Source/JavaScriptCore/ChangeLog

   1 2016-01-17  Jeremy Huddleston Sequoia  <jeremyhu@apple.com>
   2
   3         Ensure that CF_AVAILABLE is undefined when building webkit-gtk
   4
   5         https://bugs.webkit.org/show_bug.cgi?id=152720
   6
   7         This change ensures that CF_AVAILABLE is correctly a no-op to
   8         address build failure that was observed when building on older
   9         versions of OSX.  Previously, CF_AVAILABLE may have been unexpectedly
  10         re-defined to the system header value based on include-order.
  11
  12         Reviewed by Michael Catanzaro.
  13
  14         * API/WebKitAvailability.h:
  15
  16 2016-01-17  Julien Brianceau  <jbriance@cisco.com>
  17
  18         [mips] Fix regT2 and regT3 trampling in MacroAssembler
  19         https://bugs.webkit.org/show_bug.cgi?id=153131
  20
  21         Mips $t2 and $t3 registers were used as temporary registers
  22         in MacroAssemblerMIPS.h, whereas they are mapped to regT2
  23         and regT3 in LLInt and GPRInfo.
  24
  25         This patch rearranges register mapping for the mips architecture:
  26         - use $t0 and $t1 as temp registers in LLInt (as in MacroAssembler)
  27         - use $t7 and $t8 as temp registers in MacroAssembler (as in LLInt)
  28         - remove $t6 from temp registers list in LLInt
  29         - update GPRInfo.h accordingly
  30         - add mips macroScratchRegisters() list in RegisterSet.cpp
  31
  32         Reviewed by Michael Saboff.
  33
  34         * assembler/MacroAssemblerMIPS.h:
  35         * jit/GPRInfo.h:
  36         (JSC::GPRInfo::toRegister):
  37         (JSC::GPRInfo::toIndex):
  38         * jit/RegisterSet.cpp:
  39         (JSC::RegisterSet::macroScratchRegisters):
  40         (JSC::RegisterSet::calleeSaveRegisters):
  41         * offlineasm/mips.rb:
  42
  43 2016-01-16  Skachkov Oleksandr  <gskachkov@gmail.com>
  44
  45         [ES6] Arrow function syntax. Arrow function should support the destructuring parameters.
  46         https://bugs.webkit.org/show_bug.cgi?id=146934
  47
  48         Reviewed by Saam Barati.
  49
  50         Added support of destructuring parameters, before arrow function expect only simple parameters,
  51         e.g. (), (x), (x, y) or x in assigment expressio. To support destructuring parameters added
  52         additional check that check for destructuring paramters if check does not pass for simple parameters.
  53
  54         * parser/Parser.cpp:
  55         (JSC::Parser<LexerType>::isArrowFunctionParameters):
  56         (JSC::Parser<LexerType>::parseAssignmentExpression):
  57         * parser/Parser.h:
  58
  59 2016-01-15  Benjamin Poulain  <bpoulain@apple.com>
  60
  61         [JSC] Legalize Memory Offsets for ARM64 before lowering to Air
  62         https://bugs.webkit.org/show_bug.cgi?id=153065
  63
  64         Reviewed by Mark Lam.
  65         Reviewed by Filip Pizlo.
  66
  67         On ARM64, we cannot use signed 32bits offset for memory addressing.
  68         There are two available addressing: signed 9bits and unsigned scaled 12bits.
  69         Air already knows about it.
  70
  71         In this patch, the offsets are changed to something valid for ARM64
  72         prior to lowering. When an offset is invalid, it is just computed
  73         before the instruction and used as the base for addressing.
  74
  75         * JavaScriptCore.xcodeproj/project.pbxproj:
  76         * b3/B3Generate.cpp:
  77         (JSC::B3::generateToAir):
  78         * b3/B3LegalizeMemoryOffsets.cpp: Added.
  79         (JSC::B3::legalizeMemoryOffsets):
  80         * b3/B3LegalizeMemoryOffsets.h: Added.
  81         * b3/B3LowerToAir.cpp:
  82         (JSC::B3::Air::LowerToAir::effectiveAddr): Deleted.
  83         * b3/testb3.cpp:
  84         (JSC::B3::testLoadWithOffsetImpl):
  85         (JSC::B3::testLoadOffsetImm9Max):
  86         (JSC::B3::testLoadOffsetImm9MaxPlusOne):
  87         (JSC::B3::testLoadOffsetImm9MaxPlusTwo):
  88         (JSC::B3::testLoadOffsetImm9Min):
  89         (JSC::B3::testLoadOffsetImm9MinMinusOne):
  90         (JSC::B3::testLoadOffsetScaledUnsignedImm12Max):
  91         (JSC::B3::testLoadOffsetScaledUnsignedOverImm12Max):
  92         (JSC::B3::run):
  93
  94 2016-01-15  Alex Christensen  <achristensen@webkit.org>
  95
  96         Fix internal Windows build
  97         https://bugs.webkit.org/show_bug.cgi?id=153142
  98
  99         Reviewed by Brent Fulgham.
 100
 101         The internal Windows build builds JavaScriptCore from a directory that is not called JavaScriptCore.
 102         Searching for JavaScriptCore/API/APICast.h fails because it is in SomethingElse/API/APICast.h.
 103         Since we are including the JavaScriptCore directory, it is not necessary to have JavaScriptCore in
 104         the forwarding headers, but removing it allows builds form directories that are not named JavaScriptCore.
 105
 106         * ForwardingHeaders/JavaScriptCore/APICast.h:
 107         * ForwardingHeaders/JavaScriptCore/JSBase.h:
 108         * ForwardingHeaders/JavaScriptCore/JSCTestRunnerUtils.h:
 109         * ForwardingHeaders/JavaScriptCore/JSContextRef.h:
 110         * ForwardingHeaders/JavaScriptCore/JSObjectRef.h:
 111         * ForwardingHeaders/JavaScriptCore/JSRetainPtr.h:
 112         * ForwardingHeaders/JavaScriptCore/JSStringRef.h:
 113         * ForwardingHeaders/JavaScriptCore/JSStringRefCF.h:
 114         * ForwardingHeaders/JavaScriptCore/JSValueRef.h:
 115         * ForwardingHeaders/JavaScriptCore/JavaScript.h:
 116         * ForwardingHeaders/JavaScriptCore/JavaScriptCore.h:
 117         * ForwardingHeaders/JavaScriptCore/OpaqueJSString.h:
 118         * ForwardingHeaders/JavaScriptCore/WebKitAvailability.h:
 119
 120 2016-01-15  Per Arne Vollan  <peavo@outlook.com>
 121
 122         [B3][Win64] Compile fixes.
 123         https://bugs.webkit.org/show_bug.cgi?id=153127
 124
 125         Reviewed by Alex Christensen.
 126
 127         MSVC have several overloads of fmod, pow, and ceil. We need to suggest to MSVC
 128         which one we want to use.
 129
 130         * b3/B3LowerMacros.cpp:
 131         * b3/B3LowerMacrosAfterOptimizations.cpp:
 132         * b3/B3MathExtras.cpp:
 133         (JSC::B3::powDoubleInt32):
 134         * b3/B3ReduceStrength.cpp:
 135
 136 2016-01-15  Filip Pizlo  <fpizlo@apple.com>
 137
 138         Air needs a Shuffle instruction
 139         https://bugs.webkit.org/show_bug.cgi?id=152952
 140
 141         Reviewed by Saam Barati.
 142
 143         This adds an instruction called Shuffle. Shuffle allows you to simultaneously perform
 144         multiple moves to perform arbitrary permutations over registers and memory. We call these
 145         rotations. It also allows you to perform "shifts", like (a => b, b => c): after the shift,
 146         c will have b's old value, b will have a's old value, and a will be unchanged. Shifts can
 147         use immediates as their source.
 148
 149         Shuffle is added as a custom instruction, since it has a variable number of arguments. It
 150         takes any number of triplets of arguments, where each triplet describes one mapping of the
 151         shuffle. For example, to represent (a => b, b => c), we might say:
 152
 153             Shuffle %a, %b, 64, %b, %c, 64
 154
 155         Note the "64"s, those are width arguments that describe how many bits of the register are
 156         being moved. Each triplet is referred to as a "shuffle pair". We call it a pair because the
 157         most relevant part of it is the pair of registers or memroy locations (i.e. %a, %b form one
 158         of the pairs in the example). For GP arguments, the width follows ZDef semantics.
 159
 160         In the future, we will be able to use Shuffle for a lot of things. This patch is modest about
 161         how to use it:
 162
 163         - C calling convention argument marshalling. Previously we used move instructions. But that's
 164           problematic since it introduces artificial interference between the argument registers and
 165           the inputs. Using Shuffle removes that interference. This helps a bit.
 166
 167         - Cold C calls. This is what really motivated me to write this patch. If we have a C call on
 168           a cold path, then we want it to appear to the register allocator like it doesn't clobber
 169           any registers. Only after register allocation should we handle the clobbering by simply
 170           saving all of the live volatile registers to the stack. If you imagine the saving and the
 171           argument marshalling, you can see how before the call, we want to have a Shuffle that does
 172           both of those things. This is important. If argument marshalling was separate from the
 173           saving, then we'd still appear to clobber argument registers. Doing them together as one
 174           Shuffle means that the cold call doesn't appear to even clobber the argument registers.
 175
 176         Unfortunately, I was wrong about cold C calls being the dominant problem with our register
 177         allocator right now. Fixing this revealed other problems in my current tuning benchmark,
 178         Octane/encrypt. Nonetheless, this is a small speed-up across the board, and gives us some
 179         functionality we will need to implement other optimizations.
 180
 181         Relanding after fixing production build.
 182
 183         * CMakeLists.txt:
 184         * JavaScriptCore.xcodeproj/project.pbxproj:
 185         * assembler/AbstractMacroAssembler.h:
 186         (JSC::isX86_64):
 187         (JSC::isIOS):
 188         (JSC::optimizeForARMv7IDIVSupported):
 189         * assembler/MacroAssemblerX86Common.h:
 190         (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
 191         (JSC::MacroAssemblerX86Common::swap32):
 192         (JSC::MacroAssemblerX86Common::moveConditionally32):
 193         * assembler/MacroAssemblerX86_64.h:
 194         (JSC::MacroAssemblerX86_64::store64WithAddressOffsetPatch):
 195         (JSC::MacroAssemblerX86_64::swap64):
 196         (JSC::MacroAssemblerX86_64::move64ToDouble):
 197         * assembler/X86Assembler.h:
 198         (JSC::X86Assembler::xchgl_rr):
 199         (JSC::X86Assembler::xchgl_rm):
 200         (JSC::X86Assembler::xchgq_rr):
 201         (JSC::X86Assembler::xchgq_rm):
 202         (JSC::X86Assembler::movl_rr):
 203         * b3/B3CCallValue.h:
 204         * b3/B3Compilation.cpp:
 205         (JSC::B3::Compilation::Compilation):
 206         (JSC::B3::Compilation::~Compilation):
 207         * b3/B3Compilation.h:
 208         (JSC::B3::Compilation::code):
 209         * b3/B3LowerToAir.cpp:
 210         (JSC::B3::Air::LowerToAir::run):
 211         (JSC::B3::Air::LowerToAir::createSelect):
 212         (JSC::B3::Air::LowerToAir::lower):
 213         (JSC::B3::Air::LowerToAir::marshallCCallArgument): Deleted.
 214         * b3/B3OpaqueByproducts.h:
 215         (JSC::B3::OpaqueByproducts::count):
 216         * b3/B3StackmapSpecial.cpp:
 217         (JSC::B3::StackmapSpecial::isArgValidForValue):
 218         (JSC::B3::StackmapSpecial::isArgValidForRep):
 219         * b3/air/AirArg.cpp:
 220         (JSC::B3::Air::Arg::isStackMemory):
 221         (JSC::B3::Air::Arg::isRepresentableAs):
 222         (JSC::B3::Air::Arg::usesTmp):
 223         (JSC::B3::Air::Arg::canRepresent):
 224         (JSC::B3::Air::Arg::isCompatibleType):
 225         (JSC::B3::Air::Arg::dump):
 226         (WTF::printInternal):
 227         * b3/air/AirArg.h:
 228         (JSC::B3::Air::Arg::forEachType):
 229         (JSC::B3::Air::Arg::isWarmUse):
 230         (JSC::B3::Air::Arg::cooled):
 231         (JSC::B3::Air::Arg::isEarlyUse):
 232         (JSC::B3::Air::Arg::imm64):
 233         (JSC::B3::Air::Arg::immPtr):
 234         (JSC::B3::Air::Arg::addr):
 235         (JSC::B3::Air::Arg::special):
 236         (JSC::B3::Air::Arg::widthArg):
 237         (JSC::B3::Air::Arg::operator==):
 238         (JSC::B3::Air::Arg::isImm64):
 239         (JSC::B3::Air::Arg::isSomeImm):
 240         (JSC::B3::Air::Arg::isAddr):
 241         (JSC::B3::Air::Arg::isIndex):
 242         (JSC::B3::Air::Arg::isMemory):
 243         (JSC::B3::Air::Arg::isRelCond):
 244         (JSC::B3::Air::Arg::isSpecial):
 245         (JSC::B3::Air::Arg::isWidthArg):
 246         (JSC::B3::Air::Arg::isAlive):
 247         (JSC::B3::Air::Arg::base):
 248         (JSC::B3::Air::Arg::hasOffset):
 249         (JSC::B3::Air::Arg::offset):
 250         (JSC::B3::Air::Arg::width):
 251         (JSC::B3::Air::Arg::isGPTmp):
 252         (JSC::B3::Air::Arg::isGP):
 253         (JSC::B3::Air::Arg::isFP):
 254         (JSC::B3::Air::Arg::isType):
 255         (JSC::B3::Air::Arg::isGPR):
 256         (JSC::B3::Air::Arg::isValidForm):
 257         (JSC::B3::Air::Arg::forEachTmpFast):
 258         * b3/air/AirBasicBlock.h:
 259         (JSC::B3::Air::BasicBlock::insts):
 260         (JSC::B3::Air::BasicBlock::appendInst):
 261         (JSC::B3::Air::BasicBlock::append):
 262         * b3/air/AirCCallingConvention.cpp: Added.
 263         (JSC::B3::Air::computeCCallingConvention):
 264         (JSC::B3::Air::cCallResult):
 265         (JSC::B3::Air::buildCCall):
 266         * b3/air/AirCCallingConvention.h: Added.
 267         * b3/air/AirCode.h:
 268         (JSC::B3::Air::Code::proc):
 269         * b3/air/AirCustom.cpp: Added.
 270         (JSC::B3::Air::CCallCustom::isValidForm):
 271         (JSC::B3::Air::CCallCustom::generate):
 272         (JSC::B3::Air::ShuffleCustom::isValidForm):
 273         (JSC::B3::Air::ShuffleCustom::generate):
 274         * b3/air/AirCustom.h:
 275         (JSC::B3::Air::PatchCustom::forEachArg):
 276         (JSC::B3::Air::PatchCustom::generate):
 277         (JSC::B3::Air::CCallCustom::forEachArg):
 278         (JSC::B3::Air::CCallCustom::isValidFormStatic):
 279         (JSC::B3::Air::CCallCustom::admitsStack):
 280         (JSC::B3::Air::CCallCustom::hasNonArgNonControlEffects):
 281         (JSC::B3::Air::ColdCCallCustom::forEachArg):
 282         (JSC::B3::Air::ShuffleCustom::forEachArg):
 283         (JSC::B3::Air::ShuffleCustom::isValidFormStatic):
 284         (JSC::B3::Air::ShuffleCustom::admitsStack):
 285         (JSC::B3::Air::ShuffleCustom::hasNonArgNonControlEffects):
 286         * b3/air/AirEmitShuffle.cpp: Added.
 287         (JSC::B3::Air::ShufflePair::dump):
 288         (JSC::B3::Air::emitShuffle):
 289         * b3/air/AirEmitShuffle.h: Added.
 290         (JSC::B3::Air::ShufflePair::ShufflePair):
 291         (JSC::B3::Air::ShufflePair::src):
 292         (JSC::B3::Air::ShufflePair::dst):
 293         (JSC::B3::Air::ShufflePair::width):
 294         * b3/air/AirGenerate.cpp:
 295         (JSC::B3::Air::prepareForGeneration):
 296         * b3/air/AirGenerate.h:
 297         * b3/air/AirInsertionSet.cpp:
 298         (JSC::B3::Air::InsertionSet::insertInsts):
 299         (JSC::B3::Air::InsertionSet::execute):
 300         * b3/air/AirInsertionSet.h:
 301         (JSC::B3::Air::InsertionSet::insertInst):
 302         (JSC::B3::Air::InsertionSet::insert):
 303         * b3/air/AirInst.h:
 304         (JSC::B3::Air::Inst::operator bool):
 305         (JSC::B3::Air::Inst::append):
 306         * b3/air/AirLowerAfterRegAlloc.cpp: Added.
 307         (JSC::B3::Air::lowerAfterRegAlloc):
 308         * b3/air/AirLowerAfterRegAlloc.h: Added.
 309         * b3/air/AirLowerMacros.cpp: Added.
 310         (JSC::B3::Air::lowerMacros):
 311         * b3/air/AirLowerMacros.h: Added.
 312         * b3/air/AirOpcode.opcodes:
 313         * b3/air/AirRegisterPriority.h:
 314         (JSC::B3::Air::regsInPriorityOrder):
 315         * b3/air/testair.cpp: Added.
 316         (hiddenTruthBecauseNoReturnIsStupid):
 317         (usage):
 318         (JSC::B3::Air::compile):
 319         (JSC::B3::Air::invoke):
 320         (JSC::B3::Air::compileAndRun):
 321         (JSC::B3::Air::testSimple):
 322         (JSC::B3::Air::loadConstantImpl):
 323         (JSC::B3::Air::loadConstant):
 324         (JSC::B3::Air::loadDoubleConstant):
 325         (JSC::B3::Air::testShuffleSimpleSwap):
 326         (JSC::B3::Air::testShuffleSimpleShift):
 327         (JSC::B3::Air::testShuffleLongShift):
 328         (JSC::B3::Air::testShuffleLongShiftBackwards):
 329         (JSC::B3::Air::testShuffleSimpleRotate):
 330         (JSC::B3::Air::testShuffleSimpleBroadcast):
 331         (JSC::B3::Air::testShuffleBroadcastAllRegs):
 332         (JSC::B3::Air::testShuffleTreeShift):
 333         (JSC::B3::Air::testShuffleTreeShiftBackward):
 334         (JSC::B3::Air::testShuffleTreeShiftOtherBackward):
 335         (JSC::B3::Air::testShuffleMultipleShifts):
 336         (JSC::B3::Air::testShuffleRotateWithFringe):
 337         (JSC::B3::Air::testShuffleRotateWithLongFringe):
 338         (JSC::B3::Air::testShuffleMultipleRotates):
 339         (JSC::B3::Air::testShuffleShiftAndRotate):
 340         (JSC::B3::Air::testShuffleShiftAllRegs):
 341         (JSC::B3::Air::testShuffleRotateAllRegs):
 342         (JSC::B3::Air::testShuffleSimpleSwap64):
 343         (JSC::B3::Air::testShuffleSimpleShift64):
 344         (JSC::B3::Air::testShuffleSwapMixedWidth):
 345         (JSC::B3::Air::testShuffleShiftMixedWidth):
 346         (JSC::B3::Air::testShuffleShiftMemory):
 347         (JSC::B3::Air::testShuffleShiftMemoryLong):
 348         (JSC::B3::Air::testShuffleShiftMemoryAllRegs):
 349         (JSC::B3::Air::testShuffleShiftMemoryAllRegs64):
 350         (JSC::B3::Air::combineHiLo):
 351         (JSC::B3::Air::testShuffleShiftMemoryAllRegsMixedWidth):
 352         (JSC::B3::Air::testShuffleRotateMemory):
 353         (JSC::B3::Air::testShuffleRotateMemory64):
 354         (JSC::B3::Air::testShuffleRotateMemoryMixedWidth):
 355         (JSC::B3::Air::testShuffleRotateMemoryAllRegs64):
 356         (JSC::B3::Air::testShuffleRotateMemoryAllRegsMixedWidth):
 357         (JSC::B3::Air::testShuffleSwapDouble):
 358         (JSC::B3::Air::testShuffleShiftDouble):
 359         (JSC::B3::Air::run):
 360         (run):
 361         (main):
 362         * b3/testb3.cpp:
 363         (JSC::B3::testCallSimple):
 364         (JSC::B3::testCallRare):
 365         (JSC::B3::testCallRareLive):
 366         (JSC::B3::testCallSimplePure):
 367         (JSC::B3::run):
 368
 369 2016-01-15  Andy VanWagoner  <thetalecrafter@gmail.com>
 370
 371         [INTL] Implement Date.prototype.toLocaleString in ECMA-402
 372         https://bugs.webkit.org/show_bug.cgi?id=147611
 373
 374         Reviewed by Benjamin Poulain.
 375
 376         Expose dateProtoFuncGetTime as thisTimeValue for builtins.
 377         Remove unused code in DateTimeFormat toDateTimeOptions, and make the
 378         function specific to the call in initializeDateTimeFormat. Properly
 379         throw when the options parameter is null.
 380         Add toLocaleString in builtin JavaScript, with it's own specific branch
 381         of toDateTimeOptions.
 382
 383         * CMakeLists.txt:
 384         * DerivedSources.make:
 385         * JavaScriptCore.xcodeproj/project.pbxproj:
 386         * builtins/DatePrototype.js: Added.
 387         (toLocaleString.toDateTimeOptionsAnyAll):
 388         (toLocaleString):
 389         * runtime/CommonIdentifiers.h:
 390         * runtime/DatePrototype.cpp:
 391         (JSC::DatePrototype::finishCreation):
 392         * runtime/DatePrototype.h:
 393         * runtime/IntlDateTimeFormat.cpp:
 394         (JSC::toDateTimeOptionsAnyDate):
 395         (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
 396         (JSC::toDateTimeOptions): Deleted.
 397         * runtime/JSGlobalObject.cpp:
 398         (JSC::JSGlobalObject::init):
 399
 400 2016-01-15  Konstantin Tokarev  <annulen@yandex.ru>
 401
 402         [mips] Implemented emitFunctionPrologue/Epilogue
 403         https://bugs.webkit.org/show_bug.cgi?id=152947
 404
 405         Reviewed by Michael Saboff.
 406
 407         * assembler/MacroAssemblerMIPS.h:
 408         (JSC::MacroAssemblerMIPS::popPair):
 409         (JSC::MacroAssemblerMIPS::pushPair):
 410         * jit/AssemblyHelpers.h:
 411         (JSC::AssemblyHelpers::emitFunctionPrologue):
 412         (JSC::AssemblyHelpers::emitFunctionEpilogueWithEmptyFrame):
 413         (JSC::AssemblyHelpers::emitFunctionEpilogue):
 414
 415 2016-01-15  Commit Queue  <commit-queue@webkit.org>
 416
 417         Unreviewed, rolling out r195084.
 418         https://bugs.webkit.org/show_bug.cgi?id=153132
 419
 420         Broke Production build (Requested by ap on #webkit).
 421
 422         Reverted changeset:
 423
 424         "Air needs a Shuffle instruction"
 425         https://bugs.webkit.org/show_bug.cgi?id=152952
 426         http://trac.webkit.org/changeset/195084
 427
 428 2016-01-15  Julien Brianceau  <jbriance@cisco.com>
 429
 430         [mips] Add countLeadingZeros32 implementation in macro assembler
 431         https://bugs.webkit.org/show_bug.cgi?id=152886
 432
 433         Reviewed by Michael Saboff.
 434
 435         * assembler/MIPSAssembler.h:
 436         (JSC::MIPSAssembler::lui):
 437         (JSC::MIPSAssembler::clz):
 438         (JSC::MIPSAssembler::addiu):
 439         * assembler/MacroAssemblerMIPS.h:
 440         (JSC::MacroAssemblerMIPS::and32):
 441         (JSC::MacroAssemblerMIPS::countLeadingZeros32):
 442         (JSC::MacroAssemblerMIPS::lshift32):
 443
 444 2016-01-14  Filip Pizlo  <fpizlo@apple.com>
 445
 446         Air needs a Shuffle instruction
 447         https://bugs.webkit.org/show_bug.cgi?id=152952
 448
 449         Reviewed by Saam Barati.
 450
 451         This adds an instruction called Shuffle. Shuffle allows you to simultaneously perform
 452         multiple moves to perform arbitrary permutations over registers and memory. We call these
 453         rotations. It also allows you to perform "shifts", like (a => b, b => c): after the shift,
 454         c will have b's old value, b will have a's old value, and a will be unchanged. Shifts can
 455         use immediates as their source.
 456
 457         Shuffle is added as a custom instruction, since it has a variable number of arguments. It
 458         takes any number of triplets of arguments, where each triplet describes one mapping of the
 459         shuffle. For example, to represent (a => b, b => c), we might say:
 460
 461             Shuffle %a, %b, 64, %b, %c, 64
 462
 463         Note the "64"s, those are width arguments that describe how many bits of the register are
 464         being moved. Each triplet is referred to as a "shuffle pair". We call it a pair because the
 465         most relevant part of it is the pair of registers or memroy locations (i.e. %a, %b form one
 466         of the pairs in the example). For GP arguments, the width follows ZDef semantics.
 467
 468         In the future, we will be able to use Shuffle for a lot of things. This patch is modest about
 469         how to use it:
 470
 471         - C calling convention argument marshalling. Previously we used move instructions. But that's
 472           problematic since it introduces artificial interference between the argument registers and
 473           the inputs. Using Shuffle removes that interference. This helps a bit.
 474
 475         - Cold C calls. This is what really motivated me to write this patch. If we have a C call on
 476           a cold path, then we want it to appear to the register allocator like it doesn't clobber
 477           any registers. Only after register allocation should we handle the clobbering by simply
 478           saving all of the live volatile registers to the stack. If you imagine the saving and the
 479           argument marshalling, you can see how before the call, we want to have a Shuffle that does
 480           both of those things. This is important. If argument marshalling was separate from the
 481           saving, then we'd still appear to clobber argument registers. Doing them together as one
 482           Shuffle means that the cold call doesn't appear to even clobber the argument registers.
 483
 484         Unfortunately, I was wrong about cold C calls being the dominant problem with our register
 485         allocator right now. Fixing this revealed other problems in my current tuning benchmark,
 486         Octane/encrypt. Nonetheless, this is a small speed-up across the board, and gives us some
 487         functionality we will need to implement other optimizations.
 488
 489         * CMakeLists.txt:
 490         * JavaScriptCore.xcodeproj/project.pbxproj:
 491         * assembler/AbstractMacroAssembler.h:
 492         (JSC::isX86_64):
 493         (JSC::isIOS):
 494         (JSC::optimizeForARMv7IDIVSupported):
 495         * assembler/MacroAssemblerX86Common.h:
 496         (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
 497         (JSC::MacroAssemblerX86Common::swap32):
 498         (JSC::MacroAssemblerX86Common::moveConditionally32):
 499         * assembler/MacroAssemblerX86_64.h:
 500         (JSC::MacroAssemblerX86_64::store64WithAddressOffsetPatch):
 501         (JSC::MacroAssemblerX86_64::swap64):
 502         (JSC::MacroAssemblerX86_64::move64ToDouble):
 503         * assembler/X86Assembler.h:
 504         (JSC::X86Assembler::xchgl_rr):
 505         (JSC::X86Assembler::xchgl_rm):
 506         (JSC::X86Assembler::xchgq_rr):
 507         (JSC::X86Assembler::xchgq_rm):
 508         (JSC::X86Assembler::movl_rr):
 509         * b3/B3CCallValue.h:
 510         * b3/B3Compilation.cpp:
 511         (JSC::B3::Compilation::Compilation):
 512         (JSC::B3::Compilation::~Compilation):
 513         * b3/B3Compilation.h:
 514         (JSC::B3::Compilation::code):
 515         * b3/B3LowerToAir.cpp:
 516         (JSC::B3::Air::LowerToAir::run):
 517         (JSC::B3::Air::LowerToAir::createSelect):
 518         (JSC::B3::Air::LowerToAir::lower):
 519         (JSC::B3::Air::LowerToAir::marshallCCallArgument): Deleted.
 520         * b3/B3OpaqueByproducts.h:
 521         (JSC::B3::OpaqueByproducts::count):
 522         * b3/B3StackmapSpecial.cpp:
 523         (JSC::B3::StackmapSpecial::isArgValidForValue):
 524         (JSC::B3::StackmapSpecial::isArgValidForRep):
 525         * b3/air/AirArg.cpp:
 526         (JSC::B3::Air::Arg::isStackMemory):
 527         (JSC::B3::Air::Arg::isRepresentableAs):
 528         (JSC::B3::Air::Arg::usesTmp):
 529         (JSC::B3::Air::Arg::canRepresent):
 530         (JSC::B3::Air::Arg::isCompatibleType):
 531         (JSC::B3::Air::Arg::dump):
 532         (WTF::printInternal):
 533         * b3/air/AirArg.h:
 534         (JSC::B3::Air::Arg::forEachType):
 535         (JSC::B3::Air::Arg::isWarmUse):
 536         (JSC::B3::Air::Arg::cooled):
 537         (JSC::B3::Air::Arg::isEarlyUse):
 538         (JSC::B3::Air::Arg::imm64):
 539         (JSC::B3::Air::Arg::immPtr):
 540         (JSC::B3::Air::Arg::addr):
 541         (JSC::B3::Air::Arg::special):
 542         (JSC::B3::Air::Arg::widthArg):
 543         (JSC::B3::Air::Arg::operator==):
 544         (JSC::B3::Air::Arg::isImm64):
 545         (JSC::B3::Air::Arg::isSomeImm):
 546         (JSC::B3::Air::Arg::isAddr):
 547         (JSC::B3::Air::Arg::isIndex):
 548         (JSC::B3::Air::Arg::isMemory):
 549         (JSC::B3::Air::Arg::isRelCond):
 550         (JSC::B3::Air::Arg::isSpecial):
 551         (JSC::B3::Air::Arg::isWidthArg):
 552         (JSC::B3::Air::Arg::isAlive):
 553         (JSC::B3::Air::Arg::base):
 554         (JSC::B3::Air::Arg::hasOffset):
 555         (JSC::B3::Air::Arg::offset):
 556         (JSC::B3::Air::Arg::width):
 557         (JSC::B3::Air::Arg::isGPTmp):
 558         (JSC::B3::Air::Arg::isGP):
 559         (JSC::B3::Air::Arg::isFP):
 560         (JSC::B3::Air::Arg::isType):
 561         (JSC::B3::Air::Arg::isGPR):
 562         (JSC::B3::Air::Arg::isValidForm):
 563         (JSC::B3::Air::Arg::forEachTmpFast):
 564         * b3/air/AirBasicBlock.h:
 565         (JSC::B3::Air::BasicBlock::insts):
 566         (JSC::B3::Air::BasicBlock::appendInst):
 567         (JSC::B3::Air::BasicBlock::append):
 568         * b3/air/AirCCallingConvention.cpp: Added.
 569         (JSC::B3::Air::computeCCallingConvention):
 570         (JSC::B3::Air::cCallResult):
 571         (JSC::B3::Air::buildCCall):
 572         * b3/air/AirCCallingConvention.h: Added.
 573         * b3/air/AirCode.h:
 574         (JSC::B3::Air::Code::proc):
 575         * b3/air/AirCustom.cpp: Added.
 576         (JSC::B3::Air::CCallCustom::isValidForm):
 577         (JSC::B3::Air::CCallCustom::generate):
 578         (JSC::B3::Air::ShuffleCustom::isValidForm):
 579         (JSC::B3::Air::ShuffleCustom::generate):
 580         * b3/air/AirCustom.h:
 581         (JSC::B3::Air::PatchCustom::forEachArg):
 582         (JSC::B3::Air::PatchCustom::generate):
 583         (JSC::B3::Air::CCallCustom::forEachArg):
 584         (JSC::B3::Air::CCallCustom::isValidFormStatic):
 585         (JSC::B3::Air::CCallCustom::admitsStack):
 586         (JSC::B3::Air::CCallCustom::hasNonArgNonControlEffects):
 587         (JSC::B3::Air::ColdCCallCustom::forEachArg):
 588         (JSC::B3::Air::ShuffleCustom::forEachArg):
 589         (JSC::B3::Air::ShuffleCustom::isValidFormStatic):
 590         (JSC::B3::Air::ShuffleCustom::admitsStack):
 591         (JSC::B3::Air::ShuffleCustom::hasNonArgNonControlEffects):
 592         * b3/air/AirEmitShuffle.cpp: Added.
 593         (JSC::B3::Air::ShufflePair::dump):
 594         (JSC::B3::Air::emitShuffle):
 595         * b3/air/AirEmitShuffle.h: Added.
 596         (JSC::B3::Air::ShufflePair::ShufflePair):
 597         (JSC::B3::Air::ShufflePair::src):
 598         (JSC::B3::Air::ShufflePair::dst):
 599         (JSC::B3::Air::ShufflePair::width):
 600         * b3/air/AirGenerate.cpp:
 601         (JSC::B3::Air::prepareForGeneration):
 602         * b3/air/AirGenerate.h:
 603         * b3/air/AirInsertionSet.cpp:
 604         (JSC::B3::Air::InsertionSet::insertInsts):
 605         (JSC::B3::Air::InsertionSet::execute):
 606         * b3/air/AirInsertionSet.h:
 607         (JSC::B3::Air::InsertionSet::insertInst):
 608         (JSC::B3::Air::InsertionSet::insert):
 609         * b3/air/AirInst.h:
 610         (JSC::B3::Air::Inst::operator bool):
 611         (JSC::B3::Air::Inst::append):
 612         * b3/air/AirLowerAfterRegAlloc.cpp: Added.
 613         (JSC::B3::Air::lowerAfterRegAlloc):
 614         * b3/air/AirLowerAfterRegAlloc.h: Added.
 615         * b3/air/AirLowerMacros.cpp: Added.
 616         (JSC::B3::Air::lowerMacros):
 617         * b3/air/AirLowerMacros.h: Added.
 618         * b3/air/AirOpcode.opcodes:
 619         * b3/air/AirRegisterPriority.h:
 620         (JSC::B3::Air::regsInPriorityOrder):
 621         * b3/air/testair.cpp: Added.
 622         (hiddenTruthBecauseNoReturnIsStupid):
 623         (usage):
 624         (JSC::B3::Air::compile):
 625         (JSC::B3::Air::invoke):
 626         (JSC::B3::Air::compileAndRun):
 627         (JSC::B3::Air::testSimple):
 628         (JSC::B3::Air::loadConstantImpl):
 629         (JSC::B3::Air::loadConstant):
 630         (JSC::B3::Air::loadDoubleConstant):
 631         (JSC::B3::Air::testShuffleSimpleSwap):
 632         (JSC::B3::Air::testShuffleSimpleShift):
 633         (JSC::B3::Air::testShuffleLongShift):
 634         (JSC::B3::Air::testShuffleLongShiftBackwards):
 635         (JSC::B3::Air::testShuffleSimpleRotate):
 636         (JSC::B3::Air::testShuffleSimpleBroadcast):
 637         (JSC::B3::Air::testShuffleBroadcastAllRegs):
 638         (JSC::B3::Air::testShuffleTreeShift):
 639         (JSC::B3::Air::testShuffleTreeShiftBackward):
 640         (JSC::B3::Air::testShuffleTreeShiftOtherBackward):
 641         (JSC::B3::Air::testShuffleMultipleShifts):
 642         (JSC::B3::Air::testShuffleRotateWithFringe):
 643         (JSC::B3::Air::testShuffleRotateWithLongFringe):
 644         (JSC::B3::Air::testShuffleMultipleRotates):
 645         (JSC::B3::Air::testShuffleShiftAndRotate):
 646         (JSC::B3::Air::testShuffleShiftAllRegs):
 647         (JSC::B3::Air::testShuffleRotateAllRegs):
 648         (JSC::B3::Air::testShuffleSimpleSwap64):
 649         (JSC::B3::Air::testShuffleSimpleShift64):
 650         (JSC::B3::Air::testShuffleSwapMixedWidth):
 651         (JSC::B3::Air::testShuffleShiftMixedWidth):
 652         (JSC::B3::Air::testShuffleShiftMemory):
 653         (JSC::B3::Air::testShuffleShiftMemoryLong):
 654         (JSC::B3::Air::testShuffleShiftMemoryAllRegs):
 655         (JSC::B3::Air::testShuffleShiftMemoryAllRegs64):
 656         (JSC::B3::Air::combineHiLo):
 657         (JSC::B3::Air::testShuffleShiftMemoryAllRegsMixedWidth):
 658         (JSC::B3::Air::testShuffleRotateMemory):
 659         (JSC::B3::Air::testShuffleRotateMemory64):
 660         (JSC::B3::Air::testShuffleRotateMemoryMixedWidth):
 661         (JSC::B3::Air::testShuffleRotateMemoryAllRegs64):
 662         (JSC::B3::Air::testShuffleRotateMemoryAllRegsMixedWidth):
 663         (JSC::B3::Air::testShuffleSwapDouble):
 664         (JSC::B3::Air::testShuffleShiftDouble):
 665         (JSC::B3::Air::run):
 666         (run):
 667         (main):
 668         * b3/testb3.cpp:
 669         (JSC::B3::testCallSimple):
 670         (JSC::B3::testCallRare):
 671         (JSC::B3::testCallRareLive):
 672         (JSC::B3::testCallSimplePure):
 673         (JSC::B3::run):
 674
 675 2016-01-14  Keith Miller  <keith_miller@apple.com>
 676
 677         Unreviewed mark passing es6 tests as no longer failing.
 678
 679         * tests/es6.yaml:
 680
 681 2016-01-14  Keith Miller  <keith_miller@apple.com>
 682
 683         [ES6] Support subclassing Function.
 684         https://bugs.webkit.org/show_bug.cgi?id=153081
 685
 686         Reviewed by Geoffrey Garen.
 687
 688         This patch enables subclassing the Function object. It also fixes an existing
 689         bug that prevented users from subclassing functions that have a function in
 690         the superclass's prototype property.
 691
 692         * bytecompiler/NodesCodegen.cpp:
 693         (JSC::ClassExprNode::emitBytecode):
 694         * runtime/FunctionConstructor.cpp:
 695         (JSC::constructWithFunctionConstructor):
 696         (JSC::constructFunction):
 697         (JSC::constructFunctionSkippingEvalEnabledCheck):
 698         * runtime/FunctionConstructor.h:
 699         * runtime/JSFunction.cpp:
 700         (JSC::JSFunction::create):
 701         * runtime/JSFunction.h:
 702         (JSC::JSFunction::createImpl):
 703         * runtime/JSFunctionInlines.h:
 704         (JSC::JSFunction::createWithInvalidatedReallocationWatchpoint):
 705         (JSC::JSFunction::JSFunction): Deleted.
 706         * tests/stress/class-subclassing-function.js: Added.
 707
 708 2016-01-13  Carlos Garcia Campos  <cgarcia@igalia.com>
 709
 710         [CMake] Do not use LLVM static libraries for FTL JIT
 711         https://bugs.webkit.org/show_bug.cgi?id=151559
 712
 713         Reviewed by Michael Catanzaro.
 714
 715         Allow ports decide whether to prefer linking to llvm static or
 716         dynamic libraries. This patch only changes the behavior of the GTK
 717         port, other ports can change the default behavior by setting
 718         llvmForJSC_LIBRARIES in their platform specific cmake files.
 719
 720         * CMakeLists.txt: Move llvmForJSC library definition after the
 721         WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS, to allow platform specific
 722         files to set their own llvmForJSC_LIBRARIES. When not set, it
 723         defaults to LLVM_STATIC_LIBRARIES. The command to create
 724         WebKitLLVMLibraryToken.h no longer depends on the static
 725         libraries, since we are going to make the build fail anyway when
 726         not found in case of linking to the static libraries. If platform
 727         specific file defined llvmForJSC_INSTALL_DIR llvmForJSC is also
 728         installed to the given destination.
 729         * PlatformGTK.cmake: Set llvmForJSC_LIBRARIES and
 730         llvmForJSC_INSTALL_DIR.
 731
 732 2016-01-13  Saam barati  <sbarati@apple.com>
 733
 734         NativeExecutable should have a name field
 735         https://bugs.webkit.org/show_bug.cgi?id=153083
 736
 737         Reviewed by Geoffrey Garen.
 738
 739         This is going to help the SamplingProfiler come up
 740         with names for NativeExecutable objects it encounters.
 741
 742         * jit/JITThunks.cpp:
 743         (JSC::JITThunks::finalize):
 744         (JSC::JITThunks::hostFunctionStub):
 745         * jit/JITThunks.h:
 746         * runtime/Executable.h:
 747         * runtime/JSBoundFunction.cpp:
 748         (JSC::JSBoundFunction::create):
 749         * runtime/JSFunction.cpp:
 750         (JSC::JSFunction::create):
 751         (JSC::JSFunction::lookUpOrCreateNativeExecutable):
 752         * runtime/JSFunction.h:
 753         (JSC::JSFunction::createImpl):
 754         * runtime/JSNativeStdFunction.cpp:
 755         (JSC::JSNativeStdFunction::create):
 756         * runtime/VM.cpp:
 757         (JSC::thunkGeneratorForIntrinsic):
 758         (JSC::VM::getHostFunction):
 759         * runtime/VM.h:
 760         (JSC::VM::getCTIStub):
 761         (JSC::VM::exceptionOffset):
 762
 763 2016-01-13  Keith Miller  <keith_miller@apple.com>
 764
 765         [ES6] Support subclassing the String builtin object
 766         https://bugs.webkit.org/show_bug.cgi?id=153068
 767
 768         Reviewed by Michael Saboff.
 769
 770         This patch adds subclassing of strings. Also, this patch fixes a bug where we could have
 771         the wrong indexing type for builtins constructed without storage.
 772
 773         * runtime/PrototypeMap.cpp:
 774         (JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
 775         * runtime/StringConstructor.cpp:
 776         (JSC::constructWithStringConstructor):
 777         * tests/stress/class-subclassing-string.js: Added.
 778         (test):
 779
 780 2016-01-13  Mark Lam  <mark.lam@apple.com>
 781
 782         The StringFromCharCode DFG intrinsic should support untyped operands.
 783         https://bugs.webkit.org/show_bug.cgi?id=153046
 784
 785         Reviewed by Geoffrey Garen.
 786
 787         The current StringFromCharCode DFG intrinsic assumes that its operand charCode
 788         must be an Int32.  This results in 26000+ BadType OSR exits in the LongSpider
 789         crypto-aes benchmark.  With support for Untyped operands, the number of OSR
 790         exits drops to 202.
 791
 792         * dfg/DFGClobberize.h:
 793         (JSC::DFG::clobberize):
 794         * dfg/DFGFixupPhase.cpp:
 795         (JSC::DFG::FixupPhase::fixupNode):
 796         * dfg/DFGOperations.cpp:
 797         * dfg/DFGOperations.h:
 798         * dfg/DFGSpeculativeJIT.cpp:
 799         (JSC::DFG::SpeculativeJIT::compileFromCharCode):
 800         * dfg/DFGSpeculativeJIT.h:
 801         (JSC::DFG::SpeculativeJIT::callOperation):
 802         * dfg/DFGValidate.cpp:
 803         (JSC::DFG::Validate::validate):
 804         * runtime/JSCJSValueInlines.h:
 805         (JSC::JSValue::toUInt32):
 806
 807 2016-01-13  Mark Lam  <mark.lam@apple.com>
 808
 809         Use DFG Graph::binary/unaryArithShouldSpeculateInt32/MachineInt() functions consistently.
 810         https://bugs.webkit.org/show_bug.cgi?id=153080
 811
 812         Reviewed by Geoffrey Garen.
 813
 814         We currently have Graph::mulShouldSpeculateInt32/machineInt() and
 815         Graph::negateShouldSpeculateInt32/MachineInt() functions which are only used by
 816         the ArithMul and ArithNegate nodes.  However, the same tests need to be done for
 817         many other arith nodes in the DFG.  This patch renames these functions as
 818         Graph::binaryArithShouldSpeculateInt32/machineInt() and
 819         Graph::unaryArithShouldSpeculateInt32/MachineInt(), and uses them consistently
 820         in the DFG.
 821
 822         * dfg/DFGFixupPhase.cpp:
 823         (JSC::DFG::FixupPhase::fixupNode):
 824         * dfg/DFGGraph.h:
 825         (JSC::DFG::Graph::addShouldSpeculateMachineInt):
 826         (JSC::DFG::Graph::binaryArithShouldSpeculateInt32):
 827         (JSC::DFG::Graph::binaryArithShouldSpeculateMachineInt):
 828         (JSC::DFG::Graph::unaryArithShouldSpeculateInt32):
 829         (JSC::DFG::Graph::unaryArithShouldSpeculateMachineInt):
 830         (JSC::DFG::Graph::mulShouldSpeculateInt32): Deleted.
 831         (JSC::DFG::Graph::mulShouldSpeculateMachineInt): Deleted.
 832         (JSC::DFG::Graph::negateShouldSpeculateInt32): Deleted.
 833         (JSC::DFG::Graph::negateShouldSpeculateMachineInt): Deleted.
 834         * dfg/DFGPredictionPropagationPhase.cpp:
 835         (JSC::DFG::PredictionPropagationPhase::propagate):
 836         (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
 837
 838 2016-01-13  Joseph Pecoraro  <pecoraro@apple.com>
 839
 840         Web Inspector: Inspector should use the last sourceURL / sourceMappingURL directive
 841         https://bugs.webkit.org/show_bug.cgi?id=153072
 842         <rdar://problem/24168312>
 843
 844         Reviewed by Timothy Hatcher.
 845
 846         * parser/Lexer.cpp:
 847         (JSC::Lexer<T>::parseCommentDirective):
 848         Just keep overwriting the member variable so we end up with
 849         the last directive value.
 850
 851 2016-01-13  Commit Queue  <commit-queue@webkit.org>
 852
 853         Unreviewed, rolling out r194969.
 854         https://bugs.webkit.org/show_bug.cgi?id=153075
 855
 856         This change broke the iOS build (Requested by ryanhaddad on
 857         #webkit).
 858
 859         Reverted changeset:
 860
 861         "[JSC] Legalize Memory Offsets for ARM64 before lowering to
 862         Air"
 863         https://bugs.webkit.org/show_bug.cgi?id=153065
 864         http://trac.webkit.org/changeset/194969
 865
 866 2016-01-13  Benjamin Poulain  <bpoulain@apple.com>
 867
 868         [JSC] Legalize Memory Offsets for ARM64 before lowering to Air
 869         https://bugs.webkit.org/show_bug.cgi?id=153065
 870
 871         Reviewed by Mark Lam.
 872         Reviewed by Filip Pizlo.
 873
 874         On ARM64, we cannot use signed 32bits offset for memory addressing.
 875         There are two available addressing: signed 9bits and unsigned scaled 12bits.
 876         Air already knows about it.
 877
 878         In this patch, the offsets are changed to something valid for ARM64
 879         prior to lowering. When an offset is invalid, it is just computed
 880         before the instruction and used as the base for addressing.
 881
 882         * JavaScriptCore.xcodeproj/project.pbxproj:
 883         * b3/B3Generate.cpp:
 884         (JSC::B3::generateToAir):
 885         * b3/B3LegalizeMemoryOffsets.cpp: Added.
 886         (JSC::B3::legalizeMemoryOffsets):
 887         * b3/B3LegalizeMemoryOffsets.h: Added.
 888         * b3/B3LowerToAir.cpp:
 889         (JSC::B3::Air::LowerToAir::effectiveAddr): Deleted.
 890         * b3/testb3.cpp:
 891         (JSC::B3::testLoadWithOffsetImpl):
 892         (JSC::B3::testLoadOffsetImm9Max):
 893         (JSC::B3::testLoadOffsetImm9MaxPlusOne):
 894         (JSC::B3::testLoadOffsetImm9MaxPlusTwo):
 895         (JSC::B3::testLoadOffsetImm9Min):
 896         (JSC::B3::testLoadOffsetImm9MinMinusOne):
 897         (JSC::B3::testLoadOffsetScaledUnsignedImm12Max):
 898         (JSC::B3::testLoadOffsetScaledUnsignedOverImm12Max):
 899         (JSC::B3::run):
 900
 901 2016-01-12  Per Arne Vollan  <peavo@outlook.com>
 902
 903         [FTL][Win64] Compile error.
 904         https://bugs.webkit.org/show_bug.cgi?id=153031
 905
 906         Reviewed by Brent Fulgham.
 907
 908         The header file dlfcn.h does not exist on Windows.
 909
 910         * ftl/FTLLowerDFGToLLVM.cpp:
 911
 912 2016-01-12  Ryosuke Niwa  <rniwa@webkit.org>
 913
 914         Add a build flag for custom element
 915         https://bugs.webkit.org/show_bug.cgi?id=153005
 916
 917         Reviewed by Alex Christensen.
 918
 919         * Configurations/FeatureDefines.xcconfig:
 920
 921 2016-01-12  Benjamin Poulain  <bpoulain@apple.com>
 922
 923         [JSC] Remove some invalid immediate instruction forms from ARM64 Air
 924         https://bugs.webkit.org/show_bug.cgi?id=153024
 925
 926         Reviewed by Michael Saboff.
 927
 928         * b3/B3BasicBlock.h:
 929         Export the symbols for testb3.
 930
 931         * b3/air/AirOpcode.opcodes:
 932         We had 2 invalid opcodes:
 933         -Compare with immediate just does not exist.
 934         -Test64 with immediate exists but Air does not recognize
 935          the valid form of bit-immediates.
 936
 937         * b3/testb3.cpp:
 938         (JSC::B3::genericTestCompare):
 939         (JSC::B3::testCompareImpl):
 940         Extend the tests to cover what was invalid.
 941
 942 2016-01-12  Benjamin Poulain  <bpoulain@apple.com>
 943
 944         [JSC] JSC does not build with FTL_USES_B3 on ARM64
 945         https://bugs.webkit.org/show_bug.cgi?id=153011
 946
 947         Reviewed by Saam Barati.
 948
 949         Apparently the static const member can only be used for constexpr.
 950         C++ is weird.
 951
 952         * jit/GPRInfo.cpp:
 953         * jit/GPRInfo.h:
 954
 955 2016-01-11  Johan K. Jensen  <jj@johanjensen.dk>
 956
 957         Web Inspector: console.count() shouldn't show a colon in front of a number
 958         https://bugs.webkit.org/show_bug.cgi?id=152038
 959
 960         Reviewed by Brian Burg.
 961
 962         * inspector/agents/InspectorConsoleAgent.cpp:
 963         (Inspector::InspectorConsoleAgent::count):
 964         Do not include title and colon if the title is empty.
 965
 966 2016-01-11  Dan Bernstein  <mitz@apple.com>
 967
 968         Reverted r194317.
 969
 970         Reviewed by Joseph Pecoraro.
 971
 972         r194317 did not contain a change log entry, did not explain the motivation, did not name a
 973         reviewer, and does not seem necessary.
 974
 975         * JavaScriptCore.xcodeproj/project.pbxproj:
 976
 977 2016-01-11  Joseph Pecoraro  <pecoraro@apple.com>
 978
 979         keywords ("super", "delete", etc) should be valid method names
 980         https://bugs.webkit.org/show_bug.cgi?id=144281
 981
 982         Reviewed by Ryosuke Niwa.
 983
 984         * parser/Parser.cpp:
 985         (JSC::Parser<LexerType>::parseClass):
 986         - When parsing "static(" treat it as a method named "static" and not a static method.
 987         - When parsing a keyword treat it like a string method name (get and set are not keywords)
 988         - When parsing a getter / setter method name identifier, allow lookahead to be a keyword
 989
 990         (JSC::Parser<LexerType>::parseGetterSetter):
 991         - When parsing the getter / setter's name, allow it to be a keyword.
 992
 993 2016-01-11  Benjamin Poulain  <bpoulain@apple.com>
 994
 995         [JSC] Add Div/Mod and fix Mul for B3 ARM64
 996         https://bugs.webkit.org/show_bug.cgi?id=152978
 997
 998         Reviewed by Filip Pizlo.
 999
1000         Add the 3 operands forms of Mul.
1001         Remove the form taking immediate on ARM64, there are no such instruction.
1002
1003         Add Div with sdiv.
1004
1005         Unfortunately, I discovered ChillMod's division by zero
1006         makes it non-trivial on ARM64. I just made it into a macro like on x86.
1007
1008         * assembler/MacroAssemblerARM64.h:
1009         (JSC::MacroAssemblerARM64::mul32):
1010         (JSC::MacroAssemblerARM64::mul64):
1011         (JSC::MacroAssemblerARM64::div32):
1012         (JSC::MacroAssemblerARM64::div64):
1013         * b3/B3LowerMacros.cpp:
1014         * b3/B3LowerToAir.cpp:
1015         (JSC::B3::Air::LowerToAir::lower):
1016         * b3/air/AirOpcode.opcodes:
1017
1018 2016-01-11  Keith Miller  <keith_miller@apple.com>
1019
1020         Arrays should use the InternalFunctionAllocationProfile when constructing new Arrays
1021         https://bugs.webkit.org/show_bug.cgi?id=152949
1022
1023         Reviewed by Michael Saboff.
1024
1025         This patch updates Array constructors to use the new InternalFunctionAllocationProfile.
1026
1027         * runtime/ArrayConstructor.cpp:
1028         (JSC::constructArrayWithSizeQuirk):
1029         (JSC::constructWithArrayConstructor):
1030         * runtime/InternalFunction.h:
1031         (JSC::InternalFunction::createStructure):
1032         * runtime/JSGlobalObject.h:
1033         (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation):
1034         (JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation):
1035         (JSC::constructEmptyArray):
1036         (JSC::constructArray):
1037         (JSC::constructArrayNegativeIndexed):
1038         * runtime/PrototypeMap.cpp:
1039         (JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
1040         * runtime/Structure.h:
1041         * runtime/StructureInlines.h:
1042
1043 2016-01-08  Keith Miller  <keith_miller@apple.com>
1044
1045         Use a profile to store allocation structures for subclasses of InternalFunctions
1046         https://bugs.webkit.org/show_bug.cgi?id=152942
1047
1048         Reviewed by Michael Saboff.
1049
1050         This patch adds InternalFunctionAllocationProfile to FunctionRareData, which holds
1051         a cached structure that can be used to quickly allocate any derived class of an InternalFunction.
1052         InternalFunctionAllocationProfile ended up being distinct from ObjectAllocationProfile, due to
1053         constraints imposed by Reflect.construct. Reflect.construct allows the user to pass an arbitrary
1054         constructor as a new.target to any other constructor. This means that a user can pass some
1055         non-derived constructor to an InternalFunction (they can even pass another InternalFunction as the
1056         new.target). If we use the same profile for both InternalFunctions and JS allocations then we always
1057         need to check in both JS code and C++ code that the profiled structure has the same ClassInfo as the
1058         current constructor. By using different profiles, we only need to check the profile in InternalFunctions
1059         as all JS constructed objects share the same ClassInfo (JSFinalObject). This comes at the relatively
1060         low cost of using slightly more memory on FunctionRareData and being slightly more conceptually complex.
1061
1062         Additionally, this patch adds subclassing to some omitted classes.
1063
1064         * API/JSObjectRef.cpp:
1065         (JSObjectMakeDate):
1066         (JSObjectMakeRegExp):
1067         * JavaScriptCore.xcodeproj/project.pbxproj:
1068         * bytecode/InternalFunctionAllocationProfile.h: Added.
1069         (JSC::InternalFunctionAllocationProfile::structure):
1070         (JSC::InternalFunctionAllocationProfile::clear):
1071         (JSC::InternalFunctionAllocationProfile::visitAggregate):
1072         (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
1073         * dfg/DFGByteCodeParser.cpp:
1074         (JSC::DFG::ByteCodeParser::parseBlock):
1075         * dfg/DFGOperations.cpp:
1076         * dfg/DFGSpeculativeJIT32_64.cpp:
1077         (JSC::DFG::SpeculativeJIT::compile):
1078         * dfg/DFGSpeculativeJIT64.cpp:
1079         (JSC::DFG::SpeculativeJIT::compile):
1080         * jit/JITOpcodes.cpp:
1081         (JSC::JIT::emit_op_create_this):
1082         * jit/JITOpcodes32_64.cpp:
1083         (JSC::JIT::emit_op_create_this):
1084         * llint/LowLevelInterpreter32_64.asm:
1085         * llint/LowLevelInterpreter64.asm:
1086         * runtime/BooleanConstructor.cpp:
1087         (JSC::constructWithBooleanConstructor):
1088         * runtime/CommonSlowPaths.cpp:
1089         (JSC::SLOW_PATH_DECL):
1090         * runtime/DateConstructor.cpp:
1091         (JSC::constructDate):
1092         (JSC::constructWithDateConstructor):
1093         * runtime/DateConstructor.h:
1094         * runtime/ErrorConstructor.cpp:
1095         (JSC::Interpreter::constructWithErrorConstructor):
1096         * runtime/FunctionRareData.cpp:
1097         (JSC::FunctionRareData::create):
1098         (JSC::FunctionRareData::visitChildren):
1099         (JSC::FunctionRareData::FunctionRareData):
1100         (JSC::FunctionRareData::initializeObjectAllocationProfile):
1101         (JSC::FunctionRareData::clear):
1102         (JSC::FunctionRareData::finishCreation): Deleted.
1103         (JSC::FunctionRareData::initialize): Deleted.
1104         * runtime/FunctionRareData.h:
1105         (JSC::FunctionRareData::offsetOfObjectAllocationProfile):
1106         (JSC::FunctionRareData::objectAllocationProfile):
1107         (JSC::FunctionRareData::objectAllocationStructure):
1108         (JSC::FunctionRareData::allocationProfileWatchpointSet):
1109         (JSC::FunctionRareData::isObjectAllocationProfileInitialized):
1110         (JSC::FunctionRareData::internalFunctionAllocationStructure):
1111         (JSC::FunctionRareData::createInternalFunctionAllocationStructureFromBase):
1112         (JSC::FunctionRareData::offsetOfAllocationProfile): Deleted.
1113         (JSC::FunctionRareData::allocationProfile): Deleted.
1114         (JSC::FunctionRareData::allocationStructure): Deleted.
1115         (JSC::FunctionRareData::isInitialized): Deleted.
1116         * runtime/InternalFunction.cpp:
1117         (JSC::InternalFunction::createSubclassStructure):
1118         * runtime/InternalFunction.h:
1119         * runtime/JSArrayBufferConstructor.cpp:
1120         (JSC::constructArrayBuffer):
1121         * runtime/JSFunction.cpp:
1122         (JSC::JSFunction::allocateRareData):
1123         (JSC::JSFunction::allocateAndInitializeRareData):
1124         (JSC::JSFunction::initializeRareData):
1125         * runtime/JSFunction.h:
1126         (JSC::JSFunction::rareData):
1127         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
1128         (JSC::constructGenericTypedArrayView):
1129         * runtime/JSObject.h:
1130         (JSC::JSFinalObject::typeInfo):
1131         (JSC::JSFinalObject::createStructure):
1132         * runtime/JSPromiseConstructor.cpp:
1133         (JSC::constructPromise):
1134         * runtime/JSPromiseConstructor.h:
1135         * runtime/JSWeakMap.cpp:
1136         * runtime/JSWeakSet.cpp:
1137         * runtime/MapConstructor.cpp:
1138         (JSC::constructMap):
1139         * runtime/NativeErrorConstructor.cpp:
1140         (JSC::Interpreter::constructWithNativeErrorConstructor):
1141         * runtime/NumberConstructor.cpp:
1142         (JSC::constructWithNumberConstructor):
1143         * runtime/PrototypeMap.cpp:
1144         (JSC::PrototypeMap::createEmptyStructure):
1145         (JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
1146         (JSC::PrototypeMap::emptyObjectStructureForPrototype):
1147         (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
1148         * runtime/PrototypeMap.h:
1149         * runtime/RegExpConstructor.cpp:
1150         (JSC::getRegExpStructure):
1151         (JSC::constructRegExp):
1152         (JSC::constructWithRegExpConstructor):
1153         * runtime/RegExpConstructor.h:
1154         * runtime/SetConstructor.cpp:
1155         (JSC::constructSet):
1156         * runtime/WeakMapConstructor.cpp:
1157         (JSC::constructWeakMap):
1158         * runtime/WeakSetConstructor.cpp:
1159         (JSC::constructWeakSet):
1160         * tests/stress/class-subclassing-misc.js:
1161         (A):
1162         (D):
1163         (E):
1164         (WM):
1165         (WS):
1166         (test):
1167         * tests/stress/class-subclassing-typedarray.js: Added.
1168         (test):
1169
1170 2016-01-11  Per Arne Vollan  <peavo@outlook.com>
1171
1172         [B3][Win64] Compile error.
1173         https://bugs.webkit.org/show_bug.cgi?id=152984
1174
1175         Reviewed by Alex Christensen.
1176
1177         Windows does not have bzero, use memset instead.
1178
1179         * b3/air/AirIteratedRegisterCoalescing.cpp:
1180
1181 2016-01-11  Konstantin Tokarev  <annulen@yandex.ru>
1182
1183         Fixed compilation of JavaScriptCore with GCC 4.8 on 32-bit platforms
1184         https://bugs.webkit.org/show_bug.cgi?id=152923
1185
1186         Reviewed by Alex Christensen.
1187
1188         * jit/CallFrameShuffler.h:
1189         (JSC::CallFrameShuffler::assumeCalleeIsCell):
1190
1191 2016-01-11  Csaba Osztrogonác  <ossy@webkit.org>
1192
1193         [B3] Fix control reaches end of non-void function GCC warnings on Linux
1194         https://bugs.webkit.org/show_bug.cgi?id=152887
1195
1196         Reviewed by Mark Lam.
1197
1198         * b3/B3LowerToAir.cpp:
1199         (JSC::B3::Air::LowerToAir::createBranch):
1200         (JSC::B3::Air::LowerToAir::createCompare):
1201         (JSC::B3::Air::LowerToAir::createSelect):
1202         * b3/B3Type.h:
1203         (JSC::B3::sizeofType):
1204         * b3/air/AirArg.cpp:
1205         (JSC::B3::Air::Arg::isRepresentableAs):
1206         * b3/air/AirArg.h:
1207         (JSC::B3::Air::Arg::isAnyUse):
1208         (JSC::B3::Air::Arg::isColdUse):
1209         (JSC::B3::Air::Arg::isEarlyUse):
1210         (JSC::B3::Air::Arg::isLateUse):
1211         (JSC::B3::Air::Arg::isAnyDef):
1212         (JSC::B3::Air::Arg::isEarlyDef):
1213         (JSC::B3::Air::Arg::isLateDef):
1214         (JSC::B3::Air::Arg::isZDef):
1215         (JSC::B3::Air::Arg::widthForB3Type):
1216         (JSC::B3::Air::Arg::isGP):
1217         (JSC::B3::Air::Arg::isFP):
1218         (JSC::B3::Air::Arg::isType):
1219         (JSC::B3::Air::Arg::isValidForm):
1220         * b3/air/AirCode.h:
1221         (JSC::B3::Air::Code::newTmp):
1222         (JSC::B3::Air::Code::numTmps):
1223
1224 2016-01-11  Filip Pizlo  <fpizlo@apple.com>
1225
1226         Make it easier to introduce exotic instructions to Air
1227         https://bugs.webkit.org/show_bug.cgi?id=152953
1228
1229         Reviewed by Benjamin Poulain.
1230
1231         Currently, you can define new "opcodes" in Air using either:
1232
1233         1) New opcode declared in AirOpcode.opcodes.
1234         2) Patch opcode with a new implementation of Air::Special.
1235
1236         With (1), you are limited to fixed-argument-length instructions. There are other
1237         restrictions as well, like that you can only use the roles that the AirOpcode syntax
1238         supports.
1239
1240         With (2), you can do anything you like, but the instruction will be harder to match
1241         since it will share the same opcode as any other Patch. Also, the instruction will have
1242         the Special argument, which means more busy-work when creating the instruction and
1243         validating it.
1244
1245         This introduces an in-between facility called "custom". This replaces what AirOpcode
1246         previously called "special". A custom instruction is one whose behavior is defined by a
1247         FooCustom struct with some static methods. Calls to those methods are emitted by
1248         opcode_generator.rb.
1249
1250         The "custom" facility is powerful enough to be used to implement Patch, with the caveat
1251         that we now treat the Patch instruction specially in a few places. Those places were
1252         already effectively treating it specially by assuming that only Patch instructions have
1253         a Special as their first argument.
1254
1255         This will let me implement the Shuffle instruction (bug 152952), which I think is needed
1256         for performance work.
1257
1258         * JavaScriptCore.xcodeproj/project.pbxproj:
1259         * b3/air/AirCustom.h: Added.
1260         (JSC::B3::Air::PatchCustom::forEachArg):
1261         (JSC::B3::Air::PatchCustom::isValidFormStatic):
1262         (JSC::B3::Air::PatchCustom::isValidForm):
1263         (JSC::B3::Air::PatchCustom::admitsStack):
1264         (JSC::B3::Air::PatchCustom::hasNonArgNonControlEffects):
1265         (JSC::B3::Air::PatchCustom::generate):
1266         * b3/air/AirHandleCalleeSaves.cpp:
1267         (JSC::B3::Air::handleCalleeSaves):
1268         * b3/air/AirInst.h:
1269         * b3/air/AirInstInlines.h:
1270         (JSC::B3::Air::Inst::forEach):
1271         (JSC::B3::Air::Inst::extraClobberedRegs):
1272         (JSC::B3::Air::Inst::extraEarlyClobberedRegs):
1273         (JSC::B3::Air::Inst::forEachDefWithExtraClobberedRegs):
1274         (JSC::B3::Air::Inst::reportUsedRegisters):
1275         (JSC::B3::Air::Inst::hasSpecial): Deleted.
1276         * b3/air/AirOpcode.opcodes:
1277         * b3/air/AirReportUsedRegisters.cpp:
1278         (JSC::B3::Air::reportUsedRegisters):
1279         * b3/air/opcode_generator.rb:
1280
1281 2016-01-11  Filip Pizlo  <fpizlo@apple.com>
1282
1283         Turn Check(true) into Patchpoint() followed by Oops
1284         https://bugs.webkit.org/show_bug.cgi?id=152968
1285
1286         Reviewed by Benjamin Poulain.
1287
1288         This is an obvious strength reduction to have, especially since if we discover that the
1289         input to the Check is true after some amount of B3 optimization, then stubbing out the rest
1290         of the basic block unlocks CFG simplification opportunities.
1291
1292         It's also a proof-of-concept for the Check->Patchpoint conversion that I'll use once I
1293         implement sinking (bug 152162).
1294
1295         * b3/B3ControlValue.cpp:
1296         (JSC::B3::ControlValue::convertToJump):
1297         (JSC::B3::ControlValue::convertToOops):
1298         (JSC::B3::ControlValue::dumpMeta):
1299         * b3/B3ControlValue.h:
1300         * b3/B3InsertionSet.h:
1301         (JSC::B3::InsertionSet::insertValue):
1302         * b3/B3InsertionSetInlines.h:
1303         (JSC::B3::InsertionSet::insert):
1304         * b3/B3ReduceStrength.cpp:
1305         * b3/B3StackmapValue.h:
1306         * b3/B3Value.h:
1307         * tests/stress/ftl-force-osr-exit.js: Added.
1308
1309 2016-01-11  Benjamin Poulain  <bpoulain@apple.com>
1310
1311         [JSC] When resolving Stack arguments, use addressing from SP when addressing from FP is invalid
1312         https://bugs.webkit.org/show_bug.cgi?id=152840
1313
1314         Reviewed by Mark Lam.
1315
1316         ARM64 has two kinds of addressing with immediates:
1317         -Signed 9bits direct (really only -256 to 255).
1318         -Unsigned 12bits scaled by the load/store size.
1319
1320         When resolving the stack addresses, we easily run
1321         past -256 bytes from FP. Addressing from SP gives us more
1322         room to address the stack efficiently because we can
1323         use unsigned immediates.
1324
1325         * b3/B3StackmapSpecial.cpp:
1326         (JSC::B3::StackmapSpecial::repForArg):
1327         * b3/air/AirAllocateStack.cpp:
1328         (JSC::B3::Air::allocateStack):
1329
1330 2016-01-10  Saam barati  <sbarati@apple.com>
1331
1332         Implement a sampling profiler
1333         https://bugs.webkit.org/show_bug.cgi?id=151713
1334
1335         Reviewed by Filip Pizlo.
1336
1337         This patch implements a sampling profiler for JavaScriptCore
1338         that will be used in the Inspector UI. The implementation works as follows:
1339         We queue the sampling profiler to run a task on a background
1340         thread every 1ms. When the queued task executes, the sampling profiler
1341         will pause the JSC execution thread and attempt to take a stack trace.
1342         The sampling profiler does everything it can to be very careful
1343         while taking this stack trace. Because it's reading arbitrary memory,
1344         the sampling profiler must validate every pointer it reads from.
1345
1346         The sampling profiler tries to get an ExecutableBase for every call frame
1347         it reads. It first tries to read the CodeBlock slot. It does this because
1348         it can be 100% certain that a pointer is a CodeBlock while it's taking a
1349         stack trace. But, not every call frame will have a CodeBlock. So we must read
1350         the call frame's callee. For these stack traces where we read the callee, we
1351         must verify the callee pointer, and the pointer traversal to an ExecutableBase,
1352         on the main JSC execution thread, and not on the thread taking the stack
1353         trace. We do this verification either before we run the marking phase in
1354         GC, or when somebody asks the SamplingProfiler to materialize its data.
1355
1356         The SamplingProfiler must also be careful to not grab any locks while the JSC execution
1357         thread is paused (this means it can't do anything that mallocs) because
1358         that could cause a deadlock. Therefore, the sampling profiler grabs
1359         locks for all data structures it consults before it pauses the JSC
1360         execution thread.
1361
1362         * CMakeLists.txt:
1363         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1364         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1365         * JavaScriptCore.xcodeproj/project.pbxproj:
1366         * bytecode/CodeBlock.h:
1367         (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled):
1368         (JSC::CodeBlockSet::mark):
1369         * dfg/DFGNodeType.h:
1370         * heap/CodeBlockSet.cpp:
1371         (JSC::CodeBlockSet::add):
1372         (JSC::CodeBlockSet::promoteYoungCodeBlocks):
1373         (JSC::CodeBlockSet::clearMarksForFullCollection):
1374         (JSC::CodeBlockSet::lastChanceToFinalize):
1375         (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
1376         (JSC::CodeBlockSet::contains):
1377         (JSC::CodeBlockSet::writeBarrierCurrentlyExecutingCodeBlocks):
1378         (JSC::CodeBlockSet::remove): Deleted.
1379         * heap/CodeBlockSet.h:
1380         (JSC::CodeBlockSet::getLock):
1381         (JSC::CodeBlockSet::iterate):
1382         The sampling pofiler uses the heap's CodeBlockSet to validate
1383         CodeBlock pointers. This data structure must now be under a lock
1384         because we must be certain we're not pausing the JSC execution thread
1385         while it's manipulating this data structure.
1386
1387         * heap/ConservativeRoots.cpp:
1388         (JSC::ConservativeRoots::ConservativeRoots):
1389         (JSC::ConservativeRoots::grow):
1390         (JSC::ConservativeRoots::genericAddPointer):
1391         (JSC::ConservativeRoots::genericAddSpan):
1392         (JSC::ConservativeRoots::add):
1393         (JSC::CompositeMarkHook::CompositeMarkHook):
1394         (JSC::CompositeMarkHook::mark):
1395         * heap/ConservativeRoots.h:
1396         * heap/Heap.cpp:
1397         (JSC::Heap::markRoots):
1398         (JSC::Heap::visitHandleStack):
1399         (JSC::Heap::visitSamplingProfiler):
1400         (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
1401         (JSC::Heap::snapshotMarkedSpace):
1402         * heap/Heap.h:
1403         (JSC::Heap::structureIDTable):
1404         (JSC::Heap::codeBlockSet):
1405         * heap/MachineStackMarker.cpp:
1406         (pthreadSignalHandlerSuspendResume):
1407         (JSC::getCurrentPlatformThread):
1408         (JSC::MachineThreads::MachineThreads):
1409         (JSC::MachineThreads::~MachineThreads):
1410         (JSC::MachineThreads::Thread::createForCurrentThread):
1411         (JSC::MachineThreads::Thread::operator==):
1412         (JSC::isThreadInList):
1413         (JSC::MachineThreads::addCurrentThread):
1414         (JSC::MachineThreads::machineThreadForCurrentThread):
1415         (JSC::MachineThreads::removeThread):
1416         (JSC::MachineThreads::gatherFromCurrentThread):
1417         (JSC::MachineThreads::Thread::Thread):
1418         (JSC::MachineThreads::Thread::~Thread):
1419         (JSC::MachineThreads::Thread::suspend):
1420         (JSC::MachineThreads::Thread::resume):
1421         (JSC::MachineThreads::Thread::getRegisters):
1422         (JSC::MachineThreads::Thread::Registers::stackPointer):
1423         (JSC::MachineThreads::Thread::Registers::framePointer):
1424         (JSC::MachineThreads::Thread::Registers::instructionPointer):
1425         (JSC::MachineThreads::Thread::freeRegisters):
1426         (JSC::MachineThreads::tryCopyOtherThreadStacks):
1427         (JSC::pthreadSignalHandlerSuspendResume): Deleted.
1428         (JSC::MachineThreads::Thread::operator!=): Deleted.
1429         * heap/MachineStackMarker.h:
1430         (JSC::MachineThreads::Thread::operator!=):
1431         (JSC::MachineThreads::getLock):
1432         (JSC::MachineThreads::threadsListHead):
1433         We can now ask a MachineThreads::Thread for its frame pointer
1434         and program counter on darwin and windows platforms. efl
1435         and gtk implementations will happen in another patch.
1436
1437         * heap/MarkedBlockSet.h:
1438         (JSC::MarkedBlockSet::getLock):
1439         (JSC::MarkedBlockSet::add):
1440         (JSC::MarkedBlockSet::remove):
1441         (JSC::MarkedBlockSet::recomputeFilter):
1442         (JSC::MarkedBlockSet::filter):
1443         (JSC::MarkedBlockSet::set):
1444         * heap/MarkedSpace.cpp:
1445         (JSC::Free::Free):
1446         (JSC::Free::operator()):
1447         (JSC::FreeOrShrink::FreeOrShrink):
1448         (JSC::FreeOrShrink::operator()):
1449         (JSC::MarkedSpace::~MarkedSpace):
1450         (JSC::MarkedSpace::isPagedOut):
1451         (JSC::MarkedSpace::freeBlock):
1452         (JSC::MarkedSpace::freeOrShrinkBlock):
1453         (JSC::MarkedSpace::shrink):
1454         * heap/MarkedSpace.h:
1455         (JSC::MarkedSpace::forEachLiveCell):
1456         (JSC::MarkedSpace::forEachDeadCell):
1457         * interpreter/CallFrame.h:
1458         (JSC::ExecState::calleeAsValue):
1459         (JSC::ExecState::callee):
1460         (JSC::ExecState::unsafeCallee):
1461         (JSC::ExecState::codeBlock):
1462         (JSC::ExecState::scope):
1463         * jit/ExecutableAllocator.cpp:
1464         (JSC::ExecutableAllocator::dumpProfile):
1465         (JSC::ExecutableAllocator::getLock):
1466         (JSC::ExecutableAllocator::isValidExecutableMemory):
1467         * jit/ExecutableAllocator.h:
1468         * jit/ExecutableAllocatorFixedVMPool.cpp:
1469         (JSC::ExecutableAllocator::allocate):
1470         (JSC::ExecutableAllocator::isValidExecutableMemory):
1471         (JSC::ExecutableAllocator::getLock):
1472         (JSC::ExecutableAllocator::committedByteCount):
1473         The sampling profiler consults the ExecutableAllocator to check
1474         if the frame pointer it reads is in executable allocated memory.
1475
1476         * jsc.cpp:
1477         (GlobalObject::finishCreation):
1478         (functionCheckModuleSyntax):
1479         (functionStartSamplingProfiler):
1480         (functionSamplingProfilerStackTraces):
1481         * llint/LLIntPCRanges.h: Added.
1482         (JSC::LLInt::isLLIntPC):
1483         * offlineasm/asm.rb:
1484         I added the ability to test whether the PC is executing
1485         LLInt code because this code is not part of the memory
1486         our executable allocator allocates.
1487
1488         * runtime/Executable.h:
1489         (JSC::ExecutableBase::isModuleProgramExecutable):
1490         (JSC::ExecutableBase::isExecutableType):
1491         (JSC::ExecutableBase::isHostFunction):
1492         * runtime/JSLock.cpp:
1493         (JSC::JSLock::didAcquireLock):
1494         (JSC::JSLock::unlock):
1495         * runtime/Options.h:
1496         * runtime/SamplingProfiler.cpp: Added.
1497         (JSC::reportStats):
1498         (JSC::FrameWalker::FrameWalker):
1499         (JSC::FrameWalker::walk):
1500         (JSC::FrameWalker::wasValidWalk):
1501         (JSC::FrameWalker::advanceToParentFrame):
1502         (JSC::FrameWalker::isAtTop):
1503         (JSC::FrameWalker::resetAtMachineFrame):
1504         (JSC::FrameWalker::isValidFramePointer):
1505         (JSC::FrameWalker::isValidCodeBlock):
1506         (JSC::FrameWalker::tryToGetExecutableFromCallee):
1507         The FrameWalker class is used to walk the stack in a safe
1508         manner. It doesn't do anything that would deadlock, and it
1509         validates all pointers that it sees.
1510
1511         (JSC::SamplingProfiler::SamplingProfiler):
1512         (JSC::SamplingProfiler::~SamplingProfiler):
1513         (JSC::SamplingProfiler::visit):
1514         (JSC::SamplingProfiler::shutdown):
1515         (JSC::SamplingProfiler::start):
1516         (JSC::SamplingProfiler::stop):
1517         (JSC::SamplingProfiler::pause):
1518         (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread):
1519         (JSC::SamplingProfiler::dispatchIfNecessary):
1520         (JSC::SamplingProfiler::dispatchFunction):
1521         (JSC::SamplingProfiler::noticeJSLockAcquisition):
1522         (JSC::SamplingProfiler::noticeVMEntry):
1523         (JSC::SamplingProfiler::observeStackTrace):
1524         (JSC::SamplingProfiler::clearData):
1525         (JSC::displayName):
1526         (JSC::startLine):
1527         (JSC::startColumn):
1528         (JSC::sourceID):
1529         (JSC::url):
1530         (JSC::SamplingProfiler::stacktracesAsJSON):
1531         * runtime/SamplingProfiler.h: Added.
1532         (JSC::SamplingProfiler::getLock):
1533         (JSC::SamplingProfiler::setTimingInterval):
1534         (JSC::SamplingProfiler::stackTraces):
1535         * runtime/VM.cpp:
1536         (JSC::VM::VM):
1537         (JSC::VM::~VM):
1538         (JSC::VM::setLastStackTop):
1539         (JSC::VM::createContextGroup):
1540         (JSC::VM::ensureWatchdog):
1541         (JSC::VM::ensureSamplingProfiler):
1542         (JSC::thunkGeneratorForIntrinsic):
1543         * runtime/VM.h:
1544         (JSC::VM::watchdog):
1545         (JSC::VM::isSafeToRecurse):
1546         (JSC::VM::lastStackTop):
1547         (JSC::VM::scratchBufferForSize):
1548         (JSC::VM::samplingProfiler):
1549         (JSC::VM::setShouldRewriteConstAsVar):
1550         (JSC::VM::setLastStackTop): Deleted.
1551         * runtime/VMEntryScope.cpp:
1552         (JSC::VMEntryScope::VMEntryScope):
1553         * tests/stress/sampling-profiler: Added.
1554         * tests/stress/sampling-profiler-anonymous-function.js: Added.
1555         (foo):
1556         (baz):
1557         * tests/stress/sampling-profiler-basic.js: Added.
1558         (bar):
1559         (foo):
1560         (nothing):
1561         (top):
1562         (jaz):
1563         (kaz):
1564         (checkInlining):
1565         * tests/stress/sampling-profiler-deep-stack.js: Added.
1566         (foo):
1567         (hellaDeep):
1568         (start):
1569         * tests/stress/sampling-profiler-microtasks.js: Added.
1570         (testResults):
1571         (loop.jaz):
1572         (loop):
1573         * tests/stress/sampling-profiler/samplingProfiler.js: Added.
1574         (assert):
1575         (let.nodePrototype.makeChildIfNeeded):
1576         (makeNode):
1577         (updateCallingContextTree):
1578         (doesTreeHaveStackTrace):
1579         (makeTree):
1580         (runTest):
1581         (dumpTree):
1582         * tools/JSDollarVMPrototype.cpp:
1583         (JSC::JSDollarVMPrototype::isInObjectSpace):
1584         (JSC::JSDollarVMPrototype::isInStorageSpace):
1585         * yarr/YarrJIT.cpp:
1586         (JSC::Yarr::YarrGenerator::generateEnter):
1587         (JSC::Yarr::YarrGenerator::generateReturn):
1588         (JSC::Yarr::YarrGenerator::YarrGenerator):
1589         (JSC::Yarr::YarrGenerator::compile):
1590         (JSC::Yarr::jitCompile):
1591         We now have a boolean that's set to true when
1592         we're executing a RegExp, and to false otherwise.
1593         The boolean lives off of VM.
1594
1595         * CMakeLists.txt:
1596         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1597         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1598         * JavaScriptCore.xcodeproj/project.pbxproj:
1599         * bytecode/CodeBlock.h:
1600         (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled):
1601         (JSC::CodeBlockSet::mark):
1602         * dfg/DFGNodeType.h:
1603         * heap/CodeBlockSet.cpp:
1604         (JSC::CodeBlockSet::add):
1605         (JSC::CodeBlockSet::promoteYoungCodeBlocks):
1606         (JSC::CodeBlockSet::clearMarksForFullCollection):
1607         (JSC::CodeBlockSet::lastChanceToFinalize):
1608         (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
1609         (JSC::CodeBlockSet::contains):
1610         (JSC::CodeBlockSet::writeBarrierCurrentlyExecutingCodeBlocks):
1611         (JSC::CodeBlockSet::remove): Deleted.
1612         * heap/CodeBlockSet.h:
1613         (JSC::CodeBlockSet::getLock):
1614         (JSC::CodeBlockSet::iterate):
1615         * heap/ConservativeRoots.cpp:
1616         (JSC::ConservativeRoots::ConservativeRoots):
1617         (JSC::ConservativeRoots::genericAddPointer):
1618         (JSC::ConservativeRoots::add):
1619         (JSC::CompositeMarkHook::CompositeMarkHook):
1620         (JSC::CompositeMarkHook::mark):
1621         * heap/ConservativeRoots.h:
1622         * heap/Heap.cpp:
1623         (JSC::Heap::markRoots):
1624         (JSC::Heap::visitHandleStack):
1625         (JSC::Heap::visitSamplingProfiler):
1626         (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
1627         * heap/Heap.h:
1628         (JSC::Heap::structureIDTable):
1629         (JSC::Heap::codeBlockSet):
1630         * heap/HeapInlines.h:
1631         (JSC::Heap::didFreeBlock):
1632         (JSC::Heap::isPointerGCObject):
1633         (JSC::Heap::isValueGCObject):
1634         * heap/MachineStackMarker.cpp:
1635         (pthreadSignalHandlerSuspendResume):
1636         (JSC::getCurrentPlatformThread):
1637         (JSC::MachineThreads::MachineThreads):
1638         (JSC::MachineThreads::~MachineThreads):
1639         (JSC::MachineThreads::Thread::createForCurrentThread):
1640         (JSC::MachineThreads::Thread::operator==):
1641         (JSC::isThreadInList):
1642         (JSC::MachineThreads::addCurrentThread):
1643         (JSC::MachineThreads::machineThreadForCurrentThread):
1644         (JSC::MachineThreads::removeThread):
1645         (JSC::MachineThreads::gatherFromCurrentThread):
1646         (JSC::MachineThreads::Thread::Thread):
1647         (JSC::MachineThreads::Thread::~Thread):
1648         (JSC::MachineThreads::Thread::suspend):
1649         (JSC::MachineThreads::Thread::resume):
1650         (JSC::MachineThreads::Thread::getRegisters):
1651         (JSC::MachineThreads::Thread::Registers::stackPointer):
1652         (JSC::MachineThreads::Thread::Registers::framePointer):
1653         (JSC::MachineThreads::Thread::Registers::instructionPointer):
1654         (JSC::MachineThreads::Thread::freeRegisters):
1655         (JSC::pthreadSignalHandlerSuspendResume): Deleted.
1656         (JSC::MachineThreads::Thread::operator!=): Deleted.
1657         * heap/MachineStackMarker.h:
1658         (JSC::MachineThreads::Thread::operator!=):
1659         (JSC::MachineThreads::getLock):
1660         (JSC::MachineThreads::threadsListHead):
1661         * heap/MarkedBlockSet.h:
1662         * heap/MarkedSpace.cpp:
1663         (JSC::Free::Free):
1664         (JSC::Free::operator()):
1665         (JSC::FreeOrShrink::FreeOrShrink):
1666         (JSC::FreeOrShrink::operator()):
1667         * interpreter/CallFrame.h:
1668         (JSC::ExecState::calleeAsValue):
1669         (JSC::ExecState::callee):
1670         (JSC::ExecState::unsafeCallee):
1671         (JSC::ExecState::codeBlock):
1672         (JSC::ExecState::scope):
1673         * jit/ExecutableAllocator.cpp:
1674         (JSC::ExecutableAllocator::dumpProfile):
1675         (JSC::ExecutableAllocator::getLock):
1676         (JSC::ExecutableAllocator::isValidExecutableMemory):
1677         * jit/ExecutableAllocator.h:
1678         * jit/ExecutableAllocatorFixedVMPool.cpp:
1679         (JSC::ExecutableAllocator::allocate):
1680         (JSC::ExecutableAllocator::isValidExecutableMemory):
1681         (JSC::ExecutableAllocator::getLock):
1682         (JSC::ExecutableAllocator::committedByteCount):
1683         * jsc.cpp:
1684         (GlobalObject::finishCreation):
1685         (functionCheckModuleSyntax):
1686         (functionPlatformSupportsSamplingProfiler):
1687         (functionStartSamplingProfiler):
1688         (functionSamplingProfilerStackTraces):
1689         * llint/LLIntPCRanges.h: Added.
1690         (JSC::LLInt::isLLIntPC):
1691         * offlineasm/asm.rb:
1692         * runtime/Executable.h:
1693         (JSC::ExecutableBase::isModuleProgramExecutable):
1694         (JSC::ExecutableBase::isExecutableType):
1695         (JSC::ExecutableBase::isHostFunction):
1696         * runtime/JSLock.cpp:
1697         (JSC::JSLock::didAcquireLock):
1698         (JSC::JSLock::unlock):
1699         * runtime/Options.h:
1700         * runtime/SamplingProfiler.cpp: Added.
1701         (JSC::reportStats):
1702         (JSC::FrameWalker::FrameWalker):
1703         (JSC::FrameWalker::walk):
1704         (JSC::FrameWalker::wasValidWalk):
1705         (JSC::FrameWalker::advanceToParentFrame):
1706         (JSC::FrameWalker::isAtTop):
1707         (JSC::FrameWalker::resetAtMachineFrame):
1708         (JSC::FrameWalker::isValidFramePointer):
1709         (JSC::FrameWalker::isValidCodeBlock):
1710         (JSC::SamplingProfiler::SamplingProfiler):
1711         (JSC::SamplingProfiler::~SamplingProfiler):
1712         (JSC::SamplingProfiler::processUnverifiedStackTraces):
1713         (JSC::SamplingProfiler::visit):
1714         (JSC::SamplingProfiler::shutdown):
1715         (JSC::SamplingProfiler::start):
1716         (JSC::SamplingProfiler::stop):
1717         (JSC::SamplingProfiler::pause):
1718         (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread):
1719         (JSC::SamplingProfiler::dispatchIfNecessary):
1720         (JSC::SamplingProfiler::dispatchFunction):
1721         (JSC::SamplingProfiler::noticeJSLockAcquisition):
1722         (JSC::SamplingProfiler::noticeVMEntry):
1723         (JSC::SamplingProfiler::clearData):
1724         (JSC::displayName):
1725         (JSC::SamplingProfiler::stacktracesAsJSON):
1726         (WTF::printInternal):
1727         * runtime/SamplingProfiler.h: Added.
1728         (JSC::SamplingProfiler::StackFrame::StackFrame):
1729         (JSC::SamplingProfiler::getLock):
1730         (JSC::SamplingProfiler::setTimingInterval):
1731         (JSC::SamplingProfiler::stackTraces):
1732         * runtime/VM.cpp:
1733         (JSC::VM::VM):
1734         (JSC::VM::~VM):
1735         (JSC::VM::setLastStackTop):
1736         (JSC::VM::createContextGroup):
1737         (JSC::VM::ensureWatchdog):
1738         (JSC::VM::ensureSamplingProfiler):
1739         (JSC::thunkGeneratorForIntrinsic):
1740         * runtime/VM.h:
1741         (JSC::VM::watchdog):
1742         (JSC::VM::samplingProfiler):
1743         (JSC::VM::isSafeToRecurse):
1744         (JSC::VM::lastStackTop):
1745         (JSC::VM::scratchBufferForSize):
1746         (JSC::VM::setLastStackTop): Deleted.
1747         * runtime/VMEntryScope.cpp:
1748         (JSC::VMEntryScope::VMEntryScope):
1749         * tests/stress/sampling-profiler: Added.
1750         * tests/stress/sampling-profiler-anonymous-function.js: Added.
1751         (platformSupportsSamplingProfiler.foo):
1752         (platformSupportsSamplingProfiler.baz):
1753         (platformSupportsSamplingProfiler):
1754         * tests/stress/sampling-profiler-basic.js: Added.
1755         (platformSupportsSamplingProfiler.bar):
1756         (platformSupportsSamplingProfiler.foo):
1757         (platformSupportsSamplingProfiler.nothing):
1758         (platformSupportsSamplingProfiler.top):
1759         (platformSupportsSamplingProfiler.jaz):
1760         (platformSupportsSamplingProfiler.kaz):
1761         (platformSupportsSamplingProfiler.checkInlining):
1762         (platformSupportsSamplingProfiler):
1763         * tests/stress/sampling-profiler-deep-stack.js: Added.
1764         (platformSupportsSamplingProfiler.foo):
1765         (platformSupportsSamplingProfiler.let.hellaDeep):
1766         (platformSupportsSamplingProfiler.let.start):
1767         (platformSupportsSamplingProfiler):
1768         * tests/stress/sampling-profiler-microtasks.js: Added.
1769         (platformSupportsSamplingProfiler.testResults):
1770         (platformSupportsSamplingProfiler):
1771         (platformSupportsSamplingProfiler.loop.jaz):
1772         (platformSupportsSamplingProfiler.loop):
1773         * tests/stress/sampling-profiler/samplingProfiler.js: Added.
1774         (assert):
1775         (let.nodePrototype.makeChildIfNeeded):
1776         (makeNode):
1777         (updateCallingContextTree):
1778         (doesTreeHaveStackTrace):
1779         (makeTree):
1780         (runTest):
1781         (dumpTree):
1782         * yarr/YarrJIT.cpp:
1783         (JSC::Yarr::YarrGenerator::generateEnter):
1784         (JSC::Yarr::YarrGenerator::generateReturn):
1785         (JSC::Yarr::YarrGenerator::YarrGenerator):
1786         (JSC::Yarr::YarrGenerator::compile):
1787         (JSC::Yarr::jitCompile):
1788
1789 2016-01-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1790
1791         [JSC] Iterating over a Set/Map is too slow
1792         https://bugs.webkit.org/show_bug.cgi?id=152691
1793
1794         Reviewed by Saam Barati.
1795
1796         Set#forEach and Set & for-of are very slow. There are 2 reasons.
1797
1798         1. forEach is implemented in C++. And typically, taking JS callback and calling it from C++.
1799
1800         C++ to JS transition seems costly. perf result in Linux machine shows this.
1801
1802             Samples: 23K of event 'cycles', Event count (approx.): 21446074385
1803             34.04%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::Interpreter::execute(JSC::CallFrameClosure&)
1804             20.48%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] vmEntryToJavaScript
1805              9.80%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
1806              7.95%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::setProtoFuncForEach(JSC::ExecState*)
1807              5.65%  jsc  perf-22854.map                      [.] 0x00007f5d2c204a6f
1808
1809         Writing forEach in JS eliminates this.
1810
1811             Samples: 23K of event 'cycles', Event count (approx.): 21255691651
1812             62.91%  jsc  perf-22890.map                      [.] 0x00007fd117c0a3b9
1813             24.89%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::privateFuncSetIteratorNext(JSC::ExecState*)
1814              0.29%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::CodeBlock::updateAllPredictionsAndCountLiveness(unsigned int&, unsigned int&)
1815              0.24%  jsc  [vdso]                              [.] 0x00000000000008e8
1816              0.22%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::CodeBlock::predictedMachineCodeSize()
1817              0.16%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] WTF::MetaAllocator::currentStatistics()
1818              0.15%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::Lexer<unsigned char>::lex(JSC::JSToken*, unsigned int, bool)
1819
1820         2. Iterator result object allocation is costly.
1821
1822         Iterator result object allocation is costly. Even if the (1) is solved, when executing Set & for-of, perf result shows very slow performance due to (2).
1823
1824             Samples: 108K of event 'cycles', Event count (approx.): 95529273748
1825             18.02%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::createIteratorResultObject(JSC::ExecState*, JSC::JSValue, bool)
1826             15.68%  jsc  jsc                                 [.] JSC::JSObject::putDirect(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int)
1827             14.18%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::PrototypeMap::emptyObjectStructureForPrototype(JSC::JSObject*, unsigned int)
1828             13.40%  jsc  perf-25420.map                      [.] 0x00007fce158006a1
1829              6.79%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::StructureTransitionTable::get(WTF::UniquedStringImpl*, unsigned int) const
1830
1831         In the long term, we should implement SetIterator#next in JS and make the iterator result object allocation written in JS to encourage object allocation elimination in FTL.
1832         But seeing the perf result, we can find the easy to fix bottleneck in the current implementation.
1833         Every time createIteratorResultObject creates the empty object and use putDirect to store properties.
1834         The pre-baked Structure* with `done` and `value` properties makes this implementation fast.
1835
1836         After these improvements, the micro benchmark[1] shows the following.
1837
1838         old:
1839             Linked List x 212,776 ops/sec ±0.21% (162 runs sampled)
1840             Array x 376,156 ops/sec ±0.20% (162 runs sampled)
1841             Array forEach x 17,345 ops/sec ±0.99% (137 runs sampled)
1842             Array for-of x 16,518 ops/sec ±0.58% (160 runs sampled)
1843             Set forEach x 13,263 ops/sec ±0.20% (162 runs sampled)
1844             Set for-of x 4,732 ops/sec ±0.34% (123 runs sampled)
1845
1846         new:
1847             Linked List x 210,833 ops/sec ±0.28% (161 runs sampled)
1848             Array x 371,347 ops/sec ±0.36% (162 runs sampled)
1849             Array forEach x 17,460 ops/sec ±0.84% (136 runs sampled)
1850             Array for-of x 16,188 ops/sec ±1.27% (158 runs sampled)
1851             Set forEach x 23,684 ops/sec ±2.46% (139 runs sampled)
1852             Set for-of x 12,176 ops/sec ±0.54% (157 runs sampled)
1853
1854         Set#forEach becomes comparable to Array#forEach. And Set#forEach and Set & for-of are improved (1.79x, and 2.57x).
1855         After this optimizations, they are still much slower than linked list and array.
1856         This should be optimized in the long term.
1857
1858         [1]: https://gist.github.com/Constellation/8db5f5b8f12fe7e283d0
1859
1860         * CMakeLists.txt:
1861         * DerivedSources.make:
1862         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1863         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1864         * JavaScriptCore.xcodeproj/project.pbxproj:
1865         * builtins/MapPrototype.js: Copied from Source/JavaScriptCore/runtime/IteratorOperations.h.
1866         (forEach):
1867         * builtins/SetPrototype.js: Copied from Source/JavaScriptCore/runtime/IteratorOperations.h.
1868         (forEach):
1869         * runtime/CommonIdentifiers.h:
1870         * runtime/IteratorOperations.cpp:
1871         (JSC::createIteratorResultObjectStructure):
1872         (JSC::createIteratorResultObject):
1873         * runtime/IteratorOperations.h:
1874         * runtime/JSGlobalObject.cpp:
1875         (JSC::JSGlobalObject::init):
1876         (JSC::JSGlobalObject::visitChildren):
1877         * runtime/JSGlobalObject.h:
1878         (JSC::JSGlobalObject::iteratorResultObjectStructure):
1879         (JSC::JSGlobalObject::iteratorResultStructure): Deleted.
1880         (JSC::JSGlobalObject::iteratorResultStructureOffset): Deleted.
1881         * runtime/MapPrototype.cpp:
1882         (JSC::MapPrototype::getOwnPropertySlot):
1883         (JSC::privateFuncIsMap):
1884         (JSC::privateFuncMapIterator):
1885         (JSC::privateFuncMapIteratorNext):
1886         (JSC::MapPrototype::finishCreation): Deleted.
1887         (JSC::mapProtoFuncForEach): Deleted.
1888         * runtime/MapPrototype.h:
1889         * runtime/SetPrototype.cpp:
1890         (JSC::SetPrototype::getOwnPropertySlot):
1891         (JSC::privateFuncIsSet):
1892         (JSC::privateFuncSetIterator):
1893         (JSC::privateFuncSetIteratorNext):
1894         (JSC::SetPrototype::finishCreation): Deleted.
1895         (JSC::setProtoFuncForEach): Deleted.
1896         * runtime/SetPrototype.h:
1897
1898 2016-01-10  Filip Pizlo  <fpizlo@apple.com>
1899
1900         Unreviewed, fix ARM64 build.
1901
1902         * b3/air/AirOpcode.opcodes:
1903
1904 2016-01-10  Filip Pizlo  <fpizlo@apple.com>
1905
1906         B3 should reduce Trunc(BitOr(value, constant)) where !(constant & 0xffffffff) to Trunc(value)
1907         https://bugs.webkit.org/show_bug.cgi?id=152955
1908
1909         Reviewed by Saam Barati.
1910
1911         This happens when we box an int32 and then immediately unbox it.
1912
1913         This makes an enormous difference on AsmBench/FloatMM. It's a 2x speed-up on that
1914         benchmark. It's neutral elsewhere.
1915
1916         * b3/B3ReduceStrength.cpp:
1917         * b3/testb3.cpp:
1918         (JSC::B3::testPowDoubleByIntegerLoop):
1919         (JSC::B3::testTruncOrHigh):
1920         (JSC::B3::testTruncOrLow):
1921         (JSC::B3::testBitAndOrHigh):
1922         (JSC::B3::testBitAndOrLow):
1923         (JSC::B3::zero):
1924         (JSC::B3::run):
1925
1926 2016-01-10  Skachkov Oleksandr  <gskachkov@gmail.com>
1927
1928         [ES6] Arrow function syntax. Get rid of JSArrowFunction and use standard JSFunction class
1929         https://bugs.webkit.org/show_bug.cgi?id=149855
1930
1931         Reviewed by Saam Barati.
1932
1933         JSArrowFunction.h/cpp were removed from JavaScriptCore, because now is used new approach for storing
1934         'this', 'arguments' and 'super'
1935
1936         * CMakeLists.txt:
1937         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1938         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1939         * JavaScriptCore.xcodeproj/project.pbxproj:
1940         * dfg/DFGAbstractInterpreterInlines.h:
1941         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1942         * dfg/DFGSpeculativeJIT.cpp:
1943         (JSC::DFG::SpeculativeJIT::compileNewFunction):
1944         * dfg/DFGStructureRegistrationPhase.cpp:
1945         (JSC::DFG::StructureRegistrationPhase::run):
1946         * ftl/FTLAbstractHeapRepository.cpp:
1947         * ftl/FTLAbstractHeapRepository.h:
1948         * ftl/FTLLowerDFGToLLVM.cpp:
1949         (JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction):
1950         * interpreter/Interpreter.cpp:
1951         * interpreter/Interpreter.h:
1952         * jit/JITOpcodes.cpp:
1953         * jit/JITOpcodes32_64.cpp:
1954         * jit/JITOperations.cpp:
1955         * jit/JITOperations.h:
1956         * llint/LLIntOffsetsExtractor.cpp:
1957         * llint/LLIntSlowPaths.cpp:
1958         * runtime/JSArrowFunction.cpp: Removed.
1959         * runtime/JSArrowFunction.h: Removed.
1960         * runtime/JSGlobalObject.cpp:
1961         * runtime/JSGlobalObject.h:
1962
1963 2016-01-10  Filip Pizlo  <fpizlo@apple.com>
1964
1965         It should be possible to run liveness over registers without also tracking Tmps
1966         https://bugs.webkit.org/show_bug.cgi?id=152963
1967
1968         Reviewed by Saam Barati.
1969
1970         This adds a RegLivenessAdapter so that we can run Liveness over registers. This makes it
1971         easier to write certain kinds of phases, like ReportUsedRegisters. I anticipate writing more
1972         code like that for handling cold function calls. It also makes code like that somewhat more
1973         scalable, since we're no longer using HashSets.
1974
1975         Currently, the way we track sets of registers is with a BitVector. Normally, we use the
1976         RegisterSet class, which wraps BitVector, so that we can add()/contains() on Reg's. But in
1977         the liveness analysis, everything gets turned into an index. So, we want to use BitVector
1978         directly. To do that, I needed to make the BitVector API look a bit more like a set API. I
1979         think that this is good, because the lack of set methods (add/remove/contains) has caused
1980         bugs in the past. This makes BitVector have methods both for set operations on bits and array
1981         operations on bits. I think that's good, since BitVector gets used in both contexts.
1982
1983         * b3/B3IndexSet.h:
1984         (JSC::B3::IndexSet::Iterable::iterator::iterator):
1985         (JSC::B3::IndexSet::Iterable::begin):
1986         (JSC::B3::IndexSet::dump):
1987         * b3/air/AirInstInlines.h:
1988         (JSC::B3::Air::ForEach<Tmp>::forEach):
1989         (JSC::B3::Air::ForEach<Arg>::forEach):
1990         (JSC::B3::Air::ForEach<Reg>::forEach):
1991         (JSC::B3::Air::Inst::forEach):
1992         * b3/air/AirLiveness.h:
1993         (JSC::B3::Air::RegLivenessAdapter::RegLivenessAdapter):
1994         (JSC::B3::Air::RegLivenessAdapter::maxIndex):
1995         (JSC::B3::Air::RegLivenessAdapter::acceptsType):
1996         (JSC::B3::Air::RegLivenessAdapter::valueToIndex):
1997         (JSC::B3::Air::RegLivenessAdapter::indexToValue):
1998         * b3/air/AirReportUsedRegisters.cpp:
1999         (JSC::B3::Air::reportUsedRegisters):
2000         * jit/Reg.h:
2001         (JSC::Reg::next):
2002         (JSC::Reg::index):
2003         (JSC::Reg::maxIndex):
2004         (JSC::Reg::isSet):
2005         (JSC::Reg::operator bool):
2006         * jit/RegisterSet.h:
2007         (JSC::RegisterSet::forEach):
2008
2009 2016-01-10  Benjamin Poulain  <bpoulain@apple.com>
2010
2011         [JSC] Make branchMul functional in ARM B3 and minor fixes
2012         https://bugs.webkit.org/show_bug.cgi?id=152889
2013
2014         Reviewed by Mark Lam.
2015
2016         ARM64 does not have a "S" version of MUL setting the flags.
2017         What we do is abstract that in the MacroAssembler. The problem
2018         is that form requires scratch registers.
2019
2020         For simplicity, I just exposed the two scratch registers
2021         for Air. Filip already added the concept of Scratch role,
2022         all I needed was to expose it for opcodes.
2023
2024         * assembler/MacroAssemblerARM64.h:
2025         (JSC::MacroAssemblerARM64::branchMul32):
2026         (JSC::MacroAssemblerARM64::branchMul64):
2027         Expose a version with the scratch registers as arguments.
2028
2029         * b3/B3LowerToAir.cpp:
2030         (JSC::B3::Air::LowerToAir::lower):
2031         Add the new form of CheckMul lowering.
2032
2033         * b3/air/AirOpcode.opcodes:
2034         Expose the new BranchMuls.
2035         Remove all the Test variants that use immediates
2036         since Air can't handle those immediates correctly yet.
2037
2038         * b3/air/opcode_generator.rb:
2039         Expose the Scratch role.
2040
2041         * b3/testb3.cpp:
2042         (JSC::B3::testPatchpointLotsOfLateAnys):
2043         Ooops, the scratch registers were not clobbered. We were just lucky
2044         on x86.
2045
2046 2016-01-10  Benjamin Poulain  <bpoulain@apple.com>
2047
2048         [JSC] B3 is unable to do function calls on ARM64
2049         https://bugs.webkit.org/show_bug.cgi?id=152895
2050
2051         Reviewed by Mark Lam.
2052
2053         Apparently iOS does not follow the ARM64 ABI for function calls.
2054         Instead of giving each value a 8 bytes slot, it must be packed
2055         while preserving alignment.
2056
2057         This patch adds a #ifdef to make function calls functional.
2058
2059         * b3/B3LowerToAir.cpp:
2060         (JSC::B3::Air::LowerToAir::marshallCCallArgument):
2061         (JSC::B3::Air::LowerToAir::lower):
2062
2063 2016-01-09  Filip Pizlo  <fpizlo@apple.com>
2064
2065         Air should support Branch64 with immediates
2066         https://bugs.webkit.org/show_bug.cgi?id=152951
2067
2068         Reviewed by Oliver Hunt.
2069
2070         This doesn't significantly improve performance on any benchmarks, but it's great to get this
2071         obvious omission out of the way.
2072
2073         * assembler/MacroAssemblerX86_64.h:
2074         (JSC::MacroAssemblerX86_64::branch64):
2075         * b3/air/AirOpcode.opcodes:
2076         * b3/testb3.cpp:
2077         (JSC::B3::testPowDoubleByIntegerLoop):
2078         (JSC::B3::testBranch64Equal):
2079         (JSC::B3::testBranch64EqualImm):
2080         (JSC::B3::testBranch64EqualMem):
2081         (JSC::B3::testBranch64EqualMemImm):
2082         (JSC::B3::zero):
2083         (JSC::B3::run):
2084
2085 2016-01-09  Dan Bernstein  <mitz@apple.com>
2086
2087         [Cocoa] Allow overriding the frameworks directory independently of using a staging install path
2088         https://bugs.webkit.org/show_bug.cgi?id=152926
2089
2090         Reviewed by Tim Horton.
2091
2092         Introduce a new build setting, WK_OVERRIDE_FRAMEWORKS_DIR. When not empty, it determines
2093         where the frameworks are installed. Setting USE_STAGING_INSTALL_PATH to YES sets
2094         WK_OVERRIDE_FRAMEWORKS_DIR to $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari.
2095
2096         Account for the possibility of WK_OVERRIDE_FRAMEWORKS_DIR containing spaces.
2097
2098         * Configurations/Base.xcconfig:
2099         - Replace STAGED_FRAMEWORKS_SEARCH_PATH in FRAMEWORK_SEARCH_PATHS with
2100           WK_OVERRIDE_FRAMEWORKS_DIR and add quotes to account for spaces.
2101         - Define JAVASCRIPTCORE_FRAMEWORKS_DIR based on WK_OVERRIDE_FRAMEWORKS_DIR.
2102         * Configurations/JSC.xcconfig:
2103           Add quotes to account for spaces.
2104         * Configurations/ToolExecutable.xcconfig:
2105           Ditto.
2106         * postprocess-headers.sh:
2107           Ditto.
2108
2109 2016-01-09  Mark Lam  <mark.lam@apple.com>
2110
2111         The FTL allocated spill slots for BinaryOps is sometimes inaccurate.
2112         https://bugs.webkit.org/show_bug.cgi?id=152918
2113
2114         Reviewed by Filip Pizlo and Saam Barati.
2115
2116         * ftl/FTLCompile.cpp:
2117         - Updated a comment.
2118         * ftl/FTLLowerDFGToLLVM.cpp:
2119         (JSC::FTL::DFG::LowerDFGToLLVM::lower):
2120         - The code to compute maxNumberOfCatchSpills was unnecessarily allocating an
2121           extra slot for BinaryOps that don't have Untyped operands, and failing to
2122           allocate that extra slot for some binary ops.  This is now fixed.
2123
2124         * tests/stress/ftl-shr-exception.js:
2125         * tests/stress/ftl-xor-exception.js:
2126         - Un-skipped these tests.  They now pass with this patch.
2127
2128 2016-01-09  Andreas Kling  <akling@apple.com>
2129
2130         Use NeverDestroyed instead of DEPRECATED_DEFINE_STATIC_LOCAL
2131         <https://webkit.org/b/152902>
2132
2133         Reviewed by Anders Carlsson.
2134
2135         Mostly mechanical conversion to NeverDestroyed throughout JavaScriptCore.
2136
2137         * API/JSAPIWrapperObject.mm:
2138         (jsAPIWrapperObjectHandleOwner):
2139         * API/JSManagedValue.mm:
2140         (managedValueHandleOwner):
2141         * inspector/agents/InspectorDebuggerAgent.cpp:
2142         (Inspector::objectGroupForBreakpointAction):
2143         * jit/ExecutableAllocator.cpp:
2144         (JSC::DemandExecutableAllocator::allocators):
2145
2146 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2147
2148         FTL B3 should do varargs tail calls and stack overflows
2149         https://bugs.webkit.org/show_bug.cgi?id=152934
2150
2151         Reviewed by Saam Barati.
2152
2153         I was trying to get tail-call-varargs-no-stack-overflow.js.ftl-no-cjit-validate to work and
2154         at first I hit the stack overflow issue and then I hit the varargs tail call issue. That's
2155         why I have two fixes in one change. Now the test passes.
2156
2157         This reduces the number of failures from 13 to 0.
2158
2159         * ftl/FTLLowerDFGToLLVM.cpp:
2160         (JSC::FTL::DFG::LowerDFGToLLVM::lower): Implement stack overflow handling.
2161         (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs): Varargs tail calls need to
2162         append an Oops (i.e. "unreachable").
2163
2164 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2165
2166         B3 needs Neg()
2167         https://bugs.webkit.org/show_bug.cgi?id=152925
2168
2169         Reviewed by Mark Lam.
2170
2171         Previously we said that negation should be represented as Sub(0, x). That's wrong, since
2172         for floats, Sub(0, 0) == 0 while Neg(0) == -0.
2173
2174         One way to solve this would be to say that anyone trying to say Neg(x) where x is a float
2175         should instead say BitXor(x, -0). That's actually correct, but I think that it would be odd
2176         to use bitops to represent floating point operations. Whatever cuteness this would have
2177         bought us would be outweighed by the annoyance of having to write code that matches
2178         Sub(0, x) for integer negation and BitXor(x, -0) for double negation. For example, this
2179         would mean strictly more code for anyone implementing a Neg(Neg(x))=>x strength reduction.
2180         Also, I suspect that the omission of Neg would cause others to make the mistake of using
2181         Sub to represent floating point negation.
2182
2183         So, this introduces a proper Neg() opcode to B3. It's now the canonical way of saying
2184         negation for both ints and floats. For ints, we canonicalize Sub(0, x) to Neg(x). For
2185         floats, we lower it to BitXor(x, -0) on x86.
2186
2187         This reduces the number of failures from 13 to 12.
2188
2189         * assembler/MacroAssemblerX86Common.h:
2190         (JSC::MacroAssemblerX86Common::andFloat):
2191         (JSC::MacroAssemblerX86Common::xorDouble):
2192         (JSC::MacroAssemblerX86Common::xorFloat):
2193         (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
2194         * b3/B3LowerMacrosAfterOptimizations.cpp:
2195         * b3/B3LowerToAir.cpp:
2196         (JSC::B3::Air::LowerToAir::lower):
2197         * b3/B3Opcode.cpp:
2198         (WTF::printInternal):
2199         * b3/B3Opcode.h:
2200         * b3/B3ReduceStrength.cpp:
2201         * b3/B3Validate.cpp:
2202         * b3/B3Value.cpp:
2203         (JSC::B3::Value::effects):
2204         (JSC::B3::Value::key):
2205         (JSC::B3::Value::typeFor):
2206         * b3/air/AirOpcode.opcodes:
2207         * ftl/FTLB3Output.cpp:
2208         (JSC::FTL::Output::lockedStackSlot):
2209         (JSC::FTL::Output::neg):
2210         (JSC::FTL::Output::bitNot):
2211         * ftl/FTLB3Output.h:
2212         (JSC::FTL::Output::chillDiv):
2213         (JSC::FTL::Output::mod):
2214         (JSC::FTL::Output::chillMod):
2215         (JSC::FTL::Output::doubleAdd):
2216         (JSC::FTL::Output::doubleSub):
2217         (JSC::FTL::Output::doubleMul):
2218         (JSC::FTL::Output::doubleDiv):
2219         (JSC::FTL::Output::doubleMod):
2220         (JSC::FTL::Output::doubleNeg):
2221         (JSC::FTL::Output::bitAnd):
2222         (JSC::FTL::Output::bitOr):
2223         (JSC::FTL::Output::neg): Deleted.
2224         * tests/stress/ftl-negate-zero.js: Added. This was already covered by op_negate but since
2225         it's such a glaring bug, I thought having a test for it specifically would be good.
2226
2227 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2228
2229         FTL B3 compile() doesn't clear exception handlers before we add FTL-specific ones
2230         https://bugs.webkit.org/show_bug.cgi?id=152922
2231
2232         Reviewed by Saam Barati.
2233
2234         FTL B3 was generating a handler table that first contained the old baseline handlers keyed
2235         by baseline's bytecode indices and then the FTL handlers keyed by FTL callsite index. That's
2236         wrong, since the FTL code block should not contain any baseline handlers. The fix is to
2237         clear the handlers before generation, sort of like FTL LLVM does.
2238
2239         Also added some stuff to make it easier to inspect the handler table.
2240
2241         This reduces the numbe rof failures from 25 to 13.
2242
2243         * bytecode/CodeBlock.cpp:
2244         (JSC::CodeBlock::dumpBytecode):
2245         (JSC::CodeBlock::dumpExceptionHandlers):
2246         (JSC::CodeBlock::beginDumpProfiling):
2247         * bytecode/CodeBlock.h:
2248         * ftl/FTLB3Compile.cpp:
2249         (JSC::FTL::compile):
2250
2251 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2252
2253         B3 incorrectly turns NotEqual(bool, 1) into Equal(bool, 1) instead of Equal(bool, 0)
2254         https://bugs.webkit.org/show_bug.cgi?id=152916
2255
2256         Reviewed by Mark Lam.
2257
2258         This was causing a failure in an ancient DFG layout test. Thanks, ftl-eager-no-cjit!
2259
2260         This reduces the number of failures from 27 to 25.
2261
2262         * b3/B3ReduceStrength.cpp:
2263
2264 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2265
2266         FTL B3 allocateCell() should not crash
2267         https://bugs.webkit.org/show_bug.cgi?id=152909
2268
2269         Reviewed by Mark Lam.
2270
2271         This code was crashing in some tests that forced GC slow paths because it was stubbed out
2272         due to the use of undef. B3 doesn't have undef. In this case, there's no good reason to use
2273         undef. We can just use zero. Since the path is dead anyway in that case, we weren't gaining
2274         any LLVM optimizations by using undef.
2275
2276         This reduces the number of failures from 35 to 27.
2277
2278         * ftl/FTLLowerDFGToLLVM.cpp:
2279         (JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):
2280
2281 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2282
2283         FTL B3 fails to realize that binary snippets might choose to omit their fast path
2284         https://bugs.webkit.org/show_bug.cgi?id=152901
2285
2286         Reviewed by Mark Lam.
2287
2288         This reduces the number of failures from 99 to 35.
2289
2290         * ftl/FTLLowerDFGToLLVM.cpp:
2291         (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
2292
2293 2016-01-08  Saam barati  <sbarati@apple.com>
2294
2295         restoreCalleeSavesFromVMCalleeSavesBuffer should use the scratch register
2296         https://bugs.webkit.org/show_bug.cgi?id=152879
2297
2298         Reviewed by Filip Pizlo.
2299
2300         We were clobbering a register we needed when picking
2301         a scratch register inside an FTL OSR Exit.
2302
2303         * dfg/DFGThunks.cpp:
2304         (JSC::DFG::osrEntryThunkGenerator):
2305         * jit/AssemblyHelpers.cpp:
2306         (JSC::AssemblyHelpers::emitRandomThunk):
2307         (JSC::AssemblyHelpers::restoreCalleeSavesFromVMCalleeSavesBuffer):
2308         * jit/AssemblyHelpers.h:
2309         (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMCalleeSavesBuffer):
2310         (JSC::AssemblyHelpers::restoreCalleeSavesFromVMCalleeSavesBuffer): Deleted.
2311         * tests/stress/ftl-put-by-id-setter-exception-interesting-live-state.js:
2312         (foo):
2313
2314 2016-01-08  Mark Lam  <mark.lam@apple.com>
2315
2316         Rolling out: Rename StringFromCharCode to StringFromSingleCharCode.
2317         https://bugs.webkit.org/show_bug.cgi?id=152897
2318
2319         Not reviewed.
2320
2321         * dfg/DFGAbstractInterpreterInlines.h:
2322         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2323         * dfg/DFGByteCodeParser.cpp:
2324         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
2325         * dfg/DFGClobberize.h:
2326         (JSC::DFG::clobberize):
2327         * dfg/DFGDoesGC.cpp:
2328         (JSC::DFG::doesGC):
2329         * dfg/DFGFixupPhase.cpp:
2330         (JSC::DFG::FixupPhase::fixupNode):
2331         * dfg/DFGNodeType.h:
2332         * dfg/DFGOperations.cpp:
2333         * dfg/DFGOperations.h:
2334         * dfg/DFGPredictionPropagationPhase.cpp:
2335         (JSC::DFG::PredictionPropagationPhase::propagate):
2336         * dfg/DFGSafeToExecute.h:
2337         (JSC::DFG::safeToExecute):
2338         * dfg/DFGSpeculativeJIT.cpp:
2339         (JSC::DFG::SpeculativeJIT::compileFromCharCode):
2340         * dfg/DFGSpeculativeJIT32_64.cpp:
2341         (JSC::DFG::SpeculativeJIT::compile):
2342         * dfg/DFGSpeculativeJIT64.cpp:
2343         (JSC::DFG::SpeculativeJIT::compile):
2344         * runtime/StringConstructor.cpp:
2345         (JSC::stringFromCharCode):
2346         (JSC::stringFromSingleCharCode): Deleted.
2347         * runtime/StringConstructor.h:
2348
2349 2016-01-08  Per Arne Vollan  <peavo@outlook.com>
2350
2351         [JSC] Use std::call_once instead of pthread_once when initializing LLVM.
2352         https://bugs.webkit.org/show_bug.cgi?id=152893
2353
2354         Reviewed by Mark Lam.
2355
2356         Use std::call_once since pthreads is not present on all platforms.
2357
2358         * llvm/InitializeLLVM.cpp:
2359         (JSC::initializeLLVMImpl):
2360         (JSC::initializeLLVM):
2361
2362 2016-01-08  Mark Lam  <mark.lam@apple.com>
2363
2364         Rename StringFromCharCode to StringFromSingleCharCode.
2365         https://bugs.webkit.org/show_bug.cgi?id=152897
2366
2367         Reviewed by Daniel Bates.
2368
2369         StringFromSingleCharCode is a better name because the intrinsic it represents
2370         only applies when we are converting from a single char code.  This is purely
2371         a refactoring patch.  There is no semantic change.
2372
2373         * dfg/DFGAbstractInterpreterInlines.h:
2374         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2375         * dfg/DFGByteCodeParser.cpp:
2376         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
2377         * dfg/DFGClobberize.h:
2378         (JSC::DFG::clobberize):
2379         * dfg/DFGDoesGC.cpp:
2380         (JSC::DFG::doesGC):
2381         * dfg/DFGFixupPhase.cpp:
2382         (JSC::DFG::FixupPhase::fixupNode):
2383         * dfg/DFGNodeType.h:
2384         * dfg/DFGOperations.cpp:
2385         * dfg/DFGOperations.h:
2386         * dfg/DFGPredictionPropagationPhase.cpp:
2387         (JSC::DFG::PredictionPropagationPhase::propagate):
2388         * dfg/DFGSafeToExecute.h:
2389         (JSC::DFG::safeToExecute):
2390         * dfg/DFGSpeculativeJIT.cpp:
2391         (JSC::DFG::SpeculativeJIT::compileFromCharCode):
2392         * dfg/DFGSpeculativeJIT32_64.cpp:
2393         (JSC::DFG::SpeculativeJIT::compile):
2394         * dfg/DFGSpeculativeJIT64.cpp:
2395         (JSC::DFG::SpeculativeJIT::compile):
2396         * runtime/StringConstructor.cpp:
2397         (JSC::stringFromCharCode):
2398         (JSC::stringFromSingleCharCode):
2399         * runtime/StringConstructor.h:
2400
2401 2016-01-08  Konstantin Tokarev  <annulen@yandex.ru>
2402
2403         [mips] Fixed unused parameter warnings
2404         https://bugs.webkit.org/show_bug.cgi?id=152885
2405
2406         Reviewed by Mark Lam.
2407
2408         * jit/CCallHelpers.h:
2409         (JSC::CCallHelpers::setupArgumentsWithExecState):
2410
2411 2016-01-08  Konstantin Tokarev  <annulen@yandex.ru>
2412
2413         [mips] Max value of immediate arg of logical ops is 0xffff
2414         https://bugs.webkit.org/show_bug.cgi?id=152884
2415
2416         Reviewed by Michael Saboff.
2417
2418         Replaced imm.m_value < 65535 checks with imm.m_value <= 65535
2419
2420         * assembler/MacroAssemblerMIPS.h:
2421         (JSC::MacroAssemblerMIPS::and32):
2422         (JSC::MacroAssemblerMIPS::or32):
2423
2424 2016-01-08  Konstantin Tokarev  <annulen@yandex.ru>
2425
2426         [mips] Add new or32 implementation after r194613
2427         https://bugs.webkit.org/show_bug.cgi?id=152865
2428
2429         Reviewed by Michael Saboff.
2430
2431         * assembler/MacroAssemblerMIPS.h:
2432         (JSC::MacroAssemblerMIPS::or32):
2433
2434 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2435
2436         FTL B3 lazy slow paths should do exceptions
2437         https://bugs.webkit.org/show_bug.cgi?id=152853
2438
2439         Reviewed by Saam Barati.
2440
2441         This reduces the number of JSC test failures to 97.
2442
2443         * ftl/FTLLowerDFGToLLVM.cpp:
2444         (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
2445         * tests/stress/ftl-new-negative-array-size.js: Added.
2446         (foo):
2447
2448 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2449
2450         Unreviewed, skip more tests that fail.
2451
2452         * tests/stress/ftl-shr-exception.js:
2453         (foo):
2454         * tests/stress/ftl-xor-exception.js:
2455         (foo):
2456
2457 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2458
2459         FTL B3 binary snippets should do exceptions
2460         https://bugs.webkit.org/show_bug.cgi?id=152852
2461
2462         Reviewed by Saam Barati.
2463
2464         This reduces the number of JSC test failures to 110.
2465
2466         * ftl/FTLLowerDFGToLLVM.cpp:
2467         (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
2468         (JSC::FTL::DFG::LowerDFGToLLVM::emitBinaryBitOpSnippet):
2469         (JSC::FTL::DFG::LowerDFGToLLVM::emitRightShiftSnippet):
2470         * tests/stress/ftl-shr-exception.js: Added.
2471         (foo):
2472         (result.foo.valueOf):
2473         * tests/stress/ftl-sub-exception.js: Added.
2474         (foo):
2475         (result.foo.valueOf):
2476         * tests/stress/ftl-xor-exception.js: Added.
2477         (foo):
2478         (result.foo.valueOf):
2479
2480 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2481
2482         Unreviewed, skipping this test. Looks like LLVM can't handle this one, either.
2483
2484         * tests/stress/ftl-call-varargs-bad-args-exception-interesting-live-state.js:
2485         (foo):
2486
2487 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2488
2489         Unreviewed, skipping this test. Looks like LLVM can't handle it.
2490
2491         * tests/stress/ftl-put-by-id-setter-exception-interesting-live-state.js:
2492         (foo):
2493
2494 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2495
2496         FTL B3 JS calls should do exceptions
2497         https://bugs.webkit.org/show_bug.cgi?id=152851
2498
2499         Reviewed by Geoffrey Garen.
2500
2501         This reduces the number of JSC test failures with FTL B3 to 111.
2502
2503         * dfg/DFGSpeculativeJIT64.cpp:
2504         (JSC::DFG::SpeculativeJIT::emitCall):
2505         * ftl/FTLLowerDFGToLLVM.cpp:
2506         (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
2507         (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
2508         (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
2509         * tests/stress/ftl-call-bad-args-exception-interesting-live-state.js: Added.
2510         * tests/stress/ftl-call-bad-callee-exception-interesting-live-state.js: Added.
2511         * tests/stress/ftl-call-exception-interesting-live-state.js: Added.
2512         * tests/stress/ftl-call-exception-no-catch.js: Added.
2513         * tests/stress/ftl-call-exception.js: Added.
2514         * tests/stress/ftl-call-varargs-bad-callee-exception-interesting-live-state.js: Added.
2515         * tests/stress/ftl-call-varargs-exception-interesting-live-state.js: Added.
2516         * tests/stress/ftl-call-varargs-exception-no-catch.js: Added.
2517         * tests/stress/ftl-call-varargs-exception.js: Added.
2518
2519 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2520
2521         FTL B3 PutById should do exceptions
2522         https://bugs.webkit.org/show_bug.cgi?id=152850
2523
2524         Reviewed by Saam Barati.
2525
2526         Implemented PutById exception handling by following the idiom used in GetById. Reduces the
2527         number of JSC test failures to 128.
2528
2529         * ftl/FTLLowerDFGToLLVM.cpp:
2530         (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
2531         * tests/stress/ftl-put-by-id-setter-exception-interesting-live-state.js: Added.
2532         * tests/stress/ftl-put-by-id-setter-exception-no-catch.js: Added.
2533         * tests/stress/ftl-put-by-id-setter-exception.js: Added.
2534         * tests/stress/ftl-put-by-id-slow-exception-interesting-live-state.js: Added.
2535         * tests/stress/ftl-put-by-id-slow-exception-no-catch.js: Added.
2536         * tests/stress/ftl-put-by-id-slow-exception.js: Added.
2537
2538 2016-01-07  Commit Queue  <commit-queue@webkit.org>
2539
2540         Unreviewed, rolling out r194714.
2541         https://bugs.webkit.org/show_bug.cgi?id=152864
2542
2543         it broke many JSC tests when FTL B3 is enabled (Requested by
2544         pizlo on #webkit).
2545
2546         Reverted changeset:
2547
2548         "[JSC] When resolving Stack arguments, use addressing from SP
2549         when addressing from FP is invalid"
2550         https://bugs.webkit.org/show_bug.cgi?id=152840
2551         http://trac.webkit.org/changeset/194714
2552
2553 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2554
2555         [mips] Lower immediates of logical operations.
2556         https://bugs.webkit.org/show_bug.cgi?id=152693
2557
2558         On MIPS immediate operands of andi, ori, and xori are required to be 16-bit
2559         non-negative numbers.
2560
2561         Reviewed by Michael Saboff.
2562
2563         * offlineasm/mips.rb:
2564
2565 2016-01-07  Benjamin Poulain  <bpoulain@apple.com>
2566
2567         [JSC] Update testCheckSubBadImm() for ARM64
2568         https://bugs.webkit.org/show_bug.cgi?id=152846
2569
2570         Reviewed by Mark Lam.
2571
2572         * b3/testb3.cpp:
2573         (JSC::B3::testCheckSubBadImm):
2574         The test was assuming the constant can always be used
2575         as immediate. That's obviously not the case on ARM64.
2576
2577 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2578
2579         FTL B3 getById() should do exceptions
2580         https://bugs.webkit.org/show_bug.cgi?id=152810
2581
2582         Reviewed by Saam Barati.
2583
2584         This adds abstractions for doing exceptions from patchpoints, and uses them to implement
2585         exceptions from GetById. This covers all of the following ways that a GetById might throw an
2586         exceptions:
2587
2588         - Throw without try/catch from the vmCall() in a GetById(Untyped:)
2589         - Throw with try/catch from the vmCall() in a GetById(Untyped:)
2590         - Throw without try/catch from the callOperation() in the patchpoint of a GetById
2591         - Throw with try/catch from the callOperation() in the patchpoint of a GetById
2592         - Throw without try/catch from the Call IC generated in the patchpoint of a GetById
2593         - Throw with try/catch from the Call IC generated in the patchpoint of a GetById
2594
2595         This requires having a default exception target in FTL-generated code, and ensuring that this
2596         target is generated regardless of whether we have branches to the B3 basic block of the
2597         default exception target. This also requires adding some extra arguments to a
2598         PatchpointValue, and then knowing that the arguments are used for OSR exit and not anything
2599         else. This also requires associating the CallSiteIndex of the patchpoint with the register
2600         set used for exit and with the OSR exit label for the unwind exit.
2601
2602         All of the stuff that you have to worry about when wiring a patchpoint to exception handling
2603         is covered by the new PatchpointExceptionHandle object. You create one by calling
2604         preparePatchpointForExceptions(). This sets up the B3 IR representation of the patchpoint
2605         with stackmap arguments for the exceptional exit, and creates a PatchpointExceptionHandle
2606         object that can be used to create zero or more actual OSR exits. It can create both OSR exits
2607         for operation calls and OSR exits for unwind. You call the
2608         PatchpointExceptionHandle::scheduleExitCreationXXX() methods from the generator callback to
2609         actually get OSR exits.
2610
2611         This API makes heavy use of Box<>, late paths, and link tasks. For example, you can use the
2612         PatchpointExceptionHandle to get a Box<JumpList> that you can append exception jumps to. When
2613         you use this API, it automatically registers a link task that will link the JumpList to the
2614         actual OSR exit label.
2615
2616         This API is very flexible about how you get to the label of the OSR exit. You are encouraged
2617         to use the Box<JumpList> approach, but if you really just need the label, you can also get
2618         a RefPtr<ExceptionTarget> and rely on the fact that the ExceptionTarget object will be able
2619         to vend you the OSR exit label at link-time.
2620
2621         This reduces the number of JSC test failures with FTL B3 from 186 to 133. It also adds a
2622         bunch of new tests specifically for all of the ways you might throw from GetById, and B3
2623         passes all of these new tests. Note that I'm not counting the new tests as part of the
2624         previous 186 test failures (FTL B3 failed all of the new tests prior to this change).
2625
2626         After this change, it should be easy to make all of the other patchpoints also handle
2627         exceptions by just following the preparePatchpointForExceptions() idiom.
2628
2629         * CMakeLists.txt:
2630         * JavaScriptCore.xcodeproj/project.pbxproj:
2631         * b3/B3StackmapValue.h:
2632         * b3/B3ValueRep.cpp:
2633         (JSC::B3::ValueRep::addUsedRegistersTo):
2634         (JSC::B3::ValueRep::usedRegisters):
2635         (JSC::B3::ValueRep::dump):
2636         * b3/B3ValueRep.h:
2637         (JSC::B3::ValueRep::doubleValue):
2638         (JSC::B3::ValueRep::withOffset):
2639         (JSC::B3::ValueRep::usedRegisters):
2640         * ftl/FTLB3Compile.cpp:
2641         (JSC::FTL::compile):
2642         * ftl/FTLB3Output.h:
2643         (JSC::FTL::Output::unreachable):
2644         (JSC::FTL::Output::speculate):
2645         * ftl/FTLExceptionTarget.cpp: Added.
2646         (JSC::FTL::ExceptionTarget::~ExceptionTarget):
2647         (JSC::FTL::ExceptionTarget::label):
2648         (JSC::FTL::ExceptionTarget::jumps):
2649         (JSC::FTL::ExceptionTarget::ExceptionTarget):
2650         * ftl/FTLExceptionTarget.h: Added.
2651         * ftl/FTLJITCode.cpp:
2652         (JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
2653         * ftl/FTLLowerDFGToLLVM.cpp:
2654         (JSC::FTL::DFG::LowerDFGToLLVM::lower):
2655         (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
2656         (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
2657         (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
2658         (JSC::FTL::DFG::LowerDFGToLLVM::compileMakeRope):
2659         (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
2660         (JSC::FTL::DFG::LowerDFGToLLVM::compileIn):
2661         (JSC::FTL::DFG::LowerDFGToLLVM::getById):
2662         (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
2663         (JSC::FTL::DFG::LowerDFGToLLVM::emitBinaryBitOpSnippet):
2664         (JSC::FTL::DFG::LowerDFGToLLVM::emitRightShiftSnippet):
2665         (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
2666         (JSC::FTL::DFG::LowerDFGToLLVM::preparePatchpointForExceptions):
2667         (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
2668         (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
2669         (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
2670         (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
2671         * ftl/FTLPatchpointExceptionHandle.cpp: Added.
2672         (JSC::FTL::PatchpointExceptionHandle::create):
2673         (JSC::FTL::PatchpointExceptionHandle::defaultHandle):
2674         (JSC::FTL::PatchpointExceptionHandle::~PatchpointExceptionHandle):
2675         (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreation):
2676         (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreationForUnwind):
2677         (JSC::FTL::PatchpointExceptionHandle::PatchpointExceptionHandle):
2678         (JSC::FTL::PatchpointExceptionHandle::createHandle):
2679         * ftl/FTLPatchpointExceptionHandle.h: Added.
2680         * ftl/FTLState.cpp:
2681         * ftl/FTLState.h:
2682         (JSC::FTL::verboseCompilationEnabled):
2683         * tests/stress/ftl-get-by-id-getter-exception-interesting-live-state.js: Added.
2684         * tests/stress/ftl-get-by-id-getter-exception-no-catch.js: Added.
2685         * tests/stress/ftl-get-by-id-getter-exception.js: Added.
2686         * tests/stress/ftl-get-by-id-slow-exception-interesting-live-state.js: Added.
2687         * tests/stress/ftl-get-by-id-slow-exception-no-catch.js: Added.
2688         * tests/stress/ftl-get-by-id-slow-exception.js: Added.
2689         * tests/stress/ftl-operation-exception-interesting-live-state.js: Added.
2690         * tests/stress/ftl-operation-exception-no-catch.js: Added.
2691
2692 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2693
2694         [mips] Implemented missing branch patching methods.
2695         https://bugs.webkit.org/show_bug.cgi?id=152845
2696
2697         Reviewed by Michael Saboff.
2698
2699         * assembler/MacroAssemblerMIPS.h:
2700         (JSC::MacroAssemblerMIPS::canJumpReplacePatchableBranch32WithPatch):
2701         (JSC::MacroAssemblerMIPS::startOfPatchableBranch32WithPatchOnAddress):
2702         (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranch32WithPatch):
2703
2704 2016-01-07  Benjamin Poulain  <bpoulain@apple.com>
2705
2706         [JSC] When resolving Stack arguments, use addressing from SP when addressing from FP is invalid
2707         https://bugs.webkit.org/show_bug.cgi?id=152840
2708
2709         Reviewed by Mark Lam.
2710
2711         ARM64 has two kinds of addressing with immediates:
2712         -Signed 9bits direct (really only -256 to 255).
2713         -Unsigned 12bits scaled by the load/store size.
2714
2715         When resolving the stack addresses, we easily run
2716         past -256 bytes from FP. Addressing from SP gives us more
2717         room to address the stack efficiently because we can
2718         use unsigned immediates.
2719
2720         * b3/B3StackmapSpecial.cpp:
2721         (JSC::B3::StackmapSpecial::repForArg):
2722         * b3/air/AirAllocateStack.cpp:
2723         (JSC::B3::Air::allocateStack):
2724
2725 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2726
2727         [mips] Make repatchCall public to fix compilation.
2728         https://bugs.webkit.org/show_bug.cgi?id=152843
2729
2730         Reviewed by Michael Saboff.
2731
2732         * assembler/MacroAssemblerMIPS.h:
2733         (JSC::MacroAssemblerMIPS::repatchCall):
2734         (JSC::MacroAssemblerMIPS::linkCall): Deleted.
2735
2736 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2737
2738         [mips] Replaced subi with addi in getHostCallReturnValue
2739         https://bugs.webkit.org/show_bug.cgi?id=152841
2740
2741         Reviewed by Michael Saboff.
2742
2743         MIPS architecture does not have subi instruction, addi with negative
2744         number should be used instead.
2745
2746         * jit/JITOperations.cpp:
2747
2748 2016-01-07  Mark Lam  <mark.lam@apple.com>
2749
2750         ARMv7 or32(TrustedImm32, AbsoluteAddress) may have a bug with its use of dataTempRegister.
2751         https://bugs.webkit.org/show_bug.cgi?id=152833
2752
2753         Reviewed by Michael Saboff.
2754
2755         Follow-up patch to fix illegal use of memoryTempRegister as the src for ARM64's
2756         store32.
2757
2758         * assembler/MacroAssemblerARM64.h:
2759         (JSC::MacroAssemblerARM64::or32):
2760         (JSC::MacroAssemblerARM64::store):
2761
2762 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2763
2764         [mips] GPRInfo::toArgumentRegister missing
2765         https://bugs.webkit.org/show_bug.cgi?id=152838
2766
2767         Reviewed by Michael Saboff.
2768
2769         * jit/GPRInfo.h:
2770         (JSC::GPRInfo::toArgumentRegister):
2771
2772 2016-01-07  Mark Lam  <mark.lam@apple.com>
2773
2774         ARMv7 or32(TrustedImm32, AbsoluteAddress) may have a bug with its use of dataTempRegister.
2775         https://bugs.webkit.org/show_bug.cgi?id=152833
2776
2777         Reviewed by Benjamin Poulain.
2778
2779         * assembler/MacroAssemblerARM.h:
2780         (JSC::MacroAssemblerARM::or32):
2781         - Added some assertions to make sure it is safe to use ARMRegisters::S0 as a temp.
2782         * assembler/MacroAssemblerARM64.h:
2783         (JSC::MacroAssemblerARM64::or32):
2784         - Implement an optimization that avoids reloading the memoryTempRegister when
2785           the immediate is encodable as an instruction immediate.
2786         * assembler/MacroAssemblerARMv7.h:
2787         (JSC::MacroAssemblerARMv7::or32):
2788         - Added an assertion to make sure it is safe to use the dataTempRegister as a temp.
2789         - Implement an optimization that avoids reloading the memoryTempRegister when
2790           the immediate is encodable as an instruction immediate.  In the event that we
2791           cannot encode the immediate, we'll use the addressTempRegister as a temp, and
2792           reload it later.
2793
2794 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2795
2796         [CMake] JSC shell sources should include JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES
2797         https://bugs.webkit.org/show_bug.cgi?id=152664
2798
2799         Reviewed by Alex Christensen.
2800
2801         * shell/CMakeLists.txt:
2802
2803 2016-01-06  Joseph Pecoraro  <pecoraro@apple.com>
2804
2805         Web Inspector: CRASH Attempting to pause on CSP violation not inside of script
2806         https://bugs.webkit.org/show_bug.cgi?id=152825
2807         <rdar://problem/24021276>
2808
2809         Reviewed by Timothy Hatcher.
2810
2811         * debugger/Debugger.cpp:
2812         (JSC::Debugger::breakProgram):
2813         We cannot pause if we are not evaluating JavaScript, so bail.
2814
2815 2016-01-07  Benjamin Poulain  <bpoulain@apple.com>
2816
2817         [JSC] Re-enable lea() in Air on ARM64
2818         https://bugs.webkit.org/show_bug.cgi?id=152832
2819
2820         Reviewed by Michael Saboff.
2821
2822         Lea() on the MacroAssembler is not the full x86 Lea (the real one being
2823         x86Lea32()). Instead, it is a addPtr() with SP and a constant.
2824
2825         The instruction is required to implement B3's StackSlot. It is not
2826         safe for big offsets but none of the stack operations are at the moment.
2827
2828         * b3/air/AirOpcode.opcodes:
2829
2830 2016-01-07  Julien Brianceau  <jbriance@cisco.com>
2831
2832         [mips] Add two missing abortWithReason implementations
2833         https://bugs.webkit.org/show_bug.cgi?id=136753
2834
2835         Reviewed by Benjamin Poulain.
2836
2837         * assembler/MacroAssemblerMIPS.h:
2838         (JSC::MacroAssemblerMIPS::memoryFence):
2839         (JSC::MacroAssemblerMIPS::abortWithReason):
2840         (JSC::MacroAssemblerMIPS::readCallTarget):
2841
2842 2016-01-07  Csaba Osztrogonác  <ossy@webkit.org>
2843
2844         Add new or32 implementation to MacroAssemblerARM after r194613
2845         https://bugs.webkit.org/show_bug.cgi?id=152784
2846
2847         Reviewed by Benjamin Poulain.
2848
2849         * assembler/MacroAssemblerARM.h:
2850         (JSC::MacroAssemblerARM::or32):
2851
2852 2016-01-06  Mark Lam  <mark.lam@apple.com>
2853
2854         REGRESSION(r194613): JITMulGenerator needs a scratch GPR on 32-bit too.
2855         https://bugs.webkit.org/show_bug.cgi?id=152805
2856
2857         Reviewed by Michael Saboff.
2858
2859         There aren't enough registers on x86 32-bit to allocate the needed scratch GPR.
2860         So, we'll continue to use one of the result registers as the scratch, and
2861         re-compute the result at the end.
2862
2863         * jit/JITMulGenerator.cpp:
2864         (JSC::JITMulGenerator::generateFastPath):
2865
2866 2016-01-06  Anders Carlsson  <andersca@apple.com>
2867
2868         Add a smart block pointer
2869         https://bugs.webkit.org/show_bug.cgi?id=152799
2870
2871         Reviewed by Tim Horton.
2872
2873         Get rid of RemoteTargetBlock and replace it with WTF::BlockPtr<void ()>.
2874
2875         * inspector/remote/RemoteConnectionToTarget.h:
2876         (Inspector::RemoteTargetBlock::RemoteTargetBlock): Deleted.
2877         (Inspector::RemoteTargetBlock::~RemoteTargetBlock): Deleted.
2878         (Inspector::RemoteTargetBlock::operator=): Deleted.
2879         (Inspector::RemoteTargetBlock::operator()): Deleted.
2880         * inspector/remote/RemoteConnectionToTarget.mm:
2881         (Inspector::RemoteTargetQueueTaskOnGlobalQueue):
2882         (Inspector::RemoteConnectionToTarget::queueTaskOnPrivateRunLoop):
2883
2884 2016-01-06  Benjamin Poulain  <bpoulain@apple.com>
2885
2886         [JSC] More B3 tests passing on ARM64
2887         https://bugs.webkit.org/show_bug.cgi?id=152787
2888
2889         Reviewed by Michael Saboff.
2890
2891         Some more minor bugs.
2892
2893         * assembler/MacroAssemblerARM64.h:
2894         (JSC::MacroAssemblerARM64::urshift64):
2895         The offset was being truncated. That code was just copied
2896         from the 32bits version of urshift.
2897
2898         * b3/B3LowerToAir.cpp:
2899         (JSC::B3::Air::LowerToAir::createGenericCompare):
2900         Very few instructions can encode -1 as immediate.
2901         TST certainly can't. The fallback works for ARM.
2902
2903         * b3/air/AirOpcode.opcodes:
2904         Bit instructions have very specific immediate encoding.
2905         B3 cannot express that properly yet. I disabled those
2906         forms for now. Immediates encoding is something we'll really
2907         have to look into at some point for B3 ARM64.
2908
2909 2016-01-06  Michael Catanzaro  <mcatanzaro@igalia.com>
2910
2911         Silence -Wtautological-compare
2912         https://bugs.webkit.org/show_bug.cgi?id=152768
2913
2914         Reviewed by Saam Barati.
2915
2916         * runtime/Options.cpp:
2917         (JSC::Options::setAliasedOption):
2918
2919 2016-01-06  Filip Pizlo  <fpizlo@apple.com>
2920
2921         Make sure that the basic throw-from-operation mode of throwing makes sense in FTL B3
2922         https://bugs.webkit.org/show_bug.cgi?id=152798
2923
2924         Reviewed by Oliver Hunt.
2925
2926         This really just contains one change: we inline emitBranchToOSRExitIfWillCatchException()
2927         into callCheck(), since that was its only caller. This makes it a bit more clear what is
2928         going on.
2929
2930         It turns out that FTL B3 already handled this case properly. I added a test that I believe
2931         illustrates this. Note that although the test uses GetById, which ordinarily throws
2932         exceptions from inside a patchpoint, it uses it in such a way that the exception is thrown
2933         from the operation call for the non-cell bypass path of a GetById(UntypedUse:).
2934
2935         * ftl/FTLLowerDFGToLLVM.cpp:
2936         (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
2937         (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
2938         (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
2939         (JSC::FTL::DFG::LowerDFGToLLVM::emitBranchToOSRExitIfWillCatchException): Deleted.
2940         * tests/stress/ftl-operation-exception.js: Added.
2941         (foo):
2942
2943 2016-01-06  Joseph Pecoraro  <pecoraro@apple.com>
2944
2945         Web Inspector: Remove duplicate check
2946         https://bugs.webkit.org/show_bug.cgi?id=152792
2947
2948         Reviewed by Timothy Hatcher.
2949
2950         * inspector/InjectedScriptSource.js:
2951         (InjectedScript.RemoteObject.prototype._generatePreview): Deleted.
2952         This method is only called from one place, and it does an equivalent
2953         check before calling this function. Remove the duplicate check.
2954
2955 2016-01-06  Brian Burg  <bburg@apple.com>
2956
2957         Add a WebKit SPI for registering an automation controller with RemoteInspector
2958         https://bugs.webkit.org/show_bug.cgi?id=151576
2959
2960         Reviewed by Dan Bernstein and Joseph Pecoraro.
2961
2962         Given a RemoteInspector endpoint that is instantiated in UIProcess, there
2963         should be a way to delegate automation-related functionality and policy to
2964         clients of WebKit.
2965
2966         This class adds a RemoteInspector::Client interface that serves a delegate.
2967         This is ultimately delegated via _WKAutomationDelegate, which is an SPI
2968         that allows clients to install an Objective-C delegate for automation.
2969
2970         The setting for whether remote automation is allowed is included in the
2971         listing that RemoteInspector sends out. It is updated when RemoteInspector::Client
2972         is assigned, or when the client signals that its capabilities have changed.
2973
2974         * inspector/remote/RemoteInspector.h:
2975         * inspector/remote/RemoteInspector.mm:
2976         (Inspector::RemoteInspector::setRemoteInspectorClient): Added.
2977         (Inspector::RemoteInspector::pushListingsNow):
2978
2979             In the listing, include whether the application supports remote automation.
2980
2981         * inspector/remote/RemoteInspectorConstants.h: Add a constant.
2982
2983 2016-01-05  Keith Miller  <keith_miller@apple.com>
2984
2985         [ES6] Boolean, Number, Map, RegExp, and Set should be subclassable
2986         https://bugs.webkit.org/show_bug.cgi?id=152765
2987
2988         Reviewed by Michael Saboff.
2989
2990         This patch enables subclassing of five more builtins: Boolean, Number, Map, RegExp, and Set.
2991
2992         * runtime/BooleanConstructor.cpp:
2993         (JSC::constructWithBooleanConstructor):
2994         (JSC::constructBoolean): Deleted.
2995         * runtime/BooleanConstructor.h:
2996         * runtime/MapConstructor.cpp:
2997         (JSC::constructMap):
2998         * runtime/NumberConstructor.cpp:
2999         (JSC::constructWithNumberConstructor):
3000         * runtime/RegExpConstructor.cpp:
3001         (JSC::getRegExpStructure):
3002         (JSC::constructRegExp):
3003         * runtime/SetConstructor.cpp:
3004         (JSC::constructSet):
3005         * tests/es6.yaml:
3006         * tests/stress/class-subclassing-misc.js: Added.
3007         (B):
3008         (N):
3009         (M):
3010         (R):
3011         (S):
3012         (test):
3013
3014 2016-01-06  Julien Brianceau  <jbriance@cisco.com>
3015
3016         [mips] Fix branchTruncateDoubleToUint32 implementation in macro assembler
3017         https://bugs.webkit.org/show_bug.cgi?id=152782
3018
3019         Reviewed by Benjamin Poulain.
3020
3021         Already covered by LayoutTests/js/dfg-uint32array-overflow-values test.
3022
3023         * assembler/MacroAssemblerMIPS.h:
3024         (JSC::MacroAssemblerMIPS::branchTruncateDoubleToUint32):
3025
3026 2016-01-06  Julien Brianceau  <jbriance@cisco.com>
3027
3028         [mips] Fix or32 implementation in macro assembler
3029         https://bugs.webkit.org/show_bug.cgi?id=152781
3030
3031         Reviewed by Michael Saboff.
3032
3033         * assembler/MacroAssemblerMIPS.h:
3034         (JSC::MacroAssemblerMIPS::or32):
3035
3036 2016-01-06  Julien Brianceau  <jbriance@cisco.com>
3037
3038         [mips] Add missing branchAdd32 implementation in macro assembler
3039         https://bugs.webkit.org/show_bug.cgi?id=152785
3040
3041         Reviewed by Michael Saboff.
3042
3043         * assembler/MacroAssemblerMIPS.h:
3044         (JSC::MacroAssemblerMIPS::branchAdd32):
3045
3046 2016-01-06  Andy VanWagoner  <thetalecrafter@gmail.com>
3047
3048         [ES6] Date.prototype should be a plain object
3049         https://bugs.webkit.org/show_bug.cgi?id=152574
3050
3051         Reviewed by Benjamin Poulain.
3052
3053         * runtime/DateConstructor.cpp:
3054         (JSC::DateConstructor::finishCreation):
3055         * runtime/DatePrototype.cpp:
3056         (JSC::DatePrototype::DatePrototype):
3057         * runtime/DatePrototype.h:
3058         * tests/mozilla/mozilla-tests.yaml: Expect errors from old Date.prototype as Date instance tests.
3059
3060 2016-01-06  Benjamin Poulain  <bpoulain@apple.com>
3061
3062         [JSC] Get more of testb3 to pass on ARM64
3063         https://bugs.webkit.org/show_bug.cgi?id=152737
3064
3065         Reviewed by Geoffrey Garen.
3066
3067         A bunch of minor bugs and missing function to make most of testb3
3068         run on ARM64.
3069
3070         * JavaScriptCore.xcodeproj/project.pbxproj:
3071         * assembler/ARM64Assembler.h:
3072         (JSC::ARM64Assembler::canEncodePImmOffset):
3073         (JSC::ARM64Assembler::canEncodeSImmOffset):
3074         (JSC::isInt9): Deleted.
3075         (JSC::isUInt12): Deleted.
3076         * assembler/ARMv7Assembler.h:
3077         * assembler/AssemblerCommon.h: Added.
3078         (JSC::isInt9):
3079         (JSC::isUInt12):
3080         (JSC::isValidScaledUImm12):
3081         (JSC::isValidSignedImm9):
3082         * assembler/MacroAssemblerARM64.h:
3083         (JSC::MacroAssemblerARM64::load16SignedExtendTo32):
3084         (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
3085         (JSC::MacroAssemblerARM64::store16):
3086         (JSC::MacroAssemblerARM64::absFloat):
3087         (JSC::MacroAssemblerARM64::loadFloat):
3088         (JSC::MacroAssemblerARM64::storeFloat):
3089         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnsignedImmediate):
3090         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnscaledImmediate):
3091         (JSC::MacroAssemblerARM64::tryLoadSignedWithOffset):
3092         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnsignedImmediate<8>):
3093         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnsignedImmediate<16>):
3094         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnscaledImmediate<8>):
3095         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnscaledImmediate<16>):
3096         * assembler/X86Assembler.h:
3097         * b3/B3LowerToAir.cpp:
3098         (JSC::B3::Air::LowerToAir::effectiveAddr):
3099         (JSC::B3::Air::LowerToAir::lower):
3100         * b3/air/AirArg.h:
3101         (JSC::B3::Air::Arg::isValidImmForm):
3102         (JSC::B3::Air::Arg::isValidAddrForm):
3103         (JSC::B3::Air::Arg::isValidForm):
3104         * b3/air/AirOpcode.opcodes:
3105
3106 2016-01-05  Zan Dobersek  <zdobersek@igalia.com>
3107
3108         [CMake] Remove USE_UDIS86 variable
3109         https://bugs.webkit.org/show_bug.cgi?id=152731
3110
3111         Reviewed by Gyuyoung Kim.
3112
3113         * CMakeLists.txt: Unconditionally build the Udis86-specific files.
3114
3115 2016-01-05  Filip Pizlo  <fpizlo@apple.com>
3116
3117         FTL B3 fails cdjs-tests.yaml/red_black_tree_test.js.ftl-eager-no-cjit
3118         https://bugs.webkit.org/show_bug.cgi?id=152770
3119
3120         Reviewed by Mark Lam.
3121
3122         It turns out that liveness didn't know that the return value GPR or FPR is live at the
3123         return. Consequently, we can end up with code that clobbers the return value register after
3124         the move of the return value into that register. This could happen if we start with
3125         something like:
3126
3127             Move 42(%tmp1), %tmp2
3128             Move 50(%tmp1), %tmp3
3129             Move %tmp3, 58(%tmp1)
3130             Move %tmp2, %rax
3131             Ret
3132
3133         Then we might coalesce %tmp2 with %rax:
3134
3135             Move 42(%tmp1), %rax
3136             Move 50(%tmp1), %tmp3
3137             Move %tmp3, 58(%tmp1)
3138             Ret
3139
3140         But now there is no use of %rax after that first instruction, so %rax appears dead at the
3141         other two Move's. So, the register allocator could then do this:
3142
3143             Move 42(%tmp1), %rax
3144             Move 50(%tmp1), %rax
3145             Move %rax, 58(%tmp1)
3146             Ret
3147
3148         And that's clearly wrong. This patch solves this issue by replacing the old Ret instruction
3149         with Ret32, Ret64, RetFloat, and RetDouble. These all take the return value register as an
3150         argument. They also tell Air which parts of the return value register the caller will
3151         observe. That's great for width analysis.
3152
3153         This resolves a test failure in the CDjs red_black_tree_test. This reduces the total number
3154         of JSC test failures from 217 to 191.
3155
3156         * assembler/MacroAssembler.h:
3157         (JSC::MacroAssembler::oops):
3158         (JSC::MacroAssembler::ret32):
3159         (JSC::MacroAssembler::ret64):
3160         (JSC::MacroAssembler::retFloat):
3161         (JSC::MacroAssembler::retDouble):
3162         (JSC::MacroAssembler::shouldConsiderBlinding):
3163         * b3/B3LowerToAir.cpp:
3164         (JSC::B3::Air::LowerToAir::lower):
3165         * b3/air/AirGenerate.cpp:
3166         (JSC::B3::Air::generate):
3167         * b3/air/AirHandleCalleeSaves.cpp:
3168         (JSC::B3::Air::handleCalleeSaves):
3169         * b3/air/AirOpcode.opcodes:
3170         * b3/air/opcode_generator.rb:
3171
3172 2016-01-05  Keith Miller  <keith_miller@apple.com>
3173
3174         Unreviewed build fix. A symbol was being exported that should not have been.
3175
3176         * runtime/Structure.h:
3177
3178 2016-01-05  Commit Queue  <commit-queue@webkit.org>
3179
3180         Unreviewed, rolling out r194603.
3181         https://bugs.webkit.org/show_bug.cgi?id=152762
3182
3183         This change introduced JSC test failures (Requested by
3184         ryanhaddad on #webkit).
3185
3186         Reverted changeset:
3187
3188         "[ES6] Date.prototype should be a plain object"
3189         https://bugs.webkit.org/show_bug.cgi?id=152574
3190         http://trac.webkit.org/changeset/194603
3191
3192 2016-01-05  Filip Pizlo  <fpizlo@apple.com>
3193
3194         stress/v8-crypto-strict.js.ftl-eager-no-cjit in FTL B3 fails with an assertion in the callframe shuffler
3195         https://bugs.webkit.org/show_bug.cgi?id=152756
3196
3197         Reviewed by Saam Barati.
3198
3199         This fixes a really obvious and dumb tail call bug in FTL B3. I think that tail calls work
3200         for real now. I have no idea why I got any tail call tests to pass before this fix.
3201
3202         * ftl/FTLLowerDFGToLLVM.cpp:
3203         (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
3204
3205 2016-01-04  Mark Lam  <mark.lam@apple.com>
3206
3207         Profiling should detect when multiplication overflows but does not create negative zero.
3208         https://bugs.webkit.org/show_bug.cgi?id=132470
3209
3210         Reviewed by Geoffrey Garen.
3211
3212         * assembler/MacroAssemblerARM64.h:
3213         (JSC::MacroAssemblerARM64::or32):
3214         * assembler/MacroAssemblerARMv7.h:
3215         (JSC::MacroAssemblerARMv7::or32):
3216         - New or32 emitter needed by the mul snippet.
3217
3218         * bytecode/CodeBlock.cpp:
3219         (JSC::CodeBlock::resultProfileForBytecodeOffset):
3220         (JSC::CodeBlock::updateResultProfileForBytecodeOffset): Deleted.
3221         * bytecode/CodeBlock.h:
3222         (JSC::CodeBlock::ensureResultProfile):
3223         (JSC::CodeBlock::addResultProfile): Deleted.
3224         (JSC::CodeBlock::likelyToTakeDeepestSlowCase): Deleted.
3225         - Added a m_bytecodeOffsetToResultProfileIndexMap because we can now add result
3226           profiles in any order (based on runtime execution), not necessarily in bytecode
3227           order at baseline compilation time.
3228
3229         * bytecode/ValueProfile.cpp:
3230         (WTF::printInternal):
3231         * bytecode/ValueProfile.h:
3232         (JSC::ResultProfile::didObserveInt52Overflow):
3233         (JSC::ResultProfile::setObservedInt52Overflow):
3234         - Add new Int52Overflow flags.
3235
3236         * dfg/DFGByteCodeParser.cpp:
3237         (JSC::DFG::ByteCodeParser::makeSafe):
3238         - Now with more straightforward mapping of profiling info.
3239
3240         * dfg/DFGCommon.h:
3241         - Fixed a typo in a comment.
3242
3243         * dfg/DFGNode.h:
3244         (JSC::DFG::Node::arithNodeFlags):
3245         (JSC::DFG::Node::mayHaveNonIntResult):
3246         (JSC::DFG::Node::hasConstantBuffer):
3247         * dfg/DFGNodeFlags.cpp:
3248         (JSC::DFG::dumpNodeFlags):
3249         * dfg/DFGNodeFlags.h:
3250         (JSC::DFG::nodeMayOverflowInt52):
3251         (JSC::DFG::nodeCanSpeculateInt52):
3252         * dfg/DFGPredictionPropagationPhase.cpp:
3253         (JSC::DFG::PredictionPropagationPhase::propagate):
3254         - We now have profiling info for whether the result was ever seen to be a non-Int.
3255           Use this to make a better prediction.
3256
3257         * jit/JITArithmetic.cpp:
3258         (JSC::JIT::emit_op_div):
3259         (JSC::JIT::emit_op_mul):
3260         - Switch to using CodeBlock::ensureResultProfile().  ResultProfiles can now be
3261           created at any time (including the slow path), not just in bytecode order
3262           during baseline compilation.
3263
3264         * jit/JITMulGenerator.cpp:
3265         (JSC::JITMulGenerator::generateFastPath):
3266         - Removed the fast path profiling code for NegZero because we'll go to the slow
3267           path anyway.  Let the slow path do the profiling for us.
3268         - Added profiling for NegZero and potential Int52 overflows in the fast path
3269           that does double math.
3270
3271         * runtime/CommonSlowPaths.cpp:
3272         (JSC::updateResultProfileForBinaryArithOp):
3273         - Removed the RETURN_WITH_RESULT_PROFILING macro (2 less macros), and just use
3274           the RETURN_WITH_PROFILING macro instead with a call to
3275           updateResultProfileForBinaryArithOp().  This makes it clear what we're doing
3276           to do profiling in each case, and also allows us to do custom profiling for
3277           each opcode if needed.  However, so far, we always call
3278           updateResultProfileForBinaryArithOp().
3279
3280 2016-01-05  Keith Miller  <keith_miller@apple.com>
3281
3282         [ES6] Arrays should be subclassable.
3283         https://bugs.webkit.org/show_bug.cgi?id=152706
3284
3285         Reviewed by Benjamin Poulain.
3286
3287         This patch enables full subclassing of Arrays. We do this by fetching the new.target's prototype property
3288         in the Array constructor and transitioning the old structure to have the new prototype. This method has
3289         two downsides. The first is that we clobber the transition watchpoint on the base structure. The second,
3290         which is currently very significant but should be fixed in a future patch, is that we allocate a new
3291         structure for each new derived class we allocate.
3292
3293         * runtime/ArrayConstructor.cpp:
3294         (JSC::constructArrayWithSizeQuirk):
3295         (JSC::constructWithArrayConstructor):
3296         (JSC::callArrayConstructor):
3297         * runtime/ArrayConstructor.h:
3298         * runtime/JSGlobalObject.h:
3299         (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation):
3300         (JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation):
3301         (JSC::constructEmptyArray):
3302         (JSC::constructArray):
3303         (JSC::constructArrayNegativeIndexed):
3304         * runtime/PrototypeMap.h:
3305         * runtime/Structure.h:
3306         * runtime/StructureInlines.h:
3307         (JSC::Structure::createSubclassStructure):
3308         * tests/es6.yaml:
3309         * tests/stress/class-subclassing-array.js: Added.
3310         (A):
3311         (B.prototype.get 1):
3312         (B):
3313         (C):
3314         (test):
3315
3316 2016-01-05  Filip Pizlo  <fpizlo@apple.com>
3317
3318         regress/script-tests/deltablue-varargs.js.ftl-no-cjit-no-put-stack-validate on FTL B3 gets a B3 validation failure
3319         https://bugs.webkit.org/show_bug.cgi?id=152754
3320
3321         Reviewed by Geoffrey Garen and Saam Barati.
3322
3323         It turns out that the FTL was creating orphans. Rather than making the FTL handle them by
3324         itself, I gave B3 the power to eliminate them for you. I also made the dumper print them
3325         since otherwise, you wouldn't know anything about the orphan when looking at a validation
3326         failure or other kind of procedure dump.
3327
3328         * b3/B3IndexSet.h:
3329         (JSC::B3::IndexSet::add):
3330         (JSC::B3::IndexSet::addAll):
3331         (JSC::B3::IndexSet::remove):
3332         * b3/B3Procedure.cpp:
3333         (JSC::B3::Procedure::dump):
3334         (JSC::B3::Procedure::deleteValue):
3335         (JSC::B3::Procedure::deleteOrphans):
3336         (JSC::B3::Procedure::dominators):
3337         * b3/B3Procedure.h:
3338         (JSC::B3::Procedure::cfg):
3339         * ftl/FTLLowerDFGToLLVM.cpp:
3340         (JSC::FTL::DFG::LowerDFGToLLVM::lower):
3341
3342 2015-12-24  Mark Lam  <mark.lam@apple.com>
3343
3344         Re-landing: Add validation of JSC options to catch typos.
3345         https://bugs.webkit.org/show_bug.cgi?id=152549
3346
3347         Reviewed by Benjamin Poulain.
3348
3349         1. If a JSC_xxx option is found and xxx is not a valid option, we will now log
3350            an error message.
3351         2. If a --xxx jsc option is specified, but xxx is not a valid option, we will
3352            now log an error message.
3353         3. Added JSC_validateOptions, which if set to true will cause the VM to crash if
3354            an invalid option was seen during options parsing.
3355
3356         In this version for re-landing, I removed the change where I disallowed -- options
3357         after the script name.  Apparently, we have some test harnesses that do append the
3358         -- options after the script name.
3359
3360         * jsc.cpp:
3361         (CommandLine::parseArguments):
3362         * runtime/Options.cpp:
3363         (JSC::Options::initialize):
3364         * runtime/Options.h:
3365
3366 2016-01-05  Filip Pizlo  <fpizlo@apple.com>
3367
3368         FTL B3 should do ArithNegate
3369         https://bugs.webkit.org/show_bug.cgi?id=152745
3370
3371         Reviewed by Geoffrey Garen.
3372
3373         * ftl/FTLLowerDFGToLLVM.cpp:
3374         (JSC::FTL::DFG::LowerDFGToLLVM::compileArithNegate):
3375
3376 2016-01-05  Andy VanWagoner  <thetalecrafter@gmail.com>
3377
3378         [ES6] Date.prototype should be a plain object
3379         https://bugs.webkit.org/show_bug.cgi?id=152574
3380
3381         Reviewed by Benjamin Poulain.
3382
3383         * runtime/DateConstructor.cpp: