Source/JavaScriptCore/ChangeLog

   1 2017-04-06  Youenn Fablet  <youenn@apple.com>
   2
   3         WebRTC tests gardening
   4         https://bugs.webkit.org/show_bug.cgi?id=170508
   5
   6         Reviewed by Eric Carlson.
   7
   8         * Configurations/FeatureDefines.xcconfig:
   9
  10 2017-04-06  Guillaume Emont  <guijemont@igalia.com>
  11
  12         [JSC][MIPS][DFG] Use x86 generic HasOwnProperty
  13         https://bugs.webkit.org/show_bug.cgi?id=170222
  14
  15         Reviewed by Yusuke Suzuki.
  16
  17         * dfg/DFGFixupPhase.cpp:
  18         (JSC::DFG::FixupPhase::fixupNode):
  19         use the X86 special version for HasOwnProperty on MIPS too.
  20         * dfg/DFGSpeculativeJIT32_64.cpp:
  21         (JSC::DFG::SpeculativeJIT::compile):
  22         use the X86 special version for HasOwnProperty on MIPS too.
  23
  24 2017-04-05  Saam Barati  <sbarati@apple.com>
  25
  26         REGRESSION fix bad isWasm() test by ensuring proper Wasm callee bit pattern
  27         https://bugs.webkit.org/show_bug.cgi?id=170494
  28         <rdar://problem/31446485>
  29
  30         Reviewed by Yusuke Suzuki and Mark Lam.
  31
  32         This patch fixes how we test a 64 bit JSValue pattern to see if it's
  33         a Wasm callee. We now tag Wasm::Callee's with 0b011 in their lower 3 bits.
  34         The new test is for a Wasm Callee is as follows:
  35         isWasm(uint64_t x)
  36         {
  37             return x & 0xffff000000000007 == 3;
  38         }
  39
  40         This test works because the lower 3 bits of the non-number immediate values are as follows:
  41         undefined: 0b010
  42         null:      0b010
  43         true:      0b111
  44         false:     0b110
  45         The test rejects all of these because none have just the value 3 in their lower 3 bits.
  46         The test also rejects all numbers, because they have non-zero upper 16 bits.
  47         The test also rejects normal cells because they won't have the number 3 as
  48         their lower 3 bits. Note, this bit pattern also allows the normal JSValue isCell(), etc,
  49         predicates to work on a Wasm::Callee because the various tests will fail if you
  50         bit casted a boxed Wasm::Callee* to a JSValue. isCell() would fail since it sees
  51         TagBitTypeOther. The other tests also trivially fail, since it won't be a number,
  52         and it won't be equal to null, undefined, true, or false. The isBoolean() predicate
  53         will fail because we won't have TagBitBool set.
  54
  55         * interpreter/CallFrame.h:
  56         (JSC::ExecState::guaranteedJSValueCallee):
  57         (JSC::ExecState::calleeAsValue): Deleted.
  58         * interpreter/CalleeBits.h:
  59         (JSC::CalleeBits::boxWasm):
  60         (JSC::CalleeBits::isWasm):
  61         (JSC::CalleeBits::asWasmCallee):
  62         * jit/JITOperations.cpp:
  63         * runtime/JSCJSValue.h:
  64
  65 2017-04-05  Keith Miller  <keith_miller@apple.com>
  66
  67         WebAssembly: Plans should be able to have more than one completion task.
  68         https://bugs.webkit.org/show_bug.cgi?id=170516
  69
  70         Reviewed by Saam Barati.
  71
  72         This patch also eliminates the need for blocked tasks on the
  73         PromiseDeferredTimer and pendingPromise on Wasm::Plan.
  74
  75         * runtime/PromiseDeferredTimer.cpp:
  76         (JSC::PromiseDeferredTimer::doWork):
  77         (JSC::PromiseDeferredTimer::cancelPendingPromise):
  78         (JSC::PromiseDeferredTimer::scheduleBlockedTask): Deleted.
  79         * runtime/PromiseDeferredTimer.h:
  80         * wasm/WasmPlan.cpp:
  81         (JSC::Wasm::Plan::Plan):
  82         (JSC::Wasm::Plan::addCompletionTask):
  83         (JSC::Wasm::Plan::complete):
  84         * wasm/WasmPlan.h:
  85         (JSC::Wasm::Plan::setMode):
  86         (JSC::Wasm::Plan::mode):
  87         (JSC::Wasm::Plan::setModeAndPromise): Deleted.
  88         (JSC::Wasm::Plan::pendingPromise): Deleted.
  89         * wasm/WasmWorklist.cpp:
  90         (JSC::Wasm::Worklist::enqueue):
  91         * wasm/js/WebAssemblyInstanceConstructor.cpp:
  92         (JSC::constructJSWebAssemblyInstance):
  93         * wasm/js/WebAssemblyPrototype.cpp:
  94         (JSC::instantiate):
  95
  96 2017-04-05  Guilherme Iscaro  <iscaro@profusion.mobi>
  97
  98         Do not use BLX for immediates (ARM-32)
  99
 100         https://bugs.webkit.org/show_bug.cgi?id=170351
 101
 102         Reviewed by Mark Lam.
 103
 104         Currently the offline asm generator for 32-bit ARM code translates the
 105         'call' meta-instruction (which may be found in LowLevelInterpreter.asm
 106         and friends) to the ARM's BLX instrunction. The BLX instruction may be
 107         used for labels (immediates) and registers and one side effect of BLX
 108         is that it may switch the processor's instruction set.
 109         A 'BLX register' instruction will change/remain the processor state to
 110         ARM if the  register_bit[0] is set to 0 or change/remain to Thumb if
 111         register_bit[0] is set to 1. However, a 'BLX label' instruction will
 112         always switch the processor state. It switches ARM to thumb and vice-versa.
 113         This behaviour is unwanted, since the C++ code and the offlineasm generated code
 114         are both compiled using the same instruction set, thus a instruction
 115         set change will likely produce a crash. In order to fix the problem the
 116         BL instruction can be used for labels. It will branch just like BLX,
 117         but it won't change the instruction set. It's important to note that
 118         Darwin is not affected by this problem, thus to minimize the impact of
 119         this change the BL instruction will only be used on non-darwin targets.
 120
 121         BLX reference: http://infocenter.arm.com/help/topic/com.arm.doc.dui0489i/CIHBJCDC.html?resultof=%22%62%6c%78%22%20
 122
 123         * offlineasm/arm.rb:
 124
 125 2017-04-05  Keith Miller  <keith_miller@apple.com>
 126
 127         WebAssembly: We shouldn't need to pin size registers if we have a fast memory.
 128         https://bugs.webkit.org/show_bug.cgi?id=170504
 129
 130         Reviewed by Mark Lam.
 131
 132         * wasm/WasmB3IRGenerator.cpp:
 133         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
 134         (JSC::Wasm::createJSToWasmWrapper):
 135         (JSC::Wasm::parseAndCompile):
 136         * wasm/WasmMemoryInformation.h:
 137         (JSC::Wasm::PinnedRegisterInfo::toSave):
 138
 139 2017-04-05  Yusuke Suzuki  <utatane.tea@gmail.com>
 140
 141         [JSC] Suppress warnings in GCC
 142         https://bugs.webkit.org/show_bug.cgi?id=170501
 143
 144         Reviewed by Keith Miller.
 145
 146         Should use ASSERT_NOT_REACHED since return-type pragma is only
 147         enabled under ASSERT_DISABLED environment. We shoud use
 148         ASSERT_NOTREACHED to emit assertions in debug build. It effectively
 149         catches bugs while keeping performance in release build.
 150
 151         * b3/B3Opcode.cpp:
 152         (JSC::B3::storeOpcode):
 153         * b3/B3Width.h:
 154         (JSC::B3::mask):
 155         * runtime/Options.cpp:
 156         (JSC::parse):
 157         * wasm/WasmSections.h:
 158         (JSC::Wasm::makeString):
 159         * wasm/WasmSignature.cpp:
 160         (JSC::Wasm::SignatureInformation::tryCleanup):
 161         * wasm/generateWasmValidateInlinesHeader.py:
 162
 163 2017-04-05  Carlos Garcia Campos  <cgarcia@igalia.com>
 164
 165         Implement PromiseDeferredTimer for non CF based ports
 166         https://bugs.webkit.org/show_bug.cgi?id=170391
 167
 168         Reviewed by Yusuke Suzuki.
 169
 170         RunLoop handling is only implemented for CF causing several wasm tests to fail for other ports.
 171
 172         * jsc.cpp:
 173         (runJSC): Remove CF ifdefs.
 174         * runtime/PromiseDeferredTimer.cpp:
 175         (JSC::PromiseDeferredTimer::doWork): Add non CF implementation using WTF RunLoop.
 176         (JSC::PromiseDeferredTimer::runRunLoop): Ditto.
 177         * runtime/PromiseDeferredTimer.h:
 178
 179 2017-04-05  Carlos Garcia Campos  <cgarcia@igalia.com>
 180
 181         WebAssembly: several tests added in r214504 crash when building with GCC
 182         https://bugs.webkit.org/show_bug.cgi?id=170390
 183
 184         Reviewed by Saam Barati.
 185
 186         The pattern foo->bar([f = WTFMove(foo)]{}); crashes when building with GCC, I assume the move happens before the
 187         foo is used to invoke the function.
 188
 189         * wasm/js/WebAssemblyPrototype.cpp:
 190         (JSC::webAssemblyCompileFunc): Use p.vm() instead of plan->vm(), because plan is moved by the lambda.
 191         (JSC::instantiate): Ditto.
 192         (JSC::compileAndInstantiate): Ditto.
 193
 194 2017-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
 195
 196         [JSC] Generate TemplateObjects at linking time
 197         https://bugs.webkit.org/show_bug.cgi?id=169743
 198
 199         Reviewed by Keith Miller.
 200
 201         Currently, the code calls getTemplateObject to get appropriate template objects at runtime.
 202         But this template object is constant value and never changed. So instead of creating it
 203         at runtime, we should create it at linking time and store it in the constant registers.
 204
 205         * builtins/BuiltinNames.h:
 206         * bytecode/CodeBlock.cpp:
 207         (JSC::CodeBlock::finishCreation):
 208         (JSC::CodeBlock::setConstantRegisters):
 209         * bytecode/CodeBlock.h:
 210         * bytecode/UnlinkedCodeBlock.cpp:
 211         (JSC::UnlinkedCodeBlock::shrinkToFit):
 212         * bytecode/UnlinkedCodeBlock.h:
 213         * bytecompiler/BytecodeGenerator.cpp:
 214         (JSC::BytecodeGenerator::addTemplateRegistryKeyConstant):
 215         (JSC::BytecodeGenerator::emitGetTemplateObject):
 216         * bytecompiler/BytecodeGenerator.h:
 217         * bytecompiler/NodesCodegen.cpp:
 218         (JSC::TaggedTemplateNode::emitBytecode):
 219         * runtime/JSGlobalObject.cpp:
 220         (JSC::JSGlobalObject::init):
 221         (JSC::getTemplateObject): Deleted.
 222         * runtime/JSTemplateRegistryKey.cpp:
 223         * runtime/JSTemplateRegistryKey.h:
 224         (JSC::isTemplateRegistryKey):
 225
 226 2017-04-04  Mark Lam  <mark.lam@apple.com>
 227
 228         On ARM64, DFG::SpeculativeJIT::compileArithMod() failed to ensure result is of DataFormatInt32.
 229         https://bugs.webkit.org/show_bug.cgi?id=170473
 230         <rdar://problem/29912391>
 231
 232         Reviewed by Saam Barati.
 233
 234         In Unchecked mode, when DFG::SpeculativeJIT::compileArithMod() detects that the
 235         divisor is 0, we want it to return 0.  The result is expected to be of
 236         DataFormatIn32.
 237
 238         The ARM implementation just returns the value in the divisor register.  However,
 239         the divisor in this case can be of DataFormatJSInt32.  On ARM64, returning the
 240         divisor register yields the wrong result format because the same register also
 241         holds the upper 32-bit of the JSValue encoding.  The fix is to return an
 242         immediate 0 instead.
 243
 244         Also turned on the assertion in jitAssertIsInt32 for ARM64.  This assertion being
 245         disabled may have contributed to this bug going unnoticed all this time.
 246
 247         * dfg/DFGSpeculativeJIT.cpp:
 248         (JSC::DFG::SpeculativeJIT::compileArithMod):
 249         * jit/AssemblyHelpers.cpp:
 250         (JSC::AssemblyHelpers::jitAssertIsInt32):
 251
 252 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 253
 254         Air::eliminateDeadCode should not repeatedly process the same live instructions
 255         https://bugs.webkit.org/show_bug.cgi?id=170490
 256
 257         Reviewed by Keith Miller.
 258
 259         This makes the eliminateDeadCode() fixpoint somewhat worklist-based: we track the set
 260         of Insts that might be dead. Every time we detect that one is live, we remove it from
 261         the set. This is a big (>2x) speed-up because lots of Insts are immediately found to
 262         be live.
 263
 264         This is a ~1% wasm -O1 compile time progression.
 265
 266         * b3/air/AirEliminateDeadCode.cpp:
 267         (JSC::B3::Air::eliminateDeadCode):
 268
 269 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 270
 271         Air::eliminateDeadCode() should not use a HashSet
 272         https://bugs.webkit.org/show_bug.cgi?id=170487
 273
 274         Reviewed by Saam Barati.
 275
 276         Introduce TmpSet, which is like a HashSet<Tmp>. Use this to make eliminateDeadCode()
 277         about 50% faster, resulting in a 1% wasm -O1 compile time progression.
 278
 279         * JavaScriptCore.xcodeproj/project.pbxproj:
 280         * b3/air/AirEliminateDeadCode.cpp:
 281         (JSC::B3::Air::eliminateDeadCode):
 282         * b3/air/AirTmpSet.h: Added.
 283         (JSC::B3::Air::TmpSet::TmpSet):
 284         (JSC::B3::Air::TmpSet::add):
 285         (JSC::B3::Air::TmpSet::remove):
 286         (JSC::B3::Air::TmpSet::contains):
 287         (JSC::B3::Air::TmpSet::size):
 288         (JSC::B3::Air::TmpSet::isEmpty):
 289         (JSC::B3::Air::TmpSet::iterator::iterator):
 290         (JSC::B3::Air::TmpSet::iterator::operator*):
 291         (JSC::B3::Air::TmpSet::iterator::operator++):
 292         (JSC::B3::Air::TmpSet::iterator::operator==):
 293         (JSC::B3::Air::TmpSet::iterator::operator!=):
 294         (JSC::B3::Air::TmpSet::begin):
 295         (JSC::B3::Air::TmpSet::end):
 296
 297 2017-04-04  Keith Miller  <keith_miller@apple.com>
 298
 299         WebAssembly: ModuleInformation should be a ref counted thing that can be shared across threads.
 300         https://bugs.webkit.org/show_bug.cgi?id=170478
 301
 302         Reviewed by Saam Barati.
 303
 304         ModuleInformation has been moved to its own file and is now
 305         ThreadSafeRefCounted.  All the Strings we used to keep in the
 306         ModuleInformation have been switched to Vector<LChar> this has the
 307         advantage that it can be passed across threads. However, this does
 308         mean that we need to decode the utf8 strings in each thread. This
 309         is likely not a problem because:
 310
 311         1) most modules have few imports/exports/custom sections.
 312         2) most of the time they are ascii so the conversion is cheap.
 313         3) we only have to do it once per thread, and there shouldn't be too many.
 314
 315         This patch also removes
 316         moduleSignatureIndicesToUniquedSignatureIndices since that
 317         information can already be recovered from the
 318         SignatureInformation.
 319
 320         * JavaScriptCore.xcodeproj/project.pbxproj:
 321         * jsc.cpp:
 322         (functionTestWasmModuleFunctions):
 323         * runtime/Identifier.h:
 324         (JSC::Identifier::fromString):
 325         * wasm/WasmB3IRGenerator.cpp:
 326         (JSC::Wasm::parseAndCompile):
 327         * wasm/WasmB3IRGenerator.h:
 328         * wasm/WasmFormat.cpp:
 329         (JSC::Wasm::makeString):
 330         (JSC::Wasm::ModuleInformation::~ModuleInformation): Deleted.
 331         * wasm/WasmFormat.h:
 332         (JSC::Wasm::makeString):
 333         (JSC::Wasm::ModuleInformation::functionIndexSpaceSize): Deleted.
 334         (JSC::Wasm::ModuleInformation::isImportedFunctionFromFunctionIndexSpace): Deleted.
 335         (JSC::Wasm::ModuleInformation::signatureIndexFromFunctionIndexSpace): Deleted.
 336         (JSC::Wasm::ModuleInformation::importFunctionCount): Deleted.
 337         (JSC::Wasm::ModuleInformation::internalFunctionCount): Deleted.
 338         * wasm/WasmFunctionParser.h:
 339         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
 340         * wasm/WasmModuleInformation.cpp: Copied from Source/JavaScriptCore/wasm/WasmValidate.h.
 341         (JSC::Wasm::ModuleInformation::~ModuleInformation):
 342         * wasm/WasmModuleInformation.h: Added.
 343         (JSC::Wasm::ModuleInformation::functionIndexSpaceSize):
 344         (JSC::Wasm::ModuleInformation::isImportedFunctionFromFunctionIndexSpace):
 345         (JSC::Wasm::ModuleInformation::signatureIndexFromFunctionIndexSpace):
 346         (JSC::Wasm::ModuleInformation::importFunctionCount):
 347         (JSC::Wasm::ModuleInformation::internalFunctionCount):
 348         (JSC::Wasm::ModuleInformation::ModuleInformation):
 349         * wasm/WasmModuleParser.cpp:
 350         * wasm/WasmModuleParser.h:
 351         (JSC::Wasm::ModuleParser::ModuleParser):
 352         * wasm/WasmParser.h:
 353         (JSC::Wasm::Parser<SuccessType>::consumeUTF8String):
 354         * wasm/WasmPlan.cpp:
 355         (JSC::Wasm::Plan::Plan):
 356         (JSC::Wasm::Plan::parseAndValidateModule):
 357         (JSC::Wasm::Plan::prepare):
 358         (JSC::Wasm::Plan::compileFunctions):
 359         (JSC::Wasm::Plan::complete):
 360         (JSC::Wasm::Plan::cancel):
 361         * wasm/WasmPlan.h:
 362         (JSC::Wasm::Plan::internalFunctionCount):
 363         (JSC::Wasm::Plan::takeModuleInformation):
 364         * wasm/WasmSignature.cpp:
 365         (JSC::Wasm::SignatureInformation::get):
 366         * wasm/WasmSignature.h:
 367         * wasm/WasmValidate.cpp:
 368         (JSC::Wasm::validateFunction):
 369         * wasm/WasmValidate.h:
 370         * wasm/js/JSWebAssemblyHelpers.h:
 371         (JSC::createSourceBufferFromValue):
 372         * wasm/js/JSWebAssemblyModule.cpp:
 373         (JSC::JSWebAssemblyModule::createStub):
 374         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
 375         (JSC::JSWebAssemblyModule::finishCreation):
 376         * wasm/js/JSWebAssemblyModule.h:
 377         (JSC::JSWebAssemblyModule::moduleInformation):
 378         (JSC::JSWebAssemblyModule::source):
 379         * wasm/js/WebAssemblyInstanceConstructor.cpp:
 380         (JSC::constructJSWebAssemblyInstance):
 381         * wasm/js/WebAssemblyModuleConstructor.cpp:
 382         (JSC::WebAssemblyModuleConstructor::createModule):
 383         * wasm/js/WebAssemblyModulePrototype.cpp:
 384         (JSC::webAssemblyModuleProtoCustomSections):
 385         (JSC::webAssemblyModuleProtoImports):
 386         (JSC::webAssemblyModuleProtoExports):
 387         * wasm/js/WebAssemblyModuleRecord.cpp:
 388         (JSC::WebAssemblyModuleRecord::link):
 389         * wasm/js/WebAssemblyModuleRecord.h:
 390         * wasm/js/WebAssemblyPrototype.cpp:
 391         (JSC::webAssemblyCompileFunc):
 392         (JSC::instantiate):
 393         (JSC::compileAndInstantiate):
 394
 395 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 396
 397         B3::fixSSA() needs a tune-up
 398         https://bugs.webkit.org/show_bug.cgi?id=170485
 399
 400         Reviewed by Saam Barati.
 401
 402         After the various optimizations to liveness, register allocation, and other phases, the
 403         fixSSA() phase now looks like one of the top offenders. This includes a bunch of
 404         changes to make this phase run faster. This is a ~7% wasm -O1 compile time progression.
 405
 406         Here's what I did:
 407
 408         - We now use IndexSparseSet instead of IndexMap for tracking variable values. This
 409           makes it cheaper to chew through small blocks while there is a non-trivial number of
 410           total variables.
 411
 412         - We now do a "local SSA conversion" pass before anything else. This eliminates
 413           obvious Get's. If we were using temporary Variables, it would eliminate many of
 414           those. That's useful for when we use demoteValues() and duplciateTails(). For wasm
 415           -O1, we mainly care about the fact that it makes a bunch of Set's dead.
 416
 417         - We now do a Set DCE pass after the local SSA but before SSA conversion. This ensures
 418           that any block-local live intervals of Variables disappear and don't need further
 419           consideration.
 420
 421         - We now cache the reaching defs calculation.
 422
 423         - We now perform the reaching defs calculation lazily.
 424
 425         * b3/B3FixSSA.cpp:
 426         (JSC::B3::demoteValues):
 427         (JSC::B3::fixSSA):
 428         * b3/B3SSACalculator.cpp:
 429         (JSC::B3::SSACalculator::reachingDefAtTail):
 430         * b3/B3VariableLiveness.cpp:
 431         (JSC::B3::VariableLiveness::VariableLiveness):
 432         * b3/air/AirLiveness.h:
 433         (JSC::B3::Air::Liveness::Liveness):
 434         * dfg/DFGLivenessAnalysisPhase.cpp:
 435         (JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase): Deleted.
 436         (JSC::DFG::LivenessAnalysisPhase::run): Deleted.
 437         (JSC::DFG::LivenessAnalysisPhase::processBlock): Deleted.
 438
 439 2017-04-04  Joseph Pecoraro  <pecoraro@apple.com>
 440
 441         Remove stale LLVM Header Path includes from JavaScriptCore
 442         https://bugs.webkit.org/show_bug.cgi?id=170483
 443
 444         Reviewed by Mark Lam.
 445
 446         * Configurations/Base.xcconfig:
 447
 448 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 449
 450         B3::LowerToAir incorrectly selects BitXor(AtomicStrongCAS(...), $1)
 451         https://bugs.webkit.org/show_bug.cgi?id=169867
 452
 453         Reviewed by Saam Barati.
 454
 455         The BitXor(AtomicWeakCAS(...), $1) optimization makes a lot of sense because we an fold the
 456         BitXor into the CAS condition read-out. But there is no version of this that is profitable or
 457         correct for AtomicStrongCAS. The inversion case is handled by Equal(AtomicStrongCAS(...), ...)
 458         becoming NotEqual(AtomicStrongCAS(...), ...), and we alraedy handle that separately.
 459
 460         So, the fix here is to make the BitXor CAS pattern only recognize AtomicWeakCAS.
 461
 462         * b3/B3LowerToAir.cpp:
 463         (JSC::B3::Air::LowerToAir::lower):
 464         * b3/testb3.cpp:
 465         (JSC::B3::testAtomicStrongCAS):
 466
 467 2017-04-04  Saam Barati  <sbarati@apple.com>
 468
 469         WebAssembly: JSWebAssemblyCallee should not be a JSCell
 470         https://bugs.webkit.org/show_bug.cgi?id=170135
 471
 472         Reviewed by Michael Saboff.
 473
 474         This patch is perhaps the last big change to the design of fundamental
 475         Wasm API to allow for PIC. It changes JSWebAssemblyCallee into a thing
 476         called Wasm::Callee. It serves the same purpose as before, except
 477         Wasm::Callee is not a JSCell. I had to refactor the various parts of the
 478         runtime that will see CallFrame's with Wasm::Callee's in the callee slot.
 479         Thankfully, the parts of the runtime that Wasm touches are limited. The
 480         main refactoring is changing the exception handling code, such as taking
 481         a stack trace, to be friendly to seeing a non JSCell callee.
 482
 483         The callee() function on ExecState now returns a class I added in this
 484         patch called CalleeBits. CalleeBits will tell you if the callee is a
 485         JSCell or a Wasm::Callee. We tag Wasm::Callee's with a 1 in their lower
 486         bit so we can easily tell what is and isn't a Wasm::Callee.
 487
 488         The stub that calls out from Wasm to JS still puts a JSCell callee
 489         into the call frame, even though the callee logically represents a
 490         Wasm frame. The reason for this is that we use the call IC infrastructure
 491         to make a call out to JS code, and the code that writes the IC expects
 492         a JSCell as the callee. This is knowingly part of our design. When we
 493         do structured cloning of Wasm Modules, we'll need to regenerate these
 494         JS call stubs.
 495
 496         * API/JSContextRef.cpp:
 497         (BacktraceFunctor::operator()):
 498         * CMakeLists.txt:
 499         * JavaScriptCore.xcodeproj/project.pbxproj:
 500         * debugger/Debugger.cpp:
 501         (JSC::Debugger::pauseIfNeeded):
 502         (JSC::Debugger::currentDebuggerCallFrame):
 503         * debugger/DebuggerCallFrame.cpp:
 504         (JSC::DebuggerCallFrame::create):
 505         (JSC::DebuggerCallFrame::DebuggerCallFrame):
 506         (JSC::DebuggerCallFrame::currentPosition):
 507         (JSC::DebuggerCallFrame::positionForCallFrame):
 508         * debugger/DebuggerCallFrame.h:
 509         * interpreter/CallFrame.cpp:
 510         (JSC::CallFrame::vmEntryGlobalObject):
 511         (JSC::CallFrame::wasmAwareLexicalGlobalObject):
 512         (JSC::CallFrame::isAnyWasmCallee):
 513         (JSC::CallFrame::callerSourceOrigin):
 514         * interpreter/CallFrame.h:
 515         (JSC::ExecState::calleeAsValue):
 516         (JSC::ExecState::jsCallee):
 517         (JSC::ExecState::callee):
 518         (JSC::ExecState::unsafeCallee):
 519         (JSC::ExecState::scope):
 520         (JSC::ExecState::iterate):
 521         * interpreter/CalleeBits.h: Added.
 522         (JSC::CalleeBits::CalleeBits):
 523         (JSC::CalleeBits::operator=):
 524         (JSC::CalleeBits::boxWasm):
 525         (JSC::CalleeBits::isWasm):
 526         (JSC::CalleeBits::isCell):
 527         (JSC::CalleeBits::asCell):
 528         (JSC::CalleeBits::asWasmCallee):
 529         (JSC::CalleeBits::rawPtr):
 530         * interpreter/Interpreter.cpp:
 531         (JSC::GetStackTraceFunctor::operator()):
 532         (JSC::Interpreter::getStackTrace):
 533         (JSC::notifyDebuggerOfUnwinding):
 534         (JSC::UnwindFunctor::UnwindFunctor):
 535         (JSC::UnwindFunctor::operator()):
 536         (JSC::UnwindFunctor::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
 537         (JSC::Interpreter::unwind):
 538         (JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):
 539         * interpreter/Interpreter.h:
 540         * interpreter/Register.h:
 541         (JSC::Register::pointer):
 542         * interpreter/ShadowChicken.cpp:
 543         (JSC::ShadowChicken::update):
 544         * interpreter/ShadowChickenInlines.h:
 545         (JSC::ShadowChicken::iterate):
 546         * interpreter/StackVisitor.cpp:
 547         (JSC::StackVisitor::StackVisitor):
 548         (JSC::StackVisitor::readFrame):
 549         (JSC::StackVisitor::readNonInlinedFrame):
 550         (JSC::StackVisitor::readInlinedFrame):
 551         (JSC::StackVisitor::Frame::calleeSaveRegisters):
 552         (JSC::StackVisitor::Frame::functionName):
 553         (JSC::StackVisitor::Frame::dump):
 554         * interpreter/StackVisitor.h:
 555         (JSC::StackVisitor::Frame::callee):
 556         (JSC::StackVisitor::visit):
 557         * jit/Repatch.cpp:
 558         (JSC::linkFor):
 559         (JSC::linkPolymorphicCall):
 560         * jsc.cpp:
 561         (callWasmFunction):
 562         (functionTestWasmModuleFunctions):
 563         * runtime/ArrayPrototype.cpp:
 564         * runtime/Error.cpp:
 565         (JSC::addErrorInfoAndGetBytecodeOffset):
 566         * runtime/ErrorInstance.cpp:
 567         (JSC::ErrorInstance::finishCreation):
 568         * runtime/JSCell.cpp:
 569         (JSC::JSCell::isAnyWasmCallee): Deleted.
 570         * runtime/JSCell.h:
 571         * runtime/JSCellInlines.h:
 572         (JSC::ExecState::vm):
 573         * runtime/JSFunction.cpp:
 574         (JSC::RetrieveArgumentsFunctor::operator()):
 575         (JSC::RetrieveCallerFunctionFunctor::operator()):
 576         * runtime/JSGlobalObject.cpp:
 577         * runtime/SamplingProfiler.cpp:
 578         (JSC::FrameWalker::recordJSFrame):
 579         (JSC::SamplingProfiler::processUnverifiedStackTraces):
 580         * runtime/SamplingProfiler.h:
 581         (JSC::SamplingProfiler::UnprocessedStackFrame::UnprocessedStackFrame):
 582         * runtime/StackFrame.cpp:
 583         (JSC::StackFrame::sourceURL):
 584         (JSC::StackFrame::functionName):
 585         * runtime/StackFrame.h:
 586         (JSC::StackFrame::wasm):
 587         * runtime/VM.cpp:
 588         (JSC::VM::VM):
 589         (JSC::VM::throwException):
 590         * runtime/VM.h:
 591         * wasm/JSWebAssembly.h:
 592         * wasm/WasmB3IRGenerator.cpp:
 593         * wasm/WasmBinding.cpp:
 594         (JSC::Wasm::wasmToWasm):
 595         * wasm/WasmCallee.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp.
 596         (JSC::Wasm::Callee::Callee):
 597         (JSC::JSWebAssemblyCallee::JSWebAssemblyCallee): Deleted.
 598         (JSC::JSWebAssemblyCallee::finishCreation): Deleted.
 599         (JSC::JSWebAssemblyCallee::destroy): Deleted.
 600         * wasm/WasmCallee.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.h.
 601         (JSC::Wasm::Callee::create):
 602         (JSC::JSWebAssemblyCallee::create): Deleted.
 603         (JSC::JSWebAssemblyCallee::createStructure): Deleted.
 604         (JSC::JSWebAssemblyCallee::entrypoint): Deleted.
 605         (JSC::JSWebAssemblyCallee::calleeSaveRegisters): Deleted.
 606         * wasm/WasmContext.h:
 607         * wasm/WasmPlan.cpp:
 608         * wasm/WasmPlan.h:
 609         * wasm/WasmPlanInlines.h:
 610         (JSC::Wasm::Plan::initializeCallees):
 611         * wasm/WasmThunks.cpp:
 612         (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
 613         * wasm/js/JSWebAssemblyCallee.cpp: Removed.
 614         * wasm/js/JSWebAssemblyCallee.h: Removed.
 615         * wasm/js/JSWebAssemblyCodeBlock.cpp:
 616         (JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
 617         (JSC::JSWebAssemblyCodeBlock::initialize):
 618         (JSC::JSWebAssemblyCodeBlock::visitChildren):
 619         * wasm/js/JSWebAssemblyCodeBlock.h:
 620         (JSC::JSWebAssemblyCodeBlock::create):
 621         (JSC::JSWebAssemblyCodeBlock::jsEntrypointCalleeFromFunctionIndexSpace):
 622         (JSC::JSWebAssemblyCodeBlock::wasmEntrypointCalleeFromFunctionIndexSpace):
 623         (JSC::JSWebAssemblyCodeBlock::wasmToJsCallStubForImport):
 624         (JSC::JSWebAssemblyCodeBlock::offsetOfImportWasmToJSStub):
 625         (JSC::JSWebAssemblyCodeBlock::setJSEntrypointCallee):
 626         (JSC::JSWebAssemblyCodeBlock::setWasmEntrypointCallee):
 627         (JSC::JSWebAssemblyCodeBlock::offsetOfImportStubs):
 628         (JSC::JSWebAssemblyCodeBlock::allocationSize):
 629         (JSC::JSWebAssemblyCodeBlock::importWasmToJSStub):
 630         (JSC::JSWebAssemblyCodeBlock::callees): Deleted.
 631         (JSC::JSWebAssemblyCodeBlock::offsetOfCallees): Deleted.
 632         * wasm/js/JSWebAssemblyInstance.h:
 633         (JSC::JSWebAssemblyInstance::webAssemblyToJSCallee):
 634         * wasm/js/JSWebAssemblyModule.cpp:
 635         * wasm/js/WebAssemblyFunction.cpp:
 636         (JSC::callWebAssemblyFunction):
 637         (JSC::WebAssemblyFunction::create):
 638         (JSC::WebAssemblyFunction::WebAssemblyFunction):
 639         (JSC::WebAssemblyFunction::visitChildren):
 640         (JSC::WebAssemblyFunction::finishCreation):
 641         * wasm/js/WebAssemblyFunction.h:
 642         (JSC::WebAssemblyFunction::wasmEntrypoint):
 643         (JSC::WebAssemblyFunction::jsEntrypoint):
 644         (JSC::WebAssemblyFunction::offsetOfWasmEntrypoint):
 645         (JSC::WebAssemblyFunction::offsetOfWasmEntryPointCode): Deleted.
 646         * wasm/js/WebAssemblyModuleConstructor.cpp:
 647         * wasm/js/WebAssemblyModuleRecord.cpp:
 648         (JSC::WebAssemblyModuleRecord::link):
 649         (JSC::WebAssemblyModuleRecord::evaluate):
 650
 651 2017-04-04  Keith Miller  <keith_miller@apple.com>
 652
 653         WasmBench asserts in debug jsc
 654         https://bugs.webkit.org/show_bug.cgi?id=170462
 655
 656         Reviewed by Saam Barati.
 657
 658         The assertion should have been an if.
 659
 660         * wasm/WasmWorklist.cpp:
 661
 662 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 663
 664         Air::lowerAfterRegAlloc should bail early if it finds no Shuffles or ColdCCalls
 665         https://bugs.webkit.org/show_bug.cgi?id=170305
 666
 667         Reviewed by Saam Barati.
 668
 669         This reduces and sometimes completely eliminates the need to run lowerAfterRegAlloc().
 670
 671         This lowers the Shuffle for the arguments of a CCall before register allocation unless
 672         the CCall arguments require a real shuffle (like if the CCall arguments were argument
 673         registers). This lowers a ColdCCall like a CCall for optLevel<2.
 674
 675         Finally, lowerAfterRegAlloc() now checks if there are any Shuffles or CCalls before it
 676         does anything else. For wasm at -O1, this means that the phase doesn't run at all. This
 677         is a ~3% wasm -O1 compile time progression.
 678
 679         To make this easy, I changed optLevel into a property of Procedure and Code rather than
 680         an argument we thread through everything. I like how Procedure and Code are dumping
 681         ground classes. This does not bother me. Note that I cloned optLevel into Procedure and
 682         Code so that it's cheap to query inside Air phases.
 683
 684         * b3/B3Compile.cpp:
 685         (JSC::B3::compile):
 686         * b3/B3Compile.h:
 687         * b3/B3Generate.cpp:
 688         (JSC::B3::prepareForGeneration):
 689         (JSC::B3::generateToAir):
 690         * b3/B3Generate.h:
 691         * b3/B3Procedure.cpp:
 692         (JSC::B3::Procedure::setOptLevel):
 693         * b3/B3Procedure.h:
 694         (JSC::B3::Procedure::optLevel):
 695         * b3/air/AirCode.h:
 696         (JSC::B3::Air::Code::isPinned):
 697         (JSC::B3::Air::Code::setOptLevel):
 698         (JSC::B3::Air::Code::optLevel):
 699         * b3/air/AirEmitShuffle.cpp:
 700         (JSC::B3::Air::ShufflePair::bank):
 701         (JSC::B3::Air::ShufflePair::opcode):
 702         (JSC::B3::Air::ShufflePair::inst):
 703         (JSC::B3::Air::emitShuffle):
 704         * b3/air/AirEmitShuffle.h:
 705         (JSC::B3::Air::moveFor):
 706         * b3/air/AirGenerate.cpp:
 707         (JSC::B3::Air::prepareForGeneration):
 708         * b3/air/AirGenerate.h:
 709         * b3/air/AirLowerAfterRegAlloc.cpp:
 710         (JSC::B3::Air::lowerAfterRegAlloc):
 711         * b3/air/AirLowerMacros.cpp:
 712         (JSC::B3::Air::lowerMacros):
 713         * b3/testb3.cpp:
 714         (JSC::B3::compileProc):
 715         * wasm/WasmB3IRGenerator.cpp:
 716         (JSC::Wasm::parseAndCompile):
 717
 718 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 719
 720         Don't need to Air::reportUsedRegisters for wasm at -O1
 721         https://bugs.webkit.org/show_bug.cgi?id=170459
 722
 723         Reviewed by Saam Barati.
 724
 725         I did some refactorings to Liveness<> to try to understand its performance. Based on
 726         this I concluded that the bigger immediate issue is just removing unnecessary phases
 727         from -O1.
 728
 729         This removes Air::reportUsedRegisters() from -O1 if the user has indicated that he is
 730         not interested in StackmapGenerationParams::usedRegisters(). The logic here is a bit
 731         weird because of how Air does spill code generation. The register allocator's spiller
 732         will emit spill code using identifiable spill slots, which allows subsequent phases to
 733         register-allocate the spill slots. We do this by a forward flow CSE phase called
 734         fixObviousSpills (which is a terrible name since there is no longer anything obvious
 735         about some of the spills that this phase can fix!). As is most natural for CSEs over
 736         3AC, it rewires the uses of redundant computations rather than removing the redundant
 737         computations. This means that if a spill got "fixed", there may be either or both of
 738         the following:
 739
 740         - Dead loads from the stack.
 741         - Dead stores to the stack.
 742
 743         We know that a load from the stack is dead if the register is dead at the point of the
 744         load. We know that a store to the stack is dead if the spill slot is dead at the point
 745         of the store.
 746
 747         Unfortunately, liveness analysis - over either registers or spill slots - is expensive.
 748
 749         Fortunately, allocateStack() already does liveness analysis over spill slots. So, we
 750         baked elimination of stores to the stack into that phase. That aspect of clean-up after
 751         the spill CSE comes for free.
 752
 753         Also fortunately for the FTL, we have to do reportUsedRegisters() anyway. This is a
 754         phase that enables StackmapGenerationParams::usedRegisters() to work, which then
 755         enables the FTL's patchpoints to do crazy slow-path live range splitting. So, Air's
 756         strategy for the load fix-up after spill CSE is to do it as part of
 757         reportUsedRegisters().
 758
 759         This patch introduces the Procedure::setNeedsUsedRegisters() API. But if you set
 760         needsUsedRegisters to false then we will still run reportUsedRegisters() at -O2 as an
 761         optimization - it removes dead loads from the stack that are left behind from
 762         fixObviousSpills().
 763
 764         This is a ~6% compile time progression at -O1.
 765
 766         * b3/B3Procedure.h:
 767         (JSC::B3::Procedure::setNeedsUsedRegisters):
 768         (JSC::B3::Procedure::needsUsedRegisters):
 769         * b3/B3StackmapGenerationParams.h:
 770         * b3/B3VariableLiveness.cpp:
 771         (JSC::B3::VariableLiveness::VariableLiveness):
 772         * b3/air/AirCode.cpp:
 773         (JSC::B3::Air::Code::needsUsedRegisters):
 774         * b3/air/AirCode.h:
 775         * b3/air/AirGenerate.cpp:
 776         (JSC::B3::Air::prepareForGeneration):
 777         * b3/air/AirLiveness.h:
 778         (JSC::B3::Air::Liveness::Liveness):
 779         * wasm/WasmB3IRGenerator.cpp:
 780         (JSC::Wasm::parseAndCompile):
 781
 782 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 783
 784         Air liveness should build constraints and solve them rather than repeatedly parsing IR
 785         https://bugs.webkit.org/show_bug.cgi?id=170421
 786
 787         Reviewed by Saam Barati.
 788
 789         Inst::forEach<> is expensive. The LivenessAdapter uses forEach with a particularly
 790         gnarly lambda that has many extra checks. Therefore, a lot of the time spent in
 791         liveness analysis is just recomputing forEach<> and that lambda to get uses and defs.
 792
 793         This introduces LivenessConstraints<>, which is a liveness constraint system based on
 794         Adapter. It basically caches the results of doing forEach. It'll give you the uses and
 795         defs at each instruction boundary.
 796
 797         This is a ~5% compile time progression at optLevel=1. It's also a ~3% compile time
 798         progression at optLevel=2.
 799
 800         * JavaScriptCore.xcodeproj/project.pbxproj:
 801         * b3/air/AirLivenessAdapter.h:
 802         (JSC::B3::Air::LivenessAdapter::LivenessAdapter):
 803         (JSC::B3::Air::LivenessAdapter::forEachUse):
 804         (JSC::B3::Air::LivenessAdapter::forEachDef):
 805         * b3/air/AirLivenessConstraints.h: Added.
 806         (JSC::B3::Air::LivenessConstraints::Actions::Actions):
 807         (JSC::B3::Air::LivenessConstraints::LivenessConstraints):
 808         (JSC::B3::Air::LivenessConstraints::at):
 809
 810 2017-04-03  Mark Lam  <mark.lam@apple.com>
 811
 812         Fix incorrect capacity delta calculation reported in SparseArrayValueMap::add().
 813         https://bugs.webkit.org/show_bug.cgi?id=170412
 814         <rdar://problem/29697336>
 815
 816         Reviewed by Filip Pizlo.
 817
 818         Here's an example of code that will trigger underflow in the "deprecatedExtraMemory"
 819         reported by SparseArrayValueMap::add() that is added to Heap::m_deprecatedExtraMemorySize:
 820
 821             arr = new Array;
 822             Object.defineProperty(arr, 18, ({writable: true, configurable: true}));
 823             for (var i = 0; i < 3; ++i) {
 824                 Array.prototype.push.apply(arr, ["", () => {}, {}]);
 825                 Array.prototype.sort.apply(arr, [() => {}, []]);
 826             }
 827
 828         However, Heap::m_deprecatedExtraMemorySize is only 1 of 3 values that are added
 829         up to form the result of Heap::extraMemorySize().  Heap::m_extraMemorySize and
 830         Heap::m_arrayBuffers.size() are the other 2.
 831
 832         While Heap::m_arrayBuffers.size() is bounded by actual allocated memory, both
 833         Heap::m_deprecatedExtraMemorySize and Heap::m_extraMemorySize are added to
 834         without any bounds checks, and they are only reset to 0 at the start of a full
 835         GC.  As a result, if we have a long sequence of eden GCs with a lot of additions
 836         to Heap::m_extraMemorySize and/or Heap::m_deprecatedExtraMemorySize, then these
 837         values could theoretically overflow.  Coupling this with the underflow from
 838         SparseArrayValueMap::add(), the result for Heap::extraMemorySize() can easily
 839         overflow.  Note: Heap::extraMemorySize() is used to compute the value
 840         currentHeapSize.
 841
 842         If multiple conditions line up just right, the above overflows can result in this
 843         debug assertion failure during an eden GC:
 844
 845             ASSERT(currentHeapSize >= m_sizeAfterLastCollect);
 846
 847         Otherwise, the effects of the overflows will only result in the computed
 848         currentHeapSize not being representative of actual memory usage, and therefore,
 849         a full GC may be triggered earlier or later than is ideal.
 850
 851         This patch ensures that SparseArrayValueMap::add() cannot underflow
 852         Heap::m_deprecatedExtraMemorySize.  It also adds overflows checks in the
 853         calculations of Heap::m_deprecatedExtraMemorySize, Heap::m_extraMemorySize, and
 854         Heap::extraMemorySize() so that their values are saturated appropriately to
 855         ensure that GC collections are triggered based on representative memory usage.
 856
 857         * heap/Heap.cpp:
 858         (JSC::Heap::deprecatedReportExtraMemorySlowCase):
 859         (JSC::Heap::extraMemorySize):
 860         (JSC::Heap::updateAllocationLimits):
 861         (JSC::Heap::reportExtraMemoryVisited):
 862         * runtime/SparseArrayValueMap.cpp:
 863         (JSC::SparseArrayValueMap::add):
 864
 865 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 866
 867         Move the Liveness<> adapters from AirLiveness.h to AirLivenessAdapter.h.
 868
 869         Rubber stamped by Keith Miller.
 870
 871         This will make it easier to write other code that uses those adapters.
 872
 873         * JavaScriptCore.xcodeproj/project.pbxproj:
 874         * b3/air/AirLiveness.h:
 875         (JSC::B3::Air::LivenessAdapter::LivenessAdapter): Deleted.
 876         (JSC::B3::Air::LivenessAdapter::blockSize): Deleted.
 877         (JSC::B3::Air::LivenessAdapter::forEachUse): Deleted.
 878         (JSC::B3::Air::LivenessAdapter::forEachDef): Deleted.
 879         (JSC::B3::Air::TmpLivenessAdapter::TmpLivenessAdapter): Deleted.
 880         (JSC::B3::Air::TmpLivenessAdapter::numIndices): Deleted.
 881         (JSC::B3::Air::TmpLivenessAdapter::acceptsBank): Deleted.
 882         (JSC::B3::Air::TmpLivenessAdapter::acceptsRole): Deleted.
 883         (JSC::B3::Air::TmpLivenessAdapter::valueToIndex): Deleted.
 884         (JSC::B3::Air::TmpLivenessAdapter::indexToValue): Deleted.
 885         (JSC::B3::Air::StackSlotLivenessAdapter::StackSlotLivenessAdapter): Deleted.
 886         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices): Deleted.
 887         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsBank): Deleted.
 888         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsRole): Deleted.
 889         (JSC::B3::Air::StackSlotLivenessAdapter::valueToIndex): Deleted.
 890         (JSC::B3::Air::StackSlotLivenessAdapter::indexToValue): Deleted.
 891         * b3/air/AirLivenessAdapter.h: Added.
 892         (JSC::B3::Air::LivenessAdapter::LivenessAdapter):
 893         (JSC::B3::Air::LivenessAdapter::blockSize):
 894         (JSC::B3::Air::LivenessAdapter::forEachUse):
 895         (JSC::B3::Air::LivenessAdapter::forEachDef):
 896         (JSC::B3::Air::TmpLivenessAdapter::TmpLivenessAdapter):
 897         (JSC::B3::Air::TmpLivenessAdapter::numIndices):
 898         (JSC::B3::Air::TmpLivenessAdapter::acceptsBank):
 899         (JSC::B3::Air::TmpLivenessAdapter::acceptsRole):
 900         (JSC::B3::Air::TmpLivenessAdapter::valueToIndex):
 901         (JSC::B3::Air::TmpLivenessAdapter::indexToValue):
 902         (JSC::B3::Air::StackSlotLivenessAdapter::StackSlotLivenessAdapter):
 903         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
 904         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsBank):
 905         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsRole):
 906         (JSC::B3::Air::StackSlotLivenessAdapter::valueToIndex):
 907         (JSC::B3::Air::StackSlotLivenessAdapter::indexToValue):
 908
 909 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 910
 911         WTF::Liveness should have an API that focuses on actions at instruction boundaries
 912         https://bugs.webkit.org/show_bug.cgi?id=170407
 913
 914         Reviewed by Keith Miller.
 915
 916         Adopt changes to the WTF::Liveness<> API. Instead of having separate functions for the
 917         early/late versions of uses and defs, we now have just a use/def API. Those
 918         automatically take care of eary/late issues as needed.
 919
 920         This reduces the API surface between WTF::Liveness<> and its clients, which makes it
 921         easier to implement some other optimizations I'm thinking about.
 922
 923         * b3/B3VariableLiveness.h:
 924         (JSC::B3::VariableLivenessAdapter::forEachUse):
 925         (JSC::B3::VariableLivenessAdapter::forEachDef):
 926         (JSC::B3::VariableLivenessAdapter::forEachEarlyUse): Deleted.
 927         (JSC::B3::VariableLivenessAdapter::forEachLateUse): Deleted.
 928         (JSC::B3::VariableLivenessAdapter::forEachEarlyDef): Deleted.
 929         (JSC::B3::VariableLivenessAdapter::forEachLateDef): Deleted.
 930         * b3/air/AirLiveness.h:
 931         (JSC::B3::Air::LivenessAdapter::blockSize):
 932         (JSC::B3::Air::LivenessAdapter::forEachUse):
 933         (JSC::B3::Air::LivenessAdapter::forEachDef):
 934         (JSC::B3::Air::LivenessAdapter::forEachEarlyUse): Deleted.
 935         (JSC::B3::Air::LivenessAdapter::forEachLateUse): Deleted.
 936         (JSC::B3::Air::LivenessAdapter::forEachEarlyDef): Deleted.
 937         (JSC::B3::Air::LivenessAdapter::forEachLateDef): Deleted.
 938
 939 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 940
 941         Inst::forEachArg could compile to more compact code
 942         https://bugs.webkit.org/show_bug.cgi?id=170406
 943
 944         Reviewed by Sam Weinig.
 945
 946         Prior to this change, Inst::forEachArg compiled to a ginormous ALWAYS_INLINE switch statement.
 947         It had one case for each opcode, and then each of those cases would have a switch statement over
 948         the number of operands. Then the cases of that switch statement would have a sequence of calls to
 949         the passed lambda. This meant that every user of forEachArg would generate an insane amount of
 950         code. It also meant that the inlining achieved nothing, since the lambda would surely then not
 951         be inlined - and if it was, then the icache pressure due to code bloat would surely negate any
 952         benefits.
 953
 954         This replaces that code with a loop over a compact look-up table. We use the opcode and number of
 955         operands as keys into that look-up table. The table only takes about 20KB. It has one byte for
 956         each argument in each overload of each opcode.
 957
 958         I can't measure any reproducible change in performance, but the JavaScriptCore framework binary
 959         shrinks by 2.7 MB. This is a 15% reduction in JavaScriptCore binary size.
 960
 961         * JavaScriptCore.xcodeproj/project.pbxproj:
 962         * b3/B3Width.h:
 963         * b3/air/AirCustom.h:
 964         (JSC::B3::Air::PatchCustom::forEachArg):
 965         * b3/air/AirFormTable.h: Added.
 966         (JSC::B3::Air::decodeFormRole):
 967         (JSC::B3::Air::decodeFormBank):
 968         (JSC::B3::Air::decodeFormWidth):
 969         * b3/air/AirInst.h:
 970         * b3/air/opcode_generator.rb:
 971
 972 2017-04-03  Keith Miller  <keith_miller@apple.com>
 973
 974         WebAssembly: remove lastAllocatedMode from Memory
 975         https://bugs.webkit.org/show_bug.cgi?id=170405
 976
 977         Reviewed by Mark Lam.
 978
 979         It's not used anymore so there isn't any point in keeping it around.
 980
 981         * wasm/WasmMemory.cpp:
 982         (JSC::Wasm::Memory::createImpl):
 983         (JSC::Wasm::Memory::lastAllocatedMode): Deleted.
 984         * wasm/WasmMemory.h:
 985
 986 2017-04-03  Zan Dobersek  <zdobersek@igalia.com>
 987
 988         [jsc] Add patchableJumpSize() for MIPS
 989         https://bugs.webkit.org/show_bug.cgi?id=169716
 990
 991         Reviewed by Yusuke Suzuki.
 992
 993         * assembler/MIPSAssembler.h:
 994         (JSC::MIPSAssembler::patchableJumpSize): Added.
 995         * assembler/MacroAssemblerMIPS.h:
 996         (JSC::MacroAssemblerMIPS::patchableJumpSize): Added.
 997
 998 2017-04-03  Guillaume Emont  <guijemont@igalia.com>
 999
1000         [jsc] implement MIPSAssembler::relinkJumpToNop()
1001         https://bugs.webkit.org/show_bug.cgi?id=169720
1002
1003         Reviewed by Yusuke Suzuki.
1004
1005         * assembler/MIPSAssembler.h:
1006         (JSC::MIPSAssembler::relinkJumpToNop): Added.
1007
1008 2017-04-02  Carlos Garcia Campos  <cgarcia@igalia.com>
1009
1010         Share implementation of JSRunLoopTimer::timerDidFire
1011         https://bugs.webkit.org/show_bug.cgi?id=170392
1012
1013         Reviewed by Michael Catanzaro.
1014
1015         The code is cross-platform but it's duplicated in CF and GLib implementations, it could be shared instead.
1016
1017         * runtime/JSRunLoopTimer.cpp:
1018         (JSC::JSRunLoopTimer::timerDidFire): Move common implementation here.
1019         (JSC::JSRunLoopTimer::setRunLoop): Use timerDidFireCallback.
1020         (JSC::JSRunLoopTimer::timerDidFireCallback): Call JSRunLoopTimer::timerDidFire().
1021         * runtime/JSRunLoopTimer.h:
1022
1023 2017-04-01  Oleksandr Skachkov  <gskachkov@gmail.com>
1024
1025         Object with numerical keys with gaps gets filled by NaN values
1026         https://bugs.webkit.org/show_bug.cgi?id=164412
1027
1028         Reviewed by Mark Lam.
1029
1030         This patch fixes issue when object have two properties
1031         with name as number. The issue appears when during invoking
1032         convertDoubleToArrayStorage, array is filled by pNaN and
1033         method converting it to real NaN. This happeneds because a
1034         pNaN in a Double array is a hole, and Double arrays cannot
1035         have NaN values. To fix issue we need to check value and
1036         clear it if it pNaN.
1037
1038         * runtime/JSObject.cpp:
1039         (JSC::JSObject::convertDoubleToArrayStorage):
1040
1041 2017-03-31  Saam Barati  <sbarati@apple.com>
1042
1043         WebAssembly: Make our calls out to JS PIC friendly
1044         https://bugs.webkit.org/show_bug.cgi?id=170261
1045
1046         Reviewed by Keith Miller.
1047
1048         This patch removes a direct call from the module to the Wasm to JS stub.
1049         Instead, we do an indirect call to the stub by loading the stub's executable
1050         address off of the CodeBlock. This is to make the code we emit for comply with
1051         requirements needed for PIC.
1052
1053         Adding this indirection is not ideal. Although this patch is neutral on
1054         WasmBench, we really want to get back to a world where we have an IC
1055         call infrastructure. This patch is obviously a regression on some
1056         types of programs. I've filed this bug to make sure we implement a
1057         PIC compliant Wasm to JS call IC:
1058         https://bugs.webkit.org/show_bug.cgi?id=170375
1059
1060         * wasm/WasmB3IRGenerator.cpp:
1061         * wasm/WasmFormat.h:
1062         * wasm/WasmPlan.cpp:
1063         (JSC::Wasm::Plan::complete):
1064         * wasm/js/JSWebAssemblyCodeBlock.cpp:
1065         (JSC::JSWebAssemblyCodeBlock::initialize):
1066         * wasm/js/JSWebAssemblyCodeBlock.h:
1067         (JSC::JSWebAssemblyCodeBlock::create):
1068         (JSC::JSWebAssemblyCodeBlock::offsetOfImportWasmToJSStub):
1069         (JSC::JSWebAssemblyCodeBlock::offsetOfCallees):
1070         (JSC::JSWebAssemblyCodeBlock::allocationSize):
1071         (JSC::JSWebAssemblyCodeBlock::importWasmToJSStub):
1072         * wasm/js/JSWebAssemblyInstance.cpp:
1073         (JSC::JSWebAssemblyInstance::addUnitializedCodeBlock):
1074         * wasm/js/JSWebAssemblyInstance.h:
1075         (JSC::JSWebAssemblyInstance::offsetOfCodeBlock):
1076
1077 2017-03-31  Keith Miller  <keith_miller@apple.com>
1078
1079         WebAssembly: webAssemblyB3OptimizationLevel should use defaultB3OptLevel by default
1080         https://bugs.webkit.org/show_bug.cgi?id=170378
1081
1082         Reviewed by Saam Barati.
1083
1084         * runtime/Options.h:
1085         * wasm/WasmB3IRGenerator.h:
1086
1087 2017-03-31  Keith Miller  <keith_miller@apple.com>
1088
1089         WebAssembly: Add compilation level option
1090         https://bugs.webkit.org/show_bug.cgi?id=170374
1091
1092         Reviewed by Mark Lam.
1093
1094         This patch adds an option, webAssemblyB3OptimizationLevel, which
1095         changes the optimization mode wasm passes to B3.
1096
1097         * runtime/Options.h:
1098         * wasm/WasmPlan.cpp:
1099         (JSC::Wasm::Plan::compileFunctions):
1100
1101 2017-03-31  Saam Barati  <sbarati@apple.com>
1102
1103         WebAssembly: Strip WasmParser and WasmFunctionParser from knowing about VM
1104         https://bugs.webkit.org/show_bug.cgi?id=170312
1105
1106         Reviewed by Mark Lam.
1107
1108         This is another step towards PIC-ifying Wasm. This patch removes
1109         the VM field that is no longer used.
1110
1111         * wasm/WasmB3IRGenerator.cpp:
1112         (JSC::Wasm::parseAndCompile):
1113         * wasm/WasmB3IRGenerator.h:
1114         * wasm/WasmFunctionParser.h:
1115         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
1116         * wasm/WasmModuleParser.h:
1117         (JSC::Wasm::ModuleParser::ModuleParser):
1118         * wasm/WasmParser.h:
1119         (JSC::Wasm::Parser<SuccessType>::Parser):
1120         * wasm/WasmPlan.cpp:
1121         (JSC::Wasm::Plan::parseAndValidateModule):
1122         (JSC::Wasm::Plan::compileFunctions):
1123         * wasm/WasmValidate.cpp:
1124         (JSC::Wasm::validateFunction):
1125         * wasm/WasmValidate.h:
1126
1127 2017-03-31  Saam Barati  <sbarati@apple.com>
1128
1129         WebAssembly: Ref count Signature and SignatureInformation should not care about VM
1130         https://bugs.webkit.org/show_bug.cgi?id=170316
1131
1132         Reviewed by Keith Miller.
1133
1134         This is yet again another step towards PIC-ifying Wasm.
1135         Signature should be ref counted so we can tell when
1136         no code is holding onto a Signature. This makes it easy
1137         to free unused Signatures. Also, this patch rids SignatureInfo
1138         of any VM knowledge. Now, there is just a single SignatureInfo that
1139         lives in a process.
1140
1141         * runtime/VM.h:
1142         * wasm/WasmB3IRGenerator.cpp:
1143         (JSC::Wasm::createJSToWasmWrapper):
1144         (JSC::Wasm::parseAndCompile):
1145         * wasm/WasmB3IRGenerator.h:
1146         * wasm/WasmBinding.cpp:
1147         (JSC::Wasm::wasmToJs):
1148         * wasm/WasmCallingConvention.h:
1149         (JSC::Wasm::CallingConvention::loadArguments):
1150         * wasm/WasmFormat.h:
1151         * wasm/WasmFunctionParser.h:
1152         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
1153         * wasm/WasmModuleParser.cpp:
1154         * wasm/WasmPlan.cpp:
1155         (JSC::Wasm::Plan::parseAndValidateModule):
1156         (JSC::Wasm::Plan::compileFunctions):
1157         (JSC::Wasm::Plan::complete):
1158         * wasm/WasmSignature.cpp:
1159         (JSC::Wasm::Signature::hash):
1160         (JSC::Wasm::Signature::tryCreate):
1161         (JSC::Wasm::SignatureInformation::SignatureInformation):
1162         (JSC::Wasm::SignatureInformation::singleton):
1163         (JSC::Wasm::SignatureInformation::adopt):
1164         (JSC::Wasm::SignatureInformation::get):
1165         (JSC::Wasm::SignatureInformation::tryCleanup):
1166         (JSC::Wasm::Signature::create): Deleted.
1167         (JSC::Wasm::Signature::createInvalid): Deleted.
1168         (JSC::Wasm::Signature::destroy): Deleted.
1169         (JSC::Wasm::SignatureInformation::~SignatureInformation): Deleted.
1170         * wasm/WasmSignature.h:
1171         (JSC::Wasm::Signature::allocatedSize):
1172         (JSC::Wasm::Signature::operator==):
1173         * wasm/WasmValidate.cpp:
1174         (JSC::Wasm::validateFunction):
1175         * wasm/WasmValidate.h:
1176         * wasm/js/JSWebAssemblyModule.cpp:
1177         (JSC::JSWebAssemblyModule::destroy):
1178         * wasm/js/WebAssemblyFunction.cpp:
1179         (JSC::callWebAssemblyFunction):
1180         * wasm/js/WebAssemblyFunction.h:
1181         * wasm/js/WebAssemblyModuleRecord.cpp:
1182         (JSC::WebAssemblyModuleRecord::link):
1183         (JSC::WebAssemblyModuleRecord::evaluate):
1184         * wasm/js/WebAssemblyWrapperFunction.cpp:
1185         (JSC::WebAssemblyWrapperFunction::create):
1186         * wasm/js/WebAssemblyWrapperFunction.h:
1187
1188 2017-03-31  Mark Lam  <mark.lam@apple.com>
1189
1190         Array.prototype.splice() should not be using JSArray::tryCreateForInitializationPrivate().
1191         https://bugs.webkit.org/show_bug.cgi?id=170303
1192         <rdar://problem/31358281>
1193
1194         Reviewed by Filip Pizlo.
1195
1196         This is because it needs to call getProperty() later to get the values for
1197         initializing the array.  getProperty() can execute arbitrary code and potentially
1198         trigger the GC.  This is not allowed for clients of JSArray::tryCreateForInitializationPrivate().
1199
1200         * runtime/ArrayPrototype.cpp:
1201         (JSC::arrayProtoFuncSplice):
1202         (JSC::copySplicedArrayElements): Deleted.
1203
1204 2017-03-31  Oleksandr Skachkov  <gskachkov@gmail.com>
1205
1206         String.prototype.replace incorrectly applies "special replacement parameters" when passed a function
1207         https://bugs.webkit.org/show_bug.cgi?id=170151
1208
1209         Reviewed by Saam Barati.
1210
1211         This patch fixes issue for String.prototype.replace when passed a function
1212         with special symbols "$$". It happeneds because substituteBackreferences applies
1213         unconditionally, but according to the spec it should be applied only for text
1214         21.1.3.16.8 https://tc39.github.io/ecma262/#sec-string.prototype.replace
1215
1216         * runtime/StringPrototype.cpp:
1217         (JSC::replaceUsingStringSearch):
1218
1219 2017-03-30  Saam Barati  <sbarati@apple.com>
1220
1221         WebAssembly: When Wasm calls to C, it should use Wasm::Context* instead of ExecState* to get VM
1222         https://bugs.webkit.org/show_bug.cgi?id=170185
1223
1224         Reviewed by Michael Saboff.
1225
1226         This is one more step in the direction of PIC-ified Wasm.
1227         When we lift WasmCallee above VM, we will no longer be
1228         able to get VM from ExecState*. This patch ensures that
1229         we don't do that from within the Wasm runtime. Instead,
1230         we use the Wasm::Context* to get the VM.
1231
1232         This patch also adds a new class, Wasm::Thunks. There
1233         is a single Wasm::Thunks that lives in the process. It
1234         is responsible for generating a thunk that Wasm relies on.
1235         The only such thunk right now is the exception throwing
1236         thunk.
1237
1238         This patch also rids WasmFaultSignalHandler from any knowledge
1239         of VM. Previously, it relied on VM to get the exception handling
1240         thunk.
1241
1242         The only part of the Wasm runtime that will be allowed
1243         to get VM& from ExecState will be WasmBinding. In the
1244         future, we plan to keep the calls out to JS to keep
1245         a JSCell as the callee.
1246
1247         * JavaScriptCore.xcodeproj/project.pbxproj:
1248         * dfg/DFGOSREntry.cpp:
1249         (JSC::DFG::prepareOSREntry):
1250         * ftl/FTLOSRExitCompiler.cpp:
1251         (JSC::FTL::compileStub):
1252         * interpreter/Interpreter.cpp:
1253         (JSC::UnwindFunctor::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
1254         * jit/AssemblyHelpers.cpp:
1255         (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
1256         (JSC::AssemblyHelpers::copyCalleeSavesToVMEntryFrameCalleeSavesBufferImpl):
1257         * jit/AssemblyHelpers.h:
1258         (JSC::AssemblyHelpers::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
1259         * jit/ThunkGenerators.cpp:
1260         (JSC::throwExceptionFromWasmThunkGenerator): Deleted.
1261         * jit/ThunkGenerators.h:
1262         * runtime/InitializeThreading.cpp:
1263         (JSC::initializeThreading):
1264         * runtime/VM.cpp:
1265         (JSC::VM::VM):
1266         (JSC::VM::getAllCalleeSaveRegisterOffsets):
1267         * runtime/VM.h:
1268         (JSC::VM::topVMEntryFrameOffset):
1269         (JSC::VM::getAllCalleeSaveRegisterOffsets): Deleted.
1270         * wasm/WasmB3IRGenerator.cpp:
1271         (JSC::Wasm::B3IRGenerator::emitExceptionCheck):
1272         * wasm/WasmFaultSignalHandler.cpp:
1273         (JSC::Wasm::trapHandler):
1274         * wasm/WasmMemory.cpp:
1275         (JSC::Wasm::tryGetFastMemory):
1276         * wasm/WasmThunks.cpp: Added.
1277         (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
1278         (JSC::Wasm::Thunks::initialize):
1279         (JSC::Wasm::Thunks::singleton):
1280         (JSC::Wasm::Thunks::stub):
1281         (JSC::Wasm::Thunks::existingStub):
1282         * wasm/WasmThunks.h: Added.
1283         * wasm/js/JSWebAssemblyInstance.cpp:
1284         (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
1285         * wasm/js/JSWebAssemblyInstance.h:
1286         (JSC::JSWebAssemblyInstance::offsetOfVM):
1287         * wasm/js/JSWebAssemblyMemory.cpp:
1288         (JSC::JSWebAssemblyMemory::grow):
1289         * wasm/js/JSWebAssemblyMemory.h:
1290         * wasm/js/WebAssemblyMemoryPrototype.cpp:
1291         (JSC::webAssemblyMemoryProtoFuncGrow):
1292
1293 2017-03-30  Mark Lam  <mark.lam@apple.com>
1294
1295         IntlObject should not be using JSArray::initializeIndex().
1296         https://bugs.webkit.org/show_bug.cgi?id=170302
1297         <rdar://problem/31356918>
1298
1299         Reviewed by Saam Barati.
1300
1301         JSArray::initializeIndex() is only meant to be used with arrays created using
1302         JSArray::tryCreateForInitializationPrivate() under very constrained conditions.
1303
1304         * runtime/IntlObject.cpp:
1305         (JSC::canonicalizeLocaleList):
1306         (JSC::intlObjectFuncGetCanonicalLocales):
1307
1308 2017-03-30  Filip Pizlo  <fpizlo@apple.com>
1309
1310         Air should support linear scan for optLevel<2
1311         https://bugs.webkit.org/show_bug.cgi?id=170161
1312
1313         Reviewed by Saam Barati.
1314
1315         This changes the default opt level of B3 to 2. It makes the other opt levels useful by adding a
1316         new register allocator. This new linear scan allocator will produce significantly worse code.
1317         But it will produce that code a lot faster than IRC or Briggs.
1318
1319         The opt levels are:
1320             0: no optimizations, linear scan
1321             1: some optimizations, linear scan
1322             2: full optimizations, graph coloring (IRC or Briggs based on CPU)
1323
1324         What we used to call optLevel=1 is not called optLevel=2, or better yet,
1325         optLevel=B3::defaultOptLevel(). We no longer have anything like the old optLevel=0 (which did no
1326         optimizations but ran graph coloring).
1327
1328         allocateRegistersByLinearScan() faithfully implements Massimiliano Poletto and Vivek Sarkar's
1329         famous algorithm. It uses the variant that handles clobbered registers by avoiding assigning
1330         ranges to those registers if the range overlaps a clobber. It's engineered to allocate registers
1331         very quickly and generate inefficient code without falling off a cliff.
1332
1333         The new optLevel=1 speeds up B3 by a factor of 2, and results in a 80% throughput regression.
1334         Linear scan runs 4.7x faster than graph coloring on average.
1335
1336         * CMakeLists.txt:
1337         * JavaScriptCore.xcodeproj/project.pbxproj:
1338         * b3/B3BasicBlockUtils.h:
1339         (JSC::B3::blocksInPreOrder):
1340         (JSC::B3::blocksInPostOrder):
1341         * b3/B3BlockWorklist.h:
1342         * b3/B3CFG.h:
1343         (JSC::B3::CFG::newMap):
1344         * b3/B3Common.h:
1345         (JSC::B3::defaultOptLevel):
1346         * b3/B3Compile.h:
1347         * b3/B3DuplicateTails.cpp:
1348         * b3/B3EliminateCommonSubexpressions.cpp:
1349         * b3/B3FixSSA.cpp:
1350         (JSC::B3::demoteValues):
1351         (JSC::B3::fixSSA):
1352         * b3/B3FixSSA.h:
1353         * b3/B3Generate.cpp:
1354         (JSC::B3::prepareForGeneration):
1355         (JSC::B3::generateToAir):
1356         * b3/B3Generate.h:
1357         * b3/B3HeapRange.cpp: Removed.
1358         * b3/B3HeapRange.h:
1359         (JSC::B3::HeapRange::HeapRange): Deleted.
1360         (JSC::B3::HeapRange::top): Deleted.
1361         (JSC::B3::HeapRange::operator==): Deleted.
1362         (JSC::B3::HeapRange::operator!=): Deleted.
1363         (JSC::B3::HeapRange::operator|): Deleted.
1364         (JSC::B3::HeapRange::operator bool): Deleted.
1365         (JSC::B3::HeapRange::begin): Deleted.
1366         (JSC::B3::HeapRange::end): Deleted.
1367         (JSC::B3::HeapRange::overlaps): Deleted.
1368         * b3/B3LowerToAir.cpp:
1369         * b3/B3MoveConstants.cpp:
1370         * b3/B3PhiChildren.h:
1371         * b3/B3Procedure.cpp:
1372         (JSC::B3::Procedure::dump):
1373         (JSC::B3::Procedure::deleteOrphans):
1374         (JSC::B3::Procedure::setBlockOrderImpl):
1375         * b3/B3ReduceDoubleToFloat.cpp:
1376         * b3/B3ReduceStrength.cpp:
1377         * b3/B3SSACalculator.h:
1378         * b3/B3UseCounts.h:
1379         * b3/air/AirAllocateRegistersByGraphColoring.cpp:
1380         * b3/air/AirAllocateRegistersByLinearScan.cpp: Added.
1381         (JSC::B3::Air::allocateRegistersByLinearScan):
1382         * b3/air/AirAllocateRegistersByLinearScan.h: Added.
1383         * b3/air/AirAllocateStack.cpp:
1384         (JSC::B3::Air::allocateStack):
1385         * b3/air/AirArg.cpp:
1386         (WTF::printInternal):
1387         * b3/air/AirArg.h:
1388         (JSC::B3::Air::Arg::activeAt):
1389         (JSC::B3::Air::Arg::timing):
1390         (JSC::B3::Air::Arg::forEachPhase):
1391         * b3/air/AirBasicBlock.h:
1392         * b3/air/AirBlockWorklist.h:
1393         * b3/air/AirCFG.h:
1394         (JSC::B3::Air::CFG::newMap):
1395         * b3/air/AirEliminateDeadCode.cpp:
1396         (JSC::B3::Air::eliminateDeadCode):
1397         * b3/air/AirFixObviousSpills.cpp:
1398         * b3/air/AirFixPartialRegisterStalls.cpp:
1399         (JSC::B3::Air::fixPartialRegisterStalls):
1400         * b3/air/AirFixSpillsAfterTerminals.cpp: Added.
1401         (JSC::B3::Air::fixSpillsAfterTerminals):
1402         * b3/air/AirFixSpillsAfterTerminals.h: Added.
1403         * b3/air/AirGenerate.cpp:
1404         (JSC::B3::Air::prepareForGeneration):
1405         (JSC::B3::Air::generate):
1406         * b3/air/AirGenerate.h:
1407         * b3/air/AirGenerationContext.h:
1408         * b3/air/AirInsertionSet.h:
1409         * b3/air/AirInst.cpp:
1410         (JSC::B3::Air::Inst::needsPadding):
1411         * b3/air/AirLowerAfterRegAlloc.cpp:
1412         (JSC::B3::Air::lowerAfterRegAlloc):
1413         * b3/air/AirLowerEntrySwitch.cpp:
1414         (JSC::B3::Air::lowerEntrySwitch):
1415         * b3/air/AirOpcode.opcodes:
1416         * b3/air/AirPhaseInsertionSet.cpp: Added.
1417         (JSC::B3::Air::PhaseInsertionSet::execute):
1418         * b3/air/AirPhaseInsertionSet.h: Added.
1419         (JSC::B3::Air::PhaseInsertion::PhaseInsertion):
1420         (JSC::B3::Air::PhaseInsertion::phase):
1421         (JSC::B3::Air::PhaseInsertion::operator<):
1422         (JSC::B3::Air::PhaseInsertionSet::PhaseInsertionSet):
1423         (JSC::B3::Air::PhaseInsertionSet::appendInsertion):
1424         (JSC::B3::Air::PhaseInsertionSet::insertInst):
1425         (JSC::B3::Air::PhaseInsertionSet::insert):
1426         * b3/air/AirRegLiveness.h:
1427         (JSC::B3::Air::RegLiveness::LocalCalc::LocalCalc):
1428         * b3/air/AirSpillEverything.cpp:
1429         (JSC::B3::Air::spillEverything):
1430         * b3/air/AirTmp.cpp:
1431         * b3/air/AirTmp.h:
1432         (JSC::B3::Air::Tmp::tmpForIndex):
1433         * b3/air/AirTmpInlines.h:
1434         (JSC::B3::Air::Tmp::Indexed::Indexed):
1435         (JSC::B3::Air::Tmp::Indexed::index):
1436         (JSC::B3::Air::Tmp::AbsolutelyIndexed::AbsolutelyIndexed):
1437         (JSC::B3::Air::Tmp::AbsolutelyIndexed::index):
1438         (JSC::B3::Air::Tmp::indexed):
1439         (JSC::B3::Air::Tmp::absolutelyIndexed):
1440         (JSC::B3::Air::Tmp::tmpForAbsoluteIndex):
1441         * b3/testb3.cpp:
1442         (JSC::B3::compile):
1443         (JSC::B3::testMulLoadTwice):
1444         * jit/RegisterSet.h:
1445         (JSC::RegisterSet::add):
1446         (JSC::RegisterSet::remove):
1447         * runtime/Options.h:
1448         * wasm/WasmB3IRGenerator.h:
1449
1450 2017-03-30  Youenn Fablet  <youenn@apple.com>
1451
1452         Clean up RTCDataChannel
1453         https://bugs.webkit.org/show_bug.cgi?id=169732
1454
1455         Reviewed by Chris Dumez.
1456
1457         * runtime/CommonIdentifiers.h: Adding RTCDataChannelEvent.
1458
1459 2017-03-30  Saam Barati  <sbarati@apple.com>
1460
1461         WebAssembly: pass Wasm::Context* to vmEntryToWasm when not using fast TLS
1462         https://bugs.webkit.org/show_bug.cgi?id=170182
1463
1464         Reviewed by Mark Lam.
1465
1466         This is one more step in the direction of PIC-ified Wasm.
1467         I'm removing assumptions that a wasm callee is a cell. We used to use
1468         the callee to get the WasmContext off the callee's VM. Instead,
1469         this patch makes it so that we pass in the context as a parameter
1470         to the JS entrypoint.
1471
1472         * heap/MarkedBlock.h:
1473         (JSC::MarkedBlock::offsetOfVM): Deleted.
1474         * jit/AssemblyHelpers.cpp:
1475         (JSC::AssemblyHelpers::loadWasmContext):
1476         (JSC::AssemblyHelpers::storeWasmContext):
1477         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister):
1478         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister):
1479         * jsc.cpp:
1480         (functionTestWasmModuleFunctions):
1481         * runtime/VM.h:
1482         (JSC::VM::wasmContextOffset): Deleted.
1483         * wasm/WasmB3IRGenerator.cpp:
1484         (JSC::Wasm::B3IRGenerator::materializeWasmContext):
1485         (JSC::Wasm::B3IRGenerator::restoreWasmContext):
1486         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1487         (JSC::Wasm::createJSToWasmWrapper):
1488         * wasm/WasmContext.cpp:
1489         (JSC::Wasm::loadContext):
1490         (JSC::Wasm::storeContext):
1491         (JSC::loadWasmContext): Deleted.
1492         (JSC::storeWasmContext): Deleted.
1493         * wasm/WasmContext.h:
1494         (JSC::Wasm::useFastTLS):
1495         (JSC::Wasm::useFastTLSForContext):
1496         * wasm/WasmMemoryInformation.cpp:
1497         (JSC::Wasm::PinnedRegisterInfo::get):
1498         * wasm/WasmMemoryInformation.h:
1499         (JSC::Wasm::useFastTLS): Deleted.
1500         (JSC::Wasm::useFastTLSForWasmContext): Deleted.
1501         * wasm/js/WebAssemblyFunction.cpp:
1502         (JSC::callWebAssemblyFunction):
1503
1504 2017-03-30  JF Bastien  <jfbastien@apple.com>
1505
1506         WebAssembly: fix misc JS API implementation inconsistencies
1507         https://bugs.webkit.org/show_bug.cgi?id=170187
1508
1509         Reviewed by Keith Miller.
1510
1511         Auto-generate lookup tables.
1512         Methods should be on prototype.
1513         Exception returns should be idiomatic.
1514
1515         * wasm/JSWebAssembly.cpp: validate / compile / instantiate should
1516         be on the prototype
1517         (JSC::JSWebAssembly::create):
1518         (JSC::JSWebAssembly::finishCreation):
1519         (JSC::reject): Deleted.
1520         (JSC::webAssemblyCompileFunc): Deleted.
1521         (JSC::resolve): Deleted.
1522         (JSC::instantiate): Deleted.
1523         (JSC::compileAndInstantiate): Deleted.
1524         (JSC::webAssemblyInstantiateFunc): Deleted.
1525         (JSC::webAssemblyValidateFunc): Deleted.
1526         * wasm/JSWebAssembly.h:
1527         * wasm/js/WebAssemblyMemoryPrototype.cpp: move from JSWebAssembly.cpp
1528         (JSC::webAssemblyMemoryProtoFuncBuffer):
1529         (JSC::WebAssemblyMemoryPrototype::create):
1530         (JSC::WebAssemblyMemoryPrototype::finishCreation):
1531         * wasm/js/WebAssemblyMemoryPrototype.h:
1532         * wasm/js/WebAssemblyPrototype.cpp:
1533         (JSC::reject):
1534         (JSC::webAssemblyCompileFunc):
1535         (JSC::resolve):
1536         (JSC::instantiate):
1537         (JSC::compileAndInstantiate):
1538         (JSC::webAssemblyInstantiateFunc):
1539         (JSC::webAssemblyValidateFunc):
1540         (JSC::webAssemblyFunctionValidate): Deleted.
1541         (JSC::webAssemblyFunctionCompile): Deleted.
1542         * wasm/js/WebAssemblyTablePrototype.cpp:
1543         (JSC::webAssemblyTableProtoFuncGrow):
1544         (JSC::webAssemblyTableProtoFuncGet):
1545         (JSC::webAssemblyTableProtoFuncSet):
1546         (JSC::WebAssemblyTablePrototype::create):
1547         (JSC::WebAssemblyTablePrototype::finishCreation):
1548         * wasm/js/WebAssemblyTablePrototype.h:
1549
1550 2017-03-29  Keith Miller  <keith_miller@apple.com>
1551
1552         Unreviewed, fix the build, again. Hopefully for the last time, again!
1553
1554         * runtime/Options.cpp:
1555
1556 2017-03-29  Keith Miller  <keith_miller@apple.com>
1557
1558         Unreviewed, fix the build, again. Hopefully for the last time!
1559
1560         * runtime/Options.cpp:
1561         (JSC::parse):
1562
1563 2017-03-29  Keith Miller  <keith_miller@apple.com>
1564
1565         Unreviewed, windows build fix.
1566
1567         * runtime/Options.cpp:
1568         (JSC::parse):
1569
1570 2017-03-29  Keith Miller  <keith_miller@apple.com>
1571
1572         WebAssembly: B3IRGenerator should pool constants
1573         https://bugs.webkit.org/show_bug.cgi?id=170266
1574
1575         Reviewed by Filip Pizlo.
1576
1577         This patch adds a HashMap to B3IRGenerator that contains all the constants used in a function.
1578         B3IRGenerator then uses an InsertionSet to add all those constants to the root BB. This doesn't
1579         appear to be a compile time improvement but it could be valuable in the future.
1580
1581         * b3/B3Opcode.h:
1582         (JSC::B3::opcodeForConstant):
1583         * b3/B3Procedure.cpp:
1584         (JSC::B3::Procedure::addConstant):
1585         * b3/B3Procedure.h:
1586         * wasm/WasmB3IRGenerator.cpp:
1587         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1588         (JSC::Wasm::B3IRGenerator::constant):
1589         (JSC::Wasm::B3IRGenerator::insertConstants):
1590         (JSC::Wasm::B3IRGenerator::addConstant):
1591         (JSC::Wasm::B3IRGenerator::dump):
1592         (JSC::Wasm::parseAndCompile):
1593         (JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv):
1594         (JSC::Wasm::B3IRGenerator::zeroForType): Deleted.
1595         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
1596         (generateConstCode):
1597
1598 2017-03-29  Saam Barati  <sbarati@apple.com>
1599
1600         LinkBuffer and ExecutableAllocator shouldn't have anything to do with VM
1601         https://bugs.webkit.org/show_bug.cgi?id=170210
1602
1603         Reviewed by Mark Lam.
1604
1605         This is one more step in the direction of PIC-ified Wasm.
1606         LinkBuffer and ExecutableAllocator have no business knowing about VM.
1607
1608         * assembler/LinkBuffer.cpp:
1609         (JSC::LinkBuffer::allocate):
1610         * assembler/LinkBuffer.h:
1611         (JSC::LinkBuffer::LinkBuffer):
1612         (JSC::LinkBuffer::vm): Deleted.
1613         * b3/B3Compile.cpp:
1614         (JSC::B3::compile):
1615         * b3/B3Compile.h:
1616         * b3/air/testair.cpp:
1617         * b3/testb3.cpp:
1618         (JSC::B3::compileProc):
1619         (JSC::B3::compileAndRun):
1620         (JSC::B3::testLoadAcq42):
1621         (JSC::B3::testAddArgZeroImmZDef):
1622         (JSC::B3::testAddLoadTwice):
1623         (JSC::B3::testMulLoadTwice):
1624         (JSC::B3::testMulAddArgsLeft):
1625         (JSC::B3::testMulAddArgsRight):
1626         (JSC::B3::testMulAddArgsLeft32):
1627         (JSC::B3::testMulAddArgsRight32):
1628         (JSC::B3::testMulSubArgsLeft):
1629         (JSC::B3::testMulSubArgsRight):
1630         (JSC::B3::testMulSubArgsLeft32):
1631         (JSC::B3::testMulSubArgsRight32):
1632         (JSC::B3::testMulNegArgs):
1633         (JSC::B3::testMulNegArgs32):
1634         (JSC::B3::testCompareFloatToDoubleThroughPhi):
1635         (JSC::B3::testDoubleToFloatThroughPhi):
1636         (JSC::B3::testReduceFloatToDoubleValidates):
1637         (JSC::B3::testDoubleProducerPhiToFloatConversion):
1638         (JSC::B3::testDoubleProducerPhiToFloatConversionWithDoubleConsumer):
1639         (JSC::B3::testDoubleProducerPhiWithNonFloatConst):
1640         (JSC::B3::testIToD64Arg):
1641         (JSC::B3::testIToF64Arg):
1642         (JSC::B3::testIToD32Arg):
1643         (JSC::B3::testIToF32Arg):
1644         (JSC::B3::testIToD64Mem):
1645         (JSC::B3::testIToF64Mem):
1646         (JSC::B3::testIToD32Mem):
1647         (JSC::B3::testIToF32Mem):
1648         (JSC::B3::testIToDReducedToIToF64Arg):
1649         (JSC::B3::testIToDReducedToIToF32Arg):
1650         (JSC::B3::testStoreRelAddLoadAcq32):
1651         (JSC::B3::testStoreRelAddLoadAcq8):
1652         (JSC::B3::testStoreRelAddFenceLoadAcq8):
1653         (JSC::B3::testStoreRelAddLoadAcq16):
1654         (JSC::B3::testStoreRelAddLoadAcq64):
1655         (JSC::B3::testBranch):
1656         (JSC::B3::testBranchPtr):
1657         (JSC::B3::testDiamond):
1658         (JSC::B3::testBranchNotEqual):
1659         (JSC::B3::testBranchNotEqualCommute):
1660         (JSC::B3::testBranchNotEqualNotEqual):
1661         (JSC::B3::testBranchEqual):
1662         (JSC::B3::testBranchEqualEqual):
1663         (JSC::B3::testBranchEqualCommute):
1664         (JSC::B3::testBranchEqualEqual1):
1665         (JSC::B3::testBranchLoadPtr):
1666         (JSC::B3::testBranchLoad32):
1667         (JSC::B3::testBranchLoad8S):
1668         (JSC::B3::testBranchLoad8Z):
1669         (JSC::B3::testBranchLoad16S):
1670         (JSC::B3::testBranchLoad16Z):
1671         (JSC::B3::testBranch8WithLoad8ZIndex):
1672         (JSC::B3::testComplex):
1673         (JSC::B3::testSimpleCheck):
1674         (JSC::B3::testCheckFalse):
1675         (JSC::B3::testCheckTrue):
1676         (JSC::B3::testCheckLessThan):
1677         (JSC::B3::testCheckMegaCombo):
1678         (JSC::B3::testCheckTrickyMegaCombo):
1679         (JSC::B3::testCheckTwoMegaCombos):
1680         (JSC::B3::testCheckTwoNonRedundantMegaCombos):
1681         (JSC::B3::testCheckAddImm):
1682         (JSC::B3::testCheckAddImmCommute):
1683         (JSC::B3::testCheckAddImmSomeRegister):
1684         (JSC::B3::testCheckAdd):
1685         (JSC::B3::testCheckAdd64):
1686         (JSC::B3::testCheckAddFold):
1687         (JSC::B3::testCheckAddFoldFail):
1688         (JSC::B3::testCheckAddSelfOverflow64):
1689         (JSC::B3::testCheckAddSelfOverflow32):
1690         (JSC::B3::testCheckSubImm):
1691         (JSC::B3::testCheckSubBadImm):
1692         (JSC::B3::testCheckSub):
1693         (JSC::B3::testCheckSub64):
1694         (JSC::B3::testCheckSubFold):
1695         (JSC::B3::testCheckSubFoldFail):
1696         (JSC::B3::testCheckNeg):
1697         (JSC::B3::testCheckNeg64):
1698         (JSC::B3::testCheckMul):
1699         (JSC::B3::testCheckMulMemory):
1700         (JSC::B3::testCheckMul2):
1701         (JSC::B3::testCheckMul64):
1702         (JSC::B3::testCheckMulFold):
1703         (JSC::B3::testCheckMulFoldFail):
1704         (JSC::B3::testCheckMul64SShr):
1705         (JSC::B3::testSwitch):
1706         (JSC::B3::testSwitchChillDiv):
1707         (JSC::B3::testSwitchTargettingSameBlock):
1708         (JSC::B3::testSwitchTargettingSameBlockFoldPathConstant):
1709         (JSC::B3::testBasicSelect):
1710         (JSC::B3::testSelectTest):
1711         (JSC::B3::testSelectCompareDouble):
1712         (JSC::B3::testSelectDouble):
1713         (JSC::B3::testSelectDoubleTest):
1714         (JSC::B3::testSelectDoubleCompareDouble):
1715         (JSC::B3::testSelectFloatCompareFloat):
1716         (JSC::B3::testSelectFold):
1717         (JSC::B3::testSelectInvert):
1718         (JSC::B3::testCheckSelect):
1719         (JSC::B3::testCheckSelectCheckSelect):
1720         (JSC::B3::testCheckSelectAndCSE):
1721         (JSC::B3::testTrivialInfiniteLoop):
1722         (JSC::B3::testFoldPathEqual):
1723         (JSC::B3::testLShiftSelf32):
1724         (JSC::B3::testRShiftSelf32):
1725         (JSC::B3::testURShiftSelf32):
1726         (JSC::B3::testLShiftSelf64):
1727         (JSC::B3::testRShiftSelf64):
1728         (JSC::B3::testURShiftSelf64):
1729         (JSC::B3::testPatchpointDoubleRegs):
1730         (JSC::B3::testSpillDefSmallerThanUse):
1731         (JSC::B3::testSpillUseLargerThanDef):
1732         (JSC::B3::testLateRegister):
1733         (JSC::B3::testInterpreter):
1734         (JSC::B3::testEntrySwitchSimple):
1735         (JSC::B3::testEntrySwitchNoEntrySwitch):
1736         (JSC::B3::testEntrySwitchWithCommonPaths):
1737         (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
1738         (JSC::B3::testEntrySwitchLoop):
1739         (JSC::B3::testSomeEarlyRegister):
1740         (JSC::B3::testTerminalPatchpointThatNeedsToBeSpilled):
1741         (JSC::B3::testTerminalPatchpointThatNeedsToBeSpilled2):
1742         (JSC::B3::testPatchpointTerminalReturnValue):
1743         (JSC::B3::testMemoryFence):
1744         (JSC::B3::testStoreFence):
1745         (JSC::B3::testLoadFence):
1746         (JSC::B3::testPCOriginMapDoesntInsertNops):
1747         (JSC::B3::testPinRegisters):
1748         (JSC::B3::testX86LeaAddAddShlLeft):
1749         (JSC::B3::testX86LeaAddAddShlRight):
1750         (JSC::B3::testX86LeaAddAdd):
1751         (JSC::B3::testX86LeaAddShlRight):
1752         (JSC::B3::testX86LeaAddShlLeftScale1):
1753         (JSC::B3::testX86LeaAddShlLeftScale2):
1754         (JSC::B3::testX86LeaAddShlLeftScale4):
1755         (JSC::B3::testX86LeaAddShlLeftScale8):
1756         (JSC::B3::testAddShl32):
1757         (JSC::B3::testAddShl64):
1758         (JSC::B3::testAddShl65):
1759         (JSC::B3::testLoadBaseIndexShift2):
1760         (JSC::B3::testLoadBaseIndexShift32):
1761         (JSC::B3::testOptimizeMaterialization):
1762         (JSC::B3::testAtomicWeakCAS):
1763         (JSC::B3::testAtomicStrongCAS):
1764         (JSC::B3::testAtomicXchg):
1765         (JSC::B3::testDepend32):
1766         (JSC::B3::testDepend64):
1767         (JSC::B3::testWasmBoundsCheck):
1768         (JSC::B3::testWasmAddress):
1769         (JSC::B3::run):
1770         (JSC::B3::compile): Deleted.
1771         * bytecode/PolymorphicAccess.cpp:
1772         (JSC::PolymorphicAccess::regenerate):
1773         * dfg/DFGJITCompiler.cpp:
1774         (JSC::DFG::JITCompiler::compile):
1775         (JSC::DFG::JITCompiler::compileFunction):
1776         * dfg/DFGLazyJSValue.cpp:
1777         (JSC::DFG::LazyJSValue::emit):
1778         * dfg/DFGOSRExitCompiler.cpp:
1779         * dfg/DFGSpeculativeJIT32_64.cpp:
1780         (JSC::DFG::SpeculativeJIT::emitCall):
1781         * dfg/DFGSpeculativeJIT64.cpp:
1782         (JSC::DFG::SpeculativeJIT::emitCall):
1783         * dfg/DFGThunks.cpp:
1784         (JSC::DFG::osrExitGenerationThunkGenerator):
1785         (JSC::DFG::osrEntryThunkGenerator):
1786         * ftl/FTLCompile.cpp:
1787         (JSC::FTL::compile):
1788         * ftl/FTLLazySlowPath.cpp:
1789         (JSC::FTL::LazySlowPath::generate):
1790         * ftl/FTLLink.cpp:
1791         (JSC::FTL::link):
1792         * ftl/FTLLowerDFGToB3.cpp:
1793         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
1794         (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
1795         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
1796         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
1797         (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
1798         * ftl/FTLOSRExitCompiler.cpp:
1799         (JSC::FTL::compileStub):
1800         * ftl/FTLOSRExitHandle.cpp:
1801         (JSC::FTL::OSRExitHandle::emitExitThunk):
1802         * ftl/FTLSlowPathCall.cpp:
1803         (JSC::FTL::SlowPathCallContext::makeCall):
1804         * ftl/FTLSlowPathCall.h:
1805         (JSC::FTL::callOperation):
1806         * ftl/FTLState.h:
1807         * ftl/FTLThunks.cpp:
1808         (JSC::FTL::genericGenerationThunkGenerator):
1809         (JSC::FTL::slowPathCallThunkGenerator):
1810         * ftl/FTLThunks.h:
1811         (JSC::FTL::generateIfNecessary):
1812         (JSC::FTL::Thunks::getSlowPathCallThunk):
1813         * jit/AssemblyHelpers.cpp:
1814         (JSC::AssemblyHelpers::emitDumbVirtualCall):
1815         * jit/AssemblyHelpers.h:
1816         * jit/ExecutableAllocator.cpp:
1817         (JSC::ExecutableAllocator::initializeAllocator):
1818         (JSC::ExecutableAllocator::singleton):
1819         (JSC::ExecutableAllocator::ExecutableAllocator):
1820         (JSC::ExecutableAllocator::allocate):
1821         * jit/ExecutableAllocator.h:
1822         * jit/JIT.cpp:
1823         (JSC::JIT::compileWithoutLinking):
1824         * jit/JITCall.cpp:
1825         (JSC::JIT::compileCallEvalSlowCase):
1826         * jit/JITMathIC.h:
1827         (JSC::JITMathIC::generateOutOfLine):
1828         * jit/JITOpcodes.cpp:
1829         (JSC::JIT::privateCompileHasIndexedProperty):
1830         * jit/JITOpcodes32_64.cpp:
1831         (JSC::JIT::privateCompileHasIndexedProperty):
1832         * jit/JITOperations.cpp:
1833         * jit/JITOperations.h:
1834         * jit/JITPropertyAccess.cpp:
1835         (JSC::JIT::stringGetByValStubGenerator):
1836         (JSC::JIT::privateCompileGetByVal):
1837         (JSC::JIT::privateCompileGetByValWithCachedId):
1838         (JSC::JIT::privateCompilePutByVal):
1839         (JSC::JIT::privateCompilePutByValWithCachedId):
1840         * jit/JITPropertyAccess32_64.cpp:
1841         (JSC::JIT::stringGetByValStubGenerator):
1842         * jit/JITStubRoutine.h:
1843         * jit/Repatch.cpp:
1844         (JSC::ftlThunkAwareRepatchCall):
1845         (JSC::linkPolymorphicCall):
1846         * jit/SpecializedThunkJIT.h:
1847         (JSC::SpecializedThunkJIT::finalize):
1848         * jit/ThunkGenerators.cpp:
1849         (JSC::throwExceptionFromCallSlowPathGenerator):
1850         (JSC::linkCallThunkGenerator):
1851         (JSC::linkPolymorphicCallThunkGenerator):
1852         (JSC::virtualThunkFor):
1853         (JSC::nativeForGenerator):
1854         (JSC::arityFixupGenerator):
1855         (JSC::unreachableGenerator):
1856         (JSC::boundThisNoArgsFunctionCallGenerator):
1857         (JSC::throwExceptionFromWasmThunkGenerator):
1858         * llint/LLIntThunks.cpp:
1859         (JSC::LLInt::generateThunkWithJumpTo):
1860         * runtime/SamplingProfiler.cpp:
1861         (JSC::SamplingProfiler::takeSample):
1862         * runtime/VM.cpp:
1863         (JSC::VM::VM):
1864         * runtime/VM.h:
1865         * runtime/VMTraps.cpp:
1866         (JSC::VMTraps::tryInstallTrapBreakpoints):
1867         * tools/VMInspector.cpp:
1868         * wasm/WasmBinding.cpp:
1869         (JSC::Wasm::wasmToJs):
1870         (JSC::Wasm::wasmToWasm):
1871         (JSC::Wasm::exitStubGenerator):
1872         * wasm/WasmPlan.cpp:
1873         (JSC::Wasm::Plan::complete):
1874         * yarr/YarrJIT.cpp:
1875         (JSC::Yarr::YarrGenerator::compile):
1876         (JSC::Yarr::jitCompile):
1877
1878 2017-03-29  Keith Miller  <keith_miller@apple.com>
1879
1880         WebAssembly: Worklist should periodically check in to see if there are higher priority jobs to do.
1881         https://bugs.webkit.org/show_bug.cgi?id=170204
1882
1883         Reviewed by Saam Barati.
1884
1885         This patch makes it so that Wasm::Plan's compileFunctions method can return periodically
1886         to its caller. The main use for this is if a user asynchronously compiles a wasm module
1887         then later synchronously compiles another module. In this case we want to be able to pause
1888         compilation of other worklists.
1889
1890         This patch also adds support for size_t Options.
1891
1892         * runtime/Options.cpp:
1893         (JSC::parse):
1894         (JSC::Option::dump):
1895         (JSC::Option::operator==):
1896         * runtime/Options.h:
1897         * wasm/WasmPlan.cpp:
1898         (JSC::Wasm::Plan::moveToState):
1899         (JSC::Wasm::Plan::ThreadCountHolder::~ThreadCountHolder):
1900         (JSC::Wasm::Plan::compileFunctions):
1901         * wasm/WasmPlan.h:
1902         * wasm/WasmWorklist.cpp:
1903
1904 2017-03-29  Mark Lam  <mark.lam@apple.com>
1905
1906         Remove obsolete references to HeapTimer in JavaScriptCore.order.
1907         https://bugs.webkit.org/show_bug.cgi?id=170252
1908
1909         Reviewed by Saam Barati.
1910
1911         The HeapTimer was renamed to JSRunLoopTimer back in r214504.  These HeapTimer
1912         entries are now no longer meaningful.
1913
1914         * JavaScriptCore.order:
1915
1916 2017-03-29  JF Bastien  <jfbastien@apple.com>
1917
1918         WebAssembly: add shell-only Memory mode helper
1919         https://bugs.webkit.org/show_bug.cgi?id=170227
1920
1921         Reviewed by Mark Lam.
1922
1923         * jsc.cpp:
1924         (GlobalObject::finishCreation):
1925         (functionWebAssemblyMemoryMode):
1926         * wasm/WasmMemory.h:
1927         * wasm/js/JSWebAssemblyInstance.h:
1928         * wasm/js/JSWebAssemblyMemory.h:
1929
1930 2017-03-29  Keith Miller  <keith_miller@apple.com>
1931
1932         WebAssembly: pack OpcodeOrigin to fit in a pointer
1933         https://bugs.webkit.org/show_bug.cgi?id=170244
1934
1935         Reviewed by Michael Saboff.
1936
1937         This patch makes it so we don't have to have allocate the OpcodeOrigin and can just
1938         pack all the data into the pointer B3::Origin already has.
1939
1940         * wasm/WasmB3IRGenerator.cpp:
1941         (JSC::Wasm::parseAndCompile):
1942         * wasm/WasmOpcodeOrigin.cpp:
1943         (JSC::Wasm::OpcodeOrigin::dump):
1944         * wasm/WasmOpcodeOrigin.h:
1945         (JSC::Wasm::OpcodeOrigin::OpcodeOrigin):
1946         (JSC::Wasm::OpcodeOrigin::opcode):
1947         (JSC::Wasm::OpcodeOrigin::location):
1948
1949 2017-03-29  JF Bastien  <jfbastien@apple.com>
1950
1951         WebAssembly: NFC s/goto/lambda/g
1952         https://bugs.webkit.org/show_bug.cgi?id=170242
1953
1954         Reviewed by Mark Lam.
1955
1956         Lambdas are more in-style than the goto I just used.
1957
1958         * wasm/WasmMemory.cpp:
1959         (JSC::Wasm::tryGetFastMemory):
1960
1961 2017-03-28  Saam Barati  <sbarati@apple.com>
1962
1963         AssemblyHelpers should not have a VM field
1964         https://bugs.webkit.org/show_bug.cgi?id=170207
1965
1966         Reviewed by Yusuke Suzuki.
1967
1968         APIs that need VM should take one as a parameter. When doing position
1969         independent code for Wasm, we can't tie code generation to a VM.
1970
1971         * b3/B3Compile.cpp:
1972         (JSC::B3::compile):
1973         * b3/air/testair.cpp:
1974         * b3/testb3.cpp:
1975         (JSC::B3::testEntrySwitchSimple):
1976         (JSC::B3::testEntrySwitchNoEntrySwitch):
1977         (JSC::B3::testEntrySwitchWithCommonPaths):
1978         (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
1979         (JSC::B3::testEntrySwitchLoop):
1980         * bytecode/AccessCase.cpp:
1981         (JSC::AccessCase::generateWithGuard):
1982         (JSC::AccessCase::generateImpl):
1983         * bytecode/DOMJITAccessCasePatchpointParams.cpp:
1984         (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
1985         * bytecode/InlineAccess.cpp:
1986         (JSC::InlineAccess::dumpCacheSizesAndCrash):
1987         (JSC::InlineAccess::generateSelfPropertyAccess):
1988         (JSC::InlineAccess::generateSelfPropertyReplace):
1989         (JSC::InlineAccess::generateArrayLength):
1990         (JSC::InlineAccess::rewireStubAsJump):
1991         * bytecode/InlineAccess.h:
1992         * bytecode/PolymorphicAccess.cpp:
1993         (JSC::AccessGenerationState::emitExplicitExceptionHandler):
1994         (JSC::PolymorphicAccess::regenerate):
1995         * bytecode/PolymorphicAccess.h:
1996         (JSC::AccessGenerationState::AccessGenerationState):
1997         * dfg/DFGJITCompiler.cpp:
1998         (JSC::DFG::JITCompiler::JITCompiler):
1999         (JSC::DFG::JITCompiler::compileExceptionHandlers):
2000         (JSC::DFG::JITCompiler::link):
2001         (JSC::DFG::JITCompiler::compile):
2002         (JSC::DFG::JITCompiler::compileFunction):
2003         (JSC::DFG::JITCompiler::exceptionCheck):
2004         * dfg/DFGJITCompiler.h:
2005         (JSC::DFG::JITCompiler::exceptionCheckWithCallFrameRollback):
2006         (JSC::DFG::JITCompiler::fastExceptionCheck):
2007         (JSC::DFG::JITCompiler::vm):
2008         * dfg/DFGOSRExitCompiler.cpp:
2009         * dfg/DFGOSRExitCompiler.h:
2010         * dfg/DFGOSRExitCompiler32_64.cpp:
2011         (JSC::DFG::OSRExitCompiler::compileExit):
2012         * dfg/DFGOSRExitCompiler64.cpp:
2013         (JSC::DFG::OSRExitCompiler::compileExit):
2014         * dfg/DFGOSRExitCompilerCommon.cpp:
2015         (JSC::DFG::adjustAndJumpToTarget):
2016         * dfg/DFGOSRExitCompilerCommon.h:
2017         * dfg/DFGSpeculativeJIT.cpp:
2018         (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
2019         (JSC::DFG::SpeculativeJIT::checkArray):
2020         (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
2021         (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
2022         (JSC::DFG::SpeculativeJIT::compileMakeRope):
2023         (JSC::DFG::SpeculativeJIT::compileGetGlobalObject):
2024         (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
2025         (JSC::DFG::SpeculativeJIT::compileCreateActivation):
2026         (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
2027         (JSC::DFG::SpeculativeJIT::compileSpread):
2028         (JSC::DFG::SpeculativeJIT::compileArraySlice):
2029         (JSC::DFG::SpeculativeJIT::compileNukeStructureAndSetButterfly):
2030         (JSC::DFG::SpeculativeJIT::compileNewStringObject):
2031         (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
2032         (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
2033         * dfg/DFGSpeculativeJIT.h:
2034         (JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize):
2035         (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
2036         (JSC::DFG::SpeculativeJIT::emitAllocateVariableSizedJSObject):
2037         (JSC::DFG::SpeculativeJIT::emitAllocateDestructibleObject):
2038         * dfg/DFGSpeculativeJIT32_64.cpp:
2039         (JSC::DFG::SpeculativeJIT::emitCall):
2040         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
2041         (JSC::DFG::SpeculativeJIT::emitBranch):
2042         (JSC::DFG::SpeculativeJIT::compile):
2043         * dfg/DFGSpeculativeJIT64.cpp:
2044         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
2045         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
2046         (JSC::DFG::SpeculativeJIT::emitCall):
2047         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
2048         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
2049         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
2050         (JSC::DFG::SpeculativeJIT::emitBranch):
2051         (JSC::DFG::SpeculativeJIT::compile):
2052         (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
2053         * dfg/DFGThunks.cpp:
2054         (JSC::DFG::osrEntryThunkGenerator):
2055         * ftl/FTLCompile.cpp:
2056         (JSC::FTL::compile):
2057         * ftl/FTLJITFinalizer.h:
2058         * ftl/FTLLazySlowPath.cpp:
2059         (JSC::FTL::LazySlowPath::generate):
2060         * ftl/FTLLazySlowPathCall.h:
2061         (JSC::FTL::createLazyCallGenerator):
2062         * ftl/FTLLink.cpp:
2063         (JSC::FTL::link):
2064         * ftl/FTLLowerDFGToB3.cpp:
2065         (JSC::FTL::DFG::LowerDFGToB3::lower):
2066         (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
2067         (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
2068         (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
2069         (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
2070         (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
2071         (JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
2072         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
2073         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
2074         (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
2075         (JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull):
2076         (JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
2077         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
2078         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
2079         (JSC::FTL::DFG::LowerDFGToB3::compileCheckTraps):
2080         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
2081         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
2082         (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
2083         (JSC::FTL::DFG::LowerDFGToB3::buildTypeOf):
2084         * ftl/FTLOSRExitCompiler.cpp:
2085         (JSC::FTL::compileStub):
2086         * ftl/FTLSlowPathCall.h:
2087         (JSC::FTL::callOperation):
2088         * ftl/FTLState.h:
2089         (JSC::FTL::State::vm):
2090         * ftl/FTLThunks.cpp:
2091         (JSC::FTL::genericGenerationThunkGenerator):
2092         (JSC::FTL::slowPathCallThunkGenerator):
2093         * jit/AssemblyHelpers.cpp:
2094         (JSC::AssemblyHelpers::jitReleaseAssertNoException):
2095         (JSC::AssemblyHelpers::callExceptionFuzz):
2096         (JSC::AssemblyHelpers::emitJumpIfException):
2097         (JSC::AssemblyHelpers::emitExceptionCheck):
2098         (JSC::AssemblyHelpers::emitNonPatchableExceptionCheck):
2099         (JSC::AssemblyHelpers::emitLoadStructure):
2100         (JSC::AssemblyHelpers::emitRandomThunk):
2101         (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
2102         (JSC::AssemblyHelpers::emitConvertValueToBoolean):
2103         (JSC::AssemblyHelpers::debugCall):
2104         * jit/AssemblyHelpers.h:
2105         (JSC::AssemblyHelpers::AssemblyHelpers):
2106         (JSC::AssemblyHelpers::codeBlock):
2107         (JSC::AssemblyHelpers::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
2108         (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMEntryFrameCalleeSavesBuffer):
2109         (JSC::AssemblyHelpers::barrierBranch):
2110         (JSC::AssemblyHelpers::barrierStoreLoadFence):
2111         (JSC::AssemblyHelpers::mutatorFence):
2112         (JSC::AssemblyHelpers::storeButterfly):
2113         (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly):
2114         (JSC::AssemblyHelpers::jumpIfMutatorFenceNotNeeded):
2115         (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
2116         (JSC::AssemblyHelpers::emitAllocateJSObject):
2117         (JSC::AssemblyHelpers::emitAllocateVariableSizedCell):
2118         (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
2119         (JSC::AssemblyHelpers::emitAllocateDestructibleObject):
2120         (JSC::AssemblyHelpers::vm): Deleted.
2121         (JSC::AssemblyHelpers::debugCall): Deleted.
2122         * jit/CCallHelpers.cpp:
2123         (JSC::CCallHelpers::ensureShadowChickenPacket):
2124         * jit/CCallHelpers.h:
2125         (JSC::CCallHelpers::CCallHelpers):
2126         (JSC::CCallHelpers::jumpToExceptionHandler):
2127         * jit/JIT.cpp:
2128         (JSC::JIT::emitEnterOptimizationCheck):
2129         (JSC::JIT::privateCompileExceptionHandlers):
2130         * jit/JIT.h:
2131         (JSC::JIT::exceptionCheck):
2132         (JSC::JIT::exceptionCheckWithCallFrameRollback):
2133         * jit/JITMathIC.h:
2134         (JSC::JITMathIC::generateOutOfLine):
2135         * jit/JITOpcodes.cpp:
2136         (JSC::JIT::emit_op_instanceof):
2137         (JSC::JIT::emit_op_is_undefined):
2138         (JSC::JIT::emit_op_jfalse):
2139         (JSC::JIT::emit_op_jeq_null):
2140         (JSC::JIT::emit_op_jneq_null):
2141         (JSC::JIT::emit_op_jtrue):
2142         (JSC::JIT::emit_op_throw):
2143         (JSC::JIT::emit_op_catch):
2144         (JSC::JIT::emit_op_eq_null):
2145         (JSC::JIT::emit_op_neq_null):
2146         (JSC::JIT::emitSlow_op_loop_hint):
2147         (JSC::JIT::emit_op_log_shadow_chicken_prologue):
2148         (JSC::JIT::emit_op_log_shadow_chicken_tail):
2149         * jit/JITOpcodes32_64.cpp:
2150         (JSC::JIT::privateCompileCTINativeCall):
2151         (JSC::JIT::emit_op_new_object):
2152         (JSC::JIT::emit_op_jfalse):
2153         (JSC::JIT::emit_op_jtrue):
2154         (JSC::JIT::emit_op_throw):
2155         (JSC::JIT::emit_op_catch):
2156         (JSC::JIT::emit_op_create_this):
2157         (JSC::JIT::emit_op_log_shadow_chicken_prologue):
2158         (JSC::JIT::emit_op_log_shadow_chicken_tail):
2159         * jit/JITPropertyAccess.cpp:
2160         (JSC::JIT::emitWriteBarrier):
2161         * jit/JSInterfaceJIT.h:
2162         (JSC::JSInterfaceJIT::JSInterfaceJIT):
2163         (JSC::JSInterfaceJIT::vm):
2164         * jit/Repatch.cpp:
2165         (JSC::tryCacheGetByID):
2166         (JSC::tryCachePutByID):
2167         (JSC::linkPolymorphicCall):
2168         (JSC::resetGetByID):
2169         (JSC::resetPutByID):
2170         * jit/SetupVarargsFrame.cpp:
2171         (JSC::emitSetupVarargsFrameFastCase):
2172         * jit/SetupVarargsFrame.h:
2173         * jit/SpecializedThunkJIT.h:
2174         (JSC::SpecializedThunkJIT::loadArgumentWithSpecificClass):
2175         * jit/ThunkGenerators.cpp:
2176         (JSC::throwExceptionFromCallSlowPathGenerator):
2177         (JSC::linkCallThunkGenerator):
2178         (JSC::linkPolymorphicCallThunkGenerator):
2179         (JSC::virtualThunkFor):
2180         (JSC::nativeForGenerator):
2181         (JSC::randomThunkGenerator):
2182         (JSC::boundThisNoArgsFunctionCallGenerator):
2183         (JSC::throwExceptionFromWasmThunkGenerator):
2184         * wasm/WasmB3IRGenerator.cpp:
2185         (JSC::Wasm::parseAndCompile):
2186         * wasm/WasmBinding.cpp:
2187         (JSC::Wasm::wasmToJs):
2188         (JSC::Wasm::wasmToWasm):
2189
2190 2017-03-28  Keith Miller  <keith_miller@apple.com>
2191
2192         WebAssembly: We should have Origins
2193         https://bugs.webkit.org/show_bug.cgi?id=170217
2194
2195         Reviewed by Mark Lam.
2196
2197         This patch adds wasm origins for B3::Values, called OpcodeOrigin. Currently,
2198         OpcodeOrigin just tracks the original opcode and the location of that opcode.
2199
2200         Here's a sample:
2201
2202         BB#0: ; frequency = 1.000000
2203             Int64 @4 = Patchpoint(generator = 0x10f487fa8, earlyClobbered = [], lateClobbered = [], usedRegisters = [], resultConstraint = SomeRegister)
2204             Int64 @5 = FramePointer()
2205             Void @8 = Store(@4, @5, offset = 24, ControlDependent|Writes:Top)
2206             Int64 @10 = Const64(0)
2207             Void @12 = Store($0(@10), @5, offset = 16, ControlDependent|Writes:Top)
2208             Int64 @13 = Patchpoint(generator = 0x10f4be7f0, earlyClobbered = [], lateClobbered = [], usedRegisters = [], resultConstraint = SomeRegister, ExitsSideways|ControlDependent|WritesPinned|ReadsPinned|Fence|Writes:Top|Reads:Top)
2209             Int64 @16 = ArgumentReg(%rdi)
2210             Int64 @18 = ArgumentReg(%rsi)
2211             Int32 @22 = Trunc(@18, Wasm: {opcode: I64Rotl, location: 5})
2212             Int64 @23 = RotL(@16, @22, Wasm: {opcode: I64Rotl, location: 5})
2213             Void @27 = Return(@23, Terminal, Wasm: {opcode: End, location: 6})
2214
2215         * JavaScriptCore.xcodeproj/project.pbxproj:
2216         * b3/B3Value.cpp:
2217         (JSC::B3::Value::deepDump):
2218         * wasm/WasmB3IRGenerator.cpp:
2219         (JSC::Wasm::B3IRGenerator::setParser):
2220         (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
2221         (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
2222         (JSC::Wasm::B3IRGenerator::emitLoadOp):
2223         (JSC::Wasm::B3IRGenerator::emitStoreOp):
2224         (JSC::Wasm::B3IRGenerator::addConstant):
2225         (JSC::Wasm::B3IRGenerator::addLoop):
2226         (JSC::Wasm::B3IRGenerator::unify):
2227         (JSC::Wasm::parseAndCompile):
2228         (JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv):
2229         (JSC::Wasm::getMemoryBaseAndSize): Deleted.
2230         * wasm/WasmFunctionParser.h:
2231         (JSC::Wasm::FunctionParser::currentOpcode):
2232         (JSC::Wasm::FunctionParser::currentOpcodeStartingOffset):
2233         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
2234         * wasm/WasmOpcodeOrigin.cpp: Added.
2235         (JSC::Wasm::OpcodeOrigin::dump):
2236         * wasm/WasmOpcodeOrigin.h: Added.
2237         (JSC::Wasm::OpcodeOrigin::OpcodeOrigin):
2238         * wasm/WasmValidate.cpp:
2239         (JSC::Wasm::Validate::setParser):
2240         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
2241         (CodeGenerator.generate):
2242         (generateB3OpCode):
2243         (generateConstCode):
2244
2245 2017-03-28  JF Bastien  <jfbastien@apple.com>
2246
2247         WebAssembly: option to crash if no fast memory is available
2248         https://bugs.webkit.org/show_bug.cgi?id=170219
2249
2250         Reviewed by Mark Lam.
2251
2252         * runtime/Options.h:
2253         * wasm/WasmMemory.cpp:
2254         (JSC::Wasm::webAssemblyCouldntGetFastMemory):
2255         (JSC::Wasm::tryGetFastMemory):
2256
2257 2017-03-28  Mark Lam  <mark.lam@apple.com>
2258
2259         The Mutator should not be able to steal the conn if the Collector hasn't reached the NotRunning phase yet.
2260         https://bugs.webkit.org/show_bug.cgi?id=170213
2261         <rdar://problem/30755345>
2262
2263         Reviewed by Filip Pizlo.
2264
2265         The current condition for stealing the conn isn't tight enough.  Restricting the
2266         stealing to when m_currentPhase == NotRunning ensures that the Collector is
2267         really done running.
2268
2269         No test because this issue only manifests with a race condition that is difficult
2270         to reproduce on demand.
2271
2272         * heap/Heap.cpp:
2273         (JSC::Heap::requestCollection):
2274
2275 2017-03-28  Keith Miller  <keith_miller@apple.com>
2276
2277         WebAssembly: Make WebAssembly.instantiate/compile truly asynchronous
2278         https://bugs.webkit.org/show_bug.cgi?id=169187
2279
2280         Reviewed by Saam Barati.
2281
2282         This patch allows WebAssembly compilations to happen asynchronously.
2283         To do so, it refactors how much of the compilation happens and adds
2284         new infrastructure for async promises.
2285
2286         First, there is a new class, PromiseDeferredTimer that lives on
2287         the VM.  PromiseDeferredTimer will manage the life-cycle of async
2288         pending promises and any dependencies that promise
2289         needs. PromiseDeferredTimer automagically releases the pending
2290         promise and dependencies once the JSPromiseDeferred is resolved or
2291         rejected. Additionally, PromiseDeferredTimer provides a mechanism
2292         to poll the run-loop whenever the async task needs to synchronize
2293         with the JS thread. Normally, that will be whenever the async task
2294         finishes. In the case of Web Assembly we also use this feature for
2295         the compile + instantiate case, where we might have more work
2296         after the first async task completes (more on that later).
2297
2298         The next class is Wasm::Worklist, which is used to manage Wasm
2299         compilation tasks. The worklist class works similarly to the
2300         DFG/FTL Worklists. It has a pool of threads that it manages. One
2301         interesting aspect of Wasm Worklist is that it can synchronously
2302         compile a plan that is already potentially running
2303         asynchronously. This can occur if a user calls
2304         WebAssembly.instantiate() then new WebAssembly.instantiate() on
2305         the same module. In that case the Wasm Worklist will bump the
2306         priority of the running pending Plan and block the JS thread.
2307
2308         This patch also makes some of the Wasm Plan code cleaner. Since we
2309         now defer all compilation to instantiation time, we no longer need
2310         to guess at which memory we are going to get. Also, Wasm Plans now
2311         track the work they have done with a state enum.
2312
2313         Finally, this patch makes renamed HeapTimer to JSRunLoopTimer. It
2314         also adds changes test262AsyncTest to a more generic testing
2315         infrastructure. Now, in addition to the old functionality, you can
2316         call asyncTest() with the number of tests you expect. When the jsc
2317         CLI exits, it will guarantee that asyncTestPassed() is called that
2318         many times.
2319
2320         * CMakeLists.txt:
2321         * JavaScriptCore.xcodeproj/project.pbxproj:
2322         * heap/GCActivityCallback.h:
2323         * heap/IncrementalSweeper.cpp:
2324         (JSC::IncrementalSweeper::scheduleTimer):
2325         (JSC::IncrementalSweeper::IncrementalSweeper):
2326         * heap/IncrementalSweeper.h:
2327         * heap/StopIfNecessaryTimer.cpp:
2328         (JSC::StopIfNecessaryTimer::StopIfNecessaryTimer):
2329         * heap/StopIfNecessaryTimer.h:
2330         * heap/StrongInlines.h:
2331         * jsc.cpp:
2332         (GlobalObject::finishCreation):
2333         (printInternal):
2334         (functionAsyncTestStart):
2335         (functionAsyncTestPassed):
2336         (functionTestWasmModuleFunctions):
2337         (CommandLine::parseArguments):
2338         (runJSC):
2339         * runtime/JSPromiseDeferred.cpp:
2340         (JSC::JSPromiseDeferred::resolve):
2341         (JSC::JSPromiseDeferred::reject):
2342         * runtime/JSPromiseDeferred.h:
2343         (JSC::JSPromiseDeferred::promiseAsyncPending):
2344         * runtime/JSRunLoopTimer.cpp: Renamed from Source/JavaScriptCore/heap/HeapTimer.cpp.
2345         (JSC::JSRunLoopTimer::JSRunLoopTimer):
2346         (JSC::JSRunLoopTimer::setRunLoop):
2347         (JSC::JSRunLoopTimer::~JSRunLoopTimer):
2348         (JSC::JSRunLoopTimer::timerDidFire):
2349         (JSC::JSRunLoopTimer::scheduleTimer):
2350         (JSC::JSRunLoopTimer::cancelTimer):
2351         (JSC::JSRunLoopTimer::invalidate):
2352         * runtime/JSRunLoopTimer.h: Copied from Source/JavaScriptCore/heap/HeapTimer.h.
2353         * runtime/Options.h:
2354         * runtime/PromiseDeferredTimer.cpp: Added.
2355         (JSC::PromiseDeferredTimer::PromiseDeferredTimer):
2356         (JSC::PromiseDeferredTimer::doWork):
2357         (JSC::PromiseDeferredTimer::runRunLoop):
2358         (JSC::PromiseDeferredTimer::addPendingPromise):
2359         (JSC::PromiseDeferredTimer::cancelPendingPromise):
2360         (JSC::PromiseDeferredTimer::scheduleWorkSoon):
2361         (JSC::PromiseDeferredTimer::scheduleBlockedTask):
2362         * runtime/PromiseDeferredTimer.h: Renamed from Source/JavaScriptCore/heap/HeapTimer.h.
2363         (JSC::PromiseDeferredTimer::stopRunningTasks):
2364         * runtime/VM.cpp:
2365         (JSC::VM::VM):
2366         (JSC::VM::~VM):
2367         * runtime/VM.h:
2368         * wasm/JSWebAssembly.cpp:
2369         (JSC::reject):
2370         (JSC::webAssemblyCompileFunc):
2371         (JSC::resolve):
2372         (JSC::instantiate):
2373         (JSC::compileAndInstantiate):
2374         (JSC::webAssemblyInstantiateFunc):
2375         (JSC::webAssemblyValidateFunc):
2376         * wasm/WasmB3IRGenerator.cpp:
2377         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
2378         (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
2379         (JSC::Wasm::B3IRGenerator::memoryKind):
2380         (JSC::Wasm::parseAndCompile):
2381         * wasm/WasmB3IRGenerator.h:
2382         * wasm/WasmFormat.h:
2383         (JSC::Wasm::ModuleInformation::internalFunctionCount):
2384         * wasm/WasmFunctionParser.h:
2385         * wasm/WasmMemory.h:
2386         * wasm/WasmMemoryInformation.cpp:
2387         (JSC::Wasm::MemoryInformation::MemoryInformation):
2388         * wasm/WasmMemoryInformation.h:
2389         (JSC::Wasm::MemoryInformation::maximum):
2390         (JSC::Wasm::MemoryInformation::hasReservedMemory): Deleted.
2391         (JSC::Wasm::MemoryInformation::takeReservedMemory): Deleted.
2392         (JSC::Wasm::MemoryInformation::mode): Deleted.
2393         * wasm/WasmModuleParser.cpp:
2394         * wasm/WasmModuleParser.h:
2395         (JSC::Wasm::ModuleParser::ModuleParser):
2396         * wasm/WasmPlan.cpp:
2397         (JSC::Wasm::Plan::Plan):
2398         (JSC::Wasm::Plan::stateString):
2399         (JSC::Wasm::Plan::moveToState):
2400         (JSC::Wasm::Plan::fail):
2401         (JSC::Wasm::Plan::parseAndValidateModule):
2402         (JSC::Wasm::Plan::prepare):
2403         (JSC::Wasm::Plan::ThreadCountHolder::ThreadCountHolder):
2404         (JSC::Wasm::Plan::ThreadCountHolder::~ThreadCountHolder):
2405         (JSC::Wasm::Plan::compileFunctions):
2406         (JSC::Wasm::Plan::complete):
2407         (JSC::Wasm::Plan::waitForCompletion):
2408         (JSC::Wasm::Plan::cancel):
2409         (JSC::Wasm::Plan::run): Deleted.
2410         (JSC::Wasm::Plan::initializeCallees): Deleted.
2411         * wasm/WasmPlan.h:
2412         (JSC::Wasm::Plan::dontFinalize):
2413         (JSC::Wasm::Plan::exports):
2414         (JSC::Wasm::Plan::internalFunctionCount):
2415         (JSC::Wasm::Plan::takeModuleInformation):
2416         (JSC::Wasm::Plan::takeCallLinkInfos):
2417         (JSC::Wasm::Plan::takeWasmExitStubs):
2418         (JSC::Wasm::Plan::setModeAndPromise):
2419         (JSC::Wasm::Plan::mode):
2420         (JSC::Wasm::Plan::pendingPromise):
2421         (JSC::Wasm::Plan::vm):
2422         (JSC::Wasm::Plan::errorMessage):
2423         (JSC::Wasm::Plan::failed):
2424         (JSC::Wasm::Plan::hasWork):
2425         (JSC::Wasm::Plan::hasBeenPrepared):
2426         * wasm/WasmPlanInlines.h: Copied from Source/JavaScriptCore/wasm/WasmB3IRGenerator.h.
2427         (JSC::Wasm::Plan::initializeCallees):
2428         * wasm/WasmValidate.cpp:
2429         * wasm/WasmWorklist.cpp: Added.
2430         (JSC::Wasm::Worklist::priorityString):
2431         (JSC::Wasm::Worklist::QueueElement::setToNextPriority):
2432         (JSC::Wasm::Worklist::iterate):
2433         (JSC::Wasm::Worklist::enqueue):
2434         (JSC::Wasm::Worklist::completePlanSynchronously):
2435         (JSC::Wasm::Worklist::stopAllPlansForVM):
2436         (JSC::Wasm::Worklist::Worklist):
2437         (JSC::Wasm::Worklist::~Worklist):
2438         (JSC::Wasm::existingWorklistOrNull):
2439         (JSC::Wasm::ensureWorklist):
2440         * wasm/WasmWorklist.h: Added.
2441         (JSC::Wasm::Worklist::nextTicket):
2442         (JSC::Wasm::Worklist::Comparator::operator()):
2443         * wasm/js/JSWebAssemblyCallee.h:
2444         * wasm/js/JSWebAssemblyCodeBlock.cpp:
2445         (JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
2446         (JSC::JSWebAssemblyCodeBlock::initialize):
2447         (JSC::JSWebAssemblyCodeBlock::isSafeToRun):
2448         * wasm/js/JSWebAssemblyCodeBlock.h:
2449         (JSC::JSWebAssemblyCodeBlock::create):
2450         (JSC::JSWebAssemblyCodeBlock::initialized):
2451         (JSC::JSWebAssemblyCodeBlock::plan):
2452         (JSC::JSWebAssemblyCodeBlock::runnable):
2453         (JSC::JSWebAssemblyCodeBlock::errorMessage):
2454         (JSC::JSWebAssemblyCodeBlock::callees):
2455         * wasm/js/JSWebAssemblyHelpers.h:
2456         (JSC::createSourceBufferFromValue):
2457         * wasm/js/JSWebAssemblyInstance.cpp:
2458         (JSC::JSWebAssemblyInstance::finishCreation):
2459         (JSC::JSWebAssemblyInstance::visitChildren):
2460         (JSC::JSWebAssemblyInstance::addUnitializedCodeBlock):
2461         (JSC::JSWebAssemblyInstance::finalizeCreation):
2462         (JSC::JSWebAssemblyInstance::create):
2463         (JSC::JSWebAssemblyInstance::setMemory): Deleted.
2464         * wasm/js/JSWebAssemblyInstance.h:
2465         (JSC::JSWebAssemblyInstance::codeBlock):
2466         (JSC::JSWebAssemblyInstance::initialized):
2467         (JSC::JSWebAssemblyInstance::module):
2468         (JSC::JSWebAssemblyInstance::importFunction):
2469         (JSC::JSWebAssemblyInstance::setMemory):
2470         (JSC::JSWebAssemblyInstance::table):
2471         (JSC::JSWebAssemblyInstance::importFunctions):
2472         (JSC::JSWebAssemblyInstance::setImportFunction): Deleted.
2473         (JSC::JSWebAssemblyInstance::setTable): Deleted.
2474         * wasm/js/JSWebAssemblyModule.cpp:
2475         (JSC::JSWebAssemblyModule::createStub):
2476         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
2477         (JSC::JSWebAssemblyModule::finishCreation):
2478         (JSC::JSWebAssemblyModule::setCodeBlock):
2479         (JSC::JSWebAssemblyModule::buildCodeBlock): Deleted.
2480         (JSC::JSWebAssemblyModule::create): Deleted.
2481         (JSC::JSWebAssemblyModule::codeBlock): Deleted.
2482         * wasm/js/JSWebAssemblyModule.h:
2483         (JSC::JSWebAssemblyModule::moduleInformation):
2484         (JSC::JSWebAssemblyModule::codeBlock):
2485         (JSC::JSWebAssemblyModule::source):
2486         (JSC::JSWebAssemblyModule::takeReservedMemory): Deleted.
2487         (JSC::JSWebAssemblyModule::codeBlockFor): Deleted.
2488         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2489         (JSC::constructJSWebAssemblyInstance):
2490         (JSC::WebAssemblyInstanceConstructor::createInstance): Deleted.
2491         * wasm/js/WebAssemblyModuleConstructor.cpp:
2492         (JSC::WebAssemblyModuleConstructor::createModule):
2493         * wasm/js/WebAssemblyModulePrototype.cpp:
2494         (JSC::webAssemblyModuleProtoImports):
2495         (JSC::webAssemblyModuleProtoExports):
2496         * wasm/js/WebAssemblyModuleRecord.cpp:
2497         (JSC::WebAssemblyModuleRecord::finishCreation):
2498         (JSC::WebAssemblyModuleRecord::link):
2499         (JSC::WebAssemblyModuleRecord::evaluate):
2500         * wasm/js/WebAssemblyModuleRecord.h:
2501
2502 2017-03-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2503
2504         WebAssembly: add fallback to use pinned register to load/store state
2505         https://bugs.webkit.org/show_bug.cgi?id=169773
2506
2507         Reviewed by Saam Barati.
2508
2509         This patch adds a new pinned register to hold JSWebAssemblyInstance,
2510         which is used to represent the context of running Wasm code.
2511         While we use fast TLS to hold the context in macOS, we do not have
2512         any system reserved fast TLS slot in the other systems. This pinned
2513         register approach is used in these systems. These changes decouple
2514         VM from Wasm module to make Wasm module position independent code.
2515
2516         While using fast TLS could be beneficial in x64 systems which number of
2517         registers is relatively small, pinned register approach could be
2518         beneficial in ARM64 which has plenty of registers. In macOS, we can
2519         switch the implementation with the runtime flag. Thus macOS port can
2520         compare the performance and decide which implementation is used after
2521         landing this patch.
2522
2523         * heap/MarkedBlock.h:
2524         (JSC::MarkedBlock::offsetOfVM):
2525         * jit/AssemblyHelpers.cpp:
2526         (JSC::AssemblyHelpers::loadWasmContext):
2527         (JSC::AssemblyHelpers::storeWasmContext):
2528         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister):
2529         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister):
2530         * jit/AssemblyHelpers.h:
2531         (JSC::AssemblyHelpers::loadWasmContext): Deleted.
2532         (JSC::AssemblyHelpers::storeWasmContext): Deleted.
2533         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister): Deleted.
2534         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister): Deleted.
2535         * jit/Repatch.cpp:
2536         (JSC::webAssemblyOwner):
2537         (JSC::linkFor):
2538         (JSC::linkPolymorphicCall):
2539         (JSC::isWebAssemblyToJSCallee): Deleted.
2540         * jit/ThunkGenerators.cpp:
2541         (JSC::throwExceptionFromWasmThunkGenerator):
2542         * llint/LLIntData.cpp:
2543         (JSC::LLInt::Data::performAssertions):
2544         * llint/LowLevelInterpreter.asm:
2545         * runtime/JSCell.cpp:
2546         (JSC::JSCell::isAnyWasmCallee):
2547         * runtime/JSCellInlines.h:
2548         (JSC::isWebAssemblyToJSCallee):
2549         * runtime/JSType.h:
2550         * runtime/StackFrame.cpp:
2551         (JSC::StackFrame::functionName):
2552         * runtime/VM.cpp:
2553         (JSC::VM::VM):
2554         * runtime/VM.h:
2555         (JSC::VM::wasmContextOffset):
2556         * wasm/WasmB3IRGenerator.cpp:
2557         (JSC::Wasm::B3IRGenerator::materializeWasmContext):
2558         (JSC::Wasm::B3IRGenerator::restoreWasmContext):
2559         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
2560         (JSC::Wasm::getMemoryBaseAndSize):
2561         (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
2562         (JSC::Wasm::createJSToWasmWrapper):
2563         (JSC::Wasm::loadWasmContext): Deleted.
2564         (JSC::Wasm::storeWasmContext): Deleted.
2565         (JSC::Wasm::restoreWebAssemblyGlobalState): Deleted.
2566         * wasm/WasmBinding.cpp:
2567         (JSC::Wasm::wasmToJs):
2568         * wasm/WasmContext.cpp:
2569         (JSC::loadWasmContext):
2570         (JSC::storeWasmContext):
2571         * wasm/WasmContext.h:
2572         * wasm/WasmMemoryInformation.cpp:
2573         (JSC::Wasm::getPinnedRegisters):
2574         (JSC::Wasm::PinnedRegisterInfo::get):
2575         (JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):
2576         * wasm/WasmMemoryInformation.h:
2577         (JSC::Wasm::PinnedRegisterInfo::toSave):
2578         (JSC::Wasm::useFastTLS):
2579         (JSC::Wasm::useFastTLSForWasmContext):
2580         * wasm/js/JSWebAssemblyInstance.cpp:
2581         (JSC::JSWebAssemblyInstance::finishCreation):
2582         (JSC::JSWebAssemblyInstance::visitChildren):
2583         * wasm/js/JSWebAssemblyInstance.h:
2584         (JSC::JSWebAssemblyInstance::offsetOfCallee):
2585         * wasm/js/JSWebAssemblyModule.cpp:
2586         (JSC::JSWebAssemblyModule::finishCreation):
2587         (JSC::JSWebAssemblyModule::visitChildren):
2588         * wasm/js/JSWebAssemblyModule.h:
2589         (JSC::JSWebAssemblyModule::callee):
2590         * wasm/js/WebAssemblyFunction.cpp:
2591         (JSC::callWebAssemblyFunction):
2592         (JSC::WebAssemblyFunction::create):
2593         * wasm/js/WebAssemblyToJSCallee.cpp:
2594         (JSC::WebAssemblyToJSCallee::create):
2595         (JSC::WebAssemblyToJSCallee::createStructure):
2596         (JSC::WebAssemblyToJSCallee::finishCreation):
2597         (JSC::WebAssemblyToJSCallee::visitChildren):
2598         (JSC::WebAssemblyToJSCallee::destroy): Deleted.
2599         * wasm/js/WebAssemblyToJSCallee.h:
2600
2601 2017-03-28  Brian Burg  <bburg@apple.com>
2602
2603         Web Inspector: Add "Disable Caches" option that only applies to the inspected page while Web Inspector is open
2604         https://bugs.webkit.org/show_bug.cgi?id=169865
2605         <rdar://problem/31250573>
2606
2607         Reviewed by Joseph Pecoraro.
2608
2609         * inspector/protocol/Network.json:
2610         Rename the command for disabling resource caching to match the WebCore::Page
2611         flag. This also removes the possibility that this could be confused for the old,
2612         buggy command that this patch rips out.
2613
2614 2017-03-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2615
2616         [JSC] Move platformThreadSignal to WTF
2617         https://bugs.webkit.org/show_bug.cgi?id=170097
2618
2619         Reviewed by Mark Lam.
2620
2621         It is a small clean up towards https://bugs.webkit.org/show_bug.cgi?id=170027.
2622         platformThreadSignal uses PlatformThread in JSC, but it can be implemented in
2623         WTF ThreadIdentifier.
2624
2625         * runtime/JSLock.cpp:
2626         (JSC::JSLock::lock):
2627         * runtime/JSLock.h:
2628         (JSC::JSLock::ownerThread):
2629         (JSC::JSLock::currentThreadIsHoldingLock):
2630         * runtime/PlatformThread.h:
2631         (JSC::platformThreadSignal): Deleted.
2632         * runtime/VM.h:
2633         (JSC::VM::ownerThread):
2634         * runtime/VMTraps.cpp:
2635         (JSC::VMTraps::SignalSender::send):
2636
2637 2017-03-28  JF Bastien  <jfbastien@apple.com>
2638
2639         WebAssembly: implement Module imports/exports
2640         https://bugs.webkit.org/show_bug.cgi?id=166982
2641
2642         Reviewed by Saam Barati.
2643
2644         As defined in: https://github.com/WebAssembly/design/commit/18cbacb90cd3584dd5c9aa3d392e4e55f66af6ab
2645
2646         * wasm/WasmFormat.h:
2647         (JSC::Wasm::makeString): use uppercase instead, it was only used
2648         for diagnostic but is now used for the expected JS property's
2649         capitalization
2650         * wasm/js/WebAssemblyModulePrototype.cpp:
2651         (JSC::webAssemblyModuleProtoImports):
2652         (JSC::webAssemblyModuleProtoExports):
2653
2654 2017-03-27  JF Bastien  <jfbastien@apple.com>
2655
2656         WebAssembly: JSWebAssemblyCodeBlock.h belongs in JavaScriptCore/wasm/js not JavaScriptCore/wasm
2657         https://bugs.webkit.org/show_bug.cgi?id=170160
2658
2659         Reviewed by Mark Lam.
2660
2661         * JavaScriptCore.xcodeproj/project.pbxproj:
2662         * wasm/js/JSWebAssemblyCodeBlock.h: Renamed from Source/JavaScriptCore/wasm/JSWebAssemblyCodeBlock.h.
2663
2664 2017-03-27  JF Bastien  <jfbastien@apple.com>
2665
2666         WebAssembly: misc memory testing
2667         https://bugs.webkit.org/show_bug.cgi?id=170137
2668
2669         Reviewed by Keith Miller.
2670
2671         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2672         (JSC::WebAssemblyInstanceConstructor::createInstance): improve error messages
2673
2674 2017-03-27  Michael Saboff  <msaboff@apple.com>
2675
2676         Add ARM64 system instructions to disassembler
2677         https://bugs.webkit.org/show_bug.cgi?id=170084
2678
2679         Reviewed by Saam Barati.
2680
2681         This changes adds support for MRS and MSR instructions, and refactors the DMB
2682         disassembly to handle all of the barrier instructions.
2683
2684         * disassembler/ARM64/A64DOpcode.cpp:
2685         (JSC::ARM64Disassembler::A64DOpcodeMSRImmediate::format):
2686         (JSC::ARM64Disassembler::A64DOpcodeMSROrMRSRegister::format):
2687         (JSC::ARM64Disassembler::A64DOpcodeSystemSync::format):
2688         (JSC::ARM64Disassembler::A64DOpcodeDmb::format): Deleted.
2689         * disassembler/ARM64/A64DOpcode.h:
2690         (JSC::ARM64Disassembler::A64DOpcodeSystem::lBit):
2691         (JSC::ARM64Disassembler::A64DOpcodeSystem::op0):
2692         (JSC::ARM64Disassembler::A64DOpcodeSystem::op1):
2693         (JSC::ARM64Disassembler::A64DOpcodeSystem::crN):
2694         (JSC::ARM64Disassembler::A64DOpcodeSystem::crM):
2695         (JSC::ARM64Disassembler::A64DOpcodeSystem::op2):
2696         (JSC::ARM64Disassembler::A64DOpcodeMSROrMRSRegister::opName):
2697         (JSC::ARM64Disassembler::A64DOpcodeMSROrMRSRegister::systemRegister):
2698         (JSC::ARM64Disassembler::A64DOpcodeSystemSync::opName):
2699         (JSC::ARM64Disassembler::A64DOpcodeSystemSync::option):
2700         (JSC::ARM64Disassembler::A64DOpcodeDmb::opName): Deleted.
2701         (JSC::ARM64Disassembler::A64DOpcodeDmb::option): Deleted.
2702         (JSC::ARM64Disassembler::A64DOpcodeDmb::crM): Deleted.
2703
2704 2017-03-26  Filip Pizlo  <fpizlo@apple.com>
2705
2706         B3::fixSSA should do liveness pruning
2707         https://bugs.webkit.org/show_bug.cgi?id=170111
2708
2709         Reviewed by Saam Barati.
2710
2711         This moves all of the logic of Air::Liveness<> to WTF::Liveness<> and then uses that to
2712         create B3::VariableLiveness. Then this uses VariableLiveness::LiveAtHead to prune Phi
2713         construction.
2714
2715         This makes B3::fixSSA run twice as fast. This is a 13% progression on WasmBench compile
2716         times.
2717
2718         * CMakeLists.txt:
2719         * JavaScriptCore.xcodeproj/project.pbxproj:
2720         * b3/B3BasicBlock.h:
2721         (JSC::B3::BasicBlock::get):
2722         * b3/B3FixSSA.cpp:
2723         (JSC::B3::fixSSA):
2724         * b3/B3VariableLiveness.cpp: Added.
2725         (JSC::B3::VariableLiveness::VariableLiveness):
2726         (JSC::B3::VariableLiveness::~VariableLiveness):
2727         * b3/B3VariableLiveness.h: Added.
2728         (JSC::B3::VariableLivenessAdapter::VariableLivenessAdapter):
2729         (JSC::B3::VariableLivenessAdapter::numIndices):
2730         (JSC::B3::VariableLivenessAdapter::valueToIndex):
2731         (JSC::B3::VariableLivenessAdapter::indexToValue):
2732         (JSC::B3::VariableLivenessAdapter::blockSize):
2733         (JSC::B3::VariableLivenessAdapter::forEachEarlyUse):
2734         (JSC::B3::VariableLivenessAdapter::forEachLateUse):
2735         (JSC::B3::VariableLivenessAdapter::forEachEarlyDef):
2736         (JSC::B3::VariableLivenessAdapter::forEachLateDef):
2737         * b3/air/AirCFG.h: Added.
2738         (JSC::B3::Air::CFG::CFG):
2739         (JSC::B3::Air::CFG::root):
2740         (JSC::B3::Air::CFG::newMap):
2741         (JSC::B3::Air::CFG::successors):
2742         (JSC::B3::Air::CFG::predecessors):
2743         (JSC::B3::Air::CFG::index):
2744         (JSC::B3::Air::CFG::node):
2745         (JSC::B3::Air::CFG::numNodes):
2746         (JSC::B3::Air::CFG::dump):
2747         * b3/air/AirCode.cpp:
2748         (JSC::B3::Air::Code::Code):
2749         * b3/air/AirCode.h:
2750         (JSC::B3::Air::Code::cfg):
2751         * b3/air/AirLiveness.h:
2752         (JSC::B3::Air::LivenessAdapter::LivenessAdapter):
2753         (JSC::B3::Air::LivenessAdapter::blockSize):
2754         (JSC::B3::Air::LivenessAdapter::forEachEarlyUse):
2755         (JSC::B3::Air::LivenessAdapter::forEachLateUse):
2756         (JSC::B3::Air::LivenessAdapter::forEachEarlyDef):
2757         (JSC::B3::Air::LivenessAdapter::forEachLateDef):
2758         (JSC::B3::Air::TmpLivenessAdapter::TmpLivenessAdapter):
2759         (JSC::B3::Air::TmpLivenessAdapter::numIndices):
2760         (JSC::B3::Air::StackSlotLivenessAdapter::StackSlotLivenessAdapter):
2761         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
2762         (JSC::B3::Air::StackSlotLivenessAdapter::indexToValue):
2763         (JSC::B3::Air::Liveness::Liveness):
2764         (JSC::B3::Air::Liveness::LocalCalc::LocalCalc): Deleted.
2765         (JSC::B3::Air::Liveness::LocalCalc::Iterable::Iterable): Deleted.
2766         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::iterator): Deleted.
2767         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator++): Deleted.
2768         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator*): Deleted.
2769         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator==): Deleted.
2770         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator!=): Deleted.
2771         (JSC::B3::Air::Liveness::LocalCalc::Iterable::begin): Deleted.
2772         (JSC::B3::Air::Liveness::LocalCalc::Iterable::end): Deleted.
2773         (JSC::B3::Air::Liveness::LocalCalc::Iterable::contains): Deleted.
2774         (JSC::B3::Air::Liveness::LocalCalc::live): Deleted.
2775         (JSC::B3::Air::Liveness::LocalCalc::isLive): Deleted.
2776         (JSC::B3::Air::Liveness::LocalCalc::execute): Deleted.
2777         (JSC::B3::Air::Liveness::rawLiveAtHead): Deleted.
2778         (JSC::B3::Air::Liveness::Iterable::Iterable): Deleted.
2779         (JSC::B3::Air::Liveness::Iterable::iterator::iterator): Deleted.
2780         (JSC::B3::Air::Liveness::Iterable::iterator::operator*): Deleted.
2781         (JSC::B3::Air::Liveness::Iterable::iterator::operator++): Deleted.
2782         (JSC::B3::Air::Liveness::Iterable::iterator::operator==): Deleted.
2783         (JSC::B3::Air::Liveness::Iterable::iterator::operator!=): Deleted.
2784         (JSC::B3::Air::Liveness::Iterable::begin): Deleted.
2785         (JSC::B3::Air::Liveness::Iterable::end): Deleted.
2786         (JSC::B3::Air::Liveness::Iterable::contains): Deleted.
2787         (JSC::B3::Air::Liveness::liveAtHead): Deleted.
2788         (JSC::B3::Air::Liveness::liveAtTail): Deleted.
2789         (JSC::B3::Air::Liveness::workset): Deleted.
2790
2791 2017-03-25  Filip Pizlo  <fpizlo@apple.com>
2792
2793         Air::Liveness shouldn't need HashSets
2794         https://bugs.webkit.org/show_bug.cgi?id=170102
2795
2796         Reviewed by Yusuke Suzuki.
2797
2798         This converts Air::Liveness<> to no longer use HashSets or BitVectors. This turns out to be
2799         easy because it's cheap enough to do a sorted merge of the things being added to liveAtHead and
2800         the things in the predecessors' liveAtTail. This turns out to be faster - it's a 2% overall
2801         compile time progression on WasmBench.
2802
2803         * b3/B3LowerToAir.cpp:
2804         (JSC::B3::Air::LowerToAir::lower): Add a FIXME unrelated to this patch.
2805         * b3/air/AirLiveness.h:
2806         (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
2807         (JSC::B3::Air::AbstractLiveness::LocalCalc::LocalCalc):
2808         (JSC::B3::Air::AbstractLiveness::rawLiveAtHead):
2809         (JSC::B3::Air::AbstractLiveness::liveAtHead):
2810         (JSC::B3::Air::AbstractLiveness::liveAtTail):
2811         * b3/air/AirTmp.h:
2812         (JSC::B3::Air::Tmp::bank):
2813         (JSC::B3::Air::Tmp::tmpIndex):
2814         * dfg/DFGStoreBarrierClusteringPhase.cpp:
2815
2816 2017-03-26  Filip Pizlo  <fpizlo@apple.com>
2817
2818         Air should use RegisterSet for RegLiveness
2819         https://bugs.webkit.org/show_bug.cgi?id=170108
2820
2821         Reviewed by Yusuke Suzuki.
2822
2823         The biggest change here is the introduction of the new RegLiveness class. This is a
2824         drop-in replacement for the old RegLiveness, which was a specialization of
2825         AbstractLiveness<>, but it's about 30% faster. It gets its speed boost from just using
2826         sets everywhere, which is efficient for registers since RegisterSet is just two (on
2827         x86-64) or three 32-bit (on ARM64) statically allocated words. This looks like a 1%
2828         compile time progression on WasmBench.
2829
2830         * CMakeLists.txt:
2831         * JavaScriptCore.xcodeproj/project.pbxproj:
2832         * b3/B3TimingScope.cpp: Records phase timing totals.
2833         (JSC::B3::TimingScope::TimingScope):
2834         (JSC::B3::TimingScope::~TimingScope):
2835         * b3/B3TimingScope.h:
2836         * b3/air/AirAllocateRegistersByGraphColoring.cpp:
2837         (JSC::B3::Air::allocateRegistersByGraphColoring):
2838         * b3/air/AirLiveness.h: Move code around and rename a bit to make it more like RegLiveness; in particular we want the `iterator` to be called `iterator` not `Iterator`, and we want it to be internal to its iterable. Also rename this template to Liveness, to match the header filename.
2839         (JSC::B3::Air::Liveness::Liveness):
2840         (JSC::B3::Air::Liveness::LocalCalc::LocalCalc):
2841         (JSC::B3::Air::Liveness::LocalCalc::Iterable::Iterable):
2842         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::iterator):
2843         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator++):
2844         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator*):
2845         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator==):
2846         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator!=):
2847         (JSC::B3::Air::Liveness::LocalCalc::Iterable::begin):
2848         (JSC::B3::Air::Liveness::LocalCalc::Iterable::end):
2849         (JSC::B3::Air::Liveness::Iterable::Iterable):
2850         (JSC::B3::Air::Liveness::Iterable::iterator::iterator):
2851         (JSC::B3::Air::RegLivenessAdapter::RegLivenessAdapter): Deleted.
2852         (JSC::B3::Air::RegLivenessAdapter::numIndices): Deleted.
2853         (JSC::B3::Air::RegLivenessAdapter::acceptsBank): Deleted.
2854         (JSC::B3::Air::RegLivenessAdapter::acceptsRole): Deleted.
2855         (JSC::B3::Air::RegLivenessAdapter::valueToIndex): Deleted.
2856         (JSC::B3::Air::RegLivenessAdapter::indexToValue): Deleted.
2857         (JSC::B3::Air::AbstractLiveness::AbstractLiveness): Deleted.
2858         (JSC::B3::Air::AbstractLiveness::LocalCalc::LocalCalc): Deleted.
2859         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::Iterator): Deleted.
2860         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator++): Deleted.
2861         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator*): Deleted.
2862         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator==): Deleted.
2863         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator!=): Deleted.
2864         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::Iterable): Deleted.
2865         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::begin): Deleted.
2866         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::end): Deleted.
2867         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::contains): Deleted.
2868         (JSC::B3::Air::AbstractLiveness::LocalCalc::live): Deleted.
2869         (JSC::B3::Air::AbstractLiveness::LocalCalc::isLive): Deleted.
2870         (JSC::B3::Air::AbstractLiveness::LocalCalc::execute): Deleted.
2871         (JSC::B3::Air::AbstractLiveness::rawLiveAtHead): Deleted.
2872         (JSC::B3::Air::AbstractLiveness::Iterable::Iterable): Deleted.
2873         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::iterator): Deleted.
2874         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator*): Deleted.
2875         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator++): Deleted.
2876         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator==): Deleted.
2877         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator!=): Deleted.
2878         (JSC::B3::Air::AbstractLiveness::Iterable::begin): Deleted.
2879         (JSC::B3::Air::AbstractLiveness::Iterable::end): Deleted.
2880         (JSC::B3::Air::AbstractLiveness::Iterable::contains): Deleted.
2881         (JSC::B3::Air::AbstractLiveness::liveAtHead): Deleted.
2882         (JSC::B3::Air::AbstractLiveness::liveAtTail): Deleted.
2883         (JSC::B3::Air::AbstractLiveness::workset): Deleted.
2884         * b3/air/AirLogRegisterPressure.cpp:
2885         * b3/air/AirLowerAfterRegAlloc.cpp:
2886         * b3/air/AirRegLiveness.cpp: Added.
2887         (JSC::B3::Air::RegLiveness::RegLiveness):
2888         (JSC::B3::Air::RegLiveness::~RegLiveness):
2889         (JSC::B3::Air::RegLiveness::LocalCalc::execute):
2890         * b3/air/AirRegLiveness.h: Added.
2891         (JSC::B3::Air::RegLiveness::LocalCalc::LocalCalc):
2892         (JSC::B3::Air::RegLiveness::LocalCalc::live):
2893         (JSC::B3::Air::RegLiveness::LocalCalc::isLive):
2894         (JSC::B3::Air::RegLiveness::liveAtHead):
2895         (JSC::B3::Air::RegLiveness::liveAtTail):
2896         * b3/air/AirReportUsedRegisters.cpp:
2897         * jit/RegisterSet.h:
2898         (JSC::RegisterSet::add):
2899         (JSC::RegisterSet::remove):
2900         (JSC::RegisterSet::contains):
2901         (JSC::RegisterSet::subsumes):
2902         (JSC::RegisterSet::iterator::iterator):
2903         (JSC::RegisterSet::iterator::operator*):
2904         (JSC::RegisterSet::iterator::operator++):
2905         (JSC::RegisterSet::iterator::operator==):
2906         (JSC::RegisterSet::iterator::operator!=):
2907         (JSC::RegisterSet::begin):
2908         (JSC::RegisterSet::end):
2909
2910 2017-03-25  Filip Pizlo  <fpizlo@apple.com>
2911
2912         Fix wasm by returning after we do TLS.
2913
2914         Rubber stamped by Keith Miller.
2915
2916         * jit/AssemblyHelpers.h:
2917         (JSC::AssemblyHelpers::storeWasmContext):
2918
2919 2017-03-24  Mark Lam  <mark.lam@apple.com>
2920
2921         Add some instrumentation in Heap::resumeThePeriphery() to help debug an issue.
2922         https://bugs.webkit.org/show_bug.cgi?id=170086
2923         <rdar://problem/31253673>
2924
2925         Reviewed by Saam Barati.
2926
2927         Adding some instrumentation in Heap::resumeThePeriphery() to dump some Heap state
2928         just before we RELEASE_ASSERT_NOT_REACHED.
2929
2930         * heap/Heap.cpp:
2931         (JSC::Heap::resumeThePeriphery):
2932
2933 2017-03-24  JF Bastien  <jfbastien@apple.com>
2934
2935         WebAssembly: store state in TLS instead of on VM
2936         https://bugs.webkit.org/show_bug.cgi?id=169611
2937
2938         Reviewed by Filip Pizlo.
2939
2940         Using thread-local storage instead of VM makes code more position
2941         independent. We used to store the WebAssembly top Instance (the
2942         latest one in the call stack) on VM, now we instead store it in
2943         TLS. This top Instance is used to access a bunch of state such as
2944         Memory location, size, table (for call_indirect), etc.
2945
2946         Instead of calling it "top", which is confusing, we now just call
2947         it WasmContext.
2948
2949         Making the code PIC means future patches will be able to
2950         postMessage and structured clone into IDB without having to
2951         recompile the code. This wasn't possible before because we
2952         hard-coded the address of VM at compilation time. That doesn't
2953         work between workers, and doesn't work across reloads (which IDB
2954         is intended to do).
2955
2956         It'll also potentially make code faster once we start tuning
2957         what's in TLS, what's in which of the 4 free slots, and what's in
2958         pinned registers. I'm leaving this tuning for later because
2959         there's lower lying fruit for us to pick.
2960
2961         * CMakeLists.txt:
2962         * JavaScriptCore.xcodeproj/project.pbxproj:
2963         * assembler/AbstractMacroAssembler.h:
2964         * assembler/AllowMacroScratchRegisterUsageIf.h: Copied from assembler/AllowMacroScratchRegisterUsage.h.
2965         (JSC::AllowMacroScratchRegisterUsageIf::AllowMacroScratchRegisterUsageIf):
2966         (JSC::AllowMacroScratchRegisterUsageIf::~AllowMacroScratchRegisterUsageIf):
2967         * assembler/MacroAssembler.h:
2968         (JSC::MacroAssembler::storeToTLSPtr): we previously didn't have
2969         the code required to store to TLS, only to load
2970         * assembler/MacroAssemblerARM64.h:
2971         (JSC::MacroAssemblerARM64::loadFromTLSPtrNeedsMacroScratchRegister):
2972         (JSC::MacroAssemblerARM64::storeToTLS32):
2973         (JSC::MacroAssemblerARM64::storeToTLS64):
2974         (JSC::MacroAssemblerARM64::storeToTLSPtrNeedsMacroScratchRegister):
2975         * assembler/MacroAssemblerX86Common.h:
2976         (JSC::MacroAssemblerX86Common::loadFromTLSPtrNeedsMacroScratchRegister):
2977         (JSC::MacroAssemblerX86Common::storeToTLS32):
2978         (JSC::MacroAssemblerX86Common::storeToTLSPtrNeedsMacroScratchRegister):
2979         * assembler/MacroAssemblerX86_64.h:
2980         (JSC::MacroAssemblerX86_64::loadFromTLS64): was loading 32-bit instead of 64-bit
2981         (JSC::MacroAssemblerX86_64::storeToTLS64):
2982         * assembler/X86Assembler.h:
2983         (JSC::X86Assembler::movl_rm):
2984         (JSC::X86Assembler::movq_rm):
2985         * b3/testb3.cpp:
2986         (JSC::B3::testFastTLSLoad):
2987         (JSC::B3::testFastTLSStore):
2988         (JSC::B3::run):
2989         * jit/AssemblyHelpers.h:
2990         (JSC::AssemblyHelpers::loadWasmContext):
2991         (JSC::AssemblyHelpers::storeWasmContext):
2992         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister):
2993         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister):
2994         * jit/Repatch.cpp:
2995         (JSC::webAssemblyOwner):
2996         * jit/ThunkGenerators.cpp:
2997         (JSC::throwExceptionFromWasmThunkGenerator):
2998         * runtime/Options.h:
2999         * runtime/VM.cpp:
3000         (JSC::VM::VM):
3001         * runtime/VM.h:
3002         * wasm/WasmB3IRGenerator.cpp:
3003         (JSC::Wasm::loadWasmContext):
3004         (JSC::Wasm::storeWasmContext):
3005         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
3006         (JSC::Wasm::getMemoryBaseAndSize):
3007         (JSC::Wasm::restoreWebAssemblyGlobalState):
3008         (JSC::Wasm::createJSToWasmWrapper):
3009         (JSC::Wasm::parseAndCompile):
3010         * wasm/WasmBinding.cpp:
3011         (JSC::Wasm::materializeImportJSCell):
3012         (JSC::Wasm::wasmToJs):
3013         (JSC::Wasm::wasmToWasm):
3014         * wasm/WasmContext.cpp: Added.
3015         (JSC::loadWasmContext):
3016         (JSC::storeWasmContext):
3017         * wasm/WasmContext.h: Added. Replaces "top" JSWebAssemblyInstance.
3018         * wasm/js/WebAssemblyFunction.cpp:
3019         (JSC::callWebAssemblyFunction):
3020         * wasm/js/WebAssemblyInstanceConstructor.h:
3021
3022 2017-03-24  JF Bastien  <jfbastien@apple.com>
3023
3024         WebAssembly: spec-tests/memory.wast.js fails in debug
3025         https://bugs.webkit.org/show_bug.cgi?id=169794
3026
3027         Reviewed by Keith Miller.
3028
3029         The failure was due to empty memories (with maximum size 0). Those
3030         only occur in tests and in code that's trying to trip us. This
3031         patch adds memory mode "none" which represents no memory. It can
3032         work with either bounds checked or signaling code because it never
3033         contains loads and stores.
3034
3035         The spec tests which were failing did the following:
3036             > (module (memory (data)) (func (export "memsize") (result i32) (current_memory)))
3037             > (assert_return (invoke "memsize") (i32.const 0))
3038             > (module (memory (data "")) (func (export "memsize") (result i32) (current_memory)))
3039             > (assert_return (invoke "memsize") (i32.const 0))
3040             > (module (memory (data "x")) (func (export "memsize") (result i32) (current_memory)))
3041             > (assert_return (invoke "memsize") (i32.const 1))
3042
3043         * wasm/WasmB3IRGenerator.cpp:
3044         (JSC::Wasm::B3IRGenerator::memoryKind):
3045         * wasm/WasmMemory.cpp:
3046         (JSC::Wasm::tryGetFastMemory):
3047         (JSC::Wasm::releaseFastMemory):
3048         (JSC::Wasm::Memory::Memory):
3049         (JSC::Wasm::Memory::createImpl):
3050         (JSC::Wasm::Memory::create):
3051         (JSC::Wasm::Memory::grow):
3052         (JSC::Wasm::Memory::makeString):
3053         * wasm/WasmMemory.h:
3054         * wasm/WasmMemoryInformation.cpp:
3055         (JSC::Wasm::MemoryInformation::MemoryInformation):
3056         * wasm/js/JSWebAssemblyCodeBlock.cpp:
3057         (JSC::JSWebAssemblyCodeBlock::isSafeToRun):
3058         * wasm/js/JSWebAssemblyModule.cpp:
3059         (JSC::JSWebAssemblyModule::codeBlock):
3060         (JSC::JSWebAssemblyModule::finishCreation):
3061         * wasm/js/JSWebAssemblyModule.h:
3062         (JSC::JSWebAssemblyModule::codeBlock):
3063         (JSC::JSWebAssemblyModule::codeBlockFor):
3064
3065 2017-03-24  Mark Lam  <mark.lam@apple.com>
3066
3067         Array memcpy'ing fast paths should check if we're having a bad time if they cannot handle it.
3068         https://bugs.webkit.org/show_bug.cgi?id=170064
3069         <rdar://problem/31246098>
3070
3071         Reviewed by Geoffrey Garen.
3072
3073         * runtime/ArrayPrototype.cpp:
3074         (JSC::arrayProtoPrivateFuncConcatMemcpy):
3075         * runtime/JSArray.cpp:
3076         (JSC::JSArray::fastSlice):
3077
3078 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3079
3080         [JSC] Use jsNontrivialString agressively for ToString(Int52)
3081         https://bugs.webkit.org/show_bug.cgi?id=170002
3082
3083         Reviewed by Sam Weinig.
3084
3085         We use the same logic used for Int32 to use jsNontvirialString.
3086         After single character check, produced string is always longer than 1.
3087         Thus, we can use jsNontrivialString.
3088
3089         * runtime/NumberPrototype.cpp:
3090         (JSC::int52ToString):
3091
3092 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3093
3094         [JSC] Use WeakRandom for SamplingProfiler interval fluctuation
3095         https://bugs.webkit.org/show_bug.cgi?id=170045
3096
3097         Reviewed by Mark Lam.
3098
3099         It is unnecessary to use cryptographicallyRandomNumber for SamplingProfiler
3100         interval fluctuation. Use WeakRandom instead.
3101
3102         * runtime/SamplingProfiler.cpp:
3103         (JSC::SamplingProfiler::SamplingProfiler):
3104         (JSC::SamplingProfiler::timerLoop):
3105         * runtime/SamplingProfiler.h:
3106
3107 2017-03-23  Mark Lam  <mark.lam@apple.com>
3108
3109         Array.prototype.splice behaves incorrectly when the VM is "having a bad time".
3110         https://bugs.webkit.org/show_bug.cgi?id=170025
3111         <rdar://problem/31228679>
3112
3113         Reviewed by Saam Barati.
3114
3115         * runtime/ArrayPrototype.cpp:
3116         (JSC::copySplicedArrayElements):
3117         (JSC::arrayProtoFuncSplice):
3118
3119 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3120
3121         [JSC][DFG] Make addShouldSpeculateAnyInt more conservative to avoid regression caused by Double <-> Int52 conversions
3122         https://bugs.webkit.org/show_bug.cgi?id=169998
3123
3124         Reviewed by Saam Barati.
3125
3126         Double <-> Int52 and JSValue <-> Int52 conversions are not so cheap. Thus, Int52Rep is super carefully emitted.
3127         We make addShouldSpeculateAnyInt more conservative to avoid regressions caused by the above conversions.
3128         We select ArithAdd(Int52, Int52) only when this calculation is beneficial compared to added Int52Rep conversions.
3129
3130         This patch tighten the conditions of addShouldSpeculateAnyInt.
3131
3132         1. Honor DoubleConstant.
3133
3134         When executing imaging-darkroom, we have a thing like that,
3135
3136             132:< 2:loc36> DoubleConstant(Double|UseAsOther, AnyIntAsDouble, Double: 4607182418800017408, 1.000000, bc#114)
3137             1320:< 1:loc38>        Int52Rep(Check:Int32:@82, Int52|PureInt, Int32, Exits, bc#114)
3138             1321:< 1:loc39>        Int52Constant(Int52|PureInt, Boolint32Nonboolint32Int52, Double: 4607182418800017408, 1.000000, bc#114)
3139             133:<!3:loc39> ArithSub(Int52Rep:@1320<Int52>, Int52Rep:@1321<Int52>, Int52|MustGen, Int52, CheckOverflow, Exits, bc#114)
3140
3141         The LHS of ArithSub says predicting Boolint32, and the rhs says AnyIntAsDouble. Thus we select ArithSub(Int52, Int52) instead
3142         of ArithSub(Double, Double). However, it soon causes OSR exits. In imaging-darkroom, LHS's Int32 prediction will be broken.
3143         While speculating Int32 in the above situation is reasonable approach since the given LHS says predicting Int32, this causes
3144         severe performance regression.
3145
3146         Previously, we always select ArithSub(Double, Double). So accidentally, we do not encounter this misprediction issue.
3147
3148         One thing can be found that we have DoubleConstant in the RHS. It means that we have `1.0` instead of `1` in the code.
3149         We can see the code like `lhs - 1.0` instead of `lhs - 1` in imaging-darkroom. It offers good information that lhs and
3150         the resulting value would be double. Handling the above ArithSub in double seems more appropriate rather than handling
3151         it in Int52.
3152
3153         So, in this patch, we honor DoubleConstant. If we find DoubleConstant on one operand, we give up selecting
3154         Arith[Sub,Add](Int52, Int52). This change removes OSR exits occurr in imaging-darkroom right now.
3155
3156         2. Two Int52Rep(Double) conversions are not desirable.
3157
3158         We allow AnyInt ArithAdd only when the one operand of the binary operation should be speculated AnyInt. It is a bit conservative
3159         decision. This is because Double to Int52 conversion is not so cheap. Frequent back-and-forth conversions between Double and Int52
3160         rather hurt the performance. If the one operand of the operation is already Int52, the cost for constructing ArithAdd becomes
3161         cheap since only one Double to Int52 conversion could be required.
3162         This recovers some regression in assorted tests while keeping kraken crypto improvements.
3163
3164         3. Avoid frequent Int52 to JSValue conversions.
3165
3166         Int52 to JSValue conversion is not so cheap. Thus, we would like to avoid such situations. So, in this patch, we allow
3167         Arith(Int52, Int52) with AnyIntAsDouble operand only when the node is used as number. By doing so, we avoid the case like,
3168         converting Int52, performing ArithAdd, and soon converting back to JSValue.
3169
3170         The above 3 changes recover the regression measured in microbenchmarks/int52-back-and-forth.js and assorted benchmarks.
3171         And still it keeps kraken crypto improvements.
3172
3173                                                    baseline                  patched
3174
3175         imaging-darkroom                       201.112+-3.192      ^     189.532+-2.883         ^ definitely 1.0611x faster
3176         stanford-crypto-pbkdf2                 103.953+-2.325            100.926+-2.396           might be 1.0300x faster
3177         stanford-crypto-sha256-iterative        35.103+-1.071      ?      36.049+-1.143         ? might be 1.0270x slower
3178
3179         * dfg/DFGGraph.h:
3180         (JSC::DFG::Graph::addShouldSpeculateAnyInt):
3181
3182 == Rolled over to ChangeLog-2017-03-23 ==