Source/JavaScriptCore/ChangeLog

   1 2014-07-30  Andreas Kling  <akling@apple.com>
   2
   3         Speculative Windows build fix.
   4
   5         Try to dllimport the dllexported global object HashTable.
   6
   7         * jsc.cpp:
   8         * testRegExp.cpp:
   9
  10 2014-07-30  Andreas Kling  <akling@apple.com>
  11
  12         PropertyName's internal string is always atomic.
  13         <https://webkit.org/b/135451>
  14
  15         Now that we've merged the JSC::Identifier and WTF::AtomicString tables,
  16         we know that any string that's an Identifier is guaranteed to be atomic.
  17
  18         A PropertyName can be either an Identifier or a PrivateName, and the
  19         private names are also guaranteed to be atomic internally.
  20
  21         Make PropertyName vend AtomicStringImpl* instead of StringImpl*.
  22
  23         Reviewed by Benjamin Poulain.
  24
  25         * runtime/PropertyName.h:
  26         (JSC::PropertyName::PropertyName):
  27         (JSC::PropertyName::uid):
  28         (JSC::PropertyName::publicName):
  29
  30 2014-07-30  Andy Estes  <aestes@apple.com>
  31
  32         USE(CONTENT_FILTERING) should be ENABLE(CONTENT_FILTERING)
  33         https://bugs.webkit.org/show_bug.cgi?id=135439
  34
  35         Reviewed by Tim Horton.
  36
  37         We now support two different platform content filters, and will soon support a mock content filter (as part of
  38         webkit.org/b/128858). This makes content filtering a feature of WebKit, not just an adoption of a third-party
  39         library. ENABLE() is the correct macro to use for such a feature.
  40
  41         * Configurations/FeatureDefines.xcconfig:
  42
  43 2014-07-30  Andreas Kling  <akling@apple.com>
  44
  45         Static hash tables no longer need to be coupled with a VM.
  46         <https://webkit.org/b/135421>
  47
  48         Now that the static hash tables are using char** instead of StringImpl**,
  49         it's no longer necessary to make them per-VM.
  50
  51         This patch removes the hook in ClassInfo for providing your own static
  52         hash table getter. Everyone now uses ClassInfo::staticPropHashTable.
  53         Most of this patch is tweaking ClassInfo construction sites to pass one
  54         less null pointer.
  55
  56         Also simplified Lookup.h to stop requiring ExecState/VM to access the
  57         static hash tables.
  58
  59         Reviewed by Geoffrey Garen.
  60
  61         * API/JSAPIWrapperObject.mm:
  62         * API/JSCallbackConstructor.cpp:
  63         * API/JSCallbackFunction.cpp:
  64         * API/JSCallbackObject.cpp:
  65         * API/ObjCCallbackFunction.mm:
  66         * bytecode/UnlinkedCodeBlock.cpp:
  67         * create_hash_table:
  68         * debugger/DebuggerScope.cpp:
  69         * inspector/JSInjectedScriptHost.cpp:
  70         * inspector/JSInjectedScriptHostPrototype.cpp:
  71         * inspector/JSJavaScriptCallFrame.cpp:
  72         * inspector/JSJavaScriptCallFramePrototype.cpp:
  73         * interpreter/CallFrame.h:
  74         (JSC::ExecState::arrayConstructorTable): Deleted.
  75         (JSC::ExecState::arrayPrototypeTable): Deleted.
  76         (JSC::ExecState::booleanPrototypeTable): Deleted.
  77         (JSC::ExecState::dataViewTable): Deleted.
  78         (JSC::ExecState::dateTable): Deleted.
  79         (JSC::ExecState::dateConstructorTable): Deleted.
  80         (JSC::ExecState::errorPrototypeTable): Deleted.
  81         (JSC::ExecState::globalObjectTable): Deleted.
  82         (JSC::ExecState::jsonTable): Deleted.
  83         (JSC::ExecState::numberConstructorTable): Deleted.
  84         (JSC::ExecState::numberPrototypeTable): Deleted.
  85         (JSC::ExecState::objectConstructorTable): Deleted.
  86         (JSC::ExecState::privateNamePrototypeTable): Deleted.
  87         (JSC::ExecState::regExpTable): Deleted.
  88         (JSC::ExecState::regExpConstructorTable): Deleted.
  89         (JSC::ExecState::regExpPrototypeTable): Deleted.
  90         (JSC::ExecState::stringConstructorTable): Deleted.
  91         (JSC::ExecState::promisePrototypeTable): Deleted.
  92         (JSC::ExecState::promiseConstructorTable): Deleted.
  93         * jsc.cpp:
  94         * parser/Lexer.h:
  95         (JSC::Keywords::isKeyword):
  96         (JSC::Keywords::getKeyword):
  97         * runtime/Arguments.cpp:
  98         * runtime/ArgumentsIteratorConstructor.cpp:
  99         * runtime/ArgumentsIteratorPrototype.cpp:
 100         * runtime/ArrayBufferNeuteringWatchpoint.cpp:
 101         * runtime/ArrayConstructor.cpp:
 102         (JSC::ArrayConstructor::getOwnPropertySlot):
 103         * runtime/ArrayIteratorConstructor.cpp:
 104         * runtime/ArrayIteratorPrototype.cpp:
 105         * runtime/ArrayPrototype.cpp:
 106         (JSC::ArrayPrototype::getOwnPropertySlot):
 107         * runtime/BooleanConstructor.cpp:
 108         * runtime/BooleanObject.cpp:
 109         * runtime/BooleanPrototype.cpp:
 110         (JSC::BooleanPrototype::getOwnPropertySlot):
 111         * runtime/ClassInfo.h:
 112         (JSC::ClassInfo::hasStaticProperties):
 113         (JSC::ClassInfo::propHashTable): Deleted.
 114         * runtime/ConsolePrototype.cpp:
 115         * runtime/CustomGetterSetter.cpp:
 116         * runtime/DateConstructor.cpp:
 117         (JSC::DateConstructor::getOwnPropertySlot):
 118         * runtime/DateInstance.cpp:
 119         * runtime/DatePrototype.cpp:
 120         (JSC::DatePrototype::getOwnPropertySlot):
 121         * runtime/Error.cpp:
 122         * runtime/ErrorConstructor.cpp:
 123         * runtime/ErrorInstance.cpp:
 124         * runtime/ErrorPrototype.cpp:
 125         (JSC::ErrorPrototype::getOwnPropertySlot):
 126         * runtime/ExceptionHelpers.cpp:
 127         * runtime/Executable.cpp:
 128         * runtime/FunctionConstructor.cpp:
 129         * runtime/FunctionPrototype.cpp:
 130         * runtime/GetterSetter.cpp:
 131         * runtime/InternalFunction.cpp:
 132         * runtime/JSAPIValueWrapper.cpp:
 133         * runtime/JSActivation.cpp:
 134         * runtime/JSArgumentsIterator.cpp:
 135         * runtime/JSArray.cpp:
 136         * runtime/JSArrayBuffer.cpp:
 137         * runtime/JSArrayBufferConstructor.cpp:
 138         * runtime/JSArrayBufferPrototype.cpp:
 139         * runtime/JSArrayBufferView.cpp:
 140         * runtime/JSArrayIterator.cpp:
 141         * runtime/JSBoundFunction.cpp:
 142         * runtime/JSConsole.cpp:
 143         * runtime/JSDataView.cpp:
 144         * runtime/JSDataViewPrototype.cpp:
 145         (JSC::JSDataViewPrototype::getOwnPropertySlot):
 146         * runtime/JSFunction.cpp:
 147         * runtime/JSGlobalObject.cpp:
 148         (JSC::JSGlobalObject::getOwnPropertySlot):
 149         * runtime/JSMap.cpp:
 150         * runtime/JSMapIterator.cpp:
 151         * runtime/JSNameScope.cpp:
 152         * runtime/JSNotAnObject.cpp:
 153         * runtime/JSONObject.cpp:
 154         (JSC::JSONObject::getOwnPropertySlot):
 155         * runtime/JSObject.cpp:
 156         (JSC::getClassPropertyNames):
 157         (JSC::JSObject::put):
 158         (JSC::JSObject::deleteProperty):
 159         (JSC::JSObject::findPropertyHashEntry):
 160         (JSC::JSObject::reifyStaticFunctionsForDelete):
 161         * runtime/JSObject.h:
 162         * runtime/JSPromise.cpp:
 163         * runtime/JSPromiseConstructor.cpp:
 164         (JSC::JSPromiseConstructor::getOwnPropertySlot):
 165         * runtime/JSPromiseDeferred.cpp:
 166         * runtime/JSPromisePrototype.cpp:
 167         (JSC::JSPromisePrototype::getOwnPropertySlot):
 168         * runtime/JSPromiseReaction.cpp:
 169         * runtime/JSPropertyNameIterator.cpp:
 170         * runtime/JSProxy.cpp:
 171         * runtime/JSSet.cpp:
 172         * runtime/JSSetIterator.cpp:
 173         * runtime/JSString.cpp:
 174         * runtime/JSTypedArrayConstructors.cpp:
 175         * runtime/JSTypedArrayPrototypes.cpp:
 176         * runtime/JSTypedArrays.cpp:
 177         * runtime/JSVariableObject.cpp:
 178         * runtime/JSWeakMap.cpp:
 179         * runtime/JSWithScope.cpp:
 180         * runtime/Lookup.cpp:
 181         (JSC::HashTable::createTable):
 182         * runtime/Lookup.h:
 183         (JSC::HashTable::initializeIfNeeded):
 184         (JSC::HashTable::entry):
 185         (JSC::HashTable::begin):
 186         (JSC::HashTable::end):
 187         (JSC::getStaticPropertySlot):
 188         (JSC::getStaticFunctionSlot):
 189         (JSC::getStaticValueSlot):
 190         (JSC::lookupPut):
 191         * runtime/MapConstructor.cpp:
 192         * runtime/MapData.cpp:
 193         * runtime/MapIteratorConstructor.cpp:
 194         * runtime/MapIteratorPrototype.cpp:
 195         * runtime/MapPrototype.cpp:
 196         * runtime/MathObject.cpp:
 197         * runtime/NameConstructor.cpp:
 198         * runtime/NameInstance.cpp:
 199         * runtime/NamePrototype.cpp:
 200         (JSC::NamePrototype::getOwnPropertySlot):
 201         * runtime/NativeErrorConstructor.cpp:
 202         * runtime/NumberConstructor.cpp:
 203         (JSC::NumberConstructor::getOwnPropertySlot):
 204         * runtime/NumberObject.cpp:
 205         * runtime/NumberPrototype.cpp:
 206         (JSC::NumberPrototype::getOwnPropertySlot):
 207         * runtime/ObjectConstructor.cpp:
 208         (JSC::ObjectConstructor::getOwnPropertySlot):
 209         * runtime/ObjectPrototype.cpp:
 210         * runtime/PropertyTable.cpp:
 211         * runtime/RegExp.cpp:
 212         * runtime/RegExpConstructor.cpp:
 213         (JSC::RegExpConstructor::getOwnPropertySlot):
 214         * runtime/RegExpMatchesArray.cpp:
 215         * runtime/RegExpObject.cpp:
 216         (JSC::RegExpObject::getOwnPropertySlot):
 217         * runtime/RegExpPrototype.cpp:
 218         (JSC::RegExpPrototype::getOwnPropertySlot):
 219         * runtime/SetConstructor.cpp:
 220         * runtime/SetIteratorConstructor.cpp:
 221         * runtime/SetIteratorPrototype.cpp:
 222         * runtime/SetPrototype.cpp:
 223         * runtime/SparseArrayValueMap.cpp:
 224         * runtime/StrictEvalActivation.cpp:
 225         * runtime/StringConstructor.cpp:
 226         (JSC::StringConstructor::getOwnPropertySlot):
 227         * runtime/StringObject.cpp:
 228         * runtime/StringPrototype.cpp:
 229         * runtime/Structure.cpp:
 230         (JSC::Structure::Structure):
 231         (JSC::Structure::freezeTransition):
 232         (JSC::ClassInfo::hasStaticSetterOrReadonlyProperties):
 233         * runtime/StructureChain.cpp:
 234         * runtime/StructureRareData.cpp:
 235         * runtime/SymbolTable.cpp:
 236         * runtime/VM.cpp:
 237         (JSC::VM::VM):
 238         (JSC::VM::~VM):
 239         * runtime/VM.h:
 240         * runtime/WeakMapConstructor.cpp:
 241         * runtime/WeakMapData.cpp:
 242         * runtime/WeakMapPrototype.cpp:
 243         * testRegExp.cpp:
 244
 245 2014-07-29  Brent Fulgham  <bfulgham@apple.com>
 246
 247         [Win] Modify version numbering scheme to support 5-tuple versions
 248         https://bugs.webkit.org/show_bug.cgi?id=135400
 249         <rdar://problem/17849033>
 250
 251         Reviewed by David Kilzer.
 252
 253         * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd: Use the
 254         new version-stamp.pl script to version JavaScriptCore.dll.
 255
 256 2014-07-29  Daniel Bates  <dabates@apple.com>
 257
 258         Use WTF::move() instead of std::move() to help ensure move semantics
 259         https://bugs.webkit.org/show_bug.cgi?id=135351
 260
 261         Reviewed by Alexey Proskuryakov.
 262
 263         * bytecode/GetByIdStatus.cpp:
 264         (JSC::GetByIdStatus::computeForStubInfo):
 265         * bytecode/GetByIdVariant.cpp:
 266         (JSC::GetByIdVariant::GetByIdVariant):
 267
 268 2014-07-28  Tamas Gergely  <tgergely.u-szeged@partner.samsung.com>
 269
 270         BuildFix: JavaScriptCore/bytecode/StructureSet.h:262:77: warning.
 271         https://bugs.webkit.org/show_bug.cgi?id=135287
 272
 273         Reviewed by Darin Adler.
 274
 275         The set() method tries to use a part of the old value (the reservedFlag bit) which
 276         was not defined when the constructor is called. Initialize m_pointer to 0 explicitely.
 277
 278         * bytecode/StructureSet.h:
 279         (JSC::StructureSet::StructureSet):
 280
 281 2014-07-28  Benjamin Poulain  <bpoulain@apple.com>
 282
 283         [JSC] JIT::assertStackPointerOffset() crashes on ARM64
 284         https://bugs.webkit.org/show_bug.cgi?id=135316
 285
 286         Reviewed by Geoffrey Garen.
 287
 288         JIT::assertStackPointerOffset() does a compare between an arbitrary register
 289         and the stack pointer. This was not supported by the ARM64 assembler.
 290
 291         There are no variation that can take a stack pointer for Xd. There is one version of subs
 292         that can take a stack pointer, but only for the Xn: the shift+extend one.
 293         To solve the problem, I changed cmp to swap the registers if necessary, and I fixed
 294         the implementation of sub.
 295
 296         * assembler/ARM64Assembler.h:
 297         (JSC::ARM64Assembler::sub):
 298         In the generic sub(reg, reg), I added assertions to catch the condition that cannot be generated
 299         with either version of sub.
 300
 301         In sub(with shift), I remove the weird special case for SP. First, it was quite misleading because
 302         the Rd case only works if "setflag == false". The other confusing part is going to addSubtractShiftedRegister()
 303         gives you a reduce shift range, which could create subtle bug that only appear when SP is used.
 304
 305         Since I removed the weird case, I need to differentiate between the sub() that support SP, and the one that does
 306         not elsewhere. That is why that branch has moved to the generic sub(reg, reg). Since at that point we know
 307         the shift value must be zero, it is safe to call either variant.
 308
 309         * assembler/MacroAssemblerARM64.h:
 310         (JSC::MacroAssemblerARM64::branch64):
 311         With the changes described above, we can now use SP for the left register. What do we do if the rightmost
 312         register is SP?
 313
 314         For the case of JIT::assertStackPointerOffset(), the comparison is Equal so the order really does not matter,
 315         we just switch the registers before generating the instruction.
 316
 317         For the generic case, just move the value of SP to a GPR before doing the CMP.
 318
 319 2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
 320
 321         Unreviewed build fix after r171682.
 322
 323         * replay/EncodedValue.h: Don't mark the inlined Vector<char> specialization
 324         as an exported symbol.
 325
 326 2014-07-28  Mark Hahnenberg  <mhahnenberg@apple.com>
 327
 328         REGRESSION: JSObjectSetPrototype() does not work on result of JSGetGlobalObject()
 329         https://bugs.webkit.org/show_bug.cgi?id=135322
 330
 331         Reviewed by Oliver Hunt.
 332
 333         The prototype chain of the JSProxy object should match that of the JSGlobalObject.
 334
 335         This is a separate but related issue with JSObjectSetPrototype which doesn't correctly
 336         account for JSProxies. I also audited the rest of the C API to check that we correctly
 337         handle JSProxies in all other situations where we expect a JSCallbackObject of some sort
 338         and found some SPI calls (JSObject*PrivateProperty) that didn't behave correctly when
 339         passed a JSProxy.
 340
 341         I also added some new tests for these cases.
 342
 343         * API/JSObjectRef.cpp:
 344         (JSObjectSetPrototype):
 345         (JSObjectGetPrivateProperty):
 346         (JSObjectSetPrivateProperty):
 347         (JSObjectDeletePrivateProperty):
 348         * API/JSWeakObjectMapRefPrivate.cpp:
 349         * API/tests/CustomGlobalObjectClassTest.c:
 350         (globalObjectSetPrototypeTest):
 351         (globalObjectPrivatePropertyTest):
 352         * API/tests/CustomGlobalObjectClassTest.h:
 353         * API/tests/testapi.c:
 354         (main):
 355
 356 2014-07-28  Filip Pizlo  <fpizlo@apple.com>
 357
 358         Make sure that we don't use non-speculative BooleanToNumber for a speculative Branch
 359         https://bugs.webkit.org/show_bug.cgi?id=135350
 360         <rdar://problem/17509889>
 361
 362         Reviewed by Mark Hahnenberg and Oliver Hunt.
 363
 364         If we have an exiting node that uses a conversion node, then that exiting node
 365         needs to have a Phantom after it for the the original node. But we can't do that
 366         for Branch because https://bugs.webkit.org/show_bug.cgi?id=126778.
 367
 368         * dfg/DFGFixupPhase.cpp:
 369         (JSC::DFG::FixupPhase::fixupNode):
 370         (JSC::DFG::FixupPhase::clearPhantomsAtEnd):
 371         * tests/stress/branch-check-int32-on-boolean-to-number-untyped.js: Added.
 372         (foo):
 373         (test):
 374         * tests/stress/branch-check-number-on-boolean-to-number-untyped.js: Added.
 375         (foo):
 376         (test):
 377
 378 2014-07-28  Joseph Pecoraro  <pecoraro@apple.com>
 379
 380         JSContext Inspector: crash when using step-into
 381         https://bugs.webkit.org/show_bug.cgi?id=135345
 382
 383         Reviewed by Timothy Hatcher.
 384
 385         * inspector/agents/InspectorDebuggerAgent.cpp:
 386         (Inspector::InspectorDebuggerAgent::stepInto):
 387         Null check m_listener since it may not be set.
 388
 389 2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
 390
 391         Web Replay: auto-decoding of parameterized vector's elements is incorrect
 392         https://bugs.webkit.org/show_bug.cgi?id=135343
 393
 394         Reviewed by Timothy Hatcher.
 395
 396         Fix an incorrect type argument in EncodingTraits<Vector<T>>::encodeValue
 397         that was using the element's decoded type as the type parameter to
 398         EncodedValue::append<T>. It should instead be the raw type T. This
 399         causes problems when encoding Vector<RefPtr<T>>, as it later tries to
 400         use encoding traits for RefPtr<T> rather than for T.
 401
 402         Fix incorrect generated encoding traits argument for vectors of
 403         RefCounted objects. Updated test to cover this scenario.
 404
 405         * replay/scripts/CodeGeneratorReplayInputs.py:
 406         (Type.encoding_type_argument):
 407         (VectorType.type_name):
 408         (VectorType):
 409         (VectorType.encoding_type_argument):
 410         (Generator.generate_input_encode_implementation):
 411         (Generator.generate_input_decode_implementation):
 412         * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.cpp:
 413         * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h:
 414         * replay/scripts/tests/generate-input-with-vector-members.json: Updated.
 415
 416 2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
 417
 418         Web Replay: incorrect serialization code generated for enum classes inside class scope
 419         https://bugs.webkit.org/show_bug.cgi?id=135342
 420
 421         Reviewed by Timothy Hatcher.
 422
 423         If an enum class is defined inside of a class scope, then the enum class
 424         cannot be forward-declared and the relevant header should be included.
 425         Some generated code used incorrectly-scoped enum values in this situation.
 426
 427         * replay/scripts/CodeGeneratorReplayInputs.py:
 428         (Generator.generate_includes.declaration.is):
 429         (Generator.generate_enum_trait_implementation.is):
 430         (Generator.generate_enum_trait_implementation):
 431
 432         Tests:
 433
 434         * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.cpp: Rebaselined.
 435         * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.h: Rebaselined.
 436         * replay/scripts/tests/generate-enums-with-same-base-name.json: Add enum
 437         class types to this test case.
 438
 439 2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
 440
 441         Web Replay: vectors of characters should be base64-encoded
 442         https://bugs.webkit.org/show_bug.cgi?id=135341
 443
 444         Reviewed by Timothy Hatcher.
 445
 446         Without this specialization, encode/decode methods try to create an
 447         array of single characters in JSON, rather than treating the
 448         vector as a binary blob.
 449
 450         * replay/EncodedValue.cpp:
 451         (JSC::EncodingTraits<Vector<char>>::encodeValue): Added.
 452         (JSC::EncodingTraits<Vector<char>>::decodeValue): Added.
 453         * replay/EncodedValue.h:
 454
 455 2014-07-28  Brent Fulgham  <bfulgham@apple.com>
 456
 457         [Win] Unreviewed build fix.
 458
 459         * JavaScriptCore.vcxproj/JavaScriptCore.proj: Switch from the 'Rebuild' target for MSBuild
 460         builds to the 'Build' target to avoid a spurious 'clean' in between build steps.
 461
 462 2014-07-27  Ryuan Choi  <ryuan.choi@samsung.com>
 463
 464         Unreviewed build fix on the EFL port
 465
 466         Build break because of -Werror=return-type
 467
 468         * bytecode/PutByIdVariant.cpp:
 469         (JSC::PutByIdVariant::oldStructureForTransition):
 470         * dfg/DFGValueStrength.h:
 471         (JSC::DFG::merge):
 472
 473 2014-07-27  Filip Pizlo  <fpizlo@apple.com>
 474
 475         [REGRESSION][ftlopt merge][32-bit] stress/prune-multi-put-by-offset-replace-or-transition-variant.js.dfg-eager hits an assertion in SpeculativeJIT::silentSavePlanForGPR
 476         https://bugs.webkit.org/show_bug.cgi?id=135323
 477
 478         Reviewed by Oliver Hunt.
 479
 480         SpeculativeJIT::silentSavePlanForGPR likes to believe that if a node is a constant,
 481         then it's a constant that can be represented using that node's current DataFormat.
 482         This doesn't work if the constant had been filled as a JSValue, and then one of the
 483         fillSpeculateBlah() methods had speculated that it's of some type that the constant
 484         isn't. Unless fillSpeculateBlah() specifically defends against this case, we'll have
 485         a constant that claims to have a contradictory data format.
 486
 487         This patch fixes such a bug in the 32-bit fillSpeculateCell(). The 64-bit
 488         fillSpeculateCell() appears to not have this bug, but I added a similar defense
 489         mechanism anyway just in case, since this is one of those mistakes that keeps
 490         reappearing.
 491
 492         * dfg/DFGSpeculativeJIT.cpp:
 493         (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
 494         * dfg/DFGSpeculativeJIT32_64.cpp:
 495         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 496         * dfg/DFGSpeculativeJIT64.cpp:
 497         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 498
 499 2014-07-27  Filip Pizlo  <fpizlo@apple.com>
 500
 501         Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
 502
 503         This fixes the previous mismerge and adds test coverage for the thing that went wrong.
 504
 505         Additional changes listed here:
 506
 507         * jsc.cpp:
 508         (functionHasCustomProperties): Expose a way of checking hasCustomProperties(), which the DOM relies on. The regression I previously introduced was because this didn't work right. Now we can test it!
 509         * runtime/Structure.cpp:
 510         (JSC::Structure::Structure): This was supposed to be setDidTransition(true); the last merge had it set to false.
 511         * tests/stress/has-custom-properties.js: Added. This test failed with the mismerge.
 512
 513     2014-06-27  Michael Saboff  <msaboff@apple.com>
 514
 515             Unreviewed build fix after r169795.
 516
 517             Fixed ASSERT for 32 bit build.
 518
 519             * dfg/DFGSpeculativeJIT.cpp:
 520             (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
 521
 522     2014-06-24  Saam Barati  <sbarati@apple.com>
 523
 524             Web Inspector: debugger should be able to show variable types
 525             https://bugs.webkit.org/show_bug.cgi?id=133395
 526
 527             Reviewed by Filip Pizlo.
 528
 529             Increase the amount of type information the VM gathers when directed
 530             to do so. This initial commit is working towards the goal of
 531             capturing, and then showing (via the Web Inspector) type information for all
 532             assignment and load operations. This patch doesn't have the feature fully
 533             implemented, but it ensures the VM has no performance regressions
 534             unless the feature is specifically turned on.
 535
 536             * JavaScriptCore.xcodeproj/project.pbxproj:
 537             * bytecode/BytecodeList.json:
 538             * bytecode/BytecodeUseDef.h:
 539             (JSC::computeUsesForBytecodeOffset):
 540             (JSC::computeDefsForBytecodeOffset):
 541             * bytecode/CodeBlock.cpp:
 542             (JSC::CodeBlock::dumpBytecode):
 543             (JSC::CodeBlock::CodeBlock):
 544             (JSC::CodeBlock::finalizeUnconditionally):
 545             * bytecode/CodeBlock.h:
 546             * bytecode/Instruction.h:
 547             * bytecode/TypeLocation.h: Added.
 548             (JSC::TypeLocation::TypeLocation):
 549             * bytecompiler/BytecodeGenerator.cpp:
 550             (JSC::BytecodeGenerator::emitMove):
 551             (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity):
 552             (JSC::BytecodeGenerator::emitPutToScope):
 553             (JSC::BytecodeGenerator::emitPutById):
 554             (JSC::BytecodeGenerator::emitPutByVal):
 555             * bytecompiler/BytecodeGenerator.h:
 556             (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity):
 557             * bytecompiler/NodesCodegen.cpp:
 558             (JSC::PostfixNode::emitResolve):
 559             (JSC::PrefixNode::emitResolve):
 560             (JSC::ReadModifyResolveNode::emitBytecode):
 561             (JSC::AssignResolveNode::emitBytecode):
 562             (JSC::ConstDeclNode::emitCodeSingle):
 563             (JSC::ForInNode::emitBytecode):
 564             * heap/Heap.cpp:
 565             (JSC::Heap::collect):
 566             * inspector/agents/InspectorRuntimeAgent.cpp:
 567             (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange):
 568             * inspector/agents/InspectorRuntimeAgent.h:
 569             * inspector/protocol/Runtime.json:
 570             * jsc.cpp:
 571             (GlobalObject::finishCreation):
 572             (functionDumpTypesForAllVariables):
 573             * llint/LLIntSlowPaths.cpp:
 574             (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 575             (JSC::LLInt::putToScopeCommon):
 576             * llint/LLIntSlowPaths.h:
 577             * llint/LowLevelInterpreter.asm:
 578             * runtime/HighFidelityLog.cpp: Added.
 579             (JSC::HighFidelityLog::initializeHighFidelityLog):
 580             (JSC::HighFidelityLog::~HighFidelityLog):
 581             (JSC::HighFidelityLog::recordTypeInformationForLocation):
 582             (JSC::HighFidelityLog::processHighFidelityLog):
 583             (JSC::HighFidelityLog::actuallyProcessLogThreadFunction):
 584             * runtime/HighFidelityLog.h: Added.
 585             (JSC::HighFidelityLog::HighFidelityLog):
 586             * runtime/HighFidelityTypeProfiler.cpp: Added.
 587             (JSC::HighFidelityTypeProfiler::getTypesForVariableInRange):
 588             (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableInRange):
 589             (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableInRange):
 590             (JSC::HighFidelityTypeProfiler::insertNewLocation):
 591             (JSC::HighFidelityTypeProfiler::getLocationBasedHash):
 592             * runtime/HighFidelityTypeProfiler.h: Added.
 593             * runtime/Options.h:
 594             * runtime/Structure.cpp:
 595             (JSC::Structure::toStructureShape):
 596             * runtime/Structure.h:
 597             * runtime/SymbolTable.cpp:
 598             (JSC::SymbolTable::SymbolTable):
 599             (JSC::SymbolTable::cloneCapturedNames):
 600             (JSC::SymbolTable::uniqueIDForVariable):
 601             (JSC::SymbolTable::uniqueIDForRegister):
 602             (JSC::SymbolTable::globalTypeSetForRegister):
 603             (JSC::SymbolTable::globalTypeSetForVariable):
 604             * runtime/SymbolTable.h:
 605             (JSC::SymbolTable::add):
 606             (JSC::SymbolTable::set):
 607             * runtime/TypeSet.cpp: Added.
 608             (JSC::TypeSet::TypeSet):
 609             (JSC::TypeSet::getRuntimeTypeForValue):
 610             (JSC::TypeSet::addTypeForValue):
 611             (JSC::TypeSet::removeDuplicatesInStructureHistory):
 612             (JSC::TypeSet::seenTypes):
 613             (JSC::TypeSet::dumpSeenTypes):
 614             (JSC::StructureShape::StructureShape):
 615             (JSC::StructureShape::markAsFinal):
 616             (JSC::StructureShape::addProperty):
 617             (JSC::StructureShape::propertyHash):
 618             (JSC::StructureShape::leastUpperBound):
 619             (JSC::StructureShape::stringRepresentation):
 620             * runtime/TypeSet.h: Added.
 621             (JSC::StructureShape::create):
 622             (JSC::TypeSet::create):
 623             * runtime/VM.cpp:
 624             (JSC::VM::VM):
 625             (JSC::VM::getTypesForVariableInRange):
 626             (JSC::VM::updateHighFidelityTypeProfileState):
 627             (JSC::VM::dumpHighFidelityProfilingTypes):
 628             * runtime/VM.h:
 629             (JSC::VM::isProfilingTypesWithHighFidelity):
 630             (JSC::VM::highFidelityLog):
 631             (JSC::VM::highFidelityTypeProfiler):
 632             (JSC::VM::nextLocation):
 633             (JSC::VM::getNextUniqueVariableID):
 634
 635     2014-06-26  Mark Lam  <mark.lam@apple.com>
 636
 637             Remove unused instantiation of the WithScope structure.
 638             <https://webkit.org/b/134331>
 639
 640             Reviewed by Oliver Hunt.
 641
 642             The WithScope structure instance is the VM is unused, and is now removed.
 643
 644             * runtime/VM.cpp:
 645             (JSC::VM::VM):
 646             * runtime/VM.h:
 647
 648     2014-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
 649
 650             Structure bit fields should have a consistent format
 651             https://bugs.webkit.org/show_bug.cgi?id=134307
 652
 653             Reviewed by Filip Pizlo.
 654
 655             Currently we use C-style bit fields for a number of member variables in Structure to save space.
 656             This makes it difficult to load these fields in the JIT. We should instead use our own bitfield
 657             format to make it easy to load and test these variables in JIT code.
 658
 659             * runtime/JSObject.cpp:
 660             (JSC::JSObject::putDirectNonIndexAccessor):
 661             (JSC::JSObject::reifyStaticFunctionsForDelete):
 662             * runtime/Structure.cpp:
 663             (JSC::StructureTransitionTable::contains):
 664             (JSC::StructureTransitionTable::get):
 665             (JSC::StructureTransitionTable::add):
 666             (JSC::Structure::Structure):
 667             (JSC::Structure::materializePropertyMap):
 668             (JSC::Structure::addPropertyTransition):
 669             (JSC::Structure::despecifyFunctionTransition):
 670             (JSC::Structure::toDictionaryTransition):
 671             (JSC::Structure::freezeTransition):
 672             (JSC::Structure::preventExtensionsTransition):
 673             (JSC::Structure::takePropertyTableOrCloneIfPinned):
 674             (JSC::Structure::nonPropertyTransition):
 675             (JSC::Structure::flattenDictionaryStructure):
 676             (JSC::Structure::addPropertyWithoutTransition):
 677             (JSC::Structure::pin):
 678             (JSC::Structure::allocateRareData):
 679             (JSC::Structure::cloneRareDataFrom):
 680             (JSC::Structure::getConcurrently):
 681             (JSC::Structure::putSpecificValue):
 682             (JSC::Structure::getPropertyNamesFromStructure):
 683             (JSC::Structure::visitChildren):
 684             (JSC::Structure::checkConsistency):
 685             * runtime/Structure.h:
 686             (JSC::Structure::isExtensible):
 687             (JSC::Structure::isDictionary):
 688             (JSC::Structure::isUncacheableDictionary):
 689             (JSC::Structure::propertyAccessesAreCacheable):
 690             (JSC::Structure::previousID):
 691             (JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck):
 692             (JSC::Structure::setContainsReadOnlyProperties):
 693             (JSC::Structure::disableSpecificFunctionTracking):
 694             (JSC::Structure::objectToStringValue):
 695             (JSC::Structure::setObjectToStringValue):
 696             (JSC::Structure::setPreviousID):
 697             (JSC::Structure::clearPreviousID):
 698             (JSC::Structure::previous):
 699             (JSC::Structure::rareData):
 700             (JSC::Structure::didTransition): Deleted.
 701             (JSC::Structure::hasGetterSetterProperties): Deleted.
 702             (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto): Deleted.
 703             (JSC::Structure::setHasGetterSetterProperties): Deleted.
 704             (JSC::Structure::hasNonEnumerableProperties): Deleted.
 705             (JSC::Structure::staticFunctionsReified): Deleted.
 706             (JSC::Structure::setStaticFunctionsReified): Deleted.
 707             * runtime/StructureInlines.h:
 708             (JSC::Structure::setEnumerationCache):
 709             (JSC::Structure::enumerationCache):
 710             (JSC::Structure::checkOffsetConsistency):
 711
 712     2014-06-24  Mark Lam  <mark.lam@apple.com>
 713
 714             [ftlopt] Renamed DebuggerActivation to DebuggerScope.
 715             <https://webkit.org/b/134273>
 716
 717             Reviewed by Michael Saboff.
 718
 719             * CMakeLists.txt:
 720             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 721             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
 722             * JavaScriptCore.xcodeproj/project.pbxproj:
 723             * debugger/DebuggerActivation.cpp: Removed.
 724             * debugger/DebuggerActivation.h: Removed.
 725             * debugger/DebuggerScope.cpp: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp.
 726             (JSC::DebuggerScope::DebuggerScope):
 727             (JSC::DebuggerScope::finishCreation):
 728             (JSC::DebuggerScope::visitChildren):
 729             (JSC::DebuggerScope::className):
 730             (JSC::DebuggerScope::getOwnPropertySlot):
 731             (JSC::DebuggerScope::put):
 732             (JSC::DebuggerScope::deleteProperty):
 733             (JSC::DebuggerScope::getOwnPropertyNames):
 734             (JSC::DebuggerScope::defineOwnProperty):
 735             (JSC::DebuggerActivation::DebuggerActivation): Deleted.
 736             (JSC::DebuggerActivation::finishCreation): Deleted.
 737             (JSC::DebuggerActivation::visitChildren): Deleted.
 738             (JSC::DebuggerActivation::className): Deleted.
 739             (JSC::DebuggerActivation::getOwnPropertySlot): Deleted.
 740             (JSC::DebuggerActivation::put): Deleted.
 741             (JSC::DebuggerActivation::deleteProperty): Deleted.
 742             (JSC::DebuggerActivation::getOwnPropertyNames): Deleted.
 743             (JSC::DebuggerActivation::defineOwnProperty): Deleted.
 744             * debugger/DebuggerScope.h: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h.
 745             (JSC::DebuggerScope::create):
 746             (JSC::DebuggerActivation::create): Deleted.
 747             * runtime/VM.cpp:
 748             (JSC::VM::VM):
 749             * runtime/VM.h:
 750
 751     2014-06-24  Filip Pizlo  <fpizlo@apple.com>
 752
 753             [ftlopt] PutByIdFlush can also be converted to a PutByOffset so don't assert otherwise
 754             https://bugs.webkit.org/show_bug.cgi?id=134265
 755
 756             Reviewed by Geoffrey Garen.
 757
 758             More assertion fallout from the PutById folding work.
 759
 760             * dfg/DFGNode.h:
 761             (JSC::DFG::Node::convertToPutByOffset):
 762
 763     2014-06-24  Filip Pizlo  <fpizlo@apple.com>
 764
 765             [ftlopt] GC should notify us if it resets to_this
 766             https://bugs.webkit.org/show_bug.cgi?id=128231
 767
 768             Reviewed by Geoffrey Garen.
 769
 770             * CMakeLists.txt:
 771             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 772             * JavaScriptCore.xcodeproj/project.pbxproj:
 773             * bytecode/BytecodeList.json:
 774             * bytecode/CodeBlock.cpp:
 775             (JSC::CodeBlock::dumpBytecode):
 776             (JSC::CodeBlock::finalizeUnconditionally):
 777             * bytecode/Instruction.h:
 778             * bytecode/ToThisStatus.cpp: Added.
 779             (JSC::merge):
 780             (WTF::printInternal):
 781             * bytecode/ToThisStatus.h: Added.
 782             * bytecompiler/BytecodeGenerator.cpp:
 783             (JSC::BytecodeGenerator::BytecodeGenerator):
 784             * dfg/DFGByteCodeParser.cpp:
 785             (JSC::DFG::ByteCodeParser::parseBlock):
 786             * llint/LowLevelInterpreter32_64.asm:
 787             * llint/LowLevelInterpreter64.asm:
 788             * runtime/CommonSlowPaths.cpp:
 789             (JSC::SLOW_PATH_DECL):
 790
 791     2014-06-24  Filip Pizlo  <fpizlo@apple.com>
 792
 793             [ftlopt] StructureAbstractValue::onlyStructure() should return nullptr if isClobbered()
 794             https://bugs.webkit.org/show_bug.cgi?id=134256
 795
 796             Reviewed by Michael Saboff.
 797
 798             This isn't testable right now (i.e. it's benign) but we should get it right anyway. The
 799             point is to be able to precisely model what goes on in the snippets of code between a
 800             side-effect and an InvalidationPoint.
 801
 802             This patch also cleans up onlyStructure() by delegating more work to
 803             StructureSet::onlyStructure().
 804
 805             * dfg/DFGStructureAbstractValue.h:
 806             (JSC::DFG::StructureAbstractValue::onlyStructure):
 807
 808     2014-06-24  Filip Pizlo  <fpizlo@apple.com>
 809
 810             [ftlopt][REGRESSION] PutById AI is introducing watchable structures without watching them
 811             https://bugs.webkit.org/show_bug.cgi?id=134260
 812
 813             Reviewed by Geoffrey Garen.
 814
 815             This was causing loads of assertion failures in debug builds.
 816
 817             * dfg/DFGAbstractInterpreterInlines.h:
 818             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
 819
 820     2014-06-21  Filip Pizlo  <fpizlo@apple.com>
 821
 822             [ftlopt] Fold GetById/PutById to MultiGetByOffset/GetByOffset or MultiPutByOffset/PutByOffset, which implies handling non-singleton sets
 823             https://bugs.webkit.org/show_bug.cgi?id=134090
 824
 825             Reviewed by Oliver Hunt.
 826
 827             This pretty much finishes off the work to eliminate the special-casing of singleton
 828             structure sets by making it possible to fold GetById and PutById to various polymorphic
 829             forms of the ByOffset nodes.
 830
 831             * bytecode/GetByIdStatus.cpp:
 832             (JSC::GetByIdStatus::computeForStubInfo):
 833             (JSC::GetByIdStatus::computeFor):
 834             * bytecode/GetByIdStatus.h:
 835             * bytecode/PutByIdStatus.cpp:
 836             (JSC::PutByIdStatus::computeFor):
 837             * bytecode/PutByIdStatus.h:
 838             * bytecode/PutByIdVariant.h:
 839             (JSC::PutByIdVariant::constantChecks):
 840             * dfg/DFGAbstractInterpreterInlines.h:
 841             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
 842             * dfg/DFGByteCodeParser.cpp:
 843             (JSC::DFG::ByteCodeParser::parseBlock):
 844             * dfg/DFGConstantFoldingPhase.cpp:
 845             (JSC::DFG::ConstantFoldingPhase::foldConstants):
 846             (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
 847             (JSC::DFG::ConstantFoldingPhase::addChecks):
 848             * dfg/DFGNode.h:
 849             (JSC::DFG::Node::convertToMultiGetByOffset):
 850             (JSC::DFG::Node::convertToMultiPutByOffset):
 851             * dfg/DFGSpeculativeJIT64.cpp: Also convert all release assertions to DFG assertions in this file, because I was hitting some of them while debugging.
 852             (JSC::DFG::SpeculativeJIT::fillJSValue):
 853             (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
 854             (JSC::DFG::SpeculativeJIT::emitCall):
 855             (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
 856             (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
 857             (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
 858             (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
 859             (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 860             (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
 861             (JSC::DFG::SpeculativeJIT::compileLogicalNot):
 862             (JSC::DFG::SpeculativeJIT::emitBranch):
 863             (JSC::DFG::SpeculativeJIT::compile):
 864             * dfg/DFGStructureAbstractValue.h:
 865             (JSC::DFG::StructureAbstractValue::set):
 866
 867     2014-06-19  Filip Pizlo  <fpizlo@apple.com>
 868
 869             [ftlopt] StructureSet::onlyStructure() should return nullptr if it's not a singleton (instead of asserting)
 870             https://bugs.webkit.org/show_bug.cgi?id=134077
 871
 872             Reviewed by Sam Weinig.
 873
 874             This makes StructureSet and StructureAbstractValue more consistent and fixes a debug assert
 875             in the abstract interpreter.
 876
 877             * bytecode/StructureSet.h:
 878             (JSC::StructureSet::onlyStructure):
 879
 880     2014-06-18  Filip Pizlo  <fpizlo@apple.com>
 881
 882             DFG AI and constant folder should be able to precisely prune MultiGetByOffset/MultiPutByOffset even if the base structure abstract value is not a singleton
 883             https://bugs.webkit.org/show_bug.cgi?id=133918
 884
 885             Reviewed by Mark Hahnenberg.
 886
 887             This also adds pruning of PutStructure, since I basically had no choice but
 888             to implement such logic within MultiPutByOffset.
 889
 890             Also adds a bunch of PutById cache status dumping to bytecode dumping.
 891
 892             * bytecode/GetByIdVariant.cpp:
 893             (JSC::GetByIdVariant::dumpInContext):
 894             * bytecode/GetByIdVariant.h:
 895             (JSC::GetByIdVariant::structureSet):
 896             * bytecode/PutByIdVariant.h:
 897             (JSC::PutByIdVariant::oldStructure):
 898             * bytecode/StructureSet.cpp:
 899             (JSC::StructureSet::filter):
 900             (JSC::StructureSet::filterArrayModes):
 901             * bytecode/StructureSet.h:
 902             * dfg/DFGAbstractInterpreterInlines.h:
 903             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
 904             * dfg/DFGAbstractValue.cpp:
 905             (JSC::DFG::AbstractValue::changeStructure):
 906             (JSC::DFG::AbstractValue::contains):
 907             * dfg/DFGAbstractValue.h:
 908             (JSC::DFG::AbstractValue::couldBeType):
 909             (JSC::DFG::AbstractValue::isType):
 910             * dfg/DFGConstantFoldingPhase.cpp:
 911             (JSC::DFG::ConstantFoldingPhase::foldConstants):
 912             (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
 913             (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
 914             (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
 915             * dfg/DFGGraph.cpp:
 916             (JSC::DFG::Graph::freezeStrong):
 917             * dfg/DFGGraph.h:
 918             * dfg/DFGStructureAbstractValue.h:
 919             (JSC::DFG::StructureAbstractValue::operator=):
 920             * ftl/FTLLowerDFGToLLVM.cpp:
 921             (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
 922             * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Added.
 923             (foo):
 924             (fu):
 925             (bar):
 926             (baz):
 927             (.bar):
 928             (.baz):
 929             * tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Added.
 930             (foo):
 931             (fu):
 932             (bar):
 933             (baz):
 934             (.bar):
 935             (.baz):
 936             * tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Added.
 937             (foo):
 938             (fu):
 939             (bar):
 940             (baz):
 941             (.bar):
 942             (.baz):
 943
 944     2014-06-18  Mark Hahnenberg  <mhahnenberg@apple.com>
 945
 946             Remove CompoundType and LeafType
 947             https://bugs.webkit.org/show_bug.cgi?id=134037
 948
 949             Reviewed by Filip Pizlo.
 950
 951             We don't use them for anything. We'll replace them with a generic CellType type for all
 952             the objects that are JSCells, aren't JSObjects, and for which we generally don't care about
 953             their JSType at runtime.
 954
 955             * llint/LLIntData.cpp:
 956             (JSC::LLInt::Data::performAssertions):
 957             * runtime/ArrayBufferNeuteringWatchpoint.cpp:
 958             (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
 959             * runtime/Executable.h:
 960             (JSC::ExecutableBase::createStructure):
 961             (JSC::NativeExecutable::createStructure):
 962             * runtime/JSPromiseDeferred.h:
 963             (JSC::JSPromiseDeferred::createStructure):
 964             * runtime/JSPromiseReaction.h:
 965             (JSC::JSPromiseReaction::createStructure):
 966             * runtime/JSPropertyNameIterator.h:
 967             (JSC::JSPropertyNameIterator::createStructure):
 968             * runtime/JSType.h:
 969             * runtime/JSTypeInfo.h:
 970             (JSC::TypeInfo::TypeInfo):
 971             * runtime/MapData.h:
 972             (JSC::MapData::createStructure):
 973             * runtime/PropertyMapHashTable.h:
 974             (JSC::PropertyTable::createStructure):
 975             * runtime/RegExp.h:
 976             (JSC::RegExp::createStructure):
 977             * runtime/SparseArrayValueMap.cpp:
 978             (JSC::SparseArrayValueMap::createStructure):
 979             * runtime/Structure.cpp:
 980             (JSC::Structure::Structure):
 981             * runtime/StructureChain.h:
 982             (JSC::StructureChain::createStructure):
 983             * runtime/StructureRareData.cpp:
 984             (JSC::StructureRareData::createStructure):
 985             * runtime/SymbolTable.h:
 986             (JSC::SymbolTable::createStructure):
 987             * runtime/WeakMapData.h:
 988             (JSC::WeakMapData::createStructure):
 989
 990     2014-06-17  Filip Pizlo  <fpizlo@apple.com>
 991
 992             [ftlopt] PutStructure and PhantomPutStructure shouldn't leave the world in a clobbered state
 993             https://bugs.webkit.org/show_bug.cgi?id=134002
 994
 995             Reviewed by Mark Hahnenberg.
 996
 997             The effect of this bug was that if we had a PutStructure or PhantomPutStructure then any
 998             JSConstants would be in a Clobbered state, so we wouldn't take advantage of our knowledge
 999             of the structure if that structure was watchable.
1000
1001             Also kill PhantomPutStructure.
1002
1003             * dfg/DFGAbstractInterpreterInlines.h:
1004             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1005             (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
1006             (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
1007             * dfg/DFGClobberize.h:
1008             (JSC::DFG::clobberize):
1009             * dfg/DFGDoesGC.cpp:
1010             (JSC::DFG::doesGC):
1011             * dfg/DFGFixupPhase.cpp:
1012             (JSC::DFG::FixupPhase::fixupNode):
1013             * dfg/DFGGraph.cpp:
1014             (JSC::DFG::Graph::visitChildren):
1015             * dfg/DFGNode.h:
1016             (JSC::DFG::Node::hasTransition):
1017             * dfg/DFGNodeType.h:
1018             * dfg/DFGPredictionPropagationPhase.cpp:
1019             (JSC::DFG::PredictionPropagationPhase::propagate):
1020             * dfg/DFGSafeToExecute.h:
1021             (JSC::DFG::safeToExecute):
1022             * dfg/DFGSpeculativeJIT32_64.cpp:
1023             (JSC::DFG::SpeculativeJIT::compile):
1024             * dfg/DFGSpeculativeJIT64.cpp:
1025             (JSC::DFG::SpeculativeJIT::compile):
1026             * dfg/DFGStructureAbstractValue.cpp:
1027             (JSC::DFG::StructureAbstractValue::observeTransition):
1028             (JSC::DFG::StructureAbstractValue::observeTransitions):
1029             * dfg/DFGValidate.cpp:
1030             (JSC::DFG::Validate::validate):
1031             * dfg/DFGWatchableStructureWatchingPhase.cpp:
1032             (JSC::DFG::WatchableStructureWatchingPhase::run):
1033             * ftl/FTLCapabilities.cpp:
1034             (JSC::FTL::canCompile):
1035             * ftl/FTLLowerDFGToLLVM.cpp:
1036             (JSC::FTL::LowerDFGToLLVM::compileNode):
1037             (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure): Deleted.
1038
1039     2014-06-17  Filip Pizlo  <fpizlo@apple.com>
1040
1041             [ftlopt] DFG put_by_id should inline accesses with a slightly polymorphic base
1042             https://bugs.webkit.org/show_bug.cgi?id=133964
1043
1044             Reviewed by Mark Hahnenberg.
1045
1046             * bytecode/PutByIdStatus.cpp:
1047             (JSC::PutByIdStatus::appendVariant):
1048             (JSC::PutByIdStatus::computeForStubInfo):
1049             * bytecode/PutByIdVariant.cpp:
1050             (JSC::PutByIdVariant::oldStructureForTransition):
1051             (JSC::PutByIdVariant::writesStructures):
1052             (JSC::PutByIdVariant::reallocatesStorage):
1053             (JSC::PutByIdVariant::attemptToMerge):
1054             (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace):
1055             (JSC::PutByIdVariant::dumpInContext):
1056             * bytecode/PutByIdVariant.h:
1057             (JSC::PutByIdVariant::PutByIdVariant):
1058             (JSC::PutByIdVariant::replace):
1059             (JSC::PutByIdVariant::transition):
1060             (JSC::PutByIdVariant::structure):
1061             (JSC::PutByIdVariant::oldStructure):
1062             * dfg/DFGAbstractInterpreterInlines.h:
1063             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1064             * dfg/DFGByteCodeParser.cpp:
1065             (JSC::DFG::ByteCodeParser::handlePutById):
1066             (JSC::DFG::ByteCodeParser::parseBlock):
1067             * dfg/DFGConstantFoldingPhase.cpp:
1068             (JSC::DFG::ConstantFoldingPhase::foldConstants):
1069             (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
1070             * dfg/DFGGraph.cpp:
1071             (JSC::DFG::Graph::visitChildren):
1072             * dfg/DFGNode.cpp:
1073             (JSC::DFG::MultiPutByOffsetData::writesStructures):
1074             (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
1075             * ftl/FTLAbbreviations.h:
1076             (JSC::FTL::getLinkage):
1077             * ftl/FTLLowerDFGToLLVM.cpp:
1078             (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
1079             (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
1080
1081 2014-07-26  Filip Pizlo  <fpizlo@apple.com>
1082
1083         Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
1084         reland later.
1085
1086         * CMakeLists.txt:
1087         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1088         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1089         * JavaScriptCore.xcodeproj/project.pbxproj:
1090         * bytecode/BytecodeList.json:
1091         * bytecode/BytecodeUseDef.h:
1092         (JSC::computeUsesForBytecodeOffset):
1093         (JSC::computeDefsForBytecodeOffset):
1094         * bytecode/CodeBlock.cpp:
1095         (JSC::CodeBlock::dumpBytecode):
1096         (JSC::CodeBlock::CodeBlock):
1097         (JSC::CodeBlock::finalizeUnconditionally):
1098         (JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
1099         * bytecode/CodeBlock.h:
1100         * bytecode/GetByIdStatus.cpp:
1101         (JSC::GetByIdStatus::computeForStubInfo):
1102         (JSC::GetByIdStatus::computeFor):
1103         * bytecode/GetByIdStatus.h:
1104         * bytecode/GetByIdVariant.cpp:
1105         (JSC::GetByIdVariant::dumpInContext):
1106         * bytecode/GetByIdVariant.h:
1107         (JSC::GetByIdVariant::structureSet):
1108         * bytecode/Instruction.h:
1109         * bytecode/PutByIdStatus.cpp:
1110         (JSC::PutByIdStatus::appendVariant):
1111         (JSC::PutByIdStatus::computeForStubInfo):
1112         (JSC::PutByIdStatus::computeFor):
1113         * bytecode/PutByIdStatus.h:
1114         * bytecode/PutByIdVariant.cpp:
1115         (JSC::PutByIdVariant::dumpInContext):
1116         (JSC::PutByIdVariant::oldStructureForTransition): Deleted.
1117         (JSC::PutByIdVariant::writesStructures): Deleted.
1118         (JSC::PutByIdVariant::reallocatesStorage): Deleted.
1119         (JSC::PutByIdVariant::attemptToMerge): Deleted.
1120         (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace): Deleted.
1121         * bytecode/PutByIdVariant.h:
1122         (JSC::PutByIdVariant::PutByIdVariant):
1123         (JSC::PutByIdVariant::replace):
1124         (JSC::PutByIdVariant::transition):
1125         (JSC::PutByIdVariant::structure):
1126         (JSC::PutByIdVariant::oldStructure):
1127         (JSC::PutByIdVariant::newStructure):
1128         (JSC::PutByIdVariant::constantChecks):
1129         * bytecode/StructureSet.cpp:
1130         (JSC::StructureSet::filter): Deleted.
1131         (JSC::StructureSet::filterArrayModes): Deleted.
1132         * bytecode/StructureSet.h:
1133         (JSC::StructureSet::onlyStructure):
1134         * bytecode/ToThisStatus.cpp: Removed.
1135         * bytecode/ToThisStatus.h: Removed.
1136         * bytecode/TypeLocation.h: Removed.
1137         * bytecompiler/BytecodeGenerator.cpp:
1138         (JSC::BytecodeGenerator::BytecodeGenerator):
1139         (JSC::BytecodeGenerator::emitMove):
1140         (JSC::BytecodeGenerator::emitPutToScope):
1141         (JSC::BytecodeGenerator::emitPutById):
1142         (JSC::BytecodeGenerator::emitPutByVal):
1143         (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity): Deleted.
1144         * bytecompiler/BytecodeGenerator.h:
1145         (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity): Deleted.
1146         * bytecompiler/NodesCodegen.cpp:
1147         (JSC::PostfixNode::emitResolve):
1148         (JSC::PrefixNode::emitResolve):
1149         (JSC::ReadModifyResolveNode::emitBytecode):
1150         (JSC::AssignResolveNode::emitBytecode):
1151         (JSC::ConstDeclNode::emitCodeSingle):
1152         (JSC::ForInNode::emitBytecode):
1153         * debugger/DebuggerActivation.cpp: Added.
1154         (JSC::DebuggerActivation::DebuggerActivation):
1155         (JSC::DebuggerActivation::finishCreation):
1156         (JSC::DebuggerActivation::visitChildren):
1157         (JSC::DebuggerActivation::className):
1158         (JSC::DebuggerActivation::getOwnPropertySlot):
1159         (JSC::DebuggerActivation::put):
1160         (JSC::DebuggerActivation::deleteProperty):
1161         (JSC::DebuggerActivation::getOwnPropertyNames):
1162         (JSC::DebuggerActivation::defineOwnProperty):
1163         * debugger/DebuggerActivation.h: Added.
1164         (JSC::DebuggerActivation::create):
1165         (JSC::DebuggerActivation::createStructure):
1166         * debugger/DebuggerScope.cpp: Removed.
1167         * debugger/DebuggerScope.h: Removed.
1168         * dfg/DFGAbstractInterpreterInlines.h:
1169         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1170         (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
1171         (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
1172         * dfg/DFGAbstractValue.cpp:
1173         (JSC::DFG::AbstractValue::changeStructure): Deleted.
1174         (JSC::DFG::AbstractValue::contains): Deleted.
1175         * dfg/DFGAbstractValue.h:
1176         (JSC::DFG::AbstractValue::couldBeType):
1177         (JSC::DFG::AbstractValue::isType):
1178         * dfg/DFGByteCodeParser.cpp:
1179         (JSC::DFG::ByteCodeParser::handlePutById):
1180         (JSC::DFG::ByteCodeParser::parseBlock):
1181         * dfg/DFGClobberize.h:
1182         (JSC::DFG::clobberize):
1183         * dfg/DFGConstantFoldingPhase.cpp:
1184         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1185         (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
1186         (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
1187         (JSC::DFG::ConstantFoldingPhase::addBaseCheck): Deleted.
1188         (JSC::DFG::ConstantFoldingPhase::addChecks): Deleted.
1189         * dfg/DFGDoesGC.cpp:
1190         (JSC::DFG::doesGC):
1191         * dfg/DFGFixupPhase.cpp:
1192         (JSC::DFG::FixupPhase::fixupNode):
1193         * dfg/DFGGraph.cpp:
1194         (JSC::DFG::Graph::visitChildren):
1195         (JSC::DFG::Graph::freezeStrong):
1196         * dfg/DFGGraph.h:
1197         * dfg/DFGNode.cpp:
1198         (JSC::DFG::MultiPutByOffsetData::writesStructures):
1199         (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
1200         * dfg/DFGNode.h:
1201         (JSC::DFG::Node::convertToPutByOffset):
1202         (JSC::DFG::Node::hasTransition):
1203         (JSC::DFG::Node::convertToMultiGetByOffset): Deleted.
1204         (JSC::DFG::Node::convertToMultiPutByOffset): Deleted.
1205         * dfg/DFGNodeType.h:
1206         * dfg/DFGPredictionPropagationPhase.cpp:
1207         (JSC::DFG::PredictionPropagationPhase::propagate):
1208         * dfg/DFGSafeToExecute.h:
1209         (JSC::DFG::safeToExecute):
1210         * dfg/DFGSpeculativeJIT.cpp:
1211         (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
1212         * dfg/DFGSpeculativeJIT32_64.cpp:
1213         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
1214         (JSC::DFG::SpeculativeJIT::compile):
1215         * dfg/DFGSpeculativeJIT64.cpp:
1216         (JSC::DFG::SpeculativeJIT::fillJSValue):
1217         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
1218         (JSC::DFG::SpeculativeJIT::emitCall):
1219         (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
1220         (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
1221         (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
1222         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
1223         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
1224         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
1225         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
1226         (JSC::DFG::SpeculativeJIT::emitBranch):
1227         (JSC::DFG::SpeculativeJIT::compile):
1228         * dfg/DFGStructureAbstractValue.cpp:
1229         (JSC::DFG::StructureAbstractValue::observeTransition):
1230         (JSC::DFG::StructureAbstractValue::observeTransitions):
1231         * dfg/DFGStructureAbstractValue.h:
1232         (JSC::DFG::StructureAbstractValue::onlyStructure):
1233         (JSC::DFG::StructureAbstractValue::operator=): Deleted.
1234         (JSC::DFG::StructureAbstractValue::set): Deleted.
1235         * dfg/DFGValidate.cpp:
1236         (JSC::DFG::Validate::validate):
1237         * dfg/DFGWatchableStructureWatchingPhase.cpp:
1238         (JSC::DFG::WatchableStructureWatchingPhase::run):
1239         * ftl/FTLAbbreviations.h:
1240         (JSC::FTL::getLinkage): Deleted.
1241         * ftl/FTLCapabilities.cpp:
1242         (JSC::FTL::canCompile):
1243         * ftl/FTLLowerDFGToLLVM.cpp:
1244         (JSC::FTL::LowerDFGToLLVM::compileNode):
1245         (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
1246         (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
1247         (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
1248         (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
1249         * heap/Heap.cpp:
1250         (JSC::Heap::collect):
1251         * inspector/agents/InspectorRuntimeAgent.cpp:
1252         (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange): Deleted.
1253         * inspector/agents/InspectorRuntimeAgent.h:
1254         * inspector/protocol/Runtime.json:
1255         * jsc.cpp:
1256         (GlobalObject::finishCreation):
1257         (functionDumpTypesForAllVariables): Deleted.
1258         * llint/LLIntData.cpp:
1259         (JSC::LLInt::Data::performAssertions):
1260         * llint/LLIntSlowPaths.cpp:
1261         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1262         (JSC::LLInt::putToScopeCommon): Deleted.
1263         * llint/LLIntSlowPaths.h:
1264         * llint/LowLevelInterpreter.asm:
1265         * llint/LowLevelInterpreter32_64.asm:
1266         * llint/LowLevelInterpreter64.asm:
1267         * runtime/ArrayBufferNeuteringWatchpoint.cpp:
1268         (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
1269         * runtime/CommonSlowPaths.cpp:
1270         (JSC::SLOW_PATH_DECL):
1271         * runtime/Executable.h:
1272         (JSC::ExecutableBase::createStructure):
1273         (JSC::NativeExecutable::createStructure):
1274         * runtime/HighFidelityLog.cpp: Removed.
1275         * runtime/HighFidelityLog.h: Removed.
1276         * runtime/HighFidelityTypeProfiler.cpp: Removed.
1277         * runtime/HighFidelityTypeProfiler.h: Removed.
1278         * runtime/JSObject.cpp:
1279         (JSC::JSObject::putDirectCustomAccessor):
1280         (JSC::JSObject::putDirectNonIndexAccessor):
1281         (JSC::JSObject::reifyStaticFunctionsForDelete):
1282         * runtime/JSPromiseDeferred.h:
1283         (JSC::JSPromiseDeferred::createStructure):
1284         * runtime/JSPromiseReaction.h:
1285         (JSC::JSPromiseReaction::createStructure):
1286         * runtime/JSPropertyNameIterator.h:
1287         (JSC::JSPropertyNameIterator::createStructure):
1288         * runtime/JSType.h:
1289         * runtime/JSTypeInfo.h:
1290         (JSC::TypeInfo::TypeInfo):
1291         * runtime/MapData.h:
1292         (JSC::MapData::createStructure):
1293         * runtime/Options.h:
1294         * runtime/PropertyMapHashTable.h:
1295         (JSC::PropertyTable::createStructure):
1296         * runtime/RegExp.h:
1297         (JSC::RegExp::createStructure):
1298         * runtime/SparseArrayValueMap.cpp:
1299         (JSC::SparseArrayValueMap::createStructure):
1300         * runtime/Structure.cpp:
1301         (JSC::StructureTransitionTable::contains):
1302         (JSC::StructureTransitionTable::get):
1303         (JSC::StructureTransitionTable::add):
1304         (JSC::Structure::Structure):
1305         (JSC::Structure::materializePropertyMap):
1306         (JSC::Structure::addPropertyTransition):
1307         (JSC::Structure::despecifyFunctionTransition):
1308         (JSC::Structure::toDictionaryTransition):
1309         (JSC::Structure::freezeTransition):
1310         (JSC::Structure::preventExtensionsTransition):
1311         (JSC::Structure::takePropertyTableOrCloneIfPinned):
1312         (JSC::Structure::nonPropertyTransition):
1313         (JSC::Structure::flattenDictionaryStructure):
1314         (JSC::Structure::addPropertyWithoutTransition):
1315         (JSC::Structure::pin):
1316         (JSC::Structure::allocateRareData):
1317         (JSC::Structure::cloneRareDataFrom):
1318         (JSC::Structure::getConcurrently):
1319         (JSC::Structure::putSpecificValue):
1320         (JSC::Structure::getPropertyNamesFromStructure):
1321         (JSC::Structure::visitChildren):
1322         (JSC::Structure::checkConsistency):
1323         (JSC::Structure::toStructureShape): Deleted.
1324         * runtime/Structure.h:
1325         (JSC::Structure::isExtensible):
1326         (JSC::Structure::didTransition):
1327         (JSC::Structure::isDictionary):
1328         (JSC::Structure::isUncacheableDictionary):
1329         (JSC::Structure::hasBeenFlattenedBefore):
1330         (JSC::Structure::propertyAccessesAreCacheable):
1331         (JSC::Structure::previousID):
1332         (JSC::Structure::hasGetterSetterProperties):
1333         (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
1334         (JSC::Structure::setHasGetterSetterProperties):
1335         (JSC::Structure::hasCustomGetterSetterProperties):
1336         (JSC::Structure::setHasCustomGetterSetterProperties):
1337         (JSC::Structure::setContainsReadOnlyProperties):
1338         (JSC::Structure::hasNonEnumerableProperties):
1339         (JSC::Structure::disableSpecificFunctionTracking):
1340         (JSC::Structure::objectToStringValue):
1341         (JSC::Structure::setObjectToStringValue):
1342         (JSC::Structure::staticFunctionsReified):
1343         (JSC::Structure::setStaticFunctionsReified):
1344         (JSC::Structure::transitionWatchpointSet):
1345         (JSC::Structure::setPreviousID):
1346         (JSC::Structure::clearPreviousID):
1347         (JSC::Structure::previous):
1348         (JSC::Structure::rareData):
1349         (JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck): Deleted.
1350         (JSC::Structure::setHasCustomGetterSetterPropertiesWithProtoCheck): Deleted.
1351         * runtime/StructureChain.h:
1352         (JSC::StructureChain::createStructure):
1353         * runtime/StructureInlines.h:
1354         (JSC::Structure::setEnumerationCache):
1355         (JSC::Structure::enumerationCache):
1356         (JSC::Structure::checkOffsetConsistency):
1357         * runtime/StructureRareData.cpp:
1358         (JSC::StructureRareData::createStructure):
1359         * runtime/SymbolTable.cpp:
1360         (JSC::SymbolTable::SymbolTable):
1361         (JSC::SymbolTable::cloneCapturedNames):
1362         (JSC::SymbolTable::uniqueIDForVariable): Deleted.
1363         (JSC::SymbolTable::uniqueIDForRegister): Deleted.
1364         (JSC::SymbolTable::globalTypeSetForRegister): Deleted.
1365         (JSC::SymbolTable::globalTypeSetForVariable): Deleted.
1366         * runtime/SymbolTable.h:
1367         (JSC::SymbolTable::createStructure):
1368         (JSC::SymbolTable::add):
1369         (JSC::SymbolTable::set):
1370         * runtime/TypeSet.cpp: Removed.
1371         * runtime/TypeSet.h: Removed.
1372         * runtime/VM.cpp:
1373         (JSC::VM::VM):
1374         (JSC::VM::getTypesForVariableInRange): Deleted.
1375         (JSC::VM::updateHighFidelityTypeProfileState): Deleted.
1376         (JSC::VM::dumpHighFidelityProfilingTypes): Deleted.
1377         * runtime/VM.h:
1378         (JSC::VM::isProfilingTypesWithHighFidelity): Deleted.
1379         (JSC::VM::highFidelityLog): Deleted.
1380         (JSC::VM::highFidelityTypeProfiler): Deleted.
1381         (JSC::VM::nextLocation): Deleted.
1382         (JSC::VM::getNextUniqueVariableID): Deleted.
1383         * runtime/WeakMapData.h:
1384         (JSC::WeakMapData::createStructure):
1385         * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Removed.
1386         * tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Removed.
1387         * tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Removed.
1388
1389 2014-07-25  Filip Pizlo  <fpizlo@apple.com>
1390
1391         Attempt to fix non-Xcode platforms.
1392
1393         * CMakeLists.txt:
1394         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1395
1396 2014-07-25  Filip Pizlo  <fpizlo@apple.com>
1397
1398         Fix cloop.
1399
1400         * bytecode/CodeBlock.cpp:
1401         (JSC::dumpChain):
1402         (JSC::CodeBlock::printPutByIdCacheStatus):
1403         * bytecode/StructureSet.cpp:
1404         * bytecode/StructureSet.h:
1405
1406 2014-07-25  Filip Pizlo  <fpizlo@apple.com>
1407
1408         Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
1409
1410     2014-06-27  Michael Saboff  <msaboff@apple.com>
1411
1412             Unreviewed build fix after r169795.
1413
1414             Fixed ASSERT for 32 bit build.
1415
1416             * dfg/DFGSpeculativeJIT.cpp:
1417             (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
1418
1419     2014-06-24  Saam Barati  <sbarati@apple.com>
1420
1421             Web Inspector: debugger should be able to show variable types
1422             https://bugs.webkit.org/show_bug.cgi?id=133395
1423
1424             Reviewed by Filip Pizlo.
1425
1426             Increase the amount of type information the VM gathers when directed
1427             to do so. This initial commit is working towards the goal of
1428             capturing, and then showing (via the Web Inspector) type information for all
1429             assignment and load operations. This patch doesn't have the feature fully
1430             implemented, but it ensures the VM has no performance regressions
1431             unless the feature is specifically turned on.
1432
1433             * JavaScriptCore.xcodeproj/project.pbxproj:
1434             * bytecode/BytecodeList.json:
1435             * bytecode/BytecodeUseDef.h:
1436             (JSC::computeUsesForBytecodeOffset):
1437             (JSC::computeDefsForBytecodeOffset):
1438             * bytecode/CodeBlock.cpp:
1439             (JSC::CodeBlock::dumpBytecode):
1440             (JSC::CodeBlock::CodeBlock):
1441             (JSC::CodeBlock::finalizeUnconditionally):
1442             * bytecode/CodeBlock.h:
1443             * bytecode/Instruction.h:
1444             * bytecode/TypeLocation.h: Added.
1445             (JSC::TypeLocation::TypeLocation):
1446             * bytecompiler/BytecodeGenerator.cpp:
1447             (JSC::BytecodeGenerator::emitMove):
1448             (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity):
1449             (JSC::BytecodeGenerator::emitPutToScope):
1450             (JSC::BytecodeGenerator::emitPutById):
1451             (JSC::BytecodeGenerator::emitPutByVal):
1452             * bytecompiler/BytecodeGenerator.h:
1453             (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity):
1454             * bytecompiler/NodesCodegen.cpp:
1455             (JSC::PostfixNode::emitResolve):
1456             (JSC::PrefixNode::emitResolve):
1457             (JSC::ReadModifyResolveNode::emitBytecode):
1458             (JSC::AssignResolveNode::emitBytecode):
1459             (JSC::ConstDeclNode::emitCodeSingle):
1460             (JSC::ForInNode::emitBytecode):
1461             * heap/Heap.cpp:
1462             (JSC::Heap::collect):
1463             * inspector/agents/InspectorRuntimeAgent.cpp:
1464             (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange):
1465             * inspector/agents/InspectorRuntimeAgent.h:
1466             * inspector/protocol/Runtime.json:
1467             * jsc.cpp:
1468             (GlobalObject::finishCreation):
1469             (functionDumpTypesForAllVariables):
1470             * llint/LLIntSlowPaths.cpp:
1471             (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1472             (JSC::LLInt::putToScopeCommon):
1473             * llint/LLIntSlowPaths.h:
1474             * llint/LowLevelInterpreter.asm:
1475             * runtime/HighFidelityLog.cpp: Added.
1476             (JSC::HighFidelityLog::initializeHighFidelityLog):
1477             (JSC::HighFidelityLog::~HighFidelityLog):
1478             (JSC::HighFidelityLog::recordTypeInformationForLocation):
1479             (JSC::HighFidelityLog::processHighFidelityLog):
1480             (JSC::HighFidelityLog::actuallyProcessLogThreadFunction):
1481             * runtime/HighFidelityLog.h: Added.
1482             (JSC::HighFidelityLog::HighFidelityLog):
1483             * runtime/HighFidelityTypeProfiler.cpp: Added.
1484             (JSC::HighFidelityTypeProfiler::getTypesForVariableInRange):
1485             (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableInRange):
1486             (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableInRange):
1487             (JSC::HighFidelityTypeProfiler::insertNewLocation):
1488             (JSC::HighFidelityTypeProfiler::getLocationBasedHash):
1489             * runtime/HighFidelityTypeProfiler.h: Added.
1490             * runtime/Options.h:
1491             * runtime/Structure.cpp:
1492             (JSC::Structure::toStructureShape):
1493             * runtime/Structure.h:
1494             * runtime/SymbolTable.cpp:
1495             (JSC::SymbolTable::SymbolTable):
1496             (JSC::SymbolTable::cloneCapturedNames):
1497             (JSC::SymbolTable::uniqueIDForVariable):
1498             (JSC::SymbolTable::uniqueIDForRegister):
1499             (JSC::SymbolTable::globalTypeSetForRegister):
1500             (JSC::SymbolTable::globalTypeSetForVariable):
1501             * runtime/SymbolTable.h:
1502             (JSC::SymbolTable::add):
1503             (JSC::SymbolTable::set):
1504             * runtime/TypeSet.cpp: Added.
1505             (JSC::TypeSet::TypeSet):
1506             (JSC::TypeSet::getRuntimeTypeForValue):
1507             (JSC::TypeSet::addTypeForValue):
1508             (JSC::TypeSet::removeDuplicatesInStructureHistory):
1509             (JSC::TypeSet::seenTypes):
1510             (JSC::TypeSet::dumpSeenTypes):
1511             (JSC::StructureShape::StructureShape):
1512             (JSC::StructureShape::markAsFinal):
1513             (JSC::StructureShape::addProperty):
1514             (JSC::StructureShape::propertyHash):
1515             (JSC::StructureShape::leastUpperBound):
1516             (JSC::StructureShape::stringRepresentation):
1517             * runtime/TypeSet.h: Added.
1518             (JSC::StructureShape::create):
1519             (JSC::TypeSet::create):
1520             * runtime/VM.cpp:
1521             (JSC::VM::VM):
1522             (JSC::VM::getTypesForVariableInRange):
1523             (JSC::VM::updateHighFidelityTypeProfileState):
1524             (JSC::VM::dumpHighFidelityProfilingTypes):
1525             * runtime/VM.h:
1526             (JSC::VM::isProfilingTypesWithHighFidelity):
1527             (JSC::VM::highFidelityLog):
1528             (JSC::VM::highFidelityTypeProfiler):
1529             (JSC::VM::nextLocation):
1530             (JSC::VM::getNextUniqueVariableID):
1531
1532     2014-06-26  Mark Lam  <mark.lam@apple.com>
1533
1534             Remove unused instantiation of the WithScope structure.
1535             <https://webkit.org/b/134331>
1536
1537             Reviewed by Oliver Hunt.
1538
1539             The WithScope structure instance is the VM is unused, and is now removed.
1540
1541             * runtime/VM.cpp:
1542             (JSC::VM::VM):
1543             * runtime/VM.h:
1544
1545     2014-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
1546
1547             Structure bit fields should have a consistent format
1548             https://bugs.webkit.org/show_bug.cgi?id=134307
1549
1550             Reviewed by Filip Pizlo.
1551
1552             Currently we use C-style bit fields for a number of member variables in Structure to save space.
1553             This makes it difficult to load these fields in the JIT. We should instead use our own bitfield
1554             format to make it easy to load and test these variables in JIT code.
1555
1556             * runtime/JSObject.cpp:
1557             (JSC::JSObject::putDirectNonIndexAccessor):
1558             (JSC::JSObject::reifyStaticFunctionsForDelete):
1559             * runtime/Structure.cpp:
1560             (JSC::StructureTransitionTable::contains):
1561             (JSC::StructureTransitionTable::get):
1562             (JSC::StructureTransitionTable::add):
1563             (JSC::Structure::Structure):
1564             (JSC::Structure::materializePropertyMap):
1565             (JSC::Structure::addPropertyTransition):
1566             (JSC::Structure::despecifyFunctionTransition):
1567             (JSC::Structure::toDictionaryTransition):
1568             (JSC::Structure::freezeTransition):
1569             (JSC::Structure::preventExtensionsTransition):
1570             (JSC::Structure::takePropertyTableOrCloneIfPinned):
1571             (JSC::Structure::nonPropertyTransition):
1572             (JSC::Structure::flattenDictionaryStructure):
1573             (JSC::Structure::addPropertyWithoutTransition):
1574             (JSC::Structure::pin):
1575             (JSC::Structure::allocateRareData):
1576             (JSC::Structure::cloneRareDataFrom):
1577             (JSC::Structure::getConcurrently):
1578             (JSC::Structure::putSpecificValue):
1579             (JSC::Structure::getPropertyNamesFromStructure):
1580             (JSC::Structure::visitChildren):
1581             (JSC::Structure::checkConsistency):
1582             * runtime/Structure.h:
1583             (JSC::Structure::isExtensible):
1584             (JSC::Structure::isDictionary):
1585             (JSC::Structure::isUncacheableDictionary):
1586             (JSC::Structure::propertyAccessesAreCacheable):
1587             (JSC::Structure::previousID):
1588             (JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck):
1589             (JSC::Structure::setContainsReadOnlyProperties):
1590             (JSC::Structure::disableSpecificFunctionTracking):
1591             (JSC::Structure::objectToStringValue):
1592             (JSC::Structure::setObjectToStringValue):
1593             (JSC::Structure::setPreviousID):
1594             (JSC::Structure::clearPreviousID):
1595             (JSC::Structure::previous):
1596             (JSC::Structure::rareData):
1597             (JSC::Structure::didTransition): Deleted.
1598             (JSC::Structure::hasGetterSetterProperties): Deleted.
1599             (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto): Deleted.
1600             (JSC::Structure::setHasGetterSetterProperties): Deleted.
1601             (JSC::Structure::hasNonEnumerableProperties): Deleted.
1602             (JSC::Structure::staticFunctionsReified): Deleted.
1603             (JSC::Structure::setStaticFunctionsReified): Deleted.
1604             * runtime/StructureInlines.h:
1605             (JSC::Structure::setEnumerationCache):
1606             (JSC::Structure::enumerationCache):
1607             (JSC::Structure::checkOffsetConsistency):
1608
1609     2014-06-24  Mark Lam  <mark.lam@apple.com>
1610
1611             [ftlopt] Renamed DebuggerActivation to DebuggerScope.
1612             <https://webkit.org/b/134273>
1613
1614             Reviewed by Michael Saboff.
1615
1616             * CMakeLists.txt:
1617             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1618             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1619             * JavaScriptCore.xcodeproj/project.pbxproj:
1620             * debugger/DebuggerActivation.cpp: Removed.
1621             * debugger/DebuggerActivation.h: Removed.
1622             * debugger/DebuggerScope.cpp: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp.
1623             (JSC::DebuggerScope::DebuggerScope):
1624             (JSC::DebuggerScope::finishCreation):
1625             (JSC::DebuggerScope::visitChildren):
1626             (JSC::DebuggerScope::className):
1627             (JSC::DebuggerScope::getOwnPropertySlot):
1628             (JSC::DebuggerScope::put):
1629             (JSC::DebuggerScope::deleteProperty):
1630             (JSC::DebuggerScope::getOwnPropertyNames):
1631             (JSC::DebuggerScope::defineOwnProperty):
1632             (JSC::DebuggerActivation::DebuggerActivation): Deleted.
1633             (JSC::DebuggerActivation::finishCreation): Deleted.
1634             (JSC::DebuggerActivation::visitChildren): Deleted.
1635             (JSC::DebuggerActivation::className): Deleted.
1636             (JSC::DebuggerActivation::getOwnPropertySlot): Deleted.
1637             (JSC::DebuggerActivation::put): Deleted.
1638             (JSC::DebuggerActivation::deleteProperty): Deleted.
1639             (JSC::DebuggerActivation::getOwnPropertyNames): Deleted.
1640             (JSC::DebuggerActivation::defineOwnProperty): Deleted.
1641             * debugger/DebuggerScope.h: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h.
1642             (JSC::DebuggerScope::create):
1643             (JSC::DebuggerActivation::create): Deleted.
1644             * runtime/VM.cpp:
1645             (JSC::VM::VM):
1646             * runtime/VM.h:
1647
1648     2014-06-24  Filip Pizlo  <fpizlo@apple.com>
1649
1650             [ftlopt] PutByIdFlush can also be converted to a PutByOffset so don't assert otherwise
1651             https://bugs.webkit.org/show_bug.cgi?id=134265
1652
1653             Reviewed by Geoffrey Garen.
1654
1655             More assertion fallout from the PutById folding work.
1656
1657             * dfg/DFGNode.h:
1658             (JSC::DFG::Node::convertToPutByOffset):
1659
1660     2014-06-24  Filip Pizlo  <fpizlo@apple.com>
1661
1662             [ftlopt] GC should notify us if it resets to_this
1663             https://bugs.webkit.org/show_bug.cgi?id=128231
1664
1665             Reviewed by Geoffrey Garen.
1666
1667             * CMakeLists.txt:
1668             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1669             * JavaScriptCore.xcodeproj/project.pbxproj:
1670             * bytecode/BytecodeList.json:
1671             * bytecode/CodeBlock.cpp:
1672             (JSC::CodeBlock::dumpBytecode):
1673             (JSC::CodeBlock::finalizeUnconditionally):
1674             * bytecode/Instruction.h:
1675             * bytecode/ToThisStatus.cpp: Added.
1676             (JSC::merge):
1677             (WTF::printInternal):
1678             * bytecode/ToThisStatus.h: Added.
1679             * bytecompiler/BytecodeGenerator.cpp:
1680             (JSC::BytecodeGenerator::BytecodeGenerator):
1681             * dfg/DFGByteCodeParser.cpp:
1682             (JSC::DFG::ByteCodeParser::parseBlock):
1683             * llint/LowLevelInterpreter32_64.asm:
1684             * llint/LowLevelInterpreter64.asm:
1685             * runtime/CommonSlowPaths.cpp:
1686             (JSC::SLOW_PATH_DECL):
1687
1688     2014-06-24  Filip Pizlo  <fpizlo@apple.com>
1689
1690             [ftlopt] StructureAbstractValue::onlyStructure() should return nullptr if isClobbered()
1691             https://bugs.webkit.org/show_bug.cgi?id=134256
1692
1693             Reviewed by Michael Saboff.
1694
1695             This isn't testable right now (i.e. it's benign) but we should get it right anyway. The
1696             point is to be able to precisely model what goes on in the snippets of code between a
1697             side-effect and an InvalidationPoint.
1698
1699             This patch also cleans up onlyStructure() by delegating more work to
1700             StructureSet::onlyStructure().
1701
1702             * dfg/DFGStructureAbstractValue.h:
1703             (JSC::DFG::StructureAbstractValue::onlyStructure):
1704
1705     2014-06-24  Filip Pizlo  <fpizlo@apple.com>
1706
1707             [ftlopt][REGRESSION] PutById AI is introducing watchable structures without watching them
1708             https://bugs.webkit.org/show_bug.cgi?id=134260
1709
1710             Reviewed by Geoffrey Garen.
1711
1712             This was causing loads of assertion failures in debug builds.
1713
1714             * dfg/DFGAbstractInterpreterInlines.h:
1715             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1716
1717     2014-06-21  Filip Pizlo  <fpizlo@apple.com>
1718
1719             [ftlopt] Fold GetById/PutById to MultiGetByOffset/GetByOffset or MultiPutByOffset/PutByOffset, which implies handling non-singleton sets
1720             https://bugs.webkit.org/show_bug.cgi?id=134090
1721
1722             Reviewed by Oliver Hunt.
1723
1724             This pretty much finishes off the work to eliminate the special-casing of singleton
1725             structure sets by making it possible to fold GetById and PutById to various polymorphic
1726             forms of the ByOffset nodes.
1727
1728             * bytecode/GetByIdStatus.cpp:
1729             (JSC::GetByIdStatus::computeForStubInfo):
1730             (JSC::GetByIdStatus::computeFor):
1731             * bytecode/GetByIdStatus.h:
1732             * bytecode/PutByIdStatus.cpp:
1733             (JSC::PutByIdStatus::computeFor):
1734             * bytecode/PutByIdStatus.h:
1735             * bytecode/PutByIdVariant.h:
1736             (JSC::PutByIdVariant::constantChecks):
1737             * dfg/DFGAbstractInterpreterInlines.h:
1738             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1739             * dfg/DFGByteCodeParser.cpp:
1740             (JSC::DFG::ByteCodeParser::parseBlock):
1741             * dfg/DFGConstantFoldingPhase.cpp:
1742             (JSC::DFG::ConstantFoldingPhase::foldConstants):
1743             (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
1744             (JSC::DFG::ConstantFoldingPhase::addChecks):
1745             * dfg/DFGNode.h:
1746             (JSC::DFG::Node::convertToMultiGetByOffset):
1747             (JSC::DFG::Node::convertToMultiPutByOffset):
1748             * dfg/DFGSpeculativeJIT64.cpp: Also convert all release assertions to DFG assertions in this file, because I was hitting some of them while debugging.
1749             (JSC::DFG::SpeculativeJIT::fillJSValue):
1750             (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
1751             (JSC::DFG::SpeculativeJIT::emitCall):
1752             (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
1753             (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
1754             (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
1755             (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
1756             (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
1757             (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
1758             (JSC::DFG::SpeculativeJIT::compileLogicalNot):
1759             (JSC::DFG::SpeculativeJIT::emitBranch):
1760             (JSC::DFG::SpeculativeJIT::compile):
1761             * dfg/DFGStructureAbstractValue.h:
1762             (JSC::DFG::StructureAbstractValue::set):
1763
1764     2014-06-19  Filip Pizlo  <fpizlo@apple.com>
1765
1766             [ftlopt] StructureSet::onlyStructure() should return nullptr if it's not a singleton (instead of asserting)
1767             https://bugs.webkit.org/show_bug.cgi?id=134077
1768
1769             Reviewed by Sam Weinig.
1770
1771             This makes StructureSet and StructureAbstractValue more consistent and fixes a debug assert
1772             in the abstract interpreter.
1773
1774             * bytecode/StructureSet.h:
1775             (JSC::StructureSet::onlyStructure):
1776
1777     2014-06-18  Filip Pizlo  <fpizlo@apple.com>
1778
1779             DFG AI and constant folder should be able to precisely prune MultiGetByOffset/MultiPutByOffset even if the base structure abstract value is not a singleton
1780             https://bugs.webkit.org/show_bug.cgi?id=133918
1781
1782             Reviewed by Mark Hahnenberg.
1783
1784             This also adds pruning of PutStructure, since I basically had no choice but
1785             to implement such logic within MultiPutByOffset.
1786
1787             Also adds a bunch of PutById cache status dumping to bytecode dumping.
1788
1789             * bytecode/GetByIdVariant.cpp:
1790             (JSC::GetByIdVariant::dumpInContext):
1791             * bytecode/GetByIdVariant.h:
1792             (JSC::GetByIdVariant::structureSet):
1793             * bytecode/PutByIdVariant.h:
1794             (JSC::PutByIdVariant::oldStructure):
1795             * bytecode/StructureSet.cpp:
1796             (JSC::StructureSet::filter):
1797             (JSC::StructureSet::filterArrayModes):
1798             * bytecode/StructureSet.h:
1799             * dfg/DFGAbstractInterpreterInlines.h:
1800             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1801             * dfg/DFGAbstractValue.cpp:
1802             (JSC::DFG::AbstractValue::changeStructure):
1803             (JSC::DFG::AbstractValue::contains):
1804             * dfg/DFGAbstractValue.h:
1805             (JSC::DFG::AbstractValue::couldBeType):
1806             (JSC::DFG::AbstractValue::isType):
1807             * dfg/DFGConstantFoldingPhase.cpp:
1808             (JSC::DFG::ConstantFoldingPhase::foldConstants):
1809             (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
1810             (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
1811             (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
1812             * dfg/DFGGraph.cpp:
1813             (JSC::DFG::Graph::freezeStrong):
1814             * dfg/DFGGraph.h:
1815             * dfg/DFGStructureAbstractValue.h:
1816             (JSC::DFG::StructureAbstractValue::operator=):
1817             * ftl/FTLLowerDFGToLLVM.cpp:
1818             (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
1819             * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Added.
1820             (foo):
1821             (fu):
1822             (bar):
1823             (baz):
1824             (.bar):
1825             (.baz):
1826             * tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Added.
1827             (foo):
1828             (fu):
1829             (bar):
1830             (baz):
1831             (.bar):
1832             (.baz):
1833             * tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Added.
1834             (foo):
1835             (fu):
1836             (bar):
1837             (baz):
1838             (.bar):
1839             (.baz):
1840
1841     2014-06-18  Mark Hahnenberg  <mhahnenberg@apple.com>
1842
1843             Remove CompoundType and LeafType
1844             https://bugs.webkit.org/show_bug.cgi?id=134037
1845
1846             Reviewed by Filip Pizlo.
1847
1848             We don't use them for anything. We'll replace them with a generic CellType type for all
1849             the objects that are JSCells, aren't JSObjects, and for which we generally don't care about
1850             their JSType at runtime.
1851
1852             * llint/LLIntData.cpp:
1853             (JSC::LLInt::Data::performAssertions):
1854             * runtime/ArrayBufferNeuteringWatchpoint.cpp:
1855             (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
1856             * runtime/Executable.h:
1857             (JSC::ExecutableBase::createStructure):
1858             (JSC::NativeExecutable::createStructure):
1859             * runtime/JSPromiseDeferred.h:
1860             (JSC::JSPromiseDeferred::createStructure):
1861             * runtime/JSPromiseReaction.h:
1862             (JSC::JSPromiseReaction::createStructure):
1863             * runtime/JSPropertyNameIterator.h:
1864             (JSC::JSPropertyNameIterator::createStructure):
1865             * runtime/JSType.h:
1866             * runtime/JSTypeInfo.h:
1867             (JSC::TypeInfo::TypeInfo):
1868             * runtime/MapData.h:
1869             (JSC::MapData::createStructure):
1870             * runtime/PropertyMapHashTable.h:
1871             (JSC::PropertyTable::createStructure):
1872             * runtime/RegExp.h:
1873             (JSC::RegExp::createStructure):
1874             * runtime/SparseArrayValueMap.cpp:
1875             (JSC::SparseArrayValueMap::createStructure):
1876             * runtime/Structure.cpp:
1877             (JSC::Structure::Structure):
1878             * runtime/StructureChain.h:
1879             (JSC::StructureChain::createStructure):
1880             * runtime/StructureRareData.cpp:
1881             (JSC::StructureRareData::createStructure):
1882             * runtime/SymbolTable.h:
1883             (JSC::SymbolTable::createStructure):
1884             * runtime/WeakMapData.h:
1885             (JSC::WeakMapData::createStructure):
1886
1887     2014-06-17  Filip Pizlo  <fpizlo@apple.com>
1888
1889             [ftlopt] PutStructure and PhantomPutStructure shouldn't leave the world in a clobbered state
1890             https://bugs.webkit.org/show_bug.cgi?id=134002
1891
1892             Reviewed by Mark Hahnenberg.
1893
1894             The effect of this bug was that if we had a PutStructure or PhantomPutStructure then any
1895             JSConstants would be in a Clobbered state, so we wouldn't take advantage of our knowledge
1896             of the structure if that structure was watchable.
1897
1898             Also kill PhantomPutStructure.
1899
1900             * dfg/DFGAbstractInterpreterInlines.h:
1901             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1902             (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
1903             (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
1904             * dfg/DFGClobberize.h:
1905             (JSC::DFG::clobberize):
1906             * dfg/DFGDoesGC.cpp:
1907             (JSC::DFG::doesGC):
1908             * dfg/DFGFixupPhase.cpp:
1909             (JSC::DFG::FixupPhase::fixupNode):
1910             * dfg/DFGGraph.cpp:
1911             (JSC::DFG::Graph::visitChildren):
1912             * dfg/DFGNode.h:
1913             (JSC::DFG::Node::hasTransition):
1914             * dfg/DFGNodeType.h:
1915             * dfg/DFGPredictionPropagationPhase.cpp:
1916             (JSC::DFG::PredictionPropagationPhase::propagate):
1917             * dfg/DFGSafeToExecute.h:
1918             (JSC::DFG::safeToExecute):
1919             * dfg/DFGSpeculativeJIT32_64.cpp:
1920             (JSC::DFG::SpeculativeJIT::compile):
1921             * dfg/DFGSpeculativeJIT64.cpp:
1922             (JSC::DFG::SpeculativeJIT::compile):
1923             * dfg/DFGStructureAbstractValue.cpp:
1924             (JSC::DFG::StructureAbstractValue::observeTransition):
1925             (JSC::DFG::StructureAbstractValue::observeTransitions):
1926             * dfg/DFGValidate.cpp:
1927             (JSC::DFG::Validate::validate):
1928             * dfg/DFGWatchableStructureWatchingPhase.cpp:
1929             (JSC::DFG::WatchableStructureWatchingPhase::run):
1930             * ftl/FTLCapabilities.cpp:
1931             (JSC::FTL::canCompile):
1932             * ftl/FTLLowerDFGToLLVM.cpp:
1933             (JSC::FTL::LowerDFGToLLVM::compileNode):
1934             (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure): Deleted.
1935
1936     2014-06-17  Filip Pizlo  <fpizlo@apple.com>
1937
1938             [ftlopt] DFG put_by_id should inline accesses with a slightly polymorphic base
1939             https://bugs.webkit.org/show_bug.cgi?id=133964
1940
1941             Reviewed by Mark Hahnenberg.
1942
1943             * bytecode/PutByIdStatus.cpp:
1944             (JSC::PutByIdStatus::appendVariant):
1945             (JSC::PutByIdStatus::computeForStubInfo):
1946             * bytecode/PutByIdVariant.cpp:
1947             (JSC::PutByIdVariant::oldStructureForTransition):
1948             (JSC::PutByIdVariant::writesStructures):
1949             (JSC::PutByIdVariant::reallocatesStorage):
1950             (JSC::PutByIdVariant::attemptToMerge):
1951             (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace):
1952             (JSC::PutByIdVariant::dumpInContext):
1953             * bytecode/PutByIdVariant.h:
1954             (JSC::PutByIdVariant::PutByIdVariant):
1955             (JSC::PutByIdVariant::replace):
1956             (JSC::PutByIdVariant::transition):
1957             (JSC::PutByIdVariant::structure):
1958             (JSC::PutByIdVariant::oldStructure):
1959             * dfg/DFGAbstractInterpreterInlines.h:
1960             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1961             * dfg/DFGByteCodeParser.cpp:
1962             (JSC::DFG::ByteCodeParser::handlePutById):
1963             (JSC::DFG::ByteCodeParser::parseBlock):
1964             * dfg/DFGConstantFoldingPhase.cpp:
1965             (JSC::DFG::ConstantFoldingPhase::foldConstants):
1966             (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
1967             * dfg/DFGGraph.cpp:
1968             (JSC::DFG::Graph::visitChildren):
1969             * dfg/DFGNode.cpp:
1970             (JSC::DFG::MultiPutByOffsetData::writesStructures):
1971             (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
1972             * ftl/FTLAbbreviations.h:
1973             (JSC::FTL::getLinkage):
1974             * ftl/FTLLowerDFGToLLVM.cpp:
1975             (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
1976             (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
1977
1978 2014-07-25  Filip Pizlo  <fpizlo@apple.com>
1979
1980         Add an option to disable native call inlining. Disable it for now to see how it
1981         affects the bots.
1982
1983         * dfg/DFGByteCodeParser.cpp:
1984         (JSC::DFG::ByteCodeParser::handleCall):
1985         * runtime/Options.h:
1986
1987 2014-07-25  Filip Pizlo  <fpizlo@apple.com>
1988
1989         Fix cloop.
1990
1991         * dfg/DFGMayExit.cpp:
1992
1993 2014-07-25  Filip Pizlo  <fpizlo@apple.com>
1994
1995         Merge r169795, r169819, r169864, r169902, r169949, r169950, r170016, r170017, r170060, r170064 from ftlopt.
1996
1997     2014-06-17  Filip Pizlo  <fpizlo@apple.com>
1998
1999             [ftlopt] Fold constant Phis
2000             https://bugs.webkit.org/show_bug.cgi?id=133967
2001
2002             Reviewed by Mark Hahnenberg.
2003
2004             It's surprising but we didn't really do this before. Or, rather, we only did it
2005             incidentally when we would likely crash if it ever happened.
2006
2007             Making this work required cleaning up the validater a bit, so I did that too. I also added
2008             mayExit() validation for nodes that didn't have origin.forExit (i.e. nodes that end up in
2009             the Phi header of basic blocks). But this required beefing up mayExit() a bit.
2010
2011             * dfg/DFGAbstractInterpreterInlines.h:
2012             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2013             * dfg/DFGAdjacencyList.h:
2014             (JSC::DFG::AdjacencyList::isEmpty):
2015             * dfg/DFGConstantFoldingPhase.cpp:
2016             (JSC::DFG::ConstantFoldingPhase::run):
2017             (JSC::DFG::ConstantFoldingPhase::foldConstants):
2018             (JSC::DFG::ConstantFoldingPhase::fixUpsilons):
2019             * dfg/DFGInPlaceAbstractState.h:
2020             * dfg/DFGLICMPhase.cpp:
2021             (JSC::DFG::LICMPhase::run):
2022             (JSC::DFG::LICMPhase::attemptHoist):
2023             * dfg/DFGMayExit.cpp:
2024             (JSC::DFG::mayExit):
2025             * dfg/DFGValidate.cpp:
2026             (JSC::DFG::Validate::validate):
2027             (JSC::DFG::Validate::validateSSA):
2028
2029     2014-06-17  Filip Pizlo  <fpizlo@apple.com>
2030
2031             [ftlopt] Get rid of NodeDoesNotExit and also get rid of StoreEliminationPhase
2032             https://bugs.webkit.org/show_bug.cgi?id=133985
2033
2034             Reviewed by Michael Saboff and Mark Hahnenberg.
2035
2036             Store elimination phase has never been very profitable, and now that LLVM can do dead
2037             store elimination for us, this phase is just completely pointless.
2038
2039             This phase is also the primary user of NodeDoesNotExit, which is a flag that the CFA
2040             computes. It computes it poorly and we often get bugs in it. It's also a lot of code to
2041             maintain.
2042
2043             This patch does introduce a new mayExit() calculator that is independent of the CFA and
2044             should be enough for most of the previous NodeDoesNotExit users. Currently it's only used
2045             for assertions in the DFG backend, but we could use it if we ever brought back any of the
2046             other optimizations that previously relied upon NodeDoesNotExit.
2047
2048             This is performance-neutral, except for SunSpider, where it's a speed-up.
2049
2050             * CMakeLists.txt:
2051             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2052             * JavaScriptCore.xcodeproj/project.pbxproj:
2053             * dfg/DFGAbstractInterpreter.h:
2054             (JSC::DFG::AbstractInterpreter::filterEdgeByUse):
2055             (JSC::DFG::AbstractInterpreter::filterByType):
2056             * dfg/DFGAbstractInterpreterInlines.h:
2057             (JSC::DFG::AbstractInterpreter<AbstractStateType>::startExecuting):
2058             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2059             * dfg/DFGCSEPhase.cpp:
2060             (JSC::DFG::CSEPhase::CSEPhase):
2061             (JSC::DFG::CSEPhase::invalidationPointElimination):
2062             (JSC::DFG::CSEPhase::setLocalStoreElimination):
2063             (JSC::DFG::CSEPhase::performNodeCSE):
2064             (JSC::DFG::CSEPhase::performBlockCSE):
2065             (JSC::DFG::performCSE):
2066             (JSC::DFG::CSEPhase::globalVarStoreElimination): Deleted.
2067             (JSC::DFG::CSEPhase::scopedVarStoreElimination): Deleted.
2068             (JSC::DFG::CSEPhase::putStructureStoreElimination): Deleted.
2069             (JSC::DFG::CSEPhase::putByOffsetStoreElimination): Deleted.
2070             (JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult): Deleted.
2071             (JSC::DFG::performStoreElimination): Deleted.
2072             * dfg/DFGCSEPhase.h:
2073             * dfg/DFGFixupPhase.cpp:
2074             (JSC::DFG::FixupPhase::fixupNode):
2075             * dfg/DFGGraph.cpp:
2076             (JSC::DFG::Graph::resetExitStates): Deleted.
2077             * dfg/DFGGraph.h:
2078             * dfg/DFGMayExit.cpp: Added.
2079             (JSC::DFG::mayExit):
2080             * dfg/DFGMayExit.h: Added.
2081             * dfg/DFGNode.h:
2082             (JSC::DFG::Node::mergeFlags):
2083             (JSC::DFG::Node::filterFlags):
2084             (JSC::DFG::Node::setCanExit): Deleted.
2085             (JSC::DFG::Node::canExit): Deleted.
2086             * dfg/DFGNodeFlags.cpp:
2087             (JSC::DFG::dumpNodeFlags):
2088             * dfg/DFGNodeFlags.h:
2089             * dfg/DFGNodeType.h:
2090             * dfg/DFGPlan.cpp:
2091             (JSC::DFG::Plan::compileInThreadImpl):
2092             * dfg/DFGSpeculativeJIT.cpp:
2093             (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
2094             (JSC::DFG::SpeculativeJIT::bail):
2095             (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
2096             * dfg/DFGSpeculativeJIT32_64.cpp:
2097             (JSC::DFG::SpeculativeJIT::compile):
2098             * dfg/DFGSpeculativeJIT64.cpp:
2099             (JSC::DFG::SpeculativeJIT::compile):
2100
2101     2014-06-15  Filip Pizlo  <fpizlo@apple.com>
2102
2103             [ftlopt] Remove the DFG optimization fixpoint and remove some obvious reasons why we previously benefited from it
2104             https://bugs.webkit.org/show_bug.cgi?id=133931
2105
2106             Reviewed by Oliver Hunt.
2107
2108             * dfg/DFGAbstractInterpreterInlines.h:
2109             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Trigger constant-folding for GetMyArgumentByVal (which means turning it into GetLocalUnlinked) and correct the handling of Upsilon so we don't fold them away.
2110             * dfg/DFGConstantFoldingPhase.cpp:
2111             (JSC::DFG::ConstantFoldingPhase::foldConstants): Implement constant-folding for GetMyArgumentByVal.
2112             * dfg/DFGPlan.cpp:
2113             (JSC::DFG::Plan::compileInThreadImpl): Remove the fixpoint.
2114
2115     2014-06-15  Filip Pizlo  <fpizlo@apple.com>
2116
2117             [ftlopt] DFG OSR entry should have a crystal-clear story for when it's safe to enter at a block with a set of values
2118             https://bugs.webkit.org/show_bug.cgi?id=133935
2119
2120             Reviewed by Oliver Hunt.
2121
2122             * bytecode/Operands.h:
2123             (JSC::Operands::Operands):
2124             (JSC::Operands::ensureLocals):
2125             * dfg/DFGAbstractValue.cpp:
2126             (JSC::DFG::AbstractValue::filter): Now we can compute intersections of abstract values!
2127             * dfg/DFGAbstractValue.h:
2128             (JSC::DFG::AbstractValue::makeFullTop): Completeness.
2129             (JSC::DFG::AbstractValue::bytecodeTop): Completeness.
2130             (JSC::DFG::AbstractValue::fullTop): Completeness. We end up using this one.
2131             * dfg/DFGBasicBlock.cpp:
2132             (JSC::DFG::BasicBlock::BasicBlock):
2133             (JSC::DFG::BasicBlock::ensureLocals):
2134             * dfg/DFGBasicBlock.h: Remember the intersection of all things ever proven.
2135             * dfg/DFGCFAPhase.cpp:
2136             (JSC::DFG::CFAPhase::run): Compute the intersection.
2137             * dfg/DFGConstantFoldingPhase.cpp:
2138             (JSC::DFG::ConstantFoldingPhase::foldConstants): No need for the weirdo merge check since this fixes the root of the problem.
2139             * dfg/DFGGraph.cpp:
2140             (JSC::DFG::Graph::dumpBlockHeader): Better dumping.
2141             (JSC::DFG::Graph::dump): Better dumping.
2142             * dfg/DFGJITCompiler.h:
2143             (JSC::DFG::JITCompiler::noticeOSREntry): Use the intersected abstract value.
2144             * dfg/DFGSpeculativeJIT.cpp:
2145             (JSC::DFG::SpeculativeJIT::compileCurrentBlock): Assert if the intersected state indicates the block shouldn't execute.
2146
2147     2014-06-12  Filip Pizlo  <fpizlo@apple.com>
2148
2149             [ftlopt] A DFG inlined ById access variant should not speak of a chain, but only of what structures to test the base for, whether to use a constant as an alternate base for the actual access, and what structures to check on what additional cell constants
2150             https://bugs.webkit.org/show_bug.cgi?id=133821
2151
2152             Reviewed by Mark Hahnenberg.
2153
2154             This allows us to efficiently cache accesses that differ only in the prototypes on the path
2155             from the base to the prototype that has the field.
2156
2157             It also simplifies a bunch of code - IntendedStructureChain is now just an intermediate
2158             data structure.
2159
2160             * CMakeLists.txt:
2161             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2162             * JavaScriptCore.xcodeproj/project.pbxproj:
2163             * bytecode/ConstantStructureCheck.cpp: Added.
2164             (JSC::ConstantStructureCheck::dumpInContext):
2165             (JSC::ConstantStructureCheck::dump):
2166             (JSC::structureFor):
2167             (JSC::areCompatible):
2168             (JSC::mergeInto):
2169             * bytecode/ConstantStructureCheck.h: Added.
2170             (JSC::ConstantStructureCheck::ConstantStructureCheck):
2171             (JSC::ConstantStructureCheck::operator!):
2172             (JSC::ConstantStructureCheck::constant):
2173             (JSC::ConstantStructureCheck::structure):
2174             * bytecode/GetByIdStatus.cpp:
2175             (JSC::GetByIdStatus::computeForStubInfo):
2176             * bytecode/GetByIdVariant.cpp:
2177             (JSC::GetByIdVariant::GetByIdVariant):
2178             (JSC::GetByIdVariant::operator=):
2179             (JSC::GetByIdVariant::attemptToMerge):
2180             (JSC::GetByIdVariant::dumpInContext):
2181             * bytecode/GetByIdVariant.h:
2182             (JSC::GetByIdVariant::constantChecks):
2183             (JSC::GetByIdVariant::alternateBase):
2184             (JSC::GetByIdVariant::GetByIdVariant): Deleted.
2185             (JSC::GetByIdVariant::chain): Deleted.
2186             * bytecode/PutByIdVariant.cpp:
2187             (JSC::PutByIdVariant::dumpInContext):
2188             * bytecode/PutByIdVariant.h:
2189             (JSC::PutByIdVariant::transition):
2190             (JSC::PutByIdVariant::constantChecks):
2191             (JSC::PutByIdVariant::structureChain): Deleted.
2192             * dfg/DFGAbstractInterpreterInlines.h:
2193             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2194             * dfg/DFGByteCodeParser.cpp:
2195             (JSC::DFG::ByteCodeParser::emitChecks):
2196             (JSC::DFG::ByteCodeParser::handleGetById):
2197             (JSC::DFG::ByteCodeParser::handlePutById):
2198             (JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck): Deleted.
2199             (JSC::DFG::ByteCodeParser::structureChainIsStillValid): Deleted.
2200             (JSC::DFG::ByteCodeParser::emitPrototypeChecks): Deleted.
2201             * dfg/DFGConstantFoldingPhase.cpp:
2202             (JSC::DFG::ConstantFoldingPhase::foldConstants):
2203             (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
2204             (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
2205             (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
2206             * dfg/DFGDesiredStructureChains.cpp: Removed.
2207             * dfg/DFGDesiredStructureChains.h: Removed.
2208             * dfg/DFGGraph.h:
2209             (JSC::DFG::Graph::watchpoints):
2210             (JSC::DFG::Graph::chains): Deleted.
2211             * dfg/DFGPlan.cpp:
2212             (JSC::DFG::Plan::isStillValid):
2213             (JSC::DFG::Plan::checkLivenessAndVisitChildren):
2214             (JSC::DFG::Plan::cancel):
2215             * dfg/DFGPlan.h:
2216             * ftl/FTLLowerDFGToLLVM.cpp:
2217             (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
2218             * runtime/IntendedStructureChain.cpp:
2219             (JSC::IntendedStructureChain::gatherChecks):
2220             * runtime/IntendedStructureChain.h:
2221             (JSC::IntendedStructureChain::at):
2222             (JSC::IntendedStructureChain::operator[]):
2223
2224     2014-06-12  Filip Pizlo  <fpizlo@apple.com>
2225
2226             [ftlopt] Constant folding and strength reduction should work in SSA
2227             https://bugs.webkit.org/show_bug.cgi?id=133839
2228
2229             Reviewed by Oliver Hunt.
2230
2231             * dfg/DFGAtTailAbstractState.cpp:
2232             (JSC::DFG::AtTailAbstractState::AtTailAbstractState):
2233             (JSC::DFG::AtTailAbstractState::forNode):
2234             * dfg/DFGAtTailAbstractState.h:
2235             * dfg/DFGConstantFoldingPhase.cpp:
2236             (JSC::DFG::ConstantFoldingPhase::foldConstants):
2237             * dfg/DFGGraph.cpp:
2238             (JSC::DFG::Graph::convertToConstant):
2239             * dfg/DFGIntegerCheckCombiningPhase.cpp:
2240             (JSC::DFG::IntegerCheckCombiningPhase::rangeKeyAndAddend): Fix an unrelated regression that this uncovered.
2241             * dfg/DFGLICMPhase.cpp:
2242             (JSC::DFG::LICMPhase::LICMPhase):
2243             * dfg/DFGPlan.cpp:
2244             (JSC::DFG::Plan::compileInThreadImpl):
2245
2246     2014-06-11  Filip Pizlo  <fpizlo@apple.com>
2247
2248             [ftlopt] DFG get_by_id should inline chain accesses with a slightly polymorphic base
2249             https://bugs.webkit.org/show_bug.cgi?id=133751
2250
2251             Reviewed by Mark Hahnenberg.
2252
2253             * bytecode/GetByIdStatus.cpp:
2254             (JSC::GetByIdStatus::appendVariant):
2255             (JSC::GetByIdStatus::computeForStubInfo):
2256             * bytecode/GetByIdVariant.cpp:
2257             (JSC::GetByIdVariant::attemptToMerge):
2258             * bytecode/GetByIdVariant.h:
2259             * bytecode/PutByIdStatus.cpp:
2260             (JSC::PutByIdStatus::computeFor):
2261             * dfg/DFGByteCodeParser.cpp:
2262             (JSC::DFG::ByteCodeParser::emitPrototypeChecks):
2263             (JSC::DFG::ByteCodeParser::handleGetById):
2264             (JSC::DFG::ByteCodeParser::handlePutById):
2265             * runtime/IntendedStructureChain.cpp:
2266             (JSC::IntendedStructureChain::IntendedStructureChain):
2267             (JSC::IntendedStructureChain::isStillValid):
2268             (JSC::IntendedStructureChain::isNormalized):
2269             (JSC::IntendedStructureChain::terminalPrototype):
2270             (JSC::IntendedStructureChain::operator==):
2271             (JSC::IntendedStructureChain::visitChildren):
2272             (JSC::IntendedStructureChain::dumpInContext):
2273             (JSC::IntendedStructureChain::chain): Deleted.
2274             * runtime/IntendedStructureChain.h:
2275             (JSC::IntendedStructureChain::prototype):
2276             (JSC::IntendedStructureChain::operator!=):
2277             (JSC::IntendedStructureChain::head): Deleted.
2278
2279     2014-06-11  Matthew Mirman  <mmirman@apple.com>
2280
2281            Readded native calling to the FTL and Split the DFG nodes
2282            Call and Construct into NativeCall and NativeConstruct
2283            to better represent their semantics.
2284            https://bugs.webkit.org/show_bug.cgi?id=133660
2285
2286            Reviewed by Filip Pizlo.
2287
2288            * dfg/DFGAbstractInterpreterInlines.h:
2289            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2290            Added NativeCall and NativeConstruct case
2291            * dfg/DFGByteCodeParser.cpp:
2292            (JSC::DFG::ByteCodeParser::addCall): added NativeCall case.
2293            (JSC::DFG::ByteCodeParser::handleCall):
2294            set to return NativeCall or NativeConstruct instead of Call or Construct
2295            in the presence of a native function.
2296            * dfg/DFGClobberize.h:
2297            (JSC::DFG::clobberize): added NativeCall and NativeConstruct case.
2298            * dfg/DFGDoesGC.cpp:
2299            (JSC::DFG::doesGC): added NativeCall and NativeConstruct case.
2300            * dfg/DFGFixupPhase.cpp:
2301            (JSC::DFG::FixupPhase::fixupNode): added NativeCall and NativeConstruct case.
2302            * dfg/DFGNode.h:
2303            (JSC::DFG::Node::hasHeapPrediction): added NativeCall and NativeConstruct case.
2304            (JSC::DFG::Node::canBeKnownFunction): changed to NativeCall and NativeConstruct.
2305            (JSC::DFG::Node::hasKnownFunction): changed to NativeCall and NativeConstruct.
2306            * dfg/DFGNodeType.h: added NativeCall and NativeConstruct.
2307            * dfg/DFGPredictionPropagationPhase.cpp:
2308            (JSC::DFG::PredictionPropagationPhase::propagate): added NativeCall and NativeConstruct case.
2309            * dfg/DFGSafeToExecute.h:
2310            (JSC::DFG::safeToExecute): added NativeCall and NativeConstruct case.
2311            * dfg/DFGSpeculativeJIT32_64.cpp:
2312            (JSC::DFG::SpeculativeJIT::emitCall): ditto
2313            (JSC::DFG::SpeculativeJIT::compile): ditto
2314            * dfg/DFGSpeculativeJIT64.cpp:
2315            (JSC::DFG::SpeculativeJIT::emitCall): ditto
2316            (JSC::DFG::SpeculativeJIT::compile): ditto
2317            * ftl/FTLCapabilities.cpp:
2318            (JSC::FTL::canCompile): ditto
2319            * ftl/FTLLowerDFGToLLVM.cpp:
2320            (JSC::FTL::LowerDFGToLLVM::lower): ditto
2321            (JSC::FTL::LowerDFGToLLVM::compileNode): ditto.
2322            (JSC::FTL::LowerDFGToLLVM::compileNativeCallOrConstruct): Added.
2323            (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct): removed NativeCall and NativeConstruct functionality.
2324            (JSC::FTL::LowerDFGToLLVM::didOverflowStack): added NativeCall and NativeConstruct case.
2325            * runtime/JSCJSValue.h: added JS_EXPORT_PRIVATE to toInteger as it is apparently needed.
2326
2327     2014-06-11  Matthew Mirman  <mmirman@apple.com>
2328
2329             Ensured Native Calls and Construct and associated checks
2330             are only emitted during ftl mode.
2331             https://bugs.webkit.org/show_bug.cgi?id=133718
2332
2333             Reviewed by Filip Pizlo.
2334
2335             * dfg/DFGByteCodeParser.cpp:
2336             (JSC::DFG::ByteCodeParser::handleCall): Added check for ftl mode
2337             before attaching the native function to Call or Construct.
2338
2339     2014-06-10  Filip Pizlo  <fpizlo@apple.com>
2340
2341             [ftlopt] DFG should use its own notion of JSValue, which we should call FrozenValue, that will carry around a copy of its structure
2342             https://bugs.webkit.org/show_bug.cgi?id=133426
2343
2344             Reviewed by Geoffrey Garen.
2345
2346             The impetus for this was to provide some sense and reason to race conditions arising from
2347             cell constants having their structure changed on the main thread - this is harmess because
2348             we defend against it, but when it goes wrong, it can be difficult to reproduce because it
2349             requires a race. Giving the DFG the ability to "freeze" a cell's structure fixes this.
2350
2351             But this patch goes quite a bit further, and completely rationalizes how the DFG reasons
2352             about constants. It no longer relies on the CodeBlock constant pool at all, which allows
2353             for a more object-oriented approach: for example a Node that has a constant can tell you
2354             what constant it has without needing a CodeBlock.
2355
2356             * CMakeLists.txt:
2357             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2358             * JavaScriptCore.xcodeproj/project.pbxproj:
2359             * bytecode/CallLinkStatus.cpp:
2360             (JSC::CallLinkStatus::computeExitSiteData):
2361             * bytecode/ExitKind.cpp:
2362             (JSC::exitKindToString):
2363             (JSC::exitKindIsCountable):
2364             * bytecode/ExitKind.h:
2365             (JSC::isWatchpoint): Deleted.
2366             * bytecode/GetByIdStatus.cpp:
2367             (JSC::GetByIdStatus::hasExitSite):
2368             * bytecode/PutByIdStatus.cpp:
2369             (JSC::PutByIdStatus::hasExitSite):
2370             * dfg/DFGAbstractInterpreter.h:
2371             (JSC::DFG::AbstractInterpreter::filterByValue):
2372             (JSC::DFG::AbstractInterpreter::setBuiltInConstant):
2373             (JSC::DFG::AbstractInterpreter::setConstant):
2374             * dfg/DFGAbstractInterpreterInlines.h:
2375             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2376             (JSC::DFG::AbstractInterpreter<AbstractStateType>::filterByValue):
2377             * dfg/DFGAbstractValue.cpp:
2378             (JSC::DFG::AbstractValue::setOSREntryValue):
2379             (JSC::DFG::AbstractValue::set):
2380             (JSC::DFG::AbstractValue::filterByValue):
2381             (JSC::DFG::AbstractValue::setMostSpecific): Deleted.
2382             * dfg/DFGAbstractValue.h:
2383             * dfg/DFGArgumentsSimplificationPhase.cpp:
2384             (JSC::DFG::ArgumentsSimplificationPhase::run):
2385             * dfg/DFGBackwardsPropagationPhase.cpp:
2386             (JSC::DFG::BackwardsPropagationPhase::isNotNegZero):
2387             (JSC::DFG::BackwardsPropagationPhase::isNotPosZero):
2388             (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoForConstant):
2389             (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwo):
2390             * dfg/DFGByteCodeParser.cpp:
2391             (JSC::DFG::ByteCodeParser::ByteCodeParser):
2392             (JSC::DFG::ByteCodeParser::getDirect):
2393             (JSC::DFG::ByteCodeParser::get):
2394             (JSC::DFG::ByteCodeParser::getLocal):
2395             (JSC::DFG::ByteCodeParser::setLocal):
2396             (JSC::DFG::ByteCodeParser::setArgument):
2397             (JSC::DFG::ByteCodeParser::jsConstant):
2398             (JSC::DFG::ByteCodeParser::weakJSConstant):
2399             (JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck):
2400             (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand):
2401             (JSC::DFG::ByteCodeParser::handleCall):
2402             (JSC::DFG::ByteCodeParser::emitFunctionChecks):
2403             (JSC::DFG::ByteCodeParser::handleInlining):
2404             (JSC::DFG::ByteCodeParser::handleMinMax):
2405             (JSC::DFG::ByteCodeParser::handleIntrinsic):
2406             (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
2407             (JSC::DFG::ByteCodeParser::handleGetById):
2408             (JSC::DFG::ByteCodeParser::prepareToParseBlock):
2409             (JSC::DFG::ByteCodeParser::parseBlock):
2410             (JSC::DFG::ByteCodeParser::buildOperandMapsIfNecessary):
2411             (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
2412             (JSC::DFG::ByteCodeParser::parseCodeBlock):
2413             (JSC::DFG::ByteCodeParser::addConstant): Deleted.
2414             (JSC::DFG::ByteCodeParser::getJSConstantForValue): Deleted.
2415             (JSC::DFG::ByteCodeParser::getJSConstant): Deleted.
2416             (JSC::DFG::ByteCodeParser::isJSConstant): Deleted.
2417             (JSC::DFG::ByteCodeParser::isInt32Constant): Deleted.
2418             (JSC::DFG::ByteCodeParser::valueOfJSConstant): Deleted.
2419             (JSC::DFG::ByteCodeParser::valueOfInt32Constant): Deleted.
2420             (JSC::DFG::ByteCodeParser::constantUndefined): Deleted.
2421             (JSC::DFG::ByteCodeParser::constantNull): Deleted.
2422             (JSC::DFG::ByteCodeParser::one): Deleted.
2423             (JSC::DFG::ByteCodeParser::constantNaN): Deleted.
2424             (JSC::DFG::ByteCodeParser::cellConstant): Deleted.
2425             (JSC::DFG::ByteCodeParser::inferredConstant): Deleted.
2426             (JSC::DFG::ByteCodeParser::ConstantRecord::ConstantRecord): Deleted.
2427             * dfg/DFGCFGSimplificationPhase.cpp:
2428             (JSC::DFG::CFGSimplificationPhase::run):
2429             * dfg/DFGCSEPhase.cpp:
2430             (JSC::DFG::CSEPhase::constantCSE):
2431             (JSC::DFG::CSEPhase::checkFunctionElimination):
2432             (JSC::DFG::CSEPhase::performNodeCSE):
2433             (JSC::DFG::CSEPhase::weakConstantCSE): Deleted.
2434             * dfg/DFGClobberize.h:
2435             (JSC::DFG::clobberize):
2436             * dfg/DFGCommon.h:
2437             * dfg/DFGConstantFoldingPhase.cpp:
2438             (JSC::DFG::ConstantFoldingPhase::foldConstants):
2439             (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
2440             (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
2441             * dfg/DFGDoesGC.cpp:
2442             (JSC::DFG::doesGC):
2443             * dfg/DFGFixupPhase.cpp:
2444             (JSC::DFG::FixupPhase::fixupNode):
2445             (JSC::DFG::FixupPhase::fixupMakeRope):
2446             (JSC::DFG::FixupPhase::truncateConstantToInt32):
2447             (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteLength):
2448             (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
2449             * dfg/DFGFrozenValue.cpp: Added.
2450             (JSC::DFG::FrozenValue::emptySingleton):
2451             (JSC::DFG::FrozenValue::dumpInContext):
2452             (JSC::DFG::FrozenValue::dump):
2453             * dfg/DFGFrozenValue.h: Added.
2454             (JSC::DFG::FrozenValue::FrozenValue):
2455             (JSC::DFG::FrozenValue::operator!):
2456             (JSC::DFG::FrozenValue::value):
2457             (JSC::DFG::FrozenValue::structure):
2458             (JSC::DFG::FrozenValue::strengthenTo):
2459             (JSC::DFG::FrozenValue::strength):
2460             (JSC::DFG::FrozenValue::freeze):
2461             * dfg/DFGGraph.cpp:
2462             (JSC::DFG::Graph::Graph):
2463             (JSC::DFG::Graph::dump):
2464             (JSC::DFG::Graph::tryGetActivation):
2465             (JSC::DFG::Graph::tryGetFoldableView):
2466             (JSC::DFG::Graph::registerFrozenValues):
2467             (JSC::DFG::Graph::visitChildren):
2468             (JSC::DFG::Graph::freezeFragile):
2469             (JSC::DFG::Graph::freeze):
2470             (JSC::DFG::Graph::freezeStrong):
2471             (JSC::DFG::Graph::convertToConstant):
2472             (JSC::DFG::Graph::convertToStrongConstant):
2473             (JSC::DFG::Graph::assertIsWatched):
2474             * dfg/DFGGraph.h:
2475             (JSC::DFG::Graph::addImmediateShouldSpeculateInt32):
2476             (JSC::DFG::Graph::convertToConstant): Deleted.
2477             (JSC::DFG::Graph::constantRegisterForConstant): Deleted.
2478             (JSC::DFG::Graph::getJSConstantSpeculation): Deleted.
2479             (JSC::DFG::Graph::isConstant): Deleted.
2480             (JSC::DFG::Graph::isJSConstant): Deleted.
2481             (JSC::DFG::Graph::isInt32Constant): Deleted.
2482             (JSC::DFG::Graph::isDoubleConstant): Deleted.
2483             (JSC::DFG::Graph::isNumberConstant): Deleted.
2484             (JSC::DFG::Graph::isBooleanConstant): Deleted.
2485             (JSC::DFG::Graph::isCellConstant): Deleted.
2486             (JSC::DFG::Graph::isFunctionConstant): Deleted.
2487             (JSC::DFG::Graph::isInternalFunctionConstant): Deleted.
2488             (JSC::DFG::Graph::valueOfJSConstant): Deleted.
2489             (JSC::DFG::Graph::valueOfInt32Constant): Deleted.
2490             (JSC::DFG::Graph::valueOfNumberConstant): Deleted.
2491             (JSC::DFG::Graph::valueOfBooleanConstant): Deleted.
2492             (JSC::DFG::Graph::valueOfFunctionConstant): Deleted.
2493             (JSC::DFG::Graph::mulImmediateShouldSpeculateInt32): Deleted.
2494             * dfg/DFGInPlaceAbstractState.cpp:
2495             (JSC::DFG::InPlaceAbstractState::initialize):
2496             * dfg/DFGInsertionSet.h:
2497             (JSC::DFG::InsertionSet::insertConstant):
2498             (JSC::DFG::InsertionSet::insertConstantForUse):
2499             * dfg/DFGIntegerCheckCombiningPhase.cpp:
2500             (JSC::DFG::IntegerCheckCombiningPhase::rangeKeyAndAddend):
2501             * dfg/DFGJITCompiler.cpp:
2502             (JSC::DFG::JITCompiler::link):
2503             * dfg/DFGLazyJSValue.cpp:
2504             (JSC::DFG::LazyJSValue::getValue):
2505             (JSC::DFG::LazyJSValue::strictEqual):
2506             (JSC::DFG::LazyJSValue::dumpInContext):
2507             * dfg/DFGLazyJSValue.h:
2508             (JSC::DFG::LazyJSValue::LazyJSValue):
2509             (JSC::DFG::LazyJSValue::tryGetValue):
2510             (JSC::DFG::LazyJSValue::value):
2511             (JSC::DFG::LazyJSValue::switchLookupValue):
2512             * dfg/DFGMinifiedNode.cpp:
2513             (JSC::DFG::MinifiedNode::fromNode):
2514             * dfg/DFGMinifiedNode.h:
2515             (JSC::DFG::belongsInMinifiedGraph):
2516             (JSC::DFG::MinifiedNode::hasConstant):
2517             (JSC::DFG::MinifiedNode::constant):
2518             (JSC::DFG::MinifiedNode::hasConstantNumber): Deleted.
2519             (JSC::DFG::MinifiedNode::constantNumber): Deleted.
2520             (JSC::DFG::MinifiedNode::hasWeakConstant): Deleted.
2521             (JSC::DFG::MinifiedNode::weakConstant): Deleted.
2522             * dfg/DFGNode.h:
2523             (JSC::DFG::Node::hasConstant):
2524             (JSC::DFG::Node::constant):
2525             (JSC::DFG::Node::convertToConstant):
2526             (JSC::DFG::Node::asJSValue):
2527             (JSC::DFG::Node::isInt32Constant):
2528             (JSC::DFG::Node::asInt32):
2529             (JSC::DFG::Node::asUInt32):
2530             (JSC::DFG::Node::isDoubleConstant):
2531             (JSC::DFG::Node::isNumberConstant):
2532             (JSC::DFG::Node::asNumber):
2533             (JSC::DFG::Node::isMachineIntConstant):
2534             (JSC::DFG::Node::asMachineInt):
2535             (JSC::DFG::Node::isBooleanConstant):
2536             (JSC::DFG::Node::asBoolean):
2537             (JSC::DFG::Node::isCellConstant):
2538             (JSC::DFG::Node::asCell):
2539             (JSC::DFG::Node::dynamicCastConstant):
2540             (JSC::DFG::Node::function):
2541             (JSC::DFG::Node::isWeakConstant): Deleted.
2542             (JSC::DFG::Node::constantNumber): Deleted.
2543             (JSC::DFG::Node::convertToWeakConstant): Deleted.
2544             (JSC::DFG::Node::weakConstant): Deleted.
2545             (JSC::DFG::Node::valueOfJSConstant): Deleted.
2546             * dfg/DFGNodeType.h:
2547             * dfg/DFGOSRExitCompiler.cpp:
2548             * dfg/DFGPredictionPropagationPhase.cpp:
2549             (JSC::DFG::PredictionPropagationPhase::propagate):
2550             * dfg/DFGSafeToExecute.h:
2551             (JSC::DFG::safeToExecute):
2552             * dfg/DFGSpeculativeJIT.cpp:
2553             (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
2554             (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
2555             (JSC::DFG::SpeculativeJIT::silentFill):
2556             (JSC::DFG::SpeculativeJIT::compileIn):
2557             (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):
2558             (JSC::DFG::SpeculativeJIT::compilePeepHoleInt32Branch):
2559             (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
2560             (JSC::DFG::SpeculativeJIT::compileDoubleRep):
2561             (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
2562             (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
2563             (JSC::DFG::SpeculativeJIT::compileAdd):
2564             (JSC::DFG::SpeculativeJIT::compileArithSub):
2565             (JSC::DFG::SpeculativeJIT::compileArithMod):
2566             * dfg/DFGSpeculativeJIT.h:
2567             (JSC::DFG::SpeculativeJIT::valueOfJSConstantAsImm64):
2568             (JSC::DFG::SpeculativeJIT::initConstantInfo):
2569             (JSC::DFG::SpeculativeJIT::isConstant): Deleted.
2570             (JSC::DFG::SpeculativeJIT::isJSConstant): Deleted.
2571             (JSC::DFG::SpeculativeJIT::isInt32Constant): Deleted.
2572             (JSC::DFG::SpeculativeJIT::isDoubleConstant): Deleted.
2573             (JSC::DFG::SpeculativeJIT::isNumberConstant): Deleted.
2574             (JSC::DFG::SpeculativeJIT::isBooleanConstant): Deleted.
2575             (JSC::DFG::SpeculativeJIT::isFunctionConstant): Deleted.
2576             (JSC::DFG::SpeculativeJIT::valueOfInt32Constant): Deleted.
2577             (JSC::DFG::SpeculativeJIT::valueOfNumberConstant): Deleted.
2578             (JSC::DFG::SpeculativeJIT::addressOfDoubleConstant): Deleted.
2579             (JSC::DFG::SpeculativeJIT::valueOfJSConstant): Deleted.
2580             (JSC::DFG::SpeculativeJIT::valueOfBooleanConstant): Deleted.
2581             (JSC::DFG::SpeculativeJIT::valueOfFunctionConstant): Deleted.
2582             (JSC::DFG::SpeculativeJIT::isNullConstant): Deleted.
2583             (JSC::DFG::SpeculativeJIT::isInteger): Deleted.
2584             * dfg/DFGSpeculativeJIT32_64.cpp:
2585             (JSC::DFG::SpeculativeJIT::fillJSValue):
2586             (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
2587             (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
2588             (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
2589             (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
2590             (JSC::DFG::SpeculativeJIT::compile):
2591             * dfg/DFGSpeculativeJIT64.cpp:
2592             (JSC::DFG::SpeculativeJIT::fillJSValue):
2593             (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
2594             (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
2595             (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
2596             (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
2597             (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
2598             (JSC::DFG::SpeculativeJIT::compile):
2599             * dfg/DFGStrengthReductionPhase.cpp:
2600             (JSC::DFG::StrengthReductionPhase::handleNode):
2601             * dfg/DFGValidate.cpp:
2602             (JSC::DFG::Validate::validate):
2603             * dfg/DFGValueStrength.cpp: Added.
2604             (WTF::printInternal):
2605             * dfg/DFGValueStrength.h: Added.
2606             (JSC::DFG::merge):
2607             * dfg/DFGVariableEventStream.cpp:
2608             (JSC::DFG::VariableEventStream::tryToSetConstantRecovery):
2609             (JSC::DFG::VariableEventStream::reconstruct):
2610             * dfg/DFGVariableEventStream.h:
2611             * dfg/DFGWatchableStructureWatchingPhase.cpp:
2612             (JSC::DFG::WatchableStructureWatchingPhase::run):
2613             (JSC::DFG::WatchableStructureWatchingPhase::tryWatch):
2614             * dfg/DFGWatchpointCollectionPhase.cpp:
2615             (JSC::DFG::WatchpointCollectionPhase::handle):
2616             * ftl/FTLCapabilities.cpp:
2617             (JSC::FTL::canCompile):
2618             * ftl/FTLLink.cpp:
2619             (JSC::FTL::link):
2620             * ftl/FTLLowerDFGToLLVM.cpp:
2621             (JSC::FTL::LowerDFGToLLVM::compileNode):
2622             (JSC::FTL::LowerDFGToLLVM::compileDoubleConstant):
2623             (JSC::FTL::LowerDFGToLLVM::compileInt52Constant):
2624             (JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
2625             (JSC::FTL::LowerDFGToLLVM::compileCheckFunction):
2626             (JSC::FTL::LowerDFGToLLVM::compileCompareEqConstant):
2627             (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEqConstant):
2628             (JSC::FTL::LowerDFGToLLVM::lowInt32):
2629             (JSC::FTL::LowerDFGToLLVM::lowCell):
2630             (JSC::FTL::LowerDFGToLLVM::lowBoolean):
2631             (JSC::FTL::LowerDFGToLLVM::lowJSValue):
2632             (JSC::FTL::LowerDFGToLLVM::tryToSetConstantExitArgument):
2633             (JSC::FTL::LowerDFGToLLVM::compileWeakJSConstant): Deleted.
2634             * ftl/FTLOSRExitCompiler.cpp:
2635             (JSC::FTL::compileStub):
2636             * runtime/JSCJSValue.cpp:
2637             (JSC::JSValue::dumpInContext):
2638             (JSC::JSValue::dumpInContextAssumingStructure):
2639             * runtime/JSCJSValue.h:
2640
2641 2014-07-24  Brent Fulgham  <bfulgham@apple.com>
2642
2643         [Win] Correct build order in JavaScriptCore.submit.sln
2644         https://bugs.webkit.org/show_bug.cgi?id=135282
2645         <rdar://problem/17805592>
2646
2647         Unreviewed build fix.
2648
2649         * JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: Correct build order
2650         such that LLIntDesiredOffset is built prior to the rest of JSC.
2651
2652 2014-07-24  Mark Lam  <mark.lam@apple.com>
2653
2654         JSWrapperMap's jsWrapperForObject() needs to keep weak prototype and constructors from being GCed.
2655         <https://webkit.org/b/135258>
2656
2657         Reviewed by Mark Hahnenberg.
2658
2659         Where needed, we cache the prototype object pointer in a stack local var.
2660         This allows it to be scanned by the GC, and hence be kept alive until
2661         we use it.  The constructor object will in turn be kept alive by the
2662         prototype object.
2663
2664         Also added some comments to warn against future code additions that could
2665         regress this issue.
2666
2667         * API/JSWrapperMap.mm:
2668         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]):
2669         (-[JSObjCClassInfo reallocateConstructorAndOrPrototype]):
2670         (-[JSObjCClassInfo wrapperForObject:]):
2671         (-[JSObjCClassInfo constructor]):
2672
2673 2014-07-24  Joseph Pecoraro  <pecoraro@apple.com>
2674
2675         JSLock release should only modify the AtomicStringTable if it modified in acquire
2676         https://bugs.webkit.org/show_bug.cgi?id=135143
2677
2678         Reviewed by Darin Adler.
2679
2680         * runtime/JSLock.cpp:
2681         (JSC::JSLock::JSLock):
2682         Initialize the member variable to nullptr.
2683
2684         (JSC::JSLock::willDestroyVM):
2685         Update style to use nullptr instead of 0.
2686
2687         (JSC::JSLock::willReleaseLock):
2688         We should only reset the thread data's atomic string table if
2689         didAcquireLock changed it. m_entryAtomicStringTable will have
2690         been set by didAcquireLock if it changed, or nullptr if it didn't.
2691         This way we are sure we are balanced, regardless of m_vm changes.
2692
2693 2014-07-24  Peyton Randolph  <prandolph@apple.com>
2694
2695         Rename feature flag for long-press gesture on Mac.
2696         https://bugs.webkit.org/show_bug.cgi?id=135259
2697
2698         Reviewed by Beth Dakin.
2699
2700         * Configurations/FeatureDefines.xcconfig:
2701         Rename LINK_LONG_PRESS to MAC_LONG_PRESS.
2702
2703 2014-07-24  Commit Queue  <commit-queue@webkit.org>
2704
2705         Unreviewed, rolling out r171527.
2706         https://bugs.webkit.org/show_bug.cgi?id=135265
2707
2708         Breaks JSC API tests (Requested by mlam on #webkit).
2709
2710         Reverted changeset:
2711
2712         "JSWrapperMap's jsWrapperForObject() needs to defer GC."
2713         https://bugs.webkit.org/show_bug.cgi?id=135258
2714         http://trac.webkit.org/changeset/171527
2715
2716 2014-07-24  Mark Hahnenberg  <mhahnenberg@apple.com>
2717
2718         Creating a JSGlobalObject with a custom JSClassRef results in a JSProxy with the wrong prototype
2719         https://bugs.webkit.org/show_bug.cgi?id=135250
2720
2721         Reviewed by Geoffrey Garen.
2722
2723         JSGlobalObject::resetPrototype (which is called from JSGlobalContextCreateInGroup) doesn't change its
2724         JSProxy's prototype as well. This results in a JSProxy where no properties in the original prototype
2725         chain (as created from the JSClassRef hierarchy) are accessible. Changing resetPrototype to also change
2726         the JSProxy's prototype fixes the issue.
2727
2728         * API/JSValueRef.cpp:
2729         (JSValueIsObjectOfClass): Also fixed a bug where a JSProxy for a JSGlobalObject with a custom JSClassRef
2730         would claim it wasn't of the specified class, even if the target was of the specified class.
2731         * API/tests/CustomGlobalObjectClassTest.c: Added.
2732         (jsDoSomething):
2733         (customGlobalObjectClassTest):
2734         * API/tests/CustomGlobalObjectClassTest.h: Added.
2735         * API/tests/testapi.c:
2736         (assertTrue):
2737         (main):
2738         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
2739         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
2740         * JavaScriptCore.xcodeproj/project.pbxproj:
2741         * runtime/JSGlobalObject.cpp:
2742         (JSC::JSGlobalObject::resetPrototype):
2743
2744 2014-07-24  Brian J. Burg  <burg@cs.washington.edu>
2745
2746         Web Replay: don't encode/decode primitive types that lack explicit sizes
2747         https://bugs.webkit.org/show_bug.cgi?id=133430
2748
2749         Reviewed by Anders Carlsson.
2750
2751         Don't support encode/decode of unsigned long, since its size is compiler-dependent.
2752
2753         * replay/EncodedValue.cpp:
2754         (JSC::EncodedValue::convertTo<unsigned long>):
2755         (JSC::unsigned long>::encodeValue): Deleted.
2756         * replay/EncodedValue.h:
2757
2758 2014-07-24  Mark Lam  <mark.lam@apple.com>
2759
2760         JSWrapperMap's jsWrapperForObject() needs to defer GC.
2761         <https://webkit.org/b/135258>
2762
2763         Reviewed by Oliver Hunt.
2764
2765         In the process of creating a JS wrapper, jsWrapperForObject() will create
2766         the prototype and constructor of the corresponding ObjC class, as well as
2767         for classes in its inheritance chain.  These prototypes and constructors
2768         are stored in Weak references in the JSObjCClassInfo objects.  During all
2769         the allocation that is being done to create all the prototypes and
2770         constructors as well as the wrapper objects, a GC may occur thereby
2771         collecting one or more of these newly created prototype and constructor
2772         objects.
2773
2774         One example of where this problem can manifest is in wrapperForObject()
2775         which is called from jsWrapperForObject().  In wrapperFoObject(), we do
2776         the following steps:
2777
2778         1. reallocateConstructorAndOrPrototype() which creates the prototype
2779            object and store it in JSObjCClassInfo's m_prototype which is a Weak
2780            ref.
2781         2. makeWrapper() to create the wrapper object, which may trigger a GC.
2782            GC will collect the prototype object and nullify the corresponding
2783            JSObjCClassInfo's m_prototype Weak ref.
2784         3. call JSObjectSetPrototype() to set the JSObjCClassInfo's m_prototype
2785            in the newly created wrapper.  This results in the wrapper getting a
2786            jsNull as a prototype instead of the expected prototype object.
2787
2788         To ensure that the prototype and constructor objects are retained until
2789         they can be referenced properly from the wrapper object,
2790         jsWrapperForObject() should defer GC until it's done with its work.
2791
2792         * API/JSWrapperMap.mm:
2793         (-[JSWrapperMap jsWrapperForObject:]):
2794
2795 2014-07-23  Brent Fulgham  <bfulgham@apple.com>
2796
2797         Build fix after r171482.
2798
2799         Rubberstamped by Joe Pecoraro.
2800
2801         * runtime/Identifier.h: Make header declarations match
2802         implementation file.
2803
2804 2014-07-23  Brent Fulgham  <bfulgham@apple.com>
2805
2806         [Win] Use NO_RETURN_DUE_TO_CRASH on Windows
2807         https://bugs.webkit.org/show_bug.cgi?id=135199
2808
2809         Reviewed by Mark Lam.
2810
2811         * jsc.cpp:
2812         (WTF::RuntimeArray::deleteProperty): Stop using ugly
2813         compiler work-around on Windows; use NO_RETURN_DUE_TO_CRASH
2814         codepath instead.
2815         * runtime/Identifier.h: Add NO_RETURN_DUE_TO_CRASH
2816         to header so function declaration matches implementation.
2817
2818 2014-07-23  Bem Jones-Bey  <bjonesbe@adobe.com>
2819
2820         Remove CSS_EXCLUSIONS compile flag and leftover code
2821         https://bugs.webkit.org/show_bug.cgi?id=135175
2822
2823         Reviewed by Zoltan Horvath.
2824
2825         At this point, the CSS_EXCLUSIONS flag guards nothing but some useless
2826         stubs. This removes the flag and the useless code.
2827
2828         * Configurations/FeatureDefines.xcconfig:
2829
2830 2014-07-23  Commit Queue  <commit-queue@webkit.org>
2831
2832         Unreviewed, rolling out r171367.
2833         https://bugs.webkit.org/show_bug.cgi?id=135192
2834
2835         broke three API tests (Requested by thorton on #webkit).
2836
2837         Reverted changeset:
2838
2839         "JSLock release should only modify the AtomicStringTable if it
2840         modified in acquire"
2841         https://bugs.webkit.org/show_bug.cgi?id=135143
2842         http://trac.webkit.org/changeset/171367
2843
2844 2014-07-22  László Langó  <llango.u-szeged@partner.samsung.com>
2845
2846         [EFL] Build fix after the [ftlopt] branch merge.
2847
2848         Reviewed by Csaba Osztrogonác.
2849
2850         * dfg/DFGBranchDirection.h:
2851         (JSC::DFG::branchDirectionToString):
2852         * dfg/DFGStructureClobberState.h:
2853         (JSC::DFG::merge):
2854
2855 2014-07-22  Brent Fulgham  <bfulgham@apple.com>
2856
2857         Build fix for non-clang compile.
2858
2859         * jsc.cpp:
2860         (WTF::RuntimeArray::put): Remove incorrect return statement
2861         I added.
2862
2863 2014-07-22  Brent Fulgham  <bfulgham@apple.com>
2864
2865         Build fix for non-clang compile.
2866
2867         * jsc.cpp:
2868         (WTF::RuntimeArray::deleteProperty): Need (fake) return
2869         value when NO_RETURN_DUE_TO_CRASH is not defined.
2870
2871 2014-07-22  Filip Pizlo  <fpizlo@apple.com>
2872
2873         Merge r169628 from ftlopt.
2874
2875     2014-06-04  Matthew Mirman  <mmirman@apple.com>
2876
2877             Added system for inlining native functions via the FTL.
2878             https://bugs.webkit.org/show_bug.cgi?id=131515
2879
2880             Reviewed by Filip Pizlo.
2881
2882             Also fixed the build to not compress the bitcode and to
2883             include all of the relevant runtime. With GCC_GENERATE_DEBUGGING_SYMBOLS = NO,
2884             the produced bitcode files are a 100th the size they were before.
2885             Now we can include all of the relevant runtime files with only a 3mb overhead.
2886             This is the same overhead as for two compressed files before,
2887             but done more efficiently (on both ends) and with less code.
2888
2889             Deciding whether to inline native functions is left up to LLVM.
2890             The entire module containing the function is linked into the current
2891             compiled JS so that inlining the native functions shouldn't make them smaller.
2892
2893             Rather than loading Runtime.symtbl at runtime FTLState.cpp now generates a file
2894             InlineRuntimeSymbolTable.h which statically builds the symbol table hash table.
2895
2896             * JavaScriptCore.xcodeproj/project.pbxproj: Added back runtime files to compile.
2897             * build-symbol-table-index.py: Changed bitcode suffix.
2898             Added inclusion of only tested symbols.
2899             Added output to InlineRuntimeSymbolTable.h.
2900             * build-symbol-table-index.sh: Changed bitcode suffix.
2901             * copy-llvm-ir-to-derived-sources.sh: Removed gzip compression.
2902             * tested-symbols.symlst: Added.
2903             * dfg/DFGByteCodeParser.cpp:
2904             (JSC::DFG::ByteCodeParser::handleCall):
2905             Now sets the knownFunction of the call node if such a function exists
2906             and emits a check that during runtime the callee is in fact known.
2907             * dfg/DFGNode.h:
2908             Added functions to set the known function of a call node.
2909             (JSC::DFG::Node::canBeKnownFunction): Added.
2910             (JSC::DFG::Node::hasKnownFunction): Added.
2911             (JSC::DFG::Node::knownFunction): Added.
2912             (JSC::DFG::Node::giveKnownFunction): Added.
2913             * ftl/FTLAbbreviatedTypes.h: Added a typedef for LLVMMemoryBufferRef
2914             * ftl/FTLAbbreviations.h: Added some abbreviations.
2915             * ftl/FTLLowerDFGToLLVM.cpp:
2916             (JSC::FTL::LowerDFGToLLVM::isInlinableSize): Added. Hardcoded threshold to 275.
2917             (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): Added.
2918             (JSC::FTL::LowerDFGToLLVM::getFunctionBySymbol): Added.
2919             (JSC::FTL::LowerDFGToLLVM::possiblyCompileInlineableNativeCall): Added.
2920             (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
2921             Added call to possiblyCompileInlineableNativeCall
2922             * ftl/FTLOutput.h:
2923             (JSC::FTL::Output::allocaName):  Added. Useful for debugging.
2924             * ftl/FTLState.cpp:
2925             (JSC::FTL::State::State): Added an include for InlineRuntimeSymbolTable.h
2926             * ftl/FTLState.h: Added symbol table hash table.
2927             * ftl/FTLCompile.cpp:
2928             (JSC::FTL::compile): Added inlining and dead function elimination passes.
2929             * heap/HandleStack.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
2930             * llvm/InitializeLLVMMac.mm: Deleted.
2931             * llvm/InitializeLLVMMac.cpp: Added.
2932             * llvm/LLVMAPIFunctions.h: Added macros to include Bitcode parsing and linking functions.
2933             * llvm/LLVMHeaders.h: Added includes for Bitcode parsing and linking.
2934             * runtime/BundlePath.h: Added.
2935             * runtime/BundlePath.mm: Added.
2936             * runtime/DateInstance.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
2937             * runtime/DateInstance.h: ditto.
2938             * runtime/DateConversion.h: ditto.
2939             * runtime/ExceptionHelpers.h: ditto.
2940             * runtime/JSCJSValue.h: ditto.
2941             * runtime/JSArray.h: ditto.
2942             * runtime/JSDateMath.h: ditto.
2943             * runtime/JSObject.h: ditto.
2944             * runtime/JSObject.h: ditto.
2945             * runtime/RegExp.h: ditto.
2946             * runtime/Structure.h: ditto.
2947             * runtime/Options.h:  Added maximumLLVMInstructionCountForNativeInlining.
2948
2949 2014-07-22  Mark Lam  <mark.lam@apple.com>
2950
2951         Array.concat() should work on runtime arrays too.
2952         <https://webkit.org/b/135179>
2953
2954         Reviewed by Geoffrey Garen.
2955
2956         * jsc.cpp:
2957         (WTF::RuntimeArray::create):
2958         (WTF::RuntimeArray::~RuntimeArray):
2959         (WTF::RuntimeArray::destroy):
2960         (WTF::RuntimeArray::getOwnPropertySlot):
2961         (WTF::RuntimeArray::getOwnPropertySlotByIndex):
2962         (WTF::RuntimeArray::put):
2963         (WTF::RuntimeArray::deleteProperty):
2964         (WTF::RuntimeArray::getLength):
2965         (WTF::RuntimeArray::createPrototype):
2966         (WTF::RuntimeArray::createStructure):
2967         (WTF::RuntimeArray::finishCreation):
2968         (WTF::RuntimeArray::RuntimeArray):
2969         (WTF::RuntimeArray::lengthGetter):
2970         (GlobalObject::finishCreation):
2971         (functionCreateRuntimeArray):
2972         - Added support to create a runtime array for testing purpose.
2973         * runtime/ArrayPrototype.cpp:
2974         (JSC::getLength):
2975         - Added fast case for when the array object is a JSArray.
2976         (JSC::arrayProtoFuncJoin):
2977         - Added a needed but missing exception check.
2978         (JSC::arrayProtoFuncConcat):
2979         - Use getLength() to compute the array length instead of assuming that
2980           the array is a JSArray instance.
2981         * tests/stress/regexp-matches-array.js: Added.
2982         (testArrayConcat):
2983         * tests/stress/runtime-array.js: Added.
2984         (testArrayConcat):
2985
2986 2014-07-22  Brent Fulgham  <bfulgham@apple.com>
2987
2988         Fix Windows (return a value!)
2989
2990         * jsc.cpp:
2991         (functionQuit): Satisfy compiler's need for
2992         a return value.
2993
2994 2014-07-22  Brent Fulgham  <bfulgham@apple.com>
2995
2996         Fix Windows (sleep -> Sleep)
2997
2998         * jsc.cpp:
2999         (WTF::jscExit):
3000
3001 2014-07-22  Filip Pizlo  <fpizlo@apple.com>
3002
3003         Fix Windows.
3004
3005         * jsc.cpp:
3006         (WTF::jscExit):
3007
3008 2014-07-22  Filip Pizlo  <fpizlo@apple.com>
3009
3010         Fix 32-bit.
3011
3012         * dfg/DFGSpeculativeJIT32_64.cpp:
3013         (JSC::DFG::SpeculativeJIT::compile):
3014
3015 2014-07-22  Filip Pizlo  <fpizlo@apple.com>
3016
3017         Merge r169148, r169185, r169188, r169578, r169582, r169584, r169588, r169753 from ftlopt.
3018
3019         Note that r169753 is merged out of order because it fixes a bug in r169588.
3020
3021     2014-06-10  Filip Pizlo  <fpizlo@apple.com>
3022
3023             [ftlopt] Structure::dfgShouldWatchIfPossible() is unsound
3024             https://bugs.webkit.org/show_bug.cgi?id=133624
3025
3026             Reviewed by Mark Hahnenberg.
3027
3028             * runtime/Structure.h:
3029             (JSC::Structure::dfgShouldWatchIfPossible): Make it sound and add some verbiage.
3030
3031     2014-06-04  Filip Pizlo  <fpizlo@apple.com>
3032
3033             [ftlopt] AI should be able track structure sets larger than 1
3034             https://bugs.webkit.org/show_bug.cgi?id=128073
3035
3036             Reviewed by Oliver Hunt.
3037
3038             This makes two major changes to how AI (abstract interpreter) proves that a value has
3039             some structure:
3040
3041             - StructureAbstractValue can now track an arbitrary number of structures. A set whose
3042               size is greater than one means that the value may have any of the structures, and we
3043               don't know which - but we do know that it cannot be any structure not in the set. The
3044               structure abstract value can still be TOP, which means the set of all structures. We
3045               artificially limit the set size to StructureAbstractValue::polymorphismLimit to guard
3046               memory explosion on pathological programs. This limit is big enough that it wouldn't
3047               kick in for normal code, since we have other heuristics that limit the number of
3048               structures that we would allow an inline cache to know about.
3049
3050             - We eagerly set watchpoints on all watchable structures and then we assume that
3051               watchable structures are being watched, and that the watchpoint will jettison the code.
3052               This allows tracking of watchable structures to be far simpler than before. Previously,
3053               a structure being tracked as "future possible" was predicated on it being watchable but
3054               we might not actually watch it. This makes algebra over sets of future possible
3055               structures quite weird. But watching all watchable structures means that we simple say
3056               that a structure set can be in the following states: unclobbered, which means it's just
3057               a set of structures and it doesn't matter what is watchable or what isn't because we've
3058               proven that the value must have one of these structures right now; and clobbered, which
3059               means that we have a set of structures, plus all possible structures temporarily, with
3060               invalidation removing the "plus all possible structures". Clobbering a set means that
3061               if any of its structures are unwatchable, the set just becomes TOP; but if all
3062               structures in the set are watchable then we just set the clobbered bit to add the "plus
3063               all possible structures temporarily" thing. This precisely tracks the exact meaning of
3064               watchability and invalidation points.
3065
3066             Slight SunSpider slow-down, neutral on Octane, slight AsmBench speed-up. I believe that
3067             we will ultimately undo the SunSpider slow-down by making further improvements to the set
3068             representation. I believe that Octane perfromance will ultimately improve once we remove
3069             remaining singleton special-cases. The ultimate goal of this is to remove the need to
3070             try quite so desperately hard to make everything monomorphic as we do currently.
3071
3072             * CMakeLists.txt:
3073             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3074             * JavaScriptCore.xcodeproj/project.pbxproj:
3075             * bytecode/StructureSet.cpp:
3076             (JSC::StructureSet::clear):
3077             (JSC::StructureSet::remove):
3078             (JSC::StructureSet::filter):
3079             (JSC::StructureSet::copyFromOutOfLine):
3080             (JSC::StructureSet::StructureSet): Deleted.
3081             (JSC::StructureSet::operator=): Deleted.
3082             (JSC::StructureSet::copyFrom): Deleted.
3083             * bytecode/StructureSet.h:
3084             (JSC::StructureSet::StructureSet):
3085             (JSC::StructureSet::operator=):
3086             (JSC::StructureSet::isEmpty):
3087             (JSC::StructureSet::genericFilter):
3088             (JSC::StructureSet::ContainsOutOfLine::ContainsOutOfLine):
3089             (JSC::StructureSet::ContainsOutOfLine::operator()):
3090             (JSC::StructureSet::copyFrom):
3091             (JSC::StructureSet::deleteStructureListIfNecessary):
3092             (JSC::StructureSet::setEmpty):
3093             (JSC::StructureSet::getReservedFlag):
3094             (JSC::StructureSet::setReservedFlag):
3095             * dfg/DFGAbstractInterpreter.h:
3096             (JSC::DFG::AbstractInterpreter::setBuiltInConstant):
3097             * dfg/DFGAbstractInterpreterInlines.h:
3098             (JSC::DFG::AbstractInterpreter<AbstractStateType>::booleanResult):
3099             (JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge):
3100             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3101             (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberCapturedVars):
3102             (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
3103             (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):
3104             (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
3105             (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
3106             (JSC::DFG::AbstractInterpreter<AbstractStateType>::setDidClobber):
3107             (JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
3108             * dfg/DFGAbstractValue.cpp:
3109             (JSC::DFG::AbstractValue::observeTransitions):
3110             (JSC::DFG::AbstractValue::setMostSpecific):
3111             (JSC::DFG::AbstractValue::set):
3112             (JSC::DFG::AbstractValue::filter):
3113             (JSC::DFG::AbstractValue::shouldBeClear):
3114             (JSC::DFG::AbstractValue::normalizeClarity):
3115             (JSC::DFG::AbstractValue::checkConsistency):
3116             (JSC::DFG::AbstractValue::assertIsWatched):
3117             (JSC::DFG::AbstractValue::dumpInContext):
3118             (JSC::DFG::AbstractValue::setFuturePossibleStructure): Deleted.
3119             * dfg/DFGAbstractValue.h:
3120             (JSC::DFG::AbstractValue::clear):
3121             (JSC::DFG::AbstractValue::clobberStructures):
3122             (JSC::DFG::AbstractValue::clobberStructuresFor):
3123             (JSC::DFG::AbstractValue::observeInvalidationPoint):
3124             (JSC::DFG::AbstractValue::observeInvalidationPointFor):
3125             (JSC::DFG::AbstractValue::observeTransition):
3126             (JSC::DFG::AbstractValue::TransitionObserver::TransitionObserver):
3127             (JSC::DFG::AbstractValue::TransitionObserver::operator()):
3128             (JSC::DFG::AbstractValue::TransitionsObserver::TransitionsObserver):
3129             (JSC::DFG::AbstractValue::TransitionsObserver::operator()):
3130             (JSC::DFG::AbstractValue::isHeapTop):
3131             (JSC::DFG::AbstractValue::setType):
3132             (JSC::DFG::AbstractValue::operator==):
3133             (JSC::DFG::AbstractValue::merge):
3134             (JSC::DFG::AbstractValue::validate):
3135             (JSC::DFG::AbstractValue::hasClobberableState):
3136             (JSC::DFG::AbstractValue::assertIsWatched):
3137             (JSC::DFG::AbstractValue::observeIndexingTypeTransition):
3138             (JSC::DFG::AbstractValue::makeTop):
3139             (JSC::DFG::AbstractValue::bestProvenStructure): Deleted.
3140             * dfg/DFGAllocator.h:
3141             * dfg/DFGArgumentsSimplificationPhase.cpp:
3142             (JSC::DFG::ArgumentsSimplificationPhase::run):
3143             * dfg/DFGArrayMode.cpp:
3144             (JSC::DFG::ArrayMode::alreadyChecked):
3145             * dfg/DFGAtTailAbstractState.h:
3146             (JSC::DFG::AtTailAbstractState::structureClobberState):
3147             (JSC::DFG::AtTailAbstractState::setStructureClobberState):
3148             (JSC::DFG::AtTailAbstractState::setFoundConstants):
3149             (JSC::DFG::AtTailAbstractState::haveStructures): Deleted.
3150             (JSC::DFG::AtTailAbstractState::setHaveStructures): Deleted.
3151             * dfg/DFGBasicBlock.cpp:
3152             (JSC::DFG::BasicBlock::BasicBlock):
3153             * dfg/DFGBasicBlock.h:
3154             * dfg/DFGBranchDirection.h:
3155             (JSC::DFG::branchDirectionToString):
3156             (WTF::printInternal):
3157             * dfg/DFGByteCodeParser.cpp:
3158             (JSC::DFG::ByteCodeParser::handlePutById):
3159             * dfg/DFGCFAPhase.cpp:
3160             (JSC::DFG::CFAPhase::performBlockCFA):
3161             * dfg/DFGCSEPhase.cpp:
3162             (JSC::DFG::CSEPhase::checkStructureElimination):
3163             (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
3164             (JSC::DFG::CSEPhase::performNodeCSE):
3165             * dfg/DFGClobberize.h:
3166             (JSC::DFG::clobberize):
3167             * dfg/DFGCommon.cpp:
3168             (JSC::DFG::startCrashing):
3169             (JSC::DFG::isCrashing):
3170             * dfg/DFGCommon.h:
3171             * dfg/DFGCommonData.cpp:
3172             (JSC::DFG::CommonData::notifyCompilingStructureTransition):
3173             * dfg/DFGConstantFoldingPhase.cpp:
3174             (JSC::DFG::ConstantFoldingPhase::foldConstants):
3175             (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
3176             (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
3177             (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
3178             * dfg/DFGDesiredWatchpoints.cpp:
3179             (JSC::DFG::DesiredWatchpoints::consider):
3180             (JSC::DFG::DesiredWatchpoints::addLazily): Deleted.
3181             * dfg/DFGDesiredWatchpoints.h:
3182             (JSC::DFG::GenericDesiredWatchpoints::reallyAdd):
3183             (JSC::DFG::GenericDesiredWatchpoints::areStillValid):
3184             (JSC::DFG::GenericDesiredWatchpoints::isWatched):
3185             (JSC::DFG::DesiredWatchpoints::isWatched):
3186             (JSC::DFG::WatchpointForGenericWatchpointSet::WatchpointForGenericWatchpointSet): Deleted.
3187             (JSC::DFG::GenericDesiredWatchpoints::addLazily): Deleted.
3188             (JSC::DFG::GenericDesiredWatchpoints::isStillValid): Deleted.
3189             (JSC::DFG::GenericDesiredWatchpoints::shouldAssumeMixedState): Deleted.
3190             (JSC::DFG::GenericDesiredWatchpoints::isValidOrMixed): Deleted.
3191             (JSC::DFG::DesiredWatchpoints::isStillValid): Deleted.
3192             (JSC::DFG::DesiredWatchpoints::shouldAssumeMixedState): Deleted.
3193             (JSC::DFG::DesiredWatchpoints::isValidOrMixed): Deleted.
3194             * dfg/DFGDoesGC.cpp:
3195             (JSC::DFG::doesGC):
3196             * dfg/DFGFixupPhase.cpp:
3197             (JSC::DFG::FixupPhase::fixupNode):
3198             (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
3199             (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
3200             * dfg/DFGGraph.cpp:
3201             (JSC::DFG::Graph::~Graph):
3202             (JSC::DFG::Graph::dump):
3203             (JSC::DFG::Graph::dumpBlockHeader):
3204             (JSC::DFG::Graph::tryGetFoldableView):
3205           &nb