Source/JavaScriptCore/ChangeLog

   1 2017-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
   2
   3         [JSC] Generate TemplateObjects at linking time
   4         https://bugs.webkit.org/show_bug.cgi?id=169743
   5
   6         Reviewed by Keith Miller.
   7
   8         Currently, the code calls getTemplateObject to get appropriate template objects at runtime.
   9         But this template object is constant value and never changed. So instead of creating it
  10         at runtime, we should create it at linking time and store it in the constant registers.
  11
  12         * builtins/BuiltinNames.h:
  13         * bytecode/CodeBlock.cpp:
  14         (JSC::CodeBlock::finishCreation):
  15         (JSC::CodeBlock::setConstantRegisters):
  16         * bytecode/CodeBlock.h:
  17         * bytecode/UnlinkedCodeBlock.cpp:
  18         (JSC::UnlinkedCodeBlock::shrinkToFit):
  19         * bytecode/UnlinkedCodeBlock.h:
  20         * bytecompiler/BytecodeGenerator.cpp:
  21         (JSC::BytecodeGenerator::addTemplateRegistryKeyConstant):
  22         (JSC::BytecodeGenerator::emitGetTemplateObject):
  23         * bytecompiler/BytecodeGenerator.h:
  24         * bytecompiler/NodesCodegen.cpp:
  25         (JSC::TaggedTemplateNode::emitBytecode):
  26         * runtime/JSGlobalObject.cpp:
  27         (JSC::JSGlobalObject::init):
  28         (JSC::getTemplateObject): Deleted.
  29         * runtime/JSTemplateRegistryKey.cpp:
  30         * runtime/JSTemplateRegistryKey.h:
  31         (JSC::isTemplateRegistryKey):
  32
  33 2017-04-04  Mark Lam  <mark.lam@apple.com>
  34
  35         On ARM64, DFG::SpeculativeJIT::compileArithMod() failed to ensure result is of DataFormatInt32.
  36         https://bugs.webkit.org/show_bug.cgi?id=170473
  37         <rdar://problem/29912391>
  38
  39         Reviewed by Saam Barati.
  40
  41         In Unchecked mode, when DFG::SpeculativeJIT::compileArithMod() detects that the
  42         divisor is 0, we want it to return 0.  The result is expected to be of
  43         DataFormatIn32.
  44
  45         The ARM implementation just returns the value in the divisor register.  However,
  46         the divisor in this case can be of DataFormatJSInt32.  On ARM64, returning the
  47         divisor register yields the wrong result format because the same register also
  48         holds the upper 32-bit of the JSValue encoding.  The fix is to return an
  49         immediate 0 instead.
  50
  51         Also turned on the assertion in jitAssertIsInt32 for ARM64.  This assertion being
  52         disabled may have contributed to this bug going unnoticed all this time.
  53
  54         * dfg/DFGSpeculativeJIT.cpp:
  55         (JSC::DFG::SpeculativeJIT::compileArithMod):
  56         * jit/AssemblyHelpers.cpp:
  57         (JSC::AssemblyHelpers::jitAssertIsInt32):
  58
  59 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
  60
  61         Air::eliminateDeadCode should not repeatedly process the same live instructions
  62         https://bugs.webkit.org/show_bug.cgi?id=170490
  63
  64         Reviewed by Keith Miller.
  65
  66         This makes the eliminateDeadCode() fixpoint somewhat worklist-based: we track the set
  67         of Insts that might be dead. Every time we detect that one is live, we remove it from
  68         the set. This is a big (>2x) speed-up because lots of Insts are immediately found to
  69         be live.
  70
  71         This is a ~1% wasm -O1 compile time progression.
  72
  73         * b3/air/AirEliminateDeadCode.cpp:
  74         (JSC::B3::Air::eliminateDeadCode):
  75
  76 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
  77
  78         Air::eliminateDeadCode() should not use a HashSet
  79         https://bugs.webkit.org/show_bug.cgi?id=170487
  80
  81         Reviewed by Saam Barati.
  82
  83         Introduce TmpSet, which is like a HashSet<Tmp>. Use this to make eliminateDeadCode()
  84         about 50% faster, resulting in a 1% wasm -O1 compile time progression.
  85
  86         * JavaScriptCore.xcodeproj/project.pbxproj:
  87         * b3/air/AirEliminateDeadCode.cpp:
  88         (JSC::B3::Air::eliminateDeadCode):
  89         * b3/air/AirTmpSet.h: Added.
  90         (JSC::B3::Air::TmpSet::TmpSet):
  91         (JSC::B3::Air::TmpSet::add):
  92         (JSC::B3::Air::TmpSet::remove):
  93         (JSC::B3::Air::TmpSet::contains):
  94         (JSC::B3::Air::TmpSet::size):
  95         (JSC::B3::Air::TmpSet::isEmpty):
  96         (JSC::B3::Air::TmpSet::iterator::iterator):
  97         (JSC::B3::Air::TmpSet::iterator::operator*):
  98         (JSC::B3::Air::TmpSet::iterator::operator++):
  99         (JSC::B3::Air::TmpSet::iterator::operator==):
 100         (JSC::B3::Air::TmpSet::iterator::operator!=):
 101         (JSC::B3::Air::TmpSet::begin):
 102         (JSC::B3::Air::TmpSet::end):
 103
 104 2017-04-04  Keith Miller  <keith_miller@apple.com>
 105
 106         WebAssembly: ModuleInformation should be a ref counted thing that can be shared across threads.
 107         https://bugs.webkit.org/show_bug.cgi?id=170478
 108
 109         Reviewed by Saam Barati.
 110
 111         ModuleInformation has been moved to its own file and is now
 112         ThreadSafeRefCounted.  All the Strings we used to keep in the
 113         ModuleInformation have been switched to Vector<LChar> this has the
 114         advantage that it can be passed across threads. However, this does
 115         mean that we need to decode the utf8 strings in each thread. This
 116         is likely not a problem because:
 117
 118         1) most modules have few imports/exports/custom sections.
 119         2) most of the time they are ascii so the conversion is cheap.
 120         3) we only have to do it once per thread, and there shouldn't be too many.
 121
 122         This patch also removes
 123         moduleSignatureIndicesToUniquedSignatureIndices since that
 124         information can already be recovered from the
 125         SignatureInformation.
 126
 127         * JavaScriptCore.xcodeproj/project.pbxproj:
 128         * jsc.cpp:
 129         (functionTestWasmModuleFunctions):
 130         * runtime/Identifier.h:
 131         (JSC::Identifier::fromString):
 132         * wasm/WasmB3IRGenerator.cpp:
 133         (JSC::Wasm::parseAndCompile):
 134         * wasm/WasmB3IRGenerator.h:
 135         * wasm/WasmFormat.cpp:
 136         (JSC::Wasm::makeString):
 137         (JSC::Wasm::ModuleInformation::~ModuleInformation): Deleted.
 138         * wasm/WasmFormat.h:
 139         (JSC::Wasm::makeString):
 140         (JSC::Wasm::ModuleInformation::functionIndexSpaceSize): Deleted.
 141         (JSC::Wasm::ModuleInformation::isImportedFunctionFromFunctionIndexSpace): Deleted.
 142         (JSC::Wasm::ModuleInformation::signatureIndexFromFunctionIndexSpace): Deleted.
 143         (JSC::Wasm::ModuleInformation::importFunctionCount): Deleted.
 144         (JSC::Wasm::ModuleInformation::internalFunctionCount): Deleted.
 145         * wasm/WasmFunctionParser.h:
 146         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
 147         * wasm/WasmModuleInformation.cpp: Copied from Source/JavaScriptCore/wasm/WasmValidate.h.
 148         (JSC::Wasm::ModuleInformation::~ModuleInformation):
 149         * wasm/WasmModuleInformation.h: Added.
 150         (JSC::Wasm::ModuleInformation::functionIndexSpaceSize):
 151         (JSC::Wasm::ModuleInformation::isImportedFunctionFromFunctionIndexSpace):
 152         (JSC::Wasm::ModuleInformation::signatureIndexFromFunctionIndexSpace):
 153         (JSC::Wasm::ModuleInformation::importFunctionCount):
 154         (JSC::Wasm::ModuleInformation::internalFunctionCount):
 155         (JSC::Wasm::ModuleInformation::ModuleInformation):
 156         * wasm/WasmModuleParser.cpp:
 157         * wasm/WasmModuleParser.h:
 158         (JSC::Wasm::ModuleParser::ModuleParser):
 159         * wasm/WasmParser.h:
 160         (JSC::Wasm::Parser<SuccessType>::consumeUTF8String):
 161         * wasm/WasmPlan.cpp:
 162         (JSC::Wasm::Plan::Plan):
 163         (JSC::Wasm::Plan::parseAndValidateModule):
 164         (JSC::Wasm::Plan::prepare):
 165         (JSC::Wasm::Plan::compileFunctions):
 166         (JSC::Wasm::Plan::complete):
 167         (JSC::Wasm::Plan::cancel):
 168         * wasm/WasmPlan.h:
 169         (JSC::Wasm::Plan::internalFunctionCount):
 170         (JSC::Wasm::Plan::takeModuleInformation):
 171         * wasm/WasmSignature.cpp:
 172         (JSC::Wasm::SignatureInformation::get):
 173         * wasm/WasmSignature.h:
 174         * wasm/WasmValidate.cpp:
 175         (JSC::Wasm::validateFunction):
 176         * wasm/WasmValidate.h:
 177         * wasm/js/JSWebAssemblyHelpers.h:
 178         (JSC::createSourceBufferFromValue):
 179         * wasm/js/JSWebAssemblyModule.cpp:
 180         (JSC::JSWebAssemblyModule::createStub):
 181         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
 182         (JSC::JSWebAssemblyModule::finishCreation):
 183         * wasm/js/JSWebAssemblyModule.h:
 184         (JSC::JSWebAssemblyModule::moduleInformation):
 185         (JSC::JSWebAssemblyModule::source):
 186         * wasm/js/WebAssemblyInstanceConstructor.cpp:
 187         (JSC::constructJSWebAssemblyInstance):
 188         * wasm/js/WebAssemblyModuleConstructor.cpp:
 189         (JSC::WebAssemblyModuleConstructor::createModule):
 190         * wasm/js/WebAssemblyModulePrototype.cpp:
 191         (JSC::webAssemblyModuleProtoCustomSections):
 192         (JSC::webAssemblyModuleProtoImports):
 193         (JSC::webAssemblyModuleProtoExports):
 194         * wasm/js/WebAssemblyModuleRecord.cpp:
 195         (JSC::WebAssemblyModuleRecord::link):
 196         * wasm/js/WebAssemblyModuleRecord.h:
 197         * wasm/js/WebAssemblyPrototype.cpp:
 198         (JSC::webAssemblyCompileFunc):
 199         (JSC::instantiate):
 200         (JSC::compileAndInstantiate):
 201
 202 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 203
 204         B3::fixSSA() needs a tune-up
 205         https://bugs.webkit.org/show_bug.cgi?id=170485
 206
 207         Reviewed by Saam Barati.
 208
 209         After the various optimizations to liveness, register allocation, and other phases, the
 210         fixSSA() phase now looks like one of the top offenders. This includes a bunch of
 211         changes to make this phase run faster. This is a ~7% wasm -O1 compile time progression.
 212
 213         Here's what I did:
 214
 215         - We now use IndexSparseSet instead of IndexMap for tracking variable values. This
 216           makes it cheaper to chew through small blocks while there is a non-trivial number of
 217           total variables.
 218
 219         - We now do a "local SSA conversion" pass before anything else. This eliminates
 220           obvious Get's. If we were using temporary Variables, it would eliminate many of
 221           those. That's useful for when we use demoteValues() and duplciateTails(). For wasm
 222           -O1, we mainly care about the fact that it makes a bunch of Set's dead.
 223
 224         - We now do a Set DCE pass after the local SSA but before SSA conversion. This ensures
 225           that any block-local live intervals of Variables disappear and don't need further
 226           consideration.
 227
 228         - We now cache the reaching defs calculation.
 229
 230         - We now perform the reaching defs calculation lazily.
 231
 232         * b3/B3FixSSA.cpp:
 233         (JSC::B3::demoteValues):
 234         (JSC::B3::fixSSA):
 235         * b3/B3SSACalculator.cpp:
 236         (JSC::B3::SSACalculator::reachingDefAtTail):
 237         * b3/B3VariableLiveness.cpp:
 238         (JSC::B3::VariableLiveness::VariableLiveness):
 239         * b3/air/AirLiveness.h:
 240         (JSC::B3::Air::Liveness::Liveness):
 241         * dfg/DFGLivenessAnalysisPhase.cpp:
 242         (JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase): Deleted.
 243         (JSC::DFG::LivenessAnalysisPhase::run): Deleted.
 244         (JSC::DFG::LivenessAnalysisPhase::processBlock): Deleted.
 245
 246 2017-04-04  Joseph Pecoraro  <pecoraro@apple.com>
 247
 248         Remove stale LLVM Header Path includes from JavaScriptCore
 249         https://bugs.webkit.org/show_bug.cgi?id=170483
 250
 251         Reviewed by Mark Lam.
 252
 253         * Configurations/Base.xcconfig:
 254
 255 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 256
 257         B3::LowerToAir incorrectly selects BitXor(AtomicStrongCAS(...), $1)
 258         https://bugs.webkit.org/show_bug.cgi?id=169867
 259
 260         Reviewed by Saam Barati.
 261
 262         The BitXor(AtomicWeakCAS(...), $1) optimization makes a lot of sense because we an fold the
 263         BitXor into the CAS condition read-out. But there is no version of this that is profitable or
 264         correct for AtomicStrongCAS. The inversion case is handled by Equal(AtomicStrongCAS(...), ...)
 265         becoming NotEqual(AtomicStrongCAS(...), ...), and we alraedy handle that separately.
 266
 267         So, the fix here is to make the BitXor CAS pattern only recognize AtomicWeakCAS.
 268
 269         * b3/B3LowerToAir.cpp:
 270         (JSC::B3::Air::LowerToAir::lower):
 271         * b3/testb3.cpp:
 272         (JSC::B3::testAtomicStrongCAS):
 273
 274 2017-04-04  Saam Barati  <sbarati@apple.com>
 275
 276         WebAssembly: JSWebAssemblyCallee should not be a JSCell
 277         https://bugs.webkit.org/show_bug.cgi?id=170135
 278
 279         Reviewed by Michael Saboff.
 280
 281         This patch is perhaps the last big change to the design of fundamental
 282         Wasm API to allow for PIC. It changes JSWebAssemblyCallee into a thing
 283         called Wasm::Callee. It serves the same purpose as before, except
 284         Wasm::Callee is not a JSCell. I had to refactor the various parts of the
 285         runtime that will see CallFrame's with Wasm::Callee's in the callee slot.
 286         Thankfully, the parts of the runtime that Wasm touches are limited. The
 287         main refactoring is changing the exception handling code, such as taking
 288         a stack trace, to be friendly to seeing a non JSCell callee.
 289
 290         The callee() function on ExecState now returns a class I added in this
 291         patch called CalleeBits. CalleeBits will tell you if the callee is a
 292         JSCell or a Wasm::Callee. We tag Wasm::Callee's with a 1 in their lower
 293         bit so we can easily tell what is and isn't a Wasm::Callee.
 294
 295         The stub that calls out from Wasm to JS still puts a JSCell callee
 296         into the call frame, even though the callee logically represents a
 297         Wasm frame. The reason for this is that we use the call IC infrastructure
 298         to make a call out to JS code, and the code that writes the IC expects
 299         a JSCell as the callee. This is knowingly part of our design. When we
 300         do structured cloning of Wasm Modules, we'll need to regenerate these
 301         JS call stubs.
 302
 303         * API/JSContextRef.cpp:
 304         (BacktraceFunctor::operator()):
 305         * CMakeLists.txt:
 306         * JavaScriptCore.xcodeproj/project.pbxproj:
 307         * debugger/Debugger.cpp:
 308         (JSC::Debugger::pauseIfNeeded):
 309         (JSC::Debugger::currentDebuggerCallFrame):
 310         * debugger/DebuggerCallFrame.cpp:
 311         (JSC::DebuggerCallFrame::create):
 312         (JSC::DebuggerCallFrame::DebuggerCallFrame):
 313         (JSC::DebuggerCallFrame::currentPosition):
 314         (JSC::DebuggerCallFrame::positionForCallFrame):
 315         * debugger/DebuggerCallFrame.h:
 316         * interpreter/CallFrame.cpp:
 317         (JSC::CallFrame::vmEntryGlobalObject):
 318         (JSC::CallFrame::wasmAwareLexicalGlobalObject):
 319         (JSC::CallFrame::isAnyWasmCallee):
 320         (JSC::CallFrame::callerSourceOrigin):
 321         * interpreter/CallFrame.h:
 322         (JSC::ExecState::calleeAsValue):
 323         (JSC::ExecState::jsCallee):
 324         (JSC::ExecState::callee):
 325         (JSC::ExecState::unsafeCallee):
 326         (JSC::ExecState::scope):
 327         (JSC::ExecState::iterate):
 328         * interpreter/CalleeBits.h: Added.
 329         (JSC::CalleeBits::CalleeBits):
 330         (JSC::CalleeBits::operator=):
 331         (JSC::CalleeBits::boxWasm):
 332         (JSC::CalleeBits::isWasm):
 333         (JSC::CalleeBits::isCell):
 334         (JSC::CalleeBits::asCell):
 335         (JSC::CalleeBits::asWasmCallee):
 336         (JSC::CalleeBits::rawPtr):
 337         * interpreter/Interpreter.cpp:
 338         (JSC::GetStackTraceFunctor::operator()):
 339         (JSC::Interpreter::getStackTrace):
 340         (JSC::notifyDebuggerOfUnwinding):
 341         (JSC::UnwindFunctor::UnwindFunctor):
 342         (JSC::UnwindFunctor::operator()):
 343         (JSC::UnwindFunctor::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
 344         (JSC::Interpreter::unwind):
 345         (JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):
 346         * interpreter/Interpreter.h:
 347         * interpreter/Register.h:
 348         (JSC::Register::pointer):
 349         * interpreter/ShadowChicken.cpp:
 350         (JSC::ShadowChicken::update):
 351         * interpreter/ShadowChickenInlines.h:
 352         (JSC::ShadowChicken::iterate):
 353         * interpreter/StackVisitor.cpp:
 354         (JSC::StackVisitor::StackVisitor):
 355         (JSC::StackVisitor::readFrame):
 356         (JSC::StackVisitor::readNonInlinedFrame):
 357         (JSC::StackVisitor::readInlinedFrame):
 358         (JSC::StackVisitor::Frame::calleeSaveRegisters):
 359         (JSC::StackVisitor::Frame::functionName):
 360         (JSC::StackVisitor::Frame::dump):
 361         * interpreter/StackVisitor.h:
 362         (JSC::StackVisitor::Frame::callee):
 363         (JSC::StackVisitor::visit):
 364         * jit/Repatch.cpp:
 365         (JSC::linkFor):
 366         (JSC::linkPolymorphicCall):
 367         * jsc.cpp:
 368         (callWasmFunction):
 369         (functionTestWasmModuleFunctions):
 370         * runtime/ArrayPrototype.cpp:
 371         * runtime/Error.cpp:
 372         (JSC::addErrorInfoAndGetBytecodeOffset):
 373         * runtime/ErrorInstance.cpp:
 374         (JSC::ErrorInstance::finishCreation):
 375         * runtime/JSCell.cpp:
 376         (JSC::JSCell::isAnyWasmCallee): Deleted.
 377         * runtime/JSCell.h:
 378         * runtime/JSCellInlines.h:
 379         (JSC::ExecState::vm):
 380         * runtime/JSFunction.cpp:
 381         (JSC::RetrieveArgumentsFunctor::operator()):
 382         (JSC::RetrieveCallerFunctionFunctor::operator()):
 383         * runtime/JSGlobalObject.cpp:
 384         * runtime/SamplingProfiler.cpp:
 385         (JSC::FrameWalker::recordJSFrame):
 386         (JSC::SamplingProfiler::processUnverifiedStackTraces):
 387         * runtime/SamplingProfiler.h:
 388         (JSC::SamplingProfiler::UnprocessedStackFrame::UnprocessedStackFrame):
 389         * runtime/StackFrame.cpp:
 390         (JSC::StackFrame::sourceURL):
 391         (JSC::StackFrame::functionName):
 392         * runtime/StackFrame.h:
 393         (JSC::StackFrame::wasm):
 394         * runtime/VM.cpp:
 395         (JSC::VM::VM):
 396         (JSC::VM::throwException):
 397         * runtime/VM.h:
 398         * wasm/JSWebAssembly.h:
 399         * wasm/WasmB3IRGenerator.cpp:
 400         * wasm/WasmBinding.cpp:
 401         (JSC::Wasm::wasmToWasm):
 402         * wasm/WasmCallee.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp.
 403         (JSC::Wasm::Callee::Callee):
 404         (JSC::JSWebAssemblyCallee::JSWebAssemblyCallee): Deleted.
 405         (JSC::JSWebAssemblyCallee::finishCreation): Deleted.
 406         (JSC::JSWebAssemblyCallee::destroy): Deleted.
 407         * wasm/WasmCallee.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.h.
 408         (JSC::Wasm::Callee::create):
 409         (JSC::JSWebAssemblyCallee::create): Deleted.
 410         (JSC::JSWebAssemblyCallee::createStructure): Deleted.
 411         (JSC::JSWebAssemblyCallee::entrypoint): Deleted.
 412         (JSC::JSWebAssemblyCallee::calleeSaveRegisters): Deleted.
 413         * wasm/WasmContext.h:
 414         * wasm/WasmPlan.cpp:
 415         * wasm/WasmPlan.h:
 416         * wasm/WasmPlanInlines.h:
 417         (JSC::Wasm::Plan::initializeCallees):
 418         * wasm/WasmThunks.cpp:
 419         (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
 420         * wasm/js/JSWebAssemblyCallee.cpp: Removed.
 421         * wasm/js/JSWebAssemblyCallee.h: Removed.
 422         * wasm/js/JSWebAssemblyCodeBlock.cpp:
 423         (JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
 424         (JSC::JSWebAssemblyCodeBlock::initialize):
 425         (JSC::JSWebAssemblyCodeBlock::visitChildren):
 426         * wasm/js/JSWebAssemblyCodeBlock.h:
 427         (JSC::JSWebAssemblyCodeBlock::create):
 428         (JSC::JSWebAssemblyCodeBlock::jsEntrypointCalleeFromFunctionIndexSpace):
 429         (JSC::JSWebAssemblyCodeBlock::wasmEntrypointCalleeFromFunctionIndexSpace):
 430         (JSC::JSWebAssemblyCodeBlock::wasmToJsCallStubForImport):
 431         (JSC::JSWebAssemblyCodeBlock::offsetOfImportWasmToJSStub):
 432         (JSC::JSWebAssemblyCodeBlock::setJSEntrypointCallee):
 433         (JSC::JSWebAssemblyCodeBlock::setWasmEntrypointCallee):
 434         (JSC::JSWebAssemblyCodeBlock::offsetOfImportStubs):
 435         (JSC::JSWebAssemblyCodeBlock::allocationSize):
 436         (JSC::JSWebAssemblyCodeBlock::importWasmToJSStub):
 437         (JSC::JSWebAssemblyCodeBlock::callees): Deleted.
 438         (JSC::JSWebAssemblyCodeBlock::offsetOfCallees): Deleted.
 439         * wasm/js/JSWebAssemblyInstance.h:
 440         (JSC::JSWebAssemblyInstance::webAssemblyToJSCallee):
 441         * wasm/js/JSWebAssemblyModule.cpp:
 442         * wasm/js/WebAssemblyFunction.cpp:
 443         (JSC::callWebAssemblyFunction):
 444         (JSC::WebAssemblyFunction::create):
 445         (JSC::WebAssemblyFunction::WebAssemblyFunction):
 446         (JSC::WebAssemblyFunction::visitChildren):
 447         (JSC::WebAssemblyFunction::finishCreation):
 448         * wasm/js/WebAssemblyFunction.h:
 449         (JSC::WebAssemblyFunction::wasmEntrypoint):
 450         (JSC::WebAssemblyFunction::jsEntrypoint):
 451         (JSC::WebAssemblyFunction::offsetOfWasmEntrypoint):
 452         (JSC::WebAssemblyFunction::offsetOfWasmEntryPointCode): Deleted.
 453         * wasm/js/WebAssemblyModuleConstructor.cpp:
 454         * wasm/js/WebAssemblyModuleRecord.cpp:
 455         (JSC::WebAssemblyModuleRecord::link):
 456         (JSC::WebAssemblyModuleRecord::evaluate):
 457
 458 2017-04-04  Keith Miller  <keith_miller@apple.com>
 459
 460         WasmBench asserts in debug jsc
 461         https://bugs.webkit.org/show_bug.cgi?id=170462
 462
 463         Reviewed by Saam Barati.
 464
 465         The assertion should have been an if.
 466
 467         * wasm/WasmWorklist.cpp:
 468
 469 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 470
 471         Air::lowerAfterRegAlloc should bail early if it finds no Shuffles or ColdCCalls
 472         https://bugs.webkit.org/show_bug.cgi?id=170305
 473
 474         Reviewed by Saam Barati.
 475
 476         This reduces and sometimes completely eliminates the need to run lowerAfterRegAlloc().
 477
 478         This lowers the Shuffle for the arguments of a CCall before register allocation unless
 479         the CCall arguments require a real shuffle (like if the CCall arguments were argument
 480         registers). This lowers a ColdCCall like a CCall for optLevel<2.
 481
 482         Finally, lowerAfterRegAlloc() now checks if there are any Shuffles or CCalls before it
 483         does anything else. For wasm at -O1, this means that the phase doesn't run at all. This
 484         is a ~3% wasm -O1 compile time progression.
 485
 486         To make this easy, I changed optLevel into a property of Procedure and Code rather than
 487         an argument we thread through everything. I like how Procedure and Code are dumping
 488         ground classes. This does not bother me. Note that I cloned optLevel into Procedure and
 489         Code so that it's cheap to query inside Air phases.
 490
 491         * b3/B3Compile.cpp:
 492         (JSC::B3::compile):
 493         * b3/B3Compile.h:
 494         * b3/B3Generate.cpp:
 495         (JSC::B3::prepareForGeneration):
 496         (JSC::B3::generateToAir):
 497         * b3/B3Generate.h:
 498         * b3/B3Procedure.cpp:
 499         (JSC::B3::Procedure::setOptLevel):
 500         * b3/B3Procedure.h:
 501         (JSC::B3::Procedure::optLevel):
 502         * b3/air/AirCode.h:
 503         (JSC::B3::Air::Code::isPinned):
 504         (JSC::B3::Air::Code::setOptLevel):
 505         (JSC::B3::Air::Code::optLevel):
 506         * b3/air/AirEmitShuffle.cpp:
 507         (JSC::B3::Air::ShufflePair::bank):
 508         (JSC::B3::Air::ShufflePair::opcode):
 509         (JSC::B3::Air::ShufflePair::inst):
 510         (JSC::B3::Air::emitShuffle):
 511         * b3/air/AirEmitShuffle.h:
 512         (JSC::B3::Air::moveFor):
 513         * b3/air/AirGenerate.cpp:
 514         (JSC::B3::Air::prepareForGeneration):
 515         * b3/air/AirGenerate.h:
 516         * b3/air/AirLowerAfterRegAlloc.cpp:
 517         (JSC::B3::Air::lowerAfterRegAlloc):
 518         * b3/air/AirLowerMacros.cpp:
 519         (JSC::B3::Air::lowerMacros):
 520         * b3/testb3.cpp:
 521         (JSC::B3::compileProc):
 522         * wasm/WasmB3IRGenerator.cpp:
 523         (JSC::Wasm::parseAndCompile):
 524
 525 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 526
 527         Don't need to Air::reportUsedRegisters for wasm at -O1
 528         https://bugs.webkit.org/show_bug.cgi?id=170459
 529
 530         Reviewed by Saam Barati.
 531
 532         I did some refactorings to Liveness<> to try to understand its performance. Based on
 533         this I concluded that the bigger immediate issue is just removing unnecessary phases
 534         from -O1.
 535
 536         This removes Air::reportUsedRegisters() from -O1 if the user has indicated that he is
 537         not interested in StackmapGenerationParams::usedRegisters(). The logic here is a bit
 538         weird because of how Air does spill code generation. The register allocator's spiller
 539         will emit spill code using identifiable spill slots, which allows subsequent phases to
 540         register-allocate the spill slots. We do this by a forward flow CSE phase called
 541         fixObviousSpills (which is a terrible name since there is no longer anything obvious
 542         about some of the spills that this phase can fix!). As is most natural for CSEs over
 543         3AC, it rewires the uses of redundant computations rather than removing the redundant
 544         computations. This means that if a spill got "fixed", there may be either or both of
 545         the following:
 546
 547         - Dead loads from the stack.
 548         - Dead stores to the stack.
 549
 550         We know that a load from the stack is dead if the register is dead at the point of the
 551         load. We know that a store to the stack is dead if the spill slot is dead at the point
 552         of the store.
 553
 554         Unfortunately, liveness analysis - over either registers or spill slots - is expensive.
 555
 556         Fortunately, allocateStack() already does liveness analysis over spill slots. So, we
 557         baked elimination of stores to the stack into that phase. That aspect of clean-up after
 558         the spill CSE comes for free.
 559
 560         Also fortunately for the FTL, we have to do reportUsedRegisters() anyway. This is a
 561         phase that enables StackmapGenerationParams::usedRegisters() to work, which then
 562         enables the FTL's patchpoints to do crazy slow-path live range splitting. So, Air's
 563         strategy for the load fix-up after spill CSE is to do it as part of
 564         reportUsedRegisters().
 565
 566         This patch introduces the Procedure::setNeedsUsedRegisters() API. But if you set
 567         needsUsedRegisters to false then we will still run reportUsedRegisters() at -O2 as an
 568         optimization - it removes dead loads from the stack that are left behind from
 569         fixObviousSpills().
 570
 571         This is a ~6% compile time progression at -O1.
 572
 573         * b3/B3Procedure.h:
 574         (JSC::B3::Procedure::setNeedsUsedRegisters):
 575         (JSC::B3::Procedure::needsUsedRegisters):
 576         * b3/B3StackmapGenerationParams.h:
 577         * b3/B3VariableLiveness.cpp:
 578         (JSC::B3::VariableLiveness::VariableLiveness):
 579         * b3/air/AirCode.cpp:
 580         (JSC::B3::Air::Code::needsUsedRegisters):
 581         * b3/air/AirCode.h:
 582         * b3/air/AirGenerate.cpp:
 583         (JSC::B3::Air::prepareForGeneration):
 584         * b3/air/AirLiveness.h:
 585         (JSC::B3::Air::Liveness::Liveness):
 586         * wasm/WasmB3IRGenerator.cpp:
 587         (JSC::Wasm::parseAndCompile):
 588
 589 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 590
 591         Air liveness should build constraints and solve them rather than repeatedly parsing IR
 592         https://bugs.webkit.org/show_bug.cgi?id=170421
 593
 594         Reviewed by Saam Barati.
 595
 596         Inst::forEach<> is expensive. The LivenessAdapter uses forEach with a particularly
 597         gnarly lambda that has many extra checks. Therefore, a lot of the time spent in
 598         liveness analysis is just recomputing forEach<> and that lambda to get uses and defs.
 599
 600         This introduces LivenessConstraints<>, which is a liveness constraint system based on
 601         Adapter. It basically caches the results of doing forEach. It'll give you the uses and
 602         defs at each instruction boundary.
 603
 604         This is a ~5% compile time progression at optLevel=1. It's also a ~3% compile time
 605         progression at optLevel=2.
 606
 607         * JavaScriptCore.xcodeproj/project.pbxproj:
 608         * b3/air/AirLivenessAdapter.h:
 609         (JSC::B3::Air::LivenessAdapter::LivenessAdapter):
 610         (JSC::B3::Air::LivenessAdapter::forEachUse):
 611         (JSC::B3::Air::LivenessAdapter::forEachDef):
 612         * b3/air/AirLivenessConstraints.h: Added.
 613         (JSC::B3::Air::LivenessConstraints::Actions::Actions):
 614         (JSC::B3::Air::LivenessConstraints::LivenessConstraints):
 615         (JSC::B3::Air::LivenessConstraints::at):
 616
 617 2017-04-03  Mark Lam  <mark.lam@apple.com>
 618
 619         Fix incorrect capacity delta calculation reported in SparseArrayValueMap::add().
 620         https://bugs.webkit.org/show_bug.cgi?id=170412
 621         <rdar://problem/29697336>
 622
 623         Reviewed by Filip Pizlo.
 624
 625         Here's an example of code that will trigger underflow in the "deprecatedExtraMemory"
 626         reported by SparseArrayValueMap::add() that is added to Heap::m_deprecatedExtraMemorySize:
 627
 628             arr = new Array;
 629             Object.defineProperty(arr, 18, ({writable: true, configurable: true}));
 630             for (var i = 0; i < 3; ++i) {
 631                 Array.prototype.push.apply(arr, ["", () => {}, {}]);
 632                 Array.prototype.sort.apply(arr, [() => {}, []]);
 633             }
 634
 635         However, Heap::m_deprecatedExtraMemorySize is only 1 of 3 values that are added
 636         up to form the result of Heap::extraMemorySize().  Heap::m_extraMemorySize and
 637         Heap::m_arrayBuffers.size() are the other 2.
 638
 639         While Heap::m_arrayBuffers.size() is bounded by actual allocated memory, both
 640         Heap::m_deprecatedExtraMemorySize and Heap::m_extraMemorySize are added to
 641         without any bounds checks, and they are only reset to 0 at the start of a full
 642         GC.  As a result, if we have a long sequence of eden GCs with a lot of additions
 643         to Heap::m_extraMemorySize and/or Heap::m_deprecatedExtraMemorySize, then these
 644         values could theoretically overflow.  Coupling this with the underflow from
 645         SparseArrayValueMap::add(), the result for Heap::extraMemorySize() can easily
 646         overflow.  Note: Heap::extraMemorySize() is used to compute the value
 647         currentHeapSize.
 648
 649         If multiple conditions line up just right, the above overflows can result in this
 650         debug assertion failure during an eden GC:
 651
 652             ASSERT(currentHeapSize >= m_sizeAfterLastCollect);
 653
 654         Otherwise, the effects of the overflows will only result in the computed
 655         currentHeapSize not being representative of actual memory usage, and therefore,
 656         a full GC may be triggered earlier or later than is ideal.
 657
 658         This patch ensures that SparseArrayValueMap::add() cannot underflow
 659         Heap::m_deprecatedExtraMemorySize.  It also adds overflows checks in the
 660         calculations of Heap::m_deprecatedExtraMemorySize, Heap::m_extraMemorySize, and
 661         Heap::extraMemorySize() so that their values are saturated appropriately to
 662         ensure that GC collections are triggered based on representative memory usage.
 663
 664         * heap/Heap.cpp:
 665         (JSC::Heap::deprecatedReportExtraMemorySlowCase):
 666         (JSC::Heap::extraMemorySize):
 667         (JSC::Heap::updateAllocationLimits):
 668         (JSC::Heap::reportExtraMemoryVisited):
 669         * runtime/SparseArrayValueMap.cpp:
 670         (JSC::SparseArrayValueMap::add):
 671
 672 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 673
 674         Move the Liveness<> adapters from AirLiveness.h to AirLivenessAdapter.h.
 675
 676         Rubber stamped by Keith Miller.
 677
 678         This will make it easier to write other code that uses those adapters.
 679
 680         * JavaScriptCore.xcodeproj/project.pbxproj:
 681         * b3/air/AirLiveness.h:
 682         (JSC::B3::Air::LivenessAdapter::LivenessAdapter): Deleted.
 683         (JSC::B3::Air::LivenessAdapter::blockSize): Deleted.
 684         (JSC::B3::Air::LivenessAdapter::forEachUse): Deleted.
 685         (JSC::B3::Air::LivenessAdapter::forEachDef): Deleted.
 686         (JSC::B3::Air::TmpLivenessAdapter::TmpLivenessAdapter): Deleted.
 687         (JSC::B3::Air::TmpLivenessAdapter::numIndices): Deleted.
 688         (JSC::B3::Air::TmpLivenessAdapter::acceptsBank): Deleted.
 689         (JSC::B3::Air::TmpLivenessAdapter::acceptsRole): Deleted.
 690         (JSC::B3::Air::TmpLivenessAdapter::valueToIndex): Deleted.
 691         (JSC::B3::Air::TmpLivenessAdapter::indexToValue): Deleted.
 692         (JSC::B3::Air::StackSlotLivenessAdapter::StackSlotLivenessAdapter): Deleted.
 693         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices): Deleted.
 694         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsBank): Deleted.
 695         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsRole): Deleted.
 696         (JSC::B3::Air::StackSlotLivenessAdapter::valueToIndex): Deleted.
 697         (JSC::B3::Air::StackSlotLivenessAdapter::indexToValue): Deleted.
 698         * b3/air/AirLivenessAdapter.h: Added.
 699         (JSC::B3::Air::LivenessAdapter::LivenessAdapter):
 700         (JSC::B3::Air::LivenessAdapter::blockSize):
 701         (JSC::B3::Air::LivenessAdapter::forEachUse):
 702         (JSC::B3::Air::LivenessAdapter::forEachDef):
 703         (JSC::B3::Air::TmpLivenessAdapter::TmpLivenessAdapter):
 704         (JSC::B3::Air::TmpLivenessAdapter::numIndices):
 705         (JSC::B3::Air::TmpLivenessAdapter::acceptsBank):
 706         (JSC::B3::Air::TmpLivenessAdapter::acceptsRole):
 707         (JSC::B3::Air::TmpLivenessAdapter::valueToIndex):
 708         (JSC::B3::Air::TmpLivenessAdapter::indexToValue):
 709         (JSC::B3::Air::StackSlotLivenessAdapter::StackSlotLivenessAdapter):
 710         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
 711         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsBank):
 712         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsRole):
 713         (JSC::B3::Air::StackSlotLivenessAdapter::valueToIndex):
 714         (JSC::B3::Air::StackSlotLivenessAdapter::indexToValue):
 715
 716 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 717
 718         WTF::Liveness should have an API that focuses on actions at instruction boundaries
 719         https://bugs.webkit.org/show_bug.cgi?id=170407
 720
 721         Reviewed by Keith Miller.
 722
 723         Adopt changes to the WTF::Liveness<> API. Instead of having separate functions for the
 724         early/late versions of uses and defs, we now have just a use/def API. Those
 725         automatically take care of eary/late issues as needed.
 726
 727         This reduces the API surface between WTF::Liveness<> and its clients, which makes it
 728         easier to implement some other optimizations I'm thinking about.
 729
 730         * b3/B3VariableLiveness.h:
 731         (JSC::B3::VariableLivenessAdapter::forEachUse):
 732         (JSC::B3::VariableLivenessAdapter::forEachDef):
 733         (JSC::B3::VariableLivenessAdapter::forEachEarlyUse): Deleted.
 734         (JSC::B3::VariableLivenessAdapter::forEachLateUse): Deleted.
 735         (JSC::B3::VariableLivenessAdapter::forEachEarlyDef): Deleted.
 736         (JSC::B3::VariableLivenessAdapter::forEachLateDef): Deleted.
 737         * b3/air/AirLiveness.h:
 738         (JSC::B3::Air::LivenessAdapter::blockSize):
 739         (JSC::B3::Air::LivenessAdapter::forEachUse):
 740         (JSC::B3::Air::LivenessAdapter::forEachDef):
 741         (JSC::B3::Air::LivenessAdapter::forEachEarlyUse): Deleted.
 742         (JSC::B3::Air::LivenessAdapter::forEachLateUse): Deleted.
 743         (JSC::B3::Air::LivenessAdapter::forEachEarlyDef): Deleted.
 744         (JSC::B3::Air::LivenessAdapter::forEachLateDef): Deleted.
 745
 746 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 747
 748         Inst::forEachArg could compile to more compact code
 749         https://bugs.webkit.org/show_bug.cgi?id=170406
 750
 751         Reviewed by Sam Weinig.
 752
 753         Prior to this change, Inst::forEachArg compiled to a ginormous ALWAYS_INLINE switch statement.
 754         It had one case for each opcode, and then each of those cases would have a switch statement over
 755         the number of operands. Then the cases of that switch statement would have a sequence of calls to
 756         the passed lambda. This meant that every user of forEachArg would generate an insane amount of
 757         code. It also meant that the inlining achieved nothing, since the lambda would surely then not
 758         be inlined - and if it was, then the icache pressure due to code bloat would surely negate any
 759         benefits.
 760
 761         This replaces that code with a loop over a compact look-up table. We use the opcode and number of
 762         operands as keys into that look-up table. The table only takes about 20KB. It has one byte for
 763         each argument in each overload of each opcode.
 764
 765         I can't measure any reproducible change in performance, but the JavaScriptCore framework binary
 766         shrinks by 2.7 MB. This is a 15% reduction in JavaScriptCore binary size.
 767
 768         * JavaScriptCore.xcodeproj/project.pbxproj:
 769         * b3/B3Width.h:
 770         * b3/air/AirCustom.h:
 771         (JSC::B3::Air::PatchCustom::forEachArg):
 772         * b3/air/AirFormTable.h: Added.
 773         (JSC::B3::Air::decodeFormRole):
 774         (JSC::B3::Air::decodeFormBank):
 775         (JSC::B3::Air::decodeFormWidth):
 776         * b3/air/AirInst.h:
 777         * b3/air/opcode_generator.rb:
 778
 779 2017-04-03  Keith Miller  <keith_miller@apple.com>
 780
 781         WebAssembly: remove lastAllocatedMode from Memory
 782         https://bugs.webkit.org/show_bug.cgi?id=170405
 783
 784         Reviewed by Mark Lam.
 785
 786         It's not used anymore so there isn't any point in keeping it around.
 787
 788         * wasm/WasmMemory.cpp:
 789         (JSC::Wasm::Memory::createImpl):
 790         (JSC::Wasm::Memory::lastAllocatedMode): Deleted.
 791         * wasm/WasmMemory.h:
 792
 793 2017-04-03  Zan Dobersek  <zdobersek@igalia.com>
 794
 795         [jsc] Add patchableJumpSize() for MIPS
 796         https://bugs.webkit.org/show_bug.cgi?id=169716
 797
 798         Reviewed by Yusuke Suzuki.
 799
 800         * assembler/MIPSAssembler.h:
 801         (JSC::MIPSAssembler::patchableJumpSize): Added.
 802         * assembler/MacroAssemblerMIPS.h:
 803         (JSC::MacroAssemblerMIPS::patchableJumpSize): Added.
 804
 805 2017-04-03  Guillaume Emont  <guijemont@igalia.com>
 806
 807         [jsc] implement MIPSAssembler::relinkJumpToNop()
 808         https://bugs.webkit.org/show_bug.cgi?id=169720
 809
 810         Reviewed by Yusuke Suzuki.
 811
 812         * assembler/MIPSAssembler.h:
 813         (JSC::MIPSAssembler::relinkJumpToNop): Added.
 814
 815 2017-04-02  Carlos Garcia Campos  <cgarcia@igalia.com>
 816
 817         Share implementation of JSRunLoopTimer::timerDidFire
 818         https://bugs.webkit.org/show_bug.cgi?id=170392
 819
 820         Reviewed by Michael Catanzaro.
 821
 822         The code is cross-platform but it's duplicated in CF and GLib implementations, it could be shared instead.
 823
 824         * runtime/JSRunLoopTimer.cpp:
 825         (JSC::JSRunLoopTimer::timerDidFire): Move common implementation here.
 826         (JSC::JSRunLoopTimer::setRunLoop): Use timerDidFireCallback.
 827         (JSC::JSRunLoopTimer::timerDidFireCallback): Call JSRunLoopTimer::timerDidFire().
 828         * runtime/JSRunLoopTimer.h:
 829
 830 2017-04-01  Oleksandr Skachkov  <gskachkov@gmail.com>
 831
 832         Object with numerical keys with gaps gets filled by NaN values
 833         https://bugs.webkit.org/show_bug.cgi?id=164412
 834
 835         Reviewed by Mark Lam.
 836
 837         This patch fixes issue when object have two properties
 838         with name as number. The issue appears when during invoking
 839         convertDoubleToArrayStorage, array is filled by pNaN and
 840         method converting it to real NaN. This happeneds because a
 841         pNaN in a Double array is a hole, and Double arrays cannot
 842         have NaN values. To fix issue we need to check value and
 843         clear it if it pNaN.
 844
 845         * runtime/JSObject.cpp:
 846         (JSC::JSObject::convertDoubleToArrayStorage):
 847
 848 2017-03-31  Saam Barati  <sbarati@apple.com>
 849
 850         WebAssembly: Make our calls out to JS PIC friendly
 851         https://bugs.webkit.org/show_bug.cgi?id=170261
 852
 853         Reviewed by Keith Miller.
 854
 855         This patch removes a direct call from the module to the Wasm to JS stub.
 856         Instead, we do an indirect call to the stub by loading the stub's executable
 857         address off of the CodeBlock. This is to make the code we emit for comply with
 858         requirements needed for PIC.
 859
 860         Adding this indirection is not ideal. Although this patch is neutral on
 861         WasmBench, we really want to get back to a world where we have an IC
 862         call infrastructure. This patch is obviously a regression on some
 863         types of programs. I've filed this bug to make sure we implement a
 864         PIC compliant Wasm to JS call IC:
 865         https://bugs.webkit.org/show_bug.cgi?id=170375
 866
 867         * wasm/WasmB3IRGenerator.cpp:
 868         * wasm/WasmFormat.h:
 869         * wasm/WasmPlan.cpp:
 870         (JSC::Wasm::Plan::complete):
 871         * wasm/js/JSWebAssemblyCodeBlock.cpp:
 872         (JSC::JSWebAssemblyCodeBlock::initialize):
 873         * wasm/js/JSWebAssemblyCodeBlock.h:
 874         (JSC::JSWebAssemblyCodeBlock::create):
 875         (JSC::JSWebAssemblyCodeBlock::offsetOfImportWasmToJSStub):
 876         (JSC::JSWebAssemblyCodeBlock::offsetOfCallees):
 877         (JSC::JSWebAssemblyCodeBlock::allocationSize):
 878         (JSC::JSWebAssemblyCodeBlock::importWasmToJSStub):
 879         * wasm/js/JSWebAssemblyInstance.cpp:
 880         (JSC::JSWebAssemblyInstance::addUnitializedCodeBlock):
 881         * wasm/js/JSWebAssemblyInstance.h:
 882         (JSC::JSWebAssemblyInstance::offsetOfCodeBlock):
 883
 884 2017-03-31  Keith Miller  <keith_miller@apple.com>
 885
 886         WebAssembly: webAssemblyB3OptimizationLevel should use defaultB3OptLevel by default
 887         https://bugs.webkit.org/show_bug.cgi?id=170378
 888
 889         Reviewed by Saam Barati.
 890
 891         * runtime/Options.h:
 892         * wasm/WasmB3IRGenerator.h:
 893
 894 2017-03-31  Keith Miller  <keith_miller@apple.com>
 895
 896         WebAssembly: Add compilation level option
 897         https://bugs.webkit.org/show_bug.cgi?id=170374
 898
 899         Reviewed by Mark Lam.
 900
 901         This patch adds an option, webAssemblyB3OptimizationLevel, which
 902         changes the optimization mode wasm passes to B3.
 903
 904         * runtime/Options.h:
 905         * wasm/WasmPlan.cpp:
 906         (JSC::Wasm::Plan::compileFunctions):
 907
 908 2017-03-31  Saam Barati  <sbarati@apple.com>
 909
 910         WebAssembly: Strip WasmParser and WasmFunctionParser from knowing about VM
 911         https://bugs.webkit.org/show_bug.cgi?id=170312
 912
 913         Reviewed by Mark Lam.
 914
 915         This is another step towards PIC-ifying Wasm. This patch removes
 916         the VM field that is no longer used.
 917
 918         * wasm/WasmB3IRGenerator.cpp:
 919         (JSC::Wasm::parseAndCompile):
 920         * wasm/WasmB3IRGenerator.h:
 921         * wasm/WasmFunctionParser.h:
 922         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
 923         * wasm/WasmModuleParser.h:
 924         (JSC::Wasm::ModuleParser::ModuleParser):
 925         * wasm/WasmParser.h:
 926         (JSC::Wasm::Parser<SuccessType>::Parser):
 927         * wasm/WasmPlan.cpp:
 928         (JSC::Wasm::Plan::parseAndValidateModule):
 929         (JSC::Wasm::Plan::compileFunctions):
 930         * wasm/WasmValidate.cpp:
 931         (JSC::Wasm::validateFunction):
 932         * wasm/WasmValidate.h:
 933
 934 2017-03-31  Saam Barati  <sbarati@apple.com>
 935
 936         WebAssembly: Ref count Signature and SignatureInformation should not care about VM
 937         https://bugs.webkit.org/show_bug.cgi?id=170316
 938
 939         Reviewed by Keith Miller.
 940
 941         This is yet again another step towards PIC-ifying Wasm.
 942         Signature should be ref counted so we can tell when
 943         no code is holding onto a Signature. This makes it easy
 944         to free unused Signatures. Also, this patch rids SignatureInfo
 945         of any VM knowledge. Now, there is just a single SignatureInfo that
 946         lives in a process.
 947
 948         * runtime/VM.h:
 949         * wasm/WasmB3IRGenerator.cpp:
 950         (JSC::Wasm::createJSToWasmWrapper):
 951         (JSC::Wasm::parseAndCompile):
 952         * wasm/WasmB3IRGenerator.h:
 953         * wasm/WasmBinding.cpp:
 954         (JSC::Wasm::wasmToJs):
 955         * wasm/WasmCallingConvention.h:
 956         (JSC::Wasm::CallingConvention::loadArguments):
 957         * wasm/WasmFormat.h:
 958         * wasm/WasmFunctionParser.h:
 959         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
 960         * wasm/WasmModuleParser.cpp:
 961         * wasm/WasmPlan.cpp:
 962         (JSC::Wasm::Plan::parseAndValidateModule):
 963         (JSC::Wasm::Plan::compileFunctions):
 964         (JSC::Wasm::Plan::complete):
 965         * wasm/WasmSignature.cpp:
 966         (JSC::Wasm::Signature::hash):
 967         (JSC::Wasm::Signature::tryCreate):
 968         (JSC::Wasm::SignatureInformation::SignatureInformation):
 969         (JSC::Wasm::SignatureInformation::singleton):
 970         (JSC::Wasm::SignatureInformation::adopt):
 971         (JSC::Wasm::SignatureInformation::get):
 972         (JSC::Wasm::SignatureInformation::tryCleanup):
 973         (JSC::Wasm::Signature::create): Deleted.
 974         (JSC::Wasm::Signature::createInvalid): Deleted.
 975         (JSC::Wasm::Signature::destroy): Deleted.
 976         (JSC::Wasm::SignatureInformation::~SignatureInformation): Deleted.
 977         * wasm/WasmSignature.h:
 978         (JSC::Wasm::Signature::allocatedSize):
 979         (JSC::Wasm::Signature::operator==):
 980         * wasm/WasmValidate.cpp:
 981         (JSC::Wasm::validateFunction):
 982         * wasm/WasmValidate.h:
 983         * wasm/js/JSWebAssemblyModule.cpp:
 984         (JSC::JSWebAssemblyModule::destroy):
 985         * wasm/js/WebAssemblyFunction.cpp:
 986         (JSC::callWebAssemblyFunction):
 987         * wasm/js/WebAssemblyFunction.h:
 988         * wasm/js/WebAssemblyModuleRecord.cpp:
 989         (JSC::WebAssemblyModuleRecord::link):
 990         (JSC::WebAssemblyModuleRecord::evaluate):
 991         * wasm/js/WebAssemblyWrapperFunction.cpp:
 992         (JSC::WebAssemblyWrapperFunction::create):
 993         * wasm/js/WebAssemblyWrapperFunction.h:
 994
 995 2017-03-31  Mark Lam  <mark.lam@apple.com>
 996
 997         Array.prototype.splice() should not be using JSArray::tryCreateForInitializationPrivate().
 998         https://bugs.webkit.org/show_bug.cgi?id=170303
 999         <rdar://problem/31358281>
1000
1001         Reviewed by Filip Pizlo.
1002
1003         This is because it needs to call getProperty() later to get the values for
1004         initializing the array.  getProperty() can execute arbitrary code and potentially
1005         trigger the GC.  This is not allowed for clients of JSArray::tryCreateForInitializationPrivate().
1006
1007         * runtime/ArrayPrototype.cpp:
1008         (JSC::arrayProtoFuncSplice):
1009         (JSC::copySplicedArrayElements): Deleted.
1010
1011 2017-03-31  Oleksandr Skachkov  <gskachkov@gmail.com>
1012
1013         String.prototype.replace incorrectly applies "special replacement parameters" when passed a function
1014         https://bugs.webkit.org/show_bug.cgi?id=170151
1015
1016         Reviewed by Saam Barati.
1017
1018         This patch fixes issue for String.prototype.replace when passed a function
1019         with special symbols "$$". It happeneds because substituteBackreferences applies
1020         unconditionally, but according to the spec it should be applied only for text
1021         21.1.3.16.8 https://tc39.github.io/ecma262/#sec-string.prototype.replace
1022
1023         * runtime/StringPrototype.cpp:
1024         (JSC::replaceUsingStringSearch):
1025
1026 2017-03-30  Saam Barati  <sbarati@apple.com>
1027
1028         WebAssembly: When Wasm calls to C, it should use Wasm::Context* instead of ExecState* to get VM
1029         https://bugs.webkit.org/show_bug.cgi?id=170185
1030
1031         Reviewed by Michael Saboff.
1032
1033         This is one more step in the direction of PIC-ified Wasm.
1034         When we lift WasmCallee above VM, we will no longer be
1035         able to get VM from ExecState*. This patch ensures that
1036         we don't do that from within the Wasm runtime. Instead,
1037         we use the Wasm::Context* to get the VM.
1038
1039         This patch also adds a new class, Wasm::Thunks. There
1040         is a single Wasm::Thunks that lives in the process. It
1041         is responsible for generating a thunk that Wasm relies on.
1042         The only such thunk right now is the exception throwing
1043         thunk.
1044
1045         This patch also rids WasmFaultSignalHandler from any knowledge
1046         of VM. Previously, it relied on VM to get the exception handling
1047         thunk.
1048
1049         The only part of the Wasm runtime that will be allowed
1050         to get VM& from ExecState will be WasmBinding. In the
1051         future, we plan to keep the calls out to JS to keep
1052         a JSCell as the callee.
1053
1054         * JavaScriptCore.xcodeproj/project.pbxproj:
1055         * dfg/DFGOSREntry.cpp:
1056         (JSC::DFG::prepareOSREntry):
1057         * ftl/FTLOSRExitCompiler.cpp:
1058         (JSC::FTL::compileStub):
1059         * interpreter/Interpreter.cpp:
1060         (JSC::UnwindFunctor::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
1061         * jit/AssemblyHelpers.cpp:
1062         (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
1063         (JSC::AssemblyHelpers::copyCalleeSavesToVMEntryFrameCalleeSavesBufferImpl):
1064         * jit/AssemblyHelpers.h:
1065         (JSC::AssemblyHelpers::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
1066         * jit/ThunkGenerators.cpp:
1067         (JSC::throwExceptionFromWasmThunkGenerator): Deleted.
1068         * jit/ThunkGenerators.h:
1069         * runtime/InitializeThreading.cpp:
1070         (JSC::initializeThreading):
1071         * runtime/VM.cpp:
1072         (JSC::VM::VM):
1073         (JSC::VM::getAllCalleeSaveRegisterOffsets):
1074         * runtime/VM.h:
1075         (JSC::VM::topVMEntryFrameOffset):
1076         (JSC::VM::getAllCalleeSaveRegisterOffsets): Deleted.
1077         * wasm/WasmB3IRGenerator.cpp:
1078         (JSC::Wasm::B3IRGenerator::emitExceptionCheck):
1079         * wasm/WasmFaultSignalHandler.cpp:
1080         (JSC::Wasm::trapHandler):
1081         * wasm/WasmMemory.cpp:
1082         (JSC::Wasm::tryGetFastMemory):
1083         * wasm/WasmThunks.cpp: Added.
1084         (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
1085         (JSC::Wasm::Thunks::initialize):
1086         (JSC::Wasm::Thunks::singleton):
1087         (JSC::Wasm::Thunks::stub):
1088         (JSC::Wasm::Thunks::existingStub):
1089         * wasm/WasmThunks.h: Added.
1090         * wasm/js/JSWebAssemblyInstance.cpp:
1091         (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
1092         * wasm/js/JSWebAssemblyInstance.h:
1093         (JSC::JSWebAssemblyInstance::offsetOfVM):
1094         * wasm/js/JSWebAssemblyMemory.cpp:
1095         (JSC::JSWebAssemblyMemory::grow):
1096         * wasm/js/JSWebAssemblyMemory.h:
1097         * wasm/js/WebAssemblyMemoryPrototype.cpp:
1098         (JSC::webAssemblyMemoryProtoFuncGrow):
1099
1100 2017-03-30  Mark Lam  <mark.lam@apple.com>
1101
1102         IntlObject should not be using JSArray::initializeIndex().
1103         https://bugs.webkit.org/show_bug.cgi?id=170302
1104         <rdar://problem/31356918>
1105
1106         Reviewed by Saam Barati.
1107
1108         JSArray::initializeIndex() is only meant to be used with arrays created using
1109         JSArray::tryCreateForInitializationPrivate() under very constrained conditions.
1110
1111         * runtime/IntlObject.cpp:
1112         (JSC::canonicalizeLocaleList):
1113         (JSC::intlObjectFuncGetCanonicalLocales):
1114
1115 2017-03-30  Filip Pizlo  <fpizlo@apple.com>
1116
1117         Air should support linear scan for optLevel<2
1118         https://bugs.webkit.org/show_bug.cgi?id=170161
1119
1120         Reviewed by Saam Barati.
1121
1122         This changes the default opt level of B3 to 2. It makes the other opt levels useful by adding a
1123         new register allocator. This new linear scan allocator will produce significantly worse code.
1124         But it will produce that code a lot faster than IRC or Briggs.
1125
1126         The opt levels are:
1127             0: no optimizations, linear scan
1128             1: some optimizations, linear scan
1129             2: full optimizations, graph coloring (IRC or Briggs based on CPU)
1130
1131         What we used to call optLevel=1 is not called optLevel=2, or better yet,
1132         optLevel=B3::defaultOptLevel(). We no longer have anything like the old optLevel=0 (which did no
1133         optimizations but ran graph coloring).
1134
1135         allocateRegistersByLinearScan() faithfully implements Massimiliano Poletto and Vivek Sarkar's
1136         famous algorithm. It uses the variant that handles clobbered registers by avoiding assigning
1137         ranges to those registers if the range overlaps a clobber. It's engineered to allocate registers
1138         very quickly and generate inefficient code without falling off a cliff.
1139
1140         The new optLevel=1 speeds up B3 by a factor of 2, and results in a 80% throughput regression.
1141         Linear scan runs 4.7x faster than graph coloring on average.
1142
1143         * CMakeLists.txt:
1144         * JavaScriptCore.xcodeproj/project.pbxproj:
1145         * b3/B3BasicBlockUtils.h:
1146         (JSC::B3::blocksInPreOrder):
1147         (JSC::B3::blocksInPostOrder):
1148         * b3/B3BlockWorklist.h:
1149         * b3/B3CFG.h:
1150         (JSC::B3::CFG::newMap):
1151         * b3/B3Common.h:
1152         (JSC::B3::defaultOptLevel):
1153         * b3/B3Compile.h:
1154         * b3/B3DuplicateTails.cpp:
1155         * b3/B3EliminateCommonSubexpressions.cpp:
1156         * b3/B3FixSSA.cpp:
1157         (JSC::B3::demoteValues):
1158         (JSC::B3::fixSSA):
1159         * b3/B3FixSSA.h:
1160         * b3/B3Generate.cpp:
1161         (JSC::B3::prepareForGeneration):
1162         (JSC::B3::generateToAir):
1163         * b3/B3Generate.h:
1164         * b3/B3HeapRange.cpp: Removed.
1165         * b3/B3HeapRange.h:
1166         (JSC::B3::HeapRange::HeapRange): Deleted.
1167         (JSC::B3::HeapRange::top): Deleted.
1168         (JSC::B3::HeapRange::operator==): Deleted.
1169         (JSC::B3::HeapRange::operator!=): Deleted.
1170         (JSC::B3::HeapRange::operator|): Deleted.
1171         (JSC::B3::HeapRange::operator bool): Deleted.
1172         (JSC::B3::HeapRange::begin): Deleted.
1173         (JSC::B3::HeapRange::end): Deleted.
1174         (JSC::B3::HeapRange::overlaps): Deleted.
1175         * b3/B3LowerToAir.cpp:
1176         * b3/B3MoveConstants.cpp:
1177         * b3/B3PhiChildren.h:
1178         * b3/B3Procedure.cpp:
1179         (JSC::B3::Procedure::dump):
1180         (JSC::B3::Procedure::deleteOrphans):
1181         (JSC::B3::Procedure::setBlockOrderImpl):
1182         * b3/B3ReduceDoubleToFloat.cpp:
1183         * b3/B3ReduceStrength.cpp:
1184         * b3/B3SSACalculator.h:
1185         * b3/B3UseCounts.h:
1186         * b3/air/AirAllocateRegistersByGraphColoring.cpp:
1187         * b3/air/AirAllocateRegistersByLinearScan.cpp: Added.
1188         (JSC::B3::Air::allocateRegistersByLinearScan):
1189         * b3/air/AirAllocateRegistersByLinearScan.h: Added.
1190         * b3/air/AirAllocateStack.cpp:
1191         (JSC::B3::Air::allocateStack):
1192         * b3/air/AirArg.cpp:
1193         (WTF::printInternal):
1194         * b3/air/AirArg.h:
1195         (JSC::B3::Air::Arg::activeAt):
1196         (JSC::B3::Air::Arg::timing):
1197         (JSC::B3::Air::Arg::forEachPhase):
1198         * b3/air/AirBasicBlock.h:
1199         * b3/air/AirBlockWorklist.h:
1200         * b3/air/AirCFG.h:
1201         (JSC::B3::Air::CFG::newMap):
1202         * b3/air/AirEliminateDeadCode.cpp:
1203         (JSC::B3::Air::eliminateDeadCode):
1204         * b3/air/AirFixObviousSpills.cpp:
1205         * b3/air/AirFixPartialRegisterStalls.cpp:
1206         (JSC::B3::Air::fixPartialRegisterStalls):
1207         * b3/air/AirFixSpillsAfterTerminals.cpp: Added.
1208         (JSC::B3::Air::fixSpillsAfterTerminals):
1209         * b3/air/AirFixSpillsAfterTerminals.h: Added.
1210         * b3/air/AirGenerate.cpp:
1211         (JSC::B3::Air::prepareForGeneration):
1212         (JSC::B3::Air::generate):
1213         * b3/air/AirGenerate.h:
1214         * b3/air/AirGenerationContext.h:
1215         * b3/air/AirInsertionSet.h:
1216         * b3/air/AirInst.cpp:
1217         (JSC::B3::Air::Inst::needsPadding):
1218         * b3/air/AirLowerAfterRegAlloc.cpp:
1219         (JSC::B3::Air::lowerAfterRegAlloc):
1220         * b3/air/AirLowerEntrySwitch.cpp:
1221         (JSC::B3::Air::lowerEntrySwitch):
1222         * b3/air/AirOpcode.opcodes:
1223         * b3/air/AirPhaseInsertionSet.cpp: Added.
1224         (JSC::B3::Air::PhaseInsertionSet::execute):
1225         * b3/air/AirPhaseInsertionSet.h: Added.
1226         (JSC::B3::Air::PhaseInsertion::PhaseInsertion):
1227         (JSC::B3::Air::PhaseInsertion::phase):
1228         (JSC::B3::Air::PhaseInsertion::operator<):
1229         (JSC::B3::Air::PhaseInsertionSet::PhaseInsertionSet):
1230         (JSC::B3::Air::PhaseInsertionSet::appendInsertion):
1231         (JSC::B3::Air::PhaseInsertionSet::insertInst):
1232         (JSC::B3::Air::PhaseInsertionSet::insert):
1233         * b3/air/AirRegLiveness.h:
1234         (JSC::B3::Air::RegLiveness::LocalCalc::LocalCalc):
1235         * b3/air/AirSpillEverything.cpp:
1236         (JSC::B3::Air::spillEverything):
1237         * b3/air/AirTmp.cpp:
1238         * b3/air/AirTmp.h:
1239         (JSC::B3::Air::Tmp::tmpForIndex):
1240         * b3/air/AirTmpInlines.h:
1241         (JSC::B3::Air::Tmp::Indexed::Indexed):
1242         (JSC::B3::Air::Tmp::Indexed::index):
1243         (JSC::B3::Air::Tmp::AbsolutelyIndexed::AbsolutelyIndexed):
1244         (JSC::B3::Air::Tmp::AbsolutelyIndexed::index):
1245         (JSC::B3::Air::Tmp::indexed):
1246         (JSC::B3::Air::Tmp::absolutelyIndexed):
1247         (JSC::B3::Air::Tmp::tmpForAbsoluteIndex):
1248         * b3/testb3.cpp:
1249         (JSC::B3::compile):
1250         (JSC::B3::testMulLoadTwice):
1251         * jit/RegisterSet.h:
1252         (JSC::RegisterSet::add):
1253         (JSC::RegisterSet::remove):
1254         * runtime/Options.h:
1255         * wasm/WasmB3IRGenerator.h:
1256
1257 2017-03-30  Youenn Fablet  <youenn@apple.com>
1258
1259         Clean up RTCDataChannel
1260         https://bugs.webkit.org/show_bug.cgi?id=169732
1261
1262         Reviewed by Chris Dumez.
1263
1264         * runtime/CommonIdentifiers.h: Adding RTCDataChannelEvent.
1265
1266 2017-03-30  Saam Barati  <sbarati@apple.com>
1267
1268         WebAssembly: pass Wasm::Context* to vmEntryToWasm when not using fast TLS
1269         https://bugs.webkit.org/show_bug.cgi?id=170182
1270
1271         Reviewed by Mark Lam.
1272
1273         This is one more step in the direction of PIC-ified Wasm.
1274         I'm removing assumptions that a wasm callee is a cell. We used to use
1275         the callee to get the WasmContext off the callee's VM. Instead,
1276         this patch makes it so that we pass in the context as a parameter
1277         to the JS entrypoint.
1278
1279         * heap/MarkedBlock.h:
1280         (JSC::MarkedBlock::offsetOfVM): Deleted.
1281         * jit/AssemblyHelpers.cpp:
1282         (JSC::AssemblyHelpers::loadWasmContext):
1283         (JSC::AssemblyHelpers::storeWasmContext):
1284         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister):
1285         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister):
1286         * jsc.cpp:
1287         (functionTestWasmModuleFunctions):
1288         * runtime/VM.h:
1289         (JSC::VM::wasmContextOffset): Deleted.
1290         * wasm/WasmB3IRGenerator.cpp:
1291         (JSC::Wasm::B3IRGenerator::materializeWasmContext):
1292         (JSC::Wasm::B3IRGenerator::restoreWasmContext):
1293         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1294         (JSC::Wasm::createJSToWasmWrapper):
1295         * wasm/WasmContext.cpp:
1296         (JSC::Wasm::loadContext):
1297         (JSC::Wasm::storeContext):
1298         (JSC::loadWasmContext): Deleted.
1299         (JSC::storeWasmContext): Deleted.
1300         * wasm/WasmContext.h:
1301         (JSC::Wasm::useFastTLS):
1302         (JSC::Wasm::useFastTLSForContext):
1303         * wasm/WasmMemoryInformation.cpp:
1304         (JSC::Wasm::PinnedRegisterInfo::get):
1305         * wasm/WasmMemoryInformation.h:
1306         (JSC::Wasm::useFastTLS): Deleted.
1307         (JSC::Wasm::useFastTLSForWasmContext): Deleted.
1308         * wasm/js/WebAssemblyFunction.cpp:
1309         (JSC::callWebAssemblyFunction):
1310
1311 2017-03-30  JF Bastien  <jfbastien@apple.com>
1312
1313         WebAssembly: fix misc JS API implementation inconsistencies
1314         https://bugs.webkit.org/show_bug.cgi?id=170187
1315
1316         Reviewed by Keith Miller.
1317
1318         Auto-generate lookup tables.
1319         Methods should be on prototype.
1320         Exception returns should be idiomatic.
1321
1322         * wasm/JSWebAssembly.cpp: validate / compile / instantiate should
1323         be on the prototype
1324         (JSC::JSWebAssembly::create):
1325         (JSC::JSWebAssembly::finishCreation):
1326         (JSC::reject): Deleted.
1327         (JSC::webAssemblyCompileFunc): Deleted.
1328         (JSC::resolve): Deleted.
1329         (JSC::instantiate): Deleted.
1330         (JSC::compileAndInstantiate): Deleted.
1331         (JSC::webAssemblyInstantiateFunc): Deleted.
1332         (JSC::webAssemblyValidateFunc): Deleted.
1333         * wasm/JSWebAssembly.h:
1334         * wasm/js/WebAssemblyMemoryPrototype.cpp: move from JSWebAssembly.cpp
1335         (JSC::webAssemblyMemoryProtoFuncBuffer):
1336         (JSC::WebAssemblyMemoryPrototype::create):
1337         (JSC::WebAssemblyMemoryPrototype::finishCreation):
1338         * wasm/js/WebAssemblyMemoryPrototype.h:
1339         * wasm/js/WebAssemblyPrototype.cpp:
1340         (JSC::reject):
1341         (JSC::webAssemblyCompileFunc):
1342         (JSC::resolve):
1343         (JSC::instantiate):
1344         (JSC::compileAndInstantiate):
1345         (JSC::webAssemblyInstantiateFunc):
1346         (JSC::webAssemblyValidateFunc):
1347         (JSC::webAssemblyFunctionValidate): Deleted.
1348         (JSC::webAssemblyFunctionCompile): Deleted.
1349         * wasm/js/WebAssemblyTablePrototype.cpp:
1350         (JSC::webAssemblyTableProtoFuncGrow):
1351         (JSC::webAssemblyTableProtoFuncGet):
1352         (JSC::webAssemblyTableProtoFuncSet):
1353         (JSC::WebAssemblyTablePrototype::create):
1354         (JSC::WebAssemblyTablePrototype::finishCreation):
1355         * wasm/js/WebAssemblyTablePrototype.h:
1356
1357 2017-03-29  Keith Miller  <keith_miller@apple.com>
1358
1359         Unreviewed, fix the build, again. Hopefully for the last time, again!
1360
1361         * runtime/Options.cpp:
1362
1363 2017-03-29  Keith Miller  <keith_miller@apple.com>
1364
1365         Unreviewed, fix the build, again. Hopefully for the last time!
1366
1367         * runtime/Options.cpp:
1368         (JSC::parse):
1369
1370 2017-03-29  Keith Miller  <keith_miller@apple.com>
1371
1372         Unreviewed, windows build fix.
1373
1374         * runtime/Options.cpp:
1375         (JSC::parse):
1376
1377 2017-03-29  Keith Miller  <keith_miller@apple.com>
1378
1379         WebAssembly: B3IRGenerator should pool constants
1380         https://bugs.webkit.org/show_bug.cgi?id=170266
1381
1382         Reviewed by Filip Pizlo.
1383
1384         This patch adds a HashMap to B3IRGenerator that contains all the constants used in a function.
1385         B3IRGenerator then uses an InsertionSet to add all those constants to the root BB. This doesn't
1386         appear to be a compile time improvement but it could be valuable in the future.
1387
1388         * b3/B3Opcode.h:
1389         (JSC::B3::opcodeForConstant):
1390         * b3/B3Procedure.cpp:
1391         (JSC::B3::Procedure::addConstant):
1392         * b3/B3Procedure.h:
1393         * wasm/WasmB3IRGenerator.cpp:
1394         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1395         (JSC::Wasm::B3IRGenerator::constant):
1396         (JSC::Wasm::B3IRGenerator::insertConstants):
1397         (JSC::Wasm::B3IRGenerator::addConstant):
1398         (JSC::Wasm::B3IRGenerator::dump):
1399         (JSC::Wasm::parseAndCompile):
1400         (JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv):
1401         (JSC::Wasm::B3IRGenerator::zeroForType): Deleted.
1402         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
1403         (generateConstCode):
1404
1405 2017-03-29  Saam Barati  <sbarati@apple.com>
1406
1407         LinkBuffer and ExecutableAllocator shouldn't have anything to do with VM
1408         https://bugs.webkit.org/show_bug.cgi?id=170210
1409
1410         Reviewed by Mark Lam.
1411
1412         This is one more step in the direction of PIC-ified Wasm.
1413         LinkBuffer and ExecutableAllocator have no business knowing about VM.
1414
1415         * assembler/LinkBuffer.cpp:
1416         (JSC::LinkBuffer::allocate):
1417         * assembler/LinkBuffer.h:
1418         (JSC::LinkBuffer::LinkBuffer):
1419         (JSC::LinkBuffer::vm): Deleted.
1420         * b3/B3Compile.cpp:
1421         (JSC::B3::compile):
1422         * b3/B3Compile.h:
1423         * b3/air/testair.cpp:
1424         * b3/testb3.cpp:
1425         (JSC::B3::compileProc):
1426         (JSC::B3::compileAndRun):
1427         (JSC::B3::testLoadAcq42):
1428         (JSC::B3::testAddArgZeroImmZDef):
1429         (JSC::B3::testAddLoadTwice):
1430         (JSC::B3::testMulLoadTwice):
1431         (JSC::B3::testMulAddArgsLeft):
1432         (JSC::B3::testMulAddArgsRight):
1433         (JSC::B3::testMulAddArgsLeft32):
1434         (JSC::B3::testMulAddArgsRight32):
1435         (JSC::B3::testMulSubArgsLeft):
1436         (JSC::B3::testMulSubArgsRight):
1437         (JSC::B3::testMulSubArgsLeft32):
1438         (JSC::B3::testMulSubArgsRight32):
1439         (JSC::B3::testMulNegArgs):
1440         (JSC::B3::testMulNegArgs32):
1441         (JSC::B3::testCompareFloatToDoubleThroughPhi):
1442         (JSC::B3::testDoubleToFloatThroughPhi):
1443         (JSC::B3::testReduceFloatToDoubleValidates):
1444         (JSC::B3::testDoubleProducerPhiToFloatConversion):
1445         (JSC::B3::testDoubleProducerPhiToFloatConversionWithDoubleConsumer):
1446         (JSC::B3::testDoubleProducerPhiWithNonFloatConst):
1447         (JSC::B3::testIToD64Arg):
1448         (JSC::B3::testIToF64Arg):
1449         (JSC::B3::testIToD32Arg):
1450         (JSC::B3::testIToF32Arg):
1451         (JSC::B3::testIToD64Mem):
1452         (JSC::B3::testIToF64Mem):
1453         (JSC::B3::testIToD32Mem):
1454         (JSC::B3::testIToF32Mem):
1455         (JSC::B3::testIToDReducedToIToF64Arg):
1456         (JSC::B3::testIToDReducedToIToF32Arg):
1457         (JSC::B3::testStoreRelAddLoadAcq32):
1458         (JSC::B3::testStoreRelAddLoadAcq8):
1459         (JSC::B3::testStoreRelAddFenceLoadAcq8):
1460         (JSC::B3::testStoreRelAddLoadAcq16):
1461         (JSC::B3::testStoreRelAddLoadAcq64):
1462         (JSC::B3::testBranch):
1463         (JSC::B3::testBranchPtr):
1464         (JSC::B3::testDiamond):
1465         (JSC::B3::testBranchNotEqual):
1466         (JSC::B3::testBranchNotEqualCommute):
1467         (JSC::B3::testBranchNotEqualNotEqual):
1468         (JSC::B3::testBranchEqual):
1469         (JSC::B3::testBranchEqualEqual):
1470         (JSC::B3::testBranchEqualCommute):
1471         (JSC::B3::testBranchEqualEqual1):
1472         (JSC::B3::testBranchLoadPtr):
1473         (JSC::B3::testBranchLoad32):
1474         (JSC::B3::testBranchLoad8S):
1475         (JSC::B3::testBranchLoad8Z):
1476         (JSC::B3::testBranchLoad16S):
1477         (JSC::B3::testBranchLoad16Z):
1478         (JSC::B3::testBranch8WithLoad8ZIndex):
1479         (JSC::B3::testComplex):
1480         (JSC::B3::testSimpleCheck):
1481         (JSC::B3::testCheckFalse):
1482         (JSC::B3::testCheckTrue):
1483         (JSC::B3::testCheckLessThan):
1484         (JSC::B3::testCheckMegaCombo):
1485         (JSC::B3::testCheckTrickyMegaCombo):
1486         (JSC::B3::testCheckTwoMegaCombos):
1487         (JSC::B3::testCheckTwoNonRedundantMegaCombos):
1488         (JSC::B3::testCheckAddImm):
1489         (JSC::B3::testCheckAddImmCommute):
1490         (JSC::B3::testCheckAddImmSomeRegister):
1491         (JSC::B3::testCheckAdd):
1492         (JSC::B3::testCheckAdd64):
1493         (JSC::B3::testCheckAddFold):
1494         (JSC::B3::testCheckAddFoldFail):
1495         (JSC::B3::testCheckAddSelfOverflow64):
1496         (JSC::B3::testCheckAddSelfOverflow32):
1497         (JSC::B3::testCheckSubImm):
1498         (JSC::B3::testCheckSubBadImm):
1499         (JSC::B3::testCheckSub):
1500         (JSC::B3::testCheckSub64):
1501         (JSC::B3::testCheckSubFold):
1502         (JSC::B3::testCheckSubFoldFail):
1503         (JSC::B3::testCheckNeg):
1504         (JSC::B3::testCheckNeg64):
1505         (JSC::B3::testCheckMul):
1506         (JSC::B3::testCheckMulMemory):
1507         (JSC::B3::testCheckMul2):
1508         (JSC::B3::testCheckMul64):
1509         (JSC::B3::testCheckMulFold):
1510         (JSC::B3::testCheckMulFoldFail):
1511         (JSC::B3::testCheckMul64SShr):
1512         (JSC::B3::testSwitch):
1513         (JSC::B3::testSwitchChillDiv):
1514         (JSC::B3::testSwitchTargettingSameBlock):
1515         (JSC::B3::testSwitchTargettingSameBlockFoldPathConstant):
1516         (JSC::B3::testBasicSelect):
1517         (JSC::B3::testSelectTest):
1518         (JSC::B3::testSelectCompareDouble):
1519         (JSC::B3::testSelectDouble):
1520         (JSC::B3::testSelectDoubleTest):
1521         (JSC::B3::testSelectDoubleCompareDouble):
1522         (JSC::B3::testSelectFloatCompareFloat):
1523         (JSC::B3::testSelectFold):
1524         (JSC::B3::testSelectInvert):
1525         (JSC::B3::testCheckSelect):
1526         (JSC::B3::testCheckSelectCheckSelect):
1527         (JSC::B3::testCheckSelectAndCSE):
1528         (JSC::B3::testTrivialInfiniteLoop):
1529         (JSC::B3::testFoldPathEqual):
1530         (JSC::B3::testLShiftSelf32):
1531         (JSC::B3::testRShiftSelf32):
1532         (JSC::B3::testURShiftSelf32):
1533         (JSC::B3::testLShiftSelf64):
1534         (JSC::B3::testRShiftSelf64):
1535         (JSC::B3::testURShiftSelf64):
1536         (JSC::B3::testPatchpointDoubleRegs):
1537         (JSC::B3::testSpillDefSmallerThanUse):
1538         (JSC::B3::testSpillUseLargerThanDef):
1539         (JSC::B3::testLateRegister):
1540         (JSC::B3::testInterpreter):
1541         (JSC::B3::testEntrySwitchSimple):
1542         (JSC::B3::testEntrySwitchNoEntrySwitch):
1543         (JSC::B3::testEntrySwitchWithCommonPaths):
1544         (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
1545         (JSC::B3::testEntrySwitchLoop):
1546         (JSC::B3::testSomeEarlyRegister):
1547         (JSC::B3::testTerminalPatchpointThatNeedsToBeSpilled):
1548         (JSC::B3::testTerminalPatchpointThatNeedsToBeSpilled2):
1549         (JSC::B3::testPatchpointTerminalReturnValue):
1550         (JSC::B3::testMemoryFence):
1551         (JSC::B3::testStoreFence):
1552         (JSC::B3::testLoadFence):
1553         (JSC::B3::testPCOriginMapDoesntInsertNops):
1554         (JSC::B3::testPinRegisters):
1555         (JSC::B3::testX86LeaAddAddShlLeft):
1556         (JSC::B3::testX86LeaAddAddShlRight):
1557         (JSC::B3::testX86LeaAddAdd):
1558         (JSC::B3::testX86LeaAddShlRight):
1559         (JSC::B3::testX86LeaAddShlLeftScale1):
1560         (JSC::B3::testX86LeaAddShlLeftScale2):
1561         (JSC::B3::testX86LeaAddShlLeftScale4):
1562         (JSC::B3::testX86LeaAddShlLeftScale8):
1563         (JSC::B3::testAddShl32):
1564         (JSC::B3::testAddShl64):
1565         (JSC::B3::testAddShl65):
1566         (JSC::B3::testLoadBaseIndexShift2):
1567         (JSC::B3::testLoadBaseIndexShift32):
1568         (JSC::B3::testOptimizeMaterialization):
1569         (JSC::B3::testAtomicWeakCAS):
1570         (JSC::B3::testAtomicStrongCAS):
1571         (JSC::B3::testAtomicXchg):
1572         (JSC::B3::testDepend32):
1573         (JSC::B3::testDepend64):
1574         (JSC::B3::testWasmBoundsCheck):
1575         (JSC::B3::testWasmAddress):
1576         (JSC::B3::run):
1577         (JSC::B3::compile): Deleted.
1578         * bytecode/PolymorphicAccess.cpp:
1579         (JSC::PolymorphicAccess::regenerate):
1580         * dfg/DFGJITCompiler.cpp:
1581         (JSC::DFG::JITCompiler::compile):
1582         (JSC::DFG::JITCompiler::compileFunction):
1583         * dfg/DFGLazyJSValue.cpp:
1584         (JSC::DFG::LazyJSValue::emit):
1585         * dfg/DFGOSRExitCompiler.cpp:
1586         * dfg/DFGSpeculativeJIT32_64.cpp:
1587         (JSC::DFG::SpeculativeJIT::emitCall):
1588         * dfg/DFGSpeculativeJIT64.cpp:
1589         (JSC::DFG::SpeculativeJIT::emitCall):
1590         * dfg/DFGThunks.cpp:
1591         (JSC::DFG::osrExitGenerationThunkGenerator):
1592         (JSC::DFG::osrEntryThunkGenerator):
1593         * ftl/FTLCompile.cpp:
1594         (JSC::FTL::compile):
1595         * ftl/FTLLazySlowPath.cpp:
1596         (JSC::FTL::LazySlowPath::generate):
1597         * ftl/FTLLink.cpp:
1598         (JSC::FTL::link):
1599         * ftl/FTLLowerDFGToB3.cpp:
1600         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
1601         (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
1602         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
1603         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
1604         (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
1605         * ftl/FTLOSRExitCompiler.cpp:
1606         (JSC::FTL::compileStub):
1607         * ftl/FTLOSRExitHandle.cpp:
1608         (JSC::FTL::OSRExitHandle::emitExitThunk):
1609         * ftl/FTLSlowPathCall.cpp:
1610         (JSC::FTL::SlowPathCallContext::makeCall):
1611         * ftl/FTLSlowPathCall.h:
1612         (JSC::FTL::callOperation):
1613         * ftl/FTLState.h:
1614         * ftl/FTLThunks.cpp:
1615         (JSC::FTL::genericGenerationThunkGenerator):
1616         (JSC::FTL::slowPathCallThunkGenerator):
1617         * ftl/FTLThunks.h:
1618         (JSC::FTL::generateIfNecessary):
1619         (JSC::FTL::Thunks::getSlowPathCallThunk):
1620         * jit/AssemblyHelpers.cpp:
1621         (JSC::AssemblyHelpers::emitDumbVirtualCall):
1622         * jit/AssemblyHelpers.h:
1623         * jit/ExecutableAllocator.cpp:
1624         (JSC::ExecutableAllocator::initializeAllocator):
1625         (JSC::ExecutableAllocator::singleton):
1626         (JSC::ExecutableAllocator::ExecutableAllocator):
1627         (JSC::ExecutableAllocator::allocate):
1628         * jit/ExecutableAllocator.h:
1629         * jit/JIT.cpp:
1630         (JSC::JIT::compileWithoutLinking):
1631         * jit/JITCall.cpp:
1632         (JSC::JIT::compileCallEvalSlowCase):
1633         * jit/JITMathIC.h:
1634         (JSC::JITMathIC::generateOutOfLine):
1635         * jit/JITOpcodes.cpp:
1636         (JSC::JIT::privateCompileHasIndexedProperty):
1637         * jit/JITOpcodes32_64.cpp:
1638         (JSC::JIT::privateCompileHasIndexedProperty):
1639         * jit/JITOperations.cpp:
1640         * jit/JITOperations.h:
1641         * jit/JITPropertyAccess.cpp:
1642         (JSC::JIT::stringGetByValStubGenerator):
1643         (JSC::JIT::privateCompileGetByVal):
1644         (JSC::JIT::privateCompileGetByValWithCachedId):
1645         (JSC::JIT::privateCompilePutByVal):
1646         (JSC::JIT::privateCompilePutByValWithCachedId):
1647         * jit/JITPropertyAccess32_64.cpp:
1648         (JSC::JIT::stringGetByValStubGenerator):
1649         * jit/JITStubRoutine.h:
1650         * jit/Repatch.cpp:
1651         (JSC::ftlThunkAwareRepatchCall):
1652         (JSC::linkPolymorphicCall):
1653         * jit/SpecializedThunkJIT.h:
1654         (JSC::SpecializedThunkJIT::finalize):
1655         * jit/ThunkGenerators.cpp:
1656         (JSC::throwExceptionFromCallSlowPathGenerator):
1657         (JSC::linkCallThunkGenerator):
1658         (JSC::linkPolymorphicCallThunkGenerator):
1659         (JSC::virtualThunkFor):
1660         (JSC::nativeForGenerator):
1661         (JSC::arityFixupGenerator):
1662         (JSC::unreachableGenerator):
1663         (JSC::boundThisNoArgsFunctionCallGenerator):
1664         (JSC::throwExceptionFromWasmThunkGenerator):
1665         * llint/LLIntThunks.cpp:
1666         (JSC::LLInt::generateThunkWithJumpTo):
1667         * runtime/SamplingProfiler.cpp:
1668         (JSC::SamplingProfiler::takeSample):
1669         * runtime/VM.cpp:
1670         (JSC::VM::VM):
1671         * runtime/VM.h:
1672         * runtime/VMTraps.cpp:
1673         (JSC::VMTraps::tryInstallTrapBreakpoints):
1674         * tools/VMInspector.cpp:
1675         * wasm/WasmBinding.cpp:
1676         (JSC::Wasm::wasmToJs):
1677         (JSC::Wasm::wasmToWasm):
1678         (JSC::Wasm::exitStubGenerator):
1679         * wasm/WasmPlan.cpp:
1680         (JSC::Wasm::Plan::complete):
1681         * yarr/YarrJIT.cpp:
1682         (JSC::Yarr::YarrGenerator::compile):
1683         (JSC::Yarr::jitCompile):
1684
1685 2017-03-29  Keith Miller  <keith_miller@apple.com>
1686
1687         WebAssembly: Worklist should periodically check in to see if there are higher priority jobs to do.
1688         https://bugs.webkit.org/show_bug.cgi?id=170204
1689
1690         Reviewed by Saam Barati.
1691
1692         This patch makes it so that Wasm::Plan's compileFunctions method can return periodically
1693         to its caller. The main use for this is if a user asynchronously compiles a wasm module
1694         then later synchronously compiles another module. In this case we want to be able to pause
1695         compilation of other worklists.
1696
1697         This patch also adds support for size_t Options.
1698
1699         * runtime/Options.cpp:
1700         (JSC::parse):
1701         (JSC::Option::dump):
1702         (JSC::Option::operator==):
1703         * runtime/Options.h:
1704         * wasm/WasmPlan.cpp:
1705         (JSC::Wasm::Plan::moveToState):
1706         (JSC::Wasm::Plan::ThreadCountHolder::~ThreadCountHolder):
1707         (JSC::Wasm::Plan::compileFunctions):
1708         * wasm/WasmPlan.h:
1709         * wasm/WasmWorklist.cpp:
1710
1711 2017-03-29  Mark Lam  <mark.lam@apple.com>
1712
1713         Remove obsolete references to HeapTimer in JavaScriptCore.order.
1714         https://bugs.webkit.org/show_bug.cgi?id=170252
1715
1716         Reviewed by Saam Barati.
1717
1718         The HeapTimer was renamed to JSRunLoopTimer back in r214504.  These HeapTimer
1719         entries are now no longer meaningful.
1720
1721         * JavaScriptCore.order:
1722
1723 2017-03-29  JF Bastien  <jfbastien@apple.com>
1724
1725         WebAssembly: add shell-only Memory mode helper
1726         https://bugs.webkit.org/show_bug.cgi?id=170227
1727
1728         Reviewed by Mark Lam.
1729
1730         * jsc.cpp:
1731         (GlobalObject::finishCreation):
1732         (functionWebAssemblyMemoryMode):
1733         * wasm/WasmMemory.h:
1734         * wasm/js/JSWebAssemblyInstance.h:
1735         * wasm/js/JSWebAssemblyMemory.h:
1736
1737 2017-03-29  Keith Miller  <keith_miller@apple.com>
1738
1739         WebAssembly: pack OpcodeOrigin to fit in a pointer
1740         https://bugs.webkit.org/show_bug.cgi?id=170244
1741
1742         Reviewed by Michael Saboff.
1743
1744         This patch makes it so we don't have to have allocate the OpcodeOrigin and can just
1745         pack all the data into the pointer B3::Origin already has.
1746
1747         * wasm/WasmB3IRGenerator.cpp:
1748         (JSC::Wasm::parseAndCompile):
1749         * wasm/WasmOpcodeOrigin.cpp:
1750         (JSC::Wasm::OpcodeOrigin::dump):
1751         * wasm/WasmOpcodeOrigin.h:
1752         (JSC::Wasm::OpcodeOrigin::OpcodeOrigin):
1753         (JSC::Wasm::OpcodeOrigin::opcode):
1754         (JSC::Wasm::OpcodeOrigin::location):
1755
1756 2017-03-29  JF Bastien  <jfbastien@apple.com>
1757
1758         WebAssembly: NFC s/goto/lambda/g
1759         https://bugs.webkit.org/show_bug.cgi?id=170242
1760
1761         Reviewed by Mark Lam.
1762
1763         Lambdas are more in-style than the goto I just used.
1764
1765         * wasm/WasmMemory.cpp:
1766         (JSC::Wasm::tryGetFastMemory):
1767
1768 2017-03-28  Saam Barati  <sbarati@apple.com>
1769
1770         AssemblyHelpers should not have a VM field
1771         https://bugs.webkit.org/show_bug.cgi?id=170207
1772
1773         Reviewed by Yusuke Suzuki.
1774
1775         APIs that need VM should take one as a parameter. When doing position
1776         independent code for Wasm, we can't tie code generation to a VM.
1777
1778         * b3/B3Compile.cpp:
1779         (JSC::B3::compile):
1780         * b3/air/testair.cpp:
1781         * b3/testb3.cpp:
1782         (JSC::B3::testEntrySwitchSimple):
1783         (JSC::B3::testEntrySwitchNoEntrySwitch):
1784         (JSC::B3::testEntrySwitchWithCommonPaths):
1785         (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
1786         (JSC::B3::testEntrySwitchLoop):
1787         * bytecode/AccessCase.cpp:
1788         (JSC::AccessCase::generateWithGuard):
1789         (JSC::AccessCase::generateImpl):
1790         * bytecode/DOMJITAccessCasePatchpointParams.cpp:
1791         (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
1792         * bytecode/InlineAccess.cpp:
1793         (JSC::InlineAccess::dumpCacheSizesAndCrash):
1794         (JSC::InlineAccess::generateSelfPropertyAccess):
1795         (JSC::InlineAccess::generateSelfPropertyReplace):
1796         (JSC::InlineAccess::generateArrayLength):
1797         (JSC::InlineAccess::rewireStubAsJump):
1798         * bytecode/InlineAccess.h:
1799         * bytecode/PolymorphicAccess.cpp:
1800         (JSC::AccessGenerationState::emitExplicitExceptionHandler):
1801         (JSC::PolymorphicAccess::regenerate):
1802         * bytecode/PolymorphicAccess.h:
1803         (JSC::AccessGenerationState::AccessGenerationState):
1804         * dfg/DFGJITCompiler.cpp:
1805         (JSC::DFG::JITCompiler::JITCompiler):
1806         (JSC::DFG::JITCompiler::compileExceptionHandlers):
1807         (JSC::DFG::JITCompiler::link):
1808         (JSC::DFG::JITCompiler::compile):
1809         (JSC::DFG::JITCompiler::compileFunction):
1810         (JSC::DFG::JITCompiler::exceptionCheck):
1811         * dfg/DFGJITCompiler.h:
1812         (JSC::DFG::JITCompiler::exceptionCheckWithCallFrameRollback):
1813         (JSC::DFG::JITCompiler::fastExceptionCheck):
1814         (JSC::DFG::JITCompiler::vm):
1815         * dfg/DFGOSRExitCompiler.cpp:
1816         * dfg/DFGOSRExitCompiler.h:
1817         * dfg/DFGOSRExitCompiler32_64.cpp:
1818         (JSC::DFG::OSRExitCompiler::compileExit):
1819         * dfg/DFGOSRExitCompiler64.cpp:
1820         (JSC::DFG::OSRExitCompiler::compileExit):
1821         * dfg/DFGOSRExitCompilerCommon.cpp:
1822         (JSC::DFG::adjustAndJumpToTarget):
1823         * dfg/DFGOSRExitCompilerCommon.h:
1824         * dfg/DFGSpeculativeJIT.cpp:
1825         (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
1826         (JSC::DFG::SpeculativeJIT::checkArray):
1827         (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
1828         (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
1829         (JSC::DFG::SpeculativeJIT::compileMakeRope):
1830         (JSC::DFG::SpeculativeJIT::compileGetGlobalObject):
1831         (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
1832         (JSC::DFG::SpeculativeJIT::compileCreateActivation):
1833         (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
1834         (JSC::DFG::SpeculativeJIT::compileSpread):
1835         (JSC::DFG::SpeculativeJIT::compileArraySlice):
1836         (JSC::DFG::SpeculativeJIT::compileNukeStructureAndSetButterfly):
1837         (JSC::DFG::SpeculativeJIT::compileNewStringObject):
1838         (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
1839         (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
1840         * dfg/DFGSpeculativeJIT.h:
1841         (JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize):
1842         (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
1843         (JSC::DFG::SpeculativeJIT::emitAllocateVariableSizedJSObject):
1844         (JSC::DFG::SpeculativeJIT::emitAllocateDestructibleObject):
1845         * dfg/DFGSpeculativeJIT32_64.cpp:
1846         (JSC::DFG::SpeculativeJIT::emitCall):
1847         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
1848         (JSC::DFG::SpeculativeJIT::emitBranch):
1849         (JSC::DFG::SpeculativeJIT::compile):
1850         * dfg/DFGSpeculativeJIT64.cpp:
1851         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
1852         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
1853         (JSC::DFG::SpeculativeJIT::emitCall):
1854         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
1855         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
1856         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
1857         (JSC::DFG::SpeculativeJIT::emitBranch):
1858         (JSC::DFG::SpeculativeJIT::compile):
1859         (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
1860         * dfg/DFGThunks.cpp:
1861         (JSC::DFG::osrEntryThunkGenerator):
1862         * ftl/FTLCompile.cpp:
1863         (JSC::FTL::compile):
1864         * ftl/FTLJITFinalizer.h:
1865         * ftl/FTLLazySlowPath.cpp:
1866         (JSC::FTL::LazySlowPath::generate):
1867         * ftl/FTLLazySlowPathCall.h:
1868         (JSC::FTL::createLazyCallGenerator):
1869         * ftl/FTLLink.cpp:
1870         (JSC::FTL::link):
1871         * ftl/FTLLowerDFGToB3.cpp:
1872         (JSC::FTL::DFG::LowerDFGToB3::lower):
1873         (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
1874         (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
1875         (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
1876         (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
1877         (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
1878         (JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
1879         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
1880         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
1881         (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
1882         (JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull):
1883         (JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
1884         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
1885         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
1886         (JSC::FTL::DFG::LowerDFGToB3::compileCheckTraps):
1887         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
1888         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
1889         (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
1890         (JSC::FTL::DFG::LowerDFGToB3::buildTypeOf):
1891         * ftl/FTLOSRExitCompiler.cpp:
1892         (JSC::FTL::compileStub):
1893         * ftl/FTLSlowPathCall.h:
1894         (JSC::FTL::callOperation):
1895         * ftl/FTLState.h:
1896         (JSC::FTL::State::vm):
1897         * ftl/FTLThunks.cpp:
1898         (JSC::FTL::genericGenerationThunkGenerator):
1899         (JSC::FTL::slowPathCallThunkGenerator):
1900         * jit/AssemblyHelpers.cpp:
1901         (JSC::AssemblyHelpers::jitReleaseAssertNoException):
1902         (JSC::AssemblyHelpers::callExceptionFuzz):
1903         (JSC::AssemblyHelpers::emitJumpIfException):
1904         (JSC::AssemblyHelpers::emitExceptionCheck):
1905         (JSC::AssemblyHelpers::emitNonPatchableExceptionCheck):
1906         (JSC::AssemblyHelpers::emitLoadStructure):
1907         (JSC::AssemblyHelpers::emitRandomThunk):
1908         (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
1909         (JSC::AssemblyHelpers::emitConvertValueToBoolean):
1910         (JSC::AssemblyHelpers::debugCall):
1911         * jit/AssemblyHelpers.h:
1912         (JSC::AssemblyHelpers::AssemblyHelpers):
1913         (JSC::AssemblyHelpers::codeBlock):
1914         (JSC::AssemblyHelpers::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
1915         (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMEntryFrameCalleeSavesBuffer):
1916         (JSC::AssemblyHelpers::barrierBranch):
1917         (JSC::AssemblyHelpers::barrierStoreLoadFence):
1918         (JSC::AssemblyHelpers::mutatorFence):
1919         (JSC::AssemblyHelpers::storeButterfly):
1920         (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly):
1921         (JSC::AssemblyHelpers::jumpIfMutatorFenceNotNeeded):
1922         (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
1923         (JSC::AssemblyHelpers::emitAllocateJSObject):
1924         (JSC::AssemblyHelpers::emitAllocateVariableSizedCell):
1925         (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
1926         (JSC::AssemblyHelpers::emitAllocateDestructibleObject):
1927         (JSC::AssemblyHelpers::vm): Deleted.
1928         (JSC::AssemblyHelpers::debugCall): Deleted.
1929         * jit/CCallHelpers.cpp:
1930         (JSC::CCallHelpers::ensureShadowChickenPacket):
1931         * jit/CCallHelpers.h:
1932         (JSC::CCallHelpers::CCallHelpers):
1933         (JSC::CCallHelpers::jumpToExceptionHandler):
1934         * jit/JIT.cpp:
1935         (JSC::JIT::emitEnterOptimizationCheck):
1936         (JSC::JIT::privateCompileExceptionHandlers):
1937         * jit/JIT.h:
1938         (JSC::JIT::exceptionCheck):
1939         (JSC::JIT::exceptionCheckWithCallFrameRollback):
1940         * jit/JITMathIC.h:
1941         (JSC::JITMathIC::generateOutOfLine):
1942         * jit/JITOpcodes.cpp:
1943         (JSC::JIT::emit_op_instanceof):
1944         (JSC::JIT::emit_op_is_undefined):
1945         (JSC::JIT::emit_op_jfalse):
1946         (JSC::JIT::emit_op_jeq_null):
1947         (JSC::JIT::emit_op_jneq_null):
1948         (JSC::JIT::emit_op_jtrue):
1949         (JSC::JIT::emit_op_throw):
1950         (JSC::JIT::emit_op_catch):
1951         (JSC::JIT::emit_op_eq_null):
1952         (JSC::JIT::emit_op_neq_null):
1953         (JSC::JIT::emitSlow_op_loop_hint):
1954         (JSC::JIT::emit_op_log_shadow_chicken_prologue):
1955         (JSC::JIT::emit_op_log_shadow_chicken_tail):
1956         * jit/JITOpcodes32_64.cpp:
1957         (JSC::JIT::privateCompileCTINativeCall):
1958         (JSC::JIT::emit_op_new_object):
1959         (JSC::JIT::emit_op_jfalse):
1960         (JSC::JIT::emit_op_jtrue):
1961         (JSC::JIT::emit_op_throw):
1962         (JSC::JIT::emit_op_catch):
1963         (JSC::JIT::emit_op_create_this):
1964         (JSC::JIT::emit_op_log_shadow_chicken_prologue):
1965         (JSC::JIT::emit_op_log_shadow_chicken_tail):
1966         * jit/JITPropertyAccess.cpp:
1967         (JSC::JIT::emitWriteBarrier):
1968         * jit/JSInterfaceJIT.h:
1969         (JSC::JSInterfaceJIT::JSInterfaceJIT):
1970         (JSC::JSInterfaceJIT::vm):
1971         * jit/Repatch.cpp:
1972         (JSC::tryCacheGetByID):
1973         (JSC::tryCachePutByID):
1974         (JSC::linkPolymorphicCall):
1975         (JSC::resetGetByID):
1976         (JSC::resetPutByID):
1977         * jit/SetupVarargsFrame.cpp:
1978         (JSC::emitSetupVarargsFrameFastCase):
1979         * jit/SetupVarargsFrame.h:
1980         * jit/SpecializedThunkJIT.h:
1981         (JSC::SpecializedThunkJIT::loadArgumentWithSpecificClass):
1982         * jit/ThunkGenerators.cpp:
1983         (JSC::throwExceptionFromCallSlowPathGenerator):
1984         (JSC::linkCallThunkGenerator):
1985         (JSC::linkPolymorphicCallThunkGenerator):
1986         (JSC::virtualThunkFor):
1987         (JSC::nativeForGenerator):
1988         (JSC::randomThunkGenerator):
1989         (JSC::boundThisNoArgsFunctionCallGenerator):
1990         (JSC::throwExceptionFromWasmThunkGenerator):
1991         * wasm/WasmB3IRGenerator.cpp:
1992         (JSC::Wasm::parseAndCompile):
1993         * wasm/WasmBinding.cpp:
1994         (JSC::Wasm::wasmToJs):
1995         (JSC::Wasm::wasmToWasm):
1996
1997 2017-03-28  Keith Miller  <keith_miller@apple.com>
1998
1999         WebAssembly: We should have Origins
2000         https://bugs.webkit.org/show_bug.cgi?id=170217
2001
2002         Reviewed by Mark Lam.
2003
2004         This patch adds wasm origins for B3::Values, called OpcodeOrigin. Currently,
2005         OpcodeOrigin just tracks the original opcode and the location of that opcode.
2006
2007         Here's a sample:
2008
2009         BB#0: ; frequency = 1.000000
2010             Int64 @4 = Patchpoint(generator = 0x10f487fa8, earlyClobbered = [], lateClobbered = [], usedRegisters = [], resultConstraint = SomeRegister)
2011             Int64 @5 = FramePointer()
2012             Void @8 = Store(@4, @5, offset = 24, ControlDependent|Writes:Top)
2013             Int64 @10 = Const64(0)
2014             Void @12 = Store($0(@10), @5, offset = 16, ControlDependent|Writes:Top)
2015             Int64 @13 = Patchpoint(generator = 0x10f4be7f0, earlyClobbered = [], lateClobbered = [], usedRegisters = [], resultConstraint = SomeRegister, ExitsSideways|ControlDependent|WritesPinned|ReadsPinned|Fence|Writes:Top|Reads:Top)
2016             Int64 @16 = ArgumentReg(%rdi)
2017             Int64 @18 = ArgumentReg(%rsi)
2018             Int32 @22 = Trunc(@18, Wasm: {opcode: I64Rotl, location: 5})
2019             Int64 @23 = RotL(@16, @22, Wasm: {opcode: I64Rotl, location: 5})
2020             Void @27 = Return(@23, Terminal, Wasm: {opcode: End, location: 6})
2021
2022         * JavaScriptCore.xcodeproj/project.pbxproj:
2023         * b3/B3Value.cpp:
2024         (JSC::B3::Value::deepDump):
2025         * wasm/WasmB3IRGenerator.cpp:
2026         (JSC::Wasm::B3IRGenerator::setParser):
2027         (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
2028         (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
2029         (JSC::Wasm::B3IRGenerator::emitLoadOp):
2030         (JSC::Wasm::B3IRGenerator::emitStoreOp):
2031         (JSC::Wasm::B3IRGenerator::addConstant):
2032         (JSC::Wasm::B3IRGenerator::addLoop):
2033         (JSC::Wasm::B3IRGenerator::unify):
2034         (JSC::Wasm::parseAndCompile):
2035         (JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv):
2036         (JSC::Wasm::getMemoryBaseAndSize): Deleted.
2037         * wasm/WasmFunctionParser.h:
2038         (JSC::Wasm::FunctionParser::currentOpcode):
2039         (JSC::Wasm::FunctionParser::currentOpcodeStartingOffset):
2040         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
2041         * wasm/WasmOpcodeOrigin.cpp: Added.
2042         (JSC::Wasm::OpcodeOrigin::dump):
2043         * wasm/WasmOpcodeOrigin.h: Added.
2044         (JSC::Wasm::OpcodeOrigin::OpcodeOrigin):
2045         * wasm/WasmValidate.cpp:
2046         (JSC::Wasm::Validate::setParser):
2047         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
2048         (CodeGenerator.generate):
2049         (generateB3OpCode):
2050         (generateConstCode):
2051
2052 2017-03-28  JF Bastien  <jfbastien@apple.com>
2053
2054         WebAssembly: option to crash if no fast memory is available
2055         https://bugs.webkit.org/show_bug.cgi?id=170219
2056
2057         Reviewed by Mark Lam.
2058
2059         * runtime/Options.h:
2060         * wasm/WasmMemory.cpp:
2061         (JSC::Wasm::webAssemblyCouldntGetFastMemory):
2062         (JSC::Wasm::tryGetFastMemory):
2063
2064 2017-03-28  Mark Lam  <mark.lam@apple.com>
2065
2066         The Mutator should not be able to steal the conn if the Collector hasn't reached the NotRunning phase yet.
2067         https://bugs.webkit.org/show_bug.cgi?id=170213
2068         <rdar://problem/30755345>
2069
2070         Reviewed by Filip Pizlo.
2071
2072         The current condition for stealing the conn isn't tight enough.  Restricting the
2073         stealing to when m_currentPhase == NotRunning ensures that the Collector is
2074         really done running.
2075
2076         No test because this issue only manifests with a race condition that is difficult
2077         to reproduce on demand.
2078
2079         * heap/Heap.cpp:
2080         (JSC::Heap::requestCollection):
2081
2082 2017-03-28  Keith Miller  <keith_miller@apple.com>
2083
2084         WebAssembly: Make WebAssembly.instantiate/compile truly asynchronous
2085         https://bugs.webkit.org/show_bug.cgi?id=169187
2086
2087         Reviewed by Saam Barati.
2088
2089         This patch allows WebAssembly compilations to happen asynchronously.
2090         To do so, it refactors how much of the compilation happens and adds
2091         new infrastructure for async promises.
2092
2093         First, there is a new class, PromiseDeferredTimer that lives on
2094         the VM.  PromiseDeferredTimer will manage the life-cycle of async
2095         pending promises and any dependencies that promise
2096         needs. PromiseDeferredTimer automagically releases the pending
2097         promise and dependencies once the JSPromiseDeferred is resolved or
2098         rejected. Additionally, PromiseDeferredTimer provides a mechanism
2099         to poll the run-loop whenever the async task needs to synchronize
2100         with the JS thread. Normally, that will be whenever the async task
2101         finishes. In the case of Web Assembly we also use this feature for
2102         the compile + instantiate case, where we might have more work
2103         after the first async task completes (more on that later).
2104
2105         The next class is Wasm::Worklist, which is used to manage Wasm
2106         compilation tasks. The worklist class works similarly to the
2107         DFG/FTL Worklists. It has a pool of threads that it manages. One
2108         interesting aspect of Wasm Worklist is that it can synchronously
2109         compile a plan that is already potentially running
2110         asynchronously. This can occur if a user calls
2111         WebAssembly.instantiate() then new WebAssembly.instantiate() on
2112         the same module. In that case the Wasm Worklist will bump the
2113         priority of the running pending Plan and block the JS thread.
2114
2115         This patch also makes some of the Wasm Plan code cleaner. Since we
2116         now defer all compilation to instantiation time, we no longer need
2117         to guess at which memory we are going to get. Also, Wasm Plans now
2118         track the work they have done with a state enum.
2119
2120         Finally, this patch makes renamed HeapTimer to JSRunLoopTimer. It
2121         also adds changes test262AsyncTest to a more generic testing
2122         infrastructure. Now, in addition to the old functionality, you can
2123         call asyncTest() with the number of tests you expect. When the jsc
2124         CLI exits, it will guarantee that asyncTestPassed() is called that
2125         many times.
2126
2127         * CMakeLists.txt:
2128         * JavaScriptCore.xcodeproj/project.pbxproj:
2129         * heap/GCActivityCallback.h:
2130         * heap/IncrementalSweeper.cpp:
2131         (JSC::IncrementalSweeper::scheduleTimer):
2132         (JSC::IncrementalSweeper::IncrementalSweeper):
2133         * heap/IncrementalSweeper.h:
2134         * heap/StopIfNecessaryTimer.cpp:
2135         (JSC::StopIfNecessaryTimer::StopIfNecessaryTimer):
2136         * heap/StopIfNecessaryTimer.h:
2137         * heap/StrongInlines.h:
2138         * jsc.cpp:
2139         (GlobalObject::finishCreation):
2140         (printInternal):
2141         (functionAsyncTestStart):
2142         (functionAsyncTestPassed):
2143         (functionTestWasmModuleFunctions):
2144         (CommandLine::parseArguments):
2145         (runJSC):
2146         * runtime/JSPromiseDeferred.cpp:
2147         (JSC::JSPromiseDeferred::resolve):
2148         (JSC::JSPromiseDeferred::reject):
2149         * runtime/JSPromiseDeferred.h:
2150         (JSC::JSPromiseDeferred::promiseAsyncPending):
2151         * runtime/JSRunLoopTimer.cpp: Renamed from Source/JavaScriptCore/heap/HeapTimer.cpp.
2152         (JSC::JSRunLoopTimer::JSRunLoopTimer):
2153         (JSC::JSRunLoopTimer::setRunLoop):
2154         (JSC::JSRunLoopTimer::~JSRunLoopTimer):
2155         (JSC::JSRunLoopTimer::timerDidFire):
2156         (JSC::JSRunLoopTimer::scheduleTimer):
2157         (JSC::JSRunLoopTimer::cancelTimer):
2158         (JSC::JSRunLoopTimer::invalidate):
2159         * runtime/JSRunLoopTimer.h: Copied from Source/JavaScriptCore/heap/HeapTimer.h.
2160         * runtime/Options.h:
2161         * runtime/PromiseDeferredTimer.cpp: Added.
2162         (JSC::PromiseDeferredTimer::PromiseDeferredTimer):
2163         (JSC::PromiseDeferredTimer::doWork):
2164         (JSC::PromiseDeferredTimer::runRunLoop):
2165         (JSC::PromiseDeferredTimer::addPendingPromise):
2166         (JSC::PromiseDeferredTimer::cancelPendingPromise):
2167         (JSC::PromiseDeferredTimer::scheduleWorkSoon):
2168         (JSC::PromiseDeferredTimer::scheduleBlockedTask):
2169         * runtime/PromiseDeferredTimer.h: Renamed from Source/JavaScriptCore/heap/HeapTimer.h.
2170         (JSC::PromiseDeferredTimer::stopRunningTasks):
2171         * runtime/VM.cpp:
2172         (JSC::VM::VM):
2173         (JSC::VM::~VM):
2174         * runtime/VM.h:
2175         * wasm/JSWebAssembly.cpp:
2176         (JSC::reject):
2177         (JSC::webAssemblyCompileFunc):
2178         (JSC::resolve):
2179         (JSC::instantiate):
2180         (JSC::compileAndInstantiate):
2181         (JSC::webAssemblyInstantiateFunc):
2182         (JSC::webAssemblyValidateFunc):
2183         * wasm/WasmB3IRGenerator.cpp:
2184         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
2185         (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
2186         (JSC::Wasm::B3IRGenerator::memoryKind):
2187         (JSC::Wasm::parseAndCompile):
2188         * wasm/WasmB3IRGenerator.h:
2189         * wasm/WasmFormat.h:
2190         (JSC::Wasm::ModuleInformation::internalFunctionCount):
2191         * wasm/WasmFunctionParser.h:
2192         * wasm/WasmMemory.h:
2193         * wasm/WasmMemoryInformation.cpp:
2194         (JSC::Wasm::MemoryInformation::MemoryInformation):
2195         * wasm/WasmMemoryInformation.h:
2196         (JSC::Wasm::MemoryInformation::maximum):
2197         (JSC::Wasm::MemoryInformation::hasReservedMemory): Deleted.
2198         (JSC::Wasm::MemoryInformation::takeReservedMemory): Deleted.
2199         (JSC::Wasm::MemoryInformation::mode): Deleted.
2200         * wasm/WasmModuleParser.cpp:
2201         * wasm/WasmModuleParser.h:
2202         (JSC::Wasm::ModuleParser::ModuleParser):
2203         * wasm/WasmPlan.cpp:
2204         (JSC::Wasm::Plan::Plan):
2205         (JSC::Wasm::Plan::stateString):
2206         (JSC::Wasm::Plan::moveToState):
2207         (JSC::Wasm::Plan::fail):
2208         (JSC::Wasm::Plan::parseAndValidateModule):
2209         (JSC::Wasm::Plan::prepare):
2210         (JSC::Wasm::Plan::ThreadCountHolder::ThreadCountHolder):
2211         (JSC::Wasm::Plan::ThreadCountHolder::~ThreadCountHolder):
2212         (JSC::Wasm::Plan::compileFunctions):
2213         (JSC::Wasm::Plan::complete):
2214         (JSC::Wasm::Plan::waitForCompletion):
2215         (JSC::Wasm::Plan::cancel):
2216         (JSC::Wasm::Plan::run): Deleted.
2217         (JSC::Wasm::Plan::initializeCallees): Deleted.
2218         * wasm/WasmPlan.h:
2219         (JSC::Wasm::Plan::dontFinalize):
2220         (JSC::Wasm::Plan::exports):
2221         (JSC::Wasm::Plan::internalFunctionCount):
2222         (JSC::Wasm::Plan::takeModuleInformation):
2223         (JSC::Wasm::Plan::takeCallLinkInfos):
2224         (JSC::Wasm::Plan::takeWasmExitStubs):
2225         (JSC::Wasm::Plan::setModeAndPromise):
2226         (JSC::Wasm::Plan::mode):
2227         (JSC::Wasm::Plan::pendingPromise):
2228         (JSC::Wasm::Plan::vm):
2229         (JSC::Wasm::Plan::errorMessage):
2230         (JSC::Wasm::Plan::failed):
2231         (JSC::Wasm::Plan::hasWork):
2232         (JSC::Wasm::Plan::hasBeenPrepared):
2233         * wasm/WasmPlanInlines.h: Copied from Source/JavaScriptCore/wasm/WasmB3IRGenerator.h.
2234         (JSC::Wasm::Plan::initializeCallees):
2235         * wasm/WasmValidate.cpp:
2236         * wasm/WasmWorklist.cpp: Added.
2237         (JSC::Wasm::Worklist::priorityString):
2238         (JSC::Wasm::Worklist::QueueElement::setToNextPriority):
2239         (JSC::Wasm::Worklist::iterate):
2240         (JSC::Wasm::Worklist::enqueue):
2241         (JSC::Wasm::Worklist::completePlanSynchronously):
2242         (JSC::Wasm::Worklist::stopAllPlansForVM):
2243         (JSC::Wasm::Worklist::Worklist):
2244         (JSC::Wasm::Worklist::~Worklist):
2245         (JSC::Wasm::existingWorklistOrNull):
2246         (JSC::Wasm::ensureWorklist):
2247         * wasm/WasmWorklist.h: Added.
2248         (JSC::Wasm::Worklist::nextTicket):
2249         (JSC::Wasm::Worklist::Comparator::operator()):
2250         * wasm/js/JSWebAssemblyCallee.h:
2251         * wasm/js/JSWebAssemblyCodeBlock.cpp:
2252         (JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
2253         (JSC::JSWebAssemblyCodeBlock::initialize):
2254         (JSC::JSWebAssemblyCodeBlock::isSafeToRun):
2255         * wasm/js/JSWebAssemblyCodeBlock.h:
2256         (JSC::JSWebAssemblyCodeBlock::create):
2257         (JSC::JSWebAssemblyCodeBlock::initialized):
2258         (JSC::JSWebAssemblyCodeBlock::plan):
2259         (JSC::JSWebAssemblyCodeBlock::runnable):
2260         (JSC::JSWebAssemblyCodeBlock::errorMessage):
2261         (JSC::JSWebAssemblyCodeBlock::callees):
2262         * wasm/js/JSWebAssemblyHelpers.h:
2263         (JSC::createSourceBufferFromValue):
2264         * wasm/js/JSWebAssemblyInstance.cpp:
2265         (JSC::JSWebAssemblyInstance::finishCreation):
2266         (JSC::JSWebAssemblyInstance::visitChildren):
2267         (JSC::JSWebAssemblyInstance::addUnitializedCodeBlock):
2268         (JSC::JSWebAssemblyInstance::finalizeCreation):
2269         (JSC::JSWebAssemblyInstance::create):
2270         (JSC::JSWebAssemblyInstance::setMemory): Deleted.
2271         * wasm/js/JSWebAssemblyInstance.h:
2272         (JSC::JSWebAssemblyInstance::codeBlock):
2273         (JSC::JSWebAssemblyInstance::initialized):
2274         (JSC::JSWebAssemblyInstance::module):
2275         (JSC::JSWebAssemblyInstance::importFunction):
2276         (JSC::JSWebAssemblyInstance::setMemory):
2277         (JSC::JSWebAssemblyInstance::table):
2278         (JSC::JSWebAssemblyInstance::importFunctions):
2279         (JSC::JSWebAssemblyInstance::setImportFunction): Deleted.
2280         (JSC::JSWebAssemblyInstance::setTable): Deleted.
2281         * wasm/js/JSWebAssemblyModule.cpp:
2282         (JSC::JSWebAssemblyModule::createStub):
2283         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
2284         (JSC::JSWebAssemblyModule::finishCreation):
2285         (JSC::JSWebAssemblyModule::setCodeBlock):
2286         (JSC::JSWebAssemblyModule::buildCodeBlock): Deleted.
2287         (JSC::JSWebAssemblyModule::create): Deleted.
2288         (JSC::JSWebAssemblyModule::codeBlock): Deleted.
2289         * wasm/js/JSWebAssemblyModule.h:
2290         (JSC::JSWebAssemblyModule::moduleInformation):
2291         (JSC::JSWebAssemblyModule::codeBlock):
2292         (JSC::JSWebAssemblyModule::source):
2293         (JSC::JSWebAssemblyModule::takeReservedMemory): Deleted.
2294         (JSC::JSWebAssemblyModule::codeBlockFor): Deleted.
2295         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2296         (JSC::constructJSWebAssemblyInstance):
2297         (JSC::WebAssemblyInstanceConstructor::createInstance): Deleted.
2298         * wasm/js/WebAssemblyModuleConstructor.cpp:
2299         (JSC::WebAssemblyModuleConstructor::createModule):
2300         * wasm/js/WebAssemblyModulePrototype.cpp:
2301         (JSC::webAssemblyModuleProtoImports):
2302         (JSC::webAssemblyModuleProtoExports):
2303         * wasm/js/WebAssemblyModuleRecord.cpp:
2304         (JSC::WebAssemblyModuleRecord::finishCreation):
2305         (JSC::WebAssemblyModuleRecord::link):
2306         (JSC::WebAssemblyModuleRecord::evaluate):
2307         * wasm/js/WebAssemblyModuleRecord.h:
2308
2309 2017-03-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2310
2311         WebAssembly: add fallback to use pinned register to load/store state
2312         https://bugs.webkit.org/show_bug.cgi?id=169773
2313
2314         Reviewed by Saam Barati.
2315
2316         This patch adds a new pinned register to hold JSWebAssemblyInstance,
2317         which is used to represent the context of running Wasm code.
2318         While we use fast TLS to hold the context in macOS, we do not have
2319         any system reserved fast TLS slot in the other systems. This pinned
2320         register approach is used in these systems. These changes decouple
2321         VM from Wasm module to make Wasm module position independent code.
2322
2323         While using fast TLS could be beneficial in x64 systems which number of
2324         registers is relatively small, pinned register approach could be
2325         beneficial in ARM64 which has plenty of registers. In macOS, we can
2326         switch the implementation with the runtime flag. Thus macOS port can
2327         compare the performance and decide which implementation is used after
2328         landing this patch.
2329
2330         * heap/MarkedBlock.h:
2331         (JSC::MarkedBlock::offsetOfVM):
2332         * jit/AssemblyHelpers.cpp:
2333         (JSC::AssemblyHelpers::loadWasmContext):
2334         (JSC::AssemblyHelpers::storeWasmContext):
2335         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister):
2336         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister):
2337         * jit/AssemblyHelpers.h:
2338         (JSC::AssemblyHelpers::loadWasmContext): Deleted.
2339         (JSC::AssemblyHelpers::storeWasmContext): Deleted.
2340         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister): Deleted.
2341         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister): Deleted.
2342         * jit/Repatch.cpp:
2343         (JSC::webAssemblyOwner):
2344         (JSC::linkFor):
2345         (JSC::linkPolymorphicCall):
2346         (JSC::isWebAssemblyToJSCallee): Deleted.
2347         * jit/ThunkGenerators.cpp:
2348         (JSC::throwExceptionFromWasmThunkGenerator):
2349         * llint/LLIntData.cpp:
2350         (JSC::LLInt::Data::performAssertions):
2351         * llint/LowLevelInterpreter.asm:
2352         * runtime/JSCell.cpp:
2353         (JSC::JSCell::isAnyWasmCallee):
2354         * runtime/JSCellInlines.h:
2355         (JSC::isWebAssemblyToJSCallee):
2356         * runtime/JSType.h:
2357         * runtime/StackFrame.cpp:
2358         (JSC::StackFrame::functionName):
2359         * runtime/VM.cpp:
2360         (JSC::VM::VM):
2361         * runtime/VM.h:
2362         (JSC::VM::wasmContextOffset):
2363         * wasm/WasmB3IRGenerator.cpp:
2364         (JSC::Wasm::B3IRGenerator::materializeWasmContext):
2365         (JSC::Wasm::B3IRGenerator::restoreWasmContext):
2366         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
2367         (JSC::Wasm::getMemoryBaseAndSize):
2368         (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
2369         (JSC::Wasm::createJSToWasmWrapper):
2370         (JSC::Wasm::loadWasmContext): Deleted.
2371         (JSC::Wasm::storeWasmContext): Deleted.
2372         (JSC::Wasm::restoreWebAssemblyGlobalState): Deleted.
2373         * wasm/WasmBinding.cpp:
2374         (JSC::Wasm::wasmToJs):
2375         * wasm/WasmContext.cpp:
2376         (JSC::loadWasmContext):
2377         (JSC::storeWasmContext):
2378         * wasm/WasmContext.h:
2379         * wasm/WasmMemoryInformation.cpp:
2380         (JSC::Wasm::getPinnedRegisters):
2381         (JSC::Wasm::PinnedRegisterInfo::get):
2382         (JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):
2383         * wasm/WasmMemoryInformation.h:
2384         (JSC::Wasm::PinnedRegisterInfo::toSave):
2385         (JSC::Wasm::useFastTLS):
2386         (JSC::Wasm::useFastTLSForWasmContext):
2387         * wasm/js/JSWebAssemblyInstance.cpp:
2388         (JSC::JSWebAssemblyInstance::finishCreation):
2389         (JSC::JSWebAssemblyInstance::visitChildren):
2390         * wasm/js/JSWebAssemblyInstance.h:
2391         (JSC::JSWebAssemblyInstance::offsetOfCallee):
2392         * wasm/js/JSWebAssemblyModule.cpp:
2393         (JSC::JSWebAssemblyModule::finishCreation):
2394         (JSC::JSWebAssemblyModule::visitChildren):
2395         * wasm/js/JSWebAssemblyModule.h:
2396         (JSC::JSWebAssemblyModule::callee):
2397         * wasm/js/WebAssemblyFunction.cpp:
2398         (JSC::callWebAssemblyFunction):
2399         (JSC::WebAssemblyFunction::create):
2400         * wasm/js/WebAssemblyToJSCallee.cpp:
2401         (JSC::WebAssemblyToJSCallee::create):
2402         (JSC::WebAssemblyToJSCallee::createStructure):
2403         (JSC::WebAssemblyToJSCallee::finishCreation):
2404         (JSC::WebAssemblyToJSCallee::visitChildren):
2405         (JSC::WebAssemblyToJSCallee::destroy): Deleted.
2406         * wasm/js/WebAssemblyToJSCallee.h:
2407
2408 2017-03-28  Brian Burg  <bburg@apple.com>
2409
2410         Web Inspector: Add "Disable Caches" option that only applies to the inspected page while Web Inspector is open
2411         https://bugs.webkit.org/show_bug.cgi?id=169865
2412         <rdar://problem/31250573>
2413
2414         Reviewed by Joseph Pecoraro.
2415
2416         * inspector/protocol/Network.json:
2417         Rename the command for disabling resource caching to match the WebCore::Page
2418         flag. This also removes the possibility that this could be confused for the old,
2419         buggy command that this patch rips out.
2420
2421 2017-03-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2422
2423         [JSC] Move platformThreadSignal to WTF
2424         https://bugs.webkit.org/show_bug.cgi?id=170097
2425
2426         Reviewed by Mark Lam.
2427
2428         It is a small clean up towards https://bugs.webkit.org/show_bug.cgi?id=170027.
2429         platformThreadSignal uses PlatformThread in JSC, but it can be implemented in
2430         WTF ThreadIdentifier.
2431
2432         * runtime/JSLock.cpp:
2433         (JSC::JSLock::lock):
2434         * runtime/JSLock.h:
2435         (JSC::JSLock::ownerThread):
2436         (JSC::JSLock::currentThreadIsHoldingLock):
2437         * runtime/PlatformThread.h:
2438         (JSC::platformThreadSignal): Deleted.
2439         * runtime/VM.h:
2440         (JSC::VM::ownerThread):
2441         * runtime/VMTraps.cpp:
2442         (JSC::VMTraps::SignalSender::send):
2443
2444 2017-03-28  JF Bastien  <jfbastien@apple.com>
2445
2446         WebAssembly: implement Module imports/exports
2447         https://bugs.webkit.org/show_bug.cgi?id=166982
2448
2449         Reviewed by Saam Barati.
2450
2451         As defined in: https://github.com/WebAssembly/design/commit/18cbacb90cd3584dd5c9aa3d392e4e55f66af6ab
2452
2453         * wasm/WasmFormat.h:
2454         (JSC::Wasm::makeString): use uppercase instead, it was only used
2455         for diagnostic but is now used for the expected JS property's
2456         capitalization
2457         * wasm/js/WebAssemblyModulePrototype.cpp:
2458         (JSC::webAssemblyModuleProtoImports):
2459         (JSC::webAssemblyModuleProtoExports):
2460
2461 2017-03-27  JF Bastien  <jfbastien@apple.com>
2462
2463         WebAssembly: JSWebAssemblyCodeBlock.h belongs in JavaScriptCore/wasm/js not JavaScriptCore/wasm
2464         https://bugs.webkit.org/show_bug.cgi?id=170160
2465
2466         Reviewed by Mark Lam.
2467
2468         * JavaScriptCore.xcodeproj/project.pbxproj:
2469         * wasm/js/JSWebAssemblyCodeBlock.h: Renamed from Source/JavaScriptCore/wasm/JSWebAssemblyCodeBlock.h.
2470
2471 2017-03-27  JF Bastien  <jfbastien@apple.com>
2472
2473         WebAssembly: misc memory testing
2474         https://bugs.webkit.org/show_bug.cgi?id=170137
2475
2476         Reviewed by Keith Miller.
2477
2478         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2479         (JSC::WebAssemblyInstanceConstructor::createInstance): improve error messages
2480
2481 2017-03-27  Michael Saboff  <msaboff@apple.com>
2482
2483         Add ARM64 system instructions to disassembler
2484         https://bugs.webkit.org/show_bug.cgi?id=170084
2485
2486         Reviewed by Saam Barati.
2487
2488         This changes adds support for MRS and MSR instructions, and refactors the DMB
2489         disassembly to handle all of the barrier instructions.
2490
2491         * disassembler/ARM64/A64DOpcode.cpp:
2492         (JSC::ARM64Disassembler::A64DOpcodeMSRImmediate::format):
2493         (JSC::ARM64Disassembler::A64DOpcodeMSROrMRSRegister::format):
2494         (JSC::ARM64Disassembler::A64DOpcodeSystemSync::format):
2495         (JSC::ARM64Disassembler::A64DOpcodeDmb::format): Deleted.
2496         * disassembler/ARM64/A64DOpcode.h:
2497         (JSC::ARM64Disassembler::A64DOpcodeSystem::lBit):
2498         (JSC::ARM64Disassembler::A64DOpcodeSystem::op0):
2499         (JSC::ARM64Disassembler::A64DOpcodeSystem::op1):
2500         (JSC::ARM64Disassembler::A64DOpcodeSystem::crN):
2501         (JSC::ARM64Disassembler::A64DOpcodeSystem::crM):
2502         (JSC::ARM64Disassembler::A64DOpcodeSystem::op2):
2503         (JSC::ARM64Disassembler::A64DOpcodeMSROrMRSRegister::opName):
2504         (JSC::ARM64Disassembler::A64DOpcodeMSROrMRSRegister::systemRegister):
2505         (JSC::ARM64Disassembler::A64DOpcodeSystemSync::opName):
2506         (JSC::ARM64Disassembler::A64DOpcodeSystemSync::option):
2507         (JSC::ARM64Disassembler::A64DOpcodeDmb::opName): Deleted.
2508         (JSC::ARM64Disassembler::A64DOpcodeDmb::option): Deleted.
2509         (JSC::ARM64Disassembler::A64DOpcodeDmb::crM): Deleted.
2510
2511 2017-03-26  Filip Pizlo  <fpizlo@apple.com>
2512
2513         B3::fixSSA should do liveness pruning
2514         https://bugs.webkit.org/show_bug.cgi?id=170111
2515
2516         Reviewed by Saam Barati.
2517
2518         This moves all of the logic of Air::Liveness<> to WTF::Liveness<> and then uses that to
2519         create B3::VariableLiveness. Then this uses VariableLiveness::LiveAtHead to prune Phi
2520         construction.
2521
2522         This makes B3::fixSSA run twice as fast. This is a 13% progression on WasmBench compile
2523         times.
2524
2525         * CMakeLists.txt:
2526         * JavaScriptCore.xcodeproj/project.pbxproj:
2527         * b3/B3BasicBlock.h:
2528         (JSC::B3::BasicBlock::get):
2529         * b3/B3FixSSA.cpp:
2530         (JSC::B3::fixSSA):
2531         * b3/B3VariableLiveness.cpp: Added.
2532         (JSC::B3::VariableLiveness::VariableLiveness):
2533         (JSC::B3::VariableLiveness::~VariableLiveness):
2534         * b3/B3VariableLiveness.h: Added.
2535         (JSC::B3::VariableLivenessAdapter::VariableLivenessAdapter):
2536         (JSC::B3::VariableLivenessAdapter::numIndices):
2537         (JSC::B3::VariableLivenessAdapter::valueToIndex):
2538         (JSC::B3::VariableLivenessAdapter::indexToValue):
2539         (JSC::B3::VariableLivenessAdapter::blockSize):
2540         (JSC::B3::VariableLivenessAdapter::forEachEarlyUse):
2541         (JSC::B3::VariableLivenessAdapter::forEachLateUse):
2542         (JSC::B3::VariableLivenessAdapter::forEachEarlyDef):
2543         (JSC::B3::VariableLivenessAdapter::forEachLateDef):
2544         * b3/air/AirCFG.h: Added.
2545         (JSC::B3::Air::CFG::CFG):
2546         (JSC::B3::Air::CFG::root):
2547         (JSC::B3::Air::CFG::newMap):
2548         (JSC::B3::Air::CFG::successors):
2549         (JSC::B3::Air::CFG::predecessors):
2550         (JSC::B3::Air::CFG::index):
2551         (JSC::B3::Air::CFG::node):
2552         (JSC::B3::Air::CFG::numNodes):
2553         (JSC::B3::Air::CFG::dump):
2554         * b3/air/AirCode.cpp:
2555         (JSC::B3::Air::Code::Code):
2556         * b3/air/AirCode.h:
2557         (JSC::B3::Air::Code::cfg):
2558         * b3/air/AirLiveness.h:
2559         (JSC::B3::Air::LivenessAdapter::LivenessAdapter):
2560         (JSC::B3::Air::LivenessAdapter::blockSize):
2561         (JSC::B3::Air::LivenessAdapter::forEachEarlyUse):
2562         (JSC::B3::Air::LivenessAdapter::forEachLateUse):
2563         (JSC::B3::Air::LivenessAdapter::forEachEarlyDef):
2564         (JSC::B3::Air::LivenessAdapter::forEachLateDef):
2565         (JSC::B3::Air::TmpLivenessAdapter::TmpLivenessAdapter):
2566         (JSC::B3::Air::TmpLivenessAdapter::numIndices):
2567         (JSC::B3::Air::StackSlotLivenessAdapter::StackSlotLivenessAdapter):
2568         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
2569         (JSC::B3::Air::StackSlotLivenessAdapter::indexToValue):
2570         (JSC::B3::Air::Liveness::Liveness):
2571         (JSC::B3::Air::Liveness::LocalCalc::LocalCalc): Deleted.
2572         (JSC::B3::Air::Liveness::LocalCalc::Iterable::Iterable): Deleted.
2573         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::iterator): Deleted.
2574         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator++): Deleted.
2575         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator*): Deleted.
2576         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator==): Deleted.
2577         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator!=): Deleted.
2578         (JSC::B3::Air::Liveness::LocalCalc::Iterable::begin): Deleted.
2579         (JSC::B3::Air::Liveness::LocalCalc::Iterable::end): Deleted.
2580         (JSC::B3::Air::Liveness::LocalCalc::Iterable::contains): Deleted.
2581         (JSC::B3::Air::Liveness::LocalCalc::live): Deleted.
2582         (JSC::B3::Air::Liveness::LocalCalc::isLive): Deleted.
2583         (JSC::B3::Air::Liveness::LocalCalc::execute): Deleted.
2584         (JSC::B3::Air::Liveness::rawLiveAtHead): Deleted.
2585         (JSC::B3::Air::Liveness::Iterable::Iterable): Deleted.
2586         (JSC::B3::Air::Liveness::Iterable::iterator::iterator): Deleted.
2587         (JSC::B3::Air::Liveness::Iterable::iterator::operator*): Deleted.
2588         (JSC::B3::Air::Liveness::Iterable::iterator::operator++): Deleted.
2589         (JSC::B3::Air::Liveness::Iterable::iterator::operator==): Deleted.
2590         (JSC::B3::Air::Liveness::Iterable::iterator::operator!=): Deleted.
2591         (JSC::B3::Air::Liveness::Iterable::begin): Deleted.
2592         (JSC::B3::Air::Liveness::Iterable::end): Deleted.
2593         (JSC::B3::Air::Liveness::Iterable::contains): Deleted.
2594         (JSC::B3::Air::Liveness::liveAtHead): Deleted.
2595         (JSC::B3::Air::Liveness::liveAtTail): Deleted.
2596         (JSC::B3::Air::Liveness::workset): Deleted.
2597
2598 2017-03-25  Filip Pizlo  <fpizlo@apple.com>
2599
2600         Air::Liveness shouldn't need HashSets
2601         https://bugs.webkit.org/show_bug.cgi?id=170102
2602
2603         Reviewed by Yusuke Suzuki.
2604
2605         This converts Air::Liveness<> to no longer use HashSets or BitVectors. This turns out to be
2606         easy because it's cheap enough to do a sorted merge of the things being added to liveAtHead and
2607         the things in the predecessors' liveAtTail. This turns out to be faster - it's a 2% overall
2608         compile time progression on WasmBench.
2609
2610         * b3/B3LowerToAir.cpp:
2611         (JSC::B3::Air::LowerToAir::lower): Add a FIXME unrelated to this patch.
2612         * b3/air/AirLiveness.h:
2613         (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
2614         (JSC::B3::Air::AbstractLiveness::LocalCalc::LocalCalc):
2615         (JSC::B3::Air::AbstractLiveness::rawLiveAtHead):
2616         (JSC::B3::Air::AbstractLiveness::liveAtHead):
2617         (JSC::B3::Air::AbstractLiveness::liveAtTail):
2618         * b3/air/AirTmp.h:
2619         (JSC::B3::Air::Tmp::bank):
2620         (JSC::B3::Air::Tmp::tmpIndex):
2621         * dfg/DFGStoreBarrierClusteringPhase.cpp:
2622
2623 2017-03-26  Filip Pizlo  <fpizlo@apple.com>
2624
2625         Air should use RegisterSet for RegLiveness
2626         https://bugs.webkit.org/show_bug.cgi?id=170108
2627
2628         Reviewed by Yusuke Suzuki.
2629
2630         The biggest change here is the introduction of the new RegLiveness class. This is a
2631         drop-in replacement for the old RegLiveness, which was a specialization of
2632         AbstractLiveness<>, but it's about 30% faster. It gets its speed boost from just using
2633         sets everywhere, which is efficient for registers since RegisterSet is just two (on
2634         x86-64) or three 32-bit (on ARM64) statically allocated words. This looks like a 1%
2635         compile time progression on WasmBench.
2636
2637         * CMakeLists.txt:
2638         * JavaScriptCore.xcodeproj/project.pbxproj:
2639         * b3/B3TimingScope.cpp: Records phase timing totals.
2640         (JSC::B3::TimingScope::TimingScope):
2641         (JSC::B3::TimingScope::~TimingScope):
2642         * b3/B3TimingScope.h:
2643         * b3/air/AirAllocateRegistersByGraphColoring.cpp:
2644         (JSC::B3::Air::allocateRegistersByGraphColoring):
2645         * b3/air/AirLiveness.h: Move code around and rename a bit to make it more like RegLiveness; in particular we want the `iterator` to be called `iterator` not `Iterator`, and we want it to be internal to its iterable. Also rename this template to Liveness, to match the header filename.
2646         (JSC::B3::Air::Liveness::Liveness):
2647         (JSC::B3::Air::Liveness::LocalCalc::LocalCalc):
2648         (JSC::B3::Air::Liveness::LocalCalc::Iterable::Iterable):
2649         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::iterator):
2650         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator++):
2651         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator*):
2652         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator==):
2653         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator!=):
2654         (JSC::B3::Air::Liveness::LocalCalc::Iterable::begin):
2655         (JSC::B3::Air::Liveness::LocalCalc::Iterable::end):
2656         (JSC::B3::Air::Liveness::Iterable::Iterable):
2657         (JSC::B3::Air::Liveness::Iterable::iterator::iterator):
2658         (JSC::B3::Air::RegLivenessAdapter::RegLivenessAdapter): Deleted.
2659         (JSC::B3::Air::RegLivenessAdapter::numIndices): Deleted.
2660         (JSC::B3::Air::RegLivenessAdapter::acceptsBank): Deleted.
2661         (JSC::B3::Air::RegLivenessAdapter::acceptsRole): Deleted.
2662         (JSC::B3::Air::RegLivenessAdapter::valueToIndex): Deleted.
2663         (JSC::B3::Air::RegLivenessAdapter::indexToValue): Deleted.
2664         (JSC::B3::Air::AbstractLiveness::AbstractLiveness): Deleted.
2665         (JSC::B3::Air::AbstractLiveness::LocalCalc::LocalCalc): Deleted.
2666         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::Iterator): Deleted.
2667         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator++): Deleted.
2668         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator*): Deleted.
2669         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator==): Deleted.
2670         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator!=): Deleted.
2671         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::Iterable): Deleted.
2672         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::begin): Deleted.
2673         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::end): Deleted.
2674         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::contains): Deleted.
2675         (JSC::B3::Air::AbstractLiveness::LocalCalc::live): Deleted.
2676         (JSC::B3::Air::AbstractLiveness::LocalCalc::isLive): Deleted.
2677         (JSC::B3::Air::AbstractLiveness::LocalCalc::execute): Deleted.
2678         (JSC::B3::Air::AbstractLiveness::rawLiveAtHead): Deleted.
2679         (JSC::B3::Air::AbstractLiveness::Iterable::Iterable): Deleted.
2680         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::iterator): Deleted.
2681         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator*): Deleted.
2682         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator++): Deleted.
2683         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator==): Deleted.
2684         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator!=): Deleted.
2685         (JSC::B3::Air::AbstractLiveness::Iterable::begin): Deleted.
2686         (JSC::B3::Air::AbstractLiveness::Iterable::end): Deleted.
2687         (JSC::B3::Air::AbstractLiveness::Iterable::contains): Deleted.
2688         (JSC::B3::Air::AbstractLiveness::liveAtHead): Deleted.
2689         (JSC::B3::Air::AbstractLiveness::liveAtTail): Deleted.
2690         (JSC::B3::Air::AbstractLiveness::workset): Deleted.
2691         * b3/air/AirLogRegisterPressure.cpp:
2692         * b3/air/AirLowerAfterRegAlloc.cpp:
2693         * b3/air/AirRegLiveness.cpp: Added.
2694         (JSC::B3::Air::RegLiveness::RegLiveness):
2695         (JSC::B3::Air::RegLiveness::~RegLiveness):
2696         (JSC::B3::Air::RegLiveness::LocalCalc::execute):
2697         * b3/air/AirRegLiveness.h: Added.
2698         (JSC::B3::Air::RegLiveness::LocalCalc::LocalCalc):
2699         (JSC::B3::Air::RegLiveness::LocalCalc::live):
2700         (JSC::B3::Air::RegLiveness::LocalCalc::isLive):
2701         (JSC::B3::Air::RegLiveness::liveAtHead):
2702         (JSC::B3::Air::RegLiveness::liveAtTail):
2703         * b3/air/AirReportUsedRegisters.cpp:
2704         * jit/RegisterSet.h:
2705         (JSC::RegisterSet::add):
2706         (JSC::RegisterSet::remove):
2707         (JSC::RegisterSet::contains):
2708         (JSC::RegisterSet::subsumes):
2709         (JSC::RegisterSet::iterator::iterator):
2710         (JSC::RegisterSet::iterator::operator*):
2711         (JSC::RegisterSet::iterator::operator++):
2712         (JSC::RegisterSet::iterator::operator==):
2713         (JSC::RegisterSet::iterator::operator!=):
2714         (JSC::RegisterSet::begin):
2715         (JSC::RegisterSet::end):
2716
2717 2017-03-25  Filip Pizlo  <fpizlo@apple.com>
2718
2719         Fix wasm by returning after we do TLS.
2720
2721         Rubber stamped by Keith Miller.
2722
2723         * jit/AssemblyHelpers.h:
2724         (JSC::AssemblyHelpers::storeWasmContext):
2725
2726 2017-03-24  Mark Lam  <mark.lam@apple.com>
2727
2728         Add some instrumentation in Heap::resumeThePeriphery() to help debug an issue.
2729         https://bugs.webkit.org/show_bug.cgi?id=170086
2730         <rdar://problem/31253673>
2731
2732         Reviewed by Saam Barati.
2733
2734         Adding some instrumentation in Heap::resumeThePeriphery() to dump some Heap state
2735         just before we RELEASE_ASSERT_NOT_REACHED.
2736
2737         * heap/Heap.cpp:
2738         (JSC::Heap::resumeThePeriphery):
2739
2740 2017-03-24  JF Bastien  <jfbastien@apple.com>
2741
2742         WebAssembly: store state in TLS instead of on VM
2743         https://bugs.webkit.org/show_bug.cgi?id=169611
2744
2745         Reviewed by Filip Pizlo.
2746
2747         Using thread-local storage instead of VM makes code more position
2748         independent. We used to store the WebAssembly top Instance (the
2749         latest one in the call stack) on VM, now we instead store it in
2750         TLS. This top Instance is used to access a bunch of state such as
2751         Memory location, size, table (for call_indirect), etc.
2752
2753         Instead of calling it "top", which is confusing, we now just call
2754         it WasmContext.
2755
2756         Making the code PIC means future patches will be able to
2757         postMessage and structured clone into IDB without having to
2758         recompile the code. This wasn't possible before because we
2759         hard-coded the address of VM at compilation time. That doesn't
2760         work between workers, and doesn't work across reloads (which IDB
2761         is intended to do).
2762
2763         It'll also potentially make code faster once we start tuning
2764         what's in TLS, what's in which of the 4 free slots, and what's in
2765         pinned registers. I'm leaving this tuning for later because
2766         there's lower lying fruit for us to pick.
2767
2768         * CMakeLists.txt:
2769         * JavaScriptCore.xcodeproj/project.pbxproj:
2770         * assembler/AbstractMacroAssembler.h:
2771         * assembler/AllowMacroScratchRegisterUsageIf.h: Copied from assembler/AllowMacroScratchRegisterUsage.h.
2772         (JSC::AllowMacroScratchRegisterUsageIf::AllowMacroScratchRegisterUsageIf):
2773         (JSC::AllowMacroScratchRegisterUsageIf::~AllowMacroScratchRegisterUsageIf):
2774         * assembler/MacroAssembler.h:
2775         (JSC::MacroAssembler::storeToTLSPtr): we previously didn't have
2776         the code required to store to TLS, only to load
2777         * assembler/MacroAssemblerARM64.h:
2778         (JSC::MacroAssemblerARM64::loadFromTLSPtrNeedsMacroScratchRegister):
2779         (JSC::MacroAssemblerARM64::storeToTLS32):
2780         (JSC::MacroAssemblerARM64::storeToTLS64):
2781         (JSC::MacroAssemblerARM64::storeToTLSPtrNeedsMacroScratchRegister):
2782         * assembler/MacroAssemblerX86Common.h:
2783         (JSC::MacroAssemblerX86Common::loadFromTLSPtrNeedsMacroScratchRegister):
2784         (JSC::MacroAssemblerX86Common::storeToTLS32):
2785         (JSC::MacroAssemblerX86Common::storeToTLSPtrNeedsMacroScratchRegister):
2786         * assembler/MacroAssemblerX86_64.h:
2787         (JSC::MacroAssemblerX86_64::loadFromTLS64): was loading 32-bit instead of 64-bit
2788         (JSC::MacroAssemblerX86_64::storeToTLS64):
2789         * assembler/X86Assembler.h:
2790         (JSC::X86Assembler::movl_rm):
2791         (JSC::X86Assembler::movq_rm):
2792         * b3/testb3.cpp:
2793         (JSC::B3::testFastTLSLoad):
2794         (JSC::B3::testFastTLSStore):
2795         (JSC::B3::run):
2796         * jit/AssemblyHelpers.h:
2797         (JSC::AssemblyHelpers::loadWasmContext):
2798         (JSC::AssemblyHelpers::storeWasmContext):
2799         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister):
2800         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister):
2801         * jit/Repatch.cpp:
2802         (JSC::webAssemblyOwner):
2803         * jit/ThunkGenerators.cpp:
2804         (JSC::throwExceptionFromWasmThunkGenerator):
2805         * runtime/Options.h:
2806         * runtime/VM.cpp:
2807         (JSC::VM::VM):
2808         * runtime/VM.h:
2809         * wasm/WasmB3IRGenerator.cpp:
2810         (JSC::Wasm::loadWasmContext):
2811         (JSC::Wasm::storeWasmContext):
2812         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
2813         (JSC::Wasm::getMemoryBaseAndSize):
2814         (JSC::Wasm::restoreWebAssemblyGlobalState):
2815         (JSC::Wasm::createJSToWasmWrapper):
2816         (JSC::Wasm::parseAndCompile):
2817         * wasm/WasmBinding.cpp:
2818         (JSC::Wasm::materializeImportJSCell):
2819         (JSC::Wasm::wasmToJs):
2820         (JSC::Wasm::wasmToWasm):
2821         * wasm/WasmContext.cpp: Added.
2822         (JSC::loadWasmContext):
2823         (JSC::storeWasmContext):
2824         * wasm/WasmContext.h: Added. Replaces "top" JSWebAssemblyInstance.
2825         * wasm/js/WebAssemblyFunction.cpp:
2826         (JSC::callWebAssemblyFunction):
2827         * wasm/js/WebAssemblyInstanceConstructor.h:
2828
2829 2017-03-24  JF Bastien  <jfbastien@apple.com>
2830
2831         WebAssembly: spec-tests/memory.wast.js fails in debug
2832         https://bugs.webkit.org/show_bug.cgi?id=169794
2833
2834         Reviewed by Keith Miller.
2835
2836         The failure was due to empty memories (with maximum size 0). Those
2837         only occur in tests and in code that's trying to trip us. This
2838         patch adds memory mode "none" which represents no memory. It can
2839         work with either bounds checked or signaling code because it never
2840         contains loads and stores.
2841
2842         The spec tests which were failing did the following:
2843             > (module (memory (data)) (func (export "memsize") (result i32) (current_memory)))
2844             > (assert_return (invoke "memsize") (i32.const 0))
2845             > (module (memory (data "")) (func (export "memsize") (result i32) (current_memory)))
2846             > (assert_return (invoke "memsize") (i32.const 0))
2847             > (module (memory (data "x")) (func (export "memsize") (result i32) (current_memory)))
2848             > (assert_return (invoke "memsize") (i32.const 1))
2849
2850         * wasm/WasmB3IRGenerator.cpp:
2851         (JSC::Wasm::B3IRGenerator::memoryKind):
2852         * wasm/WasmMemory.cpp:
2853         (JSC::Wasm::tryGetFastMemory):
2854         (JSC::Wasm::releaseFastMemory):
2855         (JSC::Wasm::Memory::Memory):
2856         (JSC::Wasm::Memory::createImpl):
2857         (JSC::Wasm::Memory::create):
2858         (JSC::Wasm::Memory::grow):
2859         (JSC::Wasm::Memory::makeString):
2860         * wasm/WasmMemory.h:
2861         * wasm/WasmMemoryInformation.cpp:
2862         (JSC::Wasm::MemoryInformation::MemoryInformation):
2863         * wasm/js/JSWebAssemblyCodeBlock.cpp:
2864         (JSC::JSWebAssemblyCodeBlock::isSafeToRun):
2865         * wasm/js/JSWebAssemblyModule.cpp:
2866         (JSC::JSWebAssemblyModule::codeBlock):
2867         (JSC::JSWebAssemblyModule::finishCreation):
2868         * wasm/js/JSWebAssemblyModule.h:
2869         (JSC::JSWebAssemblyModule::codeBlock):
2870         (JSC::JSWebAssemblyModule::codeBlockFor):
2871
2872 2017-03-24  Mark Lam  <mark.lam@apple.com>
2873
2874         Array memcpy'ing fast paths should check if we're having a bad time if they cannot handle it.
2875         https://bugs.webkit.org/show_bug.cgi?id=170064
2876         <rdar://problem/31246098>
2877
2878         Reviewed by Geoffrey Garen.
2879
2880         * runtime/ArrayPrototype.cpp:
2881         (JSC::arrayProtoPrivateFuncConcatMemcpy):
2882         * runtime/JSArray.cpp:
2883         (JSC::JSArray::fastSlice):
2884
2885 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2886
2887         [JSC] Use jsNontrivialString agressively for ToString(Int52)
2888         https://bugs.webkit.org/show_bug.cgi?id=170002
2889
2890         Reviewed by Sam Weinig.
2891
2892         We use the same logic used for Int32 to use jsNontvirialString.
2893         After single character check, produced string is always longer than 1.
2894         Thus, we can use jsNontrivialString.
2895
2896         * runtime/NumberPrototype.cpp:
2897         (JSC::int52ToString):
2898
2899 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2900
2901         [JSC] Use WeakRandom for SamplingProfiler interval fluctuation
2902         https://bugs.webkit.org/show_bug.cgi?id=170045
2903
2904         Reviewed by Mark Lam.
2905
2906         It is unnecessary to use cryptographicallyRandomNumber for SamplingProfiler
2907         interval fluctuation. Use WeakRandom instead.
2908
2909         * runtime/SamplingProfiler.cpp:
2910         (JSC::SamplingProfiler::SamplingProfiler):
2911         (JSC::SamplingProfiler::timerLoop):
2912         * runtime/SamplingProfiler.h:
2913
2914 2017-03-23  Mark Lam  <mark.lam@apple.com>
2915
2916         Array.prototype.splice behaves incorrectly when the VM is "having a bad time".
2917         https://bugs.webkit.org/show_bug.cgi?id=170025
2918         <rdar://problem/31228679>
2919
2920         Reviewed by Saam Barati.
2921
2922         * runtime/ArrayPrototype.cpp:
2923         (JSC::copySplicedArrayElements):
2924         (JSC::arrayProtoFuncSplice):
2925
2926 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2927
2928         [JSC][DFG] Make addShouldSpeculateAnyInt more conservative to avoid regression caused by Double <-> Int52 conversions
2929         https://bugs.webkit.org/show_bug.cgi?id=169998
2930
2931         Reviewed by Saam Barati.
2932
2933         Double <-> Int52 and JSValue <-> Int52 conversions are not so cheap. Thus, Int52Rep is super carefully emitted.
2934         We make addShouldSpeculateAnyInt more conservative to avoid regressions caused by the above conversions.
2935         We select ArithAdd(Int52, Int52) only when this calculation is beneficial compared to added Int52Rep conversions.
2936
2937         This patch tighten the conditions of addShouldSpeculateAnyInt.
2938
2939         1. Honor DoubleConstant.
2940
2941         When executing imaging-darkroom, we have a thing like that,
2942
2943             132:< 2:loc36> DoubleConstant(Double|UseAsOther, AnyIntAsDouble, Double: 4607182418800017408, 1.000000, bc#114)
2944             1320:< 1:loc38>        Int52Rep(Check:Int32:@82, Int52|PureInt, Int32, Exits, bc#114)
2945             1321:< 1:loc39>        Int52Constant(Int52|PureInt, Boolint32Nonboolint32Int52, Double: 4607182418800017408, 1.000000, bc#114)
2946             133:<!3:loc39> ArithSub(Int52Rep:@1320<Int52>, Int52Rep:@1321<Int52>, Int52|MustGen, Int52, CheckOverflow, Exits, bc#114)
2947
2948         The LHS of ArithSub says predicting Boolint32, and the rhs says AnyIntAsDouble. Thus we select ArithSub(Int52, Int52) instead
2949         of ArithSub(Double, Double). However, it soon causes OSR exits. In imaging-darkroom, LHS's Int32 prediction will be broken.
2950         While speculating Int32 in the above situation is reasonable approach since the given LHS says predicting Int32, this causes
2951         severe performance regression.
2952
2953         Previously, we always select ArithSub(Double, Double). So accidentally, we do not encounter this misprediction issue.
2954
2955         One thing can be found that we have DoubleConstant in the RHS. It means that we have `1.0` instead of `1` in the code.
2956         We can see the code like `lhs - 1.0` instead of `lhs - 1` in imaging-darkroom. It offers good information that lhs and
2957         the resulting value would be double. Handling the above ArithSub in double seems more appropriate rather than handling
2958         it in Int52.
2959
2960         So, in this patch, we honor DoubleConstant. If we find DoubleConstant on one operand, we give up selecting
2961         Arith[Sub,Add](Int52, Int52). This change removes OSR exits occurr in imaging-darkroom right now.
2962
2963         2. Two Int52Rep(Double) conversions are not desirable.
2964
2965         We allow AnyInt ArithAdd only when the one operand of the binary operation should be speculated AnyInt. It is a bit conservative
2966         decision. This is because Double to Int52 conversion is not so cheap. Frequent back-and-forth conversions between Double and Int52
2967         rather hurt the performance. If the one operand of the operation is already Int52, the cost for constructing ArithAdd becomes
2968         cheap since only one Double to Int52 conversion could be required.
2969         This recovers some regression in assorted tests while keeping kraken crypto improvements.
2970
2971         3. Avoid frequent Int52 to JSValue conversions.
2972
2973         Int52 to JSValue conversion is not so cheap. Thus, we would like to avoid such situations. So, in this patch, we allow
2974         Arith(Int52, Int52) with AnyIntAsDouble operand only when the node is used as number. By doing so, we avoid the case like,
2975         converting Int52, performing ArithAdd, and soon converting back to JSValue.
2976
2977         The above 3 changes recover the regression measured in microbenchmarks/int52-back-and-forth.js and assorted benchmarks.
2978         And still it keeps kraken crypto improvements.
2979
2980                                                    baseline                  patched
2981
2982         imaging-darkroom                       201.112+-3.192      ^     189.532+-2.883         ^ definitely 1.0611x faster
2983         stanford-crypto-pbkdf2                 103.953+-2.325            100.926+-2.396           might be 1.0300x faster
2984         stanford-crypto-sha256-iterative        35.103+-1.071      ?      36.049+-1.143         ? might be 1.0270x slower
2985
2986         * dfg/DFGGraph.h:
2987         (JSC::DFG::Graph::addShouldSpeculateAnyInt):
2988
2989 == Rolled over to ChangeLog-2017-03-23 ==