Source/JavaScriptCore/ChangeLog

   1 2015-08-11  Alexey Proskuryakov  <ap@apple.com>
   2
   3         Make ASan build not depend on asan.xcconfig
   4         https://bugs.webkit.org/show_bug.cgi?id=147840
   5         rdar://problem/21093702
   6
   7         Reviewed by Daniel Bates.
   8
   9         * dfg/DFGOSREntry.cpp:
  10         (JSC::DFG::OSREntryData::dump):
  11         (JSC::DFG::prepareOSREntry):
  12         * ftl/FTLOSREntry.cpp:
  13         (JSC::FTL::prepareOSREntry):
  14         * heap/ConservativeRoots.cpp:
  15         (JSC::ConservativeRoots::genericAddPointer):
  16         (JSC::ConservativeRoots::genericAddSpan):
  17         * heap/MachineStackMarker.cpp:
  18         (JSC::MachineThreads::removeThreadIfFound):
  19         (JSC::MachineThreads::gatherFromCurrentThread):
  20         (JSC::MachineThreads::Thread::captureStack):
  21         (JSC::copyMemory):
  22         * interpreter/Register.h:
  23         (JSC::Register::operator=):
  24         (JSC::Register::asanUnsafeJSValue):
  25         (JSC::Register::jsValue):
  26
  27 2015-08-11  Yusuke Suzuki  <utatane.tea@gmail.com>
  28
  29         Introduce get_by_id like IC into get_by_val when the given name is String or Symbol
  30         https://bugs.webkit.org/show_bug.cgi?id=147480
  31
  32         Reviewed by Filip Pizlo.
  33
  34         This patch adds get_by_id IC to get_by_val operation by caching the string / symbol id.
  35         The IC site only caches one id. After checking that the given id is the same to the
  36         cached one, we perform the get_by_id IC onto it.
  37         And by collecting IC StructureStubInfo information, we pass it to the DFG and DFG
  38         compiles get_by_val op code into CheckIdent (with edge type check) and GetById related
  39         operations when the given get_by_val leverages the property load with the cached id.
  40
  41         To ensure the incoming value is the expected id, in DFG layer, we use SymbolUse and
  42         StringIdentUse to enforce the type. To use it, this patch implements SymbolUse.
  43         This can be leveraged to optimize symbol operations in DFG.
  44
  45         And since byValInfo is frequently used, we align the byValInfo design to the stubInfo like one.
  46         Allocated by the Bag and operations take the raw byValInfo pointer directly instead of performing
  47         binary search onto m_byValInfos. And by storing ArrayProfile* under the ByValInfo, we replaced the
  48         argument ArrayProfile* in the operations with ByValInfo*.
  49
  50         * bytecode/ByValInfo.h:
  51         (JSC::ByValInfo::ByValInfo):
  52         * bytecode/CodeBlock.cpp:
  53         (JSC::CodeBlock::getByValInfoMap):
  54         (JSC::CodeBlock::addByValInfo):
  55         * bytecode/CodeBlock.h:
  56         (JSC::CodeBlock::getByValInfo): Deleted.
  57         (JSC::CodeBlock::setNumberOfByValInfos): Deleted.
  58         (JSC::CodeBlock::numberOfByValInfos): Deleted.
  59         (JSC::CodeBlock::byValInfo): Deleted.
  60         * bytecode/ExitKind.cpp:
  61         (JSC::exitKindToString):
  62         * bytecode/ExitKind.h:
  63         * bytecode/GetByIdStatus.cpp:
  64         (JSC::GetByIdStatus::computeFor):
  65         (JSC::GetByIdStatus::computeForStubInfo):
  66         (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
  67         * bytecode/GetByIdStatus.h:
  68         * dfg/DFGAbstractInterpreterInlines.h:
  69         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
  70         * dfg/DFGByteCodeParser.cpp:
  71         (JSC::DFG::ByteCodeParser::parseBlock):
  72         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
  73         * dfg/DFGClobberize.h:
  74         (JSC::DFG::clobberize):
  75         * dfg/DFGConstantFoldingPhase.cpp:
  76         (JSC::DFG::ConstantFoldingPhase::foldConstants):
  77         * dfg/DFGDoesGC.cpp:
  78         (JSC::DFG::doesGC):
  79         * dfg/DFGFixupPhase.cpp:
  80         (JSC::DFG::FixupPhase::fixupNode):
  81         (JSC::DFG::FixupPhase::observeUseKindOnNode):
  82         * dfg/DFGNode.h:
  83         (JSC::DFG::Node::hasUidOperand):
  84         (JSC::DFG::Node::uidOperand):
  85         * dfg/DFGNodeType.h:
  86         * dfg/DFGPredictionPropagationPhase.cpp:
  87         (JSC::DFG::PredictionPropagationPhase::propagate):
  88         * dfg/DFGSafeToExecute.h:
  89         (JSC::DFG::SafeToExecuteEdge::operator()):
  90         (JSC::DFG::safeToExecute):
  91         * dfg/DFGSpeculativeJIT.cpp:
  92         (JSC::DFG::SpeculativeJIT::compileCheckIdent):
  93         (JSC::DFG::SpeculativeJIT::speculateSymbol):
  94         (JSC::DFG::SpeculativeJIT::speculate):
  95         * dfg/DFGSpeculativeJIT.h:
  96         * dfg/DFGSpeculativeJIT32_64.cpp:
  97         (JSC::DFG::SpeculativeJIT::compile):
  98         * dfg/DFGSpeculativeJIT64.cpp:
  99         (JSC::DFG::SpeculativeJIT::compile):
 100         * dfg/DFGUseKind.cpp:
 101         (WTF::printInternal):
 102         * dfg/DFGUseKind.h:
 103         (JSC::DFG::typeFilterFor):
 104         (JSC::DFG::isCell):
 105         * ftl/FTLAbstractHeapRepository.h:
 106         * ftl/FTLCapabilities.cpp:
 107         (JSC::FTL::canCompile):
 108         * ftl/FTLLowerDFGToLLVM.cpp:
 109         (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
 110         (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckIdent):
 111         (JSC::FTL::DFG::LowerDFGToLLVM::lowSymbol):
 112         (JSC::FTL::DFG::LowerDFGToLLVM::speculate):
 113         (JSC::FTL::DFG::LowerDFGToLLVM::isNotSymbol):
 114         (JSC::FTL::DFG::LowerDFGToLLVM::speculateSymbol):
 115         * jit/JIT.cpp:
 116         (JSC::JIT::privateCompile):
 117         * jit/JIT.h:
 118         (JSC::ByValCompilationInfo::ByValCompilationInfo):
 119         (JSC::JIT::compileGetByValWithCachedId):
 120         * jit/JITInlines.h:
 121         (JSC::JIT::callOperation):
 122         * jit/JITOpcodes.cpp:
 123         (JSC::JIT::emit_op_has_indexed_property):
 124         (JSC::JIT::emitSlow_op_has_indexed_property):
 125         * jit/JITOpcodes32_64.cpp:
 126         (JSC::JIT::emit_op_has_indexed_property):
 127         (JSC::JIT::emitSlow_op_has_indexed_property):
 128         * jit/JITOperations.cpp:
 129         (JSC::getByVal):
 130         * jit/JITOperations.h:
 131         * jit/JITPropertyAccess.cpp:
 132         (JSC::JIT::emit_op_get_by_val):
 133         (JSC::JIT::emitGetByValWithCachedId):
 134         (JSC::JIT::emitSlow_op_get_by_val):
 135         (JSC::JIT::emit_op_put_by_val):
 136         (JSC::JIT::emitSlow_op_put_by_val):
 137         (JSC::JIT::privateCompileGetByVal):
 138         (JSC::JIT::privateCompileGetByValWithCachedId):
 139         * jit/JITPropertyAccess32_64.cpp:
 140         (JSC::JIT::emit_op_get_by_val):
 141         (JSC::JIT::emitGetByValWithCachedId):
 142         (JSC::JIT::emitSlow_op_get_by_val):
 143         (JSC::JIT::emit_op_put_by_val):
 144         (JSC::JIT::emitSlow_op_put_by_val):
 145         * runtime/Symbol.h:
 146         * tests/stress/get-by-val-with-string-constructor.js: Added.
 147         (Hello):
 148         (get Hello.prototype.generate):
 149         (ok):
 150         * tests/stress/get-by-val-with-string-exit.js: Added.
 151         (shouldBe):
 152         (getByVal):
 153         (getStr1):
 154         (getStr2):
 155         * tests/stress/get-by-val-with-string-generated.js: Added.
 156         (shouldBe):
 157         (getByVal):
 158         (getStr1):
 159         (getStr2):
 160         * tests/stress/get-by-val-with-string-getter.js: Added.
 161         (object.get hello):
 162         (ok):
 163         * tests/stress/get-by-val-with-string.js: Added.
 164         (shouldBe):
 165         (getByVal):
 166         (getStr1):
 167         (getStr2):
 168         * tests/stress/get-by-val-with-symbol-constructor.js: Added.
 169         (Hello):
 170         (get Hello.prototype.generate):
 171         (ok):
 172         * tests/stress/get-by-val-with-symbol-exit.js: Added.
 173         (shouldBe):
 174         (getByVal):
 175         (getSym1):
 176         (getSym2):
 177         * tests/stress/get-by-val-with-symbol-getter.js: Added.
 178         (object.get hello):
 179         (.get ok):
 180         * tests/stress/get-by-val-with-symbol.js: Added.
 181         (shouldBe):
 182         (getByVal):
 183         (getSym1):
 184         (getSym2):
 185
 186 2015-08-11  Filip Pizlo  <fpizlo@apple.com>
 187
 188         DFG::ByteCodeParser shouldn't call tryGetConstantProperty() with some StructureSet if it isn't checking that the base has a structure in that StructureSet
 189         https://bugs.webkit.org/show_bug.cgi?id=147891
 190         rdar://problem/22129447
 191
 192         Reviewed by Mark Lam.
 193
 194         * dfg/DFGByteCodeParser.cpp:
 195         (JSC::DFG::ByteCodeParser::handleGetByOffset): Get rid of this.
 196         (JSC::DFG::ByteCodeParser::load): Don't call the version of handleGetByOffset() that assumes that we had CheckStructure'd some StructureSet, since we may not have CheckStructure'd anything.
 197         * dfg/DFGGraph.cpp:
 198         (JSC::DFG::Graph::assertIsRegistered): Make this always assert even before the StructureRegistrationPhase.
 199         * dfg/DFGStructureRegistrationPhase.cpp:
 200         (JSC::DFG::StructureRegistrationPhase::run): Add a FIXME that notes that we no longer believe that structures should be registered only at this phase. They should be registered before this phase and this phase should be removed.
 201
 202 2015-08-11  Brent Fulgham  <bfulgham@apple.com>
 203
 204         [Win] Switch Windows build to Visual Studio 2015
 205         https://bugs.webkit.org/show_bug.cgi?id=147887
 206         <rdar://problem/22235098>
 207
 208         Reviewed by Alex Christensen.
 209
 210         Update Visual Studio project file settings to use the current Visual
 211         Studio and compiler. Continue targeting binaries to run on our minimum
 212         supported configuration of Windows 7.
 213
 214         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 215         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
 216         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
 217         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
 218         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
 219         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
 220         * JavaScriptCore.vcxproj/jsc/jscLauncher.vcxproj:
 221         * JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.vcxproj:
 222         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
 223         * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncher.vcxproj:
 224         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
 225         * JavaScriptCore.vcxproj/testapi/testapiLauncher.vcxproj:
 226
 227 2015-08-10  Filip Pizlo  <fpizlo@apple.com>
 228
 229         WTF should have a ParkingLot for parking sleeping threads, so that locks can fit in 1.6 bits
 230         https://bugs.webkit.org/show_bug.cgi?id=147665
 231
 232         Reviewed by Mark Lam.
 233
 234         Replace ByteSpinLock with ByteLock.
 235
 236         * runtime/ConcurrentJITLock.h:
 237
 238 2015-08-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 239
 240         Numeric setter on prototype doesn't get called.
 241         https://bugs.webkit.org/show_bug.cgi?id=144252
 242
 243         Reviewed by Darin Adler.
 244
 245         When switching the blank indexing type to the other one in putByIndex,
 246         if the `structure(vm)->needsSlowPutIndexing()` is true, we need to switch
 247         it to the slow put indexing type and reloop the putByIndex since there may
 248         be some indexing accessor in the prototype chain. Previously, we just set
 249         the value into the allocated vector.
 250
 251         In the putDirectIndex case, we just store the value to the vector.
 252         This is because putDirectIndex is the operation to store the own property
 253         and it does not check the accessors in the prototype chain.
 254
 255         * runtime/JSObject.cpp:
 256         (JSC::JSObject::putByIndexBeyondVectorLength):
 257         * tests/stress/injected-numeric-setter-on-prototype.js: Added.
 258         (shouldBe):
 259         (Trace):
 260         (Trace.prototype.trace):
 261         (Trace.prototype.get count):
 262         (.):
 263         * tests/stress/numeric-setter-on-prototype-non-blank-array.js: Added.
 264         (shouldBe):
 265         (Trace):
 266         (Trace.prototype.trace):
 267         (Trace.prototype.get count):
 268         (.):
 269         * tests/stress/numeric-setter-on-prototype.js: Added.
 270         (shouldBe):
 271         (Trace):
 272         (Trace.prototype.trace):
 273         (Trace.prototype.get count):
 274         (.z.__proto__.set 3):
 275         * tests/stress/numeric-setter-on-self.js: Added.
 276         (shouldBe):
 277         (Trace):
 278         (Trace.prototype.trace):
 279         (Trace.prototype.get count):
 280         (.y.set 2):
 281
 282 2015-08-11  Brent Fulgham  <bfulgham@apple.com>
 283
 284         [Win] Unreviewed gardening.
 285
 286         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Add missing
 287         file references so they appear in the proper IDE locations.
 288
 289 2015-08-11  Brent Fulgham  <bfulgham@apple.com>
 290
 291         Unreviewed windows build fix for VS2015.
 292
 293         * bindings/ScriptValue.h: Add missing JSCJSValueInlines.h include.
 294
 295 2015-08-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 296
 297         [ES6] Implement Reflect.has
 298         https://bugs.webkit.org/show_bug.cgi?id=147875
 299
 300         Reviewed by Sam Weinig.
 301
 302         This patch implements Reflect.has[1].
 303         Since the semantics is the same to the `in` operator in the JS[2],
 304         we can implement it in builtin JS code.
 305
 306         [1]: http://www.ecma-international.org/ecma-262/6.0/#sec-reflect.has
 307         [2]: http://www.ecma-international.org/ecma-262/6.0/#sec-relational-operators-runtime-semantics-evaluation
 308
 309         * builtins/ReflectObject.js:
 310         (has):
 311         * runtime/ReflectObject.cpp:
 312         * tests/stress/reflect-has.js: Added.
 313         (shouldBe):
 314         (shouldThrow):
 315
 316 2015-08-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 317
 318         [ES6] Implement Reflect.getPrototypeOf and Reflect.setPrototypeOf
 319         https://bugs.webkit.org/show_bug.cgi?id=147874
 320
 321         Reviewed by Darin Adler.
 322
 323         This patch implements ES6 Reflect.{getPrototypeOf, setPrototypeOf}.
 324         The difference from the Object.* one is
 325
 326         1. They dont not perform ToObject onto the non-object arguments. They make it as a TypeError.
 327         2. Reflect.setPrototyeOf returns false when the operation is failed. In Object.setPrototypeOf, it raises a TypeError.
 328
 329         * runtime/ObjectConstructor.cpp:
 330         (JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
 331         (JSC::ObjectConstructorGetPrototypeOfFunctor::result):
 332         (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
 333         (JSC::objectConstructorGetPrototypeOf):
 334         * runtime/ObjectConstructor.h:
 335         * runtime/ReflectObject.cpp:
 336         (JSC::reflectObjectGetPrototypeOf):
 337         (JSC::reflectObjectSetPrototypeOf):
 338         * tests/stress/reflect-get-prototype-of.js: Added.
 339         (shouldBe):
 340         (shouldThrow):
 341         (Base):
 342         (Derived):
 343         * tests/stress/reflect-set-prototype-of.js: Added.
 344         (shouldBe):
 345         (shouldThrow):
 346
 347 2015-08-11  Ting-Wei Lan  <lantw44@gmail.com>
 348
 349         Fix debug build when optimization is enabled
 350         https://bugs.webkit.org/show_bug.cgi?id=147816
 351
 352         Reviewed by Alexey Proskuryakov.
 353
 354         * llint/LLIntEntrypoint.cpp:
 355         * runtime/FunctionExecutableDump.cpp:
 356
 357 2015-08-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 358
 359         Ensure that Reflect.enumerate does not produce the deleted keys
 360         https://bugs.webkit.org/show_bug.cgi?id=147677
 361
 362         Reviewed by Darin Adler.
 363
 364         Add tests for Reflect.enumerate that delete the property keys during the enumeration.
 365
 366         * tests/stress/reflect-enumerate.js:
 367
 368 2015-08-10  Geoffrey Garen  <ggaren@apple.com>
 369
 370         Start beating UnlinkedCodeBlock.h/.cpp with the "One Class per File" stick
 371         https://bugs.webkit.org/show_bug.cgi?id=147856
 372
 373         Reviewed by Saam Barati.
 374
 375         Split out UnlinkedFunctionExecutable.h/.cpp and ExecutableInfo.h into separate files.
 376
 377         * CMakeLists.txt:
 378         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 379         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
 380         * JavaScriptCore.xcodeproj/project.pbxproj:
 381         * bytecode/ExecutableInfo.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
 382         (JSC::ExecutableInfo::ExecutableInfo):
 383         (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
 384         (JSC::UnlinkedSimpleJumpTable::add): Deleted.
 385         (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
 386         (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
 387         (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
 388         (JSC::UnlinkedCodeBlock::usesEval): Deleted.
 389         (JSC::UnlinkedCodeBlock::needsFullScopeChain): Deleted.
 390         (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
 391         (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
 392         (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
 393         (JSC::UnlinkedCodeBlock::setActivationRegister): Deleted.
 394         (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
 395         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
 396         (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
 397         (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
 398         (JSC::UnlinkedCodeBlock::addParameter): Deleted.
 399         (JSC::UnlinkedCodeBlock::numParameters): Deleted.
 400         (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
 401         (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
 402         (JSC::UnlinkedCodeBlock::regexp): Deleted.
 403         (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
 404         (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
 405         (JSC::UnlinkedCodeBlock::identifier): Deleted.
 406         (JSC::UnlinkedCodeBlock::identifiers): Deleted.
 407         (JSC::UnlinkedCodeBlock::addConstant): Deleted.
 408         (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
 409         (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
 410         (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
 411         (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
 412         (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
 413         (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
 414         (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
 415         (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
 416         (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
 417         (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
 418         (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
 419         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
 420         (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
 421         (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
 422         (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
 423         (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
 424         (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
 425         (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
 426         (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
 427         (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
 428         (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
 429         (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
 430         (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
 431         (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
 432         (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
 433         (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
 434         (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
 435         (JSC::UnlinkedCodeBlock::vm): Deleted.
 436         (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
 437         (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
 438         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
 439         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
 440         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
 441         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
 442         (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
 443         (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
 444         (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
 445         (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
 446         (JSC::UnlinkedCodeBlock::codeType): Deleted.
 447         (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
 448         (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
 449         (JSC::UnlinkedCodeBlock::activationRegister): Deleted.
 450         (JSC::UnlinkedCodeBlock::hasActivationRegister): Deleted.
 451         (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
 452         (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
 453         (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
 454         (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
 455         (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
 456         (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
 457         (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
 458         (JSC::UnlinkedCodeBlock::recordParse): Deleted.
 459         (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
 460         (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
 461         (JSC::UnlinkedCodeBlock::firstLine): Deleted.
 462         (JSC::UnlinkedCodeBlock::lineCount): Deleted.
 463         (JSC::UnlinkedCodeBlock::startColumn): Deleted.
 464         (JSC::UnlinkedCodeBlock::endColumn): Deleted.
 465         (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
 466         (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
 467         (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
 468         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
 469         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
 470         * bytecode/UnlinkedCodeBlock.cpp:
 471         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
 472         (JSC::generateFunctionCodeBlock): Deleted.
 473         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable): Deleted.
 474         (JSC::UnlinkedFunctionExecutable::visitChildren): Deleted.
 475         (JSC::UnlinkedFunctionExecutable::link): Deleted.
 476         (JSC::UnlinkedFunctionExecutable::fromGlobalCode): Deleted.
 477         (JSC::UnlinkedFunctionExecutable::codeBlockFor): Deleted.
 478         * bytecode/UnlinkedCodeBlock.h:
 479         (JSC::ExecutableInfo::ExecutableInfo): Deleted.
 480         (JSC::ExecutableInfo::needsActivation): Deleted.
 481         (JSC::ExecutableInfo::usesEval): Deleted.
 482         (JSC::ExecutableInfo::isStrictMode): Deleted.
 483         (JSC::ExecutableInfo::isConstructor): Deleted.
 484         (JSC::ExecutableInfo::isBuiltinFunction): Deleted.
 485         (JSC::ExecutableInfo::constructorKind): Deleted.
 486         * bytecode/UnlinkedFunctionExecutable.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
 487         (JSC::generateFunctionCodeBlock):
 488         (JSC::UnlinkedFunctionExecutable::codeBlockFor):
 489         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
 490         (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
 491         (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
 492         (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
 493         (JSC::dumpLineColumnEntry): Deleted.
 494         (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
 495         (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
 496         (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
 497         (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
 498         (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
 499         (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
 500         (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
 501         (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
 502         (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
 503         (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
 504         (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
 505         (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
 506         (JSC::UnlinkedCodeBlock::instructions): Deleted.
 507         * bytecode/UnlinkedFunctionExecutable.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
 508         (JSC::ExecutableInfo::ExecutableInfo): Deleted.
 509         (JSC::ExecutableInfo::needsActivation): Deleted.
 510         (JSC::ExecutableInfo::usesEval): Deleted.
 511         (JSC::ExecutableInfo::isStrictMode): Deleted.
 512         (JSC::ExecutableInfo::isConstructor): Deleted.
 513         (JSC::ExecutableInfo::isBuiltinFunction): Deleted.
 514         (JSC::ExecutableInfo::constructorKind): Deleted.
 515         (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
 516         (JSC::UnlinkedSimpleJumpTable::add): Deleted.
 517         (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
 518         (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
 519         (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
 520         (JSC::UnlinkedCodeBlock::usesEval): Deleted.
 521         (JSC::UnlinkedCodeBlock::needsFullScopeChain): Deleted.
 522         (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
 523         (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
 524         (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
 525         (JSC::UnlinkedCodeBlock::setActivationRegister): Deleted.
 526         (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
 527         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
 528         (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
 529         (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
 530         (JSC::UnlinkedCodeBlock::addParameter): Deleted.
 531         (JSC::UnlinkedCodeBlock::numParameters): Deleted.
 532         (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
 533         (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
 534         (JSC::UnlinkedCodeBlock::regexp): Deleted.
 535         (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
 536         (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
 537         (JSC::UnlinkedCodeBlock::identifier): Deleted.
 538         (JSC::UnlinkedCodeBlock::identifiers): Deleted.
 539         (JSC::UnlinkedCodeBlock::addConstant): Deleted.
 540         (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
 541         (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
 542         (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
 543         (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
 544         (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
 545         (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
 546         (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
 547         (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
 548         (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
 549         (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
 550         (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
 551         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
 552         (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
 553         (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
 554         (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
 555         (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
 556         (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
 557         (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
 558         (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
 559         (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
 560         (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
 561         (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
 562         (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
 563         (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
 564         (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
 565         (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
 566         (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
 567         (JSC::UnlinkedCodeBlock::vm): Deleted.
 568         (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
 569         (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
 570         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
 571         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
 572         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
 573         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
 574         (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
 575         (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
 576         (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
 577         (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
 578         (JSC::UnlinkedCodeBlock::codeType): Deleted.
 579         (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
 580         (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
 581         (JSC::UnlinkedCodeBlock::activationRegister): Deleted.
 582         (JSC::UnlinkedCodeBlock::hasActivationRegister): Deleted.
 583         (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
 584         (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
 585         (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
 586         (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
 587         (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
 588         (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
 589         (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
 590         (JSC::UnlinkedCodeBlock::recordParse): Deleted.
 591         (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
 592         (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
 593         (JSC::UnlinkedCodeBlock::firstLine): Deleted.
 594         (JSC::UnlinkedCodeBlock::lineCount): Deleted.
 595         (JSC::UnlinkedCodeBlock::startColumn): Deleted.
 596         (JSC::UnlinkedCodeBlock::endColumn): Deleted.
 597         (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
 598         (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
 599         (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
 600         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
 601         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
 602         * runtime/Executable.h:
 603
 604 2015-08-10  Mark Lam  <mark.lam@apple.com>
 605
 606         Refactor LiveObjectList and LiveObjectData into their own files.
 607         https://bugs.webkit.org/show_bug.cgi?id=147843
 608
 609         Reviewed by Saam Barati.
 610
 611         There is no behavior change in this patch.
 612
 613         * CMakeLists.txt:
 614         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 615         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
 616         * JavaScriptCore.xcodeproj/project.pbxproj:
 617         * heap/HeapVerifier.cpp:
 618         (JSC::HeapVerifier::HeapVerifier):
 619         (JSC::LiveObjectList::findObject): Deleted.
 620         * heap/HeapVerifier.h:
 621         (JSC::LiveObjectData::LiveObjectData): Deleted.
 622         (JSC::LiveObjectList::LiveObjectList): Deleted.
 623         (JSC::LiveObjectList::reset): Deleted.
 624         * heap/LiveObjectData.h: Added.
 625         (JSC::LiveObjectData::LiveObjectData):
 626         * heap/LiveObjectList.cpp: Added.
 627         (JSC::LiveObjectList::findObject):
 628         * heap/LiveObjectList.h: Added.
 629         (JSC::LiveObjectList::LiveObjectList):
 630         (JSC::LiveObjectList::reset):
 631
 632 2015-08-07  Geoffrey Garen  <ggaren@apple.com>
 633
 634         Let's rename FunctionBodyNode
 635         https://bugs.webkit.org/show_bug.cgi?id=147292
 636
 637         Reviewed by Mark Lam & Saam Barati.
 638
 639         FunctionBodyNode => FunctionMetadataNode
 640
 641         Make FunctionMetadataNode inherit from Node instead of StatementNode
 642         because a FunctionMetadataNode can appear in expression context and does
 643         not have a next statement.
 644
 645         (I decided to continue allocating FunctionMetadataNode in the AST arena,
 646         and to retain "Node" in its name, because it really is a parsing
 647         construct, and we transform its data before consuming it elsewhere.
 648
 649         There is still room for a future patch to distill and simplify the
 650         metadata we track about functions between FunDeclNode/FuncExprNode,
 651         FunctionMetadataNode, and UnlinkedFunctionExecutable. But this is a start.)
 652
 653         * builtins/BuiltinExecutables.cpp:
 654         (JSC::BuiltinExecutables::createExecutableInternal):
 655         * bytecode/UnlinkedCodeBlock.cpp:
 656         (JSC::generateFunctionCodeBlock):
 657         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
 658         * bytecode/UnlinkedCodeBlock.h:
 659         * bytecompiler/BytecodeGenerator.cpp:
 660         (JSC::BytecodeGenerator::generate):
 661         (JSC::BytecodeGenerator::BytecodeGenerator):
 662         (JSC::BytecodeGenerator::emitNewArray):
 663         (JSC::BytecodeGenerator::emitNewFunction):
 664         (JSC::BytecodeGenerator::emitNewFunctionExpression):
 665         * bytecompiler/BytecodeGenerator.h:
 666         (JSC::BytecodeGenerator::makeFunction):
 667         * bytecompiler/NodesCodegen.cpp:
 668         (JSC::EvalNode::emitBytecode):
 669         (JSC::FunctionNode::emitBytecode):
 670         (JSC::FunctionBodyNode::emitBytecode): Deleted.
 671         * parser/ASTBuilder.h:
 672         (JSC::ASTBuilder::createFunctionExpr):
 673         (JSC::ASTBuilder::createFunctionBody):
 674         * parser/NodeConstructors.h:
 675         (JSC::FunctionParameters::FunctionParameters):
 676         (JSC::FuncExprNode::FuncExprNode):
 677         (JSC::FuncDeclNode::FuncDeclNode):
 678         * parser/Nodes.cpp:
 679         (JSC::EvalNode::EvalNode):
 680         (JSC::FunctionMetadataNode::FunctionMetadataNode):
 681         (JSC::FunctionMetadataNode::finishParsing):
 682         (JSC::FunctionMetadataNode::setEndPosition):
 683         (JSC::FunctionBodyNode::FunctionBodyNode): Deleted.
 684         (JSC::FunctionBodyNode::finishParsing): Deleted.
 685         (JSC::FunctionBodyNode::setEndPosition): Deleted.
 686         * parser/Nodes.h:
 687         (JSC::FuncExprNode::body):
 688         (JSC::FuncDeclNode::body):
 689         * parser/Parser.h:
 690         (JSC::Parser::isFunctionMetadataNode):
 691         (JSC::Parser::next):
 692         (JSC::Parser<LexerType>::parse):
 693         (JSC::Parser::isFunctionBodyNode): Deleted.
 694         * runtime/CodeCache.cpp:
 695         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
 696         * runtime/CodeCache.h:
 697
 698 2015-08-09  Chris Dumez  <cdumez@apple.com>
 699
 700         Regression(r188105): Seems to have caused crashes during PLT on some iPads
 701         https://bugs.webkit.org/show_bug.cgi?id=147818
 702
 703         Unreviewed, roll out r188105.
 704
 705         * bytecode/ByValInfo.h:
 706         (JSC::ByValInfo::ByValInfo):
 707         * bytecode/CodeBlock.cpp:
 708         (JSC::CodeBlock::getByValInfoMap): Deleted.
 709         (JSC::CodeBlock::addByValInfo): Deleted.
 710         * bytecode/CodeBlock.h:
 711         (JSC::CodeBlock::getByValInfo):
 712         (JSC::CodeBlock::setNumberOfByValInfos):
 713         (JSC::CodeBlock::numberOfByValInfos):
 714         (JSC::CodeBlock::byValInfo):
 715         * bytecode/ExitKind.cpp:
 716         (JSC::exitKindToString): Deleted.
 717         * bytecode/ExitKind.h:
 718         * bytecode/GetByIdStatus.cpp:
 719         (JSC::GetByIdStatus::computeFor):
 720         (JSC::GetByIdStatus::computeForStubInfo):
 721         (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback): Deleted.
 722         * bytecode/GetByIdStatus.h:
 723         * dfg/DFGAbstractInterpreterInlines.h:
 724         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.
 725         * dfg/DFGByteCodeParser.cpp:
 726         (JSC::DFG::ByteCodeParser::parseBlock):
 727         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): Deleted.
 728         * dfg/DFGClobberize.h:
 729         (JSC::DFG::clobberize): Deleted.
 730         * dfg/DFGConstantFoldingPhase.cpp:
 731         (JSC::DFG::ConstantFoldingPhase::foldConstants): Deleted.
 732         * dfg/DFGDoesGC.cpp:
 733         (JSC::DFG::doesGC): Deleted.
 734         * dfg/DFGFixupPhase.cpp:
 735         (JSC::DFG::FixupPhase::fixupNode): Deleted.
 736         (JSC::DFG::FixupPhase::observeUseKindOnNode): Deleted.
 737         * dfg/DFGNode.h:
 738         (JSC::DFG::Node::hasUidOperand): Deleted.
 739         (JSC::DFG::Node::uidOperand): Deleted.
 740         * dfg/DFGNodeType.h:
 741         * dfg/DFGPredictionPropagationPhase.cpp:
 742         (JSC::DFG::PredictionPropagationPhase::propagate): Deleted.
 743         * dfg/DFGSafeToExecute.h:
 744         (JSC::DFG::SafeToExecuteEdge::operator()): Deleted.
 745         (JSC::DFG::safeToExecute): Deleted.
 746         * dfg/DFGSpeculativeJIT.cpp:
 747         (JSC::DFG::SpeculativeJIT::compileCheckIdent): Deleted.
 748         (JSC::DFG::SpeculativeJIT::speculateSymbol): Deleted.
 749         (JSC::DFG::SpeculativeJIT::speculate): Deleted.
 750         * dfg/DFGSpeculativeJIT.h:
 751         * dfg/DFGSpeculativeJIT32_64.cpp:
 752         (JSC::DFG::SpeculativeJIT::compile): Deleted.
 753         * dfg/DFGSpeculativeJIT64.cpp:
 754         (JSC::DFG::SpeculativeJIT::compile): Deleted.
 755         * dfg/DFGUseKind.cpp:
 756         (WTF::printInternal): Deleted.
 757         * dfg/DFGUseKind.h:
 758         (JSC::DFG::typeFilterFor): Deleted.
 759         (JSC::DFG::isCell): Deleted.
 760         * ftl/FTLAbstractHeapRepository.h:
 761         * ftl/FTLCapabilities.cpp:
 762         (JSC::FTL::canCompile): Deleted.
 763         * ftl/FTLLowerDFGToLLVM.cpp:
 764         (JSC::FTL::DFG::LowerDFGToLLVM::compileNode): Deleted.
 765         (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckIdent): Deleted.
 766         (JSC::FTL::DFG::LowerDFGToLLVM::lowSymbol): Deleted.
 767         (JSC::FTL::DFG::LowerDFGToLLVM::speculate): Deleted.
 768         (JSC::FTL::DFG::LowerDFGToLLVM::isNotSymbol): Deleted.
 769         (JSC::FTL::DFG::LowerDFGToLLVM::speculateSymbol): Deleted.
 770         * jit/JIT.cpp:
 771         (JSC::JIT::privateCompile):
 772         * jit/JIT.h:
 773         (JSC::ByValCompilationInfo::ByValCompilationInfo):
 774         (JSC::JIT::compileGetByValWithCachedId): Deleted.
 775         * jit/JITInlines.h:
 776         (JSC::JIT::callOperation): Deleted.
 777         * jit/JITOpcodes.cpp:
 778         (JSC::JIT::emit_op_has_indexed_property):
 779         (JSC::JIT::emitSlow_op_has_indexed_property):
 780         * jit/JITOpcodes32_64.cpp:
 781         (JSC::JIT::emit_op_has_indexed_property):
 782         (JSC::JIT::emitSlow_op_has_indexed_property):
 783         * jit/JITOperations.cpp:
 784         (JSC::getByVal):
 785         * jit/JITOperations.h:
 786         * jit/JITPropertyAccess.cpp:
 787         (JSC::JIT::emit_op_get_by_val):
 788         (JSC::JIT::emitSlow_op_get_by_val):
 789         (JSC::JIT::emit_op_put_by_val):
 790         (JSC::JIT::emitSlow_op_put_by_val):
 791         (JSC::JIT::emitGetByValWithCachedId): Deleted.
 792         (JSC::JIT::privateCompileGetByVal): Deleted.
 793         (JSC::JIT::privateCompileGetByValWithCachedId): Deleted.
 794         * jit/JITPropertyAccess32_64.cpp:
 795         (JSC::JIT::emit_op_get_by_val):
 796         (JSC::JIT::emitSlow_op_get_by_val):
 797         (JSC::JIT::emit_op_put_by_val):
 798         (JSC::JIT::emitSlow_op_put_by_val):
 799         (JSC::JIT::emitGetByValWithCachedId): Deleted.
 800         * runtime/Symbol.h:
 801         * tests/stress/get-by-val-with-string-constructor.js: Removed.
 802         * tests/stress/get-by-val-with-string-exit.js: Removed.
 803         * tests/stress/get-by-val-with-string-generated.js: Removed.
 804         * tests/stress/get-by-val-with-string-getter.js: Removed.
 805         * tests/stress/get-by-val-with-string.js: Removed.
 806         * tests/stress/get-by-val-with-symbol-constructor.js: Removed.
 807         * tests/stress/get-by-val-with-symbol-exit.js: Removed.
 808         * tests/stress/get-by-val-with-symbol-getter.js: Removed.
 809         * tests/stress/get-by-val-with-symbol.js: Removed.
 810
 811 2015-08-07  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
 812
 813         Reduce uses of PassRefPtr in bindings
 814         https://bugs.webkit.org/show_bug.cgi?id=147781
 815
 816         Reviewed by Chris Dumez.
 817
 818         Use RefPtr when function can return null or an instance. If not, Ref is used.
 819
 820         * runtime/JSGenericTypedArrayView.h:
 821         (JSC::toNativeTypedView):
 822
 823 2015-08-07  Alex Christensen  <achristensen@webkit.org>
 824
 825         Build more testing binaries with CMake on Windows
 826         https://bugs.webkit.org/show_bug.cgi?id=147799
 827
 828         Reviewed by Brent Fulgham.
 829
 830         * shell/PlatformWin.cmake: Added.
 831         Build jsc.dll and jsc.exe to find Apple Application Support or WinCairo dlls before using them.
 832
 833 2015-08-07  Filip Pizlo  <fpizlo@apple.com>
 834
 835         Lightweight locks should be adaptive
 836         https://bugs.webkit.org/show_bug.cgi?id=147545
 837
 838         Reviewed by Geoffrey Garen.
 839
 840         * dfg/DFGCommon.cpp:
 841         (JSC::DFG::startCrashing):
 842         * heap/CopiedBlock.h:
 843         (JSC::CopiedBlock::workListLock):
 844         * heap/CopiedBlockInlines.h:
 845         (JSC::CopiedBlock::shouldReportLiveBytes):
 846         (JSC::CopiedBlock::reportLiveBytes):
 847         * heap/CopiedSpace.cpp:
 848         (JSC::CopiedSpace::doneFillingBlock):
 849         * heap/CopiedSpace.h:
 850         (JSC::CopiedSpace::CopiedGeneration::CopiedGeneration):
 851         * heap/CopiedSpaceInlines.h:
 852         (JSC::CopiedSpace::recycleEvacuatedBlock):
 853         * heap/GCThreadSharedData.cpp:
 854         (JSC::GCThreadSharedData::didStartCopying):
 855         * heap/GCThreadSharedData.h:
 856         (JSC::GCThreadSharedData::getNextBlocksToCopy):
 857         * heap/ListableHandler.h:
 858         (JSC::ListableHandler::List::addThreadSafe):
 859         (JSC::ListableHandler::List::addNotThreadSafe):
 860         * heap/MachineStackMarker.cpp:
 861         (JSC::MachineThreads::tryCopyOtherThreadStacks):
 862         * heap/SlotVisitorInlines.h:
 863         (JSC::SlotVisitor::copyLater):
 864         * parser/SourceProvider.cpp:
 865         (JSC::SourceProvider::~SourceProvider):
 866         (JSC::SourceProvider::getID):
 867         * profiler/ProfilerDatabase.cpp:
 868         (JSC::Profiler::Database::addDatabaseToAtExit):
 869         (JSC::Profiler::Database::removeDatabaseFromAtExit):
 870         (JSC::Profiler::Database::removeFirstAtExitDatabase):
 871         * runtime/TypeProfilerLog.h:
 872
 873 2015-08-07  Mark Lam  <mark.lam@apple.com>
 874
 875         Rename some variables in the JSC watchdog implementation.
 876         https://bugs.webkit.org/show_bug.cgi?id=147790
 877
 878         Rubber stamped by Benjamin Poulain.
 879
 880         This is just a refactoring patch to give the variable better names that describe their
 881         intended use.  There is no behavior change.
 882
 883         * runtime/Watchdog.cpp:
 884         (JSC::Watchdog::Watchdog):
 885         (JSC::Watchdog::setTimeLimit):
 886         (JSC::Watchdog::didFire):
 887         (JSC::Watchdog::isEnabled):
 888         (JSC::Watchdog::fire):
 889         (JSC::Watchdog::startCountdownIfNeeded):
 890         * runtime/Watchdog.h:
 891
 892 2015-08-07  Saam barati  <saambarati1@gmail.com>
 893
 894         Interpreter::unwind shouldn't be responsible for assigning the correct scope.
 895         https://bugs.webkit.org/show_bug.cgi?id=147666
 896
 897         Reviewed by Geoffrey Garen.
 898
 899         If we make the bytecode generator know about every local scope it
 900         creates, and if we give each local scope a unique register, the
 901         bytecode generator has all the information it needs to assign
 902         the correct scope to a catch handler. Because the bytecode generator
 903         knows this information, it's a better separation of responsibilties
 904         for it to set up the proper scope instead of relying on the exception
 905         handling runtime to find the scope.
 906
 907         * bytecode/BytecodeList.json:
 908         * bytecode/BytecodeUseDef.h:
 909         (JSC::computeUsesForBytecodeOffset):
 910         * bytecode/CodeBlock.cpp:
 911         (JSC::CodeBlock::dumpBytecode):
 912         (JSC::CodeBlock::CodeBlock):
 913         * bytecode/HandlerInfo.h:
 914         (JSC::UnlinkedHandlerInfo::UnlinkedHandlerInfo):
 915         (JSC::HandlerInfo::initialize):
 916         * bytecompiler/BytecodeGenerator.cpp:
 917         (JSC::BytecodeGenerator::generate):
 918         (JSC::BytecodeGenerator::pushLexicalScopeInternal):
 919         (JSC::BytecodeGenerator::emitGetScope):
 920         (JSC::BytecodeGenerator::emitPushWithScope):
 921         (JSC::BytecodeGenerator::emitGetParentScope):
 922         (JSC::BytecodeGenerator::emitPopScope):
 923         (JSC::BytecodeGenerator::emitPopWithScope):
 924         (JSC::BytecodeGenerator::allocateAndEmitScope):
 925         (JSC::BytecodeGenerator::emitComplexPopScopes):
 926         (JSC::BytecodeGenerator::pushTry):
 927         (JSC::BytecodeGenerator::popTryAndEmitCatch):
 928         (JSC::BytecodeGenerator::localScopeDepth):
 929         (JSC::BytecodeGenerator::calculateTargetScopeDepthForExceptionHandler): Deleted.
 930         * bytecompiler/BytecodeGenerator.h:
 931         * bytecompiler/NodesCodegen.cpp:
 932         (JSC::WithNode::emitBytecode):
 933         * interpreter/Interpreter.cpp:
 934         (JSC::Interpreter::unwind):
 935         * jit/JITOpcodes.cpp:
 936         (JSC::JIT::emit_op_push_with_scope):
 937         (JSC::JIT::compileOpStrictEq):
 938         * jit/JITOpcodes32_64.cpp:
 939         (JSC::JIT::emit_op_push_with_scope):
 940         (JSC::JIT::emit_op_to_number):
 941         * jit/JITOperations.cpp:
 942         * jit/JITOperations.h:
 943         * llint/LLIntSlowPaths.cpp:
 944         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 945         * llint/LLIntSlowPaths.h:
 946         * llint/LowLevelInterpreter.asm:
 947         * runtime/CommonSlowPaths.cpp:
 948         (JSC::SLOW_PATH_DECL):
 949         * runtime/CommonSlowPaths.h:
 950         * runtime/JSScope.cpp:
 951         (JSC::JSScope::objectAtScope):
 952         (JSC::isUnscopable):
 953         (JSC::JSScope::depth): Deleted.
 954         * runtime/JSScope.h:
 955
 956 2015-08-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 957
 958         Add MacroAssembler::patchableBranch64 and fix ARM64's patchableBranchPtr
 959         https://bugs.webkit.org/show_bug.cgi?id=147761
 960
 961         Reviewed by Mark Lam.
 962
 963         This patch implements MacroAssembler::patchableBranch64 in 64bit environments.
 964         And fix the existing MacroAssemblerARM64::patchableBranchPtr, before this patch,
 965         it truncates the immediate pointer into the 32bit immediate.
 966         And use patchableBranch64 in the baseline JIT under the JSVALUE64 configuration.
 967
 968         * assembler/MacroAssemblerARM64.h:
 969         (JSC::MacroAssemblerARM64::patchableBranchPtr):
 970         (JSC::MacroAssemblerARM64::patchableBranch64):
 971         * assembler/MacroAssemblerX86_64.h:
 972         (JSC::MacroAssemblerX86_64::patchableBranch64):
 973         * jit/JIT.h:
 974         * jit/JITInlines.h:
 975         (JSC::JIT::emitPatchableJumpIfNotImmediateInteger):
 976         * jit/JITPropertyAccess.cpp:
 977         (JSC::JIT::emit_op_get_by_val):
 978
 979 2015-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
 980
 981         Introduce get_by_id like IC into get_by_val when the given name is String or Symbol
 982         https://bugs.webkit.org/show_bug.cgi?id=147480
 983
 984         Reviewed by Filip Pizlo.
 985
 986         This patch adds get_by_id IC to get_by_val operation by caching the string / symbol id.
 987         The IC site only caches one id. After checking that the given id is the same to the
 988         cached one, we perform the get_by_id IC onto it.
 989         And by collecting IC StructureStubInfo information, we pass it to the DFG and DFG
 990         compiles get_by_val op code into CheckIdent (with edge type check) and GetById related
 991         operations when the given get_by_val leverages the property load with the cached id.
 992
 993         To ensure the incoming value is the expected id, in DFG layer, we use SymbolUse and
 994         StringIdentUse to enforce the type. To use it, this patch implements SymbolUse.
 995         This can be leveraged to optimize symbol operations in DFG.
 996
 997         And since byValInfo is frequently used, we align the byValInfo design to the stubInfo like one.
 998         Allocated by the Bag and operations take the raw byValInfo pointer directly instead of performing
 999         binary search onto m_byValInfos. And by storing ArrayProfile* under the ByValInfo, we replaced the
1000         argument ArrayProfile* in the operations with ByValInfo*.
1001
1002         * bytecode/ByValInfo.h:
1003         (JSC::ByValInfo::ByValInfo):
1004         * bytecode/CodeBlock.cpp:
1005         (JSC::CodeBlock::getByValInfoMap):
1006         (JSC::CodeBlock::addByValInfo):
1007         * bytecode/CodeBlock.h:
1008         (JSC::CodeBlock::getByValInfo): Deleted.
1009         (JSC::CodeBlock::setNumberOfByValInfos): Deleted.
1010         (JSC::CodeBlock::numberOfByValInfos): Deleted.
1011         (JSC::CodeBlock::byValInfo): Deleted.
1012         * bytecode/ExitKind.cpp:
1013         (JSC::exitKindToString):
1014         * bytecode/ExitKind.h:
1015         * bytecode/GetByIdStatus.cpp:
1016         (JSC::GetByIdStatus::computeFor):
1017         (JSC::GetByIdStatus::computeForStubInfo):
1018         (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
1019         * bytecode/GetByIdStatus.h:
1020         * dfg/DFGAbstractInterpreterInlines.h:
1021         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1022         * dfg/DFGByteCodeParser.cpp:
1023         (JSC::DFG::ByteCodeParser::parseBlock):
1024         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
1025         * dfg/DFGClobberize.h:
1026         (JSC::DFG::clobberize):
1027         * dfg/DFGConstantFoldingPhase.cpp:
1028         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1029         * dfg/DFGDoesGC.cpp:
1030         (JSC::DFG::doesGC):
1031         * dfg/DFGFixupPhase.cpp:
1032         (JSC::DFG::FixupPhase::fixupNode):
1033         (JSC::DFG::FixupPhase::observeUseKindOnNode):
1034         * dfg/DFGNode.h:
1035         (JSC::DFG::Node::hasUidOperand):
1036         (JSC::DFG::Node::uidOperand):
1037         * dfg/DFGNodeType.h:
1038         * dfg/DFGPredictionPropagationPhase.cpp:
1039         (JSC::DFG::PredictionPropagationPhase::propagate):
1040         * dfg/DFGSafeToExecute.h:
1041         (JSC::DFG::SafeToExecuteEdge::operator()):
1042         (JSC::DFG::safeToExecute):
1043         * dfg/DFGSpeculativeJIT.cpp:
1044         (JSC::DFG::SpeculativeJIT::compileCheckIdent):
1045         (JSC::DFG::SpeculativeJIT::speculateSymbol):
1046         (JSC::DFG::SpeculativeJIT::speculate):
1047         * dfg/DFGSpeculativeJIT.h:
1048         * dfg/DFGSpeculativeJIT32_64.cpp:
1049         (JSC::DFG::SpeculativeJIT::compile):
1050         * dfg/DFGSpeculativeJIT64.cpp:
1051         (JSC::DFG::SpeculativeJIT::compile):
1052         * dfg/DFGUseKind.cpp:
1053         (WTF::printInternal):
1054         * dfg/DFGUseKind.h:
1055         (JSC::DFG::typeFilterFor):
1056         (JSC::DFG::isCell):
1057         * ftl/FTLAbstractHeapRepository.h:
1058         * ftl/FTLCapabilities.cpp:
1059         (JSC::FTL::canCompile):
1060         * ftl/FTLLowerDFGToLLVM.cpp:
1061         (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
1062         (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckIdent):
1063         (JSC::FTL::DFG::LowerDFGToLLVM::lowSymbol):
1064         (JSC::FTL::DFG::LowerDFGToLLVM::speculate):
1065         (JSC::FTL::DFG::LowerDFGToLLVM::isNotSymbol):
1066         (JSC::FTL::DFG::LowerDFGToLLVM::speculateSymbol):
1067         * jit/JIT.cpp:
1068         (JSC::JIT::privateCompile):
1069         * jit/JIT.h:
1070         (JSC::ByValCompilationInfo::ByValCompilationInfo):
1071         (JSC::JIT::compileGetByValWithCachedId):
1072         * jit/JITInlines.h:
1073         (JSC::JIT::callOperation):
1074         * jit/JITOpcodes.cpp:
1075         (JSC::JIT::emit_op_has_indexed_property):
1076         (JSC::JIT::emitSlow_op_has_indexed_property):
1077         * jit/JITOpcodes32_64.cpp:
1078         (JSC::JIT::emit_op_has_indexed_property):
1079         (JSC::JIT::emitSlow_op_has_indexed_property):
1080         * jit/JITOperations.cpp:
1081         (JSC::getByVal):
1082         * jit/JITOperations.h:
1083         * jit/JITPropertyAccess.cpp:
1084         (JSC::JIT::emit_op_get_by_val):
1085         (JSC::JIT::emitGetByValWithCachedId):
1086         (JSC::JIT::emitSlow_op_get_by_val):
1087         (JSC::JIT::emit_op_put_by_val):
1088         (JSC::JIT::emitSlow_op_put_by_val):
1089         (JSC::JIT::privateCompileGetByVal):
1090         (JSC::JIT::privateCompileGetByValWithCachedId):
1091         * jit/JITPropertyAccess32_64.cpp:
1092         (JSC::JIT::emit_op_get_by_val):
1093         (JSC::JIT::emitGetByValWithCachedId):
1094         (JSC::JIT::emitSlow_op_get_by_val):
1095         (JSC::JIT::emit_op_put_by_val):
1096         (JSC::JIT::emitSlow_op_put_by_val):
1097         * runtime/Symbol.h:
1098         * tests/stress/get-by-val-with-string-constructor.js: Added.
1099         (Hello):
1100         (get Hello.prototype.generate):
1101         (ok):
1102         * tests/stress/get-by-val-with-string-exit.js: Added.
1103         (shouldBe):
1104         (getByVal):
1105         (getStr1):
1106         (getStr2):
1107         * tests/stress/get-by-val-with-string-generated.js: Added.
1108         (shouldBe):
1109         (getByVal):
1110         (getStr1):
1111         (getStr2):
1112         * tests/stress/get-by-val-with-string-getter.js: Added.
1113         (object.get hello):
1114         (ok):
1115         * tests/stress/get-by-val-with-string.js: Added.
1116         (shouldBe):
1117         (getByVal):
1118         (getStr1):
1119         (getStr2):
1120         * tests/stress/get-by-val-with-symbol-constructor.js: Added.
1121         (Hello):
1122         (get Hello.prototype.generate):
1123         (ok):
1124         * tests/stress/get-by-val-with-symbol-exit.js: Added.
1125         (shouldBe):
1126         (getByVal):
1127         (getSym1):
1128         (getSym2):
1129         * tests/stress/get-by-val-with-symbol-getter.js: Added.
1130         (object.get hello):
1131         (.get ok):
1132         * tests/stress/get-by-val-with-symbol.js: Added.
1133         (shouldBe):
1134         (getByVal):
1135         (getSym1):
1136         (getSym2):
1137
1138 2015-08-06  Sukolsak Sakshuwong  <sukolsak@gmail.com>
1139
1140         Parse the entire WebAssembly modules
1141         https://bugs.webkit.org/show_bug.cgi?id=147393
1142
1143         Reviewed by Geoffrey Garen.
1144
1145         Parse the entire WebAssembly modules from files produced by pack-asmjs
1146         <https://github.com/WebAssembly/polyfill-prototype-1>. This patch can only
1147         parse modules whose function definition section contains only functions that
1148         have "return 0;" as their only statement. Parsing of any functions will be
1149         implemented in a subsequent patch.
1150
1151         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1152         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1153         * JavaScriptCore.xcodeproj/project.pbxproj:
1154         * wasm/JSWASMModule.cpp:
1155         (JSC::JSWASMModule::destroy):
1156         * wasm/JSWASMModule.h:
1157         (JSC::JSWASMModule::i32Constants):
1158         (JSC::JSWASMModule::f32Constants):
1159         (JSC::JSWASMModule::f64Constants):
1160         (JSC::JSWASMModule::signatures):
1161         (JSC::JSWASMModule::functionImports):
1162         (JSC::JSWASMModule::functionImportSignatures):
1163         (JSC::JSWASMModule::globalVariableTypes):
1164         (JSC::JSWASMModule::functionDeclarations):
1165         (JSC::JSWASMModule::functionPointerTables):
1166         * wasm/WASMFormat.h: Added.
1167         * wasm/WASMModuleParser.cpp:
1168         (JSC::WASMModuleParser::parse):
1169         (JSC::WASMModuleParser::parseModule):
1170         (JSC::WASMModuleParser::parseConstantPoolSection):
1171         (JSC::WASMModuleParser::parseSignatureSection):
1172         (JSC::WASMModuleParser::parseFunctionImportSection):
1173         (JSC::WASMModuleParser::parseGlobalSection):
1174         (JSC::WASMModuleParser::parseFunctionDeclarationSection):
1175         (JSC::WASMModuleParser::parseFunctionPointerTableSection):
1176         (JSC::WASMModuleParser::parseFunctionDefinitionSection):
1177         (JSC::WASMModuleParser::parseFunctionDefinition):
1178         (JSC::WASMModuleParser::parseExportSection):
1179         * wasm/WASMModuleParser.h:
1180         * wasm/WASMReader.cpp:
1181         (JSC::WASMReader::readUInt32):
1182         (JSC::WASMReader::readCompactUInt32):
1183         (JSC::WASMReader::readString):
1184         (JSC::WASMReader::readType):
1185         (JSC::WASMReader::readExpressionType):
1186         (JSC::WASMReader::readExportFormat):
1187         (JSC::WASMReader::readByte):
1188         (JSC::WASMReader::readUnsignedInt32): Deleted.
1189         * wasm/WASMReader.h:
1190
1191 2015-08-06  Keith Miller  <keith_miller@apple.com>
1192
1193         The typedArrayLength function in FTLLowerDFGToLLVM is dead code.
1194         https://bugs.webkit.org/show_bug.cgi?id=147749
1195
1196         Reviewed by Filip Pizlo.
1197
1198         Removed dead code elimination. the TypedArray length is compiled in compileGetArrayLength()
1199         thus no one calls this code.
1200
1201         * ftl/FTLLowerDFGToLLVM.cpp:
1202         (JSC::FTL::DFG::LowerDFGToLLVM::typedArrayLength): Deleted.
1203
1204 2015-08-06  Keith Miller  <keith_miller@apple.com>
1205
1206         The JSONP parser incorrectly parsers -0 as +0.
1207         https://bugs.webkit.org/show_bug.cgi?id=147590
1208
1209         Reviewed by Michael Saboff.
1210
1211         In the LiteralParser we should use a double to store the accumulator for numerical tokens
1212         rather than an int. Using an int means that -0 is, incorrectly, parsed as +0.
1213
1214         * runtime/LiteralParser.cpp:
1215         (JSC::LiteralParser<CharType>::Lexer::lexNumber):
1216
1217 2015-08-06  Filip Pizlo  <fpizlo@apple.com>
1218
1219         Structures used for tryGetConstantProperty() should be registered first
1220         https://bugs.webkit.org/show_bug.cgi?id=147750
1221
1222         Reviewed by Saam Barati and Michael Saboff.
1223
1224         * dfg/DFGGraph.cpp:
1225         (JSC::DFG::Graph::tryGetConstantProperty): Add an assertion to that effect. This should catch the bug sooner.
1226         * dfg/DFGGraph.h:
1227         (JSC::DFG::Graph::addStructureSet): Register structures when we make a structure set. That ensures that we won't call tryGetConstantProperty() on a structure that hasn't been registered yet.
1228         * dfg/DFGStructureRegistrationPhase.cpp:
1229         (JSC::DFG::StructureRegistrationPhase::run): Don't register structure sets here anymore. Registering them before we get here means there is no chance of the code being DCE'd before the structures get registered. It also enables the tryGetConstantProperty() assertion, since that code runs before StructureRegisterationPhase.
1230         (JSC::DFG::StructureRegistrationPhase::registerStructures):
1231         (JSC::DFG::StructureRegistrationPhase::registerStructure):
1232         (JSC::DFG::StructureRegistrationPhase::assertAreRegistered):
1233         (JSC::DFG::StructureRegistrationPhase::assertIsRegistered):
1234         (JSC::DFG::performStructureRegistration):
1235
1236 2015-08-06  Keith Miller  <keith_miller@apple.com>
1237
1238         Remove UnspecifiedBoolType from JSC
1239         https://bugs.webkit.org/show_bug.cgi?id=147597
1240
1241         Reviewed by Mark Lam.
1242
1243         We were using the safe bool pattern in the code base for implicit casting to booleans.
1244         With C++11 this is no longer necessary and we can instead create an operator bool.
1245
1246         * API/JSRetainPtr.h:
1247         (JSRetainPtr::operator bool):
1248         (JSRetainPtr::operator UnspecifiedBoolType): Deleted.
1249         * dfg/DFGEdge.h:
1250         (JSC::DFG::Edge::operator bool):
1251         (JSC::DFG::Edge::operator UnspecifiedBoolType*): Deleted.
1252         * dfg/DFGIntegerRangeOptimizationPhase.cpp:
1253         * heap/Weak.h:
1254         * heap/WeakInlines.h:
1255         (JSC::bool):
1256         (JSC::UnspecifiedBoolType): Deleted.
1257
1258 2015-08-05  Ryosuke Niwa  <rniwa@webkit.org>
1259
1260         [ES6] Class parser does not allow methods named set and get.
1261         https://bugs.webkit.org/show_bug.cgi?id=147150
1262
1263         Reviewed by Oliver Hunt.
1264
1265         The bug was caused by parseClass assuming identifiers "get" and "set" could only appear
1266         as the leading token for getter and setter methods. Fixed the bug by generalizing the code
1267         so that we only treat them as such when it's followed by another token that could be a method name.
1268
1269         * parser/Parser.cpp:
1270         (JSC::Parser<LexerType>::parseClass):
1271
1272 2015-08-05  Filip Pizlo  <fpizlo@apple.com>
1273
1274         Unreviewed, roll out http://trac.webkit.org/changeset/187972.
1275
1276         * bytecode/SamplingTool.cpp:
1277         (JSC::SamplingTool::doRun):
1278         (JSC::SamplingTool::notifyOfScope):
1279         * bytecode/SamplingTool.h:
1280         * dfg/DFGThreadData.h:
1281         * dfg/DFGWorklist.cpp:
1282         (JSC::DFG::Worklist::~Worklist):
1283         (JSC::DFG::Worklist::isActiveForVM):
1284         (JSC::DFG::Worklist::enqueue):
1285         (JSC::DFG::Worklist::compilationState):
1286         (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
1287         (JSC::DFG::Worklist::removeAllReadyPlansForVM):
1288         (JSC::DFG::Worklist::completeAllReadyPlansForVM):
1289         (JSC::DFG::Worklist::visitWeakReferences):
1290         (JSC::DFG::Worklist::removeDeadPlans):
1291         (JSC::DFG::Worklist::queueLength):
1292         (JSC::DFG::Worklist::dump):
1293         (JSC::DFG::Worklist::runThread):
1294         * dfg/DFGWorklist.h:
1295         * disassembler/Disassembler.cpp:
1296         * heap/CopiedSpace.cpp:
1297         (JSC::CopiedSpace::doneFillingBlock):
1298         (JSC::CopiedSpace::doneCopying):
1299         * heap/CopiedSpace.h:
1300         * heap/CopiedSpaceInlines.h:
1301         (JSC::CopiedSpace::recycleBorrowedBlock):
1302         (JSC::CopiedSpace::allocateBlockForCopyingPhase):
1303         * heap/HeapTimer.h:
1304         * heap/MachineStackMarker.cpp:
1305         (JSC::ActiveMachineThreadsManager::Locker::Locker):
1306         (JSC::ActiveMachineThreadsManager::add):
1307         (JSC::ActiveMachineThreadsManager::remove):
1308         (JSC::ActiveMachineThreadsManager::ActiveMachineThreadsManager):
1309         (JSC::MachineThreads::~MachineThreads):
1310         (JSC::MachineThreads::addCurrentThread):
1311         (JSC::MachineThreads::removeThreadIfFound):
1312         (JSC::MachineThreads::tryCopyOtherThreadStack):
1313         (JSC::MachineThreads::tryCopyOtherThreadStacks):
1314         (JSC::MachineThreads::gatherConservativeRoots):
1315         * heap/MachineStackMarker.h:
1316         * interpreter/JSStack.cpp:
1317         (JSC::stackStatisticsMutex):
1318         (JSC::JSStack::addToCommittedByteCount):
1319         (JSC::JSStack::committedByteCount):
1320         * jit/JITThunks.h:
1321         * profiler/ProfilerDatabase.h:
1322
1323 2015-08-05  Saam barati  <saambarati1@gmail.com>
1324
1325         Bytecodegenerator emits crappy code for returns in a lexical scope.
1326         https://bugs.webkit.org/show_bug.cgi?id=147688
1327
1328         Reviewed by Mark Lam.
1329
1330         When returning, we only need to emit complex pop scopes if we're in
1331         a finally block. Otherwise, we can just return like normal. This saves
1332         us from inefficiently emitting unnecessary pop scopes.
1333
1334         * bytecompiler/BytecodeGenerator.h:
1335         (JSC::BytecodeGenerator::isInFinallyBlock):
1336         (JSC::BytecodeGenerator::hasFinaliser): Deleted.
1337         * bytecompiler/NodesCodegen.cpp:
1338         (JSC::ReturnNode::emitBytecode):
1339
1340 2015-08-05  Benjamin Poulain  <benjamin@webkit.org>
1341
1342         Add the Intl API to the status page
1343
1344         * features.json:
1345         Andy VanWagoner landed the skeleton of the API and it is
1346         enabled by default.
1347
1348 2015-08-04  Filip Pizlo  <fpizlo@apple.com>
1349
1350         Rename Mutex to DeprecatedMutex
1351         https://bugs.webkit.org/show_bug.cgi?id=147675
1352
1353         Reviewed by Geoffrey Garen.
1354
1355         * bytecode/SamplingTool.cpp:
1356         (JSC::SamplingTool::doRun):
1357         (JSC::SamplingTool::notifyOfScope):
1358         * bytecode/SamplingTool.h:
1359         * dfg/DFGThreadData.h:
1360         * dfg/DFGWorklist.cpp:
1361         (JSC::DFG::Worklist::~Worklist):
1362         (JSC::DFG::Worklist::isActiveForVM):
1363         (JSC::DFG::Worklist::enqueue):
1364         (JSC::DFG::Worklist::compilationState):
1365         (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
1366         (JSC::DFG::Worklist::removeAllReadyPlansForVM):
1367         (JSC::DFG::Worklist::completeAllReadyPlansForVM):
1368         (JSC::DFG::Worklist::visitWeakReferences):
1369         (JSC::DFG::Worklist::removeDeadPlans):
1370         (JSC::DFG::Worklist::queueLength):
1371         (JSC::DFG::Worklist::dump):
1372         (JSC::DFG::Worklist::runThread):
1373         * dfg/DFGWorklist.h:
1374         * disassembler/Disassembler.cpp:
1375         * heap/CopiedSpace.cpp:
1376         (JSC::CopiedSpace::doneFillingBlock):
1377         (JSC::CopiedSpace::doneCopying):
1378         * heap/CopiedSpace.h:
1379         * heap/CopiedSpaceInlines.h:
1380         (JSC::CopiedSpace::recycleBorrowedBlock):
1381         (JSC::CopiedSpace::allocateBlockForCopyingPhase):
1382         * heap/HeapTimer.h:
1383         * heap/MachineStackMarker.cpp:
1384         (JSC::ActiveMachineThreadsManager::Locker::Locker):
1385         (JSC::ActiveMachineThreadsManager::add):
1386         (JSC::ActiveMachineThreadsManager::remove):
1387         (JSC::ActiveMachineThreadsManager::ActiveMachineThreadsManager):
1388         (JSC::MachineThreads::~MachineThreads):
1389         (JSC::MachineThreads::addCurrentThread):
1390         (JSC::MachineThreads::removeThreadIfFound):
1391         (JSC::MachineThreads::tryCopyOtherThreadStack):
1392         (JSC::MachineThreads::tryCopyOtherThreadStacks):
1393         (JSC::MachineThreads::gatherConservativeRoots):
1394         * heap/MachineStackMarker.h:
1395         * interpreter/JSStack.cpp:
1396         (JSC::stackStatisticsMutex):
1397         (JSC::JSStack::addToCommittedByteCount):
1398         (JSC::JSStack::committedByteCount):
1399         * jit/JITThunks.h:
1400         * profiler/ProfilerDatabase.h:
1401
1402 2015-08-05  Saam barati  <saambarati1@gmail.com>
1403
1404         Replace JSFunctionNameScope with JSLexicalEnvironment for the function name scope.
1405         https://bugs.webkit.org/show_bug.cgi?id=147657
1406
1407         Reviewed by Mark Lam.
1408
1409         This kills the last of the name scope objects. Function name scopes are
1410         now built on top of the scoping mechanisms introduced with ES6 block scoping.
1411         A name scope is now just a JSLexicalEnvironment.  We treat assignments to the
1412         function name scoped variable carefully depending on if the function is in
1413         strict mode. If we're in strict mode, then we treat the variable exactly
1414         like a "const" variable. If we're not in strict mode, we can't treat
1415         this variable like like ES6 "const" because that would cause the bytecode
1416         generator to throw an exception when it shouldn't.
1417
1418         * CMakeLists.txt:
1419         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1420         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1421         * JavaScriptCore.xcodeproj/project.pbxproj:
1422         * bytecode/BytecodeList.json:
1423         * bytecode/BytecodeUseDef.h:
1424         (JSC::computeUsesForBytecodeOffset):
1425         (JSC::computeDefsForBytecodeOffset):
1426         * bytecode/CodeBlock.cpp:
1427         (JSC::CodeBlock::dumpBytecode):
1428         * bytecompiler/BytecodeGenerator.cpp:
1429         (JSC::BytecodeGenerator::BytecodeGenerator):
1430         (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
1431         (JSC::BytecodeGenerator::pushLexicalScope):
1432         (JSC::BytecodeGenerator::pushLexicalScopeInternal):
1433         (JSC::BytecodeGenerator::variable):
1434         (JSC::BytecodeGenerator::resolveType):
1435         (JSC::BytecodeGenerator::emitThrowTypeError):
1436         (JSC::BytecodeGenerator::emitPushFunctionNameScope):
1437         (JSC::BytecodeGenerator::pushScopedControlFlowContext):
1438         (JSC::BytecodeGenerator::emitPushCatchScope):
1439         * bytecompiler/BytecodeGenerator.h:
1440         * bytecompiler/NodesCodegen.cpp:
1441         * debugger/DebuggerScope.cpp:
1442         * dfg/DFGOperations.cpp:
1443         * interpreter/Interpreter.cpp:
1444         * jit/JIT.cpp:
1445         (JSC::JIT::privateCompileMainPass):
1446         * jit/JIT.h:
1447         * jit/JITOpcodes.cpp:
1448         (JSC::JIT::emit_op_to_string):
1449         (JSC::JIT::emit_op_catch):
1450         (JSC::JIT::emit_op_push_name_scope): Deleted.
1451         * jit/JITOpcodes32_64.cpp:
1452         (JSC::JIT::emitSlow_op_to_string):
1453         (JSC::JIT::emit_op_catch):
1454         (JSC::JIT::emit_op_push_name_scope): Deleted.
1455         * jit/JITOperations.cpp:
1456         (JSC::pushNameScope): Deleted.
1457         * llint/LLIntSlowPaths.cpp:
1458         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1459         * llint/LLIntSlowPaths.h:
1460         * llint/LowLevelInterpreter.asm:
1461         * parser/Nodes.cpp:
1462         * runtime/CommonSlowPaths.cpp:
1463         * runtime/Executable.cpp:
1464         (JSC::ScriptExecutable::newCodeBlockFor):
1465         * runtime/JSFunctionNameScope.cpp: Removed.
1466         * runtime/JSFunctionNameScope.h: Removed.
1467         * runtime/JSGlobalObject.cpp:
1468         (JSC::JSGlobalObject::init):
1469         (JSC::JSGlobalObject::visitChildren):
1470         * runtime/JSGlobalObject.h:
1471         (JSC::JSGlobalObject::withScopeStructure):
1472         (JSC::JSGlobalObject::strictEvalActivationStructure):
1473         (JSC::JSGlobalObject::activationStructure):
1474         (JSC::JSGlobalObject::directArgumentsStructure):
1475         (JSC::JSGlobalObject::scopedArgumentsStructure):
1476         (JSC::JSGlobalObject::outOfBandArgumentsStructure):
1477         (JSC::JSGlobalObject::functionNameScopeStructure): Deleted.
1478         * runtime/JSNameScope.cpp: Removed.
1479         * runtime/JSNameScope.h: Removed.
1480         * runtime/JSObject.cpp:
1481         (JSC::JSObject::toThis):
1482         (JSC::JSObject::seal):
1483         (JSC::JSObject::isFunctionNameScopeObject): Deleted.
1484         * runtime/JSObject.h:
1485         * runtime/JSScope.cpp:
1486         (JSC::JSScope::isCatchScope):
1487         (JSC::JSScope::isFunctionNameScopeObject):
1488         (JSC::resolveModeName):
1489         * runtime/JSScope.h:
1490         * runtime/JSSymbolTableObject.cpp:
1491         * runtime/SymbolTable.h:
1492         * runtime/VM.cpp:
1493
1494 2015-08-05  Joseph Pecoraro  <pecoraro@apple.com>
1495
1496         Web Inspector: Improve Support for PropertyName Iterator (Reflect.enumerate) in Inspector
1497         https://bugs.webkit.org/show_bug.cgi?id=147679
1498
1499         Reviewed by Timothy Hatcher.
1500
1501         Improve native iterator support for the PropertyName Iterator by
1502         allowing inspection of the internal object within the iterator
1503         and peeking of the next upcoming values of the iterator.
1504
1505         * inspector/JSInjectedScriptHost.cpp:
1506         (Inspector::JSInjectedScriptHost::subtype):
1507         (Inspector::JSInjectedScriptHost::getInternalProperties):
1508         (Inspector::JSInjectedScriptHost::iteratorEntries):
1509         * runtime/JSPropertyNameIterator.h:
1510         (JSC::JSPropertyNameIterator::iteratedValue):
1511
1512 2015-08-04  Brent Fulgham  <bfulgham@apple.com>
1513
1514         [Win] Update Apple Windows build for VS2015
1515         https://bugs.webkit.org/show_bug.cgi?id=147653
1516
1517         Reviewed by Dean Jackson.
1518
1519         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Drive-by-fix.
1520         Show JSC files in proper project locations in IDE.
1521
1522 2015-08-04  Joseph Pecoraro  <pecoraro@apple.com>
1523
1524         Web Inspector: Object previews for SVG elements shows SVGAnimatedString instead of text
1525         https://bugs.webkit.org/show_bug.cgi?id=147328
1526
1527         Reviewed by Timothy Hatcher.
1528
1529         * inspector/InjectedScriptSource.js:
1530         Use classList and classList.toString instead of className.
1531
1532 2015-08-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1533
1534         [ES6] Support Module Syntax
1535         https://bugs.webkit.org/show_bug.cgi?id=147422
1536
1537         Reviewed by Saam Barati.
1538
1539         This patch introduces ES6 Modules syntax parsing part.
1540         In this patch, ASTBuilder just produces the corresponding nodes to the ES6 Modules syntax,
1541         and this patch does not include the code generator part.
1542
1543         Modules require 2 phase parsing. In the first pass, we just analyze the dependent modules
1544         and do not execute the body or construct the AST. And after analyzing all the dependent
1545         modules, we will parse the dependent modules next.
1546         After all analyzing part is done, we will start the second pass. In the second pass, we
1547         will parse the module, produce the AST, and execute the body.
1548         If we don't do so, we need to create all the ASTs in the module's dependent graph at first
1549         because the given module can be executed after the all dependent modules are executed. It
1550         means that we need to hold so many parser arenas. To avoid this, the first pass only extracts
1551         the dependent modules' information.
1552
1553         In this patch, we don't add this analyzing part yet. This patch only implements the second pass.
1554         This patch aims at just implementing the syntax parsing functionality correctly.
1555         After this patch is landed, we will create the ModuleDependencyAnalyzer that inherits SyntaxChecker
1556         to collect the dependent modules fast[1].
1557
1558         To test the parsing, we added the "checkModuleSyntax" function into jsc shell.
1559         By using this, we can parse the given string as the module.
1560
1561         [1]: https://bugs.webkit.org/show_bug.cgi?id=147353
1562
1563         * bytecompiler/NodesCodegen.cpp:
1564         (JSC::ModuleProgramNode::emitBytecode):
1565         (JSC::ImportDeclarationNode::emitBytecode):
1566         (JSC::ExportAllDeclarationNode::emitBytecode):
1567         (JSC::ExportDefaultDeclarationNode::emitBytecode):
1568         (JSC::ExportLocalDeclarationNode::emitBytecode):
1569         (JSC::ExportNamedDeclarationNode::emitBytecode):
1570         * jsc.cpp:
1571         (GlobalObject::finishCreation):
1572         (functionCheckModuleSyntax):
1573         * parser/ASTBuilder.h:
1574         (JSC::ASTBuilder::createModuleSpecifier):
1575         (JSC::ASTBuilder::createImportSpecifier):
1576         (JSC::ASTBuilder::createImportSpecifierList):
1577         (JSC::ASTBuilder::appendImportSpecifier):
1578         (JSC::ASTBuilder::createImportDeclaration):
1579         (JSC::ASTBuilder::createExportAllDeclaration):
1580         (JSC::ASTBuilder::createExportDefaultDeclaration):
1581         (JSC::ASTBuilder::createExportLocalDeclaration):
1582         (JSC::ASTBuilder::createExportNamedDeclaration):
1583         (JSC::ASTBuilder::createExportSpecifier):
1584         (JSC::ASTBuilder::createExportSpecifierList):
1585         (JSC::ASTBuilder::appendExportSpecifier):
1586         * parser/Keywords.table:
1587         * parser/NodeConstructors.h:
1588         (JSC::ModuleSpecifierNode::ModuleSpecifierNode):
1589         (JSC::ImportSpecifierNode::ImportSpecifierNode):
1590         (JSC::ImportDeclarationNode::ImportDeclarationNode):
1591         (JSC::ExportAllDeclarationNode::ExportAllDeclarationNode):
1592         (JSC::ExportDefaultDeclarationNode::ExportDefaultDeclarationNode):
1593         (JSC::ExportLocalDeclarationNode::ExportLocalDeclarationNode):
1594         (JSC::ExportNamedDeclarationNode::ExportNamedDeclarationNode):
1595         (JSC::ExportSpecifierNode::ExportSpecifierNode):
1596         * parser/Nodes.cpp:
1597         (JSC::ModuleProgramNode::ModuleProgramNode):
1598         * parser/Nodes.h:
1599         (JSC::ModuleProgramNode::startColumn):
1600         (JSC::ModuleProgramNode::endColumn):
1601         (JSC::ModuleSpecifierNode::moduleName):
1602         (JSC::ImportSpecifierNode::importedName):
1603         (JSC::ImportSpecifierNode::localName):
1604         (JSC::ImportSpecifierListNode::specifiers):
1605         (JSC::ImportSpecifierListNode::append):
1606         (JSC::ImportDeclarationNode::specifierList):
1607         (JSC::ImportDeclarationNode::moduleSpecifier):
1608         (JSC::ExportAllDeclarationNode::moduleSpecifier):
1609         (JSC::ExportDefaultDeclarationNode::declaration):
1610         (JSC::ExportLocalDeclarationNode::declaration):
1611         (JSC::ExportSpecifierNode::exportedName):
1612         (JSC::ExportSpecifierNode::localName):
1613         (JSC::ExportSpecifierListNode::specifiers):
1614         (JSC::ExportSpecifierListNode::append):
1615         (JSC::ExportNamedDeclarationNode::specifierList):
1616         (JSC::ExportNamedDeclarationNode::moduleSpecifier):
1617         * parser/Parser.cpp:
1618         (JSC::Parser<LexerType>::Parser):
1619         (JSC::Parser<LexerType>::parseInner):
1620         (JSC::Parser<LexerType>::parseModuleSourceElements):
1621         (JSC::Parser<LexerType>::parseVariableDeclaration):
1622         (JSC::Parser<LexerType>::parseVariableDeclarationList):
1623         (JSC::Parser<LexerType>::createBindingPattern):
1624         (JSC::Parser<LexerType>::tryParseDestructuringPatternExpression):
1625         (JSC::Parser<LexerType>::parseDestructuringPattern):
1626         (JSC::Parser<LexerType>::parseForStatement):
1627         (JSC::Parser<LexerType>::parseFormalParameters):
1628         (JSC::Parser<LexerType>::parseFunctionParameters):
1629         (JSC::Parser<LexerType>::parseFunctionDeclaration):
1630         (JSC::Parser<LexerType>::parseClassDeclaration):
1631         (JSC::Parser<LexerType>::parseModuleSpecifier):
1632         (JSC::Parser<LexerType>::parseImportClauseItem):
1633         (JSC::Parser<LexerType>::parseImportDeclaration):
1634         (JSC::Parser<LexerType>::parseExportSpecifier):
1635         (JSC::Parser<LexerType>::parseExportDeclaration):
1636         (JSC::Parser<LexerType>::parseMemberExpression):
1637         * parser/Parser.h:
1638         (JSC::isIdentifierOrKeyword):
1639         (JSC::ModuleScopeData::create):
1640         (JSC::ModuleScopeData::exportedBindings):
1641         (JSC::ModuleScopeData::exportName):
1642         (JSC::ModuleScopeData::exportBinding):
1643         (JSC::Scope::Scope):
1644         (JSC::Scope::setIsModule):
1645         (JSC::Scope::moduleScopeData):
1646         (JSC::Parser::matchContextualKeyword):
1647         (JSC::Parser::matchIdentifierOrKeyword):
1648         (JSC::Parser::isofToken): Deleted.
1649         * parser/ParserModes.h:
1650         * parser/ParserTokens.h:
1651         * parser/SyntaxChecker.h:
1652         (JSC::SyntaxChecker::createModuleSpecifier):
1653         (JSC::SyntaxChecker::createImportSpecifier):
1654         (JSC::SyntaxChecker::createImportSpecifierList):
1655         (JSC::SyntaxChecker::appendImportSpecifier):
1656         (JSC::SyntaxChecker::createImportDeclaration):
1657         (JSC::SyntaxChecker::createExportAllDeclaration):
1658         (JSC::SyntaxChecker::createExportDefaultDeclaration):
1659         (JSC::SyntaxChecker::createExportLocalDeclaration):
1660         (JSC::SyntaxChecker::createExportNamedDeclaration):
1661         (JSC::SyntaxChecker::createExportSpecifier):
1662         (JSC::SyntaxChecker::createExportSpecifierList):
1663         (JSC::SyntaxChecker::appendExportSpecifier):
1664         * runtime/CommonIdentifiers.cpp:
1665         (JSC::CommonIdentifiers::CommonIdentifiers):
1666         * runtime/CommonIdentifiers.h:
1667         * runtime/Completion.cpp:
1668         (JSC::checkModuleSyntax):
1669         * runtime/Completion.h:
1670         * tests/stress/modules-syntax-error-with-names.js: Added.
1671         (shouldThrow):
1672         * tests/stress/modules-syntax-error.js: Added.
1673         (shouldThrow):
1674         (checkModuleSyntaxError.checkModuleSyntaxError.checkModuleSyntaxError):
1675         * tests/stress/modules-syntax.js: Added.
1676         (prototype.checkModuleSyntax):
1677         (checkModuleSyntax):
1678         * tests/stress/tagged-templates-syntax.js:
1679
1680 2015-08-03  Csaba Osztrogonác  <ossy@webkit.org>
1681
1682         Introduce COMPILER(GCC_OR_CLANG) guard and make COMPILER(GCC) true only for GCC
1683         https://bugs.webkit.org/show_bug.cgi?id=146833
1684
1685         Reviewed by Alexey Proskuryakov.
1686
1687         * assembler/ARM64Assembler.h:
1688         * assembler/ARMAssembler.h:
1689         (JSC::ARMAssembler::cacheFlush):
1690         * assembler/MacroAssemblerARM.cpp:
1691         (JSC::isVFPPresent):
1692         * assembler/MacroAssemblerX86Common.h:
1693         (JSC::MacroAssemblerX86Common::isSSE2Present):
1694         * heap/MachineStackMarker.h:
1695         * interpreter/StackVisitor.cpp: Removed redundant COMPILER(CLANG) guards.
1696         (JSC::logF):
1697         * jit/HostCallReturnValue.h:
1698         * jit/JIT.h:
1699         * jit/JITOperations.cpp:
1700         * jit/JITStubsARM.h:
1701         * jit/JITStubsARMv7.h:
1702         * jit/JITStubsX86.h:
1703         * jit/JITStubsX86Common.h:
1704         * jit/JITStubsX86_64.h:
1705         * jit/ThunkGenerators.cpp:
1706         * runtime/JSExportMacros.h:
1707         * runtime/MathCommon.h: Removed redundant COMPILER(CLANG) guard.
1708         (JSC::clz32):
1709
1710 2015-08-03  Filip Pizlo  <fpizlo@apple.com>
1711
1712         Unreviewed, fix uninitialized property leading to an assert.
1713
1714         * runtime/PutPropertySlot.h:
1715         (JSC::PutPropertySlot::PutPropertySlot):
1716
1717 2015-08-03  Filip Pizlo  <fpizlo@apple.com>
1718
1719         Unreviewed, fix Windows.
1720
1721         * bytecode/ObjectPropertyConditionSet.h:
1722         (JSC::ObjectPropertyConditionSet::fromRawPointer):
1723
1724 2015-07-31  Filip Pizlo  <fpizlo@apple.com>
1725
1726         DFG should have adaptive structure watchpoints
1727         https://bugs.webkit.org/show_bug.cgi?id=146929
1728
1729         Reviewed by Geoffrey Garen.
1730
1731         Before this change, if you wanted to efficiently validate whether an object has (or doesn't have) a
1732         property, you'd check that the object still has the structure that you first saw the object have. We
1733         optimized this a bit with transition watchpoints on the structure, which sometimes allowed us to
1734         elide the structure check.
1735
1736         But this approach fails when that object frequently has new properties added to it. This would
1737         change the structure and fire the transition watchpoint, so the code we emitted would be invalid and
1738         we'd have to recompile either the IC or an entire code block.
1739
1740         This change introduces a new concept: an object property condition. This value describes some
1741         condition involving a property on some object. There are four kinds: presence, absence,
1742         absence-of-setter, and equivalence. For example, a presence condition says that we expect that the
1743         object has some property at some offset with some attributes. This allows us to implement a new kind
1744         of watchpoint, which knows about the object property condition that it's being used to enforce. If
1745         the watchpoint fires because of a structure transition, the watchpoint may simply reinstall itself
1746         on the new structure.
1747
1748         Object property conditions are used on the prototype chain of PutById transitions, GetById misses,
1749         and prototype accesses. They are also used for any DFG accesses to object constants, including
1750         global property accesses.
1751
1752         Mostly because of the effect on global property access, this is a 9% speed-up on Kraken. It's
1753         neutral on most other things. It's a 68x speed-up on a microbenchmark that illustrates the prototype
1754         chain situation. It's also a small speed-up on getter-richards.
1755
1756         * CMakeLists.txt:
1757         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1758         * JavaScriptCore.xcodeproj/project.pbxproj:
1759         * bytecode/CodeBlock.cpp:
1760         (JSC::CodeBlock::printGetByIdCacheStatus):
1761         (JSC::CodeBlock::printPutByIdCacheStatus):
1762         * bytecode/CodeBlockJettisoningWatchpoint.cpp:
1763         (JSC::CodeBlockJettisoningWatchpoint::fireInternal):
1764         * bytecode/ComplexGetStatus.cpp:
1765         (JSC::ComplexGetStatus::computeFor):
1766         * bytecode/ComplexGetStatus.h:
1767         (JSC::ComplexGetStatus::ComplexGetStatus):
1768         (JSC::ComplexGetStatus::takesSlowPath):
1769         (JSC::ComplexGetStatus::kind):
1770         (JSC::ComplexGetStatus::offset):
1771         (JSC::ComplexGetStatus::conditionSet):
1772         (JSC::ComplexGetStatus::attributes): Deleted.
1773         (JSC::ComplexGetStatus::specificValue): Deleted.
1774         (JSC::ComplexGetStatus::chain): Deleted.
1775         * bytecode/ConstantStructureCheck.cpp: Removed.
1776         * bytecode/ConstantStructureCheck.h: Removed.
1777         * bytecode/GetByIdStatus.cpp:
1778         (JSC::GetByIdStatus::computeForStubInfo):
1779         * bytecode/GetByIdVariant.cpp:
1780         (JSC::GetByIdVariant::GetByIdVariant):
1781         (JSC::GetByIdVariant::~GetByIdVariant):
1782         (JSC::GetByIdVariant::operator=):
1783         (JSC::GetByIdVariant::attemptToMerge):
1784         (JSC::GetByIdVariant::dumpInContext):
1785         (JSC::GetByIdVariant::baseStructure): Deleted.
1786         * bytecode/GetByIdVariant.h:
1787         (JSC::GetByIdVariant::operator!):
1788         (JSC::GetByIdVariant::structureSet):
1789         (JSC::GetByIdVariant::conditionSet):
1790         (JSC::GetByIdVariant::offset):
1791         (JSC::GetByIdVariant::callLinkStatus):
1792         (JSC::GetByIdVariant::constantChecks): Deleted.
1793         (JSC::GetByIdVariant::alternateBase): Deleted.
1794         * bytecode/ObjectPropertyCondition.cpp: Added.
1795         (JSC::ObjectPropertyCondition::dumpInContext):
1796         (JSC::ObjectPropertyCondition::dump):
1797         (JSC::ObjectPropertyCondition::structureEnsuresValidityAssumingImpurePropertyWatchpoint):
1798         (JSC::ObjectPropertyCondition::validityRequiresImpurePropertyWatchpoint):
1799         (JSC::ObjectPropertyCondition::isStillValid):
1800         (JSC::ObjectPropertyCondition::structureEnsuresValidity):
1801         (JSC::ObjectPropertyCondition::isWatchableAssumingImpurePropertyWatchpoint):
1802         (JSC::ObjectPropertyCondition::isWatchable):
1803         (JSC::ObjectPropertyCondition::isStillLive):
1804         (JSC::ObjectPropertyCondition::validateReferences):
1805         (JSC::ObjectPropertyCondition::attemptToMakeEquivalenceWithoutBarrier):
1806         * bytecode/ObjectPropertyCondition.h: Added.
1807         (JSC::ObjectPropertyCondition::ObjectPropertyCondition):
1808         (JSC::ObjectPropertyCondition::presenceWithoutBarrier):
1809         (JSC::ObjectPropertyCondition::presence):
1810         (JSC::ObjectPropertyCondition::absenceWithoutBarrier):
1811         (JSC::ObjectPropertyCondition::absence):
1812         (JSC::ObjectPropertyCondition::absenceOfSetterWithoutBarrier):
1813         (JSC::ObjectPropertyCondition::absenceOfSetter):
1814         (JSC::ObjectPropertyCondition::equivalenceWithoutBarrier):
1815         (JSC::ObjectPropertyCondition::equivalence):
1816         (JSC::ObjectPropertyCondition::operator!):
1817         (JSC::ObjectPropertyCondition::object):
1818         (JSC::ObjectPropertyCondition::condition):
1819         (JSC::ObjectPropertyCondition::kind):
1820         (JSC::ObjectPropertyCondition::uid):
1821         (JSC::ObjectPropertyCondition::hasOffset):
1822         (JSC::ObjectPropertyCondition::offset):
1823         (JSC::ObjectPropertyCondition::hasAttributes):
1824         (JSC::ObjectPropertyCondition::attributes):
1825         (JSC::ObjectPropertyCondition::hasPrototype):
1826         (JSC::ObjectPropertyCondition::prototype):
1827         (JSC::ObjectPropertyCondition::hasRequiredValue):
1828         (JSC::ObjectPropertyCondition::requiredValue):
1829         (JSC::ObjectPropertyCondition::hash):
1830         (JSC::ObjectPropertyCondition::operator==):
1831         (JSC::ObjectPropertyCondition::isHashTableDeletedValue):
1832         (JSC::ObjectPropertyCondition::isCompatibleWith):
1833         (JSC::ObjectPropertyCondition::watchingRequiresStructureTransitionWatchpoint):
1834         (JSC::ObjectPropertyCondition::watchingRequiresReplacementWatchpoint):
1835         (JSC::ObjectPropertyCondition::isValidValueForPresence):
1836         (JSC::ObjectPropertyConditionHash::hash):
1837         (JSC::ObjectPropertyConditionHash::equal):
1838         * bytecode/ObjectPropertyConditionSet.cpp: Added.
1839         (JSC::ObjectPropertyConditionSet::forObject):
1840         (JSC::ObjectPropertyConditionSet::forConditionKind):
1841         (JSC::ObjectPropertyConditionSet::numberOfConditionsWithKind):
1842         (JSC::ObjectPropertyConditionSet::hasOneSlotBaseCondition):
1843         (JSC::ObjectPropertyConditionSet::slotBaseCondition):
1844         (JSC::ObjectPropertyConditionSet::mergedWith):
1845         (JSC::ObjectPropertyConditionSet::structuresEnsureValidity):
1846         (JSC::ObjectPropertyConditionSet::structuresEnsureValidityAssumingImpurePropertyWatchpoint):
1847         (JSC::ObjectPropertyConditionSet::needImpurePropertyWatchpoint):
1848         (JSC::ObjectPropertyConditionSet::areStillLive):
1849         (JSC::ObjectPropertyConditionSet::dumpInContext):
1850         (JSC::ObjectPropertyConditionSet::dump):
1851         (JSC::generateConditionsForPropertyMiss):
1852         (JSC::generateConditionsForPropertySetterMiss):
1853         (JSC::generateConditionsForPrototypePropertyHit):
1854         (JSC::generateConditionsForPrototypePropertyHitCustom):
1855         (JSC::generateConditionsForPropertySetterMissConcurrently):
1856         * bytecode/ObjectPropertyConditionSet.h: Added.
1857         (JSC::ObjectPropertyConditionSet::ObjectPropertyConditionSet):
1858         (JSC::ObjectPropertyConditionSet::invalid):
1859         (JSC::ObjectPropertyConditionSet::nonEmpty):
1860         (JSC::ObjectPropertyConditionSet::isValid):
1861         (JSC::ObjectPropertyConditionSet::isEmpty):
1862         (JSC::ObjectPropertyConditionSet::begin):
1863         (JSC::ObjectPropertyConditionSet::end):
1864         (JSC::ObjectPropertyConditionSet::releaseRawPointer):
1865         (JSC::ObjectPropertyConditionSet::adoptRawPointer):
1866         (JSC::ObjectPropertyConditionSet::fromRawPointer):
1867         (JSC::ObjectPropertyConditionSet::Data::Data):
1868         * bytecode/PolymorphicGetByIdList.cpp:
1869         (JSC::GetByIdAccess::GetByIdAccess):
1870         (JSC::GetByIdAccess::~GetByIdAccess):
1871         (JSC::GetByIdAccess::visitWeak):
1872         * bytecode/PolymorphicGetByIdList.h:
1873         (JSC::GetByIdAccess::GetByIdAccess):
1874         (JSC::GetByIdAccess::structure):
1875         (JSC::GetByIdAccess::conditionSet):
1876         (JSC::GetByIdAccess::stubRoutine):
1877         (JSC::GetByIdAccess::chain): Deleted.
1878         (JSC::GetByIdAccess::chainCount): Deleted.
1879         * bytecode/PolymorphicPutByIdList.cpp:
1880         (JSC::PutByIdAccess::fromStructureStubInfo):
1881         (JSC::PutByIdAccess::visitWeak):
1882         * bytecode/PolymorphicPutByIdList.h:
1883         (JSC::PutByIdAccess::PutByIdAccess):
1884         (JSC::PutByIdAccess::transition):
1885         (JSC::PutByIdAccess::setter):
1886         (JSC::PutByIdAccess::newStructure):
1887         (JSC::PutByIdAccess::conditionSet):
1888         (JSC::PutByIdAccess::stubRoutine):
1889         (JSC::PutByIdAccess::chain): Deleted.
1890         (JSC::PutByIdAccess::chainCount): Deleted.
1891         * bytecode/PropertyCondition.cpp: Added.
1892         (JSC::PropertyCondition::dumpInContext):
1893         (JSC::PropertyCondition::dump):
1894         (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint):
1895         (JSC::PropertyCondition::validityRequiresImpurePropertyWatchpoint):
1896         (JSC::PropertyCondition::isStillValid):
1897         (JSC::PropertyCondition::isWatchableWhenValid):
1898         (JSC::PropertyCondition::isWatchableAssumingImpurePropertyWatchpoint):
1899         (JSC::PropertyCondition::isWatchable):
1900         (JSC::PropertyCondition::isStillLive):
1901         (JSC::PropertyCondition::validateReferences):
1902         (JSC::PropertyCondition::isValidValueForAttributes):
1903         (JSC::PropertyCondition::isValidValueForPresence):
1904         (JSC::PropertyCondition::attemptToMakeEquivalenceWithoutBarrier):
1905         (WTF::printInternal):
1906         * bytecode/PropertyCondition.h: Added.
1907         (JSC::PropertyCondition::PropertyCondition):
1908         (JSC::PropertyCondition::presenceWithoutBarrier):
1909         (JSC::PropertyCondition::presence):
1910         (JSC::PropertyCondition::absenceWithoutBarrier):
1911         (JSC::PropertyCondition::absence):
1912         (JSC::PropertyCondition::absenceOfSetterWithoutBarrier):
1913         (JSC::PropertyCondition::absenceOfSetter):
1914         (JSC::PropertyCondition::equivalenceWithoutBarrier):
1915         (JSC::PropertyCondition::equivalence):
1916         (JSC::PropertyCondition::operator!):
1917         (JSC::PropertyCondition::kind):
1918         (JSC::PropertyCondition::uid):
1919         (JSC::PropertyCondition::hasOffset):
1920         (JSC::PropertyCondition::offset):
1921         (JSC::PropertyCondition::hasAttributes):
1922         (JSC::PropertyCondition::attributes):
1923         (JSC::PropertyCondition::hasPrototype):
1924         (JSC::PropertyCondition::prototype):
1925         (JSC::PropertyCondition::hasRequiredValue):
1926         (JSC::PropertyCondition::requiredValue):
1927         (JSC::PropertyCondition::hash):
1928         (JSC::PropertyCondition::operator==):
1929         (JSC::PropertyCondition::isHashTableDeletedValue):
1930         (JSC::PropertyCondition::isCompatibleWith):
1931         (JSC::PropertyCondition::watchingRequiresStructureTransitionWatchpoint):
1932         (JSC::PropertyCondition::watchingRequiresReplacementWatchpoint):
1933         (JSC::PropertyConditionHash::hash):
1934         (JSC::PropertyConditionHash::equal):
1935         * bytecode/PutByIdStatus.cpp:
1936         (JSC::PutByIdStatus::computeFromLLInt):
1937         (JSC::PutByIdStatus::computeFor):
1938         (JSC::PutByIdStatus::computeForStubInfo):
1939         * bytecode/PutByIdVariant.cpp:
1940         (JSC::PutByIdVariant::operator=):
1941         (JSC::PutByIdVariant::transition):
1942         (JSC::PutByIdVariant::setter):
1943         (JSC::PutByIdVariant::makesCalls):
1944         (JSC::PutByIdVariant::attemptToMerge):
1945         (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace):
1946         (JSC::PutByIdVariant::dumpInContext):
1947         (JSC::PutByIdVariant::baseStructure): Deleted.
1948         * bytecode/PutByIdVariant.h:
1949         (JSC::PutByIdVariant::PutByIdVariant):
1950         (JSC::PutByIdVariant::kind):
1951         (JSC::PutByIdVariant::structure):
1952         (JSC::PutByIdVariant::structureSet):
1953         (JSC::PutByIdVariant::oldStructure):
1954         (JSC::PutByIdVariant::conditionSet):
1955         (JSC::PutByIdVariant::offset):
1956         (JSC::PutByIdVariant::callLinkStatus):
1957         (JSC::PutByIdVariant::constantChecks): Deleted.
1958         (JSC::PutByIdVariant::alternateBase): Deleted.
1959         * bytecode/StructureStubClearingWatchpoint.cpp:
1960         (JSC::StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint):
1961         (JSC::StructureStubClearingWatchpoint::push):
1962         (JSC::StructureStubClearingWatchpoint::fireInternal):
1963         (JSC::WatchpointsOnStructureStubInfo::~WatchpointsOnStructureStubInfo):
1964         (JSC::WatchpointsOnStructureStubInfo::addWatchpoint):
1965         (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint):
1966         * bytecode/StructureStubClearingWatchpoint.h:
1967         (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint):
1968         (JSC::WatchpointsOnStructureStubInfo::codeBlock):
1969         (JSC::WatchpointsOnStructureStubInfo::stubInfo):
1970         * bytecode/StructureStubInfo.cpp:
1971         (JSC::StructureStubInfo::deref):
1972         (JSC::StructureStubInfo::visitWeakReferences):
1973         * bytecode/StructureStubInfo.h:
1974         (JSC::StructureStubInfo::initPutByIdTransition):
1975         (JSC::StructureStubInfo::initPutByIdReplace):
1976         (JSC::StructureStubInfo::setSeen):
1977         (JSC::StructureStubInfo::addWatchpoint):
1978         * dfg/DFGAbstractInterpreterInlines.h:
1979         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1980         * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp: Added.
1981         (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::AdaptiveInferredPropertyValueWatchpoint):
1982         (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::install):
1983         (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::fire):
1984         (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::fireInternal):
1985         (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::fireInternal):
1986         * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h: Added.
1987         (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::key):
1988         (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::StructureWatchpoint):
1989         (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::PropertyWatchpoint):
1990         * dfg/DFGAdaptiveStructureWatchpoint.cpp: Added.
1991         (JSC::DFG::AdaptiveStructureWatchpoint::AdaptiveStructureWatchpoint):
1992         (JSC::DFG::AdaptiveStructureWatchpoint::install):
1993         (JSC::DFG::AdaptiveStructureWatchpoint::fireInternal):
1994         * dfg/DFGAdaptiveStructureWatchpoint.h: Added.
1995         (JSC::DFG::AdaptiveStructureWatchpoint::key):
1996         * dfg/DFGByteCodeParser.cpp:
1997         (JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck):
1998         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
1999         (JSC::DFG::ByteCodeParser::handleGetByOffset):
2000         (JSC::DFG::ByteCodeParser::handlePutByOffset):
2001         (JSC::DFG::ByteCodeParser::check):
2002         (JSC::DFG::ByteCodeParser::promoteToConstant):
2003         (JSC::DFG::ByteCodeParser::planLoad):
2004         (JSC::DFG::ByteCodeParser::load):
2005         (JSC::DFG::ByteCodeParser::presenceLike):
2006         (JSC::DFG::ByteCodeParser::checkPresenceLike):
2007         (JSC::DFG::ByteCodeParser::store):
2008         (JSC::DFG::ByteCodeParser::handleGetById):
2009         (JSC::DFG::ByteCodeParser::handlePutById):
2010         (JSC::DFG::ByteCodeParser::parseBlock):
2011         (JSC::DFG::ByteCodeParser::emitChecks): Deleted.
2012         * dfg/DFGCommonData.cpp:
2013         (JSC::DFG::CommonData::validateReferences):
2014         * dfg/DFGCommonData.h:
2015         * dfg/DFGConstantFoldingPhase.cpp:
2016         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2017         (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
2018         (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
2019         (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
2020         (JSC::DFG::ConstantFoldingPhase::addChecks): Deleted.
2021         * dfg/DFGDesiredWatchpoints.cpp:
2022         (JSC::DFG::ArrayBufferViewWatchpointAdaptor::add):
2023         (JSC::DFG::InferredValueAdaptor::add):
2024         (JSC::DFG::AdaptiveStructureWatchpointAdaptor::add):
2025         (JSC::DFG::DesiredWatchpoints::DesiredWatchpoints):
2026         (JSC::DFG::DesiredWatchpoints::addLazily):
2027         (JSC::DFG::DesiredWatchpoints::consider):
2028         (JSC::DFG::DesiredWatchpoints::reallyAdd):
2029         (JSC::DFG::DesiredWatchpoints::areStillValid):
2030         (JSC::DFG::DesiredWatchpoints::dumpInContext):
2031         * dfg/DFGDesiredWatchpoints.h:
2032         (JSC::DFG::SetPointerAdaptor::add):
2033         (JSC::DFG::SetPointerAdaptor::hasBeenInvalidated):
2034         (JSC::DFG::SetPointerAdaptor::dumpInContext):
2035         (JSC::DFG::InferredValueAdaptor::hasBeenInvalidated):
2036         (JSC::DFG::InferredValueAdaptor::dumpInContext):
2037         (JSC::DFG::ArrayBufferViewWatchpointAdaptor::hasBeenInvalidated):
2038         (JSC::DFG::ArrayBufferViewWatchpointAdaptor::dumpInContext):
2039         (JSC::DFG::AdaptiveStructureWatchpointAdaptor::hasBeenInvalidated):
2040         (JSC::DFG::AdaptiveStructureWatchpointAdaptor::dumpInContext):
2041         (JSC::DFG::GenericDesiredWatchpoints::reallyAdd):
2042         (JSC::DFG::GenericDesiredWatchpoints::isWatched):
2043         (JSC::DFG::GenericDesiredWatchpoints::dumpInContext):
2044         (JSC::DFG::DesiredWatchpoints::isWatched):
2045         (JSC::DFG::GenericSetAdaptor::add): Deleted.
2046         (JSC::DFG::GenericSetAdaptor::hasBeenInvalidated): Deleted.
2047         * dfg/DFGDesiredWeakReferences.cpp:
2048         (JSC::DFG::DesiredWeakReferences::addLazily):
2049         (JSC::DFG::DesiredWeakReferences::contains):
2050         * dfg/DFGDesiredWeakReferences.h:
2051         * dfg/DFGGraph.cpp:
2052         (JSC::DFG::Graph::dump):
2053         (JSC::DFG::Graph::clearFlagsOnAllNodes):
2054         (JSC::DFG::Graph::watchCondition):
2055         (JSC::DFG::Graph::isSafeToLoad):
2056         (JSC::DFG::Graph::livenessFor):
2057         (JSC::DFG::Graph::tryGetConstantProperty):
2058         (JSC::DFG::Graph::visitChildren):
2059         * dfg/DFGGraph.h:
2060         (JSC::DFG::Graph::identifiers):
2061         (JSC::DFG::Graph::watchpoints):
2062         * dfg/DFGMultiGetByOffsetData.cpp: Added.
2063         (JSC::DFG::GetByOffsetMethod::dumpInContext):
2064         (JSC::DFG::GetByOffsetMethod::dump):
2065         (JSC::DFG::MultiGetByOffsetCase::dumpInContext):
2066         (JSC::DFG::MultiGetByOffsetCase::dump):
2067         (WTF::printInternal):
2068         * dfg/DFGMultiGetByOffsetData.h: Added.
2069         (JSC::DFG::GetByOffsetMethod::GetByOffsetMethod):
2070         (JSC::DFG::GetByOffsetMethod::constant):
2071         (JSC::DFG::GetByOffsetMethod::load):
2072         (JSC::DFG::GetByOffsetMethod::loadFromPrototype):
2073         (JSC::DFG::GetByOffsetMethod::operator!):
2074         (JSC::DFG::GetByOffsetMethod::kind):
2075         (JSC::DFG::GetByOffsetMethod::prototype):
2076         (JSC::DFG::GetByOffsetMethod::offset):
2077         (JSC::DFG::MultiGetByOffsetCase::MultiGetByOffsetCase):
2078         (JSC::DFG::MultiGetByOffsetCase::set):
2079         (JSC::DFG::MultiGetByOffsetCase::method):
2080         * dfg/DFGNode.h:
2081         * dfg/DFGSafeToExecute.h:
2082         (JSC::DFG::safeToExecute):
2083         * dfg/DFGStructureRegistrationPhase.cpp:
2084         (JSC::DFG::StructureRegistrationPhase::run):
2085         * ftl/FTLLowerDFGToLLVM.cpp:
2086         (JSC::FTL::DFG::LowerDFGToLLVM::compileMultiGetByOffset):
2087         * jit/Repatch.cpp:
2088         (JSC::repatchByIdSelfAccess):
2089         (JSC::checkObjectPropertyCondition):
2090         (JSC::checkObjectPropertyConditions):
2091         (JSC::replaceWithJump):
2092         (JSC::generateByIdStub):
2093         (JSC::actionForCell):
2094         (JSC::tryBuildGetByIDList):
2095         (JSC::emitPutReplaceStub):
2096         (JSC::emitPutTransitionStub):
2097         (JSC::tryCachePutByID):
2098         (JSC::tryBuildPutByIdList):
2099         (JSC::tryRepatchIn):
2100         (JSC::addStructureTransitionCheck): Deleted.
2101         (JSC::emitPutTransitionStubAndGetOldStructure): Deleted.
2102         * runtime/IntendedStructureChain.cpp: Removed.
2103         * runtime/IntendedStructureChain.h: Removed.
2104         * runtime/JSCJSValue.h:
2105         * runtime/JSObject.cpp:
2106         (JSC::throwTypeError):
2107         (JSC::JSObject::convertToDictionary):
2108         (JSC::JSObject::shiftButterflyAfterFlattening):
2109         * runtime/JSObject.h:
2110         (JSC::JSObject::flattenDictionaryObject):
2111         (JSC::JSObject::convertToDictionary): Deleted.
2112         * runtime/Operations.h:
2113         (JSC::normalizePrototypeChain):
2114         (JSC::normalizePrototypeChainForChainAccess): Deleted.
2115         (JSC::isPrototypeChainNormalized): Deleted.
2116         * runtime/PropertySlot.h:
2117         (JSC::PropertySlot::PropertySlot):
2118         (JSC::PropertySlot::slotBase):
2119         * runtime/Structure.cpp:
2120         (JSC::Structure::addPropertyTransition):
2121         (JSC::Structure::attributeChangeTransition):
2122         (JSC::Structure::toDictionaryTransition):
2123         (JSC::Structure::toCacheableDictionaryTransition):
2124         (JSC::Structure::toUncacheableDictionaryTransition):
2125         (JSC::Structure::ensurePropertyReplacementWatchpointSet):
2126         (JSC::Structure::startWatchingPropertyForReplacements):
2127         (JSC::Structure::didCachePropertyReplacement):
2128         (JSC::Structure::dump):
2129         * runtime/Structure.h:
2130         * runtime/VM.h:
2131         * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check-new.js: Added.
2132         (foo):
2133         (bar):
2134         (baz):
2135         * tests/stress/multi-get-by-offset-self-or-proto.js: Added.
2136         (foo):
2137         * tests/stress/replacement-watchpoint-dictionary.js: Added.
2138         (foo):
2139         * tests/stress/replacement-watchpoint.js: Added.
2140         (foo):
2141         * tests/stress/undefined-access-dictionary-then-proto-change.js: Added.
2142         (foo):
2143         * tests/stress/undefined-access-then-proto-change.js: Added.
2144         (foo):
2145
2146 2015-08-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2147
2148         JavascriptCore Crash in JSC::ASTBuilder::Property JSC::Parser<JSC::Lexer<unsigned char> >::parseProperty<JSC::ASTBuilder>(JSC::ASTBuilder&, bool)
2149         https://bugs.webkit.org/show_bug.cgi?id=147538
2150
2151         Reviewed by Geoffrey Garen.
2152
2153         Due to the order of the ARROWFUNCTION token in JSTokenType enum, it is categorized as the one of the Keyword.
2154         As a result, when lexing the property name that can take the keywords, the ARROWFUNCTION token is accidentally accepted.
2155         This patch changes the order of the ARROWFUNCTION token in JSTokenType to make it the operator token.
2156
2157         * parser/ParserTokens.h:
2158         * tests/stress/arrow-function-token-is-not-keyword.js: Added.
2159         (testSyntaxError):
2160
2161 2015-08-03  Keith Miller  <keith_miller@apple.com>
2162
2163         Clean up the naming for AST expression generation.
2164         https://bugs.webkit.org/show_bug.cgi?id=147581
2165
2166         Reviewed by Yusuke Suzuki.
2167
2168         * parser/ASTBuilder.h:
2169         (JSC::ASTBuilder::createThisExpr):
2170         (JSC::ASTBuilder::createSuperExpr):
2171         (JSC::ASTBuilder::createNewTargetExpr):
2172         (JSC::ASTBuilder::thisExpr): Deleted.
2173         (JSC::ASTBuilder::superExpr): Deleted.
2174         (JSC::ASTBuilder::newTargetExpr): Deleted.
2175         * parser/Parser.cpp:
2176         (JSC::Parser<LexerType>::parsePrimaryExpression):
2177         (JSC::Parser<LexerType>::parseMemberExpression):
2178         * parser/SyntaxChecker.h:
2179         (JSC::SyntaxChecker::createThisExpr):
2180         (JSC::SyntaxChecker::createSuperExpr):
2181         (JSC::SyntaxChecker::createNewTargetExpr):
2182         (JSC::SyntaxChecker::thisExpr): Deleted.
2183         (JSC::SyntaxChecker::superExpr): Deleted.
2184         (JSC::SyntaxChecker::newTargetExpr): Deleted.
2185
2186 2015-08-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2187
2188         Don't set up the callsite to operationGetByValDefault when the optimization is already done
2189         https://bugs.webkit.org/show_bug.cgi?id=147577
2190
2191         Reviewed by Filip Pizlo.
2192
2193         operationGetByValDefault should be called only when the IC is not set.
2194         operationGetByValString breaks this invariant and `ASSERT(!byValInfo.stubRoutine)` in
2195         operationGetByValDefault raises the assertion failure.
2196         In this patch, we change the callsite setting up code in operationGetByValString when
2197         the IC is already set. And to make the operation's meaning explicitly, we changed the
2198         name operationGetByValDefault to operationGetByValOptimize, that is aligned to the
2199         GetById case.
2200
2201         * jit/JITOperations.cpp:
2202         * jit/JITOperations.h:
2203         * jit/JITPropertyAccess.cpp:
2204         (JSC::JIT::emitSlow_op_get_by_val):
2205         * jit/JITPropertyAccess32_64.cpp:
2206         (JSC::JIT::emitSlow_op_get_by_val):
2207         * tests/stress/operation-get-by-val-default-should-not-called-for-already-optimized-site.js: Added.
2208         (hello):
2209
2210 2015-08-03  Csaba Osztrogonác  <ossy@webkit.org>
2211
2212         [FTL] Remove unused scripts related to native call inlining
2213         https://bugs.webkit.org/show_bug.cgi?id=147448
2214
2215         Reviewed by Filip Pizlo.
2216
2217         * build-symbol-table-index.py: Removed.
2218         * copy-llvm-ir-to-derived-sources.sh: Removed.
2219         * create-llvm-ir-from-source-file.py: Removed.
2220         * create-symbol-table-index.py: Removed.
2221
2222 2015-08-02  Benjamin Poulain  <bpoulain@apple.com>
2223
2224         Investigate HashTable::HashTable(const HashTable&) and HashTable::operator=(const HashTable&) performance for hash-based static analyses
2225         https://bugs.webkit.org/show_bug.cgi?id=118455
2226
2227         Reviewed by Filip Pizlo.
2228
2229         LivenessAnalysisPhase lights up like a christmas tree in profiles.
2230
2231         This patch cuts its cost by 4.
2232         About half of the gains come from removing many rehash() when copying
2233         the HashSet.
2234         The last quarter is achieved by having a special add() function for initializing
2235         a HashSet.
2236
2237         This makes benchmarks progress by 1-2% here and there. Nothing massive.
2238
2239         * dfg/DFGLivenessAnalysisPhase.cpp:
2240         (JSC::DFG::LivenessAnalysisPhase::process):
2241         The m_live HashSet is only useful per block. When we are done with it,
2242         we can transfer it to liveAtHead to avoid a copy.
2243
2244 2015-08-01  Saam barati  <saambarati1@gmail.com>
2245
2246         Unreviewed. Remove unintentional "print" statement in test case.
2247         https://bugs.webkit.org/show_bug.cgi?id=142567
2248
2249         * tests/stress/class-syntax-definition-semantics.js:
2250         (shouldBeSyntaxError):
2251
2252 2015-07-31  Alex Christensen  <achristensen@webkit.org>
2253
2254         Prepare for VS2015
2255         https://bugs.webkit.org/show_bug.cgi?id=146579
2256
2257         Reviewed by Jon Honeycutt.
2258
2259         * heap/Heap.h:
2260         Fix compiler error by explicitly casting zombifiedBits to the size of a pointer.
2261
2262 2015-07-31  Saam barati  <saambarati1@gmail.com>
2263
2264         ES6 class syntax should use block scoping
2265         https://bugs.webkit.org/show_bug.cgi?id=142567
2266
2267         Reviewed by Geoffrey Garen.
2268
2269         We treat class declarations like we do "let" declarations.
2270         The class name is under TDZ until the class declaration
2271         statement is evaluated. Class declarations also follow
2272         the same rules as "let": No duplicate definitions inside
2273         a lexical environment.
2274
2275         * parser/ASTBuilder.h:
2276         (JSC::ASTBuilder::createClassDeclStatement):
2277         * parser/Parser.cpp:
2278         (JSC::Parser<LexerType>::parseClassDeclaration):
2279         * tests/stress/class-syntax-block-scoping.js: Added.
2280         (assert):
2281         (truth):
2282         (.):
2283         * tests/stress/class-syntax-definition-semantics.js: Added.
2284         (shouldBeSyntaxError):
2285         (shouldNotBeSyntaxError):
2286         (truth):
2287         * tests/stress/class-syntax-tdz.js:
2288         (assert):
2289         (shouldThrowTDZ):
2290         (truth):
2291         (.):
2292
2293 2015-07-31  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2294
2295         Implement WebAssembly module parser
2296         https://bugs.webkit.org/show_bug.cgi?id=147293
2297
2298         Reviewed by Mark Lam.
2299
2300         Re-landing after fix for the "..\..\jsc.cpp(46): fatal error C1083: Cannot open
2301         include file: 'JSWASMModule.h'" issue on Windows.
2302
2303         Implement WebAssembly module parser for WebAssembly files produced by pack-asmjs
2304         <https://github.com/WebAssembly/polyfill-prototype-1>. This patch only checks
2305         the magic number at the beginning of the files. Parsing of the rest will be
2306         implemented in a subsequent patch.
2307
2308         * CMakeLists.txt:
2309         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2310         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2311         * JavaScriptCore.xcodeproj/project.pbxproj:
2312         * jsc.cpp:
2313         (GlobalObject::finishCreation):
2314         (functionLoadWebAssembly):
2315         * parser/SourceProvider.h:
2316         (JSC::WebAssemblySourceProvider::create):
2317         (JSC::WebAssemblySourceProvider::data):
2318         (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
2319         * runtime/JSGlobalObject.cpp:
2320         (JSC::JSGlobalObject::init):
2321         (JSC::JSGlobalObject::visitChildren):
2322         * runtime/JSGlobalObject.h:
2323         (JSC::JSGlobalObject::wasmModuleStructure):
2324         * wasm/WASMMagicNumber.h: Added.
2325         * wasm/WASMModuleParser.cpp: Added.
2326         (JSC::WASMModuleParser::WASMModuleParser):
2327         (JSC::WASMModuleParser::parse):
2328         (JSC::WASMModuleParser::parseModule):
2329         (JSC::parseWebAssembly):
2330         * wasm/WASMModuleParser.h: Added.
2331         * wasm/WASMReader.cpp: Added.
2332         (JSC::WASMReader::readUnsignedInt32):
2333         (JSC::WASMReader::readFloat):
2334         (JSC::WASMReader::readDouble):
2335         * wasm/WASMReader.h: Added.
2336         (JSC::WASMReader::WASMReader):
2337
2338 2015-07-30  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2339
2340         Add the "wasm" directory to the Additional Include Directories for jsc.exe
2341         https://bugs.webkit.org/show_bug.cgi?id=147443
2342
2343         Reviewed by Mark Lam.
2344
2345         This patch should fix the "..\..\jsc.cpp(46): fatal error C1083:
2346         Cannot open include file: 'JSWASMModule.h'" error in the Windows build.
2347
2348         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
2349
2350 2015-07-30  Chris Dumez  <cdumez@apple.com>
2351
2352         Mark more classes as fast allocated
2353         https://bugs.webkit.org/show_bug.cgi?id=147440
2354
2355         Reviewed by Sam Weinig.
2356
2357         Mark more classes as fast allocated for performance. We heap-allocate
2358         objects of those types throughout the code base.
2359
2360         * API/JSCallbackObject.h:
2361         * API/ObjCCallbackFunction.mm:
2362         * bytecode/BytecodeKills.h:
2363         * bytecode/BytecodeLivenessAnalysis.h:
2364         * bytecode/CallLinkStatus.h:
2365         * bytecode/FullBytecodeLiveness.h:
2366         * bytecode/SamplingTool.h:
2367         * bytecompiler/BytecodeGenerator.h:
2368         * dfg/DFGBasicBlock.h:
2369         * dfg/DFGBlockMap.h:
2370         * dfg/DFGInPlaceAbstractState.h:
2371         * dfg/DFGThreadData.h:
2372         * heap/HeapVerifier.h:
2373         * heap/SlotVisitor.h:
2374         * parser/Lexer.h:
2375         * runtime/ControlFlowProfiler.h:
2376         * runtime/TypeProfiler.h:
2377         * runtime/TypeProfilerLog.h:
2378         * runtime/Watchdog.h:
2379
2380 2015-07-29  Filip Pizlo  <fpizlo@apple.com>
2381
2382         DFG::ArgumentsEliminationPhase should emit a PutStack for all of the GetStacks that the ByteCodeParser emitted
2383         https://bugs.webkit.org/show_bug.cgi?id=147433
2384         rdar://problem/21668986
2385
2386         Reviewed by Mark Lam.
2387
2388         Ideally, the ByteCodeParser would only emit SetArgument nodes for named arguments.  But
2389         currently that's not what it does - it emits a SetArgument for every argument that a varargs
2390         call may pass.  Each SetArgument gets turned into a GetStack.  This means that if
2391         ArgumentsEliminationPhase optimizes away PutStacks for those varargs arguments that didn't
2392         get passed or used, we get degenerate IR where we have a GetStack of something that didn't
2393         have a PutStack.
2394
2395         This fixes the bug by removing the code to optimize away PutStacks in
2396         ArgumentsEliminationPhase.
2397
2398         * dfg/DFGArgumentsEliminationPhase.cpp:
2399         * tests/stress/varargs-inlining-underflow.js: Added.
2400         (baz):
2401         (bar):
2402         (foo):
2403
2404 2015-07-29  Andy VanWagoner  <thetalecrafter@gmail.com>
2405
2406         Implement basic types for ECMAScript Internationalization API
2407         https://bugs.webkit.org/show_bug.cgi?id=146926
2408
2409         Reviewed by Benjamin Poulain.
2410
2411         Adds basic types for ECMA-402 2nd edition, but does not implement the full locale-aware features yet.
2412         http://www.ecma-international.org/ecma-402/2.0/ECMA-402.pdf
2413
2414         * CMakeLists.txt: Added new Intl files.
2415         * Configurations/FeatureDefines.xcconfig: Enable INTL.
2416         * DerivedSources.make: Added Intl files.
2417         * JavaScriptCore.xcodeproj/project.pbxproj: Added Intl files.
2418         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Added Intl files.
2419         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Added Intl files.
2420         * runtime/CommonIdentifiers.h: Added Collator, NumberFormat, and DateTimeFormat.
2421         * runtime/DateConstructor.cpp: Made Date.now public.
2422         * runtime/DateConstructor.h: Made Date.now public.
2423         * runtime/IntlCollator.cpp: Added.
2424         (JSC::IntlCollator::create):
2425         (JSC::IntlCollator::createStructure):
2426         (JSC::IntlCollator::IntlCollator):
2427         (JSC::IntlCollator::finishCreation):
2428         (JSC::IntlCollator::destroy):
2429         (JSC::IntlCollator::visitChildren):
2430         (JSC::IntlCollator::setBoundCompare):
2431         (JSC::IntlCollatorFuncCompare): Added placeholder implementation using codePointCompare.
2432         * runtime/IntlCollator.h: Added.
2433         (JSC::IntlCollator::constructor):
2434         (JSC::IntlCollator::boundCompare):
2435         * runtime/IntlCollatorConstructor.cpp: Added.
2436         (JSC::IntlCollatorConstructor::create):
2437         (JSC::IntlCollatorConstructor::createStructure):
2438         (JSC::IntlCollatorConstructor::IntlCollatorConstructor):
2439         (JSC::IntlCollatorConstructor::finishCreation):
2440         (JSC::constructIntlCollator): Added Collator constructor (10.1.2).
2441         (JSC::callIntlCollator): Added Collator constructor (10.1.2).
2442         (JSC::IntlCollatorConstructor::getConstructData):
2443         (JSC::IntlCollatorConstructor::getCallData):
2444         (JSC::IntlCollatorConstructor::getOwnPropertySlot):
2445         (JSC::IntlCollatorConstructorFuncSupportedLocalesOf): Added placeholder implementation returning [].
2446         (JSC::IntlCollatorConstructor::visitChildren):
2447         * runtime/IntlCollatorConstructor.h: Added.
2448         (JSC::IntlCollatorConstructor::collatorStructure):
2449         * runtime/IntlCollatorPrototype.cpp: Added.
2450         (JSC::IntlCollatorPrototype::create):
2451         (JSC::IntlCollatorPrototype::createStructure):
2452         (JSC::IntlCollatorPrototype::IntlCollatorPrototype):
2453         (JSC::IntlCollatorPrototype::finishCreation):
2454         (JSC::IntlCollatorPrototype::getOwnPropertySlot):
2455         (JSC::IntlCollatorPrototypeGetterCompare): Added compare getter (10.3.3)
2456         (JSC::IntlCollatorPrototypeFuncResolvedOptions): Added placeholder implementation returning {}.
2457         * runtime/IntlCollatorPrototype.h: Added.
2458         * runtime/IntlDateTimeFormat.cpp: Added.
2459         (JSC::IntlDateTimeFormat::create):
2460         (JSC::IntlDateTimeFormat::createStructure):
2461         (JSC::IntlDateTimeFormat::IntlDateTimeFormat):
2462         (JSC::IntlDateTimeFormat::finishCreation):
2463         (JSC::IntlDateTimeFormat::destroy):
2464         (JSC::IntlDateTimeFormat::visitChildren):
2465         (JSC::IntlDateTimeFormat::setBoundFormat):
2466         (JSC::IntlDateTimeFormatFuncFormatDateTime): Added placeholder implementation returning new Date(value).toString().
2467         * runtime/IntlDateTimeFormat.h: Added.
2468         (JSC::IntlDateTimeFormat::constructor):
2469         (JSC::IntlDateTimeFormat::boundFormat):
2470         * runtime/IntlDateTimeFormatConstructor.cpp: Added.
2471         (JSC::IntlDateTimeFormatConstructor::create):
2472         (JSC::IntlDateTimeFormatConstructor::createStructure):
2473         (JSC::IntlDateTimeFormatConstructor::IntlDateTimeFormatConstructor):
2474         (JSC::IntlDateTimeFormatConstructor::finishCreation):
2475         (JSC::constructIntlDateTimeFormat): Added DateTimeFormat constructor (12.1.2).
2476         (JSC::callIntlDateTimeFormat): Added DateTimeFormat constructor (12.1.2).
2477         (JSC::IntlDateTimeFormatConstructor::getConstructData):
2478         (JSC::IntlDateTimeFormatConstructor::getCallData):
2479         (JSC::IntlDateTimeFormatConstructor::getOwnPropertySlot):
2480         (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf): Added placeholder implementation returning [].
2481         (JSC::IntlDateTimeFormatConstructor::visitChildren):
2482         * runtime/IntlDateTimeFormatConstructor.h: Added.
2483         (JSC::IntlDateTimeFormatConstructor::dateTimeFormatStructure):
2484         * runtime/IntlDateTimeFormatPrototype.cpp: Added.
2485         (JSC::IntlDateTimeFormatPrototype::create):
2486         (JSC::IntlDateTimeFormatPrototype::createStructure):
2487         (JSC::IntlDateTimeFormatPrototype::IntlDateTimeFormatPrototype):
2488         (JSC::IntlDateTimeFormatPrototype::finishCreation):
2489         (JSC::IntlDateTimeFormatPrototype::getOwnPropertySlot):
2490         (JSC::IntlDateTimeFormatPrototypeGetterFormat): Added format getter (12.3.3).
2491         (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions): Added placeholder implementation returning {}.
2492         * runtime/IntlDateTimeFormatPrototype.h: Added.
2493         * runtime/IntlNumberFormat.cpp: Added.
2494         (JSC::IntlNumberFormat::create):
2495         (JSC::IntlNumberFormat::createStructure):
2496         (JSC::IntlNumberFormat::IntlNumberFormat):
2497         (JSC::IntlNumberFormat::finishCreation):
2498         (JSC::IntlNumberFormat::destroy):
2499         (JSC::IntlNumberFormat::visitChildren):
2500         (JSC::IntlNumberFormat::setBoundFormat):
2501         (JSC::IntlNumberFormatFuncFormatNumber): Added placeholder implementation returning Number(value).toString().
2502         * runtime/IntlNumberFormat.h: Added.
2503         (JSC::IntlNumberFormat::constructor):
2504         (JSC::IntlNumberFormat::boundFormat):
2505         * runtime/IntlNumberFormatConstructor.cpp: Added.
2506         (JSC::IntlNumberFormatConstructor::create):
2507         (JSC::IntlNumberFormatConstructor::createStructure):
2508         (JSC::IntlNumberFormatConstructor::IntlNumberFormatConstructor):
2509         (JSC::IntlNumberFormatConstructor::finishCreation):
2510         (JSC::constructIntlNumberFormat): Added NumberFormat constructor (11.1.2).
2511         (JSC::callIntlNumberFormat): Added NumberFormat constructor (11.1.2).
2512         (JSC::IntlNumberFormatConstructor::getConstructData):
2513         (JSC::IntlNumberFormatConstructor::getCallData):
2514         (JSC::IntlNumberFormatConstructor::getOwnPropertySlot):
2515         (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf): Added placeholder implementation returning [].
2516         (JSC::IntlNumberFormatConstructor::visitChildren):
2517         * runtime/IntlNumberFormatConstructor.h: Added.
2518         (JSC::IntlNumberFormatConstructor::numberFormatStructure):
2519         * runtime/IntlNumberFormatPrototype.cpp: Added.
2520         (JSC::IntlNumberFormatPrototype::create):
2521         (JSC::IntlNumberFormatPrototype::createStructure):
2522         (JSC::IntlNumberFormatPrototype::IntlNumberFormatPrototype):
2523         (JSC::IntlNumberFormatPrototype::finishCreation):
2524         (JSC::IntlNumberFormatPrototype::getOwnPropertySlot):
2525         (JSC::IntlNumberFormatPrototypeGetterFormat): Added format getter (11.3.3).
2526         (JSC::IntlNumberFormatPrototypeFuncResolvedOptions): Added placeholder implementation returning {}.
2527         * runtime/IntlNumberFormatPrototype.h: Added.
2528         * runtime/IntlObject.cpp:
2529         (JSC::IntlObject::create):
2530         (JSC::IntlObject::finishCreation): Added Collator, NumberFormat, and DateTimeFormat properties (8.1).
2531         (JSC::IntlObject::visitChildren):
2532         * runtime/IntlObject.h:
2533         (JSC::IntlObject::collatorConstructor):
2534         (JSC::IntlObject::collatorPrototype):
2535         (JSC::IntlObject::collatorStructure):
2536         (JSC::IntlObject::numberFormatConstructor):
2537         (JSC::IntlObject::numberFormatPrototype):
2538         (JSC::IntlObject::numberFormatStructure):
2539         (JSC::IntlObject::dateTimeFormatConstructor):
2540         (JSC::IntlObject::dateTimeFormatPrototype):
2541         (JSC::IntlObject::dateTimeFormatStructure):
2542         * runtime/JSGlobalObject.cpp:
2543         (JSC::JSGlobalObject::init):
2544
2545 2015-07-29  Commit Queue  <commit-queue@webkit.org>
2546
2547         Unreviewed, rolling out r187550.
2548         https://bugs.webkit.org/show_bug.cgi?id=147420
2549
2550         Broke Windows build (again) (Requested by smfr on #webkit).
2551
2552         Reverted changeset:
2553
2554         "Implement WebAssembly module parser"
2555         https://bugs.webkit.org/show_bug.cgi?id=147293
2556         http://trac.webkit.org/changeset/187550
2557
2558 2015-07-29  Basile Clement  <basile_clement@apple.com>
2559
2560         Remove native call inlining
2561         https://bugs.webkit.org/show_bug.cgi?id=147417
2562
2563         Rubber Stamped by Filip Pizlo.
2564
2565         * CMakeLists.txt:
2566         * dfg/DFGAbstractInterpreterInlines.h:
2567         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.
2568         * dfg/DFGByteCodeParser.cpp:
2569         (JSC::DFG::ByteCodeParser::handleCall): Deleted.
2570         * dfg/DFGClobberize.h:
2571         (JSC::DFG::clobberize): Deleted.
2572         * dfg/DFGDoesGC.cpp:
2573         (JSC::DFG::doesGC): Deleted.
2574         * dfg/DFGFixupPhase.cpp:
2575         (JSC::DFG::FixupPhase::fixupNode): Deleted.
2576         * dfg/DFGNode.h:
2577         (JSC::DFG::Node::hasHeapPrediction): Deleted.
2578         (JSC::DFG::Node::hasCellOperand): Deleted.
2579         * dfg/DFGNodeType.h:
2580         * dfg/DFGPredictionPropagationPhase.cpp:
2581         (JSC::DFG::PredictionPropagationPhase::propagate): Deleted.
2582         * dfg/DFGSafeToExecute.h:
2583         (JSC::DFG::safeToExecute): Deleted.
2584         * dfg/DFGSpeculativeJIT32_64.cpp:
2585         (JSC::DFG::SpeculativeJIT::compile): Deleted.
2586         * dfg/DFGSpeculativeJIT64.cpp:
2587         (JSC::DFG::SpeculativeJIT::compile): Deleted.
2588         * ftl/FTLCapabilities.cpp:
2589         (JSC::FTL::canCompile): Deleted.
2590         * ftl/FTLLowerDFGToLLVM.cpp:
2591         (JSC::FTL::DFG::LowerDFGToLLVM::lower): Deleted.
2592         (JSC::FTL::DFG::LowerDFGToLLVM::compileNode): Deleted.
2593         (JSC::FTL::DFG::LowerDFGToLLVM::compileNativeCallOrConstruct): Deleted.
2594         (JSC::FTL::DFG::LowerDFGToLLVM::getFunctionBySymbol): Deleted.
2595         (JSC::FTL::DFG::LowerDFGToLLVM::getModuleByPathForSymbol): Deleted.
2596         (JSC::FTL::DFG::LowerDFGToLLVM::didOverflowStack): Deleted.
2597         * ftl/FTLState.cpp:
2598         (JSC::FTL::State::State): Deleted.
2599         * ftl/FTLState.h:
2600         * runtime/BundlePath.cpp: Removed.
2601         (JSC::bundlePath): Deleted.
2602         * runtime/JSDataViewPrototype.cpp:
2603         (JSC::getData):
2604         (JSC::setData):
2605         * runtime/Options.h:
2606
2607 2015-07-29  Basile Clement  <basile_clement@apple.com>
2608
2609         Unreviewed, skipping a test that is too complex for its own good
2610         https://bugs.webkit.org/show_bug.cgi?id=147167
2611
2612         * tests/stress/math-pow-coherency.js:
2613
2614 2015-07-29  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2615
2616         Implement WebAssembly module parser
2617         https://bugs.webkit.org/show_bug.cgi?id=147293
2618
2619         Reviewed by Mark Lam.
2620
2621         Reupload the patch, since r187539 should fix the "Cannot open include file:
2622         'JSWASMModule.h'" issue in the Windows build.
2623
2624         * CMakeLists.txt:
2625         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2626         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2627         * JavaScriptCore.xcodeproj/project.pbxproj:
2628         * jsc.cpp:
2629         (GlobalObject::finishCreation):
2630         (functionLoadWebAssembly):
2631         * parser/SourceProvider.h:
2632         (JSC::WebAssemblySourceProvider::create):
2633         (JSC::WebAssemblySourceProvider::data):
2634         (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
2635         * runtime/JSGlobalObject.cpp:
2636         (JSC::JSGlobalObject::init):
2637         (JSC::JSGlobalObject::visitChildren):
2638         * runtime/JSGlobalObject.h:
2639         (JSC::JSGlobalObject::wasmModuleStructure):
2640         * wasm/WASMMagicNumber.h: Added.
2641         * wasm/WASMModuleParser.cpp: Added.
2642         (JSC::WASMModuleParser::WASMModuleParser):
2643         (JSC::WASMModuleParser::parse):
2644         (JSC::WASMModuleParser::parseModule):
2645         (JSC::parseWebAssembly):
2646         * wasm/WASMModuleParser.h: Added.
2647         * wasm/WASMReader.cpp: Added.
2648         (JSC::WASMReader::readUnsignedInt32):
2649         (JSC::WASMReader::readFloat):
2650         (JSC::WASMReader::readDouble):
2651         * wasm/WASMReader.h: Added.
2652         (JSC::WASMReader::WASMReader):
2653
2654 2015-07-29  Basile Clement  <basile_clement@apple.com>
2655
2656         Unreviewed, lower the number of test iterations to prevent timing out on Debug builds
2657         https://bugs.webkit.org/show_bug.cgi?id=147167
2658
2659         * tests/stress/math-pow-coherency.js:
2660
2661 2015-07-28  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2662
2663         Add the "wasm" directory to Visual Studio project files
2664         https://bugs.webkit.org/show_bug.cgi?id=147400
2665
2666         Reviewed by Simon Fraser.
2667
2668         This patch should fix the "Cannot open include file: 'JSWASMModule.h'" issue
2669         in the Windows build.
2670
2671         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
2672         * JavaScriptCore.vcxproj/copy-files.cmd:
2673
2674 2015-07-28  Commit Queue  <commit-queue@webkit.org>
2675
2676         Unreviewed, rolling out r187531.
2677         https://bugs.webkit.org/show_bug.cgi?id=147397
2678
2679         Broke Windows bild (Requested by smfr on #webkit).
2680
2681         Reverted changeset:
2682
2683         "Implement WebAssembly module parser"
2684         https://bugs.webkit.org/show_bug.cgi?id=147293
2685         http://trac.webkit.org/changeset/187531
2686
2687 2015-07-28  Benjamin Poulain  <bpoulain@apple.com>
2688
2689         Speed up the Stringifier::toJSON() fast case
2690         https://bugs.webkit.org/show_bug.cgi?id=147383
2691
2692         Reviewed by Andreas Kling.
2693
2694         * runtime/JSONObject.cpp:
2695         (JSC::Stringifier::toJSON):
2696         (JSC::Stringifier::toJSONImpl):
2697
2698 2015-07-28  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2699
2700         Implement WebAssembly module parser
2701         https://bugs.webkit.org/show_bug.cgi?id=147293
2702
2703         Reviewed by Geoffrey Garen.
2704
2705         Implement WebAssembly module parser for WebAssembly files produced by pack-asmjs
2706         <https://github.com/WebAssembly/polyfill-prototype-1>. This patch only checks
2707         the magic number at the beginning of the files. Parsing of the rest will be
2708         implemented in a subsequent patch.
2709
2710         * CMakeLists.txt:
2711         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2712         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2713         * JavaScriptCore.xcodeproj/project.pbxproj:
2714         * jsc.cpp:
2715         (GlobalObject::finishCreation):
2716         (functionLoadWebAssembly):
2717         * parser/SourceProvider.h:
2718         (JSC::WebAssemblySourceProvider::create):
2719         (JSC::WebAssemblySourceProvider::data):
2720         (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
2721         * runtime/JSGlobalObject.cpp:
2722         (JSC::JSGlobalObject::init):
2723         (JSC::JSGlobalObject::visitChildren):
2724         * runtime/JSGlobalObject.h:
2725         (JSC::JSGlobalObject::wasmModuleStructure):
2726         * wasm/WASMMagicNumber.h: Added.
2727         * wasm/WASMModuleParser.cpp: Added.
2728         (JSC::WASMModuleParser::WASMModuleParser):
2729         (JSC::WASMModuleParser::parse):
2730         (JSC::WASMModuleParser::parseModule):
2731         (JSC::parseWebAssembly):
2732         * wasm/WASMModuleParser.h: Added.
2733         * wasm/WASMReader.cpp: Added.
2734         (JSC::WASMReader::readUnsignedInt32):
2735         (JSC::WASMReader::readFloat):
2736         (JSC::WASMReader::readDouble):
2737         * wasm/WASMReader.h: Added.
2738         (JSC::WASMReader::WASMReader):
2739
2740 2015-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2741
2742         [ES6] Add ENABLE_ES6_MODULES compile time flag with the default value "false"
2743         https://bugs.webkit.org/show_bug.cgi?id=147350
2744
2745         Reviewed by Sam Weinig.
2746
2747         * Configurations/FeatureDefines.xcconfig:
2748
2749 2015-07-28  Saam barati  <saambarati1@gmail.com>
2750
2751         Make the type profiler work with lexical scoping and add tests
2752         https://bugs.webkit.org/show_bug.cgi?id=145438
2753
2754         Reviewed by Geoffrey Garen.
2755
2756         op_profile_type now knows how to resolve variables allocated within
2757         the local scope stack. This means it knows how to resolve "let"
2758         and "const" variables. Also, some refactoring was done inside
2759         the BytecodeGenerator to make writing code to support the type
2760         profiler much simpler and clearer.
2761
2762         * bytecode/CodeBlock.cpp:
2763         (JSC::CodeBlock::CodeBlock):
2764         * bytecode/CodeBlock.h:
2765         (JSC::CodeBlock::symbolTable): Deleted.
2766         * bytecode/UnlinkedCodeBlock.h:
2767         (JSC::UnlinkedCodeBlock::addExceptionHandler):
2768         (JSC::UnlinkedCodeBlock::exceptionHandler):
2769         (JSC::UnlinkedCodeBlock::vm):
2770         (JSC::UnlinkedCodeBlock::addArrayProfile):
2771         (JSC::UnlinkedCodeBlock::setSymbolTableConstantIndex): Deleted.
2772         (JSC::UnlinkedCodeBlock::symbolTableConstantIndex): Deleted.
2773         * bytecompiler/BytecodeGenerator.cpp:
2774         (JSC::BytecodeGenerator::BytecodeGenerator):
2775         (JSC::BytecodeGenerator::emitMove):
2776         (JSC::BytecodeGenerator::emitTypeProfilerExpressionInfo):
2777         (JSC::BytecodeGenerator::emitProfileType):
2778         (JSC::BytecodeGenerator::emitProfileControlFlow):
2779         (JSC::BytecodeGenerator::pushLexicalScopeInternal):
2780         * bytecompiler/BytecodeGenerator.h:
2781         (JSC::BytecodeGenerator::emitNodeForLeftHandSide):
2782         * bytecompiler/NodesCodegen.cpp:
2783         (JSC::ThisNode::emitBytecode):
2784         (JSC::ResolveNode::emitBytecode):
2785         (JSC::BracketAccessorNode::emitBytecode):
2786         (JSC::DotAccessorNode::emitBytecode):
2787         (JSC::FunctionCallValueNode::emitBytecode):
2788         (JSC::FunctionCallResolveNode::emitBytecode):
2789         (JSC::FunctionCallBracketNode::emitBytecode):
2790         (JSC::FunctionCallDotNode::emitBytecode):
2791         (JSC::CallFunctionCallDotNode::emitBytecode):
2792         (JSC::ApplyFunctionCallDotNode::emitBytecode):
2793         (JSC::PostfixNode::emitResolve):
2794         (JSC::PostfixNode::emitBracket):
2795         (JSC::PostfixNode::emitDot):
2796         (JSC::PrefixNode::emitResolve):
2797         (JSC::PrefixNode::emitBracket):
2798         (JSC::PrefixNode::emitDot):
2799         (JSC::ReadModifyResolveNode::emitBytecode):
2800         (JSC::AssignResolveNode::emitBytecode):
2801         (JSC::AssignDotNode::emitBytecode):
2802         (JSC::ReadModifyDotNode::emitBytecode):
2803         (JSC::AssignBracketNode::emitBytecode):
2804         (JSC::ReadModifyBracketNode::emitBytecode):
2805         (JSC::EmptyVarExpression::emitBytecode):
2806         (JSC::EmptyLetExpression::emitBytecode):
2807         (JSC::ForInNode::emitLoopHeader):
2808         (JSC::ForOfNode::emitBytecode):
2809         (JSC::ReturnNode::emitBytecode):
2810         (JSC::FunctionNode::emitBytecode):
2811         (JSC::BindingNode::bindValue):
2812         * dfg/DFGSpeculativeJIT32_64.cpp:
2813         (JSC::DFG::SpeculativeJIT::compile):
2814         * dfg/DFGSpeculativeJIT64.cpp:
2815         (JSC::DFG::SpeculativeJIT::compile):
2816         * jit/JITOpcodes.cpp:
2817         (JSC::JIT::emit_op_profile_type):
2818         * jit/JITOpcodes32_64.cpp:
2819         (JSC::JIT::emit_op_profile_type):
2820         * llint/LowLevelInterpreter32_64.asm:
2821         * llint/LowLevelInterpreter64.asm:
2822         * tests/typeProfiler/es6-block-scoping.js: Added.
2823         (noop):
2824         (arr):
2825         (wrapper.changeFoo):
2826         (wrapper.scoping):
2827         (wrapper.scoping2):
2828         (wrapper):
2829         * tests/typeProfiler/es6-classes.js: Added.
2830         (noop):
2831         (wrapper.Animal):
2832         (wrapper.Animal.prototype.methodA):
2833         (wrapper.Dog):
2834         (wrapper.Dog.prototype.methodB):
2835         (wrapper):
2836
2837 2015-07-28  Saam barati  <saambarati1@gmail.com>
2838
2839         Implement catch scope using lexical scoping constructs introduced with "let" scoping patch
2840         https://bugs.webkit.org/show_bug.cgi?id=146979
2841
2842         Reviewed by Geoffrey Garen.
2843
2844         Now that BytecodeGenerator has a notion of local scope depth,
2845         we can easily implement a catch scope that doesn't claim that
2846         all variables are dynamically scoped. This means that functions
2847         that use try/catch can have local variable resolution. This also
2848         means that all functions that use try/catch don't have all
2849         their variables marked as being captured.
2850
2851         Catch scopes now behave like a "let" scope (sans the TDZ logic) with a
2852         single variable. Catch scopes are now just JSLexicalEnvironments and the
2853         symbol table backing the catch scope knows that it corresponds to a catch scope.
2854
2855         * CMakeLists.txt:
2856         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2857         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2858         * JavaScriptCore.xcodeproj/project.pbxproj:
2859         * bytecode/CodeBlock.cpp:
2860         (JSC::CodeBlock::dumpBytecode):
2861         * bytecode/EvalCodeCache.h:
2862         (JSC::EvalCodeCache::isCacheable):
2863         * bytecompiler/BytecodeGenerator.cpp:
2864         (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
2865         (JSC::BytecodeGenerator::emitLoadGlobalObject):
2866         (JSC::BytecodeGenerator::pushLexicalScope):
2867         (JSC::BytecodeGenerator::pushLexicalScopeInternal):
2868         (JSC::BytecodeGenerator::popLexicalScope):
2869         (JSC::BytecodeGenerator::popLexicalScopeInternal):
2870         (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
2871         (JSC::BytecodeGenerator::variable):
2872         (JSC::BytecodeGenerator::resolveType):
2873         (JSC::BytecodeGenerator::emitResolveScope):
2874         (JSC::BytecodeGenerator::emitPopScope):
2875         (JSC::BytecodeGenerator::emitPopWithScope):
2876         (JSC::BytecodeGenerator::emitDebugHook):
2877         (JSC::BytecodeGenerator::popScopedControlFlowContext):
2878         (JSC::BytecodeGenerator::emitPushCatchScope):
2879         (JSC::BytecodeGenerator::emitPopCatchScope):
2880         (JSC::BytecodeGenerator::beginSwitch):
2881         (JSC::BytecodeGenerator::emitPopWithOrCatchScope): Deleted.
2882         * bytecompiler/BytecodeGenerator.h:
2883         (JSC::BytecodeGenerator::lastOpcodeID):
2884         * bytecompiler/NodesCodegen.cpp:
2885         (JSC::AssignResolveNode::emitBytecode):
2886         (JSC::WithNode::emitBytecode):
2887         (JSC::TryNode::emitBytecode):
2888         * debugger/DebuggerScope.cpp:
2889         (JSC::DebuggerScope::isCatchScope):
2890         (JSC::DebuggerScope::isFunctionNameScope):
2891         (JSC::DebuggerScope::isFunctionOrEvalScope):
2892         (JSC::DebuggerScope::caughtValue):
2893         * debugger/DebuggerScope.h:
2894         * inspector/ScriptDebugServer.cpp:
2895         (Inspector::ScriptDebugServer::exceptionOrCaughtValue):
2896         * interpreter/Interpreter.cpp:
2897         (JSC::Interpreter::execute):
2898         * jit/JITOpcodes.cpp:
2899         (JSC::JIT::emit_op_push_name_scope):
2900         * jit/JITOpcodes32_64.cpp:
2901         (JSC::JIT::emit_op_push_name_scope):
2902         * jit/JITOperations.cpp:
2903         * jit/JITOperations.h:
2904         * parser/ASTBuilder.h:
2905         (JSC::ASTBuilder::createContinueStatement):
2906         (JSC::ASTBuilder::createTryStatement):
2907         * parser/NodeConstructors.h:
2908         (JSC::ThrowNode::ThrowNode):
2909         (JSC::TryNode::TryNode):
2910         (JSC::FunctionParameters::FunctionParameters):
2911         * parser/Nodes.h:
2912         * parser/Parser.cpp:
2913         (JSC::Parser<LexerType>::parseTryStatement):
2914         * parser/SyntaxChecker.h:
2915         (JSC::SyntaxChecker::createBreakStatement):
2916         (JSC::SyntaxChecker::createContinueStatement):
2917         (JSC::SyntaxChecker::createTryStatement):
2918         (JSC::SyntaxChecker::createSwitchStatement):
2919         (JSC::SyntaxChecker::createWhileStatement):
2920         (JSC::SyntaxChecker::createWithStatement):
2921         * runtime/JSCatchScope.cpp:
2922         * runtime/JSCatchScope.h:
2923         (JSC::JSCatchScope::JSCatchScope): Deleted.
2924         (JSC::JSCatchScope::create): Deleted.
2925         (JSC::JSCatchScope::createStructure): Deleted.
2926         * runtime/JSFunctionNameScope.h:
2927         (JSC::JSFunctionNameScope::JSFunctionNameScope):
2928         * runtime/JSGlobalObject.cpp:
2929         (JSC::JSGlobalObject::init):
2930         (JSC::JSGlobalObject::visitChildren):
2931         * runtime/JSGlobalObject.h:
2932         (JSC::JSGlobalObject::withScopeStructure):
2933         (JSC::JSGlobalObject::strictEvalActivationStructure):
2934         (JSC::JSGlobalObject::activationStructure):
2935         (JSC::JSGlobalObject::functionNameScopeStructure):
2936         (JSC::JSGlobalObject::directArgumentsStructure):
2937         (JSC::JSGlobalObject::scopedArgumentsStructure):
2938         (JSC::JSGlobalObject::catchScopeStructure): Deleted.
2939         * runtime/JSNameScope.cpp:
2940         (JSC::JSNameScope::create):
2941         (JSC::JSNameScope::toThis):
2942         * runtime/JSNameScope.h:
2943         * runtime/JSObject.cpp:
2944         (JSC::JSObject::toThis):
2945         (JSC::JSObject::isFunctionNameScopeObject):
2946         (JSC::JSObject::isCatchScopeObject): Deleted.
2947         * runtime/JSObject.h:
2948         * runtime/JSScope.cpp:
2949         (JSC::JSScope::collectVariablesUnderTDZ):
2950         (JSC::JSScope::isLexicalScope):
2951         (JSC::JSScope::isCatchScope):
2952         (JSC::resolveModeName):
2953         * runtime/JSScope.h:
2954         * runtime/SymbolTable.cpp:
2955         (JSC::SymbolTable::SymbolTable):
2956         (JSC::SymbolTable::cloneScopePart):
2957         * runtime/SymbolTable.h:
2958         * tests/stress/const-semantics.js:
2959         (.):
2960
2961 2015-07-28  Filip Pizlo  <fpizlo@apple.com>
2962
2963         DFG::ArgumentsEliminationPhase has a redundant check for inserting CheckInBounds when converting GetByVal to GetStack in the inline non-varargs case
2964         https://bugs.webkit.org/show_bug.cgi?id=147373
2965
2966         Reviewed by Mark Lam.
2967
2968         The code was doing a check for "index >= inlineCallFrame->arguments.size() - 1" in code where
2969         safeToGetStack is true and we aren't in varargs context, but in a non-varargs context,
2970         safeToGetStack can only be true if "index < inlineCallFrame->arguments.size() - 1".
2971
2972         When converting a GetByVal to GetStack, there are three possibilities:
2973
2974         1) Impossible to convert. This can happen if the GetByVal is out-of-bounds of the things we
2975            know to have stored to the stack. For example, if we inline a function that does
2976            "arguments[42]" at a call that passes no arguments.
2977
2978         2) Possible to convert, but we cannot prove statically that the GetByVal was in bounds. This
2979            can happen for "arguments[42]" with no inline call frame (since we don't know statically
2980            how many arguments we will be passed) or in a varargs call frame.
2981
2982         3) Possible to convert, and we know statically that the GetByVal is in bounds. This can
2983            happen for "arguments[42]" if we have an inline call frame, and it's not a varargs call
2984            frame, and we know that the caller passed 42 or more arguments.
2985
2986         The way the phase handles this is it first determines that we're not in case (1). This is
2987         called safeToGetStack. safeToGetStack is true if we have case (2) or (3). For inline call
2988         frames that have no varargs, this means that safeToGetStack is true exactly when the GetByVal
2989         is in-bounds (i.e. case (3)).
2990
2991         But the phase was again doing a check for whether the index is in-bounds for non-varargs
2992         inline call frames even when safeToGetStack was true. That check is redundant and should be
2993         eliminated, since it makes the code confusing.
2994
2995         * dfg/DFGArgumentsEliminationPhase.cpp:
2996
2997 2015-07-28  Filip Pizlo  <fpizlo@apple.com>
2998
2999         DFG::PutStackSinkingPhase should be more aggressive about its "no GetStack until put" rule
3000         https://bugs.webkit.org/show_bug.cgi?id=147371
3001
3002         Reviewed by Mark Lam.
3003
3004         Two fixes:
3005
3006         - Make ConflictingFlush really mean that you can't load from the stack slot. This means not
3007           using ConflictingFlush for arguments.
3008
3009         - Assert that a GetStack never sees ConflictingFlush.
3010
3011         * dfg/DFGPutStackSinkingPhase.cpp:
3012
3013 2015-07-28  Basile Clement  <basile_clement@apple.com>
3014
3015         Misleading error message: "At least one digit must occur after a decimal point"
3016         https://bugs.webkit.org/show_bug.cgi?id=146238
3017
3018         Reviewed by Geoffrey Garen.
3019
3020         Interestingly, we had a comment explaining what this error message was
3021         about that is much clearer than the error message itself. This patch
3022         simply replaces the error message with the explanation from the
3023         comment.
3024
3025         * parser/Lexer.cpp:
3026         (JSC::Lexer<T>::lex):
3027
3028 2015-07-28  Basile Clement  <basile_clement@apple.com>
3029
3030         Simplify call linking
3031         https://bugs.webkit.org/show_bug.cgi?id=147363
3032
3033         Reviewed by Filip Pizlo.
3034
3035         Previously, we were passing both the CallLinkInfo and a
3036         (CodeSpecializationKind, RegisterPreservationMode) pair to the
3037         different call linking slow paths. However, the CallLinkInfo already
3038         has all of that information, and we don't gain anything by having them
3039         in additional static parameters - except possibly a very small
3040         performance gain in presence of inlining. However since those are
3041         already slow paths, this performance loss (if it exists) will not be
3042         visible in practice.
3043
3044         This patch removes the various specialized thunks and JIT operations
3045         for regular and polymorphic call linking with a single thunk and
3046         operation for each case. Moreover, it removes the four specialized
3047         virtual call thunks and operations with one virtual call thunk for each
3048         call link info, allowing for better branch prediction by the CPU and
3049         fixing a pre-existing FIXME.
3050
3051         * bytecode/CallLinkInfo.cpp:
3052         (JSC::CallLinkInfo::unlink):
3053         (JSC::CallLinkInfo::dummy): Deleted.
3054         * bytecode/CallLinkInfo.h:
3055         (JSC::CallLinkInfo::CallLinkInfo):
3056         (JSC::CallLinkInfo::registerPreservationMode):
3057         (JSC::CallLinkInfo::setUpCallFromFTL):
3058         (JSC::CallLinkInfo::setSlowStub):
3059         (JSC::CallLinkInfo::clearSlowStub):
3060         (JSC::CallLinkInfo::slowStub):
3061         * dfg/DFGDriver.cpp:
3062         (JSC::DFG::compileImpl):
3063         * dfg/DFGJITCompiler.cpp:
3064         (JSC::DFG::JITCompiler::link):
3065         * ftl/FTLJSCallBase.cpp:
3066         (JSC::FTL::JSCallBase::link):
3067         * jit/JITCall.cpp:
3068         (JSC::JIT::compileCallEvalSlowCase):
3069         (JSC::JIT::compileOpCall):
3070         (JSC::JIT::compileOpCallSlowCase):
3071         * jit/JITCall32_64.cpp:
3072         (JSC::JIT::compileCallEvalSlowCase):
3073         (JSC::JIT::compileOpCall):
3074         (JSC::JIT::compileOpCallSlowCase):
3075         * jit/JITOperations.cpp:
3076         * jit/JITOperations.h:
3077         (JSC::operationLinkFor): Deleted.
3078         (JSC::operationVirtualFor): Deleted.
3079         (JSC::operationLinkPolymorphicCallFor): Deleted.
3080         * jit/Repatch.cpp:
3081         (JSC::generateByIdStub):
3082         (JSC::linkSlowFor):
3083         (JSC::linkFor):
3084         (JSC::revertCall):
3085         (JSC::unlinkFor):
3086         (JSC::linkVirtualFor):
3087         (JSC::linkPolymorphicCall):
3088         * jit/Repatch.h:
3089         * jit/ThunkGenerators.cpp:
3090         (JSC::linkCallThunkGenerator):
3091         (JSC::linkPolymorphicCallThunkGenerator):
3092         (JSC::virtualThunkFor):
3093         (JSC::linkForThunkGenerator): Deleted.
3094         (JSC::linkConstructThunkGenerator): Deleted.
3095         (JSC::linkCallThatPreservesRegsThunkGenerator): Deleted.
3096         (JSC::linkConstructThatPreservesRegsThunkGenerator): Deleted.
3097         (JSC::linkPolymorphicCallForThunkGenerator): Deleted.
3098         (JSC::linkPolymorphicCallThatPreservesRegsThunkGenerator): Deleted.
3099         (JSC::virtualForThunkGenerator): Deleted.
3100         (JSC::virtualCallThunkGenerator): Deleted.
3101         (JSC::virtualConstructThunkGenerator): Deleted.
3102         (JSC::virtualCallThatPreservesRegsThunkGenerator): Deleted.
3103         (JSC::virtualConstructThatPreservesRegsThunkGenerator): Deleted.
3104         * jit/ThunkGenerators.h:
3105         (JSC::linkThunkGeneratorFor): Deleted.
3106         (JSC::linkPolymorphicCallThunkGeneratorFor): Deleted.
3107         (JSC::virtualThunkGeneratorFor): Deleted.
3108
3109 2015-07-28  Basile Clement  <basile_clement@apple.com>
3110
3111         stress/math-pow-with-constants.js fails in cloop
3112         https://bugs.webkit.org/show_bug.cgi?id=147167
3113
3114         Reviewed by Geoffrey Garen.
3115
3116         Baseline JIT, DFG and FTL are using a fast exponentiation fast path
3117         when computing Math.pow() with an integer exponent that is not taken in
3118         the LLInt (or the DFG abstract interpreter). This leads to the result
3119         of pow changing depending on the compilation tier or the fact that
3120         constant propagation kicks in, which is undesirable.
3121
3122         This patch adds the fast path to the slow operationMathPow in order to
3123         maintain an illusion of consistency.
3124
3125         * runtime/MathCommon.cpp:
3126         (JSC::operationMathPow):
3127         * tests/stress/math-pow-coherency.js: Added.
3128         (pow42):
3129         (build42AsDouble.opaqueAdd):
3130         (build42AsDouble):
3131         (powDouble42):
3132         (clobber):
3133         (pow42NoConstantFolding):
3134         (powDouble42NoConstantFolding):
3135
3136 2015-07-28  Joseph Pecoraro  <pecoraro@apple.com>
3137
3138         Web Inspector: Show Pseudo Elements in DOM Tree
3139         https://bugs.webkit.org/show_bug.cgi?id=139612
3140
3141         Reviewed by Timothy Hatcher.
3142
3143         * inspector/protocol/DOM.json:
3144         Add new properties to DOMNode if it is a pseudo element or if it has
3145         pseudo element children. Add new events for if a pseudo element is
3146         added or removed dynamically to an existing DOMNode.
3147
3148 2015-07-27  Filip Pizlo  <fpizlo@apple.com>
3149
3150         Add logging when executable code gets deallocated
3151         https://bugs.webkit.org/show_bug.cgi?id=147355
3152
3153         Reviewed by Mark Lam.
3154
3155         * ftl/FTLJITCode.cpp:
3156         (JSC::FTL::JITCode::~JITCode): Print something when this is freed.
3157         * jit/JITCode.cpp:
3158         (JSC::JITCodeWithCodeRef::~JITCodeWithCodeRef): Print something when this is freed.
3159
3160 2015-07-27  Filip Pizlo  <fpizlo@apple.com>
3161
3162         DFG::safeToExecute() cases for GetByOffset/PutByOffset don't handle clobbered structure abstract values correctly
3163         https://bugs.webkit.org/show_bug.cgi?id=147354
3164
3165         Reviewed by Michael Saboff.
3166
3167         If m_structure.isClobbered(), it means that we had a side effect that clobbered
3168         the abstract value but it may recover back to its original value at the next
3169         invalidation point. Since the invalidation point hasn't been reached yet, we need
3170         to conservatively treat the clobbered state as if it was top. At the invalidation
3171         point, the clobbered set will return back to being unclobbered.
3172
3173         In addition to fixing the bug, this introduces isInfinite(), which should be used
3174         in places where it's tempting to just use isTop().
3175
3176         * dfg/DFGSafeToExecute.h:
3177         (JSC::DFG::safeToExecute): Fix the bug.
3178         * dfg/DFGStructureAbstractValue.cpp:
3179         (JSC::DFG::StructureAbstractValue::contains): Switch to using isInfinite().
3180         (JSC::DFG::StructureAbstractValue::isSubsetOf): Switch to using isInfinite().
3181         (JSC::DFG::StructureAbstractValue::isSupersetOf): Switch to using isInfinite().
3182         (JSC::DFG::StructureAbstractValue::overlaps): Switch to using isInfinite().
3183         * dfg/DFGStructureAbstractValue.h:
3184         (JSC::DFG::StructureAbstractValue::isFinite): New convenience method.
3185         (JSC::DFG::StructureAbstractValue::isInfinite): New convenience method.
3186         (JSC::DFG::StructureAbstractValue::onlyStructure): Switch to using isInfinite().
3187
3188 2015-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3189
3190         [ES6] Implement Reflect.enumerate
3191         https://bugs.webkit.org/show_bug.cgi?id=147347
3192
3193         Reviewed by Sam Weinig.
3194
3195         This patch implements Reflect.enumerate.
3196         It returns the iterator that iterates the enumerable keys of the given object.
3197         It follows the for-in's enumeration order.
3198
3199         To implement it, we write down the same logic to the for-in's enumeration code in C++.
3200
3201         * CMakeLists.txt:
3202         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3203         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
3204         * JavaScriptCore.xcodeproj/project.pbxproj:
3205         * runtime/JSGlobalObject.cpp:
3206         (JSC::JSGlobalObject::init):
3207         (JSC::JSGlobalObject::visitChildren):
3208         * runtime/JSGlobalObject.h:
3209         (JSC::JSGlobalObject::propertyNameIteratorStructure):
3210         * runtime/JSPropertyNameIterator.cpp: Added.
3211         (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
3212         (JSC::JSPropertyNameIterator::clone):
3213         (JSC::JSPropertyNameIterator::create):
3214         (JSC::JSPropertyNameIterator::finishCreation):
3215         (JSC::JSPropertyNameIterator::visitChildren):
3216         (JSC::JSPropertyNameIterator::next):
3217         (JSC::propertyNameIteratorFuncNext):
3218         * runtime/JSPropertyNameIterator.h: Added.
3219         (JSC::JSPropertyNameIterator::createStructure):
3220         * runtime/ReflectObject.cpp:
3221         (JSC::reflectObjectEnumerate):
3222         * tests/stress/reflect-enumerate.js: Added.
3223         (shouldBe):
3224         (shouldThrow):
3225
3226 2015-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3227
3228         [ES6] Implement Reflect.preventExtensions
3229         https://bugs.webkit.org/show_bug.cgi?id=147331
3230
3231         Reviewed by Sam Weinig.
3232
3233         Implement Reflect.preventExtensions.
3234         This is different from Object.preventExensions.
3235
3236         1. When preventExtensions is called onto the non-object, it raises the TypeError.
3237         2. Reflect.preventExtensions does not raise the TypeError when the preventExtensions operation is failed.
3238
3239         For the (2) case, since there is no Proxy implementation currently, Reflect.preventExtensions always succeed.
3240
3241         * runtime/ReflectObject.cpp:
3242         (JSC::reflectObjectPreventExtensions):
3243         * tests/stress/reflect-prevent-extensions.js: Added.
3244         (shouldBe):
3245         (shouldThrow):
3246
3247 2015-07-27  Alex Christensen  <achristensen@webkit.org>
3248
3249         Use Ninja on Windows.
3250         https://bugs.webkit.org/show_bug.cgi?id=147228
3251
3252         Reviewed by Martin Robinson.
3253
3254         * CMakeLists.txt:
3255         Set the working directory when generating LowLevelInterpreterWin.asm to put LowLevelInterpreterWin.asm.sym in the right place.
3256
3257 2015-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3258
3259         SparseValueMap check is skipped when the butterfly's vectorLength is larger than the access-requested index
3260         https://bugs.webkit.org/show_bug.cgi?id=147265
3261
3262         Reviewed by Geoffrey Garen.
3263
3264         JSObject's vector holds the indexed values and we leverage it to represent stored values and holes.
3265         By checking that the given index is in-bound of the vector's length, we can look up the property fast.
3266         And for the sparse array, we have also the separated SparseValueMap to hold the pairs.
3267         And we need to take care that the length of the vector should not overlap the indices stored in the SparseValueMap.
3268
3269         The vector only holds the pure JS values to avoid additional checking for accessors when looking up the value
3270         from the vector. To achieve this, we also store the accessors (and attributed properties) to SparseValueMap
3271         even the index is less than MIN_SPARSE_ARRAY_INDEX.
3272
3273         As a result, if the length of the vector overlaps the indices of the accessors stored in the SparseValueMap,
3274         we accidentally skip the phase looking up from the SparseValueMap. Instead, we just load from the vector and
3275         if the loaded value is an array hole, we decide the given object does not have the value for the given index.
3276
3277         This patch fixes the problem.
3278         When defining the attributed value that index is smaller than the length of the vector, we throw away the vector
3279         and change the object to DictionaryIndexingMode. Since we can assume that indexed accessors rarely exist in
3280         practice, we expect this does not hurt the performance while keeping the fast property access system without
3281         checking the sparse map.
3282
3283         * runtime/JSObject.cpp:
3284         (JSC::JSObject::putDirectIndexBeyondVectorLength):
3285         * tests/stress/sparse-map-non-overlapping.js: Added.
3286         (shouldBe):
3287         (testing):
3288         (object.get 1000):
3289         * tests/stress/sparse-map-non-skip-getter-overriding.js: Added.
3290         (shouldBe):
3291         (obj.get 1):
3292         (testing):
3293         * tests/stress/sparse-map-non-skip.js: Added.
3294         (shouldBe):
3295         (testing):
3296         (testing2):
3297         (.get for):
3298
3299 2015-07-27  Saam barati  <saambarati1@gmail.com>
3300
3301         Reduce execution time for "let" and "const" tests
3302         https://bugs.webkit.org/show_bug.cgi?id=147291
3303
3304         Reviewed by Geoffrey Garen.
3305
3306         We don't need to loop so many times for things that will not make it
3307         into the DFG.  Also, we can loop a lot less for almost all the tests
3308         because they're mostly testing the bytecode generator.
3309
3310         * tests/stress/const-and-with-statement.js:
3311         * tests/stress/const-exception-handling.js:
3312         * tests/stress/const-loop-semantics.js:
3313         * tests/stress/const-not-strict-mode.js:
3314         * tests/stress/const-semantics.js:
3315         * tests/stress/const-tdz.js:
3316         * tests/stress/lexical-let-and-with-statement.js:
3317         * tests/stress/lexical-let-exception-handling.js:
3318         (assert):
3319         * tests/stress/lexical-let-loop-semantics.js:
3320         (assert):
3321         (shouldThrowTDZ):
3322         (.):
3323         * tests/stress/lexical-let-not-strict-mode.js:
3324         * tests/stress/lexical-let-semantics.js:
3325         (.):
3326         * tests/stress/lexical-let-tdz.js:
3327         (shouldThrowTDZ):
3328         (.):
3329
3330 2015-07-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3331
3332         Rename PropertyNameMode::Both to PropertyNameMode::StringsAndSymbols
3333         https://bugs.webkit.org/show_bug.cgi?id=147311
3334
3335         Reviewed by Sam Weinig.
3336
3337         To make the meaning clear in the user side (PropertyNameArray array(exec, PropertyNameMode::StringsAndSymbols)),
3338         this patch renames PropertyNameMode::Both to PropertyNameMode::StringsAndSymbols.
3339
3340         * bytecode/ObjectAllocationProfile.h:
3341         (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount):
3342         * runtime/EnumerationMode.h:
3343         * runtime/ObjectConstructor.cpp:
3344         (JSC::ownEnumerablePropertyKeys):
3345         (JSC::defineProperties):
3346         (JSC::objectConstructorSeal):
3347         (JSC::objectConstructorFreeze):
3348         (JSC::objectConstructorIsSealed):
3349         (JSC::objectConstructorIsFrozen):
3350         (JSC::ownPropertyKeys):
3351         * runtime/ReflectObject.cpp:
3352         (JSC::reflectObjectOwnKeys):
3353
3354 2015-07-27  Saam barati  <saambarati1@gmail.com>
3355
3356         Added a comment explaining that all "addVar()"s should happen before
3357         emitting bytecode for a function's default parameter expressions