Source/JavaScriptCore/ChangeLog

   1 2016-03-08  Joseph Pecoraro  <pecoraro@apple.com>
   2
   3         Web Inspector: Add Heap domain start/stop tracking commands
   4         https://bugs.webkit.org/show_bug.cgi?id=155190
   5
   6         Reviewed by Brian Burg.
   7
   8         * inspector/agents/InspectorHeapAgent.cpp:
   9         (Inspector::InspectorHeapAgent::willDestroyFrontendAndBackend):
  10         (Inspector::InspectorHeapAgent::startTracking):
  11         (Inspector::InspectorHeapAgent::stopTracking):
  12         * inspector/agents/InspectorHeapAgent.h:
  13         * inspector/protocol/Heap.json:
  14
  15 2016-03-08  Joseph Pecoraro  <pecoraro@apple.com>
  16
  17         Web Inspector: Add a way to create a Heap Snapshot
  18         https://bugs.webkit.org/show_bug.cgi?id=155188
  19
  20         Reviewed by Brian Burg.
  21
  22         * inspector/agents/InspectorHeapAgent.h:
  23         * inspector/protocol/Heap.json:
  24         * inspector/agents/InspectorHeapAgent.cpp:
  25         (Inspector::InspectorHeapAgent::snapshot):
  26         Take a heap snapshot and return the JSON string result.
  27
  28         * inspector/protocol/Debugger.json:
  29         Remove unused optional inferredName. Our displayName would be inferred.
  30
  31 2016-03-08  Oliver Hunt  <oliver@apple.com>
  32
  33         Fix ios bot build.
  34
  35         * jit/ExecutableAllocatorFixedVMPool.cpp:
  36         (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
  37
  38 2016-03-08  Mark Lam  <mark.lam@apple.com>
  39
  40         Implement Function.name support for getters/setters and inferring name of function properties.
  41         https://bugs.webkit.org/show_bug.cgi?id=154865
  42
  43         Rubber-stamped by Joseph Pecoraro.
  44
  45         Follow up to the fix for this bug: adding a few small clean-ups for issues Joe
  46         pointed out in the bug.
  47
  48         * runtime/JSBoundSlotBaseFunction.cpp:
  49         (JSC::JSBoundSlotBaseFunction::create):
  50         * runtime/JSCJSValue.cpp:
  51         (JSC::JSValue::putToPrimitiveByIndex):
  52
  53 2016-03-08  Oliver Hunt  <oliver@apple.com>
  54
  55         Start moving to separated writable and executable mappings in the JIT
  56         https://bugs.webkit.org/show_bug.cgi?id=155178
  57
  58         Reviewed by Fil Pizlo.
  59
  60         Start moving to a separate writable and executable heap for the various
  61         JITs.
  62
  63         As part of our work to harden the JIT against various attacks, we're
  64         moving away from our current RWX heap and on to using separate RW and X
  65         mappings. This means that simply leaking the location of the executable
  66         mapping is not sufficient to compromise JSC, so we can continue to
  67         use direct executable pointers in our GC objects (which we need for
  68         performance), but keep the writable pointer in only a single location
  69         so that we are less likely to leak the address. To further obscure the
  70         address of the writable region we place it in an execute only region
  71         of memory so that it is not possible to read the location from
  72         anywhere. That means an attacker must have at least partial control
  73         of PC (to call jitMemCopy) before they can start to attack the JIT.
  74
  75         This work is initially ARM64 only, as we use as the jitMemCopy is
  76         currently specific to that platform's calling conventions and layout.
  77         We're just landing it in the current form so that we can at least
  78         ensure it doesn't regress.
  79
  80         * Configurations/FeatureDefines.xcconfig:
  81         * assembler/ARM64Assembler.h:
  82         (JSC::ARM64Assembler::ldp):
  83         (JSC::ARM64Assembler::ldnp):
  84         (JSC::ARM64Assembler::fillNops):
  85         (JSC::ARM64Assembler::stp):
  86         (JSC::ARM64Assembler::stnp):
  87         (JSC::ARM64Assembler::replaceWithJump):
  88         (JSC::ARM64Assembler::replaceWithLoad):
  89         (JSC::ARM64Assembler::replaceWithAddressComputation):
  90         (JSC::ARM64Assembler::setPointer):
  91         (JSC::ARM64Assembler::repatchInt32):
  92         (JSC::ARM64Assembler::repatchCompact):
  93         (JSC::ARM64Assembler::linkJumpOrCall):
  94         (JSC::ARM64Assembler::linkCompareAndBranch):
  95         (JSC::ARM64Assembler::linkConditionalBranch):
  96         (JSC::ARM64Assembler::linkTestAndBranch):
  97         (JSC::ARM64Assembler::loadStoreRegisterPairOffset):
  98         (JSC::ARM64Assembler::loadStoreRegisterPairNonTemporal):
  99         * assembler/LinkBuffer.cpp:
 100         (JSC::LinkBuffer::copyCompactAndLinkCode):
 101         (JSC::LinkBuffer::allocate):
 102         * assembler/LinkBuffer.h:
 103         (JSC::LinkBuffer::LinkBuffer):
 104         * assembler/MacroAssemblerARM64.h:
 105         (JSC::MacroAssemblerARM64::sub64):
 106         (JSC::MacroAssemblerARM64::load64):
 107         (JSC::MacroAssemblerARM64::loadPair64):
 108         (JSC::MacroAssemblerARM64::loadPair64WithNonTemporalAccess):
 109         (JSC::MacroAssemblerARM64::load8):
 110         (JSC::MacroAssemblerARM64::store64):
 111         (JSC::MacroAssemblerARM64::storePair64):
 112         (JSC::MacroAssemblerARM64::storePair64WithNonTemporalAccess):
 113         (JSC::MacroAssemblerARM64::store8):
 114         (JSC::MacroAssemblerARM64::branchAdd64):
 115         (JSC::MacroAssemblerARM64::branchSub64):
 116         * jit/ExecutableAllocator.h:
 117         (JSC::performJITMemcpy):
 118         * jit/ExecutableAllocatorFixedVMPool.cpp:
 119         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
 120         (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
 121         (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
 122         * runtime/Options.cpp:
 123         (JSC::recomputeDependentOptions):
 124         * runtime/Options.h:
 125
 126 2016-03-08  Mark Lam  <mark.lam@apple.com>
 127
 128         Implement Function.name support for getters/setters and inferring name of function properties.
 129         https://bugs.webkit.org/show_bug.cgi?id=154865
 130
 131         Reviewed by Geoffrey Garen.
 132
 133         1. toString() no longer uses the value of Function.name as the name of the
 134            function in the returned string, because ...
 135
 136             i. Function.name is supposed to be configurable.  Hence, it can be made
 137                writable and can be set to any JSValue, or deleted.
 138            ii. Function.prototype.toString() is supposed to produce a string that can be
 139                eval'ed.  Hence, for JS functions, the function name in the produced
 140                string must be a legal function name (and not some arbitrary value set in
 141                Function.name).  For example, while a number is a legal value for
 142                Function.name, it is not legal as the function name in the toString()
 143                string.
 144
 145            Instead, we'll always use the original name from the JS source that the
 146            function was parsed from.
 147
 148         2. JSFunction::name() now always return the original name, not the value of
 149            the Function.name property.  As a result, it also no longer needs an
 150            ExecState* arg.
 151
 152            If the original name is an empty string, JSFunction::name() will use the
 153            inferred name.
 154
 155         3. For JS functions, the original name can be attained from their
 156            FunctionExecutable object.
 157
 158            For host/native functions (which do not have a FunctionExecutable), we get the
 159            "original" name from its NativeExecutable.
 160
 161         4. The m_hostFunctionStubMap now keys its NativeExecutable pointers using the
 162            original name, in addition to the native function and constructor pointers.
 163
 164            This is needed because we want a different NativeExecutable for functions with
 165            a different name (to satisfy (3) above).
 166
 167         5. Changed JSBoundFunction to store the name of its bound function in its
 168            NativeExecutable.  This will later be used to generate the toString() string.
 169            It's Function.name value is eagerly initialized at construction time.
 170
 171         6. Function.name for getters/setters are now prefixed with "get"/"set".
 172            This was done both for the JSBoundSlotBaseFunctions and JS definable get/set
 173            functions.
 174
 175         7. Added InternalFunction::m_originalName so that we can use it to generate the
 176            toString() string.  We're storing it as a JSString instead of a WTF::String
 177            only because we want InternalFunction to be continue to be trivially
 178            destructible.
 179
 180         * inspector/JSInjectedScriptHost.cpp:
 181         (Inspector::JSInjectedScriptHost::functionDetails):
 182         * jit/JITThunks.cpp:
 183         (JSC::JITThunks::finalize):
 184         (JSC::JITThunks::hostFunctionStub):
 185         * jit/JITThunks.h:
 186         * runtime/Executable.h:
 187         * runtime/FunctionPrototype.cpp:
 188         (JSC::functionProtoFuncToString):
 189         * runtime/InternalFunction.cpp:
 190         (JSC::InternalFunction::finishCreation):
 191         (JSC::InternalFunction::visitChildren):
 192         (JSC::InternalFunction::name):
 193         (JSC::InternalFunction::displayName):
 194         * runtime/InternalFunction.h:
 195         * runtime/JSBoundFunction.cpp:
 196         (JSC::JSBoundFunction::create):
 197         (JSC::JSBoundFunction::visitChildren):
 198         (JSC::JSBoundFunction::toStringName): Deleted.
 199         * runtime/JSBoundFunction.h:
 200         (JSC::JSBoundFunction::boundThis):
 201         (JSC::JSBoundFunction::boundArgs):
 202         (JSC::JSBoundFunction::createStructure):
 203         * runtime/JSBoundSlotBaseFunction.cpp:
 204         (JSC::boundSlotBaseFunctionCall):
 205         (JSC::JSBoundSlotBaseFunction::create):
 206         * runtime/JSFunction.cpp:
 207         (JSC::JSFunction::initializeRareData):
 208         (JSC::JSFunction::name):
 209         (JSC::JSFunction::displayName):
 210         (JSC::JSFunction::calculatedDisplayName):
 211         (JSC::JSFunction::reifyName):
 212         * runtime/JSFunction.h:
 213         * tests/es6.yaml:
 214
 215 2016-03-08  Commit Queue  <commit-queue@webkit.org>
 216
 217         Unreviewed, rolling out r197793 and r197799.
 218         https://bugs.webkit.org/show_bug.cgi?id=155195
 219
 220         something weird happened while landing this and everything
 221         broke (Requested by olliej on #webkit).
 222
 223         Reverted changesets:
 224
 225         "Start moving to separated writable and executable mappings in
 226         the JIT"
 227         https://bugs.webkit.org/show_bug.cgi?id=155178
 228         http://trac.webkit.org/changeset/197793
 229
 230         "arm64 build fix after r197793."
 231         http://trac.webkit.org/changeset/197799
 232
 233 2016-03-08  Alex Christensen  <achristensen@webkit.org>
 234
 235         arm64 build fix after r197793.
 236
 237         * jit/ExecutableAllocatorFixedVMPool.cpp:
 238         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
 239         (JSC::FixedVMPoolExecutableAllocator::initializeBulletproofJIT):
 240         (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
 241         Use consistent ENABLE macro.  It looks like it was partially renamed.
 242
 243 2016-03-08  Filip Pizlo  <fpizlo@apple.com>
 244
 245         Regexp matching should incur less call overhead
 246         https://bugs.webkit.org/show_bug.cgi?id=155181
 247
 248         Reviewed by Geoffrey Garen.
 249
 250         Previously we had DFG/FTL code call into the DFGOperation, which then called in to
 251         RegExpObject, which then called into createRegExpMatchesArray, which then called into
 252         RegExp, which then called the code generated by Yarr.
 253
 254         Now we have DFG/FTL code call into the DFGOperation, which does all of the things and calls
 255         into code generated by Yarr.
 256
 257         This is another tiny Octane/regexp speed-up.
 258
 259         * JavaScriptCore.xcodeproj/project.pbxproj:
 260         * dfg/DFGOperations.cpp:
 261         * runtime/RegExp.cpp:
 262         (JSC::regExpFlags):
 263         (JSC::RegExp::compile):
 264         (JSC::RegExp::match):
 265         (JSC::RegExp::compileMatchOnly):
 266         (JSC::RegExp::deleteCode):
 267         (JSC::RegExpFunctionalTestCollector::clearRegExp): Deleted.
 268         (JSC::RegExp::compileIfNecessary): Deleted.
 269         (JSC::RegExp::compileIfNecessaryMatchOnly): Deleted.
 270         * runtime/RegExp.h:
 271         * runtime/RegExpInlines.h: Added.
 272         (JSC::RegExpFunctionalTestCollector::clearRegExp):
 273         (JSC::RegExp::compileIfNecessary):
 274         (JSC::RegExp::matchInline):
 275         (JSC::RegExp::compileIfNecessaryMatchOnly):
 276         * runtime/RegExpMatchesArray.cpp:
 277         (JSC::createEmptyRegExpMatchesArray):
 278         (JSC::createStructureImpl):
 279         (JSC::tryCreateUninitializedRegExpMatchesArray): Deleted.
 280         (JSC::createRegExpMatchesArray): Deleted.
 281         * runtime/RegExpMatchesArray.h:
 282         (JSC::tryCreateUninitializedRegExpMatchesArray):
 283         (JSC::createRegExpMatchesArray):
 284         * runtime/RegExpObject.cpp:
 285         (JSC::RegExpObject::put):
 286         (JSC::RegExpObject::exec):
 287         (JSC::RegExpObject::match):
 288         (JSC::getLastIndexAsUnsigned): Deleted.
 289         * runtime/RegExpObject.h:
 290         (JSC::RegExpObject::getLastIndex):
 291         (JSC::RegExpObject::test):
 292         (JSC::RegExpObject::testInline):
 293         * runtime/RegExpObjectInlines.h: Added.
 294         (JSC::getRegExpObjectLastIndexAsUnsigned):
 295         (JSC::RegExpObject::execInline):
 296         (JSC::RegExpObject::matchInline):
 297
 298 2016-03-08  Mark Lam  <mark.lam@apple.com>
 299
 300         synthesizePrototype() and friends need to be followed by exception checks (or equivalent).
 301         https://bugs.webkit.org/show_bug.cgi?id=155169
 302
 303         Reviewed by Geoffrey Garen.
 304
 305         With the exception checks, we may end up throwing new exceptions over an existing
 306         one that has been thrown but not handled yet, thereby obscuring it.  It may also
 307         mean that the VM will continue running on potentially unstable state, which may
 308         have undesirable consequences.
 309
 310         I first observed this in some failed assertion while running tests on a patch for
 311         https://bugs.webkit.org/show_bug.cgi?id=154865.
 312
 313         Performance is neutral with this patch (tested on x86_64).
 314
 315         1. Deleted JSNotAnObject, and removed all uses of it.
 316
 317         2. Added exception checks, when needed, following calls to synthesizePrototype()
 318            and JSValue::toObject().
 319
 320            The cases that do not need an exception check are the ones that already ensures
 321            that JSValue::toObject() is only called on a value that is convertible to an
 322            object.  In those cases, I added an assertion that no exception was thrown
 323            after the call.
 324
 325         * CMakeLists.txt:
 326         * JavaScriptCore.xcodeproj/project.pbxproj:
 327         * inspector/ScriptCallStackFactory.cpp:
 328         (Inspector::createScriptCallStackFromException):
 329         * interpreter/Interpreter.cpp:
 330         * jit/JITOperations.cpp:
 331         * llint/LLIntSlowPaths.cpp:
 332         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 333         * runtime/ArrayPrototype.cpp:
 334         (JSC::arrayProtoFuncJoin):
 335         (JSC::arrayProtoFuncConcat):
 336         (JSC::arrayProtoFuncPop):
 337         (JSC::arrayProtoFuncPush):
 338         (JSC::arrayProtoFuncReverse):
 339         (JSC::arrayProtoFuncShift):
 340         (JSC::arrayProtoFuncSlice):
 341         (JSC::arrayProtoFuncSplice):
 342         (JSC::arrayProtoFuncUnShift):
 343         (JSC::arrayProtoFuncIndexOf):
 344         (JSC::arrayProtoFuncLastIndexOf):
 345         (JSC::arrayProtoFuncValues):
 346         (JSC::arrayProtoFuncEntries):
 347         (JSC::arrayProtoFuncKeys):
 348         * runtime/CommonSlowPaths.cpp:
 349         (JSC::SLOW_PATH_DECL):
 350         * runtime/ExceptionHelpers.cpp:
 351         * runtime/JSCJSValue.cpp:
 352         (JSC::JSValue::toObjectSlowCase):
 353         (JSC::JSValue::toThisSlowCase):
 354         (JSC::JSValue::synthesizePrototype):
 355         (JSC::JSValue::putToPrimitive):
 356         (JSC::JSValue::putToPrimitiveByIndex):
 357         * runtime/JSCJSValueInlines.h:
 358         (JSC::JSValue::getPropertySlot):
 359         (JSC::JSValue::get):
 360         * runtime/JSFunction.cpp:
 361         * runtime/JSGlobalObjectFunctions.cpp:
 362         (JSC::globalFuncProtoGetter):
 363         * runtime/JSNotAnObject.cpp: Removed.
 364         * runtime/JSNotAnObject.h: Removed.
 365         * runtime/ObjectConstructor.cpp:
 366         (JSC::objectConstructorDefineProperties):
 367         (JSC::objectConstructorCreate):
 368         * runtime/ObjectPrototype.cpp:
 369         (JSC::objectProtoFuncValueOf):
 370         (JSC::objectProtoFuncHasOwnProperty):
 371         (JSC::objectProtoFuncIsPrototypeOf):
 372         (JSC::objectProtoFuncToString):
 373         * runtime/VM.cpp:
 374         (JSC::VM::VM):
 375         * runtime/VM.h:
 376
 377 2016-03-08  Oliver Hunt  <oliver@apple.com>
 378
 379         Start moving to separated writable and executable mappings in the JIT
 380         https://bugs.webkit.org/show_bug.cgi?id=155178
 381
 382         Reviewed by Filip Pizlo.
 383
 384         Start moving to a separate writable and executable heap for the various
 385         JITs.
 386
 387         As part of our work to harden the JIT against various attacks, we're
 388         moving away from our current RWX heap and on to using separate RW and X
 389         mappings. This means that simply leaking the location of the executable
 390         mapping is not sufficient to compromise JSC, so we can continue to
 391         use direct executable pointers in our GC objects (which we need for
 392         performance), but keep the writable pointer in only a single location
 393         so that we are less likely to leak the address. To further obscure the
 394         address of the writable region we place it in an execute only region
 395         of memory so that it is not possible to read the location from
 396         anywhere. That means an attacker must have at least partial control
 397         of PC (to call jitMemCopy) before they can start to attack the JIT.
 398
 399         This work is initially ARM64 only, as we use as the jitMemCopy is
 400         currently specific to that platform's calling conventions and layout.
 401         We're just landing it in the current form so that we can at least
 402         ensure it doesn't regress.
 403
 404         * Configurations/FeatureDefines.xcconfig:
 405         * assembler/ARM64Assembler.h:
 406         (JSC::ARM64Assembler::ldp):
 407         (JSC::ARM64Assembler::ldnp):
 408         (JSC::ARM64Assembler::fillNops):
 409         (JSC::ARM64Assembler::stp):
 410         (JSC::ARM64Assembler::stnp):
 411         (JSC::ARM64Assembler::replaceWithJump):
 412         (JSC::ARM64Assembler::replaceWithLoad):
 413         (JSC::ARM64Assembler::replaceWithAddressComputation):
 414         (JSC::ARM64Assembler::setPointer):
 415         (JSC::ARM64Assembler::repatchInt32):
 416         (JSC::ARM64Assembler::repatchCompact):
 417         (JSC::ARM64Assembler::linkJumpOrCall):
 418         (JSC::ARM64Assembler::linkCompareAndBranch):
 419         (JSC::ARM64Assembler::linkConditionalBranch):
 420         (JSC::ARM64Assembler::linkTestAndBranch):
 421         (JSC::ARM64Assembler::loadStoreRegisterPairOffset):
 422         (JSC::ARM64Assembler::loadStoreRegisterPairNonTemporal):
 423         * assembler/LinkBuffer.cpp:
 424         (JSC::LinkBuffer::copyCompactAndLinkCode):
 425         (JSC::LinkBuffer::allocate):
 426         * assembler/LinkBuffer.h:
 427         (JSC::LinkBuffer::LinkBuffer):
 428         * assembler/MacroAssemblerARM64.h:
 429         (JSC::MacroAssemblerARM64::sub64):
 430         (JSC::MacroAssemblerARM64::load64):
 431         (JSC::MacroAssemblerARM64::loadPair64):
 432         (JSC::MacroAssemblerARM64::loadPair64WithNonTemporalAccess):
 433         (JSC::MacroAssemblerARM64::load8):
 434         (JSC::MacroAssemblerARM64::store64):
 435         (JSC::MacroAssemblerARM64::storePair64):
 436         (JSC::MacroAssemblerARM64::storePair64WithNonTemporalAccess):
 437         (JSC::MacroAssemblerARM64::store8):
 438         (JSC::MacroAssemblerARM64::branchAdd64):
 439         (JSC::MacroAssemblerARM64::branchSub64):
 440         * jit/ExecutableAllocator.h:
 441         (JSC::performJITMemcpy):
 442         * jit/ExecutableAllocatorFixedVMPool.cpp:
 443         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
 444         (JSC::FixedVMPoolExecutableAllocator::initializeBulletproofJIT):
 445         (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
 446         * runtime/Options.cpp:
 447         (JSC::recomputeDependentOptions):
 448         * runtime/Options.h:
 449
 450 2016-03-08  Michael Saboff  <msaboff@apple.com>
 451
 452         [ES6] Regular Expression canonicalization tables for Unicode need to be updated to use Unicode CaseFolding.txt
 453         https://bugs.webkit.org/show_bug.cgi?id=155114
 454
 455         Reviewed by Darin Adler.
 456
 457         Extracted out the Unicode canonicalization table creation from
 458         YarrCanonicalizeUnicode.js into a new Python script, generateYarrCanonicalizeUnicode.
 459         That script generates the Unicode tables as the file YarrCanonicalizeUnicode.cpp in
 460         DerivedSources/JavaScriptCore.
 461
 462         Updated the processing of ignore case to make the ASCII short cuts dependent on whether
 463         or not we are a Unicode pattern.
 464
 465         Renamed yarr/YarrCanonicalizeUnicode.{cpp,js} back to their prior names,
 466         YarrCanonicalizeUCS2.{cpp,js}.
 467         Renamed yarr/YarrCanonicalizeUnicode.h to YarrCanonicalize.h as it declares both the
 468         legacy UCS2 and Unicode tables.
 469
 470         * CMakeLists.txt:
 471         * DerivedSources.make:
 472         * JavaScriptCore.xcodeproj/project.pbxproj:
 473         * generateYarrCanonicalizeUnicode: Added.
 474         * ucd: Added.
 475         * ucd/CaseFolding.txt: Added.  The current verion, 8.0, of the Unicode CaseFolding table.
 476         * yarr/YarrCanonicalizeUCS2.cpp: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUnicode.cpp.
 477         * yarr/YarrCanonicalize.h: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUnicode.h.
 478         * yarr/YarrCanonicalizeUCS2.js: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUnicode.js.
 479         (printHeader):
 480         * yarr/YarrCanonicalizeUnicode.cpp: Removed.
 481         * yarr/YarrCanonicalizeUnicode.h: Removed.
 482         * yarr/YarrCanonicalizeUnicode.js: Removed.
 483         * yarr/YarrInterpreter.cpp:
 484         (JSC::Yarr::Interpreter::tryConsumeBackReference):
 485         * yarr/YarrJIT.cpp:
 486         * yarr/YarrPattern.cpp:
 487         (JSC::Yarr::CharacterClassConstructor::putChar):
 488
 489 2016-03-08  Andreas Kling  <akling@apple.com>
 490
 491         WeakBlock::visit() should check for a WeakHandleOwner before consulting mark bits.
 492         <https://webkit.org/b/155154>
 493
 494         Reviewed by Darin Adler.
 495
 496         Reorder the checks in WeakBlock::visit() so we don't look at the mark bits in MarkedBlock
 497         unless the current WeakImpl has a WeakHandleOwner we need to consult.
 498
 499         I was originally hoping to make an optimization that could skip over entire WeakBlocks
 500         if they didn't have a single WeakHandleOwner, but it turns out that scenario is not as
 501         common as I suspected.
 502
 503         * heap/WeakBlock.cpp:
 504         (JSC::WeakBlock::visit):
 505
 506 2016-03-07  Saam barati  <sbarati@apple.com>
 507
 508         [ES6] Implement revocable proxies
 509         https://bugs.webkit.org/show_bug.cgi?id=154321
 510
 511         Reviewed by Mark Lam.
 512
 513         This patch is a straight forward implementation of Proxy.revocable
 514         with respect to section 26.2.2.1 of the ECMAScript spec.
 515         https://tc39.github.io/ecma262/#sec-proxy.revocable
 516
 517         This patch also fixes a bug in Proxy where we
 518         were incorrectly caching "in", i.e, `"x" in proxy`.
 519         We should never blatantly cache this because caching is observable
 520         behavior by users of the language. We could come up with
 521         a smarter caching scheme that caches only if the Proxy's
 522         handler doesn't have a "has" property, i.e, we don't have
 523         to call out to JS code. But for now, it's easiest to disable
 524         caching.
 525
 526         * CMakeLists.txt:
 527         * JavaScriptCore.xcodeproj/project.pbxproj:
 528         * runtime/JSGlobalObject.cpp:
 529         (JSC::JSGlobalObject::init):
 530         (JSC::JSGlobalObject::visitChildren):
 531         * runtime/JSGlobalObject.h:
 532         (JSC::JSGlobalObject::moduleRecordStructure):
 533         (JSC::JSGlobalObject::moduleNamespaceObjectStructure):
 534         (JSC::JSGlobalObject::proxyObjectStructure):
 535         (JSC::JSGlobalObject::proxyRevokeStructure):
 536         (JSC::JSGlobalObject::wasmModuleStructure):
 537         * runtime/ProxyConstructor.cpp:
 538         (JSC::ProxyConstructor::create):
 539         (JSC::ProxyConstructor::ProxyConstructor):
 540         (JSC::makeRevocableProxy):
 541         (JSC::proxyRevocableConstructorThrowError):
 542         (JSC::ProxyConstructor::finishCreation):
 543         (JSC::constructProxyObject):
 544         * runtime/ProxyConstructor.h:
 545         (JSC::ProxyConstructor::createStructure):
 546         * runtime/ProxyObject.cpp:
 547         (JSC::ProxyObject::finishCreation):
 548         (JSC::performProxyGet):
 549         (JSC::ProxyObject::performInternalMethodGetOwnProperty):
 550         (JSC::ProxyObject::performHasProperty):
 551         (JSC::ProxyObject::performPut):
 552         (JSC::performProxyCall):
 553         (JSC::performProxyConstruct):
 554         (JSC::ProxyObject::performDelete):
 555         (JSC::ProxyObject::performPreventExtensions):
 556         (JSC::ProxyObject::performIsExtensible):
 557         (JSC::ProxyObject::performDefineOwnProperty):
 558         (JSC::ProxyObject::performGetOwnPropertyNames):
 559         (JSC::ProxyObject::performSetPrototype):
 560         (JSC::ProxyObject::performGetPrototype):
 561         (JSC::ProxyObject::getPrototype):
 562         (JSC::ProxyObject::revoke):
 563         (JSC::ProxyObject::visitChildren):
 564         * runtime/ProxyObject.h:
 565         (JSC::ProxyObject::create):
 566         * runtime/ProxyRevoke.cpp: Added.
 567         (JSC::ProxyRevoke::create):
 568         (JSC::ProxyRevoke::ProxyRevoke):
 569         (JSC::ProxyRevoke::finishCreation):
 570         (JSC::performProxyRevoke):
 571         (JSC::ProxyRevoke::getCallData):
 572         (JSC::ProxyRevoke::visitChildren):
 573         * runtime/ProxyRevoke.h: Added.
 574         (JSC::ProxyRevoke::createStructure):
 575         (JSC::ProxyRevoke::proxy):
 576         (JSC::ProxyRevoke::setProxyToNull):
 577         * tests/stress/proxy-has-property.js:
 578         (assert):
 579         (assert.let.handler.has):
 580         (assert.let.foo):
 581         * tests/stress/proxy-revoke.js: Added.
 582         (assert):
 583         (throw.new.Error.):
 584         (throw.new.Error):
 585         (callAllHandlers):
 586         (shouldThrowNullHandler):
 587         (allHandlersShouldThrow):
 588         (i.let.trap.of.traps.trap.string_appeared_here.func):
 589         (i.let.trap.of.traps.else.func):
 590         (i.Proxy.revocable):
 591
 592 2016-03-07  Csaba Osztrogonác  <ossy@webkit.org>
 593
 594         Fix the ARM build after r197687
 595         https://bugs.webkit.org/show_bug.cgi?id=155128
 596
 597         Reviewed by Saam Barati.
 598
 599         * assembler/MacroAssemblerARM.h:
 600         (JSC::MacroAssemblerARM::moveZeroToDouble):
 601
 602 2016-03-07  Filip Pizlo  <fpizlo@apple.com>
 603
 604         Reduce the number of instructions needed to record the last regexp result
 605         https://bugs.webkit.org/show_bug.cgi?id=155161
 606
 607         Reviewed by Sam Weinig.
 608
 609         This tightens up RegExpCachedResult::record(). My profiling shows that we spend just
 610         over 1% of the time in Octane/regexp in this function. This function had two obvious
 611         redundancies:
 612
 613         1) It executed the write barrier on owner twice. It only needs to execute it once. Since
 614            the same RegExpConstructor is likely to be used many times, it makes sense to do the
 615            barrier without looking at the 'to' objects at all. In steady state, this means that
 616            the RegExpConstructor will simply be OldGrey so this one barrier will always skip the
 617            slow path.
 618
 619         2) It cleared some fields that didn't need to be cleared, since we can just use
 620            m_reified to indicate that the fields are not meaningful anymore.
 621
 622         This is meant to be a microscopic regexp speed-up.
 623
 624         * runtime/RegExpCachedResult.cpp:
 625         (JSC::RegExpCachedResult::visitChildren):
 626         (JSC::RegExpCachedResult::lastResult):
 627         * runtime/RegExpCachedResult.h:
 628         (JSC::RegExpCachedResult::record):
 629
 630 2016-03-07  Filip Pizlo  <fpizlo@apple.com>
 631
 632         createRegExpMatchesArray should allocate substrings more quickly
 633         https://bugs.webkit.org/show_bug.cgi?id=155160
 634
 635         Reviewed by Sam Weinig.
 636
 637         This was calling a version of jsSubstring() that isn't inlineable because it was doing a lot
 638         of checks in finishCreation(). In particular, it was checking that the base string is not
 639         itself a substring and that it's been resolved. We don't need those checks here, since the
 640         string must have been resolved prior to regexp processing.
 641
 642         This patch is also smart about whether to do checks for the empty and full substrings. In
 643         the matches array loop, these checks are super unlikely to be profitable, so we just
 644         unconditionally allocate the substring.
 645
 646         This removes those checks and makes the allocation inlineable. It looks like a 1% speed-up
 647         on Octane/regexp.
 648
 649         * runtime/JSString.h:
 650         (JSC::jsSubstring):
 651         (JSC::jsSubstringOfResolved):
 652         * runtime/RegExpMatchesArray.cpp:
 653         (JSC::createRegExpMatchesArray):
 654
 655 2016-03-07  Benjamin Poulain  <bpoulain@apple.com>
 656
 657         [JSC] Small clean up of how we use SSA's valuesAtHead
 658         https://bugs.webkit.org/show_bug.cgi?id=155152
 659
 660         Reviewed by Filip Pizlo.
 661
 662         liveAtHead and valuesAtHead contain the same nodes,
 663         we do not need the extra look up.
 664
 665         This also opens the way to use the same kind of liveness
 666         analysis as Air (where live values at head do not use a set).
 667
 668         * dfg/DFGInPlaceAbstractState.cpp:
 669         (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
 670         (JSC::DFG::InPlaceAbstractState::merge):
 671
 672 2016-03-07  Brian Burg  <bburg@apple.com>
 673
 674         Web Inspector: the protocol generator should generate factory method stubs for protocol types
 675         https://bugs.webkit.org/show_bug.cgi?id=155103
 676         <rdar://problem/25002772>
 677
 678         Reviewed by Timothy Hatcher.
 679
 680         Generate stubs with unique names so that parsing methods can be used
 681         reflectively at runtime, based on the protocol version that's loaded.
 682
 683         * JavaScriptCore.xcodeproj/project.pbxproj:
 684         * inspector/scripts/codegen/__init__.py:
 685         * inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py:
 686         Added. For each type in a domain, add a method of the form
 687         -[ProtocolTypeConversions _parseXXX:fromPayload]. This is in a category
 688         method, and the selector is only ever looked up at runtime.
 689
 690         (ObjCProtocolTypeConversionsHeaderGenerator.generate_output):
 691         * inspector/scripts/generate-inspector-protocol-bindings.py:
 692         (generate_from_specification):
 693
 694         Rebaseline test results with new generator output.
 695
 696         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
 697         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
 698         * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
 699         * inspector/scripts/tests/expected/enum-values.json-result:
 700         * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
 701         * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
 702         * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
 703         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
 704         * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
 705         * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
 706         * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
 707         * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
 708         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
 709
 710 2016-03-07  Filip Pizlo  <fpizlo@apple.com>
 711
 712         RegExp.prototype.exec() should call into Yarr at most once
 713         https://bugs.webkit.org/show_bug.cgi?id=155139
 714
 715         Reviewed by Saam Barati.
 716
 717         For apparently no good reason, RegExp.prototype.match() was calling into Yarr twice, almost
 718         as if it was hoping that the non-matching case was so common that it was best to have the
 719         matching case do the work all over again.
 720
 721         This is a 4% speed-up on Octane/regexp. It's also a matter of common sense: we should not be
 722         in the business of presuming whether someone's match will succeed or fail. The increased
 723         cost of running Yarr twice is so much larger than whatever savings we were getting from
 724         running a match-only regexp that this is just not a good overall deal for the engine.
 725
 726         Also, it's interesting that we are seeing a 4% speed-up on regexp despite the fact that a
 727         majority (almost a supermajority, I think) of calls into RegExp.prototype.match() are failed
 728         matches. So, this change is a 4% speed-up despite being a slow down on the common case. That
 729         tells you just how bad the old behavior was on the uncommon case.
 730
 731         * runtime/MatchResult.h:
 732         (MatchResult::MatchResult):
 733         (MatchResult::failed):
 734         (MatchResult::operator bool):
 735         * runtime/RegExpCachedResult.cpp:
 736         (JSC::RegExpCachedResult::lastResult):
 737         * runtime/RegExpConstructor.h:
 738         (JSC::RegExpConstructor::setMultiline):
 739         (JSC::RegExpConstructor::multiline):
 740         (JSC::RegExpConstructor::performMatch):
 741         (JSC::RegExpConstructor::recordMatch):
 742         * runtime/RegExpMatchesArray.cpp:
 743         (JSC::createRegExpMatchesArray):
 744         (JSC::createEmptyRegExpMatchesArray):
 745         (JSC::createStructureImpl):
 746         * runtime/RegExpMatchesArray.h:
 747         (JSC::createRegExpMatchesArray):
 748         * runtime/RegExpObject.cpp:
 749         (JSC::RegExpObject::put):
 750         (JSC::getLastIndexAsUnsigned):
 751         (JSC::RegExpObject::exec):
 752         (JSC::RegExpObject::match):
 753         * runtime/RegExpObject.h:
 754         (JSC::RegExpObject::getLastIndex):
 755         (JSC::RegExpObject::test):
 756         * runtime/StringPrototype.cpp:
 757         (JSC::stringProtoFuncMatch):
 758
 759 2016-03-07  Joseph Pecoraro  <pecoraro@apple.com>
 760
 761         Heap Snapshot should include different Edge types and data (Property, Index, Variable)
 762         https://bugs.webkit.org/show_bug.cgi?id=154937
 763
 764         Reviewed by Geoffrey Garen.
 765
 766         * heap/SlotVisitor.cpp:
 767         (JSC::SlotVisitor::appendHidden):
 768         * heap/SlotVisitor.h:
 769         * heap/SlotVisitorInlines.h:
 770         (JSC::SlotVisitor::appendHidden):
 771         (JSC::SlotVisitor::appendValuesHidden):
 772         Add new visit methods to visit a reference without snapshotting the edge.
 773
 774         * heap/Heap.cpp:
 775         (JSC::AddExtraHeapSnapshotEdges::AddExtraHeapSnapshotEdges):
 776         (JSC::AddExtraHeapSnapshotEdges::operator()):
 777         (JSC::Heap::addHeapSnapshotEdges):
 778         (JSC::Heap::removeDeadHeapSnapshotNodes):
 779         (JSC::Heap::collectImpl):
 780         * heap/Heap.h:
 781         After marking, visit the live cells for a chance to record extra
 782         heap snapshotting information about the cell.
 783
 784         * heap/HeapSnapshotBuilder.cpp:
 785         (JSC::HeapSnapshotBuilder::appendNode):
 786         (JSC::HeapSnapshotBuilder::appendEdge):
 787         (JSC::HeapSnapshotBuilder::appendPropertyNameEdge):
 788         (JSC::HeapSnapshotBuilder::appendVariableNameEdge):
 789         (JSC::HeapSnapshotBuilder::appendIndexEdge):
 790         (JSC::HeapSnapshotBuilder::json):
 791         * heap/HeapSnapshotBuilder.h:
 792         (JSC::HeapSnapshotEdge::HeapSnapshotEdge):
 793         Construct edges with extra data.
 794
 795         * runtime/ClassInfo.h:
 796         * runtime/JSCell.cpp:
 797         (JSC::JSCell::heapSnapshot):
 798         * runtime/JSCell.h:
 799         Add a new method to provide cells with an opportunity to provide
 800         extra heap snapshotting information.
 801
 802         * runtime/JSObject.cpp:
 803         (JSC::JSObject::visitButterfly):
 804         (JSC::JSObject::visitChildren):
 805         (JSC::JSObject::heapSnapshot):
 806         (JSC::JSFinalObject::visitChildren):
 807         * runtime/JSObject.h:
 808         Capture object property names and index names when heap snapshotting.
 809         Do not include them as internal edges in normal visitChildren.
 810
 811         * runtime/JSEnvironmentRecord.cpp:
 812         (JSC::JSEnvironmentRecord::visitChildren):
 813         (JSC::JSEnvironmentRecord::heapSnapshot):
 814         * runtime/JSEnvironmentRecord.h:
 815         * runtime/JSSegmentedVariableObject.cpp:
 816         (JSC::JSSegmentedVariableObject::visitChildren):
 817         (JSC::JSSegmentedVariableObject::heapSnapshot):
 818         * runtime/JSSegmentedVariableObject.h:
 819         Capture scope variable names when heap snapshotting.
 820
 821         * runtime/Structure.cpp:
 822         (JSC::Structure::visitChildren):
 823         * runtime/Structure.h:
 824         * runtime/StructureInlines.h:
 825         (JSC::Structure::propertyTable):
 826         When performing a heap snapshotting collection, don't clear the
 827         property table so that accessing the table during this GC is okay.
 828
 829         * tests/heapProfiler/driver/driver.js:
 830         * tests/heapProfiler/property-edge-types.js: Added.
 831         * tests/heapProfiler/variable-edge-types.js: Added.
 832         Tests covering the different edge types and data we capture.
 833
 834 2016-03-07  Saam barati  <sbarati@apple.com>
 835
 836         [ES6] Implement Proxy.[[GetPrototypeOf]]
 837         https://bugs.webkit.org/show_bug.cgi?id=155099
 838
 839         Reviewed by Mark Lam.
 840
 841         This patch is a straight forward implementation of Proxy.[[GetPrototypeOf]]
 842         with respect to section 9.5.1 of the ECMAScript spec.
 843         https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-getprototypeof
 844
 845         * runtime/ProxyObject.cpp:
 846         (JSC::performProxyGet):
 847         (JSC::ProxyObject::setPrototype):
 848         (JSC::ProxyObject::performGetPrototype):
 849         (JSC::ProxyObject::getPrototype):
 850         (JSC::ProxyObject::visitChildren):
 851         * runtime/ProxyObject.h:
 852         * tests/es6.yaml:
 853         * tests/stress/proxy-get-prototype-of.js: Added.
 854         (assert):
 855         (throw.new.Error.let.handler.get getPrototypeOf):
 856         (throw.new.Error.get let):
 857         (throw.new.Error.get catch):
 858         (throw.new.Error):
 859         (assert.let.handler.getPrototypeOf):
 860         (assert.get let):
 861         (assert.get catch):
 862         (assert.):
 863         (let.handler.getPrototypeOf):
 864         (get let):
 865         (let.handler.has):
 866
 867 2016-03-07  Brian Burg  <bburg@apple.com>
 868
 869         Web Inspector: rename generated *EnumConversionHelpers.h to *TypeConversions.h
 870         https://bugs.webkit.org/show_bug.cgi?id=155121
 871         <rdar://problem/25010391>
 872
 873         Reviewed by Timothy Hatcher.
 874
 875         Split out this renaming from the work to generate factory method stubs for types.
 876
 877         * JavaScriptCore.xcodeproj/project.pbxproj:
 878         * inspector/scripts/codegen/__init__.py:
 879         * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
 880         (ObjCConfigurationImplementationGenerator.generate_output):
 881         * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
 882         (ObjCFrontendDispatcherImplementationGenerator.generate_output):
 883         * inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objc_conversion_helpers.py.
 884         * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
 885         (ObjCProtocolTypesImplementationGenerator.generate_output):
 886         * inspector/scripts/codegen/objc_generator_templates.py:
 887         * inspector/scripts/generate-inspector-protocol-bindings.py:
 888         (generate_from_specification):
 889
 890         Rebaseline tests after changing generator order.
 891
 892         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
 893         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
 894         * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
 895         * inspector/scripts/tests/expected/enum-values.json-result:
 896         * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
 897         * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
 898         * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
 899         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
 900         * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
 901         * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
 902         * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
 903         * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
 904         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
 905
 906 2016-03-07  Benjamin Poulain  <benjamin@webkit.org>
 907
 908         [JSC] Improve and64() and or64() with immediate on x86
 909         https://bugs.webkit.org/show_bug.cgi?id=155104
 910
 911         Reviewed by Geoffrey Garen.
 912
 913         GetButterflyReadOnly was doing:
 914             movq 0x8(%rbx), %r9
 915             movq $0xfffffffffffffffc, %r11
 916             andq %r11, %r9
 917         There is no need for the move to load the immediate,
 918         andq sign extend its immediate.
 919
 920         With this patch, we have:
 921             movq 0x8(%rbx), %r9
 922             andq $0xfffffffffffffffc, %r9
 923
 924         * assembler/MacroAssemblerX86_64.h:
 925         (JSC::MacroAssemblerX86_64::and64):
 926         (JSC::MacroAssemblerX86_64::or64):
 927
 928 2016-03-07  Brian Burg  <bburg@apple.com>
 929
 930         Web Inspector: It should be possible to initialize generated ObjC protocol types from an NSDictionary payload
 931         https://bugs.webkit.org/show_bug.cgi?id=155102
 932         <rdar://problem/25002015>
 933
 934         Reviewed by Timothy Hatcher.
 935
 936         In Objective-C code, we sometimes prefer to parse JSON using Cocoa rather
 937         than the InspectorValue classes. Support initializing protocol objects
 938         directly from an NSDictionary payload. This delegates validation of values to
 939         the setter methods that already exist on the protocol object classes.
 940
 941         * inspector/scripts/codegen/generate_objc_header.py:
 942         (ObjCHeaderGenerator._generate_type_interface):
 943         * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
 944         (ObjCProtocolTypesImplementationGenerator.generate_type_implementation):
 945         (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_payload):
 946         * inspector/scripts/codegen/objc_generator.py:
 947         (ObjCGenerator.payload_to_objc_expression_for_member):
 948         Add a new helper method to generate an expression to unpack the value
 949         from an NSDictionary. If it's not a primitive, the setter performs
 950         validation of the value's kind using -[NSObject isKindOfClass:].
 951
 952         Rebaseline relevant tests.
 953
 954         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
 955         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
 956         * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
 957         * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
 958         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
 959         * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
 960         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
 961
 962 2016-03-07  Benjamin Poulain  <benjamin@webkit.org>
 963
 964         [JSC] Simplify the overflow check of ArithAbs
 965         https://bugs.webkit.org/show_bug.cgi?id=155063
 966
 967         Reviewed by Geoffrey Garen.
 968
 969         The only integer that overflow abs(int32) is INT_MIN.
 970         For some reason, our code testing for that case
 971         was checking the top bit of the result specifically.
 972
 973         The code required a large immediate on x86 and an extra
 974         register on ARM64.
 975
 976         This patch turns the overflow check into a branch on
 977         the sign of the result.
 978
 979         * dfg/DFGSpeculativeJIT32_64.cpp:
 980         (JSC::DFG::SpeculativeJIT::compile):
 981         * dfg/DFGSpeculativeJIT64.cpp:
 982         (JSC::DFG::SpeculativeJIT::compile):
 983         * ftl/FTLLowerDFGToB3.cpp:
 984         (JSC::FTL::DFG::LowerDFGToB3::compileArithAbs):
 985         * jit/ThunkGenerators.cpp:
 986         (JSC::absThunkGenerator):
 987         * tests/stress/arith-abs-overflow.js: Added.
 988         (opaqueAbs):
 989
 990 2016-03-07  Benjamin Poulain  <bpoulain@apple.com>
 991
 992         [JSC] Improve how DFG zero Floating Point registers
 993         https://bugs.webkit.org/show_bug.cgi?id=155096
 994
 995         Reviewed by Geoffrey Garen.
 996
 997         DFG had a weird way of zeroing a FPR:
 998             -zero a GP.
 999             -move that to a FP.
1000
1001         Filip added moveZeroToDouble() for B3. This patch
1002         uses that in the lower tiers.
1003
1004         * assembler/MacroAssemblerARMv7.h:
1005         (JSC::MacroAssemblerARMv7::moveZeroToDouble):
1006         * dfg/DFGSpeculativeJIT64.cpp:
1007         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
1008         * jit/ThunkGenerators.cpp:
1009         (JSC::floorThunkGenerator):
1010         (JSC::roundThunkGenerator):
1011
1012 2016-03-07  Andreas Kling  <akling@apple.com>
1013
1014         REGRESSION (r197303): Web Inspector crashes web process when inspecting an element on TOT
1015         <https://webkit.org/b/154812>
1016
1017         Reviewed by Geoffrey Garen.
1018
1019         Guard against null pointer dereference for UnlinkedCodeBlocks that don't have any control flow
1020         profiling data.
1021
1022         * bytecode/CodeBlock.cpp:
1023         (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):
1024         * bytecode/UnlinkedCodeBlock.h:
1025         (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets):
1026
1027 2016-03-07  Benjamin Poulain  <benjamin@webkit.org>
1028
1029         [JSC] Remove a useless "Move" from baseline-JIT op_mul's fast path
1030         https://bugs.webkit.org/show_bug.cgi?id=155071
1031
1032         Reviewed by Geoffrey Garen.
1033
1034         We do not need to multiply to a scratch and then move the result
1035         to the destination. We can just multiply to the destination.
1036
1037         * jit/JITArithmetic.cpp:
1038         (JSC::JIT::emit_op_mul):
1039         * jit/JITMulGenerator.cpp:
1040         (JSC::JITMulGenerator::generateFastPath):
1041
1042 2016-03-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1043
1044         [JSC] StringObject.{put, defineOwnProperty} should realize indexed properties
1045         https://bugs.webkit.org/show_bug.cgi?id=155089
1046
1047         Reviewed by Geoffrey Garen.
1048
1049         Through implementing Reflect.set[1], we found StringObject does not obey the spec.
1050         StringObject::put should call putByIndex if the given propertyName is index.
1051         And StringObject::defineOwnProperty should recognize indexed properties since
1052         JSObject::defineOwnIndexedProperty is specialized to JSObject layout.
1053         Before calling JSObject::defineOwnProperty,
1054         StringObject should handle its special indexed own properties.
1055         It is responsibility of StringObject::defineOwnProperty.
1056
1057         And the logic is cleaned up by using validateAndApplyPropertyDescriptor.
1058
1059         [1]: https://bugs.webkit.org/show_bug.cgi?id=155024
1060
1061         * runtime/StringObject.cpp:
1062         (JSC::StringObject::put):
1063         (JSC::StringObject::putByIndex):
1064         (JSC::isStringOwnProperty):
1065         (JSC::StringObject::defineOwnProperty):
1066         (JSC::StringObject::deleteProperty):
1067         * tests/stress/string-object-define-own-property.js: Added.
1068         (shouldBe):
1069         (shouldThrow):
1070         * tests/stress/string-object-put-by-index.js: Added.
1071         (shouldBe):
1072         (shouldThrow):
1073         (testSloppy):
1074         (testStrict):
1075
1076 2016-03-06  Brian Burg  <bburg@apple.com>
1077
1078         Web Inspector: the protocol generator should have separate prefix options for Objective-C classes and filenames
1079         https://bugs.webkit.org/show_bug.cgi?id=155101
1080         <rdar://problem/25000053>
1081
1082         Reviewed by Timothy Hatcher.
1083
1084         It should be possible to generate Objective-C protocol types without prefixing all class names.
1085         The prefixes are only necessary when the generated files are part of a framework, but this isn't
1086         how the generated Objective-C frontend files are used.
1087
1088         Add a separate framework setting and switch over code to use the 'protocol_group' in filenames,
1089         and the 'objc_prefix' for Objective-C enum and class prefixes.
1090
1091         No tests need to be rebaselined because tests always set the protocol_group and objc_prefix
1092         to the same value.
1093
1094         * inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:
1095         (ObjCBackendDispatcherHeaderGenerator.output_filename):
1096         * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
1097         (ObjCConfigurationImplementationGenerator.output_filename):
1098         (ObjCConfigurationImplementationGenerator.generate_output):
1099         * inspector/scripts/codegen/generate_objc_configuration_header.py:
1100         (ObjCConfigurationHeaderGenerator.output_filename):
1101         (ObjCConfigurationHeaderGenerator.generate_output):
1102         (ObjCConfigurationHeaderGenerator._generate_configuration_interface_for_domains):
1103         * inspector/scripts/codegen/generate_objc_configuration_implementation.py:
1104         (ObjCBackendDispatcherImplementationGenerator.output_filename):
1105         (ObjCBackendDispatcherImplementationGenerator.generate_output):
1106         (ObjCBackendDispatcherImplementationGenerator._generate_configuration_implementation_for_domains):
1107         * inspector/scripts/codegen/generate_objc_conversion_helpers.py:
1108         (ObjCConversionHelpersGenerator.output_filename):
1109         * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
1110         (ObjCFrontendDispatcherImplementationGenerator.output_filename):
1111         (ObjCFrontendDispatcherImplementationGenerator.generate_output):
1112         * inspector/scripts/codegen/generate_objc_header.py:
1113         (ObjCHeaderGenerator.output_filename):
1114         * inspector/scripts/codegen/generate_objc_internal_header.py:
1115         (ObjCInternalHeaderGenerator.output_filename):
1116         (ObjCInternalHeaderGenerator.generate_output):
1117         * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
1118         (ObjCProtocolTypesImplementationGenerator.output_filename):
1119         (ObjCProtocolTypesImplementationGenerator.generate_output):
1120         * inspector/scripts/codegen/models.py:
1121         * inspector/scripts/codegen/objc_generator.py:
1122         (ObjCGenerator):
1123         (ObjCGenerator.protocol_name):
1124         (ObjCGenerator.objc_prefix):
1125
1126 2016-03-06  Brian Burg  <bburg@apple.com>
1127
1128         Unreviewed, rebaseline inspector protocol generator tests after r197563.
1129
1130         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
1131         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
1132         * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
1133         * inspector/scripts/tests/expected/enum-values.json-result:
1134         * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
1135
1136 2016-03-06  Benjamin Poulain  <benjamin@webkit.org>
1137
1138         [JSC] Improve DFG's Int32 ArithMul if one operand is a constant
1139         https://bugs.webkit.org/show_bug.cgi?id=155066
1140
1141         Reviewed by Filip Pizlo.
1142
1143         When multiplying an integer by a constant, DFG was doing quite
1144         a bit worse than baseline JIT.
1145         We were loading the constant into a register, doing the multiply,
1146         the checking the result and both operands for negative zero.
1147
1148         This patch changes:
1149         -Use the multiply-by-immediate form on x86.
1150         -Do as few checks as possible to detect negative-zero.
1151
1152         In most cases, this reduce the negative-zero checks
1153         to zero or one TEST+JUMP.
1154
1155         * assembler/MacroAssembler.h:
1156         (JSC::MacroAssembler::mul32):
1157         * dfg/DFGSpeculativeJIT.cpp:
1158         (JSC::DFG::SpeculativeJIT::compileArithMul):
1159
1160 2016-03-06  Benjamin Poulain  <benjamin@webkit.org>
1161
1162         [JSC] Remove a superfluous Move in front of every double unboxing
1163         https://bugs.webkit.org/show_bug.cgi?id=155064
1164
1165         Reviewed by Saam Barati.
1166
1167         Double unboxing was always doing:
1168             Move source, scratch
1169             Add64 tag, scratch
1170             IntToDouble scratch, fp
1171
1172         We do not need to "Move" to copy the source.
1173         Both x86 and ARM64 have an efficient 3 operands Add instruction.
1174
1175         * dfg/DFGSpeculativeJIT.cpp:
1176         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
1177         (JSC::DFG::SpeculativeJIT::compileDoubleRep):
1178         (JSC::DFG::SpeculativeJIT::speculateRealNumber):
1179         * dfg/DFGSpeculativeJIT.h:
1180         (JSC::DFG::SpeculativeJIT::unboxDouble):
1181         * jit/AssemblyHelpers.h:
1182         (JSC::AssemblyHelpers::unboxDoubleWithoutAssertions):
1183         (JSC::AssemblyHelpers::unboxDouble):
1184         (JSC::AssemblyHelpers::unboxDoubleNonDestructive):
1185
1186 2016-03-06  Benjamin Poulain  <benjamin@webkit.org>
1187
1188         [JSC] Use 3 operands Add in more places
1189         https://bugs.webkit.org/show_bug.cgi?id=155082
1190
1191         Reviewed by Filip Pizlo.
1192
1193         * assembler/MacroAssembler.h:
1194         (JSC::MacroAssembler::addPtr):
1195         (JSC::MacroAssembler::add32):
1196         * assembler/MacroAssemblerARMv7.h:
1197         (JSC::MacroAssemblerARMv7::add32):
1198         * dfg/DFGSpeculativeJIT.cpp:
1199         (JSC::DFG::SpeculativeJIT::compileArithAdd):
1200         The case with child1 constant is useless.
1201         The canonical form will have the constant as child2.
1202
1203         Also add register reuse for the fast-add.
1204         Registers are a scarce resource on x86.
1205
1206         * jit/CCallHelpers.h:
1207         (JSC::CCallHelpers::prepareForTailCallSlow):
1208         * yarr/YarrJIT.cpp:
1209         (JSC::Yarr::YarrGenerator::generate):
1210
1211 2016-03-06  Benjamin Poulain  <bpoulain@apple.com>
1212
1213         [JSC] Improve codegen of Compare and Test
1214         https://bugs.webkit.org/show_bug.cgi?id=155055
1215
1216         Reviewed by Filip Pizlo.
1217
1218         This patch introduces a few improvements on how we lower
1219         Compare and Test with immediates:
1220             -Add certain Immediate forms of ARM64.
1221             -Use CBZ/CBNZ when possible on ARM64.
1222             -When possible, convert a CMP into a TST
1223              On some hardware, we can issue more TST simultaneously.
1224
1225              On x86, any TST+Jump is candidate for macro-fusion.
1226              They are also smaller.
1227              (sections 3.4.2.2 and 3.5.1.9)
1228             -Do not load the mask immediate of a TST
1229              if it only contains ones (mostly useful for ARM64
1230              since that would not have been a valid immediate).
1231
1232         * assembler/MacroAssembler.h:
1233         (JSC::MacroAssembler::compare32):
1234         * assembler/MacroAssemblerARM64.h:
1235         (JSC::MacroAssemblerARM64::moveConditionallyAfterFloatingPointCompare):
1236         (JSC::MacroAssemblerARM64::moveDoubleConditionallyAfterFloatingPointCompare):
1237         This is somewhat unrelated but I found that out while working
1238         on moveDoubleConditionallyTest32:
1239             If "thenCase" and "dest" are assigned the same register
1240             by the allocator, then the first (f)fcsel would override
1241             the "thenCase" and the second fcsel would always be "elseCase".
1242
1243         This is covered by testb3 but was only uncovered
1244         after recent "Move" removals in lowering.
1245
1246         (JSC::MacroAssemblerARM64::moveConditionally32):
1247         (JSC::MacroAssemblerARM64::moveConditionally64):
1248         (JSC::MacroAssemblerARM64::moveConditionallyTest32):
1249         (JSC::MacroAssemblerARM64::moveDoubleConditionally32):
1250         (JSC::MacroAssemblerARM64::moveDoubleConditionally64):
1251         (JSC::MacroAssemblerARM64::moveDoubleConditionallyTest32):
1252         (JSC::MacroAssemblerARM64::branch32):
1253         (JSC::MacroAssemblerARM64::branch64):
1254         (JSC::MacroAssemblerARM64::branchTest32):
1255         (JSC::MacroAssemblerARM64::test32):
1256         The version taking an immediate was guarded by
1257         (cond == Zero) || (cond == NonZero). That is overzealous,
1258         and only needed for CBZ/CBNZ.
1259
1260         (JSC::MacroAssemblerARM64::branchTest64):
1261         (JSC::MacroAssemblerARM64::compare32):
1262         (JSC::MacroAssemblerARM64::compare64):
1263         (JSC::MacroAssemblerARM64::commuteCompareToZeroIntoTest):
1264         * assembler/MacroAssemblerX86Common.h:
1265         (JSC::MacroAssemblerX86Common::moveConditionally32):
1266         (JSC::MacroAssemblerX86Common::moveConditionallyTest32):
1267         (JSC::MacroAssemblerX86Common::branch32):
1268         (JSC::MacroAssemblerX86Common::test32):
1269         (JSC::MacroAssemblerX86Common::branchTest32):
1270         (JSC::MacroAssemblerX86Common::compare32):
1271         (JSC::MacroAssemblerX86Common::commuteCompareToZeroIntoTest):
1272         * assembler/MacroAssemblerX86_64.h:
1273         (JSC::MacroAssemblerX86_64::compare64):
1274         (JSC::MacroAssemblerX86_64::branch64):
1275         (JSC::MacroAssemblerX86_64::moveConditionally64):
1276         * b3/B3LowerToAir.cpp:
1277         (JSC::B3::Air::LowerToAir::createGenericCompare):
1278         Unfortunately this cannot be abstracted by the MacroAssembler.
1279         Those immediates are not valid, we have to pick the better
1280         for right away.
1281
1282         * b3/air/AirOpcode.opcodes:
1283         * b3/testb3.cpp:
1284         (JSC::B3::int64Operands):
1285         (JSC::B3::modelCompare):
1286         (JSC::B3::testCompareImpl):
1287         (JSC::B3::testCompare):
1288         (JSC::B3::b3Pow):
1289         (JSC::B3::testPowDoubleByIntegerLoop):
1290         Some versions of pow(double, int) do not return
1291         the exact same bits as our integer loop.
1292         Added a new version to have the same behavior
1293         as the B3 loop.
1294
1295         (JSC::B3::run):
1296         * dfg/DFGSpeculativeJIT.cpp:
1297         (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):
1298         * dfg/DFGSpeculativeJIT64.cpp:
1299         (JSC::DFG::SpeculativeJIT::compileInt32Compare):
1300         Comparing to an immediate is super common. Do not waste
1301         a register for that!
1302
1303 2016-03-06  Filip Pizlo  <fpizlo@apple.com>
1304
1305         Unreviewed, fix build. This was a messed up merge.
1306
1307         * ftl/FTLLowerDFGToB3.cpp:
1308         (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
1309
1310 2016-03-06  Filip Pizlo  <fpizlo@apple.com>
1311
1312         DFG should know how to speculate StringOrOther
1313         https://bugs.webkit.org/show_bug.cgi?id=155094
1314
1315         Reviewed by Saam Barati.
1316
1317         Any code that processes the regexp matches array was previously doing a relatively expensive
1318         Branch(Untyped:). This introduces a new use kind called StringOrOther, which is perfect for
1319         code that loops over the matches array and branches on the entries being non-empty.
1320
1321         To do this, I needed to introduce code into the FTL that creates new blocks. We still had that
1322         awful FTL_NEW_BLOCK idiom since the only way to debug LLVM IR was to ascribe names to basic
1323         blocks. B3 IR is inherently more debuggable since unlike LLVM, B3 knows how to always respect
1324         code origin, and it knows how to print the code origin nicely in the dumps. So, rather than
1325         continue using FTL_NEW_BLOCK(m_out, ("things")), I replaced all of that stuff with
1326         m_out.newBlock(). It's much nicer that way.
1327
1328         This is a tiny speed-up on Octane/regexp at best. I was hoping for more. Oh well.
1329
1330         * bytecode/SpeculatedType.h:
1331         (JSC::isStringSpeculation):
1332         (JSC::isStringOrOtherSpeculation):
1333         (JSC::isSymbolSpeculation):
1334         * dfg/DFGFixupPhase.cpp:
1335         (JSC::DFG::FixupPhase::fixupNode):
1336         * dfg/DFGNode.h:
1337         (JSC::DFG::Node::shouldSpeculateString):
1338         (JSC::DFG::Node::shouldSpeculateStringOrOther):
1339         (JSC::DFG::Node::shouldSpeculateStringObject):
1340         * dfg/DFGSafeToExecute.h:
1341         (JSC::DFG::SafeToExecuteEdge::operator()):
1342         * dfg/DFGSpeculativeJIT.cpp:
1343         (JSC::DFG::SpeculativeJIT::compileStringZeroLength):
1344         (JSC::DFG::SpeculativeJIT::compileLogicalNotStringOrOther):
1345         (JSC::DFG::SpeculativeJIT::emitStringBranch):
1346         (JSC::DFG::SpeculativeJIT::emitStringOrOtherBranch):
1347         (JSC::DFG::SpeculativeJIT::compileConstantStoragePointer):
1348         (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
1349         (JSC::DFG::SpeculativeJIT::speculateString):
1350         (JSC::DFG::SpeculativeJIT::speculateStringOrOther):
1351         (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
1352         (JSC::DFG::SpeculativeJIT::speculate):
1353         * dfg/DFGSpeculativeJIT.h:
1354         * dfg/DFGSpeculativeJIT32_64.cpp:
1355         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
1356         (JSC::DFG::SpeculativeJIT::emitBranch):
1357         * dfg/DFGSpeculativeJIT64.cpp:
1358         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
1359         (JSC::DFG::SpeculativeJIT::emitBranch):
1360         * dfg/DFGUseKind.cpp:
1361         (WTF::printInternal):
1362         * dfg/DFGUseKind.h:
1363         (JSC::DFG::typeFilterFor):
1364         * ftl/FTLCapabilities.cpp:
1365         (JSC::FTL::canCompile):
1366         * ftl/FTLLowerDFGToB3.cpp:
1367         (JSC::FTL::DFG::LowerDFGToB3::lower):
1368         (JSC::FTL::DFG::LowerDFGToB3::compileDoubleRep):
1369         (JSC::FTL::DFG::LowerDFGToB3::compileBooleanToNumber):
1370         (JSC::FTL::DFG::LowerDFGToB3::compileToThis):
1371         (JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
1372         (JSC::FTL::DFG::LowerDFGToB3::compileArithDiv):
1373         (JSC::FTL::DFG::LowerDFGToB3::compileArithMod):
1374         (JSC::FTL::DFG::LowerDFGToB3::compileArithMinOrMax):
1375         (JSC::FTL::DFG::LowerDFGToB3::compileArithPow):
1376         (JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
1377         (JSC::FTL::DFG::LowerDFGToB3::compileCheckStructure):
1378         (JSC::FTL::DFG::LowerDFGToB3::compileArrayifyToStructure):
1379         (JSC::FTL::DFG::LowerDFGToB3::compileGetById):
1380         (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
1381         (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
1382         (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
1383         (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
1384         (JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):
1385         (JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
1386         (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
1387         (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
1388         (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
1389         (JSC::FTL::DFG::LowerDFGToB3::compileCopyRest):
1390         (JSC::FTL::DFG::LowerDFGToB3::compileGetRestLength):
1391         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
1392         (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
1393         (JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructor):
1394         (JSC::FTL::DFG::LowerDFGToB3::compileToPrimitive):
1395         (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
1396         (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
1397         (JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
1398         (JSC::FTL::DFG::LowerDFGToB3::compileStringFromCharCode):
1399         (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
1400         (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
1401         (JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
1402         (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
1403         (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
1404         (JSC::FTL::DFG::LowerDFGToB3::compileSwitch):
1405         (JSC::FTL::DFG::LowerDFGToB3::compileIsString):
1406         (JSC::FTL::DFG::LowerDFGToB3::compileIsObject):
1407         (JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull):
1408         (JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
1409         (JSC::FTL::DFG::LowerDFGToB3::compileTypeOf):
1410         (JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
1411         (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
1412         (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
1413         (JSC::FTL::DFG::LowerDFGToB3::compileHasStructureProperty):
1414         (JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
1415         (JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorStructurePname):
1416         (JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorGenericPname):
1417         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
1418         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
1419         (JSC::FTL::DFG::LowerDFGToB3::compileCheckWatchdogTimer):
1420         (JSC::FTL::DFG::LowerDFGToB3::checkStructure):
1421         (JSC::FTL::DFG::LowerDFGToB3::numberOrNotCellToInt32):
1422         (JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
1423         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
1424         (JSC::FTL::DFG::LowerDFGToB3::loadVectorWithBarrier):
1425         (JSC::FTL::DFG::LowerDFGToB3::copyBarrier):
1426         (JSC::FTL::DFG::LowerDFGToB3::loadVectorReadOnly):
1427         (JSC::FTL::DFG::LowerDFGToB3::compareEqObjectOrOtherToObject):
1428         (JSC::FTL::DFG::LowerDFGToB3::nonSpeculativeCompare):
1429         (JSC::FTL::DFG::LowerDFGToB3::stringsEqual):
1430         (JSC::FTL::DFG::LowerDFGToB3::allocateCell):
1431         (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
1432         (JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorageAndGetEnd):
1433         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
1434         (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
1435         (JSC::FTL::DFG::LowerDFGToB3::boolify):
1436         (JSC::FTL::DFG::LowerDFGToB3::equalNullOrUndefined):
1437         (JSC::FTL::DFG::LowerDFGToB3::contiguousPutByValOutOfBounds):
1438         (JSC::FTL::DFG::LowerDFGToB3::switchString):
1439         (JSC::FTL::DFG::LowerDFGToB3::switchStringRecurse):
1440         (JSC::FTL::DFG::LowerDFGToB3::buildTypeOf):
1441         (JSC::FTL::DFG::LowerDFGToB3::doubleToInt32):
1442         (JSC::FTL::DFG::LowerDFGToB3::sensibleDoubleToInt32):
1443         (JSC::FTL::DFG::LowerDFGToB3::strictInt52ToJSValue):
1444         (JSC::FTL::DFG::LowerDFGToB3::jsValueToStrictInt52):
1445         (JSC::FTL::DFG::LowerDFGToB3::convertDoubleToInt32):
1446         (JSC::FTL::DFG::LowerDFGToB3::speculate):
1447         (JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
1448         (JSC::FTL::DFG::LowerDFGToB3::speculateObjectOrOther):
1449         (JSC::FTL::DFG::LowerDFGToB3::speculateString):
1450         (JSC::FTL::DFG::LowerDFGToB3::speculateStringOrOther):
1451         (JSC::FTL::DFG::LowerDFGToB3::speculateStringIdent):
1452         (JSC::FTL::DFG::LowerDFGToB3::speculateStringOrStringObject):
1453         (JSC::FTL::DFG::LowerDFGToB3::speculateRealNumber):
1454         (JSC::FTL::DFG::LowerDFGToB3::speculateNotStringVar):
1455         (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
1456         (JSC::FTL::DFG::LowerDFGToB3::callCheck):
1457         * ftl/FTLOutput.cpp:
1458         (JSC::FTL::Output::initialize):
1459         (JSC::FTL::Output::newBlock):
1460         (JSC::FTL::Output::check):
1461         * ftl/FTLOutput.h:
1462         (JSC::FTL::Output::setFrequency):
1463         (JSC::FTL::Output::insertNewBlocksBefore):
1464
1465 2016-03-06  Saam Barati  <sbarati@apple.com>
1466
1467         [[GetPrototypeOf]] should be a fully virtual method in the method table
1468         https://bugs.webkit.org/show_bug.cgi?id=155002
1469
1470         Reviewed by Filip Pizlo.
1471
1472         This patch makes us more consistent with how the ES6 specification models the
1473         [[GetPrototypeOf]] trap. Moving this method into ClassInfo::methodTable
1474         is a prerequisite for implementing Proxy.[[GetPrototypeOf]]. This patch
1475         still allows directly accessing the prototype for situations where this
1476         is the desired behavior. This is equivalent to getting the internal
1477         [[Prototype]] field as described in the specification.
1478
1479         * API/JSObjectRef.cpp:
1480         (JSObjectGetPrototype):
1481         (JSObjectSetPrototype):
1482         * dfg/DFGOperations.cpp:
1483         * dfg/DFGOperations.h:
1484         * dfg/DFGSpeculativeJIT.cpp:
1485         (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
1486         (JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags):
1487         * ftl/FTLLowerDFGToB3.cpp:
1488         (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
1489         (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOfCustom):
1490         * jit/JITOpcodes.cpp:
1491         (JSC::JIT::emit_op_instanceof):
1492         (JSC::JIT::emitSlow_op_instanceof):
1493         * jit/JITOpcodes32_64.cpp:
1494         (JSC::JIT::emit_op_instanceof):
1495         (JSC::JIT::emitSlow_op_instanceof):
1496         * jit/JITOperations.cpp:
1497         * jit/JITOperations.h:
1498         * jsc.cpp:
1499         (functionCreateProxy):
1500         * llint/LLIntSlowPaths.cpp:
1501         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1502         * llint/LowLevelInterpreter.asm:
1503         * llint/LowLevelInterpreter32_64.asm:
1504         * llint/LowLevelInterpreter64.asm:
1505         * runtime/ArrayPrototype.cpp:
1506         (JSC::speciesConstructArray):
1507         * runtime/ClassInfo.h:
1508         * runtime/FunctionPrototype.cpp:
1509         (JSC::functionProtoFuncBind):
1510         * runtime/IntlCollatorPrototype.cpp:
1511         (JSC::IntlCollatorPrototypeGetterCompare):
1512         * runtime/IntlDateTimeFormatPrototype.cpp:
1513         (JSC::IntlDateTimeFormatPrototypeGetterFormat):
1514         * runtime/IntlNumberFormatPrototype.cpp:
1515         (JSC::IntlNumberFormatPrototypeGetterFormat):
1516         * runtime/JSBoundFunction.cpp:
1517         (JSC::hasInstanceBoundFunction):
1518         (JSC::getBoundFunctionStructure):
1519         (JSC::JSBoundFunction::create):
1520         * runtime/JSBoundFunction.h:
1521         * runtime/JSCJSValue.cpp:
1522         (JSC::JSValue::putToPrimitive):
1523         * runtime/JSCell.cpp:
1524         (JSC::JSCell::setPrototype):
1525         (JSC::JSCell::getPrototype):
1526         * runtime/JSCell.h:
1527         * runtime/JSGlobalObject.cpp:
1528         (JSC::JSGlobalObject::init):
1529         (JSC::JSGlobalObject::hasLegacyProfiler):
1530         (JSC::lastInPrototypeChain):
1531         (JSC::JSGlobalObject::objectPrototypeIsSane):
1532         (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
1533         (JSC::JSGlobalObject::stringPrototypeChainIsSane):
1534         * runtime/JSGlobalObject.h:
1535         (JSC::JSGlobalObject::finishCreation):
1536         * runtime/JSGlobalObjectFunctions.cpp:
1537         (JSC::GlobalFuncProtoGetterFunctor::GlobalFuncProtoGetterFunctor):
1538         (JSC::GlobalFuncProtoGetterFunctor::operator()):
1539         (JSC::globalFuncProtoGetter):
1540         * runtime/JSLexicalEnvironment.cpp:
1541         (JSC::JSLexicalEnvironment::getOwnPropertySlot):
1542         * runtime/JSObject.cpp:
1543         (JSC::JSObject::calculatedClassName):
1544         (JSC::JSObject::putInlineSlow):
1545         (JSC::JSObject::setPrototypeWithCycleCheck):
1546         (JSC::JSObject::setPrototype):
1547         (JSC::JSObject::getPrototype):
1548         (JSC::JSObject::defaultHasInstance):
1549         (JSC::objectPrivateFuncInstanceOf):
1550         (JSC::JSObject::getPropertyNames):
1551         (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
1552         (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
1553         (JSC::JSObject::getGenericPropertyNames):
1554         * runtime/JSObject.h:
1555         (JSC::JSObject::finishCreation):
1556         (JSC::JSObject::JSObject):
1557         (JSC::JSObject::getPrototypeDirect):
1558         (JSC::JSObject::getPrototype):
1559         (JSC::JSObject::getOwnNonIndexPropertySlot):
1560         (JSC::JSObject::getPropertySlot):
1561         (JSC::JSObject::getNonIndexPropertySlot):
1562         (JSC::JSObject::prototype): Deleted.
1563         * runtime/JSObjectInlines.h:
1564         (JSC::JSObject::canPerformFastPutInline):
1565         * runtime/JSProxy.cpp:
1566         (JSC::JSProxy::setTarget):
1567         * runtime/JSTypedArrayViewConstructor.cpp:
1568         (JSC::constructTypedArrayView):
1569         * runtime/ObjectConstructor.cpp:
1570         (JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
1571         (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
1572         (JSC::objectConstructorGetPrototypeOf):
1573         * runtime/ObjectPrototype.cpp:
1574         (JSC::objectProtoFuncIsPrototypeOf):
1575         * runtime/ProxyObject.cpp:
1576         (JSC::performProxyGet):
1577         (JSC::ProxyObject::performSetPrototype):
1578         * runtime/StructureInlines.h:
1579         (JSC::Structure::isValid):
1580         * tests/stress/proxy-has-property.js:
1581         (assert.let.h1.has):
1582         (assert.let.h2.has):
1583         (assert):
1584
1585 2016-03-06  Commit Queue  <commit-queue@webkit.org>
1586
1587         Unreviewed, rolling out r197645.
1588         https://bugs.webkit.org/show_bug.cgi?id=155097
1589
1590         "Doesn't build properly when building entire webkit"
1591         (Requested by saamyjoon on #webkit).
1592
1593         Reverted changeset:
1594
1595         "[[GetPrototypeOf]] should be a fully virtual method in the
1596         method table"
1597         https://bugs.webkit.org/show_bug.cgi?id=155002
1598         http://trac.webkit.org/changeset/197645
1599
1600 2016-03-06  Saam barati  <sbarati@apple.com>
1601
1602         [[GetPrototypeOf]] should be a fully virtual method in the method table
1603         https://bugs.webkit.org/show_bug.cgi?id=155002
1604
1605         Reviewed by Filip Pizlo.
1606
1607         This patch makes us more consistent with how the ES6 specification models the
1608         [[GetPrototypeOf]] trap. Moving this method into ClassInfo::methodTable
1609         is a prerequisite for implementing Proxy.[[GetPrototypeOf]]. This patch
1610         still allows directly accessing the prototype for situations where this
1611         is the desired behavior. This is equivalent to getting the internal
1612         [[Prototype]] field as described in the specification.
1613
1614         * API/JSObjectRef.cpp:
1615         (JSObjectGetPrototype):
1616         (JSObjectSetPrototype):
1617         * dfg/DFGOperations.cpp:
1618         * dfg/DFGOperations.h:
1619         * dfg/DFGSpeculativeJIT.cpp:
1620         (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
1621         (JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags):
1622         * ftl/FTLLowerDFGToB3.cpp:
1623         (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
1624         (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOfCustom):
1625         * jit/JITOpcodes.cpp:
1626         (JSC::JIT::emit_op_instanceof):
1627         (JSC::JIT::emitSlow_op_instanceof):
1628         * jit/JITOpcodes32_64.cpp:
1629         (JSC::JIT::emit_op_instanceof):
1630         (JSC::JIT::emitSlow_op_instanceof):
1631         * jit/JITOperations.cpp:
1632         * jit/JITOperations.h:
1633         * jsc.cpp:
1634         (functionCreateProxy):
1635         * llint/LLIntSlowPaths.cpp:
1636         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1637         * llint/LowLevelInterpreter.asm:
1638         * llint/LowLevelInterpreter32_64.asm:
1639         * llint/LowLevelInterpreter64.asm:
1640         * runtime/ArrayPrototype.cpp:
1641         (JSC::speciesConstructArray):
1642         * runtime/ClassInfo.h:
1643         * runtime/FunctionPrototype.cpp:
1644         (JSC::functionProtoFuncBind):
1645         * runtime/IntlCollatorPrototype.cpp:
1646         (JSC::IntlCollatorPrototypeGetterCompare):
1647         * runtime/IntlDateTimeFormatPrototype.cpp:
1648         (JSC::IntlDateTimeFormatPrototypeGetterFormat):
1649         * runtime/IntlNumberFormatPrototype.cpp:
1650         (JSC::IntlNumberFormatPrototypeGetterFormat):
1651         * runtime/JSBoundFunction.cpp:
1652         (JSC::hasInstanceBoundFunction):
1653         (JSC::getBoundFunctionStructure):
1654         (JSC::JSBoundFunction::create):
1655         * runtime/JSBoundFunction.h:
1656         * runtime/JSCJSValue.cpp:
1657         (JSC::JSValue::putToPrimitive):
1658         * runtime/JSCell.cpp:
1659         (JSC::JSCell::setPrototype):
1660         (JSC::JSCell::getPrototype):
1661         * runtime/JSCell.h:
1662         * runtime/JSGlobalObject.cpp:
1663         (JSC::JSGlobalObject::init):
1664         (JSC::JSGlobalObject::hasLegacyProfiler):
1665         (JSC::lastInPrototypeChain):
1666         (JSC::JSGlobalObject::objectPrototypeIsSane):
1667         (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
1668         (JSC::JSGlobalObject::stringPrototypeChainIsSane):
1669         * runtime/JSGlobalObject.h:
1670         (JSC::JSGlobalObject::finishCreation):
1671         * runtime/JSGlobalObjectFunctions.cpp:
1672         (JSC::GlobalFuncProtoGetterFunctor::GlobalFuncProtoGetterFunctor):
1673         (JSC::GlobalFuncProtoGetterFunctor::operator()):
1674         (JSC::globalFuncProtoGetter):
1675         * runtime/JSLexicalEnvironment.cpp:
1676         (JSC::JSLexicalEnvironment::getOwnPropertySlot):
1677         * runtime/JSObject.cpp:
1678         (JSC::JSObject::calculatedClassName):
1679         (JSC::JSObject::putInlineSlow):
1680         (JSC::JSObject::setPrototypeWithCycleCheck):
1681         (JSC::JSObject::setPrototype):
1682         (JSC::JSObject::getPrototype):
1683         (JSC::JSObject::defaultHasInstance):
1684         (JSC::objectPrivateFuncInstanceOf):
1685         (JSC::JSObject::getPropertyNames):
1686         (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
1687         (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
1688         (JSC::JSObject::getGenericPropertyNames):
1689         * runtime/JSObject.h:
1690         (JSC::JSObject::finishCreation):
1691         (JSC::JSObject::JSObject):
1692         (JSC::JSObject::getPrototypeDirect):
1693         (JSC::JSObject::getPrototype):
1694         (JSC::JSObject::getOwnNonIndexPropertySlot):
1695         (JSC::JSObject::getPropertySlot):
1696         (JSC::JSObject::getNonIndexPropertySlot):
1697         (JSC::JSObject::prototype): Deleted.
1698         * runtime/JSObjectInlines.h:
1699         (JSC::JSObject::canPerformFastPutInline):
1700         * runtime/JSProxy.cpp:
1701         (JSC::JSProxy::setTarget):
1702         * runtime/JSTypedArrayViewConstructor.cpp:
1703         (JSC::constructTypedArrayView):
1704         * runtime/ObjectConstructor.cpp:
1705         (JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
1706         (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
1707         (JSC::objectConstructorGetPrototypeOf):
1708         * runtime/ObjectPrototype.cpp:
1709         (JSC::objectProtoFuncIsPrototypeOf):
1710         * runtime/ProxyObject.cpp:
1711         (JSC::performProxyGet):
1712         (JSC::ProxyObject::performSetPrototype):
1713         * runtime/StructureInlines.h:
1714         (JSC::Structure::isValid):
1715         * tests/stress/proxy-has-property.js:
1716         (assert.let.h1.has):
1717         (assert.let.h2.has):
1718         (assert):
1719
1720 2016-03-06  Filip Pizlo  <fpizlo@apple.com>
1721
1722         RegExpMatchesArray doesn't know how to have a bad time
1723         https://bugs.webkit.org/show_bug.cgi?id=155069
1724
1725         Reviewed by Yusuke Suzuki.
1726
1727         In trunk if we are having a bad time, the regexp matches array is still allocated with a
1728         non-slow-put indexing shape, which makes it have the wrong behavior on indexed setters on
1729         the prototype chain.
1730
1731         Getting this to work right requires introducing bad time code paths into the regexp matches
1732         array. It also requires something more drastic: making this code not play games with the
1733         global object. The code that creates the matches array needs to have the actual global
1734         object of the regexp native function that it's logically created by.
1735
1736         This is totally different from how we've handled global objects in the past because it means
1737         that the global object is not a constant. Normally we can make it a constant because a
1738         script executable will know its global object. But with native functions, it's the function
1739         instance that knows the global object - not the native executable. When we inline a native
1740         intrinsic, we are guaranteed to know the native executable but we're not guaranteed to know
1741         the functon instance. This means that the global object may be a variable that gets computed
1742         by looking at the instance at run-time. So, the RegExpExec/RegExpTest nodes in DFG IR now
1743         take a global object child. That also meant adding a new node type, GetGlobalObject, which
1744         does the thing to the callee that CallFrame::lexicalGlobalObject() would have done.
1745         Eventually, we'll probably have to make other native intrinsics also use GetGlobalObject. It
1746         turns out that this really isn't so bad because usually it's constant-folded anyway, since
1747         although the intrinsic code supports executable-based inlining (which leaves the callee
1748         instance as an unknown), it happens rarely for intrinsics. So, conveying the global object
1749         via a child isn't any worse than conveying it via meta-data, and it's probably better than
1750         telling the inliner not to do executable-based inlining of native intrinsics. That would
1751         have been a confusing special-case.
1752
1753         This is perf-neutral on my machines but it fixes a bug and it unlocks some interesting
1754         possibilities. For example, RegExpExec can now make a firm promise about the type of array
1755         it's creating.
1756
1757         This also contains some other changes:
1758
1759         - We are now using Structure::addPropertyTransition() in a lot of places even though it was
1760           meant to be an internal method with a quirky contract - for example if only works if you
1761           know that there is not existing transition. This relaxes this constraint.
1762
1763         - Restores the use of "*" for heap references in JSString.h. It's very unusual to have heap
1764           references pointed at with "&", since we don't currently do that anywhere. The fact that
1765           it was using the wrong reference type also meant that the code couldn't elegantly make use
1766           of some our GC pointer helpers like jsCast<>.
1767
1768         * dfg/DFGAbstractInterpreterInlines.h:
1769         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1770         * dfg/DFGByteCodeParser.cpp:
1771         (JSC::DFG::ByteCodeParser::attemptToInlineCall):
1772         (JSC::DFG::ByteCodeParser::handleMinMax):
1773         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
1774         * dfg/DFGClobberize.h:
1775         (JSC::DFG::clobberize):
1776         * dfg/DFGDoesGC.cpp:
1777         (JSC::DFG::doesGC):
1778         * dfg/DFGFixupPhase.cpp:
1779         (JSC::DFG::FixupPhase::fixupNode):
1780         * dfg/DFGNodeType.h:
1781         * dfg/DFGOperations.cpp:
1782         * dfg/DFGOperations.h:
1783         * dfg/DFGPredictionPropagationPhase.cpp:
1784         (JSC::DFG::PredictionPropagationPhase::propagate):
1785         * dfg/DFGSafeToExecute.h:
1786         (JSC::DFG::safeToExecute):
1787         * dfg/DFGSpeculativeJIT.cpp:
1788         (JSC::DFG::SpeculativeJIT::compileSkipScope):
1789         (JSC::DFG::SpeculativeJIT::compileGetGlobalObject):
1790         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
1791         * dfg/DFGSpeculativeJIT.h:
1792         (JSC::DFG::SpeculativeJIT::callOperation):
1793         * dfg/DFGSpeculativeJIT32_64.cpp:
1794         (JSC::DFG::SpeculativeJIT::compile):
1795         * dfg/DFGSpeculativeJIT64.cpp:
1796         (JSC::DFG::SpeculativeJIT::compile):
1797         * ftl/FTLCapabilities.cpp:
1798         (JSC::FTL::canCompile):
1799         * ftl/FTLLowerDFGToB3.cpp:
1800         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1801         (JSC::FTL::DFG::LowerDFGToB3::compileSkipScope):
1802         (JSC::FTL::DFG::LowerDFGToB3::compileGetGlobalObject):
1803         (JSC::FTL::DFG::LowerDFGToB3::compileGetClosureVar):
1804         (JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
1805         (JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
1806         (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
1807         * jit/JITOperations.h:
1808         * runtime/JSGlobalObject.cpp:
1809         (JSC::JSGlobalObject::init):
1810         (JSC::JSGlobalObject::haveABadTime):
1811         (JSC::JSGlobalObject::visitChildren):
1812         * runtime/JSGlobalObject.h:
1813         * runtime/JSObject.h:
1814         (JSC::JSObject::putDirectInternal):
1815         * runtime/JSString.h:
1816         (JSC::jsString):
1817         (JSC::jsSubstring):
1818         * runtime/RegExpCachedResult.cpp:
1819         (JSC::RegExpCachedResult::lastResult):
1820         * runtime/RegExpMatchesArray.cpp:
1821         (JSC::tryCreateUninitializedRegExpMatchesArray):
1822         (JSC::createRegExpMatchesArray):
1823         (JSC::createStructureImpl):
1824         (JSC::createRegExpMatchesArrayStructure):
1825         (JSC::createRegExpMatchesArraySlowPutStructure):
1826         * runtime/RegExpMatchesArray.h:
1827         * runtime/RegExpObject.cpp:
1828         (JSC::RegExpObject::put):
1829         (JSC::RegExpObject::exec):
1830         (JSC::RegExpObject::match):
1831         * runtime/RegExpObject.h:
1832         (JSC::RegExpObject::getLastIndex):
1833         (JSC::RegExpObject::test):
1834         * runtime/RegExpPrototype.cpp:
1835         (JSC::regExpProtoFuncTest):
1836         (JSC::regExpProtoFuncExec):
1837         (JSC::regExpProtoFuncCompile):
1838         * runtime/StringPrototype.cpp:
1839         (JSC::stringProtoFuncMatch):
1840         * runtime/Structure.cpp:
1841         (JSC::Structure::suggestedArrayStorageTransition):
1842         (JSC::Structure::addPropertyTransition):
1843         (JSC::Structure::addNewPropertyTransition):
1844         * runtime/Structure.h:
1845         * tests/stress/regexp-matches-array-bad-time.js: Added.
1846         * tests/stress/regexp-matches-array-slow-put.js: Added.
1847
1848 2016-03-06  Yusuke Suzuki  <utatane.tea@gmail.com>
1849
1850         [JSC] RegExp#lastIndex should handle writable attribute when defining in defineOwnProperty path
1851         https://bugs.webkit.org/show_bug.cgi?id=155093
1852
1853         Reviewed by Filip Pizlo.
1854
1855         Before this patch, `setLastIndex(ExecState* exec, size_t lastIndex)` always overwrites the existing value
1856         regardless of writable attribute.
1857         And when defining RegExp#lastIndex in defineOwnProperty, we need to define the value first
1858         before making the attribute readonly. After changing the writable attribute, we cannot define the value.
1859
1860         * runtime/RegExpObject.cpp:
1861         (JSC::RegExpObject::defineOwnProperty):
1862         * runtime/RegExpObject.h:
1863         (JSC::RegExpObject::setLastIndex):
1864         * tests/stress/regexp-last-index-writable.js: Added.
1865         (shouldBe):
1866         (shouldThrow):
1867         (regExpLastIndex):
1868
1869 2016-03-05  Filip Pizlo  <fpizlo@apple.com>
1870
1871         The most aggressive form of RegExpTest/RegExpExec should speculate more aggressively than just cell
1872         https://bugs.webkit.org/show_bug.cgi?id=154900
1873
1874         Reviewed by Saam Barati.
1875
1876         These old operations used to speculate cell. That's what they did when they were first
1877         introduced. That was probably about as good as they could do back then because we didn't have
1878         very powerful checks. Now we have powerful checks, so we can do this right.
1879
1880         The most profitable thing to check is that child1 is a RegExpObject and child2 is a JSString.
1881         Sometimes though, we will not know what child2 is even though we know that child1 is a
1882         RegExpObject. So, this patch means that RegExpExec/RegExpTest have the following overloads:
1883
1884             RegExpExec(RegExpObject:, String:)
1885             RegExpExec(RegExpObject:, Untyped:)
1886             RegExpExec(Untyped:, Untyped:)
1887
1888         This shaves off some type checks in Octane/regexp. It also cleans up some problems in our
1889         modeling of the effectfulness of these operations.
1890
1891         * dfg/DFGAbstractInterpreterInlines.h:
1892         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1893         * dfg/DFGClobberize.h:
1894         (JSC::DFG::clobberize):
1895         * dfg/DFGFixupPhase.cpp:
1896         (JSC::DFG::FixupPhase::fixupNode):
1897         * dfg/DFGOperations.cpp:
1898         * dfg/DFGOperations.h:
1899         * dfg/DFGSpeculativeJIT.h:
1900         (JSC::DFG::SpeculativeJIT::callOperation):
1901         * dfg/DFGSpeculativeJIT32_64.cpp:
1902         (JSC::DFG::SpeculativeJIT::compile):
1903         * dfg/DFGSpeculativeJIT64.cpp:
1904         (JSC::DFG::SpeculativeJIT::compile):
1905         * ftl/FTLLowerDFGToB3.cpp:
1906         (JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
1907         (JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
1908         * jit/JITOperations.h:
1909
1910 2016-03-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1911
1912         [ES6] Support Reflect.construct
1913         https://bugs.webkit.org/show_bug.cgi?id=147330
1914
1915         Reviewed by Saam Barati.
1916
1917         Based on Saam's r196868, this patch adds support for Reflect.construct.
1918         This patch implements OrdinaryCreateFromConstructor[1] for fallback cases.
1919         This path is rarely taken. For example,
1920
1921             Reflect.construct(function () { }, [], Map);
1922
1923         In this case, the `new.target` becomes `Map`.
1924         So we should create an object that `__proto__` is `Map.prototype`.
1925
1926         And to allow forward declaration (and encouraging strong type checking), we change
1927         ConstructType, CallType to C++11 enum class.
1928
1929         [1]: http://ecma-international.org/ecma-262/6.0/#sec-ordinarycreatefromconstructor
1930
1931         * API/JSCallbackConstructor.cpp:
1932         (JSC::JSCallbackConstructor::getConstructData):
1933         * API/JSCallbackFunction.cpp:
1934         (JSC::JSCallbackFunction::getCallData):
1935         * API/JSCallbackObjectFunctions.h:
1936         (JSC::JSCallbackObject<Parent>::getConstructData):
1937         (JSC::JSCallbackObject<Parent>::getCallData):
1938         * API/JSObjectRef.cpp:
1939         (JSObjectIsFunction):
1940         (JSObjectCallAsFunction):
1941         (JSObjectIsConstructor):
1942         (JSObjectCallAsConstructor):
1943         * API/ObjCCallbackFunction.mm:
1944         (JSC::ObjCCallbackFunction::getCallData):
1945         (JSC::ObjCCallbackFunction::getConstructData):
1946         * bindings/ScriptFunctionCall.cpp:
1947         (Deprecated::ScriptFunctionCall::call):
1948         * bindings/ScriptValue.cpp:
1949         (Deprecated::ScriptValue::isFunction):
1950         * builtins/ReflectObject.js:
1951         * dfg/DFGOperations.cpp:
1952         * inspector/InjectedScriptManager.cpp:
1953         (Inspector::InjectedScriptManager::createInjectedScript):
1954         * interpreter/Interpreter.cpp:
1955         (JSC::sizeOfVarargs):
1956         (JSC::Interpreter::execute):
1957         (JSC::Interpreter::executeCall):
1958         (JSC::Interpreter::executeConstruct):
1959         * jit/JITOperations.cpp:
1960         * llint/LLIntSlowPaths.cpp:
1961         (JSC::LLInt::handleHostCall):
1962         * runtime/ArrayConstructor.cpp:
1963         (JSC::ArrayConstructor::getConstructData):
1964         (JSC::ArrayConstructor::getCallData):
1965         * runtime/ArrayPrototype.cpp:
1966         (JSC::arrayProtoFuncToString):
1967         (JSC::arrayProtoFuncToLocaleString):
1968         (JSC::getLength): Deleted.
1969         * runtime/BooleanConstructor.cpp:
1970         (JSC::BooleanConstructor::getConstructData):
1971         (JSC::BooleanConstructor::getCallData):
1972         * runtime/CallData.cpp:
1973         (JSC::call):
1974         * runtime/CallData.h:
1975         * runtime/CommonSlowPaths.cpp:
1976         (JSC::SLOW_PATH_DECL):
1977         * runtime/ConstructData.cpp:
1978         (JSC::construct):
1979         * runtime/ConstructData.h:
1980         * runtime/DateConstructor.cpp:
1981         (JSC::DateConstructor::getConstructData):
1982         (JSC::DateConstructor::getCallData):
1983         * runtime/DatePrototype.cpp:
1984         (JSC::dateProtoFuncToJSON):
1985         * runtime/Error.h:
1986         (JSC::StrictModeTypeErrorFunction::getConstructData):
1987         (JSC::StrictModeTypeErrorFunction::getCallData):
1988         * runtime/ErrorConstructor.cpp:
1989         (JSC::ErrorConstructor::getConstructData):
1990         (JSC::ErrorConstructor::getCallData):
1991         * runtime/ExceptionHelpers.cpp:
1992         (JSC::errorDescriptionForValue):
1993         * runtime/FunctionConstructor.cpp:
1994         (JSC::FunctionConstructor::getConstructData):
1995         (JSC::FunctionConstructor::getCallData):
1996         * runtime/FunctionPrototype.cpp:
1997         (JSC::FunctionPrototype::getCallData):
1998         (JSC::functionProtoFuncToString):
1999         (JSC::functionProtoFuncBind):
2000         * runtime/GeneratorFunctionConstructor.cpp:
2001         (JSC::GeneratorFunctionConstructor::getCallData):
2002         (JSC::GeneratorFunctionConstructor::getConstructData):
2003         * runtime/InternalFunction.cpp:
2004         (JSC::InternalFunction::getCallData):
2005         * runtime/IntlCollatorConstructor.cpp:
2006         (JSC::IntlCollatorConstructor::getConstructData):
2007         (JSC::IntlCollatorConstructor::getCallData):
2008         * runtime/IntlDateTimeFormatConstructor.cpp:
2009         (JSC::IntlDateTimeFormatConstructor::getConstructData):
2010         (JSC::IntlDateTimeFormatConstructor::getCallData):
2011         * runtime/IntlNumberFormatConstructor.cpp:
2012         (JSC::IntlNumberFormatConstructor::getConstructData):
2013         (JSC::IntlNumberFormatConstructor::getCallData):
2014         * runtime/IteratorOperations.cpp:
2015         (JSC::iteratorNext):
2016         (JSC::iteratorClose):
2017         * runtime/JSArray.h:
2018         (JSC::getLength):
2019         * runtime/JSArrayBufferConstructor.cpp:
2020         (JSC::JSArrayBufferConstructor::getConstructData):
2021         (JSC::JSArrayBufferConstructor::getCallData):
2022         * runtime/JSBoundFunction.cpp:
2023         (JSC::boundFunctionCall):
2024         (JSC::boundFunctionConstruct):
2025         (JSC::JSBoundFunction::create):
2026         * runtime/JSCJSValue.h:
2027         * runtime/JSCJSValueInlines.h:
2028         (JSC::JSValue::isFunction):
2029         (JSC::JSValue::isConstructor):
2030         * runtime/JSCell.cpp:
2031         (JSC::JSCell::getCallData):
2032         (JSC::JSCell::getConstructData):
2033         * runtime/JSFunction.cpp:
2034         (JSC::JSFunction::getCallData):
2035         (JSC::JSFunction::getConstructData):
2036         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
2037         (JSC::constructGenericTypedArrayViewWithArguments):
2038         (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getConstructData):
2039         (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getCallData):
2040         * runtime/JSInternalPromise.cpp:
2041         (JSC::JSInternalPromise::then):
2042         * runtime/JSInternalPromiseConstructor.cpp:
2043         (JSC::JSInternalPromiseConstructor::getConstructData):
2044         (JSC::JSInternalPromiseConstructor::getCallData):
2045         * runtime/JSJob.cpp:
2046         (JSC::JSJobMicrotask::run):
2047         * runtime/JSONObject.cpp:
2048         (JSC::Stringifier::Stringifier):
2049         (JSC::Stringifier::toJSONImpl):
2050         (JSC::Stringifier::appendStringifiedValue):
2051         (JSC::JSONProtoFuncParse):
2052         * runtime/JSObject.cpp:
2053         (JSC::callToPrimitiveFunction):
2054         (JSC::JSObject::hasInstance):
2055         (JSC::JSObject::getMethod):
2056         * runtime/JSObject.h:
2057         (JSC::getCallData):
2058         (JSC::getConstructData):
2059         * runtime/JSPromise.cpp:
2060         (JSC::JSPromise::initialize):
2061         * runtime/JSPromiseConstructor.cpp:
2062         (JSC::JSPromiseConstructor::getConstructData):
2063         (JSC::JSPromiseConstructor::getCallData):
2064         * runtime/JSPromiseDeferred.cpp:
2065         (JSC::newPromiseCapability):
2066         (JSC::callFunction):
2067         * runtime/JSTypedArrayViewConstructor.cpp:
2068         (JSC::constructTypedArrayView):
2069         (JSC::JSTypedArrayViewConstructor::getConstructData):
2070         (JSC::JSTypedArrayViewConstructor::getCallData):
2071         * runtime/MapConstructor.cpp:
2072         (JSC::constructMap):
2073         (JSC::MapConstructor::getConstructData):
2074         (JSC::MapConstructor::getCallData):
2075         * runtime/ModuleLoaderObject.cpp:
2076         (JSC::ModuleLoaderObject::provide):
2077         (JSC::ModuleLoaderObject::loadAndEvaluateModule):
2078         (JSC::ModuleLoaderObject::loadModule):
2079         (JSC::ModuleLoaderObject::linkAndEvaluateModule):
2080         * runtime/NativeErrorConstructor.cpp:
2081         (JSC::NativeErrorConstructor::getConstructData):
2082         (JSC::NativeErrorConstructor::getCallData):
2083         * runtime/NullGetterFunction.cpp:
2084         (JSC::NullGetterFunction::getCallData):
2085         (JSC::NullGetterFunction::getConstructData):
2086         * runtime/NullSetterFunction.cpp:
2087         (JSC::NullSetterFunction::getCallData):
2088         (JSC::NullSetterFunction::getConstructData):
2089         * runtime/NumberConstructor.cpp:
2090         (JSC::NumberConstructor::getConstructData):
2091         (JSC::NumberConstructor::getCallData):
2092         * runtime/ObjectConstructor.cpp:
2093         (JSC::ObjectConstructor::getConstructData):
2094         (JSC::ObjectConstructor::getCallData):
2095         (JSC::toPropertyDescriptor):
2096         * runtime/ObjectPrototype.cpp:
2097         (JSC::objectProtoFuncDefineGetter):
2098         (JSC::objectProtoFuncDefineSetter):
2099         (JSC::objectProtoFuncToLocaleString):
2100         * runtime/Operations.cpp:
2101         (JSC::jsTypeStringForValue):
2102         (JSC::jsIsObjectTypeOrNull):
2103         (JSC::jsIsFunctionType):
2104         * runtime/ProxyConstructor.cpp:
2105         (JSC::ProxyConstructor::getConstructData):
2106         (JSC::ProxyConstructor::getCallData):
2107         * runtime/ProxyObject.cpp:
2108         (JSC::ProxyObject::finishCreation):
2109         (JSC::performProxyCall):
2110         (JSC::ProxyObject::getCallData):
2111         (JSC::performProxyConstruct):
2112         (JSC::ProxyObject::getConstructData):
2113         * runtime/ReflectObject.cpp:
2114         (JSC::reflectObjectConstruct):
2115         * runtime/RegExpConstructor.cpp:
2116         (JSC::RegExpConstructor::getConstructData):
2117         (JSC::RegExpConstructor::getCallData):
2118         * runtime/RuntimeType.h:
2119         * runtime/SamplingProfiler.cpp:
2120         (JSC::SamplingProfiler::processUnverifiedStackTraces):
2121         * runtime/SetConstructor.cpp:
2122         (JSC::constructSet):
2123         (JSC::SetConstructor::getConstructData):
2124         (JSC::SetConstructor::getCallData):
2125         * runtime/StringConstructor.cpp:
2126         (JSC::StringConstructor::getConstructData):
2127         (JSC::StringConstructor::getCallData):
2128         * runtime/StringPrototype.cpp:
2129         (JSC::replaceUsingRegExpSearch):
2130         (JSC::operationStringProtoFuncReplaceRegExpEmptyStr):
2131         (JSC::operationStringProtoFuncReplaceRegExpString):
2132         (JSC::replaceUsingStringSearch):
2133         * runtime/SymbolConstructor.cpp:
2134         (JSC::SymbolConstructor::getConstructData):
2135         (JSC::SymbolConstructor::getCallData):
2136         * runtime/WeakMapConstructor.cpp:
2137         (JSC::constructWeakMap):
2138         (JSC::WeakMapConstructor::getConstructData):
2139         (JSC::WeakMapConstructor::getCallData):
2140         * runtime/WeakSetConstructor.cpp:
2141         (JSC::constructWeakSet):
2142         (JSC::WeakSetConstructor::getConstructData):
2143         (JSC::WeakSetConstructor::getCallData):
2144         * tests/es6.yaml:
2145         * tests/stress/reflect-construct.js: Added.
2146         (shouldBe):
2147         (shouldThrow):
2148         (shouldThrow.array.get length):
2149         (shouldThrow.array.get 0):
2150         (array.get length):
2151         (array.get 0):
2152         (shouldBe.Reflect.construct):
2153         (shouldBe.Reflect.construct.Hello):
2154         (3.shouldBe.Reflect.construct.Hello):
2155         (3.newTarget):
2156         (0.shouldBe.Reflect.construct):
2157         (shouldBe.A):
2158         (shouldBe.B):
2159         (nativeConstructorTest.DerivedMap):
2160         (nativeConstructorTest.FailedMap):
2161         (set noInline):
2162
2163 2016-03-04  Andreas Kling  <akling@apple.com>
2164
2165         [iOS] Throw away compiled RegExp code when navigating to a new page.
2166         <https://webkit.org/b/155015>
2167
2168         Reviewed by Anders Carlsson.
2169
2170         Add a mechanism to have the VM discard all RegExp bytecode and JIT code.
2171
2172         * runtime/VM.cpp:
2173         (JSC::VM::deleteAllRegExpCode):
2174         * runtime/VM.h:
2175
2176 2016-03-04  David Kilzer  <ddkilzer@apple.com>
2177
2178         REGRESSION (r197531): JavaScriptCore ASan build fails due to weak external symbol
2179         <http://webkit.org/b/155033>
2180         <rdar://problem/24979661>
2181
2182         Reviewed by Alexey Proskuryakov.
2183
2184         * runtime/JSObject.cpp:
2185         (JSC::JSObject::ordinaryToPrimitive): Don't mark this method
2186         inline since it's also used in DatePrototype.cpp, and is
2187         declared as a public class method.
2188         * runtime/JSObject.h:
2189         (JSC::JSObject::ordinaryToPrimitive): Don't export this method
2190         since it is not used outside of JavaScriptCore.
2191
2192 2016-03-04  Alex Christensen  <achristensen@webkit.org>
2193
2194         Remove vcxproj build system
2195         https://bugs.webkit.org/show_bug.cgi?id=154388
2196
2197         Rubber-stamped by Brent Fulgham.
2198
2199         * JavaScriptCore.vcxproj/JavaScriptCore.sln: Removed.
2200         * JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: Removed.
2201         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Removed.
2202         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Removed.
2203         * JavaScriptCore.vcxproj/JavaScriptCoreCF.props: Removed.
2204         * JavaScriptCore.vcxproj/JavaScriptCoreCFLite.props: Removed.
2205         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props: Removed.
2206         * JavaScriptCore.vcxproj/JavaScriptCoreDLL.cpp: Removed.
2207         * JavaScriptCore.vcxproj/JavaScriptCoreDebug.props: Removed.
2208         * JavaScriptCore.vcxproj/JavaScriptCoreDebugCFLite.props: Removed.
2209         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make: Removed.
2210         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj: Removed.
2211         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.filters: Removed.
2212         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedCommon.props: Removed.
2213         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedDebug.props: Removed.
2214         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedProduction.props: Removed.
2215         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props: Removed.
2216         * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd: Removed.
2217         * JavaScriptCore.vcxproj/JavaScriptCorePreBuild.cmd: Removed.
2218         * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd: Removed.
2219         * JavaScriptCore.vcxproj/JavaScriptCoreProduction.props: Removed.
2220         * JavaScriptCore.vcxproj/JavaScriptCoreRelease.props: Removed.
2221         * JavaScriptCore.vcxproj/JavaScriptCoreReleaseCFLite.props: Removed.
2222         * JavaScriptCore.vcxproj/build-generated-files.pl: Removed.
2223         * JavaScriptCore.vcxproj/copy-files.cmd: Removed.
2224
2225 2016-03-04  Chris Dumez  <cdumez@apple.com>
2226
2227         Location.reload should not be writable
2228         https://bugs.webkit.org/show_bug.cgi?id=154989
2229
2230         Reviewed by Gavin Barraclough.
2231
2232         After r196770, operations marked as [Unforgeable] in the IDL (such as
2233         Location.reload) are correctly reported as not writable by
2234         Object.getOwnPropertyDescriptor(). Trying to set such property in JS
2235         is correctly ignored (or throws in strict mode) if the object has
2236         previously been reified. However, due to a bug in putEntry(), it was
2237         still possible to override the property if the object was not reified
2238         yet. This patch fixes the issue by checking in putEntry() that entries
2239         that are functions are not ReadOnly before calling putDirect().
2240
2241         * runtime/Lookup.h:
2242         (JSC::putEntry):
2243
2244 2016-03-04  Skachkov Oleksandr  <gskachkov@gmail.com>
2245
2246         [ES6] Arrow function syntax. Lexical bind "super" inside of the arrow function in generator.
2247         https://bugs.webkit.org/show_bug.cgi?id=152575
2248
2249         Reviewed by Yusuke Suzuki.
2250
2251         Added support of the 'SuperProperty' in arrow function within of the generator
2252         method of class. Before patch parser  did not recognize that current arrow function
2253         is declated inside of the generator and raise SyntaxError.
2254
2255         * parser/Parser.cpp:
2256         (JSC::Parser<LexerType>::parseFunctionInfo):
2257         * parser/Parser.h:
2258         (JSC::Scope::Scope):
2259         (JSC::Scope::isGeneratorBoundary):
2260         (JSC::Scope::setIsFunction):
2261         (JSC::Scope::setIsGenerator):
2262         (JSC::Parser::closestParentOrdinaryFunctionNonLexicalScope):
2263         * tests/stress/arrowfunction-lexical-bind-superproperty.js:
2264
2265 2016-03-03  Filip Pizlo  <fpizlo@apple.com>
2266
2267         DFG/FTL should inline accesses to RegExpObject::m_lastIndex
2268         https://bugs.webkit.org/show_bug.cgi?id=155003
2269
2270         Reviewed by Benjamin Poulain.
2271
2272         The Octane/regexp benchmark sets RegExps' lastIndex a lot. I could imagine this being
2273         something that people want to do. Right now, I'm not convinced that making the RegExp object
2274         be more plain-JS would be a good idea considering that pretty much all uses of it will
2275         require some special compiler magic. Also, it's good that this patch teaches the compiler
2276         how to reason about lastIndex since some of my other plans for regexp involve having the
2277         compiler treat more regexp stuff as intrinsic.
2278
2279         This is a smaller Octane/regexp speed-up than I hoped - maybe around 1%. It's an enormous
2280         speed-up on the microbenchmarks attached to this patch.
2281
2282         * dfg/DFGAbstractHeap.h:
2283         * dfg/DFGAbstractInterpreterInlines.h:
2284         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2285         * dfg/DFGClobberize.h:
2286         (JSC::DFG::clobberize):
2287         * dfg/DFGDoesGC.cpp:
2288         (JSC::DFG::doesGC):
2289         * dfg/DFGFixupPhase.cpp:
2290         (JSC::DFG::FixupPhase::fixupNode):
2291         * dfg/DFGHeapLocation.h:
2292         * dfg/DFGNodeType.h:
2293         * dfg/DFGPredictionPropagationPhase.cpp:
2294         (JSC::DFG::PredictionPropagationPhase::propagate):
2295         * dfg/DFGSafeToExecute.h:
2296         (JSC::DFG::safeToExecute):
2297         * dfg/DFGSpeculativeJIT.cpp:
2298         (JSC::DFG::SpeculativeJIT::compilePutAccessorByVal):
2299         (JSC::DFG::SpeculativeJIT::compileGetRegExpObjectLastIndex):
2300         (JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex):
2301         * dfg/DFGSpeculativeJIT.h:
2302         * dfg/DFGSpeculativeJIT32_64.cpp:
2303         (JSC::DFG::SpeculativeJIT::compile):
2304         * dfg/DFGSpeculativeJIT64.cpp:
2305         (JSC::DFG::SpeculativeJIT::compile):
2306         * dfg/DFGStoreBarrierInsertionPhase.cpp:
2307         * ftl/FTLAbstractHeapRepository.cpp:
2308         * ftl/FTLAbstractHeapRepository.h:
2309         * ftl/FTLCapabilities.cpp:
2310         (JSC::FTL::canCompile):
2311         * ftl/FTLLowerDFGToB3.cpp:
2312         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
2313         (JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
2314         (JSC::FTL::DFG::LowerDFGToB3::compileGetRegExpObjectLastIndex):
2315         (JSC::FTL::DFG::LowerDFGToB3::compileSetRegExpObjectLastIndex):
2316         (JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):
2317         (JSC::FTL::DFG::LowerDFGToB3::lowObject):
2318         (JSC::FTL::DFG::LowerDFGToB3::lowRegExpObject):
2319         (JSC::FTL::DFG::LowerDFGToB3::lowString):
2320         * runtime/RegExpObject.h:
2321         (JSC::RegExpObject::createStructure):
2322         (JSC::RegExpObject::offsetOfLastIndex):
2323
2324 2016-03-03  Chris Dumez  <cdumez@apple.com>
2325
2326         Regression(r196770): Unable to use HipChat Mac app
2327         https://bugs.webkit.org/show_bug.cgi?id=154999
2328         <rdar://problem/24931959>
2329
2330         Reviewed by Darin Adler.
2331
2332         Add a setter to PutPropertySlot to override the 'isStrictMode' flag.
2333
2334         * runtime/PutPropertySlot.h:
2335         (JSC::PutPropertySlot::setStrictMode):
2336
2337 2016-03-03  Benjamin Poulain  <bpoulain@apple.com>
2338
2339         [JSC] Add support for MADD, MSUB and MNEG to Air
2340         https://bugs.webkit.org/show_bug.cgi?id=154997
2341
2342         Reviewed by Filip Pizlo.
2343
2344         ARM64 can do an Add/Sub in the Multiply units.
2345         LLVM was doing so but we lost that when switching to B3.
2346
2347         This patch adds those instructions in Air.
2348
2349         There are more ALUs than multiply units, thus we are more
2350         likely to successfully schedule a Multiply+Add than 2 Multiply.
2351         I am conservative and only emit a multiply-add if the value
2352         can be interned. As far as I can tell from what is generated
2353         by LLVM, that backend had the same rule.
2354
2355         * assembler/MacroAssemblerARM64.h:
2356         (JSC::MacroAssemblerARM64::multiplyAdd32):
2357         (JSC::MacroAssemblerARM64::multiplySub32):
2358         (JSC::MacroAssemblerARM64::multiplyNeg32):
2359         (JSC::MacroAssemblerARM64::multiplyAdd64):
2360         (JSC::MacroAssemblerARM64::multiplySub64):
2361         (JSC::MacroAssemblerARM64::multiplyNeg64):
2362         * b3/B3LowerToAir.cpp:
2363         (JSC::B3::Air::LowerToAir::lower):
2364         * b3/air/AirOpcode.opcodes:
2365         * b3/testb3.cpp:
2366         (JSC::B3::populateWithInterestingValues):
2367         (JSC::B3::floatingPointOperands):
2368         (JSC::B3::int64Operands):
2369         (JSC::B3::int32Operands):
2370         (JSC::B3::testMulAddArgsLeft):
2371         (JSC::B3::testMulAddArgsRight):
2372         (JSC::B3::testMulAddArgsLeft32):
2373         (JSC::B3::testMulAddArgsRight32):
2374         (JSC::B3::testMulSubArgsLeft):
2375         (JSC::B3::testMulSubArgsRight):
2376         (JSC::B3::testMulSubArgsLeft32):
2377         (JSC::B3::testMulSubArgsRight32):
2378         (JSC::B3::testMulNegArgs):
2379         (JSC::B3::testMulNegArgs32):
2380         (JSC::B3::run):
2381
2382 2016-03-03  Saam Barati  <sbarati@apple.com>
2383
2384         [ES6] Implement Proxy.[[SetPrototypeOf]]
2385         https://bugs.webkit.org/show_bug.cgi?id=154931
2386
2387         Reviewed by Ryosuke Niwa.
2388
2389         This patch is a straight forward implementation of Proxy.[[SetPrototypeOf]]
2390         with respect to section 9.5.2 of the ECMAScript spec.
2391         https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-setprototypeof-v
2392
2393         * runtime/JSObject.cpp:
2394         (JSC::JSObject::putInlineSlow):
2395         * runtime/ProxyObject.cpp:
2396         (JSC::ProxyObject::put):
2397         (JSC::ProxyObject::getGenericPropertyNames):
2398         (JSC::ProxyObject::performSetPrototype):
2399         (JSC::ProxyObject::setPrototype):
2400         (JSC::ProxyObject::visitChildren):
2401         * runtime/ProxyObject.h:
2402         * tests/es6.yaml:
2403         * tests/stress/proxy-set-prototype-of.js: Added.
2404         (assert):
2405         (throw.new.Error.let.handler.get setPrototypeOf):
2406         (throw.new.Error.set let):
2407         (throw.new.Error.set catch):
2408         (throw.new.Error):
2409         (assert.let.handler.setPrototypeOf):
2410         (assert.set let):
2411         (assert.set catch):
2412         (let.handler.setPrototypeOf):
2413         (set let):
2414         (set catch):
2415
2416 2016-03-03  Keith Miller  <keith_miller@apple.com>
2417
2418         JSArrayBuffers should be collected less aggressively
2419         https://bugs.webkit.org/show_bug.cgi?id=154982
2420
2421         Reviewed by Geoffrey Garen.
2422
2423         We are currently too aggressive in our collection of ArrayBuffer wrappers.
2424         There are three cases where we need to avoid collecting ArrayBuffer wrappers.
2425         1. If the wrapper has custom properties.
2426         2. If the wrapper is a subclass of ArrayBuffer.
2427         3. If the wrapper is in a WeakMap/WeakSet.
2428
2429         Currently, we only pass the first case in WebCore and none in the jsc CLI.
2430         This patch removes some optimizations that cause us to collect when we
2431         should not. Namely, always skipping the object unless it has custom
2432         properties. Additionally, in the case of subclassing, we also need a way
2433         for custom JSArrayBuffer objects to register themselves as the wrapper for
2434         an ArrayBuffer class.
2435
2436         Finally, this patch fixes an issue where views would not mark their ArrayBuffer
2437         as an opaque root. This patch also moves an associated ASSERT that the
2438         ArrayBuffer held by a view is not null in JSGenericTypedArrayView::visitChildren
2439         into JSArrayBufferView::visitChildren, where we add the opaque root.
2440
2441         * runtime/JSArrayBuffer.cpp:
2442         (JSC::JSArrayBuffer::finishCreation):
2443         (JSC::JSArrayBuffer::create):
2444         (JSC::JSArrayBuffer::createWithoutWrapping):
2445         * runtime/JSArrayBuffer.h:
2446         * runtime/JSArrayBufferView.cpp:
2447         (JSC::JSArrayBufferView::visitChildren):
2448         * runtime/JSArrayBufferView.h:
2449         * runtime/JSGenericTypedArrayViewInlines.h:
2450         (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren): Deleted.
2451         * runtime/SimpleTypedArrayController.cpp:
2452         (JSC::SimpleTypedArrayController::toJS):
2453         (JSC::SimpleTypedArrayController::registerWrapper):
2454         (JSC::SimpleTypedArrayController::JSArrayBufferOwner::isReachableFromOpaqueRoots):
2455         (JSC::SimpleTypedArrayController::JSArrayBufferOwner::finalize):
2456         * runtime/SimpleTypedArrayController.h:
2457         * runtime/TypedArrayController.h:
2458
2459 2016-03-03  Filip Pizlo  <fpizlo@apple.com>
2460
2461         Octane/regexp's Exec function should benefit from array length accessor inlining
2462         https://bugs.webkit.org/show_bug.cgi?id=154994
2463
2464         Reviewed by Benjamin Poulain.
2465
2466         It does:
2467
2468             var thingy = blahbitty.blah;
2469             if (thingy)
2470                 foo = thingy.length;
2471
2472         So, 'thingy' is SpecArray | SpecOther, which prevents the array length accessor inlining from
2473         kicking in. Our strategy for this elsewhere in the DFG is to allow a one-time speculation that
2474         we won't see SpecOther, since *usually* we see SpecOther mixed with other stuff in cases like
2475         this where there is some null check guarding the code.
2476
2477         This gives another slight speed-up on Octane/regexp.
2478
2479         * bytecode/SpeculatedType.h:
2480         (JSC::isCellSpeculation):
2481         (JSC::isCellOrOtherSpeculation):
2482         (JSC::isNotCellSpeculation):
2483         * dfg/DFGFixupPhase.cpp:
2484         (JSC::DFG::FixupPhase::fixupNode):
2485         * dfg/DFGNode.h:
2486         (JSC::DFG::Node::shouldSpeculateCell):
2487         (JSC::DFG::Node::shouldSpeculateCellOrOther):
2488         (JSC::DFG::Node::shouldSpeculateNotCell):
2489
2490 2016-03-03  Saam Barati  <sbarati@apple.com>
2491
2492         Add Proxy tests for exceptions that depend on an object being non-extensible and having configurable properties
2493         https://bugs.webkit.org/show_bug.cgi?id=154745
2494
2495         Reviewed by Geoffrey Garen.
2496
2497         This patch is mostly an implementation of Proxy.[[OwnPropertyKeys]]
2498         with respect to section 9.5.11 of the ECMAScript spec.
2499         https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys
2500
2501         This patch also changes call sites of getOwnPropertyNames and
2502         getPropertyNames to expect that an exception can be thrown.
2503
2504         * dfg/DFGOperations.cpp:
2505         * inspector/JSInjectedScriptHost.cpp:
2506         (Inspector::JSInjectedScriptHost::iteratorEntries):
2507         * interpreter/Interpreter.cpp:
2508         (JSC::Interpreter::execute):
2509         * runtime/IntlObject.cpp:
2510         (JSC::supportedLocales):
2511         * runtime/JSCJSValue.h:
2512         * runtime/JSCJSValueInlines.h:
2513         (JSC::JSValue::get):
2514         (JSC::JSValue::put):
2515         * runtime/JSONObject.cpp:
2516         (JSC::Stringifier::Holder::appendNextProperty):
2517         (JSC::Walker::walk):
2518         * runtime/JSObject.cpp:
2519         (JSC::JSObject::getPropertyNames):
2520         (JSC::JSObject::getGenericPropertyNames):
2521         * runtime/JSObject.h:
2522         (JSC::makeIdentifier):
2523         (JSC::createListFromArrayLike):
2524         * runtime/JSPropertyNameEnumerator.h:
2525         (JSC::propertyNameEnumerator):
2526         * runtime/JSPropertyNameIterator.cpp:
2527         (JSC::JSPropertyNameIterator::create):
2528         * runtime/MapConstructor.cpp:
2529         (JSC::constructMap):
2530         * runtime/ObjectConstructor.cpp:
2531         (JSC::defineProperties):
2532         (JSC::objectConstructorSeal):
2533         (JSC::objectConstructorFreeze):
2534         (JSC::objectConstructorIsSealed):
2535         (JSC::objectConstructorIsFrozen):
2536         (JSC::ownPropertyKeys):
2537         * runtime/ProxyObject.cpp:
2538         (JSC::ProxyObject::getOwnPropertySlotByIndex):
2539         (JSC::ProxyObject::deleteProperty):
2540         (JSC::ProxyObject::deletePropertyByIndex):
2541         (JSC::ProxyObject::defineOwnProperty):
2542         (JSC::ProxyObject::performGetOwnPropertyNames):
2543         (JSC::ProxyObject::getOwnPropertyNames):
2544         (JSC::ProxyObject::getOwnNonIndexPropertyNames):
2545         (JSC::ProxyObject::getStructurePropertyNames):
2546         (JSC::ProxyObject::getGenericPropertyNames):
2547         (JSC::ProxyObject::visitChildren):
2548         * runtime/ProxyObject.h:
2549         (JSC::ProxyObject::create):
2550         (JSC::ProxyObject::createStructure):
2551         * runtime/Structure.cpp:
2552         (JSC::Structure::Structure):
2553         (JSC::Structure::add):
2554         (JSC::Structure::getPropertyNamesFromStructure):
2555         (JSC::Structure::checkConsistency):
2556         (JSC::Structure::canCachePropertyNameEnumerator):
2557         (JSC::Structure::canAccessPropertiesQuicklyForEnumeration):
2558         (JSC::Structure::canAccessPropertiesQuickly): Deleted.
2559         * runtime/Structure.h:
2560         * runtime/WeakMapConstructor.cpp:
2561         (JSC::constructWeakMap):
2562         * tests/es6.yaml:
2563         * tests/stress/proxy-own-keys.js: Added.
2564         (assert):
2565         (throw.new.Error.let.handler.ownKeys):
2566         (throw.new.Error):
2567         (assert.let.handler.get ownKeys):
2568         (assert.let.handler.ownKeys):
2569         (let.handler.ownKeys):
2570         (i.catch):
2571         (shallowEq):
2572         (let.handler.getOwnPropertyDescriptor):
2573         (i.set assert):
2574         (set add):
2575         (set assert):
2576         (set if):
2577
2578 2016-03-03  Keith Miller  <keith_miller@apple.com>
2579
2580         Array prototype JS builtins should support Symbol.species
2581         https://bugs.webkit.org/show_bug.cgi?id=154710
2582
2583         Reviewed by Geoffrey Garen.
2584
2585         Add support for Symbol.species in the Array.prototype JS
2586         builtin functions.
2587
2588         * builtins/ArrayPrototype.js:
2589         (filter):
2590         (map):
2591         * runtime/ArrayConstructor.cpp:
2592         (JSC::ArrayConstructor::finishCreation):
2593         (JSC::arrayConstructorPrivateFuncIsArrayConstructor):
2594         * runtime/ArrayConstructor.h:
2595         (JSC::ArrayConstructor::create):
2596         * runtime/CommonIdentifiers.h:
2597         * runtime/JSGlobalObject.cpp:
2598         (JSC::JSGlobalObject::init):
2599         * tests/stress/array-species-functions.js:
2600         (id):
2601
2602 2016-03-03  Michael Saboff  <msaboff@apple.com>
2603
2604         [ES6] Make Unicode RegExp pattern parsing conform to the spec
2605         https://bugs.webkit.org/show_bug.cgi?id=154988
2606
2607         Reviewed by Benjamin Poulain.
2608
2609         Updated RegExp pattern processing with 'u' (Unicode) flag to conform to the
2610         spec (https://tc39.github.io/ecma262/2016/#sec-patterns).  In the spec, the
2611         grammar is annotated with [U] annotations.  Productions that are prefixed with
2612         [+U] are only available with the Unicode flags while productions prefixed with
2613         [~U] are only available without the Unicode flag.
2614
2615         Added flags argument to Yarr::checkSyntax() so we can catch Unicode flag related
2616         parsing errors at syntax checking time.  Restricted what escapes are available for
2617         non Unicode patterns.  Most of this is defined in the IdentityEscape rule in the
2618         pattern grammar.
2619
2620         Added \- as a CharacterClass only escape in Unicode patterns.
2621
2622         Updated the tests for these changes.
2623
2624         Made changes suggested in https://bugs.webkit.org/show_bug.cgi?id=154842#c22 after
2625         change set r197426 was landed.
2626
2627         * parser/ASTBuilder.h:
2628         (JSC::ASTBuilder::createRegExp):
2629         * parser/Parser.cpp:
2630         (JSC::Parser<LexerType>::parsePrimaryExpression):
2631         * parser/SyntaxChecker.h:
2632         (JSC::SyntaxChecker::createRegExp):
2633         * yarr/YarrInterpreter.cpp:
2634         (JSC::Yarr::Interpreter::InputStream::readChecked):
2635         (JSC::Yarr::Interpreter::InputStream::readSurrogatePairChecked):
2636         (JSC::Yarr::Interpreter::InputStream::reread):
2637         (JSC::Yarr::Interpreter::InputStream::uncheckInput):
2638         (JSC::Yarr::Interpreter::InputStream::atStart):
2639         (JSC::Yarr::Interpreter::InputStream::atEnd):
2640         (JSC::Yarr::Interpreter::testCharacterClass):
2641         (JSC::Yarr::Interpreter::backtrackPatternCharacter):
2642         (JSC::Yarr::Interpreter::matchDisjunction):
2643         (JSC::Yarr::ByteCompiler::atomPatternCharacter):
2644         * yarr/YarrParser.h:
2645         (JSC::Yarr::Parser::Parser):
2646         (JSC::Yarr::Parser::isIdentityEscapeAnError):
2647         (JSC::Yarr::Parser::parseEscape):
2648         (JSC::Yarr::Parser::parse):
2649         * yarr/YarrPattern.cpp:
2650         (JSC::Yarr::CharacterClassConstructor::putChar):
2651         (JSC::Yarr::CharacterClassConstructor::putRange):
2652         (JSC::Yarr::CharacterClassConstructor::addSorted):
2653         (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
2654         * yarr/YarrSyntaxChecker.cpp:
2655         (JSC::Yarr::SyntaxChecker::disjunction):
2656         (JSC::Yarr::checkSyntax):
2657         * yarr/YarrSyntaxChecker.h:
2658
2659 2016-03-03  Saam barati  <sbarati@apple.com>
2660
2661         [ES6] Implement Proxy.[[DefineOwnProperty]]
2662         https://bugs.webkit.org/show_bug.cgi?id=154759
2663
2664         Reviewed by Geoffrey Garen and Mark Lam.
2665
2666         This patch is a straight forward implementation of Proxy.[[DefineOwnProperty]]
2667         with respect to section 9.5.6 of the ECMAScript spec.
2668         https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-defineownproperty-p-desc
2669
2670         * runtime/ObjectConstructor.cpp:
2671         (JSC::objectConstructorGetOwnPropertyDescriptor):
2672         (JSC::objectConstructorGetOwnPropertyDescriptors):
2673         * runtime/ObjectConstructor.h:
2674         (JSC::constructEmptyObject):
2675         (JSC::constructObjectFromPropertyDescriptor):
2676         * runtime/ProxyObject.cpp:
2677         (JSC::ProxyObject::isExtensible):
2678         (JSC::ProxyObject::performDefineOwnProperty):
2679         (JSC::ProxyObject::defineOwnProperty):
2680         (JSC::ProxyObject::visitChildren):
2681         * runtime/ProxyObject.h:
2682         * tests/es6.yaml:
2683         * tests/stress/proxy-define-own-property.js: Added.
2684         (assert):
2685         (throw.new.Error):
2686         (assert.let.handler.get defineProperty):
2687         (assert.let.handler.defineProperty):
2688         (let.handler.defineProperty):
2689         (i.catch):
2690         (assert.try.):
2691         (assert.set get catch):
2692         (assert.let.setter):
2693         (assert.let.getter):
2694         (assert.set get let.handler.defineProperty):
2695         (assert.set get let):
2696         (assert.):
2697
2698 2016-03-03  Keith Miller  <keith_miller@apple.com>
2699
2700         [ES6] Add support for Symbol.toPrimitive
2701         https://bugs.webkit.org/show_bug.cgi?id=154877
2702
2703         Reviewed by Saam Barati.
2704
2705         This patch adds suport for Symbol.toPrimitive. Since we don't currently
2706         generate snippits for one side of a binary operation we only need to change
2707         the JSObject::ToPrimitive function and update some optimizations in the DFG
2708         that need to know how conversions to primitive values should work. As of
2709         ES6, the date prototype is also no longer special cased in the ToPrimitive
2710         operation. Instead, Date.prototype has a Symbol.species function that
2711         replicates the old behavior.
2712
2713         * bytecode/ObjectPropertyConditionSet.cpp:
2714         (JSC::generateConditionsForPropertyMissConcurrently):
2715         * bytecode/ObjectPropertyConditionSet.h:
2716         * dfg/DFGGraph.cpp:
2717         (JSC::DFG::Graph::watchConditions):
2718         (JSC::DFG::Graph::canOptimizeStringObjectAccess):
2719         * dfg/DFGGraph.h:
2720         * runtime/CommonIdentifiers.h:
2721         * runtime/DatePrototype.cpp:
2722         (JSC::DatePrototype::finishCreation):
2723         (JSC::dateProtoFuncToPrimitiveSymbol):
2724         * runtime/Error.cpp:
2725         (JSC::throwTypeError):
2726         * runtime/Error.h:
2727         * runtime/JSCJSValueInlines.h:
2728         (JSC::toPreferredPrimitiveType):
2729         * runtime/JSObject.cpp:
2730         (JSC::callToPrimitiveFunction):
2731         (JSC::JSObject::ordinaryToPrimitive):
2732         (JSC::JSObject::defaultValue):
2733         (JSC::JSObject::toPrimitive):
2734         (JSC::JSObject::getPrimitiveNumber):
2735         (JSC::callDefaultValueFunction): Deleted.
2736         (JSC::throwTypeError): Deleted.
2737         * runtime/JSObject.h:
2738         (JSC::JSObject::toPrimitive): Deleted.
2739         * runtime/SmallStrings.h:
2740         * runtime/SymbolPrototype.cpp:
2741         (JSC::SymbolPrototype::finishCreation):
2742         * runtime/SymbolPrototype.h:
2743         (JSC::SymbolPrototype::create):
2744         * tests/es6.yaml:
2745         * tests/stress/date-symbol-toprimitive.js: Added.
2746         * tests/stress/ropes-symbol-toprimitive.js: Added.
2747         (ropify):
2748         (String.prototype.Symbol.toPrimitive):
2749         * tests/stress/symbol-toprimitive.js: Added.
2750         (foo.Symbol.toPrimitive):
2751         (catch):
2752
2753 2016-03-03  Filip Pizlo  <fpizlo@apple.com>
2754
2755         DFG should be able to compile StringReplace
2756         https://bugs.webkit.org/show_bug.cgi?id=154979
2757
2758         Reviewed by Benjamin Poulain.
2759
2760         Adds support for StringReplace to the DFG tier. This is a 3% speed-up on Octane/regexp.
2761
2762         * dfg/DFGByteCodeParser.cpp:
2763         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
2764         * dfg/DFGSpeculativeJIT.cpp:
2765         (JSC::DFG::SpeculativeJIT::speculateFinalObject):
2766         (JSC::DFG::SpeculativeJIT::speculateRegExpObject):
2767         (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
2768         * dfg/DFGSpeculativeJIT.h:
2769         (JSC::DFG::SpeculativeJIT::callOperation):
2770         * dfg/DFGSpeculativeJIT32_64.cpp:
2771         (JSC::DFG::SpeculativeJIT::compile):
2772         * dfg/DFGSpeculativeJIT64.cpp:
2773         (JSC::DFG::SpeculativeJIT::compile):
2774         * jit/JITOperations.h:
2775
2776 2016-03-03  Saam barati  <sbarati@apple.com>
2777
2778         [[SetPrototypeOf]] isn't properly implemented everywhere
2779         https://bugs.webkit.org/show_bug.cgi?id=154943
2780
2781         Reviewed by Benjamin Poulain.
2782
2783         We were copy-pasting implememntation bits that belong in OrdinarySetPrototypeOf
2784         in a few different places that call O.[[SetPrototypeOf]](v)
2785         rather than having those bits in OrdinarySetPrototypeOf itself.
2786         We need to put those copy-pasted bits into OrdinarySetPrototypeOf
2787         and not the call sites of O.[[SetPrototypeOf]](v) because
2788         O.[[SetPrototypeOf]](v) won't always call into OrdinarySetPrototypeOf.
2789         This is needed for correctness because this behavior is now observable
2790         with the ES6 Proxy object.
2791
2792         * runtime/ClassInfo.h:
2793         * runtime/JSCell.cpp:
2794         (JSC::JSCell::isExtensible):
2795         (JSC::JSCell::setPrototype):
2796         * runtime/JSCell.h:
2797         * runtime/JSGlobalObjectFunctions.cpp:
2798         (JSC::globalFuncProtoSetter):
2799         * runtime/JSObject.cpp:
2800         (JSC::JSObject::setPrototypeDirect):
2801         (JSC::JSObject::setPrototypeWithCycleCheck):
2802         (JSC::JSObject::setPrototype):
2803         (JSC::JSObject::allowsAccessFrom):
2804         * runtime/JSObject.h:
2805         (JSC::JSObject::mayInterceptIndexedAccesses):
2806         * runtime/ObjectConstructor.cpp:
2807         (JSC::objectConstructorSetPrototypeOf):
2808         * runtime/ReflectObject.cpp:
2809         (JSC::reflectObjectSetPrototypeOf):
2810
2811 2016-03-03  Alex Christensen  <achristensen@webkit.org>
2812
2813         Fix Windows build after r197489.
2814
2815         * jsc.cpp:
2816
2817 2016-03-02  Filip Pizlo  <fpizlo@apple.com>
2818
2819         RegExpExec/RegExpTest should not unconditionally speculate cell
2820         https://bugs.webkit.org/show_bug.cgi?id=154901
2821
2822         Reviewed by Benjamin Poulain.
2823
2824         This is a three part change. It all started with a simple goal: end the rage-recompiles in
2825         Octane/regexp by enabling the DFG and FTL to do untyped RegExpExec/RegExpTest. This keeps us
2826         in the optimized code when you do a regexp match on a number, for example.
2827
2828         While implementing this, I realized that DFGOperations.cpp was bad at exception checking. When
2829         it did check for exceptions, it used exec->hadException() instead of vm.exception(). So I
2830         fixed that. I also made sure that the regexp operations checked for exception after doing
2831         toString().
2832
2833         Unfortunately, the introduction of untyped RegExpExec/RegExpTest caused a regression on
2834         Octane/regexp. This was because we were simultaneously scheduling replacement and OSR compiles
2835         of some large functions with the FTL JIT. The OSR compiles were not useful. This was a
2836         regression from the previous changes to make OSR compiles happen sooner. The problem is that
2837         this change also removed the throttling of OSR compiles even in those cases where we suspect
2838         that replacement is more likely. This patch reintroduces that throttling, but only in the
2839         replacement path.
2840
2841         This change ends up being neutral overall.
2842
2843         * dfg/DFGFixupPhase.cpp:
2844         (JSC::DFG::FixupPhase::fixupNode):
2845         * dfg/DFGOperations.cpp:
2846         * dfg/DFGOperations.h:
2847         * dfg/DFGSpeculativeJIT32_64.cpp:
2848         (JSC::DFG::SpeculativeJIT::compile):
2849         * dfg/DFGSpeculativeJIT64.cpp:
2850         (JSC::DFG::SpeculativeJIT::compile):
2851         * ftl/FTLLowerDFGToB3.cpp:
2852         (JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
2853         (JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
2854         (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
2855         * tests/stress/regexp-exec-effect-after-exception.js: Added.
2856
2857 2016-03-02  Benjamin Poulain  <bpoulain@apple.com>
2858
2859         [JSC] JSCell_freeListNext and JSCell_structureID are considered not overlapping
2860         https://bugs.webkit.org/show_bug.cgi?id=154947
2861
2862         Reviewed by Filip Pizlo.
2863
2864         This bug was discovered while testing https://bugs.webkit.org/show_bug.cgi?id=154894.
2865
2866         The problem was that JSCell_freeListNext and JSCell_structureID were
2867         considered as disjoint. When reordering instructions, the scheduler
2868         could move the write of the StructureID first to reduce dependencies.
2869         This would erase half of JSCell_freeListNext before we get a chance
2870         to load the value.
2871
2872         This patch changes the hierarchy to make sure nothing is written
2873         until JSCell_freeListNext is processed.
2874
2875         All credits for this patch go to Filip.
2876
2877         * ftl/FTLAbstractHeapRepository.cpp:
2878         (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
2879         * ftl/FTLAbstractHeapRepository.h:
2880
2881 2016-03-02  Benjamin Poulain  <bpoulain@apple.com>
2882
2883         [JSC] Improve Select of Doubles based on Double condition
2884         https://bugs.webkit.org/show_bug.cgi?id=154572
2885
2886         Reviewed by Filip Pizlo.
2887
2888         Octane has a bunch of Select on Double based on comparing Doubles.
2889         A few nodes generate that: ValueRep, Min, Max, etc.
2890
2891         On ARM64, we can improve our code a lot. ARM can do a select
2892         based on flags with the FCSEL instruction.
2893
2894         On x86, this patch adds aggressive aliasing for moveDoubleConditionallyXXX.
2895         This has obviously a much more limited impact.
2896
2897         * assembler/MacroAssembler.h:
2898         (JSC::MacroAssembler::moveDoubleConditionally32): Deleted.
2899         (JSC::MacroAssembler::moveDoubleConditionally64): Deleted.
2900         (JSC::MacroAssembler::moveDoubleConditionallyTest32): Deleted.
2901         (JSC::MacroAssembler::moveDoubleConditionallyTest64): Deleted.
2902         (JSC::MacroAssembler::moveDoubleConditionallyDouble): Deleted.
2903         (JSC::MacroAssembler::moveDoubleConditionallyFloat): Deleted.
2904         * assembler/MacroAssemblerARM64.h:
2905         (JSC::MacroAssemblerARM64::moveDoubleConditionallyAfterFloatingPointCompare):
2906         (JSC::MacroAssemblerARM64::moveDoubleConditionallyDouble):
2907         (JSC::MacroAssemblerARM64::moveDoubleConditionallyFloat):
2908         (JSC::MacroAssemblerARM64::moveConditionally32):
2909         (JSC::MacroAssemblerARM64::moveDoubleConditionally32):
2910         (JSC::MacroAssemblerARM64::moveDoubleConditionally64):
2911         (JSC::MacroAssemblerARM64::moveDoubleConditionallyTest32):
2912         (JSC::MacroAssemblerARM64::moveDoubleConditionallyTest64):
2913         (JSC::MacroAssemblerARM64::branch64):
2914         * assembler/MacroAssemblerX86Common.h:
2915         (JSC::MacroAssemblerX86Common::moveConditionally32):
2916         (JSC::MacroAssemblerX86Common::moveDoubleConditionally32):
2917         (JSC::MacroAssemblerX86Common::moveDoubleConditionallyTest32):
2918         (JSC::MacroAssemblerX86Common::moveDoubleConditionallyDouble):
2919         (JSC::MacroAssemblerX86Common::moveDoubleConditionallyFloat):
2920         * assembler/MacroAssemblerX86_64.h:
2921         (JSC::MacroAssemblerX86_64::moveDoubleConditionally64):
2922         (JSC::MacroAssemblerX86_64::moveDoubleConditionallyTest64):
2923         * b3/air/AirInstInlines.h:
2924         (JSC::B3::Air::Inst::shouldTryAliasingDef):
2925         * b3/air/AirOpcode.opcodes:
2926         * b3/testb3.cpp:
2927         (JSC::B3::populateWithInterestingValues):
2928         (JSC::B3::floatingPointOperands):
2929         (JSC::B3::int64Operands):
2930         (JSC::B3::int32Operands):
2931         (JSC::B3::testSelectCompareFloat):
2932         (JSC::B3::testSelectCompareFloatToDouble):
2933         (JSC::B3::testSelectDoubleCompareDouble):
2934         (JSC::B3::testSelectDoubleCompareDoubleWithAliasing):
2935         (JSC::B3::testSelectFloatCompareFloat):
2936         (JSC::B3::testSelectFloatCompareFloatWithAliasing):
2937         (JSC::B3::run):
2938
2939 2016-03-02  Joseph Pecoraro  <pecoraro@apple.com>
2940
2941         Add ability to generate a Heap Snapshot
2942         https://bugs.webkit.org/show_bug.cgi?id=154847
2943
2944         Reviewed by Mark Lam.
2945
2946         This adds HeapSnapshot, HeapSnapshotBuilder, and HeapProfiler.
2947
2948         HeapProfiler hangs off of the VM and holds the list of snapshots.
2949         I expect to add other HeapProfiling features, such as allocation
2950         tracking, to the profiler.
2951
2952         HeapSnapshot contains a collection of live cells and their identifiers.
2953         It can point to a previous HeapSnapshot, to ensure that a cell that
2954         already received an identifier maintains the same identifier across
2955         multiple snapshots. When a snapshotted cell gets garbage collected,
2956         the cell will be swept from the HeapSnapshot at the end of collection
2957         to ensure the list contains only live cells.
2958
2959         When building a HeapSnapshot nodes are added in increasing node
2960         identifier order. When done building, the list of nodes is complete
2961         and the snapshot is finalized. At this point the nodes are sorted
2962         by JSCell* address to allow for quick lookup of a JSCell*.
2963
2964         HeapSnapshotBuilder is where snapshotting begins. The builder
2965         will initiate a specialized heap snapshotting garbage collection.
2966         During this collection the builder will be notified of all marked
2967         (live) cells, and connections between cells, as seen by SlotVisitors.
2968         The builder can reference the previous, readonly, HeapSnapshots to
2969         avoid creating new nodes for cells that have already been snapshotted.
2970         When it is determined that we are visiting a live cell for the first
2971         time, we give the cell a unique identifier and add it to the the
2972         snapshot we are building.
2973
2974         Since edge data is costly, and of little long term utility, this
2975         data is only held by the builder for serialization, and not stored
2976         long term with the HeapSnapshot node data.
2977
2978         The goals of HeapSnapshotting at this time are:
2979         - minimal impact on performance when not profiling the heap
2980         - unique identifier for cells, so they may be identified across multiple snapshots
2981         - nodes and edges to be able to construct a graph of which nodes reference/retain which other nodes
2982         - node data - identifier, type (class name), size
2983         - edge data - from cell, to cell, type / data (to come in a follow-up patch)
2984
2985         * CMakeLists.txt:
2986         * JavaScriptCore.xcodeproj/project.pbxproj:
2987         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2988         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2989         Add new files to the build.
2990
2991         * heap/Heap.cpp:
2992         (JSC::Heap::isHeapSnapshotting):
2993         (JSC::RemoveDeadHeapSnapshotNodes::RemoveDeadHeapSnapshotNodes):
2994         (JSC::RemoveDeadHeapSnapshotNodes::operator()):
2995         (JSC::Heap::removeDeadHeapSnapshotNodes):
2996         (JSC::Heap::collectImpl):
2997         After every collection, sweep dead cells from in memory snapshots.
2998
2999         * runtime/VM.cpp:
3000         (JSC::VM::ensureHeapProfiler):
3001         * runtime/VM.h:
3002         (JSC::VM::heapProfiler):
3003         * heap/Heap.h:
3004         * heap/HeapProfiler.cpp: Added.
3005         (JSC::HeapProfiler::HeapProfiler):
3006         (JSC::HeapProfiler::~HeapProfiler):
3007         (JSC::HeapProfiler::mostRecentSnapshot):
3008         (JSC::HeapProfiler::appendSnapshot):
3009         (JSC::HeapProfiler::clearSnapshots):
3010         (JSC::HeapProfiler::setActiveSnapshotBuilder):
3011         * heap/HeapProfiler.h: Added.
3012         (JSC::HeapProfiler::vm):
3013         (JSC::HeapProfiler::activeSnapshotBuilder):
3014         VM and Heap can look at the profiler to determine if we are building a
3015         snapshot, or the "head" snapshot to use for sweeping.
3016
3017         * heap/HeapSnapshot.cpp: Added.
3018         (JSC::HeapSnapshot::HeapSnapshot):
3019         (JSC::HeapSnapshot::~HeapSnapshot):
3020         (JSC::HeapSnapshot::appendNode):
3021         Add a node to the unfinalized list of new cells.
3022
3023         (JSC::HeapSnapshot::sweepCell):
3024         (JSC::HeapSnapshot::shrinkToFit):
3025         Collect a list of cells for sweeping and then remove them all at once
3026         in shrinkToFit. This is done to avoid thrashing of individual removes
3027         that could cause many overlapping moves within the Vector.
3028
3029         (JSC::HeapSnapshot::finalize):
3030         Sort the list, and also cache the bounding start/stop identifiers.
3031         No other snapshot can contain an identifier in this range, so it will
3032         improve lookup of a node from an identifier.
3033
3034         (JSC::HeapSnapshot::nodeForCell):
3035         (JSC::HeapSnapshot::nodeForObjectIdentifier):
3036         Search helpers.
3037
3038         * heap/HeapSnapshotBuilder.h: Added.
3039         (JSC::HeapSnapshotNode::HeapSnapshotNode):
3040         (JSC::HeapSnapshotEdge::HeapSnapshotEdge):
3041         Node and Edge struct types the builder creates.
3042
3043         * heap/HeapSnapshotBuilder.cpp: Added.
3044         (JSC::HeapSnapshotBuilder::getNextObjectIdentifier):
3045         (JSC::HeapSnapshotBuilder::HeapSnapshotBuilder):
3046         (JSC::HeapSnapshotBuilder::~HeapSnapshotBuilder):
3047         (JSC::HeapSnapshotBuilder::buildSnapshot):
3048         (JSC::HeapSnapshotBuilder::appendNode):
3049         (JSC::HeapSnapshotBuilder::appendEdge):
3050         When building the snapshot, generating the next identifier, and
3051         appending to any of the lists must be guarded by a lock because
3052         SlotVisitors running in parallel may be accessing the builder.
3053
3054         (JSC::HeapSnapshotBuilder::hasExistingNodeForCell):
3055         Looking up if a node already exists in a previous snapshot can be
3056         done without a lock because at this point the data is readonly.
3057
3058         (JSC::edgeTypeToNumber):
3059         (JSC::edgeTypeToString):
3060         (JSC::HeapSnapshotBuilder::json):
3061         JSON serialization of a heap snapshot contains node and edge data.
3062
3063         * heap/SlotVisitor.h:
3064         * heap/SlotVisitor.cpp:
3065         (JSC::SlotVisitor::didStartMarking):
3066         (JSC::SlotVisitor::reset):
3067         Set/clear the active snapshot builder to know if this will be a
3068         snapshotting GC or not.
3069
3070         (JSC::SlotVisitor::append):
3071         (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
3072         Inform the builder of a new node or edge.
3073
3074         (JSC::SlotVisitor::visitChildren):
3075         Remember the current cell we are visiting so that if we need to
3076         inform the builder of edges we know the "from" cell.
3077
3078         * jsc.cpp:
3079         (SimpleObject::SimpleObject):
3080         (SimpleObject::create):
3081         (SimpleObject::finishCreation):
3082         (SimpleObject::visitChildren):
3083         (SimpleObject::createStructure):
3084         (SimpleObject::hiddenValue):
3085         (SimpleObject::setHiddenValue):
3086         Create a new class "SimpleObject" that can be used by heap snapshotting
3087         tests. It is easy to filter for this new class name and test internal
3088         edge relationships created by garbage collection visiting the cell.
3089
3090         (functionCreateSimpleObject):
3091         (functionGetHiddenValue):
3092         (functionSetHiddenValue):
3093         Expose methods to create and interact with a SimpleObject.
3094
3095         (functionGenerateHeapSnapshot):
3096         Expose methods to create a heap snapshot. This currently automatically
3097         turns the serialized string into a JSON object. That may change.
3098
3099         * tests/heapProfiler.yaml: Added.
3100         * tests/heapProfiler/basic-edges.js: Added.
3101         (excludeStructure):
3102         * tests/heapProfiler/basic-nodes.js: Added.
3103         (hasDifferentSizeNodes):
3104         (hasAllInternalNodes):
3105         Add tests for basic node and edge data.
3106
3107         * tests/heapProfiler/driver/driver.js: Added.
3108         (assert):
3109         (CheapHeapSnapshotNode):
3110         (CheapHeapSnapshotEdge):
3111         (CheapHeapSnapshotEdge.prototype.get from):
3112         (CheapHeapSnapshotEdge.prototype.get to):
3113         (CheapHeapSnapshot):
3114         (CheapHeapSnapshot.prototype.get nodes):
3115         (CheapHeapSnapshot.prototype.get edges):
3116         (CheapHeapSnapshot.prototype.nodeWithIdentifier):
3117         (CheapHeapSnapshot.prototype.nodesWithClassName):
3118         (CheapHeapSnapshot.prototype.classNameFromTableIndex):
3119         (CheapHeapSnapshot.prototype.edgeTypeFromTableIndex):
3120         (createCheapHeapSnapshot):
3121         (HeapSnapshotNode):
3122         (HeapSnapshotEdge):
3123         (HeapSnapshot):
3124         (HeapSnapshot.prototype.nodesWithClassName):
3125         (createHeapSnapshot):
3126         Add two HeapSnapshot representations.
3127         CheapHeapSnapshot creates two lists of node and edge data that
3128         lazily creates objects as needed.
3129         HeapSnapshot creates an object for each node and edge. This
3130         is wasteful but easier to use.
3131
3132 2016-03-02  Filip Pizlo  <fpizlo@apple.com>
3133
3134         RegExpPrototype should check for exceptions after calling toString and doing so should not be expensive
3135         https://bugs.webkit.org/show_bug.cgi?id=154927
3136
3137         Reviewed by Saam Barati.
3138
3139         While working on regexp optimizations, I found that RegExpPrototype calls toString(), an
3140         effectful operation that could do anything, without then checking for hadException().
3141
3142         So I added a call to hadException().
3143
3144         But that regressed Octane/regexp by 5%!  That's a lot!  It turns out that
3145         exec->hadException() is soooper slow. So, I made it cheaper to check for exceptions from
3146         toString(): there is now a variant called toStringFast() that returns null iff it throws an
3147         exception.
3148
3149         This allowed me to add the exception check without regressing perf.
3150
3151         Note that toString() must retain its old behavior of returning an empty string on exception.
3152         There is just too much code that relies on that behavior.
3153
3154         * runtime/JSCJSValue.cpp:
3155         (JSC::JSValue::isValidCallee):
3156         (JSC::JSValue::toStringSlowCase):
3157         (JSC::JSValue::toWTFStringSlowCase):
3158         * runtime/JSCJSValue.h:
3159         (JSC::JSValue::asValue):
3160         * runtime/JSString.h:
3161         (JSC::JSValue::toString):
3162         (JSC::JSValue::toStringFast):
3163         (JSC::JSValue::toWTFString):
3164         * runtime/RegExpPrototype.cpp:
3165         (JSC::regExpProtoFuncTest):
3166         (JSC::regExpProtoFuncExec):
3167         (JSC::regExpProtoFuncCompile):
3168
3169 2016-03-02  Saam barati  <sbarati@apple.com>
3170
3171         clean up JSObject::isExtensibleInline and JSObject::setPrototypeOfInline, and rename setPrototypeOf to setPrototype
3172         https://bugs.webkit.org/show_bug.cgi?id=154942
3173
3174         Reviewed by Benjamin Poulain.
3175
3176         These don't need to be inlined in the way they are.
3177         Doing dynamic dispatch is ok performance wise until
3178         we have evidence stating otherwise.
3179
3180         * API/JSObjectRef.cpp:
3181         (JSObjectSetPrototype):
3182         (JSObjectHasProperty):
3183         * runtime/ClassInfo.h:
3184         * runtime/IntlCollatorConstructor.cpp:
3185         (JSC::constructIntlCollator):
3186         * runtime/IntlDateTimeFormatConstructor.cpp:
3187         (JSC::constructIntlDateTimeFormat):
3188         * runtime/IntlNumberFormatConstructor.cpp:
3189         (JSC::constructIntlNumberFormat):
3190         * runtime/JSCell.cpp:
3191         (JSC::JSCell::isExtensible):
3192         (JSC::JSCell::setPrototype):
3193         (JSC::JSCell::setPrototypeOf): Deleted.
3194         * runtime/JSCell.h:
3195         * runtime/JSGlobalObjectFunctions.cpp:
3196         (JSC::globalFuncProtoSetter):
3197         * runtime/JSObject.cpp:
3198         (JSC::JSObject::setPrototypeWithCycleCheck):
3199         (JSC::JSObject::setPrototype):
3200         (JSC::JSObject::allowsAccessFrom):
3201         (JSC::JSObject::isExtensible):
3202         (JSC::JSObject::reifyAllStaticProperties):
3203         (JSC::JSObject::defineOwnNonIndexProperty):
3204         (JSC::JSObject::setPrototypeOf): Deleted.
3205         * runtime/JSObject.h:
3206         (JSC::JSObject::mayInterceptIndexedAccesses):
3207         (JSC::JSObject::indexingShouldBeSparse):
3208         (JSC::JSObject::setPrototypeOfInline): Deleted.
3209         (JSC::JSObject::isExtensibleInline): Deleted.
3210         * runtime/ObjectConstructor.cpp:
3211         (JSC::objectConstructorSetPrototypeOf):
3212         (JSC::objectConstructorIsSealed):
3213         (JSC::objectConstructorIsFrozen):
3214         (JSC::objectConstructorIsExtensible):
3215         * runtime/ProxyObject.cpp:
3216         (JSC::ProxyObject::performInternalMethodGetOwnProperty):
3217         (JSC::ProxyObject::performHasProperty):
3218         (JSC::ProxyObject::performPreventExtensions):
3219         (JSC::ProxyObject::performIsExtensible):
3220         * runtime/ReflectObject.cpp:
3221         (JSC::reflectObjectIsExtensible):
3222         (JSC::reflectObjectSetPrototypeOf):
3223         * runtime/StringObject.cpp:
3224         (JSC::StringObject::defineOwnProperty):
3225
3226 2016-03-02  Konstantin Tokarev  <annulen@yandex.ru>
3227
3228         [cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK.
3229         https://bugs.webkit.org/show_bug.cgi?id=154651
3230
3231         Reviewed by Alex Christensen.
3232
3233         * CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.
3234
3235 2016-03-02  Saam barati  <sbarati@apple.com>
3236
3237         [[SetPrototypeOf]] should be a fully virtual method in ClassInfo::methodTable
3238         https://bugs.webkit.org/show_bug.cgi?id=154897
3239
3240         Reviewed by Filip Pizlo.
3241
3242         This patch makes us more consistent with how the ES6 specification models the
3243         [[SetPrototypeOf]] trap. Moving this method into ClassInfo::methodTable
3244         is a prerequisite for implementing Proxy.[[SetPrototypeOf]]. This patch
3245         still allows directly setting the prototype for situations where this
3246         is the desired behavior. This is equivalent to setting the internal
3247         [[Prototype]] field as described in the specification.
3248
3249         * API/JSClassRef.cpp:
3250         (OpaqueJSClass::prototype):
3251         * API/JSObjectRef.cpp:
3252         (JSObjectMake):
3253         (JSObjectSetPrototype):
3254         (JSObjectHasProperty):
3255         * API/JSWrapperMap.mm:
3256         (makeWrapper):
3257         * runtime/ClassInfo.h:
3258         * runtime/IntlCollatorConstructor.cpp:
3259         (JSC::constructIntlCollator):
3260         * runtime/IntlDateTimeFormatConstructor.cpp:
3261         (JSC::constructIntlDateTimeFormat):
3262         * runtime/IntlNumberFormatConstructor.cpp:
3263         (JSC::constructIntlNumberFormat):
3264         * runtime/JSCell.cpp:
3265         (JSC::JSCell::isExtensible):
3266         (JSC::JSCell::setPrototypeOf):
3267         * runtime/JSCell.h:
3268         * runtime/JSGlobalObject.cpp:
3269         (JSC::JSGlobalObject::resetPrototype):
3270         * runtime/JSGlobalObjectFunctions.cpp:
3271         (JSC::globalFuncProtoSetter):
3272         * runtime/JSObject.cpp:
3273         (JSC::JSObject::switchToSlowPutArrayStorage):
3274         (JSC::JSObject::setPrototypeDirect):
3275         (JSC::JSObject::setPrototypeWithCycleCheck):
3276         (JSC::JSObject::setPrototypeOf):
3277         (JSC::JSObject::allowsAccessFrom):
3278         (JSC::JSObject::setPrototype): Deleted.
3279         * runtime/JSObject.h:
3280         (JSC::JSObject::setPrototypeOfInline):
3281         (JSC::JSObject::mayInterceptIndexedAccesses):
3282         * runtime/JSProxy.cpp:
3283         (JSC::JSProxy::setTarget):
3284         * runtime/ObjectConstructor.cpp:
3285         (JSC::objectConstructorSetPrototypeOf):
3286         * runtime/ReflectObject.cpp:
3287         (JSC::reflectObjectSetPrototypeOf):
3288
3289 2016-03-02  Saam barati  <sbarati@apple.com>
3290
3291         SIGSEGV in Proxy [[Get]] and [[Set]] recursion
3292         https://bugs.webkit.org/show_bug.cgi?id=154854
3293
3294         Reviewed by Yusuke Suzuki.
3295
3296         We need to be aware of the possibility that the VM
3297         may recurse and that we can stack overflow.
3298
3299         * runtime/ProxyObject.cpp:
3300         (JSC::performProxyGet):
3301         (JSC::ProxyObject::performPut):
3302         * tests/stress/proxy-get-and-set-recursion-stack-overflow.js: Added.
3303         (assert):
3304         (testStackOverflowGet):
3305         (testStackOverflowIndexedGet):
3306         (testStackOverflowSet):
3307         (testStackOverflowIndexedSet):
3308
3309 2016-03-02  Benjamin Poulain  <bpoulain@apple.com>
3310
3311         [JSC] Use a Move without REX byte when possible
3312         https://bugs.webkit.org/show_bug.cgi?id=154801
3313
3314         Reviewed by Alex Christensen.
3315
3316         Filip wrote an optimization in the register allocator
3317         to use 32bit "Move" when we don't care about the top bytes.
3318
3319         When I moved the commutative ops to the fake 3 operands instruction
3320         I largely destroyed this since all the "Moves" became full register.
3321
3322         In this patch, I switch back to 32bit "Moves" for 32bit operations.
3323
3324         * assembler/MacroAssemblerX86Common.h:
3325         (JSC::MacroAssemblerX86Common::and32):
3326         (JSC::MacroAssemblerX86Common::lshift32):
3327         (JSC::MacroAssemblerX86Common::mul32):
3328         (JSC::MacroAssemblerX86Common::or32):
3329         (JSC::MacroAssemblerX86Common::rshift32):
3330         (JSC::MacroAssemblerX86Common::urshift32):
3331         (JSC::MacroAssemblerX86Common::xor32):
3332         (JSC::MacroAssemblerX86Common::branchAdd32):
3333         (JSC::MacroAssemblerX86Common::branchMul32):
3334         (JSC::MacroAssemblerX86Common::branchSub32):
3335         (JSC::MacroAssemblerX86Common::move32IfNeeded):
3336
3337 2016-03-01  Benjamin Poulain  <benjamin@webkit.org>
3338
3339         [JSC] Simplify ArithMod(ArithMod(x, const1), const2) if const2 >= const1
3340         https://bugs.webkit.org/show_bug.cgi?id=154904
3341
3342         Reviewed by Saam Barati.
3343
3344         The ASM test "ubench" has a "x % 10 % 255".
3345         The second modulo should be eliminated.
3346
3347         This is a 15% improvement on ASMJS' ubench.
3348
3349         * dfg/DFGStrengthReductionPhase.cpp:
3350         (JSC::DFG::StrengthReductionPhase::handleNode):
3351         * tests/stress/arith-modulo-twice.js: Added.
3352         (opaqueModuloSmaller):
3353         (opaqueModuloEqual):
3354         (opaqueModuloLarger):