Source/JavaScriptCore/ChangeLog

   1 2015-04-07  Filip Pizlo  <fpizlo@apple.com>
   2
   3         Constant folding of typed array properties should be handled by AI rather than strength reduction
   4         https://bugs.webkit.org/show_bug.cgi?id=143496
   5
   6         Reviewed by Geoffrey Garen.
   7
   8         Handling constant folding in AI is better because it precludes us from having to fixpoint the CFA
   9         phase and whatever other phase did the folding in order to find all constants.
  10
  11         This also removes the TypedArrayWatchpoint node type because we can just set the watchpoint
  12         directly.
  13
  14         This also fixes a bug in FTL lowering of GetTypedArrayByteOffset. The bug was previously not
  15         found because all of the tests for it involved the property getting constant folded. I found that
  16         the codegen was bad because an earlier version of the patch broke that constant folding. This
  17         adds a new test for that node type, which makes constant folding impossible by allocating a new
  18         typed array every type. The lesson here is: if you write a test for something, run the test with
  19         full IR dumps to make sure it's actually testing the thing you want it to test.
  20
  21         * dfg/DFGAbstractInterpreterInlines.h:
  22         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
  23         * dfg/DFGClobberize.h:
  24         (JSC::DFG::clobberize):
  25         * dfg/DFGConstantFoldingPhase.cpp:
  26         (JSC::DFG::ConstantFoldingPhase::foldConstants):
  27         * dfg/DFGDoesGC.cpp:
  28         (JSC::DFG::doesGC):
  29         * dfg/DFGFixupPhase.cpp:
  30         (JSC::DFG::FixupPhase::fixupNode):
  31         * dfg/DFGGraph.cpp:
  32         (JSC::DFG::Graph::dump):
  33         (JSC::DFG::Graph::tryGetFoldableView):
  34         (JSC::DFG::Graph::tryGetFoldableViewForChild1): Deleted.
  35         * dfg/DFGGraph.h:
  36         * dfg/DFGNode.h:
  37         (JSC::DFG::Node::hasTypedArray): Deleted.
  38         (JSC::DFG::Node::typedArray): Deleted.
  39         * dfg/DFGNodeType.h:
  40         * dfg/DFGPredictionPropagationPhase.cpp:
  41         (JSC::DFG::PredictionPropagationPhase::propagate):
  42         * dfg/DFGSafeToExecute.h:
  43         (JSC::DFG::safeToExecute):
  44         * dfg/DFGSpeculativeJIT.cpp:
  45         (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
  46         * dfg/DFGSpeculativeJIT32_64.cpp:
  47         (JSC::DFG::SpeculativeJIT::compile):
  48         * dfg/DFGSpeculativeJIT64.cpp:
  49         (JSC::DFG::SpeculativeJIT::compile):
  50         * dfg/DFGStrengthReductionPhase.cpp:
  51         (JSC::DFG::StrengthReductionPhase::handleNode):
  52         (JSC::DFG::StrengthReductionPhase::foldTypedArrayPropertyToConstant): Deleted.
  53         (JSC::DFG::StrengthReductionPhase::prepareToFoldTypedArray): Deleted.
  54         * dfg/DFGWatchpointCollectionPhase.cpp:
  55         (JSC::DFG::WatchpointCollectionPhase::handle):
  56         (JSC::DFG::WatchpointCollectionPhase::addLazily):
  57         * ftl/FTLCapabilities.cpp:
  58         (JSC::FTL::canCompile):
  59         * ftl/FTLLowerDFGToLLVM.cpp:
  60         (JSC::FTL::LowerDFGToLLVM::compileNode):
  61         (JSC::FTL::LowerDFGToLLVM::compileGetTypedArrayByteOffset):
  62         (JSC::FTL::LowerDFGToLLVM::typedArrayLength):
  63         * tests/stress/fold-typed-array-properties.js:
  64         (foo):
  65         * tests/stress/typed-array-byte-offset.js: Added.
  66         (foo):
  67
  68 2015-04-07  Matthew Mirman  <mmirman@apple.com>
  69
  70         Source and stack information should get appended only to native errors
  71         and should be added directly after construction rather than when thrown.
  72         This fixes frozen objects being unfrozen when thrown while conforming to
  73         ecma script standard and other browser behavior.
  74         rdar://problem/19927293
  75         https://bugs.webkit.org/show_bug.cgi?id=141871
  76
  77         Reviewed by Geoffrey Garen.
  78
  79         Appending stack, source, line, and column information to an object whenever that object is thrown
  80         is incorrect because it violates the ecma script standard for the behavior of throw.  Suppose for example
  81         that the object being thrown already has one of these properties or is frozen.  Adding the properties
  82         would then violate the frozen contract or overwrite those properties.  Other browsers do not do this,
  83         and doing this causes unnecessary performance hits in code with heavy use of the throw construct as
  84         a control flow construct rather than just an error reporting mechanism.
  85
  86         Because WebCore adds "native" errors which do not inherit from any JSC native error,
  87         appending the error properties as a seperate call after construction of the error is required
  88         to avoid having to manually truncate the stack and gather local source information due to
  89         the stack being extended by a nested call to construct one of the native jsc error.
  90
  91         * interpreter/Interpreter.cpp:
  92         (JSC::Interpreter::execute):
  93         * interpreter/Interpreter.h:
  94         * parser/ParserError.h:
  95         (JSC::ParserError::toErrorObject):
  96         * runtime/CommonIdentifiers.h:
  97         * runtime/Error.cpp:
  98         (JSC::createError):
  99         (JSC::createEvalError):
 100         (JSC::createRangeError):
 101         (JSC::createReferenceError):
 102         (JSC::createSyntaxError):
 103         (JSC::createTypeError):
 104         (JSC::createNotEnoughArgumentsError):
 105         (JSC::createURIError):
 106         (JSC::createOutOfMemoryError):
 107         (JSC::FindFirstCallerFrameWithCodeblockFunctor::FindFirstCallerFrameWithCodeblockFunctor):
 108         (JSC::FindFirstCallerFrameWithCodeblockFunctor::operator()):
 109         (JSC::FindFirstCallerFrameWithCodeblockFunctor::foundCallFrame):
 110         (JSC::FindFirstCallerFrameWithCodeblockFunctor::index):
 111         (JSC::addErrorInfoAndGetBytecodeOffset):  Added.
 112         (JSC::addErrorInfo): Added special case for appending complete error info
 113         to a newly constructed error object.
 114         * runtime/Error.h:
 115         * runtime/ErrorConstructor.cpp:
 116         (JSC::Interpreter::constructWithErrorConstructor):
 117         (JSC::Interpreter::callErrorConstructor):
 118         * runtime/ErrorInstance.cpp:
 119         (JSC::appendSourceToError): Moved from VM.cpp
 120         (JSC::FindFirstCallerFrameWithCodeblockFunctor::FindFirstCallerFrameWithCodeblockFunctor):
 121         (JSC::FindFirstCallerFrameWithCodeblockFunctor::operator()):
 122         (JSC::FindFirstCallerFrameWithCodeblockFunctor::foundCallFrame):
 123         (JSC::FindFirstCallerFrameWithCodeblockFunctor::index):
 124         (JSC::addErrorInfoAndGetBytecodeOffset):
 125         (JSC::ErrorInstance::finishCreation):
 126         * runtime/ErrorInstance.h:
 127         (JSC::ErrorInstance::create):
 128         * runtime/ErrorPrototype.cpp:
 129         (JSC::ErrorPrototype::finishCreation):
 130         * runtime/ExceptionFuzz.cpp:
 131         (JSC::doExceptionFuzzing):
 132         * runtime/ExceptionHelpers.cpp:
 133         (JSC::createError):
 134         (JSC::createInvalidFunctionApplyParameterError):
 135         (JSC::createInvalidInParameterError):
 136         (JSC::createInvalidInstanceofParameterError):
 137         (JSC::createNotAConstructorError):
 138         (JSC::createNotAFunctionError):
 139         (JSC::createNotAnObjectError):
 140         (JSC::throwOutOfMemoryError):
 141         (JSC::createStackOverflowError): Deleted.
 142         (JSC::createOutOfMemoryError): Deleted.
 143         * runtime/ExceptionHelpers.h:
 144         * runtime/JSArrayBufferConstructor.cpp:
 145         (JSC::constructArrayBuffer):
 146         * runtime/JSArrayBufferPrototype.cpp:
 147         (JSC::arrayBufferProtoFuncSlice):
 148         * runtime/JSGenericTypedArrayViewInlines.h:
 149         (JSC::JSGenericTypedArrayView<Adaptor>::create):
 150         (JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):
 151         * runtime/NativeErrorConstructor.cpp:
 152         (JSC::Interpreter::constructWithNativeErrorConstructor):
 153         (JSC::Interpreter::callNativeErrorConstructor):
 154         * runtime/VM.cpp:
 155         (JSC::VM::throwException):
 156         (JSC::appendSourceToError): Moved to Error.cpp
 157         (JSC::FindFirstCallerFrameWithCodeblockFunctor::FindFirstCallerFrameWithCodeblockFunctor): Deleted.
 158         (JSC::FindFirstCallerFrameWithCodeblockFunctor::operator()): Deleted.
 159         (JSC::FindFirstCallerFrameWithCodeblockFunctor::foundCallFrame): Deleted.
 160         (JSC::FindFirstCallerFrameWithCodeblockFunctor::index): Deleted.
 161         * tests/stress/freeze_leek.js: Added.
 162
 163 2015-04-07  Joseph Pecoraro  <pecoraro@apple.com>
 164
 165         Web Inspector: ES6: Show Symbol properties on Objects
 166         https://bugs.webkit.org/show_bug.cgi?id=141279
 167
 168         Reviewed by Timothy Hatcher.
 169
 170         * inspector/protocol/Runtime.json:
 171         Give PropertyDescriptor a reference to the Symbol RemoteObject
 172         if the property is a symbol property.
 173
 174         * inspector/InjectedScriptSource.js:
 175         Enumerate symbol properties on objects.
 176
 177 2015-04-07  Filip Pizlo  <fpizlo@apple.com>
 178
 179         Make it possible to enable LLVM FastISel
 180         https://bugs.webkit.org/show_bug.cgi?id=143489
 181
 182         Reviewed by Michael Saboff.
 183
 184         The decision to enable FastISel is made by Options.h|cpp, but the LLVM library can disable it if it finds that it is built
 185         against a version of LLVM that doesn't support it. Thereafter, JSC::enableLLVMFastISel is the flag that tells the system
 186         if we should enable it.
 187
 188         * ftl/FTLCompile.cpp:
 189         (JSC::FTL::mmAllocateDataSection):
 190         * llvm/InitializeLLVM.cpp:
 191         (JSC::initializeLLVMImpl):
 192         * llvm/InitializeLLVM.h:
 193         * llvm/InitializeLLVMLinux.cpp:
 194         (JSC::getLLVMInitializerFunction):
 195         (JSC::initializeLLVMImpl): Deleted.
 196         * llvm/InitializeLLVMMac.cpp:
 197         (JSC::getLLVMInitializerFunction):
 198         (JSC::initializeLLVMImpl): Deleted.
 199         * llvm/InitializeLLVMPOSIX.cpp:
 200         (JSC::getLLVMInitializerFunctionPOSIX):
 201         (JSC::initializeLLVMPOSIX): Deleted.
 202         * llvm/InitializeLLVMPOSIX.h:
 203         * llvm/InitializeLLVMWin.cpp:
 204         (JSC::getLLVMInitializerFunction):
 205         (JSC::initializeLLVMImpl): Deleted.
 206         * llvm/LLVMAPI.cpp:
 207         * llvm/LLVMAPI.h:
 208         * llvm/library/LLVMExports.cpp:
 209         (initCommandLine):
 210         (initializeAndGetJSCLLVMAPI):
 211         * runtime/Options.cpp:
 212         (JSC::Options::initialize):
 213
 214 2015-04-06  Yusuke Suzuki  <utatane.tea@gmail.com>
 215
 216         put_by_val_direct need to check the property is index or not for using putDirect / putDirectIndex
 217         https://bugs.webkit.org/show_bug.cgi?id=140426
 218
 219         Reviewed by Darin Adler.
 220
 221         In the put_by_val_direct operation, we use JSObject::putDirect.
 222         However, it only accepts non-index property. For index property, we need to use JSObject::putDirectIndex.
 223         This patch checks toString-ed Identifier is index or not to choose putDirect / putDirectIndex.
 224
 225         * dfg/DFGOperations.cpp:
 226         (JSC::DFG::putByVal):
 227         (JSC::DFG::operationPutByValInternal):
 228         * jit/JITOperations.cpp:
 229         * llint/LLIntSlowPaths.cpp:
 230         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 231         * runtime/Identifier.h:
 232         (JSC::isIndex):
 233         (JSC::parseIndex):
 234         * tests/stress/dfg-put-by-val-direct-with-edge-numbers.js: Added.
 235         (lookupWithKey):
 236         (toStringThrowsError.toString):
 237
 238 2015-04-06  Alberto Garcia  <berto@igalia.com>
 239
 240         [GTK] Fix HPPA build
 241         https://bugs.webkit.org/show_bug.cgi?id=143453
 242
 243         Reviewed by Darin Adler.
 244
 245         Add HPPA to the list of supported CPUs.
 246
 247         * CMakeLists.txt:
 248
 249 2015-04-06  Mark Lam  <mark.lam@apple.com>
 250
 251         In the 64-bit DFG and FTL, Array::Double case for HasIndexedProperty should set its result to true when all is well.
 252         <https://webkit.org/b/143396>
 253
 254         Reviewed by Filip Pizlo.
 255
 256         The DFG was neglecting to set the result boolean.  The FTL was setting it with
 257         an inverted value.  Both of these are now resolved.
 258
 259         * dfg/DFGSpeculativeJIT64.cpp:
 260         (JSC::DFG::SpeculativeJIT::compile):
 261         * ftl/FTLLowerDFGToLLVM.cpp:
 262         (JSC::FTL::LowerDFGToLLVM::compileHasIndexedProperty):
 263         * tests/stress/for-in-array-mode.js: Added.
 264         (.):
 265         (test):
 266
 267 2015-04-06  Yusuke Suzuki  <utatane.tea@gmail.com>
 268
 269         [ES6] DFG and FTL should be aware of that StringConstructor behavior for symbols becomes different from ToString
 270         https://bugs.webkit.org/show_bug.cgi?id=143424
 271
 272         Reviewed by Geoffrey Garen.
 273
 274         In ES6, StringConstructor behavior becomes different from ToString abstract operations in the spec. (and JSValue::toString).
 275
 276         ToString(symbol) throws a type error.
 277         However, String(symbol) produces SymbolDescriptiveString(symbol).
 278
 279         So, in DFG and FTL phase, they should not inline StringConstructor to ToString.
 280
 281         Now, in the template literals patch, ToString DFG operation is planned to be used.
 282         And current ToString behavior is aligned to the spec (and JSValue::toString) and it's better.
 283         So intead of changing ToString behavior, this patch adds CallStringConstructor operation into DFG and FTL.
 284         In CallStringConstructor, all behavior in DFG analysis is the same.
 285         Only the difference from ToString is, when calling DFG operation functions, it calls
 286         operationCallStringConstructorOnCell and operationCallStringConstructor instead of
 287         operationToStringOnCell and operationToString.
 288
 289         * dfg/DFGAbstractInterpreterInlines.h:
 290         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
 291         * dfg/DFGBackwardsPropagationPhase.cpp:
 292         (JSC::DFG::BackwardsPropagationPhase::propagate):
 293         * dfg/DFGByteCodeParser.cpp:
 294         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
 295         * dfg/DFGClobberize.h:
 296         (JSC::DFG::clobberize):
 297         * dfg/DFGDoesGC.cpp:
 298         (JSC::DFG::doesGC):
 299         * dfg/DFGFixupPhase.cpp:
 300         (JSC::DFG::FixupPhase::fixupNode):
 301         (JSC::DFG::FixupPhase::fixupToStringOrCallStringConstructor):
 302         (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
 303         (JSC::DFG::FixupPhase::fixupToString): Deleted.
 304         * dfg/DFGNodeType.h:
 305         * dfg/DFGOperations.cpp:
 306         * dfg/DFGOperations.h:
 307         * dfg/DFGPredictionPropagationPhase.cpp:
 308         (JSC::DFG::PredictionPropagationPhase::propagate):
 309         * dfg/DFGSafeToExecute.h:
 310         (JSC::DFG::safeToExecute):
 311         * dfg/DFGSpeculativeJIT.cpp:
 312         (JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOnCell):
 313         (JSC::DFG::SpeculativeJIT::compileToStringOnCell): Deleted.
 314         * dfg/DFGSpeculativeJIT.h:
 315         * dfg/DFGSpeculativeJIT32_64.cpp:
 316         (JSC::DFG::SpeculativeJIT::compile):
 317         * dfg/DFGSpeculativeJIT64.cpp:
 318         (JSC::DFG::SpeculativeJIT::compile):
 319         * dfg/DFGStructureRegistrationPhase.cpp:
 320         (JSC::DFG::StructureRegistrationPhase::run):
 321         * ftl/FTLCapabilities.cpp:
 322         (JSC::FTL::canCompile):
 323         * ftl/FTLLowerDFGToLLVM.cpp:
 324         (JSC::FTL::LowerDFGToLLVM::compileNode):
 325         (JSC::FTL::LowerDFGToLLVM::compileToStringOrCallStringConstructor):
 326         (JSC::FTL::LowerDFGToLLVM::compileToString): Deleted.
 327         * runtime/StringConstructor.cpp:
 328         (JSC::stringConstructor):
 329         (JSC::callStringConstructor):
 330         * runtime/StringConstructor.h:
 331         * tests/stress/symbol-and-string-constructor.js: Added.
 332         (performString):
 333
 334 2015-04-06  Yusuke Suzuki  <utatane.tea@gmail.com>
 335
 336         Return Optional<uint32_t> from PropertyName::asIndex
 337         https://bugs.webkit.org/show_bug.cgi?id=143422
 338
 339         Reviewed by Darin Adler.
 340
 341         PropertyName::asIndex returns uint32_t and use UINT_MAX as NotAnIndex.
 342         But it's not obvious to callers.
 343
 344         This patch changes
 345         1. PropertyName::asIndex() to return Optional<uint32_t> and
 346         2. function name `asIndex()` to `parseIndex()`.
 347         It forces callers to check the value is index or not explicitly.
 348
 349         * bytecode/GetByIdStatus.cpp:
 350         (JSC::GetByIdStatus::computeFor):
 351         * bytecode/PutByIdStatus.cpp:
 352         (JSC::PutByIdStatus::computeFor):
 353         * bytecompiler/BytecodeGenerator.cpp:
 354         (JSC::BytecodeGenerator::emitDirectPutById):
 355         * jit/Repatch.cpp:
 356         (JSC::emitPutTransitionStubAndGetOldStructure):
 357         * jsc.cpp:
 358         * runtime/ArrayPrototype.cpp:
 359         (JSC::arrayProtoFuncSort):
 360         * runtime/GenericArgumentsInlines.h:
 361         (JSC::GenericArguments<Type>::getOwnPropertySlot):
 362         (JSC::GenericArguments<Type>::put):
 363         (JSC::GenericArguments<Type>::deleteProperty):
 364         (JSC::GenericArguments<Type>::defineOwnProperty):
 365         * runtime/Identifier.h:
 366         (JSC::parseIndex):
 367         (JSC::Identifier::isSymbol):
 368         * runtime/JSArray.cpp:
 369         (JSC::JSArray::defineOwnProperty):
 370         * runtime/JSCJSValue.cpp:
 371         (JSC::JSValue::putToPrimitive):
 372         * runtime/JSGenericTypedArrayViewInlines.h:
 373         (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
 374         (JSC::JSGenericTypedArrayView<Adaptor>::put):
 375         (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
 376         (JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
 377         * runtime/JSObject.cpp:
 378         (JSC::JSObject::put):
 379         (JSC::JSObject::putDirectAccessor):
 380         (JSC::JSObject::putDirectCustomAccessor):
 381         (JSC::JSObject::deleteProperty):
 382         (JSC::JSObject::putDirectMayBeIndex):
 383         (JSC::JSObject::defineOwnProperty):
 384         * runtime/JSObject.h:
 385         (JSC::JSObject::getOwnPropertySlot):
 386         (JSC::JSObject::getPropertySlot):
 387         (JSC::JSObject::putDirectInternal):
 388         * runtime/JSString.cpp:
 389         (JSC::JSString::getStringPropertyDescriptor):
 390         * runtime/JSString.h:
 391         (JSC::JSString::getStringPropertySlot):
 392         * runtime/LiteralParser.cpp:
 393         (JSC::LiteralParser<CharType>::parse):
 394         * runtime/PropertyName.h:
 395         (JSC::parseIndex):
 396         (JSC::toUInt32FromCharacters): Deleted.
 397         (JSC::toUInt32FromStringImpl): Deleted.
 398         (JSC::PropertyName::asIndex): Deleted.
 399         * runtime/PropertyNameArray.cpp:
 400         (JSC::PropertyNameArray::add):
 401         * runtime/StringObject.cpp:
 402         (JSC::StringObject::deleteProperty):
 403         * runtime/Structure.cpp:
 404         (JSC::Structure::prototypeChainMayInterceptStoreTo):
 405
 406 2015-04-05  Andreas Kling  <akling@apple.com>
 407
 408         URI encoding/escaping should use efficient string building instead of calling snprintf().
 409         <https://webkit.org/b/143426>
 410
 411         Reviewed by Gavin Barraclough.
 412
 413         I saw 0.5% of main thread time in snprintf() on <http://polymerlabs.github.io/benchmarks/>
 414         which seemed pretty silly. This change gets that down to nothing in favor of using our
 415         existing JSStringBuilder and HexNumber.h facilities.
 416
 417         These APIs are well-exercised by our existing test suite.
 418
 419         * runtime/JSGlobalObjectFunctions.cpp:
 420         (JSC::encode):
 421         (JSC::globalFuncEscape):
 422
 423 2015-04-05  Masataka Yakura  <masataka.yakura@gmail.com>
 424
 425         documentation for ES Promises points to the wrong one
 426         https://bugs.webkit.org/show_bug.cgi?id=143263
 427
 428         Reviewed by Darin Adler.
 429
 430         * features.json:
 431
 432 2015-04-05  Simon Fraser  <simon.fraser@apple.com>
 433
 434         Remove "go ahead and" from comments
 435         https://bugs.webkit.org/show_bug.cgi?id=143421
 436
 437         Reviewed by Darin Adler, Benjamin Poulain.
 438
 439         Remove the phrase "go ahead and" from comments where it doesn't add
 440         anything (which is almost all of them).
 441
 442         * interpreter/JSStack.cpp:
 443         (JSC::JSStack::growSlowCase):
 444
 445 2015-04-04  Andreas Kling  <akling@apple.com>
 446
 447         Logically empty WeakBlocks should not pin down their MarkedBlocks indefinitely.
 448         <https://webkit.org/b/143210>
 449
 450         Reviewed by Geoffrey Garen.
 451
 452         Since a MarkedBlock cannot be destroyed until all the WeakBlocks pointing into it are gone,
 453         we had a little problem where WeakBlocks with only null pointers would still keep their
 454         MarkedBlock alive.
 455
 456         This patch fixes that by detaching WeakBlocks from their MarkedBlock once a sweep discovers
 457         that the WeakBlock contains no pointers to live objects. Ownership of the WeakBlock is passed
 458         to the Heap, which will sweep the list of these detached WeakBlocks as part of a full GC,
 459         destroying them once they're fully dead.
 460
 461         This allows the garbage collector to reclaim the 64kB MarkedBlocks much sooner, and resolves
 462         a mysterious issue where doing two full garbage collections back-to-back would free additional
 463         memory in the second collection.
 464
 465         Management of detached WeakBlocks is implemented as a Vector<WeakBlock*> in Heap, along with
 466         an index of the next block in that vector that needs to be swept. The IncrementalSweeper then
 467         calls into Heap::sweepNextLogicallyEmptyWeakBlock() to sweep one block at a time.
 468
 469         * heap/Heap.h:
 470         * heap/Heap.cpp:
 471         (JSC::Heap::collectAllGarbage): Add a final pass where we sweep the logically empty WeakBlocks
 472         owned by Heap, after everything else has been swept.
 473
 474         (JSC::Heap::notifyIncrementalSweeper): Set up an incremental sweep of logically empty WeakBlocks
 475         after a full garbage collection ends. Note that we don't do this after Eden collections, since
 476         they are unlikely to cause entire WeakBlocks to go empty.
 477
 478         (JSC::Heap::addLogicallyEmptyWeakBlock): Added. Interface for passing ownership of a WeakBlock
 479         to the Heap when it's detached from a WeakSet.
 480
 481         (JSC::Heap::sweepAllLogicallyEmptyWeakBlocks): Helper for collectAllGarbage() that sweeps all
 482         of the logically empty WeakBlocks owned by Heap.
 483
 484         (JSC::Heap::sweepNextLogicallyEmptyWeakBlock): Sweeps one logically empty WeakBlock if needed
 485         and updates the next-logically-empty-weak-block-to-sweep index.
 486
 487         (JSC::Heap::lastChanceToFinalize): call sweepAllLogicallyEmptyWeakBlocks() here, since there
 488         won't be another chance after this.
 489
 490         * heap/IncrementalSweeper.h:
 491         (JSC::IncrementalSweeper::hasWork): Deleted.
 492
 493         * heap/IncrementalSweeper.cpp:
 494         (JSC::IncrementalSweeper::fullSweep):
 495         (JSC::IncrementalSweeper::doSweep):
 496         (JSC::IncrementalSweeper::sweepNextBlock): Restructured IncrementalSweeper a bit to simplify
 497         adding a new sweeping stage for the Heap's logically empty WeakBlocks. sweepNextBlock() is
 498         changed to return a bool (true if there's more work to be done.)
 499
 500         * heap/WeakBlock.cpp:
 501         (JSC::WeakBlock::sweep): This now figures out if the WeakBlock is logically empty, i.e doesn't
 502         contain any pointers to live objects. The answer is stored in a new SweepResult member.
 503
 504         * heap/WeakBlock.h:
 505         (JSC::WeakBlock::isLogicallyEmptyButNotFree): Added. Can be queried after a sweep to determine
 506         if the WeakBlock could be detached from the MarkedBlock.
 507
 508         (JSC::WeakBlock::SweepResult::SweepResult): Deleted in favor of initializing member variables
 509         when declaring them.
 510
 511 2015-04-04  Yusuke Suzuki  <utatane.tea@gmail.com>
 512
 513         Implement ES6 Object.getOwnPropertySymbols
 514         https://bugs.webkit.org/show_bug.cgi?id=141106
 515
 516         Reviewed by Geoffrey Garen.
 517
 518         This patch implements `Object.getOwnPropertySymbols`.
 519         One technical issue is that, since we use private symbols (such as `@Object`) in the
 520         privileged JS code in `builtins/`, they should not be exposed.
 521         To distinguish them from the usual symbols, check the target `StringImpl*` is a not private name
 522         before adding it into PropertyNameArray.
 523
 524         To check the target `StringImpl*` is a private name, we leverage privateToPublic map in `BuiltinNames`
 525         since all private symbols are held in this map.
 526
 527         * builtins/BuiltinExecutables.cpp:
 528         (JSC::BuiltinExecutables::createExecutableInternal):
 529         * builtins/BuiltinNames.h:
 530         (JSC::BuiltinNames::isPrivateName):
 531         * runtime/CommonIdentifiers.cpp:
 532         (JSC::CommonIdentifiers::isPrivateName):
 533         * runtime/CommonIdentifiers.h:
 534         * runtime/EnumerationMode.h:
 535         (JSC::EnumerationMode::EnumerationMode):
 536         (JSC::EnumerationMode::includeSymbolProperties):
 537         * runtime/ExceptionHelpers.cpp:
 538         (JSC::createUndefinedVariableError):
 539         * runtime/JSGlobalObject.cpp:
 540         (JSC::JSGlobalObject::init):
 541         * runtime/JSLexicalEnvironment.cpp:
 542         (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
 543         * runtime/JSSymbolTableObject.cpp:
 544         (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
 545         * runtime/ObjectConstructor.cpp:
 546         (JSC::ObjectConstructor::finishCreation):
 547         (JSC::objectConstructorGetOwnPropertySymbols):
 548         (JSC::defineProperties):
 549         (JSC::objectConstructorSeal):
 550         (JSC::objectConstructorFreeze):
 551         (JSC::objectConstructorIsSealed):
 552         (JSC::objectConstructorIsFrozen):
 553         * runtime/ObjectConstructor.h:
 554         (JSC::ObjectConstructor::create):
 555         * runtime/Structure.cpp:
 556         (JSC::Structure::getPropertyNamesFromStructure):
 557         * tests/stress/object-get-own-property-symbols-perform-to-object.js: Added.
 558         (compare):
 559         * tests/stress/object-get-own-property-symbols.js: Added.
 560         (forIn):
 561         * tests/stress/symbol-define-property.js: Added.
 562         (testSymbol):
 563         * tests/stress/symbol-seal-and-freeze.js: Added.
 564         * tests/stress/symbol-with-json.js: Added.
 565
 566 2015-04-03  Mark Lam  <mark.lam@apple.com>
 567
 568         Add Options::jitPolicyScale() as a single knob to make all compilations happen sooner.
 569         <https://webkit.org/b/143385>
 570
 571         Reviewed by Geoffrey Garen.
 572
 573         For debugging purposes, sometimes, we want to be able to make compilation happen
 574         sooner to see if we can accelerate the manifestation of certain events / bugs.
 575         Currently, in order to achieve this, we'll have to tweak multiple JIT thresholds
 576         which make up the compilation policy.  Let's add a single knob that can tune all
 577         the thresholds up / down in one go proportionately so that we can easily tweak
 578         how soon compilation occurs.
 579
 580         * runtime/Options.cpp:
 581         (JSC::scaleJITPolicy):
 582         (JSC::recomputeDependentOptions):
 583         * runtime/Options.h:
 584
 585 2015-04-03  Geoffrey Garen  <ggaren@apple.com>
 586
 587         is* API methods should be @properties
 588         https://bugs.webkit.org/show_bug.cgi?id=143388
 589
 590         Reviewed by Mark Lam.
 591
 592         This appears to be the preferred idiom in WebKit, CA, AppKit, and
 593         Foundation.
 594
 595         * API/JSValue.h: Be @properties.
 596
 597         * API/tests/testapi.mm:
 598         (testObjectiveCAPI): Use the @properties.
 599
 600 2015-04-03  Mark Lam  <mark.lam@apple.com>
 601
 602         Some JSC Options refactoring and enhancements.
 603         <https://webkit.org/b/143384>
 604
 605         Rubber stamped by Benjamin Poulain.
 606
 607         Create a better encapsulated Option class to make working with options easier.  This
 608         is a building block towards a JIT policy scaling debugging option I will introduce later.
 609
 610         This work entails:
 611         1. Convert Options::Option into a public class Option (who works closely with Options).
 612         2. Convert Options::EntryType into an enum class Options::Type and make it public.
 613         3. Renamed Options::OPT_<option name> to Options::<option name>ID because it reads better.
 614         4. Add misc methods to class Option to make it more useable.
 615
 616         * runtime/Options.cpp:
 617         (JSC::Options::dumpOption):
 618         (JSC::Option::dump):
 619         (JSC::Option::operator==):
 620         (JSC::Options::Option::dump): Deleted.
 621         (JSC::Options::Option::operator==): Deleted.
 622         * runtime/Options.h:
 623         (JSC::Option::Option):
 624         (JSC::Option::operator!=):
 625         (JSC::Option::name):
 626         (JSC::Option::description):
 627         (JSC::Option::type):
 628         (JSC::Option::isOverridden):
 629         (JSC::Option::defaultOption):
 630         (JSC::Option::boolVal):
 631         (JSC::Option::unsignedVal):
 632         (JSC::Option::doubleVal):
 633         (JSC::Option::int32Val):
 634         (JSC::Option::optionRangeVal):
 635         (JSC::Option::optionStringVal):
 636         (JSC::Option::gcLogLevelVal):
 637         (JSC::Options::Option::Option): Deleted.
 638         (JSC::Options::Option::operator!=): Deleted.
 639
 640 2015-04-03  Geoffrey Garen  <ggaren@apple.com>
 641
 642         JavaScriptCore API should support type checking for Array and Date
 643         https://bugs.webkit.org/show_bug.cgi?id=143324
 644
 645         Follow-up to address a comment by Dan.
 646
 647         * API/WebKitAvailability.h: __MAC_OS_X_VERSION_MIN_REQUIRED <= 101100
 648         is wrong, since this API is available when __MAC_OS_X_VERSION_MIN_REQUIRED
 649         is equal to 101100.
 650
 651 2015-04-03  Geoffrey Garen  <ggaren@apple.com>
 652
 653         JavaScriptCore API should support type checking for Array and Date
 654         https://bugs.webkit.org/show_bug.cgi?id=143324
 655
 656         Follow-up to address a comment by Dan.
 657
 658         * API/WebKitAvailability.h: Do use 10.0 because it was right all along.
 659         Added a comment explaining why.
 660
 661 2015-04-03  Csaba Osztrogonác  <ossy@webkit.org>
 662
 663         FTL JIT tests should fail if LLVM library isn't available
 664         https://bugs.webkit.org/show_bug.cgi?id=143374
 665
 666         Reviewed by Mark Lam.
 667
 668         * dfg/DFGPlan.cpp:
 669         (JSC::DFG::Plan::compileInThreadImpl):
 670         * runtime/Options.h:
 671
 672 2015-04-03  Zan Dobersek  <zdobersek@igalia.com>
 673
 674         Fix the EFL and GTK build after r182243
 675         https://bugs.webkit.org/show_bug.cgi?id=143361
 676
 677         Reviewed by Csaba Osztrogonác.
 678
 679         * CMakeLists.txt: InspectorBackendCommands.js is generated in the
 680         DerivedSources/JavaScriptCore/inspector/ directory.
 681
 682 2015-04-03  Zan Dobersek  <zdobersek@igalia.com>
 683
 684         Unreviewed, fixing Clang builds of the GTK port on Linux.
 685
 686         * runtime/Options.cpp:
 687         Include the <math.h> header for isnan().
 688
 689 2015-04-02  Mark Lam  <mark.lam@apple.com>
 690
 691         Enhance ability to dump JSC Options.
 692         <https://webkit.org/b/143357>
 693
 694         Reviewed by Benjamin Poulain.
 695
 696         Some enhancements to how the JSC options work:
 697
 698         1. Add a JSC_showOptions option which take values: 0 = None, 1 = Overridden only,
 699            2 = All, 3 = Verbose.
 700
 701            The default is 0 (None).  This dumps nothing.
 702            With the Overridden setting, at VM initialization time, we will dump all
 703            option values that have been changed from their default.
 704            With the All setting, at VM initialization time, we will dump all option values.
 705            With the Verbose setting, at VM initialization time, we will dump all option
 706            values along with their descriptions (if available).
 707
 708         2. We now store a copy of the default option values.
 709
 710            We later use this for comparison to tell if an option has been overridden, and
 711            print the default value for reference.  As a result, we no longer need the
 712            didOverride flag since we can compute whether the option is overridden at any time.
 713
 714         3. Added description strings to some options to be printed when JSC_showOptions=3 (Verbose).
 715
 716            This will come in handy later when we want to rename some of the options to more sane
 717            names that are easier to remember.  For example, we can change
 718            Options::dfgFunctionWhitelistFile() to Options::dfgWhiteList(), and
 719            Options::slowPathAllocsBetweenGCs() to Options::forcedGcRate().  With the availability
 720            of the description, we can afford to use shorter and less descriptive option names,
 721            but they will be easier to remember and use for day to day debugging work.
 722
 723            In this patch, I did not change the names of any of the options yet.  I only added
 724            description strings for options that I know about, and where I think the option name
 725            isn't already descriptive enough.
 726
 727         4. Also deleted some unused code.
 728
 729         * jsc.cpp:
 730         (CommandLine::parseArguments):
 731         * runtime/Options.cpp:
 732         (JSC::Options::initialize):
 733         (JSC::Options::setOption):
 734         (JSC::Options::dumpAllOptions):
 735         (JSC::Options::dumpOption):
 736         (JSC::Options::Option::dump):
 737         (JSC::Options::Option::operator==):
 738         * runtime/Options.h:
 739         (JSC::OptionRange::rangeString):
 740         (JSC::Options::Option::Option):
 741         (JSC::Options::Option::operator!=):
 742
 743 2015-04-02  Geoffrey Garen  <ggaren@apple.com>
 744
 745         JavaScriptCore API should support type checking for Array and Date
 746         https://bugs.webkit.org/show_bug.cgi?id=143324
 747
 748         Reviewed by Darin Adler, Sam Weinig, Dan Bernstein.
 749
 750         * API/JSValue.h:
 751         * API/JSValue.mm:
 752         (-[JSValue isArray]):
 753         (-[JSValue isDate]): Added an ObjC API.
 754
 755         * API/JSValueRef.cpp:
 756         (JSValueIsArray):
 757         (JSValueIsDate):
 758         * API/JSValueRef.h: Added a C API.
 759
 760         * API/WebKitAvailability.h: Brought our availability macros up to date
 761         and fixed a harmless bug where "10_10" translated to "10.0".
 762
 763         * API/tests/testapi.c:
 764         (main): Added a test and corrected a pre-existing leak.
 765
 766         * API/tests/testapi.mm:
 767         (testObjectiveCAPI): Added a test.
 768
 769 2015-04-02  Mark Lam  <mark.lam@apple.com>
 770
 771         Add Options::dumpSourceAtDFGTime().
 772         <https://webkit.org/b/143349>
 773
 774         Reviewed by Oliver Hunt, and Michael Saboff.
 775
 776         Sometimes, we will want to see the JS source code that we're compiling, and it
 777         would be nice to be able to do this without having to jump thru a lot of hoops.
 778         So, let's add a Options::dumpSourceAtDFGTime() option just like we have a
 779         Options::dumpBytecodeAtDFGTime() option.
 780
 781         Also added versions of CodeBlock::dumpSource() and CodeBlock::dumpBytecode()
 782         that explicitly take no arguments (instead of relying on the version that takes
 783         the default argument).  These versions are friendlier to use when we want to call
 784         them from an interactive debugging session.
 785
 786         * bytecode/CodeBlock.cpp:
 787         (JSC::CodeBlock::dumpSource):
 788         (JSC::CodeBlock::dumpBytecode):
 789         * bytecode/CodeBlock.h:
 790         * dfg/DFGByteCodeParser.cpp:
 791         (JSC::DFG::ByteCodeParser::parseCodeBlock):
 792         * runtime/Options.h:
 793
 794 2015-04-02  Yusuke Suzuki  <utatane.tea@gmail.com>
 795
 796         Clean up EnumerationMode to easily extend
 797         https://bugs.webkit.org/show_bug.cgi?id=143276
 798
 799         Reviewed by Geoffrey Garen.
 800
 801         To make the followings easily,
 802         1. Adding new flag Include/ExcludeSymbols in the Object.getOwnPropertySymbols patch
 803         2. Make ExcludeSymbols implicitly default for the existing flags
 804         we encapsulate EnumerationMode flags into EnumerationMode class.
 805
 806         And this class manages 2 flags. Later it will be extended to 3.
 807         1. DontEnumPropertiesMode (default is Exclude)
 808         2. JSObjectPropertiesMode (default is Include)
 809         3. SymbolPropertiesMode (default is Exclude)
 810             SymbolPropertiesMode will be added in Object.getOwnPropertySymbols patch.
 811
 812         This patch replaces places using ExcludeDontEnumProperties
 813         to EnumerationMode() value which represents default mode.
 814
 815         * API/JSCallbackObjectFunctions.h:
 816         (JSC::JSCallbackObject<Parent>::getOwnNonIndexPropertyNames):
 817         * API/JSObjectRef.cpp:
 818         (JSObjectCopyPropertyNames):
 819         * bindings/ScriptValue.cpp:
 820         (Deprecated::jsToInspectorValue):
 821         * bytecode/ObjectAllocationProfile.h:
 822         (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount):
 823         * runtime/ArrayPrototype.cpp:
 824         (JSC::arrayProtoFuncSort):
 825         * runtime/EnumerationMode.h:
 826         (JSC::EnumerationMode::EnumerationMode):
 827         (JSC::EnumerationMode::includeDontEnumProperties):
 828         (JSC::EnumerationMode::includeJSObjectProperties):
 829         (JSC::shouldIncludeDontEnumProperties): Deleted.
 830         (JSC::shouldExcludeDontEnumProperties): Deleted.
 831         (JSC::shouldIncludeJSObjectPropertyNames): Deleted.
 832         (JSC::modeThatSkipsJSObject): Deleted.
 833         * runtime/GenericArgumentsInlines.h:
 834         (JSC::GenericArguments<Type>::getOwnPropertyNames):
 835         * runtime/JSArray.cpp:
 836         (JSC::JSArray::getOwnNonIndexPropertyNames):
 837         * runtime/JSArrayBuffer.cpp:
 838         (JSC::JSArrayBuffer::getOwnNonIndexPropertyNames):
 839         * runtime/JSArrayBufferView.cpp:
 840         (JSC::JSArrayBufferView::getOwnNonIndexPropertyNames):
 841         * runtime/JSFunction.cpp:
 842         (JSC::JSFunction::getOwnNonIndexPropertyNames):
 843         * runtime/JSFunction.h:
 844         * runtime/JSGenericTypedArrayViewInlines.h:
 845         (JSC::JSGenericTypedArrayView<Adaptor>::getOwnNonIndexPropertyNames):
 846         * runtime/JSLexicalEnvironment.cpp:
 847         (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
 848         * runtime/JSONObject.cpp:
 849         (JSC::Stringifier::Holder::appendNextProperty):
 850         (JSC::Walker::walk):
 851         * runtime/JSObject.cpp:
 852         (JSC::getClassPropertyNames):
 853         (JSC::JSObject::getOwnPropertyNames):
 854         (JSC::JSObject::getOwnNonIndexPropertyNames):
 855         (JSC::JSObject::getGenericPropertyNames):
 856         * runtime/JSPropertyNameEnumerator.h:
 857         (JSC::propertyNameEnumerator):
 858         * runtime/JSSymbolTableObject.cpp:
 859         (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
 860         * runtime/ObjectConstructor.cpp:
 861         (JSC::objectConstructorGetOwnPropertyNames):
 862         (JSC::objectConstructorKeys):
 863         (JSC::defineProperties):
 864         (JSC::objectConstructorSeal):
 865         (JSC::objectConstructorFreeze):
 866         (JSC::objectConstructorIsSealed):
 867         (JSC::objectConstructorIsFrozen):
 868         * runtime/RegExpObject.cpp:
 869         (JSC::RegExpObject::getOwnNonIndexPropertyNames):
 870         (JSC::RegExpObject::getPropertyNames):
 871         (JSC::RegExpObject::getGenericPropertyNames):
 872         * runtime/StringObject.cpp:
 873         (JSC::StringObject::getOwnPropertyNames):
 874         * runtime/Structure.cpp:
 875         (JSC::Structure::getPropertyNamesFromStructure):
 876
 877 2015-04-01  Alex Christensen  <achristensen@webkit.org>
 878
 879         Progress towards CMake on Windows and Mac.
 880         https://bugs.webkit.org/show_bug.cgi?id=143293
 881
 882         Reviewed by Filip Pizlo.
 883
 884         * CMakeLists.txt:
 885         Enabled using assembly on Windows.
 886         Replaced unix commands with CMake commands.
 887         * PlatformMac.cmake:
 888         Tell open source builders where to find unicode headers.
 889
 890 2015-04-01  Yusuke Suzuki  <utatane.tea@gmail.com>
 891
 892         IteratorClose should be called when jumping over the target for-of loop
 893         https://bugs.webkit.org/show_bug.cgi?id=143140
 894
 895         Reviewed by Geoffrey Garen.
 896
 897         This patch fixes labeled break/continue behaviors with for-of and iterators.
 898
 899         1. Support IteratorClose beyond multiple loop contexts
 900         Previously, IteratorClose is only executed in for-of's breakTarget().
 901         However, this misses IteratorClose execution when statement roll-ups multiple control flow contexts.
 902         For example,
 903         outer: for (var e1 of outer) {
 904             inner: for (var e2 of inner) {
 905                 break outer;
 906             }
 907         }
 908         In this case, return method of inner should be called.
 909         We leverage the existing system for `finally` to execute inner.return method correctly.
 910         Leveraging `finally` system fixes `break`, `continue` and `return` cases.
 911         `throw` case is already supported by emitting try-catch handlers in for-of.
 912
 913         2. Incorrect LabelScope creation is done in ForOfNode
 914         ForOfNode creates duplicated LabelScope.
 915         It causes infinite loop when executing the following program that contains
 916         explicitly labeled for-of loop.
 917         For example,
 918         inner: for (var elm of array) {
 919             continue inner;
 920         }
 921
 922         * bytecompiler/BytecodeGenerator.cpp:
 923         (JSC::BytecodeGenerator::pushFinallyContext):
 924         (JSC::BytecodeGenerator::pushIteratorCloseContext):
 925         (JSC::BytecodeGenerator::popFinallyContext):
 926         (JSC::BytecodeGenerator::popIteratorCloseContext):
 927         (JSC::BytecodeGenerator::emitComplexPopScopes):
 928         (JSC::BytecodeGenerator::emitEnumeration):
 929         (JSC::BytecodeGenerator::emitIteratorClose):
 930         * bytecompiler/BytecodeGenerator.h:
 931         * bytecompiler/NodesCodegen.cpp:
 932         (JSC::ForOfNode::emitBytecode):
 933         * tests/stress/iterator-return-beyond-multiple-iteration-scopes.js: Added.
 934         (createIterator.iterator.return):
 935         (createIterator):
 936         * tests/stress/raise-error-in-iterator-close.js: Added.
 937         (createIterator.iterator.return):
 938         (createIterator):
 939
 940 2015-04-01  Yusuke Suzuki  <utatane.tea@gmail.com>
 941
 942         [ES6] Implement Symbol.unscopables
 943         https://bugs.webkit.org/show_bug.cgi?id=142829
 944
 945         Reviewed by Geoffrey Garen.
 946
 947         This patch introduces Symbol.unscopables functionality.
 948         In ES6, some generic names (like keys, values) are introduced
 949         as Array's method name. And this breaks the web since some web sites
 950         use like the following code.
 951
 952         var values = ...;
 953         with (array) {
 954             values;  // This values is trapped by array's method "values".
 955         }
 956
 957         To fix this, Symbol.unscopables introduces blacklist
 958         for with scope's trapping. When resolving scope,
 959         if name is found in the target scope and the target scope is with scope,
 960         we check Symbol.unscopables object to filter generic names.
 961
 962         This functionality is only active for with scopes.
 963         Global scope does not have unscopables functionality.
 964
 965         And since
 966         1) op_resolve_scope for with scope always return Dynamic resolve type,
 967         2) in that case, JSScope::resolve is always used in JIT and LLInt,
 968         3) the code which contains op_resolve_scope that returns Dynamic cannot be compiled with DFG and FTL,
 969         to implement this functionality, we just change JSScope::resolve and no need to change JIT code.
 970         So performance regression is only visible in Dynamic resolving case, and it is already much slow.
 971
 972         * runtime/ArrayPrototype.cpp:
 973         (JSC::ArrayPrototype::finishCreation):
 974         * runtime/CommonIdentifiers.h:
 975         * runtime/JSGlobalObject.h:
 976         (JSC::JSGlobalObject::runtimeFlags):
 977         * runtime/JSScope.cpp:
 978         (JSC::isUnscopable):
 979         (JSC::JSScope::resolve):
 980         * runtime/JSScope.h:
 981         (JSC::ScopeChainIterator::scope):
 982         * tests/stress/global-environment-does-not-trap-unscopables.js: Added.
 983         (test):
 984         * tests/stress/unscopables.js: Added.
 985         (test):
 986         (.):
 987
 988 2015-03-31  Ryosuke Niwa  <rniwa@webkit.org>
 989
 990         ES6 class syntax should allow static setters and getters
 991         https://bugs.webkit.org/show_bug.cgi?id=143180
 992
 993         Reviewed by Filip Pizlo
 994
 995         Apparently I misread the spec when I initially implemented parseClass.
 996         ES6 class syntax allows static getters and setters so just allow that.
 997
 998         * parser/Parser.cpp:
 999         (JSC::Parser<LexerType>::parseClass):
1000
1001 2015-03-31  Filip Pizlo  <fpizlo@apple.com>
1002
1003         PutClosureVar CSE def() rule has a wrong base
1004         https://bugs.webkit.org/show_bug.cgi?id=143280
1005
1006         Reviewed by Michael Saboff.
1007
1008         I think that this code was incorrect in a benign way, since the base of a
1009         PutClosureVar is not a JS-visible object. But it was preventing some optimizations.
1010
1011         * dfg/DFGClobberize.h:
1012         (JSC::DFG::clobberize):
1013
1014 2015-03-31  Commit Queue  <commit-queue@webkit.org>
1015
1016         Unreviewed, rolling out r182200.
1017         https://bugs.webkit.org/show_bug.cgi?id=143279
1018
1019         Probably causing assertion extravaganza on bots. (Requested by
1020         kling on #webkit).
1021
1022         Reverted changeset:
1023
1024         "Logically empty WeakBlocks should not pin down their
1025         MarkedBlocks indefinitely."
1026         https://bugs.webkit.org/show_bug.cgi?id=143210
1027         http://trac.webkit.org/changeset/182200
1028
1029 2015-03-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1030
1031         Clean up Identifier factories to clarify the meaning of StringImpl*
1032         https://bugs.webkit.org/show_bug.cgi?id=143146
1033
1034         Reviewed by Filip Pizlo.
1035
1036         In the a lot of places, `Identifier(VM*/ExecState*, StringImpl*)` constructor is used.
1037         However, it's ambiguous because `StringImpl*` has 2 different meanings.
1038         1) normal string, it is replacable with `WTFString` and
1039         2) `uid`, which holds `isSymbol` information to represent Symbols.
1040         So we dropped Identifier constructors for strings and instead, introduced 2 factory functions.
1041         + `Identifier::fromString(VM*/ExecState*, const String&)`.
1042         Just construct Identifier from strings. The symbol-ness of StringImpl* is not kept.
1043         + `Identifier::fromUid(VM*/ExecState*, StringImpl*)`.
1044         This function is used for 2) `uid`. So symbol-ness of `StringImpl*` is kept.
1045
1046         And to clean up `StringImpl` which is used as uid,
1047         we introduce `StringKind` into `StringImpl`. There's 3 kinds
1048         1. StringNormal (non-atomic, non-symbol)
1049         2. StringAtomic (atomic, non-symbol)
1050         3. StringSymbol (non-atomic, symbol)
1051         They are mutually exclusive. And (atomic, symbol) case should not exist.
1052
1053         * API/JSCallbackObjectFunctions.h:
1054         (JSC::JSCallbackObject<Parent>::getOwnNonIndexPropertyNames):
1055         * API/JSObjectRef.cpp:
1056         (JSObjectMakeFunction):
1057         * API/OpaqueJSString.cpp:
1058         (OpaqueJSString::identifier):
1059         * bindings/ScriptFunctionCall.cpp:
1060         (Deprecated::ScriptFunctionCall::call):
1061         * builtins/BuiltinExecutables.cpp:
1062         (JSC::BuiltinExecutables::createExecutableInternal):
1063         * builtins/BuiltinNames.h:
1064         (JSC::BuiltinNames::BuiltinNames):
1065         * bytecompiler/BytecodeGenerator.cpp:
1066         (JSC::BytecodeGenerator::BytecodeGenerator):
1067         (JSC::BytecodeGenerator::emitThrowReferenceError):
1068         (JSC::BytecodeGenerator::emitThrowTypeError):
1069         (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
1070         (JSC::BytecodeGenerator::emitEnumeration):
1071         * dfg/DFGDesiredIdentifiers.cpp:
1072         (JSC::DFG::DesiredIdentifiers::reallyAdd):
1073         * inspector/JSInjectedScriptHost.cpp:
1074         (Inspector::JSInjectedScriptHost::functionDetails):
1075         (Inspector::constructInternalProperty):
1076         (Inspector::JSInjectedScriptHost::weakMapEntries):
1077         (Inspector::JSInjectedScriptHost::iteratorEntries):
1078         * inspector/JSInjectedScriptHostPrototype.cpp:
1079         (Inspector::JSInjectedScriptHostPrototype::finishCreation):
1080         * inspector/JSJavaScriptCallFramePrototype.cpp:
1081         * inspector/ScriptCallStackFactory.cpp:
1082         (Inspector::extractSourceInformationFromException):
1083         * jit/JITOperations.cpp:
1084         * jsc.cpp:
1085         (GlobalObject::finishCreation):
1086         (GlobalObject::addFunction):
1087         (GlobalObject::addConstructableFunction):
1088         (functionRun):
1089         (runWithScripts):
1090         * llint/LLIntData.cpp:
1091         (JSC::LLInt::Data::performAssertions):
1092         * llint/LowLevelInterpreter.asm:
1093         * parser/ASTBuilder.h:
1094         (JSC::ASTBuilder::addVar):
1095         * parser/Parser.cpp:
1096         (JSC::Parser<LexerType>::parseInner):
1097         (JSC::Parser<LexerType>::createBindingPattern):
1098         * parser/ParserArena.h:
1099         (JSC::IdentifierArena::makeIdentifier):
1100         (JSC::IdentifierArena::makeIdentifierLCharFromUChar):
1101         (JSC::IdentifierArena::makeNumericIdentifier):
1102         * runtime/ArgumentsIteratorPrototype.cpp:
1103         (JSC::ArgumentsIteratorPrototype::finishCreation):
1104         * runtime/ArrayIteratorPrototype.cpp:
1105         (JSC::ArrayIteratorPrototype::finishCreation):
1106         * runtime/ArrayPrototype.cpp:
1107         (JSC::ArrayPrototype::finishCreation):
1108         (JSC::arrayProtoFuncPush):
1109         * runtime/ClonedArguments.cpp:
1110         (JSC::ClonedArguments::getOwnPropertySlot):
1111         * runtime/CommonIdentifiers.cpp:
1112         (JSC::CommonIdentifiers::CommonIdentifiers):
1113         * runtime/CommonIdentifiers.h:
1114         * runtime/Error.cpp:
1115         (JSC::addErrorInfo):
1116         (JSC::hasErrorInfo):
1117         * runtime/ExceptionHelpers.cpp:
1118         (JSC::createUndefinedVariableError):
1119         * runtime/GenericArgumentsInlines.h:
1120         (JSC::GenericArguments<Type>::getOwnPropertySlot):
1121         * runtime/Identifier.h:
1122         (JSC::Identifier::isSymbol):
1123         (JSC::Identifier::Identifier):
1124         (JSC::Identifier::from): Deleted.
1125         * runtime/IdentifierInlines.h:
1126         (JSC::Identifier::Identifier):
1127         (JSC::Identifier::fromUid):
1128         (JSC::Identifier::fromString):
1129         * runtime/JSCJSValue.cpp:
1130         (JSC::JSValue::dumpInContextAssumingStructure):
1131         * runtime/JSCJSValueInlines.h:
1132         (JSC::JSValue::toPropertyKey):
1133         * runtime/JSGlobalObject.cpp:
1134         (JSC::JSGlobalObject::init):
1135         * runtime/JSLexicalEnvironment.cpp:
1136         (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
1137         * runtime/JSObject.cpp:
1138         (JSC::getClassPropertyNames):
1139         (JSC::JSObject::reifyStaticFunctionsForDelete):
1140         * runtime/JSObject.h:
1141         (JSC::makeIdentifier):
1142         * runtime/JSPromiseConstructor.cpp:
1143         (JSC::JSPromiseConstructorFuncRace):
1144         (JSC::JSPromiseConstructorFuncAll):
1145         * runtime/JSString.h:
1146         (JSC::JSString::toIdentifier):
1147         * runtime/JSSymbolTableObject.cpp:
1148         (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
1149         * runtime/LiteralParser.cpp:
1150         (JSC::LiteralParser<CharType>::tryJSONPParse):
1151         (JSC::LiteralParser<CharType>::makeIdentifier):
1152         * runtime/Lookup.h:
1153         (JSC::reifyStaticProperties):
1154         * runtime/MapConstructor.cpp:
1155         (JSC::constructMap):
1156         * runtime/MapIteratorPrototype.cpp:
1157         (JSC::MapIteratorPrototype::finishCreation):
1158         * runtime/MapPrototype.cpp:
1159         (JSC::MapPrototype::finishCreation):
1160         * runtime/MathObject.cpp:
1161         (JSC::MathObject::finishCreation):
1162         * runtime/NumberConstructor.cpp:
1163         (JSC::NumberConstructor::finishCreation):
1164         * runtime/ObjectConstructor.cpp:
1165         (JSC::ObjectConstructor::finishCreation):
1166         * runtime/PrivateName.h:
1167         (JSC::PrivateName::PrivateName):
1168         * runtime/PropertyMapHashTable.h:
1169         (JSC::PropertyTable::find):
1170         (JSC::PropertyTable::get):
1171         * runtime/PropertyName.h:
1172         (JSC::PropertyName::PropertyName):
1173         (JSC::PropertyName::publicName):
1174         (JSC::PropertyName::asIndex):
1175         * runtime/PropertyNameArray.cpp:
1176         (JSC::PropertyNameArray::add):
1177         * runtime/PropertyNameArray.h:
1178         (JSC::PropertyNameArray::addKnownUnique):
1179         * runtime/RegExpConstructor.cpp:
1180         (JSC::RegExpConstructor::finishCreation):
1181         * runtime/SetConstructor.cpp:
1182         (JSC::constructSet):
1183         * runtime/SetIteratorPrototype.cpp:
1184         (JSC::SetIteratorPrototype::finishCreation):
1185         * runtime/SetPrototype.cpp:
1186         (JSC::SetPrototype::finishCreation):
1187         * runtime/StringIteratorPrototype.cpp:
1188         (JSC::StringIteratorPrototype::finishCreation):
1189         * runtime/StringPrototype.cpp:
1190         (JSC::StringPrototype::finishCreation):
1191         * runtime/Structure.cpp:
1192         (JSC::Structure::getPropertyNamesFromStructure):
1193         * runtime/SymbolConstructor.cpp:
1194         * runtime/VM.cpp:
1195         (JSC::VM::throwException):
1196         * runtime/WeakMapConstructor.cpp:
1197         (JSC::constructWeakMap):
1198
1199 2015-03-31  Andreas Kling  <akling@apple.com>
1200
1201         Logically empty WeakBlocks should not pin down their MarkedBlocks indefinitely.
1202         <https://webkit.org/b/143210>
1203
1204         Reviewed by Geoffrey Garen.
1205
1206         Since a MarkedBlock cannot be destroyed until all the WeakBlocks pointing into it are gone,
1207         we had a little problem where WeakBlocks with only null pointers would still keep their
1208         MarkedBlock alive.
1209
1210         This patch fixes that by detaching WeakBlocks from their MarkedBlock once a sweep discovers
1211         that the WeakBlock contains no pointers to live objects. Ownership of the WeakBlock is passed
1212         to the Heap, which will sweep the list of these detached WeakBlocks as part of a full GC,
1213         destroying them once they're fully dead.
1214
1215         This allows the garbage collector to reclaim the 64kB MarkedBlocks much sooner, and resolves
1216         a mysterious issue where doing two full garbage collections back-to-back would free additional
1217         memory in the second collection.
1218
1219         Management of detached WeakBlocks is implemented as a Vector<WeakBlock*> in Heap, along with
1220         an index of the next block in that vector that needs to be swept. The IncrementalSweeper then
1221         calls into Heap::sweepNextLogicallyEmptyWeakBlock() to sweep one block at a time.
1222
1223         * heap/Heap.h:
1224         * heap/Heap.cpp:
1225         (JSC::Heap::collectAllGarbage): Add a final pass where we sweep the logically empty WeakBlocks
1226         owned by Heap, after everything else has been swept.
1227
1228         (JSC::Heap::notifyIncrementalSweeper): Set up an incremental sweep of logically empty WeakBlocks
1229         after a full garbage collection ends. Note that we don't do this after Eden collections, since
1230         they are unlikely to cause entire WeakBlocks to go empty.
1231
1232         (JSC::Heap::addLogicallyEmptyWeakBlock): Added. Interface for passing ownership of a WeakBlock
1233         to the Heap when it's detached from a WeakSet.
1234
1235         (JSC::Heap::sweepAllLogicallyEmptyWeakBlocks): Helper for collectAllGarbage() that sweeps all
1236         of the logically empty WeakBlocks owned by Heap.
1237
1238         (JSC::Heap::sweepNextLogicallyEmptyWeakBlock): Sweeps one logically empty WeakBlock if needed
1239         and updates the next-logically-empty-weak-block-to-sweep index.
1240
1241         (JSC::Heap::lastChanceToFinalize): call sweepAllLogicallyEmptyWeakBlocks() here, since there
1242         won't be another chance after this.
1243
1244         * heap/IncrementalSweeper.h:
1245         (JSC::IncrementalSweeper::hasWork): Deleted.
1246
1247         * heap/IncrementalSweeper.cpp:
1248         (JSC::IncrementalSweeper::fullSweep):
1249         (JSC::IncrementalSweeper::doSweep):
1250         (JSC::IncrementalSweeper::sweepNextBlock): Restructured IncrementalSweeper a bit to simplify
1251         adding a new sweeping stage for the Heap's logically empty WeakBlocks. sweepNextBlock() is
1252         changed to return a bool (true if there's more work to be done.)
1253
1254         * heap/WeakBlock.cpp:
1255         (JSC::WeakBlock::sweep): This now figures out if the WeakBlock is logically empty, i.e doesn't
1256         contain any pointers to live objects. The answer is stored in a new SweepResult member.
1257
1258         * heap/WeakBlock.h:
1259         (JSC::WeakBlock::isLogicallyEmptyButNotFree): Added. Can be queried after a sweep to determine
1260         if the WeakBlock could be detached from the MarkedBlock.
1261
1262         (JSC::WeakBlock::SweepResult::SweepResult): Deleted in favor of initializing member variables
1263         when declaring them.
1264
1265 2015-03-31  Ryosuke Niwa  <rniwa@webkit.org>
1266
1267         eval("this.foo") causes a crash if this had not been initialized in a derived class's constructor
1268         https://bugs.webkit.org/show_bug.cgi?id=142883
1269
1270         Reviewed by Filip Pizlo.
1271
1272         The crash was caused by eval inside the constructor of a derived class not checking TDZ.
1273
1274         Fixed the bug by adding a parser flag that forces the TDZ check to be always emitted when accessing "this"
1275         in eval inside a derived class' constructor.
1276
1277         * bytecode/EvalCodeCache.h:
1278         (JSC::EvalCodeCache::getSlow):
1279         * bytecompiler/NodesCodegen.cpp:
1280         (JSC::ThisNode::emitBytecode):
1281         * debugger/DebuggerCallFrame.cpp:
1282         (JSC::DebuggerCallFrame::evaluate):
1283         * interpreter/Interpreter.cpp:
1284         (JSC::eval):
1285         * parser/ASTBuilder.h:
1286         (JSC::ASTBuilder::thisExpr):
1287         * parser/NodeConstructors.h:
1288         (JSC::ThisNode::ThisNode):
1289         * parser/Nodes.h:
1290         * parser/Parser.cpp:
1291         (JSC::Parser<LexerType>::Parser):
1292         (JSC::Parser<LexerType>::parsePrimaryExpression):
1293         * parser/Parser.h:
1294         (JSC::parse):
1295         * parser/ParserModes.h:
1296         * parser/SyntaxChecker.h:
1297         (JSC::SyntaxChecker::thisExpr):
1298         * runtime/CodeCache.cpp:
1299         (JSC::CodeCache::getGlobalCodeBlock):
1300         (JSC::CodeCache::getProgramCodeBlock):
1301         (JSC::CodeCache::getEvalCodeBlock):
1302         * runtime/CodeCache.h:
1303         (JSC::SourceCodeKey::SourceCodeKey):
1304         * runtime/Executable.cpp:
1305         (JSC::EvalExecutable::create):
1306         * runtime/Executable.h:
1307         * runtime/JSGlobalObject.cpp:
1308         (JSC::JSGlobalObject::createEvalCodeBlock):
1309         * runtime/JSGlobalObject.h:
1310         * runtime/JSGlobalObjectFunctions.cpp:
1311         (JSC::globalFuncEval):
1312         * tests/stress/class-syntax-no-tdz-in-eval.js: Added.
1313         * tests/stress/class-syntax-tdz-in-eval.js: Added.
1314
1315 2015-03-31  Commit Queue  <commit-queue@webkit.org>
1316
1317         Unreviewed, rolling out r182186.
1318         https://bugs.webkit.org/show_bug.cgi?id=143270
1319
1320         it crashes all the WebGL tests on the Debug bots (Requested by
1321         dino on #webkit).
1322
1323         Reverted changeset:
1324
1325         "Web Inspector: add 2D/WebGL canvas instrumentation
1326         infrastructure"
1327         https://bugs.webkit.org/show_bug.cgi?id=137278
1328         http://trac.webkit.org/changeset/182186
1329
1330 2015-03-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1331
1332         [ES6] Object type restrictions on a first parameter of several Object.* functions are relaxed
1333         https://bugs.webkit.org/show_bug.cgi?id=142937
1334
1335         Reviewed by Darin Adler.
1336
1337         In ES6, Object type restrictions on a first parameter of several Object.* functions are relaxed.
1338         In ES5 or prior, when a first parameter is not object type, these functions raise TypeError.
1339         But now, several functions perform ToObject onto a non-object parameter.
1340         And others behaves as if a parameter is a non-extensible ordinary object with no own properties.
1341         It is described in ES6 Annex E.
1342         Functions different from ES5 are following.
1343
1344         1. An attempt is make to coerce the argument using ToObject.
1345             Object.getOwnPropertyDescriptor
1346             Object.getOwnPropertyNames
1347             Object.getPrototypeOf
1348             Object.keys
1349
1350         2. Treated as if it was a non-extensible ordinary object with no own properties.
1351             Object.freeze
1352             Object.isExtensible
1353             Object.isFrozen
1354             Object.isSealed
1355             Object.preventExtensions
1356             Object.seal
1357
1358         * runtime/ObjectConstructor.cpp:
1359         (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
1360         (JSC::objectConstructorGetPrototypeOf):
1361         (JSC::objectConstructorGetOwnPropertyDescriptor):
1362         (JSC::objectConstructorGetOwnPropertyNames):
1363         (JSC::objectConstructorKeys):
1364         (JSC::objectConstructorSeal):
1365         (JSC::objectConstructorFreeze):
1366         (JSC::objectConstructorPreventExtensions):
1367         (JSC::objectConstructorIsSealed):
1368         (JSC::objectConstructorIsFrozen):
1369         (JSC::objectConstructorIsExtensible):
1370         * tests/stress/object-freeze-accept-non-object.js: Added.
1371         * tests/stress/object-get-own-property-descriptor-perform-to-object.js: Added.
1372         (canary):
1373         * tests/stress/object-get-own-property-names-perform-to-object.js: Added.
1374         (compare):
1375         * tests/stress/object-get-prototype-of-perform-to-object.js: Added.
1376         * tests/stress/object-is-extensible-accept-non-object.js: Added.
1377         * tests/stress/object-is-frozen-accept-non-object.js: Added.
1378         * tests/stress/object-is-sealed-accept-non-object.js: Added.
1379         * tests/stress/object-keys-perform-to-object.js: Added.
1380         (compare):
1381         * tests/stress/object-prevent-extensions-accept-non-object.js: Added.
1382         * tests/stress/object-seal-accept-non-object.js: Added.
1383
1384 2015-03-31  Matt Baker  <mattbaker@apple.com>
1385
1386         Web Inspector: add 2D/WebGL canvas instrumentation infrastructure
1387         https://bugs.webkit.org/show_bug.cgi?id=137278
1388
1389         Reviewed by Timothy Hatcher.
1390
1391         Added Canvas protocol which defines types used by InspectorCanvasAgent.
1392
1393         * CMakeLists.txt:
1394         * DerivedSources.make:
1395         * inspector/protocol/Canvas.json: Added.
1396
1397         * inspector/scripts/codegen/generator.py:
1398         (Generator.stylized_name_for_enum_value):
1399         Added special handling for 2D (always uppercase) and WebGL (rename mapping) enum strings.
1400
1401 2015-03-30  Ryosuke Niwa  <rniwa@webkit.org>
1402
1403         Extending null should set __proto__ to null
1404         https://bugs.webkit.org/show_bug.cgi?id=142882
1405
1406         Reviewed by Geoffrey Garen and Benjamin Poulain.
1407
1408         Set Derived.prototype.__proto__ to null when extending null.
1409
1410         * bytecompiler/NodesCodegen.cpp:
1411         (JSC::ClassExprNode::emitBytecode):
1412
1413 2015-03-30  Mark Lam  <mark.lam@apple.com>
1414
1415         REGRESSION (r181993): inspector-protocol/debugger/setBreakpoint-dfg-and-modify-local.html crashes.
1416         <https://webkit.org/b/143105>
1417
1418         Reviewed by Filip Pizlo.
1419
1420         With r181993, the DFG and FTL may elide the storing of the scope register.  As a result,
1421         on OSR exits from DFG / FTL frames where this elision has take place, we may get baseline
1422         JIT frames that may have its scope register not set.  The Debugger's current implementation
1423         which relies on the scope register is not happy about this.  For example, this results in a
1424         crash in the layout test inspector-protocol/debugger/setBreakpoint-dfg-and-modify-local.html.
1425
1426         The fix is to disable inlining when the debugger is in use.  Also, we add Flush nodes to
1427         ensure that the scope register value is flushed to the register in the stack frame.
1428
1429         * dfg/DFGByteCodeParser.cpp:
1430         (JSC::DFG::ByteCodeParser::ByteCodeParser):
1431         (JSC::DFG::ByteCodeParser::setLocal):
1432         (JSC::DFG::ByteCodeParser::flush):
1433         - Add code to flush the scope register.
1434         (JSC::DFG::ByteCodeParser::inliningCost):
1435         - Pretend that all codeBlocks are too expensive to inline if the debugger is in use, thereby
1436           disabling inlining whenever the debugger is in use.
1437         * dfg/DFGGraph.cpp:
1438         (JSC::DFG::Graph::Graph):
1439         * dfg/DFGGraph.h:
1440         (JSC::DFG::Graph::hasDebuggerEnabled):
1441         * dfg/DFGStackLayoutPhase.cpp:
1442         (JSC::DFG::StackLayoutPhase::run):
1443         - Update the DFG codeBlock's scopeRegister since it can be moved during stack layout.
1444         * ftl/FTLCompile.cpp:
1445         (JSC::FTL::mmAllocateDataSection):
1446         - Update the FTL codeBlock's scopeRegister since it can be moved during stack layout.
1447
1448 2015-03-30  Michael Saboff  <msaboff@apple.com>
1449
1450         Fix flakey float32-repeat-out-of-bounds.js and int8-repeat-out-of-bounds.js tests for ARM64
1451         https://bugs.webkit.org/show_bug.cgi?id=138391
1452
1453         Reviewed by Mark Lam.
1454
1455         Re-enabling these tests as I can't get them to fail on local iOS test devices.
1456         There have been many changes since these tests were disabled.
1457         I'll watch automated test results for failures.  If there are failures running automated
1458         testing, it might be due to the device's relative CPU performance.
1459
1460         * tests/stress/float32-repeat-out-of-bounds.js:
1461         * tests/stress/int8-repeat-out-of-bounds.js:
1462
1463 2015-03-30  Joseph Pecoraro  <pecoraro@apple.com>
1464
1465         Web Inspector: Regression: Preview for [[null]] shouldn't be []
1466         https://bugs.webkit.org/show_bug.cgi?id=143208
1467
1468         Reviewed by Mark Lam.
1469
1470         * inspector/InjectedScriptSource.js:
1471         Handle null when generating simple object previews.
1472
1473 2015-03-30  Per Arne Vollan  <peavo@outlook.com>
1474
1475         Avoid using hardcoded values for JSValue::Int32Tag, if possible.
1476         https://bugs.webkit.org/show_bug.cgi?id=143134
1477
1478         Reviewed by Geoffrey Garen.
1479
1480         * jit/JSInterfaceJIT.h:
1481         * jit/Repatch.cpp:
1482         (JSC::tryCacheGetByID):
1483
1484 2015-03-30  Filip Pizlo  <fpizlo@apple.com>
1485
1486         REGRESSION: js/regress/inline-arguments-local-escape.html is flaky
1487         https://bugs.webkit.org/show_bug.cgi?id=143104
1488
1489         Reviewed by Geoffrey Garen.
1490
1491         Created a test that is a 100% repro of the flaky failure. This test is called
1492         get-my-argument-by-val-for-inlined-escaped-arguments.js. It fails all of the time because it
1493         always causes the compiler to emit a GetMyArgumentByVal of the arguments object returned by
1494         the inlined function. Other than that, it's the same as inline-arguments-local-escape.
1495
1496         Also created three more tests for three similar, but not identical, failures.
1497
1498         Then fixed the bug: PreciseLocalClobberize was assuming that if we read(Stack) then we are
1499         only reading those parts of the stack that are relevant to the current semantic code origin.
1500         That's false after ArgumentsEliminationPhase - we might have operations on phantom arguments,
1501         like GetMyArgumentByVal, ForwardVarargs, CallForwardVarargs, and ConstructForwardVarargs, that
1502         read parts of the stack associated with the inline call frame for the phantom arguments. This
1503         may not be subsumed by the current semantic origin's stack area in cases that the arguments
1504         were allowed to "locally" escape.
1505
1506         The higher-order lesson here is that in DFG SSA IR, the current semantic origin's stack area
1507         is not really a meaningful concept anymore. It is only meaningful for nodes that will read
1508         the stack due to function.arguments, but there are a bunch of other ways that we could also
1509         read the stack and those operations may read any stack slot. I believe that this change makes
1510         PreciseLocalClobberize right: it will refine a read(Stack) from Clobberize correctly by casing
1511         on node type. In future, if we add a read(Stack) to Clobberize, we'll have to make sure that
1512         readTop() in PreciseLocalClobberize does the right thing.
1513
1514         * dfg/DFGClobberize.h:
1515         (JSC::DFG::clobberize):
1516         * dfg/DFGPreciseLocalClobberize.h:
1517         (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
1518         * dfg/DFGPutStackSinkingPhase.cpp:
1519         * tests/stress/call-forward-varargs-for-inlined-escaped-arguments.js: Added.
1520         * tests/stress/construct-forward-varargs-for-inlined-escaped-arguments.js: Added.
1521         * tests/stress/forward-varargs-for-inlined-escaped-arguments.js: Added.
1522         * tests/stress/get-my-argument-by-val-for-inlined-escaped-arguments.js: Added.
1523         * tests/stress/real-forward-varargs-for-inlined-escaped-arguments.js: Added.
1524
1525 2015-03-30  Benjamin Poulain  <benjamin@webkit.org>
1526
1527         Start the features.json files
1528         https://bugs.webkit.org/show_bug.cgi?id=143207
1529
1530         Reviewed by Darin Adler.
1531
1532         Start the features.json files to have something to experiment
1533         with for the UI.
1534
1535         * features.json: Added.
1536
1537 2015-03-29  Myles C. Maxfield  <mmaxfield@apple.com>
1538
1539         [Win] Addresing post-review comment after r182122
1540         https://bugs.webkit.org/show_bug.cgi?id=143189
1541
1542         Unreviewed.
1543
1544 2015-03-29  Myles C. Maxfield  <mmaxfield@apple.com>
1545
1546         [Win] Allow building JavaScriptCore without Cygwin
1547         https://bugs.webkit.org/show_bug.cgi?id=143189
1548
1549         Reviewed by Brent Fulgham.
1550
1551         Paths like /usr/bin/ don't exist on Windows.
1552         Hashbangs don't work on Windows. Instead we must explicitly call the executable.
1553         Prefixing commands with environment variables doesn't work on Windows.
1554         Windows doesn't have 'cmp'
1555         Windows uses 'del' instead of 'rm'
1556         Windows uses 'type NUL' intead of 'touch'
1557
1558         * DerivedSources.make:
1559         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
1560         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
1561         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.pl:
1562         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
1563         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.pl:
1564         * JavaScriptCore.vcxproj/build-generated-files.pl:
1565         * UpdateContents.py: Copied from Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.pl.
1566
1567 2015-03-28  Joseph Pecoraro  <pecoraro@apple.com>
1568
1569         Clean up JavaScriptCore/builtins
1570         https://bugs.webkit.org/show_bug.cgi?id=143177
1571
1572         Reviewed by Ryosuke Niwa.
1573
1574         * builtins/ArrayConstructor.js:
1575         (from):
1576         - We can compare to undefined instead of using a typeof undefined check.
1577         - Converge on double quoted strings everywhere.
1578
1579         * builtins/ArrayIterator.prototype.js:
1580         (next):
1581         * builtins/StringIterator.prototype.js:
1582         (next):
1583         - Use shorthand object construction to avoid duplication.
1584         - Improve grammar in error messages.
1585
1586         * tests/stress/array-iterators-next-with-call.js:
1587         * tests/stress/string-iterators.js:
1588         - Update for new error message strings.
1589
1590 2015-03-28  Saam Barati  <saambarati1@gmail.com>
1591
1592         Web Inspector: ES6: Better support for Symbol types in Type Profiler
1593         https://bugs.webkit.org/show_bug.cgi?id=141257
1594
1595         Reviewed by Joseph Pecoraro.
1596
1597         ES6 introduces the new primitive type Symbol. This patch makes JSC's
1598         type profiler support this new primitive type.
1599
1600         * dfg/DFGFixupPhase.cpp:
1601         (JSC::DFG::FixupPhase::fixupNode):
1602         * inspector/protocol/Runtime.json:
1603         * runtime/RuntimeType.cpp:
1604         (JSC::runtimeTypeForValue):
1605         * runtime/RuntimeType.h:
1606         (JSC::runtimeTypeIsPrimitive):
1607         * runtime/TypeSet.cpp:
1608         (JSC::TypeSet::addTypeInformation):
1609         (JSC::TypeSet::dumpTypes):
1610         (JSC::TypeSet::doesTypeConformTo):
1611         (JSC::TypeSet::displayName):
1612         (JSC::TypeSet::inspectorTypeSet):
1613         (JSC::TypeSet::toJSONString):
1614         * runtime/TypeSet.h:
1615         (JSC::TypeSet::seenTypes):
1616         * tests/typeProfiler/driver/driver.js:
1617         * tests/typeProfiler/symbol.js: Added.
1618         (wrapper.foo):
1619         (wrapper.bar):
1620         (wrapper.bar.bar.baz):
1621         (wrapper):
1622
1623 2015-03-27  Saam Barati  <saambarati1@gmail.com>
1624
1625         Deconstruction parameters are bound too late
1626         https://bugs.webkit.org/show_bug.cgi?id=143148
1627
1628         Reviewed by Filip Pizlo.
1629
1630         Currently, a deconstruction pattern named with the same
1631         name as a function will shadow the function. This is
1632         wrong. It should be the other way around.
1633
1634         * bytecompiler/BytecodeGenerator.cpp:
1635         (JSC::BytecodeGenerator::generate):
1636
1637 2015-03-27  Ryosuke Niwa  <rniwa@webkit.org>
1638
1639         parse doesn't initialize the 16-bit version of the JSC parser with defaultConstructorKind
1640         https://bugs.webkit.org/show_bug.cgi?id=143170
1641
1642         Reviewed by Benjamin Poulain.
1643
1644         Assert that we never use 16-bit version of the parser to parse a default constructor
1645         since both base and derived default constructors should be using a 8-bit string.
1646
1647         * parser/Parser.h:
1648         (JSC::parse):
1649
1650 2015-03-27  Ryosuke Niwa  <rniwa@webkit.org>
1651
1652         ES6 Classes: Runtime error in JIT'd class calling super() with arguments and superclass has default constructor
1653         https://bugs.webkit.org/show_bug.cgi?id=142862
1654
1655         Reviewed by Benjamin Poulain.
1656
1657         Add a test that used to fail in DFG now that the bug has been fixed by r181993.
1658
1659         * tests/stress/class-syntax-derived-default-constructor.js: Added.
1660
1661 2015-03-27  Michael Saboff  <msaboff@apple.com>
1662
1663         load8Signed() and load16Signed() should be renamed to avoid confusion
1664         https://bugs.webkit.org/show_bug.cgi?id=143168
1665
1666         Reviewed by Benjamin Poulain.
1667
1668         Renamed load8Signed() to load8SignedExtendTo32() and load16Signed() to load16SignedExtendTo32().
1669
1670         * assembler/MacroAssemblerARM.h:
1671         (JSC::MacroAssemblerARM::load8SignedExtendTo32):
1672         (JSC::MacroAssemblerARM::load16SignedExtendTo32):
1673         (JSC::MacroAssemblerARM::load8Signed): Deleted.
1674         (JSC::MacroAssemblerARM::load16Signed): Deleted.
1675         * assembler/MacroAssemblerARM64.h:
1676         (JSC::MacroAssemblerARM64::load16SignedExtendTo32):
1677         (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
1678         (JSC::MacroAssemblerARM64::load16Signed): Deleted.
1679         (JSC::MacroAssemblerARM64::load8Signed): Deleted.
1680         * assembler/MacroAssemblerARMv7.h:
1681         (JSC::MacroAssemblerARMv7::load16SignedExtendTo32):
1682         (JSC::MacroAssemblerARMv7::load8SignedExtendTo32):
1683         (JSC::MacroAssemblerARMv7::load16Signed): Deleted.
1684         (JSC::MacroAssemblerARMv7::load8Signed): Deleted.
1685         * assembler/MacroAssemblerMIPS.h:
1686         (JSC::MacroAssemblerMIPS::load8SignedExtendTo32):
1687         (JSC::MacroAssemblerMIPS::load16SignedExtendTo32):
1688         (JSC::MacroAssemblerMIPS::load8Signed): Deleted.
1689         (JSC::MacroAssemblerMIPS::load16Signed): Deleted.
1690         * assembler/MacroAssemblerSH4.h:
1691         (JSC::MacroAssemblerSH4::load8SignedExtendTo32):
1692         (JSC::MacroAssemblerSH4::load8):
1693         (JSC::MacroAssemblerSH4::load16SignedExtendTo32):
1694         (JSC::MacroAssemblerSH4::load16):
1695         (JSC::MacroAssemblerSH4::load8Signed): Deleted.
1696         (JSC::MacroAssemblerSH4::load16Signed): Deleted.
1697         * assembler/MacroAssemblerX86Common.h:
1698         (JSC::MacroAssemblerX86Common::load8SignedExtendTo32):
1699         (JSC::MacroAssemblerX86Common::load16SignedExtendTo32):
1700         (JSC::MacroAssemblerX86Common::load8Signed): Deleted.
1701         (JSC::MacroAssemblerX86Common::load16Signed): Deleted.
1702         * dfg/DFGSpeculativeJIT.cpp:
1703         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
1704         * jit/JITPropertyAccess.cpp:
1705         (JSC::JIT::emitIntTypedArrayGetByVal):
1706
1707 2015-03-27  Michael Saboff  <msaboff@apple.com>
1708
1709         Fix flakey dfg-int8array.js and dfg-int16array.js tests for ARM64
1710         https://bugs.webkit.org/show_bug.cgi?id=138390
1711
1712         Reviewed by Mark Lam.
1713
1714         Changed load8Signed() and load16Signed() to only sign extend the loaded value to 32 bits
1715         instead of 64 bits.  This is what X86-64 does.
1716
1717         * assembler/MacroAssemblerARM64.h:
1718         (JSC::MacroAssemblerARM64::load16Signed):
1719         (JSC::MacroAssemblerARM64::load8Signed):
1720
1721 2015-03-27  Saam Barati  <saambarati1@gmail.com>
1722
1723         Add back previously broken assert from bug 141869
1724         https://bugs.webkit.org/show_bug.cgi?id=143005
1725
1726         Reviewed by Michael Saboff.
1727
1728         * runtime/ExceptionHelpers.cpp:
1729         (JSC::invalidParameterInSourceAppender):
1730
1731 2015-03-26  Geoffrey Garen  <ggaren@apple.com>
1732
1733         Make some more objects use FastMalloc
1734         https://bugs.webkit.org/show_bug.cgi?id=143122
1735
1736         Reviewed by Csaba Osztrogonác.
1737
1738         * API/JSCallbackObject.h:
1739         * heap/IncrementalSweeper.h:
1740         * jit/JITThunks.h:
1741         * runtime/JSGlobalObjectDebuggable.h:
1742         * runtime/RegExpCache.h:
1743
1744 2015-03-27  Michael Saboff  <msaboff@apple.com>
1745
1746         Objects with numeric properties intermittently get a phantom 'length' property
1747         https://bugs.webkit.org/show_bug.cgi?id=142792
1748
1749         Reviewed by Csaba Osztrogonác.
1750
1751         Fixed a > (greater than) that should be a >> (right shift) in the code that disassembles
1752         test and branch instructions.  This function is used for linking tbz/tbnz branches between
1753         two seperately JIT'ed sections of code.  Sometime we'd create a bogus tbz instruction in
1754         the failure case checks in the GetById array length stub created for "obj.length" access.
1755         If the failure case code address was at a negative offset from the stub, we'd look for bit 1
1756         being set when we should have been looking for bit 0.
1757
1758         * assembler/ARM64Assembler.h:
1759         (JSC::ARM64Assembler::disassembleTestAndBranchImmediate):
1760
1761 2015-03-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1762
1763         Insert exception check around toPropertyKey call
1764         https://bugs.webkit.org/show_bug.cgi?id=142922
1765
1766         Reviewed by Geoffrey Garen.
1767
1768         In some places, exception check is missing after/before toPropertyKey.
1769         However, since it calls toString, it's observable to users,
1770
1771         Missing exception checks in Object.prototype methods can be
1772         observed since it would be overridden with toObject(null/undefined) errors.
1773         We inserted exception checks after toPropertyKey.
1774
1775         Missing exception checks in GetById related code can be
1776         observed since it would be overridden with toObject(null/undefined) errors.
1777         In this case, we need to insert exception checks before/after toPropertyKey
1778         since RequireObjectCoercible followed by toPropertyKey can cause exceptions.
1779
1780         JSValue::get checks null/undefined and raise an exception if |this| is null or undefined.
1781         However, we need to check whether the baseValue is object coercible before executing JSValue::toPropertyKey.
1782         According to the spec, we first perform RequireObjectCoercible and check the exception.
1783         And second, we perform ToPropertyKey and check the exception.
1784         Since JSValue::toPropertyKey can cause toString call, this is observable to users.
1785         For example, if the target is not object coercible,
1786         ToPropertyKey should not be executed, and toString should not be executed by ToPropertyKey.
1787         So the order of observable actions (RequireObjectCoercible and ToPropertyKey) should be correct to the spec.
1788
1789         This patch introduces JSValue::requireObjectCoercible and use it because of the following 2 reasons.
1790
1791         1. Using toObject instead of requireObjectCoercible produces unnecessary wrapper object.
1792
1793         toObject converts primitive types into wrapper objects.
1794         But it is not efficient since wrapper objects are not necessary
1795         if we look up methods from primitive values's prototype. (using synthesizePrototype is better).
1796
1797         2. Using the result of toObject is not correct to the spec.
1798
1799         To align to the spec correctly, we cannot use JSObject::get
1800         by using the wrapper object produced by the toObject suggested in (1).
1801         If we use JSObject that is converted by toObject, getter will be called by using this JSObject as |this|.
1802         It is not correct since getter should be called with the original |this| value that may be primitive types.
1803
1804         So in this patch, we use JSValue::requireObjectCoercible
1805         to check the target is object coercible and raise an error if it's not.
1806
1807         * dfg/DFGOperations.cpp:
1808         * jit/JITOperations.cpp:
1809         (JSC::getByVal):
1810         * llint/LLIntSlowPaths.cpp:
1811         (JSC::LLInt::getByVal):
1812         * runtime/CommonSlowPaths.cpp:
1813         (JSC::SLOW_PATH_DECL):
1814         * runtime/JSCJSValue.h:
1815         * runtime/JSCJSValueInlines.h:
1816         (JSC::JSValue::requireObjectCoercible):
1817         * runtime/ObjectPrototype.cpp:
1818         (JSC::objectProtoFuncHasOwnProperty):
1819         (JSC::objectProtoFuncDefineGetter):
1820         (JSC::objectProtoFuncDefineSetter):
1821         (JSC::objectProtoFuncLookupGetter):
1822         (JSC::objectProtoFuncLookupSetter):
1823         (JSC::objectProtoFuncPropertyIsEnumerable):
1824         * tests/stress/exception-in-to-property-key-should-be-handled-early-in-object-methods.js: Added.
1825         (shouldThrow):
1826         (if):
1827         * tests/stress/exception-in-to-property-key-should-be-handled-early.js: Added.
1828         (shouldThrow):
1829         (.):
1830
1831 2015-03-26  Joseph Pecoraro  <pecoraro@apple.com>
1832
1833         WebContent Crash when instantiating class with Type Profiling enabled
1834         https://bugs.webkit.org/show_bug.cgi?id=143037
1835
1836         Reviewed by Ryosuke Niwa.
1837
1838         * bytecompiler/BytecodeGenerator.h:
1839         * bytecompiler/BytecodeGenerator.cpp:
1840         (JSC::BytecodeGenerator::BytecodeGenerator):
1841         (JSC::BytecodeGenerator::emitMoveEmptyValue):
1842         We cannot profile the type of an uninitialized empty JSValue.
1843         Nor do we expect this to be necessary, since it is effectively
1844         an unseen undefined value. So add a way to put the empty value
1845         without profiling.
1846
1847         (JSC::BytecodeGenerator::emitMove):
1848         Add an assert to try to catch this issue early on, and force
1849         callers to explicitly use emitMoveEmptyValue instead.
1850
1851         * tests/typeProfiler/classes.js: Added.
1852         (wrapper.Base):
1853         (wrapper.Derived):
1854         (wrapper):
1855         Add test coverage both for this case and classes in general.
1856
1857 2015-03-26  Joseph Pecoraro  <pecoraro@apple.com>
1858
1859         Web Inspector: ES6: Provide a better view for Classes in the console
1860         https://bugs.webkit.org/show_bug.cgi?id=142999
1861
1862         Reviewed by Timothy Hatcher.
1863
1864         * inspector/protocol/Runtime.json:
1865         Provide a new `subtype` enum "class". This is a subtype of `type`
1866         "function", all other subtypes are subtypes of `object` types.
1867         For a class, the frontend will immediately want to get the prototype
1868         to enumerate its methods, so include the `classPrototype`.
1869
1870         * inspector/JSInjectedScriptHost.cpp:
1871         (Inspector::JSInjectedScriptHost::subtype):
1872         Denote class construction functions as "class" subtypes.
1873
1874         * inspector/InjectedScriptSource.js:
1875         Handling for the new "class" type.
1876
1877         * bytecode/UnlinkedCodeBlock.h:
1878         (JSC::UnlinkedFunctionExecutable::isClassConstructorFunction):
1879         * runtime/Executable.h:
1880         (JSC::FunctionExecutable::isClassConstructorFunction):
1881         * runtime/JSFunction.h:
1882         * runtime/JSFunctionInlines.h:
1883         (JSC::JSFunction::isClassConstructorFunction):
1884         Check if this function is a class constructor function. That information
1885         is on the UnlinkedFunctionExecutable, so plumb it through to JSFunction.
1886
1887 2015-03-26  Geoffrey Garen  <ggaren@apple.com>
1888
1889         Function.prototype.toString should not decompile the AST
1890         https://bugs.webkit.org/show_bug.cgi?id=142853
1891
1892         Reviewed by Darin Adler.
1893
1894         Following up on Darin's review comments.
1895
1896         * runtime/FunctionConstructor.cpp:
1897         (JSC::constructFunctionSkippingEvalEnabledCheck):
1898
1899 2015-03-26  Geoffrey Garen  <ggaren@apple.com>
1900
1901         "lineNo" does not match WebKit coding style guidelines
1902         https://bugs.webkit.org/show_bug.cgi?id=143119
1903
1904         Reviewed by Michael Saboff.
1905
1906         We can afford to use whole words.
1907
1908         * bytecode/CodeBlock.cpp:
1909         (JSC::CodeBlock::lineNumberForBytecodeOffset):
1910         (JSC::CodeBlock::expressionRangeForBytecodeOffset):
1911         * bytecode/UnlinkedCodeBlock.cpp:
1912         (JSC::UnlinkedFunctionExecutable::link):
1913         (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
1914         * bytecode/UnlinkedCodeBlock.h:
1915         * bytecompiler/NodesCodegen.cpp:
1916         (JSC::WhileNode::emitBytecode):
1917         * debugger/Debugger.cpp:
1918         (JSC::Debugger::toggleBreakpoint):
1919         * interpreter/Interpreter.cpp:
1920         (JSC::StackFrame::computeLineAndColumn):
1921         (JSC::GetStackTraceFunctor::operator()):
1922         (JSC::Interpreter::execute):
1923         * interpreter/StackVisitor.cpp:
1924         (JSC::StackVisitor::Frame::computeLineAndColumn):
1925         * parser/Nodes.h:
1926         (JSC::Node::firstLine):
1927         (JSC::Node::lineNo): Deleted.
1928         (JSC::StatementNode::firstLine): Deleted.
1929         * parser/ParserError.h:
1930         (JSC::ParserError::toErrorObject):
1931         * profiler/LegacyProfiler.cpp:
1932         (JSC::createCallIdentifierFromFunctionImp):
1933         * runtime/CodeCache.cpp:
1934         (JSC::CodeCache::getGlobalCodeBlock):
1935         * runtime/Executable.cpp:
1936         (JSC::ScriptExecutable::ScriptExecutable):
1937         (JSC::ScriptExecutable::newCodeBlockFor):
1938         (JSC::FunctionExecutable::fromGlobalCode):
1939         * runtime/Executable.h:
1940         (JSC::ScriptExecutable::firstLine):
1941         (JSC::ScriptExecutable::setOverrideLineNumber):
1942         (JSC::ScriptExecutable::hasOverrideLineNumber):
1943         (JSC::ScriptExecutable::overrideLineNumber):
1944         (JSC::ScriptExecutable::lineNo): Deleted.
1945         (JSC::ScriptExecutable::setOverrideLineNo): Deleted.
1946         (JSC::ScriptExecutable::hasOverrideLineNo): Deleted.
1947         (JSC::ScriptExecutable::overrideLineNo): Deleted.
1948         * runtime/FunctionConstructor.cpp:
1949         (JSC::constructFunctionSkippingEvalEnabledCheck):
1950         * runtime/FunctionConstructor.h:
1951         * tools/CodeProfile.cpp:
1952         (JSC::CodeProfile::report):
1953         * tools/CodeProfile.h:
1954         (JSC::CodeProfile::CodeProfile):
1955
1956 2015-03-26  Geoffrey Garen  <ggaren@apple.com>
1957
1958         Assertion firing in JavaScriptCore/parser/parser.h for statesman.com site
1959         https://bugs.webkit.org/show_bug.cgi?id=142974
1960
1961         Reviewed by Joseph Pecoraro.
1962
1963         This patch does two things:
1964
1965         (1) Restore JavaScriptCore's sanitization of line and column numbers to
1966         one-based values.
1967
1968         We need this because WebCore sometimes provides huge negative column
1969         numbers.
1970
1971         (2) Solve the attribute event listener line numbering problem a different
1972         way: Rather than offseting all line numbers by -1 in an attribute event
1973         listener in order to arrange for a custom result, instead use an explicit
1974         feature for saying "all errors in this code should map to this line number".
1975
1976         * bytecode/UnlinkedCodeBlock.cpp:
1977         (JSC::UnlinkedFunctionExecutable::link):
1978         (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
1979         * bytecode/UnlinkedCodeBlock.h:
1980         * interpreter/Interpreter.cpp:
1981         (JSC::StackFrame::computeLineAndColumn):
1982         (JSC::GetStackTraceFunctor::operator()):
1983         * interpreter/Interpreter.h:
1984         * interpreter/StackVisitor.cpp:
1985         (JSC::StackVisitor::Frame::computeLineAndColumn):
1986         * parser/ParserError.h:
1987         (JSC::ParserError::toErrorObject): Plumb through an override line number.
1988         When a function has an override line number, all syntax and runtime
1989         errors in the function will map to it. This is useful for attribute event
1990         listeners.
1991
1992         * parser/SourceCode.h:
1993         (JSC::SourceCode::SourceCode): Restore the old sanitization of line and
1994         column numbers to one-based integers. It was kind of a hack to remove this.
1995
1996         * runtime/Executable.cpp:
1997         (JSC::ScriptExecutable::ScriptExecutable):
1998         (JSC::FunctionExecutable::fromGlobalCode):
1999         * runtime/Executable.h:
2000         (JSC::ScriptExecutable::setOverrideLineNo):
2001         (JSC::ScriptExecutable::hasOverrideLineNo):
2002         (JSC::ScriptExecutable::overrideLineNo):
2003         * runtime/FunctionConstructor.cpp:
2004         (JSC::constructFunctionSkippingEvalEnabledCheck):
2005         * runtime/FunctionConstructor.h: Plumb through an override line number.
2006
2007 2015-03-26  Filip Pizlo  <fpizlo@apple.com>
2008
2009         If we're in code for accessing scoped arguments, we should probably check if the object is a scoped arguments rather than checking if it's a direct arguments.
2010
2011         Reviewed by Michael Saboff.
2012
2013         * jit/JITPropertyAccess.cpp:
2014         (JSC::JIT::emitScopedArgumentsGetByVal):
2015         * tests/stress/scoped-then-direct-arguments-get-by-val-in-baseline.js: Added.
2016
2017 2015-03-26  Filip Pizlo  <fpizlo@apple.com>
2018
2019         FTL ScopedArguments GetArrayLength generates incorrect code and crashes in LLVM
2020         https://bugs.webkit.org/show_bug.cgi?id=143098
2021
2022         Reviewed by Csaba Osztrogonác.
2023
2024         * ftl/FTLLowerDFGToLLVM.cpp:
2025         (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength): Fix a typo.
2026         * tests/stress/scoped-arguments-array-length.js: Added. This test previously always crashed in ftl-no-cjit mode.
2027
2028 2015-03-26  Csaba Osztrogonác  <ossy@webkit.org>
2029
2030         Unreviewed gardening, skip failing tests on AArch64 Linux.
2031
2032         * tests/mozilla/mozilla-tests.yaml:
2033         * tests/stress/cached-prototype-setter.js:
2034
2035 2015-03-26  Filip Pizlo  <fpizlo@apple.com>
2036
2037         Unreviewed, fixes to silly things. While landing fixes to r181993, I introduced crashes. This fixes them.
2038
2039         * dfg/DFGConstantFoldingPhase.cpp:
2040         (JSC::DFG::ConstantFoldingPhase::foldConstants): I landed a fix for a VS warning. It broke this. Now I'm fixing it.
2041         * ftl/FTLCompile.cpp:
2042         (JSC::FTL::compile): Make sure we pass the module when dumping. This makes FTL debugging possible again.
2043         * ftl/FTLState.cpp:
2044         (JSC::FTL::State::dumpState): New overload that takes a module, so that we can call this after FTL::compile() clears State's module.
2045         * ftl/FTLState.h:
2046
2047 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
2048
2049         Unreviewed, fix obvious goof that was causing 32-bit debug crashes. The 64-bit version did it
2050         right, so this just makes 32-bit do the same.
2051
2052         * dfg/DFGSpeculativeJIT32_64.cpp:
2053         (JSC::DFG::SpeculativeJIT::emitCall):
2054
2055 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
2056
2057         Fix a typo that ggaren found but that I didn't fix before.
2058
2059         * runtime/DirectArgumentsOffset.h:
2060
2061 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
2062
2063         Unreviewed, VC found a bug. This fixes the bug.
2064
2065         * dfg/DFGConstantFoldingPhase.cpp:
2066         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2067
2068 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
2069
2070         Unreviewed, try to fix Windows build.
2071
2072         * runtime/ClonedArguments.cpp:
2073         (JSC::ClonedArguments::createWithInlineFrame):
2074
2075 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
2076
2077         Unreviewed, fix debug build.
2078
2079         * bytecompiler/NodesCodegen.cpp:
2080         (JSC::ConstDeclNode::emitCodeSingle):
2081
2082 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
2083
2084         Unreviewed, fix CLOOP build.
2085
2086         * dfg/DFGMinifiedID.h:
2087
2088 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
2089
2090         Heap variables shouldn't end up in the stack frame
2091         https://bugs.webkit.org/show_bug.cgi?id=141174
2092
2093         Reviewed by Geoffrey Garen.
2094
2095         This is a major change to how JavaScriptCore handles declared variables (i.e. "var"). It removes
2096         any ambiguity about whether a variable should be in the heap or on the stack. A variable will no
2097         longer move between heap and stack during its lifetime. This enables a bunch of optimizations and
2098         simplifications:
2099
2100         - Accesses to variables no longer need checks or indirections to determine where the variable is
2101           at that moment in time. For example, loading a closure variable now takes just one load instead
2102           of two. Loading an argument by index now takes a bounds check and a load in the fastest case
2103           (when no arguments object allocation is required) while previously that same operation required
2104           a "did I allocate arguments yet" check, a bounds check, and then the load.
2105
2106         - Reasoning about the allocation of an activation or arguments object now follows the same simple
2107           logic as the allocation of any other kind of object. Previously, those objects were lazily
2108           allocated - so an allocation instruction wasn't the actual allocation site, since it might not
2109           allocate anything at all. This made the implementation of traditional escape analyses really
2110           awkward, and ultimately it meant that we missed important cases. Now, we can reason about the
2111           arguments object using the usual SSA tricks which allows for more comprehensive removal.
2112
2113         - The allocations of arguments objects, functions, and activations are now much faster. While
2114           this patch generally expands our ability to eliminate arguments object allocations, an earlier
2115           version of the patch - which lacked that functionality - was a progression on some arguments-
2116           and closure-happy benchmarks because although no allocations were eliminated, all allocations
2117           were faster.
2118
2119         - There is no tear-off. The runtime no loner needs to know about where on the stack a frame keeps
2120           its arguments objects or activations. The runtime doesn't have to do things to the arguments
2121           objects and activations that a frame allocated, when the frame is unwound. We always had horrid
2122           bugs in that code, so it's good to see it go. This removes *a ton* of machinery from the DFG,
2123           FTL, CodeBlock, and other places. All of the things having to do with "captured variables" is
2124           now gone. This also enables implementing block-scoping. Without this change, block-scope
2125           support would require telling CodeBlock and all of the rest of the runtime about all of the
2126           variables that store currently-live scopes. That would have been so disastrously hard that it
2127           might as well be impossible. With this change, it's fair game for the bytecode generator to
2128           simply allocate whatever activations it wants, wherever it wants, and to keep them live for
2129           however long it wants. This all works, because after bytecode generation, an activation is just
2130           an object and variables that refer to it are just normal variables.
2131
2132         - SymbolTable can now tell you explicitly where a variable lives. The answer is in the form of a
2133           VarOffset object, which has methods like isStack(), isScope(), etc. VirtualRegister is never
2134           used for offsets of non-stack variables anymore. We now have shiny new objects for other kinds
2135           of offsets - ScopeOffset for offsets into scopes, and DirectArgumentsOffset for offsets into
2136           an arguments object.
2137
2138         - Functions that create activations can now tier-up into the FTL. Previously they couldn't. Also,
2139           using activations used to prevent inlining; now functions that use activations can be inlined
2140           just fine.
2141
2142         This is a >1% speed-up on Octane. This is a >2% speed-up on CompressionBench. This is a tiny
2143         speed-up on AsmBench (~0.4% or something). This looks like it might be a speed-up on SunSpider.
2144         It's only a slow-down on very short-running microbenchmarks we had previously written for our old
2145         style of tear-off-based arguments optimization. Those benchmarks are not part of any major suite.
2146
2147         The easiest way of understanding this change is to start by looking at the changes in runtime/,
2148         and then the changes in bytecompiler/, and then sort of work your way up the compiler tiers.
2149
2150         * CMakeLists.txt:
2151         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2152         * JavaScriptCore.xcodeproj/project.pbxproj:
2153         * assembler/AbortReason.h:
2154         * assembler/AbstractMacroAssembler.h:
2155         (JSC::AbstractMacroAssembler::BaseIndex::withOffset):
2156         * bytecode/ByValInfo.h:
2157         (JSC::hasOptimizableIndexingForJSType):
2158         (JSC::hasOptimizableIndexing):
2159         (JSC::jitArrayModeForJSType):
2160         (JSC::jitArrayModePermitsPut):
2161         (JSC::jitArrayModeForStructure):
2162         * bytecode/BytecodeKills.h: Added.
2163         (JSC::BytecodeKills::BytecodeKills):
2164         (JSC::BytecodeKills::operandIsKilled):
2165         (JSC::BytecodeKills::forEachOperandKilledAt):
2166         (JSC::BytecodeKills::KillSet::KillSet):
2167         (JSC::BytecodeKills::KillSet::add):
2168         (JSC::BytecodeKills::KillSet::forEachLocal):
2169         (JSC::BytecodeKills::KillSet::contains):
2170         * bytecode/BytecodeList.json:
2171         * bytecode/BytecodeLivenessAnalysis.cpp:
2172         (JSC::isValidRegisterForLiveness):
2173         (JSC::stepOverInstruction):
2174         (JSC::BytecodeLivenessAnalysis::runLivenessFixpoint):
2175         (JSC::BytecodeLivenessAnalysis::getLivenessInfoAtBytecodeOffset):
2176         (JSC::BytecodeLivenessAnalysis::operandIsLiveAtBytecodeOffset):
2177         (JSC::BytecodeLivenessAnalysis::computeFullLiveness):
2178         (JSC::BytecodeLivenessAnalysis::computeKills):
2179         (JSC::indexForOperand): Deleted.
2180         (JSC::BytecodeLivenessAnalysis::getLivenessInfoForNonCapturedVarsAtBytecodeOffset): Deleted.
2181         (JSC::getLivenessInfo): Deleted.
2182         * bytecode/BytecodeLivenessAnalysis.h:
2183         * bytecode/BytecodeLivenessAnalysisInlines.h:
2184         (JSC::operandIsAlwaysLive):
2185         (JSC::operandThatIsNotAlwaysLiveIsLive):
2186         (JSC::operandIsLive):
2187         * bytecode/BytecodeUseDef.h:
2188         (JSC::computeUsesForBytecodeOffset):
2189         (JSC::computeDefsForBytecodeOffset):
2190         * bytecode/CodeBlock.cpp:
2191         (JSC::CodeBlock::dumpBytecode):
2192         (JSC::CodeBlock::CodeBlock):
2193         (JSC::CodeBlock::nameForRegister):
2194         (JSC::CodeBlock::validate):
2195         (JSC::CodeBlock::isCaptured): Deleted.
2196         (JSC::CodeBlock::framePointerOffsetToGetActivationRegisters): Deleted.
2197         (JSC::CodeBlock::machineSlowArguments): Deleted.
2198         * bytecode/CodeBlock.h:
2199         (JSC::unmodifiedArgumentsRegister): Deleted.
2200         (JSC::CodeBlock::setArgumentsRegister): Deleted.
2201         (JSC::CodeBlock::argumentsRegister): Deleted.
2202         (JSC::CodeBlock::uncheckedArgumentsRegister): Deleted.
2203         (JSC::CodeBlock::usesArguments): Deleted.
2204         (JSC::CodeBlock::captureCount): Deleted.
2205         (JSC::CodeBlock::captureStart): Deleted.
2206         (JSC::CodeBlock::captureEnd): Deleted.
2207         (JSC::CodeBlock::argumentIndexAfterCapture): Deleted.
2208         (JSC::CodeBlock::hasSlowArguments): Deleted.
2209         (JSC::ExecState::argumentAfterCapture): Deleted.
2210         * bytecode/CodeOrigin.h:
2211         * bytecode/DataFormat.h:
2212         (JSC::dataFormatToString):
2213         * bytecode/FullBytecodeLiveness.h:
2214         (JSC::FullBytecodeLiveness::getLiveness):
2215         (JSC::FullBytecodeLiveness::operandIsLive):
2216         (JSC::FullBytecodeLiveness::FullBytecodeLiveness): Deleted.
2217         (JSC::FullBytecodeLiveness::getOut): Deleted.
2218         * bytecode/Instruction.h:
2219         (JSC::Instruction::Instruction):
2220         * bytecode/Operands.h:
2221         (JSC::Operands::virtualRegisterForIndex):
2222         * bytecode/SpeculatedType.cpp:
2223         (JSC::dumpSpeculation):
2224         (JSC::speculationToAbbreviatedString):
2225         (JSC::speculationFromClassInfo):
2226         * bytecode/SpeculatedType.h:
2227         (JSC::isDirectArgumentsSpeculation):
2228         (JSC::isScopedArgumentsSpeculation):
2229         (JSC::isActionableMutableArraySpeculation):
2230         (JSC::isActionableArraySpeculation):
2231         (JSC::isArgumentsSpeculation): Deleted.
2232         * bytecode/UnlinkedCodeBlock.cpp:
2233         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
2234         * bytecode/UnlinkedCodeBlock.h:
2235         (JSC::UnlinkedCodeBlock::setArgumentsRegister): Deleted.
2236         (JSC::UnlinkedCodeBlock::usesArguments): Deleted.
2237         (JSC::UnlinkedCodeBlock::argumentsRegister): Deleted.
2238         * bytecode/ValueRecovery.cpp:
2239         (JSC::ValueRecovery::dumpInContext):
2240         * bytecode/ValueRecovery.h:
2241         (JSC::ValueRecovery::directArgumentsThatWereNotCreated):
2242         (JSC::ValueRecovery::outOfBandArgumentsThatWereNotCreated):
2243         (JSC::ValueRecovery::nodeID):
2244         (JSC::ValueRecovery::argumentsThatWereNotCreated): Deleted.
2245         * bytecode/VirtualRegister.h:
2246         (JSC::VirtualRegister::operator==):
2247         (JSC::VirtualRegister::operator!=):
2248         (JSC::VirtualRegister::operator<):
2249         (JSC::VirtualRegister::operator>):
2250         (JSC::VirtualRegister::operator<=):
2251         (JSC::VirtualRegister::operator>=):
2252         * bytecompiler/BytecodeGenerator.cpp:
2253         (JSC::BytecodeGenerator::generate):
2254         (JSC::BytecodeGenerator::BytecodeGenerator):
2255         (JSC::BytecodeGenerator::initializeNextParameter):
2256         (JSC::BytecodeGenerator::visibleNameForParameter):
2257         (JSC::BytecodeGenerator::emitMove):
2258         (JSC::BytecodeGenerator::variable):
2259         (JSC::BytecodeGenerator::createVariable):
2260         (JSC::BytecodeGenerator::emitResolveScope):
2261         (JSC::BytecodeGenerator::emitGetFromScope):
2262         (JSC::BytecodeGenerator::emitPutToScope):
2263         (JSC::BytecodeGenerator::initializeVariable):
2264         (JSC::BytecodeGenerator::emitInstanceOf):
2265         (JSC::BytecodeGenerator::emitNewFunction):
2266         (JSC::BytecodeGenerator::emitNewFunctionInternal):
2267         (JSC::BytecodeGenerator::emitCall):
2268         (JSC::BytecodeGenerator::emitReturn):
2269         (JSC::BytecodeGenerator::emitConstruct):
2270         (JSC::BytecodeGenerator::isArgumentNumber):
2271         (JSC::BytecodeGenerator::emitEnumeration):
2272         (JSC::BytecodeGenerator::addVar): Deleted.
2273         (JSC::BytecodeGenerator::emitInitLazyRegister): Deleted.
2274         (JSC::BytecodeGenerator::initializeCapturedVariable): Deleted.
2275         (JSC::BytecodeGenerator::resolveCallee): Deleted.
2276         (JSC::BytecodeGenerator::addCallee): Deleted.
2277         (JSC::BytecodeGenerator::addParameter): Deleted.
2278         (JSC::BytecodeGenerator::willResolveToArgumentsRegister): Deleted.
2279         (JSC::BytecodeGenerator::uncheckedLocalArgumentsRegister): Deleted.
2280         (JSC::BytecodeGenerator::createLazyRegisterIfNecessary): Deleted.
2281         (JSC::BytecodeGenerator::isCaptured): Deleted.
2282         (JSC::BytecodeGenerator::local): Deleted.
2283         (JSC::BytecodeGenerator::constLocal): Deleted.
2284         (JSC::BytecodeGenerator::emitResolveConstantLocal): Deleted.
2285         (JSC::BytecodeGenerator::emitGetArgumentsLength): Deleted.
2286         (JSC::BytecodeGenerator::emitGetArgumentByVal): Deleted.
2287         (JSC::BytecodeGenerator::emitLazyNewFunction): Deleted.
2288         (JSC::BytecodeGenerator::createArgumentsIfNecessary): Deleted.
2289         * bytecompiler/BytecodeGenerator.h:
2290         (JSC::Variable::Variable):
2291         (JSC::Variable::isResolved):
2292         (JSC::Variable::ident):
2293         (JSC::Variable::offset):
2294         (JSC::Variable::isLocal):
2295         (JSC::Variable::local):
2296         (JSC::Variable::isSpecial):
2297         (JSC::BytecodeGenerator::argumentsRegister):
2298         (JSC::BytecodeGenerator::emitNode):
2299         (JSC::BytecodeGenerator::registerFor):
2300         (JSC::Local::Local): Deleted.
2301         (JSC::Local::operator bool): Deleted.
2302         (JSC::Local::get): Deleted.
2303         (JSC::Local::isSpecial): Deleted.
2304         (JSC::ResolveScopeInfo::ResolveScopeInfo): Deleted.
2305         (JSC::ResolveScopeInfo::isLocal): Deleted.
2306         (JSC::ResolveScopeInfo::localIndex): Deleted.
2307         (JSC::BytecodeGenerator::hasSafeLocalArgumentsRegister): Deleted.
2308         (JSC::BytecodeGenerator::captureMode): Deleted.
2309         (JSC::BytecodeGenerator::shouldTearOffArgumentsEagerly): Deleted.
2310         (JSC::BytecodeGenerator::shouldCreateArgumentsEagerly): Deleted.
2311         (JSC::BytecodeGenerator::hasWatchableVariable): Deleted.
2312         (JSC::BytecodeGenerator::watchableVariableIdentifier): Deleted.
2313         * bytecompiler/NodesCodegen.cpp:
2314         (JSC::ResolveNode::isPure):
2315         (JSC::ResolveNode::emitBytecode):
2316         (JSC::BracketAccessorNode::emitBytecode):
2317         (JSC::DotAccessorNode::emitBytecode):
2318         (JSC::EvalFunctionCallNode::emitBytecode):
2319         (JSC::FunctionCallResolveNode::emitBytecode):
2320         (JSC::CallFunctionCallDotNode::emitBytecode):
2321         (JSC::ApplyFunctionCallDotNode::emitBytecode):
2322         (JSC::PostfixNode::emitResolve):
2323         (JSC::DeleteResolveNode::emitBytecode):
2324         (JSC::TypeOfResolveNode::emitBytecode):
2325         (JSC::PrefixNode::emitResolve):
2326         (JSC::ReadModifyResolveNode::emitBytecode):
2327         (JSC::AssignResolveNode::emitBytecode):
2328         (JSC::ConstDeclNode::emitCodeSingle):
2329         (JSC::EmptyVarExpression::emitBytecode):
2330         (JSC::ForInNode::tryGetBoundLocal):
2331         (JSC::ForInNode::emitLoopHeader):
2332         (JSC::ForOfNode::emitBytecode):
2333         (JSC::ArrayPatternNode::emitDirectBinding):
2334         (JSC::BindingNode::bindValue):
2335         (JSC::getArgumentByVal): Deleted.
2336         * dfg/DFGAbstractHeap.h:
2337         * dfg/DFGAbstractInterpreter.h:
2338         * dfg/DFGAbstractInterpreterInlines.h:
2339         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2340         (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberWorld):
2341         (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberCapturedVars): Deleted.
2342         * dfg/DFGAbstractValue.h:
2343         * dfg/DFGArgumentPosition.h:
2344         (JSC::DFG::ArgumentPosition::addVariable):
2345         * dfg/DFGArgumentsEliminationPhase.cpp: Added.
2346         (JSC::DFG::performArgumentsElimination):
2347         * dfg/DFGArgumentsEliminationPhase.h: Added.
2348         * dfg/DFGArgumentsSimplificationPhase.cpp: Removed.
2349         * dfg/DFGArgumentsSimplificationPhase.h: Removed.
2350         * dfg/DFGArgumentsUtilities.cpp: Added.
2351         (JSC::DFG::argumentsInvolveStackSlot):
2352         (JSC::DFG::emitCodeToGetArgumentsArrayLength):
2353         * dfg/DFGArgumentsUtilities.h: Added.
2354         * dfg/DFGArrayMode.cpp:
2355         (JSC::DFG::ArrayMode::refine):
2356         (JSC::DFG::ArrayMode::alreadyChecked):
2357         (JSC::DFG::arrayTypeToString):
2358         * dfg/DFGArrayMode.h:
2359         (JSC::DFG::ArrayMode::canCSEStorage):
2360         (JSC::DFG::ArrayMode::modeForPut):
2361         * dfg/DFGAvailabilityMap.cpp:
2362         (JSC::DFG::AvailabilityMap::prune):
2363         * dfg/DFGAvailabilityMap.h:
2364         (JSC::DFG::AvailabilityMap::closeOverNodes):
2365         (JSC::DFG::AvailabilityMap::closeStartingWithLocal):
2366         * dfg/DFGBackwardsPropagationPhase.cpp:
2367         (JSC::DFG::BackwardsPropagationPhase::propagate):
2368         * dfg/DFGByteCodeParser.cpp:
2369         (JSC::DFG::ByteCodeParser::newVariableAccessData):
2370         (JSC::DFG::ByteCodeParser::getLocal):
2371         (JSC::DFG::ByteCodeParser::setLocal):
2372         (JSC::DFG::ByteCodeParser::getArgument):
2373         (JSC::DFG::ByteCodeParser::setArgument):
2374         (JSC::DFG::ByteCodeParser::flushDirect):
2375         (JSC::DFG::ByteCodeParser::flush):
2376         (JSC::DFG::ByteCodeParser::noticeArgumentsUse):
2377         (JSC::DFG::ByteCodeParser::handleVarargsCall):
2378         (JSC::DFG::ByteCodeParser::attemptToInlineCall):
2379         (JSC::DFG::ByteCodeParser::handleInlining):
2380         (JSC::DFG::ByteCodeParser::parseBlock):
2381         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
2382         (JSC::DFG::ByteCodeParser::parseCodeBlock):
2383         * dfg/DFGCPSRethreadingPhase.cpp:
2384         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
2385         (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
2386         * dfg/DFGCSEPhase.cpp:
2387         * dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h: Added.
2388         (JSC::DFG::CallCreateDirectArgumentsSlowPathGenerator::CallCreateDirectArgumentsSlowPathGenerator):
2389         * dfg/DFGCapabilities.cpp:
2390         (JSC::DFG::isSupportedForInlining):
2391         (JSC::DFG::capabilityLevel):
2392         * dfg/DFGClobberize.h:
2393         (JSC::DFG::clobberize):
2394         * dfg/DFGCommon.h:
2395         * dfg/DFGCommonData.h:
2396         (JSC::DFG::CommonData::CommonData):
2397         * dfg/DFGConstantFoldingPhase.cpp:
2398         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2399         * dfg/DFGDCEPhase.cpp:
2400         (JSC::DFG::DCEPhase::cleanVariables):
2401         * dfg/DFGDisassembler.h:
2402         * dfg/DFGDoesGC.cpp:
2403         (JSC::DFG::doesGC):
2404         * dfg/DFGFixupPhase.cpp:
2405         (JSC::DFG::FixupPhase::fixupNode):
2406         * dfg/DFGFlushFormat.cpp:
2407         (WTF::printInternal):
2408         * dfg/DFGFlushFormat.h:
2409         (JSC::DFG::resultFor):
2410         (JSC::DFG::useKindFor):
2411         (JSC::DFG::dataFormatFor):
2412         * dfg/DFGForAllKills.h: Added.
2413         (JSC::DFG::forAllLiveNodesAtTail):
2414         (JSC::DFG::forAllDirectlyKilledOperands):
2415         (JSC::DFG::forAllKilledOperands):
2416         (JSC::DFG::forAllKilledNodesAtNodeIndex):
2417         (JSC::DFG::forAllKillsInBlock):
2418         * dfg/DFGGraph.cpp:
2419         (JSC::DFG::Graph::Graph):
2420         (JSC::DFG::Graph::dump):
2421         (JSC::DFG::Graph::substituteGetLocal):
2422         (JSC::DFG::Graph::livenessFor):
2423         (JSC::DFG::Graph::killsFor):
2424         (JSC::DFG::Graph::tryGetConstantClosureVar):
2425         (JSC::DFG::Graph::tryGetRegisters): Deleted.
2426         * dfg/DFGGraph.h:
2427         (JSC::DFG::Graph::symbolTableFor):
2428         (JSC::DFG::Graph::uses):
2429         (JSC::DFG::Graph::bytecodeRegisterForArgument): Deleted.
2430         (JSC::DFG::Graph::capturedVarsFor): Deleted.
2431         (JSC::DFG::Graph::usesArguments): Deleted.
2432         (JSC::DFG::Graph::argumentsRegisterFor): Deleted.
2433         (JSC::DFG::Graph::machineArgumentsRegisterFor): Deleted.
2434         (JSC::DFG::Graph::uncheckedArgumentsRegisterFor): Deleted.
2435         * dfg/DFGHeapLocation.cpp:
2436         (WTF::printInternal):
2437         * dfg/DFGHeapLocation.h:
2438         * dfg/DFGInPlaceAbstractState.cpp:
2439         (JSC::DFG::InPlaceAbstractState::initialize):
2440         (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
2441         * dfg/DFGJITCompiler.cpp:
2442         (JSC::DFG::JITCompiler::link):
2443         * dfg/DFGMayExit.cpp:
2444         (JSC::DFG::mayExit):
2445         * dfg/DFGMinifiedID.h:
2446         * dfg/DFGMinifiedNode.cpp:
2447         (JSC::DFG::MinifiedNode::fromNode):
2448         * dfg/DFGMinifiedNode.h:
2449         (JSC::DFG::belongsInMinifiedGraph):
2450         (JSC::DFG::MinifiedNode::hasInlineCallFrame):
2451         (JSC::DFG::MinifiedNode::inlineCallFrame):
2452         * dfg/DFGNode.cpp:
2453         (JSC::DFG::Node::convertToIdentityOn):
2454         * dfg/DFGNode.h:
2455         (JSC::DFG::Node::hasConstant):
2456         (JSC::DFG::Node::constant):
2457         (JSC::DFG::Node::hasScopeOffset):
2458         (JSC::DFG::Node::scopeOffset):
2459         (JSC::DFG::Node::hasDirectArgumentsOffset):
2460         (JSC::DFG::Node::capturedArgumentsOffset):
2461         (JSC::DFG::Node::variablePointer):
2462         (JSC::DFG::Node::hasCallVarargsData):
2463         (JSC::DFG::Node::hasLoadVarargsData):
2464         (JSC::DFG::Node::hasHeapPrediction):
2465         (JSC::DFG::Node::hasCellOperand):
2466         (JSC::DFG::Node::objectMaterializationData):
2467         (JSC::DFG::Node::isPhantomAllocation):
2468         (JSC::DFG::Node::willHaveCodeGenOrOSR):
2469         (JSC::DFG::Node::shouldSpeculateDirectArguments):
2470         (JSC::DFG::Node::shouldSpeculateScopedArguments):
2471         (JSC::DFG::Node::isPhantomArguments): Deleted.
2472         (JSC::DFG::Node::hasVarNumber): Deleted.
2473         (JSC::DFG::Node::varNumber): Deleted.
2474         (JSC::DFG::Node::registerPointer): Deleted.
2475         (JSC::DFG::Node::shouldSpeculateArguments): Deleted.
2476         * dfg/DFGNodeType.h:
2477         * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
2478         (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
2479         (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
2480         * dfg/DFGOSRExitCompiler.cpp:
2481         (JSC::DFG::OSRExitCompiler::emitRestoreArguments):
2482         * dfg/DFGOSRExitCompiler.h:
2483         (JSC::DFG::OSRExitCompiler::badIndex): Deleted.
2484         (JSC::DFG::OSRExitCompiler::initializePoisoned): Deleted.
2485         (JSC::DFG::OSRExitCompiler::poisonIndex): Deleted.
2486         * dfg/DFGOSRExitCompiler32_64.cpp:
2487         (JSC::DFG::OSRExitCompiler::compileExit):
2488         * dfg/DFGOSRExitCompiler64.cpp:
2489         (JSC::DFG::OSRExitCompiler::compileExit):
2490         * dfg/DFGOSRExitCompilerCommon.cpp:
2491         (JSC::DFG::reifyInlinedCallFrames):
2492         (JSC::DFG::ArgumentsRecoveryGenerator::ArgumentsRecoveryGenerator): Deleted.
2493         (JSC::DFG::ArgumentsRecoveryGenerator::~ArgumentsRecoveryGenerator): Deleted.
2494         (JSC::DFG::ArgumentsRecoveryGenerator::generateFor): Deleted.
2495         * dfg/DFGOSRExitCompilerCommon.h:
2496         * dfg/DFGOperations.cpp:
2497         * dfg/DFGOperations.h:
2498         * dfg/DFGPlan.cpp:
2499         (JSC::DFG::Plan::compileInThreadImpl):
2500         * dfg/DFGPreciseLocalClobberize.h:
2501         (JSC::DFG::PreciseLocalClobberizeAdaptor::read):
2502         (JSC::DFG::PreciseLocalClobberizeAdaptor::write):
2503         (JSC::DFG::PreciseLocalClobberizeAdaptor::def):
2504         (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
2505         (JSC::DFG::preciseLocalClobberize):
2506         (JSC::DFG::PreciseLocalClobberizeAdaptor::writeTop): Deleted.
2507         (JSC::DFG::forEachLocalReadByUnwind): Deleted.
2508         * dfg/DFGPredictionPropagationPhase.cpp:
2509         (JSC::DFG::PredictionPropagationPhase::run):
2510         (JSC::DFG::PredictionPropagationPhase::propagate):
2511         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
2512         (JSC::DFG::PredictionPropagationPhase::propagateThroughArgumentPositions):
2513         * dfg/DFGPromoteHeapAccess.h:
2514         (JSC::DFG::promoteHeapAccess):
2515         * dfg/DFGPromotedHeapLocation.cpp:
2516         (WTF::printInternal):
2517         * dfg/DFGPromotedHeapLocation.h:
2518         * dfg/DFGSSAConversionPhase.cpp:
2519         (JSC::DFG::SSAConversionPhase::run):
2520         * dfg/DFGSafeToExecute.h:
2521         (JSC::DFG::safeToExecute):
2522         * dfg/DFGSpeculativeJIT.cpp:
2523         (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
2524         (JSC::DFG::SpeculativeJIT::emitGetLength):
2525         (JSC::DFG::SpeculativeJIT::emitGetCallee):
2526         (JSC::DFG::SpeculativeJIT::emitGetArgumentStart):
2527         (JSC::DFG::SpeculativeJIT::checkArray):
2528         (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
2529         (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
2530         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
2531         (JSC::DFG::SpeculativeJIT::compileNewFunction):
2532         (JSC::DFG::SpeculativeJIT::compileForwardVarargs):
2533         (JSC::DFG::SpeculativeJIT::compileCreateActivation):
2534         (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
2535         (JSC::DFG::SpeculativeJIT::compileGetFromArguments):
2536         (JSC::DFG::SpeculativeJIT::compilePutToArguments):
2537         (JSC::DFG::SpeculativeJIT::compileCreateScopedArguments):
2538         (JSC::DFG::SpeculativeJIT::compileCreateClonedArguments):
2539         (JSC::DFG::SpeculativeJIT::emitAllocateArguments): Deleted.
2540         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): Deleted.
2541         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength): Deleted.
2542         (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck): Deleted.
2543         (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression): Deleted.
2544         * dfg/DFGSpeculativeJIT.h:
2545         (JSC::DFG::SpeculativeJIT::callOperation):
2546         (JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize):
2547         (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
2548         (JSC::DFG::SpeculativeJIT::framePointerOffsetToGetActivationRegisters): Deleted.
2549         * dfg/DFGSpeculativeJIT32_64.cpp:
2550         (JSC::DFG::SpeculativeJIT::emitCall):
2551         (JSC::DFG::SpeculativeJIT::compile):
2552         * dfg/DFGSpeculativeJIT64.cpp:
2553         (JSC::DFG::SpeculativeJIT::emitCall):
2554         (JSC::DFG::SpeculativeJIT::compile):
2555         * dfg/DFGStackLayoutPhase.cpp:
2556         (JSC::DFG::StackLayoutPhase::run):
2557         * dfg/DFGStrengthReductionPhase.cpp:
2558         (JSC::DFG::StrengthReductionPhase::handleNode):
2559         * dfg/DFGStructureRegistrationPhase.cpp:
2560         (JSC::DFG::StructureRegistrationPhase::run):
2561         * dfg/DFGUnificationPhase.cpp:
2562         (JSC::DFG::UnificationPhase::run):
2563         * dfg/DFGValidate.cpp:
2564         (JSC::DFG::Validate::validateCPS):
2565         * dfg/DFGValueSource.cpp:
2566         (JSC::DFG::ValueSource::dump):
2567         * dfg/DFGValueSource.h:
2568         (JSC::DFG::dataFormatToValueSourceKind):
2569         (JSC::DFG::valueSourceKindToDataFormat):
2570         (JSC::DFG::ValueSource::ValueSource):
2571         (JSC::DFG::ValueSource::forFlushFormat):
2572         (JSC::DFG::ValueSource::valueRecovery):
2573         * dfg/DFGVarargsForwardingPhase.cpp: Added.
2574         (JSC::DFG::performVarargsForwarding):
2575         * dfg/DFGVarargsForwardingPhase.h: Added.
2576         * dfg/DFGVariableAccessData.cpp:
2577         (JSC::DFG::VariableAccessData::VariableAccessData):
2578         (JSC::DFG::VariableAccessData::flushFormat):
2579         (JSC::DFG::VariableAccessData::mergeIsCaptured): Deleted.
2580         * dfg/DFGVariableAccessData.h:
2581         (JSC::DFG::VariableAccessData::shouldNeverUnbox):
2582         (JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
2583         (JSC::DFG::VariableAccessData::isCaptured): Deleted.
2584         (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias): Deleted.
2585         (JSC::DFG::VariableAccessData::isArgumentsAlias): Deleted.
2586         * dfg/DFGVariableAccessDataDump.cpp:
2587         (JSC::DFG::VariableAccessDataDump::dump):
2588         * dfg/DFGVariableAccessDataDump.h:
2589         * dfg/DFGVariableEventStream.cpp:
2590         (JSC::DFG::VariableEventStream::tryToSetConstantRecovery):
2591         * dfg/DFGVariableEventStream.h:
2592         * ftl/FTLAbstractHeap.cpp:
2593         (JSC::FTL::AbstractHeap::dump):
2594         (JSC::FTL::AbstractField::dump):
2595         (JSC::FTL::IndexedAbstractHeap::dump):
2596         (JSC::FTL::NumberedAbstractHeap::dump):
2597         (JSC::FTL::AbsoluteAbstractHeap::dump):
2598         * ftl/FTLAbstractHeap.h:
2599         * ftl/FTLAbstractHeapRepository.cpp:
2600         * ftl/FTLAbstractHeapRepository.h:
2601         * ftl/FTLCapabilities.cpp:
2602         (JSC::FTL::canCompile):
2603         * ftl/FTLCompile.cpp:
2604         (JSC::FTL::mmAllocateDataSection):
2605         * ftl/FTLExitArgument.cpp:
2606         (JSC::FTL::ExitArgument::dump):
2607         * ftl/FTLExitPropertyValue.cpp:
2608         (JSC::FTL::ExitPropertyValue::withLocalsOffset):
2609         * ftl/FTLExitPropertyValue.h:
2610         * ftl/FTLExitTimeObjectMaterialization.cpp:
2611         (JSC::FTL::ExitTimeObjectMaterialization::ExitTimeObjectMaterialization):
2612         (JSC::FTL::ExitTimeObjectMaterialization::accountForLocalsOffset):
2613         * ftl/FTLExitTimeObjectMaterialization.h:
2614         (JSC::FTL::ExitTimeObjectMaterialization::origin):
2615         * ftl/FTLExitValue.cpp:
2616         (JSC::FTL::ExitValue::withLocalsOffset):
2617         (JSC::FTL::ExitValue::valueFormat):
2618         (JSC::FTL::ExitValue::dumpInContext):
2619         * ftl/FTLExitValue.h:
2620         (JSC::FTL::ExitValue::isArgument):
2621         (JSC::FTL::ExitValue::argumentsObjectThatWasNotCreated): Deleted.
2622         (JSC::FTL::ExitValue::isArgumentsObjectThatWasNotCreated): Deleted.
2623         (JSC::FTL::ExitValue::valueFormat): Deleted.
2624         * ftl/FTLInlineCacheSize.cpp:
2625         (JSC::FTL::sizeOfCallForwardVarargs):
2626         (JSC::FTL::sizeOfConstructForwardVarargs):
2627         (JSC::FTL::sizeOfICFor):
2628         * ftl/FTLInlineCacheSize.h:
2629         * ftl/FTLIntrinsicRepository.h:
2630         * ftl/FTLJSCallVarargs.cpp:
2631         (JSC::FTL::JSCallVarargs::JSCallVarargs):
2632         (JSC::FTL::JSCallVarargs::emit):
2633         * ftl/FTLJSCallVarargs.h:
2634         * ftl/FTLLowerDFGToLLVM.cpp:
2635         (JSC::FTL::LowerDFGToLLVM::lower):
2636         (JSC::FTL::LowerDFGToLLVM::compileNode):
2637         (JSC::FTL::LowerDFGToLLVM::compilePutStack):
2638         (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
2639         (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
2640         (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
2641         (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
2642         (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
2643         (JSC::FTL::LowerDFGToLLVM::compileArrayPop):
2644         (JSC::FTL::LowerDFGToLLVM::compileCreateActivation):
2645         (JSC::FTL::LowerDFGToLLVM::compileNewFunction):
2646         (JSC::FTL::LowerDFGToLLVM::compileCreateDirectArguments):
2647         (JSC::FTL::LowerDFGToLLVM::compileCreateScopedArguments):
2648         (JSC::FTL::LowerDFGToLLVM::compileCreateClonedArguments):
2649         (JSC::FTL::LowerDFGToLLVM::compileStringCharAt):
2650         (JSC::FTL::LowerDFGToLLVM::compileStringCharCodeAt):
2651         (JSC::FTL::LowerDFGToLLVM::compileGetGlobalVar):
2652         (JSC::FTL::LowerDFGToLLVM::compilePutGlobalVar):
2653         (JSC::FTL::LowerDFGToLLVM::compileGetArgumentCount):
2654         (JSC::FTL::LowerDFGToLLVM::compileGetClosureVar):
2655         (JSC::FTL::LowerDFGToLLVM::compilePutClosureVar):
2656         (JSC::FTL::LowerDFGToLLVM::compileGetFromArguments):
2657         (JSC::FTL::LowerDFGToLLVM::compilePutToArguments):
2658         (JSC::FTL::LowerDFGToLLVM::compileCallOrConstructVarargs):
2659         (JSC::FTL::LowerDFGToLLVM::compileForwardVarargs):
2660         (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorPname):
2661         (JSC::FTL::LowerDFGToLLVM::ArgumentsLength::ArgumentsLength):
2662         (JSC::FTL::LowerDFGToLLVM::getArgumentsLength):
2663         (JSC::FTL::LowerDFGToLLVM::getCurrentCallee):
2664         (JSC::FTL::LowerDFGToLLVM::getArgumentsStart):
2665         (JSC::FTL::LowerDFGToLLVM::baseIndex):
2666         (JSC::FTL::LowerDFGToLLVM::allocateObject):
2667         (JSC::FTL::LowerDFGToLLVM::allocateVariableSizedObject):
2668         (JSC::FTL::LowerDFGToLLVM::isArrayType):
2669         (JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
2670         (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
2671         (JSC::FTL::LowerDFGToLLVM::exitValueForAvailability):
2672         (JSC::FTL::LowerDFGToLLVM::exitValueForNode):
2673         (JSC::FTL::LowerDFGToLLVM::loadStructure):
2674         (JSC::FTL::LowerDFGToLLVM::compilePhantomArguments): Deleted.
2675         (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength): Deleted.
2676         (JSC::FTL::LowerDFGToLLVM::compileGetClosureRegisters): Deleted.
2677         (JSC::FTL::LowerDFGToLLVM::compileCheckArgumentsNotCreated): Deleted.
2678         (JSC::FTL::LowerDFGToLLVM::checkArgumentsNotCreated): Deleted.
2679         * ftl/FTLOSRExitCompiler.cpp:
2680         (JSC::FTL::compileRecovery):
2681         (JSC::FTL::compileStub):
2682         * ftl/FTLOperations.cpp:
2683         (JSC::FTL::operationMaterializeObjectInOSR):
2684         * ftl/FTLOutput.h:
2685         (JSC::FTL::Output::aShr):
2686         (JSC::FTL::Output::lShr):
2687         (JSC::FTL::Output::zeroExtPtr):
2688         * heap/CopyToken.h:
2689         * interpreter/CallFrame.h:
2690         (JSC::ExecState::getArgumentUnsafe):
2691         * interpreter/Interpreter.cpp:
2692         (JSC::sizeOfVarargs):
2693         (JSC::sizeFrameForVarargs):
2694         (JSC::loadVarargs):
2695         (JSC::unwindCallFrame):
2696         * interpreter/Interpreter.h:
2697         * interpreter/StackVisitor.cpp:
2698         (JSC::StackVisitor::Frame::createArguments):
2699         (JSC::StackVisitor::Frame::existingArguments): Deleted.
2700         * interpreter/StackVisitor.h:
2701         * jit/AssemblyHelpers.h:
2702         (JSC::AssemblyHelpers::storeValue):
2703         (JSC::AssemblyHelpers::loadValue):
2704         (JSC::AssemblyHelpers::storeTrustedValue):
2705         (JSC::AssemblyHelpers::branchIfNotCell):
2706         (JSC::AssemblyHelpers::branchIsEmpty):
2707         (JSC::AssemblyHelpers::argumentsStart):
2708         (JSC::AssemblyHelpers::baselineArgumentsRegisterFor): Deleted.
2709         (JSC::AssemblyHelpers::offsetOfLocals): Deleted.
2710         (JSC::AssemblyHelpers::offsetOfArguments): Deleted.
2711         * jit/CCallHelpers.h:
2712         (JSC::CCallHelpers::setupArgument):
2713         * jit/GPRInfo.h:
2714         (JSC::JSValueRegs::withTwoAvailableRegs):
2715         * jit/JIT.cpp:
2716         (JSC::JIT::privateCompileMainPass):
2717         (JSC::JIT::privateCompileSlowCases):
2718         * jit/JIT.h:
2719         * jit/JITCall.cpp:
2720         (JSC::JIT::compileSetupVarargsFrame):
2721         * jit/JITCall32_64.cpp:
2722         (JSC::JIT::compileSetupVarargsFrame):
2723         * jit/JITInlines.h:
2724         (JSC::JIT::callOperation):
2725         * jit/JITOpcodes.cpp:
2726         (JSC::JIT::emit_op_create_lexical_environment):
2727         (JSC::JIT::emit_op_new_func):
2728         (JSC::JIT::emit_op_create_direct_arguments):
2729         (JSC::JIT::emit_op_create_scoped_arguments):
2730         (JSC::JIT::emit_op_create_out_of_band_arguments):
2731         (JSC::JIT::emit_op_tear_off_arguments): Deleted.
2732         (JSC::JIT::emit_op_create_arguments): Deleted.
2733         (JSC::JIT::emit_op_init_lazy_reg): Deleted.
2734         (JSC::JIT::emit_op_get_arguments_length): Deleted.
2735         (JSC::JIT::emitSlow_op_get_arguments_length): Deleted.
2736         (JSC::JIT::emit_op_get_argument_by_val): Deleted.
2737         (JSC::JIT::emitSlow_op_get_argument_by_val): Deleted.
2738         * jit/JITOpcodes32_64.cpp:
2739         (JSC::JIT::emit_op_create_lexical_environment):
2740         (JSC::JIT::emit_op_tear_off_arguments): Deleted.
2741         (JSC::JIT::emit_op_create_arguments): Deleted.
2742         (JSC::JIT::emit_op_init_lazy_reg): Deleted.
2743         (JSC::JIT::emit_op_get_arguments_length): Deleted.
2744         (JSC::JIT::emitSlow_op_get_arguments_length): Deleted.
2745         (JSC::JIT::emit_op_get_argument_by_val): Deleted.
2746         (JSC::JIT::emitSlow_op_get_argument_by_val): Deleted.
2747         * jit/JITOperations.cpp:
2748         * jit/JITOperations.h:
2749         * jit/JITPropertyAccess.cpp:
2750         (JSC::JIT::emitGetClosureVar):
2751         (JSC::JIT::emitPutClosureVar):
2752         (JSC::JIT::emit_op_get_from_arguments):
2753         (JSC::JIT::emit_op_put_to_arguments):
2754         (JSC::JIT::emit_op_init_global_const):
2755         (JSC::JIT::privateCompileGetByVal):
2756         (JSC::JIT::emitDirectArgumentsGetByVal):
2757         (JSC::JIT::emitScopedArgumentsGetByVal):
2758         * jit/JITPropertyAccess32_64.cpp:
2759         (JSC::JIT::emitGetClosureVar):
2760         (JSC::JIT::emitPutClosureVar):
2761         (JSC::JIT::emit_op_get_from_arguments):
2762         (JSC::JIT::emit_op_put_to_arguments):
2763         (JSC::JIT::emit_op_init_global_const):
2764         * jit/SetupVarargsFrame.cpp:
2765         (JSC::emitSetupVarargsFrameFastCase):
2766         * llint/LLIntOffsetsExtractor.cpp:
2767         * llint/LLIntSlowPaths.cpp:
2768         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2769         * llint/LowLevelInterpreter.asm:
2770         * llint/LowLevelInterpreter32_64.asm:
2771         * llint/LowLevelInterpreter64.asm:
2772         * parser/Nodes.h:
2773         (JSC::ScopeNode::captures):
2774         * runtime/Arguments.cpp: Removed.
2775         * runtime/Arguments.h: Removed.
2776         * runtime/ArgumentsMode.h: Added.
2777         * runtime/DirectArgumentsOffset.cpp: Added.
2778         (JSC::DirectArgumentsOffset::dump):
2779         * runtime/DirectArgumentsOffset.h: Added.
2780         (JSC::DirectArgumentsOffset::DirectArgumentsOffset):
2781         * runtime/CommonSlowPaths.cpp:
2782         (JSC::SLOW_PATH_DECL):
2783         * runtime/CommonSlowPaths.h:
2784         * runtime/ConstantMode.cpp: Added.
2785         (WTF::printInternal):
2786         * runtime/ConstantMode.h:
2787         (JSC::modeForIsConstant):
2788         * runtime/DirectArguments.cpp: Added.
2789         (JSC::DirectArguments::DirectArguments):
2790         (JSC::DirectArguments::createUninitialized):
2791         (JSC::DirectArguments::create):
2792         (JSC::DirectArguments::createByCopying):
2793         (JSC::DirectArguments::visitChildren):
2794         (JSC::DirectArguments::copyBackingStore):
2795         (JSC::DirectArguments::createStructure):
2796         (JSC::DirectArguments::overrideThings):
2797         (JSC::DirectArguments::overrideThingsIfNecessary):
2798         (JSC::DirectArguments::overrideArgument):
2799         (JSC::DirectArguments::copyToArguments):
2800         (JSC::DirectArguments::overridesSize):
2801         * runtime/DirectArguments.h: Added.
2802         (JSC::DirectArguments::internalLength):
2803         (JSC::DirectArguments::length):
2804         (JSC::DirectArguments::canAccessIndexQuickly):
2805         (JSC::DirectArguments::getIndexQuickly):
2806         (JSC::DirectArguments::setIndexQuickly):
2807         (JSC::DirectArguments::callee):
2808         (JSC::DirectArguments::argument):
2809         (JSC::DirectArguments::overrodeThings):
2810         (JSC::DirectArguments::offsetOfCallee):
2811         (JSC::DirectArguments::offsetOfLength):
2812         (JSC::DirectArguments::offsetOfMinCapacity):
2813         (JSC::DirectArguments::offsetOfOverrides):
2814         (JSC::DirectArguments::storageOffset):
2815         (JSC::DirectArguments::offsetOfSlot):
2816         (JSC::DirectArguments::allocationSize):
2817         (JSC::DirectArguments::storage):
2818         * runtime/FunctionPrototype.cpp:
2819         * runtime/GenericArguments.h: Added.
2820         (JSC::GenericArguments::GenericArguments):
2821         * runtime/GenericArgumentsInlines.h: Added.
2822         (JSC::GenericArguments<Type>::getOwnPropertySlot):
2823         (JSC::GenericArguments<Type>::getOwnPropertySlotByIndex):
2824         (JSC::GenericArguments<Type>::getOwnPropertyNames):
2825         (JSC::GenericArguments<Type>::put):
2826         (JSC::GenericArguments<Type>::putByIndex):
2827         (JSC::GenericArguments<Type>::deleteProperty):
2828         (JSC::GenericArguments<Type>::deletePropertyByIndex):
2829         (JSC::GenericArguments<Type>::defineOwnProperty):
2830         (JSC::GenericArguments<Type>::copyToArguments):
2831         * runtime/GenericOffset.h: Added.
2832         (JSC::GenericOffset::GenericOffset):
2833         (JSC::GenericOffset::operator!):
2834         (JSC::GenericOffset::offsetUnchecked):
2835         (JSC::GenericOffset::offset):
2836         (JSC::GenericOffset::operator==):
2837         (JSC::GenericOffset::operator!=):
2838         (JSC::GenericOffset::operator<):
2839         (JSC::GenericOffset::operator>):
2840         (JSC::GenericOffset::operator<=):
2841         (JSC::GenericOffset::operator>=):
2842         (JSC::GenericOffset::operator+):
2843         (JSC::GenericOffset::operator-):
2844         (JSC::GenericOffset::operator+=):
2845         (JSC::GenericOffset::operator-=):
2846         * runtime/JSArgumentsIterator.cpp:
2847         (JSC::JSArgumentsIterator::finishCreation):
2848         (JSC::argumentsFuncIterator):
2849         * runtime/JSArgumentsIterator.h:
2850         (JSC::JSArgumentsIterator::create):
2851         (JSC::JSArgumentsIterator::next):
2852         * runtime/JSEnvironmentRecord.cpp:
2853         (JSC::JSEnvironmentRecord::visitChildren):
2854         * runtime/JSEnvironmentRecord.h:
2855         (JSC::JSEnvironmentRecord::variables):
2856         (JSC::JSEnvironmentRecord::isValid):
2857         (JSC::JSEnvironmentRecord::variableAt):
2858         (JSC::JSEnvironmentRecord::offsetOfVariables):
2859         (JSC::JSEnvironmentRecord::offsetOfVariable):
2860         (JSC::JSEnvironmentRecord::allocationSizeForScopeSize):
2861         (JSC::JSEnvironmentRecord::allocationSize):
2862         (JSC::JSEnvironmentRecord::JSEnvironmentRecord):
2863         (JSC::JSEnvironmentRecord::finishCreationUninitialized):
2864         (JSC::JSEnvironmentRecord::finishCreation):
2865         (JSC::JSEnvironmentRecord::registers): Deleted.
2866         (JSC::JSEnvironmentRecord::registerAt): Deleted.
2867         (JSC::JSEnvironmentRecord::addressOfRegisters): Deleted.
2868         (JSC::JSEnvironmentRecord::offsetOfRegisters): Deleted.
2869         * runtime/JSFunction.cpp:
2870         * runtime/JSGlobalObject.cpp:
2871         (JSC::JSGlobalObject::init):
2872         (JSC::JSGlobalObject::addGlobalVar):
2873         (JSC::JSGlobalObject::addFunction):
2874         (JSC::JSGlobalObject::visitChildren):
2875         (JSC::JSGlobalObject::addStaticGlobals):
2876         * runtime/JSGlobalObject.h:
2877         (JSC::JSGlobalObject::directArgumentsStructure):
2878         (JSC::JSGlobalObject::scopedArgumentsStructure):
2879         (JSC::JSGlobalObject::outOfBandArgumentsStructure):
2880         (JSC::JSGlobalObject::argumentsStructure): Deleted.
2881         * runtime/JSLexicalEnvironment.cpp:
2882         (JSC::JSLexicalEnvironment::symbolTableGet):
2883         (JSC::JSLexicalEnvironment::symbolTablePut):
2884         (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
2885         (JSC::JSLexicalEnvironment::symbolTablePutWithAttributes):
2886         (JSC::JSLexicalEnvironment::visitChildren): Deleted.
2887         * runtime/JSLexicalEnvironment.h:
2888         (JSC::JSLexicalEnvironment::create):
2889         (JSC::JSLexicalEnvironment::JSLexicalEnvironment):
2890         (JSC::JSLexicalEnvironment::registersOffset): Deleted.
2891         (JSC::JSLexicalEnvironment::storageOffset): Deleted.
2892         (JSC::JSLexicalEnvironment::storage): Deleted.
2893         (JSC::JSLexicalEnvironment::allocationSize): Deleted.
2894         (JSC::JSLexicalEnvironment::isValidIndex): Deleted.
2895         (JSC::JSLexicalEnvironment::isValid): Deleted.
2896         (JSC::JSLexicalEnvironment::registerAt): Deleted.
2897         * runtime/JSNameScope.cpp:
2898         (JSC::JSNameScope::visitChildren): Deleted.
2899         * runtime/JSNameScope.h:
2900         (JSC::JSNameScope::create):
2901         (JSC::JSNameScope::value):
2902         (JSC::JSNameScope::finishCreation):
2903         (JSC::JSNameScope::JSNameScope):
2904         * runtime/JSScope.cpp:
2905         (JSC::abstractAccess):
2906         * runtime/JSSegmentedVariableObject.cpp:
2907         (JSC::JSSegmentedVariableObject::findVariableIndex):
2908         (JSC::JSSegmentedVariableObject::addVariables):
2909         (JSC::JSSegmentedVariableObject::visitChildren):
2910         (JSC::JSSegmentedVariableObject::findRegisterIndex): Deleted.
2911         (JSC::JSSegmentedVariableObject::addRegisters): Deleted.
2912         * runtime/JSSegmentedVariableObject.h:
2913         (JSC::JSSegmentedVariableObject::variableAt):
2914         (JSC::JSSegmentedVariableObject::assertVariableIsInThisObject):
2915         (JSC::JSSegmentedVariableObject::registerAt): Deleted.
2916         (JSC::JSSegmentedVariableObject::assertRegisterIsInThisObject): Deleted.
2917         * runtime/JSSymbolTableObject.h:
2918         (JSC::JSSymbolTableObject::offsetOfSymbolTable):
2919         (JSC::symbolTableGet):
2920         (JSC::symbolTablePut):
2921         (JSC::symbolTablePutWithAttributes):
2922         * runtime/JSType.h:
2923         * runtime/Options.h:
2924         * runtime/ClonedArguments.cpp: Added.
2925         (JSC::ClonedArguments::ClonedArguments):
2926         (JSC::ClonedArguments::createEmpty):
2927         (JSC::ClonedArguments::createWithInlineFrame):
2928         (JSC::ClonedArguments::createWithMachineFrame):
2929         (JSC::ClonedArguments::createByCopyingFrom):
2930         (JSC::ClonedArguments::createStructure):
2931         (JSC::ClonedArguments::getOwnPropertySlot):
2932         (JSC::ClonedArguments::getOwnPropertyNames):
2933         (JSC::ClonedArguments::put):
2934         (JSC::ClonedArguments::deleteProperty):
2935         (JSC::ClonedArguments::defineOwnProperty):
2936         (JSC::ClonedArguments::materializeSpecials):
2937         (JSC::ClonedArguments::materializeSpecialsIfNecessary):
2938         * runtime/ClonedArguments.h: Added.
2939         (JSC::ClonedArguments::specialsMaterialized):
2940         * runtime/ScopeOffset.cpp: Added.
2941         (JSC::ScopeOffset::dump):
2942         * runtime/ScopeOffset.h: Added.
2943         (JSC::ScopeOffset::ScopeOffset):
2944         * runtime/ScopedArguments.cpp: Added.
2945         (JSC::ScopedArguments::ScopedArguments):
2946         (JSC::ScopedArguments::finishCreation):
2947         (JSC::ScopedArguments::createUninitialized):
2948         (JSC::ScopedArguments::create):
2949         (JSC::ScopedArguments::createByCopying):
2950         (JSC::ScopedArguments::createByCopyingFrom):
2951         (JSC::ScopedArguments::visitChildren):
2952         (JSC::ScopedArguments::createStructure):
2953         (JSC::ScopedArguments::overrideThings):
2954         (JSC::ScopedArguments::overrideThingsIfNecessary):
2955         (JSC::ScopedArguments::overrideArgument):
2956         (JSC::ScopedArguments::copyToArguments):
2957         * runtime/ScopedArguments.h: Added.
2958         (JSC::ScopedArguments::internalLength):
2959         (JSC::ScopedArguments::length):
2960         (JSC::ScopedArguments::canAccessIndexQuickly):
2961         (JSC::ScopedArguments::getIndexQuickly):
2962         (JSC::ScopedArguments::setIndexQuickly):
2963         (JSC::ScopedArguments::callee):
2964         (JSC::ScopedArguments::overrodeThings):
2965         (JSC::ScopedArguments::offsetOfOverrodeThings):
2966         (JSC::ScopedArguments::offsetOfTotalLength):
2967         (JSC::ScopedArguments::offsetOfTable):
2968         (JSC::ScopedArguments::offsetOfScope):
2969         (JSC::ScopedArguments::overflowStorageOffset):
2970         (JSC::ScopedArguments::allocationSize):
2971         (JSC::ScopedArguments::overflowStorage):
2972         * runtime/ScopedArgumentsTable.cpp: Added.
2973         (JSC::ScopedArgumentsTable::ScopedArgumentsTable):
2974         (JSC::ScopedArgumentsTable::~ScopedArgumentsTable):
2975         (JSC::ScopedArgumentsTable::destroy):
2976         (JSC::ScopedArgumentsTable::create):
2977         (JSC::ScopedArgumentsTable::clone):
2978         (JSC::ScopedArgumentsTable::setLength):
2979         (JSC::ScopedArgumentsTable::set):
2980         (JSC::ScopedArgumentsTable::createStructure):
2981         * runtime/ScopedArgumentsTable.h: Added.
2982         (JSC::ScopedArgumentsTable::length):
2983         (JSC::ScopedArgumentsTable::get):
2984         (JSC::ScopedArgumentsTable::lock):
2985         (JSC::ScopedArgumentsTable::offsetOfLength):
2986         (JSC::ScopedArgumentsTable::offsetOfArguments):
2987         (JSC::ScopedArgumentsTable::at):
2988         * runtime/SymbolTable.cpp:
2989         (JSC::SymbolTableEntry::prepareToWatch):
2990         (JSC::SymbolTable::SymbolTable):
2991         (JSC::SymbolTable::visitChildren):
2992         (JSC::SymbolTable::localToEntry):
2993         (JSC::SymbolTable::entryFor):
2994         (JSC::SymbolTable::cloneScopePart):
2995         (JSC::SymbolTable::prepareForTypeProfiling):
2996         (JSC::SymbolTable::uniqueIDForOffset):
2997         (JSC::SymbolTable::globalTypeSetForOffset):
2998         (JSC::SymbolTable::cloneCapturedNames): Deleted.
2999         (JSC::SymbolTable::uniqueIDForRegister): Deleted.
3000         (JSC::SymbolTable::globalTypeSetForRegister): Deleted.
3001         * runtime/SymbolTable.h:
3002         (JSC::SymbolTableEntry::varOffsetFromBits):
3003         (JSC::SymbolTableEntry::scopeOffsetFromBits):
3004         (JSC::SymbolTableEntry::Fast::varOffset):
3005         (JSC::SymbolTableEntry::Fast::scopeOffset):
3006         (JSC::SymbolTableEntry::Fast::isDontEnum):
3007         (JSC::SymbolTableEntry::Fast::getAttributes):
3008         (JSC::SymbolTableEntry::SymbolTableEntry):
3009         (JSC::SymbolTableEntry::varOffset):
3010         (JSC::SymbolTableEntry::isWatchable):
3011         (JSC::SymbolTableEntry::scopeOffset):
3012         (JSC::SymbolTableEntry::setAttributes):
3013         (JSC::SymbolTableEntry::constantMode):
3014         (JSC::SymbolTableEntry::isDontEnum):
3015         (JSC::SymbolTableEntry::disableWatching):
3016         (JSC::SymbolTableEntry::pack):
3017         (JSC::SymbolTableEntry::isValidVarOffset):
3018         (JSC::SymbolTable::createNameScopeTable):
3019         (JSC::SymbolTable::maxScopeOffset):
3020         (JSC::SymbolTable::didUseScopeOffset):
3021         (JSC::SymbolTable::didUseVarOffset):
3022         (JSC::SymbolTable::scopeSize):
3023         (JSC::SymbolTable::nextScopeOffset):
3024         (JSC::SymbolTable::takeNextScopeOffset):
3025         (JSC::SymbolTable::add):
3026         (JSC::SymbolTable::set):
3027         (JSC::SymbolTable::argumentsLength):
3028         (JSC::SymbolTable::setArgumentsLength):
3029         (JSC::SymbolTable::argumentOffset):
3030         (JSC::SymbolTable::setArgumentOffset):
3031         (JSC::SymbolTable::arguments):
3032         (JSC::SlowArgument::SlowArgument): Deleted.
3033         (JSC::SymbolTableEntry::Fast::getIndex): Deleted.
3034         (JSC::SymbolTableEntry::getIndex): Deleted.
3035         (JSC::SymbolTableEntry::isValidIndex): Deleted.
3036         (JSC::SymbolTable::captureStart): Deleted.
3037         (JSC::SymbolTable::setCaptureStart): Deleted.
3038         (JSC::SymbolTable::captureEnd): Deleted.
3039         (JSC::SymbolTable::setCaptureEnd): Deleted.
3040         (JSC::SymbolTable::captureCount): Deleted.
3041         (JSC::SymbolTable::isCaptured): Deleted.
3042         (JSC::SymbolTable::parameterCount): Deleted.
3043         (JSC::SymbolTable::parameterCountIncludingThis): Deleted.
3044         (JSC::SymbolTable::setParameterCountIncludingThis): Deleted.
3045         (JSC::SymbolTable::slowArguments): Deleted.
3046         (JSC::SymbolTable::setSlowArguments): Deleted.
3047         * runtime/VM.cpp:
3048         (JSC::VM::VM):
3049         * runtime/VM.h:
3050         * runtime/VarOffset.cpp: Added.
3051         (JSC::VarOffset::dump):
3052         (WTF::printInternal):
3053         * runtime/VarOffset.h: Added.
3054         (JSC::VarOffset::VarOffset):
3055         (JSC::VarOffset::assemble):
3056         (JSC::VarOffset::isValid):
3057         (JSC::VarOffset::operator!):
3058         (JSC::VarOffset::kind):
3059         (JSC::VarOffset::isStack):
3060         (JSC::VarOffset::isScope):
3061         (JSC::VarOffset::isDirectArgument):
3062         (JSC::VarOffset::stackOffsetUnchecked):
3063         (JSC::VarOffset::scopeOffsetUnchecked):
3064         (JSC::VarOffset::capturedArgumentsOffsetUnchecked):
3065         (JSC::VarOffset::stackOffset):
3066         (JSC::VarOffset::scopeOffset):
3067         (JSC::VarOffset::capturedArgumentsOffset):
3068         (JSC::VarOffset::rawOffset):
3069         (JSC::VarOffset::checkSanity):
3070         (JSC::VarOffset::operator==):
3071         (JSC::VarOffset::operator!=):
3072         (JSC::VarOffset::hash):
3073         (JSC::VarOffset::isHashTableDeletedValue):
3074         (JSC::VarOffsetHash::hash):
3075         (JSC::VarOffsetHash::equal):
3076         * tests/stress/arguments-exit-strict-mode.js: Added.
3077         * tests/stress/arguments-exit.js: Added.
3078         * tests/stress/arguments-inlined-exit-strict-mode-fixed.js: Added.
3079         * tests/stress/arguments-inlined-exit-strict-mode.js: Added.
3080         * tests/stress/arguments-inlined-exit.js: Added.
3081         * tests/stress/arguments-interference.js: Added.
3082         * tests/stress/arguments-interference-cfg.js: Added.
3083         * tests/stress/dead-get-closure-var.js: Added.
3084         * tests/stress/get-declared-unpassed-argument-in-direct-arguments.js: Added.
3085         * tests/stress/get-declared-unpassed-argument-in-scoped-arguments.js: Added.
3086         * tests/stress/varargs-closure-inlined-exit-strict-mode.js: Added.
3087         * tests/stress/varargs-closure-inlined-exit.js: Added.
3088         * tests/stress/varargs-exit.js: Added.
3089         * tests/stress/varargs-inlined-exit.js: Added.
3090         * tests/stress/varargs-inlined-simple-exit-aliasing-weird-reversed-args.js: Added.
3091         * tests/stress/varargs-inlined-simple-exit-aliasing-weird.js: Added.
3092         * tests/stress/varargs-inlined-simple-exit-aliasing.js: Added.
3093         * tests/stress/varargs-inlined-simple-exit.js: Added.
3094         * tests/stress/varargs-too-few-arguments.js: Added.
3095         * tests/stress/varargs-varargs-closure-inlined-exit.js: Added.
3096         * tests/stress/varargs-varargs-inlined-exit-strict-mode.js: Added.
3097         * tests/stress/varargs-varargs-inlined-exit.js: Added.
3098
3099 2015-03-25  Andy Estes  <aestes@apple.com>
3100
3101         [Cocoa] RemoteInspectorXPCConnection::deserializeMessage() leaks a NSDictionary under Objective-C GC
3102         https://bugs.webkit.org/show_bug.cgi?id=143068
3103
3104         Reviewed by Dan Bernstein.
3105
3106         * inspector/remote/RemoteInspectorXPCConnection.mm:
3107         (Inspector::RemoteInspectorXPCConnection::deserializeMessage): Used RetainPtr::autorelease(), which does the right thing under GC.
3108
3109 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
3110
3111         Use JITCompilationCanFail in more places, and make the fail path of JITCompilationMustSucceed a crash instead of attempting GC
3112         https://bugs.webkit.org/show_bug.cgi?id=142993
3113
3114         Reviewed by Geoffrey Garen and Mark Lam.
3115
3116         This changes the most commonly invoked paths that relied on JITCompilationMustSucceed
3117         into using JITCompilationCanFail and having a legit fallback path. This mostly involves
3118         having the FTL JIT do the same trick as the DFG JIT in case of any memory allocation
3119         failure, but also involves adding the same kind of thing to the stub generators in
3120         Repatch.
3121
3122         Because of that change, there are relatively few uses of JITCompilationMustSucceed. Most
3123         of those uses cannot handle a GC, and so cannot do releaseExecutableMemory(). Only a few,
3124         like host call stub generation, could handle a GC, but those get invoked very rarely. So,
3125         this patch changes the releaseExecutableMemory() call into a crash with some diagnostic
3126         printout.
3127
3128         Also add a way of inducing executable allocation failure, so that we can test this.
3129
3130         * CMakeLists.txt:
3131         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3132         * JavaScriptCore.xcodeproj/project.pbxproj:
3133         * dfg/DFGJITCompiler.cpp:
3134         (JSC::DFG::JITCompiler::compile):
3135         (JSC::DFG::JITCompiler::compileFunction):
3136         (JSC::DFG::JITCompiler::link): Deleted.
3137         (JSC::DFG::JITCompiler::linkFunction): Deleted.
3138         * dfg/DFGJITCompiler.h:
3139         * dfg/DFGPlan.cpp:
3140         (JSC::DFG::Plan::compileInThreadImpl):
3141         * ftl/FTLCompile.cpp:
3142         (JSC::FTL::mmAllocateCodeSection):
3143         (JSC::FTL::mmAllocateDataSection):
3144         * ftl/FTLLink.cpp:
3145         (JSC::FTL::link):
3146         * ftl/FTLState.h:
3147         * jit/ArityCheckFailReturnThunks.cpp:
3148         (JSC::ArityCheckFailReturnThunks::returnPCsFor):
3149         * jit/ExecutableAllocationFuzz.cpp: Added.
3150         (JSC::numberOfExecutableAllocationFuzzChecks):
3151         (JSC::doExecutableAllocationFuzzing):
3152         * jit/ExecutableAllocationFuzz.h: Added.
3153         (JSC::doExecutableAllocationFuzzingIfEnabled):
3154         * jit/ExecutableAllocatorFixedVMPool.cpp:
3155         (JSC::ExecutableAllocator::allocate):
3156         * jit/JIT.cpp:
3157         (JSC::JIT::privateCompile):
3158         * jit/JITCompilationEffort.h:
3159         * jit/Repatch.cpp:
3160         (JSC::generateByIdStub):
3161         (JSC::tryCacheGetByID):
3162         (JSC::tryBuildGetByIDList):
3163         (JSC::emitPutReplaceStub):
3164         (JSC::emitPutTransitionStubAndGetOldStructure):
3165         (JSC::tryCachePutByID):
3166         (JSC::tryBuildPutByIdList):
3167         (JSC::tryRepatchIn):
3168         (JSC::linkPolymorphicCall):
3169         * jsc.cpp:
3170         (jscmain):
3171         * runtime/Options.h:
3172         * runtime/TestRunnerUtils.h:
3173         * runtime/VM.cpp:
3174         * tests/executableAllocationFuzz: Added.
3175         * tests/executableAllocationFuzz.yaml: Added.
3176         * tests/executableAllocationFuzz/v8-raytrace.js: Added.
3177
3178 2015-03-25  Mark Lam  <mark.lam@apple.com>
3179
3180         REGRESSION(169139): LLINT intermittently fails JSC testapi tests.
3181         <https://webkit.org/b/135719>
3182
3183         Reviewed by Geoffrey Garen.
3184
3185         This is a regression introduced in http://trac.webkit.org/changeset/169139 which
3186         changed VM::watchdog from an embedded field into a std::unique_ptr, but did not
3187         update the LLINT to access it as such.
3188
3189         The issue has only manifested so far on the CLoop tests because those are LLINT
3190         only.  In the non-CLoop cases, the JIT kicks in and does the right thing, thereby
3191         hiding the bug in the LLINT.
3192
3193         * API/JSContextRef.cpp:
3194         (createWatchdogIfNeeded):
3195         (JSContextGroupSetExecutionTimeLimit):
3196         (JSContextGroupClearExecutionTimeLimit):
3197         * llint/LowLevelInterpreter.asm:
3198
3199 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
3200
3201         Change Atomic methods from using the_wrong_naming_conventions to using theRightNamingConventions. Also make seq_cst the default.
3202
3203         Rubber stamped by Geoffrey Garen.
3204
3205         * bytecode/CodeBlock.cpp:
3206         (JSC::CodeBlock::visitAggregate):
3207
3208 2015-03-25  Joseph Pecoraro  <pecoraro@apple.com>
3209
3210         Fix formatting in BuiltinExecutables
3211         https://bugs.webkit.org/show_bug.cgi?id=143061
3212
3213         Reviewed by Ryosuke Niwa.
3214
3215         * builtins/BuiltinExecutables.cpp:
3216         (JSC::BuiltinExecutables::createExecutableInternal):
3217
3218 2015-03-25  Joseph Pecoraro  <pecoraro@apple.com>
3219
3220         ES6: Classes: Program level class statement throws exception in strict mode
3221         https://bugs.webkit.org/show_bug.cgi?id=143038
3222
3223         Reviewed by Ryosuke Niwa.
3224
3225         Classes expose a name to the current lexical environment. This treats
3226         "class X {}" like "var X = class X {}". Ideally it would be "let X = class X {}".
3227         Also, improve error messages for class statements where the class is missing a name.
3228
3229         * parser/Parser.h:
3230         * parser/Parser.cpp:
3231         (JSC::Parser<LexerType>::parseClass):
3232         Fill name in info parameter if needed. Better error message if name is needed and missing.
3233
3234         (JSC::Parser<LexerType>::parseClassDeclaration):
3235         Pass info parameter to get name, and expose the name as a variable name.
3236
3237         (JSC::Parser<LexerType>::parsePrimaryExpression):
3238         Pass info parameter that is ignored.
3239
3240         * parser/ParserFunctionInfo.h:
3241         Add a parser info for class, to extract the name.
3242
3243 2015-03-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3244
3245         New map and set modification tests in r181922 fails
3246         https://bugs.webkit.org/show_bug.cgi?id=143031
3247
3248         Reviewed and tweaked by Geoffrey Garen.
3249
3250         When packing Map/Set backing store, we need to decrement Map/Set iterator's m_index
3251         to adjust for the packed backing store.
3252
3253         Consider the following map data.
3254
3255         x: deleted, o: exists
3256         0 1 2 3 4
3257         x x x x o
3258
3259         And iterator with m_index 3.
3260
3261         When packing the map data, map data will become,
3262
3263         0
3264         o
3265
3266         At that time, we perfom didRemoveEntry 4 times on iterators.
3267         times => m_index/index/result
3268         1 => 3/0/dec
3269         2 => 2/1/dec
3270         3 => 1/2/nothing
3271         4 => 1/3/nothing
3272
3273         After iteration, iterator's m_index becomes 1. But we expected that becomes 0.
3274         This is because if we use decremented m_index for comparison,
3275         while provided deletedIndex is the index in old storage, m_index is the index in partially packed storage.
3276
3277         In this patch, we compare against the packed index instead.
3278         times => m_index/packedIndex/result
3279         1 => 3/0/dec
3280         2 => 2/0/dec
3281         3 => 1/0/dec
3282         4 => 0/0/nothing
3283
3284         So m_index becomes 0 as expected.
3285
3286         And according to the spec, once the iterator is closed (becomes done: true),
3287         its internal [[Map]]/[[Set]] is set to undefined.
3288         So after the iterator is finished, we don't revive the iterator (e.g. by clearing m_index = 0).
3289
3290         In this patch, we change 2 things.
3291         1.
3292         Compare an iterator's index against the packed index when removing an entry.
3293
3294         2.
3295         If the iterator is closed (isFinished()), we don't apply adjustment to the iterator.
3296
3297         * runtime/MapData.h:
3298         (JSC::MapDataImpl::IteratorData::finish):
3299         (JSC::MapDataImpl::IteratorData::isFinished):
3300         (JSC::MapDataImpl::IteratorData::didRemoveEntry):
3301         (JSC::MapDataImpl::IteratorData::didRemoveAllEntries):
3302         (JSC::MapDataImpl::IteratorData::startPackBackingStore):
3303         * runtime/MapDataInlines.h:
3304         (JSC::JSIterator>::replaceAndPackBackingStore):
3305         * tests/stress/modify-map-during-iteration.js:
3306         * tests/stress/modify-set-during-iteration.js:
3307
3308 2015-03-24  Joseph Pecoraro  <pecoraro@apple.com>
3309
3310         Setter should have a single formal parameter, Getter no parameters
3311         https://bugs.webkit.org/show_bug.cgi?id=142903
3312
3313         Reviewed by Geoffrey Garen.
3314
3315         * parser/Parser.cpp:
3316         (JSC::Parser<LexerType>::parseFunctionInfo):
3317         Enforce no parameters for getters and a single parameter
3318         for setters, with informational error messages.
3319
3320 2015-03-24  Joseph Pecoraro  <pecoraro@apple.com>
3321
3322         ES6: Classes: Early return in sub-class constructor results in returning undefined instead of instance
3323         https://bugs.webkit.org/show_bug.cgi?id=143012
3324
3325         Reviewed by Ryosuke Niwa.
3326
3327         * bytecompiler/BytecodeGenerator.cpp:
3328         (JSC::BytecodeGenerator::emitReturn):
3329         Fix handling of "undefined" when returned from a Derived class. It was
3330         returning "undefined" when it should have returned "this".
3331
3332 2015-03-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3333
3334         REGRESSION (r181458): Heap use-after-free in JSSetIterator destructor
3335         https://bugs.webkit.org/show_bug.cgi?id=142696
3336
3337         Reviewed and tweaked by Geoffrey Garen.
3338
3339         Before r142556, JSSetIterator::destroy was not defined.
3340         So accidentally MapData::const_iterator in JSSet was never destroyed.
3341         But it had non trivial destructor, decrementing MapData->m_iteratorCount.
3342
3343         After r142556, JSSetIterator::destroy works.
3344         It correctly destruct MapData::const_iterator and m_iteratorCount partially works.
3345         But JSSetIterator::~JSSetIterator requires owned JSSet since it mutates MapData->m_iteratorCount.
3346
3347         It is guaranteed that JSSet is live since JSSetIterator has a reference to JSSet
3348         and marks it in visitChildren (WriteBarrier<Unknown>).
3349         However, the order of destructions is not guaranteed in GC-ed system.
3350
3351         Consider the following case,
3352         allocate JSSet and subsequently allocate JSSetIterator.
3353         And they resides in the separated MarkedBlock, <1> and <2>.
3354
3355         JSSet<1> <- JSSetIterator<2>
3356
3357         And after that, when performing GC, Marker decides that the above 2 objects are not marked.
3358         And Marker also decides MarkedBlocks <1> and <2> can be sweeped.
3359
3360         First Sweeper sweep <1>, destruct JSSet<1> and free MarkedBlock<1>.
3361         Second Sweeper sweep <2>, attempt to destruct JSSetIterator<2>.
3362         However, JSSetIterator<2>'s destructor,
3363         JSSetIterator::~JSSetIterator requires live JSSet<1>, it causes use-after-free.
3364
3365         In this patch, we introduce WeakGCMap into JSMap/JSSet to track live iterators.
3366         When packing the removed elements in JSSet/JSMap, we apply the change to all live
3367         iterators tracked by WeakGCMap.
3368
3369         WeakGCMap can only track JSCell since they are managed by GC.
3370         So we drop JSSet/JSMap C++ style iterators. Instead of C++ style iterator, this patch
3371         introduces JS style iterator signatures into C++ class IteratorData.
3372         If we need to iterate over JSMap/JSSet, use JSSetIterator/JSMapIterator instead of using
3373         IteratorData directly.
3374
3375         * runtime/JSMap.cpp:
3376         (JSC::JSMap::destroy):
3377         * runtime/JSMap.h:
3378         (JSC::JSMap::JSMap):
3379         (JSC::JSMap::begin): Deleted.
3380         (JSC::JSMap::end): Deleted.
3381         * runtime/JSMapIterator.cpp:
3382         (JSC::JSMapIterator::destroy):
3383         * runtime/JSMapIterator.h:
3384         (JSC::JSMapIterator::next):
3385         (JSC::JSMapIterator::nextKeyValue):
3386         (JSC::JSMapIterator::iteratorData):
3387         (JSC::JSMapIterator::JSMapIterator):
3388         * runtime/JSSet.cpp:
3389         (JSC::JSSet::destroy):
3390         * runtime/JSSet.h:
3391         (JSC::JSSet::JSSet):
3392         (JSC::JSSet::begin): Deleted.
3393         (JSC::JSSet::end): Deleted.
3394         * runtime/JSSetIterator.cpp:
3395         (JSC::JSSetIterator::destroy):
3396         * runtime/JSSetIterator.h:
3397         (JSC::JSSetIterator::next):
3398         (JSC::JSSetIterator::iteratorData):
3399         (JSC::JSSetIterator::JSSetIterator):
3400         * runtime/MapData.h:
3401         (JSC::MapDataImpl::IteratorData::finish):
3402         (JSC::MapDataImpl::IteratorData::isFinished):
3403         (JSC::MapDataImpl::shouldPack):
3404         (JSC::JSIterator>::MapDataImpl):
3405         (JSC::JSIterator>::KeyType::KeyType):
3406         (JSC::JSIterator>::IteratorData::IteratorData):
3407         (JSC::JSIterator>::IteratorData::next):
3408         (JSC::JSIterator>::IteratorData::ensureSlot):
3409         (JSC::JSIterator>::IteratorData::applyMapDataPatch):
3410         (JSC::JSIterator>::IteratorData::refreshCursor):
3411         (JSC::MapDataImpl::const_iterator::key): Deleted.
3412         (JSC::MapDataImpl::const_iterator::value): Deleted.
3413         (JSC::MapDataImpl::const_iterator::operator++): Deleted.
3414         (JSC::MapDataImpl::const_iterator::finish): Deleted.
3415         (JSC::MapDataImpl::const_iterator::atEnd): Deleted.
3416         (JSC::MapDataImpl::begin): Deleted.
3417         (JSC::MapDataImpl::end): Deleted.
3418         (JSC::MapDataImpl<Entry>::MapDataImpl): Deleted.
3419         (JSC::MapDataImpl<Entry>::clear): Deleted.
3420         (JSC::MapDataImpl<Entry>::KeyType::KeyType): Deleted.
3421         (JSC::MapDataImpl<Entry>::const_iterator::internalIncrement): Deleted.
3422         (JSC::MapDataImpl<Entry>::const_iterator::ensureSlot): Deleted.
3423         (JSC::MapDataImpl<Entry>::const_iterator::const_iterator): Deleted.
3424         (JSC::MapDataImpl<Entry>::const_iterator::~const_iterator): Deleted.
3425         (JSC::MapDataImpl<Entry>::const_iterator::operator): Deleted.
3426         (JSC::=): Deleted.
3427         * runtime/MapDataInlines.h:
3428         (JSC::JSIterator>::clear):
3429         (JSC::JSIterator>::find):
3430         (JSC::JSIterator>::contains):
3431         (JSC::JSIterator>::add):
3432         (JSC::JSIterator>::set):
3433         (JSC::JSIterator>::get):
3434         (JSC::JSIterator>::remove):
3435         (JSC::JSIterator>::replaceAndPackBackingStore):
3436         (JSC::JSIterator>::replaceBackingStore):
3437         (JSC::JSIterator>::ensureSpaceForAppend):
3438         (JSC::JSIterator>::visitChildren):
3439         (JSC::JSIterator>::copyBackingStore):
3440         (JSC::JSIterator>::applyMapDataPatch):
3441         (JSC::MapDataImpl<Entry>::find): Deleted.
3442         (JSC::MapDataImpl<Entry>::contains): Deleted.
3443         (JSC::MapDataImpl<Entry>::add): Deleted.
3444         (JSC::MapDataImpl<Entry>::set): Deleted.
3445         (JSC::MapDataImpl<Entry>::get): Deleted.
3446         (JSC::MapDataImpl<Entry>::remove): Deleted.
3447         (JSC::MapDataImpl<Entry>::replaceAndPackBackingStore): Deleted.
3448         (JSC::MapDataImpl<Entry>::replaceBackingStore): Deleted.
3449         (JSC::MapDataImpl<Entry>::ensureSpaceForAppend): Deleted.
3450         (JSC::MapDataImpl<Entry>::visitChildren): Deleted.
3451         (JSC::MapDataImpl<Entry>::copyBackingStore): Deleted.
3452         * runtime/MapPrototype.cpp:
3453         (JSC::mapProtoFuncForEach):
3454         * runtime/SetPrototype.cpp:
3455         (JSC::setProtoFuncForEach):
3456         * runtime/WeakGCMap.h:
3457         (JSC::WeakGCMap::forEach):
3458         * tests/stress/modify-map-during-iteration.js: Added.
3459         (testValue):
3460         (identityPairs):
3461         (.set if):
3462         (var):
3463         (set map):
3464         * tests/stress/modify-set-during-iteration.js: Added.
3465         (testValue):
3466         (set forEach):
3467         (set delete):
3468
3469 2015-03-24  Mark Lam  <mark.lam@apple.com>
3470
3471         The ExecutionTimeLimit test should use its own JSGlobalContextRef.
3472         <https://webkit.org/b/143024>
3473
3474         Reviewed by Geoffrey Garen.
3475
3476         Currently, the ExecutionTimeLimit test is using a JSGlobalContextRef
3477         passed in from testapi.c.  It should create its own for better
3478         encapsulation of the test.
3479
3480         * API/tests/ExecutionTimeLimitTest.cpp:
3481         (currentCPUTimeAsJSFunctionCallback):
3482         (testExecutionTimeLimit):
3483         * API/tests/ExecutionTimeLimitTest.h:
3484         * API/tests/testapi.c:
3485         (main):
3486
3487 2015-03-24  Joseph Pecoraro  <pecoraro@apple.com>
3488
3489         ES6: Object Literal Methods toString is missing method name
3490         https://bugs.webkit.org/show_bug.cgi?id=142992
3491
3492         Reviewed by Geoffrey Garen.
3493
3494         Always stringify functions in the pattern:
3495
3496           "function " + <function name> + <text from opening parenthesis to closing brace>.
3497
3498         * runtime/FunctionPrototype.cpp:
3499         (JSC::functionProtoFuncToString):
3500         Update the path that was not stringifying in this pattern.
3501
3502         * bytecode/UnlinkedCodeBlock.cpp:
3503         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
3504         * bytecode/UnlinkedCodeBlock.h:
3505         (JSC::UnlinkedFunctionExecutable::parametersStartOffset):
3506         * parser/Nodes.h:
3507         * runtime/Executable.cpp:
3508         (JSC::FunctionExecutable::FunctionExecutable):
3509         * runtime/Executable.h:
3510         (JSC::FunctionExecutable::parametersStartOffset):
3511         Pass the already known function parameter opening parenthesis
3512         start offset through to the FunctionExecutable.
3513
3514         * tests/mozilla/js1_5/Scope/regress-185485.js:
3515         (with.g):
3516         Add back original space in this test that was removed by r181810
3517         now that we have the space again in stringification.
3518
3519 2015-03-24  Michael Saboff  <msaboff@apple.com>
3520
3521         REGRESSION (172175-172177): Change in for...in processing causes properties added in loop to be enumerated
3522         https://bugs.webkit.org/show_bug.cgi?id=142856
3523
3524         Reviewed by Filip Pizlo.
3525
3526         Refactored the way the for .. in enumeration over objects is done.  We used to make three C++ calls to
3527         get info for three loops to iterate over indexed properties, structure properties and other properties,
3528         respectively.  We still have the three loops, but now we make one C++ call to get all the info needed
3529         for all loops before we exectue any enumeration.
3530
3531         The JSPropertyEnumerator has a count of the indexed properties and a list of named properties.
3532         The named properties are one list, with structured properties in the range [0,m_endStructurePropertyIndex)
3533         and the generic properties in the range [m_endStructurePropertyIndex, m_endGenericPropertyIndex);
3534
3535         Eliminated the bytecodes op_get_structure_property_enumerator, op_get_generic_property_enumerator and
3536         op_next_enumerator_pname.
3537         Added the bytecodes op_get_property_enumerator, op_enumerator_structure_pname and op_enumerator_generic_pname.
3538         The bytecodes op_enumerator_structure_pname and op_enumerator_generic_pname are similar except for what
3539         end value we stop iterating on.
3540
3541         Made corresponding node changes to the DFG and FTL for the bytecode changes.
3542
3543         * bytecode/BytecodeList.json:
3544         * bytecode/BytecodeUseDef.h:
3545         (JSC::computeUsesForBytecodeOffset):
3546         (JSC::computeDefsForBytecodeOffset):
3547         * bytecode/CodeBlock.cpp:
3548         (JSC::CodeBlock::dumpBytecode):
3549         * bytecompiler/BytecodeGenerator.cpp:
3550         (JSC::BytecodeGenerator::emitGetPropertyEnumerator):
3551         (JSC::BytecodeGenerator::emitEnumeratorStructurePropertyName):
3552         (JSC::BytecodeGenerator::emitEnumeratorGenericPropertyName):
3553         (JSC::BytecodeGenerator::emitGetStructurePropertyEnumerator): Deleted.
3554         (JSC::BytecodeGenerator::emitGetGenericPropertyEnumerator): Deleted.
3555         (JSC::BytecodeGenerator::emitNextEnumeratorPropertyName): Deleted.
3556         * bytecompiler/BytecodeGenerator.h:
3557         * bytecompiler/NodesCodegen.cpp:
3558         (JSC::ForInNode::emitMultiLoopBytecode):
3559         * dfg/DFGAbstractInterpreterInlines.h:
3560         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3561         * dfg/DFGByteCodeParser.cpp:
3562         (JSC::DFG::ByteCodeParser::parseBlock):
3563         * dfg/DFGCapabilities.cpp:
3564         (JSC::DFG::capabilityLevel):
3565         * dfg/DFGClobberize.h:
3566         (JSC::DFG::clobberize):
3567         * dfg/DFGDoesGC.cpp:
3568         (JSC::DFG::doesGC):
3569         * dfg/DFGFixupPhase.cpp:
3570         (JSC::DFG::FixupPhase::fixupNode):
3571         * dfg/DFGNodeType.h:
3572         * dfg/DFGPredictionPropagationPhase.cpp:
3573         (JSC::DFG::PredictionPropagationPhase::propagate):
3574         * dfg/DFGSafeToExecute.h:
3575         (JSC::DFG::safeToExecute):
3576         * dfg/DFGSpeculativeJIT32_64.cpp:
3577         (JSC::DFG::SpeculativeJIT::compile):
3578         * dfg/DFGSpeculativeJIT64.cpp:
3579         (JSC::DFG::SpeculativeJIT::compile):
3580         * ftl/FTLAbstractHeapRepository.h:
3581         * ftl/FTLCapabilities.cpp:
3582         (JSC::FTL::canCompile):
3583         * ftl/FTLLowerDFGToLLVM.cpp:
3584         (JSC::FTL::LowerDFGToLLVM::compileNode):
3585         (JSC::FTL::LowerDFGToLLVM::compileGetEnumerableLength):
3586         (JSC::FTL::LowerDFGToLLVM::compileGetPropertyEnumerator):
3587         (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorStructurePname):
3588         (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorGenericPname):
3589         (JSC::FTL::LowerDFGToLLVM::compileGetStructurePropertyEnumerator): Deleted.
3590         (JSC::FTL::LowerDFGToLLVM::compileGetGenericPropertyEnumerator): Deleted.
3591         (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorPname): Deleted.
3592         * jit/JIT.cpp:
3593         (JSC::JIT::privateCompileMainPass):
3594         * jit/JIT.h:
3595         * jit/JITOpcodes.cpp:
3596         (JSC::JIT::emit_op_enumerator_structure_pname):
3597         (JSC::JIT::emit_op_enumerator_generic_pname):
3598         (JSC::JIT::emit_op_get_property_enumerator):
3599         (JSC::JIT::emit_op_next_enumerator_pname): Deleted.
3600         (JSC::JIT::emit_op_get_structure_property_enumerator): Deleted.
3601         (JSC::JIT::emit_op_get_generic_property_enumerator): Deleted.
3602         * jit/JITOpcodes32_64.cpp:
3603         (JSC::JIT::emit_op_enumerator_structure_pname):
3604         (JSC::JIT::emit_op_enumerator_generic_pname):
3605         (JSC::JIT::emit_op_next_enumerator_pname): Deleted.
3606         * jit/JITOperations.cpp:
3607         * jit/JITOperations.h:
3608         * llint/LowLevelInterpreter.asm:
3609         * runtime/CommonSlowPaths.cpp:
3610         (JSC::SLOW_PATH_DECL):
3611         * runtime/CommonSlowPaths.h:
3612         * runtime/JSPropertyNameEnumerator.cpp:
3613         (JSC::JSPropertyNameEnumerator::create):
3614         (JSC::JSPropertyNameEnumerator::finishCreation):
3615         * runtime/JSPropertyNameEnumerator.h:
3616         (JSC::JSPropertyNameEnumerator::indexedLength):
3617         (JSC::JSPropertyNameEnumerator::endStructurePropertyIndex):
3618         (JSC::JSPropertyNameEnumerator::endGenericPropertyIndex):
3619         (JSC::JSPropertyNameEnumerator::indexedLengthOffset):
3620         (JSC::JSPropertyNameEnumerator::endStructurePropertyIndexOffset):
3621         (JSC::JSPropertyNameEnumerator::endGenericPropertyIndexOffset):
3622         (JSC::JSPropertyNameEnumerator::cachedInlineCapacityOffset):
3623         (JSC::propertyNameEnumerator):
3624         (JSC::JSPropertyNameEnumerator::cachedPropertyNamesLengthOffset): Deleted.
3625         (JSC::structurePropertyNameEnumerator): Deleted.
3626         (JSC::genericPropertyNameEnumerator): Deleted.
3627         * runtime/Structure.cpp:
3628         (JSC::Structure::setCachedPropertyNameEnumerator):
3629         (JSC::Structure::cachedPropertyNameEnumerator):
3630         (JSC::Structure::canCachePropertyNameEnumerator):
3631         (JSC::Structure::setCachedStructurePropertyNameEnumerator): Deleted.
3632         (JSC::Structure::cachedStructurePropertyNameEnumerator): Deleted.
3633         (JSC::Structure::setCachedGenericPropertyNameEnumerator): Deleted.
3634         (JSC::Structure::cachedGenericPropertyNameEnumerator): Deleted.
3635         (JSC::Structure::canCacheStructurePropertyNameEnumerator): Deleted.
3636         (JSC::Structure::canCacheGenericPropertyNameEnumerator): Deleted.
3637         * runtime/Structure.h:
3638         * runtime/StructureRareData.cpp:
3639         (JSC::StructureRareData::visitChildren):
3640         (JSC::StructureRareData::cachedPropertyNameEnumerator):
3641         (JSC::StructureRareData::setCachedPropertyNameEnumerator):
3642         (JSC::StructureRareData::cachedStructurePropertyNameEnumerator): Deleted.
3643         (JSC::StructureRareData::setCachedStructurePropertyNameEnumerator): Deleted.
3644         (JSC::StructureRareData::cachedGenericPropertyNameEnumerator): Deleted.
3645         (JSC::StructureRareData::setCachedGenericPropertyNameEnumerator): Deleted.
3646         * runtime/StructureRareData.h:
3647         * tests/stress/for-in-delete-during-iteration.js:
3648
3649 2015-03-24  Michael Saboff  <msaboff@apple.com>
3650
3651         Unreviewed build fix for debug builds.
3652
3653         * runtime/ExceptionHelpers.cpp:
3654         (JSC::invalidParameterInSourceAppender):
3655
3656 2015-03-24  Saam Barati  <saambarati1@gmail.com>
3657
3658         Improve error messages in JSC
3659         https://bugs.webkit.org/show_bug.cgi?id=141869
3660
3661         Reviewed by Geoffrey Garen.
3662
3663         JavaScriptCore has some unintuitive error messages associated
3664         with certain common errors. This patch changes some specific
3665         error messages to be more understandable and also creates a
3666         mechanism that will allow for easy modification of error messages
3667         in the future. The specific errors we change are not a function
3668         errors and invalid parameter errors.
3669
3670         * CMakeLists.txt:
3671         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3672         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
3673         * JavaScriptCore.xcodeproj/project.pbxproj:
3674         * interpreter/Interpreter.cpp:
3675         (JSC::sizeOfVarargs):
3676         * jit/JITOperations.cpp:
3677         op_throw_static_error always has a JSString as its argument.
3678         There is no need to dance around this, and we should assert
3679         that this always holds. This JSString represents the error
3680         message we want to display to the user, so there is no need
3681         to pass it into errorDescriptionForValue which will now place
3682         quotes around the string.
3683
3684         * llint/LLIntSlowPaths.cpp:
3685         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3686         * runtime/CommonSlowPaths.h:
3687         (JSC::CommonSlowPaths::opIn):
3688         * runtime/ErrorInstance.cpp:
3689         (JSC::ErrorInstance::ErrorInstance):
3690         * runtime/ErrorInstance.h:
3691         (JSC::ErrorInstance::hasSourceAppender):
3692         (JSC::ErrorInstance::sourceAppender):
3693         (JSC::ErrorInstance::setSourceAppender):
3694         (JSC::ErrorInstance::clearSourceAppender):
3695         (JSC::ErrorInstance::setRuntimeTypeForCause):
3696         (JSC::ErrorInstance::runtimeTypeForCause):
3697         (JSC::ErrorInstance::clearRuntimeTypeForCause):
3698         (JSC::ErrorInstance::appendSourceToMessage): Deleted.
3699         (JSC::ErrorInstance::setAppendSourceToMessage): Deleted.
3700         (JSC::ErrorInstance::clearAppendSourceToMessage): Deleted.
3701         * runtime/ExceptionHelpers.cpp:
3702         (JSC::errorDescriptionForValue):
3703         (JSC::defaultApproximateSourceError):
3704         (JSC::defaultSourceAppender):
3705         (JSC::functionCallBase):
3706         (JSC::notAFunctionSourceAppender):
3707         (JSC::invalidParameterInSourceAppender):
3708         (JSC::invalidParameterInstanceofSourceAppender):
3709         (JSC::createError):
3710         (JSC::createInvalidFunctionApplyParameterError):
3711         (JSC::createInvalidInParameterError):
3712         (JSC::createInvalidInstanceofParameterError):
3713         (JSC::createNotAConstructorError):
3714         (JSC::createNotAFunctionError):
3715         (JSC::createNotAnObjectError):
3716         (JSC::createInvalidParameterError): Deleted.
3717         * runtime/ExceptionHelpers.h:
3718         * runtime/JSObject.cpp:
3719         (JSC::JSObject::hasInstance):
3720         * runtime/RuntimeType.cpp: Added.
3721         (JSC::runtimeTypeForValue):
3722         (JSC::runtimeTypeAsString):
3723         * runtime/RuntimeType.h: Added.
3724         * runtime/TypeProfilerLog.cpp:
3725         (JSC::TypeProfilerLog::processLogEntries):
3726         * runtime/TypeSet.cpp:
3727         (JSC::TypeSet::getRuntimeTypeForValue): Deleted.
3728         * runtime/TypeSet.h:
3729         * runtime/VM.cpp:
3730         (JSC::appendSourceToError):
3731         (JSC::VM::throwException):
3732
3733 2015-03-23  Filip Pizlo  <fpizlo@apple.com>
3734
3735         JSC should have a low-cost asynchronous disassembler
3736         https://bugs.webkit.org/show_bug.cgi?id=142997
3737
3738         Reviewed by Mark Lam.
3739
3740         This adds a JSC_asyncDisassembly option that disassembles on a thread. Disassembly
3741         doesn't block execution. Some code will live a little longer because of this, since the
3742         work tasks hold a ref to the code, but other than that there is basically no overhead.
3743
3744         At present, this isn't really a replacement for JSC_showDisassembly, since it doesn't
3745         provide contextual IR information for Baseline and DFG disassemblies, and it doesn't do
3746         the separate IR dumps for FTL. Using JSC_showDisassembly and friends along with
3747         JSC_asyncDisassembly has bizarre behavior - so just choose one.
3748
3749         A simple way of understanding how great this is, is to run a small benchmark like
3750         V8Spider/earley-boyer.
3751
3752         Performance without any disassembly flags: 60ms
3753         Performance with JSC_showDisassembly=true: 477ms
3754         Performance with JSC_asyncDisassembly=true: 65ms
3755
3756         So, the overhead of disassembly goes from 8x to 8%.
3757
3758         Note that JSC_asyncDisassembly=true does make it incorrect to run "time" as a way of
3759         measuring benchmark performance. This is because at VM exit, we wait for all async
3760         disassembly requests to finish. For example, for earley-boyer, we spend an extra ~130ms
3761         after the benchmark completely finishes to finish the disassemblies. This small weirdness
3762         should be OK for the intended use-cases, since all you have to do to get around it is to
3763         measure the execution time of the benchmark payload rather than the end-to-end time of
3764         launching the VM.
3765
3766         * assembler/LinkBuffer.cpp:
3767         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
3768         * assembler/LinkBuffer.h:
3769         (JSC::LinkBuffer::wasAlreadyDisassembled):
3770         (JSC::LinkBuffer::didAlreadyDisassemble):
3771         * dfg/DFGJITCompiler.cpp:
3772         (JSC::DFG::JITCompiler::disassemble):
3773         * dfg/DFGJITFinalizer.cpp:
3774         (JSC::DFG::JITFinalizer::finalize):
3775         (JSC::DFG::JITFinalizer::finalizeFunction):
3776         * disassembler/Disassembler.cpp:
3777         (JSC::disassembleAsynchronously):
3778         (JSC::waitForAsynchronousDisassembly):
3779         * disassembler/Disassembler.h:
3780         * ftl/FTLCompile.cpp:
3781         (JSC::FTL::mmAllocateDataSection):
3782         * ftl/FTLLink.cpp:
3783         (JSC::FTL::link):
3784         * jit/JIT.cpp:
3785         (JSC::JIT::privateCompile):
3786         * jsc.cpp:
3787         * runtime/Options.h:
3788         * runtime/VM.cpp:
3789         (JSC::VM::~VM):
3790
3791 2015-03-23  Dean Jackson  <dino@apple.com>
3792
3793         ES7: Implement Array.prototype.includes
3794         https://bugs.webkit.org/show_bug.cgi?id=142707
3795
3796         Reviewed by Geoffrey Garen.
3797
3798         Add support for the ES7 includes method on Arrays.
3799         https://github.com/tc39/Array.prototype.includes
3800
3801         * builtins/Array.prototype.js:
3802         (includes): Implementation in JS.
3803         * runtime/ArrayPrototype.cpp: Add 'includes' to the lookup table.
3804
3805 2015-03-23  Joseph Pecoraro  <pecoraro@apple.com>
3806
3807         __defineGetter__/__defineSetter__ should throw exceptions
3808         https://bugs.webkit.org/show_bug.cgi?id=142934
3809
3810         Reviewed by Geoffrey Garen.
3811
3812         * runtime/ObjectPrototype.cpp:
3813         (JSC::objectProtoFuncDefineGetter):
3814         (JSC::objectProtoFuncDefineSetter):
3815         Throw exceptions when these functions are used directly.
3816
3817 2015-03-23  Joseph Pecoraro  <pecoraro@apple.com>
3818
3819         Fix DO_PROPERTYMAP_CONSTENCY_CHECK enabled build
3820         https://bugs.webkit.org/show_bug.cgi?id=142952
3821
3822         Reviewed by Geoffrey Garen.
3823
3824         * runtime/Structure.cpp:
3825         (JSC::PropertyTable::checkConsistency):
3826         The check offset method doesn't exist in PropertyTable, it exists in Structure.
3827
3828         (JSC::Structure::checkConsistency):
3829         So move it here, and always put it at the start to match normal behavior.
3830
3831 2015-03-22  Filip Pizlo  <fpizlo@apple.com>
3832
3833         Remove DFG::ValueRecoveryOverride; it's been dead since we removed forward speculations
3834         https://bugs.webkit.org/show_bug.cgi?id=142956
3835
3836         Rubber stamped by Gyuyoung Kim.
3837
3838         Just removing dead code.
3839
3840         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3841         * JavaScriptCore.xcodeproj/project.pbxproj:
3842         * dfg/DFGOSRExit.h:
3843         * dfg/DFGOSRExitCompiler.cpp:
3844         * dfg/DFGValueRecoveryOverride.h: Removed.
3845
3846 2015-03-22  Filip Pizlo  <fpizlo@apple.com>
3847
3848         DFG OSR exit shouldn't assume that the frame count for exit is greater than the frame count in DFG
3849         https://bugs.webkit.org/show_bug.cgi?id=142948
3850
3851         Reviewed by Sam Weinig.
3852
3853         It's necessary to ensure that the stack pointer accounts for the extent of our stack usage
3854         since a signal may clobber the area below the stack pointer. When the DFG is executing,
3855         the stack pointer accounts for the DFG's worst-case stack usage. When we OSR exit back to
3856         baseline, we will use a different amount of stack. This is because baseline is a different
3857         compiler. It will make different decisions. So it will use a different amount of stack.
3858
3859         This gets tricky when we are in the process of doing an OSR exit, because we are sort of
3860         incrementally transforming the stack from how it looked in the DFG to how it will look in
3861         baseline. The most conservative approach would be to set the stack pointer to the max of
3862         DFG and baseline.
3863
3864         When this code was written, a reckless assumption was made: that the stack usage in
3865         baseline is always at least as large as the stack usage in DFG. Based on this incorrect
3866         assumption, the code first adjusts the stack pointer to account for the baseline stack
3867         usage. This sort of usually works, because usually baseline does happen to use more stack.
3868         But that's not an invariant. Nobody guarantees this. We will never make any changes that
3869         would make this be guaranteed, because that would be antithetical to how optimizing
3870         compilers work. The DFG should be allowed to use however much stack it decides that it
3871         should use in order to get good performance, and it shouldn't try to guarantee that it
3872         always uses less stack than baseline.
3873
3874         As such, we must always assume that the frame size for DFG execution (i.e.
3875         frameRegisterCount) and the frame size in baseline once we exit (i.e.
3876         requiredRegisterCountForExit) are two independent quantities and they have no
3877         relationship.
3878
3879         Fortunately, though, this code can be made correct by just moving the stack adjustment to
3880         just before we do conversions. This is because we have since changed the OSR exit
3881         algorithm to first lift up all state from the DFG state into a scratch buffer, and then to
3882         drop it out of the scratch buffer and into the stack according to the baseline layo