1 2018-08-17 Yusuke Suzuki <yusukesuzuki@slowstart.org> and Fujii Hironori <Hironori.Fujii@sony.com>
3 [JSC] Add GPRReg::InvalidGPRReg and FPRReg::InvalidFPRReg
4 https://bugs.webkit.org/show_bug.cgi?id=188589
7 And reviewed by Yusuke Suzuki for Hironori's change.
9 Since GPRReg(RegisterID) and FPRReg(FPRegisterID) do not include -1 in their enum values,
10 UBSan dumps bunch of warnings "runtime error: load of value 4294967295, which is not a valid value for type 'RegisterID'".
12 - We add InvalidGPRReg and InvalidFPRReg to enum values of GPRReg and FPRReg to suppress the above warnings.
13 - We make GPRReg and FPRReg int8_t enums.
14 - We replace `#define InvalidGPRReg ((JSC::GPRReg)-1)` to `static constexpr GPRReg InvalidGPRReg { GPRReg::InvalidGPRReg };`.
15 - We add operator+/- definition for RegisterIDs as a MSVC workaround. MSVC fails to resolve operator+ and operator-
16 if `enum : int8_t` is used instead of `enum`.
18 * assembler/ARM64Assembler.h:
19 * assembler/ARMAssembler.h:
20 * assembler/ARMv7Assembler.h:
21 * assembler/MIPSAssembler.h:
22 * assembler/MacroAssembler.h:
23 * assembler/X86Assembler.h:
25 (JSC::CCallHelpers::clampArrayToSize):
28 (JSC::JSValueRegs::JSValueRegs):
29 (JSC::JSValueRegs::tagGPR const):
30 (JSC::JSValueRegs::payloadGPR const):
31 (JSC::JSValueSource::JSValueSource):
32 (JSC::JSValueSource::unboxedCell):
33 (JSC::JSValueSource::operator bool const):
34 (JSC::JSValueSource::base const):
35 (JSC::JSValueSource::tagGPR const):
36 (JSC::JSValueSource::payloadGPR const):
37 (JSC::JSValueSource::hasKnownTag const):
39 2018-08-16 Yusuke Suzuki <yusukesuzuki@slowstart.org>
41 [JSC] alignas for RegisterState should respect alignof(RegisterState) too
42 https://bugs.webkit.org/show_bug.cgi?id=188686
44 Reviewed by Saam Barati.
46 RegisterState would have larger alignment than `alignof(void*)`. We use the larger alignment value
47 for `alignof` for RegisterState.
49 * heap/RegisterState.h:
51 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
53 [YARR] Align allocation size in BumpPointerAllocator with sizeof(void*)
54 https://bugs.webkit.org/show_bug.cgi?id=188571
56 Reviewed by Saam Barati.
58 UBSan finds YarrInterpreter performs misaligned accesses. This is because YarrInterpreter
59 allocates DisjunctionContext and ParenthesesDisjunctionContext from BumpPointerAllocator
60 without considering alignment of them. This patch adds DisjunctionContext::allocationSize
61 and ParenthesesDisjunctionContext::allocationSize to calculate allocation sizes for them.
62 The size is always rounded to `sizeof(void*)` so that these classes are always allocated
63 with `sizeof(void*)` alignment. We also ensure the alignments of both classes are less
64 than or equal to `sizeof(void*)` by `static_assert`.
66 * yarr/YarrInterpreter.cpp:
67 (JSC::Yarr::Interpreter::DisjunctionContext::allocationSize):
68 (JSC::Yarr::Interpreter::allocDisjunctionContext):
69 (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
70 (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::getDisjunctionContext):
71 (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::allocationSize):
72 (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
73 (JSC::Yarr::Interpreter::Interpreter):
74 (JSC::Yarr::Interpreter::DisjunctionContext::DisjunctionContext): Deleted.
76 2018-08-15 Keith Miller <keith_miller@apple.com>
79 https://bugs.webkit.org/show_bug.cgi?id=188591
81 Reviewed by Joseph Pecoraro.
83 The hack was added in 2012 and the evernote app seems to work now.
84 It's probably not needed anymore.
88 (evernoteHackNeeded): Deleted.
90 2018-08-14 Fujii Hironori <Hironori.Fujii@sony.com>
92 Unreviewed, rolling out r234874 and r234876.
94 WinCairo port can't compile
98 "[JSC] Add GPRReg::InvalidGPRReg and FPRReg::InvalidFPRReg"
99 https://bugs.webkit.org/show_bug.cgi?id=188589
100 https://trac.webkit.org/changeset/234874
102 "Unreviewed, attempt to fix CLoop build"
103 https://bugs.webkit.org/show_bug.cgi?id=188589
104 https://trac.webkit.org/changeset/234876
106 2018-08-14 Saam barati <sbarati@apple.com>
108 HashMap<Ref<P>, V> asserts when V is not zero for its empty value
109 https://bugs.webkit.org/show_bug.cgi?id=188582
111 Reviewed by Sam Weinig.
113 * runtime/SparseArrayValueMap.h:
115 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
117 Unreviewed, attempt to fix CLoop build
118 https://bugs.webkit.org/show_bug.cgi?id=188589
120 * assembler/MacroAssembler.h:
122 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
124 [JSC] Add GPRReg::InvalidGPRReg and FPRReg::InvalidFPRReg
125 https://bugs.webkit.org/show_bug.cgi?id=188589
127 Reviewed by Mark Lam.
129 Since GPRReg(RegisterID) and FPRReg(FPRegisterID) do not include -1 in their enum values,
130 UBSan dumps bunch of warnings "runtime error: load of value 4294967295, which is not a valid value for type 'RegisterID'".
132 1. We add InvalidGPRReg and InvalidFPRReg to enum values of GPRReg and FPRReg to suppress the above warnings.
133 2. We make GPRReg and FPRReg int8_t enums.
134 3. We replace `#define InvalidGPRReg ((JSC::GPRReg)-1)` to `static constexpr GPRReg InvalidGPRReg { GPRReg::InvalidGPRReg };`.
136 * assembler/ARM64Assembler.h:
137 * assembler/ARMAssembler.h:
138 * assembler/ARMv7Assembler.h:
139 * assembler/MIPSAssembler.h:
140 * assembler/X86Assembler.h:
143 (JSC::JSValueRegs::JSValueRegs):
144 (JSC::JSValueRegs::tagGPR const):
145 (JSC::JSValueRegs::payloadGPR const):
146 (JSC::JSValueSource::JSValueSource):
147 (JSC::JSValueSource::unboxedCell):
148 (JSC::JSValueSource::operator bool const):
149 (JSC::JSValueSource::base const):
150 (JSC::JSValueSource::tagGPR const):
151 (JSC::JSValueSource::payloadGPR const):
152 (JSC::JSValueSource::hasKnownTag const):
154 2018-08-14 Keith Miller <keith_miller@apple.com>
156 Add missing availability macro.
157 https://bugs.webkit.org/show_bug.cgi?id=188563
159 Reviewed by Mark Lam.
163 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
165 [JSC] GetByIdStatus::m_wasSeenInJIT is touched in GetByIdStatus::slowVersion
166 https://bugs.webkit.org/show_bug.cgi?id=188560
168 Reviewed by Keith Miller.
170 While GetByIdStatus() / GetByIdStatus(status) constructors do not set m_wasSeenInJIT,
171 it is loaded unconditionally in GetByIdStatus::slowVersion. This access to the
172 uninitialized member field is caught in UBSan. This patch fixes it by adding an initializer
173 `m_wasSeenInJIT { false }`.
175 * bytecode/GetByIdStatus.h:
177 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
179 [DFG] DFGPredictionPropagation should set PrimaryPass when processing invariants
180 https://bugs.webkit.org/show_bug.cgi?id=188557
182 Reviewed by Mark Lam.
184 DFGPredictionPropagationPhase should set PrimaryPass before processing invariants since
185 processing for ArithRound etc.'s invariants requires `m_pass` load. This issue is found
188 * dfg/DFGPredictionPropagationPhase.cpp:
190 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
192 [JSC] Should not rotate constant with 64
193 https://bugs.webkit.org/show_bug.cgi?id=188556
195 Reviewed by Mark Lam.
197 To defend against JIT splaying, we rotate a constant with a randomly generated seed.
198 But if a seed becomes 64, the following code performs `value << 64` where value's type
199 is uint64_t, and it causes undefined behaviors (UBs). This patch limits the seed in the
200 range of [0, 64) not to generate code causing UBs. This is found by UBSan.
202 * assembler/MacroAssembler.h:
203 (JSC::MacroAssembler::generateRotationSeed):
204 (JSC::MacroAssembler::rotationBlindConstant):
206 2018-08-12 Karo Gyoker <karogyoker2+webkit@gmail.com>
208 Disable JIT on IA-32 without SSE2
209 https://bugs.webkit.org/show_bug.cgi?id=188476
211 Reviewed by Michael Catanzaro.
213 Including missing header (MacroAssembler.h) in case of other
214 operating systems than Windows too.
216 * runtime/Options.cpp:
218 2018-08-11 Karo Gyoker <karogyoker2+webkit@gmail.com>
220 Disable JIT on IA-32 without SSE2
221 https://bugs.webkit.org/show_bug.cgi?id=188476
223 Reviewed by Yusuke Suzuki.
225 On IA-32 CPUs without SSE2 most of the webpages cannot load
226 if the JIT is turned on.
228 * runtime/Options.cpp:
229 (JSC::recomputeDependentOptions):
231 2018-08-10 Joseph Pecoraro <pecoraro@apple.com>
233 Web Inspector: console.log fires getters for deep properties
234 https://bugs.webkit.org/show_bug.cgi?id=187542
235 <rdar://problem/42873158>
237 Reviewed by Saam Barati.
239 * inspector/InjectedScriptSource.js:
240 (RemoteObject.prototype._isPreviewableObject):
241 Avoid getters/setters when checking for simple properties to preview.
242 Here we avoid invoking `object[property]` if it could be a user getter.
244 2018-08-10 Keith Miller <keith_miller@apple.com>
246 Slicing an ArrayBuffer with a long number returns an ArrayBuffer with byteLength zero
247 https://bugs.webkit.org/show_bug.cgi?id=185127
249 Reviewed by Saam Barati.
251 Previously, we would truncate the indicies passed to slice to an
252 int. This meant that the value was not getting properly clamped
255 This patch also removes a non-spec compliant check that slice was
256 passed at least one argument.
258 * runtime/ArrayBuffer.cpp:
259 (JSC::ArrayBuffer::clampValue):
260 (JSC::ArrayBuffer::clampIndex const):
261 (JSC::ArrayBuffer::slice const):
262 * runtime/ArrayBuffer.h:
263 (JSC::ArrayBuffer::clampValue): Deleted.
264 (JSC::ArrayBuffer::clampIndex const): Deleted.
265 * runtime/JSArrayBufferPrototype.cpp:
266 (JSC::arrayBufferProtoFuncSlice):
268 2018-08-10 Yusuke Suzuki <yusukesuzuki@slowstart.org>
270 Date.UTC should not return NaN with only Year param
271 https://bugs.webkit.org/show_bug.cgi?id=188378
273 Reviewed by Keith Miller.
275 Date.UTC requires one argument for |year|. But the other ones are optional.
276 This patch fix this handling.
278 * runtime/DateConstructor.cpp:
279 (JSC::millisecondsFromComponents):
281 2018-08-08 Keith Miller <keith_miller@apple.com>
283 Array.prototype.sort should call @toLength instead of ">>> 0"
284 https://bugs.webkit.org/show_bug.cgi?id=188430
286 Reviewed by Saam Barati.
288 Also add a new function to $vm that will fetch a private
289 property. This can be useful for running builtin helper functions.
291 * builtins/ArrayPrototype.js:
293 * tools/JSDollarVM.cpp:
294 (JSC::functionGetPrivateProperty):
295 (JSC::JSDollarVM::finishCreation):
297 2018-08-08 Keith Miller <keith_miller@apple.com>
299 Array.prototype.sort should throw TypeError if param is a not callable object
300 https://bugs.webkit.org/show_bug.cgi?id=188382
302 Reviewed by Saam Barati.
304 Improve spec compatability by checking if the Array.prototype.sort comparator is a function
305 before doing anything else.
307 Also, refactor the various helper functions to use let instead of var.
309 * builtins/ArrayPrototype.js:
310 (sort.stringComparator):
311 (sort.compactSparse):
317 (sort.comparatorSort):
321 2018-08-08 Michael Saboff <msaboff@apple.com>
323 Yarr JIT should include annotations with dumpDisassembly=true
324 https://bugs.webkit.org/show_bug.cgi?id=188415
326 Reviewed by Yusuke Suzuki.
328 Created a YarrDisassembler class that handles annotations similar to the baseline JIT.
329 Given that the Yarr creates matching code bu going through the YarrPattern ops forward and
330 then the backtracking code through the YarrPattern ops in reverse order, the disassembler
331 needs to do the same think.
333 Restructured some of the logging code in YarrPattern to eliminate redundent code and factor
334 out simple methods for what was needed by the YarrDisassembler.
336 Here is abbreviated sample output after this change.
338 Generated JIT code for 8-bit regular expression /ab*c/:
339 Code at [0x469561c03720, 0x469561c03840):
340 0x469561c03720: push %rbp
341 0x469561c03721: mov %rsp, %rbp
343 0x469561c03762: sub $0x40, %rsp
345 0:OpBodyAlternativeBegin minimum size 2
346 0x469561c03766: add $0x2, %esi
347 0x469561c03769: cmp %edx, %esi
348 0x469561c0376b: ja 0x469561c037fa
349 1:OpTerm TypePatternCharacter 'a'
350 0x469561c03771: movzx -0x2(%rdi,%rsi), %eax
351 0x469561c03776: cmp $0x61, %eax
352 0x469561c03779: jnz 0x469561c037e9
353 2:OpTerm TypePatternCharacter 'b' {0,...} greedy
354 0x469561c0377f: xor %r9d, %r9d
355 0x469561c03782: cmp %edx, %esi
356 0x469561c03784: jz 0x469561c037a2
358 0x469561c0379d: jmp 0x469561c03782
359 0x469561c037a2: mov %r9, 0x8(%rsp)
360 3:OpTerm TypePatternCharacter 'c'
361 0x469561c037a7: movzx -0x1(%rdi,%rsi), %eax
362 0x469561c037ac: cmp $0x63, %eax
363 0x469561c037af: jnz 0x469561c037d1
364 4:OpBodyAlternativeEnd
365 0x469561c037b5: add $0x40, %rsp
367 0x469561c037cf: pop %rbp
370 4:OpBodyAlternativeEnd
371 3:OpTerm TypePatternCharacter 'c'
372 2:OpTerm TypePatternCharacter 'b' {0,...} greedy
373 0x469561c037d1: mov 0x8(%rsp), %r9
375 0x469561c037e4: jmp 0x469561c037a2
376 1:OpTerm TypePatternCharacter 'a'
377 0:OpBodyAlternativeBegin minimum size 2
378 0x469561c037e9: mov %rsi, %rax
380 0x469561c0382f: pop %rbp
383 * JavaScriptCore.xcodeproj/project.pbxproj:
385 * runtime/RegExp.cpp:
386 (JSC::RegExp::compile):
387 (JSC::RegExp::compileMatchOnly):
388 * yarr/YarrDisassembler.cpp: Added.
389 (JSC::Yarr::YarrDisassembler::indentString):
390 (JSC::Yarr::YarrDisassembler::YarrDisassembler):
391 (JSC::Yarr::YarrDisassembler::~YarrDisassembler):
392 (JSC::Yarr::YarrDisassembler::dump):
393 (JSC::Yarr::YarrDisassembler::dumpHeader):
394 (JSC::Yarr::YarrDisassembler::dumpVectorForInstructions):
395 (JSC::Yarr::YarrDisassembler::dumpForInstructions):
396 (JSC::Yarr::YarrDisassembler::dumpDisassembly):
397 * yarr/YarrDisassembler.h: Added.
398 (JSC::Yarr::YarrJITInfo::~YarrJITInfo):
399 (JSC::Yarr::YarrDisassembler::setStartOfCode):
400 (JSC::Yarr::YarrDisassembler::setForGenerate):
401 (JSC::Yarr::YarrDisassembler::setForBacktrack):
402 (JSC::Yarr::YarrDisassembler::setEndOfGenerate):
403 (JSC::Yarr::YarrDisassembler::setEndOfBacktrack):
404 (JSC::Yarr::YarrDisassembler::setEndOfCode):
405 (JSC::Yarr::YarrDisassembler::indentString):
407 (JSC::Yarr::YarrGenerator::generate):
408 (JSC::Yarr::YarrGenerator::backtrack):
409 (JSC::Yarr::YarrGenerator::YarrGenerator):
410 (JSC::Yarr::YarrGenerator::compile):
411 (JSC::Yarr::jitCompile):
413 * yarr/YarrPattern.cpp:
414 (JSC::Yarr::dumpCharacterClass):
415 (JSC::Yarr::PatternTerm::dump):
416 (JSC::Yarr::YarrPattern::dumpPatternString):
417 (JSC::Yarr::YarrPattern::dumpPattern):
418 * yarr/YarrPattern.h:
420 2018-08-05 Darin Adler <darin@apple.com>
422 [Cocoa] More tweaks and refactoring to prepare for ARC
423 https://bugs.webkit.org/show_bug.cgi?id=188245
425 Reviewed by Dan Bernstein.
427 * API/JSValue.mm: Use __unsafe_unretained.
428 (JSContainerConvertor::convert): Use auto for compatibility with the above.
429 * API/JSWrapperMap.mm:
430 (allocateConstructorForCustomClass): Use CFTypeRef instead of Protocol *.
431 (-[JSWrapperMap initWithGlobalContextRef:]): Use __unsafe_unretained.
433 * heap/Heap.cpp: Updated include for rename: FoundationSPI.h -> objcSPI.h.
435 2018-08-07 Yusuke Suzuki <yusukesuzuki@slowstart.org>
437 Shrink size of PropertyCondition by packing UniquedStringImpl* and Kind
438 https://bugs.webkit.org/show_bug.cgi?id=188328
440 Reviewed by Saam Barati.
442 Shrinking the size of PropertyCondition can improve memory consumption by a lot.
443 For example, cnn.com can show 7000 persistent StructureStubClearingWatchpoint
444 and 6000 LLIntPrototypeLoadAdaptiveStructureWatchpoint which have PropertyCondition
447 This patch shrinks the size of PropertyCondition by packing UniquedStringImpl* and
448 PropertyCondition::Kind into uint64_t data in 64bit architecture. Since our address
449 are within 48bit, we can put PropertyCondition::Kind in this unused bits.
450 To make it easy, we add WTF::CompactPointerTuple<PointerType, Type>, which automatically
451 folds a pointer and 1byte type into 64bit data.
453 This change shrinks PropertyCondition from 24bytes to 16bytes.
455 * bytecode/PropertyCondition.cpp:
456 (JSC::PropertyCondition::dumpInContext const):
457 (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
458 (JSC::PropertyCondition::validityRequiresImpurePropertyWatchpoint const):
459 (JSC::PropertyCondition::isStillValid const):
460 (JSC::PropertyCondition::isWatchableWhenValid const):
461 * bytecode/PropertyCondition.h:
462 (JSC::PropertyCondition::PropertyCondition):
463 (JSC::PropertyCondition::presenceWithoutBarrier):
464 (JSC::PropertyCondition::absenceWithoutBarrier):
465 (JSC::PropertyCondition::absenceOfSetEffectWithoutBarrier):
466 (JSC::PropertyCondition::equivalenceWithoutBarrier):
467 (JSC::PropertyCondition::hasPrototypeWithoutBarrier):
468 (JSC::PropertyCondition::operator bool const):
469 (JSC::PropertyCondition::kind const):
470 (JSC::PropertyCondition::uid const):
471 (JSC::PropertyCondition::hasOffset const):
472 (JSC::PropertyCondition::hasAttributes const):
473 (JSC::PropertyCondition::hasPrototype const):
474 (JSC::PropertyCondition::hasRequiredValue const):
475 (JSC::PropertyCondition::hash const):
476 (JSC::PropertyCondition::operator== const):
477 (JSC::PropertyCondition::isHashTableDeletedValue const):
478 (JSC::PropertyCondition::watchingRequiresReplacementWatchpoint const):
480 2018-08-07 Mark Lam <mark.lam@apple.com>
482 Use a more specific PtrTag for PlatformRegisters PC and LR.
483 https://bugs.webkit.org/show_bug.cgi?id=188366
484 <rdar://problem/42984123>
486 Reviewed by Keith Miller.
488 Also fixed a bug in linkRegister(), which was previously returning the PC instead
489 of LR. It now returns LR.
491 * runtime/JSCPtrTag.h:
492 * runtime/MachineContext.h:
493 (JSC::MachineContext::instructionPointer):
494 (JSC::MachineContext::linkRegister):
495 * runtime/VMTraps.cpp:
496 (JSC::SignalContext::SignalContext):
497 * tools/SigillCrashAnalyzer.cpp:
498 (JSC::SignalContext::SignalContext):
500 2018-08-07 Karo Gyoker <karogyoker2+webkit@gmail.com>
502 Hardcoded LFENCE instruction
503 https://bugs.webkit.org/show_bug.cgi?id=188145
505 Reviewed by Filip Pizlo.
507 Remove lfence instruction because it is crashing systems without SSE2 and
508 this is not the way how WebKit mitigates Spectre.
510 * runtime/JSLock.cpp:
511 (JSC::JSLock::didAcquireLock):
512 (JSC::JSLock::willReleaseLock):
514 2018-08-04 David Kilzer <ddkilzer@apple.com>
516 REGRESSION (r208953): TemplateObjectDescriptor constructor calculates m_hash on use-after-move variable
517 <https://webkit.org/b/188331>
519 Reviewed by Yusuke Suzuki.
521 * runtime/TemplateObjectDescriptor.h:
522 (JSC::TemplateObjectDescriptor::TemplateObjectDescriptor):
523 Use `m_rawstrings` instead of `rawStrings` to calculate hash.
525 2018-08-03 Saam Barati <sbarati@apple.com>
527 Give the `jsc` shell the JIT entitlement
528 https://bugs.webkit.org/show_bug.cgi?id=188324
529 <rdar://problem/42885806>
531 Reviewed by Dan Bernstein.
533 This should help us in ensuring the system jsc is able to JIT.
535 * Configurations/JSC.xcconfig:
536 * JavaScriptCore.xcodeproj/project.pbxproj:
537 * allow-jit-macOS.entitlements: Added.
539 2018-08-03 Alex Christensen <achristensen@webkit.org>
541 Fix spelling of "overridden"
542 https://bugs.webkit.org/show_bug.cgi?id=188315
544 Reviewed by Darin Adler.
547 * inspector/InjectedScriptSource.js:
549 2018-08-02 Saam Barati <sbarati@apple.com>
551 Reading instructionPointer from PlatformRegisters may fail when using pointer profiling
552 https://bugs.webkit.org/show_bug.cgi?id=188271
553 <rdar://problem/42850884>
555 Reviewed by Michael Saboff.
557 This patch defends against the instructionPointer containing garbage bits.
558 See radar for details.
560 * runtime/MachineContext.h:
561 (JSC::MachineContext::instructionPointer):
562 * runtime/SamplingProfiler.cpp:
563 (JSC::SamplingProfiler::takeSample):
564 * runtime/VMTraps.cpp:
565 (JSC::SignalContext::SignalContext):
566 (JSC::SignalContext::tryCreate):
567 * tools/CodeProfiling.cpp:
568 (JSC::profilingTimer):
569 * tools/SigillCrashAnalyzer.cpp:
570 (JSC::SignalContext::SignalContext):
571 (JSC::SignalContext::tryCreate):
572 (JSC::SignalContext::dump):
573 (JSC::installCrashHandler):
574 * wasm/WasmFaultSignalHandler.cpp:
575 (JSC::Wasm::trapHandler):
577 2018-08-02 David Fenton <david_fenton@apple.com>
579 Unreviewed, rolling out r234489.
581 Caused 50+ crashes and 60+ API failures on iOS
585 "[WTF] Rename String::format to String::deprecatedFormat"
586 https://bugs.webkit.org/show_bug.cgi?id=188191
587 https://trac.webkit.org/changeset/234489
589 2018-08-01 Yusuke Suzuki <utatane.tea@gmail.com>
591 Add self.queueMicrotask(f) on DOMWindow
592 https://bugs.webkit.org/show_bug.cgi?id=188212
594 Reviewed by Ryosuke Niwa.
597 * JavaScriptCore.xcodeproj/project.pbxproj:
599 * runtime/JSGlobalObject.cpp:
601 * runtime/JSMicrotask.cpp: Renamed from Source/JavaScriptCore/runtime/JSJob.cpp.
602 (JSC::createJSMicrotask):
603 Export them to WebCore.
605 (JSC::JSMicrotask::run):
606 * runtime/JSMicrotask.h: Renamed from Source/JavaScriptCore/runtime/JSJob.h.
607 Add another version of JSMicrotask which does not have arguments.
609 2018-08-01 Tomas Popela <tpopela@redhat.com>
611 [WTF] Rename String::format to String::deprecatedFormat
612 https://bugs.webkit.org/show_bug.cgi?id=188191
614 Reviewed by Darin Adler.
616 It should be replaced with string concatenation.
618 * bytecode/CodeBlock.cpp:
619 (JSC::CodeBlock::nameForRegister):
620 * inspector/InjectedScriptBase.cpp:
621 (Inspector::InjectedScriptBase::makeCall):
622 * inspector/InspectorBackendDispatcher.cpp:
623 (Inspector::BackendDispatcher::getPropertyValue):
624 * inspector/agents/InspectorConsoleAgent.cpp:
625 (Inspector::InspectorConsoleAgent::enable):
626 (Inspector::InspectorConsoleAgent::stopTiming):
628 (FunctionJSCStackFunctor::operator() const):
630 (JSC::Lexer<T>::invalidCharacterMessage const):
631 * runtime/IntlDateTimeFormat.cpp:
632 (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
633 * runtime/IntlObject.cpp:
634 (JSC::canonicalizeLocaleList):
635 * runtime/LiteralParser.cpp:
636 (JSC::LiteralParser<CharType>::Lexer::lex):
637 (JSC::LiteralParser<CharType>::Lexer::lexStringSlow):
638 (JSC::LiteralParser<CharType>::parse):
639 * runtime/LiteralParser.h:
640 (JSC::LiteralParser::getErrorMessage):
642 2018-08-01 Andy VanWagoner <andy@vanwagoner.family>
644 [INTL] Allow "unknown" formatToParts types
645 https://bugs.webkit.org/show_bug.cgi?id=188176
647 Reviewed by Darin Adler.
649 Originally extra unexpected field types were marked as "literal", since
650 the spec did not account for these. The ECMA 402 spec has since been updated
651 to specify "unknown" should be used in these cases.
653 Currently there is no known way to reach these cases, so no tests can
654 account for them. Theoretically they shoudn't exist, but they are specified,
655 just to be safe. Marking them as "unknown" instead of "literal" hopefully
656 will make such cases easy to identify if they ever happen.
658 * runtime/IntlDateTimeFormat.cpp:
659 (JSC::IntlDateTimeFormat::partTypeString):
660 * runtime/IntlNumberFormat.cpp:
661 (JSC::IntlNumberFormat::partTypeString):
663 2018-08-01 Andy VanWagoner <andy@vanwagoner.family>
665 [INTL] Implement hourCycle in DateTimeFormat
666 https://bugs.webkit.org/show_bug.cgi?id=188006
668 Reviewed by Darin Adler.
670 Implemented hourCycle, updating both the skeleton and the final pattern.
671 Changed resolveLocale to assume undefined options are not given and null
672 strings actually mean null, which removes the tag extension.
674 * runtime/CommonIdentifiers.h:
675 * runtime/IntlCollator.cpp:
676 (JSC::IntlCollator::initializeCollator):
677 * runtime/IntlDateTimeFormat.cpp:
678 (JSC::IntlDTFInternal::localeData):
679 (JSC::IntlDateTimeFormat::setFormatsFromPattern):
680 (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
681 (JSC::IntlDateTimeFormat::resolvedOptions):
682 * runtime/IntlDateTimeFormat.h:
683 * runtime/IntlObject.cpp:
684 (JSC::resolveLocale):
686 2018-08-01 Keith Miller <keith_miller@apple.com>
688 JSArrayBuffer should have its own JSType
689 https://bugs.webkit.org/show_bug.cgi?id=188231
691 Reviewed by Saam Barati.
693 * runtime/JSArrayBuffer.cpp:
694 (JSC::JSArrayBuffer::createStructure):
698 2018-07-31 Keith Miller <keith_miller@apple.com>
700 Unreviewed 32-bit build fix...
702 * dfg/DFGSpeculativeJIT32_64.cpp:
704 2018-07-31 Keith Miller <keith_miller@apple.com>
706 Long compiling JSC files should not be unified
707 https://bugs.webkit.org/show_bug.cgi?id=188205
709 Reviewed by Saam Barati.
711 The DFGSpeculativeJIT and FTLLowerDFGToB3 files take a long time
712 to compile. Unifying them means touching anything in the same
713 bundle as those files takes a long time to incrementally build.
714 This patch separates those files so they build standalone.
716 * JavaScriptCore.xcodeproj/project.pbxproj:
718 * dfg/DFGSpeculativeJIT64.cpp:
720 2018-07-31 Yusuke Suzuki <utatane.tea@gmail.com>
722 [JSC] Remove unnecessary cellLock() in JSObject's GC marking if IndexingType is contiguous
723 https://bugs.webkit.org/show_bug.cgi?id=188201
725 Reviewed by Keith Miller.
727 We do not reuse the existing butterfly with Contiguous shape for new ArrayStorage butterfly.
728 When converting the butterfly with Contiguous shape to ArrayStorage, we always allocate a
729 new one. So this cellLock() is unnecessary for contiguous shape since contigous shaped butterfly
730 never becomes broken state. This patch removes unnecessary locking.
732 * runtime/JSObject.cpp:
733 (JSC::JSObject::visitButterflyImpl):
735 2018-07-31 Guillaume Emont <guijemont@igalia.com>
737 [JSC] Remove gcc warnings for 32-bit platforms
738 https://bugs.webkit.org/show_bug.cgi?id=187803
740 Reviewed by Yusuke Suzuki.
742 * assembler/MacroAssemblerPrinter.cpp:
743 (JSC::Printer::printPCRegister):
744 (JSC::Printer::printRegisterID):
745 (JSC::Printer::printAddress):
746 * dfg/DFGSpeculativeJIT.cpp:
747 (JSC::DFG::SpeculativeJIT::speculateNumber):
748 (JSC::DFG::SpeculativeJIT::speculateMisc):
749 * jit/CCallHelpers.h:
750 (JSC::CCallHelpers::calculatePokeOffset):
751 * runtime/Options.cpp:
754 2018-07-30 Wenson Hsieh <wenson_hsieh@apple.com>
756 watchOS engineering build is broken after r234227
757 https://bugs.webkit.org/show_bug.cgi?id=188180
759 Reviewed by Keith Miller.
761 In the case where we're building with a `PLATFORM_NAME` of neither "macosx" nor "iphone*",
762 postprocess-headers.sh attempts to delete any usage of the JSC availability macros. However,
763 `JSC_MAC_VERSION_TBA` and `JSC_IOS_VERSION_TBA` still remain, and JSValue.h's usage of
764 `JSC_IOS_VERSION_TBA` causes engineering watchOS builds to fail.
766 To fix this, simply allow the fallback path to remove these macros from JavaScriptCore headers
767 entirely, since there's no relevant version to replace them with.
769 * postprocess-headers.sh:
771 2018-07-30 Keith Miller <keith_miller@apple.com>
773 Clarify conversion rules for JSValue property access API
774 https://bugs.webkit.org/show_bug.cgi?id=188179
776 Reviewed by Geoffrey Garen.
780 2018-07-30 Keith Miller <keith_miller@apple.com>
782 Rename some JSC API functions/types.
783 https://bugs.webkit.org/show_bug.cgi?id=188173
785 Reviewed by Saam Barati.
787 * API/JSObjectRef.cpp:
788 (JSObjectHasPropertyForKey):
789 (JSObjectGetPropertyForKey):
790 (JSObjectSetPropertyForKey):
791 (JSObjectDeletePropertyForKey):
792 (JSObjectHasPropertyKey): Deleted.
793 (JSObjectGetPropertyKey): Deleted.
794 (JSObjectSetPropertyKey): Deleted.
795 (JSObjectDeletePropertyKey): Deleted.
799 (-[JSValue valueForProperty:]):
800 (-[JSValue setValue:forProperty:]):
801 (-[JSValue deleteProperty:]):
802 (-[JSValue hasProperty:]):
803 (-[JSValue defineProperty:descriptor:]):
804 * API/tests/testapi.cpp:
807 2018-07-30 Mark Lam <mark.lam@apple.com>
809 Add a debugging utility to dump the memory layout of a JSCell.
810 https://bugs.webkit.org/show_bug.cgi?id=188157
812 Reviewed by Yusuke Suzuki.
814 This patch adds $vm.dumpCell() and VMInspector::dumpCellMemory() to allow us to
815 dump the memory contents of a cell and if present, its butterfly for debugging
818 Example usage for JS code when JSC_useDollarVM=true:
822 Example usage from C++ code or from lldb:
824 (lldb) p JSC::VMInspector::dumpCellMemory(obj)
826 Some examples of dumps:
828 <0x104bc8260, Object>
829 [0] 0x104bc8260 : 0x010016000000016c header
830 structureID 364 0x16c structure 0x104b721b0
831 indexingTypeAndMisc 0 0x0 NonArray
835 [1] 0x104bc8268 : 0x0000000000000000 butterfly
836 [2] 0x104bc8270 : 0xffff000000000007
837 [3] 0x104bc8278 : 0xffff000000000008
840 [0] 0x104bb4360 : 0x0108210b00000171 header
841 structureID 369 0x171 structure 0x104b723e0
842 indexingTypeAndMisc 11 0xb ArrayWithArrayStorage
846 [1] 0x104bb4368 : 0x00000008000f4718 butterfly
848 hasIndexingHeader YES hasAnyArrayStorage YES
849 publicLength 4 vectorLength 7 indexBias 2
850 preCapacity 2 propertyCapacity 4
852 [0] 0x8000f46e0 : 0x0000000000000000
853 [1] 0x8000f46e8 : 0x0000000000000000
854 <--- propertyCapacity
855 [2] 0x8000f46f0 : 0x0000000000000000
856 [3] 0x8000f46f8 : 0x0000000000000000
857 [4] 0x8000f4700 : 0xffff00000000000d
858 [5] 0x8000f4708 : 0xffff00000000000c
860 [6] 0x8000f4710 : 0x0000000700000004
863 [7] 0x8000f4718 : 0x0000000000000000
864 [8] 0x8000f4720 : 0x0000000400000002
865 <--- indexedProperties
866 [9] 0x8000f4728 : 0xffff000000000008
867 [10] 0x8000f4730 : 0xffff000000000009
868 [11] 0x8000f4738 : 0xffff000000000005
869 [12] 0x8000f4740 : 0xffff000000000006
870 [13] 0x8000f4748 : 0x0000000000000000
871 [14] 0x8000f4750 : 0x0000000000000000
872 [15] 0x8000f4758 : 0x0000000000000000
873 <--- unallocated capacity
874 [16] 0x8000f4760 : 0x0000000000000000
875 [17] 0x8000f4768 : 0x0000000000000000
876 [18] 0x8000f4770 : 0x0000000000000000
877 [19] 0x8000f4778 : 0x0000000000000000
879 * runtime/JSObject.h:
880 * tools/JSDollarVM.cpp:
881 (JSC::functionDumpCell):
882 (JSC::JSDollarVM::finishCreation):
883 * tools/VMInspector.cpp:
884 (JSC::VMInspector::dumpCellMemory):
885 (JSC::IndentationScope::IndentationScope):
886 (JSC::IndentationScope::~IndentationScope):
887 (JSC::VMInspector::dumpCellMemoryToStream):
888 * tools/VMInspector.h:
890 2018-07-27 Mark Lam <mark.lam@apple.com>
892 Add some crash info to Heap::checkConn() RELEASE_ASSERTs.
893 https://bugs.webkit.org/show_bug.cgi?id=188123
894 <rdar://problem/42672268>
896 Reviewed by Keith Miller.
898 1. Add VM::m_id and Heap::m_lastPhase fields. Both of these fit within existing
899 padding space in VM and Heap, and should not cost any measurable perf to
900 initialize and update.
902 2. Add some crash info to the RELEASE_ASSERTs in Heap::checkConn():
904 worldState tells us the value we failed the assertion on.
906 m_lastPhase, m_currentPhase, and m_nextPhase tells us the GC phase transition
909 VM::id(), and VM::numberOfIDs() tells us how many VMs may be in play.
911 VM::isEntered() tells us if the current VM is currently executing JS code.
913 Some of this data may be redundant, but the redundancy is intentional so that
914 we can double check what is really happening at the time of crash.
918 (JSC::Heap::checkConn):
919 (JSC::Heap::changePhase):
925 (JSC::VM::numberOfIDs):
927 (JSC::VM::isEntered const):
929 2018-07-25 Yusuke Suzuki <utatane.tea@gmail.com>
931 [JSC] Record CoW status in ArrayProfile correctly
932 https://bugs.webkit.org/show_bug.cgi?id=187949
934 Reviewed by Saam Barati.
936 In this patch, we simplify asArrayModes: just shifting the value with IndexingMode.
937 This is important since our OSR exit compiler records m_observedArrayModes by calculating
938 ArrayModes with shifting. Since ArrayModes for CoW arrays are incorrectly calculated,
939 our OSR exit compiler records incorrect results in ArrayProfile. And it leads to
940 Array::Generic DFG nodes.
942 * bytecode/ArrayProfile.h:
944 (JSC::ArrayProfile::ArrayProfile):
945 * dfg/DFGOSRExit.cpp:
946 (JSC::DFG::OSRExit::compileExit):
947 * ftl/FTLOSRExitCompiler.cpp:
948 (JSC::FTL::compileStub):
949 * runtime/IndexingType.h:
951 2018-07-26 Andy VanWagoner <andy@vanwagoner.family>
953 [INTL] Remove INTL sub-feature compile flags
954 https://bugs.webkit.org/show_bug.cgi?id=188081
956 Reviewed by Michael Catanzaro.
958 Removed ENABLE_INTL_NUMBER_FORMAT_TO_PARTS and ENABLE_INTL_PLURAL_RULES flags.
959 The runtime flags are still present, and should be relied on instead.
960 The defines for ICU features have also been updated to match HAVE() style.
962 * Configurations/FeatureDefines.xcconfig:
963 * runtime/IntlPluralRules.cpp:
964 (JSC::IntlPluralRules::resolvedOptions):
965 (JSC::IntlPluralRules::select):
966 * runtime/IntlPluralRules.h:
969 2018-07-26 Yusuke Suzuki <utatane.tea@gmail.com>
971 [JSC] Dump IndexingMode in Structure
972 https://bugs.webkit.org/show_bug.cgi?id=188085
974 Reviewed by Keith Miller.
976 Dump IndexingMode instead of IndexingType.
978 * runtime/Structure.cpp:
979 (JSC::Structure::dump const):
981 2018-07-26 Ross Kirsling <ross.kirsling@sony.com>
983 String(View) should have a splitAllowingEmptyEntries function instead of a flag parameter
984 https://bugs.webkit.org/show_bug.cgi?id=187963
986 Reviewed by Alex Christensen.
988 * inspector/InspectorBackendDispatcher.cpp:
989 (Inspector::BackendDispatcher::dispatch):
991 (ModuleName::ModuleName):
993 * runtime/IntlObject.cpp:
994 (JSC::canonicalizeLanguageTag):
995 (JSC::removeUnicodeLocaleExtension):
996 Update split/splitAllowingEmptyEntries usage.
998 2018-07-26 Commit Queue <commit-queue@webkit.org>
1000 Unreviewed, rolling out r234181 and r234189.
1001 https://bugs.webkit.org/show_bug.cgi?id=188075
1003 These are not needed right now (Requested by thorton on
1006 Reverted changesets:
1008 "Enable Web Content Filtering on watchOS"
1009 https://bugs.webkit.org/show_bug.cgi?id=187979
1010 https://trac.webkit.org/changeset/234181
1012 "HAVE(PARENTAL_CONTROLS) should be true on watchOS"
1013 https://bugs.webkit.org/show_bug.cgi?id=187985
1014 https://trac.webkit.org/changeset/234189
1016 2018-07-26 Mark Lam <mark.lam@apple.com>
1018 arrayProtoPrivateFuncConcatMemcpy() should handle copying from an Undecided type array.
1019 https://bugs.webkit.org/show_bug.cgi?id=188065
1020 <rdar://problem/42515726>
1022 Reviewed by Saam Barati.
1024 * runtime/ArrayPrototype.cpp:
1025 (JSC::clearElement):
1026 (JSC::copyElements):
1027 (JSC::arrayProtoPrivateFuncConcatMemcpy):
1029 2018-07-26 Andy VanWagoner <andy@vanwagoner.family>
1031 JSC: Intl API should ignore encoding when parsing BCP 47 language tag from ISO 15897 locale string (passed via LANG)
1032 https://bugs.webkit.org/show_bug.cgi?id=167991
1034 Reviewed by Michael Catanzaro.
1036 Improved the conversion of ICU locales to BCP47 tags, using their preferred method.
1037 Checked locale.isEmpty() before returning it from defaultLocale, so there should be
1038 no more cases where you might have an invalid locale come back from resolveLocale.
1040 * runtime/IntlObject.cpp:
1041 (JSC::convertICULocaleToBCP47LanguageTag):
1042 (JSC::defaultLocale):
1043 (JSC::lookupMatcher):
1044 * runtime/IntlObject.h:
1045 * runtime/JSGlobalObject.cpp:
1046 (JSC::JSGlobalObject::intlCollatorAvailableLocales):
1047 (JSC::JSGlobalObject::intlDateTimeFormatAvailableLocales):
1048 (JSC::JSGlobalObject::intlNumberFormatAvailableLocales):
1049 (JSC::JSGlobalObject::intlPluralRulesAvailableLocales):
1051 2018-07-26 Fujii Hironori <Hironori.Fujii@sony.com>
1053 REGRESSION(r234248) [Win] testapi.c: nonstandard extension used: non-constant aggregate initializer
1054 https://bugs.webkit.org/show_bug.cgi?id=188040
1056 Unreviewed build fix for AppleWin port.
1058 * API/tests/testapi.c: Disabled warning C4204.
1059 (testMarkingConstraintsAndHeapFinalizers): Added an explicit void* cast for weakRefs.
1061 2018-07-26 Fujii Hironori <Hironori.Fujii@sony.com>
1063 [JSC API] We should support the symbol type in our C/Obj-C API
1064 https://bugs.webkit.org/show_bug.cgi?id=175836
1066 Unreviewed build fix for Windows port.
1068 r234227 introduced a compilation error unresolved external symbol
1069 "int __cdecl testCAPIViaCpp(void)" in testapi for Windows ports.
1071 Windows ports are compiling testapi.c as C++ by using /TP switch.
1073 * API/tests/testapi.c:
1074 (main): Removed `::` prefix of ::SetErrorMode Windows API.
1075 (dllLauncherEntryPoint): Converted into C style.
1076 * shell/PlatformWin.cmake: Do not use /TP switch for testapi.c
1078 2018-07-25 Keith Miller <keith_miller@apple.com>
1080 [JSC API] We should support the symbol type in our C/Obj-C API
1081 https://bugs.webkit.org/show_bug.cgi?id=175836
1083 Reviewed by Filip Pizlo.
1085 This patch makes the following API additions:
1086 1) Test if a JSValue/JSValueRef is a symbol via any of the methods API are able to test for the types of other JSValues.
1087 2) Create a symbol on both APIs.
1088 3) Get/Set/Delete/Define property now take ids in the Obj-C API.
1089 4) Add Get/Set/Delete in the C API.
1091 We can do 3 because it is both binary and source compatable with
1092 the existing API. I added (4) because the current property access
1093 APIs only have the ability to get Strings. It was possible to
1094 merge symbols into JSStringRef but that felt confusing and exposes
1095 implementation details of our engine. The new functions match the
1096 same meaning that they have in JS, thus should be forward
1097 compatible with any future language extensions.
1099 Lastly, this patch adds the same availability preproccessing phase
1100 in WebCore to JavaScriptCore, which enables TBA features for
1101 testing on previous releases.
1104 * API/JSBasePrivate.h:
1106 * API/JSContextPrivate.h:
1107 * API/JSContextRef.h:
1108 * API/JSContextRefInternal.h:
1109 * API/JSContextRefPrivate.h:
1110 * API/JSManagedValue.h:
1111 * API/JSObjectRef.cpp:
1112 (JSObjectHasPropertyKey):
1113 (JSObjectGetPropertyKey):
1114 (JSObjectSetPropertyKey):
1115 (JSObjectDeletePropertyKey):
1116 * API/JSObjectRef.h:
1117 * API/JSRemoteInspector.h:
1118 * API/JSTypedArray.h:
1121 (+[JSValue valueWithNewSymbolFromDescription:inContext:]):
1122 (performPropertyOperation):
1123 (-[JSValue valueForProperty:valueForProperty:]):
1124 (-[JSValue setValue:forProperty:setValue:forProperty:]):
1125 (-[JSValue deleteProperty:deleteProperty:]):
1126 (-[JSValue hasProperty:hasProperty:]):
1127 (-[JSValue defineProperty:descriptor:defineProperty:descriptor:]):
1128 (-[JSValue isSymbol]):
1129 (-[JSValue objectForKeyedSubscript:]):
1130 (-[JSValue setObject:forKeyedSubscript:]):
1131 (-[JSValue valueForProperty:]): Deleted.
1132 (-[JSValue setValue:forProperty:]): Deleted.
1133 (-[JSValue deleteProperty:]): Deleted.
1134 (-[JSValue hasProperty:]): Deleted.
1135 (-[JSValue defineProperty:descriptor:]): Deleted.
1136 * API/JSValueRef.cpp:
1139 (JSValueMakeSymbol):
1141 * API/WebKitAvailability.h:
1142 * API/tests/CurrentThisInsideBlockGetterTest.mm:
1143 * API/tests/CustomGlobalObjectClassTest.c:
1144 * API/tests/DateTests.mm:
1145 * API/tests/JSExportTests.mm:
1146 * API/tests/JSNode.c:
1147 * API/tests/JSNodeList.c:
1149 * API/tests/NodeList.c:
1150 * API/tests/minidom.c:
1151 * API/tests/testapi.c:
1153 * API/tests/testapi.cpp: Added.
1154 (APIString::APIString):
1155 (APIString::~APIString):
1156 (APIString::operator JSStringRef):
1157 (APIContext::APIContext):
1158 (APIContext::~APIContext):
1159 (APIContext::operator JSGlobalContextRef):
1160 (APIVector::APIVector):
1161 (APIVector::~APIVector):
1162 (APIVector::append):
1164 (TestAPI::evaluateScript):
1165 (TestAPI::callFunction):
1166 (TestAPI::functionReturnsTrue):
1168 (TestAPI::checkJSAndAPIMatch):
1169 (TestAPI::interestingObjects):
1170 (TestAPI::interestingKeys):
1172 * API/tests/testapi.mm:
1173 (testObjectiveCAPIMain):
1174 * JavaScriptCore.xcodeproj/project.pbxproj:
1176 * postprocess-headers.sh:
1177 * shell/CMakeLists.txt:
1178 * testmem/testmem.mm:
1180 2018-07-25 Andy VanWagoner <andy@vanwagoner.family>
1182 [INTL] Call Typed Array elements toLocaleString with locale and options
1183 https://bugs.webkit.org/show_bug.cgi?id=185796
1185 Reviewed by Keith Miller.
1187 Improve ECMA 402 compliance of typed array toLocaleString, passing along
1188 the locale and options to element toLocaleString calls.
1190 * builtins/TypedArrayPrototype.js:
1193 2018-07-25 Andy VanWagoner <andy@vanwagoner.family>
1195 [INTL] Intl constructor lengths should be configurable
1196 https://bugs.webkit.org/show_bug.cgi?id=187960
1198 Reviewed by Saam Barati.
1200 Removed DontDelete from Intl constructor lengths.
1201 Fixed DateTimeFormat formatToParts length.
1203 * runtime/IntlCollatorConstructor.cpp:
1204 (JSC::IntlCollatorConstructor::finishCreation):
1205 * runtime/IntlDateTimeFormatConstructor.cpp:
1206 (JSC::IntlDateTimeFormatConstructor::finishCreation):
1207 * runtime/IntlDateTimeFormatPrototype.cpp:
1208 (JSC::IntlDateTimeFormatPrototype::finishCreation):
1209 * runtime/IntlNumberFormatConstructor.cpp:
1210 (JSC::IntlNumberFormatConstructor::finishCreation):
1211 * runtime/IntlPluralRulesConstructor.cpp:
1212 (JSC::IntlPluralRulesConstructor::finishCreation):
1214 2018-07-24 Fujii Hironori <Hironori.Fujii@sony.com>
1216 runJITThreadLimitTests is failing
1217 https://bugs.webkit.org/show_bug.cgi?id=187886
1218 <rdar://problem/42561966>
1220 Unreviewed build fix for MSVC.
1222 MSVC doen't support ternary operator without second operand.
1224 * dfg/DFGWorklist.cpp:
1225 (JSC::DFG::getNumberOfDFGCompilerThreads):
1226 (JSC::DFG::getNumberOfFTLCompilerThreads):
1228 2018-07-24 Commit Queue <commit-queue@webkit.org>
1230 Unreviewed, rolling out r234183.
1231 https://bugs.webkit.org/show_bug.cgi?id=187983
1233 cause regression in Kraken gaussian blur and desaturate
1234 (Requested by yusukesuzuki on #webkit).
1238 "[JSC] Record CoW status in ArrayProfile"
1239 https://bugs.webkit.org/show_bug.cgi?id=187949
1240 https://trac.webkit.org/changeset/234183
1242 2018-07-24 Yusuke Suzuki <utatane.tea@gmail.com>
1244 [JSC] Record CoW status in ArrayProfile
1245 https://bugs.webkit.org/show_bug.cgi?id=187949
1247 Reviewed by Saam Barati.
1249 Once CoW array is converted to non-CoW array, subsequent operations are done for this non-CoW array.
1250 Even though these operations are performed onto both CoW and non-CoW arrays in the code, array profiles
1251 in these code typically record only non-CoW arrays since array profiles hold only one StructureID recently
1252 seen. This results emitting CheckStructure for non-CoW arrays in DFG, and it soon causes OSR exits due to
1255 In this patch, we record CoW status in ArrayProfile separately to construct more appropriate DFG::ArrayMode
1256 speculation. To do so efficiently, we store union of seen IndexingMode in ArrayProfile.
1258 This patch removes one of Kraken/stanford-crypto-aes's OSR exit reason, and improves the performance by 6-7%.
1262 stanford-crypto-aes 60.893+-1.346 ^ 57.412+-1.298 ^ definitely 1.0606x faster
1263 stanford-crypto-ccm 62.124+-1.992 58.921+-1.844 might be 1.0544x faster
1265 * bytecode/ArrayProfile.cpp:
1266 (JSC::ArrayProfile::briefDescriptionWithoutUpdating):
1267 * bytecode/ArrayProfile.h:
1268 (JSC::asArrayModes):
1269 We simplify asArrayModes instead of giving up Int8ArrayMode - Float64ArrayMode contiguous sequence.
1271 (JSC::ArrayProfile::ArrayProfile):
1272 (JSC::ArrayProfile::addressOfObservedIndexingModes):
1273 (JSC::ArrayProfile::observedIndexingModes const):
1274 Currently, our macro assembler and offlineasm only support `or32` / `ori` operation onto addresses.
1275 So storing the union of seen IndexingMode in `unsigned` instead.
1277 * dfg/DFGArrayMode.cpp:
1278 (JSC::DFG::ArrayMode::fromObserved):
1279 * dfg/DFGArrayMode.h:
1280 (JSC::DFG::ArrayMode::withProfile const):
1282 (JSC::JIT::compileOpCall):
1283 * jit/JITCall32_64.cpp:
1284 (JSC::JIT::compileOpCall):
1286 (JSC::JIT::emitArrayProfilingSiteWithCell):
1287 * llint/LowLevelInterpreter.asm:
1288 * llint/LowLevelInterpreter32_64.asm:
1289 * llint/LowLevelInterpreter64.asm:
1291 2018-07-24 Tim Horton <timothy_horton@apple.com>
1293 Enable Web Content Filtering on watchOS
1294 https://bugs.webkit.org/show_bug.cgi?id=187979
1295 <rdar://problem/42559346>
1297 Reviewed by Wenson Hsieh.
1299 * Configurations/FeatureDefines.xcconfig:
1301 2018-07-24 Tadeu Zagallo <tzagallo@apple.com>
1303 Don't modify Options when setting JIT thread limits
1304 https://bugs.webkit.org/show_bug.cgi?id=187886
1306 Reviewed by Filip Pizlo.
1308 Previously, when setting the JIT thread limit prior to the worklist
1309 initialization, it'd be set via Options, which didn't work if Options
1310 hadn't been initialized yet. Change it to use a static variable in the
1313 * API/JSVirtualMachine.mm:
1314 (+[JSVirtualMachine setNumberOfDFGCompilerThreads:]):
1315 (+[JSVirtualMachine setNumberOfFTLCompilerThreads:]):
1316 * API/tests/testapi.mm:
1317 (testObjectiveCAPIMain):
1318 * dfg/DFGWorklist.cpp:
1319 (JSC::DFG::getNumberOfDFGCompilerThreads):
1320 (JSC::DFG::getNumberOfFTLCompilerThreads):
1321 (JSC::DFG::setNumberOfDFGCompilerThreads):
1322 (JSC::DFG::setNumberOfFTLCompilerThreads):
1323 (JSC::DFG::ensureGlobalDFGWorklist):
1324 (JSC::DFG::ensureGlobalFTLWorklist):
1325 * dfg/DFGWorklist.h:
1327 2018-07-24 Mark Lam <mark.lam@apple.com>
1329 Refactoring: make DFG::Plan a class.
1330 https://bugs.webkit.org/show_bug.cgi?id=187968
1332 Reviewed by Saam Barati.
1334 This patch makes all the DFG::Plan fields private, and provide accessor methods
1335 for them. This makes it easier to reason about how these fields are used and
1338 * dfg/DFGAbstractInterpreterInlines.h:
1339 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1340 * dfg/DFGByteCodeParser.cpp:
1341 (JSC::DFG::ByteCodeParser::handleCall):
1342 (JSC::DFG::ByteCodeParser::handleVarargsCall):
1343 (JSC::DFG::ByteCodeParser::handleInlining):
1344 (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
1345 (JSC::DFG::ByteCodeParser::handleDOMJITGetter):
1346 (JSC::DFG::ByteCodeParser::handleModuleNamespaceLoad):
1347 (JSC::DFG::ByteCodeParser::handleGetById):
1348 (JSC::DFG::ByteCodeParser::handlePutById):
1349 (JSC::DFG::ByteCodeParser::parseBlock):
1350 (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
1351 (JSC::DFG::ByteCodeParser::parseCodeBlock):
1352 (JSC::DFG::ByteCodeParser::parse):
1353 * dfg/DFGCFAPhase.cpp:
1354 (JSC::DFG::CFAPhase::run):
1355 (JSC::DFG::CFAPhase::injectOSR):
1356 * dfg/DFGClobberize.h:
1357 (JSC::DFG::clobberize):
1358 * dfg/DFGCommonData.cpp:
1359 (JSC::DFG::CommonData::notifyCompilingStructureTransition):
1360 * dfg/DFGCommonData.h:
1361 * dfg/DFGConstantFoldingPhase.cpp:
1362 (JSC::DFG::ConstantFoldingPhase::foldConstants):
1363 * dfg/DFGDriver.cpp:
1364 (JSC::DFG::compileImpl):
1365 * dfg/DFGFinalizer.h:
1366 * dfg/DFGFixupPhase.cpp:
1367 (JSC::DFG::FixupPhase::fixupNode):
1368 (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):
1370 (JSC::DFG::Graph::Graph):
1371 (JSC::DFG::Graph::watchCondition):
1372 (JSC::DFG::Graph::inferredTypeFor):
1373 (JSC::DFG::Graph::requiredRegisterCountForExit):
1374 (JSC::DFG::Graph::registerFrozenValues):
1375 (JSC::DFG::Graph::registerStructure):
1376 (JSC::DFG::Graph::registerAndWatchStructureTransition):
1377 (JSC::DFG::Graph::assertIsRegistered):
1379 (JSC::DFG::Graph::compilation):
1380 (JSC::DFG::Graph::identifiers):
1381 (JSC::DFG::Graph::watchpoints):
1382 * dfg/DFGJITCompiler.cpp:
1383 (JSC::DFG::JITCompiler::JITCompiler):
1384 (JSC::DFG::JITCompiler::link):
1385 (JSC::DFG::JITCompiler::compile):
1386 (JSC::DFG::JITCompiler::compileFunction):
1387 (JSC::DFG::JITCompiler::disassemble):
1388 * dfg/DFGJITCompiler.h:
1389 (JSC::DFG::JITCompiler::addWeakReference):
1390 * dfg/DFGJITFinalizer.cpp:
1391 (JSC::DFG::JITFinalizer::finalize):
1392 (JSC::DFG::JITFinalizer::finalizeFunction):
1393 (JSC::DFG::JITFinalizer::finalizeCommon):
1394 * dfg/DFGOSREntrypointCreationPhase.cpp:
1395 (JSC::DFG::OSREntrypointCreationPhase::run):
1397 (JSC::DFG::Phase::beginPhase):
1399 (JSC::DFG::runAndLog):
1401 (JSC::DFG::Plan::Plan):
1402 (JSC::DFG::Plan::computeCompileTimes const):
1403 (JSC::DFG::Plan::reportCompileTimes const):
1404 (JSC::DFG::Plan::compileInThread):
1405 (JSC::DFG::Plan::compileInThreadImpl):
1406 (JSC::DFG::Plan::isStillValid):
1407 (JSC::DFG::Plan::reallyAdd):
1408 (JSC::DFG::Plan::notifyCompiling):
1409 (JSC::DFG::Plan::notifyReady):
1410 (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
1411 (JSC::DFG::Plan::finalizeAndNotifyCallback):
1412 (JSC::DFG::Plan::key):
1413 (JSC::DFG::Plan::checkLivenessAndVisitChildren):
1414 (JSC::DFG::Plan::finalizeInGC):
1415 (JSC::DFG::Plan::isKnownToBeLiveDuringGC):
1416 (JSC::DFG::Plan::cancel):
1417 (JSC::DFG::Plan::cleanMustHandleValuesIfNecessary):
1419 (JSC::DFG::Plan::canTierUpAndOSREnter const):
1420 (JSC::DFG::Plan::vm const):
1421 (JSC::DFG::Plan::codeBlock):
1422 (JSC::DFG::Plan::mode const):
1423 (JSC::DFG::Plan::osrEntryBytecodeIndex const):
1424 (JSC::DFG::Plan::mustHandleValues const):
1425 (JSC::DFG::Plan::threadData const):
1426 (JSC::DFG::Plan::compilation const):
1427 (JSC::DFG::Plan::finalizer const):
1428 (JSC::DFG::Plan::setFinalizer):
1429 (JSC::DFG::Plan::inlineCallFrames const):
1430 (JSC::DFG::Plan::watchpoints):
1431 (JSC::DFG::Plan::identifiers):
1432 (JSC::DFG::Plan::weakReferences):
1433 (JSC::DFG::Plan::transitions):
1434 (JSC::DFG::Plan::recordedStatuses):
1435 (JSC::DFG::Plan::willTryToTierUp const):
1436 (JSC::DFG::Plan::setWillTryToTierUp):
1437 (JSC::DFG::Plan::tierUpInLoopHierarchy):
1438 (JSC::DFG::Plan::tierUpAndOSREnterBytecodes):
1439 (JSC::DFG::Plan::stage const):
1440 (JSC::DFG::Plan::callback const):
1441 (JSC::DFG::Plan::setCallback):
1442 * dfg/DFGPlanInlines.h:
1443 (JSC::DFG::Plan::iterateCodeBlocksForGC):
1444 * dfg/DFGPreciseLocalClobberize.h:
1445 (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
1446 * dfg/DFGPredictionInjectionPhase.cpp:
1447 (JSC::DFG::PredictionInjectionPhase::run):
1448 * dfg/DFGSafepoint.cpp:
1449 (JSC::DFG::Safepoint::Safepoint):
1450 (JSC::DFG::Safepoint::~Safepoint):
1451 (JSC::DFG::Safepoint::begin):
1452 * dfg/DFGSafepoint.h:
1453 * dfg/DFGSpeculativeJIT.h:
1454 (JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPointer):
1455 (JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPoisonedPointer):
1456 * dfg/DFGStackLayoutPhase.cpp:
1457 (JSC::DFG::StackLayoutPhase::run):
1458 * dfg/DFGStrengthReductionPhase.cpp:
1459 (JSC::DFG::StrengthReductionPhase::handleNode):
1460 * dfg/DFGTierUpCheckInjectionPhase.cpp:
1461 (JSC::DFG::TierUpCheckInjectionPhase::run):
1462 * dfg/DFGTypeCheckHoistingPhase.cpp:
1463 (JSC::DFG::TypeCheckHoistingPhase::disableHoistingAcrossOSREntries):
1464 * dfg/DFGWorklist.cpp:
1465 (JSC::DFG::Worklist::isActiveForVM const):
1466 (JSC::DFG::Worklist::compilationState):
1467 (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
1468 (JSC::DFG::Worklist::removeAllReadyPlansForVM):
1469 (JSC::DFG::Worklist::completeAllReadyPlansForVM):
1470 (JSC::DFG::Worklist::visitWeakReferences):
1471 (JSC::DFG::Worklist::removeDeadPlans):
1472 (JSC::DFG::Worklist::removeNonCompilingPlansForVM):
1473 * dfg/DFGWorklistInlines.h:
1474 (JSC::DFG::Worklist::iterateCodeBlocksForGC):
1475 * ftl/FTLCompile.cpp:
1476 (JSC::FTL::compile):
1479 * ftl/FTLJITFinalizer.cpp:
1480 (JSC::FTL::JITFinalizer::finalizeCommon):
1483 * ftl/FTLLowerDFGToB3.cpp:
1484 (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
1485 (JSC::FTL::DFG::LowerDFGToB3::buildExitArguments):
1486 (JSC::FTL::DFG::LowerDFGToB3::addWeakReference):
1488 (JSC::FTL::State::State):
1490 2018-07-24 Saam Barati <sbarati@apple.com>
1492 Make VM::canUseJIT an inlined function
1493 https://bugs.webkit.org/show_bug.cgi?id=187583
1495 Reviewed by Mark Lam.
1497 We know the answer to this query in initializeThreading after initializing
1498 the executable allocator. This patch makes it so that we just hold this value
1499 in a static variable and have an inlined function that just returns the value
1500 of that static variable.
1502 * runtime/InitializeThreading.cpp:
1503 (JSC::initializeThreading):
1505 (JSC::VM::computeCanUseJIT):
1506 (JSC::VM::canUseJIT): Deleted.
1508 (JSC::VM::canUseJIT):
1510 2018-07-24 Mark Lam <mark.lam@apple.com>
1512 Placate exception check verification after recent changes.
1513 https://bugs.webkit.org/show_bug.cgi?id=187961
1514 <rdar://problem/42545394>
1516 Reviewed by Saam Barati.
1518 * runtime/IntlObject.cpp:
1519 (JSC::intlNumberOption):
1521 2018-07-23 Saam Barati <sbarati@apple.com>
1523 need to didFoldClobberWorld when we constant fold GetByVal
1524 https://bugs.webkit.org/show_bug.cgi?id=187917
1525 <rdar://problem/42505095>
1527 Reviewed by Yusuke Suzuki.
1529 * dfg/DFGAbstractInterpreterInlines.h:
1530 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1532 2018-07-23 Andy VanWagoner <andy@vanwagoner.family>
1534 [INTL] Language tags are not canonicalized
1535 https://bugs.webkit.org/show_bug.cgi?id=185836
1537 Reviewed by Keith Miller.
1539 Canonicalize language tags, replacing deprecated tag parts with the
1540 preferred values. Remove broken support for algorithmic numbering systems,
1541 that can cause an error in icu, and are not supported in other engines.
1543 Generate the lookup functions from the language-subtag-registry.
1545 Also initialize the UNumberFormat in initializeNumberFormat so any
1546 failures are thrown immediately instead of failing to format later.
1549 * DerivedSources.make:
1550 * JavaScriptCore.xcodeproj/project.pbxproj:
1551 * Scripts/generateIntlCanonicalizeLanguage.py: Added.
1552 * runtime/IntlDateTimeFormat.cpp:
1553 (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
1554 * runtime/IntlNumberFormat.cpp:
1555 (JSC::IntlNumberFormat::initializeNumberFormat):
1556 (JSC::IntlNumberFormat::formatNumber):
1557 (JSC::IntlNumberFormat::formatToParts):
1558 (JSC::IntlNumberFormat::createNumberFormat): Deleted.
1559 * runtime/IntlNumberFormat.h:
1560 * runtime/IntlObject.cpp:
1561 (JSC::intlNumberOption):
1562 (JSC::intlDefaultNumberOption):
1563 (JSC::preferredLanguage):
1564 (JSC::preferredRegion):
1565 (JSC::canonicalLangTag):
1566 (JSC::canonicalizeLanguageTag):
1567 (JSC::defaultLocale):
1568 (JSC::removeUnicodeLocaleExtension):
1569 (JSC::numberingSystemsForLocale):
1570 (JSC::grandfatheredLangTag): Deleted.
1571 * runtime/IntlObject.h:
1572 * runtime/IntlPluralRules.cpp:
1573 (JSC::IntlPluralRules::initializePluralRules):
1574 * runtime/JSGlobalObject.cpp:
1575 (JSC::addMissingScriptLocales):
1576 (JSC::JSGlobalObject::intlCollatorAvailableLocales):
1577 (JSC::JSGlobalObject::intlDateTimeFormatAvailableLocales):
1578 (JSC::JSGlobalObject::intlNumberFormatAvailableLocales):
1579 (JSC::JSGlobalObject::intlPluralRulesAvailableLocales):
1580 * ucd/language-subtag-registry.txt: Added.
1582 2018-07-23 Mark Lam <mark.lam@apple.com>
1584 Add some asserts to help diagnose a crash.
1585 https://bugs.webkit.org/show_bug.cgi?id=187915
1586 <rdar://problem/42508166>
1588 Reviewed by Michael Saboff.
1590 Add some asserts to verify that an CodeBlock alternative should always have a
1591 non-null jitCode. Also change a RELEASE_ASSERT_NOT_REACHED() in
1592 CodeBlock::setOptimizationThresholdBasedOnCompilationResult() to a RELEASE_ASSERT()
1593 so that we'll retain the state of the variables that failed the assertion (again
1594 to help with diagnosis).
1596 * bytecode/CodeBlock.cpp:
1597 (JSC::CodeBlock::setAlternative):
1598 (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
1600 (JSC::DFG::Plan::Plan):
1602 2018-07-23 Filip Pizlo <fpizlo@apple.com>
1604 Unreviewed, fix no-JIT build.
1606 * bytecode/CallLinkStatus.cpp:
1607 (JSC::CallLinkStatus::computeFor):
1608 * bytecode/CodeBlock.cpp:
1609 (JSC::CodeBlock::finalizeUnconditionally):
1610 * bytecode/GetByIdStatus.cpp:
1611 (JSC::GetByIdStatus::computeFor):
1612 (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
1613 * bytecode/InByIdStatus.cpp:
1614 * bytecode/PutByIdStatus.cpp:
1615 (JSC::PutByIdStatus::computeForStubInfo):
1617 2018-07-22 Yusuke Suzuki <utatane.tea@gmail.com>
1619 [JSC] GetByIdVariant and InByIdVariant do not need slot base if they are not "hit" variants
1620 https://bugs.webkit.org/show_bug.cgi?id=187891
1622 Reviewed by Saam Barati.
1624 When merging GetByIdVariant and InByIdVariant, we accidentally make merging failed if
1625 two variants are mergeable but they have "Miss" status. We make merging failed if
1626 the merged OPCSet says hasOneSlotBaseCondition() is false. But it is only reasonable
1627 if the variant has "Hit" status. This bug is revealed when we introduce CreateThis in FTL,
1628 which patch have more chances to merge variants.
1630 This patch fixes this issue by checking `!isPropertyUnset()` / `isHit()`. PutByIdVariant
1631 is not related since it does not use this check in Transition case.
1633 * bytecode/GetByIdVariant.cpp:
1634 (JSC::GetByIdVariant::attemptToMerge):
1635 * bytecode/InByIdVariant.cpp:
1636 (JSC::InByIdVariant::attemptToMerge):
1638 2018-07-22 Yusuke Suzuki <utatane.tea@gmail.com>
1640 [DFG] Fold GetByVal if the indexed value is non configurable and non writable
1641 https://bugs.webkit.org/show_bug.cgi?id=186462
1643 Reviewed by Saam Barati.
1645 Non-special DontDelete | ReadOnly properties mean that it won't be changed. If DFG AI can retrieve this
1646 property, AI can fold it into a constant. This type of property can be seen when we use ES6 tagged templates.
1647 Tagged templates' callsite includes indexed properties whose attributes are DontDelete | ReadOnly.
1649 This patch attempts to fold such properties into constant in DFG AI. The challenge is that DFG AI runs
1650 concurrently with the mutator thread. In this patch, we insert WTF::storeStoreFence between value setting
1651 and attributes setting. The attributes must be set after the corresponding value is set. If the loaded
1652 attributes (with WTF::loadLoadFence) include DontDelete | ReadOnly, it means the given value won't be
1653 changed and we can safely use it. We arrange our existing code to use this protocol.
1655 Since GetByVal folding requires the correct Structure & Butterfly pairs, it is only enabled in x86 architecture
1656 since it is TSO. So, our WTF::storeStoreFence in SparseArrayValueMap is also emitted only in x86.
1658 This patch improves SixSpeed/template_string_tag.es6.
1662 template_string_tag.es6 237.0301+-4.8374 ^ 9.8779+-0.3628 ^ definitely 23.9960x faster
1664 * dfg/DFGAbstractInterpreterInlines.h:
1665 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1666 * runtime/JSArray.cpp:
1667 (JSC::JSArray::setLengthWithArrayStorage):
1668 * runtime/JSObject.cpp:
1669 (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
1670 (JSC::JSObject::deletePropertyByIndex):
1671 (JSC::JSObject::getOwnPropertyNames):
1672 (JSC::putIndexedDescriptor):
1673 (JSC::JSObject::defineOwnIndexedProperty):
1674 (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
1675 (JSC::JSObject::putIndexedDescriptor): Deleted.
1676 * runtime/JSObject.h:
1677 * runtime/SparseArrayValueMap.cpp:
1678 (JSC::SparseArrayValueMap::SparseArrayValueMap):
1679 (JSC::SparseArrayValueMap::add):
1680 (JSC::SparseArrayValueMap::putDirect):
1681 (JSC::SparseArrayValueMap::getConcurrently):
1682 (JSC::SparseArrayEntry::get const):
1683 (JSC::SparseArrayEntry::getConcurrently const):
1684 (JSC::SparseArrayEntry::put):
1685 (JSC::SparseArrayEntry::getNonSparseMode const):
1686 (JSC::SparseArrayValueMap::visitChildren):
1687 (JSC::SparseArrayValueMap::~SparseArrayValueMap): Deleted.
1688 * runtime/SparseArrayValueMap.h:
1689 (JSC::SparseArrayEntry::SparseArrayEntry):
1690 (JSC::SparseArrayEntry::attributes const):
1691 (JSC::SparseArrayEntry::forceSet):
1692 (JSC::SparseArrayEntry::asValue):
1694 2018-06-02 Filip Pizlo <fpizlo@apple.com>
1696 We should support CreateThis in the FTL
1697 https://bugs.webkit.org/show_bug.cgi?id=164904
1699 Reviewed by Yusuke Suzuki.
1701 This started with Saam's patch to implement CreateThis in the FTL, but turned into a type
1702 inference adventure.
1704 CreateThis in the FTL was a massive regression in raytrace because it disturbed that
1705 benchmark's extremely perverse way of winning at type inference:
1707 - The benchmark wanted polyvariant devirtualization of an object construction helper. But,
1708 the polyvariant profiler wasn't powerful enough to reliably devirtualize that code. So, the
1709 benchmark was falling back to other mechanisms...
1711 - The construction helper could not tier up into the FTL. When the DFG compiled it, it would
1712 see that the IC had 4 cases. That's too polymorphic for the DFG. So, the DFG would emit a
1713 GetById. Shortly after the DFG compile, that get_by_id would see many more cases, but now
1714 that the helper was compiled by the DFG, the baseline get_by_id would not see those cases.
1715 The DFG's GetById would "hide" those cases. The number of cases the DFG's GetById would see
1716 is larger than our polymorphic list limit (limit = 8, case count = 13, I think).
1718 Note that if the FTL compiles that construction helper, it sees the 4 cases, turns them
1719 into a MultiGetByOffset, then suffers from exits when the new cases hit, and then exits to
1720 baseline, which then sees those cases. Luckily, the FTL was not compiling the construction
1721 helper because it had a CreateThis.
1723 - Compilations that inlined the construction helper would have gotten super lucky with
1724 parse-time constant folding, so they knew what structure the input to the get_by_id would
1725 have at parse time. This is only profitable if the get_by_id parsing computed a
1726 GetByIdStatus that had a finite number of cases. Because the 13 cases were being hidden by
1727 the DFG GetById and GetByIdStatus would only look at the baseline get_by_id, which had 4
1728 cases, we would indeed get a finite number of cases. The parser would then prune those
1729 cases to just one - based on its knowledge of the structure - and that would result in that
1730 get_by_id being folded at parse time to a constant.
1732 - The subsequent op_call would inline based on parse-time knowledge of that constant.
1734 This patch comprehensively fixes these issues, as well as other issues that come up along the
1735 way. The short version is that raytrace was revealing sloppiness in our use of profiling for
1736 type inference. This patch fixes the sloppiness by vastly expanding *polyvariant* profiling,
1737 i.e. the profiling that considers call context. I was encouraged to do this by the fact that
1738 even the old version of polyvariant profiling was a speed-up on JetStream, ARES-6, and
1739 Speedometer 2 (it's easy to measure since it's a runtime flag). So, it seemed worthwhile to
1740 attack raytrace's problem as a shortcoming of polyvariant profiling.
1742 - Polyvariant profiling now consults every DFG or FTL code block that participated in any
1743 subset of the inline stack that includes the IC we're profiling. For example, if we have
1744 an inline stack like foo->bar->baz, with baz on top, then we will consult DFG or FTL
1745 compilations for foo, bar, and baz. In foo, we'll look up foo->bar->baz; in bar we'll look
1746 up bar->baz; etc. This fixes two problems encountered in raytrace. First, it ensures that
1747 a DFG GetById cannot hide anything from the profiling of that get_by_id, since the
1748 polyvariant profiling code will always consult it. Second, it enables raytrace to benefit
1749 from polyvariant profling. Previously, the polyvariant profiler would only look at the
1750 previous DFG compilation of foo and look up foo->bar->baz. But that only works if DFG-foo
1751 had inlined bar and then baz. It may not have done that, because those calls could have
1752 required polyvariant profiling that was only available in the FTL.
1754 - A particularly interesting case is when some IC in foo-baseline is also available in
1755 foo-DFG. This case is encountered by the polyvariant profiler as it walks the inline stack.
1756 In the case of gathering profiling for foo-FTL, the polyvariant profiler finds foo-DFG via
1757 the trivial case of no inline stack. This also means that if foo ever gets inlined, we will
1758 find foo-DFG or foo-FTL in the final case of polyvariant profiling. In those cases, we now
1759 merge the IC of foo-baseline and foo-DFG. This avoids lots of unnecessary recompilations,
1760 because it warns us of historical polymorphism. Historical polymorphism usually means
1761 future polymorphism. IC status code already had some merging functionality, but I needed to
1762 beef it up a lot to make this work right.
1764 - Inlining an inline cache now preserves as much information as profiling. One challenge of
1765 polyvariant profiling is that the FTL compile for bar (that includes bar->baz) could have
1766 inlined an inline cache based on polyvariant profiling. So, when the FTL compile for foo
1767 (that includes foo->bar->baz) asks bar what it knows about that IC inside bar->baz, it will
1768 say "I don't have such an IC". At this point the DFG compilation that included that IC that
1769 gave us the information that we used to inline the IC is no longer alive. To keep us from
1770 losing the information we learned about the IC, there is now a RecordedStatuses data
1771 structure that preserves the statuses we use for inlining ICs. We also filter those
1772 statuses according to things we learn from AI. This further reduces the risk of information
1773 about an IC being forgotten.
1775 - Exit profiling now considers whether or not an exit happened from inline code. This
1776 protects us in the case where the not-inlined version of an IC exited a lot because of
1777 polymorphism that doesn't exist in the inlined version. So, when using polyvariant
1778 profiling data, we consider only inlined exits.
1780 - CallLinkInfo now records when it's repatched to the virtual call thunk. Previously, this
1781 would clear the CallLinkInfo, so CallLinkStatus would fall back to the lastSeenCallee. It's
1782 surprising that we've had this bug.
1784 Altogether this patch is performance-neutral in run-jsc-benchmarks, except for speed-ups in
1785 microbenchmarks and a compile time regression. Octane/deltablue speeds up by ~5%.
1786 Octane/raytrace is regressed by a minuscule amount, which we could make up by implementing
1787 prototype access folding in the bytecode parser and constant folder. That would require some
1788 significant new logic in GetByIdStatus. That would also require a new benchmark - we want to
1789 have a test that captures raytrace's behavior in the case that the parser cannot fold the
1792 This change is a 1.2% regression on V8Spider-CompileTime. That's a smaller regression than
1793 recent compile time progressions, so I think that's an OK trade-off. Also, I would expect a
1794 compile time regression anytime we fill in FTL coverage.
1796 This is neutral on JetStream, ARES-6, and Speedometer2. JetStream agrees that deltablue
1797 speeds up and that raytrace slows down, but these changes balance out and don't affect the
1798 overall score. In ARES-6, it looks like individual tests have some significant 1-2% speed-ups
1799 or slow-downs. Air-steady is definitely ~1.5% faster. Basic-worst is probably 2% slower (p ~
1800 0.1, so it's not very certain). The JetStream, ARES-6, and Speedometer2 overall scores don't
1801 see a significant difference. In all three cases the difference is <0.5% with a high p value,
1802 with JetStream and Speedometer2 being insignificant infinitesimal speed-ups and ARES-6 being
1803 an insignificant infinitesimal slow-down.
1805 Oh, and this change means that the FTL now has 100% coverage of JavaScript. You could do an
1806 eval in a for-in loop in a for-of loop inside a with block that uses try/catch for control
1807 flow in a polymorphic constructor while having a bad time, and we'll still compile it.
1810 * JavaScriptCore.xcodeproj/project.pbxproj:
1812 * bytecode/ByValInfo.h:
1813 * bytecode/BytecodeDumper.cpp:
1814 (JSC::BytecodeDumper<Block>::printGetByIdCacheStatus):
1815 (JSC::BytecodeDumper<Block>::printPutByIdCacheStatus):
1816 (JSC::BytecodeDumper<Block>::printInByIdCacheStatus):
1817 (JSC::BytecodeDumper<Block>::dumpCallLinkStatus):
1818 (JSC::BytecodeDumper<CodeBlock>::dumpCallLinkStatus):
1819 (JSC::BytecodeDumper<Block>::printCallOp):
1820 (JSC::BytecodeDumper<Block>::dumpBytecode):
1821 (JSC::BytecodeDumper<Block>::dumpBlock):
1822 * bytecode/BytecodeDumper.h:
1823 * bytecode/CallLinkInfo.h:
1824 * bytecode/CallLinkStatus.cpp:
1825 (JSC::CallLinkStatus::computeFor):
1826 (JSC::CallLinkStatus::computeExitSiteData):
1827 (JSC::CallLinkStatus::computeFromCallLinkInfo):
1828 (JSC::CallLinkStatus::accountForExits):
1829 (JSC::CallLinkStatus::finalize):
1830 (JSC::CallLinkStatus::filter):
1831 (JSC::CallLinkStatus::computeDFGStatuses): Deleted.
1832 * bytecode/CallLinkStatus.h:
1833 (JSC::CallLinkStatus::operator bool const):
1834 (JSC::CallLinkStatus::operator! const): Deleted.
1835 * bytecode/CallVariant.cpp:
1836 (JSC::CallVariant::finalize):
1837 (JSC::CallVariant::filter):
1838 * bytecode/CallVariant.h:
1839 (JSC::CallVariant::operator bool const):
1840 (JSC::CallVariant::operator! const): Deleted.
1841 * bytecode/CodeBlock.cpp:
1842 (JSC::CodeBlock::dumpBytecode):
1843 (JSC::CodeBlock::propagateTransitions):
1844 (JSC::CodeBlock::finalizeUnconditionally):
1845 (JSC::CodeBlock::getICStatusMap):
1846 (JSC::CodeBlock::resetJITData):
1847 (JSC::CodeBlock::getStubInfoMap): Deleted.
1848 (JSC::CodeBlock::getCallLinkInfoMap): Deleted.
1849 (JSC::CodeBlock::getByValInfoMap): Deleted.
1850 * bytecode/CodeBlock.h:
1851 * bytecode/CodeOrigin.cpp:
1852 (JSC::CodeOrigin::isApproximatelyEqualTo const):
1853 (JSC::CodeOrigin::approximateHash const):
1854 * bytecode/CodeOrigin.h:
1855 (JSC::CodeOrigin::exitingInlineKind const):
1856 * bytecode/DFGExitProfile.cpp:
1857 (JSC::DFG::FrequentExitSite::dump const):
1858 (JSC::DFG::ExitProfile::add):
1859 * bytecode/DFGExitProfile.h:
1860 (JSC::DFG::FrequentExitSite::FrequentExitSite):
1861 (JSC::DFG::FrequentExitSite::operator== const):
1862 (JSC::DFG::FrequentExitSite::subsumes const):
1863 (JSC::DFG::FrequentExitSite::hash const):
1864 (JSC::DFG::FrequentExitSite::inlineKind const):
1865 (JSC::DFG::FrequentExitSite::withInlineKind const):
1866 (JSC::DFG::QueryableExitProfile::hasExitSite const):
1867 (JSC::DFG::QueryableExitProfile::hasExitSiteWithSpecificJITType const):
1868 (JSC::DFG::QueryableExitProfile::hasExitSiteWithSpecificInlineKind const):
1869 * bytecode/ExitFlag.cpp: Added.
1870 (JSC::ExitFlag::dump const):
1871 * bytecode/ExitFlag.h: Added.
1872 (JSC::ExitFlag::ExitFlag):
1873 (JSC::ExitFlag::operator| const):
1874 (JSC::ExitFlag::operator|=):
1875 (JSC::ExitFlag::operator& const):
1876 (JSC::ExitFlag::operator&=):
1877 (JSC::ExitFlag::operator bool const):
1878 (JSC::ExitFlag::isSet const):
1879 * bytecode/ExitingInlineKind.cpp: Added.
1880 (WTF::printInternal):
1881 * bytecode/ExitingInlineKind.h: Added.
1882 * bytecode/GetByIdStatus.cpp:
1883 (JSC::GetByIdStatus::computeFor):
1884 (JSC::GetByIdStatus::computeForStubInfo):
1885 (JSC::GetByIdStatus::slowVersion const):
1886 (JSC::GetByIdStatus::markIfCheap):
1887 (JSC::GetByIdStatus::finalize):
1888 (JSC::GetByIdStatus::hasExitSite): Deleted.
1889 * bytecode/GetByIdStatus.h:
1890 * bytecode/GetByIdVariant.cpp:
1891 (JSC::GetByIdVariant::markIfCheap):
1892 (JSC::GetByIdVariant::finalize):
1893 * bytecode/GetByIdVariant.h:
1894 * bytecode/ICStatusMap.cpp: Added.
1895 (JSC::ICStatusContext::get const):
1896 (JSC::ICStatusContext::isInlined const):
1897 (JSC::ICStatusContext::inlineKind const):
1898 * bytecode/ICStatusMap.h: Added.
1899 * bytecode/ICStatusUtils.cpp: Added.
1900 (JSC::hasBadCacheExitSite):
1901 * bytecode/ICStatusUtils.h:
1902 * bytecode/InstanceOfStatus.cpp:
1903 (JSC::InstanceOfStatus::computeFor):
1904 * bytecode/InstanceOfStatus.h:
1905 * bytecode/PolyProtoAccessChain.h:
1906 * bytecode/PutByIdStatus.cpp:
1907 (JSC::PutByIdStatus::hasExitSite):
1908 (JSC::PutByIdStatus::computeFor):
1909 (JSC::PutByIdStatus::slowVersion const):
1910 (JSC::PutByIdStatus::markIfCheap):
1911 (JSC::PutByIdStatus::finalize):
1912 (JSC::PutByIdStatus::filter):
1913 * bytecode/PutByIdStatus.h:
1914 * bytecode/PutByIdVariant.cpp:
1915 (JSC::PutByIdVariant::markIfCheap):
1916 (JSC::PutByIdVariant::finalize):
1917 * bytecode/PutByIdVariant.h:
1918 (JSC::PutByIdVariant::structureSet const):
1919 * bytecode/RecordedStatuses.cpp: Added.
1920 (JSC::RecordedStatuses::operator=):
1921 (JSC::RecordedStatuses::RecordedStatuses):
1922 (JSC::RecordedStatuses::addCallLinkStatus):
1923 (JSC::RecordedStatuses::addGetByIdStatus):
1924 (JSC::RecordedStatuses::addPutByIdStatus):
1925 (JSC::RecordedStatuses::markIfCheap):
1926 (JSC::RecordedStatuses::finalizeWithoutDeleting):
1927 (JSC::RecordedStatuses::finalize):
1928 (JSC::RecordedStatuses::shrinkToFit):
1929 * bytecode/RecordedStatuses.h: Added.
1930 (JSC::RecordedStatuses::RecordedStatuses):
1931 (JSC::RecordedStatuses::forEachVector):
1932 * bytecode/StructureSet.cpp:
1933 (JSC::StructureSet::markIfCheap const):
1934 (JSC::StructureSet::isStillAlive const):
1935 * bytecode/StructureSet.h:
1936 * bytecode/TerminatedCodeOrigin.h: Added.
1937 (JSC::TerminatedCodeOrigin::TerminatedCodeOrigin):
1938 (JSC::TerminatedCodeOriginHashTranslator::hash):
1939 (JSC::TerminatedCodeOriginHashTranslator::equal):
1940 * bytecode/Watchpoint.cpp:
1941 (WTF::printInternal):
1942 * bytecode/Watchpoint.h:
1943 * dfg/DFGAbstractInterpreter.h:
1944 * dfg/DFGAbstractInterpreterInlines.h:
1945 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1946 (JSC::DFG::AbstractInterpreter<AbstractStateType>::filterICStatus):
1947 * dfg/DFGByteCodeParser.cpp:
1948 (JSC::DFG::ByteCodeParser::handleCall):
1949 (JSC::DFG::ByteCodeParser::handleVarargsCall):
1950 (JSC::DFG::ByteCodeParser::handleDOMJITGetter):
1951 (JSC::DFG::ByteCodeParser::handleModuleNamespaceLoad):
1952 (JSC::DFG::ByteCodeParser::handleGetById):
1953 (JSC::DFG::ByteCodeParser::handlePutById):
1954 (JSC::DFG::ByteCodeParser::parseBlock):
1955 (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
1956 (JSC::DFG::ByteCodeParser::InlineStackEntry::~InlineStackEntry):
1957 (JSC::DFG::ByteCodeParser::parse):
1958 * dfg/DFGClobberize.h:
1959 (JSC::DFG::clobberize):
1960 * dfg/DFGClobbersExitState.cpp:
1961 (JSC::DFG::clobbersExitState):
1962 * dfg/DFGCommonData.h:
1963 * dfg/DFGConstantFoldingPhase.cpp:
1964 (JSC::DFG::ConstantFoldingPhase::foldConstants):
1965 * dfg/DFGDesiredWatchpoints.h:
1966 (JSC::DFG::SetPointerAdaptor::hasBeenInvalidated):
1967 * dfg/DFGDoesGC.cpp:
1969 * dfg/DFGFixupPhase.cpp:
1970 (JSC::DFG::FixupPhase::fixupNode):
1972 (JSC::DFG::Graph::dump):
1973 * dfg/DFGMayExit.cpp:
1975 (JSC::DFG::Node::hasCallLinkStatus):
1976 (JSC::DFG::Node::callLinkStatus):
1977 (JSC::DFG::Node::hasGetByIdStatus):
1978 (JSC::DFG::Node::getByIdStatus):
1979 (JSC::DFG::Node::hasPutByIdStatus):
1980 (JSC::DFG::Node::putByIdStatus):
1981 * dfg/DFGNodeType.h:
1982 * dfg/DFGOSRExitBase.cpp:
1983 (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):
1984 * dfg/DFGObjectAllocationSinkingPhase.cpp:
1986 (JSC::DFG::Plan::reallyAdd):
1987 (JSC::DFG::Plan::checkLivenessAndVisitChildren):
1988 (JSC::DFG::Plan::finalizeInGC):
1990 * dfg/DFGPredictionPropagationPhase.cpp:
1991 * dfg/DFGSafeToExecute.h:
1992 (JSC::DFG::safeToExecute):
1993 * dfg/DFGSpeculativeJIT32_64.cpp:
1994 (JSC::DFG::SpeculativeJIT::compile):
1995 * dfg/DFGSpeculativeJIT64.cpp:
1996 (JSC::DFG::SpeculativeJIT::compile):
1997 * dfg/DFGStrengthReductionPhase.cpp:
1998 (JSC::DFG::StrengthReductionPhase::handleNode):
1999 * dfg/DFGWorklist.cpp:
2000 (JSC::DFG::Worklist::removeDeadPlans):
2001 * ftl/FTLAbstractHeapRepository.h:
2002 * ftl/FTLCapabilities.cpp:
2003 (JSC::FTL::canCompile):
2004 * ftl/FTLLowerDFGToB3.cpp:
2005 (JSC::FTL::DFG::LowerDFGToB3::compileNode):
2006 (JSC::FTL::DFG::LowerDFGToB3::compileCreateThis):
2007 (JSC::FTL::DFG::LowerDFGToB3::compileFilterICStatus):
2008 * jit/PolymorphicCallStubRoutine.cpp:
2009 (JSC::PolymorphicCallStubRoutine::hasEdges const):
2010 (JSC::PolymorphicCallStubRoutine::edges const):
2011 * jit/PolymorphicCallStubRoutine.h:
2012 * profiler/ProfilerBytecodeSequence.cpp:
2013 (JSC::Profiler::BytecodeSequence::BytecodeSequence):
2014 * runtime/FunctionRareData.cpp:
2015 (JSC::FunctionRareData::initializeObjectAllocationProfile):
2016 * runtime/Options.h:
2018 2018-07-21 Yusuke Suzuki <utatane.tea@gmail.com>
2020 [JSC] Use Function / ScopedLambda / RecursableLambda instead of std::function
2021 https://bugs.webkit.org/show_bug.cgi?id=187472
2023 Reviewed by Mark Lam.
2025 std::function allocates memory from standard malloc instead of bmalloc. Instead of
2026 using that, we should use WTF::{Function,ScopedLambda,RecursableLambda}.
2028 This patch attempts to replace std::function with the above WTF function types.
2029 If the function's lifetime can be the same to the stack, we can use ScopedLambda, which
2030 is really efficient. Otherwise, we should use WTF::Function.
2031 For recurring use cases, we can use RecursableLambda.
2033 * assembler/MacroAssembler.cpp:
2034 (JSC::stdFunctionCallback):
2035 (JSC::MacroAssembler::probe):
2036 * assembler/MacroAssembler.h:
2037 * b3/air/AirDisassembler.cpp:
2038 (JSC::B3::Air::Disassembler::dump):
2039 * b3/air/AirDisassembler.h:
2040 * bytecompiler/BytecodeGenerator.cpp:
2041 (JSC::BytecodeGenerator::BytecodeGenerator):
2042 (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
2043 (JSC::BytecodeGenerator::emitEnumeration):
2044 * bytecompiler/BytecodeGenerator.h:
2045 * bytecompiler/NodesCodegen.cpp:
2046 (JSC::ArrayNode::emitBytecode):
2047 (JSC::ApplyFunctionCallDotNode::emitBytecode):
2048 (JSC::ForOfNode::emitBytecode):
2049 * dfg/DFGSpeculativeJIT.cpp:
2050 (JSC::DFG::SpeculativeJIT::addSlowPathGeneratorLambda):
2051 (JSC::DFG::SpeculativeJIT::compileMathIC):
2052 * dfg/DFGSpeculativeJIT.h:
2053 * dfg/DFGSpeculativeJIT64.cpp:
2054 (JSC::DFG::SpeculativeJIT::compile):
2055 * dfg/DFGValidate.cpp:
2056 * ftl/FTLCompile.cpp:
2057 (JSC::FTL::compile):
2058 * heap/HeapSnapshotBuilder.cpp:
2059 (JSC::HeapSnapshotBuilder::json):
2060 * heap/HeapSnapshotBuilder.h:
2061 * interpreter/StackVisitor.cpp:
2062 (JSC::StackVisitor::Frame::dump const):
2063 * interpreter/StackVisitor.h:
2064 * runtime/PromiseDeferredTimer.h:
2066 (JSC::VM::whenIdle):
2067 (JSC::enableProfilerWithRespectToCount):
2068 (JSC::disableProfilerWithRespectToCount):
2070 * runtime/VMEntryScope.cpp:
2071 (JSC::VMEntryScope::addDidPopListener):
2072 * runtime/VMEntryScope.h:
2073 * tools/HeapVerifier.cpp:
2074 (JSC::HeapVerifier::verifyCellList):
2075 (JSC::HeapVerifier::validateCell):
2076 (JSC::HeapVerifier::validateJSCell):
2077 * tools/HeapVerifier.h:
2079 2018-07-20 Michael Saboff <msaboff@apple.com>
2081 DFG AbstractInterpreter: CheckArray filters array modes for DirectArguments/ScopedArguments using only NonArray
2082 https://bugs.webkit.org/show_bug.cgi?id=187827
2083 rdar://problem/42146858
2085 Reviewed by Saam Barati.
2087 When filtering array modes for DirectArguments or ScopedArguments, we need to allow for the possibility
2088 that they can either be NonArray or NonArrayWithArrayStorage (aka ArrayStorageShape).
2089 We can't end up with other shapes, Int32, Double, etc because GenericArguments sets
2090 InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero which will cause us to go down a
2091 putByIndex() path that doesn't change the shape.
2093 * dfg/DFGArrayMode.h:
2094 (JSC::DFG::ArrayMode::arrayModesThatPassFiltering const):
2096 2018-07-20 Yusuke Suzuki <utatane.tea@gmail.com>
2098 [DFG] Fold GetByVal if Array is CoW
2099 https://bugs.webkit.org/show_bug.cgi?id=186459
2101 Reviewed by Saam Barati.
2103 CoW indexing type means that we now tracks the changes in CoW Array by structure. So DFG has a chance to
2104 fold GetByVal if the given array is CoW. This patch folds GetByVal onto the CoW Array. If the structure
2105 is watched and the butterfly is JSImmutableButterfly, we can load the value from this butterfly.
2107 This can be useful since these CoW arrays are used for a storage for constants. Constant-indexed access
2108 to these constant arrays can be folded into an actual constant by this patch.
2112 template_string.es6 4993.9853+-147.5308 ^ 824.1685+-44.1839 ^ definitely 6.0594x faster
2113 template_string_tag.es5 67.0822+-2.0100 ^ 9.3540+-0.5376 ^ definitely 7.1715x faster
2115 * dfg/DFGAbstractInterpreterInlines.h:
2116 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2118 2018-07-20 Yusuke Suzuki <utatane.tea@gmail.com>
2120 [JSC] Remove cellLock in JSObject::convertContiguousToArrayStorage
2121 https://bugs.webkit.org/show_bug.cgi?id=186602
2123 Reviewed by Saam Barati.
2125 JSObject::convertContiguousToArrayStorage's cellLock() is not necessary since we do not
2126 change the part of the butterfly, length etc. We prove that our procedure is safe, and
2127 drop the cellLock() here.
2129 * runtime/JSObject.cpp:
2130 (JSC::JSObject::convertContiguousToArrayStorage):
2132 2018-07-20 Saam Barati <sbarati@apple.com>
2134 CompareEq should be using KnownOtherUse instead of OtherUse
2135 https://bugs.webkit.org/show_bug.cgi?id=186814
2136 <rdar://problem/39720030>
2138 Reviewed by Filip Pizlo.
2140 CompareEq in fixup phase was doing this:
2141 insertCheck(child, OtherUse)
2142 setUseKind(child, OtherUse)
2143 And in the DFG/FTL backend, it would not emit a check for OtherUse. This could
2144 lead to edge verification crashing because a phase may optimize the check out
2145 by removing the node. However, AI may not be privy to that optimization, and
2146 AI may think the incoming value may not be Other. AI is expecting the DFG/FTL
2147 backend to actually emit a check here, but it does not.
2149 This exact pattern is why we have KnownXYZ use kinds. This patch introduces
2150 KnownOtherUse and changes the above pattern to be:
2151 insertCheck(child, OtherUse)
2152 setUseKind(child, KnownOtherUse)
2154 * dfg/DFGFixupPhase.cpp:
2155 (JSC::DFG::FixupPhase::fixupNode):
2156 * dfg/DFGSafeToExecute.h:
2157 (JSC::DFG::SafeToExecuteEdge::operator()):
2158 * dfg/DFGSpeculativeJIT.cpp:
2159 (JSC::DFG::SpeculativeJIT::speculate):
2160 * dfg/DFGUseKind.cpp:
2161 (WTF::printInternal):
2163 (JSC::DFG::typeFilterFor):
2164 (JSC::DFG::shouldNotHaveTypeCheck):
2165 (JSC::DFG::checkMayCrashIfInputIsEmpty):
2166 * dfg/DFGWatchpointCollectionPhase.cpp:
2167 (JSC::DFG::WatchpointCollectionPhase::handle):
2168 * ftl/FTLCapabilities.cpp:
2169 (JSC::FTL::canCompile):
2170 * ftl/FTLLowerDFGToB3.cpp:
2171 (JSC::FTL::DFG::LowerDFGToB3::compileCompareEq):
2172 (JSC::FTL::DFG::LowerDFGToB3::speculate):
2174 2018-07-20 Yusuke Suzuki <utatane.tea@gmail.com>
2176 [JSC] A bit performance improvement for Object.assign by cleaning up code
2177 https://bugs.webkit.org/show_bug.cgi?id=187852
2179 Reviewed by Saam Barati.
2181 We clean up Object.assign code a bit.
2183 1. Vector and MarkedArgumentBuffer are extracted out from the loop since repeatedly creating MarkedArgumentBuffer is costly.
2184 2. canDoFastPath is not necessary. Restructuring the code to clean up things.
2186 It improves the performance a bit.
2190 object-assign.es6 237.7719+-5.5175 231.2856+-4.6907 might be 1.0280x faster
2192 * runtime/ObjectConstructor.cpp:
2193 (JSC::objectConstructorAssign):
2195 2018-07-19 Carlos Garcia Campos <cgarcia@igalia.com>
2197 [GLIB] jsc_context_evaluate_in_object() should receive an instance when a JSCClass is given
2198 https://bugs.webkit.org/show_bug.cgi?id=187798
2200 Reviewed by Michael Catanzaro.
2202 Because a JSCClass is pretty much useless without an instance in this case. It should be similar to
2203 jsc_value_new_object() because indeed we are creating a new object. This makes destroy function and vtable
2204 functions to work. We can't use JSAPIWrapperObject to wrap this object, because it's a global object, so this
2205 patch adds JSAPIWrapperGlobalObject or that.
2207 * API/glib/JSAPIWrapperGlobalObject.cpp: Added.
2208 (jsAPIWrapperGlobalObjectHandleOwner):
2209 (JSAPIWrapperGlobalObjectHandleOwner::finalize):
2210 (JSC::JSCallbackObject<JSAPIWrapperGlobalObject>::createStructure):
2211 (JSC::JSCallbackObject<JSAPIWrapperGlobalObject>::create):
2212 (JSC::JSAPIWrapperGlobalObject::JSAPIWrapperGlobalObject):
2213 (JSC::JSAPIWrapperGlobalObject::finishCreation):
2214 (JSC::JSAPIWrapperGlobalObject::visitChildren):
2215 * API/glib/JSAPIWrapperGlobalObject.h: Added.
2216 (JSC::JSAPIWrapperGlobalObject::wrappedObject const):
2217 (JSC::JSAPIWrapperGlobalObject::setWrappedObject):
2218 * API/glib/JSCClass.cpp:
2219 (isWrappedObject): Helper to check if the given object is a JSAPIWrapperObject or JSAPIWrapperGlobalObject.
2220 (wrappedObjectClass): Return the class of a wrapped object.
2221 (jscContextForObject): Get the execution context of an object. If the object is a JSAPIWrapperGlobalObject, the
2222 scope extension global object is used instead.
2223 (getProperty): Use isWrappedObject, wrappedObjectClass and jscContextForObject.
2224 (setProperty): Ditto.
2225 (hasProperty): Ditto.
2226 (deleteProperty): Ditto.
2227 (getPropertyNames): Ditto.
2228 (jscClassCreateContextWithJSWrapper): Call jscContextCreateContextWithJSWrapper().
2229 * API/glib/JSCClassPrivate.h:
2230 * API/glib/JSCContext.cpp:
2231 (jscContextCreateContextWithJSWrapper): Call WrapperMap::createContextWithJSWrappper().
2232 (jsc_context_evaluate_in_object): Use jscClassCreateContextWithJSWrapper() when a JSCClass is given.
2233 * API/glib/JSCContext.h:
2234 * API/glib/JSCContextPrivate.h:
2235 * API/glib/JSCWrapperMap.cpp:
2236 (JSC::WrapperMap::createContextWithJSWrappper): Create the new context for jsc_context_evaluate_in_object() here
2237 when a JSCClass is used to create the JSAPIWrapperGlobalObject.
2238 (JSC::WrapperMap::wrappedObject const): Return the wrapped object also in case of JSAPIWrapperGlobalObject.
2239 * API/glib/JSCWrapperMap.h:
2242 2018-07-19 Saam Barati <sbarati@apple.com>
2244 Conservatively make Object.assign's fast path do a two phase protocol of loading everything then storing everything to try to prevent a crash
2245 https://bugs.webkit.org/show_bug.cgi?id=187836
2246 <rdar://problem/42409527>
2248 Reviewed by Mark Lam.
2250 We have crash reports that we're crashing on source->getDirect in Object.assign's
2251 fast path. Mark investigated this and determined we end up with a nullptr for
2252 butterfly. This is curious, because source's Structure indicated that it has
2253 out of line properties. My leading hypothesis for this at the moment is a bit
2254 handwavy, but it's essentially:
2255 - We end up firing a watchpoint when assigning to the target (this can happen
2256 if a watchpoint was set up for storing to that particular field)
2257 - When we fire that watchpoint, we end up doing some kind work on the source,
2258 perhaps causing it to flattenDictionaryStructure. Therefore, we end up
2261 I'm not super convinced this is what we're running into, but just by reading
2262 the code, I think it needs to be something similar to this. Seeing if this change
2263 fixes the crasher will give us good data to determine if something like this is
2264 happening or if the bug is something else entirely.
2266 * runtime/ObjectConstructor.cpp:
2267 (JSC::objectConstructorAssign):
2269 2018-07-19 Commit Queue <commit-queue@webkit.org>
2271 Unreviewed, rolling out r233998.
2272 https://bugs.webkit.org/show_bug.cgi?id=187815
2274 Not needed. (Requested by mlam|a on #webkit).
2278 "Temporarily mitigate a bug where a source provider is null
2279 when it shouldn't be."
2280 https://bugs.webkit.org/show_bug.cgi?id=187812
2281 https://trac.webkit.org/changeset/233998
2283 2018-07-19 Mark Lam <mark.lam@apple.com>
2285 Temporarily mitigate a bug where a source provider is null when it shouldn't be.
2286 https://bugs.webkit.org/show_bug.cgi?id=187812
2287 <rdar://problem/41192691>
2289 Reviewed by Michael Saboff.
2291 Adding a null check to temporarily mitigate https://bugs.webkit.org/show_bug.cgi?id=187811.
2293 * runtime/Error.cpp:
2294 (JSC::addErrorInfo):
2296 2018-07-19 Keith Rollin <krollin@apple.com>
2298 Adjust WEBCORE_EXPORT annotations for LTO
2299 https://bugs.webkit.org/show_bug.cgi?id=187781
2300 <rdar://problem/42351124>
2302 Reviewed by Alex Christensen.
2304 Continuation of Bug 186944. This bug addresses issues not caught
2305 during the first pass of adjustments. The initial work focussed on
2306 macOS; this one addresses issues found when building for iOS. From
2309 Adjust a number of places that result in WebKit's
2310 'check-for-weak-vtables-and-externals' script reporting weak external
2313 ERROR: WebCore has a weak external symbol in it (/Volumes/Data/dev/webkit/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore)
2314 ERROR: A weak external symbol is generated when a symbol is defined in multiple compilation units and is also marked as being exported from the library.
2315 ERROR: A common cause of weak external symbols is when an inline function is listed in the linker export file.
2318 These cases are caused by inline methods being marked with WTF_EXPORT
2319 (or related macro) or with an inline function being in a class marked
2320 as such, and when enabling LTO builds.
2322 For the most part, address these by removing the WEBCORE_EXPORT
2323 annotation from inline methods. In some cases, move the implementation
2324 out-of-line because it's the class that has the WEBCORE_EXPORT on it
2325 and removing the annotation from the class would be too disruptive.
2326 Finally, in other cases, move the implementation out-of-line because
2327 check-for-weak-vtables-and-externals still complains when keeping the
2328 implementation inline and removing the annotation; this seems to
2329 typically (but not always) happen with destructors.
2331 * inspector/remote/RemoteAutomationTarget.cpp:
2332 (Inspector::RemoteAutomationTarget::~RemoteAutomationTarget):
2333 * inspector/remote/RemoteAutomationTarget.h:
2334 * inspector/remote/RemoteInspector.cpp:
2335 (Inspector::RemoteInspector::Client::~Client):
2336 * inspector/remote/RemoteInspector.h:
2338 2018-07-19 Yusuke Suzuki <utatane.tea@gmail.com>
2340 Unreviewed, check scope after performing getPropertySlot in JSON.stringify
2341 https://bugs.webkit.org/show_bug.cgi?id=187807
2343 Properly putting EXCEPTION_ASSERT to tell our exception checker mechanism
2344 that we know that exception occurrence and handle it well.
2346 * runtime/JSONObject.cpp:
2347 (JSC::Stringifier::Holder::appendNextProperty):
2349 2018-07-18 Yusuke Suzuki <utatane.tea@gmail.com>
2351 [JSC] Reduce size of AST nodes
2352 https://bugs.webkit.org/show_bug.cgi?id=187689
2354 Reviewed by Mark Lam.
2356 We clean up AST nodes to reduce size. By doing so, we can reduce the memory consumption
2357 of ParserArena at peak state.
2359 1. Annotate `final` to AST nodes to make them solid. And it allows the compiler to
2360 devirtualize a call to the function which are implemented in a final class.
2362 2. Use default member initializers more.
2364 3. And use `nullptr` instead of `0`.
2366 4. Arrange the layout of AST nodes to reduce the size. It includes changing the order
2367 of classes in multiple inheritance. In particular, StatementNode is decreased from 48
2368 to 40. This decreases the sizes of all the derived Statement nodes.
2370 * parser/NodeConstructors.h:
2372 (JSC::StatementNode::StatementNode):
2373 (JSC::ElementNode::ElementNode):
2374 (JSC::ArrayNode::ArrayNode):
2375 (JSC::PropertyListNode::PropertyListNode):
2376 (JSC::ObjectLiteralNode::ObjectLiteralNode):
2377 (JSC::ArgumentListNode::ArgumentListNode):
2378 (JSC::ArgumentsNode::ArgumentsNode):
2379 (JSC::NewExprNode::NewExprNode):
2380 (JSC::BytecodeIntrinsicNode::BytecodeIntrinsicNode):
2381 (JSC::BinaryOpNode::BinaryOpNode):
2382 (JSC::LogicalOpNode::LogicalOpNode):
2383 (JSC::CommaNode::CommaNode):
2384 (JSC::SourceElements::SourceElements):
2385 (JSC::ClauseListNode::ClauseListNode):
2387 (JSC::FunctionMetadataNode::FunctionMetadataNode):
2388 (JSC::FunctionMetadataNode::operator== const):
2389 (JSC::FunctionMetadataNode::dump const):
2391 (JSC::BooleanNode::value): Deleted.
2392 (JSC::StringNode::value): Deleted.
2393 (JSC::TemplateExpressionListNode::value): Deleted.
2394 (JSC::TemplateExpressionListNode::next): Deleted.
2395 (JSC::TemplateStringNode::cooked): Deleted.
2396 (JSC::TemplateStringNode::raw): Deleted.
2397 (JSC::TemplateStringListNode::value): Deleted.
2398 (JSC::TemplateStringListNode::next): Deleted.
2399 (JSC::TemplateLiteralNode::templateStrings const): Deleted.
2400 (JSC::TemplateLiteralNode::templateExpressions const): Deleted.
2401 (JSC::TaggedTemplateNode::templateLiteral const): Deleted.
2402 (JSC::ResolveNode::identifier const): Deleted.
2403 (JSC::ElementNode::elision const): Deleted.
2404 (JSC::ElementNode::value): Deleted.
2405 (JSC::ElementNode::next): Deleted.
2406 (JSC::ArrayNode::elements const): Deleted.
2407 (JSC::PropertyNode::expressionName const): Deleted.
2408 (JSC::PropertyNode::name const): Deleted.
2409 (JSC::PropertyNode::type const): Deleted.
2410 (JSC::PropertyNode::needsSuperBinding const): Deleted.
2411 (JSC::PropertyNode::isClassProperty const): Deleted.
2412 (JSC::PropertyNode::isStaticClassProperty const): Deleted.
2413 (JSC::PropertyNode::isInstanceClassProperty const): Deleted.
2414 (JSC::PropertyNode::isOverriddenByDuplicate const): Deleted.
2415 (JSC::PropertyNode::setIsOverriddenByDuplicate): Deleted.
2416 (JSC::PropertyNode::putType const): Deleted.
2417 (JSC::BracketAccessorNode::base const): Deleted.
2418 (JSC::BracketAccessorNode::subscript const): Deleted.
2419 (JSC::BracketAccessorNode::subscriptHasAssignments const): Deleted.
2420 (JSC::DotAccessorNode::base const): Deleted.
2421 (JSC::DotAccessorNode::identifier const): Deleted.
2422 (JSC::SpreadExpressionNode::expression const): Deleted.
2423 (JSC::ObjectSpreadExpressionNode::expression const): Deleted.
2424 (JSC::BytecodeIntrinsicNode::type const): Deleted.
2425 (JSC::BytecodeIntrinsicNode::emitter const): Deleted.
2426 (JSC::BytecodeIntrinsicNode::identifier const): Deleted.
2427 (JSC::TypeOfResolveNode::identifier const): Deleted.
2428 (JSC::BitwiseNotNode::expr): Deleted.
2429 (JSC::BitwiseNotNode::expr const): Deleted.
2430 (JSC::AssignResolveNode::identifier const): Deleted.
2431 (JSC::ExprStatementNode::expr const): Deleted.
2432 (JSC::ForOfNode::isForAwait const): Deleted.
2433 (JSC::ReturnNode::value): Deleted.
2434 (JSC::ProgramNode::startColumn const): Deleted.
2435 (JSC::ProgramNode::endColumn const): Deleted.
2436 (JSC::EvalNode::startColumn const): Deleted.
2437 (JSC::EvalNode::endColumn const): Deleted.
2438 (JSC::ModuleProgramNode::startColumn const): Deleted.
2439 (JSC::ModuleProgramNode::endColumn const): Deleted.
2440 (JSC::ModuleProgramNode::moduleScopeData): Deleted.
2441 (JSC::ModuleNameNode::moduleName): Deleted.
2442 (JSC::ImportSpecifierNode::importedName): Deleted.
2443 (JSC::ImportSpecifierNode::localName): Deleted.
2444 (JSC::ImportSpecifierListNode::specifiers const): Deleted.
2445 (JSC::ImportSpecifierListNode::append): Deleted.
2446 (JSC::ImportDeclarationNode::specifierList const): Deleted.
2447 (JSC::ImportDeclarationNode::moduleName const): Deleted.
2448 (JSC::ExportAllDeclarationNode::moduleName const): Deleted.
2449 (JSC::ExportDefaultDeclarationNode::declaration const): Deleted.
2450 (JSC::ExportDefaultDeclarationNode::localName const): Deleted.
2451 (JSC::ExportLocalDeclarationNode::declaration const): Deleted.
2452 (JSC::ExportSpecifierNode::exportedName): Deleted.
2453 (JSC::ExportSpecifierNode::localName): Deleted.
2454 (JSC::ExportSpecifierListNode::specifiers const): Deleted.
2455 (JSC::ExportSpecifierListNode::append): Deleted.
2456 (JSC::ExportNamedDeclarationNode::specifierList const): Deleted.
2457 (JSC::ExportNamedDeclarationNode::moduleName const): Deleted.
2458 (JSC::ArrayPatternNode::appendIndex): Deleted.
2459 (JSC::ObjectPatternNode::appendEntry): Deleted.
2460 (JSC::ObjectPatternNode::setContainsRestElement): Deleted.
2461 (JSC::ObjectPatternNode::setContainsComputedProperty): Deleted.
2462 (JSC::DestructuringAssignmentNode::bindings): Deleted.
2463 (JSC::FunctionParameters::size const): Deleted.
2464 (JSC::FunctionParameters::append): Deleted.
2465 (JSC::FunctionParameters::isSimpleParameterList const): Deleted.
2466 (JSC::FuncDeclNode::metadata): Deleted.
2467 (JSC::CaseClauseNode::expr const): Deleted.
2468 (JSC::CaseClauseNode::setStartOffset): Deleted.
2469 (JSC::ClauseListNode::getClause const): Deleted.
2470 (JSC::ClauseListNode::getNext const): Deleted.
2471 * runtime/ExceptionHelpers.cpp:
2472 * runtime/JSObject.cpp:
2474 2018-07-18 Yusuke Suzuki <utatane.tea@gmail.com>
2476 JSON.stringify should emit non own properties if second array argument includes
2477 https://bugs.webkit.org/show_bug.cgi?id=187724
2479 Reviewed by Mark Lam.
2481 According to the spec[1], JSON.stringify needs to retrieve properties by using [[Get]],
2482 instead of [[GetOwnProperty]]. It means that we would look up a properties defined
2483 in [[Prototype]] or upper objects in the prototype chain. While enumeration is done
2484 by using EnumerableOwnPropertyNames typically, we can pass replacer array including
2485 property names which does not reside in the own properties. Or we can modify the
2486 own properties by deleting properties while JSON.stringify is calling a getter. So,
2487 using [[Get]] instead of [[GetOwnProperty]] is user-visible.
2489 This patch changes getOwnPropertySlot to getPropertySlot to align the behavior to the spec.
2490 The performance of Kraken/json-stringify-tinderbox is neutral.
2492 [1]: https://tc39.github.io/ecma262/#sec-serializejsonproperty
2494 * runtime/JSONObject.cpp:
2495 (JSC::Stringifier::toJSON):
2496 (JSC::Stringifier::toJSONImpl):
2497 (JSC::Stringifier::appendStringifiedValue):
2498 (JSC::Stringifier::Holder::Holder):
2499 (JSC::Stringifier::Holder::appendNextProperty):
2501 2018-07-18 Yusuke Suzuki <utatane.tea@gmail.com>
2503 [JSC] JSON.stringify's replacer should use `isArray` instead of JSArray checks
2504 https://bugs.webkit.org/show_bug.cgi?id=187755
2506 Reviewed by Mark Lam.
2508 JSON.stringify used `inherits<JSArray>(vm)` to determine whether the given replacer is an array replacer.
2509 But this is wrong. According to the spec, we should use `isArray`[1], which accepts Proxies. This difference
2510 makes one test262 test failed.
2512 This patch changes the code to using `isArray()`. And we reorder the evaluations of replacer check and ident space check
2513 to align these checks to the spec's order.
2515 [1]: https://tc39.github.io/ecma262/#sec-json.stringify
2517 * runtime/JSONObject.cpp:
2518 (JSC::Stringifier::Stringifier):
2520 2018-07-18 Yusuke Suzuki <utatane.tea@gmail.com>
2522 [JSC] Root wrapper object in JSON.stringify is not necessary if replacer is not callable
2523 https://bugs.webkit.org/show_bug.cgi?id=187752
2525 Reviewed by Mark Lam.
2527 JSON.stringify has an implicit root wrapper object since we would like to call replacer
2528 with a wrapper object and a property name. While we always create this wrapper object,
2529 it is unnecessary if the given replacer is not callable.
2531 This patch removes wrapper object creation when a replacer is not callable to avoid unnecessary
2532 allocations. This change slightly improves the performance of Kraken/json-stringify-tinderbox.
2536 json-stringify-tinderbox 39.730+-0.590 ^ 38.853+-0.266 ^ definitely 1.0226x faster
2538 * runtime/JSONObject.cpp:
2539 (JSC::Stringifier::isCallableReplacer const):
2540 (JSC::Stringifier::Stringifier):
2541 (JSC::Stringifier::stringify):
2542 (JSC::Stringifier::appendStringifiedValue):
2544 2018-07-18 Carlos Garcia Campos <cgarcia@igalia.com>
2546 [GLIB] Add jsc_context_check_syntax() to GLib API
2547 https://bugs.webkit.org/show_bug.cgi?id=187694
2549 Reviewed by Yusuke Suzuki.
2551 A new function to be able to check for syntax errors without actually evaluating the code.
2553 * API/glib/JSCContext.cpp:
2554 (jsc_context_check_syntax):
2555 * API/glib/JSCContext.h:
2556 * API/glib/docs/jsc-glib-4.0-sections.txt:
2558 2018-07-17 Keith Miller <keith_miller@apple.com>
2560 Revert r233630 since it broke internal wasm benchmarks
2561 https://bugs.webkit.org/show_bug.cgi?id=187746
2565 This patch seems to have broken internal Wasm benchmarks. This
2566 issue is likely due to an underlying bug but let's rollout while
2569 * bytecode/CodeType.h:
2570 * bytecode/UnlinkedCodeBlock.cpp:
2571 (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
2572 * bytecode/UnlinkedCodeBlock.h:
2573 (JSC::UnlinkedCodeBlock::codeType const):
2574 (JSC::UnlinkedCodeBlock::didOptimize const):
2575 (JSC::UnlinkedCodeBlock::setDidOptimize):
2576 * bytecode/VirtualRegister.h:
2577 (JSC::VirtualRegister::VirtualRegister):
2580 2018-07-17 Mark Lam <mark.lam@apple.com>
2582 CodeBlock::baselineVersion() should account for executables with purged codeBlocks.
2583 https://bugs.webkit.org/show_bug.cgi?id=187736
2584 <rdar://problem/42114371>
2586 Reviewed by Michael Saboff.
2588 CodeBlock::baselineVersion() currently checks for a null replacement but does not
2589 account for the fact that that the replacement can also be null due to the
2590 executable having being purged of its codeBlocks due to a memory event (see
2591 ExecutableBase::clearCode()). This patch adds code to account for this.
2593 * bytecode/CodeBlock.cpp:
2594 (JSC::CodeBlock::baselineVersion):
2596 2018-07-16 Yusuke Suzuki <utatane.tea@gmail.com>
2598 [JSC] UnlinkedCodeBlock::shrinkToFit miss m_constantIdentifierSets
2599 https://bugs.webkit.org/show_bug.cgi?id=187709
2601 Reviewed by Mark Lam.
2603 UnlinkedCodeBlock::shrinkToFit accidentally misses m_constantIdentifierSets shrinking.
2605 * bytecode/UnlinkedCodeBlock.cpp:
2606 (JSC::UnlinkedCodeBlock::shrinkToFit):
2608 2018-07-16 Yusuke Suzuki <utatane.tea@gmail.com>
2610 [JSC] Make SourceParseMode small
2611 https://bugs.webkit.org/show_bug.cgi?id=187705
2613 Reviewed by Mark Lam.
2615 Each SourceParseMode is distinct. So we do not need to make it a set-style (power of 2 style).
2616 Originally, this is done to make SourceParseModeSet faster because it is critical in our parser.
2617 But we can keep SourceParseModeSet fast by `1U << mode | set`. And we can make SourceParseMode
2618 within 5 bits. This reduces the size of UnlinkedCodeBlock from 288 to 280.
2620 * parser/ParserModes.h:
2621 (JSC::SourceParseModeSet::SourceParseModeSet):
2622 (JSC::SourceParseModeSet::contains):
2623 (JSC::SourceParseModeSet::mergeSourceParseModes):
2625 2018-07-12 Yusuke Suzuki <utatane.tea@gmail.com>
2627 [JSC] Generator and AsyncGeneratorMethod's prototype is incorrect
2628 https://bugs.webkit.org/show_bug.cgi?id=187585
2630 Reviewed by Darin Adler.
2632 This patch fixes Generator and AsyncGenerator's prototype issues.
2634 1. Generator's default prototype is incorrect when `generator.prototype = null` is performed.
2635 We fix this by changing JSFunction::prototypeForConstruction.
2637 2. AsyncGeneratorMethod is not handled. We change the name isAsyncGeneratorFunctionParseMode
2638 to isAsyncGeneratorWrapperParseMode since it is aligned to Generator's code. And use it well
2639 to fix `prototype` issues for AsyncGeneratorMethod.
2641 * bytecompiler/BytecodeGenerator.cpp:
2642 (JSC::BytecodeGenerator::emitPutAsyncGeneratorFields):
2643 (JSC::BytecodeGenerator::emitNewFunction):
2644 * bytecompiler/NodesCodegen.cpp:
2645 (JSC::FunctionNode::emitBytecode):
2646 * parser/ASTBuilder.h:
2647 (JSC::ASTBuilder::createFunctionMetadata):
2648 * parser/Parser.cpp:
2649 (JSC::getAsynFunctionBodyParseMode):
2650 (JSC::Parser<LexerType>::parseInner):
2651 (JSC::Parser<LexerType>::parseAsyncGeneratorFunctionSourceElements):
2652 * parser/ParserModes.h:
2653 (JSC::isAsyncGeneratorParseMode):
2654 (JSC::isAsyncGeneratorWrapperParseMode):
2655 (JSC::isAsyncGeneratorFunctionParseMode): Deleted.
2656 * runtime/FunctionExecutable.h:
2657 * runtime/JSFunction.cpp:
2658 (JSC::JSFunction::prototypeForConstruction):
2659 (JSC::JSFunction::getOwnPropertySlot):
2661 2018-07-16 Mark Lam <mark.lam@apple.com>
2663 jsc shell's noFTL utility test function should be more robust.
2664 https://bugs.webkit.org/show_bug.cgi?id=187704
2665 <rdar://problem/42231988>
2667 Reviewed by Michael Saboff and Keith Miller.
2671 - only setNeverFTLOptimize() if the function is actually a JS function.
2673 2018-07-15 Carlos Garcia Campos <cgarcia@igalia.com>
2675 [GLIB] Add API to evaluate code using a given object to store global symbols
2676 https://bugs.webkit.org/show_bug.cgi?id=187639
2678 Reviewed by Michael Catanzaro.
2680 Add jsc_context_evaluate_in_object(). It returns a new object as an out parameter. Global symbols in the
2681 evaluated script are added as properties to the new object instead of to the context global object. This is
2682 similar to JS::Evaluate in spider monkey when a scopeChain parameter is passed, but JSC doesn't support using a
2683 scope for assignments, so we have to create a new context and get its global object. This patch also updates
2684 jsc_context_evaluate_with_source_uri() to receive the starting line number for consistency with the new
2685 jsc_context_evaluate_in_object().
2687 * API/glib/JSCContext.cpp:
2688 (jsc_context_evaluate): Pass 0 as line number to jsc_context_evaluate_with_source_uri().
2689 (evaluateScriptInContext): Helper function to evaluate a script in a JSGlobalContextRef.
2690 (jsc_context_evaluate_with_source_uri): Use evaluateScriptInContext().
2691 (jsc_context_evaluate_in_object): Create a new context and set the main context global object as extension
2692 scope of it. Evaluate the script in the new context and get its global object to be returned as parameter.
2693 * API/glib/JSCContext.h:
2694 * API/glib/docs/jsc-glib-4.0-sections.txt:
2696 2018-07-13 Yusuke Suzuki <utatane.tea@gmail.com>
2698 [32bit JSC tests] stress/cow-convert-double-to-contiguous.js and stress/cow-convert-int32-to-contiguous.js are failing
2699 https://bugs.webkit.org/show_bug.cgi?id=187561
2701 Reviewed by Darin Adler.
2703 This patch fixes the issue that CoW array handling is not introduced in 32bit put_by_val code.
2704 We clean up 32bit put_by_val code.
2706 1. We remove inline out-of-bounds recording code since it is done in C operation code. This change
2707 aligns 32bit implementation to 64bit implementation.
2709 2. We add CoW array checking, which is done in 64bit implementation.
2711 * jit/JITPropertyAccess.cpp:
2712 (JSC::JIT::emit_op_put_by_val):
2713 * jit/JITPropertyAccess32_64.cpp:
2714 (JSC::JIT::emit_op_put_by_val):
2715 (JSC::JIT::emitSlow_op_put_by_val):
2717 2018-07-12 Mark Lam <mark.lam@apple.com>
2719 Need to handle CodeBlock::replacement() being null.
2720 https://bugs.webkit.org/show_bug.cgi?id=187569
2721 <rdar://problem/41468692>
2723 Reviewed by Saam Barati.
2725 CodeBlock::replacement() may return a nullptr. Some of our code already checks
2726 for this while others do not. We should add null checks in all the places that
2729 * bytecode/CodeBlock.cpp:
2730 (JSC::CodeBlock::hasOptimizedReplacement):
2731 (JSC::CodeBlock::jettison):
2732 (JSC::CodeBlock::numberOfDFGCompiles):
2733 (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
2734 * dfg/DFGOperations.cpp:
2735 * dfg/DFGToFTLDeferredCompilationCallback.cpp:
2736 (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
2737 (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
2738 * jit/JITOperations.cpp:
2740 2018-07-12 Yusuke Suzuki <utatane.tea@gmail.com>
2742 [JSC] Thread VM& to JSCell::methodTable(VM&)
2743 https://bugs.webkit.org/show_bug.cgi?id=187548
2745 Reviewed by Saam Barati.
2747 This patch threads VM& to methodTable(VM&) and remove methodTable().
2748 We add VM& parameter to estimatedSize() to thread VM& in estimatedSize implementations.
2752 * API/JSCallbackObject.h:
2753 * API/JSCallbackObjectFunctions.h:
2754 (JSC::JSCallbackObject<Parent>::className):
2755 * bytecode/CodeBlock.cpp:
2756 (JSC::CodeBlock::estimatedSize):
2757 * bytecode/CodeBlock.h:
2758 * bytecode/UnlinkedCodeBlock.cpp:
2759 (JSC::UnlinkedCodeBlock::estimatedSize):
2760 * bytecode/UnlinkedCodeBlock.h:
2761 * debugger/DebuggerScope.cpp:
2762 (JSC::DebuggerScope::className):
2763 * debugger/DebuggerScope.h:
2765 (JSC::GatherHeapSnapshotData::GatherHeapSnapshotData):
2766 (JSC::GatherHeapSnapshotData::operator() const):
2767 (JSC::Heap::gatherExtraHeapSnapshotData):
2768 * heap/HeapSnapshotBuilder.cpp:
2769 (JSC::HeapSnapshotBuilder::json):
2770 * runtime/ArrayPrototype.cpp:
2771 (JSC::arrayProtoFuncToString):
2772 * runtime/ClassInfo.h:
2773 * runtime/DirectArguments.cpp:
2774 (JSC::DirectArguments::estimatedSize):
2775 * runtime/DirectArguments.h:
2776 * runtime/HashMapImpl.cpp:
2777 (JSC::HashMapImpl<HashMapBucket>::estimatedSize):
2778 * runtime/HashMapImpl.h:
2779 * runtime/JSArrayBuffer.cpp:
2780 (JSC::JSArrayBuffer::estimatedSize):
2781 * runtime/JSArrayBuffer.h:
2782 * runtime/JSBigInt.cpp:
2783 (JSC::JSBigInt::estimatedSize):
2784 * runtime/JSBigInt.h:
2785 * runtime/JSCell.cpp:
2786 (JSC::JSCell::dump const):
2787 (JSC::JSCell::estimatedSizeInBytes const):
2788 (JSC::JSCell::estimatedSize):
2789 (JSC::JSCell::className):
2791 * runtime/JSCellInlines.h:
2792 * runtime/JSGenericTypedArrayView.h:
2793 * runtime/JSGenericTypedArrayViewInlines.h:
2794 (JSC::JSGenericTypedArrayView<Adaptor>::estimatedSize):
2795 * runtime/JSObject.cpp:
2796 (JSC::JSObject::estimatedSize):
2797 (JSC::JSObject::className):
2798 (JSC::JSObject::toStringName):
2799 (JSC::JSObject::calculatedClassName):
2800 * runtime/JSObject.h:
2801 * runtime/JSProxy.cpp:
2802 (JSC::JSProxy::className):
2803 * runtime/JSProxy.h:
2804 * runtime/JSString.cpp:
2805 (JSC::JSString::estimatedSize):
2806 * runtime/JSString.h:
2807 * runtime/RegExp.cpp:
2808 (JSC::RegExp::estimatedSize):
2810 * runtime/WeakMapImpl.cpp:
2811 (JSC::WeakMapImpl<WeakMapBucket>::estimatedSize):
2812 * runtime/WeakMapImpl.h:
2814 2018-07-11 Commit Queue <commit-queue@webkit.org>
2816 Unreviewed, rolling out r233714.
2817 https://bugs.webkit.org/show_bug.cgi?id=187579
2819 it made tests time out (Requested by pizlo on #webkit).
2823 "Change the reoptimization backoff base to 1.3 from 2"
2824 https://bugs.webkit.org/show_bug.cgi?id=187540
2825 https://trac.webkit.org/changeset/233714
2827 2018-07-11 Carlos Garcia Campos <cgarcia@igalia.com>
2829 [GLIB] Add API to allow creating variadic functions
2830 https://bugs.webkit.org/show_bug.cgi?id=187517
2832 Reviewed by Michael Catanzaro.
2834 Add a _variadic alternate method for jsc_class_add_constructor, jsc_class_add_method and
2835 jsc_value_new_function. In that case the callback always receives a GPtrArray of JSCValue.
2837 * API/glib/JSCCallbackFunction.cpp:
2838 (JSC::JSCCallbackFunction::create): Make the parameters optional.
2839 (JSC::JSCCallbackFunction::JSCCallbackFunction): Ditto.
2840 (JSC::JSCCallbackFunction::call): Handle the case of parameters being nullopt by creating a GPtrArray of
2841 JSCValue for the arguments.
2842 (JSC::JSCCallbackFunction::construct): Ditto.
2843 * API/glib/JSCCallbackFunction.h:
2844 * API/glib/JSCClass.cpp:
2845 (jscClassCreateConstructor): Make the parameters optional.
2846 (jsc_class_add_constructor_variadic): Pass nullopt as parameters to jscClassCreateConstructor.
2847 (jscClassAddMethod): Make the parameters optional.
2848 (jsc_class_add_method_variadic): Pass nullopt as parameters to jscClassAddMethod.
2849 * API/glib/JSCClass.h:
2850 * API/glib/JSCValue.cpp:
2851 (jsc_value_object_define_property_accessor): Update now that parameters are optional.
2852 (jscValueFunctionCreate): Make the parameters optional.
2853 (jsc_value_new_function_variadic): Pass nullopt as parameters to jscValueFunctionCreate.
2854 * API/glib/JSCValue.h:
2855 * API/glib/docs/jsc-glib-4.0-sections.txt:
2857 2018-07-11 Carlos Garcia Campos <cgarcia@igalia.com>
2859 [GLIB] Add jsc_context_get_global_object() to GLib API
2860 https://bugs.webkit.org/show_bug.cgi?id=187515
2862 Reviewed by Michael Catanzaro.
2864 This wasn't exposed because we have convenient methods in JSCContext to get and set properties on the global
2865 object. However, getting the global object could be useful in some cases, for example to give it a well known
2866 name like 'window' in browsers and GJS.
2868 * API/glib/JSCContext.cpp:
2869 (jsc_context_get_global_object):
2870 * API/glib/JSCContext.h:
2871 * API/glib/docs/jsc-glib-4.0-sections.txt:
2873 2018-07-11 Carlos Garcia Campos <cgarcia@igalia.com>
2875 [GLIB] Handle G_TYPE_STRV in glib API
2876 https://bugs.webkit.org/show_bug.cgi?id=187512
2878 Reviewed by Michael Catanzaro.
2880 Add jsc_value_new_array_from_strv() and handle G_TYPE_STRV types in function parameters.
2882 * API/glib/JSCContext.cpp:
2883 (jscContextGValueToJSValue):
2884 (jscContextJSValueToGValue):
2885 * API/glib/JSCValue.cpp:
2886 (jsc_value_new_array_from_strv):
2887 * API/glib/JSCValue.h:
2888 * API/glib/docs/jsc-glib-4.0-sections.txt:
2890 2018-07-11 Yusuke Suzuki <utatane.tea@gmail.com>
2892 Iterator of Array.keys() returns object in wrong order
2893 https://bugs.webkit.org/show_bug.cgi?id=185197
2895 Reviewed by Keith Miller.
2897 * builtins/ArrayIteratorPrototype.js:
2898 (globalPrivate.arrayIteratorValueNext):
2899 (globalPrivate.arrayIteratorKeyNext):
2900 (globalPrivate.arrayIteratorKeyValueNext):
2901 * builtins/AsyncFromSyncIteratorPrototype.js:
2902 * builtins/AsyncGeneratorPrototype.js:
2903 (globalPrivate.asyncGeneratorResolve):
2904 * builtins/GeneratorPrototype.js:
2905 (globalPrivate.generatorResume):
2906 * builtins/MapIteratorPrototype.js:
2907 (globalPrivate.mapIteratorNext):
2908 * builtins/SetIteratorPrototype.js:
2909 (globalPrivate.setIteratorNext):
2910 * builtins/StringIteratorPrototype.js:
2912 * runtime/IteratorOperations.cpp:
2913 (JSC::createIteratorResultObjectStructure):
2914 (JSC::createIteratorResultObject):
2916 2018-07-10 Mark Lam <mark.lam@apple.com>
2918 constructArray() should always allocate the requested length.
2919 https://bugs.webkit.org/show_bug.cgi?id=187543
2920 <rdar://problem/41947884>
2922 Reviewed by Saam Barati.
2924 Currently, it does not when we're having a bad time. We fix this by switching
2925 back to using tryCreateUninitializedRestricted() exclusively in constructArray().
2926 If we detect that a structure transition is possible before we can initialize
2927 the butterfly, we'll go ahead and eagerly initialize the rest of the butterfly.
2928 We will introduce JSArray::eagerlyInitializeButterfly() to handle this.
2930 Also enhanced the DisallowScope and ObjectInitializationScope to support this
2931 eager initialization when needed.
2933 * dfg/DFGOperations.cpp:
2934 - the client of operationNewArrayWithSizeAndHint() (in FTL generated code) expects
2935 the array allocation to always succeed. Adding this RELEASE_ASSERT here makes
2936 it clearer that we encountered an OutOfMemory condition instead of failing in FTL
2937 generated code, which will appear as a generic null pointer dereference.
2939 * runtime/ArrayPrototype.cpp:
2940 (JSC::concatAppendOne):
2941 - the code here clearly wants to check for an allocation failure. Switched to
2942 using JSArray::tryCreate() instead of JSArray::create().
2944 * runtime/DisallowScope.h:
2945 (JSC::DisallowScope::disable):
2946 * runtime/JSArray.cpp:
2947 (JSC::JSArray::tryCreateUninitializedRestricted):
2948 (JSC::JSArray::eagerlyInitializeButterfly):
2949 (JSC::constructArray):
2950 * runtime/JSArray.h:
2951 * runtime/ObjectInitializationScope.cpp:
2952 (JSC::ObjectInitializationScope::notifyInitialized):
2953 * runtime/ObjectInitializationScope.h:
2954 (JSC::ObjectInitializationScope::notifyInitialized):
2956 2018-07-05 Yusuke Suzuki <utatane.tea@gmail.com>
2958 [JSC] Remove getTypedArrayImpl
2959 https://bugs.webkit.org/show_bug.cgi?id=187338
2961 Reviewed by Mark Lam.
2963 getTypedArrayImpl is overridden only by typed arrays and DataView. Since the number of these classes
2964 are limited, we do not need to add this function to MethodTable: dispatching it in JSArrayBufferView is fine.
2965 This patch removes getTypedArrayImpl from MethodTable, and moves it to JSArrayBufferView.
2967 * runtime/ClassInfo.h:
2968 * runtime/GenericTypedArrayView.h:
2969 (JSC::GenericTypedArrayView::data const): Deleted.
2970 (JSC::GenericTypedArrayView::set): Deleted.
2971 (JSC::GenericTypedArrayView::setRange): Deleted.
2972 (JSC::GenericTypedArrayView::zeroRange): Deleted.
2973 (JSC::GenericTypedArrayView::zeroFill): Deleted.
2974 (JSC::GenericTypedArrayView::length const): Deleted.
2975 (JSC::GenericTypedArrayView::item const): Deleted.
2976 (JSC::GenericTypedArrayView::set const): Deleted.
2977 (JSC::GenericTypedArrayView::setNative const): Deleted.
2978 (JSC::GenericTypedArrayView::getRange): Deleted.
2979 (JSC::GenericTypedArrayView::checkInboundData const): Deleted.
2980 (JSC::GenericTypedArrayView::internalByteLength const): Deleted.
2981 * runtime/JSArrayBufferView.cpp:
2982 (JSC::JSArrayBufferView::possiblySharedImpl):
2983 * runtime/JSArrayBufferView.h:
2984 * runtime/JSArrayBufferViewInlines.h:
2985 (JSC::JSArrayBufferView::possiblySharedImpl): Deleted.
2986 * runtime/JSCell.cpp:
2987 (JSC::JSCell::getTypedArrayImpl): Deleted.
2989 * runtime/JSDataView.cpp:
2990 (JSC::JSDataView::getTypedArrayImpl): Deleted.
2991 * runtime/JSDataView.h:
2992 * runtime/JSGenericTypedArrayView.h:
2993 * runtime/JSGenericTypedArrayViewInlines.h:
2994 (JSC::JSGenericTypedArrayView<Adaptor>::getTypedArrayImpl): Deleted.
2996 2018-07-10 Keith Miller <keith_miller@apple.com>
2998 hasOwnProperty returns true for out of bounds property index on TypedArray
2999 https://bugs.webkit.org/show_bug.cgi?id=187520
3001 Reviewed by Saam Barati.
3003 * runtime/JSGenericTypedArrayViewInlines.h:
3004 (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
3006 2018-07-10 Michael Saboff <msaboff@apple.com>
3008 DFG JIT: compileMathIC produces incorrect machine code
3009 https://bugs.webkit.org/show_bug.cgi?id=187537
3011 Reviewed by Saam Barati.
3013 Added checks for constant multipliers in JITMulGenerator::generateInline(). If we have a constant multiplier,
3014 fall back to the fast path generator which handles such cases.
3016 * jit/JITMulGenerator.cpp:
3017 (JSC::JITMulGenerator::generateInline):
3019 2018-07-10 Filip Pizlo <fpizlo@apple.com>
3021 Change the reoptimization backoff base to 1.3 from 2
3022 https://bugs.webkit.org/show_bug.cgi?id=187540
3024 Reviewed by Saam Barati.
3026 I have data that hints at this being a speed-up on JetStream, ARES-6, and Speedometer2.
3028 I also have data that hints that a backoff base of 1 might be even better, but I think that
3029 we want to keep *some* backoff in case we find ourselves in an unmitigated recomp loop.
3031 * bytecode/CodeBlock.cpp:
3032 (JSC::CodeBlock::reoptimizationRetryCounter const):
3033 (JSC::CodeBlock::countReoptimization):
3034 (JSC::CodeBlock::adjustedCounterValue):
3035 * runtime/Options.cpp:
3036 (JSC::recomputeDependentOptions):
3037 * runtime/Options.h:
3039 2018-07-10 Mark Lam <mark.lam@apple.com>
3041 [32-bit JSC tests] ASSERTION FAILED: !butterfly->propertyStorage()[-I - 1].get() under JSC::ObjectInitializationScope::verifyPropertiesAreInitialized.
3042 https://bugs.webkit.org/show_bug.cgi?id=187362
3043 <rdar://problem/42027210>
3045 Reviewed by Saam Barati.
3047 On 32-bit targets, a 0 valued JSValue is not the empty JSValue, but it is a valid
3048 value to use for initializing unused properties. Updated an assertion to account
3051 * runtime/ObjectInitializationScope.cpp:
3052 (JSC::ObjectInitializationScope::verifyPropertiesAreInitialized):
3054 2018-07-10 Michael Saboff <msaboff@apple.com>
3056 YARR: . doesn't match non-BMP Unicode characters in some cases
3057 https://bugs.webkit.org/show_bug.cgi?id=187248
3059 Reviewed by Geoffrey Garen.
3061 The safety check in optimizeAlternative() for moving character classes that only consist of BMP
3062 characters did not take into account that the character class is inverted. In this case, we
3063 represent '.' as "not a newline" using the newline character class with an inverted check.
3064 Clearly that includes non-BMP characters.
3066 The fix is to check that the character class doesn't have non-BMP characters AND it isn't an
3067 inverted use of that character class.
3070 (JSC::Yarr::YarrGenerator::optimizeAlternative):
3072 2018-07-09 Mark Lam <mark.lam@apple.com>
3074 Add --traceLLIntExecution and --traceLLIntSlowPath options.
3075 https://bugs.webkit.org/show_bug.cgi?id=187479
3077 Reviewed by Yusuke Suzuki and Saam Barati.
3079 These options are only available if LLINT_TRACING is enabled in LLIntCommon.h.
3082 1. LLINT_TRACING consolidates and replaces LLINT_EXECUTION_TRACING and LLINT_SLOW_PATH_TRACING.
3083 2. Tracing is now guarded behind runtime options --traceLLIntExecution and --traceLLIntSlowPath.
3084 This makes it such that enabling LLINT_TRACING doesn't means that we'll
3085 continually spammed with logging until we rebuild.
3086 3. Fixed slow path LLINT tracing to work with exception check validation.
3088 * llint/LLIntCommon.h:
3089 * llint/LLIntExceptions.cpp:
3090 (JSC::LLInt::returnToThrow):
3091 (JSC::LLInt::callToThrow):
3092 * llint/LLIntOfflineAsmConfig.h:
3093 * llint/LLIntSlowPaths.cpp:
3094 (JSC::LLInt::slowPathLog):
3095 (JSC::LLInt::slowPathLn):
3096 (JSC::LLInt::slowPathLogF):
3097 (JSC::LLInt::slowPathLogLn):
3098 (JSC::LLInt::llint_trace_operand):
3099 (JSC::LLInt::llint_trace_value):
3100 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3101 (JSC::LLInt::traceFunctionPrologue):
3102 (JSC::LLInt::handleHostCall):
3103 (JSC::LLInt::setUpCall):
3104 * llint/LLIntSlowPaths.h:
3105 * llint/LowLevelInterpreter.asm:
3106 * runtime/CommonSlowPathsExceptions.cpp:
3107 (JSC::CommonSlowPaths::interpreterThrowInCaller):
3108 * runtime/Options.cpp:
3109 (JSC::Options::isAvailable):
3110 * runtime/Options.h:
3112 2018-07-09 Yusuke Suzuki <utatane.tea@gmail.com>
3114 [JSC] Embed RegExp into constant buffer in UnlinkedCodeBlock and CodeBlock
3115 https://bugs.webkit.org/show_bug.cgi?id=187477
3117 Reviewed by Mark Lam.
3119 Before this patch, RegExp* is specially held in m_regexp buffer which resides in CodeBlock's RareData.
3120 However, it is not necessary since JSCells can be reside in a constant buffer.
3121 This patch embeds RegExp* to a constant buffer in UnlinkedCodeBlock and CodeBlock. And remove RegExp
3122 vector from RareData.
3124 We also move the code of dumping RegExp from BytecodeDumper to RegExp::dumpToStream.
3126 * bytecode/BytecodeDumper.cpp:
3127 (JSC::BytecodeDumper<Block>::dumpBytecode):
3128 (JSC::BytecodeDumper<Block>::dumpBlock):
3129 (JSC::regexpToSourceString): Deleted.
3130 (JSC::regexpName): Deleted.
3131 (JSC::BytecodeDumper<Block>::dumpRegExps): Deleted.
3132 * bytecode/BytecodeDumper.h:
3133 * bytecode/CodeBlock.h:
3134 (JSC::CodeBlock::regexp const): Deleted.
3135 (JSC::CodeBlock::numberOfRegExps const): Deleted.
3136 * bytecode/UnlinkedCodeBlock.cpp:
3137 (JSC::UnlinkedCodeBlock::visitChildren):
3138 (JSC::UnlinkedCodeBlock::shrinkToFit):
3139 * bytecode/UnlinkedCodeBlock.h:
3140 (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
3141 (JSC::UnlinkedCodeBlock::numberOfRegExps const): Deleted.
3142 (JSC::UnlinkedCodeBlock::regexp const): Deleted.
3143 * bytecompiler/BytecodeGenerator.cpp:
3144 (JSC::BytecodeGenerator::emitNewRegExp):
3145 (JSC::BytecodeGenerator::addRegExp): Deleted.
3146 * bytecompiler/BytecodeGenerator.h:
3147 * dfg/DFGByteCodeParser.cpp:
3148 (JSC::DFG::ByteCodeParser::parseBlock):
3149 * jit/JITOpcodes.cpp:
3150 (JSC::JIT::emit_op_new_regexp):
3151 * llint/LLIntSlowPaths.cpp:
3152 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3153 * runtime/JSCJSValue.cpp:
3154 (JSC::JSValue::dumpInContextAssumingStructure const):
3155 * runtime/RegExp.cpp:
3156 (JSC::regexpToSourceString):
3157 (JSC::RegExp::dumpToStream):
3160 2018-07-09 Brian Burg <bburg@apple.com>
3162 REGRESSION: Web Inspector no longer pauses in internal injected scripts like WDFindNodes.js
3163 https://bugs.webkit.org/show_bug.cgi?id=187350
3164 <rdar://problem/41728249>
3166 Reviewed by Matt Baker.
3168 Add a new command that toggles whether or not to blackbox internal scripts.
3169 If blackboxed, the scripts will not be shown to the frontend and the debugger will
3170 not pause in source frames from blackboxed scripts. Sometimes we want to break into
3171 those scripts when debugging Web Inspector, WebDriver, or other WebKit-internal code
3172 that injects scripts.
3174 * inspector/agents/InspectorDebuggerAgent.cpp:
3175 (Inspector::InspectorDebuggerAgent::setPauseForInternalScripts):
3176 (Inspector::InspectorDebuggerAgent::didParseSource):
3177 * inspector/agents/InspectorDebuggerAgent.h:
3178 * inspector/protocol/Debugger.json:
3180 2018-07-09 Yusuke Suzuki <utatane.tea@gmail.com>
3182 [JSC] Make some data members of UnlinkedCodeBlock private
3183 https://bugs.webkit.org/show_bug.cgi?id=187467
3185 Reviewed by Mark Lam.
3187 This patch makes m_numVars, m_numCalleeLocals, and m_numParameters of UnlinkedCodeBlock private.
3188 We also remove m_numCapturedVars since it is no longer used.
3190 * bytecode/CodeBlock.cpp:
3191 (JSC::CodeBlock::CodeBlock):
3192 * bytecode/CodeBlock.h:
3193 * bytecode/UnlinkedCodeBlock.cpp:
3194 (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
3195 * bytecode/UnlinkedCodeBlock.h:
3197 2018-07-09 Yusuke Suzuki <utatane.tea@gmail.com>
3199 [JSC] Optimize layout of AccessCase / ProxyableAccessCase to reduce size of ProxyableAccessCase
3200 https://bugs.webkit.org/show_bug.cgi?id=187465
3202 Reviewed by Keith Miller.
3204 ProxyableAccessCase is allocated so frequently and it is persisted so long. Reducing the size
3205 of ProxyableAccessCase can reduce the footprint of many web sites including nytimes.com.
3207 This patch uses a bit complicated layout to reduce ProxyableAccessCase. We add unused bool member
3208 in AccessCase's padding, and use it in ProxyableAccessCase. By doing so, we can reduce the size
3209 of ProxyableAccessCase from 56 to 48. And it also reduces the size of GetterSetterAccessCase
3210 from 104 to 96 since it inherits ProxyableAccessCase.
3212 * bytecode/AccessCase.h:
3213 (JSC::AccessCase::viaProxy const):
3214 (JSC::AccessCase::AccessCase):
3215 * bytecode/ProxyableAccessCase.cpp:
3216 (JSC::ProxyableAccessCase::ProxyableAccessCase):
3217 * bytecode/ProxyableAccessCase.h:
3219 2018-07-08 Yusuke Suzuki <utatane.tea@gmail.com>
3221 Unreviewed, build fix for debug builds after r233630
3222 https://bugs.webkit.org/show_bug.cgi?id=187441
3225 (JSC::JIT::frameRegisterCountFor):
3226 * llint/LLIntEntrypoint.cpp:
3227 (JSC::LLInt::frameRegisterCountFor):
3229 2018-07-08 Yusuke Suzuki <utatane.tea@gmail.com>
3231 [JSC] Optimize layout of CodeBlock to reduce padding
3232 https://bugs.webkit.org/show_bug.cgi?id=187441
3234 Reviewed by Mark Lam.
3236 Arrange the order of members to reduce the size of CodeBlock from 552 to 544.
3237 We also make SourceCodeRepresentation 1 byte since CodeBlock has a vector of this,
3238 Vector<SourceCodeRepresentation> m_constantsSourceCodeRepresentation.
3240 We also move m_numCalleeLocals and m_numVars from `public` to `private` in CodeBlock.
3242 * bytecode/BytecodeDumper.cpp:
3243 (JSC::BytecodeDumper<Block>::dumpBlock):
3244 * bytecode/BytecodeUseDef.h:
3245 (JSC::computeDefsForBytecodeOffset):
3246 * bytecode/CodeBlock.cpp:
3247 (JSC::CodeBlock::CodeBlock):
3248 * bytecode/CodeBlock.h:
3249 (JSC::CodeBlock::numVars const):
3250 * bytecode/UnlinkedCodeBlock.h:
3251 (JSC::UnlinkedCodeBlock::numVars const):
3252 * dfg/DFGByteCodeParser.cpp:
3253 (JSC::DFG::ByteCodeParser::ByteCodeParser):
3254 (JSC::DFG::ByteCodeParser::flushForTerminalImpl):
3255 (JSC::DFG::ByteCodeParser::handleRecursiveTailCall):
3256 (JSC::DFG::ByteCodeParser::inlineCall):
3257 (JSC::DFG::ByteCodeParser::handleGetById):
3258 (JSC::DFG::ByteCodeParser::handlePutById):
3259 (JSC::DFG::ByteCodeParser::parseBlock):
3261 (JSC::DFG::Graph::forAllLocalsLiveInBytecode):
3262 * dfg/DFGOSREntrypointCreationPhase.cpp:
3263 (JSC::DFG::OSREntrypointCreationPhase::run):
3264 * dfg/DFGVariableEventStream.cpp:
3265 (JSC::DFG::VariableEventStream::reconstruct const):
3266 * ftl/FTLOSREntry.cpp:
3267 (JSC::FTL::prepareOSREntry):
3269 (JSC::FTL::State::State):
3270 * interpreter/Interpreter.cpp:
3271 (JSC::Interpreter::dumpRegisters):
3273 (JSC::JIT::frameRegisterCountFor):
3274 * jit/JITOpcodes.cpp:
3275 (JSC::JIT::emit_op_enter):
3276 * jit/JITOpcodes32_64.cpp:
3277 (JSC::JIT::emit_op_enter):
3278 * jit/JITOperations.cpp:
3279 * llint/LLIntEntrypoint.cpp:
3280 (JSC::LLInt::frameRegisterCountFor):
3281 * llint/LLIntSlowPaths.cpp:
3282 (JSC::LLInt::traceFunctionPrologue):
3283 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3284 * runtime/JSCJSValue.h:
3286 2018-07-08 Yusuke Suzuki <utatane.tea@gmail.com>
3288 [JSC] Optimize padding of UnlinkedCodeBlock to shrink
3289 https://bugs.webkit.org/show_bug.cgi?id=187448
3291 Reviewed by Saam Barati.
3293 We optimize the size of CodeType and TriState. And we arrange the layout of UnlinkedCodeBlock.
3294 These optimizations reduce the size of UnlinkedCodeBlock from 304 to 288.
3296 * bytecode/CodeType.h:
3297 * bytecode/UnlinkedCodeBlock.cpp:
3298 (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
3299 * bytecode/UnlinkedCodeBlock.h:
3300 (JSC::UnlinkedCodeBlock::codeType const):
3301 (JSC::UnlinkedCodeBlock::didOptimize const):
3302 (JSC::UnlinkedCodeBlock::setDidOptimize):
3303 * bytecode/VirtualRegister.h:
3305 2018-07-08 Yusuke Suzuki <utatane.tea@gmail.com>
3307 [JSC] Optimize padding of InferredTypeTable by using cellLock
3308 https://bugs.webkit.org/show_bug.cgi?id=187447
3310 Reviewed by Mark Lam.
3312 Use cellLock() in InferredTypeTable to guard changes of internal structures.
3313 This is the same usage to SparseArrayValueMap. By using cellLock(), we can
3314 reduce the size of InferredTypeTable from 40 to 32.
3316 * runtime/InferredTypeTable.cpp:
3317 (JSC::InferredTypeTable::visitChildren):
3318 (JSC::InferredTypeTable::get):
3319 (JSC::InferredTypeTable::willStoreValue):
3320 (JSC::InferredTypeTable::makeTop):
3321 * runtime/InferredTypeTable.h:
3322 Using enum class and using. And remove `isEmpty()` since it is not used.
3324 * runtime/Structure.h:
3326 2018-07-07 Yusuke Suzuki <utatane.tea@gmail.com>
3328 [JSC] Optimize layout of SourceProvider to reduce padding
3329 https://bugs.webkit.org/show_bug.cgi?id=187440
3331 Reviewed by Mark Lam.
3333 Arrange members of SourceProvider to reduce the size from 80 to 72.
3335 * parser/SourceProvider.cpp:
3336 (JSC::SourceProvider::SourceProvider):
3337 * parser/SourceProvider.h:
3339 2018-07-08 Mark Lam <mark.lam@apple.com>
3341 PropertyTable::skipDeletedEntries() should guard against iterating past the table end.
3342 https://bugs.webkit.org/show_bug.cgi?id=187444
3343 <rdar://problem/41282849>
3345 Reviewed by Saam Barati.
3347 PropertyTable supports C++ iteration by offering begin() and end() methods, and
3348 an iterator class. The begin() methods and the iterator operator++() method uses
3349 PropertyTable::skipDeletedEntries() to skip over deleted entries in the table.
3350 However, PropertyTable::skipDeletedEntries() does not prevent the iteration
3351 pointer from being incremented past the end of the table. As a result, we can
3352 iterate past the end of the table. Note that the C++ iteration protocol tests
3353 for the iterator not being equal to the end() value. It does not do a <= test.
3354 If the iterator ever shoots past end, the loop will effectively not terminate.
3356 This issue can manifest if and only if the last entry in the table is a deleted
3357 one, and the key field of the PropertyMapEntry shaped space at the end of the
3358 table (the one beyond the last) contains a 1 (i.e. PROPERTY_MAP_DELETED_ENTRY_KEY)
3361 No test because manifesting this issue requires uncontrollable happenstance where
3362 memory just beyond the end of the table looks like a deleted entry.
3364 * runtime/PropertyMapHashTable.h:
3365 (JSC::PropertyTable::begin):
3366 (JSC::PropertyTable::end):
3367 (JSC::PropertyTable::begin const):
3368 (JSC::PropertyTable::end const):
3369 (JSC::PropertyTable::skipDeletedEntries):
3371 2018-07-07 Yusuke Suzuki <utatane.tea@gmail.com>
3373 [JSC] Optimize layout of SymbolTable to reduce padding
3374 https://bugs.webkit.org/show_bug.cgi?id=187437
3376 Reviewed by Mark Lam.
3378 Arrange the layout of SymbolTable to reduce the size from 88 to 72.
3380 * runtime/SymbolTable.h:
3382 2018-07-07 Yusuke Suzuki <utatane.tea@gmail.com>
3384 [JSC] Optimize layout of RegExp to reduce padding
3385 https://bugs.webkit.org/show_bug.cgi?id=187438
3387 Reviewed by Mark Lam.
3389 Reduce the size of RegExp from 168 to 144.
3391 * runtime/RegExp.cpp:
3392 (JSC::RegExp::RegExp):
3394 * runtime/RegExpKey.h:
3395 * yarr/YarrErrorCode.h:
3397 2018-07-07 Yusuke Suzuki <utatane.tea@gmail.com>
3399 [JSC] Optimize layout of ValueProfile to reduce padding
3400 https://bugs.webkit.org/show_bug.cgi?id=187439
3402 Reviewed by Mark Lam.
3404 Reduce the size of ValueProfile from 40 to 32 by reordering members.
3406 * bytecode/ValueProfile.h:
3407 (JSC::ValueProfileBase::ValueProfileBase):
3409 2018-07-05 Saam Barati <sbarati@apple.com>
3411 ProgramExecutable may be collected as we checkSyntax on it
3412 https://bugs.webkit.org/show_bug.cgi?id=187359
3413 <rdar://problem/41832135>
3415 Reviewed by Mark Lam.
3417 The bug was we were passing in a reference to the SourceCode field on ProgramExecutable as
3418 the ProgramExecutable itself may be collected. The fix here is to make a copy
3419 of the field instead of passing in a reference inside of ParserError::toErrorObject.
3421 No new tests here as this was already caught by our iOS JSC testers.
3423 * parser/ParserError.h:
3424 (JSC::ParserError::toErrorObject):
3426 2018-07-04 Tim Horton <timothy_horton@apple.com>
3428 Introduce PLATFORM(IOSMAC)
3429 https://bugs.webkit.org/show_bug.cgi?id=187315
3431 Reviewed by Dan Bernstein.
3433 * Configurations/Base.xcconfig:
3434 * Configurations/FeatureDefines.xcconfig:
3436 2018-07-03 Mark Lam <mark.lam@apple.com>
3438 [32-bit JSC tests] ASSERTION FAILED: !getDirect(offset) || !JSValue::encode(getDirect(offset)).
3439 https://bugs.webkit.org/show_bug.cgi?id=187255
3440 <rdar://problem/41785257>
3442 Reviewed by Saam Barati.
3444 The 32-bit JIT::emit_op_create_this() needs to initialize uninitialized properties
3445 too: basically, do what the 64-bit code is doing. At present, this change only
3446 serves to pacify an assertion. It is not needed for correctness because the
3447 concurrent GC is not used on 32-bit builds.
3449 This issue is already covered by the slowMicrobenchmarks/rest-parameter-allocation-elimination.js
3452 * jit/JITOpcodes32_64.cpp:
3453 (JSC::JIT::emit_op_create_this):
3455 2018-07-03 Yusuke Suzuki <utatane.tea@gmail.com>
3457 [JSC] Move slowDownAndWasteMemory function to JSArrayBufferView
3458 https://bugs.webkit.org/show_bug.cgi?id=187290
3460 Reviewed by Saam Barati.
3462 slowDownAndWasteMemory is just overridden by typed arrays. Since they are limited,
3463 we do not need to add this function to MethodTable: just dispatching it in JSArrayBufferView
3464 is fine. And slowDownAndWasteMemory only requires the sizeof(element), which can be
3465 easily calculated from JSType.
3466 This patch removes slowDownAndWasteMemory from MethodTable, and moves it to JSArrayBufferView.
3468 * runtime/ClassInfo.h:
3469 * runtime/JSArrayBufferView.cpp:
3471 (JSC::JSArrayBufferView::slowDownAndWasteMemory):
3472 * runtime/JSArrayBufferView.h:
3473 * runtime/JSArrayBufferViewInlines.h:
3474 (JSC::JSArrayBufferView::possiblySharedBuffer):
3475 * runtime/JSCell.cpp:
3476 (JSC::JSCell::slowDownAndWasteMemory): Deleted.
3478 * runtime/JSDataView.cpp:
3479 (JSC::JSDataView::slowDownAndWasteMemory): Deleted.
3480 * runtime/JSDataView.h:
3481 * runtime/JSGenericTypedArrayView.h:
3482 * runtime/JSGenericTypedArrayViewInlines.h:
3483 (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory): Deleted.
3485 2018-07-02 Sukolsak Sakshuwong <sukolsak@gmail.com>
3487 Regular expressions with ".?" expressions at the start and the end match the entire string
3488 https://bugs.webkit.org/show_bug.cgi?id=119191
3490 Reviewed by Michael Saboff.
3492 r90962 optimized regular expressions in the form of /.*abc.*/ by looking
3493 for "abc" first and then processing the leading and trailing dot stars
3494 to find the beginning and the end of the match. However, it erroneously
3495 enabled this optimization for regular expressions whose leading or
3496 trailing dots had quantifiers that were not of arbitrary length, e.g.,
3497 /.?abc.*/, /.*abc.?/, /.{0,4}abc.*/, etc. This caused the expression to
3498 match the entire string when it shouldn't. This patch disables the
3499 optimization for those cases.
3501 * yarr/YarrPattern.cpp:
3502 (JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):
3504 2018-07-02 Sukolsak Sakshuwong <sukolsak@gmail.com>
3506 RegExp.exec returns wrong value with a long integer quantifier
3507 https://bugs.webkit.org/show_bug.cgi?id=187042
3509 Reviewed by Saam Barati.
3511 Prior to this patch, the Yarr parser checked for integer overflow when
3512 parsing quantifiers in regular expressions by adding one digit at a time
3513 to a number and checking if the result got larger. This is wrong;
3514 The parser would fail to detect overflow when parsing, for example,
3515 10,000,000,003 because (1000000000*10 + 3) % (2^32) = 1410065411 > 1000000000.
3517 Another issue was that once it detected overflow, it stopped consuming
3518 the remaining digits. Since it didn't find the closing bracket, it
3519 parsed the quantifier as a normal string instead.
3521 This patch fixes these issues by reading all the digits and checking for
3522 overflow with Checked<unsigned, RecordOverflow>. If it overflows, it
3523 returns the largest possible value (quantifyInfinite in this case). This
3524 matches Chrome [1], Firefox [2], and Edge [3].
3526 [1] https://chromium.googlesource.com/v8/v8.git/+/23222f0a88599dcf302ccf395883944620b70fd5/src/regexp/regexp-parser.cc#1042
3527 [2] https://dxr.mozilla.org/mozilla-central/rev/aea3f3457f1531706923b8d4c595a1f271de83da/js/src/irregexp/RegExpParser.cpp#1310
3528 [3] https://github.com/Microsoft/ChakraCore/blob/fc08987381da141bb686b5d0c71d75da96f9eb8a/lib/Parser/RegexParser.cpp#L1149
3530 * yarr/YarrParser.h:
3531 (JSC::Yarr::Parser::consumeNumber):
3533 2018-07-02 Keith Miller <keith_miller@apple.com>
3535 InstanceOf IC should do generic if the prototype is not an object.
3536 https://bugs.webkit.org/show_bug.cgi?id=187250
3538 Reviewed by Mark Lam.
3540 The old code was wrong for two reasons. First, the AccessCase expected that
3541 the prototype value would be non-null. Second, we would end up returning
3542 false instead of throwing an exception.
3545 (JSC::tryCacheInstanceOf):
3547 2018-07-01 Mark Lam <mark.lam@apple.com>
3549 Builtins and host functions should get their own structures.
3550 https://bugs.webkit.org/show_bug.cgi?id=187211
3551 <rdar://problem/41646336>
3553 Reviewed by Saam Barati.
3555 JSFunctions do lazy reification of properties, but ordinary functions applies
3556 different rules of property reification than builtin and host functions. Hence,
3557 we should give builtins and host functions their own structures.
3559 * runtime/JSFunction.cpp:
3560 (JSC::JSFunction::selectStructureForNewFuncExp):
3561 (JSC::JSFunction::create):
3562 (JSC::JSFunction::getOwnPropertySlot):
3563 * runtime/JSGlobalObject.cpp:
3564 (JSC::JSGlobalObject::init):
3565 (JSC::JSGlobalObject::visitChildren):
3566 * runtime/JSGlobalObject.h:
3567 (JSC::JSGlobalObject::hostFunctionStructure const):
3568 (JSC::JSGlobalObject::arrowFunctionStructure const):
3569 (JSC::JSGlobalObject::sloppyFunctionStructure const):
3570 (JSC::JSGlobalObject::strictFunctionStructure const):
3572 2018-07-01 David Kilzer <ddkilzer@apple.com>
3574 JavaScriptCore: Fix clang static analyzer warnings: Assigned value is garbage or undefined
3575 <https://webkit.org/b/187233>
3577 Reviewed by Mark Lam.
3579 * b3/air/AirEliminateDeadCode.cpp:
3580 (JSC::B3::Air::eliminateDeadCode): Initialize `changed`.
3581 * parser/ParserTokens.h:
3582 (JSC::JSTextPosition::JSTextPosition): Add struct member
3583 initialization. Simplify default constructor.
3584 (JSC::JSTokenLocation::JSTokenData): Move largest struct in the
3585 union to the beginning to make it easy to zero out all fields.
3586 (JSC::JSTokenLocation::JSTokenLocation): Add struct member
3587 initialization. Simplify default constructor. Note that
3588 `endOffset` was not being initialized previously.
3589 (JSC::JSTextPosition::JSToken): Add struct member initialization
3591 * runtime/IntlObject.cpp:
3592 (JSC::MatcherResult): Add struct member initialization.
3594 2018-06-23 Darin Adler <darin@apple.com>
3596 [Cocoa] Improve ARC compatibility of more code in JavaScriptCore
3597 https://bugs.webkit.org/show_bug.cgi?id=186973
3599 Reviewed by Dan Bernstein.
3602 (WeakContextRef::WeakContextRef): Deleted.
3603 (WeakContextRef::~WeakContextRef): Deleted.
3604 (WeakContextRef::get): Deleted.
3605 (WeakContextRef::set): Deleted.
3607 * API/JSContextInternal.h: Removed unneeded header guards since this is
3608 an Objective-C++ header. Removed unused WeakContextRef class. Removed declaration
3609 of method -[JSContext initWithGlobalContextRef:] and JSContext property wrapperMap
3610 since neither is used outside the class implementation.
3612 * API/JSManagedValue.mm:
3613 (-[JSManagedValue initWithValue:]): Use a bridging cast.
3614 (-[JSManagedValue dealloc]): Ditto.
3615 (-[JSManagedValue didAddOwner:]): Ditto.
3616 (-[JSManagedValue didRemoveOwner:]): Ditto.
3617 (JSManagedValueHandleOwner::isReachableFromOpaqueRoots): Ditto.
3618 (JSManagedValueHandleOwner::finalize): Ditto.
3620 (+[JSValue valueWithNewRegularExpressionFromPattern:flags:inContext:]): Ditto.
3621 (+[JSValue valueWithNewErrorFromMessage:inContext:]): Ditto.
3622 (-[JSValue valueForProperty:]): Ditto.
3623 (-[JSValue setValue:forProperty:]): Ditto.
3624 (-[JSValue deleteProperty:]): Ditto.
3625 (-[JSValue hasProperty:]): Ditto.
3626 (-[JSValue invokeMethod:withArguments:]): Ditto.
3627 (valueToObjectWithoutCopy): Ditto. Also removed unneeded explicit type names.
3628 (valueToArray): Ditto.
3629 (valueToDictionary): Ditto.
3630 (objectToValueWithoutCopy): Ditto.
3631 (objectToValue): Ditto.
3632 * API/JSVirtualMachine.mm:
3633 (+[JSVMWrapperCache addWrapper:forJSContextGroupRef:]): Ditto.
3634 (+[JSVMWrapperCache wrapperForJSContextGroupRef:]): Ditto.
3635 (-[JSVirtualMachine isOldExternalObject:]): Ditto.
3636 (-[JSVirtualMachine addManagedReference:withOwner:]): Ditto.
3637 (-[JSVirtualMachine removeManagedReference:withOwner:]): Ditto.
3638 (-[JSVirtualMachine contextForGlobalContextRef:]): Ditto.
3639 (-[JSVirtualMachine addContext:forGlobalContextRef:]): Ditto.
3640 (scanExternalObjectGraph): Ditto.
3641 (scanExternalRememberedSet): Ditto.
3642 * API/JSWrapperMap.mm:
3643 (makeWrapper): Ditto.
3644 (-[JSObjCClassInfo wrapperForObject:inContext:]): Ditto.
3645 (-[JSWrapperMap objcWrapperForJSValueRef:inContext:]): Ditto.
3646 (tryUnwrapObjcObject): Ditto.
3647 * API/ObjCCallbackFunction.mm:
3648 (blockSignatureContainsClass): Ditto.
3649 (objCCallbackFunctionForMethod): Switched from retain to CFRetain, but not
3650 sure we will be keeping this the same way under ARC.
3651 (objCCallbackFunctionForBlock): Use a bridging cast.
3653 * API/ObjcRuntimeExtras.h:
3654 (protocolImplementsProtocol): Use a more specific type that includes the
3655 explicit __unsafe_unretained for copied protocol lists.
3656 (forEachProtocolImplementingProtocol): Ditto.
3658 * inspector/remote/cocoa/RemoteInspectorCocoa.mm:
3659 (Inspector::convertNSNullToNil): Added to replace the CONVERT_NSNULL_TO_NIL macro.
3660 (Inspector::RemoteInspector::receivedSetupMessage): Use convertNSNullToNil.
3662 * inspector/remote/cocoa/RemoteInspectorXPCConnection.mm: Moved the
3663 CFXPCBridge SPI to a header named CFXPCBridgeSPI.h.
3664 (auditTokenHasEntitlement): Deleted. Moved to Entitlements.h/cpp in WTF.
3665 (Inspector::RemoteInspectorXPCConnection::handleEvent): Use WTF::hasEntitlement.
3666 (Inspector::RemoteInspectorXPCConnection::sendMessage): Use a bridging cast.
3668 2018-06-30 Adam Barth <abarth@webkit.org>
3670 Port JavaScriptCore to OS(FUCHSIA)
3671 https://bugs.webkit.org/show_bug.cgi?id=187223
3673 Reviewed by Daniel Bates.
3675 * assembler/ARM64Assembler.h:
3676 (JSC::ARM64Assembler::cacheFlush): Call zx_cache_flush to flush cache.
3677 * runtime/MachineContext.h: Fuchsia has the same mcontext_t as glibc.
3678 (JSC::MachineContext::stackPointerImpl):
3679 (JSC::MachineContext::framePointerImpl):
3680 (JSC::MachineContext::instructionPointerImpl):
3681 (JSC::MachineContext::argumentPointer<1>):
3682 (JSC::MachineContext::llintInstructionPointer):
3684 2018-06-30 David Kilzer <ddkilzer@apple.com>
3686 Fix clang static analyzer warnings: Garbage return value
3687 <https://webkit.org/b/187224>
3689 Reviewed by Eric Carlson.
3691 * bytecode/UnlinkedCodeBlock.cpp:
3692 (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset):
3693 - Use brace initialization for local variables.
3694 * debugger/DebuggerCallFrame.cpp:
3695 (class JSC::LineAndColumnFunctor):
3696 - Use class member initialization for member variables.
3698 2018-06-29 Saam Barati <sbarati@apple.com>
3700 Unreviewed. Try to fix Windows build after r233377
3702 * builtins/BuiltinExecutables.cpp:
3703 (JSC::BuiltinExecutables::createExecutable):
3705 2018-06-29 Saam Barati <sbarati@apple.com>
3707 Don't use tracePoints in JS/Wasm entry
3708 https://bugs.webkit.org/show_bug.cgi?id=187196
3710 Reviewed by Mark Lam.
3712 This puts VM entry and Wasm entry tracePoints behind a runtime
3713 option. This is a ~4x speedup on a soon to be released Wasm
3714 benchmark. tracePoints should basically never run more than 50
3715 times a second. Entering the VM and entering Wasm are user controlled,
3716 and can happen hundreds of thousands of times in a second. Depending
3717 on how the Wasm/JS code is structured, this can be disastrous for
3720 * runtime/Options.h:
3721 * runtime/VMEntryScope.cpp:
3722 (JSC::VMEntryScope::VMEntryScope):
3723 (JSC::VMEntryScope::~VMEntryScope):
3724 * wasm/WasmBBQPlan.cpp:
3725 (JSC::Wasm::BBQPlan::compileFunctions):
3726 * wasm/js/WebAssemblyFunction.cpp:
3727 (JSC::callWebAssemblyFunction):
3729 2018-06-29 Saam Barati <sbarati@apple.com>
3731 We shouldn't recurse into the parser when gathering metadata about various function offsets
3732 https://bugs.webkit.org/show_bug.cgi?id=184074
3733 <rdar://problem/37165897>
3735 Reviewed by Mark Lam.
3737 Prior to this patch, when we made a builtin, we had to make an UnlinkedFunctionExecutable
3738 for that builtin. This required calling into the parser. However, the parser
3739 may throw a stack overflow. We were not able to recover from that. The only
3740 reason we called into the parser here is that we were gathering text offsets
3741 and various metadata for things in the builtin function. This patch writes a
3742 mini parser that figures this information out without calling into the full
3743 parser. (I've also added a debug assert that verifies the mini parser stays in
3744 sync with the full parser.) The result of this is that BuiltinExecutbles::createExecutable
3747 * builtins/AsyncFromSyncIteratorPrototype.js:
3748 (globalPrivate.createAsyncFromSyncIterator):
3749 (globalPrivate.AsyncFromSyncIteratorConstructor):
3750 * builtins/BuiltinExecutables.cpp:
3751 (JSC::BuiltinExecutables::createExecutable):
3752 * builtins/GlobalOperations.js:
3753 (globalPrivate.getter.overriddenName.string_appeared_here.speciesGetter):
3754 (globalPrivate.speciesConstructor):
3755 (globalPrivate.copyDataProperties):
3756 (globalPrivate.copyDataPropertiesNoExclusions):
3757 * builtins/PromiseOperations.js:
3758 (globalPrivate.newHandledRejectedPromise):
3759 * builtins/RegExpPrototype.js:
3760 (globalPrivate.hasObservableSideEffectsForRegExpMatch):
3761 (globalPrivate.hasObservableSideEffectsForRegExpSplit):
3762 * builtins/StringPrototype.js:
3763 (globalPrivate.hasObservableSideEffectsForStringReplace):
3764 (globalPrivate.getDefaultCollator):
3766 (JSC::FunctionMetadataNode::FunctionMetadataNode):
3767 (JSC::FunctionMetadataNode::operator== const):
3768 (JSC::FunctionMetadataNode::dump const):
3772 * parser/ParserError.h:
3773 (JSC::ParserError::type const):
3774 * parser/ParserTokens.h:
3775 (JSC::JSTextPosition::operator== const):
3776 (JSC::JSTextPosition::operator!= const):
3777 * parser/SourceCode.h:
3778 (JSC::SourceCode::operator== const):
3779 (JSC::SourceCode::operator!= const):
3780 (JSC::SourceCode::subExpression const):
3781 (JSC::SourceCode::subExpression): Deleted.
3783 2018-06-28 Michael Saboff <msaboff@apple.com>
3785 IsoCellSet::sweepToFreeList() not safe when Full GC in process
3786 https://bugs.webkit.org/show_bug.cgi?id=187157
3788 Reviewed by Mark Lam.
3790 * heap/IsoCellSet.cpp:
3791 (JSC::IsoCellSet::sweepToFreeList): Changed the "stale marks logic" to match what
3792 is in MarkedBlock::Handle::specializedSweep where it takes into account whether
3793 or not we are in the process of marking during a full GC.
3794 * heap/MarkedBlock.h:
3795 * heap/MarkedBlockInlines.h:
3796 (JSC::MarkedBlock::Handle::areMarksStaleForSweep): New helper.
3798 2018-06-27 Saam Barati <sbarati@apple.com>
3800 Add some more register state information when we crash in repatchPutById
3801 https://bugs.webkit.org/show_bug.cgi?id=187112
3803 Reviewed by Mark Lam.
3805 This will help us gather info when we end up seeing a ObjectPropertyConditionSet
3806 with an offset that is different than what the put tells us.
3809 (JSC::tryCachePutByID):
3811 2018-06-27 Mark Lam <mark.lam@apple.com>
3813 Fix a bug in $vm.callFrame() and apply previously requested renaming of $vm.println to print.
3814 https://bugs.webkit.org/show_bug.cgi?id=187119
3816 Reviewed by Keith Miller.
3818 $vm.callFrame()'s JSDollarVMCallFrame::finishCreation()
3819 should be checking for codeBlock instead of !codeBlock
3820 before using the codeBlock.
3822 I also renamed some other "print" functions to use "dump" instead
3823 to match their underlying C++ code that they will call e.g.
3824 CodeBlock::dumpSource().
3826 * tools/JSDollarVM.cpp:
3827 (WTF::JSDollarVMCallFrame::finishCreation):
3828 (JSC::functionDumpSourceFor):
3829 (JSC::functionDumpBytecodeFor):
3831 (JSC::functionDataLog):
3832 (JSC::functionPrint):
3833 (JSC::functionDumpCallFrame):
3834 (JSC::functionDumpStack):
3835 (JSC::JSDollarVM::finishCreation):
3836 (JSC::functionPrintSourceFor): Deleted.
3837 (JSC::functionPrintBytecodeFor): Deleted.
3838 (JSC::doPrintln): Deleted.
3839 (JSC::functionPrintln): Deleted.
3840 (JSC::functionPrintCallFrame): Deleted.
3841 (JSC::functionPrintStack): Deleted.
3842 * tools/VMInspector.cpp:
3843 (JSC::DumpFrameFunctor::DumpFrameFunctor):
3844 (JSC::DumpFrameFunctor::operator() const):
3845 (JSC::VMInspector::dumpCallFrame):
3846 (JSC::VMInspector::dumpStack):
3847 (JSC::VMInspector::dumpValue):
3848 (JSC::PrintFrameFunctor::PrintFrameFunctor): Deleted.
3849 (JSC::PrintFrameFunctor::operator() const): Deleted.
3850 (JSC::VMInspector::printCallFrame): Deleted.
3851 (JSC::VMInspector::printStack): Deleted.
3852 (JSC::VMInspector::printValue): Deleted.
3853 * tools/VMInspector.h:
3855 2018-06-27 Keith Miller <keith_miller@apple.com>
3857 Add logging to try to diagnose where we get a null structure.
3858 https://bugs.webkit.org/show_bug.cgi?id=187106
3860 Reviewed by Mark Lam.
3862 Add a logging to JSObject::toPrimitive to help diagnose a nullptr
3865 This code should be removed when we fix <rdar://problem/33451840>
3867 * runtime/JSObject.cpp:
3868 (JSC::callToPrimitiveFunction):
3869 * runtime/JSObject.h:
3870 (JSC::JSObject::getPropertySlot):
3872 2018-06-27 Mark Lam <mark.lam@apple.com>
3874 DFG's compileReallocatePropertyStorage() and compileAllocatePropertyStorage() slow paths should also clear unused properties.
3875 https://bugs.webkit.org/show_bug.cgi?id=187091
3876 <rdar://problem/41395624>
3878 Reviewed by Yusuke Suzuki.
3880 Previously, when compileReallocatePropertyStorage() and compileAllocatePropertyStorage()
3881 take their slow paths, the slow path would jump back to the fast path right after
3882 the emitted code which clears the unused property values. As a result, the
3883 unused properties are not initialized. We've fixed this by adding the slow path
3884 generators before we emit the code to clear the unused properties.
3886 * dfg/DFGSpeculativeJIT.cpp:
3887 (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
3888 (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
3890 2018-06-27 Yusuke Suzuki <utatane.tea@gmail.com>
3892 [JSC] ArrayPatternNode::emitDirectBinding does not return assignment target value if dst is nullptr
3893 https://bugs.webkit.org/show_bug.cgi?id=185943
3895 Reviewed by Mark Lam.
3897 ArrayPatternNode::emitDirectBinding should return a register with an assignment target instead of filling
3898 the result with undefined if `dst` is nullptr. While `dst == ignoredResult()` means we do not require
3899 the result, `dst == nullptr` just means "dst is required, but a register for dst is not allocated.".
3900 This patch fixes emitDirectBinding to return an appropriate value with an allocated register for dst.
3902 ArrayPatternNode::emitDirectBinding() should be removed later since it does not follow array spreading protocol,
3903 but it should be done in a separate patch since it would be performance s
git://git.webkit.org / WebKit-https.git / blob