.cpp:
3274 (JSC::FTL::LazySlowPath::generate):
3277 * ftl/FTLLowerDFGToB3.cpp:
3278 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
3279 (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
3280 (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
3281 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
3282 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
3283 (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
3284 * ftl/FTLOSRExitCompiler.cpp:
3285 (JSC::FTL::compileFTLOSRExit):
3286 * ftl/FTLOSRExitHandle.cpp:
3287 (JSC::FTL::OSRExitHandle::emitExitThunk):
3288 * jit/AssemblyHelpers.cpp:
3289 (JSC::AssemblyHelpers::emitDumbVirtualCall):
3291 (JSC::JIT::compileWithoutLinking):
3294 (JSC::JIT::compileOpCallSlowCase):
3296 (JSC::JITCodeWithCodeRef::executableAddressAtOffset):
3297 (JSC::NativeJITCode::addressForCall):
3299 (JSC::JIT::emitNakedCall):
3300 (JSC::JIT::emitNakedTailCall):
3302 (JSC::isProfileEmpty):
3303 * jit/JITOpcodes.cpp:
3304 (JSC::JIT::privateCompileHasIndexedProperty):
3305 * jit/JITOperations.cpp:
3306 * jit/JITPropertyAccess.cpp:
3307 (JSC::JIT::stringGetByValStubGenerator):
3308 (JSC::JIT::privateCompileGetByVal):
3309 (JSC::JIT::privateCompileGetByValWithCachedId):
3310 (JSC::JIT::privateCompilePutByVal):
3311 (JSC::JIT::privateCompilePutByValWithCachedId):
3312 * jit/JITThunks.cpp:
3313 (JSC::JITThunks::hostFunctionStub):
3317 (JSC::linkPolymorphicCall):
3318 * jit/SpecializedThunkJIT.h:
3319 (JSC::SpecializedThunkJIT::finalize):
3320 * jit/ThunkGenerators.cpp:
3321 (JSC::virtualThunkFor):
3322 (JSC::nativeForGenerator):
3323 (JSC::boundThisNoArgsFunctionCallGenerator):
3324 * llint/LLIntData.cpp:
3325 (JSC::LLInt::initialize):
3326 * llint/LLIntEntrypoint.cpp:
3327 (JSC::LLInt::setEvalEntrypoint):
3328 (JSC::LLInt::setProgramEntrypoint):
3329 (JSC::LLInt::setModuleProgramEntrypoint):
3330 * llint/LLIntSlowPaths.cpp:
3331 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3332 (JSC::LLInt::setUpCall):
3333 * llint/LLIntThunks.cpp:
3334 (JSC::LLInt::generateThunkWithJumpTo):
3335 (JSC::LLInt::functionForCallEntryThunkGenerator):
3336 (JSC::LLInt::functionForConstructEntryThunkGenerator):
3337 (JSC::LLInt::functionForCallArityCheckThunkGenerator):
3338 (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
3339 (JSC::LLInt::evalEntryThunkGenerator):
3340 (JSC::LLInt::programEntryThunkGenerator):
3341 (JSC::LLInt::moduleProgramEntryThunkGenerator):
3342 * llint/LowLevelInterpreter.asm:
3343 * llint/LowLevelInterpreter64.asm:
3344 * runtime/NativeExecutable.cpp:
3345 (JSC::NativeExecutable::finishCreation):
3346 * runtime/NativeFunction.h:
3347 (JSC::TaggedNativeFunction::TaggedNativeFunction):
3348 (JSC::TaggedNativeFunction::operator NativeFunction):
3350 * wasm/WasmBBQPlan.cpp:
3351 (JSC::Wasm::BBQPlan::complete):
3352 * wasm/WasmOMGPlan.cpp:
3353 (JSC::Wasm::OMGPlan::work):
3354 * wasm/WasmThunks.cpp:
3355 (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
3356 (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
3357 (JSC::Wasm::triggerOMGTierUpThunkGenerator):
3358 * wasm/js/WasmToJS.cpp:
3359 (JSC::Wasm::wasmToJS):
3360 * wasm/js/WebAssemblyFunction.h:
3362 (JSC::Yarr::YarrGenerator::compile):
3364 2018-04-12 Michael Catanzaro <mcatanzaro@igalia.com>
3366 [WPE] Move libWPEWebInspectorResources.so to pkglibdir
3367 https://bugs.webkit.org/show_bug.cgi?id=184379
3369 Reviewed by Žan Doberšek.
3371 Load the module from the new location.
3373 * PlatformWPE.cmake:
3374 * inspector/remote/glib/RemoteInspectorUtils.cpp:
3375 (Inspector::backendCommands):
3377 2018-04-12 Yusuke Suzuki <utatane.tea@gmail.com>
3379 [DFG] Remove compileBigIntEquality in DFG 32bit
3380 https://bugs.webkit.org/show_bug.cgi?id=184535
3382 Reviewed by Saam Barati.
3384 We can have the unified implementation for compileBigIntEquality.
3386 * dfg/DFGSpeculativeJIT.cpp:
3387 (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
3388 * dfg/DFGSpeculativeJIT32_64.cpp:
3389 (JSC::DFG::SpeculativeJIT::compileBigIntEquality): Deleted.
3390 * dfg/DFGSpeculativeJIT64.cpp:
3391 (JSC::DFG::SpeculativeJIT::compileBigIntEquality): Deleted.
3393 2018-04-12 Michael Catanzaro <mcatanzaro@igalia.com>
3395 [WPE] Improve include hierarchy
3396 https://bugs.webkit.org/show_bug.cgi?id=184376
3398 Reviewed by Žan Doberšek.
3400 Install JSC headers under /usr/include/wpe-webkit-0.1/jsc instead of
3401 /usr/include/wpe-0.1/WPE/jsc.
3403 * PlatformWPE.cmake:
3405 2018-04-11 Carlos Garcia Campos <cgarcia@igalia.com>
3407 [GLIB] Handle strings containing null characters
3408 https://bugs.webkit.org/show_bug.cgi?id=184450
3410 Reviewed by Michael Catanzaro.
3412 We should be able to evaluate scripts containing null characters and to handle strings that contains them
3413 too. In JavaScript strings are not null-terminated, they can contain null characters. This patch adds a length
3414 parameter to jsc_context_valuate() to pass the script length (or -1 if it's null terminated), and new functions
3415 jsc_value_new_string_from_bytes() and jsc_value_to_string_as_bytes() using GBytes to store strings that might
3416 contain null characters.
3418 * API/OpaqueJSString.cpp:
3419 (OpaqueJSString::create): Add a create constructor that takes the String.
3420 * API/OpaqueJSString.h:
3421 (OpaqueJSString::OpaqueJSString): Add a constructor that takes the String.
3422 * API/glib/JSCContext.cpp:
3423 (jsc_context_evaluate): Add length parameter.
3424 (jsc_context_evaluate_with_source_uri): Ditto.
3425 * API/glib/JSCContext.h:
3426 * API/glib/JSCValue.cpp:
3427 (jsc_value_new_string_from_bytes):
3428 (jsc_value_to_string):
3429 (jsc_value_to_string_as_bytes):
3430 (jsc_value_object_is_instance_of): Pass length to evaluate.
3431 * API/glib/JSCValue.h:
3432 * API/glib/docs/jsc-glib-4.0-sections.txt:
3434 2018-04-11 Yusuke Suzuki <utatane.tea@gmail.com>
3436 [JSC] Add CCallHelpers::CellValue to wrap JSCell GPR to convert it to EncodedJSValue
3437 https://bugs.webkit.org/show_bug.cgi?id=184500
3439 Reviewed by Mark Lam.
3441 Instead of passing JSValue::JSCellTag to callOperation meta-program to convert
3442 JSCell GPR to EncodedJSValue in 32bit code, we add CallHelpers::CellValue.
3443 It is a wrapper for GPRReg, like TrustedImmPtr for pointer value. When poking
3444 CellValue, 32bit code emits JSValue::CellTag automatically. In 64bit, we just
3445 poke held GPR. The benefit from this CellValue is that we can use the same code
3446 for 32bit and 64bit. This patch removes several ifdefs.
3448 * bytecode/AccessCase.cpp:
3449 (JSC::AccessCase::generateImpl):
3450 * dfg/DFGSpeculativeJIT.cpp:
3451 (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
3452 (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
3453 (JSC::DFG::SpeculativeJIT::cachedPutById):
3454 * dfg/DFGSpeculativeJIT32_64.cpp:
3455 (JSC::DFG::SpeculativeJIT::cachedGetById):
3456 (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
3457 * jit/CCallHelpers.h:
3458 (JSC::CCallHelpers::CellValue::CellValue):
3459 (JSC::CCallHelpers::CellValue::gpr const):
3460 (JSC::CCallHelpers::setupArgumentsImpl):
3462 2018-04-11 Mark Lam <mark.lam@apple.com>
3464 [Build fix] Replace CompactJITCodeMap with JITCodeMap.
3465 https://bugs.webkit.org/show_bug.cgi?id=184512
3466 <rdar://problem/35391728>
3470 * bytecode/CodeBlock.h:
3473 2018-04-11 Mark Lam <mark.lam@apple.com>
3475 Replace CompactJITCodeMap with JITCodeMap.
3476 https://bugs.webkit.org/show_bug.cgi?id=184512
3477 <rdar://problem/35391728>
3479 Reviewed by Filip Pizlo.
3482 * JavaScriptCore.xcodeproj/project.pbxproj:
3483 * bytecode/CodeBlock.h:
3484 (JSC::CodeBlock::setJITCodeMap):
3485 (JSC::CodeBlock::jitCodeMap const):
3486 (JSC::CodeBlock::jitCodeMap): Deleted.
3487 * dfg/DFGOSRExit.cpp:
3488 (JSC::DFG::OSRExit::executeOSRExit):
3489 * dfg/DFGOSRExitCompilerCommon.cpp:
3490 (JSC::DFG::adjustAndJumpToTarget):
3491 * jit/AssemblyHelpers.cpp:
3492 (JSC::AssemblyHelpers::decodedCodeMapFor): Deleted.
3493 * jit/AssemblyHelpers.h:
3494 * jit/CompactJITCodeMap.h: Removed.
3497 * jit/JITCodeMap.h: Added.
3498 (JSC::JITCodeMap::Entry::Entry):
3499 (JSC::JITCodeMap::Entry::bytecodeIndex const):
3500 (JSC::JITCodeMap::Entry::codeLocation):
3501 (JSC::JITCodeMap::append):
3502 (JSC::JITCodeMap::finish):
3503 (JSC::JITCodeMap::find const):
3504 (JSC::JITCodeMap::operator bool const):
3505 * llint/LLIntSlowPaths.cpp:
3506 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3508 2018-04-11 Yusuke Suzuki <utatane.tea@gmail.com>
3510 [DFG] Remove CompareSlowPathGenerator
3511 https://bugs.webkit.org/show_bug.cgi?id=184492
3513 Reviewed by Mark Lam.
3515 Now CompareSlowPathGenerator is just calling a specified function.
3516 This can be altered with slowPathCall. This patch removes CompareSlowPathGenerator.
3518 We also remove some of unnecessary USE(JSVALUE32_64) / USE(JSVALUE64) ifdefs by
3519 introducing a new constructor for GPRTemporary.
3521 * JavaScriptCore.xcodeproj/project.pbxproj:
3522 * dfg/DFGCompareSlowPathGenerator.h: Removed.
3523 * dfg/DFGSpeculativeJIT.cpp:
3524 (JSC::DFG::GPRTemporary::GPRTemporary):
3525 (JSC::DFG::SpeculativeJIT::compileIsCellWithType):
3526 (JSC::DFG::SpeculativeJIT::compileIsTypedArrayView):
3527 (JSC::DFG::SpeculativeJIT::compileToObjectOrCallObjectConstructor):
3528 (JSC::DFG::SpeculativeJIT::compileIsObject):
3529 (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
3530 (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
3531 * dfg/DFGSpeculativeJIT.h:
3532 (JSC::DFG::GPRTemporary::GPRTemporary):
3533 * dfg/DFGSpeculativeJIT64.cpp:
3534 (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
3536 2018-04-11 Yusuke Suzuki <utatane.tea@gmail.com>
3538 Unreviewed, build fix for 32bit
3539 https://bugs.webkit.org/show_bug.cgi?id=184236
3541 * dfg/DFGSpeculativeJIT.cpp:
3542 (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
3544 2018-04-11 Yusuke Suzuki <utatane.tea@gmail.com>
3546 [DFG] Remove duplicate 32bit code more
3547 https://bugs.webkit.org/show_bug.cgi?id=184236
3549 Reviewed by Mark Lam.
3551 Remove duplicate 32bit code more aggressively part 2.
3553 * JavaScriptCore.xcodeproj/project.pbxproj:
3554 * dfg/DFGCompareSlowPathGenerator.h: Added.
3555 (JSC::DFG::CompareSlowPathGenerator::CompareSlowPathGenerator):
3556 Drop boxing part. Use unblessedBooleanResult in DFGSpeculativeJIT side instead.
3558 * dfg/DFGOperations.cpp:
3559 * dfg/DFGOperations.h:
3560 * dfg/DFGSpeculativeJIT.cpp:
3561 (JSC::DFG::SpeculativeJIT::compileOverridesHasInstance):
3562 (JSC::DFG::SpeculativeJIT::compileLoadVarargs):
3563 (JSC::DFG::SpeculativeJIT::compileIsObject):
3564 (JSC::DFG::SpeculativeJIT::compileCheckNotEmpty):
3565 (JSC::DFG::SpeculativeJIT::compilePutByIdFlush):
3566 (JSC::DFG::SpeculativeJIT::compilePutById):
3567 (JSC::DFG::SpeculativeJIT::compilePutByIdDirect):
3568 (JSC::DFG::SpeculativeJIT::compileNewArrayWithSize):
3569 (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
3570 (JSC::DFG::SpeculativeJIT::emitInitializeButterfly):
3571 (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
3572 (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
3573 (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
3574 (JSC::DFG::SpeculativeJIT::compileExtractCatchLocal):
3575 (JSC::DFG::SpeculativeJIT::cachedPutById):
3576 (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
3577 (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
3578 (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare): Deleted.
3579 * dfg/DFGSpeculativeJIT.h:
3580 (JSC::DFG::SpeculativeJIT::selectScratchGPR): Deleted.
3581 * dfg/DFGSpeculativeJIT32_64.cpp:
3582 (JSC::DFG::SpeculativeJIT::compile):
3583 (JSC::DFG::SpeculativeJIT::cachedPutById): Deleted.
3584 (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch): Deleted.
3585 (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator): Deleted.
3586 (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::generateInternal): Deleted.
3587 (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare): Deleted.
3588 (JSC::DFG::SpeculativeJIT::compileMiscStrictEq): Deleted.
3589 (JSC::DFG::SpeculativeJIT::emitInitializeButterfly): Deleted.
3590 (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): Deleted.
3591 * dfg/DFGSpeculativeJIT64.cpp:
3592 (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
3593 (JSC::DFG::SpeculativeJIT::compile):
3594 (JSC::DFG::SpeculativeJIT::cachedPutById): Deleted.
3595 (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch): Deleted.
3596 (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator): Deleted.
3598 (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare): Deleted.
3599 (JSC::DFG::SpeculativeJIT::compileMiscStrictEq): Deleted.
3600 (JSC::DFG::SpeculativeJIT::emitInitializeButterfly): Deleted.
3601 (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): Deleted.
3602 * ftl/FTLLowerDFGToB3.cpp:
3603 (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
3604 operationHasIndexedPropertyByInt starts returning unblessed boolean with size_t.
3606 * jit/AssemblyHelpers.h:
3607 (JSC::AssemblyHelpers::loadValue):
3608 (JSC::AssemblyHelpers::selectScratchGPR):
3609 (JSC::AssemblyHelpers::constructRegisterSet):
3610 * jit/RegisterSet.h:
3611 (JSC::RegisterSet::setAny):
3612 Clean up selectScratchGPR code to pass JSValueRegs.
3614 2018-04-10 Caio Lima <ticaiolima@gmail.com>
3616 [ESNext][BigInt] Add support for BigInt in SpeculatedType
3617 https://bugs.webkit.org/show_bug.cgi?id=182470
3619 Reviewed by Saam Barati.
3621 This patch introduces the SpecBigInt type to DFG to enable BigInt
3622 speculation into DFG and FTL.
3624 With SpecBigInt introduction, we can then specialize "===" operations
3625 to BigInts. As we are doing for some cells, we first check if operands
3626 are pointing to the same JSCell, and if it is false, we
3627 fallback to "operationCompareStrictEqCell". The idea in further
3628 patches is to implement BigInt equality check directly in
3631 We are also adding support for BigInt constant folding into
3634 * bytecode/SpeculatedType.cpp:
3635 (JSC::dumpSpeculation):
3636 (JSC::speculationFromClassInfo):
3637 (JSC::speculationFromStructure):
3638 (JSC::speculationFromJSType):
3639 (JSC::speculationFromString):
3640 * bytecode/SpeculatedType.h:
3641 (JSC::isBigIntSpeculation):
3642 * dfg/DFGAbstractInterpreterInlines.h:
3643 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3644 * dfg/DFGAbstractValue.cpp:
3645 (JSC::DFG::AbstractValue::set):
3646 * dfg/DFGConstantFoldingPhase.cpp:
3647 (JSC::DFG::ConstantFoldingPhase::foldConstants):
3648 * dfg/DFGFixupPhase.cpp:
3649 (JSC::DFG::FixupPhase::fixupNode):
3650 (JSC::DFG::FixupPhase::fixupToThis):
3651 (JSC::DFG::FixupPhase::observeUseKindOnNode):
3652 * dfg/DFGInferredTypeCheck.cpp:
3653 (JSC::DFG::insertInferredTypeCheck):
3655 (JSC::DFG::Node::shouldSpeculateBigInt):
3656 * dfg/DFGPredictionPropagationPhase.cpp:
3657 * dfg/DFGSafeToExecute.h:
3658 (JSC::DFG::SafeToExecuteEdge::operator()):
3659 * dfg/DFGSpeculativeJIT.cpp:
3660 (JSC::DFG::SpeculativeJIT::compileStrictEq):
3661 (JSC::DFG::SpeculativeJIT::speculateBigInt):
3662 (JSC::DFG::SpeculativeJIT::speculate):
3663 * dfg/DFGSpeculativeJIT.h:
3664 * dfg/DFGSpeculativeJIT32_64.cpp:
3665 (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
3666 * dfg/DFGSpeculativeJIT64.cpp:
3667 (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
3668 * dfg/DFGUseKind.cpp:
3669 (WTF::printInternal):
3671 (JSC::DFG::typeFilterFor):
3673 * ftl/FTLCapabilities.cpp:
3674 (JSC::FTL::canCompile):
3675 * ftl/FTLLowerDFGToB3.cpp:
3676 (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
3677 (JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
3678 (JSC::FTL::DFG::LowerDFGToB3::speculate):
3679 (JSC::FTL::DFG::LowerDFGToB3::isNotBigInt):
3680 (JSC::FTL::DFG::LowerDFGToB3::speculateBigInt):
3681 * jit/AssemblyHelpers.cpp:
3682 (JSC::AssemblyHelpers::branchIfNotType):
3683 * jit/AssemblyHelpers.h:
3684 (JSC::AssemblyHelpers::branchIfBigInt):
3685 (JSC::AssemblyHelpers::branchIfNotBigInt):
3686 * runtime/InferredType.cpp:
3687 (JSC::InferredType::Descriptor::forValue):
3688 (JSC::InferredType::Descriptor::putByIdFlags const):
3689 (JSC::InferredType::Descriptor::merge):
3690 (WTF::printInternal):
3691 * runtime/InferredType.h:
3692 * runtime/JSBigInt.h:
3694 2018-04-10 Filip Pizlo <fpizlo@apple.com>
3696 Unreviewed, fix cloop build.
3698 * dfg/DFGAbstractInterpreterClobberState.cpp:
3700 2018-04-10 Mark Lam <mark.lam@apple.com>
3702 Make the ASSERT in MarkedSpace::sizeClassToIndex() a RELEASE_ASSERT.
3703 https://bugs.webkit.org/show_bug.cgi?id=184464
3704 <rdar://problem/39323947>
3706 Reviewed by Saam Barati.
3708 * heap/MarkedSpace.h:
3709 (JSC::MarkedSpace::sizeClassToIndex):
3711 2018-04-09 Filip Pizlo <fpizlo@apple.com>
3713 DFG AI and clobberize should agree with each other
3714 https://bugs.webkit.org/show_bug.cgi?id=184440
3716 Reviewed by Saam Barati.
3718 One way to fix bugs involving underapproximation in AI or clobberize is to assert that they
3719 agree with each other. That's what this patch does: it adds an assertion that AI's structure
3720 state tracking must be equivalent to JSCell_structureID being clobbered.
3722 One subtlety is that AI sometimes folds away structure clobbering using information that
3723 clobberize doesn't have. So, we track this wuth special kinds of AI states (FoldedClobber and
3724 ObservedTransitions).
3726 This fixes a bunch of cases of AI missing clobberStructures/clobberWorld and one case of
3727 clobberize missing a write(Heap).
3729 This also makes some cases more precise in order to appease the assertion. Making things more
3730 precise might make things faster, but I didn't measure it because that wasn't the goal.
3732 * JavaScriptCore.xcodeproj/project.pbxproj:
3734 * dfg/DFGAbstractInterpreter.h:
3735 * dfg/DFGAbstractInterpreterClobberState.cpp: Added.
3736 (WTF::printInternal):
3737 * dfg/DFGAbstractInterpreterClobberState.h: Added.
3738 (JSC::DFG::mergeClobberStates):
3739 * dfg/DFGAbstractInterpreterInlines.h:
3740 (JSC::DFG::AbstractInterpreter<AbstractStateType>::startExecuting):
3741 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3742 (JSC::DFG::AbstractInterpreter<AbstractStateType>::didFoldClobberWorld):
3743 (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):
3744 (JSC::DFG::AbstractInterpreter<AbstractStateType>::didFoldClobberStructures):
3745 (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
3746 (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
3747 (JSC::DFG::AbstractInterpreter<AbstractStateType>::setDidClobber): Deleted.
3748 * dfg/DFGAtTailAbstractState.h:
3749 (JSC::DFG::AtTailAbstractState::setClobberState):
3750 (JSC::DFG::AtTailAbstractState::mergeClobberState):
3751 (JSC::DFG::AtTailAbstractState::setDidClobber): Deleted.
3752 * dfg/DFGCFAPhase.cpp:
3753 (JSC::DFG::CFAPhase::performBlockCFA):
3754 * dfg/DFGClobberSet.cpp:
3755 (JSC::DFG::writeSet):
3756 * dfg/DFGClobberSet.h:
3757 * dfg/DFGClobberize.h:
3758 (JSC::DFG::clobberize):
3759 * dfg/DFGConstantFoldingPhase.cpp:
3760 (JSC::DFG::ConstantFoldingPhase::foldConstants):
3761 * dfg/DFGInPlaceAbstractState.h:
3762 (JSC::DFG::InPlaceAbstractState::clobberState const):
3763 (JSC::DFG::InPlaceAbstractState::didClobberOrFolded const):
3764 (JSC::DFG::InPlaceAbstractState::didClobber const):
3765 (JSC::DFG::InPlaceAbstractState::setClobberState):
3766 (JSC::DFG::InPlaceAbstractState::mergeClobberState):
3767 (JSC::DFG::InPlaceAbstractState::setDidClobber): Deleted.
3769 2018-04-10 Filip Pizlo <fpizlo@apple.com>
3771 ExecutableToCodeBlockEdge::visitChildren() should be cool with m_codeBlock being null since we clear it in finalizeUnconditionally()
3772 https://bugs.webkit.org/show_bug.cgi?id=184460
3773 <rdar://problem/37610966>
3775 Reviewed by Mark Lam.
3777 * bytecode/ExecutableToCodeBlockEdge.cpp:
3778 (JSC::ExecutableToCodeBlockEdge::visitChildren):
3780 2018-04-10 Filip Pizlo <fpizlo@apple.com>
3782 REGRESSION(r227341 and r227742): AI and clobberize should be precise and consistent about the effectfulness of CompareEq
3783 https://bugs.webkit.org/show_bug.cgi?id=184455
3785 Reviewed by Michael Saboff.
3787 LICM is sort of an assertion that AI is as precise as clobberize about effects. If clobberize
3788 says that something is not effectful, then LICM will try to hoist it. But LICM's AI hack
3789 (AtTailAbstractState) cannot handle hoisting of things that have effects. So, if AI thinks that
3790 the thing being hoisted does have effects, then we get a crash.
3792 In r227341, we incorrectly told AI that CompareEq(Untyped:, _) is effectful. In fact, only
3793 ComapreEq(Untyped:, Untyped:) is effectful, and clobberize knew this already. As a result, LICM
3794 would blow up if we hoisted CompareEq(Untyped:, Other:), which clobberize knew wasn't
3797 Instead of fixing this by making AI precise, in r227742 we made matters worse by then breaking
3798 clobberize to also think that CompareEq(Untyped:, _) is effectful.
3800 This fixes the whole situation by teaching both clobberize and AI that the only effectful form
3801 of CompareEq is ComapreEq(Untyped:, Untyped:).
3803 * dfg/DFGAbstractInterpreterInlines.h:
3804 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3805 * dfg/DFGClobberize.h:
3806 (JSC::DFG::clobberize):
3808 2018-04-09 Filip Pizlo <fpizlo@apple.com>
3810 Executing known edge types may reveal a contradiction causing us to emit an exit at a node that is not allowed to exit
3811 https://bugs.webkit.org/show_bug.cgi?id=184372
3813 Reviewed by Saam Barati.
3815 We do a pretty good job of not emitting checks for KnownBlah edges, since those mean that we
3816 have already proved, using techniques that are more precise than AI, that the edge has type
3817 Blah. Unfortunately, we do not handle this case gracefully when AI state becomes bottom,
3818 because we have a bad habit of treating terminate/terminateSpeculativeExecution as something
3819 other than a check - so we think we can call those just because we should have already
3820 bailed. It's better to think of them as the result of folding a check. Therefore, we should
3821 only do it if there had been a check to begin with.
3823 * dfg/DFGSpeculativeJIT64.cpp:
3824 (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
3825 (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
3826 (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
3827 (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
3828 (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
3829 * ftl/FTLLowerDFGToB3.cpp:
3830 (JSC::FTL::DFG::LowerDFGToB3::lowInt32):
3831 (JSC::FTL::DFG::LowerDFGToB3::lowInt52):
3832 (JSC::FTL::DFG::LowerDFGToB3::lowCell):
3833 (JSC::FTL::DFG::LowerDFGToB3::lowBoolean):
3834 (JSC::FTL::DFG::LowerDFGToB3::lowDouble):
3835 (JSC::FTL::DFG::LowerDFGToB3::speculate):
3836 (JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
3837 (JSC::FTL::DFG::LowerDFGToB3::speculateStringOrOther):
3839 2018-04-08 Yusuke Suzuki <utatane.tea@gmail.com>
3841 [JSC] Introduce @putByIdDirectPrivate
3842 https://bugs.webkit.org/show_bug.cgi?id=184400
3844 Reviewed by Saam Barati.
3846 This patch adds @putByIdDirectPrivate() to use it for builtin JS.
3847 @getByIdDirectPrivate and @putByIdDirectPrivate are pair of intrinsics
3848 accessing to ECMAScript internal fields.
3850 This change removes accidental [[Put]] operation to an object whose [[Prototype]]
3851 has internal fields (not direct properties). By using @getByIdDirectPrivate() and
3852 @putByIdDirectPrivate(), we strongly keep the semantics of the ECMAScript internal
3853 fields that accessing to the internal fields does not traverse prototype chains.
3855 * builtins/ArrayIteratorPrototype.js:
3856 (globalPrivate.arrayIteratorValueNext):
3857 (globalPrivate.arrayIteratorKeyNext):
3858 (globalPrivate.arrayIteratorKeyValueNext):
3859 * builtins/ArrayPrototype.js:
3860 (globalPrivate.createArrayIterator):
3861 * builtins/AsyncFromSyncIteratorPrototype.js:
3862 (globalPrivate.AsyncFromSyncIteratorConstructor):
3863 * builtins/AsyncFunctionPrototype.js:
3864 (globalPrivate.asyncFunctionResume):
3865 * builtins/AsyncGeneratorPrototype.js:
3866 (globalPrivate.asyncGeneratorQueueEnqueue):
3867 (globalPrivate.asyncGeneratorQueueDequeue):
3868 (asyncGeneratorYieldAwaited):
3869 (globalPrivate.asyncGeneratorYield):
3870 (globalPrivate.doAsyncGeneratorBodyCall):
3871 (globalPrivate.asyncGeneratorResumeNext):
3872 * builtins/GeneratorPrototype.js:
3873 (globalPrivate.generatorResume):
3874 * builtins/MapIteratorPrototype.js:
3875 (globalPrivate.mapIteratorNext):
3876 * builtins/MapPrototype.js:
3877 (globalPrivate.createMapIterator):
3878 * builtins/ModuleLoaderPrototype.js:
3879 (forceFulfillPromise):
3880 * builtins/PromiseOperations.js:
3881 (globalPrivate.newHandledRejectedPromise):
3882 (globalPrivate.rejectPromise):
3883 (globalPrivate.fulfillPromise):
3884 (globalPrivate.initializePromise):
3885 * builtins/PromisePrototype.js:
3887 * builtins/SetIteratorPrototype.js:
3888 (globalPrivate.setIteratorNext):
3889 * builtins/SetPrototype.js:
3890 (globalPrivate.createSetIterator):
3891 * builtins/StringIteratorPrototype.js:
3893 * bytecode/BytecodeIntrinsicRegistry.h:
3894 * bytecompiler/NodesCodegen.cpp:
3895 (JSC::BytecodeIntrinsicNode::emit_intrinsic_putByIdDirect):
3896 (JSC::BytecodeIntrinsicNode::emit_intrinsic_putByIdDirectPrivate):
3898 2018-04-09 Mark Lam <mark.lam@apple.com>
3900 Decorate method table entries to support pointer profiling.
3901 https://bugs.webkit.org/show_bug.cgi?id=184430
3902 <rdar://problem/39296190>
3904 Reviewed by Saam Barati.
3906 * runtime/ClassInfo.h:
3908 2018-04-09 Michael Catanzaro <mcatanzaro@igalia.com>
3910 [WPE] Don't install JSC C API headers
3911 https://bugs.webkit.org/show_bug.cgi?id=184375
3913 Reviewed by Žan Doberšek.
3915 None of the functions declared in these headers are exported in WPE. Use the new jsc API
3918 * PlatformWPE.cmake:
3920 2018-04-08 Mark Lam <mark.lam@apple.com>
3922 Add pointer profiling to the FTL and supporting code.
3923 https://bugs.webkit.org/show_bug.cgi?id=184395
3924 <rdar://problem/39264019>
3926 Reviewed by Michael Saboff and Filip Pizlo.
3928 * assembler/CodeLocation.h:
3929 (JSC::CodeLocationLabel::retagged):
3930 (JSC::CodeLocationJump::retagged):
3931 * assembler/LinkBuffer.h:
3932 (JSC::LinkBuffer::locationOf):
3933 * dfg/DFGJITCompiler.cpp:
3934 (JSC::DFG::JITCompiler::linkOSRExits):
3935 (JSC::DFG::JITCompiler::link):
3936 * ftl/FTLCompile.cpp:
3937 (JSC::FTL::compile):
3938 * ftl/FTLExceptionTarget.cpp:
3939 (JSC::FTL::ExceptionTarget::label):
3940 (JSC::FTL::ExceptionTarget::jumps):
3941 * ftl/FTLExceptionTarget.h:
3942 * ftl/FTLJITCode.cpp:
3943 (JSC::FTL::JITCode::executableAddressAtOffset):
3944 * ftl/FTLLazySlowPath.cpp:
3945 (JSC::FTL::LazySlowPath::~LazySlowPath):
3946 (JSC::FTL::LazySlowPath::initialize):
3947 (JSC::FTL::LazySlowPath::generate):
3948 (JSC::FTL::LazySlowPath::LazySlowPath): Deleted.
3949 * ftl/FTLLazySlowPath.h:
3952 * ftl/FTLLowerDFGToB3.cpp:
3953 (JSC::FTL::DFG::LowerDFGToB3::lower):
3954 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
3955 (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
3956 (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
3957 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
3958 (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
3959 (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
3960 (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
3961 * ftl/FTLOSRExitCompiler.cpp:
3962 (JSC::FTL::compileStub):
3963 (JSC::FTL::compileFTLOSRExit):
3964 * ftl/FTLOSRExitHandle.cpp:
3965 (JSC::FTL::OSRExitHandle::emitExitThunk):
3966 * ftl/FTLOperations.cpp:
3967 (JSC::FTL::compileFTLLazySlowPath):
3969 (JSC::FTL::Output::callWithoutSideEffects):