Source/JavaScriptCore/ChangeLog

   1 2018-05-03  Yusuke Suzuki  <utatane.tea@gmail.com>
   2
   3         Remove std::random_shuffle
   4         https://bugs.webkit.org/show_bug.cgi?id=185292
   5
   6         Reviewed by Darin Adler.
   7
   8         std::random_shuffle is deprecated in C++14 and removed in C++17,
   9         since std::random_shuffle relies on rand and srand.
  10         Use std::shuffle instead.
  11
  12         * jit/BinarySwitch.cpp:
  13         (JSC::RandomNumberGenerator::RandomNumberGenerator):
  14         (JSC::RandomNumberGenerator::operator()):
  15         (JSC::RandomNumberGenerator::min):
  16         (JSC::RandomNumberGenerator::max):
  17         (JSC::BinarySwitch::build):
  18
  19 2018-05-03  Saam Barati  <sbarati@apple.com>
  20
  21         Don't prevent CreateThis being folded to NewObject when the structure is poly proto
  22         https://bugs.webkit.org/show_bug.cgi?id=185177
  23
  24         Reviewed by Filip Pizlo.
  25
  26         This patch teaches the DFG/FTL how to constant fold CreateThis with
  27         a known poly proto Structure to NewObject. We do it by emitting a NewObject
  28         followed by a PutByOffset for the prototype value.
  29
  30         We make it so that ObjectAllocationProfile holds the prototype value.
  31         This is sound because JSFunction clears that profile when its 'prototype'
  32         field changes.
  33
  34         This patch also renames underscoreProtoPrivateName to polyProtoName since
  35         that name was nonsensical: it was only used for poly proto.
  36
  37         This is a 2x speedup on the get_callee_polymorphic microbenchmark. I had
  38         regressed that benchmark when I first introduced poly proto.
  39
  40         * builtins/BuiltinNames.cpp:
  41         * builtins/BuiltinNames.h:
  42         (JSC::BuiltinNames::BuiltinNames):
  43         (JSC::BuiltinNames::polyProtoName const):
  44         (JSC::BuiltinNames::underscoreProtoPrivateName const): Deleted.
  45         * bytecode/ObjectAllocationProfile.h:
  46         (JSC::ObjectAllocationProfile::prototype):
  47         (JSC::ObjectAllocationProfile::clear):
  48         (JSC::ObjectAllocationProfile::visitAggregate):
  49         * bytecode/ObjectAllocationProfileInlines.h:
  50         (JSC::ObjectAllocationProfile::initializeProfile):
  51         * dfg/DFGAbstractInterpreterInlines.h:
  52         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
  53         * dfg/DFGByteCodeParser.cpp:
  54         (JSC::DFG::ByteCodeParser::parseBlock):
  55         * dfg/DFGConstantFoldingPhase.cpp:
  56         (JSC::DFG::ConstantFoldingPhase::foldConstants):
  57         * dfg/DFGOperations.cpp:
  58         * runtime/CommonSlowPaths.cpp:
  59         (JSC::SLOW_PATH_DECL):
  60         * runtime/FunctionRareData.h:
  61         * runtime/Structure.cpp:
  62         (JSC::Structure::create):
  63
  64 2018-05-03  Michael Saboff  <msaboff@apple.com>
  65
  66         OSR entry pruning of Program Bytecodes doesn't take into account try/catch
  67         https://bugs.webkit.org/show_bug.cgi?id=185281
  68
  69         Reviewed by Saam Barati.
  70
  71         When we compute bytecode block reachability, we need to take into account blocks
  72         containing try/catch.
  73
  74         * jit/JIT.cpp:
  75         (JSC::JIT::privateCompileMainPass):
  76
  77 2018-05-03  Dominik Infuehr  <dinfuehr@igalia.com>
  78
  79         ARM: Wrong offset for operand rt in disassembler
  80         https://bugs.webkit.org/show_bug.cgi?id=184083
  81
  82         Reviewed by Yusuke Suzuki.
  83
  84         * disassembler/ARMv7/ARMv7DOpcode.h:
  85         (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVDoublePrecision::rt):
  86         (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVSinglePrecision::rt):
  87
  88 2018-05-03  Dominik Infuehr  <dinfuehr@igalia.com>
  89
  90         ARM: Support vstr in disassembler
  91         https://bugs.webkit.org/show_bug.cgi?id=184084
  92
  93         Reviewed by Yusuke Suzuki.
  94
  95         * disassembler/ARMv7/ARMv7DOpcode.cpp:
  96         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDRSTR::format):
  97         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::format): Deleted.
  98         * disassembler/ARMv7/ARMv7DOpcode.h:
  99         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDRSTR::opName):
 100         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::condition): Deleted.
 101         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::uBit): Deleted.
 102         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::rn): Deleted.
 103         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::vd): Deleted.
 104         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::doubleReg): Deleted.
 105         (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::immediate8): Deleted.
 106
 107 2018-05-03  Dominik Infuehr  <dinfuehr@igalia.com>
 108
 109         Invoke ensureArrayStorage for all arguments
 110         https://bugs.webkit.org/show_bug.cgi?id=185247
 111
 112         Reviewed by Yusuke Suzuki.
 113
 114         ensureArrayStorage was only invoked for first argument in each loop iteration.
 115
 116         * jsc.cpp:
 117         (functionEnsureArrayStorage):
 118
 119 2018-05-03  Filip Pizlo  <fpizlo@apple.com>
 120
 121         Make it easy to log compile times for all optimizing tiers
 122         https://bugs.webkit.org/show_bug.cgi?id=185270
 123
 124         Reviewed by Keith Miller.
 125
 126         This makes --logPhaseTimes=true enable logging of phase times for DFG and B3 using a common
 127         helper class, CompilerTimingScope. This used to be called B3::TimingScope and only B3 used
 128         it.
 129
 130         This should help us reduce compile times by telling us where to look. So, far, it looks like
 131         CFA is the worst.
 132
 133         * JavaScriptCore.xcodeproj/project.pbxproj:
 134         * Sources.txt:
 135         * b3/B3Common.cpp:
 136         (JSC::B3::shouldMeasurePhaseTiming): Deleted.
 137         * b3/B3Common.h:
 138         * b3/B3TimingScope.cpp: Removed.
 139         * b3/B3TimingScope.h:
 140         (JSC::B3::TimingScope::TimingScope):
 141         * dfg/DFGPhase.h:
 142         (JSC::DFG::runAndLog):
 143         * dfg/DFGPlan.cpp:
 144         (JSC::DFG::Plan::compileInThread):
 145         * tools/CompilerTimingScope.cpp: Added.
 146         (JSC::CompilerTimingScope::CompilerTimingScope):
 147         (JSC::CompilerTimingScope::~CompilerTimingScope):
 148         * tools/CompilerTimingScope.h: Added.
 149         * runtime/Options.cpp:
 150         (JSC::recomputeDependentOptions):
 151         * runtime/Options.h:
 152
 153 2018-05-03  Filip Pizlo  <fpizlo@apple.com>
 154
 155         Strings should not be allocated in a gigacage
 156         https://bugs.webkit.org/show_bug.cgi?id=185218
 157
 158         Reviewed by Saam Barati.
 159
 160         * runtime/JSBigInt.cpp:
 161         (JSC::JSBigInt::toStringGeneric):
 162         * runtime/JSString.cpp:
 163         (JSC::JSRopeString::resolveRopeToAtomicString const):
 164         (JSC::JSRopeString::resolveRope const):
 165         * runtime/JSString.h:
 166         (JSC::JSString::create):
 167         (JSC::JSString::createHasOtherOwner):
 168         * runtime/VM.h:
 169         (JSC::VM::gigacageAuxiliarySpace):
 170
 171 2018-05-03  Keith Miller  <keith_miller@apple.com>
 172
 173         Unreviewed, fix 32-bit profile offset for change in bytecode
 174         length of the get_by_id and get_array_length opcodes.
 175
 176         * llint/LowLevelInterpreter32_64.asm:
 177
 178 2018-05-03  Michael Saboff  <msaboff@apple.com>
 179
 180         WebContent crash loading page on seas.upenn.edu @ JavaScriptCore: vmEntryToJavaScript
 181         https://bugs.webkit.org/show_bug.cgi?id=185231
 182
 183         Reviewed by Saam Barati.
 184
 185         We weren't clearing the scratch register cache when switching back and forth between
 186         allowing scratch register usage.  We disallow scratch register usage when we are in
 187         code that will freely allocate and use any register.  Such usage can change the
 188         contents of scratch registers.  For ARM64, where we cache the contents of scratch
 189         registers to reuse some or all of the contained values, we need to invalidate these
 190         caches.  We do this when re-enabling scratch register usage, that is when we transition
 191         from disallow to allow scratch register usage.
 192
 193         Added a new Air regression test.
 194
 195         * assembler/AllowMacroScratchRegisterUsage.h:
 196         (JSC::AllowMacroScratchRegisterUsage::AllowMacroScratchRegisterUsage):
 197         * assembler/AllowMacroScratchRegisterUsageIf.h:
 198         (JSC::AllowMacroScratchRegisterUsageIf::AllowMacroScratchRegisterUsageIf):
 199         * assembler/DisallowMacroScratchRegisterUsage.h:
 200         (JSC::DisallowMacroScratchRegisterUsage::~DisallowMacroScratchRegisterUsage):
 201         * b3/air/testair.cpp:
 202
 203 2018-05-03  Keith Miller  <keith_miller@apple.com>
 204
 205         Remove the prototype caching for get_by_id in the LLInt
 206         https://bugs.webkit.org/show_bug.cgi?id=185226
 207
 208         Reviewed by Michael Saboff.
 209
 210         There is no evidence that this is actually a speedup and we keep
 211         getting bugs with it. At this point it seems like we should just
 212         remove this code.
 213
 214         * CMakeLists.txt:
 215         * JavaScriptCore.xcodeproj/project.pbxproj:
 216         * Sources.txt:
 217         * bytecode/BytecodeDumper.cpp:
 218         (JSC::BytecodeDumper<Block>::printGetByIdOp):
 219         (JSC::BytecodeDumper<Block>::printGetByIdCacheStatus):
 220         (JSC::BytecodeDumper<Block>::dumpBytecode):
 221         * bytecode/BytecodeList.json:
 222         * bytecode/BytecodeUseDef.h:
 223         (JSC::computeUsesForBytecodeOffset):
 224         (JSC::computeDefsForBytecodeOffset):
 225         * bytecode/CodeBlock.cpp:
 226         (JSC::CodeBlock::finalizeLLIntInlineCaches):
 227         * bytecode/CodeBlock.h:
 228         (JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.
 229         * bytecode/GetByIdStatus.cpp:
 230         (JSC::GetByIdStatus::computeFromLLInt):
 231         * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp: Removed.
 232         * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h: Removed.
 233         * bytecompiler/BytecodeGenerator.cpp:
 234         (JSC::BytecodeGenerator::emitGetById):
 235         * dfg/DFGByteCodeParser.cpp:
 236         (JSC::DFG::ByteCodeParser::parseBlock):
 237         * dfg/DFGCapabilities.cpp:
 238         (JSC::DFG::capabilityLevel):
 239         * jit/JIT.cpp:
 240         (JSC::JIT::privateCompileMainPass):
 241         (JSC::JIT::privateCompileSlowCases):
 242         * llint/LLIntSlowPaths.cpp:
 243         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 244         (JSC::LLInt::setupGetByIdPrototypeCache): Deleted.
 245         * llint/LowLevelInterpreter32_64.asm:
 246         * llint/LowLevelInterpreter64.asm:
 247         * runtime/Options.h:
 248
 249 2018-05-03  Ryan Haddad  <ryanhaddad@apple.com>
 250
 251         Unreviewed, rolling out r231197.
 252
 253         The test added with this change crashes on the 32-bit JSC bot.
 254
 255         Reverted changeset:
 256
 257         "Correctly detect string overflow when using the 'Function'
 258         constructor"
 259         https://bugs.webkit.org/show_bug.cgi?id=184883
 260         https://trac.webkit.org/changeset/231197
 261
 262 2018-05-03  Dominik Infuehr  <dinfuehr@igalia.com>
 263
 264         Disable usage of fused multiply-add instructions for JSC with compiler flag
 265         https://bugs.webkit.org/show_bug.cgi?id=184909
 266
 267         Reviewed by Yusuke Suzuki.
 268
 269         Adds -ffp-contract as compiler flag for building JSC. This ensures that functions
 270         like parseInt() do not return slightly different results depending on whether the
 271         compiler was able to use fused multiply-add instructions or not.
 272
 273         * CMakeLists.txt:
 274
 275 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
 276
 277         Unreviewed, fix build failure in ARM, ARMv7 and MIPS
 278         https://bugs.webkit.org/show_bug.cgi?id=185192
 279
 280         compareDouble relies on MacroAssembler::invert function.
 281
 282         * assembler/MacroAssembler.h:
 283         (JSC::MacroAssembler::compareDouble):
 284         * assembler/MacroAssemblerARM.h:
 285         (JSC::MacroAssemblerARM::compareDouble): Deleted.
 286         * assembler/MacroAssemblerARMv7.h:
 287         (JSC::MacroAssemblerARMv7::compareDouble): Deleted.
 288         * assembler/MacroAssemblerMIPS.h:
 289         (JSC::MacroAssemblerMIPS::compareDouble): Deleted.
 290
 291 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
 292
 293         [JSC] Add MacroAssembler::and16 and store16
 294         https://bugs.webkit.org/show_bug.cgi?id=185188
 295
 296         Reviewed by Mark Lam.
 297
 298         r231129 requires and16(ImplicitAddress, RegisterID) and store16(RegisterID, ImplicitAddress) implementations.
 299         This patch adds these methods for ARM.
 300
 301         * assembler/MacroAssemblerARM.h:
 302         (JSC::MacroAssemblerARM::and16):
 303         (JSC::MacroAssemblerARM::store16):
 304
 305 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
 306
 307         [DFG] Unify compare related code in 32bit and 64bit
 308         https://bugs.webkit.org/show_bug.cgi?id=185189
 309
 310         Reviewed by Mark Lam.
 311
 312         This patch unifies some part of compare related code in 32bit and 64bit
 313         to reduce the size of 32bit specific DFG code.
 314
 315         * dfg/DFGSpeculativeJIT.cpp:
 316         (JSC::DFG::SpeculativeJIT::compileInt32Compare):
 317         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
 318         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
 319         * dfg/DFGSpeculativeJIT32_64.cpp:
 320         (JSC::DFG::SpeculativeJIT::compileObjectEquality): Deleted.
 321         (JSC::DFG::SpeculativeJIT::compileInt32Compare): Deleted.
 322         (JSC::DFG::SpeculativeJIT::compileDoubleCompare): Deleted.
 323         * dfg/DFGSpeculativeJIT64.cpp:
 324         (JSC::DFG::SpeculativeJIT::compileObjectEquality): Deleted.
 325         (JSC::DFG::SpeculativeJIT::compileInt32Compare): Deleted.
 326         (JSC::DFG::SpeculativeJIT::compileDoubleCompare): Deleted.
 327
 328 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
 329
 330         [JSC] Add compareDouble and compareFloat for ARM64, X86, and X86_64
 331         https://bugs.webkit.org/show_bug.cgi?id=185192
 332
 333         Reviewed by Mark Lam.
 334
 335         Now Object.is starts using compareDouble. So we would like to have
 336         efficient implementation for compareDouble and compareFloat for
 337         major architectures, ARM64, X86, and X86_64.
 338
 339         This patch adds compareDouble and compareFloat implementations for
 340         these architectures. And generic implementation is moved to each
 341         architecture's MacroAssembler implementation.
 342
 343         We also add tests for them in testmasm. To implement this test
 344         easily, we also add loadFloat(TrustedImmPtr, FPRegisterID) for the
 345         major architectures.
 346
 347         * assembler/MacroAssembler.h:
 348         (JSC::MacroAssembler::compareDouble): Deleted.
 349         (JSC::MacroAssembler::compareFloat): Deleted.
 350         * assembler/MacroAssemblerARM.h:
 351         (JSC::MacroAssemblerARM::compareDouble):
 352         * assembler/MacroAssemblerARM64.h:
 353         (JSC::MacroAssemblerARM64::compareDouble):
 354         (JSC::MacroAssemblerARM64::compareFloat):
 355         (JSC::MacroAssemblerARM64::loadFloat):
 356         (JSC::MacroAssemblerARM64::floatingPointCompare):
 357         * assembler/MacroAssemblerARMv7.h:
 358         (JSC::MacroAssemblerARMv7::compareDouble):
 359         * assembler/MacroAssemblerMIPS.h:
 360         (JSC::MacroAssemblerMIPS::compareDouble):
 361         * assembler/MacroAssemblerX86Common.h:
 362         (JSC::MacroAssemblerX86Common::loadFloat):
 363         (JSC::MacroAssemblerX86Common::compareDouble):
 364         (JSC::MacroAssemblerX86Common::compareFloat):
 365         (JSC::MacroAssemblerX86Common::floatingPointCompare):
 366         * assembler/X86Assembler.h:
 367         (JSC::X86Assembler::movss_mr):
 368         (JSC::X86Assembler::movss_rm):
 369         * assembler/testmasm.cpp:
 370         (JSC::floatOperands):
 371         (JSC::testCompareFloat):
 372         (JSC::run):
 373
 374 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
 375
 376         Unreviewed, fix 32bit DFG code
 377         https://bugs.webkit.org/show_bug.cgi?id=185065
 378
 379         * dfg/DFGSpeculativeJIT.cpp:
 380         (JSC::DFG::SpeculativeJIT::compileSameValue):
 381
 382 2018-05-02  Filip Pizlo  <fpizlo@apple.com>
 383
 384         JSC should know how to cache custom getter accesses on the prototype chain
 385         https://bugs.webkit.org/show_bug.cgi?id=185213
 386
 387         Reviewed by Keith Miller.
 388
 389         This was a simple fix after the work I did for bug 185174. >4x speed-up on the new get-custom-getter.js test.
 390
 391         * jit/Repatch.cpp:
 392         (JSC::tryCacheGetByID):
 393
 394 2018-05-01  Filip Pizlo  <fpizlo@apple.com>
 395
 396         JSC should be able to cache custom setter calls on the prototype chain
 397         https://bugs.webkit.org/show_bug.cgi?id=185174
 398
 399         Reviewed by Saam Barati.
 400
 401         We broke custom-setter-on-the-prototype-chain caching when we fixed a bug involving the conditionSet.isEmpty()
 402         condition being used to determine if we have an alternateBase. The fix in r222671 incorrectly tried to add
 403         impossible-to-validate conditions to the conditionSet by calling generateConditionsForPrototypePropertyHit() instead
 404         of generateConditionsForPrototypePropertyHitCustom(). The problem is that the former function will always fail for
 405         custom accessors because it won't find the custom property in the structure.
 406
 407         The fix is to add a virtual hasAlternateBase() function and use that instead of conditionSet.isEmpty().
 408
 409         This is a 4x speed-up on assign-custom-setter.js.
 410
 411         * bytecode/AccessCase.cpp:
 412         (JSC::AccessCase::hasAlternateBase const):
 413         (JSC::AccessCase::alternateBase const):
 414         (JSC::AccessCase::generateImpl):
 415         * bytecode/AccessCase.h:
 416         (JSC::AccessCase::alternateBase const): Deleted.
 417         * bytecode/GetterSetterAccessCase.cpp:
 418         (JSC::GetterSetterAccessCase::hasAlternateBase const):
 419         (JSC::GetterSetterAccessCase::alternateBase const):
 420         * bytecode/GetterSetterAccessCase.h:
 421         * bytecode/ObjectPropertyConditionSet.cpp:
 422         (JSC::generateConditionsForPrototypePropertyHitCustom):
 423         * bytecode/ObjectPropertyConditionSet.h:
 424         * jit/Repatch.cpp:
 425         (JSC::tryCacheGetByID):
 426         (JSC::tryCachePutByID):
 427
 428 2018-05-02  Dominik Infuehr  <dinfuehr@igalia.com>
 429
 430         [MIPS] Implement and16 and store16 for MacroAssemblerMIPS
 431         https://bugs.webkit.org/show_bug.cgi?id=185195
 432
 433         Reviewed by Mark Lam.
 434
 435         This implements the given function for MIPS, such that it builds again.
 436
 437         * assembler/MacroAssemblerMIPS.h:
 438         (JSC::MacroAssemblerMIPS::and16):
 439         (JSC::MacroAssemblerMIPS::store16):
 440
 441 2018-05-02  Rick Waldron  <waldron.rick@gmail.com>
 442
 443         Expose "$262.agent.monotonicNow()" for use in testing Atomic operation timeouts
 444         https://bugs.webkit.org/show_bug.cgi?id=185043
 445
 446         Reviewed by Filip Pizlo.
 447
 448         * jsc.cpp:
 449         (GlobalObject::finishCreation):
 450         (functionDollarAgentMonotonicNow):
 451
 452 2018-05-02  Dominik Infuehr  <dinfuehr@igalia.com>
 453
 454         [ARM] Implement and16 and store16 for MacroAssemblerARMv7
 455         https://bugs.webkit.org/show_bug.cgi?id=185196
 456
 457         Reviewed by Mark Lam.
 458
 459         This implements and16 and store16 for MacroAssemblerARMv7 such that JSC builds again.
 460
 461         * assembler/MacroAssemblerARMv7.h:
 462         (JSC::MacroAssemblerARMv7::and16):
 463         (JSC::MacroAssemblerARMv7::store16):
 464
 465 2018-05-02  Robin Morisset  <rmorisset@apple.com>
 466
 467         emitCodeToGetArgumentsArrayLength should not crash on PhantomNewArrayWithSpread
 468         https://bugs.webkit.org/show_bug.cgi?id=183172
 469
 470         Reviewed by Filip Pizlo.
 471
 472         DFGArgumentsEliminationPhase.cpp currently believes that allocations of NewArrayWithSpread can be deleted if they are only used by GetArrayLength,
 473         but when it then calls emitCodeToGetArgumentsArrayLength, the latter has no idea what to do with GetArrayLength.
 474
 475         I fix the problem by teaching emitCodeToGetArgumentsArrayLength how to deal with GetArrayLength.
 476         Because this requires emitting an Add that can overflow and thus exit, we also tell DFGArgumentsEliminationPhase to give up on eliminating
 477         a NewArrayWithSpread when it is used by a GetArrayLength that is not allowed to exit.
 478
 479         * dfg/DFGArgumentsEliminationPhase.cpp:
 480         * dfg/DFGArgumentsUtilities.cpp:
 481         (JSC::DFG::emitCodeToGetArgumentsArrayLength):
 482
 483 2018-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
 484
 485         Unreviewed, stackPointer signature is different from declaration
 486         https://bugs.webkit.org/show_bug.cgi?id=184790
 487
 488         * runtime/MachineContext.h:
 489         (JSC::MachineContext::stackPointer):
 490
 491 2018-05-01  Yusuke Suzuki  <utatane.tea@gmail.com>
 492
 493         [JSC] Add SameValue DFG node
 494         https://bugs.webkit.org/show_bug.cgi?id=185065
 495
 496         Reviewed by Saam Barati.
 497
 498         This patch adds Object.is handling in DFG and FTL. Object.is is converted to SameValue DFG node.
 499         And DFG fixup phase attempts to convert SameValue node to CompareStrictEq with type filter edges
 500         if possible. Since SameValue(Untyped, Untyped) and SameValue(Double, Double) have different semantics
 501         from CompareStrictEq, we do not convert SameValue to CompareStrictEq for them. DFG and FTL have
 502         implementations for these SameValue nodes.
 503
 504         This old MacroAssemblerX86Common::compareDouble was dead code since the derived class, "MacroAssembler"
 505         has a generalized compareDouble, which just uses branchDouble. Since this was not used, this function
 506         was broken. This patch fixes issues and move compareDouble to MacroAssemblerX86Common, and remove a
 507         generalized compareDouble for x86 arch to use this specialized efficient version instead. The fixes are
 508         correctly using set32 to zero-extending the result, and setting the initial value of `dest` register
 509         correctly for DoubleEqual and DoubleNotEqualOrUnordered cases.
 510
 511         Added microbenchmark shows performance improvement.
 512
 513             object-is           651.0053+-38.8204    ^    241.3467+-15.8753       ^ definitely 2.6974x faster
 514
 515         * assembler/MacroAssembler.h:
 516         * assembler/MacroAssemblerX86Common.h:
 517         (JSC::MacroAssemblerX86Common::compareDouble):
 518         * assembler/MacroAssemblerX86_64.h:
 519         (JSC::MacroAssemblerX86_64::compareDouble): Deleted.
 520         * assembler/testmasm.cpp:
 521         (JSC::doubleOperands):
 522         (JSC::testCompareDouble):
 523         (JSC::run):
 524         * dfg/DFGAbstractInterpreterInlines.h:
 525         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
 526         * dfg/DFGByteCodeParser.cpp:
 527         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
 528         * dfg/DFGClobberize.h:
 529         (JSC::DFG::clobberize):
 530         * dfg/DFGConstantFoldingPhase.cpp:
 531         (JSC::DFG::ConstantFoldingPhase::foldConstants):
 532         * dfg/DFGDoesGC.cpp:
 533         (JSC::DFG::doesGC):
 534         * dfg/DFGFixupPhase.cpp:
 535         (JSC::DFG::FixupPhase::fixupNode):
 536         (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):
 537         * dfg/DFGNodeType.h:
 538         * dfg/DFGOperations.cpp:
 539         * dfg/DFGOperations.h:
 540         * dfg/DFGPredictionPropagationPhase.cpp:
 541         * dfg/DFGSafeToExecute.h:
 542         (JSC::DFG::safeToExecute):
 543         * dfg/DFGSpeculativeJIT.cpp:
 544         (JSC::DFG::SpeculativeJIT::compileSameValue):
 545         * dfg/DFGSpeculativeJIT.h:
 546         * dfg/DFGSpeculativeJIT32_64.cpp:
 547         (JSC::DFG::SpeculativeJIT::compile):
 548         * dfg/DFGSpeculativeJIT64.cpp:
 549         (JSC::DFG::SpeculativeJIT::compile):
 550         * dfg/DFGValidate.cpp:
 551         * ftl/FTLCapabilities.cpp:
 552         (JSC::FTL::canCompile):
 553         * ftl/FTLLowerDFGToB3.cpp:
 554         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
 555         (JSC::FTL::DFG::LowerDFGToB3::compileSameValue):
 556         * runtime/Intrinsic.cpp:
 557         (JSC::intrinsicName):
 558         * runtime/Intrinsic.h:
 559         * runtime/ObjectConstructor.cpp:
 560
 561 2018-04-30  Filip Pizlo  <fpizlo@apple.com>
 562
 563         B3::demoteValues should be able to handle patchpoint terminals
 564         https://bugs.webkit.org/show_bug.cgi?id=185151
 565
 566         Reviewed by Saam Barati.
 567
 568         If we try to demote a patchpoint terminal then prior to this change we would append a Set to
 569         the basic block that the patchpoint terminated. That's wrong because then the terminal is no
 570         longer the last thing in the block.
 571
 572         Air encounters this problem in spilling and solves it by doing a fixup afterwards. We can't
 573         really do that because demotion happens as a prerequisite to other transformations.
 574
 575         One solution might have been to make demoteValues insert a basic block whenever it encounters
 576         this problem. But that would break clients that do CFG analysis before demoteValues and use
 577         the results of the CFG analysis after demoteValues. Taildup does this. Fortunately, taildup
 578         also runs breakCriticalEdges. Probably anyone using demoteValues will use breakCriticalEdges,
 579         so it's not bad to introduce that requirement.
 580
 581         So, this patch solves the problem by ensuring that breakCriticalEdges treats any patchpoint
 582         terminal as if it had multiple successors. This means that a patchpoint terminal's successors
 583         will only have it as their predecessor. Then, demoteValues just prepends the Set to the
 584         successors of the patchpoint terminal.
 585
 586         This was probably asymptomatic. It's hard to write a JS test that triggers this, so I added
 587         a unit test in testb3.
 588
 589         * b3/B3BreakCriticalEdges.cpp:
 590         (JSC::B3::breakCriticalEdges):
 591         * b3/B3BreakCriticalEdges.h:
 592         * b3/B3FixSSA.cpp:
 593         (JSC::B3::demoteValues):
 594         (JSC::B3::fixSSA):
 595         * b3/B3FixSSA.h:
 596         * b3/B3Value.cpp:
 597         (JSC::B3::Value::foldIdentity const):
 598         (JSC::B3::Value::performSubstitution):
 599         * b3/B3Value.h:
 600         * b3/testb3.cpp:
 601         (JSC::B3::testDemotePatchpointTerminal):
 602         (JSC::B3::run):
 603
 604 2018-05-01  Robin Morisset  <rmorisset@apple.com>
 605
 606         Use CheckedArithmetic for length computation in JSArray::unshiftCountWithAnyIndexingType
 607         https://bugs.webkit.org/show_bug.cgi?id=184772
 608         <rdar://problem/39146327>
 609
 610         Reviewed by Filip Pizlo.
 611
 612         Related to https://bugs.webkit.org/show_bug.cgi?id=183657 (<rdar://problem/38464399), where a check was missing.
 613         This patch now makes sure that the check correctly detects if there is an integer overflow.
 614
 615         * runtime/JSArray.cpp:
 616         (JSC::JSArray::unshiftCountWithAnyIndexingType):
 617
 618 2018-05-01  Robin Morisset  <rmorisset@apple.com>
 619
 620         Correctly detect string overflow when using the 'Function' constructor
 621         https://bugs.webkit.org/show_bug.cgi?id=184883
 622         <rdar://problem/36320331>
 623
 624         Reviewed by Filip Pizlo.
 625
 626         The 'Function' constructor creates a string containing the source code of the new function through repeated string concatenation.
 627         Because there was no way for the string concatenation routines in WTF to return an error, they just crashed in that case.
 628
 629         I added new tryAppend methods alongside the old append methods, that return a boolean (true means success, false means an overflow happened).
 630         In this way, it becomes possible for the Function constructor to just throw a proper JS exception when asked to create a string > 4GB.
 631         I made new methods instead of just adapting the existing ones (and reverted such a change on appendQuotedJSONString) so that callers that rely on the old behaviour (a hard CRASH() on overflow) don't silently start failing.
 632
 633         * runtime/FunctionConstructor.cpp:
 634         (JSC::constructFunctionSkippingEvalEnabledCheck):
 635         * runtime/JSONObject.cpp:
 636         (JSC::Stringifier::appendStringifiedValue):
 637
 638 2018-05-01  Robin Morisset  <rmorisset@apple.com>
 639
 640         IntlObject.cpp::removeUnicodeLocaleExtension() should not touch locales that end in '-u'
 641         https://bugs.webkit.org/show_bug.cgi?id=185162
 642
 643         Reviewed by Filip Pizlo.
 644
 645         * runtime/IntlObject.cpp:
 646         (JSC::removeUnicodeLocaleExtension):
 647
 648 2018-05-01  Dominik Infuehr  <dinfuehr@igalia.com>
 649
 650         Add SetCallee as DFG-Operation
 651         https://bugs.webkit.org/show_bug.cgi?id=184582
 652
 653         Reviewed by Filip Pizlo.
 654
 655         For recursive tail calls not only the argument count can change but also the
 656         callee. Add SetCallee to DFG that sets the callee slot in the current call frame.
 657         Also update the callee when optimizing a recursive tail call.
 658         Enable recursive tail call optimization also for closures.
 659
 660         * dfg/DFGAbstractInterpreterInlines.h:
 661         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
 662         * dfg/DFGByteCodeParser.cpp:
 663         (JSC::DFG::ByteCodeParser::handleRecursiveTailCall):
 664         (JSC::DFG::ByteCodeParser::handleCallVariant):
 665         * dfg/DFGClobberize.h:
 666         (JSC::DFG::clobberize):
 667         * dfg/DFGDoesGC.cpp:
 668         (JSC::DFG::doesGC):
 669         * dfg/DFGFixupPhase.cpp:
 670         (JSC::DFG::FixupPhase::fixupNode):
 671         * dfg/DFGMayExit.cpp:
 672         * dfg/DFGNodeType.h:
 673         * dfg/DFGPredictionPropagationPhase.cpp:
 674         * dfg/DFGSafeToExecute.h:
 675         (JSC::DFG::safeToExecute):
 676         * dfg/DFGSpeculativeJIT.cpp:
 677         (JSC::DFG::SpeculativeJIT::compileSetCallee):
 678         * dfg/DFGSpeculativeJIT.h:
 679         * dfg/DFGSpeculativeJIT32_64.cpp:
 680         (JSC::DFG::SpeculativeJIT::compile):
 681         * dfg/DFGSpeculativeJIT64.cpp:
 682         (JSC::DFG::SpeculativeJIT::compile):
 683         * ftl/FTLCapabilities.cpp:
 684         (JSC::FTL::canCompile):
 685         * ftl/FTLLowerDFGToB3.cpp:
 686         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
 687         (JSC::FTL::DFG::LowerDFGToB3::compileSetCallee):
 688
 689 2018-05-01  Oleksandr Skachkov  <gskachkov@gmail.com>
 690
 691         WebAssembly: add support for stream APIs - JavaScript API
 692         https://bugs.webkit.org/show_bug.cgi?id=183442
 693
 694         Reviewed by Yusuke Suzuki and JF Bastien.
 695
 696         Add WebAssembly stream API. Current patch only add functions
 697         WebAssembly.compileStreaming and WebAssembly.instantiateStreaming but,
 698         does not add streaming way of the implementation. So in current version it
 699         only wait for load whole module, than start to parse.
 700
 701         * CMakeLists.txt:
 702         * Configurations/FeatureDefines.xcconfig:
 703         * DerivedSources.make:
 704         * JavaScriptCore.xcodeproj/project.pbxproj:
 705         * builtins/BuiltinNames.h:
 706         * builtins/WebAssemblyPrototype.js: Copied from Source/JavaScriptCore/wasm/js/WebAssemblyPrototype.h.
 707         (compileStreaming):
 708         (instantiateStreaming):
 709         * jsc.cpp:
 710         * runtime/JSGlobalObject.cpp:
 711         (JSC::JSGlobalObject::init):
 712         * runtime/JSGlobalObject.h:
 713         * runtime/Options.h:
 714         * runtime/PromiseDeferredTimer.cpp:
 715         (JSC::PromiseDeferredTimer::hasPendingPromise):
 716         (JSC::PromiseDeferredTimer::hasDependancyInPendingPromise):
 717         * runtime/PromiseDeferredTimer.h:
 718         * wasm/js/WebAssemblyPrototype.cpp:
 719         (JSC::webAssemblyModuleValidateAsyncInternal):
 720         (JSC::webAssemblyCompileFunc):
 721         (JSC::WebAssemblyPrototype::webAssemblyModuleValidateAsync):
 722         (JSC::webAssemblyModuleInstantinateAsyncInternal):
 723         (JSC::WebAssemblyPrototype::webAssemblyModuleInstantinateAsync):
 724         (JSC::webAssemblyCompileStreamingInternal):
 725         (JSC::webAssemblyInstantiateStreamingInternal):
 726         (JSC::WebAssemblyPrototype::create):
 727         (JSC::WebAssemblyPrototype::finishCreation):
 728         * wasm/js/WebAssemblyPrototype.h:
 729
 730 2018-04-30  Saam Barati  <sbarati@apple.com>
 731
 732         ToString constant folds without preserving checks, causing us to break assumptions that the code would OSR exit
 733         https://bugs.webkit.org/show_bug.cgi?id=185149
 734         <rdar://problem/39455917>
 735
 736         Reviewed by Filip Pizlo.
 737
 738         The bug was that we were deleting checks that we shouldn't have deleted.
 739         This patch makes a helper inside strength reduction that converts to
 740         a LazyJSConstant while maintaining checks, and switches users of the
 741         node API inside strength reduction to instead call the helper function.
 742
 743         This patch also fixes a potential bug where StringReplace and
 744         StringReplaceRegExp may not preserve all their checks.
 745
 746
 747         * dfg/DFGStrengthReductionPhase.cpp:
 748         (JSC::DFG::StrengthReductionPhase::handleNode):
 749         (JSC::DFG::StrengthReductionPhase::convertToLazyJSValue):
 750
 751 2018-04-29  Filip Pizlo  <fpizlo@apple.com>
 752
 753         LICM shouldn't hoist nodes if hoisted nodes exited in that code block
 754         https://bugs.webkit.org/show_bug.cgi?id=185126
 755
 756         Reviewed by Saam Barati.
 757
 758         This change is just restoring functionality that we've already had for a while. It had been
 759         accidentally broken due to an unrelated CodeBlock refactoring.
 760
 761         * dfg/DFGLICMPhase.cpp:
 762         (JSC::DFG::LICMPhase::attemptHoist):
 763
 764 2018-04-30  Mark Lam  <mark.lam@apple.com>
 765
 766         Apply PtrTags to the MetaAllocator and friends.
 767         https://bugs.webkit.org/show_bug.cgi?id=185110
 768         <rdar://problem/39533895>
 769
 770         Reviewed by Saam Barati.
 771
 772         1. LinkBuffer now takes a MacroAssemblerCodePtr instead of a void* pointer.
 773         2. Apply pointer tagging to the boundary pointers of the FixedExecutableMemoryPool,
 774            and add a sanity check to verify that allocated code buffers are within those
 775            bounds.
 776
 777         * assembler/LinkBuffer.cpp:
 778         (JSC::LinkBuffer::finalizeCodeWithoutDisassemblyImpl):
 779         (JSC::LinkBuffer::copyCompactAndLinkCode):
 780         (JSC::LinkBuffer::linkCode):
 781         (JSC::LinkBuffer::allocate):
 782         * assembler/LinkBuffer.h:
 783         (JSC::LinkBuffer::LinkBuffer):
 784         (JSC::LinkBuffer::debugAddress):
 785         (JSC::LinkBuffer::code):
 786         * assembler/MacroAssemblerCodeRef.h:
 787         (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
 788         * bytecode/InlineAccess.cpp:
 789         (JSC::linkCodeInline):
 790         (JSC::InlineAccess::rewireStubAsJump):
 791         * dfg/DFGJITCode.cpp:
 792         (JSC::DFG::JITCode::findPC):
 793         * ftl/FTLJITCode.cpp:
 794         (JSC::FTL::JITCode::findPC):
 795         * jit/ExecutableAllocator.cpp:
 796         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
 797         (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
 798         (JSC::ExecutableAllocator::allocate):
 799         * jit/ExecutableAllocator.h:
 800         (JSC::isJITPC):
 801         (JSC::performJITMemcpy):
 802         * jit/JIT.cpp:
 803         (JSC::JIT::link):
 804         * jit/JITMathIC.h:
 805         (JSC::isProfileEmpty):
 806         * runtime/JSCPtrTag.h:
 807         * wasm/WasmCallee.cpp:
 808         (JSC::Wasm::Callee::Callee):
 809         * wasm/WasmFaultSignalHandler.cpp:
 810         (JSC::Wasm::trapHandler):
 811
 812 2018-04-30  Keith Miller  <keith_miller@apple.com>
 813
 814         Move the MayBePrototype JSCell header bit to InlineTypeFlags
 815         https://bugs.webkit.org/show_bug.cgi?id=185143
 816
 817         Reviewed by Mark Lam.
 818
 819         * runtime/IndexingType.h:
 820         * runtime/JSCellInlines.h:
 821         (JSC::JSCell::setStructure):
 822         (JSC::JSCell::mayBePrototype const):
 823         (JSC::JSCell::didBecomePrototype):
 824         * runtime/JSTypeInfo.h:
 825         (JSC::TypeInfo::mayBePrototype):
 826         (JSC::TypeInfo::mergeInlineTypeFlags):
 827
 828 2018-04-30  Keith Miller  <keith_miller@apple.com>
 829
 830         Remove unneeded exception check from String.fromCharCode
 831         https://bugs.webkit.org/show_bug.cgi?id=185083
 832
 833         Reviewed by Mark Lam.
 834
 835         * runtime/StringConstructor.cpp:
 836         (JSC::stringFromCharCode):
 837
 838 2018-04-30  Keith Miller  <keith_miller@apple.com>
 839
 840         Move StructureIsImmortal to out of line flags.
 841         https://bugs.webkit.org/show_bug.cgi?id=185101
 842
 843         Reviewed by Saam Barati.
 844
 845         This will free up a bit in the inline flags where we can move the
 846         isPrototype bit to. This will, in turn, free a bit for use in
 847         implementing copy on write butterflies.
 848
 849         Also, this patch removes an assertion from Structure::typeInfo()
 850         that inadvertently makes the function invalid to call while
 851         cleaning up the vm.
 852
 853         * heap/HeapCellType.cpp:
 854         (JSC::DefaultDestroyFunc::operator() const):
 855         * runtime/JSCell.h:
 856         * runtime/JSCellInlines.h:
 857         (JSC::JSCell::callDestructor): Deleted.
 858         * runtime/JSTypeInfo.h:
 859         (JSC::TypeInfo::hasStaticPropertyTable):
 860         (JSC::TypeInfo::structureIsImmortal const):
 861         * runtime/Structure.h:
 862
 863 2018-04-30  Yusuke Suzuki  <utatane.tea@gmail.com>
 864
 865         [JSC] Remove arity fixup check if the number of parameters is 1
 866         https://bugs.webkit.org/show_bug.cgi?id=183984
 867
 868         Reviewed by Mark Lam.
 869
 870         If the number of parameters is one (|this|), we never hit arity fixup check.
 871         We do not need to emit arity fixup check code.
 872
 873         * dfg/DFGDriver.cpp:
 874         (JSC::DFG::compileImpl):
 875         * dfg/DFGJITCompiler.cpp:
 876         (JSC::DFG::JITCompiler::compileFunction):
 877         * dfg/DFGJITCompiler.h:
 878         * ftl/FTLLink.cpp:
 879         (JSC::FTL::link):
 880         * jit/JIT.cpp:
 881         (JSC::JIT::compileWithoutLinking):
 882
 883 2018-04-30  Yusuke Suzuki  <utatane.tea@gmail.com>
 884
 885         Use WordLock instead of std::mutex for Threading
 886         https://bugs.webkit.org/show_bug.cgi?id=185121
 887
 888         Reviewed by Geoffrey Garen.
 889
 890         ThreadGroup starts using WordLock.
 891
 892         * heap/MachineStackMarker.h:
 893         (JSC::MachineThreads::getLock):
 894
 895 2018-04-29  Filip Pizlo  <fpizlo@apple.com>
 896
 897         B3 should run tail duplication at the bitter end
 898         https://bugs.webkit.org/show_bug.cgi?id=185123
 899
 900         Reviewed by Geoffrey Garen.
 901
 902         Also added an option to disable taildup. This appears to be a 1% AsmBench speed-up. It's neutral
 903         everywhere else.
 904
 905         The goal of this change is to allow us to run path specialization after switch lowering but
 906         before tail duplication.
 907
 908         * b3/B3Generate.cpp:
 909         (JSC::B3::generateToAir):
 910         * runtime/Options.h:
 911
 912 2018-04-29  Commit Queue  <commit-queue@webkit.org>
 913
 914         Unreviewed, rolling out r231137.
 915         https://bugs.webkit.org/show_bug.cgi?id=185118
 916
 917         It is breaking Test262 language/expressions/multiplication
 918         /order-of-evaluation.js (Requested by caiolima on #webkit).
 919
 920         Reverted changeset:
 921
 922         "[ESNext][BigInt] Implement support for "*" operation"
 923         https://bugs.webkit.org/show_bug.cgi?id=183721
 924         https://trac.webkit.org/changeset/231137
 925
 926 2018-04-28  Saam Barati  <sbarati@apple.com>
 927
 928         We don't model regexp effects properly
 929         https://bugs.webkit.org/show_bug.cgi?id=185059
 930         <rdar://problem/39736150>
 931
 932         Reviewed by Filip Pizlo.
 933
 934         RegExp exec/test can do arbitrary effects when toNumbering the lastIndex if
 935         the regexp is global.
 936
 937         * dfg/DFGAbstractInterpreterInlines.h:
 938         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
 939         * dfg/DFGClobberize.h:
 940         (JSC::DFG::clobberize):
 941
 942 2018-04-28  Rick Waldron  <waldron.rick@gmail.com>
 943
 944         Token misspelled "tocken" in error message string
 945         https://bugs.webkit.org/show_bug.cgi?id=185030
 946
 947         Reviewed by Saam Barati.
 948
 949         * parser/Parser.cpp: Fix typo "tocken" => "token" in SyntaxError message string
 950         (JSC::Parser<LexerType>::Parser):
 951         (JSC::Parser<LexerType>::didFinishParsing):
 952         (JSC::Parser<LexerType>::parseSourceElements):
 953         (JSC::Parser<LexerType>::parseAsyncGeneratorFunctionSourceElements):
 954         (JSC::Parser<LexerType>::parseVariableDeclaration):
 955         (JSC::Parser<LexerType>::parseWhileStatement):
 956         (JSC::Parser<LexerType>::parseVariableDeclarationList):
 957         (JSC::Parser<LexerType>::createBindingPattern):
 958         (JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBodySourceElements):
 959         (JSC::Parser<LexerType>::parseObjectRestElement):
 960         (JSC::Parser<LexerType>::parseDestructuringPattern):
 961         (JSC::Parser<LexerType>::parseForStatement):
 962         (JSC::Parser<LexerType>::parseBreakStatement):
 963         (JSC::Parser<LexerType>::parseContinueStatement):
 964         (JSC::Parser<LexerType>::parseThrowStatement):
 965         (JSC::Parser<LexerType>::parseWithStatement):
 966         (JSC::Parser<LexerType>::parseSwitchStatement):
 967         (JSC::Parser<LexerType>::parseSwitchClauses):
 968         (JSC::Parser<LexerType>::parseTryStatement):
 969         (JSC::Parser<LexerType>::parseBlockStatement):
 970         (JSC::Parser<LexerType>::parseFormalParameters):
 971         (JSC::Parser<LexerType>::parseFunctionParameters):
 972         (JSC::Parser<LexerType>::parseFunctionInfo):
 973         (JSC::Parser<LexerType>::parseExpressionOrLabelStatement):
 974         (JSC::Parser<LexerType>::parseExpressionStatement):
 975         (JSC::Parser<LexerType>::parseIfStatement):
 976         (JSC::Parser<LexerType>::parseAssignmentExpression):
 977         (JSC::Parser<LexerType>::parseConditionalExpression):
 978         (JSC::Parser<LexerType>::parseBinaryExpression):
 979         (JSC::Parser<LexerType>::parseObjectLiteral):
 980         (JSC::Parser<LexerType>::parseStrictObjectLiteral):
 981         (JSC::Parser<LexerType>::parseArrayLiteral):
 982         (JSC::Parser<LexerType>::parseArguments):
 983         (JSC::Parser<LexerType>::parseMemberExpression):
 984         (JSC::operatorString):
 985         (JSC::Parser<LexerType>::parseUnaryExpression):
 986         (JSC::Parser<LexerType>::printUnexpectedTokenText):
 987
 988 2018-04-28  Caio Lima  <ticaiolima@gmail.com>
 989
 990         [ESNext][BigInt] Implement support for "*" operation
 991         https://bugs.webkit.org/show_bug.cgi?id=183721
 992
 993         Reviewed by Saam Barati.
 994
 995         Added BigInt support into times binary operator into LLInt and on
 996         JITOperations profiledMul and unprofiledMul. We are also replacing all
 997         uses of int to unsigned when there is no negative values for
 998         variables.
 999
1000         * dfg/DFGConstantFoldingPhase.cpp:
1001         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1002         * jit/JITOperations.cpp:
1003         * runtime/CommonSlowPaths.cpp:
1004         (JSC::SLOW_PATH_DECL):
1005         * runtime/JSBigInt.cpp:
1006         (JSC::JSBigInt::JSBigInt):
1007         (JSC::JSBigInt::allocationSize):
1008         (JSC::JSBigInt::createWithLength):
1009         (JSC::JSBigInt::toString):
1010         (JSC::JSBigInt::multiply):
1011         (JSC::JSBigInt::digitDiv):
1012         (JSC::JSBigInt::internalMultiplyAdd):
1013         (JSC::JSBigInt::multiplyAccumulate):
1014         (JSC::JSBigInt::equals):
1015         (JSC::JSBigInt::absoluteDivSmall):
1016         (JSC::JSBigInt::calculateMaximumCharactersRequired):
1017         (JSC::JSBigInt::toStringGeneric):
1018         (JSC::JSBigInt::rightTrim):
1019         (JSC::JSBigInt::allocateFor):
1020         (JSC::JSBigInt::parseInt):
1021         (JSC::JSBigInt::digit):
1022         (JSC::JSBigInt::setDigit):
1023         * runtime/JSBigInt.h:
1024         * runtime/Operations.h:
1025         (JSC::jsMul):
1026
1027 2018-04-28  Commit Queue  <commit-queue@webkit.org>
1028
1029         Unreviewed, rolling out r231131.
1030         https://bugs.webkit.org/show_bug.cgi?id=185112
1031
1032         It is breaking Debug build due to unchecked exception
1033         (Requested by caiolima on #webkit).
1034
1035         Reverted changeset:
1036
1037         "[ESNext][BigInt] Implement support for "*" operation"
1038         https://bugs.webkit.org/show_bug.cgi?id=183721
1039         https://trac.webkit.org/changeset/231131
1040
1041 2018-04-27  Caio Lima  <ticaiolima@gmail.com>
1042
1043         [ESNext][BigInt] Implement support for "*" operation
1044         https://bugs.webkit.org/show_bug.cgi?id=183721
1045
1046         Reviewed by Saam Barati.
1047
1048         Added BigInt support into times binary operator into LLInt and on
1049         JITOperations profiledMul and unprofiledMul. We are also replacing all
1050         uses of int to unsigned when there is no negative values for
1051         variables.
1052
1053         * dfg/DFGConstantFoldingPhase.cpp:
1054         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1055         * jit/JITOperations.cpp:
1056         * runtime/CommonSlowPaths.cpp:
1057         (JSC::SLOW_PATH_DECL):
1058         * runtime/JSBigInt.cpp:
1059         (JSC::JSBigInt::JSBigInt):
1060         (JSC::JSBigInt::allocationSize):
1061         (JSC::JSBigInt::createWithLength):
1062         (JSC::JSBigInt::toString):
1063         (JSC::JSBigInt::multiply):
1064         (JSC::JSBigInt::digitDiv):
1065         (JSC::JSBigInt::internalMultiplyAdd):
1066         (JSC::JSBigInt::multiplyAccumulate):
1067         (JSC::JSBigInt::equals):
1068         (JSC::JSBigInt::absoluteDivSmall):
1069         (JSC::JSBigInt::calculateMaximumCharactersRequired):
1070         (JSC::JSBigInt::toStringGeneric):
1071         (JSC::JSBigInt::rightTrim):
1072         (JSC::JSBigInt::allocateFor):
1073         (JSC::JSBigInt::parseInt):
1074         (JSC::JSBigInt::digit):
1075         (JSC::JSBigInt::setDigit):
1076         * runtime/JSBigInt.h:
1077         * runtime/Operations.h:
1078         (JSC::jsMul):
1079
1080 2018-04-27  JF Bastien  <jfbastien@apple.com>
1081
1082         Make the first 64 bits of JSString look like a double JSValue
1083         https://bugs.webkit.org/show_bug.cgi?id=185081
1084
1085         Reviewed by Filip Pizlo.
1086
1087         We can be clever about how we lay out JSString so that, were it
1088         reinterpreted as a JSValue, it would look like a double.
1089
1090         * assembler/MacroAssemblerX86Common.h:
1091         (JSC::MacroAssemblerX86Common::and16):
1092         * assembler/X86Assembler.h:
1093         (JSC::X86Assembler::andw_mr):
1094         * dfg/DFGSpeculativeJIT.cpp:
1095         (JSC::DFG::SpeculativeJIT::compileMakeRope):
1096         * ftl/FTLLowerDFGToB3.cpp:
1097         (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
1098         * ftl/FTLOutput.h:
1099         (JSC::FTL::Output::store32As8):
1100         (JSC::FTL::Output::store32As16):
1101         * runtime/JSString.h:
1102         (JSC::JSString::JSString):
1103
1104 2018-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1105
1106         [JSC][ARM64][Linux] Add collectCPUFeatures using auxiliary vector
1107         https://bugs.webkit.org/show_bug.cgi?id=185055
1108
1109         Reviewed by JF Bastien.
1110
1111         This patch is paving the way to emitting jscvt instruction if possible.
1112         To do that, we need to determine jscvt instruction is supported in the
1113         given CPU.
1114
1115         We add a function collectCPUFeatures, which is responsible to collect
1116         CPU features if necessary. In Linux, we can use auxiliary vector to get
1117         the information without parsing /proc/cpuinfo.
1118
1119         Currently, nobody calls this function. It is later called when we emit
1120         jscvt instruction. To make it possible, we also need to add disassembler
1121         support too.
1122
1123         * assembler/AbstractMacroAssembler.h:
1124         * assembler/MacroAssemblerARM64.cpp:
1125         (JSC::MacroAssemblerARM64::collectCPUFeatures):
1126         * assembler/MacroAssemblerARM64.h:
1127         * assembler/MacroAssemblerX86Common.h:
1128
1129 2018-04-26  Filip Pizlo  <fpizlo@apple.com>
1130
1131         Also run foldPathConstants before mussing up SSA
1132         https://bugs.webkit.org/show_bug.cgi?id=185069
1133
1134         Reviewed by Saam Barati.
1135
1136         This isn't needed now, but will be once I implement the phase in bug 185060.
1137
1138         This could be a speed-up, or a slow-down, independent of that phase. Most likely it's neutral.
1139         Local testing seems to suggest that it's neutral. Anyway, whatever it ends up being, I want it to
1140         be landed separately and measured separately from that phase.
1141
1142         It's probably nice for sanity to have this and reduceStrength run before tail duplication and
1143         another round of reduceStrength, since that make for something that is closer to a fixpoint. But
1144         it will increase FTL compile times. So, there's no way to guess if this change is good, bad, or
1145         neutral. It all depends on what programs typically look like.
1146
1147         * b3/B3Generate.cpp:
1148         (JSC::B3::generateToAir):
1149
1150 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
1151
1152         Unreviewed, rolling out r231086.
1153
1154         Caused JSC test failures due to an unchecked exception.
1155
1156         Reverted changeset:
1157
1158         "[ESNext][BigInt] Implement support for "*" operation"
1159         https://bugs.webkit.org/show_bug.cgi?id=183721
1160         https://trac.webkit.org/changeset/231086
1161
1162 2018-04-26  Caio Lima  <ticaiolima@gmail.com>
1163
1164         [ESNext][BigInt] Implement support for "*" operation
1165         https://bugs.webkit.org/show_bug.cgi?id=183721
1166
1167         Reviewed by Saam Barati.
1168
1169         Added BigInt support into times binary operator into LLInt and on
1170         JITOperations profiledMul and unprofiledMul. We are also replacing all
1171         uses of int to unsigned when there is no negative values for
1172         variables.
1173
1174         * dfg/DFGConstantFoldingPhase.cpp:
1175         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1176         * jit/JITOperations.cpp:
1177         * runtime/CommonSlowPaths.cpp:
1178         (JSC::SLOW_PATH_DECL):
1179         * runtime/JSBigInt.cpp:
1180         (JSC::JSBigInt::JSBigInt):
1181         (JSC::JSBigInt::allocationSize):
1182         (JSC::JSBigInt::createWithLength):
1183         (JSC::JSBigInt::toString):
1184         (JSC::JSBigInt::multiply):
1185         (JSC::JSBigInt::digitDiv):
1186         (JSC::JSBigInt::internalMultiplyAdd):
1187         (JSC::JSBigInt::multiplyAccumulate):
1188         (JSC::JSBigInt::equals):
1189         (JSC::JSBigInt::absoluteDivSmall):
1190         (JSC::JSBigInt::calculateMaximumCharactersRequired):
1191         (JSC::JSBigInt::toStringGeneric):
1192         (JSC::JSBigInt::rightTrim):
1193         (JSC::JSBigInt::allocateFor):
1194         (JSC::JSBigInt::parseInt):
1195         (JSC::JSBigInt::digit):
1196         (JSC::JSBigInt::setDigit):
1197         * runtime/JSBigInt.h:
1198         * runtime/Operations.h:
1199         (JSC::jsMul):
1200
1201 2018-04-26  Mark Lam  <mark.lam@apple.com>
1202
1203         Gardening: Speculative build fix for Windows.
1204         https://bugs.webkit.org/show_bug.cgi?id=184976
1205         <rdar://problem/39723901>
1206
1207         Not reviewed.
1208
1209         * runtime/JSCPtrTag.h:
1210
1211 2018-04-26  Mark Lam  <mark.lam@apple.com>
1212
1213         Gardening: Windows build fix.
1214
1215         Not reviewed.
1216
1217         * runtime/Options.cpp:
1218
1219 2018-04-26  Jer Noble  <jer.noble@apple.com>
1220
1221         WK_COCOA_TOUCH all the things.
1222         https://bugs.webkit.org/show_bug.cgi?id=185006
1223         <rdar://problem/39736025>
1224
1225         Reviewed by Tim Horton.
1226
1227         * Configurations/Base.xcconfig:
1228
1229 2018-04-26  Per Arne Vollan  <pvollan@apple.com>
1230
1231         Disable content filtering in minimal simulator mode
1232         https://bugs.webkit.org/show_bug.cgi?id=185027
1233         <rdar://problem/39736091>
1234
1235         Reviewed by Jer Noble.
1236
1237         * Configurations/FeatureDefines.xcconfig:
1238
1239 2018-04-26  Andy VanWagoner  <thetalecrafter@gmail.com>
1240
1241         [INTL] Implement Intl.PluralRules
1242         https://bugs.webkit.org/show_bug.cgi?id=184312
1243
1244         Reviewed by JF Bastien.
1245
1246         Use UNumberFormat to enforce formatting, and then UPluralRules to find
1247         the correct plural rule for the given number. Relies on ICU v59+ for
1248         resolvedOptions().pluralCategories and trailing 0 detection.
1249         Behind the useIntlPluralRules option and INTL_PLURAL_RULES flag.
1250
1251         * CMakeLists.txt:
1252         * Configurations/FeatureDefines.xcconfig:
1253         * DerivedSources.make:
1254         * JavaScriptCore.xcodeproj/project.pbxproj:
1255         * Sources.txt:
1256         * builtins/BuiltinNames.h:
1257         * runtime/BigIntObject.cpp:
1258         (JSC::BigIntObject::create): Moved to ensure complete JSGlobalObject definition.
1259         * runtime/BigIntObject.h:
1260         * runtime/CommonIdentifiers.h:
1261         * runtime/IntlObject.cpp:
1262         (JSC::IntlObject::finishCreation):
1263         * runtime/IntlObject.h:
1264         * runtime/IntlPluralRules.cpp: Added.
1265         (JSC::IntlPluralRules::UPluralRulesDeleter::operator() const):
1266         (JSC::IntlPluralRules::UNumberFormatDeleter::operator() const):
1267         (JSC::UEnumerationDeleter::operator() const):
1268         (JSC::IntlPluralRules::create):
1269         (JSC::IntlPluralRules::createStructure):
1270         (JSC::IntlPluralRules::IntlPluralRules):
1271         (JSC::IntlPluralRules::finishCreation):
1272         (JSC::IntlPluralRules::destroy):
1273         (JSC::IntlPluralRules::visitChildren):
1274         (JSC::IntlPRInternal::localeData):
1275         (JSC::IntlPluralRules::initializePluralRules):
1276         (JSC::IntlPluralRules::resolvedOptions):
1277         (JSC::IntlPluralRules::select):
1278         * runtime/IntlPluralRules.h: Added.
1279         * runtime/IntlPluralRulesConstructor.cpp: Added.
1280         (JSC::IntlPluralRulesConstructor::create):
1281         (JSC::IntlPluralRulesConstructor::createStructure):
1282         (JSC::IntlPluralRulesConstructor::IntlPluralRulesConstructor):
1283         (JSC::IntlPluralRulesConstructor::finishCreation):
1284         (JSC::constructIntlPluralRules):
1285         (JSC::callIntlPluralRules):
1286         (JSC::IntlPluralRulesConstructorFuncSupportedLocalesOf):
1287         (JSC::IntlPluralRulesConstructor::visitChildren):
1288         * runtime/IntlPluralRulesConstructor.h: Added.
1289         * runtime/IntlPluralRulesPrototype.cpp: Added.
1290         (JSC::IntlPluralRulesPrototype::create):
1291         (JSC::IntlPluralRulesPrototype::createStructure):
1292         (JSC::IntlPluralRulesPrototype::IntlPluralRulesPrototype):
1293         (JSC::IntlPluralRulesPrototype::finishCreation):
1294         (JSC::IntlPluralRulesPrototypeFuncSelect):
1295         (JSC::IntlPluralRulesPrototypeFuncResolvedOptions):
1296         * runtime/IntlPluralRulesPrototype.h: Added.
1297         * runtime/JSGlobalObject.cpp:
1298         (JSC::JSGlobalObject::init):
1299         (JSC::JSGlobalObject::intlPluralRulesAvailableLocales):
1300         * runtime/JSGlobalObject.h:
1301         * runtime/Options.h:
1302         * runtime/RegExpPrototype.cpp: Added inlines header.
1303         * runtime/VM.cpp:
1304         (JSC::VM::VM):
1305         * runtime/VM.h:
1306
1307 2018-04-26  Dominik Infuehr  <dinfuehr@igalia.com>
1308
1309         [MIPS] Fix branch offsets in branchNeg32
1310         https://bugs.webkit.org/show_bug.cgi?id=185025
1311
1312         Reviewed by Yusuke Suzuki.
1313
1314         Two nops were removed in branch(Not)Equal in #183130 but the offset wasn't adjusted.
1315
1316         * assembler/MacroAssemblerMIPS.h:
1317         (JSC::MacroAssemblerMIPS::branchNeg32):
1318
1319 2018-04-25  Robin Morisset  <rmorisset@apple.com>
1320
1321         In FTLLowerDFGToB3.cpp::compileCreateRest, always use a contiguous array as the indexing type when under isWatchingHavingABadTimeWatchpoint
1322         https://bugs.webkit.org/show_bug.cgi?id=184773
1323         <rdar://problem/37773612>
1324
1325         Reviewed by Filip Pizlo.
1326
1327         We were calling restParameterStructure(), which returns arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous).
1328         arrayStructureForIndexingTypeDuringAllocation uses m_arrayStructureForIndexingShapeDuringAllocation, which is set to SlowPutArrayStorage when we are 'having a bad time'.
1329         This is problematic, because the structure is then passed to allocateUninitializedContiguousJSArray, which ASSERTs that the indexing type is contiguous (or int32).
1330         We solve the problem by using originalArrayStructureForIndexingType which always returns a structure with the right indexing type (contiguous), even if we are having a bad time.
1331         This is safe, as we are under isWatchingHavingABadTimeWatchpoint, so if we have a bad time, the code we generate will never be installed.
1332
1333         * ftl/FTLLowerDFGToB3.cpp:
1334         (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
1335
1336 2018-04-25  Mark Lam  <mark.lam@apple.com>
1337
1338         Push the definition of PtrTag down to the WTF layer.
1339         https://bugs.webkit.org/show_bug.cgi?id=184976
1340         <rdar://problem/39723901>
1341
1342         Reviewed by Saam Barati.
1343
1344         * CMakeLists.txt:
1345         * JavaScriptCore.xcodeproj/project.pbxproj:
1346         * assembler/ARM64Assembler.h:
1347         * assembler/AbstractMacroAssembler.h:
1348         * assembler/MacroAssemblerCodeRef.cpp:
1349         * assembler/MacroAssemblerCodeRef.h:
1350         * b3/B3MathExtras.cpp:
1351         * bytecode/LLIntCallLinkInfo.h:
1352         * disassembler/Disassembler.h:
1353         * ftl/FTLJITCode.cpp:
1354         * interpreter/InterpreterInlines.h:
1355         * jit/ExecutableAllocator.h:
1356         * jit/JITOperations.cpp:
1357         * jit/ThunkGenerator.h:
1358         * jit/ThunkGenerators.h:
1359         * llint/LLIntOffsetsExtractor.cpp:
1360         * llint/LLIntPCRanges.h:
1361         * runtime/JSCPtrTag.h: Added.
1362         * runtime/NativeFunction.h:
1363         * runtime/PtrTag.h: Removed.
1364         * runtime/VMTraps.cpp:
1365
1366 2018-04-25  Keith Miller  <keith_miller@apple.com>
1367
1368         getUnlinkedGlobalFunctionExecutable should only save things to the code cache if the option is set
1369         https://bugs.webkit.org/show_bug.cgi?id=184998
1370
1371         Reviewed by Saam Barati.
1372
1373         * runtime/CodeCache.cpp:
1374         (JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):
1375
1376 2018-04-25  Keith Miller  <keith_miller@apple.com>
1377
1378         Add missing scope release to functionProtoFuncToString
1379         https://bugs.webkit.org/show_bug.cgi?id=184995
1380
1381         Reviewed by Saam Barati.
1382
1383         * runtime/FunctionPrototype.cpp:
1384         (JSC::functionProtoFuncToString):
1385
1386 2018-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1387
1388         REGRESSION(r230748) [GTK][ARM] no matching function for call to 'JSC::CCallHelpers::swap(JSC::ARMRegisters::FPRegisterID&, JSC::ARMRegisters::FPRegisterID&)'
1389         https://bugs.webkit.org/show_bug.cgi?id=184730
1390
1391         Reviewed by Mark Lam.
1392
1393         Add swap(FPRegisterID, FPRegisterID) implementation using ARMRegisters::SD0 (temporary register in MacroAssemblerARM).
1394         And we now use dataTempRegister, addressTempRegister, and fpTempRegister instead of using S0, S1, and SD0.
1395
1396         We also change swap(RegisterID, RegisterID) implementation to use moves and temporaries simply. This is aligned to
1397         ARMv7 implementation.
1398
1399         * assembler/ARMAssembler.h:
1400         * assembler/MacroAssemblerARM.h:
1401         (JSC::MacroAssemblerARM::add32):
1402         (JSC::MacroAssemblerARM::and32):
1403         (JSC::MacroAssemblerARM::lshift32):
1404         (JSC::MacroAssemblerARM::mul32):
1405         (JSC::MacroAssemblerARM::or32):
1406         (JSC::MacroAssemblerARM::rshift32):
1407         (JSC::MacroAssemblerARM::urshift32):
1408         (JSC::MacroAssemblerARM::sub32):
1409         (JSC::MacroAssemblerARM::xor32):
1410         (JSC::MacroAssemblerARM::load8):
1411         (JSC::MacroAssemblerARM::abortWithReason):
1412         (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
1413         (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
1414         (JSC::MacroAssemblerARM::store8):
1415         (JSC::MacroAssemblerARM::store32):
1416         (JSC::MacroAssemblerARM::push):
1417         (JSC::MacroAssemblerARM::swap):
1418         (JSC::MacroAssemblerARM::branch8):
1419         (JSC::MacroAssemblerARM::branchPtr):
1420         (JSC::MacroAssemblerARM::branch32):
1421         (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
1422         (JSC::MacroAssemblerARM::branchTest8):
1423         (JSC::MacroAssemblerARM::branchTest32):
1424         (JSC::MacroAssemblerARM::jump):
1425         (JSC::MacroAssemblerARM::branchAdd32):
1426         (JSC::MacroAssemblerARM::mull32):
1427         (JSC::MacroAssemblerARM::branchMul32):
1428         (JSC::MacroAssemblerARM::patchableBranch32):
1429         (JSC::MacroAssemblerARM::nearCall):
1430         (JSC::MacroAssemblerARM::compare32):
1431         (JSC::MacroAssemblerARM::compare8):
1432         (JSC::MacroAssemblerARM::test32):
1433         (JSC::MacroAssemblerARM::test8):
1434         (JSC::MacroAssemblerARM::add64):
1435         (JSC::MacroAssemblerARM::load32):
1436         (JSC::MacroAssemblerARM::call):
1437         (JSC::MacroAssemblerARM::branchPtrWithPatch):
1438         (JSC::MacroAssemblerARM::branch32WithPatch):
1439         (JSC::MacroAssemblerARM::storePtrWithPatch):
1440         (JSC::MacroAssemblerARM::loadDouble):
1441         (JSC::MacroAssemblerARM::storeDouble):
1442         (JSC::MacroAssemblerARM::addDouble):
1443         (JSC::MacroAssemblerARM::divDouble):
1444         (JSC::MacroAssemblerARM::subDouble):
1445         (JSC::MacroAssemblerARM::mulDouble):
1446         (JSC::MacroAssemblerARM::convertInt32ToDouble):
1447         (JSC::MacroAssemblerARM::branchDouble):
1448         (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
1449         (JSC::MacroAssemblerARM::truncateDoubleToInt32):
1450         (JSC::MacroAssemblerARM::truncateDoubleToUint32):
1451         (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
1452         (JSC::MacroAssemblerARM::branchDoubleNonZero):
1453         (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
1454         (JSC::MacroAssemblerARM::call32):
1455         (JSC::MacroAssemblerARM::internalCompare32):
1456
1457 2018-04-25  Ross Kirsling  <ross.kirsling@sony.com>
1458
1459         [WinCairo] Fix js/regexp-unicode.html crash.
1460         https://bugs.webkit.org/show_bug.cgi?id=184891
1461
1462         Reviewed by Yusuke Suzuki.
1463
1464         On Win64, register RDI is "considered nonvolatile and must be saved and restored by a function that uses [it]".
1465         RDI is being used as a scratch register for JIT_UNICODE_EXPRESSIONS, not just YARR_JIT_ALL_PARENS_EXPRESSIONS.
1466
1467         * yarr/YarrJIT.cpp:
1468         (JSC::Yarr::YarrGenerator::generateEnter):
1469         (JSC::Yarr::YarrGenerator::generateReturn):
1470         Unconditionally save and restore RDI on 64-bit Windows.
1471
1472 2018-04-25  Michael Catanzaro  <mcatanzaro@igalia.com>
1473
1474         [GTK] Miscellaneous build cleanups
1475         https://bugs.webkit.org/show_bug.cgi?id=184399
1476
1477         Reviewed by Žan Doberšek.
1478
1479         * PlatformGTK.cmake:
1480
1481 2018-04-24  Keith Miller  <keith_miller@apple.com>
1482
1483         fromCharCode is missing some exception checks
1484         https://bugs.webkit.org/show_bug.cgi?id=184952
1485
1486         Reviewed by Saam Barati.
1487
1488         I also removed the pointless slow path function and moved it into the
1489         main function.
1490
1491         * runtime/StringConstructor.cpp:
1492         (JSC::stringFromCharCode):
1493         (JSC::stringFromCharCodeSlowCase): Deleted.
1494
1495 2018-04-24  Filip Pizlo  <fpizlo@apple.com>
1496
1497         MultiByOffset should emit one fewer branches in the case that the set of structures is proved already
1498         https://bugs.webkit.org/show_bug.cgi?id=184923
1499
1500         Reviewed by Saam Barati.
1501
1502         If we have a MultiGetByOffset or MultiPutByOffset over a structure set that we've already proved
1503         (i.e. we know that the object has one of those structures), then previously we would still emit a
1504         switch with a case per structure along with a default case. That would mean one extra redundant
1505         branch to check that whatever structure we wound up with belongs to the set. In that case, we
1506         were already making the default case be an Oops.
1507
1508         One possible solution would be to say that the default case being Oops means that B3 doesn't need
1509         to emit the extra branch. But that would require having B3 exploit the fact that Oops is known to
1510         be unreachable. Although B3 IR semantics (webkit.org/docs/b3/intermediate-representation.html)
1511         seem to allow this, I don't particularly like that style of optimization. I like Oops to mean
1512         trap.
1513
1514         So, this patch makes FTL lowering turn one of the cases into the default, explicitly removing the
1515         extra branch.
1516
1517         This is not a speed-up. But it makes the B3 IR for MultiByOffset a lot simpler, which should make
1518         it easier to implement B3-level optimizations for MultiByOffset. It also makes the IR easier to
1519         read.
1520
1521         * ftl/FTLLowerDFGToB3.cpp:
1522         (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
1523         (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
1524         (JSC::FTL::DFG::LowerDFGToB3::emitSwitchForMultiByOffset):
1525
1526 2018-04-24  Filip Pizlo  <fpizlo@apple.com>
1527
1528         DFG CSE should know how to decay a MultiGetByOffset
1529         https://bugs.webkit.org/show_bug.cgi?id=159859
1530
1531         Reviewed by Keith Miller.
1532
1533         This teaches Node::remove() how to decay a MultiGetByOffset to a CheckStructure, so that
1534         clobberize() can report a def() for MultiGetByOffset.
1535
1536         This is a slight improvement to codegen in splay because splay is a heavy user of
1537         MultiGetByOffset. It uses it redundantly in one of its hot functions (the function called
1538         "splay_"). I don't see a net speed-up in the benchmark. However, this is just a first step to
1539         removing MultiXByOffset-related redundancies, which by my estimates account for 16% of
1540         splay's time.
1541
1542         * dfg/DFGClobberize.h:
1543         (JSC::DFG::clobberize):
1544         * dfg/DFGNode.cpp:
1545         (JSC::DFG::Node::remove):
1546         (JSC::DFG::Node::removeWithoutChecks):
1547         (JSC::DFG::Node::replaceWith):
1548         (JSC::DFG::Node::replaceWithWithoutChecks):
1549         * dfg/DFGNode.h:
1550         (JSC::DFG::Node::convertToMultiGetByOffset):
1551         (JSC::DFG::Node::replaceWith): Deleted.
1552         * dfg/DFGNodeType.h:
1553         * dfg/DFGObjectAllocationSinkingPhase.cpp:
1554
1555 2018-04-24  Keith Miller  <keith_miller@apple.com>
1556
1557         Update API docs with information on which run loop the VM will use
1558         https://bugs.webkit.org/show_bug.cgi?id=184900
1559         <rdar://problem/39166054>
1560
1561         Reviewed by Mark Lam.
1562
1563         * API/JSContextRef.h:
1564         * API/JSVirtualMachine.h:
1565
1566 2018-04-24  Filip Pizlo  <fpizlo@apple.com>
1567
1568         $vm.totalGCTime() should be a thing
1569         https://bugs.webkit.org/show_bug.cgi?id=184916
1570
1571         Reviewed by Sam Weinig.
1572
1573         When debugging regressions in tests that are GC heavy, it's nice to be able to query the total
1574         time spent in GC to determine if the regression is because the GC got slower.
1575
1576         This adds $vm.totalGCTime(), which tells you the total time spent in GC, in seconds.
1577
1578         * heap/Heap.cpp:
1579         (JSC::Heap::runEndPhase):
1580         * heap/Heap.h:
1581         (JSC::Heap::totalGCTime const):
1582         * tools/JSDollarVM.cpp:
1583         (JSC::functionTotalGCTime):
1584         (JSC::JSDollarVM::finishCreation):
1585
1586 2018-04-23  Zalan Bujtas  <zalan@apple.com>
1587
1588         [LayoutFormattingContext] Initial commit.
1589         https://bugs.webkit.org/show_bug.cgi?id=184896
1590
1591         Reviewed by Antti Koivisto.
1592
1593         * Configurations/FeatureDefines.xcconfig:
1594
1595 2018-04-23  Filip Pizlo  <fpizlo@apple.com>
1596
1597         Unreviewed, revert accidental change to verbose flag.
1598
1599         * dfg/DFGByteCodeParser.cpp:
1600
1601 2018-04-23  Filip Pizlo  <fpizlo@apple.com>
1602
1603         Roll out r226655 because it broke OSR entry when the pre-header is inadequately profiled.
1604
1605         Rubber stamped by Saam Barati.
1606
1607         This is a >2x speed-up in SunSpider/bitops-bitwise-and. We don't really care about SunSpider
1608         anymore, but r226655 didn't result in any benchmark wins and just regressed this test by a lot.
1609         Seems sensible to just roll it out.
1610
1611         * dfg/DFGByteCodeParser.cpp:
1612         (JSC::DFG::ByteCodeParser::addToGraph):
1613         (JSC::DFG::ByteCodeParser::parse):
1614
1615 2018-04-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1616
1617         [JSC] Remove ModuleLoaderPrototype
1618         https://bugs.webkit.org/show_bug.cgi?id=184784
1619
1620         Reviewed by Mark Lam.
1621
1622         When we introduce ModuleLoaderPrototype, ModuleLoader may be created by users and exposed to users.
1623         However, the loader spec is abandoned. So we do not need to have ModuleLoaderPrototype and JSModuleLoader.
1624         This patch merges ModuleLoaderPrototype's functionality into JSModuleLoader.
1625
1626         * CMakeLists.txt:
1627         * DerivedSources.make:
1628         * JavaScriptCore.xcodeproj/project.pbxproj:
1629         * Sources.txt:
1630         * builtins/ModuleLoader.js: Renamed from Source/JavaScriptCore/builtins/ModuleLoaderPrototype.js.
1631         * runtime/JSGlobalObject.cpp:
1632         (JSC::JSGlobalObject::init):
1633         (JSC::JSGlobalObject::visitChildren):
1634         * runtime/JSGlobalObject.h:
1635         (JSC::JSGlobalObject::proxyRevokeStructure const):
1636         (JSC::JSGlobalObject::moduleLoaderStructure const): Deleted.
1637         * runtime/JSModuleLoader.cpp:
1638         (JSC::moduleLoaderParseModule):
1639         (JSC::moduleLoaderRequestedModules):
1640         (JSC::moduleLoaderModuleDeclarationInstantiation):
1641         (JSC::moduleLoaderResolve):
1642         (JSC::moduleLoaderResolveSync):
1643         (JSC::moduleLoaderFetch):
1644         (JSC::moduleLoaderGetModuleNamespaceObject):
1645         (JSC::moduleLoaderEvaluate):
1646         * runtime/JSModuleLoader.h:
1647         * runtime/ModuleLoaderPrototype.cpp: Removed.
1648         * runtime/ModuleLoaderPrototype.h: Removed.
1649
1650 2018-04-20  Carlos Garcia Campos  <cgarcia@igalia.com>
1651
1652         [GLIB] All API tests fail in debug builds
1653         https://bugs.webkit.org/show_bug.cgi?id=184813
1654
1655         Reviewed by Mark Lam.
1656
1657         This is because of a conflict of ExceptionHandler class used in tests and ExceptionHandler struct defined in
1658         JSCContext.cpp. This patch renames the ExceptionHandler struct as JSCContextExceptionHandler.
1659
1660         * API/glib/JSCContext.cpp:
1661         (JSCContextExceptionHandler::JSCContextExceptionHandler):
1662         (JSCContextExceptionHandler::~JSCContextExceptionHandler):
1663         (jscContextConstructed):
1664         (ExceptionHandler::ExceptionHandler): Deleted.
1665         (ExceptionHandler::~ExceptionHandler): Deleted.
1666
1667 2018-04-20  Tim Horton  <timothy_horton@apple.com>
1668
1669         Adjust geolocation feature flag
1670         https://bugs.webkit.org/show_bug.cgi?id=184856
1671
1672         Reviewed by Wenson Hsieh.
1673
1674         * Configurations/FeatureDefines.xcconfig:
1675
1676 2018-04-20  Brian Burg  <bburg@apple.com>
1677
1678         Web Inspector: remove some dead code in IdentifiersFactory
1679         https://bugs.webkit.org/show_bug.cgi?id=184839
1680
1681         Reviewed by Timothy Hatcher.
1682
1683         This was never used on non-Chrome ports, so the identifier always has a
1684         prefix of '0.'. We may change this in the future, but for now remove this.
1685         Using a PID for this purpose is problematic anyway.
1686
1687         * inspector/IdentifiersFactory.cpp:
1688         (Inspector::addPrefixToIdentifier):
1689         (Inspector::IdentifiersFactory::createIdentifier):
1690         (Inspector::IdentifiersFactory::requestId):
1691         (Inspector::IdentifiersFactory::addProcessIdPrefixTo): Deleted.
1692         * inspector/IdentifiersFactory.h:
1693
1694 2018-04-20  Mark Lam  <mark.lam@apple.com>
1695
1696         Add the ability to use a hash for setting PtrTag enum values.
1697         https://bugs.webkit.org/show_bug.cgi?id=184852
1698         <rdar://problem/39613891>
1699
1700         Reviewed by Saam Barati.
1701
1702         * runtime/PtrTag.h:
1703
1704 2018-04-20  Mark Lam  <mark.lam@apple.com>
1705
1706         Some JSEntryPtrTags should actually be JSInternalPtrTags.
1707         https://bugs.webkit.org/show_bug.cgi?id=184712
1708         <rdar://problem/39507381>
1709
1710         Reviewed by Michael Saboff.
1711
1712         1. Convert some uses of JSEntryPtrTag into JSInternalPtrTags.
1713         2. Tag all LLInt bytecodes consistently with BytecodePtrTag now and retag them
1714            only when needed.
1715
1716         * bytecode/AccessCase.cpp:
1717         (JSC::AccessCase::generateImpl):
1718         * bytecode/ByValInfo.h:
1719         (JSC::ByValInfo::ByValInfo):
1720         * bytecode/CallLinkInfo.cpp:
1721         (JSC::CallLinkInfo::callReturnLocation):
1722         (JSC::CallLinkInfo::patchableJump):
1723         (JSC::CallLinkInfo::hotPathBegin):
1724         (JSC::CallLinkInfo::slowPathStart):
1725         * bytecode/CallLinkInfo.h:
1726         (JSC::CallLinkInfo::setCallLocations):
1727         (JSC::CallLinkInfo::hotPathOther):
1728         * bytecode/PolymorphicAccess.cpp:
1729         (JSC::PolymorphicAccess::regenerate):
1730         * bytecode/StructureStubInfo.h:
1731         (JSC::StructureStubInfo::doneLocation):
1732         * dfg/DFGJITCompiler.cpp:
1733         (JSC::DFG::JITCompiler::link):
1734         * dfg/DFGOSRExit.cpp:
1735         (JSC::DFG::reifyInlinedCallFrames):
1736         * ftl/FTLLazySlowPath.cpp:
1737         (JSC::FTL::LazySlowPath::initialize):
1738         * ftl/FTLLazySlowPath.h:
1739         (JSC::FTL::LazySlowPath::done const):
1740         * ftl/FTLLowerDFGToB3.cpp:
1741         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
1742         (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
1743         (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
1744         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
1745         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
1746         (JSC::FTL::DFG::LowerDFGToB3::compileIn):
1747         (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
1748         * jit/JIT.cpp:
1749         (JSC::JIT::link):
1750         * jit/JITExceptions.cpp:
1751         (JSC::genericUnwind):
1752         * jit/JITMathIC.h:
1753         (JSC::isProfileEmpty):
1754         * llint/LLIntData.cpp:
1755         (JSC::LLInt::initialize):
1756         * llint/LLIntData.h:
1757         (JSC::LLInt::getCodePtr):
1758         (JSC::LLInt::getExecutableAddress): Deleted.
1759         * llint/LLIntExceptions.cpp:
1760         (JSC::LLInt::callToThrow):
1761         * llint/LLIntSlowPaths.cpp:
1762         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1763         * wasm/js/WasmToJS.cpp:
1764         (JSC::Wasm::wasmToJS):
1765
1766 2018-04-18  Jer Noble  <jer.noble@apple.com>
1767
1768         Don't put build products into WK_ALTERNATE_WEBKIT_SDK_PATH for engineering builds
1769         https://bugs.webkit.org/show_bug.cgi?id=184762
1770
1771         Reviewed by Dan Bernstein.
1772
1773         * Configurations/Base.xcconfig:
1774         * JavaScriptCore.xcodeproj/project.pbxproj:
1775
1776 2018-04-20  Daniel Bates  <dabates@apple.com>
1777
1778         Remove code for compilers that did not support NSDMI for aggregates
1779         https://bugs.webkit.org/show_bug.cgi?id=184599
1780
1781         Reviewed by Per Arne Vollan.
1782
1783         Remove workaround for earlier Visual Studio versions that did not support non-static data
1784         member initializers (NSDMI) for aggregates. We have since updated all the build.webkit.org
1785         and EWS bots to a newer version that supports this feature.
1786
1787         * domjit/DOMJITEffect.h:
1788         (JSC::DOMJIT::Effect::Effect): Deleted.
1789         * runtime/HasOwnPropertyCache.h:
1790         (JSC::HasOwnPropertyCache::Entry::Entry): Deleted.
1791         * wasm/WasmFormat.h:
1792         (JSC::Wasm::WasmToWasmImportableFunction::WasmToWasmImportableFunction): Deleted.
1793
1794 2018-04-20  Mark Lam  <mark.lam@apple.com>
1795
1796         Build fix for internal builds after r230826.
1797         https://bugs.webkit.org/show_bug.cgi?id=184790
1798         <rdar://problem/39301369>
1799
1800         Not reviewed.
1801
1802         * runtime/Options.cpp:
1803         (JSC::overrideDefaults):
1804         * tools/SigillCrashAnalyzer.cpp:
1805         (JSC::SignalContext::dump):
1806
1807 2018-04-19  Tadeu Zagallo  <tzagallo@apple.com>
1808
1809         REGRESSION(r227340): ArrayBuffers were not being serialized when sent via MessagePorts
1810         https://bugs.webkit.org/show_bug.cgi?id=184254
1811         <rdar://problem/39140200>
1812
1813         Reviewed by Daniel Bates.
1814
1815         Expose an extra constructor of ArrayBufferContents in order to be able to decode SerializedScriptValues.
1816
1817         * runtime/ArrayBuffer.h:
1818         (JSC::ArrayBufferContents::ArrayBufferContents):
1819
1820 2018-04-19  Mark Lam  <mark.lam@apple.com>
1821
1822         Apply pointer profiling to Signal pointers.
1823         https://bugs.webkit.org/show_bug.cgi?id=184790
1824         <rdar://problem/39301369>
1825
1826         Reviewed by Michael Saboff.
1827
1828         1. Change stackPointer, framePointer, and instructionPointer accessors to
1829            be a pair of getter/setter functions.
1830         2. Add support for USE(PLATFORM_REGISTERS_WITH_PROFILE) to allow use of a
1831            a pointer profiling variants of these accessors.
1832         3. Also add a linkRegister accessor only for ARM64 on OS(DARWIN).
1833
1834         * JavaScriptCorePrefix.h:
1835         * runtime/MachineContext.h:
1836         (JSC::MachineContext::stackPointerImpl):
1837         (JSC::MachineContext::stackPointer):
1838         (JSC::MachineContext::setStackPointer):
1839         (JSC::MachineContext::framePointerImpl):
1840         (JSC::MachineContext::framePointer):
1841         (JSC::MachineContext::setFramePointer):
1842         (JSC::MachineContext::instructionPointerImpl):
1843         (JSC::MachineContext::instructionPointer):
1844         (JSC::MachineContext::setInstructionPointer):
1845         (JSC::MachineContext::linkRegisterImpl):
1846         (JSC::MachineContext::linkRegister):
1847         (JSC::MachineContext::setLinkRegister):
1848         * runtime/SamplingProfiler.cpp:
1849         (JSC::SamplingProfiler::takeSample):
1850         * runtime/VMTraps.cpp:
1851         (JSC::SignalContext::SignalContext):
1852         (JSC::VMTraps::tryInstallTrapBreakpoints):
1853         * tools/CodeProfiling.cpp:
1854         (JSC::profilingTimer):
1855         * tools/SigillCrashAnalyzer.cpp:
1856         (JSC::SignalContext::dump):
1857         (JSC::installCrashHandler):
1858         (JSC::SigillCrashAnalyzer::analyze):
1859         * wasm/WasmFaultSignalHandler.cpp:
1860         (JSC::Wasm::trapHandler):
1861
1862 2018-04-19  David Kilzer  <ddkilzer@apple.com>
1863
1864         Enable Objective-C weak references
1865         <https://webkit.org/b/184789>
1866         <rdar://problem/39571716>
1867
1868         Reviewed by Dan Bernstein.
1869
1870         * Configurations/Base.xcconfig:
1871         (CLANG_ENABLE_OBJC_WEAK): Enable.
1872         * Configurations/ToolExecutable.xcconfig:
1873         (CLANG_ENABLE_OBJC_ARC): Simplify.
1874
1875 2018-04-17  Filip Pizlo  <fpizlo@apple.com>
1876
1877         The InternalFunction hierarchy should be in IsoSubspaces
1878         https://bugs.webkit.org/show_bug.cgi?id=184721
1879
1880         Reviewed by Saam Barati.
1881
1882         This moves InternalFunction into a IsoSubspace. It also moves all subclasses into IsoSubspaces,
1883         but subclasses that are the same size as InternalFunction share its subspace. I did this
1884         because the subclasses appear to just override methods, which are called dynamically via the
1885         structure or class of the object. So, I don't see a type confusion risk if UAF is used to
1886         allocate one kind of InternalFunction over another.
1887
1888         * API/JSBase.h:
1889         * API/JSCallbackFunction.h:
1890         * API/ObjCCallbackFunction.h:
1891         (JSC::ObjCCallbackFunction::subspaceFor):
1892         * CMakeLists.txt:
1893         * JavaScriptCore.xcodeproj/project.pbxproj:
1894         * Sources.txt:
1895         * heap/IsoSubspacePerVM.cpp: Added.
1896         (JSC::IsoSubspacePerVM::AutoremovingIsoSubspace::AutoremovingIsoSubspace):
1897         (JSC::IsoSubspacePerVM::AutoremovingIsoSubspace::~AutoremovingIsoSubspace):
1898         (JSC::IsoSubspacePerVM::IsoSubspacePerVM):
1899         (JSC::IsoSubspacePerVM::~IsoSubspacePerVM):
1900         (JSC::IsoSubspacePerVM::forVM):
1901         * heap/IsoSubspacePerVM.h: Added.
1902         (JSC::IsoSubspacePerVM::SubspaceParameters::SubspaceParameters):
1903         * runtime/Error.h:
1904         * runtime/ErrorConstructor.h:
1905         * runtime/InternalFunction.h:
1906         (JSC::InternalFunction::subspaceFor):
1907         * runtime/IntlCollatorConstructor.h:
1908         * runtime/IntlDateTimeFormatConstructor.h:
1909         * runtime/IntlNumberFormatConstructor.h:
1910         * runtime/JSArrayBufferConstructor.h:
1911         * runtime/NativeErrorConstructor.h:
1912         * runtime/ProxyRevoke.h:
1913         * runtime/RegExpConstructor.h:
1914         * runtime/VM.cpp:
1915         (JSC::VM::VM):
1916         * runtime/VM.h:
1917
1918 2018-04-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1919
1920         Unreviewed, Fix jsc shell
1921         https://bugs.webkit.org/show_bug.cgi?id=184600
1922
1923         WebAssembly module loading does not finish with drainMicrotasks().
1924         So JSNativeStdFunction's capturing variables become invalid.
1925         This patch fixes this issue.
1926
1927         * jsc.cpp:
1928         (functionDollarAgentStart):
1929         (runWithOptions):
1930         (runJSC):
1931         (jscmain):
1932
1933 2018-04-18  Ross Kirsling  <ross.kirsling@sony.com>
1934
1935         REGRESSION(r230748) [WinCairo] 'JSC::JIT::appendCallWithSlowPathReturnType': function does not take 1 arguments
1936         https://bugs.webkit.org/show_bug.cgi?id=184725
1937
1938         Reviewed by Mark Lam.
1939
1940         * jit/JIT.h:
1941
1942 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1943
1944         [WebAssembly][Modules] Import tables in wasm modules
1945         https://bugs.webkit.org/show_bug.cgi?id=184738
1946
1947         Reviewed by JF Bastien.
1948
1949         This patch simply allows wasm modules to import table from wasm modules / js re-exporting.
1950         Basically moving JSWebAssemblyInstance's table linking code to WebAssemblyModuleRecord::link
1951         just works.
1952
1953         * wasm/js/JSWebAssemblyInstance.cpp:
1954         (JSC::JSWebAssemblyInstance::create):
1955         * wasm/js/WebAssemblyModuleRecord.cpp:
1956         (JSC::WebAssemblyModuleRecord::link):
1957
1958 2018-04-18  Dominik Infuehr  <dinfuehr@igalia.com>
1959
1960         [ARM] Fix build error and crash after PtrTag change
1961         https://bugs.webkit.org/show_bug.cgi?id=184732
1962
1963         Reviewed by Mark Lam.
1964
1965         Do not pass NoPtrTag in callOperation and fix misspelled JSEntryPtrTag. Use
1966         MacroAssemblerCodePtr::createFromExecutableAddress to avoid tagging a pointer
1967         twice with ARM-Thumb2.
1968
1969         * assembler/MacroAssemblerCodeRef.h:
1970         (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
1971         * jit/JITPropertyAccess32_64.cpp:
1972         (JSC::JIT::emitSlow_op_put_by_val):
1973         * jit/Repatch.cpp:
1974         (JSC::linkPolymorphicCall):
1975
1976 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1977
1978         [WebAssembly][Modules] Import globals from wasm modules
1979         https://bugs.webkit.org/show_bug.cgi?id=184736
1980
1981         Reviewed by JF Bastien.
1982
1983         This patch implements a feature importing globals to/from wasm modules.
1984         Since we are not supporting mutable globals now, we can just copy the
1985         global data when importing. Currently we do not support importing/exporting
1986         i64 globals. This will be supported once (1) mutable global bindings are
1987         specified and (2) BigInt based i64 importing/exporting is specified.
1988
1989         * wasm/js/JSWebAssemblyInstance.cpp:
1990         (JSC::JSWebAssemblyInstance::create):
1991         * wasm/js/WebAssemblyModuleRecord.cpp:
1992         (JSC::WebAssemblyModuleRecord::link):
1993
1994 2018-04-18  Tomas Popela  <tpopela@redhat.com>
1995
1996         Unreviewed, fix build on ARM
1997
1998         * assembler/MacroAssemblerARM.h:
1999         (JSC::MacroAssemblerARM::readCallTarget):
2000
2001 2018-04-18  Tomas Popela  <tpopela@redhat.com>
2002
2003         Unreviewed, fix build with GCC
2004
2005         * assembler/LinkBuffer.h:
2006         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
2007
2008 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
2009
2010         Unreviewed, reland r230697, r230720, and r230724.
2011         https://bugs.webkit.org/show_bug.cgi?id=184600
2012
2013         With CatchScope check.
2014
2015         * JavaScriptCore.xcodeproj/project.pbxproj:
2016         * builtins/ModuleLoaderPrototype.js:
2017         (globalPrivate.newRegistryEntry):
2018         (requestInstantiate):
2019         (link):
2020         * jsc.cpp:
2021         (convertShebangToJSComment):
2022         (fillBufferWithContentsOfFile):
2023         (fetchModuleFromLocalFileSystem):
2024         (GlobalObject::moduleLoaderFetch):
2025         (functionDollarAgentStart):
2026         (checkException):
2027         (runWithOptions):
2028         * parser/NodesAnalyzeModule.cpp:
2029         (JSC::ImportDeclarationNode::analyzeModule):
2030         * parser/SourceProvider.h:
2031         (JSC::WebAssemblySourceProvider::create):
2032         (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
2033         * runtime/AbstractModuleRecord.cpp:
2034         (JSC::AbstractModuleRecord::hostResolveImportedModule):
2035         (JSC::AbstractModuleRecord::resolveImport):
2036         (JSC::AbstractModuleRecord::link):
2037         (JSC::AbstractModuleRecord::evaluate):
2038         (JSC::identifierToJSValue): Deleted.
2039         * runtime/AbstractModuleRecord.h:
2040         (JSC::AbstractModuleRecord::moduleEnvironmentMayBeNull):
2041         (JSC::AbstractModuleRecord::ImportEntry::isNamespace const): Deleted.
2042         * runtime/JSModuleEnvironment.cpp:
2043         (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
2044         * runtime/JSModuleLoader.cpp:
2045         (JSC::JSModuleLoader::evaluate):
2046         * runtime/JSModuleRecord.cpp:
2047         (JSC::JSModuleRecord::link):
2048         (JSC::JSModuleRecord::instantiateDeclarations):
2049         * runtime/JSModuleRecord.h:
2050         * runtime/ModuleLoaderPrototype.cpp:
2051         (JSC::moduleLoaderPrototypeParseModule):
2052         (JSC::moduleLoaderPrototypeRequestedModules):
2053         (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
2054         * wasm/WasmCreationMode.h: Copied from Source/JavaScriptCore/wasm/js/WebAssemblyPrototype.h.
2055         * wasm/js/JSWebAssemblyHelpers.h:
2056         (JSC::getWasmBufferFromValue):
2057         (JSC::createSourceBufferFromValue):
2058         * wasm/js/JSWebAssemblyInstance.cpp:
2059         (JSC::JSWebAssemblyInstance::finalizeCreation):
2060         (JSC::JSWebAssemblyInstance::createPrivateModuleKey):
2061         (JSC::JSWebAssemblyInstance::create):
2062         * wasm/js/JSWebAssemblyInstance.h:
2063         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2064         (JSC::constructJSWebAssemblyInstance):
2065         * wasm/js/WebAssemblyModuleRecord.cpp:
2066         (JSC::WebAssemblyModuleRecord::prepareLink):
2067         (JSC::WebAssemblyModuleRecord::link):
2068         * wasm/js/WebAssemblyModuleRecord.h:
2069         * wasm/js/WebAssemblyPrototype.cpp:
2070         (JSC::resolve):
2071         (JSC::instantiate):
2072         (JSC::compileAndInstantiate):
2073         (JSC::WebAssemblyPrototype::instantiate):
2074         (JSC::webAssemblyInstantiateFunc):
2075         (JSC::webAssemblyValidateFunc):
2076         * wasm/js/WebAssemblyPrototype.h:
2077
2078 2018-04-17  Carlos Garcia Campos  <cgarcia@igalia.com>
2079
2080         [GLIB] Make it possible to handle JSCClass external properties not added to the prototype
2081         https://bugs.webkit.org/show_bug.cgi?id=184687
2082
2083         Reviewed by Michael Catanzaro.
2084
2085         Add JSCClassVTable that can be optionally passed to jsc_context_register_class() to provide implmentations for
2086         JSClassDefinition. This is required to implement dynamic properties that can't be added with
2087         jsc_class_add_property() for example to implement something like imports object in seed/gjs.
2088
2089         * API/glib/JSCClass.cpp:
2090         (VTableExceptionHandler::VTableExceptionHandler): Helper class to handle the exceptions in vtable functions that
2091         can throw exceptions.
2092         (VTableExceptionHandler::~VTableExceptionHandler):
2093         (getProperty): Iterate the class chain to call get_property function.
2094         (setProperty): Iterate the class chain to call set_property function.
2095         (hasProperty): Iterate the class chain to call has_property function.
2096         (deleteProperty): Iterate the class chain to call delete_property function.
2097         (getPropertyNames): Iterate the class chain to call enumerate_properties function.
2098         (jsc_class_class_init): Remove constructed implementation, since we need to initialize the JSClassDefinition in
2099         jscClassCreate now.
2100         (jscClassCreate): Receive an optional JSCClassVTable that is used to initialize the JSClassDefinition.
2101         * API/glib/JSCClass.h:
2102         * API/glib/JSCClassPrivate.h:
2103         * API/glib/JSCContext.cpp:
2104         (jscContextGetRegisteredClass): Helper to get the JSCClass for a given JSClassRef.
2105         (jsc_context_register_class): Add JSCClassVTable parameter.
2106         * API/glib/JSCContext.h:
2107         * API/glib/JSCContextPrivate.h:
2108         * API/glib/JSCWrapperMap.cpp:
2109         (JSC::WrapperMap::registeredClass const): Get the JSCClass for a given JSClassRef.
2110         * API/glib/JSCWrapperMap.h:
2111         * API/glib/docs/jsc-glib-4.0-sections.txt: Add new symbols.
2112
2113 2018-04-17  Mark Lam  <mark.lam@apple.com>
2114
2115         Templatize CodePtr/Refs/FunctionPtrs with PtrTags.
2116         https://bugs.webkit.org/show_bug.cgi?id=184702
2117         <rdar://problem/35391681>
2118
2119         Reviewed by Filip Pizlo and Saam Barati.
2120
2121         1. Templatized MacroAssemblerCodePtr/Ref, FunctionPtr, and CodeLocation variants
2122            to take a PtrTag template argument.
2123         2. Replaced some uses of raw pointers with the equivalent CodePtr / FunctionPtr.
2124
2125         * assembler/AbstractMacroAssembler.h:
2126         (JSC::AbstractMacroAssembler::differenceBetweenCodePtr):
2127         (JSC::AbstractMacroAssembler::linkJump):
2128         (JSC::AbstractMacroAssembler::linkPointer):
2129         (JSC::AbstractMacroAssembler::getLinkerAddress):
2130         (JSC::AbstractMacroAssembler::repatchJump):
2131         (JSC::AbstractMacroAssembler::repatchJumpToNop):
2132         (JSC::AbstractMacroAssembler::repatchNearCall):
2133         (JSC::AbstractMacroAssembler::repatchCompact):
2134         (JSC::AbstractMacroAssembler::repatchInt32):
2135         (JSC::AbstractMacroAssembler::repatchPointer):
2136         (JSC::AbstractMacroAssembler::readPointer):
2137         (JSC::AbstractMacroAssembler::replaceWithLoad):
2138         (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
2139         * assembler/CodeLocation.h:
2140         (JSC::CodeLocationCommon:: const):
2141         (JSC::CodeLocationCommon::CodeLocationCommon):
2142         (JSC::CodeLocationInstruction::CodeLocationInstruction):
2143         (JSC::CodeLocationLabel::CodeLocationLabel):
2144         (JSC::CodeLocationLabel::retagged):
2145         (JSC::CodeLocationLabel:: const):
2146         (JSC::CodeLocationJump::CodeLocationJump):
2147         (JSC::CodeLocationJump::retagged):
2148         (JSC::CodeLocationCall::CodeLocationCall):
2149         (JSC::CodeLocationCall::retagged):
2150         (JSC::CodeLocationNearCall::CodeLocationNearCall):
2151         (JSC::CodeLocationDataLabel32::CodeLocationDataLabel32):
2152         (JSC::CodeLocationDataLabelCompact::CodeLocationDataLabelCompact):
2153         (JSC::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
2154         (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad):
2155         (JSC::CodeLocationCommon<tag>::instructionAtOffset):
2156         (JSC::CodeLocationCommon<tag>::labelAtOffset):
2157         (JSC::CodeLocationCommon<tag>::jumpAtOffset):
2158         (JSC::CodeLocationCommon<tag>::callAtOffset):
2159         (JSC::CodeLocationCommon<tag>::nearCallAtOffset):
2160         (JSC::CodeLocationCommon<tag>::dataLabelPtrAtOffset):
2161         (JSC::CodeLocationCommon<tag>::dataLabel32AtOffset):
2162         (JSC::CodeLocationCommon<tag>::dataLabelCompactAtOffset):
2163         (JSC::CodeLocationCommon<tag>::convertibleLoadAtOffset):
2164         (JSC::CodeLocationCommon::instructionAtOffset): Deleted.
2165         (JSC::CodeLocationCommon::labelAtOffset): Deleted.
2166         (JSC::CodeLocationCommon::jumpAtOffset): Deleted.
2167         (JSC::CodeLocationCommon::callAtOffset): Deleted.
2168         (JSC::CodeLocationCommon::nearCallAtOffset): Deleted.
2169         (JSC::CodeLocationCommon::dataLabelPtrAtOffset): Deleted.
2170         (JSC::CodeLocationCommon::dataLabel32AtOffset): Deleted.
2171         (JSC::CodeLocationCommon::dataLabelCompactAtOffset): Deleted.
2172         (JSC::CodeLocationCommon::convertibleLoadAtOffset): Deleted.
2173         * assembler/LinkBuffer.cpp:
2174         (JSC::LinkBuffer::finalizeCodeWithoutDisassemblyImpl):
2175         (JSC::LinkBuffer::finalizeCodeWithDisassemblyImpl):
2176         (JSC::LinkBuffer::finalizeCodeWithoutDisassembly): Deleted.
2177         (JSC::LinkBuffer::finalizeCodeWithDisassembly): Deleted.
2178         * assembler/LinkBuffer.h:
2179         (JSC::LinkBuffer::link):
2180         (JSC::LinkBuffer::patch):
2181         (JSC::LinkBuffer::entrypoint):
2182         (JSC::LinkBuffer::locationOf):
2183         (JSC::LinkBuffer::locationOfNearCall):
2184         (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
2185         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
2186         (JSC::LinkBuffer::trampolineAt):
2187         * assembler/MacroAssemblerARM.h:
2188         (JSC::MacroAssemblerARM::readCallTarget):
2189         (JSC::MacroAssemblerARM::replaceWithJump):
2190         (JSC::MacroAssemblerARM::startOfPatchableBranch32WithPatchOnAddress):
2191         (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatchOnAddress):
2192         (JSC::MacroAssemblerARM::startOfBranchPtrWithPatchOnRegister):
2193         (JSC::MacroAssemblerARM::revertJumpReplacementToBranchPtrWithPatch):
2194         (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranch32WithPatch):
2195         (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranchPtrWithPatch):
2196         (JSC::MacroAssemblerARM::repatchCall):
2197         (JSC::MacroAssemblerARM::linkCall):
2198         * assembler/MacroAssemblerARM64.h:
2199         (JSC::MacroAssemblerARM64::readCallTarget):
2200         (JSC::MacroAssemblerARM64::replaceWithVMHalt):
2201         (JSC::MacroAssemblerARM64::replaceWithJump):
2202         (JSC::MacroAssemblerARM64::startOfBranchPtrWithPatchOnRegister):
2203         (JSC::MacroAssemblerARM64::startOfPatchableBranchPtrWithPatchOnAddress):
2204         (JSC::MacroAssemblerARM64::startOfPatchableBranch32WithPatchOnAddress):
2205         (JSC::MacroAssemblerARM64::revertJumpReplacementToBranchPtrWithPatch):
2206         (JSC::MacroAssemblerARM64::revertJumpReplacementToPatchableBranchPtrWithPatch):
2207         (JSC::MacroAssemblerARM64::revertJumpReplacementToPatchableBranch32WithPatch):
2208         (JSC::MacroAssemblerARM64::repatchCall):
2209         (JSC::MacroAssemblerARM64::linkCall):
2210         * assembler/MacroAssemblerARMv7.h:
2211         (JSC::MacroAssemblerARMv7::replaceWithJump):
2212         (JSC::MacroAssemblerARMv7::readCallTarget):
2213         (JSC::MacroAssemblerARMv7::startOfBranchPtrWithPatchOnRegister):
2214         (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
2215         (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatchOnAddress):
2216         (JSC::MacroAssemblerARMv7::startOfPatchableBranch32WithPatchOnAddress):
2217         (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
2218         (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranch32WithPatch):
2219         (JSC::MacroAssemblerARMv7::repatchCall):
2220         (JSC::MacroAssemblerARMv7::linkCall):
2221         * assembler/MacroAssemblerCodeRef.cpp:
2222         (JSC::MacroAssemblerCodePtrBase::dumpWithName):
2223         (JSC::MacroAssemblerCodeRefBase::tryToDisassemble):
2224         (JSC::MacroAssemblerCodeRefBase::disassembly):
2225         (JSC::MacroAssemblerCodePtr::createLLIntCodePtr): Deleted.
2226         (JSC::MacroAssemblerCodePtr::dumpWithName const): Deleted.
2227         (JSC::MacroAssemblerCodePtr::dump const): Deleted.
2228         (JSC::MacroAssemblerCodeRef::createLLIntCodeRef): Deleted.
2229         (JSC::MacroAssemblerCodeRef::tryToDisassemble const): Deleted.
2230         (JSC::MacroAssemblerCodeRef::disassembly const): Deleted.
2231         (JSC::MacroAssemblerCodeRef::dump const): Deleted.
2232         * assembler/MacroAssemblerCodeRef.h:
2233         (JSC::FunctionPtr::FunctionPtr):
2234         (JSC::FunctionPtr::retagged const):
2235         (JSC::FunctionPtr::retaggedExecutableAddress const):
2236         (JSC::FunctionPtr::operator== const):
2237         (JSC::FunctionPtr::operator!= const):
2238         (JSC::ReturnAddressPtr::ReturnAddressPtr):
2239         (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
2240         (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
2241         (JSC::MacroAssemblerCodePtr::retagged const):
2242         (JSC::MacroAssemblerCodePtr:: const):
2243         (JSC::MacroAssemblerCodePtr::dumpWithName const):
2244         (JSC::MacroAssemblerCodePtr::dump const):
2245         (JSC::MacroAssemblerCodePtrHash::hash):
2246         (JSC::MacroAssemblerCodePtrHash::equal):
2247         (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
2248         (JSC::MacroAssemblerCodeRef::createSelfManagedCodeRef):
2249         (JSC::MacroAssemblerCodeRef::code const):
2250         (JSC::MacroAssemblerCodeRef::retaggedCode const):
2251         (JSC::MacroAssemblerCodeRef::retagged const):
2252         (JSC::MacroAssemblerCodeRef::tryToDisassemble const):
2253         (JSC::MacroAssemblerCodeRef::disassembly const):
2254         (JSC::MacroAssemblerCodeRef::dump const):
2255         (JSC::FunctionPtr<tag>::FunctionPtr):
2256         * assembler/MacroAssemblerMIPS.h:
2257         (JSC::MacroAssemblerMIPS::readCallTarget):
2258         (JSC::MacroAssemblerMIPS::replaceWithJump):
2259         (JSC::MacroAssemblerMIPS::startOfPatchableBranch32WithPatchOnAddress):
2260         (JSC::MacroAssemblerMIPS::startOfBranchPtrWithPatchOnRegister):
2261         (JSC::MacroAssemblerMIPS::revertJumpReplacementToBranchPtrWithPatch):
2262         (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatchOnAddress):
2263         (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranch32WithPatch):
2264         (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranchPtrWithPatch):
2265         (JSC::MacroAssemblerMIPS::repatchCall):
2266         (JSC::MacroAssemblerMIPS::linkCall):
2267         * assembler/MacroAssemblerX86.h:
2268         (JSC::MacroAssemblerX86::readCallTarget):
2269         (JSC::MacroAssemblerX86::startOfBranchPtrWithPatchOnRegister):
2270         (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatchOnAddress):
2271         (JSC::MacroAssemblerX86::startOfPatchableBranch32WithPatchOnAddress):
2272         (JSC::MacroAssemblerX86::revertJumpReplacementToBranchPtrWithPatch):
2273         (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranchPtrWithPatch):
2274         (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranch32WithPatch):
2275         (JSC::MacroAssemblerX86::repatchCall):
2276         (JSC::MacroAssemblerX86::linkCall):
2277         * assembler/MacroAssemblerX86Common.h:
2278         (JSC::MacroAssemblerX86Common::repatchCompact):
2279         (JSC::MacroAssemblerX86Common::replaceWithVMHalt):
2280         (JSC::MacroAssemblerX86Common::replaceWithJump):
2281         * assembler/MacroAssemblerX86_64.h:
2282         (JSC::MacroAssemblerX86_64::readCallTarget):
2283         (JSC::MacroAssemblerX86_64::startOfBranchPtrWithPatchOnRegister):
2284         (JSC::MacroAssemblerX86_64::startOfBranch32WithPatchOnRegister):
2285         (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatchOnAddress):
2286         (JSC::MacroAssemblerX86_64::startOfPatchableBranch32WithPatchOnAddress):
2287         (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranchPtrWithPatch):
2288         (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranch32WithPatch):
2289         (JSC::MacroAssemblerX86_64::revertJumpReplacementToBranchPtrWithPatch):
2290         (JSC::MacroAssemblerX86_64::repatchCall):
2291         (JSC::MacroAssemblerX86_64::linkCall):
2292         * assembler/testmasm.cpp:
2293         (JSC::compile):
2294         (JSC::invoke):
2295         (JSC::testProbeModifiesProgramCounter):
2296         * b3/B3Compilation.cpp:
2297         (JSC::B3::Compilation::Compilation):
2298         * b3/B3Compilation.h:
2299         (JSC::B3::Compilation::code const):
2300         (JSC::B3::Compilation::codeRef const):
2301         * b3/B3Compile.cpp:
2302         (JSC::B3::compile):
2303         * b3/B3LowerMacros.cpp:
2304         * b3/air/AirDisassembler.cpp:
2305         (JSC::B3::Air::Disassembler::dump):
2306         * b3/air/testair.cpp:
2307         * b3/testb3.cpp:
2308         (JSC::B3::invoke):
2309         (JSC::B3::testInterpreter):
2310         (JSC::B3::testEntrySwitchSimple):
2311         (JSC::B3::testEntrySwitchNoEntrySwitch):
2312         (JSC::B3::testEntrySwitchWithCommonPaths):
2313         (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
2314         (JSC::B3::testEntrySwitchLoop):
2315         * bytecode/AccessCase.cpp:
2316         (JSC::AccessCase::generateImpl):
2317         * bytecode/AccessCaseSnippetParams.cpp:
2318         (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
2319         * bytecode/ByValInfo.h:
2320         (JSC::ByValInfo::ByValInfo):
2321         * bytecode/CallLinkInfo.cpp:
2322         (JSC::CallLinkInfo::callReturnLocation):
2323         (JSC::CallLinkInfo::patchableJump):
2324         (JSC::CallLinkInfo::hotPathBegin):
2325         (JSC::CallLinkInfo::slowPathStart):
2326         * bytecode/CallLinkInfo.h:
2327         (JSC::CallLinkInfo::setCallLocations):
2328         (JSC::CallLinkInfo::hotPathOther):
2329         * bytecode/CodeBlock.cpp:
2330         (JSC::CodeBlock::finishCreation):
2331         * bytecode/GetByIdStatus.cpp:
2332         (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
2333         * bytecode/GetByIdVariant.cpp:
2334         (JSC::GetByIdVariant::GetByIdVariant):
2335         (JSC::GetByIdVariant::dumpInContext const):
2336         * bytecode/GetByIdVariant.h:
2337         (JSC::GetByIdVariant::customAccessorGetter const):
2338         * bytecode/GetterSetterAccessCase.cpp:
2339         (JSC::GetterSetterAccessCase::create):
2340         (JSC::GetterSetterAccessCase::GetterSetterAccessCase):
2341         (JSC::GetterSetterAccessCase::dumpImpl const):
2342         * bytecode/GetterSetterAccessCase.h:
2343         (JSC::GetterSetterAccessCase::customAccessor const):
2344         (): Deleted.
2345         * bytecode/HandlerInfo.h:
2346         (JSC::HandlerInfo::initialize):
2347         * bytecode/InlineAccess.cpp:
2348         (JSC::linkCodeInline):
2349         (JSC::InlineAccess::rewireStubAsJump):
2350         * bytecode/InlineAccess.h:
2351         * bytecode/JumpTable.h:
2352         (JSC::StringJumpTable::ctiForValue):
2353         (JSC::SimpleJumpTable::ctiForValue):
2354         * bytecode/LLIntCallLinkInfo.h:
2355         (JSC::LLIntCallLinkInfo::unlink):
2356         * bytecode/PolymorphicAccess.cpp:
2357         (JSC::AccessGenerationState::emitExplicitExceptionHandler):
2358         (JSC::PolymorphicAccess::regenerate):
2359         * bytecode/PolymorphicAccess.h:
2360         (JSC::AccessGenerationResult::AccessGenerationResult):
2361         (JSC::AccessGenerationResult::code const):
2362         * bytecode/StructureStubInfo.h:
2363         (JSC::StructureStubInfo::slowPathCallLocation):
2364         (JSC::StructureStubInfo::doneLocation):
2365         (JSC::StructureStubInfo::slowPathStartLocation):
2366         (JSC::StructureStubInfo::patchableJumpForIn):
2367         * dfg/DFGCommonData.h:
2368         (JSC::DFG::CommonData::appendCatchEntrypoint):
2369         * dfg/DFGDisassembler.cpp:
2370         (JSC::DFG::Disassembler::dumpDisassembly):
2371         * dfg/DFGDriver.h:
2372         * dfg/DFGJITCompiler.cpp:
2373         (JSC::DFG::JITCompiler::linkOSRExits):
2374         (JSC::DFG::JITCompiler::compileExceptionHandlers):
2375         (JSC::DFG::JITCompiler::link):
2376         (JSC::DFG::JITCompiler::compileFunction):
2377         (JSC::DFG::JITCompiler::noticeCatchEntrypoint):
2378         * dfg/DFGJITCompiler.h:
2379         (JSC::DFG::CallLinkRecord::CallLinkRecord):
2380         (JSC::DFG::JITCompiler::appendCall):
2381         (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
2382         (JSC::DFG::JITCompiler::JSDirectCallRecord::JSDirectCallRecord):
2383         (JSC::DFG::JITCompiler::JSDirectTailCallRecord::JSDirectTailCallRecord):
2384         * dfg/DFGJITFinalizer.cpp:
2385         (JSC::DFG::JITFinalizer::JITFinalizer):
2386         (JSC::DFG::JITFinalizer::finalize):
2387         (JSC::DFG::JITFinalizer::finalizeFunction):
2388         * dfg/DFGJITFinalizer.h:
2389         * dfg/DFGJumpReplacement.h:
2390         (JSC::DFG::JumpReplacement::JumpReplacement):
2391         * dfg/DFGNode.h:
2392         * dfg/DFGOSREntry.cpp:
2393         (JSC::DFG::prepareOSREntry):
2394         (JSC::DFG::prepareCatchOSREntry):
2395         * dfg/DFGOSREntry.h:
2396         (JSC::DFG::prepareOSREntry):
2397         * dfg/DFGOSRExit.cpp:
2398         (JSC::DFG::OSRExit::executeOSRExit):
2399         (JSC::DFG::reifyInlinedCallFrames):
2400         (JSC::DFG::adjustAndJumpToTarget):
2401         (JSC::DFG::OSRExit::codeLocationForRepatch const):
2402         (JSC::DFG::OSRExit::emitRestoreArguments):
2403         (JSC::DFG::OSRExit::compileOSRExit):
2404         * dfg/DFGOSRExit.h:
2405         * dfg/DFGOSRExitCompilerCommon.cpp:
2406         (JSC::DFG::handleExitCounts):
2407         (JSC::DFG::reifyInlinedCallFrames):
2408         (JSC::DFG::osrWriteBarrier):
2409         (JSC::DFG::adjustAndJumpToTarget):
2410         * dfg/DFGOperations.cpp:
2411         * dfg/DFGSlowPathGenerator.h:
2412         (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::CallResultAndArgumentsSlowPathGenerator):
2413         (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::unpackAndGenerate):
2414         (JSC::DFG::slowPathCall):
2415         * dfg/DFGSpeculativeJIT.cpp:
2416         (JSC::DFG::SpeculativeJIT::compileMathIC):
2417         (JSC::DFG::SpeculativeJIT::compileCallDOM):
2418         (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
2419         (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
2420         (JSC::DFG::SpeculativeJIT::emitSwitchImm):
2421         (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
2422         (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
2423         (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
2424         (JSC::DFG::SpeculativeJIT::cachedPutById):
2425         * dfg/DFGSpeculativeJIT.h:
2426         (JSC::DFG::SpeculativeJIT::callOperation):
2427         (JSC::DFG::SpeculativeJIT::appendCall):
2428         (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnException):
2429         (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnExceptionSetResult):
2430         (JSC::DFG::SpeculativeJIT::appendCallSetResult):
2431         * dfg/DFGSpeculativeJIT64.cpp:
2432         (JSC::DFG::SpeculativeJIT::cachedGetById):
2433         (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
2434         (JSC::DFG::SpeculativeJIT::compile):
2435         * dfg/DFGThunks.cpp:
2436         (JSC::DFG::osrExitThunkGenerator):
2437         (JSC::DFG::osrExitGenerationThunkGenerator):
2438         (JSC::DFG::osrEntryThunkGenerator):
2439         * dfg/DFGThunks.h:
2440         * disassembler/ARM64Disassembler.cpp:
2441         (JSC::tryToDisassemble):
2442         * disassembler/ARMv7Disassembler.cpp:
2443         (JSC::tryToDisassemble):
2444         * disassembler/Disassembler.cpp:
2445         (JSC::disassemble):
2446         (JSC::disassembleAsynchronously):
2447         * disassembler/Disassembler.h:
2448         (JSC::tryToDisassemble):
2449         * disassembler/UDis86Disassembler.cpp:
2450         (JSC::tryToDisassembleWithUDis86):
2451         * disassembler/UDis86Disassembler.h:
2452         (JSC::tryToDisassembleWithUDis86):
2453         * disassembler/X86Disassembler.cpp:
2454         (JSC::tryToDisassemble):
2455         * ftl/FTLCompile.cpp:
2456         (JSC::FTL::compile):
2457         * ftl/FTLExceptionTarget.cpp:
2458         (JSC::FTL::ExceptionTarget::label):
2459         (JSC::FTL::ExceptionTarget::jumps):
2460         * ftl/FTLExceptionTarget.h:
2461         * ftl/FTLGeneratedFunction.h:
2462         * ftl/FTLJITCode.cpp:
2463         (JSC::FTL::JITCode::initializeB3Code):
2464         (JSC::FTL::JITCode::initializeAddressForCall):
2465         (JSC::FTL::JITCode::initializeArityCheckEntrypoint):
2466         (JSC::FTL::JITCode::addressForCall):
2467         (JSC::FTL::JITCode::executableAddressAtOffset):
2468         * ftl/FTLJITCode.h:
2469         (JSC::FTL::JITCode::b3Code const):
2470         * ftl/FTLJITFinalizer.cpp:
2471         (JSC::FTL::JITFinalizer::finalizeCommon):
2472         * ftl/FTLLazySlowPath.cpp:
2473         (JSC::FTL::LazySlowPath::initialize):
2474         (JSC::FTL::LazySlowPath::generate):
2475         * ftl/FTLLazySlowPath.h:
2476         (JSC::FTL::LazySlowPath::patchableJump const):
2477         (JSC::FTL::LazySlowPath::done const):
2478         (JSC::FTL::LazySlowPath::stub const):
2479         * ftl/FTLLazySlowPathCall.h:
2480         (JSC::FTL::createLazyCallGenerator):
2481         * ftl/FTLLink.cpp:
2482         (JSC::FTL::link):
2483         * ftl/FTLLowerDFGToB3.cpp:
2484         (JSC::FTL::DFG::LowerDFGToB3::lower):
2485         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
2486         (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
2487         (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
2488         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
2489         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
2490         (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
2491         (JSC::FTL::DFG::LowerDFGToB3::compileInvalidationPoint):
2492         (JSC::FTL::DFG::LowerDFGToB3::compileIn):
2493         (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
2494         (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
2495         (JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):
2496         (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
2497         * ftl/FTLOSRExit.cpp:
2498         (JSC::FTL::OSRExit::codeLocationForRepatch const):
2499         * ftl/FTLOSRExit.h:
2500         * ftl/FTLOSRExitCompiler.cpp:
2501         (JSC::FTL::compileStub):
2502         (JSC::FTL::compileFTLOSRExit):
2503         * ftl/FTLOSRExitHandle.cpp:
2504         (JSC::FTL::OSRExitHandle::emitExitThunk):
2505         * ftl/FTLOperations.cpp:
2506         (JSC::FTL::compileFTLLazySlowPath):
2507         * ftl/FTLPatchpointExceptionHandle.cpp:
2508         (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreationForUnwind):
2509         * ftl/FTLSlowPathCall.cpp:
2510         (JSC::FTL::SlowPathCallContext::keyWithTarget const):
2511         (JSC::FTL::SlowPathCallContext::makeCall):
2512         * ftl/FTLSlowPathCall.h:
2513         (JSC::FTL::callOperation):
2514         * ftl/FTLSlowPathCallKey.cpp:
2515         (JSC::FTL::SlowPathCallKey::dump const):
2516         * ftl/FTLSlowPathCallKey.h:
2517         (JSC::FTL::SlowPathCallKey::SlowPathCallKey):
2518         (JSC::FTL::SlowPathCallKey::callTarget const):
2519         (JSC::FTL::SlowPathCallKey::withCallTarget):
2520         (JSC::FTL::SlowPathCallKey::hash const):
2521         (JSC::FTL::SlowPathCallKey::callPtrTag const): Deleted.
2522         * ftl/FTLState.cpp:
2523         (JSC::FTL::State::State):
2524         * ftl/FTLThunks.cpp:
2525         (JSC::FTL::genericGenerationThunkGenerator):
2526         (JSC::FTL::osrExitGenerationThunkGenerator):
2527         (JSC::FTL::lazySlowPathGenerationThunkGenerator):
2528         (JSC::FTL::slowPathCallThunkGenerator):
2529         * ftl/FTLThunks.h:
2530         (JSC::FTL::generateIfNecessary):
2531         (JSC::FTL::keyForThunk):
2532         (JSC::FTL::Thunks::getSlowPathCallThunk):
2533         (JSC::FTL::Thunks::keyForSlowPathCallThunk):
2534         * interpreter/InterpreterInlines.h:
2535         (JSC::Interpreter::getOpcodeID):
2536         * jit/AssemblyHelpers.cpp:
2537         (JSC::AssemblyHelpers::callExceptionFuzz):
2538         (JSC::AssemblyHelpers::emitDumbVirtualCall):
2539         (JSC::AssemblyHelpers::debugCall):
2540         * jit/CCallHelpers.cpp:
2541         (JSC::CCallHelpers::ensureShadowChickenPacket):
2542         * jit/ExecutableAllocator.cpp:
2543         (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
2544         (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
2545         * jit/ExecutableAllocator.h:
2546         (JSC::performJITMemcpy):
2547         * jit/GCAwareJITStubRoutine.cpp:
2548         (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
2549         (JSC::MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine):
2550         (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler):
2551         (JSC::createJITStubRoutine):
2552         * jit/GCAwareJITStubRoutine.h:
2553         (JSC::createJITStubRoutine):
2554         * jit/JIT.cpp:
2555         (JSC::ctiPatchCallByReturnAddress):
2556         (JSC::JIT::compileWithoutLinking):
2557         (JSC::JIT::link):
2558         (JSC::JIT::privateCompileExceptionHandlers):
2559         * jit/JIT.h:
2560         (JSC::CallRecord::CallRecord):
2561         * jit/JITArithmetic.cpp:
2562         (JSC::JIT::emitMathICFast):
2563         (JSC::JIT::emitMathICSlow):
2564         * jit/JITCall.cpp:
2565         (JSC::JIT::compileOpCallSlowCase):
2566         * jit/JITCall32_64.cpp:
2567         (JSC::JIT::compileOpCallSlowCase):
2568         * jit/JITCode.cpp:
2569         (JSC::JITCodeWithCodeRef::JITCodeWithCodeRef):
2570         (JSC::JITCodeWithCodeRef::executableAddressAtOffset):
2571         (JSC::DirectJITCode::DirectJITCode):
2572         (JSC::DirectJITCode::initializeCodeRef):
2573         (JSC::DirectJITCode::addressForCall):
2574         (JSC::NativeJITCode::NativeJITCode):
2575         (JSC::NativeJITCode::initializeCodeRef):
2576         (JSC::NativeJITCode::addressForCall):
2577         * jit/JITCode.h:
2578         * jit/JITCodeMap.h:
2579         (JSC::JITCodeMap::Entry::Entry):
2580         (JSC::JITCodeMap::Entry::codeLocation):
2581         (JSC::JITCodeMap::append):
2582         (JSC::JITCodeMap::find const):
2583         * jit/JITDisassembler.cpp:
2584         (JSC::JITDisassembler::dumpDisassembly):
2585         * jit/JITExceptions.cpp:
2586         (JSC::genericUnwind):
2587         * jit/JITInlineCacheGenerator.cpp:
2588         (JSC::JITByIdGenerator::finalize):
2589         * jit/JITInlines.h:
2590         (JSC::JIT::emitNakedCall):
2591         (JSC::JIT::emitNakedTailCall):
2592         (JSC::JIT::appendCallWithExceptionCheck):
2593         (JSC::JIT::appendCallWithExceptionCheckAndSlowPathReturnType):
2594         (JSC::JIT::appendCallWithCallFrameRollbackOnException):
2595         (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult):
2596         (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
2597         * jit/JITMathIC.h:
2598         (JSC::isProfileEmpty):
2599         * jit/JITOpcodes.cpp:
2600         (JSC::JIT::emit_op_catch):
2601         (JSC::JIT::emit_op_switch_imm):
2602         (JSC::JIT::emit_op_switch_char):
2603         (JSC::JIT::emit_op_switch_string):
2604         (JSC::JIT::privateCompileHasIndexedProperty):
2605         (JSC::JIT::emitSlow_op_has_indexed_property):
2606         * jit/JITOpcodes32_64.cpp:
2607         (JSC::JIT::privateCompileHasIndexedProperty):
2608         * jit/JITOperations.cpp:
2609         (JSC::getByVal):
2610         * jit/JITPropertyAccess.cpp:
2611         (JSC::JIT::stringGetByValStubGenerator):
2612         (JSC::JIT::emitGetByValWithCachedId):
2613         (JSC::JIT::emitSlow_op_get_by_val):
2614         (JSC::JIT::emitPutByValWithCachedId):
2615         (JSC::JIT::emitSlow_op_put_by_val):
2616         (JSC::JIT::emitSlow_op_try_get_by_id):
2617         (JSC::JIT::emitSlow_op_get_by_id_direct):
2618         (JSC::JIT::emitSlow_op_get_by_id):
2619         (JSC::JIT::emitSlow_op_get_by_id_with_this):
2620         (JSC::JIT::emitSlow_op_put_by_id):
2621         (JSC::JIT::privateCompileGetByVal):
2622         (JSC::JIT::privateCompileGetByValWithCachedId):
2623         (JSC::JIT::privateCompilePutByVal):
2624         (JSC::JIT::privateCompilePutByValWithCachedId):
2625         * jit/JITPropertyAccess32_64.cpp:
2626         (JSC::JIT::stringGetByValStubGenerator):
2627         (JSC::JIT::emitSlow_op_get_by_val):
2628         (JSC::JIT::emitSlow_op_put_by_val):
2629         * jit/JITStubRoutine.h:
2630         (JSC::JITStubRoutine::JITStubRoutine):
2631         (JSC::JITStubRoutine::createSelfManagedRoutine):
2632         (JSC::JITStubRoutine::code const):
2633         (JSC::JITStubRoutine::asCodePtr):
2634         * jit/JITThunks.cpp:
2635         (JSC::JITThunks::ctiNativeCall):
2636         (JSC::JITThunks::ctiNativeConstruct):
2637         (JSC::JITThunks::ctiNativeTailCall):
2638         (JSC::JITThunks::ctiNativeTailCallWithoutSavedTags):
2639         (JSC::JITThunks::ctiInternalFunctionCall):
2640         (JSC::JITThunks::ctiInternalFunctionConstruct):
2641         (JSC::JITThunks::ctiStub):
2642         (JSC::JITThunks::existingCTIStub):
2643         (JSC::JITThunks::hostFunctionStub):
2644         * jit/JITThunks.h:
2645         * jit/PCToCodeOriginMap.cpp:
2646         (JSC::PCToCodeOriginMap::PCToCodeOriginMap):
2647         * jit/PCToCodeOriginMap.h:
2648         * jit/PolymorphicCallStubRoutine.cpp:
2649         (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
2650         * jit/PolymorphicCallStubRoutine.h:
2651         * jit/Repatch.cpp:
2652         (JSC::readPutICCallTarget):
2653         (JSC::ftlThunkAwareRepatchCall):
2654         (JSC::appropriateOptimizingGetByIdFunction):
2655         (JSC::appropriateGetByIdFunction):
2656         (JSC::tryCacheGetByID):
2657         (JSC::repatchGetByID):
2658         (JSC::tryCachePutByID):
2659         (JSC::repatchPutByID):
2660         (JSC::tryCacheIn):
2661         (JSC::repatchIn):
2662         (JSC::linkSlowFor):
2663         (JSC::linkFor):
2664         (JSC::linkDirectFor):
2665         (JSC::revertCall):
2666         (JSC::unlinkFor):
2667         (JSC::linkVirtualFor):
2668         (JSC::linkPolymorphicCall):
2669         (JSC::resetGetByID):
2670         (JSC::resetPutByID):
2671         * jit/Repatch.h:
2672         * jit/SlowPathCall.h:
2673         (JSC::JITSlowPathCall::call):
2674         * jit/SpecializedThunkJIT.h:
2675         (JSC::SpecializedThunkJIT::finalize):
2676         (JSC::SpecializedThunkJIT::callDoubleToDouble):
2677         (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
2678         * jit/ThunkGenerator.h:
2679         * jit/ThunkGenerators.cpp:
2680         (JSC::throwExceptionFromCallSlowPathGenerator):
2681         (JSC::slowPathFor):
2682         (JSC::linkCallThunkGenerator):
2683         (JSC::linkPolymorphicCallThunkGenerator):
2684         (JSC::virtualThunkFor):
2685         (JSC::nativeForGenerator):
2686         (JSC::nativeCallGenerator):
2687         (JSC::nativeTailCallGenerator):
2688         (JSC::nativeTailCallWithoutSavedTagsGenerator):
2689         (JSC::nativeConstructGenerator):
2690         (JSC::internalFunctionCallGenerator):
2691         (JSC::internalFunctionConstructGenerator):
2692         (JSC::arityFixupGenerator):
2693         (JSC::unreachableGenerator):
2694         (JSC::charCodeAtThunkGenerator):
2695         (JSC::charAtThunkGenerator):
2696         (JSC::fromCharCodeThunkGenerator):
2697         (JSC::clz32ThunkGenerator):
2698         (JSC::sqrtThunkGenerator):
2699         (JSC::floorThunkGenerator):
2700         (JSC::ceilThunkGenerator):
2701         (JSC::truncThunkGenerator):
2702         (JSC::roundThunkGenerator):
2703         (JSC::expThunkGenerator):
2704         (JSC::logThunkGenerator):
2705         (JSC::absThunkGenerator):
2706         (JSC::imulThunkGenerator):
2707         (JSC::randomThunkGenerator):
2708         (JSC::boundThisNoArgsFunctionCallGenerator):
2709         * jit/ThunkGenerators.h:
2710         * llint/LLIntData.cpp:
2711         (JSC::LLInt::initialize):
2712         * llint/LLIntData.h:
2713         (JSC::LLInt::getExecutableAddress):
2714         (JSC::LLInt::getCodePtr):
2715         (JSC::LLInt::getCodeRef):
2716         (JSC::LLInt::getCodeFunctionPtr):
2717         * llint/LLIntEntrypoint.cpp:
2718         (JSC::LLInt::setFunctionEntrypoint):
2719         (JSC::LLInt::setEvalEntrypoint):
2720         (JSC::LLInt::setProgramEntrypoint):
2721         (JSC::LLInt::setModuleProgramEntrypoint):
2722         * llint/LLIntExceptions.cpp:
2723         (JSC::LLInt::callToThrow):
2724         * llint/LLIntSlowPaths.cpp:
2725         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2726         (JSC::LLInt::setUpCall):
2727         * llint/LLIntThunks.cpp:
2728         (JSC::vmEntryToWasm):
2729         (JSC::LLInt::generateThunkWithJumpTo):
2730         (JSC::LLInt::functionForCallEntryThunkGenerator):
2731         (JSC::LLInt::functionForConstructEntryThunkGenerator):
2732         (JSC::LLInt::functionForCallArityCheckThunkGenerator):
2733         (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
2734         (JSC::LLInt::evalEntryThunkGenerator):
2735         (JSC::LLInt::programEntryThunkGenerator):
2736         (JSC::LLInt::moduleProgramEntryThunkGenerator):
2737         * llint/LLIntThunks.h:
2738         * llint/LowLevelInterpreter.asm:
2739         * llint/LowLevelInterpreter32_64.asm:
2740         * llint/LowLevelInterpreter64.asm:
2741         * profiler/ProfilerCompilation.cpp:
2742         (JSC::Profiler::Compilation::addOSRExitSite):
2743         * profiler/ProfilerCompilation.h:
2744         * profiler/ProfilerOSRExitSite.cpp:
2745         (JSC::Profiler::OSRExitSite::toJS const):
2746         * profiler/ProfilerOSRExitSite.h:
2747         (JSC::Profiler::OSRExitSite::OSRExitSite):
2748         (JSC::Profiler::OSRExitSite::codeAddress const):
2749         (JSC::Profiler::OSRExitSite:: const): Deleted.
2750         * runtime/ExecutableBase.cpp:
2751         (JSC::ExecutableBase::clearCode):
2752         * runtime/ExecutableBase.h:
2753         (JSC::ExecutableBase::entrypointFor):
2754         * runtime/NativeExecutable.cpp:
2755         (JSC::NativeExecutable::finishCreation):
2756         * runtime/NativeFunction.h:
2757         (JSC::TaggedNativeFunction::TaggedNativeFunction):
2758         (JSC::TaggedNativeFunction::operator NativeFunction):
2759         * runtime/PtrTag.h:
2760         (JSC::tagCodePtr):
2761         (JSC::untagCodePtr):
2762         (JSC::retagCodePtr):
2763         (JSC::tagCFunctionPtr):
2764         (JSC::untagCFunctionPtr):
2765         (JSC::nextPtrTagID): Deleted.
2766         * runtime/PutPropertySlot.h:
2767         (JSC::PutPropertySlot::PutPropertySlot):
2768         (JSC::PutPropertySlot::setCustomValue):
2769         (JSC::PutPropertySlot::setCustomAccessor):
2770         (JSC::PutPropertySlot::customSetter const):
2771         * runtime/ScriptExecutable.cpp:
2772         (JSC::ScriptExecutable::installCode):
2773         * runtime/VM.cpp:
2774         (JSC::VM::getHostFunction):
2775         (JSC::VM::getCTIInternalFunctionTrampolineFor):
2776         * runtime/VM.h:
2777         (JSC::VM::getCTIStub):
2778         * wasm/WasmB3IRGenerator.cpp:
2779         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
2780         (JSC::Wasm::B3IRGenerator::emitExceptionCheck):
2781         (JSC::Wasm::B3IRGenerator::emitTierUpCheck):
2782         (JSC::Wasm::B3IRGenerator::addCall):
2783         (JSC::Wasm::B3IRGenerator::addCallIndirect):
2784         * wasm/WasmBBQPlan.cpp:
2785         (JSC::Wasm::BBQPlan::prepare):
2786         (JSC::Wasm::BBQPlan::complete):
2787         * wasm/WasmBBQPlan.h:
2788         * wasm/WasmBinding.cpp:
2789         (JSC::Wasm::wasmToWasm):
2790         * wasm/WasmBinding.h:
2791         * wasm/WasmCallee.h:
2792         (JSC::Wasm::Callee::entrypoint const):
2793         * wasm/WasmCallingConvention.h:
2794         (JSC::Wasm::CallingConvention::setupFrameInPrologue const):
2795         * wasm/WasmCodeBlock.h:
2796         (JSC::Wasm::CodeBlock::entrypointLoadLocationFromFunctionIndexSpace):
2797         * wasm/WasmFaultSignalHandler.cpp:
2798         (JSC::Wasm::trapHandler):
2799         * wasm/WasmFormat.h:
2800         * wasm/WasmInstance.h:
2801         * wasm/WasmOMGPlan.cpp:
2802         (JSC::Wasm::OMGPlan::work):
2803         * wasm/WasmThunks.cpp:
2804         (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
2805         (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
2806         (JSC::Wasm::triggerOMGTierUpThunkGenerator):
2807         (JSC::Wasm::Thunks::stub):
2808         (JSC::Wasm::Thunks::existingStub):
2809         * wasm/WasmThunks.h:
2810         * wasm/js/JSToWasm.cpp:
2811         (JSC::Wasm::createJSToWasmWrapper):
2812         * wasm/js/JSWebAssemblyCodeBlock.h:
2813         * wasm/js/WasmToJS.cpp:
2814         (JSC::Wasm::handleBadI64Use):
2815         (JSC::Wasm::wasmToJS):
2816         * wasm/js/WasmToJS.h:
2817         * wasm/js/WebAssemblyFunction.h:
2818         * yarr/YarrJIT.cpp:
2819         (JSC::Yarr::YarrGenerator::loadFromFrameAndJump):
2820         (JSC::Yarr::YarrGenerator::BacktrackingState::linkDataLabels):
2821         (JSC::Yarr::YarrGenerator::compile):
2822         * yarr/YarrJIT.h:
2823         (JSC::Yarr::YarrCodeBlock::set8BitCode):
2824         (JSC::Yarr::YarrCodeBlock::set16BitCode):
2825         (JSC::Yarr::YarrCodeBlock::set8BitCodeMatchOnly):
2826         (JSC::Yarr::YarrCodeBlock::set16BitCodeMatchOnly):
2827         (JSC::Yarr::YarrCodeBlock::execute):
2828         (JSC::Yarr::YarrCodeBlock::clear):
2829
2830 2018-04-17  Commit Queue  <commit-queue@webkit.org>
2831
2832         Unreviewed, rolling out r230697, r230720, and r230724.
2833         https://bugs.webkit.org/show_bug.cgi?id=184717
2834
2835         These caused multiple failures on the Test262 testers.
2836         (Requested by mlewis13 on #webkit).
2837
2838         Reverted changesets:
2839
2840         "[WebAssembly][Modules] Prototype wasm import"
2841         https://bugs.webkit.org/show_bug.cgi?id=184600
2842         https://trac.webkit.org/changeset/230697
2843
2844         "[WebAssembly][Modules] Implement function import from wasm
2845         modules"
2846         https://bugs.webkit.org/show_bug.cgi?id=184689
2847         https://trac.webkit.org/changeset/230720
2848
2849         "[JSC] Rename runWebAssembly to runWebAssemblySuite"
2850         https://bugs.webkit.org/show_bug.cgi?id=184703
2851         https://trac.webkit.org/changeset/230724
2852
2853 2018-04-17  JF Bastien  <jfbastien@apple.com>
2854
2855         A put is not an ExistingProperty put when we transition a structure because of an attributes change
2856         https://bugs.webkit.org/show_bug.cgi?id=184706
2857         <rdar://problem/38871451>
2858
2859         Reviewed by Saam Barati.
2860
2861         When putting a property on a structure and the slot is a different
2862         type, the slot can't be said to have already been existing.
2863
2864         * runtime/JSObjectInlines.h:
2865         (JSC::JSObject::putDirectInternal):
2866
2867 2018-04-17  Filip Pizlo  <fpizlo@apple.com>
2868
2869         JSGenericTypedArrayView<>::visitChildren has a race condition reading m_mode and m_vector
2870         https://bugs.webkit.org/show_bug.cgi?id=184705
2871
2872         Reviewed by Michael Saboff.
2873
2874         My old multisocket Mac Pro is amazing at catching race conditions in the GC. Earlier today
2875         while testing an unrelated patch, a concurrent GC thread crashed inside
2876         JSGenericTypedArrayView<>::visitChildren() calling markAuxiliary(). I'm pretty sure it's
2877         because a typed array became wasteful concurrently to the GC. So, visitChildren() read one
2878         mode and another vector.
2879
2880         The fix is to lock inside visitChildren and anyone who changes those fields.
2881
2882         I'm not even going to try to write a test. I think it's super lucky that my Mac Pro caught
2883         this.
2884
2885         * runtime/JSArrayBufferView.cpp:
2886         (JSC::JSArrayBufferView::neuter):
2887         * runtime/JSGenericTypedArrayViewInlines.h:
2888         (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
2889         (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
2890
2891 2018-04-16  Filip Pizlo  <fpizlo@apple.com>
2892
2893         PutStackSinkingPhase should know that KillStack means ConflictingFlush
2894         https://bugs.webkit.org/show_bug.cgi?id=184672
2895
2896         Reviewed by Michael Saboff.
2897
2898         We've had a long history of KillStack and PutStackSinkingPhase having problems. We kept changing the meaning of
2899         KillStack, and at some point we removed reasoning about KillStack from PutStackSinkingPhase. I tried doing some
2900         archeology - but I'm still not sure why that phase ignores KillStack entirely. Maybe it's an oversight or maybe it's
2901         intentional - I don't know.
2902
2903         Whatever the history, it's clear from the attached test case that ignoring KillStack is not correct. The outcome of
2904         doing so is that we will sometimes sink a PutStack below a KillStack. That's wrong because then, OSR exit will use
2905         the value from the PutStack instead of using the value from the MovHint that is associated with the KillStack. So,
2906         KillStack must be seen as a special kind of clobber of the stack slot. OSRAvailabiity uses ConflictingFlush. I think
2907         that's correct here, too. If we used DeadFlush and that was merged with another control flow path that had a
2908         specific flush format, then we would think that we could sink the flush from that path. That's not right, since that
2909         could still lead to sinking a PutStack past the KillStack in the sense that a PutStack will appear after the
2910         KillStack along one path through the CFG. Also, the definition of DeadFlush and ConflictingFlush in the comment
2911         inside PutStackSinkingPhase seems to suggest that KillStack is a ConflictingFlush, since DeadFlush means that we
2912         have done some PutStack and their values are still valid. KillStack is not a PutStack and it means that previous
2913         values are not valid. The definition of ConflictingFlush is that "we know, via forward flow, that there isn't any
2914         value in the given local that anyone should have been relying on" - which exactly matches KillStack's definition.
2915
2916         This also means that we cannot eliminate arguments allocations that are live over KillStacks, since if we eliminated
2917         them then we would have a GetStack after a KillStack. One easy way to fix this is to say that KillStack writes to
2918         its stack slot for the purpose of clobberize.
2919
2920         * dfg/DFGClobberize.h: KillStack "writes" to its stack slot.
2921         * dfg/DFGPutStackSinkingPhase.cpp: Fix the bug.
2922         * ftl/FTLLowerDFGToB3.cpp: Add better assertion failure.
2923         (JSC::FTL::DFG::LowerDFGToB3::buildExitArguments):
2924
2925 2018-04-17  Filip Pizlo  <fpizlo@apple.com>
2926
2927         JSWebAssemblyCodeBlock should be in an IsoSubspace
2928         https://bugs.webkit.org/show_bug.cgi?id=184704
2929
2930         Reviewed by Mark Lam.
2931
2932         Previously it was in a CompleteSubspace, which is pretty good, but also quite wasteful.
2933         CompleteSubspace means about 4KB of data to track the size-allocator mapping. IsoSubspace
2934         shortcircuits this. Also, IsoSubspace uses the iso allocator, so it provides stronger UAF
2935         protection.
2936
2937         * runtime/VM.cpp:
2938         (JSC::VM::VM):
2939         * runtime/VM.h:
2940         * wasm/js/JSWebAssemblyCodeBlock.h:
2941
2942 2018-04-17  Jer Noble  <jer.noble@apple.com>
2943
2944         Only enable useSeparatedWXHeap on ARM64.
2945         https://bugs.webkit.org/show_bug.cgi?id=184697
2946
2947         Reviewed by Saam Barati.
2948
2949         * runtime/Options.cpp:
2950         (JSC::recomputeDependentOptions):
2951
2952 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2953
2954         [WebAssembly][Modules] Implement function import from wasm modules
2955         https://bugs.webkit.org/show_bug.cgi?id=184689
2956
2957         Reviewed by JF Bastien.
2958
2959         This patch implements function import from wasm modules. We move function importing part
2960         from JSWebAssemblyInstance's creation function to WebAssemblyModuleRecord::link. This
2961         is because linking these functions requires that all the dependent modules are created.
2962         While we want to move all the linking functionality from JSWebAssemblyInstance to
2963         WebAssemblyModuleRecord::link, we do not that in this patch.  In this patch, we move only
2964         function importing part because efficient compilation of WebAssembly needs to know
2965         the type of WebAssemblyMemory (signaling or bound checking). This needs to know imported
2966         or attached WebAssembly memory object. So we cannot defer this linking to
2967         WebAssemblyModuleRecord::link now.
2968
2969         The largest difference from JS module linking is that WebAssembly module linking links
2970         function from the module by snapshotting. When you have a cyclic module graph like this,
2971
2972         -> JS1 (export "fun") -> Wasm1 (import "fun from JS1) -+
2973             ^                                                  |
2974             +--------------------------------------------------+
2975
2976         we fail to link this since "fun" is not instantiated when Wasm1 is first linked. This behavior
2977         is described in [1], and tested in this patch.
2978
2979         [1]: https://github.com/WebAssembly/esm-integration/tree/master/proposals/esm-integration#js---wasm-cycle-where-js-is-higher-in-the-module-graph
2980
2981         * JavaScriptCore.xcodeproj/project.pbxproj:
2982         * jsc.cpp:
2983         (functionDollarAgentStart):
2984         (checkException):
2985         (runWithOptions):
2986         Small fixes for wasm module loading.
2987
2988         * parser/NodesAnalyzeModule.cpp:
2989         (JSC::ImportDeclarationNode::analyzeModule):
2990         * runtime/AbstractModuleRecord.cpp:
2991         (JSC::AbstractModuleRecord::resolveImport):
2992         (JSC::AbstractModuleRecord::link):
2993         * runtime/AbstractModuleRecord.h:
2994         (JSC::AbstractModuleRecord::moduleEnvironmentMayBeNull):
2995         (JSC::AbstractModuleRecord::ImportEntry::isNamespace const): Deleted.
2996         Now, wasm modules can have import which is named "*". So this function does not work.
2997         Since wasm modules never have namespace importing, we check this in JS's module analyzer.
2998
2999         * runtime/JSModuleEnvironment.cpp:
3000         (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
3001         * runtime/JSModuleRecord.cpp:
3002         (JSC::JSModuleRecord::instantiateDeclarations):
3003         * wasm/WasmCreationMode.h: Added.
3004         * wasm/js/JSWebAssemblyInstance.cpp:
3005         (JSC::JSWebAssemblyInstance::finalizeCreation):
3006         (JSC::JSWebAssemblyInstance::create):
3007         * wasm/js/JSWebAssemblyInstance.h:
3008         * wasm/js/WebAssemblyInstanceConstructor.cpp:
3009         (JSC::constructJSWebAssemblyInstance):
3010         * wasm/js/WebAssemblyModuleRecord.cpp:
3011         (JSC::WebAssemblyModuleRecord::link):
3012         * wasm/js/WebAssemblyModuleRecord.h:
3013         * wasm/js/WebAssemblyPrototype.cpp:
3014         (JSC::resolve):
3015         (JSC::instantiate):
3016         (JSC::compileAndInstantiate):
3017         (JSC::WebAssemblyPrototype::instantiate):
3018         (JSC::webAssemblyInstantiateFunc):
3019
3020 2018-04-17  Dominik Infuehr  <dinfuehr@igalia.com>
3021
3022         Implement setupArgumentsImpl for ARM and MIPS
3023         https://bugs.webkit.org/show_bug.cgi?id=183786
3024
3025         Reviewed by Yusuke Suzuki.
3026
3027         Implement setupArgumentsImpl for ARM (hardfp and softfp) and MIPS calling convention. Added
3028         numCrossSources and extraGPRArgs to ArgCollection to keep track of extra
3029         registers used for 64-bit values on 32-bit architectures. numCrossSources
3030         keeps track of assignments from FPR to GPR registers as happens e.g. on MIPS.
3031
3032         * assembler/MacroAssemblerARMv7.h:
3033         (JSC::MacroAssemblerARMv7::moveDouble):
3034         * assembler/MacroAssemblerMIPS.h:
3035         (JSC::MacroAssemblerMIPS::moveDouble):
3036         * jit/CCallHelpers.h:
3037         (JSC::CCallHelpers::setupStubCrossArgs):
3038         (JSC::CCallHelpers::ArgCollection::ArgCollection):
3039         (JSC::CCallHelpers::ArgCollection::pushRegArg):
3040         (JSC::CCallHelpers::ArgCollection::pushExtraRegArg):
3041         (JSC::CCallHelpers::ArgCollection::addGPRArg):
3042         (JSC::CCallHelpers::ArgCollection::addGPRExtraArg):
3043         (JSC::CCallHelpers::ArgCollection::addStackArg):
3044         (JSC::CCallHelpers::ArgCollection::addPoke):
3045         (JSC::CCallHelpers::ArgCollection::argCount):
3046         (JSC::CCallHelpers::calculatePokeOffset):
3047         (JSC::CCallHelpers::pokeForArgument):
3048         (JSC::CCallHelpers::stackAligned):
3049         (JSC::CCallHelpers::marshallArgumentRegister):
3050         (JSC::CCallHelpers::setupArgumentsImpl):
3051         (JSC::CCallHelpers::pokeArgumentsAligned):
3052         (JSC::CCallHelpers::std::is_integral<CURRENT_ARGUMENT_TYPE>::value):
3053         (JSC::CCallHelpers::std::is_pointer<CURRENT_ARGUMENT_TYPE>::value):
3054         (JSC::CCallHelpers::setupArguments):
3055         * jit/FPRInfo.h:
3056         (JSC::FPRInfo::toArgumentRegister):
3057
3058 2018-04-17  Saam Barati  <sbarati@apple.com>
3059
3060         Add system trace points for process launch and for initializeWebProcess
3061         https://bugs.webkit.org/show_bug.cgi?id=184669
3062
3063         Reviewed by Simon Fraser.
3064
3065         * runtime/VMEntryScope.cpp:
3066         (JSC::VMEntryScope::VMEntryScope):
3067         (JSC::VMEntryScope::~VMEntryScope):
3068
3069 2018-04-17  Jer Noble  <jer.noble@apple.com>
3070
3071         Fix duplicate symbol errors when building JavaScriptCore with non-empty WK_ALTERNATE_WEBKIT_SDK_PATH
3072         https://bugs.webkit.org/show_bug.cgi?id=184602
3073
3074         Reviewed by Beth Dakin.
3075
3076         * JavaScriptCore.xcodeproj/project.pbxproj:
3077
3078 2018-04-17  Carlos Garcia Campos  <cgarcia@igalia.com>
3079
3080         [GLIB] Add API to clear JSCContext uncaught exception
3081         https://bugs.webkit.org/show_bug.cgi?id=184685
3082
3083         Reviewed by Žan Doberšek.
3084
3085         Add jsc_context_clear_exception() to clear any possible uncaught exception in a JSCContext.
3086
3087         * API/glib/JSCContext.cpp:
3088         (jsc_context_clear_exception):
3089         * API/glib/JSCContext.h:
3090         * API/glib/docs/jsc-glib-4.0-sections.txt:
3091
3092 2018-04-17  Carlos Garcia Campos  <cgarcia@igalia.com>
3093
3094         [GLIB] Add API to query, delete and enumerate properties
3095         https://bugs.webkit.org/show_bug.cgi?id=184647
3096
3097         Reviewed by Michael Catanzaro.
3098
3099         Add jsc_value_object_has_property(), jsc_value_object_delete_property() and jsc_value_object_enumerate_properties().
3100
3101         * API/glib/JSCValue.cpp:
3102         (jsc_value_object_has_property):
3103         (jsc_value_object_delete_property):
3104         (jsc_value_object_enumerate_properties):
3105         * API/glib/JSCValue.h:
3106         * API/glib/docs/jsc-glib-4.0-sections.txt:
3107
3108 2018-04-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3109
3110         [WebAssembly][Modules] Prototype wasm import
3111         https://bugs.webkit.org/show_bug.cgi?id=184600
3112
3113         Reviewed by JF Bastien.
3114
3115         This patch is an initial attempt to implement Wasm loading in module pipeline.
3116         Currently,
3117
3118         1. We only support Wasm loading in the JSC shell. Once loading mechanism is specified
3119            in whatwg HTML, we should integrate this into WebCore.
3120
3121         2. We only support exporting values from Wasm. Wasm module cannot import anything from
3122            the other modules now.
3123
3124         When loading a file, JSC shell checks wasm magic. If the wasm magic is found, JSC shell
3125         loads the file with WebAssemblySourceProvider. It is wrapped into JSSourceCode and
3126         module loader pipeline just handles it as the same to JS. When parsing a module, we
3127         checks the type of JSSourceCode. If the source code is Wasm source code, we create a
3128         WebAssemblyModuleRecord instead of JSModuleRecord. Our module pipeline handles
3129         AbstractModuleRecord and Wasm module is instantiated, linked, and evaluated.
3130
3131         * builtins/ModuleLoaderPrototype.js:
3132         (globalPrivate.newRegistryEntry):
3133         (requestInstantiate):
3134         (link):
3135         * jsc.cpp:
3136         (convertShebangToJSComment):
3137         (fillBufferWithContentsOfFile):
3138         (fetchModuleFromLocalFileSystem):
3139         (GlobalObject::moduleLoaderFetch):
3140         * parser/SourceProvider.h:
3141         (JSC::WebAssemblySourceProvider::create):
3142         (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
3143         * runtime/AbstractModuleRecord.cpp:
3144         (JSC::AbstractModuleRecord::hostResolveImportedModule):
3145         (JSC::AbstractModuleRecord::link):
3146         (JSC::AbstractModuleRecord::evaluate):
3147         (JSC::identifierToJSValue): Deleted.
3148         * runtime/AbstractModuleRecord.h:
3149         * runtime/JSModuleLoader.cpp:
3150         (JSC::JSModuleLoader::evaluate):
3151         * runtime/JSModuleRecord.cpp:
3152         (JSC::JSModuleRecord::link):
3153         (JSC::JSModuleRecord::instantiateDeclarations):
3154         * runtime/JSModuleRecord.h:
3155         * runtime/ModuleLoaderPrototype.cpp:
3156         (JSC::moduleLoaderPrototypeParseModule):
3157         (JSC::moduleLoaderPrototypeRequestedModules):
3158         (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
3159         * wasm/js/JSWebAssemblyHelpers.h:
3160         (JSC::getWasmBufferFromValue):
3161         (JSC::createSourceBufferFromValue):
3162         * wasm/js/JSWebAssemblyInstance.cpp:
3163         (JSC::JSWebAssemblyInstance::finalizeCreation):
3164         (JSC::JSWebAssemblyInstance::createPrivateModuleKey):
3165         (JSC::JSWebAssemblyInstance::create):
3166         * wasm/js/JSWebAssemblyInstance.h:
3167         * wasm/js/WebAssemblyInstanceConstructor.cpp:
3168         (JSC::constructJSWebAssemblyInstance):
3169         * wasm/js/WebAssemblyModuleRecord.cpp:
3170         (JSC::WebAssemblyModuleRecord::prepareLink):
3171         (JSC::WebAssemblyModuleRecord::link):
3172         * wasm/js/WebAssemblyModuleRecord.h:
3173         * wasm/js/WebAssemblyPrototype.cpp:
3174         (JSC::resolve):
3175         (JSC::instantiate):
3176         (JSC::compileAndInstantiate):
3177         (JSC::WebAssemblyPrototype::instantiate):
3178         (JSC::webAssemblyInstantiateFunc):
3179         (JSC::webAssemblyValidateFunc):
3180         * wasm/js/WebAssemblyPrototype.h:
3181
3182 2018-04-14  Filip Pizlo  <fpizlo@apple.com>
3183
3184         Function.prototype.caller shouldn't return generator bodies
3185         https://bugs.webkit.org/show_bug.cgi?id=184630
3186
3187         Reviewed by Yusuke Suzuki.
3188
3189         Function.prototype.caller no longer returns generator bodies. Those are meant to be
3190         private.
3191
3192         Also added some builtin debugging tools so that it's easier to do the investigation that I
3193         did.
3194
3195         * builtins/BuiltinNames.h:
3196         * runtime/JSFunction.cpp:
3197         (JSC::JSFunction::callerGetter):
3198         * runtime/JSGlobalObject.cpp:
3199         (JSC::JSGlobalObject::init):
3200         * runtime/JSGlobalObjectFunctions.cpp:
3201         (JSC::globalFuncBuiltinDescribe):
3202         * runtime/JSGlobalObjectFunctions.h:
3203
3204 2018-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3205
3206         [DFG] Remove duplicate 32bit ProfileType implementation
3207         https://bugs.webkit.org/show_bug.cgi?id=184536
3208
3209         Reviewed by Saam Barati.
3210
3211         This patch removes duplicate 32bit ProfileType implementation by unifying 32/64 implementations.
3212
3213         * dfg/DFGSpeculativeJIT.cpp:
3214         (JSC::DFG::SpeculativeJIT::compileProfileType):
3215         * dfg/DFGSpeculativeJIT.h:
3216         * dfg/DFGSpeculativeJIT32_64.cpp:
3217         (JSC::DFG::SpeculativeJIT::compile):
3218         * dfg/DFGSpeculativeJIT64.cpp:
3219         (JSC::DFG::SpeculativeJIT::compile):
3220         * jit/AssemblyHelpers.h:
3221         (JSC::AssemblyHelpers::branchIfUndefined):
3222         (JSC::AssemblyHelpers::branchIfNull):
3223
3224 2018-04-12  Mark Lam  <mark.lam@apple.com>
3225
3226         Consolidate some PtrTags.
3227         https://bugs.webkit.org/show_bug.cgi?id=184552
3228         <rdar://problem/39389404>
3229
3230         Reviewed by Filip Pizlo.
3231
3232         Consolidate CodeEntryPtrTag and CodeEntryWithArityCheckPtrTag into CodePtrTag.
3233         Consolidate NearCallPtrTag and NearJumpPtrTag into NearCodePtrTag.
3234
3235         * assembler/AbstractMacroAssembler.h:
3236         (JSC::AbstractMacroAssembler::repatchNearCall):
3237         * assembler/MacroAssemblerARM.h:
3238         (JSC::MacroAssemblerARM::readCallTarget):
3239         * assembler/MacroAssemblerARMv7.h:
3240         (JSC::MacroAssemblerARMv7::readCallTarget):
3241         * assembler/MacroAssemblerMIPS.h:
3242         (JSC::MacroAssemblerMIPS::readCallTarget):
3243         * assembler/MacroAssemblerX86.h:
3244         (JSC::MacroAssemblerX86::readCallTarget):
3245         * assembler/MacroAssemblerX86_64.h:
3246         (JSC::MacroAssemblerX86_64::readCallTarget):
3247         * bytecode/AccessCase.cpp:
3248         (JSC::AccessCase::generateImpl):
3249         * bytecode/InlineAccess.cpp:
3250         (JSC::InlineAccess::rewireStubAsJump):
3251         * bytecode/PolymorphicAccess.cpp:
3252         (JSC::PolymorphicAccess::regenerate):
3253         * dfg/DFGJITCompiler.cpp:
3254         (JSC::DFG::JITCompiler::linkOSRExits):
3255         (JSC::DFG::JITCompiler::link):
3256         (JSC::DFG::JITCompiler::compileFunction):
3257         * dfg/DFGJITFinalizer.cpp:
3258         (JSC::DFG::JITFinalizer::finalize):
3259         (JSC::DFG::JITFinalizer::finalizeFunction):
3260         * dfg/DFGOSREntry.cpp:
3261         (JSC::DFG::prepareOSREntry):
3262         * dfg/DFGOSRExit.cpp:
3263         (JSC::DFG::OSRExit::executeOSRExit):
3264         (JSC::DFG::adjustAndJumpToTarget):
3265         (JSC::DFG::OSRExit::compileOSRExit):
3266         * dfg/DFGOSRExitCompilerCommon.cpp:
3267         (JSC::DFG::adjustAndJumpToTarget):
3268         * dfg/DFGOperations.cpp:
3269         * ftl/FTLJITCode.cpp:
3270         (JSC::FTL::JITCode::executableAddressAtOffset):
3271         * ftl/FTLJITFinalizer.cpp:
3272         (JSC::FTL::JITFinalizer::finalizeCommon):
3273         * ftl/FTLLazySlowPath.cpp:
3274         (JSC::FTL::LazySlowPath::generate):
3275         * ftl/FTLLink.cpp:
3276         (JSC::FTL::link):
3277         * ftl/FTLLowerDFGToB3.cpp:
3278         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
3279         (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
3280         (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
3281         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
3282         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
3283         (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
3284         * ftl/FTLOSRExitCompiler.cpp:
3285         (JSC::FTL::compileFTLOSRExit):
3286         * ftl/FTLOSRExitHandle.cpp:
3287         (JSC::FTL::OSRExitHandle::emitExitThunk):
3288         * jit/AssemblyHelpers.cpp:
3289         (JSC::AssemblyHelpers::emitDumbVirtualCall):
3290         * jit/JIT.cpp:
3291         (JSC::JIT::compileWithoutLinking):
3292         (JSC::JIT::link):
3293         * jit/JITCall.cpp:
3294         (JSC::JIT::compileOpCallSlowCase):
3295         * jit/JITCode.cpp:
3296         (JSC::JITCodeWithCodeRef::executableAddressAtOffset):
3297         (JSC::NativeJITCode::addressForCall):
3298         * jit/JITInlines.h:
3299         (JSC::JIT::emitNakedCall):
3300         (JSC::JIT::emitNakedTailCall):
3301         * jit/JITMathIC.h:
3302         (JSC::isProfileEmpty):
3303         * jit/JITOpcodes.cpp:
3304         (JSC::JIT::privateCompileHasIndexedProperty):
3305         * jit/JITOperations.cpp:
3306         * jit/JITPropertyAccess.cpp:
3307         (JSC::JIT::stringGetByValStubGenerator):
3308         (JSC::JIT::privateCompileGetByVal):
3309         (JSC::JIT::privateCompileGetByValWithCachedId):
3310         (JSC::JIT::privateCompilePutByVal):
3311         (JSC::JIT::privateCompilePutByValWithCachedId):
3312         * jit/JITThunks.cpp:
3313         (JSC::JITThunks::hostFunctionStub):
3314         * jit/Repatch.cpp:
3315         (JSC::linkSlowFor):
3316         (JSC::linkFor):
3317         (JSC::linkPolymorphicCall):
3318         * jit/SpecializedThunkJIT.h:
3319         (JSC::SpecializedThunkJIT::finalize):
3320         * jit/ThunkGenerators.cpp:
3321         (JSC::virtualThunkFor):
3322         (JSC::nativeForGenerator):
3323         (JSC::boundThisNoArgsFunctionCallGenerator):
3324         * llint/LLIntData.cpp:
3325         (JSC::LLInt::initialize):
3326         * llint/LLIntEntrypoint.cpp:
3327         (JSC::LLInt::setEvalEntrypoint):
3328         (JSC::LLInt::setProgramEntrypoint):
3329         (JSC::LLInt::setModuleProgramEntrypoint):
3330         * llint/LLIntSlowPaths.cpp:
3331         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3332         (JSC::LLInt::setUpCall):
3333         * llint/LLIntThunks.cpp:
3334         (JSC::LLInt::generateThunkWithJumpTo):
3335         (JSC::LLInt::functionForCallEntryThunkGenerator):
3336         (JSC::LLInt::functionForConstructEntryThunkGenerator):
3337         (JSC::LLInt::functionForCallArityCheckThunkGenerator):
3338         (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
3339         (JSC::LLInt::evalEntryThunkGenerator):
3340         (JSC::LLInt::programEntryThunkGenerator):
3341         (JSC::LLInt::moduleProgramEntryThunkGenerator):
3342         * llint/LowLevelInterpreter.asm:
3343         * llint/LowLevelInterpreter64.asm:
3344         * runtime/NativeExecutable.cpp:
3345         (JSC::NativeExecutable::finishCreation):
3346         * runtime/NativeFunction.h:
3347         (JSC::TaggedNativeFunction::TaggedNativeFunction):
3348         (JSC::TaggedNativeFunction::operator NativeFunction):
3349         * runtime/PtrTag.h:
3350         * wasm/WasmBBQPlan.cpp:
3351         (JSC::Wasm::BBQPlan::complete):
3352         * wasm/WasmOMGPlan.cpp:
3353         (JSC::Wasm::OMGPlan::work):
3354         * wasm/WasmThunks.cpp:
3355         (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
3356         (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
3357         (JSC::Wasm::triggerOMGTierUpThunkGenerator):
3358         * wasm/js/WasmToJS.cpp:
3359         (JSC::Wasm::wasmToJS):
3360         * wasm/js/WebAssemblyFunction.h:
3361         * yarr/YarrJIT.cpp:
3362         (JSC::Yarr::YarrGenerator::compile):
3363
3364 2018-04-12  Michael Catanzaro  <mcatanzaro@igalia.com>
3365
3366         [WPE] Move libWPEWebInspectorResources.so to pkglibdir
3367         https://bugs.webkit.org/show_bug.cgi?id=184379
3368
3369         Reviewed by Žan Doberšek.
3370
3371         Load the module from the new location.
3372
3373         * PlatformWPE.cmake:
3374         * inspector/remote/glib/RemoteInspectorUtils.cpp:
3375         (Inspector::backendCommands):
3376
3377 2018-04-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3378
3379         [DFG] Remove compileBigIntEquality in DFG 32bit
3380         https://bugs.webkit.org/show_bug.cgi?id=184535
3381
3382         Reviewed by Saam Barati.
3383
3384         We can have the unified implementation for compileBigIntEquality.
3385
3386         * dfg/DFGSpeculativeJIT.cpp:
3387         (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
3388         * dfg/DFGSpeculativeJIT32_64.cpp:
3389         (JSC::DFG::SpeculativeJIT::compileBigIntEquality): Deleted.
3390         * dfg/DFGSpeculativeJIT64.cpp:
3391         (JSC::DFG::SpeculativeJIT::compileBigIntEquality): Deleted.
3392
3393 2018-04-12  Michael Catanzaro  <mcatanzaro@igalia.com>
3394
3395         [WPE] Improve include hierarchy
3396         https://bugs.webkit.org/show_bug.cgi?id=184376
3397
3398         Reviewed by Žan Doberšek.
3399
3400         Install JSC headers under /usr/include/wpe-webkit-0.1/jsc instead of
3401         /usr/include/wpe-0.1/WPE/jsc.
3402
3403         * PlatformWPE.cmake:
3404
3405 2018-04-11  Carlos Garcia Campos  <cgarcia@igalia.com>
3406
3407         [GLIB] Handle strings containing null characters
3408         https://bugs.webkit.org/show_bug.cgi?id=184450
3409
3410         Reviewed by Michael Catanzaro.
3411
3412         We should be able to evaluate scripts containing null characters and to handle strings that contains them
3413         too. In JavaScript strings are not null-terminated, they can contain null characters. This patch adds a length
3414         parameter to jsc_context_valuate() to pass the script length (or -1 if it's null terminated), and new functions
3415         jsc_value_new_string_from_bytes() and jsc_value_to_string_as_bytes() using GBytes to store strings that might
3416         contain null characters.
3417
3418         * API/OpaqueJSString.cpp:
3419         (OpaqueJSString::create): Add a create constructor that takes the String.
3420         * API/OpaqueJSString.h:
3421         (OpaqueJSString::OpaqueJSString): Add a constructor that takes the String.
3422         * API/glib/JSCContext.cpp:
3423         (jsc_context_evaluate): Add length parameter.
3424         (jsc_context_evaluate_with_source_uri): Ditto.
3425         * API/glib/JSCContext.h:
3426         * API/glib/JSCValue.cpp:
3427         (jsc_value_new_string_from_bytes):
3428         (jsc_value_to_string):
3429         (jsc_value_to_string_as_bytes):
3430         (jsc_value_object_is_instance_of): Pass length to evaluate.
3431         * API/glib/JSCValue.h:
3432         * API/glib/docs/jsc-glib-4.0-sections.txt:
3433
3434 2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3435
3436         [JSC] Add CCallHelpers::CellValue to wrap JSCell GPR to convert it to EncodedJSValue
3437         https://bugs.webkit.org/show_bug.cgi?id=184500
3438
3439         Reviewed by Mark Lam.
3440
3441         Instead of passing JSValue::JSCellTag to callOperation meta-program to convert
3442         JSCell GPR to EncodedJSValue in 32bit code, we add CallHelpers::CellValue.
3443         It is a wrapper for GPRReg, like TrustedImmPtr for pointer value. When poking
3444         CellValue, 32bit code emits JSValue::CellTag automatically. In 64bit, we just
3445         poke held GPR. The benefit from this CellValue is that we can use the same code
3446         for 32bit and 64bit. This patch removes several ifdefs.
3447
3448         * bytecode/AccessCase.cpp:
3449         (JSC::AccessCase::generateImpl):
3450         * dfg/DFGSpeculativeJIT.cpp:
3451         (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
3452         (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
3453         (JSC::DFG::SpeculativeJIT::cachedPutById):
3454         * dfg/DFGSpeculativeJIT32_64.cpp:
3455         (JSC::DFG::SpeculativeJIT::cachedGetById):
3456         (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
3457         * jit/CCallHelpers.h:
3458         (JSC::CCallHelpers::CellValue::CellValue):
3459         (JSC::CCallHelpers::CellValue::gpr const):
3460         (JSC::CCallHelpers::setupArgumentsImpl):
3461
3462 2018-04-11  Mark Lam  <mark.lam@apple.com>
3463
3464         [Build fix] Replace CompactJITCodeMap with JITCodeMap.
3465         https://bugs.webkit.org/show_bug.cgi?id=184512
3466         <rdar://problem/35391728>
3467
3468         Not reviewed.
3469
3470         * bytecode/CodeBlock.h:
3471         * jit/JITCodeMap.h:
3472
3473 2018-04-11  Mark Lam  <mark.lam@apple.com>
3474
3475         Replace CompactJITCodeMap with JITCodeMap.
3476         https://bugs.webkit.org/show_bug.cgi?id=184512
3477         <rdar://problem/35391728>
3478
3479         Reviewed by Filip Pizlo.
3480
3481         * CMakeLists.txt:
3482         * JavaScriptCore.xcodeproj/project.pbxproj:
3483         * bytecode/CodeBlock.h:
3484         (JSC::CodeBlock::setJITCodeMap):
3485         (JSC::CodeBlock::jitCodeMap const):
3486         (JSC::CodeBlock::jitCodeMap): Deleted.
3487         * dfg/DFGOSRExit.cpp:
3488         (JSC::DFG::OSRExit::executeOSRExit):
3489         * dfg/DFGOSRExitCompilerCommon.cpp:
3490         (JSC::DFG::adjustAndJumpToTarget):
3491         * jit/AssemblyHelpers.cpp:
3492         (JSC::AssemblyHelpers::decodedCodeMapFor): Deleted.
3493         * jit/AssemblyHelpers.h:
3494         * jit/CompactJITCodeMap.h: Removed.
3495         * jit/JIT.cpp:
3496         (JSC::JIT::link):
3497         * jit/JITCodeMap.h: Added.
3498         (JSC::JITCodeMap::Entry::Entry):
3499         (JSC::JITCodeMap::Entry::bytecodeIndex const):
3500         (JSC::JITCodeMap::Entry::codeLocation):
3501         (JSC::JITCodeMap::append):
3502         (JSC::JITCodeMap::finish):
3503         (JSC::JITCodeMap::find const):
3504         (JSC::JITCodeMap::operator bool const):
3505         * llint/LLIntSlowPaths.cpp:
3506         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3507
3508 2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3509
3510         [DFG] Remove CompareSlowPathGenerator
3511         https://bugs.webkit.org/show_bug.cgi?id=184492
3512
3513         Reviewed by Mark Lam.
3514
3515         Now CompareSlowPathGenerator is just calling a specified function.
3516         This can be altered with slowPathCall. This patch removes CompareSlowPathGenerator.
3517
3518         We also remove some of unnecessary USE(JSVALUE32_64) / USE(JSVALUE64) ifdefs by
3519         introducing a new constructor for GPRTemporary.
3520
3521         * JavaScriptCore.xcodeproj/project.pbxproj:
3522         * dfg/DFGCompareSlowPathGenerator.h: Removed.
3523         * dfg/DFGSpeculativeJIT.cpp:
3524         (JSC::DFG::GPRTemporary::GPRTemporary):
3525         (JSC::DFG::SpeculativeJIT::compileIsCellWithType):
3526         (JSC::DFG::SpeculativeJIT::compileIsTypedArrayView):
3527         (JSC::DFG::SpeculativeJIT::compileToObjectOrCallObjectConstructor):
3528         (JSC::DFG::SpeculativeJIT::compileIsObject):
3529         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
3530         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
3531         * dfg/DFGSpeculativeJIT.h:
3532         (JSC::DFG::GPRTemporary::GPRTemporary):
3533         * dfg/DFGSpeculativeJIT64.cpp:
3534         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
3535
3536 2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3537
3538         Unreviewed, build fix for 32bit
3539         https://bugs.webkit.org/show_bug.cgi?id=184236
3540
3541         * dfg/DFGSpeculativeJIT.cpp:
3542         (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
3543
3544 2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3545
3546         [DFG] Remove duplicate 32bit code more
3547         https://bugs.webkit.org/show_bug.cgi?id=184236
3548
3549         Reviewed by Mark Lam.
3550
3551         Remove duplicate 32bit code more aggressively part 2.
3552
3553         * JavaScriptCore.xcodeproj/project.pbxproj:
3554         * dfg/DFGCompareSlowPathGenerator.h: Added.
3555         (JSC::DFG::CompareSlowPathGenerator::CompareSlowPathGenerator):
3556         Drop boxing part. Use unblessedBooleanResult in DFGSpeculativeJIT side instead.
3557
3558         * dfg/DFGOperations.cpp:
3559         * dfg/DFGOperations.h:
3560         * dfg/DFGSpeculativeJIT.cpp:
3561         (JSC::DFG::SpeculativeJIT::compileOverridesHasInstance):
3562         (JSC::DFG::SpeculativeJIT::compileLoadVarargs):
3563         (JSC::DFG::SpeculativeJIT::compileIsObject):
3564         (JSC::DFG::SpeculativeJIT::compileCheckNotEmpty):
3565         (JSC::DFG::SpeculativeJIT::compilePutByIdFlush):
3566         (JSC::DFG::SpeculativeJIT::compilePutById):
3567         (JSC::DFG::SpeculativeJIT::compilePutByIdDirect):
3568         (JSC::DFG::SpeculativeJIT::compileNewArrayWithSize):
3569         (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
3570         (JSC::DFG::SpeculativeJIT::emitInitializeButterfly):
3571         (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
3572         (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
3573         (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
3574         (JSC::DFG::SpeculativeJIT::compileExtractCatchLocal):
3575         (JSC::DFG::SpeculativeJIT::cachedPutById):
3576         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
3577         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
3578         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare): Deleted.
3579         * dfg/DFGSpeculativeJIT.h:
3580         (JSC::DFG::SpeculativeJIT::selectScratchGPR): Deleted.
3581         * dfg/DFGSpeculativeJIT32_64.cpp:
3582         (JSC::DFG::SpeculativeJIT::compile):
3583         (JSC::DFG::SpeculativeJIT::cachedPutById): Deleted.
3584         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch): Deleted.
3585         (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator): Deleted.
3586         (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::generateInternal): Deleted.
3587         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare): Deleted.
3588         (JSC::DFG::SpeculativeJIT::compileMiscStrictEq): Deleted.
3589         (JSC::DFG::SpeculativeJIT::emitInitializeButterfly): Deleted.
3590         (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): Deleted.
3591         * dfg/DFGSpeculativeJIT64.cpp:
3592         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
3593         (JSC::DFG::SpeculativeJIT::compile):
3594         (JSC::DFG::SpeculativeJIT::cachedPutById): Deleted.
3595         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch): Deleted.
3596         (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator): Deleted.
3597         (): Deleted.
3598         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare): Deleted.
3599         (JSC::DFG::SpeculativeJIT::compileMiscStrictEq): Deleted.
3600         (JSC::DFG::SpeculativeJIT::emitInitializeButterfly): Deleted.
3601         (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): Deleted.
3602         * ftl/FTLLowerDFGToB3.cpp:
3603         (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
3604         operationHasIndexedPropertyByInt starts returning unblessed boolean with size_t.
3605
3606         * jit/AssemblyHelpers.h:
3607         (JSC::AssemblyHelpers::loadValue):
3608         (JSC::AssemblyHelpers::selectScratchGPR):
3609         (JSC::AssemblyHelpers::constructRegisterSet):
3610         * jit/RegisterSet.h:
3611         (JSC::RegisterSet::setAny):
3612         Clean up selectScratchGPR code to pass JSValueRegs.
3613
3614 2018-04-10  Caio Lima  <ticaiolima@gmail.com>
3615
3616         [ESNext][BigInt] Add support for BigInt in SpeculatedType
3617         https://bugs.webkit.org/show_bug.cgi?id=182470
3618
3619         Reviewed by Saam Barati.
3620
3621         This patch introduces the SpecBigInt type to DFG to enable BigInt
3622         speculation into DFG and FTL.
3623
3624         With SpecBigInt introduction, we can then specialize "===" operations
3625         to BigInts. As we are doing for some cells, we first check if operands
3626         are pointing to the same JSCell, and if it is false, we
3627         fallback to "operationCompareStrictEqCell". The idea in further
3628         patches is to implement BigInt equality check directly in
3629         assembly.
3630
3631         We are also adding support for BigInt constant folding into
3632         TypeOf operation.
3633
3634         * bytecode/SpeculatedType.cpp:
3635         (JSC::dumpSpeculation):
3636         (JSC::speculationFromClassInfo):
3637         (JSC::speculationFromStructure):
3638         (JSC::speculationFromJSType):
3639         (JSC::speculationFromString):
3640         * bytecode/SpeculatedType.h:
3641         (JSC::isBigIntSpeculation):
3642         * dfg/DFGAbstractInterpreterInlines.h:
3643         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3644         * dfg/DFGAbstractValue.cpp:
3645         (JSC::DFG::AbstractValue::set):
3646         * dfg/DFGConstantFoldingPhase.cpp:
3647         (JSC::DFG::ConstantFoldingPhase::foldConstants):
3648         * dfg/DFGFixupPhase.cpp:
3649         (JSC::DFG::FixupPhase::fixupNode):
3650         (JSC::DFG::FixupPhase::fixupToThis):
3651         (JSC::DFG::FixupPhase::observeUseKindOnNode):
3652         * dfg/DFGInferredTypeCheck.cpp:
3653         (JSC::DFG::insertInferredTypeCheck):
3654         * dfg/DFGNode.h:
3655         (JSC::DFG::Node::shouldSpeculateBigInt):
3656         * dfg/DFGPredictionPropagationPhase.cpp:
3657         * dfg/DFGSafeToExecute.h:
3658         (JSC::DFG::SafeToExecuteEdge::operator()):
3659         * dfg/DFGSpeculativeJIT.cpp:
3660         (JSC::DFG::SpeculativeJIT::compileStrictEq):
3661         (JSC::DFG::SpeculativeJIT::speculateBigInt):
3662         (JSC::DFG::SpeculativeJIT::speculate):
3663         * dfg/DFGSpeculativeJIT.h:
3664         * dfg/DFGSpeculativeJIT32_64.cpp:
3665         (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
3666         * dfg/DFGSpeculativeJIT64.cpp:
3667         (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
3668         * dfg/DFGUseKind.cpp:
3669         (WTF::printInternal):
3670         * dfg/DFGUseKind.h:
3671         (JSC::DFG::typeFilterFor):
3672         (JSC::DFG::isCell):
3673         * ftl/FTLCapabilities.cpp:
3674         (JSC::FTL::canCompile):
3675         * ftl/FTLLowerDFGToB3.cpp:
3676         (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
3677         (JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
3678         (JSC::FTL::DFG::LowerDFGToB3::speculate):
3679         (JSC::FTL::DFG::LowerDFGToB3::isNotBigInt):
3680         (JSC::FTL::DFG::LowerDFGToB3::speculateBigInt):
3681         * jit/AssemblyHelpers.cpp:
3682         (JSC::AssemblyHelpers::branchIfNotType):
3683         * jit/AssemblyHelpers.h:
3684         (JSC::AssemblyHelpers::branchIfBigInt):
3685         (JSC::AssemblyHelpers::branchIfNotBigInt):
3686         * runtime/InferredType.cpp:
3687         (JSC::InferredType::Descriptor::forValue):
3688         (JSC::InferredType::Descriptor::putByIdFlags const):
3689         (JSC::InferredType::Descriptor::merge):
3690         (WTF::printInternal):
3691         * runtime/InferredType.h:
3692         * runtime/JSBigInt.h:
3693
3694 2018-04-10  Filip Pizlo  <fpizlo@apple.com>
3695
3696         Unreviewed, fix cloop build.
3697
3698         * dfg/DFGAbstractInterpreterClobberState.cpp:
3699
3700 2018-04-10  Mark Lam  <mark.lam@apple.com>
3701
3702         Make the ASSERT in MarkedSpace::sizeClassToIndex() a RELEASE_ASSERT.
3703         https://bugs.webkit.org/show_bug.cgi?id=184464
3704         <rdar://problem/39323947>
3705
3706         Reviewed by Saam Barati.
3707
3708         * heap/MarkedSpace.h:
3709         (JSC::MarkedSpace::sizeClassToIndex):
3710
3711 2018-04-09  Filip Pizlo  <fpizlo@apple.com>
3712
3713         DFG AI and clobberize should agree with each other
3714         https://bugs.webkit.org/show_bug.cgi?id=184440
3715
3716         Reviewed by Saam Barati.
3717
3718         One way to fix bugs involving underapproximation in AI or clobberize is to assert that they
3719         agree with each other. That's what this patch does: it adds an assertion that AI's structure
3720         state tracking must be equivalent to JSCell_structureID being clobbered.
3721
3722         One subtlety is that AI sometimes folds away structure clobbering using information that
3723         clobberize doesn't have. So, we track this wuth special kinds of AI states (FoldedClobber and
3724         ObservedTransitions).
3725
3726         This fixes a bunch of cases of AI missing clobberStructures/clobberWorld and one case of
3727         clobberize missing a write(Heap).
3728
3729         This also makes some cases more precise in order to appease the assertion. Making things more
3730         precise might make things faster, but I didn't measure it because that wasn't the goal.
3731
3732         * JavaScriptCore.xcodeproj/project.pbxproj:
3733         * Sources.txt:
3734         * dfg/DFGAbstractInterpreter.h:
3735         * dfg/DFGAbstractInterpreterClobberState.cpp: Added.
3736         (WTF::printInternal):
3737         * dfg/DFGAbstractInterpreterClobberState.h: Added.
3738         (JSC::DFG::mergeClobberStates):
3739         * dfg/DFGAbstractInterpreterInlines.h:
3740         (JSC::DFG::AbstractInterpreter<AbstractStateType>::startExecuting):
3741         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3742         (JSC::DFG::AbstractInterpreter<AbstractStateType>::didFoldClobberWorld):
3743         (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):
3744         (JSC::DFG::AbstractInterpreter<AbstractStateType>::didFoldClobberStructures):
3745         (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
3746         (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
3747         (JSC::DFG::AbstractInterpreter<AbstractStateType>::setDidClobber): Deleted.
3748         * dfg/DFGAtTailAbstractState.h:
3749         (JSC::DFG::AtTailAbstractState::setClobberState):
3750         (JSC::DFG::AtTailAbstractState::mergeClobberState):
3751         (JSC::DFG::AtTailAbstractState::setDidClobber): Deleted.
3752         * dfg/DFGCFAPhase.cpp:
3753         (JSC::DFG::CFAPhase::performBlockCFA):
3754         * dfg/DFGClobberSet.cpp:
3755         (JSC::DFG::writeSet):
3756         * dfg/DFGClobberSet.h:
3757         * dfg/DFGClobberize.h:
3758         (JSC::DFG::clobberize):
3759         * dfg/DFGConstantFoldingPhase.cpp:
3760         (JSC::DFG::ConstantFoldingPhase::foldConstants):
3761         * dfg/DFGInPlaceAbstractState.h:
3762         (JSC::DFG::InPlaceAbstractState::clobberState const):
3763         (JSC::DFG::InPlaceAbstractState::didClobberOrFolded const):
3764         (JSC::DFG::InPlaceAbstractState::didClobber const):
3765         (JSC::DFG::InPlaceAbstractState::setClobberState):
3766         (JSC::DFG::InPlaceAbstractState::mergeClobberState):
3767         (JSC::DFG::InPlaceAbstractState::setDidClobber): Deleted.
3768
3769 2018-04-10  Filip Pizlo  <fpizlo@apple.com>
3770
3771         ExecutableToCodeBlockEdge::visitChildren() should be cool with m_codeBlock being null since we clear it in finalizeUnconditionally()
3772         https://bugs.webkit.org/show_bug.cgi?id=184460
3773         <rdar://problem/37610966>
3774
3775         Reviewed by Mark Lam.
3776
3777         * bytecode/ExecutableToCodeBlockEdge.cpp:
3778         (JSC::ExecutableToCodeBlockEdge::visitChildren):
3779
3780 2018-04-10  Filip Pizlo  <fpizlo@apple.com>
3781
3782         REGRESSION(r227341 and r227742): AI and clobberize should be precise and consistent about the effectfulness of CompareEq
3783         https://bugs.webkit.org/show_bug.cgi?id=184455
3784
3785         Reviewed by Michael Saboff.
3786
3787         LICM is sort of an assertion that AI is as precise as clobberize about effects. If clobberize
3788         says that something is not effectful, then LICM will try to hoist it. But LICM's AI hack
3789         (AtTailAbstractState) cannot handle hoisting of things that have effects. So, if AI thinks that
3790         the thing being hoisted does have effects, then we get a crash.
3791
3792         In r227341, we incorrectly told AI that CompareEq(Untyped:, _) is effectful. In fact, only
3793         ComapreEq(Untyped:, Untyped:) is effectful, and clobberize knew this already. As a result, LICM
3794         would blow up if we hoisted CompareEq(Untyped:, Other:), which clobberize knew wasn't
3795         effectful.
3796
3797         Instead of fixing this by making AI precise, in r227742 we made matters worse by then breaking
3798         clobberize to also think that CompareEq(Untyped:, _) is effectful.
3799
3800         This fixes the whole situation by teaching both clobberize and AI that the only effectful form
3801         of CompareEq is ComapreEq(Untyped:, Untyped:).
3802
3803         * dfg/DFGAbstractInterpreterInlines.h:
3804         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3805         * dfg/DFGClobberize.h:
3806         (JSC::DFG::clobberize):
3807
3808 2018-04-09  Filip Pizlo  <fpizlo@apple.com>
3809
3810         Executing known edge types may reveal a contradiction causing us to emit an exit at a node that is not allowed to exit
3811         https://bugs.webkit.org/show_bug.cgi?id=184372
3812
3813         Reviewed by Saam Barati.
3814
3815         We do a pretty good job of not emitting checks for KnownBlah edges, since those mean that we
3816         have already proved, using techniques that are more precise than AI, that the edge has type
3817         Blah. Unfortunately, we do not handle this case gracefully when AI state becomes bottom,
3818         because we have a bad habit of treating terminate/terminateSpeculativeExecution as something
3819         other than a check - so we think we can call those just because we should have already
3820         bailed. It's better to think of them as the result of folding a check. Therefore, we should
3821         only do it if there had been a check to begin with.
3822
3823         * dfg/DFGSpeculativeJIT64.cpp:
3824         (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
3825         (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
3826         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
3827         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
3828         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
3829         * ftl/FTLLowerDFGToB3.cpp:
3830         (JSC::FTL::DFG::LowerDFGToB3::lowInt32):
3831         (JSC::FTL::DFG::LowerDFGToB3::lowInt52):
3832         (JSC::FTL::DFG::LowerDFGToB3::lowCell):
3833         (JSC::FTL::DFG::LowerDFGToB3::lowBoolean):
3834         (JSC::FTL::DFG::LowerDFGToB3::lowDouble):
3835         (JSC::FTL::DFG::LowerDFGToB3::speculate):
3836         (JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
3837         (JSC::FTL::DFG::LowerDFGToB3::speculateStringOrOther):
3838
3839 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3840
3841         [JSC] Introduce @putByIdDirectPrivate
3842         https://bugs.webkit.org/show_bug.cgi?id=184400
3843
3844         Reviewed by Saam Barati.
3845
3846         This patch adds @putByIdDirectPrivate() to use it for builtin JS.
3847         @getByIdDirectPrivate and @putByIdDirectPrivate are pair of intrinsics
3848         accessing to ECMAScript internal fields.
3849
3850         This change removes accidental [[Put]] operation to an object whose [[Prototype]]
3851         has internal fields (not direct properties). By using @getByIdDirectPrivate() and
3852         @putByIdDirectPrivate(), we strongly keep the semantics of the ECMAScript internal
3853         fields that accessing to the internal fields does not traverse prototype chains.
3854
3855         * builtins/ArrayIteratorPrototype.js:
3856         (globalPrivate.arrayIteratorValueNext):
3857         (globalPrivate.arrayIteratorKeyNext):
3858         (globalPrivate.arrayIteratorKeyValueNext):
3859         * builtins/ArrayPrototype.js:
3860         (globalPrivate.createArrayIterator):
3861         * builtins/AsyncFromSyncIteratorPrototype.js:
3862         (globalPrivate.AsyncFromSyncIteratorConstructor):
3863         * builtins/AsyncFunctionPrototype.js:
3864         (globalPrivate.asyncFunctionResume):
3865         * builtins/AsyncGeneratorPrototype.js:
3866         (globalPrivate.asyncGeneratorQueueEnqueue):
3867         (globalPrivate.asyncGeneratorQueueDequeue):
3868         (asyncGeneratorYieldAwaited):
3869         (globalPrivate.asyncGeneratorYield):
3870         (globalPrivate.doAsyncGeneratorBodyCall):
3871         (globalPrivate.asyncGeneratorResumeNext):
3872         * builtins/GeneratorPrototype.js:
3873         (globalPrivate.generatorResume):
3874         * builtins/MapIteratorPrototype.js:
3875         (globalPrivate.mapIteratorNext):
3876         * builtins/MapPrototype.js:
3877         (globalPrivate.createMapIterator):
3878         * builtins/ModuleLoaderPrototype.js:
3879         (forceFulfillPromise):
3880         * builtins/PromiseOperations.js:
3881         (globalPrivate.newHandledRejectedPromise):
3882         (globalPrivate.rejectPromise):
3883         (globalPrivate.fulfillPromise):
3884         (globalPrivate.initializePromise):
3885         * builtins/PromisePrototype.js:
3886         (then):
3887         * builtins/SetIteratorPrototype.js:
3888         (globalPrivate.setIteratorNext):
3889         * builtins/SetPrototype.js:
3890         (globalPrivate.createSetIterator):
3891         * builtins/StringIteratorPrototype.js:
3892         (next):
3893         * bytecode/BytecodeIntrinsicRegistry.h:
3894         * bytecompiler/NodesCodegen.cpp:
3895         (JSC::BytecodeIntrinsicNode::emit_intrinsic_putByIdDirect):
3896         (JSC::BytecodeIntrinsicNode::emit_intrinsic_putByIdDirectPrivate):
3897
3898 2018-04-09  Mark Lam  <mark.lam@apple.com>
3899
3900         Decorate method table entries to support pointer profiling.
3901         https://bugs.webkit.org/show_bug.cgi?id=184430
3902         <rdar://problem/39296190>
3903
3904         Reviewed by Saam Barati.
3905
3906         * runtime/ClassInfo.h:
3907
3908 2018-04-09  Michael Catanzaro  <mcatanzaro@igalia.com>
3909
3910         [WPE] Don't install JSC C API headers
3911         https://bugs.webkit.org/show_bug.cgi?id=184375
3912
3913         Reviewed by Žan Doberšek.
3914
3915         None of the functions declared in these headers are exported in WPE. Use the new jsc API
3916         instead.
3917
3918         * PlatformWPE.cmake:
3919
3920 2018-04-08  Mark Lam  <mark.lam@apple.com>
3921
3922         Add pointer profiling to the FTL and supporting code.
3923         https://bugs.webkit.org/show_bug.cgi?id=184395
3924         <rdar://problem/39264019>
3925
3926         Reviewed by Michael Saboff and Filip Pizlo.
3927
3928         * assembler/CodeLocation.h:
3929         (JSC::CodeLocationLabel::retagged):
3930         (JSC::CodeLocationJump::retagged):
3931         * assembler/LinkBuffer.h:
3932         (JSC::LinkBuffer::locationOf):
3933         * dfg/DFGJITCompiler.cpp:
3934         (JSC::DFG::JITCompiler::linkOSRExits):
3935         (JSC::DFG::JITCompiler::link):
3936         * ftl/FTLCompile.cpp:
3937         (JSC::FTL::compile):
3938         * ftl/FTLExceptionTarget.cpp:
3939         (JSC::FTL::ExceptionTarget::label):
3940         (JSC::FTL::ExceptionTarget::jumps):
3941         * ftl/FTLExceptionTarget.h:
3942         * ftl/FTLJITCode.cpp:
3943         (JSC::FTL::JITCode::executableAddressAtOffset):
3944         * ftl/FTLLazySlowPath.cpp:
3945         (JSC::FTL::LazySlowPath::~LazySlowPath):
3946         (JSC::FTL::LazySlowPath::initialize):
3947         (JSC::FTL::LazySlowPath::generate):
3948         (JSC::FTL::LazySlowPath::LazySlowPath): Deleted.
3949         * ftl/FTLLazySlowPath.h:
3950         * ftl/FTLLink.cpp:
3951         (JSC::FTL::link):
3952         * ftl/FTLLowerDFGToB3.cpp:
3953         (JSC::FTL::DFG::LowerDFGToB3::lower):
3954         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
3955         (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
3956         (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
3957         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
3958         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
3959         (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
3960         (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
3961         * ftl/FTLOSRExitCompiler.cpp:
3962         (JSC::FTL::compileStub):
3963         (JSC::FTL::compileFTLOSRExit):
3964         * ftl/FTLOSRExitHandle.cpp:
3965         (JSC::FTL::OSRExitHandle::emitExitThunk):
3966         * ftl/FTLOperations.cpp:
3967         (JSC::FTL::compileFTLLazySlowPath):
3968         * ftl/FTLOutput.h:
3969         (JSC::FTL::Output::callWithoutSideEffects):