Source/JavaScriptCore/ChangeLog

   1 2012-03-26  Filip Pizlo  <fpizlo@apple.com>
   2
   3         DFG should assert that argument value recoveries can only be
   4         AlreadyInRegisterFile or Constant
   5         https://bugs.webkit.org/show_bug.cgi?id=82249
   6
   7         Reviewed by Michael Saboff.
   8
   9         Made the assertions that the DFG makes for argument value recoveries match
  10         what Arguments expects.
  11
  12         * bytecode/ValueRecovery.h:
  13         (JSC::ValueRecovery::isConstant):
  14         (ValueRecovery):
  15         (JSC::ValueRecovery::isAlreadyInRegisterFile):
  16         * dfg/DFGSpeculativeJIT.cpp:
  17         (JSC::DFG::SpeculativeJIT::compile):
  18
  19 2012-03-26  Dan Bernstein  <mitz@apple.com>
  20
  21         Tried to fix the Windows build.
  22
  23         * yarr/YarrPattern.cpp:
  24         (JSC::Yarr::CharacterClassConstructor::putRange):
  25
  26 2012-03-26  Gavin Barraclough  <barraclough@apple.com>
  27
  28         Unreviewed - speculative Windows build fix.
  29
  30         * yarr/YarrCanonicalizeUCS2.h:
  31         (JSC::Yarr::getCanonicalPair):
  32
  33 2012-03-26  Dan Bernstein  <mitz@apple.com>
  34
  35         Fixed builds with assertions disabled.
  36
  37         * yarr/YarrCanonicalizeUCS2.h:
  38         (JSC::Yarr::areCanonicallyEquivalent):
  39
  40 2012-03-26  Gavin Barraclough  <barraclough@apple.com>
  41
  42         Unreviewed - errk! - accidentally the whole pbxproj.
  43
  44         * JavaScriptCore.xcodeproj/project.pbxproj:
  45
  46 2012-03-25  Gavin Barraclough  <barraclough@apple.com>
  47
  48         Greek sigma is handled wrong in case independent regexp.
  49         https://bugs.webkit.org/show_bug.cgi?id=82063
  50
  51         Reviewed by Oliver Hunt.
  52
  53         The bug here is that we assume that any given codepoint has at most one additional value it
  54         should match under a case insensitive match, and that the pair of codepoints that match (if
  55         a codepoint does not only match itself) can be determined by calling toUpper/toLower on the
  56         given codepoint). Life is not that simple.
  57
  58         Instead, pre-calculate a set of tables mapping from a UCS2 codepoint to the set of characters
  59         it may match, under the ES5.1 case-insensitive matching rules. Since unicode is fairly regular
  60         we can pack this table quite nicely, and get it down to 364 entries. This means we can use a
  61         simple binary search to find an entry in typically eight compares.
  62
  63         * CMakeLists.txt:
  64         * GNUmakefile.list.am:
  65         * JavaScriptCore.gypi:
  66         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
  67         * JavaScriptCore.xcodeproj/project.pbxproj:
  68         * yarr/yarr.pri:
  69             - Added new files to build systems.
  70         * yarr/YarrCanonicalizeUCS2.cpp: Added.
  71             - New - autogenerated, UCS2 canonicalized comparison tables.
  72         * yarr/YarrCanonicalizeUCS2.h: Added.
  73         (JSC::Yarr::rangeInfoFor):
  74             - Look up the canonicalization info for a UCS2 character.
  75         (JSC::Yarr::getCanonicalPair):
  76             - For a UCS2 character with a single equivalent value, look it up.
  77         (JSC::Yarr::isCanonicallyUnique):
  78             - Returns true if no other UCS2 code points are canonically equal.
  79         (JSC::Yarr::areCanonicallyEquivalent):
  80             - Compare two values, under canonicalization rules.
  81         * yarr/YarrCanonicalizeUCS2.js: Added.
  82             - script used to generate YarrCanonicalizeUCS2.cpp.
  83         * yarr/YarrInterpreter.cpp:
  84         (JSC::Yarr::Interpreter::tryConsumeBackReference):
  85             - Use isCanonicallyUnique, rather than Unicode toUpper/toLower.
  86         * yarr/YarrJIT.cpp:
  87         (JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
  88         (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
  89         (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
  90             - Use isCanonicallyUnique, rather than Unicode toUpper/toLower.
  91         * yarr/YarrPattern.cpp:
  92         (JSC::Yarr::CharacterClassConstructor::putChar):
  93             - Updated to determine canonical equivalents correctly.
  94         (JSC::Yarr::CharacterClassConstructor::putUnicodeIgnoreCase):
  95             - Added, used to put a non-ascii, non-unique character in a case-insensitive match.
  96         (JSC::Yarr::CharacterClassConstructor::putRange):
  97             - Updated to determine canonical equivalents correctly.
  98         (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
  99             - Changed to call putUnicodeIgnoreCase, instead of putChar, avoid a double lookup of rangeInfo.
 100
 101 2012-03-26  Kevin Ollivier  <kevino@theolliviers.com>
 102
 103         [wx] Unreviewed build fix. Add the build outputs dir to the list of build dirs,
 104         so we make sure it finds the API headers on all platforms.
 105
 106         * wscript:
 107
 108 2012-03-26  Patrick Gansterer  <paroga@webkit.org>
 109
 110         Build fix for WinCE after r112039.
 111
 112         * interpreter/Register.h:
 113         (Register): Removed inline keyword from decleration since
 114                     there is an ALWAYS_INLINE at the definition anyway.
 115
 116 2012-03-26  Carlos Garcia Campos  <cgarcia@igalia.com>
 117
 118         Unreviewed. Fix make distcheck.
 119
 120         * GNUmakefile.list.am: Add missing files.
 121
 122 2012-03-25  Kevin Ollivier  <kevino@theolliviers.com>
 123
 124         [wx] Unreviewed build fix. Move WTF to its own static lib build.
 125
 126         * wscript:
 127
 128 2012-03-25  Filip Pizlo  <fpizlo@apple.com>
 129
 130         DFG int-to-double conversion should be revealed to CSE
 131         https://bugs.webkit.org/show_bug.cgi?id=82135
 132
 133         Reviewed by Oliver Hunt.
 134
 135         This introduces the notion of an Int32ToDouble node, which is injected
 136         into the graph anytime we know that we have a double use of a node that
 137         was predicted integer. The Int32ToDouble simplifies double speculation
 138         on integers by skipping the path that would unbox doubles, if we know
 139         that the value is already proven to be an integer. It allows integer to
 140         double conversions to be subjected to common subexpression elimination
 141         (CSE) by allowing the CSE phase to see where these conversions are
 142         occurring. Finally, it allows us to see when a constant is being used
 143         as both a double and an integer. This is a bit odd, since it means that
 144         sometimes a double use of a constant will not refer directly to the
 145         constant. This should not cause problems, for now, but it may require
 146         some canonizalization in the future if we want to support strength
 147         reductions of double operations based on constants.
 148
 149         To allow injection of nodes into the graph, this change introduces the
 150         DFG::InsertionSet, which is a way of lazily inserting elements into a
 151         list. This allows the FixupPhase to remain O(N) despite performing
 152         multiple injections in a single basic block. Without the InsertionSet,
 153         each injection would require performing an insertion into a vector,
 154         which is O(N), leading to O(N^2) performance overall. With the
 155         InsertionSet, each injection simply records what insertion would have
 156         been performed, and all insertions are performed at once (via
 157         InsertionSet::execute) after processing of a basic block is completed.
 158
 159         * JavaScriptCore.xcodeproj/project.pbxproj:
 160         * bytecode/PredictedType.h:
 161         (JSC::isActionableIntMutableArrayPrediction):
 162         (JSC):
 163         (JSC::isActionableFloatMutableArrayPrediction):
 164         (JSC::isActionableTypedMutableArrayPrediction):
 165         (JSC::isActionableMutableArrayPrediction):
 166         * dfg/DFGAbstractState.cpp:
 167         (JSC::DFG::AbstractState::execute):
 168         * dfg/DFGCSEPhase.cpp:
 169         (JSC::DFG::CSEPhase::performNodeCSE):
 170         * dfg/DFGCommon.h:
 171         (JSC::DFG::useKindToString):
 172         (DFG):
 173         * dfg/DFGFixupPhase.cpp:
 174         (JSC::DFG::FixupPhase::run):
 175         (JSC::DFG::FixupPhase::fixupBlock):
 176         (FixupPhase):
 177         (JSC::DFG::FixupPhase::fixupNode):
 178         (JSC::DFG::FixupPhase::fixDoubleEdge):
 179         * dfg/DFGGraph.cpp:
 180         (JSC::DFG::Graph::dump):
 181         * dfg/DFGInsertionSet.h: Added.
 182         (DFG):
 183         (Insertion):
 184         (JSC::DFG::Insertion::Insertion):
 185         (JSC::DFG::Insertion::index):
 186         (JSC::DFG::Insertion::element):
 187         (InsertionSet):
 188         (JSC::DFG::InsertionSet::InsertionSet):
 189         (JSC::DFG::InsertionSet::append):
 190         (JSC::DFG::InsertionSet::execute):
 191         * dfg/DFGNodeType.h:
 192         (DFG):
 193         * dfg/DFGPredictionPropagationPhase.cpp:
 194         (JSC::DFG::PredictionPropagationPhase::propagate):
 195         * dfg/DFGSpeculativeJIT.cpp:
 196         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
 197         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
 198         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
 199         (DFG):
 200         * dfg/DFGSpeculativeJIT.h:
 201         (SpeculativeJIT):
 202         (JSC::DFG::IntegerOperand::IntegerOperand):
 203         (JSC::DFG::DoubleOperand::DoubleOperand):
 204         (JSC::DFG::JSValueOperand::JSValueOperand):
 205         (JSC::DFG::StorageOperand::StorageOperand):
 206         (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
 207         (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
 208         (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
 209         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
 210         (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
 211         * dfg/DFGSpeculativeJIT32_64.cpp:
 212         (JSC::DFG::SpeculativeJIT::compile):
 213         * dfg/DFGSpeculativeJIT64.cpp:
 214         (JSC::DFG::SpeculativeJIT::compile):
 215
 216 2012-03-25  Filip Pizlo  <fpizlo@apple.com>
 217
 218         DFGOperands should be moved out of the DFG and into bytecode
 219         https://bugs.webkit.org/show_bug.cgi?id=82151
 220
 221         Reviewed by Dan Bernstein.
 222
 223         * GNUmakefile.list.am:
 224         * JavaScriptCore.xcodeproj/project.pbxproj:
 225         * bytecode/Operands.h: Copied from Source/JavaScriptCore/dfg/DFGOperands.h.
 226         * dfg/DFGBasicBlock.h:
 227         * dfg/DFGNode.h:
 228         * dfg/DFGOSREntry.h:
 229         * dfg/DFGOSRExit.h:
 230         * dfg/DFGOperands.h: Removed.
 231         * dfg/DFGVariableAccessData.h:
 232
 233 2012-03-24  Filip Pizlo  <fpizlo@apple.com>
 234
 235         DFG 64-bit Branch implementation should not be creating a JSValueOperand that
 236         it isn't going to use
 237         https://bugs.webkit.org/show_bug.cgi?id=82136
 238
 239         Reviewed by Geoff Garen.
 240
 241         * dfg/DFGSpeculativeJIT64.cpp:
 242         (JSC::DFG::SpeculativeJIT::emitBranch):
 243
 244 2012-03-24  Kevin Ollivier  <kevino@theolliviers.com>
 245
 246         [wx] Unreviewed. Fix the build after WTF move.
 247
 248         * wscript:
 249
 250 2012-03-23  Filip Pizlo  <fpizlo@apple.com>
 251
 252         DFG double voting may be overzealous in the case of variables that end up
 253         being used as integers
 254         https://bugs.webkit.org/show_bug.cgi?id=82008
 255
 256         Reviewed by Oliver Hunt.
 257
 258         Cleaned up propagation, making the intent more explicit in most places.
 259         Back-propagate NodeUsedAsInt for cases where a node was used in a context
 260         that is known to strongly prefer integers.
 261
 262         * dfg/DFGByteCodeParser.cpp:
 263         (JSC::DFG::ByteCodeParser::handleCall):
 264         (JSC::DFG::ByteCodeParser::parseBlock):
 265         * dfg/DFGGraph.cpp:
 266         (JSC::DFG::Graph::dumpCodeOrigin):
 267         (JSC::DFG::Graph::dump):
 268         * dfg/DFGGraph.h:
 269         (Graph):
 270         * dfg/DFGNodeFlags.cpp:
 271         (JSC::DFG::nodeFlagsAsString):
 272         * dfg/DFGNodeFlags.h:
 273         (DFG):
 274         * dfg/DFGPredictionPropagationPhase.cpp:
 275         (JSC::DFG::PredictionPropagationPhase::run):
 276         (JSC::DFG::PredictionPropagationPhase::propagate):
 277         (PredictionPropagationPhase):
 278         (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags):
 279         (JSC::DFG::PredictionPropagationPhase::vote):
 280         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
 281         (JSC::DFG::PredictionPropagationPhase::fixupNode):
 282         * dfg/DFGVariableAccessData.h:
 283         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
 284
 285 2012-03-24  Filip Pizlo  <fpizlo@apple.com>
 286
 287         DFG::Node::shouldNotSpeculateInteger() should be eliminated
 288         https://bugs.webkit.org/show_bug.cgi?id=82123
 289
 290         Reviewed by Geoff Garen.
 291
 292         * dfg/DFGAbstractState.cpp:
 293         (JSC::DFG::AbstractState::execute):
 294         * dfg/DFGNode.h:
 295         (Node):
 296         * dfg/DFGSpeculativeJIT.cpp:
 297         (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
 298         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
 299
 300 2012-03-24  Yong Li  <yoli@rim.com>
 301
 302         Increase getByIdSlowCase ConstantSpace/InstructionSpace for CPU(ARM_TRADITIONAL)
 303         https://bugs.webkit.org/show_bug.cgi?id=81521
 304
 305         Increase sequenceGetByIdSlowCaseConstantSpace and sequenceGetByIdSlowCaseInstructionSpace
 306         for CPU(ARM_TRADITIONAL) to fit actual need.
 307
 308         Reviewed by Oliver Hunt.
 309
 310         * jit/JIT.h:
 311         (JIT):
 312
 313 2012-03-23  Filip Pizlo  <fpizlo@apple.com>
 314
 315         DFG Fixup should be able to short-circuit trivial ValueToInt32's
 316         https://bugs.webkit.org/show_bug.cgi?id=82030
 317
 318         Reviewed by Michael Saboff.
 319
 320         Takes the fixup() method of the prediction propagation phase and makes it
 321         into its own phase. Adds the ability to short-circuit trivial ValueToInt32
 322         nodes, and mark pure ValueToInt32's as such.
 323
 324         * CMakeLists.txt:
 325         * GNUmakefile.list.am:
 326         * JavaScriptCore.xcodeproj/project.pbxproj:
 327         * Target.pri:
 328         * dfg/DFGByteCodeParser.cpp:
 329         (JSC::DFG::ByteCodeParser::makeSafe):
 330         (JSC::DFG::ByteCodeParser::handleCall):
 331         (JSC::DFG::ByteCodeParser::parseBlock):
 332         * dfg/DFGCommon.h:
 333         * dfg/DFGDriver.cpp:
 334         (JSC::DFG::compile):
 335         * dfg/DFGFixupPhase.cpp: Added.
 336         (DFG):
 337         (FixupPhase):
 338         (JSC::DFG::FixupPhase::FixupPhase):
 339         (JSC::DFG::FixupPhase::run):
 340         (JSC::DFG::FixupPhase::fixupNode):
 341         (JSC::DFG::FixupPhase::fixIntEdge):
 342         (JSC::DFG::performFixup):
 343         * dfg/DFGFixupPhase.h: Added.
 344         (DFG):
 345         * dfg/DFGPredictionPropagationPhase.cpp:
 346         (JSC::DFG::PredictionPropagationPhase::run):
 347         (PredictionPropagationPhase):
 348
 349 2012-03-23  Mark Hahnenberg  <mhahnenberg@apple.com>
 350
 351         tryReallocate could break the zero-ed memory invariant of CopiedBlocks
 352         https://bugs.webkit.org/show_bug.cgi?id=82087
 353
 354         Reviewed by Filip Pizlo.
 355
 356         Removing this optimization turned out to be ~1% regression on kraken, so I simply
 357         undid the modification to the current block if we fail.
 358
 359         * heap/CopiedSpace.cpp:
 360         (JSC::CopiedSpace::tryReallocate): Undid the reset in the CopiedAllocator if we fail
 361         to reallocate from the current block.
 362
 363 2012-03-23  Alexey Proskuryakov  <ap@apple.com>
 364
 365         [Mac] No need for platform-specific ENABLE_BLOB values
 366         https://bugs.webkit.org/show_bug.cgi?id=82102
 367
 368         Reviewed by David Kilzer.
 369
 370         * Configurations/FeatureDefines.xcconfig:
 371
 372 2012-03-23  Michael Saboff  <msaboff@apple.com>
 373
 374         DFG::compileValueToInt32 Sometime Generates GPR to FPR reg back to GPR
 375         https://bugs.webkit.org/show_bug.cgi?id=81805
 376
 377         Reviewed by Filip Pizlo.
 378
 379         Added SpeculativeJIT::checkGeneratedType() to determine the current format
 380         of an operand.  Used that information in SpeculativeJIT::compileValueToInt32
 381         to generate code that will use integer and JSValue types in integer
 382         format directly without a conversion to double.
 383
 384         * JavaScriptCore.xcodeproj/project.pbxproj:
 385         * dfg/DFGSpeculativeJIT.cpp:
 386         (JSC::DFG::SpeculativeJIT::checkGeneratedType):
 387         (DFG):
 388         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
 389         * dfg/DFGSpeculativeJIT.h:
 390         (DFG):
 391         (SpeculativeJIT):
 392
 393 2012-03-23  Steve Falkenburg  <sfalken@apple.com>
 394
 395         Update Apple Windows build files for WTF move
 396         https://bugs.webkit.org/show_bug.cgi?id=82069
 397
 398         Reviewed by Jessie Berlin.
 399
 400         * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Removed WTF and WTFGenerated.
 401
 402 2012-03-23  Dean Jackson  <dino@apple.com>
 403
 404         Disable CSS_SHADERS in Apple builds
 405         https://bugs.webkit.org/show_bug.cgi?id=81996
 406
 407         Reviewed by Simon Fraser.
 408
 409         Remove ENABLE_CSS_SHADERS from FeatureDefines. It's now in Platform.h.
 410
 411         * Configurations/FeatureDefines.xcconfig:
 412
 413 2012-03-23  Gavin Barraclough  <barraclough@apple.com>
 414
 415         RexExp constructor last match properties should not rely on previous ovector
 416         https://bugs.webkit.org/show_bug.cgi?id=82077
 417
 418         Reviewed by Oliver Hunt.
 419
 420         This change simplifies matching, and will enable subpattern results to be fully lazily generated in the future.
 421
 422         This patch changes the scheme used to lazily generate the last match properties of the RegExp object.
 423         Instead of relying on the results in the ovector, we can instead lazily generate the subpatters using
 424         a RegExpMatchesArray. To do so we just need to store the input, the regexp matched, and the match
 425         location (the MatchResult). When the match is accessed or the input is set, we reify results. We use
 426         a special value of setting the saved result to MatchResult::failed() to indicated that we're in a
 427         reified state. This means that next time a match is performed, the store of the result will
 428         automatically blow away the reified value.
 429
 430         * JavaScriptCore.xcodeproj/project.pbxproj:
 431             - Added new files.
 432         * runtime/RegExp.cpp:
 433         (JSC::RegExpFunctionalTestCollector::outputOneTest):
 434             - changed 'subPattern' -> 'subpattern' (there was a mix in JSC, 'subpattern' was more common).
 435         * runtime/RegExpCachedResult.cpp: Added.
 436         (JSC::RegExpCachedResult::visitChildren):
 437         (JSC::RegExpCachedResult::lastResult):
 438         (JSC::RegExpCachedResult::setInput):
 439             - New methods, mark GC objects, lazily create the matches array, and record a user provided input (via assignment to RegExp.inupt).
 440         * runtime/RegExpCachedResult.h: Added.
 441         (RegExpCachedResult):
 442             - Added new class.
 443         (JSC::RegExpCachedResult::RegExpCachedResult):
 444         (JSC::RegExpCachedResult::record):
 445         (JSC::RegExpCachedResult::input):
 446             - Initialize the object, record the result of a RegExp match, access the stored input property.
 447         * runtime/RegExpConstructor.cpp:
 448         (JSC::RegExpConstructor::RegExpConstructor):
 449             - Initialize m_result/m_multiline properties.
 450         (JSC::RegExpConstructor::visitChildren):
 451             - Make sure the cached results (or lazy source for them) are marked.
 452         (JSC::RegExpConstructor::getBackref):
 453         (JSC::RegExpConstructor::getLastParen):
 454         (JSC::RegExpConstructor::getLeftContext):
 455         (JSC::RegExpConstructor::getRightContext):
 456             - Moved from RegExpConstructor, moved to RegExpCachedResult, and using new caching scheme.
 457         (JSC::regExpConstructorInput):
 458         (JSC::setRegExpConstructorInput):
 459             - Changed to use RegExpCachedResult.
 460         * runtime/RegExpConstructor.h:
 461         (JSC::RegExpConstructor::create):
 462         (RegExpConstructor):
 463         (JSC::RegExpConstructor::setMultiline):
 464         (JSC::RegExpConstructor::multiline):
 465             - Move multiline property onto the constructor object; it is not affected by the last match.
 466         (JSC::RegExpConstructor::setInput):
 467         (JSC::RegExpConstructor::input):
 468             - These defer to RegExpCachedResult.
 469         (JSC::RegExpConstructor::performMatch):
 470         * runtime/RegExpMatchesArray.cpp: Added.
 471         (JSC::RegExpMatchesArray::visitChildren):
 472             - Eeeep! added missing visitChildren!
 473         (JSC::RegExpMatchesArray::finishCreation):
 474         (JSC::RegExpMatchesArray::reifyAllProperties):
 475         (JSC::RegExpMatchesArray::reifyMatchProperty):
 476             - Moved from RegExpConstructor.cpp.
 477         (JSC::RegExpMatchesArray::leftContext):
 478         (JSC::RegExpMatchesArray::rightContext):
 479             - Since the match start/
 480         * runtime/RegExpMatchesArray.h:
 481         (RegExpMatchesArray):
 482             - Declare new methods & structure flags.
 483         * runtime/RegExpObject.cpp:
 484         (JSC::RegExpObject::match):
 485             - performMatch now requires the JSString input, to cache.
 486         * runtime/StringPrototype.cpp:
 487         (JSC::removeUsingRegExpSearch):
 488         (JSC::replaceUsingRegExpSearch):
 489         (JSC::stringProtoFuncMatch):
 490         (JSC::stringProtoFuncSearch):
 491             - performMatch now requires the JSString input, to cache.
 492
 493 2012-03-23  Tony Chang  <tony@chromium.org>
 494
 495         [chromium] rename newwtf target back to wtf
 496         https://bugs.webkit.org/show_bug.cgi?id=82064
 497
 498         Reviewed by Adam Barth.
 499
 500         * JavaScriptCore.gyp/JavaScriptCore.gyp:
 501
 502 2012-03-23  Mark Hahnenberg  <mhahnenberg@apple.com>
 503
 504         Simplify memory usage tracking in CopiedSpace
 505         https://bugs.webkit.org/show_bug.cgi?id=80705
 506
 507         Reviewed by Filip Pizlo.
 508
 509         * heap/CopiedAllocator.h:
 510         (CopiedAllocator): Rename currentUtilization to currentSize.
 511         (JSC::CopiedAllocator::currentCapacity):
 512         * heap/CopiedBlock.h:
 513         (CopiedBlock):
 514         (JSC::CopiedBlock::payload): Move the implementation of payload() out of the class
 515         declaration.
 516         (JSC):
 517         (JSC::CopiedBlock::size): Add new function to calculate the block's size.
 518         (JSC::CopiedBlock::capacity): Ditto for capacity.
 519         * heap/CopiedSpace.cpp:
 520         (JSC::CopiedSpace::CopiedSpace): Remove old bogus memory stats fields and add a new
 521         field for the water mark.
 522         (JSC::CopiedSpace::init):
 523         (JSC::CopiedSpace::tryAllocateSlowCase): When we fail to allocate from the current
 524         block, we need to update our current water mark with the size of the block.
 525         (JSC::CopiedSpace::tryAllocateOversize): When we allocate a new oversize block, we
 526         need to update our current water mark with the size of the used portion of the block.
 527         (JSC::CopiedSpace::tryReallocate): We don't need to update the water mark when
 528         reallocating because it will either get accounted for when we fill up the block later
 529         in the case of being able to reallocate in the current block or it will get picked up
 530         immediately because we'll have to get a new block.
 531         (JSC::CopiedSpace::tryReallocateOversize): We do, however, need to update in when
 532         realloc-ing an oversize block because we deallocate the old block and allocate a brand
 533         new one.
 534         (JSC::CopiedSpace::doneFillingBlock): Update the water mark as blocks are returned to
 535         the CopiedSpace by the SlotVisitors.
 536         (JSC::CopiedSpace::doneCopying): Add in any pinned blocks to the water mark.
 537         (JSC::CopiedSpace::getFreshBlock): We use the Heap's new function to tell us whether or
 538         not we should collect now instead of doing the calculation ourself.
 539         (JSC::CopiedSpace::destroy):
 540         (JSC):
 541         (JSC::CopiedSpace::size): Manually calculate the size of the CopiedSpace, similar to how
 542         MarkedSpace does.
 543         (JSC::CopiedSpace::capacity): Ditto for capacity.
 544         * heap/CopiedSpace.h:
 545         (JSC::CopiedSpace::waterMark):
 546         (CopiedSpace):
 547         * heap/CopiedSpaceInlineMethods.h:
 548         (JSC::CopiedSpace::startedCopying): Reset water mark to 0 when we start copying during a
 549         collection.
 550         (JSC::CopiedSpace::allocateNewBlock):
 551         (JSC::CopiedSpace::fitsInBlock):
 552         (JSC::CopiedSpace::allocateFromBlock):
 553         * heap/Heap.cpp:
 554         (JSC::Heap::size): Incorporate size of CopiedSpace into the total size of the Heap.
 555         (JSC::Heap::capacity): Ditto for capacity.
 556         (JSC::Heap::collect):
 557         * heap/Heap.h:
 558         (Heap):
 559         (JSC::Heap::shouldCollect): New function for other sub-parts of the Heap to use to
 560         determine whether they should initiate a collection or continue to allocate new blocks.
 561         (JSC):
 562         (JSC::Heap::waterMark): Now is the sum of the water marks of the two sub-parts of the
 563         Heap (MarkedSpace and CopiedSpace).
 564         * heap/MarkedAllocator.cpp:
 565         (JSC::MarkedAllocator::allocateSlowCase): Changed to use the Heap's new shouldCollect() function.
 566
 567 2012-03-23  Ryosuke Niwa  <rniwa@webkit.org>
 568
 569         BitVector::resizeOutOfLine doesn't memset when converting an inline buffer
 570         https://bugs.webkit.org/show_bug.cgi?id=82012
 571
 572         Reviewed by Filip Pizlo.
 573
 574         Initialize out-of-line buffers while extending an inline buffer. Also export symbols to be used in WebCore.
 575
 576         * wtf/BitVector.cpp:
 577         (WTF::BitVector::resizeOutOfLine):
 578         * wtf/BitVector.h:
 579         (BitVector):
 580         (OutOfLineBits):
 581
 582 2012-03-22  Michael Saboff  <msaboff@apple.com>
 583
 584         ExecutableAllocator::memoryPressureMultiplier() might can return NaN
 585         https://bugs.webkit.org/show_bug.cgi?id=82002
 586
 587         Reviewed by Filip Pizlo.
 588
 589         Guard against divide by zero and then make sure the return
 590         value is >= 1.0.
 591
 592         * jit/ExecutableAllocator.cpp:
 593         (JSC::ExecutableAllocator::memoryPressureMultiplier):
 594         * jit/ExecutableAllocatorFixedVMPool.cpp:
 595         (JSC::ExecutableAllocator::memoryPressureMultiplier):
 596
 597 2012-03-22  Jessie Berlin  <jberlin@apple.com>
 598
 599         Windows build fix after r111778.
 600
 601         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
 602         Don't include and try to build files owned by WTF.
 603         Also, let VS have its way with the vcproj in terms of file ordering.
 604
 605 2012-03-22  Raphael Kubo da Costa  <rakuco@FreeBSD.org>
 606
 607         [CMake] Unreviewed build fix after r111778.
 608
 609         * CMakeLists.txt: Move ${WTF_DIR} after ${JAVASCRIPTCORE_DIR} in
 610         the include paths so that the right config.h is used.
 611
 612 2012-03-22  Tony Chang  <tony@chromium.org>
 613
 614         Unreviewed, fix chromium build after wtf move.
 615
 616         Remove old wtf_config and wtf targets.
 617
 618         * JavaScriptCore.gyp/JavaScriptCore.gyp:
 619
 620 2012-03-22  Martin Robinson  <mrobinson@igalia.com>
 621
 622         Fixed the GTK+ WTF/JavaScriptCore build after r111778.
 623
 624         * GNUmakefile.list.am: Removed an extra trailing backslash.
 625
 626 2012-03-22  Mark Rowe  <mrowe@apple.com>
 627
 628         Fix the build.
 629
 630         * Configurations/JavaScriptCore.xcconfig: Tell the linker to pull in all members from static libraries
 631         rather than only those that contain symbols that JavaScriptCore itself uses.
 632         * JavaScriptCore.xcodeproj/project.pbxproj: Remove some bogus settings that crept in to the Xcode project.
 633
 634 2012-03-22  Filip Pizlo  <fpizlo@apple.com>
 635
 636         DFG NodeFlags has some duplicate code and naming issues
 637         https://bugs.webkit.org/show_bug.cgi?id=81975
 638
 639         Reviewed by Gavin Barraclough.
 640
 641         Removed most references to "ArithNodeFlags" since those are now just part
 642         of the node flags. Fixed some renaming goofs (EdgedAsNum is once again
 643         NodeUsedAsNum). Got rid of setArithNodeFlags() and mergeArithNodeFlags()
 644         because the former was never called and the latter did the same things as
 645         mergeFlags().
 646
 647         * dfg/DFGByteCodeParser.cpp:
 648         (JSC::DFG::ByteCodeParser::makeSafe):
 649         (JSC::DFG::ByteCodeParser::makeDivSafe):
 650         (JSC::DFG::ByteCodeParser::handleIntrinsic):
 651         * dfg/DFGGraph.cpp:
 652         (JSC::DFG::Graph::dump):
 653         * dfg/DFGNode.h:
 654         (JSC::DFG::Node::arithNodeFlags):
 655         (Node):
 656         * dfg/DFGNodeFlags.cpp:
 657         (JSC::DFG::nodeFlagsAsString):
 658         * dfg/DFGNodeFlags.h:
 659         (DFG):
 660         (JSC::DFG::nodeUsedAsNumber):
 661         * dfg/DFGPredictionPropagationPhase.cpp:
 662         (JSC::DFG::PredictionPropagationPhase::propagate):
 663         (JSC::DFG::PredictionPropagationPhase::mergeDefaultArithFlags):
 664
 665 2012-03-22  Eric Seidel  <eric@webkit.org>
 666
 667         Actually move WTF files to their new home
 668         https://bugs.webkit.org/show_bug.cgi?id=81844
 669
 670         Unreviewed.  The details of the port-specific changes
 671         have been seen by contributors from those ports, but
 672         the whole 5MB change isn't very reviewable as-is.
 673
 674         * GNUmakefile.am:
 675         * GNUmakefile.list.am:
 676         * JSCTypedArrayStubs.h:
 677         * JavaScriptCore.gypi:
 678         * JavaScriptCore.xcodeproj/project.pbxproj:
 679         * jsc.cpp:
 680
 681 2012-03-22  Kevin Ollivier  <kevino@theolliviers.com>
 682
 683         [wx] Unreviewed. Adding Source/WTF to the build.
 684
 685         * wscript:
 686
 687 2012-03-22  Gavin Barraclough  <barraclough@apple.com>
 688
 689         Add JSValue::isFunction
 690         https://bugs.webkit.org/show_bug.cgi?id=81935
 691
 692         Reviewed by Geoff Garen.
 693
 694         This would be useful in the WebCore bindings code.
 695         Also, remove asFunction, replace with jsCast<JSFunction*>.
 696
 697         * API/JSContextRef.cpp:
 698         * debugger/Debugger.cpp:
 699         * debugger/DebuggerCallFrame.cpp:
 700         (JSC::DebuggerCallFrame::functionName):
 701         * dfg/DFGGraph.h:
 702         (JSC::DFG::Graph::valueOfFunctionConstant):
 703         * dfg/DFGOperations.cpp:
 704         * interpreter/CallFrame.cpp:
 705         (JSC::CallFrame::isInlineCallFrameSlow):
 706         * interpreter/Interpreter.cpp:
 707         (JSC::Interpreter::privateExecute):
 708         * jit/JITStubs.cpp:
 709         (JSC::DEFINE_STUB_FUNCTION):
 710         (JSC::jitCompileFor):
 711         (JSC::lazyLinkFor):
 712         * llint/LLIntSlowPaths.cpp:
 713         (JSC::LLInt::traceFunctionPrologue):
 714         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 715         (JSC::LLInt::setUpCall):
 716         * runtime/Arguments.h:
 717         (JSC::Arguments::finishCreation):
 718         * runtime/ArrayPrototype.cpp:
 719         (JSC::arrayProtoFuncFilter):
 720         (JSC::arrayProtoFuncMap):
 721         (JSC::arrayProtoFuncEvery):
 722         (JSC::arrayProtoFuncForEach):
 723         (JSC::arrayProtoFuncSome):
 724         (JSC::arrayProtoFuncReduce):
 725         (JSC::arrayProtoFuncReduceRight):
 726         * runtime/CommonSlowPaths.h:
 727         (JSC::CommonSlowPaths::arityCheckFor):
 728         * runtime/Executable.h:
 729         (JSC::FunctionExecutable::compileFor):
 730         (JSC::FunctionExecutable::compileOptimizedFor):
 731         * runtime/FunctionPrototype.cpp:
 732         (JSC::functionProtoFuncToString):
 733         * runtime/JSArray.cpp:
 734         (JSC::JSArray::sort):
 735         * runtime/JSFunction.cpp:
 736         (JSC::JSFunction::argumentsGetter):
 737         (JSC::JSFunction::callerGetter):
 738         (JSC::JSFunction::lengthGetter):
 739         * runtime/JSFunction.h:
 740         (JSC):
 741         (JSC::asJSFunction):
 742         (JSC::JSValue::isFunction):
 743         * runtime/JSGlobalData.cpp:
 744         (WTF::Recompiler::operator()):
 745         (JSC::JSGlobalData::releaseExecutableMemory):
 746         * runtime/JSValue.h:
 747         * runtime/StringPrototype.cpp:
 748         (JSC::replaceUsingRegExpSearch):
 749
 750 2012-03-21  Filip Pizlo  <fpizlo@apple.com>
 751
 752         DFG speculation on booleans should be rationalized
 753         https://bugs.webkit.org/show_bug.cgi?id=81840
 754
 755         Reviewed by Gavin Barraclough.
 756
 757         This removes isKnownBoolean() and replaces it with AbstractState-based
 758         optimization, and cleans up the control flow in code gen methods for
 759         Branch and LogicalNot. Also fixes a goof in Node::shouldSpeculateNumber,
 760         and removes isKnownNotBoolean() since that method appeared to be a
 761         helper used solely by 32_64's speculateBooleanOperation().
 762
 763         This is performance-neutral.
 764
 765         * dfg/DFGAbstractState.cpp:
 766         (JSC::DFG::AbstractState::execute):
 767         * dfg/DFGNode.h:
 768         (JSC::DFG::Node::shouldSpeculateNumber):
 769         * dfg/DFGSpeculativeJIT.cpp:
 770         (DFG):
 771         * dfg/DFGSpeculativeJIT.h:
 772         (SpeculativeJIT):
 773         * dfg/DFGSpeculativeJIT32_64.cpp:
 774         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
 775         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
 776         (JSC::DFG::SpeculativeJIT::emitBranch):
 777         (JSC::DFG::SpeculativeJIT::compile):
 778         * dfg/DFGSpeculativeJIT64.cpp:
 779         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
 780         (JSC::DFG::SpeculativeJIT::emitBranch):
 781         (JSC::DFG::SpeculativeJIT::compile):
 782
 783 2012-03-21  Mark Rowe  <mrowe@apple.com>
 784
 785         Fix the build.
 786
 787         * wtf/MetaAllocator.h:
 788         (MetaAllocator): Export the destructor.
 789
 790 2012-03-21  Eric Seidel  <eric@webkit.org>
 791
 792         Fix remaining WTF includes in JavaScriptCore in preparation for moving WTF headers out of JavaScriptCore
 793         https://bugs.webkit.org/show_bug.cgi?id=81834
 794
 795         Reviewed by Adam Barth.
 796
 797         * jsc.cpp:
 798         * os-win32/WinMain.cpp:
 799         * runtime/JSDateMath.cpp:
 800         * runtime/TimeoutChecker.cpp:
 801         * testRegExp.cpp:
 802         * tools/CodeProfiling.cpp:
 803
 804 2012-03-21  Eric Seidel  <eric@webkit.org>
 805
 806         WTF::MetaAllocator has a weak vtable (discovered when building wtf as a static library)
 807         https://bugs.webkit.org/show_bug.cgi?id=81838
 808
 809         Reviewed by Geoffrey Garen.
 810
 811         My understanding is that weak vtables happen when the compiler/linker cannot
 812         determine which compilation unit should constain the vtable.  In this case
 813         because there were only pure virtual functions as well as an "inline"
 814         virtual destructor (thus the virtual destructor was defined in many compilation
 815         units).  Since you can't actually "inline" a virtual function (it still has to
 816         bounce through the vtable), the "inline" on this virutal destructor doesn't
 817         actually help performance, and is only serving to confuse the compiler here.
 818         I've moved the destructor implementation to the .cpp file, thus making
 819         it clear to the compiler where the vtable should be stored, and solving the error.
 820
 821         * wtf/MetaAllocator.cpp:
 822         (WTF::MetaAllocator::~MetaAllocator):
 823         (WTF):
 824         * wtf/MetaAllocator.h:
 825
 826 2012-03-20  Gavin Barraclough  <barraclough@apple.com>
 827
 828         RegExpMatchesArray should not copy the ovector
 829         https://bugs.webkit.org/show_bug.cgi?id=81742
 830
 831         Reviewed by Michael Saboff.
 832
 833         Currently, all RegExpMatchesArray object contain Vector<int, 32>, used to hold any sub-pattern results.
 834         This makes allocation/construction/destruction of these objects more expensive. Instead, just store the
 835         main match, and recreate the sub-pattern ranges only if necessary (these are often only used for grouping,
 836         and the results never accessed).
 837         If the main match (index 0) of the RegExpMatchesArray is accessed, reify that value alone.
 838
 839         * dfg/DFGOperations.cpp:
 840             - RegExpObject match renamed back to test (test returns a bool).
 841         * runtime/RegExpConstructor.cpp:
 842         (JSC):
 843             - Removed RegExpResult, RegExpMatchesArray constructor, destroy method.
 844         (JSC::RegExpMatchesArray::finishCreation):
 845             - Removed RegExpConstructorPrivate parameter.
 846         (JSC::RegExpMatchesArray::reifyAllProperties):
 847             - (Was fillArrayInstance) Reify all properties of the RegExpMatchesArray.
 848             If there are sub-pattern properties, the RegExp is re-run to generate their values.
 849         (JSC::RegExpMatchesArray::reifyMatchProperty):
 850             - Reify just the match (index 0) property of the RegExpMatchesArray.
 851         * runtime/RegExpConstructor.h:
 852         (RegExpConstructor):
 853         (JSC::RegExpConstructor::performMatch):
 854             - performMatch now returns a MatchResult, rather than using out-parameters.
 855         * runtime/RegExpMatchesArray.h:
 856         (JSC::RegExpMatchesArray::RegExpMatchesArray):
 857             - Moved from .cpp, stores the input/regExp/result to use when lazily reifying properties.
 858         (RegExpMatchesArray):
 859         (JSC::RegExpMatchesArray::create):
 860             - Now passed the input string matched against, the RegExp, and the MatchResult.
 861         (JSC::RegExpMatchesArray::reifyAllPropertiesIfNecessary):
 862         (JSC::RegExpMatchesArray::reifyMatchPropertyIfNecessary):
 863             - Helpers to conditionally reify properties.
 864         (JSC::RegExpMatchesArray::getOwnPropertySlot):
 865         (JSC::RegExpMatchesArray::getOwnPropertySlotByIndex):
 866         (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
 867         (JSC::RegExpMatchesArray::put):
 868         (JSC::RegExpMatchesArray::putByIndex):
 869         (JSC::RegExpMatchesArray::deleteProperty):
 870         (JSC::RegExpMatchesArray::deletePropertyByIndex):
 871         (JSC::RegExpMatchesArray::getOwnPropertyNames):
 872         (JSC::RegExpMatchesArray::defineOwnProperty):
 873             - Changed to use reifyAllPropertiesIfNecessary/reifyMatchPropertyIfNecessary
 874             (getOwnPropertySlotByIndex calls reifyMatchPropertyIfNecessary if index is 0).
 875         * runtime/RegExpObject.cpp:
 876         (JSC::RegExpObject::exec):
 877         (JSC::RegExpObject::match):
 878             - match now returns a MatchResult.
 879         * runtime/RegExpObject.h:
 880         (JSC::MatchResult::MatchResult):
 881             - Added the result of a match is a start & end tuple.
 882         (JSC::MatchResult::failed):
 883             - A failure is indicated by (notFound, 0).
 884         (JSC::MatchResult::operator bool):
 885             - Evaluates to false if the match failed.
 886         (JSC::MatchResult::empty):
 887             - Evaluates to true if the match succeeded with length 0.
 888         (JSC::RegExpObject::test):
 889             - Now returns a bool.
 890         * runtime/RegExpPrototype.cpp:
 891         (JSC::regExpProtoFuncTest):
 892             - RegExpObject match renamed back to test (test returns a bool).
 893         * runtime/StringPrototype.cpp:
 894         (JSC::removeUsingRegExpSearch):
 895         (JSC::replaceUsingRegExpSearch):
 896         (JSC::stringProtoFuncMatch):
 897         (JSC::stringProtoFuncSearch):
 898             - performMatch now returns a MatchResult, rather than using out-parameters.
 899
 900 2012-03-21  Hojong Han  <hojong.han@samsung.com>
 901
 902         Fix out of memory by allowing overcommit
 903         https://bugs.webkit.org/show_bug.cgi?id=81743
 904
 905         Reviewed by Geoffrey Garen.
 906
 907         Garbage collection is not triggered and new blocks are added
 908         because overcommit is allowed by MAP_NORESERVE flag when high water mark is big enough.
 909
 910         * wtf/OSAllocatorPosix.cpp:
 911         (WTF::OSAllocator::reserveAndCommit):
 912
 913 2012-03-21  Jessie Berlin  <jberlin@apple.com>
 914
 915         More Windows build fixing.
 916
 917         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
 918         Fix the order of the include directories to look in include/private first before looking
 919         in include/private/JavaScriptCore.
 920         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops:
 921         Look in the Production output directory (where the wtf headers will be). This is the same
 922         thing that is done for jsc and testRegExp in ReleasePGO.
 923
 924 2012-03-21  Jessie Berlin  <jberlin@apple.com>
 925
 926         WTF headers should be in $(ConfigurationBuildDir)\include\private\wtf, not
 927         $(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf.
 928         https://bugs.webkit.org/show_bug.cgi?id=81739
 929
 930         Reviewed by Dan Bernstein.
 931
 932         * JavaScriptCore.vcproj/jsc/jsc.vcproj:
 933         Look for AtomicString.cpp, StringBuilder.cpp, StringImpl.cpp, and WTFString.cpp in the wtf
 934         subdirectory of the build output, not the JavaScriptCore/wtf subdirectory.
 935         * JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj:
 936         Ditto.
 937
 938         * JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops:
 939         Get the headers for those 4 files from the wtf subdirectory of the build output, not the
 940         JavaScriptCore/wtf subdirectory.
 941         * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops:
 942         Ditto.
 943
 944 2012-03-20  Eric Seidel  <eric@webkit.org>
 945
 946         Move wtf/Platform.h from JavaScriptCore to Source/WTF/wtf
 947         https://bugs.webkit.org/show_bug.cgi?id=80911
 948
 949         Reviewed by Adam Barth.
 950
 951         Update the various build systems to depend on Source/WTF headers
 952         as well as remove references to Platform.h (since it's now moved).
 953
 954         * CMakeLists.txt:
 955         * JavaScriptCore.pri:
 956         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
 957         * JavaScriptCore.xcodeproj/project.pbxproj:
 958         * wtf/CMakeLists.txt:
 959
 960 2012-03-20  Filip Pizlo  <fpizlo@apple.com>
 961
 962         op_mod fails on many interesting corner cases
 963         https://bugs.webkit.org/show_bug.cgi?id=81648
 964
 965         Reviewed by Oliver Hunt.
 966
 967         Removed most strength reduction for op_mod, and fixed the integer handling
 968         to do the right thing for corner cases. Oddly, this revealed bugs in OSR,
 969         which this patch also fixes.
 970
 971         This patch is performance neutral on all of the major benchmarks we track.
 972
 973         * dfg/DFGOperations.cpp:
 974         * dfg/DFGOperations.h:
 975         * dfg/DFGSpeculativeJIT.cpp:
 976         (DFG):
 977         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
 978         (JSC::DFG::SpeculativeJIT::compileArithMod):
 979         * jit/JIT.h:
 980         (JIT):
 981         * jit/JITArithmetic.cpp:
 982         (JSC):
 983         (JSC::JIT::emit_op_mod):
 984         (JSC::JIT::emitSlow_op_mod):
 985         * jit/JITArithmetic32_64.cpp:
 986         (JSC::JIT::emit_op_mod):
 987         (JSC::JIT::emitSlow_op_mod):
 988         * jit/JITOpcodes32_64.cpp:
 989         (JSC::JIT::privateCompileCTIMachineTrampolines):
 990         (JSC):
 991         * jit/JITStubs.h:
 992         (TrampolineStructure):
 993         (JSC::JITThunks::ctiNativeConstruct):
 994         * llint/LowLevelInterpreter64.asm:
 995         * wtf/Platform.h:
 996         * wtf/SimpleStats.h:
 997         (WTF::SimpleStats::variance):
 998
 999 2012-03-20  Steve Falkenburg  <sfalken@apple.com>
1000
1001         Windows (make based) build fix.
1002         <rdar://problem/11069015>
1003
1004         * JavaScriptCore.vcproj/JavaScriptCore.make: devenv /rebuild doesn't work with JavaScriptCore.vcproj. Use /clean and /build instead.
1005
1006 2012-03-20  Steve Falkenburg  <sfalken@apple.com>
1007
1008         Move WTF-related Windows project files out of JavaScriptCore
1009         https://bugs.webkit.org/show_bug.cgi?id=80680
1010
1011         This change only moves the vcproj and related files from JavaScriptCore/JavaScriptCore.vcproj/WTF.
1012         It does not move any source code. This is in preparation for the WTF source move out of
1013         JavaScriptCore.
1014
1015         Reviewed by Jessie Berlin.
1016
1017         * JavaScriptCore.vcproj/JavaScriptCore.sln:
1018         * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
1019         * JavaScriptCore.vcproj/WTF: Removed.
1020         * JavaScriptCore.vcproj/WTF/WTF.vcproj: Removed.
1021         * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Removed.
1022         * JavaScriptCore.vcproj/WTF/WTFDebug.vsprops: Removed.
1023         * JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops: Removed.
1024         * JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops: Removed.
1025         * JavaScriptCore.vcproj/WTF/WTFGenerated.make: Removed.
1026         * JavaScriptCore.vcproj/WTF/WTFGenerated.vcproj: Removed.
1027         * JavaScriptCore.vcproj/WTF/WTFGeneratedCommon.vsprops: Removed.
1028         * JavaScriptCore.vcproj/WTF/WTFGeneratedDebug.vsprops: Removed.
1029         * JavaScriptCore.vcproj/WTF/WTFGeneratedDebugAll.vsprops: Removed.
1030         * JavaScriptCore.vcproj/WTF/WTFGeneratedDebugCairoCFLite.vsprops: Removed.
1031         * JavaScriptCore.vcproj/WTF/WTFGeneratedProduction.vsprops: Removed.
1032         * JavaScriptCore.vcproj/WTF/WTFGeneratedRelease.vsprops: Removed.
1033         * JavaScriptCore.vcproj/WTF/WTFGeneratedReleaseCairoCFLite.vsprops: Removed.
1034         * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd: Removed.
1035         * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd: Removed.
1036         * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops: Removed.
1037         * JavaScriptCore.vcproj/WTF/WTFRelease.vsprops: Removed.
1038         * JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops: Removed.
1039         * JavaScriptCore.vcproj/WTF/build-generated-files.sh: Removed.
1040         * JavaScriptCore.vcproj/WTF/copy-files.cmd: Removed.
1041         * JavaScriptCore.vcproj/WTF/work-around-vs-dependency-tracking-bugs.py: Removed.
1042
1043 2012-03-20  Benjamin Poulain  <bpoulain@apple.com>
1044
1045         Cache the type string of JavaScript object
1046         https://bugs.webkit.org/show_bug.cgi?id=81446
1047
1048         Reviewed by Geoffrey Garen.
1049
1050         Instead of creating the JSString every time, we create
1051         lazily the strings in JSGlobalData.
1052
1053         This avoid the construction of the StringImpl and of the JSString,
1054         which gives some performance improvements.
1055
1056         * runtime/CommonIdentifiers.h:
1057         * runtime/JSValue.cpp:
1058         (JSC::JSValue::toStringSlowCase):
1059         * runtime/Operations.cpp:
1060         (JSC::jsTypeStringForValue):
1061         * runtime/SmallStrings.cpp:
1062         (JSC::SmallStrings::SmallStrings):
1063         (JSC::SmallStrings::finalizeSmallStrings):
1064         (JSC::SmallStrings::initialize):
1065         (JSC):
1066         * runtime/SmallStrings.h:
1067         (SmallStrings):
1068
1069 2012-03-20  Oliver Hunt  <oliver@apple.com>
1070
1071         Allow LLINT to work even when executable allocation fails.
1072         https://bugs.webkit.org/show_bug.cgi?id=81693
1073
1074         Reviewed by Gavin Barraclough.
1075
1076         Don't crash if executable allocation fails if we can fall back on LLINT
1077
1078         * jit/ExecutableAllocatorFixedVMPool.cpp:
1079         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
1080         * wtf/OSAllocatorPosix.cpp:
1081         (WTF::OSAllocator::reserveAndCommit):
1082
1083 2012-03-20  Csaba Osztrogonác  <ossy@webkit.org>
1084
1085         Division optimizations fail to infer cases of truncated division and mishandle -2147483648/-1
1086         https://bugs.webkit.org/show_bug.cgi?id=81428
1087
1088         32 bit buildfix after r111355.
1089
1090         2147483648 (2^31) isn't valid int literal in ISO C90, because 2147483647 (2^31-1) is the biggest int.
1091         The smallest int is -2147483648 (-2^31) == -2147483647 - 1  == -INT32_MAX-1 == INT32_MIN (stdint.h).
1092
1093         Reviewed by Zoltan Herczeg.
1094
1095         * dfg/DFGSpeculativeJIT.cpp:
1096         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
1097
1098 2012-03-19  Jochen Eisinger  <jochen@chromium.org>
1099
1100         Split WTFReportBacktrace into WTFReportBacktrace and WTFPrintBacktrace
1101         https://bugs.webkit.org/show_bug.cgi?id=80983
1102
1103         Reviewed by Darin Adler.
1104
1105         This allows printing a backtrace acquired by an earlier WTFGetBacktrace
1106         call which is useful for local debugging.
1107
1108         * wtf/Assertions.cpp:
1109         * wtf/Assertions.h:
1110
1111 2012-03-19  Benjamin Poulain  <benjamin@webkit.org>
1112
1113         Do not copy the script source in the SourceProvider, just reference the existing string
1114         https://bugs.webkit.org/show_bug.cgi?id=81466
1115
1116         Reviewed by Geoffrey Garen.
1117
1118         * parser/SourceCode.h: Remove the unused, and incorrect, function data().
1119         * parser/SourceProvider.h: Add OVERRIDE for clarity.
1120
1121 2012-03-19  Filip Pizlo  <fpizlo@apple.com>
1122
1123         Division optimizations fail to infer cases of truncated division and
1124         mishandle -2147483648/-1
1125         https://bugs.webkit.org/show_bug.cgi?id=81428
1126         <rdar://problem/11067382>
1127
1128         Reviewed by Oliver Hunt.
1129
1130         If you're a division over integers and you're only used as an integer, then you're
1131         an integer division and remainder checks become unnecessary. If you're dividing
1132         -2147483648 by -1, don't crash.
1133
1134         * assembler/MacroAssemblerX86Common.h:
1135         (MacroAssemblerX86Common):
1136         (JSC::MacroAssemblerX86Common::add32):
1137         * dfg/DFGSpeculativeJIT.cpp:
1138         (DFG):
1139         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
1140         * dfg/DFGSpeculativeJIT.h:
1141         (SpeculativeJIT):
1142         * dfg/DFGSpeculativeJIT32_64.cpp:
1143         (JSC::DFG::SpeculativeJIT::compile):
1144         * dfg/DFGSpeculativeJIT64.cpp:
1145         (JSC::DFG::SpeculativeJIT::compile):
1146         * llint/LowLevelInterpreter64.asm:
1147
1148 2012-03-19  Benjamin Poulain  <bpoulain@apple.com>
1149
1150         Simplify SmallStrings
1151         https://bugs.webkit.org/show_bug.cgi?id=81445
1152
1153         Reviewed by Gavin Barraclough.
1154
1155         SmallStrings had two methods that should not be public: count() and clear().
1156
1157         The method clear() is effectively replaced by finalizeSmallStrings(). The body
1158         of the method was moved to the constructor since the code is obvious.
1159
1160         The method count() is unused.
1161
1162         * runtime/SmallStrings.cpp:
1163         (JSC::SmallStrings::SmallStrings):
1164         * runtime/SmallStrings.h:
1165         (SmallStrings):
1166
1167 2012-03-19  Filip Pizlo  <fpizlo@apple.com>
1168
1169         DFG can no longer compile V8-v4/regexp in debug mode
1170         https://bugs.webkit.org/show_bug.cgi?id=81592
1171
1172         Reviewed by Gavin Barraclough.
1173
1174         * dfg/DFGSpeculativeJIT32_64.cpp:
1175         (JSC::DFG::SpeculativeJIT::compile):
1176         * dfg/DFGSpeculativeJIT64.cpp:
1177         (JSC::DFG::SpeculativeJIT::compile):
1178
1179 2012-03-19  Filip Pizlo  <fpizlo@apple.com>
1180
1181         Prediction propagation for UInt32ToNumber incorrectly assumes that outs outcome does not
1182         change throughout the fixpoint
1183         https://bugs.webkit.org/show_bug.cgi?id=81583
1184
1185         Reviewed by Michael Saboff.
1186
1187         * dfg/DFGPredictionPropagationPhase.cpp:
1188         (JSC::DFG::PredictionPropagationPhase::propagate):
1189
1190 2012-03-19  Filip Pizlo  <fpizlo@apple.com>
1191
1192         GC should not attempt to clear LLInt instruction inline caches for code blocks that are in
1193         the process of being generated
1194         https://bugs.webkit.org/show_bug.cgi?id=81565
1195
1196         Reviewed by Oliver Hunt.
1197
1198         * bytecode/CodeBlock.cpp:
1199         (JSC::CodeBlock::finalizeUnconditionally):
1200
1201 2012-03-19  Eric Seidel  <eric@webkit.org>
1202
1203         Fix WTF header include discipline in Chromium WebKit
1204         https://bugs.webkit.org/show_bug.cgi?id=81281
1205
1206         Reviewed by James Robinson.
1207
1208         * JavaScriptCore.gyp/JavaScriptCore.gyp:
1209         * wtf/unicode/icu/CollatorICU.cpp:
1210
1211 2012-03-19  Filip Pizlo  <fpizlo@apple.com>
1212
1213         DFG NodeUse should be called Edge and NodeReferenceBlob should be called AdjacencyList
1214         https://bugs.webkit.org/show_bug.cgi?id=81556
1215
1216         Rubber stamped by Gavin Barraclough.
1217
1218         * GNUmakefile.list.am:
1219         * JavaScriptCore.xcodeproj/project.pbxproj:
1220         * dfg/DFGAbstractState.h:
1221         (JSC::DFG::AbstractState::forNode):
1222         * dfg/DFGAdjacencyList.h: Copied from Source/JavaScriptCore/dfg/DFGNodeReferenceBlob.h.
1223         (JSC::DFG::AdjacencyList::AdjacencyList):
1224         (JSC::DFG::AdjacencyList::child):
1225         (JSC::DFG::AdjacencyList::setChild):
1226         (JSC::DFG::AdjacencyList::child1):
1227         (JSC::DFG::AdjacencyList::child2):
1228         (JSC::DFG::AdjacencyList::child3):
1229         (JSC::DFG::AdjacencyList::setChild1):
1230         (JSC::DFG::AdjacencyList::setChild2):
1231         (JSC::DFG::AdjacencyList::setChild3):
1232         (JSC::DFG::AdjacencyList::child1Unchecked):
1233         (JSC::DFG::AdjacencyList::initialize):
1234         (AdjacencyList):
1235         * dfg/DFGByteCodeParser.cpp:
1236         (JSC::DFG::ByteCodeParser::addVarArgChild):
1237         (JSC::DFG::ByteCodeParser::processPhiStack):
1238         * dfg/DFGCSEPhase.cpp:
1239         (JSC::DFG::CSEPhase::canonicalize):
1240         (JSC::DFG::CSEPhase::performSubstitution):
1241         * dfg/DFGEdge.h: Copied from Source/JavaScriptCore/dfg/DFGNodeUse.h.
1242         (DFG):
1243         (JSC::DFG::Edge::Edge):
1244         (JSC::DFG::Edge::operator==):
1245         (JSC::DFG::Edge::operator!=):
1246         (Edge):
1247         (JSC::DFG::operator==):
1248         (JSC::DFG::operator!=):
1249         * dfg/DFGGraph.h:
1250         (JSC::DFG::Graph::operator[]):
1251         (JSC::DFG::Graph::at):
1252         (JSC::DFG::Graph::ref):
1253         (JSC::DFG::Graph::deref):
1254         (JSC::DFG::Graph::clearAndDerefChild1):
1255         (JSC::DFG::Graph::clearAndDerefChild2):
1256         (JSC::DFG::Graph::clearAndDerefChild3):
1257         (Graph):
1258         * dfg/DFGJITCompiler.h:
1259         (JSC::DFG::JITCompiler::getPrediction):
1260         * dfg/DFGNode.h:
1261         (JSC::DFG::Node::Node):
1262         (JSC::DFG::Node::child1):
1263         (JSC::DFG::Node::child1Unchecked):
1264         (JSC::DFG::Node::child2):
1265         (JSC::DFG::Node::child3):
1266         (Node):
1267         * dfg/DFGNodeFlags.cpp:
1268         (JSC::DFG::arithNodeFlagsAsString):
1269         * dfg/DFGNodeFlags.h:
1270         (DFG):
1271         (JSC::DFG::nodeUsedAsNumber):
1272         * dfg/DFGNodeReferenceBlob.h: Removed.
1273         * dfg/DFGNodeUse.h: Removed.
1274         * dfg/DFGPredictionPropagationPhase.cpp:
1275         (JSC::DFG::PredictionPropagationPhase::propagate):
1276         (JSC::DFG::PredictionPropagationPhase::mergeDefaultArithFlags):
1277         (JSC::DFG::PredictionPropagationPhase::vote):
1278         (JSC::DFG::PredictionPropagationPhase::fixupNode):
1279         * dfg/DFGScoreBoard.h:
1280         (JSC::DFG::ScoreBoard::use):
1281         * dfg/DFGSpeculativeJIT.cpp:
1282         (JSC::DFG::SpeculativeJIT::useChildren):
1283         (JSC::DFG::SpeculativeJIT::writeBarrier):
1284         (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
1285         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
1286         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
1287         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
1288         * dfg/DFGSpeculativeJIT.h:
1289         (JSC::DFG::SpeculativeJIT::at):
1290         (JSC::DFG::SpeculativeJIT::canReuse):
1291         (JSC::DFG::SpeculativeJIT::use):
1292         (SpeculativeJIT):
1293         (JSC::DFG::SpeculativeJIT::speculationCheck):
1294         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
1295         (JSC::DFG::IntegerOperand::IntegerOperand):
1296         (JSC::DFG::DoubleOperand::DoubleOperand):
1297         (JSC::DFG::JSValueOperand::JSValueOperand):
1298         (JSC::DFG::StorageOperand::StorageOperand):
1299         (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
1300         (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
1301         (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
1302         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
1303         (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
1304         * dfg/DFGSpeculativeJIT32_64.cpp:
1305         (JSC::DFG::SpeculativeJIT::cachedPutById):
1306         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
1307         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
1308         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
1309         (JSC::DFG::SpeculativeJIT::emitCall):
1310         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
1311         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
1312         * dfg/DFGSpeculativeJIT64.cpp:
1313         (JSC::DFG::SpeculativeJIT::cachedPutById):
1314         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
1315         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
1316         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
1317         (JSC::DFG::SpeculativeJIT::emitCall):
1318         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
1319         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
1320
1321 2012-03-19  Gavin Barraclough  <barraclough@apple.com>
1322
1323         Object.freeze broken on latest Nightly
1324         https://bugs.webkit.org/show_bug.cgi?id=80577
1325
1326         Reviewed by Oliver Hunt.
1327
1328         * runtime/Arguments.cpp:
1329         (JSC::Arguments::defineOwnProperty):
1330             - defineOwnProperty was checking for correct behaviour, provided that length/callee hadn't
1331             been overrridden. instead, just reify length/callee & rely on JSObject::defineOwnProperty.
1332         * runtime/JSFunction.cpp:
1333         (JSC::JSFunction::defineOwnProperty):
1334             - for arguments/caller/length properties, defineOwnProperty was incorrectly asserting that
1335             the object must be extensible; this is incorrect since these properties should already exist
1336             on the object. In addition, it was asserting that the arguments/caller values must match the
1337             corresponding magic data properties, but for strict mode function this is incorrect. Instead,
1338             just reify the arguments/caller accessor & defer to JSObject::defineOwnProperty.
1339
1340 2012-03-19  Filip Pizlo  <fpizlo@apple.com>
1341
1342         LLInt get_by_pname slow path incorrectly assumes that the operands are not constants
1343         https://bugs.webkit.org/show_bug.cgi?id=81559
1344
1345         Reviewed by Michael Saboff.
1346
1347         * llint/LLIntSlowPaths.cpp:
1348         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1349
1350 2012-03-19  Yong Li  <yoli@rim.com>
1351
1352         [BlackBerry] Implement OSAllocator::commit/decommit in the correct way
1353         https://bugs.webkit.org/show_bug.cgi?id=77013
1354
1355         We should use mmap(PROT_NONE, MAP_LAZY) instead of posix_madvise() to
1356         implement memory decommitting for QNX.
1357
1358         Reviewed by Rob Buis.
1359
1360         * wtf/OSAllocatorPosix.cpp:
1361         (WTF::OSAllocator::reserveUncommitted):
1362         (WTF::OSAllocator::commit):
1363         (WTF::OSAllocator::decommit):
1364
1365 2012-03-19  Gavin Barraclough  <barraclough@apple.com>
1366
1367         Unreviewed - revent a couple of files accidentally committed.
1368
1369         * runtime/Arguments.cpp:
1370         (JSC::Arguments::defineOwnProperty):
1371         * runtime/JSFunction.cpp:
1372         (JSC::JSFunction::defineOwnProperty):
1373
1374 2012-03-19  Jessie Berlin  <jberlin@apple.com>
1375
1376         Another Windows build fix after r111129.
1377
1378         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1379
1380 2012-03-19  Raphael Kubo da Costa  <rakuco@FreeBSD.org>
1381
1382         Cross-platform processor core counter: fix build on FreeBSD.
1383         https://bugs.webkit.org/show_bug.cgi?id=81482
1384
1385         Reviewed by Zoltan Herczeg.
1386
1387         The documentation of sysctl(3) shows that <sys/types.h> should be
1388         included before <sys/sysctl.h> (sys/types.h tends to be the first
1389         included header in general).
1390
1391         This should fix the build on FreeBSD and other systems where
1392         sysctl.h really depends on types defined in types.h.
1393
1394         * wtf/NumberOfCores.cpp:
1395
1396 2012-03-19  Jessie Berlin  <jberlin@apple.com>
1397
1398         Windows build fix after r111129.
1399
1400         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1401
1402 2012-03-19  Gavin Barraclough  <barraclough@apple.com>
1403
1404         JSCallbackFunction::toStringCallback/valueOfCallback do not handle 0 return value from convertToType
1405         https://bugs.webkit.org/show_bug.cgi?id=81468 <rdar://problem/11034745>
1406
1407         Reviewed by Oliver Hunt.
1408
1409         The API specifies that convertToType may opt not to handle a conversion:
1410             "@result The objects's converted value, or NULL if the object was not converted."
1411         In which case, it would propagate first up the JSClass hierarchy, calling its superclass's
1412         conversion functions, and failing that call the JSObject::defaultValue function.
1413
1414         Unfortunately this behaviour was removed in bug#69677/bug#69858, and instead we now rely on
1415         the toStringCallback/valueOfCallback function introduced in bug#69156. Even after a fix in
1416         bug#73368, these will return the result from the first convertToType they find, regardless
1417         of whether this result is null, and if no convertToType method is found in the api class
1418         hierarchy (possible if toStringCallback/valueOfCallback was accessed off the prototype
1419         chain), they will also return a null pointer. This is unsafe.
1420
1421         It would be easy to make the approach based around toStringCallback/valueOfCallback continue
1422         to walk the api class hierarchy, but making the fallback to defaultValue would be problematic
1423         (since defaultValue calls toStringCallback/valueOfCallback, this would infinitely recurse).
1424         Making the fallback work with toString/valueOf methods attached to api objects is probably
1425         not the right thing to do – instead, we should just implement the defaultValue trap for api
1426         objects.
1427
1428         In addition, this bug highlights that fact that JSCallbackFunction::call will allow a hard
1429         null to be returned from C to JavaScript - this is not okay. Handle with an exception.
1430
1431         * API/JSCallbackFunction.cpp:
1432         (JSC::JSCallbackFunction::call):
1433             - Should be null checking the return value.
1434         (JSC):
1435             - Remove toStringCallback/valueOfCallback.
1436         * API/JSCallbackFunction.h:
1437         (JSCallbackFunction):
1438             - Remove toStringCallback/valueOfCallback.
1439         * API/JSCallbackObject.h:
1440         (JSCallbackObject):
1441             - Add defaultValue mthods to JSCallbackObject.
1442         * API/JSCallbackObjectFunctions.h:
1443         (JSC::::defaultValue):
1444             - Add defaultValue mthods to JSCallbackObject.
1445         * API/JSClassRef.cpp:
1446         (OpaqueJSClass::prototype):
1447             - Remove toStringCallback/valueOfCallback.
1448         * API/tests/testapi.js:
1449             - Revert this test, now we no longer artificially introduce a toString method onto the api object.
1450
1451 2012-03-18  Raphael Kubo da Costa  <rakuco@FreeBSD.org>
1452
1453         [EFL] Include ICU_INCLUDE_DIRS when building.
1454         https://bugs.webkit.org/show_bug.cgi?id=81483
1455
1456         Reviewed by Daniel Bates.
1457
1458         So far, only the ICU libraries were being included when building
1459         JavaScriptCore, however the include path is also needed, otherwise the
1460         build will fail when ICU is installed into a non-standard location.
1461
1462         * PlatformEfl.cmake: Include ${ICU_INCLUDE_DIRS}.
1463
1464 2012-03-17  Gavin Barraclough  <barraclough@apple.com>
1465
1466         Strength reduction, RegExp.exec -> RegExp.test
1467         https://bugs.webkit.org/show_bug.cgi?id=81459
1468
1469         Reviewed by Sam Weinig.
1470
1471         RegExp.prototype.exec & RegExp.prototype.test can both be used to test a regular
1472         expression for a match against a string - however exec is more expensive, since
1473         it allocates a matches array object. In cases where the result is consumed in a
1474         boolean context the allocation of the matches array can be trivially elided.
1475
1476         For example:
1477             function f()
1478             {
1479                 for (i =0; i < 10000000; ++i)
1480                     if(!/a/.exec("a"))
1481                         err = true;
1482             }
1483
1484         This is a 2.5x speedup on this example microbenchmark loop.
1485
1486         In a more advanced form of this optimization, we may be able to avoid allocating
1487         the array where access to the array can be observed.
1488
1489         * create_hash_table:
1490         * dfg/DFGAbstractState.cpp:
1491         (JSC::DFG::AbstractState::execute):
1492         * dfg/DFGByteCodeParser.cpp:
1493         (JSC::DFG::ByteCodeParser::handleIntrinsic):
1494         * dfg/DFGNode.h:
1495         (JSC::DFG::Node::hasHeapPrediction):
1496         * dfg/DFGNodeType.h:
1497         (DFG):
1498         * dfg/DFGOperations.cpp:
1499         * dfg/DFGOperations.h:
1500         * dfg/DFGPredictionPropagationPhase.cpp:
1501         (JSC::DFG::PredictionPropagationPhase::propagate):
1502         * dfg/DFGSpeculativeJIT.cpp:
1503         (JSC::DFG::SpeculativeJIT::compileRegExpExec):
1504         (DFG):
1505         * dfg/DFGSpeculativeJIT.h:
1506         (JSC::DFG::SpeculativeJIT::callOperation):
1507         * dfg/DFGSpeculativeJIT32_64.cpp:
1508         (JSC::DFG::SpeculativeJIT::compile):
1509         * dfg/DFGSpeculativeJIT64.cpp:
1510         (JSC::DFG::SpeculativeJIT::compile):
1511         * jsc.cpp:
1512         (GlobalObject::addConstructableFunction):
1513         * runtime/Intrinsic.h:
1514         * runtime/JSFunction.cpp:
1515         (JSC::JSFunction::create):
1516         (JSC):
1517         * runtime/JSFunction.h:
1518         (JSFunction):
1519         * runtime/Lookup.cpp:
1520         (JSC::setUpStaticFunctionSlot):
1521         * runtime/RegExpObject.cpp:
1522         (JSC::RegExpObject::exec):
1523         (JSC::RegExpObject::match):
1524         * runtime/RegExpObject.h:
1525         (RegExpObject):
1526         * runtime/RegExpPrototype.cpp:
1527         (JSC::regExpProtoFuncTest):
1528         (JSC::regExpProtoFuncExec):
1529
1530 2012-03-16  Michael Saboff  <msaboff@apple.com>
1531
1532         Improve diagnostic benefit of JSGlobalData::m_isInitializingObject
1533         https://bugs.webkit.org/show_bug.cgi?id=81244
1534
1535         Rubber stamped by Filip Pizlo.
1536
1537         Changed type and name of JSGlobalData::m_isInitializingObject to
1538         ClassInfo* and m_initializingObjectClass.
1539         Changed JSGlobalData::setInitializingObject to
1540         JSGlobalData::setInitializingObjectClass.  This pointer can be used within
1541         the debugger to determine what type of object is being initialized.
1542
1543         * runtime/JSCell.h:
1544         (JSC::JSCell::finishCreation):
1545         (JSC::allocateCell):
1546         * runtime/JSGlobalData.cpp:
1547         (JSC::JSGlobalData::JSGlobalData):
1548         * runtime/JSGlobalData.h:
1549         (JSGlobalData):
1550         (JSC::JSGlobalData::isInitializingObject):
1551         (JSC::JSGlobalData::setInitializingObjectClass):
1552         * runtime/Structure.h:
1553         (JSC::JSCell::finishCreation):
1554
1555 2012-03-16  Mark Rowe  <mrowe@apple.com>
1556
1557         Build fix. Do not preserve owner and group information when installing the WTF headers.
1558
1559         * JavaScriptCore.xcodeproj/project.pbxproj:
1560
1561 2012-03-15  David Dorwin  <ddorwin@chromium.org>
1562
1563         Make the array pointer parameters in the Typed Array create() methods const.
1564         https://bugs.webkit.org/show_bug.cgi?id=81147
1565
1566         Reviewed by Kenneth Russell.
1567
1568         This allows const arrays to be passed to these methods.
1569         They use PassRefPtr<Subclass> create(), which already has a const parameter.
1570
1571         * wtf/Int16Array.h:
1572         (Int16Array):
1573         (WTF::Int16Array::create):
1574         * wtf/Int32Array.h:
1575         (Int32Array):
1576         (WTF::Int32Array::create):
1577         * wtf/Int8Array.h:
1578         (Int8Array):
1579         (WTF::Int8Array::create):
1580         * wtf/Uint16Array.h:
1581         (Uint16Array):
1582         (WTF::Uint16Array::create):
1583         * wtf/Uint32Array.h:
1584         (Uint32Array):
1585         (WTF::Uint32Array::create):
1586         * wtf/Uint8Array.h:
1587         (Uint8Array):
1588         (WTF::Uint8Array::create):
1589         * wtf/Uint8ClampedArray.h:
1590         (Uint8ClampedArray):
1591         (WTF::Uint8ClampedArray::create):
1592
1593 2012-03-15  Myles Maxfield  <mmaxfield@google.com>
1594
1595         CopiedSpace::tryAllocateOversize assumes system page size
1596         https://bugs.webkit.org/show_bug.cgi?id=80615
1597
1598         Reviewed by Geoffrey Garen.
1599
1600         * heap/CopiedSpace.cpp:
1601         (JSC::CopiedSpace::tryAllocateOversize):
1602         * heap/CopiedSpace.h:
1603         (CopiedSpace):
1604         * heap/CopiedSpaceInlineMethods.h:
1605         (JSC::CopiedSpace::oversizeBlockFor):
1606         * wtf/BumpPointerAllocator.h:
1607         (WTF::BumpPointerPool::create):
1608         * wtf/StdLibExtras.h:
1609         (WTF::roundUpToMultipleOf):
1610
1611 2012-03-15  Mark Hahnenberg  <mhahnenberg@apple.com>
1612
1613         Fixing Windows build breakage
1614
1615         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1616
1617 2012-03-15  Patrick Gansterer  <paroga@webkit.org>
1618
1619         [EFL] Make zlib a general build requirement
1620         https://bugs.webkit.org/show_bug.cgi?id=80153
1621
1622         Reviewed by Hajime Morita.
1623
1624         After r109538 WebSocket module needs zlib to support deflate-frame extension.
1625
1626         * wtf/Platform.h:
1627
1628 2012-03-15  Benjamin Poulain  <bpoulain@apple.com>
1629
1630         NumericStrings should be inlined
1631         https://bugs.webkit.org/show_bug.cgi?id=81183
1632
1633         Reviewed by Gavin Barraclough.
1634
1635         NumericStrings is not always inlined. When it is not, the class is not faster
1636         than using UString::number() directly.
1637
1638         * runtime/NumericStrings.h:
1639         (JSC::NumericStrings::add):
1640         (JSC::NumericStrings::lookupSmallString):
1641
1642 2012-03-15  Andras Becsi  <andras.becsi@nokia.com>
1643
1644         Fix ARM build after r110792.
1645
1646         Unreviewed build fix.
1647
1648         * jit/ExecutableAllocator.h:
1649         (JSC::ExecutableAllocator::cacheFlush):
1650         Remove superfluous curly brackets.
1651
1652 2012-03-15  Gavin Barraclough  <barraclough@apple.com>
1653
1654         ARMv7: prefer vmov(gpr,gpr->double) over vmov(gpr->single)
1655         https://bugs.webkit.org/show_bug.cgi?id=81256
1656
1657         Reviewed by Oliver Hunt.
1658
1659         This is a 0.5% sunspider progression.
1660
1661         * assembler/MacroAssemblerARMv7.h:
1662         (JSC::MacroAssemblerARMv7::convertInt32ToDouble):
1663             - switch which form of vmov we use.
1664
1665 2012-03-15  YoungTaeck Song  <youngtaeck.song@samsung.com>
1666
1667         [EFL] Add OwnPtr specialization for Ecore_Timer.
1668         https://bugs.webkit.org/show_bug.cgi?id=80119
1669
1670         Reviewed by Hajime Morita.
1671
1672         Add an overload for deleteOwnedPtr(Ecore_Timer*) on EFL port.
1673
1674         * wtf/OwnPtrCommon.h:
1675         (WTF):
1676         * wtf/efl/OwnPtrEfl.cpp:
1677         (WTF::deleteOwnedPtr):
1678         (WTF):
1679
1680 2012-03-15  Hojong Han  <hojong.han@samsung.com>
1681
1682         Linux has madvise enough to support OSAllocator::commit/decommit
1683         https://bugs.webkit.org/show_bug.cgi?id=80505
1684
1685         Reviewed by Geoffrey Garen.
1686
1687         * wtf/OSAllocatorPosix.cpp:
1688         (WTF::OSAllocator::reserveUncommitted):
1689         (WTF::OSAllocator::commit):
1690         (WTF::OSAllocator::decommit):
1691
1692 2012-03-15  Steve Falkenburg  <sfalken@apple.com>
1693
1694         Windows build fix.
1695
1696         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops:
1697         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops:
1698         * JavaScriptCore.vcproj/WTF/copy-files.cmd:
1699         * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops:
1700
1701 2012-03-15  Steve Falkenburg  <sfalken@apple.com>
1702
1703         Windows build fix.
1704
1705         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
1706
1707 2012-03-15  Kevin Ollivier  <kevino@theolliviers.com>
1708
1709         Move wx port to using export macros
1710         https://bugs.webkit.org/show_bug.cgi?id=77279
1711
1712         Reviewed by Hajime Morita.
1713
1714         * wscript:
1715         * wtf/Platform.h:
1716
1717 2012-03-14  Benjamin Poulain  <bpoulain@apple.com>
1718
1719         Avoid StringImpl::getData16SlowCase() when sorting array
1720         https://bugs.webkit.org/show_bug.cgi?id=81070
1721
1722         Reviewed by Geoffrey Garen.
1723
1724         The function codePointCompare() is used intensively when sorting strings.
1725         This patch improves its performance by:
1726         -Avoiding character conversion.
1727         -Inlining the function.
1728
1729         This makes Peacekeeper's arrayCombined test 30% faster.
1730
1731         * wtf/text/StringImpl.cpp:
1732         * wtf/text/StringImpl.h:
1733         (WTF):
1734         (WTF::codePointCompare):
1735         (WTF::codePointCompare8):
1736         (WTF::codePointCompare16):
1737         (WTF::codePointCompare8To16):
1738
1739 2012-03-14  Hojong Han  <hojong.han@samsung.com>
1740
1741         Fix memory allocation failed by fastmalloc
1742         https://bugs.webkit.org/show_bug.cgi?id=79614
1743
1744         Reviewed by Geoffrey Garen.
1745
1746         Memory allocation failed even if the heap grows successfully.
1747         It is wrong to get the span only from the large list after the heap grows,
1748         because new span could be added in the normal list.
1749
1750         * wtf/FastMalloc.cpp:
1751         (WTF::TCMalloc_PageHeap::New):
1752
1753 2012-03-14  Hojong Han  <hojong.han@samsung.com>
1754
1755         Run cacheFlush page by page to assure of flushing all the requested ranges
1756         https://bugs.webkit.org/show_bug.cgi?id=77712
1757
1758         Reviewed by Geoffrey Garen.
1759
1760         Current MetaAllocator concept, always coalesces adjacent free spaces,
1761         doesn't meet memory management of Linux kernel.
1762         In a certain case Linux kernel doesn't regard contiguous virtual memory areas as one but two.
1763         Therefore cacheFlush page by page guarantees a flush-requested range.
1764
1765         * jit/ExecutableAllocator.h:
1766         (JSC::ExecutableAllocator::cacheFlush):
1767
1768 2012-03-14  Oliver Hunt  <oliver@apple.com>
1769
1770         Make ARMv7 work again
1771         https://bugs.webkit.org/show_bug.cgi?id=81157
1772
1773         Reviewed by Geoffrey Garen.
1774
1775         We were trying to use the ARMv7 dataRegister as a scratch register in a scenario
1776         where we the ARMv7MacroAssembler would also try to use dataRegister for its own
1777         nefarious purposes.
1778
1779         * assembler/MacroAssembler.h:
1780         (JSC::MacroAssembler::store32):
1781         * assembler/MacroAssemblerARMv7.h:
1782         (MacroAssemblerARMv7):
1783
1784 2012-03-14  Mark Hahnenberg  <mhahnenberg@apple.com>
1785
1786         Heap::destroy leaks CopiedSpace
1787         https://bugs.webkit.org/show_bug.cgi?id=81055
1788
1789         Reviewed by Geoffrey Garen.
1790
1791         Added a destroy() function to CopiedSpace that moves all normal size
1792         CopiedBlocks from the CopiedSpace to the Heap's list of free blocks
1793         as well as deallocates all of the oversize blocks in the CopiedSpace.
1794         This function is now called in Heap::destroy().
1795
1796         * heap/CopiedSpace.cpp:
1797         (JSC::CopiedSpace::destroy):
1798         (JSC):
1799         * heap/CopiedSpace.h:
1800         (CopiedSpace):
1801         * heap/Heap.cpp:
1802         (JSC::Heap::destroy):
1803
1804 2012-03-14  Andrew Lo  <anlo@rim.com>
1805
1806         [BlackBerry] Implement REQUEST_ANIMATION_FRAME_DISPLAY_MONITOR using AnimationFrameRateController
1807         https://bugs.webkit.org/show_bug.cgi?id=81000
1808
1809         Enable WTF_USE_REQUEST_ANIMATION_FRAME_DISPLAY_MONITOR for BlackBerry.
1810
1811         Reviewed by Antonio Gomes.
1812
1813         * wtf/Platform.h:
1814
1815 2012-03-13  Filip Pizlo  <fpizlo@apple.com>
1816
1817         ValueToInt32 speculation will cause OSR exits even when it does not have to
1818         https://bugs.webkit.org/show_bug.cgi?id=81068
1819         <rdar://problem/11043926>
1820
1821         Reviewed by Anders Carlsson.
1822
1823         Two related changes:
1824         1) ValueToInt32 will now always just defer to the non-speculative path, instead
1825            of exiting, if it doesn't know what speculations to perform.
1826         2) ValueToInt32 will speculate boolean if it sees this to be profitable.
1827
1828         * dfg/DFGAbstractState.cpp:
1829         (JSC::DFG::AbstractState::execute):
1830         * dfg/DFGNode.h:
1831         (JSC::DFG::Node::shouldSpeculateBoolean):
1832         (Node):
1833         * dfg/DFGSpeculativeJIT.cpp:
1834         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
1835
1836 2012-03-13  Mark Hahnenberg  <mhahnenberg@apple.com>
1837
1838         More Windows build fixing
1839
1840         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1841
1842 2012-03-13  Mark Hahnenberg  <mhahnenberg@apple.com>
1843
1844         Windows build fix
1845
1846         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1847
1848 2012-03-13  Mark Hahnenberg  <mhahnenberg@apple.com>
1849
1850         Type conversion of exponential part failed
1851         https://bugs.webkit.org/show_bug.cgi?id=80673
1852
1853         Reviewed by Geoffrey Garen.
1854
1855         * parser/Lexer.cpp:
1856         (JSC::::lex):
1857         * runtime/JSGlobalObjectFunctions.cpp:
1858         (JSC::parseInt):
1859         (JSC):
1860         (JSC::jsStrDecimalLiteral): Added another template argument that exposes whether or not
1861         we accept trailing junk to clients of jsStrDecimalLiteral. Also added additional template
1862         parameter for strtod to allow trailing spaces.
1863         (JSC::toDouble):
1864         (JSC::parseFloat): Accept trailing junk, as per the ECMA 262 spec (15.1.2.3).
1865         * runtime/LiteralParser.cpp:
1866         (JSC::::Lexer::lexNumber):
1867         * tests/mozilla/expected.html: Update the expected page for run-javascriptcore-tests so that
1868         we will run ecma/TypeConversion/9.3.1-3.js as a regression test now.
1869         * wtf/dtoa.cpp:
1870         (WTF):
1871         (WTF::strtod): We also needed to sometimes accept trailing spaces to pass a few other tests that were
1872         broken by changing the default allowance of trailing junk in jsStrDecimalLiteral.
1873         * wtf/dtoa.h:
1874         * wtf/dtoa/double-conversion.cc: When the AdvanceToNonspace function was lifted out of the
1875         Chromium codebase, the person porting it only thought to check for spaces when skipping whitespace.
1876         A few of our JSC tests check for other types of trailing whitespace, so I've added checks for those
1877         here to cover those cases (horizontal tab, vertical tab, carriage return, form feed, and line feed).
1878         * wtf/text/WTFString.cpp:
1879         (WTF::toDoubleType): Disallow trailing spaces, as this breaks form input verification stuff.
1880
1881 2012-03-13  Filip Pizlo  <fpizlo@apple.com>
1882
1883         Unreviewed, build fix since is_pod<> includes some header that I didn't know about.
1884         Removing the assert for now.
1885
1886         * dfg/DFGOperations.h:
1887         * llint/LLIntSlowPaths.h:
1888
1889 2012-03-13  Filip Pizlo  <fpizlo@apple.com>
1890
1891         Functions with C linkage should return POD types
1892         https://bugs.webkit.org/show_bug.cgi?id=81061
1893
1894         Reviewed by Mark Rowe.
1895
1896         * dfg/DFGOperations.h:
1897         * llint/LLIntSlowPaths.h:
1898         (LLInt):
1899         (SlowPathReturnType):
1900         (JSC::LLInt::encodeResult):
1901
1902 2012-03-13  Filip Pizlo  <fpizlo@apple.com>
1903
1904         Loads from UInt32Arrays should not result in a double up-convert if it isn't necessary
1905         https://bugs.webkit.org/show_bug.cgi?id=80979
1906         <rdar://problem/11036848>
1907
1908         Reviewed by Oliver Hunt.
1909
1910         Also improved DFG IR dumping to include type information in a somewhat more
1911         intuitive way.
1912
1913         * bytecode/PredictedType.cpp:
1914         (JSC::predictionToAbbreviatedString):
1915         (JSC):
1916         * bytecode/PredictedType.h:
1917         (JSC):
1918         * dfg/DFGAbstractState.cpp:
1919         (JSC::DFG::AbstractState::execute):
1920         * dfg/DFGGraph.cpp:
1921         (JSC::DFG::Graph::dump):
1922         * dfg/DFGPredictionPropagationPhase.cpp:
1923         (JSC::DFG::PredictionPropagationPhase::propagate):
1924         * dfg/DFGSpeculativeJIT.cpp:
1925         (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
1926         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
1927         * dfg/DFGSpeculativeJIT.h:
1928         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
1929
1930 2012-03-13  George Staikos  <staikos@webkit.org>
1931
1932         The callback is only used if SA_RESTART is defined.  Compile it out
1933         otherwise to avoid a warning.
1934         https://bugs.webkit.org/show_bug.cgi?id=80926
1935
1936         Reviewed by Alexey Proskuryakov.
1937
1938         * heap/MachineStackMarker.cpp:
1939         (JSC):
1940
1941 2012-03-13  Hojong Han  <hojong.han@samsung.com>
1942
1943         Dump the generated code for ARM_TRADITIONAL
1944         https://bugs.webkit.org/show_bug.cgi?id=80975
1945
1946         Reviewed by Gavin Barraclough.
1947
1948         * assembler/LinkBuffer.h:
1949         (JSC::LinkBuffer::dumpCode):
1950
1951 2012-03-13  Adam Barth  <abarth@webkit.org> && Benjamin Poulain  <bpoulain@apple.com>
1952
1953         Always enable ENABLE(CLIENT_BASED_GEOLOCATION)
1954         https://bugs.webkit.org/show_bug.cgi?id=78853
1955
1956         Reviewed by Adam Barth.
1957
1958         * Configurations/FeatureDefines.xcconfig:
1959         * wtf/Platform.h:
1960
1961 2012-03-13  Kwonjin Jeong  <gram@company100.net>
1962
1963         Remove SlotVisitor::copy() method.
1964         https://bugs.webkit.org/show_bug.cgi?id=80973
1965
1966         Reviewed by Geoffrey Garen.
1967
1968         SlotVisitor::copy() method isn't called anywhere.
1969
1970         * heap/MarkStack.cpp: Remove definition of SlotVisitor::copy() method.
1971         * heap/SlotVisitor.h: Remove declaration of SlotVisitor::copy() method.
1972
1973 2012-03-12  Hojong Han  <hojong.han@samsung.com>
1974
1975         Fix test cases for RegExp multiline
1976         https://bugs.webkit.org/show_bug.cgi?id=80822
1977
1978         Reviewed by Gavin Barraclough.
1979
1980         * tests/mozilla/js1_2/regexp/RegExp_multiline.js:
1981         * tests/mozilla/js1_2/regexp/RegExp_multiline_as_array.js:
1982         * tests/mozilla/js1_2/regexp/beginLine.js:
1983         * tests/mozilla/js1_2/regexp/endLine.js:
1984
1985 2012-03-12  Filip Pizlo  <fpizlo@apple.com>
1986
1987         Arithmetic use inference should be procedure-global and should run in tandem
1988         with type propagation
1989         https://bugs.webkit.org/show_bug.cgi?id=80819
1990         <rdar://problem/11034006>
1991
1992         Reviewed by Gavin Barraclough.
1993
1994         * CMakeLists.txt:
1995         * GNUmakefile.list.am:
1996         * JavaScriptCore.xcodeproj/project.pbxproj:
1997         * Target.pri:
1998         * dfg/DFGArithNodeFlagsInferencePhase.cpp: Removed.
1999         * dfg/DFGArithNodeFlagsInferencePhase.h: Removed.
2000         * dfg/DFGDriver.cpp:
2001         (JSC::DFG::compile):
2002         * dfg/DFGPredictionPropagationPhase.cpp:
2003         (JSC::DFG::PredictionPropagationPhase::isNotNegZero):
2004         (PredictionPropagationPhase):
2005         (JSC::DFG::PredictionPropagationPhase::isNotZero):
2006         (JSC::DFG::PredictionPropagationPhase::propagate):
2007         (JSC::DFG::PredictionPropagationPhase::mergeDefaultArithFlags):
2008         * dfg/DFGVariableAccessData.h:
2009         (JSC::DFG::VariableAccessData::VariableAccessData):
2010         (JSC::DFG::VariableAccessData::flags):
2011         (VariableAccessData):
2012         (JSC::DFG::VariableAccessData::mergeFlags):
2013
2014 2012-03-12  Filip Pizlo  <fpizlo@apple.com>
2015
2016         Node::op and Node::flags should be private
2017         https://bugs.webkit.org/show_bug.cgi?id=80824
2018         <rdar://problem/11033435>
2019
2020         Reviewed by Gavin Barraclough.
2021
2022         * CMakeLists.txt:
2023         * GNUmakefile.list.am:
2024         * JavaScriptCore.xcodeproj/project.pbxproj:
2025         * Target.pri:
2026         * dfg/DFGAbstractState.cpp:
2027         (JSC::DFG::AbstractState::initialize):
2028         (JSC::DFG::AbstractState::execute):
2029         (JSC::DFG::AbstractState::mergeStateAtTail):
2030         (JSC::DFG::AbstractState::mergeToSuccessors):
2031         * dfg/DFGArithNodeFlagsInferencePhase.cpp:
2032         (JSC::DFG::ArithNodeFlagsInferencePhase::propagate):
2033         * dfg/DFGByteCodeParser.cpp:
2034         (JSC::DFG::ByteCodeParser::injectLazyOperandPrediction):
2035         (JSC::DFG::ByteCodeParser::getLocal):
2036         (JSC::DFG::ByteCodeParser::getArgument):
2037         (JSC::DFG::ByteCodeParser::flushArgument):
2038         (JSC::DFG::ByteCodeParser::toInt32):
2039         (JSC::DFG::ByteCodeParser::isJSConstant):
2040         (JSC::DFG::ByteCodeParser::makeSafe):
2041         (JSC::DFG::ByteCodeParser::makeDivSafe):
2042         (JSC::DFG::ByteCodeParser::handleInlining):
2043         (JSC::DFG::ByteCodeParser::parseBlock):
2044         (JSC::DFG::ByteCodeParser::processPhiStack):
2045         (JSC::DFG::ByteCodeParser::linkBlock):
2046         * dfg/DFGCFAPhase.cpp:
2047         (JSC::DFG::CFAPhase::performBlockCFA):
2048         * dfg/DFGCSEPhase.cpp:
2049         (JSC::DFG::CSEPhase::canonicalize):
2050         (JSC::DFG::CSEPhase::endIndexForPureCSE):
2051         (JSC::DFG::CSEPhase::pureCSE):
2052         (JSC::DFG::CSEPhase::byValIsPure):
2053         (JSC::DFG::CSEPhase::clobbersWorld):
2054         (JSC::DFG::CSEPhase::impureCSE):
2055         (JSC::DFG::CSEPhase::globalVarLoadElimination):
2056         (JSC::DFG::CSEPhase::getByValLoadElimination):
2057         (JSC::DFG::CSEPhase::checkFunctionElimination):
2058         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
2059         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
2060         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
2061         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
2062         (JSC::DFG::CSEPhase::getScopeChainLoadElimination):
2063         (JSC::DFG::CSEPhase::performNodeCSE):
2064         * dfg/DFGGraph.cpp:
2065         (JSC::DFG::Graph::dump):
2066         (DFG):
2067         * dfg/DFGGraph.h:
2068         (JSC::DFG::Graph::addShouldSpeculateInteger):
2069         (JSC::DFG::Graph::negateShouldSpeculateInteger):
2070         (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
2071         * dfg/DFGNode.cpp: Removed.
2072         * dfg/DFGNode.h:
2073         (DFG):
2074         (JSC::DFG::Node::Node):
2075         (Node):
2076         (JSC::DFG::Node::op):
2077         (JSC::DFG::Node::flags):
2078         (JSC::DFG::Node::setOp):
2079         (JSC::DFG::Node::setFlags):
2080         (JSC::DFG::Node::mergeFlags):
2081         (JSC::DFG::Node::filterFlags):
2082         (JSC::DFG::Node::clearFlags):
2083         (JSC::DFG::Node::setOpAndDefaultFlags):
2084         (JSC::DFG::Node::mustGenerate):
2085         (JSC::DFG::Node::isConstant):
2086         (JSC::DFG::Node::isWeakConstant):
2087         (JSC::DFG::Node::valueOfJSConstant):
2088         (JSC::DFG::Node::hasVariableAccessData):
2089         (JSC::DFG::Node::hasIdentifier):
2090         (JSC::DFG::Node::resolveGlobalDataIndex):
2091         (JSC::DFG::Node::hasArithNodeFlags):
2092         (JSC::DFG::Node::arithNodeFlags):
2093         (JSC::DFG::Node::setArithNodeFlag):
2094         (JSC::DFG::Node::mergeArithNodeFlags):
2095         (JSC::DFG::Node::hasConstantBuffer):
2096         (JSC::DFG::Node::hasRegexpIndex):
2097         (JSC::DFG::Node::hasVarNumber):
2098         (JSC::DFG::Node::hasScopeChainDepth):
2099         (JSC::DFG::Node::hasResult):
2100         (JSC::DFG::Node::hasInt32Result):
2101         (JSC::DFG::Node::hasNumberResult):
2102         (JSC::DFG::Node::hasJSResult):
2103         (JSC::DFG::Node::hasBooleanResult):
2104         (JSC::DFG::Node::isJump):
2105         (JSC::DFG::Node::isBranch):
2106         (JSC::DFG::Node::isTerminal):
2107         (JSC::DFG::Node::hasHeapPrediction):
2108         (JSC::DFG::Node::hasFunctionCheckData):
2109         (JSC::DFG::Node::hasStructureTransitionData):
2110         (JSC::DFG::Node::hasStructureSet):
2111         (JSC::DFG::Node::hasStorageAccessData):
2112         (JSC::DFG::Node::hasFunctionDeclIndex):
2113         (JSC::DFG::Node::hasFunctionExprIndex):
2114         (JSC::DFG::Node::child1):
2115         (JSC::DFG::Node::child2):
2116         (JSC::DFG::Node::child3):
2117         (JSC::DFG::Node::firstChild):
2118         (JSC::DFG::Node::numChildren):
2119         * dfg/DFGNodeFlags.cpp: Copied from Source/JavaScriptCore/dfg/DFGNode.cpp.
2120         * dfg/DFGNodeFlags.h: Added.
2121         (DFG):
2122         (JSC::DFG::nodeUsedAsNumber):
2123         (JSC::DFG::nodeCanTruncateInteger):
2124         (JSC::DFG::nodeCanIgnoreNegativeZero):
2125         (JSC::DFG::nodeMayOverflow):
2126         (JSC::DFG::nodeCanSpeculateInteger):
2127         * dfg/DFGNodeType.h: Added.
2128         (DFG):
2129         (JSC::DFG::defaultFlags):
2130         * dfg/DFGPredictionPropagationPhase.cpp:
2131         (JSC::DFG::PredictionPropagationPhase::propagate):
2132         (JSC::DFG::PredictionPropagationPhase::vote):
2133         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
2134         (JSC::DFG::PredictionPropagationPhase::fixupNode):
2135         * dfg/DFGRedundantPhiEliminationPhase.cpp:
2136         (JSC::DFG::RedundantPhiEliminationPhase::run):
2137         (JSC::DFG::RedundantPhiEliminationPhase::replacePhiChild):
2138         (JSC::DFG::RedundantPhiEliminationPhase::updateBlockVariableInformation):
2139         * dfg/DFGSpeculativeJIT.cpp:
2140         (JSC::DFG::SpeculativeJIT::useChildren):
2141         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
2142         (JSC::DFG::SpeculativeJIT::compileMovHint):
2143         (JSC::DFG::SpeculativeJIT::compile):
2144         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
2145         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
2146         (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
2147         (JSC::DFG::SpeculativeJIT::compileAdd):
2148         (JSC::DFG::SpeculativeJIT::compare):
2149         * dfg/DFGSpeculativeJIT.h:
2150         (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
2151         * dfg/DFGSpeculativeJIT32_64.cpp:
2152         (JSC::DFG::SpeculativeJIT::emitCall):
2153         (JSC::DFG::SpeculativeJIT::compile):
2154         * dfg/DFGSpeculativeJIT64.cpp:
2155         (JSC::DFG::SpeculativeJIT::emitCall):
2156         (JSC::DFG::SpeculativeJIT::compile):
2157         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
2158         (JSC::DFG::VirtualRegisterAllocationPhase::run):
2159
2160 2012-03-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
2161
2162         Minor DataLog fixes
2163         https://bugs.webkit.org/show_bug.cgi?id=80826
2164
2165         Reviewed by Andreas Kling.
2166
2167         * bytecode/ExecutionCounter.cpp:
2168         Do not include DataLog.h, it is not used.
2169
2170         * jit/ExecutableAllocator.cpp:
2171         Ditto.
2172
2173         * wtf/DataLog.cpp:
2174         (WTF::initializeLogFileOnce):
2175         Add missing semi-colon to the code path where DATA_LOG_FILENAME is defined.
2176
2177         * wtf/HashTable.cpp:
2178         Include DataLog as it is used.
2179
2180 2012-03-12  SangGyu Lee  <sg5.lee@samsung.com>
2181
2182         Integer overflow check code in arithmetic operation in classic interpreter
2183         https://bugs.webkit.org/show_bug.cgi?id=80465
2184
2185         Reviewed by Gavin Barraclough.
2186
2187         * interpreter/Interpreter.cpp:
2188         (JSC::Interpreter::privateExecute):
2189
2190 2012-03-12  Zeno Albisser  <zeno@webkit.org>
2191
2192         [Qt][Mac] Build fails after enabling LLINT when JIT is disabled (r109863)
2193         https://bugs.webkit.org/show_bug.cgi?id=80827
2194
2195         Qt on Mac uses OS(DARWIN) as well, but we do not want to enable LLINT.
2196
2197         Reviewed by Simon Hausmann.
2198
2199         * wtf/Platform.h:
2200
2201 2012-03-12  Simon Hausmann  <simon.hausmann@nokia.com>
2202
2203         Unreviewed prospective Qt/Mac build fix
2204
2205         * runtime/JSGlobalData.cpp: use #USE(CF) instead of PLATFORM(MAC) to determine
2206         whether to include CoreFoundation headers, used for JIT configuration in JSGlobalData
2207         constructor.
2208
2209 2012-03-12  Filip Pizlo  <fpizlo@apple.com>
2210
2211         All DFG nodes should have a mutable set of flags
2212         https://bugs.webkit.org/show_bug.cgi?id=80779
2213         <rdar://problem/11026218>
2214
2215         Reviewed by Gavin Barraclough.
2216
2217         Got rid of NodeId, and placed all of the flags that distinguished NodeId
2218         from NodeType into a separate Node::flags field. Combined what was previously
2219         ArithNodeFlags into Node::flags.
2220
2221         In the process of debugging, I found that the debug support in the virtual
2222         register allocator was lacking, so I improved it. I also realized that the
2223         virtual register allocator was assuming that the nodes in a basic block were
2224         contiguous, which is no longer the case. So I fixed that. The fix also made
2225         it natural to have more extreme assertions, so I added them. I suspect this
2226         will make it easier to catch virtual register allocation bugs in the future.
2227
2228         This is mostly performance neutral; if anything it looks like a slight
2229         speed-up.
2230
2231         This patch does leave some work for future refactorings; for example, Node::op
2232         is unencapsulated. This was already the case, though now it feels even more
2233         like it should be. I avoided doing that because this patch has already grown
2234         way bigger than I wanted.
2235
2236         Finally, this patch creates a DFGNode.cpp file and makes a slight effort to
2237         move some unnecessarily inline stuff out of DFGNode.h.
2238
2239         * CMakeLists.txt:
2240         * GNUmakefile.list.am:
2241         * JavaScriptCore.xcodeproj/project.pbxproj:
2242         * Target.pri:
2243         * dfg/DFGArithNodeFlagsInferencePhase.cpp:
2244         (JSC::DFG::ArithNodeFlagsInferencePhase::propagate):
2245         * dfg/DFGByteCodeParser.cpp:
2246         (JSC::DFG::ByteCodeParser::addToGraph):
2247         (JSC::DFG::ByteCodeParser::makeSafe):
2248         (JSC::DFG::ByteCodeParser::makeDivSafe):
2249         (JSC::DFG::ByteCodeParser::handleMinMax):
2250         (JSC::DFG::ByteCodeParser::handleIntrinsic):
2251         (JSC::DFG::ByteCodeParser::parseBlock):
2252         * dfg/DFGCFAPhase.cpp:
2253         (JSC::DFG::CFAPhase::performBlockCFA):
2254         * dfg/DFGCSEPhase.cpp:
2255         (JSC::DFG::CSEPhase::endIndexForPureCSE):
2256         (JSC::DFG::CSEPhase::pureCSE):
2257         (JSC::DFG::CSEPhase::clobbersWorld):
2258         (JSC::DFG::CSEPhase::impureCSE):
2259         (JSC::DFG::CSEPhase::setReplacement):
2260         (JSC::DFG::CSEPhase::eliminate):
2261         (JSC::DFG::CSEPhase::performNodeCSE):
2262         (JSC::DFG::CSEPhase::performBlockCSE):
2263         (CSEPhase):
2264         * dfg/DFGGraph.cpp:
2265         (JSC::DFG::Graph::opName):
2266         (JSC::DFG::Graph::dump):
2267         (DFG):
2268         * dfg/DFGNode.cpp: Added.
2269         (DFG):
2270         (JSC::DFG::arithNodeFlagsAsString):
2271         * dfg/DFGNode.h:
2272         (DFG):
2273         (JSC::DFG::nodeUsedAsNumber):
2274         (JSC::DFG::nodeCanTruncateInteger):
2275         (JSC::DFG::nodeCanIgnoreNegativeZero):
2276         (JSC::DFG::nodeMayOverflow):
2277         (JSC::DFG::nodeCanSpeculateInteger):
2278         (JSC::DFG::defaultFlags):
2279         (JSC::DFG::Node::Node):
2280         (Node):
2281         (JSC::DFG::Node::setOpAndDefaultFlags):
2282         (JSC::DFG::Node::mustGenerate):
2283         (JSC::DFG::Node::arithNodeFlags):
2284         (JSC::DFG::Node::setArithNodeFlag):
2285         (JSC::DFG::Node::mergeArithNodeFlags):
2286         (JSC::DFG::Node::hasResult):
2287         (JSC::DFG::Node::hasInt32Result):
2288         (JSC::DFG::Node::hasNumberResult):
2289         (JSC::DFG::Node::hasJSResult):
2290         (JSC::DFG::Node::hasBooleanResult):
2291         (JSC::DFG::Node::isJump):
2292         (JSC::DFG::Node::isBranch):
2293         (JSC::DFG::Node::isTerminal):
2294         (JSC::DFG::Node::child1):
2295         (JSC::DFG::Node::child2):
2296         (JSC::DFG::Node::child3):
2297         (JSC::DFG::Node::firstChild):
2298         (JSC::DFG::Node::numChildren):
2299         * dfg/DFGPredictionPropagationPhase.cpp:
2300         (JSC::DFG::PredictionPropagationPhase::propagate):
2301         (JSC::DFG::PredictionPropagationPhase::vote):
2302         (JSC::DFG::PredictionPropagationPhase::fixupNode):
2303         * dfg/DFGScoreBoard.h:
2304         (ScoreBoard):
2305         (JSC::DFG::ScoreBoard::~ScoreBoard):
2306         (JSC::DFG::ScoreBoard::assertClear):
2307         (JSC::DFG::ScoreBoard::use):
2308         * dfg/DFGSpeculativeJIT.cpp:
2309         (JSC::DFG::SpeculativeJIT::useChildren):
2310         * dfg/DFGSpeculativeJIT32_64.cpp:
2311         (JSC::DFG::SpeculativeJIT::compile):
2312         * dfg/DFGSpeculativeJIT64.cpp:
2313         (JSC::DFG::SpeculativeJIT::compile):
2314         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
2315         (JSC::DFG::VirtualRegisterAllocationPhase::run):
2316
2317 2012-03-10  Filip Pizlo  <fpizlo@apple.com>
2318
2319         LLInt should support JSVALUE64
2320         https://bugs.webkit.org/show_bug.cgi?id=79609
2321         <rdar://problem/10063437>
2322
2323         Reviewed by Gavin Barraclough and Oliver Hunt.
2324
2325         Ported the LLInt, which previously only worked on 32-bit, to 64-bit. This
2326         patch moves a fair bit of code from LowLevelInterpreter32_64.asm to the common
2327         file, LowLevelInterpreter.asm. About 1/3 of the LLInt did not have to be
2328         specialized for value representation.
2329
2330         Also made some minor changes to offlineasm and the slow-paths.
2331
2332         * llint/LLIntData.cpp:
2333         (JSC::LLInt::Data::performAssertions):
2334         * llint/LLIntEntrypoints.cpp:
2335         * llint/LLIntSlowPaths.cpp:
2336         (LLInt):
2337         (JSC::LLInt::llint_trace_value):
2338         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2339         (JSC::LLInt::jitCompileAndSetHeuristics):
2340         * llint/LLIntSlowPaths.h:
2341         (LLInt):
2342         (SlowPathReturnType):
2343         (JSC::LLInt::SlowPathReturnType::SlowPathReturnType):
2344         (JSC::LLInt::encodeResult):
2345         * llint/LLIntThunks.cpp:
2346         * llint/LowLevelInterpreter.asm:
2347         * llint/LowLevelInterpreter32_64.asm:
2348         * llint/LowLevelInterpreter64.asm:
2349         * offlineasm/armv7.rb:
2350         * offlineasm/asm.rb:
2351         * offlineasm/ast.rb:
2352         * offlineasm/backends.rb:
2353         * offlineasm/instructions.rb:
2354         * offlineasm/parser.rb:
2355         * offlineasm/registers.rb:
2356         * offlineasm/transform.rb:
2357         * offlineasm/x86.rb:
2358         * wtf/Platform.h:
2359
2360 2012-03-10  Yong Li  <yoli@rim.com>
2361
2362         Web Worker crashes with WX_EXCLUSIVE
2363         https://bugs.webkit.org/show_bug.cgi?id=80532
2364
2365         Let each JS global object own a meta allocator
2366         for WX_EXCLUSIVE to avoid conflicts from Web Worker.
2367         Also fix a mutex leak in MetaAllocator's dtor.
2368
2369         Reviewed by Filip Pizlo.
2370
2371         * jit/ExecutableAllocator.cpp:
2372         (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
2373         (JSC::DemandExecutableAllocator::~DemandExecutableAllocator):
2374         (JSC::DemandExecutableAllocator::bytesAllocatedByAllAllocators):
2375         (DemandExecutableAllocator):
2376         (JSC::DemandExecutableAllocator::bytesCommittedByAllocactors):
2377         (JSC::DemandExecutableAllocator::dumpProfileFromAllAllocators):
2378         (JSC::DemandExecutableAllocator::allocateNewSpace):
2379         (JSC::DemandExecutableAllocator::allocators):
2380         (JSC::DemandExecutableAllocator::allocatorsMutex):
2381         (JSC):
2382         (JSC::ExecutableAllocator::initializeAllocator):
2383         (JSC::ExecutableAllocator::ExecutableAllocator):
2384         (JSC::ExecutableAllocator::underMemoryPressure):
2385         (JSC::ExecutableAllocator::memoryPressureMultiplier):
2386         (JSC::ExecutableAllocator::allocate):
2387         (JSC::ExecutableAllocator::committedByteCount):
2388         (JSC::ExecutableAllocator::dumpProfile):
2389         * jit/ExecutableAllocator.h:
2390         (JSC):
2391         (ExecutableAllocator):
2392         (JSC::ExecutableAllocator::allocator):
2393         * wtf/MetaAllocator.h:
2394         (WTF::MetaAllocator::~MetaAllocator): Finalize the spin lock.
2395         * wtf/TCSpinLock.h:
2396         (TCMalloc_SpinLock::Finalize): Add empty Finalize() to some implementations.
2397
2398 2012-03-09  Gavin Barraclough  <barraclough@apple.com>
2399
2400         Object.freeze broken on latest Nightly
2401         https://bugs.webkit.org/show_bug.cgi?id=80577
2402
2403         Reviewed by Oliver Hunt.
2404
2405         The problem here is that deleteProperty rejects deletion of prototype.
2406         This is correct in most cases, however defineOwnPropery is presently
2407         implemented internally to ensure the attributes change by deleting the
2408         old property, and creating a new one.
2409
2410         * runtime/JSFunction.cpp:
2411         (JSC::JSFunction::deleteProperty):
2412             - If deletePropery is called via defineOwnPropery, allow old prototype to be removed.
2413
2414 2012-03-09  Gavin Barraclough  <barraclough@apple.com>
2415
2416         Array.prototype.toLocaleString visits elements in wrong order under certain conditions
2417         https://bugs.webkit.org/show_bug.cgi?id=80663
2418
2419         Reviewed by Michael Saboff.
2420
2421         The bug here is actually that we're continuing to process the array after an exception
2422         has been thrown, and that the second value throw is overriding the first.
2423
2424         * runtime/ArrayPrototype.cpp:
2425         (JSC::arrayProtoFuncToLocaleString):
2426
2427 2012-03-09  Ryosuke Niwa  <rniwa@webkit.org>
2428
2429         WebKit compiled by gcc (Xcode 3.2.6) hangs while running DOM/Accessors.html
2430         https://bugs.webkit.org/show_bug.cgi?id=80080
2431
2432         Reviewed by Filip Pizlo.
2433
2434         * bytecode/SamplingTool.cpp:
2435         (JSC::SamplingRegion::Locker::Locker):
2436         (JSC::SamplingRegion::Locker::~Locker):
2437         * bytecode/SamplingTool.h:
2438         (JSC::SamplingRegion::exchangeCurrent):
2439         * wtf/Atomics.h:
2440         (WTF):
2441         (WTF::weakCompareAndSwap):
2442         (WTF::weakCompareAndSwapUIntPtr):
2443
2444 2012-03-09  Gavin Barraclough  <barraclough@apple.com>
2445
2446         REGRESSION: Date.parse("Tue Nov 23 20:40:05 2010 GMT") returns NaN
2447         https://bugs.webkit.org/show_bug.cgi?id=49989
2448
2449         Reviewed by Oliver Hunt.
2450
2451         Patch originally by chris reiss <christopher.reiss@nokia.com>,
2452         allow the year to appear before the timezone in date strings.
2453
2454         * wtf/DateMath.cpp:
2455         (WTF::parseDateFromNullTerminatedCharacters):
2456
2457 2012-03-09  Mark Rowe  <mrowe@apple.com>
2458
2459         Ensure that the WTF headers are copied at installhdrs time.
2460
2461         Reviewed by Dan Bernstein and Jessie Berlin.
2462
2463         * Configurations/JavaScriptCore.xcconfig: Set INSTALLHDRS_SCRIPT_PHASE = YES
2464         so that our script phases are invoked at installhdrs time. The only one that
2465         does any useful work at that time is the one that installs WTF headers.
2466
2467 2012-03-09  Jon Lee  <jonlee@apple.com>
2468
2469         Add support for ENABLE(LEGACY_NOTIFICATIONS)
2470         https://bugs.webkit.org/show_bug.cgi?id=80497
2471
2472         Reviewed by Adam Barth.
2473
2474         Prep for b80472: Update API for Web Notifications
2475         * Configurations/FeatureDefines.xcconfig:
2476
2477 2012-03-09  Ashod Nakashian  <ashodnakashian@yahoo.com>
2478
2479         Bash scripts should support LF endings only
2480         https://bugs.webkit.org/show_bug.cgi?id=79509
2481
2482         Reviewed by David Kilzer.
2483
2484         * gyp/generate-derived-sources.sh: Added property svn:eol-style.
2485         * gyp/run-if-exists.sh: Added property svn:eol-style.
2486         * gyp/update-info-plist.sh: Added property svn:eol-style.
2487
2488 2012-03-09  Jessie Berlin  <jberlin@apple.com>
2489
2490         Windows debug build fix.
2491
2492         * assembler/MacroAssembler.h:
2493         (JSC::MacroAssembler::shouldBlind):
2494         Fix unreachable code warnings (which we treat as errors).
2495
2496 2012-03-09  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
2497
2498         Reviewed by Zoltan Herczeg.
2499
2500         [Qt] Fix the SH4 build after r109834
2501         https://bugs.webkit.org/show_bug.cgi?id=80492
2502
2503         * assembler/MacroAssemblerSH4.h:
2504         (JSC::MacroAssemblerSH4::branchAdd32):
2505         (JSC::MacroAssemblerSH4::branchSub32):
2506
2507 2012-03-09  Andy Wingo  <wingo@igalia.com>
2508
2509         Refactor code feature analysis in the parser
2510         https://bugs.webkit.org/show_bug.cgi?id=79112
2511
2512         Reviewed by Geoffrey Garen.
2513
2514         This commit refactors the parser to more uniformly propagate flag
2515         bits down and up the parse process, as the parser descends and
2516         returns into nested blocks.  Some flags get passed town to
2517         subscopes, some apply to specific scopes only, and some get
2518         unioned up after parsing subscopes.
2519
2520         The goal is to eventually be very precise with scoping
2521         information, once we have block scopes: one block scope might use
2522         `eval', which would require the emission of a symbol table within
2523         that block and containing blocks, whereas another block in the
2524         same function might not, allowing us to not emit a symbol table.
2525
2526         * parser/Nodes.h:
2527         (JSC::ScopeFlags): Rename from CodeFeatures.
2528         (JSC::ScopeNode::addScopeFlags):
2529         (JSC::ScopeNode::scopeFlags): New accessors for m_scopeFlags.
2530         (JSC::ScopeNode::isStrictMode):
2531         (JSC::ScopeNode::usesEval):
2532         (JSC::ScopeNode::usesArguments):
2533         (JSC::ScopeNode::setUsesArguments):
2534         (JSC::ScopeNode::usesThis):
2535         (JSC::ScopeNode::needsActivationForMoreThanVariables):
2536         (JSC::ScopeNode::needsActivation): Refactor these accessors to
2537         operate on the m_scopeFlags member.
2538         (JSC::ScopeNode::source):
2539         (JSC::ScopeNode::sourceURL):
2540         (JSC::ScopeNode::sourceID): Shuffle these definitions around; no
2541         semantic change.
2542         (JSC::ScopeNode::ScopeNode)
2543         (JSC::ProgramNode::ProgramNode)
2544         (JSC::EvalNode::EvalNode)
2545         (JSC::FunctionBodyNode::FunctionBodyNode): Have these constructors
2546         take a ScopeFlags as an argument, instead of a bool inStrictContext.
2547
2548         * parser/Nodes.cpp:
2549         (JSC::ScopeNode::ScopeNode):
2550         (JSC::ProgramNode::ProgramNode):
2551         (JSC::ProgramNode::create):
2552         (JSC::EvalNode::EvalNode):
2553         (JSC::EvalNode::create):
2554         (JSC::FunctionBodyNode::FunctionBodyNode):
2555         (JSC::FunctionBodyNode::create): Adapt constructors to change.
2556
2557         * parser/ASTBuilder.h:
2558         (JSC::ASTBuilder::ASTBuilder):
2559         (JSC::ASTBuilder::thisExpr):
2560         (JSC::ASTBuilder::createResolve):
2561         (JSC::ASTBuilder::createFunctionBody):
2562         (JSC::ASTBuilder::createFuncDeclStatement):
2563         (JSC::ASTBuilder::createTryStatement):
2564         (JSC::ASTBuilder::createWithStatement):
2565         (JSC::ASTBuilder::addVar):
2566         (JSC::ASTBuilder::Scope::Scope):
2567         (Scope):
2568         (ASTBuilder):
2569         (JSC::ASTBuilder::makeFunctionCallNode): Don't track scope
2570         features here.  Instead rely on the base Parser mechanism to track
2571         features.
2572
2573         * parser/NodeInfo.h (NodeInfo, NodeDeclarationInfo): "ScopeFlags".
2574
2575         * parser/Parser.h:
2576         (JSC::Scope::Scope): Manage scope through flags, not
2577         bit-booleans.  This lets us uniformly propagate them up and down.
2578         (JSC::Scope::declareWrite):
2579         (JSC::Scope::declareParameter):
2580         (JSC::Scope::useVariable):
2581         (JSC::Scope::collectFreeVariables):
2582         (JSC::Scope::getCapturedVariables):
2583         (JSC::Scope::saveFunctionInfo):
2584         (JSC::Scope::restoreFunctionInfo):
2585         (JSC::Parser::pushScope): Adapt to use scope flags and their
2586         accessors instead of bit-booleans.
2587         * parser/Parser.cpp:
2588         (JSC::::Parser):
2589         (JSC::::parseInner):
2590         (JSC::::didFinishParsing):
2591         (JSC::::parseSourceElements):
2592         (JSC::::parseVarDeclarationList):
2593         (JSC::::parseConstDeclarationList):
2594         (JSC::::parseWithStatement):
2595         (JSC::::parseTryStatement):
2596         (JSC::::parseFunctionBody):
2597         (JSC::::parseFunctionInfo):
2598         (JSC::::parseFunctionDeclaration):
2599         (JSC::::parsePrimaryExpression): Hoist some of the flag handling
2600         out of the "context" (ASTBuilder or SyntaxChecker) and to here.
2601         Does not seem to have a performance impact.
2602
2603         * parser/SourceProviderCacheItem.h (SourceProviderCacheItem):
2604         Cache the scopeflags.
2605         * parser/SyntaxChecker.h: Remove evalCount() decl.
2606
2607         * runtime/Executable.cpp:
2608         (JSC::EvalExecutable::compileInternal):
2609         (JSC::ProgramExecutable::compileInternal):
2610         (JSC::FunctionExecutable::produceCodeBlockFor):
2611         * runtime/Executable.h:
2612         (JSC::ScriptExecutable::ScriptExecutable):
2613         (JSC::ScriptExecutable::usesEval):
2614         (JSC::ScriptExecutable::usesArguments):
2615         (JSC::ScriptExecutable::needsActivation):
2616         (JSC::ScriptExecutable::isStrictMode):
2617         (JSC::ScriptExecutable::recordParse):
2618         (ScriptExecutable): ScopeFlags, not features.
2619
2620 2012-03-08  Benjamin Poulain  <bpoulain@apple.com>
2621
2622         Build fix for MSVC after r110266
2623
2624         Unreviewed. A #ifdef for MSVC was left over in r110266.
2625
2626         * runtime/RegExpObject.h:
2627         (RegExpObject):
2628
2629 2012-03-08  Benjamin Poulain  <bpoulain@apple.com>
2630
2631         Allocate the RegExpObject's data with the Cell
2632         https://bugs.webkit.org/show_bug.cgi?id=80654
2633
2634         Reviewed by Gavin Barraclough.
2635
2636         This patch removes the creation of RegExpObject's data to avoid the overhead
2637         create by the allocation and destruction.
2638
2639         We RegExp are created repeatedly, this provides some performance improvment.
2640         The PeaceKeeper test stringDetectBrowser improves by 10%.
2641
2642         * runtime/RegExpObject.cpp:
2643         (JSC::RegExpObject::RegExpObject):
2644         (JSC::RegExpObject::visitChildren):
2645         (JSC::RegExpObject::getOwnPropertyDescriptor):
2646         (JSC::RegExpObject::defineOwnProperty):
2647         (JSC::RegExpObject::match):
2648         * runtime/RegExpObject.h:
2649         (JSC::RegExpObject::setRegExp):
2650         (JSC::RegExpObject::regExp):
2651         (JSC::RegExpObject::setLastIndex):
2652         (JSC::RegExpObject::getLastIndex):
2653         (RegExpObject):
2654
2655 2012-03-08  Steve Falkenburg  <sfalken@apple.com>
2656
2657         Separate WTF parts of JavaScriptCoreGenerated into WTFGenerated for Windows build
2658         https://bugs.webkit.org/show_bug.cgi?id=80657
2659
2660         Preparation for WTF separation from JavaScriptCore.
2661         The "Generated" vcproj files on Windows are necessary so Visual Studio can calculate correct
2662         dependencies for generated files.
2663
2664         This also removes the PGO build targets from the WTF code, since we can't build instrumentation/optimization
2665         versions of the WTF code independent of the JavaScriptCore code.
2666
2667         Reviewed by Jessie Berlin.
2668
2669         * JavaScriptCore.vcproj/JavaScriptCore.sln: Add WTFGenerated, update dependent projects.
2670         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Removed WTF specific parts.
2671         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Removed WTF specific parts.
2672         * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Removed WTF specific parts.
2673         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: Removed WTF specific parts.
2674         * JavaScriptCore.vcproj/JavaScriptCore/work-around-vs-dependency-tracking-bugs.py: Removed.
2675         * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Add WTFGenerated, update dependent projects.
2676         * JavaScriptCore.vcproj/WTF/WTF.vcproj: Remove PGO targets from WTF.
2677         * JavaScriptCore.vcproj/WTF/WTFGenerated.make: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make.
2678         * JavaScriptCore.vcproj/WTF/WTFGenerated.vcproj: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj.
2679         * JavaScriptCore.vcproj/WTF/WTFGeneratedCommon.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops.
2680         * JavaScriptCore.vcproj/WTF/WTFGeneratedDebug.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops.
2681         * JavaScriptCore.vcproj/WTF/WTFGeneratedDebugAll.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops.
2682         * JavaScriptCore.vcproj/WTF/WTFGeneratedDebugCairoCFLite.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops.
2683         * JavaScriptCore.vcproj/WTF/WTFGeneratedProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops.
2684         * JavaScriptCore.vcproj/WTF/WTFGeneratedRelease.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops.
2685         * JavaScriptCore.vcproj/WTF/WTFGeneratedReleaseCairoCFLite.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops.
2686         * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops: Removed.
2687         * JavaScriptCore.vcproj/WTF/build-generated-files.sh: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh.
2688         * JavaScriptCore.vcproj/WTF/copy-files.cmd: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd.
2689         * JavaScriptCore.vcproj/WTF/work-around-vs-dependency-tracking-bugs.py: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/work-around-vs-dependency-tracking-bugs.py.
2690
2691 2012-03-08  Benjamin Poulain  <benjamin@webkit.org>
2692
2693         Fix the build of WebKit with WTFURL following the removal of ForwardingHeaders/wtf
2694         https://bugs.webkit.org/show_bug.cgi?id=80652
2695
2696         Reviewed by Eric Seidel.
2697
2698         Fix the header, URLSegments.h is not part of the API.
2699
2700         * wtf/url/api/ParsedURL.h:
2701
2702 2012-03-08  Ryosuke Niwa  <rniwa@webkit.org>
2703
2704         Mac build fix for micro data API.
2705
2706         * Configurations/FeatureDefines.xcconfig:
2707
2708 2012-03-08  Gavin Barraclough  <barraclough@apple.com>
2709
2710         String.prototype.match and replace do not clear global regexp lastIndex per ES5.1 15.5.4.10
2711         https://bugs.webkit.org/show_bug.cgi?id=26890
2712
2713         Reviewed by Oliver Hunt.
2714
2715         Per 15.10.6.2 step 9.a.1 called via the action of the last iteration of 15.5.4.10 8.f.i.
2716
2717         * runtime/StringPrototype.cpp:
2718         (JSC::replaceUsingRegExpSearch):
2719         (JSC::stringProtoFuncMatch):
2720             - added calls to setLastIndex.
2721
2722 2012-03-08  Matt Lilek  <mrl@apple.com>
2723
2724         Don't enable VIDEO_TRACK on all OS X platforms
2725         https://bugs.webkit.org/show_bug.cgi?id=80635
2726
2727         Reviewed by Eric Carlson.
2728
2729         * Configurations/FeatureDefines.xcconfig:
2730
2731 2012-03-08  Oliver Hunt  <oliver@apple.com>
2732
2733         Build fix.  That day is not today.
2734
2735         * assembler/MacroAssembler.h:
2736         (JSC::MacroAssembler::shouldBlind):
2737         * assembler/MacroAssemblerX86Common.h:
2738         (MacroAssemblerX86Common):
2739         (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
2740
2741 2012-03-08  Oliver Hunt  <oliver@apple.com>
2742
2743         Build fix. One of these days I'll manage to commit something that works everywhere.
2744
2745         * assembler/AbstractMacroAssembler.h:
2746         (AbstractMacroAssembler):
2747         * assembler/MacroAssemblerARMv7.h:
2748         (MacroAssemblerARMv7):
2749         * assembler/MacroAssemblerX86Common.h:
2750         (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
2751         (MacroAssemblerX86Common):
2752
2753 2012-03-08  Chao-ying Fu  <fu@mips.com>
2754
2755         Update MIPS patchOffsetGetByIdSlowCaseCall
2756         https://bugs.webkit.org/show_bug.cgi?id=80302
2757
2758         Reviewed by Oliver Hunt.
2759
2760         * jit/JIT.h:
2761         (JIT):
2762
2763 2012-03-08  Oliver Hunt  <oliver@apple.com>
2764
2765         Missing some places where we should be blinding 64bit values (and blinding something we shouldn't)
2766         https://bugs.webkit.org/show_bug.cgi?id=80633
2767
2768         Reviewed by Gavin Barraclough.
2769
2770         Add 64-bit trap for shouldBlindForSpecificArch, so that we always blind
2771         if there isn't a machine specific implementation (otherwise the 64bit value
2772         got truncated and 32bit checks were used -- leaving 32bits untested).
2773         Also add a bit of logic to ensure that we don't try to blind a few common
2774         constants that go through the ImmPtr paths -- encoded numeric JSValues and
2775         unencoded doubles with common "safe" values.
2776
2777         * assembler/AbstractMacroAssembler.h:
2778         (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
2779         * assembler/MacroAssembler.h:
2780         (JSC::MacroAssembler::shouldBlindDouble):
2781         (MacroAssembler):
2782         (JSC::MacroAssembler::shouldBlind):
2783         * assembler/MacroAssemblerX86Common.h:
2784         (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
2785
2786 2012-03-08  Mark Rowe  <mrowe@apple.com>
2787
2788         <rdar://problem/11012572> Ensure that the staged frameworks path is in the search path for JavaScriptCore
2789
2790         Reviewed by Dan Bernstein.
2791
2792         * Configurations/Base.xcconfig:
2793
2794 2012-03-08  Steve Falkenburg  <sfalken@apple.com>
2795
2796         Fix line endings for copy-files.cmd.
2797
2798         If a cmd file doesn't have Windows line endings, it doesn't work properly.
2799         In this case, the label :clean wasn't found, breaking the clean build.
2800
2801         Reviewed by Jessie Berlin.
2802
2803         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
2804
2805 2012-03-07  Filip Pizlo  <fpizlo@apple.com>
2806
2807         DFG CFA incorrectly handles ValueToInt32
2808         https://bugs.webkit.org/show_bug.cgi?id=80568
2809
2810         Reviewed by Gavin Barraclough.
2811
2812         Changed it match exactly the decision pattern used in
2813         DFG::SpeculativeJIT::compileValueToInt32
2814
2815         * dfg/DFGAbstractState.cpp:
2816         (JSC::DFG::AbstractState::execute):
2817
2818 2012-03-08  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
2819
2820         [Qt] [WK2] Webkit fails to link when compiled with force_static_libs_as_shared
2821         https://bugs.webkit.org/show_bug.cgi?id=80524
2822
2823         Reviewed by Simon Hausmann.
2824
2825         Move IdentifierTable methods defintion to WTFThreadData.cpp to fix linking
2826         of WTF library.
2827
2828         * runtime/Identifier.cpp:
2829         * wtf/WTFThreadData.cpp:
2830         (JSC):
2831         (JSC::IdentifierTable::~IdentifierTable):
2832         (JSC::IdentifierTable::add):
2833
2834 2012-03-08  Filip Pizlo  <fpizlo@apple.com>
2835
2836         DFG instruction count threshold should be lifted to 10000
2837         https://bugs.webkit.org/show_bug.cgi?id=80579
2838
2839         Reviewed by Gavin Barraclough.
2840
2841         * runtime/Options.cpp:
2842         (JSC::Options::initializeOptions):
2843
2844 2012-03-07  Filip Pizlo  <fpizlo@apple.com>
2845
2846         Incorrect tracking of abstract values of variables forced double
2847         https://bugs.webkit.org/show_bug.cgi?id=80566
2848         <rdar://problem/11001442>
2849
2850         Reviewed by Gavin Barraclough.
2851
2852         * dfg/DFGAbstractState.cpp:
2853         (JSC::DFG::AbstractState::mergeStateAtTail):
2854
2855 2012-03-07  Chao-yng Fu  <fu@mips.com>
2856
2857         [Qt] Fix the MIPS/SH4 build after r109834
2858         https://bugs.webkit.org/show_bug.cgi?id=80492
2859
2860         Reviewed by Oliver Hunt.
2861
2862         Implement three-argument branch(Add,Sub)32.
2863
2864         * assembler/MacroAssemblerMIPS.h:
2865         (JSC::MacroAssemblerMIPS::add32):
2866         (MacroAssemblerMIPS):
2867         (JSC::MacroAssemblerMIPS::sub32):
2868         (JSC::MacroAssemblerMIPS::branchAdd32):
2869         (JSC::MacroAssemblerMIPS::branchSub32):
2870
2871 2012-03-07  Sheriff Bot  <webkit.review.bot@gmail.com>
2872
2873         Unreviewed, rolling out r110127.
2874         http://trac.webkit.org/changeset/110127
2875         https://bugs.webkit.org/show_bug.cgi?id=80562
2876
2877         compile failed on AppleWin (Requested by ukai on #webkit).
2878
2879         * heap/Heap.cpp:
2880         (JSC::Heap::collectAllGarbage):
2881         * heap/Heap.h:
2882         (JSC):
2883         (Heap):
2884         * runtime/Executable.cpp:
2885         (JSC::FunctionExecutable::FunctionExecutable):
2886         (JSC::FunctionExecutable::finalize):
2887         * runtime/Executable.h:
2888         (FunctionExecutable):
2889         (JSC::FunctionExecutable::create):
2890         * runtime/JSGlobalData.cpp:
2891         (WTF):
2892         (Recompiler):
2893         (WTF::Recompiler::operator()):
2894         (JSC::JSGlobalData::recompileAllJSFunctions):
2895         (JSC):
2896         * runtime/JSGlobalData.h:
2897         (JSGlobalData):
2898         * runtime/JSGlobalObject.cpp:
2899         (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
2900
2901 2012-03-07  Hojong Han  <hojong.han@samsung.com>
2902
2903         The end atom of the marked block considered to filter invalid cells
2904         https://bugs.webkit.org/show_bug.cgi?id=79191
2905
2906         Reviewed by Geoffrey Garen.
2907
2908         Register file could have stale pointers beyond the end atom of marked block.
2909         Those pointers can weasel out of filtering in-middle-of-cell pointer.
2910
2911         * heap/MarkedBlock.h:
2912         (JSC::MarkedBlock::isLiveCell):
2913
2914 2012-03-07  Jessie Berlin  <jberlin@apple.com>
2915
2916         Clean Windows build fails after r110033
2917         https://bugs.webkit.org/show_bug.cgi?id=80553
2918
2919         Rubber-stamped by Jon Honeycutt and Eric Seidel.
2920
2921         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
2922         Place the implementation files next to their header files in the wtf/text subdirectory.
2923         Use echo -F to tell xcopy that these are files (since there is apparently no flag).
2924         * JavaScriptCore.vcproj/jsc/jsc.vcproj:
2925         Update the path to those implementation files.
2926         * JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj:
2927         Ditto.
2928
2929 2012-03-07  Yuqiang Xian  <yuqiang.xian@intel.com>
2930
2931         Eliminate redundant Phis in DFG
2932         https://bugs.webkit.org/show_bug.cgi?id=80415
2933
2934         Reviewed by Filip Pizlo.
2935
2936         Although this may not have any advantage at current stage, this is towards
2937         minimal SSA to make more high level optimizations (like bug 76770) easier.
2938         We have the choices either to build minimal SSA from scratch or to
2939         keep current simple Phi insertion mechanism and remove the redundancy
2940         in another phase. Currently we choose the latter because the change
2941         could be smaller.
2942
2943         * CMakeLists.txt:
2944         * GNUmakefile.list.am:
2945         * JavaScriptCore.xcodeproj/project.pbxproj:
2946         * Target.pri:
2947         * dfg/DFGDriver.cpp:
2948         (JSC::DFG::compile):
2949         * dfg/DFGGraph.cpp:
2950         (JSC::DFG::Graph::dump):
2951         * dfg/DFGRedundantPhiEliminationPhase.cpp: Added.
2952         (DFG):
2953         (RedundantPhiEliminationPhase):
2954         (JSC::DFG::RedundantPhiEliminationPhase::RedundantPhiEliminationPhase):
2955         (JSC::DFG::RedundantPhiEliminationPhase::run):
2956         (JSC::DFG::RedundantPhiEliminationPhase::getRedundantReplacement):
2957         (JSC::DFG::RedundantPhiEliminationPhase::replacePhiChild):
2958         (JSC::DFG::RedundantPhiEliminationPhase::fixupPhis):
2959         (JSC::DFG::RedundantPhiEliminationPhase::updateBlockVariableInformation):
2960         (JSC::DFG::performRedundantPhiElimination):
2961         * dfg/DFGRedundantPhiEliminationPhase.h: Added.
2962         (DFG):
2963
2964 2012-03-07  Mark Hahnenberg  <mhahnenberg@apple.com>
2965
2966         Refactor recompileAllJSFunctions() to be less expensive
2967         https://bugs.webkit.org/show_bug.cgi?id=80330
2968
2969         Reviewed by Geoffrey Garen.
2970
2971         This change is performance neutral on the JS benchmarks we track. It's mostly to improve page
2972         load performance, which currently does at least a couple full GCs per navigation.
2973
2974         * heap/Heap.cpp:
2975         (JSC::Heap::discardAllCompiledCode): Rename recompileAllJSFunctions to discardAllCompiledCode
2976         because the function doesn't actually recompile anything (and never did); it simply throws code
2977         away for it to be recompiled later if we determine we should do so.
2978         (JSC):
2979         (JSC::Heap::collectAllGarbage):
2980         (JSC::Heap::addFunctionExecutable): Adds a newly created FunctionExecutable to the Heap's list.
2981         (JSC::Heap::removeFunctionExecutable): Removes the specified FunctionExecutable from the Heap's list.
2982         * heap/Heap.h:
2983         (JSC):
2984         (Heap):
2985         * runtime/Executable.cpp: Added next and prev fields to FunctionExecutables so that they can
2986         be used in DoublyLinkedLists.
2987         (JSC::FunctionExecutable::FunctionExecutable):
2988         (JSC::FunctionExecutable::finalize): Removes the FunctionExecutable from the Heap's list.
2989         * runtime/Executable.h:
2990         (FunctionExecutable):
2991         (JSC::FunctionExecutable::create): Adds the FunctionExecutable to the Heap's list.
2992         * runtime/JSGlobalData.cpp: Remove recompileAllJSFunctions, as it's the Heap's job to own and manage
2993         the list of FunctionExecutables.
2994         * runtime/JSGlobalData.h:
2995         (JSGlobalData):
2996         * runtime/JSGlobalObject.cpp:
2997         (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Use the new discardAllCompiledCode.
2998
2999 2012-03-06  Oliver Hunt  <oliver@apple.com>
3000
3001         Further harden 64-bit JIT
3002         https://bugs.webkit.org/show_bug.cgi?id=80457
3003
3004         Reviewed by Filip Pizlo.
3005
3006         This patch implements blinding for ImmPtr.  Rather than xor based blinding
3007         we perform randomised pointer rotations in order to avoid the significant
3008         cost in executable memory that would otherwise be necessary (and to avoid
3009         the need for an additional scratch register in some cases).
3010
3011         As with the prior blinding patch there's a moderate amount of noise as we
3012         correct the use of ImmPtr vs. TrustedImmPtr.
3013
3014         * assembler/AbstractMacroAssembler.h:
3015         (ImmPtr):
3016         (JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr):
3017         * assembler/MacroAssembler.h:
3018         (MacroAssembler):
3019         (JSC::MacroAssembler::storePtr):
3020         (JSC::MacroAssembler::branchPtr):
3021         (JSC::MacroAssembler::shouldBlind):
3022         (JSC::MacroAssembler::RotatedImmPtr::RotatedImmPtr):
3023         (RotatedImmPtr):
3024         (JSC::MacroAssembler::rotationBlindConstant):
3025         (JSC::MacroAssembler::loadRotationBlindedConstant):
3026         (JSC::MacroAssembler::convertInt32ToDouble):
3027         (JSC::MacroAssembler::move):
3028         (JSC::MacroAssembler::poke):
3029         * assembler/MacroAssemblerARMv7.h:
3030         (JSC::MacroAssemblerARMv7::storeDouble):
3031         (JSC::MacroAssemblerARMv7::branchAdd32):
3032         * assembler/MacroAssemblerX86_64.h:
3033         (MacroAssemblerX86_64):
3034         (JSC::MacroAssemblerX86_64::rotateRightPtr):
3035         (JSC::MacroAssemblerX86_64::xorPtr):
3036         * assembler/X86Assembler.h:
3037         (X86Assembler):
3038         (JSC::X86Assembler::xorq_rm):
3039         (JSC::X86Assembler::rorq_i8r):
3040         * dfg/DFGCCallHelpers.h:
3041         (CCallHelpers):
3042         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
3043         * dfg/DFGOSRExitCompiler32_64.cpp:
3044         (JSC::DFG::OSRExitCompiler::compileExit):
3045         * dfg/DFGOSRExitCompiler64.cpp:
3046         (JSC::DFG::OSRExitCompiler::compileExit):
3047         * dfg/DFGSpeculativeJIT.cpp:
3048         (JSC::DFG::SpeculativeJIT::createOSREntries):
3049         * dfg/DFGSpeculativeJIT.h:
3050         (JSC::DFG::SpeculativeJIT::silentFillGPR):
3051         (JSC::DFG::SpeculativeJIT::callOperation):
3052         (JSC::DFG::SpeculativeJIT::emitEdgeCode):
3053         * dfg/DFGSpeculativeJIT32_64.cpp:
3054         (JSC::DFG::SpeculativeJIT::compile):
3055         * dfg/DFGSpeculativeJIT64.cpp:
3056         (JSC::DFG::SpeculativeJIT::fillInteger):
3057         (JSC::DFG::SpeculativeJIT::fillDouble):
3058         (JSC::DFG::SpeculativeJIT::fillJSValue):
3059         (JSC::DFG::SpeculativeJIT::emitCall):
3060         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
3061         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
3062         (JSC::DFG::SpeculativeJIT::emitBranch):
3063         * jit/JIT.cpp:
3064         (JSC::JIT::emitOptimizationCheck):
3065         * jit/JITArithmetic32_64.cpp:
3066         (JSC::JIT::emitSlow_op_post_inc):
3067         * jit/JITInlineMethods.h:
3068         (JSC::JIT::emitValueProfilingSite):
3069         (JSC::JIT::emitGetVirtualRegister):
3070         * jit/JITOpcodes.cpp:
3071         (JSC::JIT::emit_op_mov):
3072         (JSC::JIT::emit_op_new_object):
3073         (JSC::JIT::emit_op_strcat):
3074         (JSC::JIT::emit_op_ensure_property_exists):
3075         (JSC::JIT::emit_op_resolve_skip):
3076         (JSC::JIT::emitSlow_op_resolve_global):
3077         (JSC::JIT::emit_op_resolve_with_base):
3078         (JSC::JIT::emit_op_resolve_with_this):
3079         (JSC::JIT::emit_op_jmp_scopes):
3080         (JSC::JIT::emit_op_switch_imm):
3081         (JSC::JIT::emit_op_switch_char):
3082         (JSC::JIT::emit_op_switch_string):
3083         (JSC::JIT::emit_op_throw_reference_error):
3084         (JSC::JIT::emit_op_debug):
3085         (JSC::JIT::emitSlow_op_resolve_global_dynamic):
3086         (JSC::JIT::emit_op_new_array):
3087         (JSC::JIT::emitSlow_op_new_array):
3088         (JSC::JIT::emit_op_new_array_buffer):
3089         * jit/JITOpcodes32_64.cpp:
3090         (JSC::JIT::emit_op_new_object):
3091         (JSC::JIT::emit_op_strcat):
3092         (JSC::JIT::emit_op_ensure_property_exists):
3093         (JSC::JIT::emit_op_resolve_skip):
3094         (JSC::JIT::emitSlow_op_resolve_global):
3095         (JSC::JIT::emit_op_resolve_with_base):
3096         (JSC::JIT::emit_op_resolve_with_this):
3097         (JSC::JIT::emit_op_jmp_scopes):
3098         (JSC::JIT::emit_op_switch_imm):
3099         (JSC::JIT::emit_op_switch_char):
3100         (JSC::JIT::emit_op_switch_string):
3101         * jit/JITPropertyAccess32_64.cpp:
3102         (JSC::JIT::emit_op_put_by_index):
3103         * jit/JITStubCall.h:
3104         (JITStubCall):
3105         (JSC::JITStubCall::addArgument):
3106
3107 2012-03-07  Simon Hausmann  <simon.hausmann@nokia.com>
3108
3109         ARM build fix.
3110
3111         Reviewed by Zoltan Herczeg.
3112
3113         Implement three-argument branch(Add,Sub)32.
3114
3115         * assembler/MacroAssemblerARM.h:
3116         (JSC::MacroAssemblerARM::add32):
3117         (MacroAssemblerARM):
3118         (JSC::MacroAssemblerARM::sub32):
3119         (JSC::MacroAssemblerARM::branchAdd32):
3120         (JSC::MacroAssemblerARM::branchSub32):
3121
3122 2012-03-07  Andy Wingo  <wingo@igalia.com>
3123
3124         Parser: Inline ScopeNodeData into ScopeNode
3125         https://bugs.webkit.org/show_bug.cgi?id=79776
3126
3127         Reviewed by Geoffrey Garen.
3128
3129         It used to be that some ScopeNode members were kept in a separate
3130         structure because sometimes they wouldn't be needed, and
3131         allocating a ParserArena was expensive.  This patch makes
3132         ParserArena lazily allocate its IdentifierArena, allowing the
3133         members to be included directly, which is simpler and easier to
3134         reason about.
3135
3136         * parser/ParserArena.cpp:
3137         (JSC::ParserArena::ParserArena):
3138         (JSC::ParserArena::reset):
3139         (JSC::ParserArena::isEmpty):
3140         * parser/ParserArena.h:
3141         (JSC::ParserArena::identifierArena): Lazily allocate the
3142         IdentifierArena.
3143
3144         * parser/Nodes.cpp:
3145         (JSC::ScopeNode::ScopeNode):
3146         (JSC::ScopeNode::singleStatement):
3147         (JSC::ProgramNode::create):
3148         (JSC::EvalNode::create):
3149         (JSC::FunctionBodyNode::create):
3150         * parser/Nodes.h:
3151         (JSC::ScopeNode::destroyData):
3152         (JSC::ScopeNode::needsActivationForMoreThanVariables):
3153         (JSC::ScopeNode::needsActivation):
3154         (JSC::ScopeNode::hasCapturedVariables):
3155         (JSC::ScopeNode::capturedVariableCount):
3156         (JSC::ScopeNode::captures):
3157         (JSC::ScopeNode::varStack):
3158         (JSC::ScopeNode::functionStack):
3159         (JSC::ScopeNode::neededConstants):
3160         (ScopeNode):
3161         * bytecompiler/NodesCodegen.cpp:
3162         (JSC::ScopeNode::emitStatementsBytecode): Inline ScopeNodeData
3163         into ScopeNode.  Adapt accessors.
3164
3165 2012-03-06  Eric Seidel  <eric@webkit.org>
3166
3167         Make WTF public headers use fully-qualified include paths and remove ForwardingHeaders/wtf
3168         https://bugs.webkit.org/show_bug.cgi?id=80363
3169
3170         Reviewed by Mark Rowe.
3171
3172         Historically WTF has been part of JavaScriptCore, and on Mac and Windows
3173         its headers have appeared as part of the "private" headers exported by
3174         JavaScriptCore.  All of the WTF headers there are "flattened" into a single
3175         private headers directory, and WebCore, WebKit and WebKit2 have used "ForwardingHeaders"
3176         to re-map fully-qualified <wtf/text/Foo.h> includes to simple <JavaScriptCore/Foo.h> includes.
3177
3178         However, very soon, we are moving the WTF source code out of JavaScriptCore into its
3179         own directory and project.  As part of such, the WTF headers will no longer be part of
3180         the JavaScriptCore private interfaces.
3181         In preparation for that, this change makes both the Mac and Win builds export
3182         WTF headers in a non-flattened manner.  On Mac, that means into usr/local/include/wtf
3183         (and subdirectories), on Windows for now that means JavaScriptCore/wtf (and subdirectories).
3184
3185         There are 5 parts to this change.
3186         1.  Updates the JavaScriptCore XCode and VCProj files to actually install these headers
3187             (and header directories) into the appropriate places in the build directory.
3188         2.  Updates JavaScriptCore.xcodeproj to look for these WTF headers in this install location
3189             (WebCore, WebKit, etc. had already been taught to look in previous patches).
3190         3.  Fixes all JavaScriptCore source files, and WTF headers to include WTF headers
3191             using fully qualified paths.
3192         4.  Stops the Mac and Win builds from installing these WTF headers in their old "flattened" location.
3193         5.  Removes WebCore and WebKit ForwardingHeaders/wtf directories now that the flattened headers no longer exist.
3194
3195         Unfortunately we see no way to do this change in smaller parts, since all of these steps are interdependant.
3196         It is possible there are internal Apple projects which depend on JavaScriptCore/Foo.h working for WTF
3197         headers, those will have to be updated to use <wtf/Foo.h> after this change.
3198         I've discussed this proposed change at length with Mark Rowe, and my understanding is they
3199         are ready for (and interested in) this change happening.
3200
3201         * API/tests/JSNode.c:
3202         * API/tests/JSNodeList.c:
3203         * Configurations/Base.xcconfig:
3204         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
3205         * JavaScriptCore.xcodeproj/project.pbxproj:
3206         * assembler/MacroAssemblerCodeRef.h:
3207         * bytecompiler/BytecodeGenerator.h:
3208         * dfg/DFGOperations.cpp:
3209         * heap/GCAssertions.h:
3210         * heap/HandleHeap.h:
3211         * heap/HandleStack.h:
3212         * heap/MarkedSpace.h:
3213         * heap/PassWeak.h:
3214         * heap/Strong.h:
3215         * heap/Weak.h:
3216         * jit/HostCallReturnValue.cpp:
3217         * jit/JIT.cpp:
3218         * jit/JITStubs.cpp:
3219         * jit/ThunkGenerators.cpp:
3220         * parser/Lexer.cpp:
3221         * runtime/Completion.cpp:
3222         * runtime/Executable.cpp:
3223         * runtime/Identifier.h:
3224         * runtime/InitializeThreading.cpp:
3225         * runtime/JSDateMath.cpp:
3226         * runtime/JSGlobalObjectFunctions.cpp:
3227         * runtime/JSStringBuilder.h:
3228         * runtime/JSVariableObject.h:
3229         * runtime/NumberPrototype.cpp:
3230         * runtime/WriteBarrier.h:
3231         * tools/CodeProfile.cpp:
3232         * tools/TieredMMapArray.h:
3233         * wtf/AVLTree.h:
3234         * wtf/Alignment.h:
3235         * wtf/AlwaysInline.h:
3236         * wtf/ArrayBufferView.h:
3237         * wtf/Assertions.h:
3238         * wtf/Atomics.h:
3239         * wtf/Bitmap.h:
3240         * wtf/BoundsCheckedPointer.h:
3241         * wtf/CheckedArithmetic.h:
3242         * wtf/Deque.h:
3243         * wtf/ExportMacros.h:
3244         * wtf/FastAllocBase.h:
3245         * wtf/FastMalloc.h:
3246         * wtf/Float32Array.h:
3247         * wtf/Float64Array.h:
3248         * wtf/Functional.h:
3249         * wtf/HashCountedSet.h:
3250         * wtf/HashFunctions.h:
3251         * wtf/HashMap.h:
3252         * wtf/HashSet.h:
3253         * wtf/HashTable.h:
3254         * wtf/HashTraits.h:
3255         * wtf/Int16Array.h:
3256         * wtf/Int32Array.h:
3257         * wtf/Int8Array.h:
3258         * wtf/IntegralTypedArrayBase.h:
3259         * wtf/ListHashSet.h:
3260         * wtf/MainThread.h:
3261         * wtf/MetaAllocator.h:
3262         * wtf/Noncopyable.h:
3263         * wtf/OwnArrayPtr.h:
3264         * wtf/OwnPtr.h:
3265         * wtf/PackedIntVector.h:
3266         * wtf/ParallelJobs.h:
3267         * wtf/PassOwnArrayPtr.h:
3268         * wtf/PassOwnPtr.h:
3269         * wtf/PassRefPtr.h:
3270         * wtf/PassTraits.h:
3271         * wtf/Platform.h:
3272         * wtf/PossiblyNull.h:
3273         * wtf/RefCounted.h:
3274         * wtf/RefCountedLeakCounter.h:
3275         * wtf/RefPtr.h:
3276         * wtf/RetainPtr.h:
3277         * wtf/SimpleStats.h:
3278         * wtf/Spectrum.h:
3279         * wtf/StdLibExtras.h:
3280         * wtf/TCPageMap.h:
3281         * wtf/TemporaryChange.h:
3282         * wtf/ThreadSafeRefCounted.h:
3283         * wtf/Threading.h:
3284         * wtf/ThreadingPrimitives.h:
3285         * wtf/TypeTraits.h:
3286         * wtf/TypedArrayBase.h:
3287         * wtf/Uint16Array.h:
3288         * wtf/Uint32Array.h:
3289         * wtf/Uint8Array.h:
3290         * wtf/Uint8ClampedArray.h:
3291         * wtf/UnusedParam.h:
3292         * wtf/Vector.h:
3293         * wtf/VectorTraits.h:
3294         * wtf/dtoa/double-conversion.h:
3295         * wtf/dtoa/utils.h:
3296         * wtf/gobject/GRefPtr.h:
3297         * wtf/gobject/GlibUtilities.h:
3298         * wtf/text/AtomicString.h:
3299         * wtf/text/AtomicStringImpl.h:
3300         * wtf/text/CString.h:
3301         * wtf/text/StringConcatenate.h:
3302         * wtf/text/StringHash.h:
3303         * wtf/text/WTFString.h:
3304         * wtf/unicode/CharacterNames.h:
3305         * wtf/unicode/UTF8.h:
3306         * wtf/unicode/glib/UnicodeGLib.h:
3307         * wtf/unicode/qt4/UnicodeQt4.h:
3308         * wtf/unicode/wince/UnicodeWinCE.h:
3309         * wtf/url/api/ParsedURL.h:
3310         * wtf/url/api/URLString.h:
3311         * wtf/wince/FastMallocWinCE.h:
3312         * yarr/YarrJIT.cpp:
3313
3314 2012-03-06  Gavin Barraclough  <barraclough@apple.com>
3315
3316         Array.prototype functions should throw if delete fails
3317         https://bugs.webkit.org/show_bug.cgi?id=80467
3318
3319         Reviewed by Oliver Hunt.
3320
3321         All calls to [[Delete]] from Array.prototype are specified to pass 'true' as the value of Throw.
3322         In the case of shift/unshift, these are also missing a throw from the 'put' in the implementations
3323         in JSArray.cpp. There are effectively three copies of each of the generic shift/unshift routines,
3324         one in splice, one in ArrayPrototype's shift/unshift methods, and one in JSArray's shift/unshift
3325         routines, for handling arrays with holes. These three copies should be unified.
3326
3327         * runtime/ArrayPrototype.cpp:
3328         (JSC::shift):
3329         (JSC::unshift):
3330             - Added - shared copies of the shift/unshift functionality.
3331         (JSC::arrayProtoFuncPop):
3332             - should throw if the delete fails.
3333         (JSC::arrayProtoFuncReverse):
3334             - should throw if the delete fails.
3335         (JSC::arrayProtoFuncShift):
3336         (JSC::arrayProtoFuncSplice):
3337         (JSC::arrayProtoFuncUnShift):
3338             - use shift/unshift.
3339         * runtime/JSArray.cpp:
3340         (JSC::JSArray::shiftCount):
3341         (JSC::JSArray::unshiftCount):
3342             - Don't try to handle arrays with holes; return a value indicating
3343               the generic routine should be used instead.
3344         * runtime/JSArray.h:
3345             - declaration for shiftCount/unshiftCount changed.
3346         * tests/mozilla/js1_6/Array/regress-304828.js:
3347             - this was asserting incorrect behaviour.
3348
3349 2012-03-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
3350
3351         [CMake] Make the removal of transitive library dependencies work with CMake < 2.8.7.
3352         https://bugs.webkit.org/show_bug.cgi?id=80469
3353
3354         Reviewed by Antonio Gomes.
3355
3356         * CMakeLists.txt: Manually set the LINK_INTERFACE_LIBRARIES target
3357         property on the library being created.
3358
3359 2012-03-06  Yuqiang Xian  <yuqiang.xian@intel.com>
3360
3361         DFG BasicBlock should group the Phi nodes together and separate them
3362         from the other nodes
3363         https://bugs.webkit.org/show_bug.cgi?id=80361
3364
3365         Reviewed by Filip Pizlo.
3366
3367         This would make it more efficient to remove the redundant Phi nodes or
3368         insert new Phi nodes for SSA, besides providing a cleaner BasicBlock structure.
3369         This is performance neutral on SunSpider, V8 and Kraken.
3370
3371         * dfg/DFGAbstractState.cpp:
3372         (JSC::DFG::AbstractState::clobberStructures):
3373         (JSC::DFG::AbstractState::dump):
3374         * dfg/DFGBasicBlock.h:
3375         (JSC::DFG::BasicBlock::BasicBlock):
3376         (BasicBlock):
3377         * dfg/DFGByteCodeParser.cpp:
3378         (JSC::DFG::ByteCodeParser::addToGraph):
3379         (JSC::DFG::ByteCodeParser::insertPhiNode):
3380         * dfg/DFGCFAPhase.cpp:
3381         (JSC::DFG::CFAPhase::performBlockCFA):
3382         * dfg/DFGCSEPhase.cpp:
3383         (JSC::DFG::CSEPhase::pureCSE):
3384         (JSC::DFG::CSEPhase::impureCSE):
3385         (JSC::DFG::CSEPhase::globalVarLoadElimination):
3386         (JSC::DFG::CSEPhase::getByValLoadElimination):
3387         (JSC::DFG::CSEPhase::checkFunctionElimination):
3388         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
3389         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
3390         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
3391         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
3392         (JSC::DFG::CSEPhase::getScopeChainLoadElimination):
3393         (JSC::DFG::CSEPhase::performBlockCSE):
3394         * dfg/DFGGraph.cpp:
3395         (JSC::DFG::Graph::dump):
3396         * dfg/DFGSpeculativeJIT.cpp:
3397         (JSC::DFG::SpeculativeJIT::compile):
3398
3399 2012-03-06  Mark Hahnenberg  <mhahnenberg@apple.com>
3400
3401         GCActivityCallback timer should vary with the length of the previous GC
3402         https://bugs.webkit.org/show_bug.cgi?id=80344
3403
3404         Reviewed by Geoffrey Garen.
3405
3406         * heap/Heap.cpp: Gave Heap the ability to keep track of the length of its last
3407         GC length so that the GC Activity Callback can use it.
3408         (JSC::Heap::Heap):
3409         (JSC::Heap::collect):
3410         * heap/Heap.h:
3411         (JSC::Heap::lastGCLength):
3412         (Heap):
3413         * runtime/GCActivityCallbackCF.cpp:
3414         (JSC):
3415         (JSC::DefaultGCActivityCallback::operator()): Use the length of the Heap's last
3416         GC to determine the length of our timer trigger (currently set at 100x the duration
3417         of the last GC).
3418
3419 2012-03-06  Rob Buis  <rbuis@rim.com>
3420
3421         BlackBerry] Fix cast-align gcc warnings when compiling JSC
3422         https://bugs.webkit.org/show_bug.cgi?id=80420
3423
3424         Reviewed by Gavin Barraclough.
3425
3426         Fix warnings given in Blackberry build.
3427
3428         * heap/CopiedBlock.h:
3429         (JSC::CopiedBlock::CopiedBlock):
3430         * wtf/RefCountedArray.h:
3431         (WTF::RefCountedArray::Header::fromPayload):
3432
3433 2012-03-06  Gavin Barraclough  <barraclough@apple.com>
3434
3435         writable/configurable not respected for some properties of Function/String/Arguments
3436         https://bugs.webkit.org/show_bug.cgi?id=80436
3437
3438         Reviewed by Oliver Hunt.
3439
3440         Special properties should behave like regular properties.
3441
3442         * runtime/Arguments.cpp:
3443         (JSC::Arguments::defineOwnProperty):
3444             - Mis-nested logic for making read-only properties non-live.
3445         * runtime/JSFunction.cpp:
3446         (JSC::JSFunction::put):
3447             - arguments/length/caller are non-writable, non-configurable - reject appropriately.
3448         (JSC::JSFunction::deleteProperty):
3449             - Attempting to delete prototype/caller should fail.
3450         (JSC::JSFunction::defineOwnProperty):
3451             - Ensure prototype is reified on attempt to reify it.
3452             - arguments/length/caller are non-writable, non-configurable - reject appropriately.
3453         * runtime/JSFunction.h:
3454             - added declaration for defineOwnProperty.
3455         (JSFunction):
3456         * runtime/StringObject.cpp:
3457         (JSC::StringObject::put):
3458             - length is non-writable, non-configurable - reject appropriately.
3459
3460 2012-03-06  Ulan Degenbaev  <ulan@chromium.org>
3461
3462         TypedArray subarray call for subarray does not clamp the end index parameter properly
3463         https://bugs.webkit.org/show_bug.cgi?id=80285
3464
3465         Reviewed by Kenneth Russell.
3466
3467         * wtf/ArrayBufferView.h:
3468         (WTF::ArrayBufferView::calculateOffsetAndLength):
3469
3470 2012-03-06  Sheriff Bot  <webkit.review.bot@gmail.com>
3471
3472         Unreviewed, rolling out r109837.
3473         http://trac.webkit.org/changeset/109837
3474         https://bugs.webkit.org/show_bug.cgi?id=80399
3475
3476         breaks Mac Productions builds, too late to try and fix it
3477         tonight (Requested by eseidel on #webkit).
3478
3479         * API/tests/JSNode.c:
3480         * API/tests/JSNodeList.c:
3481         * Configurations/Base.xcconfig:
3482         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
3483         * JavaScriptCore.xcodeproj/project.pbxproj:
3484         * assembler/MacroAssemblerCodeRef.h:
3485         * bytecompiler/BytecodeGenerator.h:
3486         * dfg/DFGOperations.cpp:
3487         * heap/GCAssertions.h:
3488         * heap/HandleHeap.h:
3489         * heap/HandleStack.h:
3490         * heap/MarkedSpace.h:
3491         * heap/PassWeak.h:
3492         * heap/Strong.h:
3493         * heap/Weak.h:
3494         * jit/HostCallReturnValue.cpp:
3495         * jit/JIT.cpp:
3496         * jit/JITStubs.cpp:
3497         * jit/ThunkGenerators.cpp:
3498         * parser/Lexer.cpp:
3499         * runtime/Completion.cpp:
3500         * runtime/Executable.cpp:
3501         * runtime/Identifier.h:
3502         * runtime/InitializeThreading.cpp:
3503         * runtime/JSDateMath.cpp:
3504         * runtime/JSGlobalObjectFunctions.cpp:
3505         * runtime/JSStringBuilder.h:
3506         * runtime/JSVariableObject.h:
3507         * runtime/NumberPrototype.cpp:
3508         * runtime/WriteBarrier.h:
3509         * tools/CodeProfile.cpp:
3510         * tools/TieredMMapArray.h:
3511         * yarr/YarrJIT.cpp:
3512
3513 2012-03-06  Zoltan Herczeg  <zherczeg@webkit.org>
3514
3515         [Qt][ARM] Speculative buildfix after r109834.
3516
3517         Reviewed by Csaba Osztrogonác.
3518
3519         * assembler/MacroAssemblerARM.h:
3520         (JSC::MacroAssemblerARM::and32):
3521         (MacroAssemblerARM):
3522
3523 2012-03-05  Gavin Barraclough  <barraclough@apple.com>
3524
3525         Unreviewed windows build fix pt 2.
3526
3527         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3528
3529 2012-03-05  Gavin Barraclough  <barraclough@apple.com>
3530
3531         Unreviewed windows build fix pt 1.
3532
3533         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3534
3535 2012-03-05  Gavin Barraclough  <barraclough@apple.com>
3536
3537         putByIndex should throw in strict mode
3538         https://bugs.webkit.org/show_bug.cgi?id=80335
3539
3540         Reviewed by Filip Pizlo.
3541
3542         Make the MethodTable PutByIndex trap take a boolean 'shouldThrow' parameter.
3543
3544         This is a largely mechanical change, simply adding an extra parameter to a number
3545         of functions. Some call sites need perform additional exception checks, and
3546         operationPutByValBeyondArrayBounds needs to know whether it is strict or not.
3547
3548         This patch doesn't fix a missing throw from some cases of shift/unshift (this is
3549         an existing bug), I'll follow up with a third patch to handle that.
3550
3551         * API/JSObjectRef.cpp:
3552         (JSObjectSetPropertyAtIndex):
3553         * JSCTypedArrayStubs.h:
3554         (JSC):
3555         * dfg/DFGOperations.cpp:
3556         (JSC::DFG::putByVal):
3557         * dfg/DFGOperations.h:
3558         * dfg/DFGSpeculativeJIT32_64.cpp:
3559         (JSC::DFG::SpeculativeJIT::compile):
3560         * dfg/DFGSpeculativeJIT64.cpp:
3561         (JSC::DFG::SpeculativeJIT::compile):
3562         * interpreter/Interpreter.cpp:
3563         (JSC::Interpreter::privateExecute):
3564         * jit/JITStubs.cpp:
3565         (JSC::DEFINE_STUB_FUNCTION):
3566         * jsc.cpp:
3567         (GlobalObject::finishCreation):
3568         * llint/LLIntSlowPaths.cpp:
3569         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3570         * runtime/Arguments.cpp:
3571         (JSC::Arguments::putByIndex):
3572         * runtime/Arguments.h:
3573         (Arguments):
3574         * runtime/ArrayPrototype.cpp:
3575         (JSC::arrayProtoFuncPush):
3576         (JSC::arrayProtoFuncReverse):
3577         (JSC::arrayProtoFuncShift):
3578         (JSC::arrayProtoFuncSort):
3579         (JSC::arrayProtoFuncSplice):
3580         (JSC::arrayProtoFuncUnShift):
3581         * runtime/ClassInfo.h:
3582         (MethodTable):
3583         * runtime/JSArray.cpp:
3584         (JSC::SparseArrayValueMap::put):
3585         (JSC::JSArray::put):
3586         (JSC::JSArray::putByIndex):
3587         (JSC::JSArray::putByIndexBeyondVectorLength):
3588         (JSC::JSArray::push):
3589         (JSC::JSArray::shiftCount):
3590         (JSC::JSArray::unshiftCount):
3591         * runtime/JSArray.h:
3592         (SparseArrayValueMap):
3593         (JSArray):
3594         * runtime/JSByteArray.cpp:
3595         (JSC::JSByteArray::putByIndex):
3596         * runtime/JSByteArray.h:
3597         (JSByteArray):
3598         * runtime/JSCell.cpp:
3599         (JSC::JSCell::putByIndex):
3600         * runtime/JSCell.h:
3601         (JSCell):
3602         * runtime/JSNotAnObject.cpp:
3603         (JSC::JSNotAnObject::putByIndex):
3604         * runtime/JSNotAnObject.h:
3605         (JSNotAnObject):
3606         * runtime/JSONObject.cpp:
3607         (JSC::Walker::walk):
3608         * runtime/JSObject.cpp:
3609         (JSC::JSObject::putByIndex):
3610         * runtime/JSObject.h:
3611         (JSC::JSValue::putByIndex):
3612         * runtime/RegExpConstructor.cpp:
3613         (JSC::RegExpMatchesArray::fillArrayInstance):
3614         * runtime/RegExpMatchesArray.h:
3615         (JSC::RegExpMatchesArray::putByIndex):
3616         * runtime/StringPrototype.cpp:
3617         (JSC::stringProtoFuncSplit):
3618
3619 2012-03-05  Yuqiang Xian  <yuqiang.xian@intel.com>
3620
3621         PredictNone is incorrectly treated as isDoublePrediction
3622         https://bugs.webkit.org/show_bug.cgi?id=80365
3623
3624         Reviewed by Filip Pizlo.
3625
3626         Also it is incorrectly treated as isFixedIndexedStorageObjectPrediction.
3627
3628         * bytecode/PredictedType.h:
3629         (JSC::isFixedIndexedStorageObjectPrediction):
3630         (JSC::isDoublePrediction):
3631
3632 2012-03-05  Filip Pizlo  <fpizlo@apple.com>
3633
3634         The LLInt should work even when the JIT is disabled
3635         https://bugs.webkit.org/show_bug.cgi?id=80340
3636         <rdar://problem/10922235>
3637
3638         Reviewed by Gavin Barraclough.
3639
3640         * assembler/MacroAssemblerCodeRef.h:
3641         (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
3642         (MacroAssemblerCodeRef):
3643         (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
3644         * interpreter/Interpreter.cpp:
3645         (JSC::Interpreter::initialize):
3646         (JSC::Interpreter::execute):
3647         (JSC::Interpreter::executeCall):
3648         (JSC::Interpreter::executeConstruct):
3649         * jit/JIT.h:
3650         (JSC::JIT::compileCTINativeCall):
3651         * jit/JITStubs.h:
3652         (JSC::JITThunks::ctiNativeCall):
3653         (JSC::JITThunks::ctiNativeConstruct):
3654         * llint/LLIntEntrypoints.cpp:
3655         (JSC::LLInt::getFunctionEntrypoint):
3656         (JSC::LLInt::getEvalEntrypoint):
3657         (JSC::LLInt::getProgramEntrypoint):
3658         * llint/LLIntSlowPaths.cpp:
3659         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3660         (LLInt):
3661         * llint/LLIntSlowPaths.h:
3662         (LLInt):
3663         * llint/LowLevelInterpreter.h:
3664         * llint/LowLevelInterpreter32_64.asm:
3665         * runtime/Executable.h:
3666         (NativeExecutable):
3667         (JSC::NativeExecutable::create):
3668         (JSC::NativeExecutable::finishCreation):
3669         * runtime/JSGlobalData.cpp:
3670         (JSC::JSGlobalData::JSGlobalData):
3671         * runtime/JSGlobalData.h:
3672         (JSGlobalData):
3673         * runtime/Options.cpp:
3674         (Options):
3675         (JSC::Options::parse):
3676         (JSC::Options::initializeOptions):
3677         * runtime/Options.h:
3678         (Options):
3679         * wtf/Platform.h:
3680
3681 2012-03-05  Yuqiang Xian  <yuqiang.xian@intel.com>
3682
3683         Checks for dead variables are not sufficient when fixing the expected
3684         values in DFG OSR entry
3685         https://bugs.webkit.org/show_bug.cgi?id=80371
3686
3687         Reviewed by Filip Pizlo.
3688
3689         A dead variable should be identified when there's no node referencing it.
3690         But we currently failed to catch the case where there are some nodes
3691         referencing a variable but those nodes are actually not referenced by
3692         others so will be ignored in code generation. In such case we should
3693         also consider that variable to be a dead variable in the block and fix
3694         the expected values.
3695         This is performance neutral on SunSpider, V8 and Kraken.
3696
3697         * dfg/DFGJITCompiler.h:
3698         (JSC::DFG::JITCompiler::noticeOSREntry):
3699
3700 2012-03-05  Oliver Hunt  <oliver@apple.com>
3701
3702         Fix Qt build.
3703
3704         * assembler/AbstractMacroAssembler.h:
3705         * assembler/MacroAssembler.h:
3706         (MacroAssembler):
3707         * dfg/DFGSpeculativeJIT.cpp:
3708         (JSC::DFG::SpeculativeJIT::compileArithSub):
3709         * jit/JITArithmetic32_64.cpp:
3710         (JSC::JIT::emitSub32Constant):
3711
3712 2012-03-05  Eric Seidel  <eric@webkit.org>
3713
3714         Update JavaScriptCore files to use fully-qualified WTF include paths
3715         https://bugs.webkit.org/show_bug.cgi?id=79960
3716
3717         Reviewed by Adam Barth.
3718
3719         This change does 5 small/related things:
3720          1. Updates JavaScriptCore.xcodeproj to install WTF headers into $BUILD/usr/local/include
3721             (WebCore, WebKit were already setup to look there, but JavaScriptCore.xcodeproj
3722             was not installing headers there.)
3723          2. Makes JavaScriptCore targets include $BUILD/usr/local/include in their
3724             header search path, as that's where the WTF headers will be installed.
3725          3. Similarly updates JavaScriptCore.vcproj/copy-files.cmd to copy WTF headers to PrivateHeaders/wtf/*
3726             in addition to the current behavior of flattening all headers to PrivateHeaders/*.h.
3727          4. Updates a bunch of JSC files to use #include <wtf/Foo.h> instead of #include "Foo.h"
3728             since soon the WTF headers will not be part of the JavaScriptCore Xcode project.
3729          5. Makes build-webkit build the WTF XCode project by default.
3730
3731         * API/tests/JSNode.c:
3732         * API/tests/JSNodeList.c:
3733         * Configurations/Base.xcconfig:
3734         * assembler/MacroAssemblerCodeRef.h:
3735         * bytecompiler/BytecodeGenerator.h:
3736         * dfg/DFGOperations.cpp:
3737         * heap/GCAssertions.h:
3738         * heap/HandleHeap.h:
3739         * heap/HandleStack.h:
3740         * heap/MarkedSpace.h:
3741         * heap/PassWeak.h:
3742         * heap/Strong.h:
3743         * heap/Weak.h:
3744         * jit/HostCallReturnValue.cpp:
3745         * jit/JIT.cpp:
3746         * jit/JITStubs.cpp:
3747         * jit/ThunkGenerators.cpp:
3748         * parser/Lexer.cpp:
3749         * runtime/Completion.cpp:
3750         * runtime/Executable.cpp:
3751         * runtime/Identifier.h:
3752         * runtime/InitializeThreading.cpp:
3753         * runtime/JSDateMath.cpp:
3754         * runtime/JSGlobalObjectFunctions.cpp:
3755         * runtime/JSStringBuilder.h:
3756         * runtime/JSVariableObject.h:
3757         * runtime/NumberPrototype.cpp:
3758         * runtime/WriteBarrier.h:
3759         * tools/CodeProfile.cpp:
3760         * tools/TieredMMapArray.h:
3761         * yarr/YarrJIT.cpp:
3762
3763 2012-03-05  Oliver Hunt  <oliver@apple.com>
3764
3765         Add basic support for constant blinding to the JIT
3766         https://bugs.webkit.org/show_bug.cgi?id=80354
3767
3768         Reviewed by Filip Pizlo.
3769
3770         This patch adds basic constant blinding support to the JIT, at the
3771         MacroAssembler level.  This means all JITs in JSC (Yarr, baseline, and DFG)
3772         get constant blinding.  Woo!
3773
3774         This patch only introduces blinding for Imm32, a later patch will do similar
3775         for ImmPtr.  In order to make misuse of Imm32 as a trusted type essentially
3776         impossible, we make TrustedImm32 a private parent of Imm32 and add an explicit
3777         accessor that's needed to access the actual value.  This also means you cannot
3778         accidentally pass an untrusted value to a function that does not perform
3779         blinding.
3780
3781         To make everything work sensibly, this patch also corrects some code that was using
3782         Imm32 when TrustedImm32 could be used, and refactors a few callers that use
3783         untrusted immediates, so that they call slightly different varaints of the functions
3784         that they used previously.  This is largely necessary to deal with x86-32 not having
3785         sufficient registers to handle the additional work required when we choose to blind
3786         a constant.
3787
3788         * assembler/AbstractMacroAssembler.h:
3789         (JSC::AbstractMacroAssembler::Imm32::asTrustedImm32):
3790         (Imm32):
3791         (JSC::AbstractMacroAssembler::beginUninterruptedSequence):
3792         (JSC::AbstractMacroAssembler::endUninterruptedSequence):
3793         (JSC::AbstractMacroAssembler::AbstractMacroAssembler):
3794         (AbstractMacroAssembler):
3795         (JSC::AbstractMacroAssembler::inUninterruptedSequence):
3796         (JSC::AbstractMacroAssembler::random):
3797         (JSC::AbstractMacroAssembler::scratchRegisterForBlinding):
3798         (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
3799         * assembler/MacroAssembler.h:
3800         (JSC::MacroAssembler::addressForPoke):
3801         (MacroAssembler):
3802         (JSC::MacroAssembler::poke):
3803         (JSC::MacroAssembler::branchPtr):
3804         (JSC::MacroAssembler::branch32):
3805         (JSC::MacroAssembler::convertInt32ToDouble):
3806         (JSC::MacroAssembler::shouldBlind):
3807         (JSC::MacroAssembler::BlindedImm32::BlindedImm32):
3808         (BlindedImm32):
3809         (JSC::MacroAssembler::keyForConstant):
3810         (JSC::MacroAssembler::xorBlindConstant):
3811         (JSC::MacroAssembler::additionBlindedConstant):
3812         (JSC::MacroAssembler::andBlindedConstant):
3813         (JSC::MacroAssembler::orBlindedConstant):
3814         (JSC::MacroAssembler::loadXorBlindedConstant):
3815         (JSC::MacroAssembler::add32):
3816         (JSC::MacroAssembler::addPtr):
3817         (JSC::MacroAssembler::and32):
3818         (JSC::MacroAssembler::andPtr):
3819         (JSC::MacroAssembler::move):
3820         (JSC::MacroAssembler::or32):
3821         (JSC::MacroAssembler::store32):
3822         (JSC::MacroAssembler::sub32):
3823         (JSC::MacroAssembler::subPtr):
3824         (JSC::MacroAssembler::xor32):
3825         (JSC::MacroAssembler::branchAdd32):
3826         (JSC::MacroAssembler::branchMul32):
3827         (JSC::MacroAssembler::branchSub32):
3828         (JSC::MacroAssembler::trustedImm32ForShift):
3829         (JSC::MacroAssembler::lshift32):
3830         (JSC::MacroAssembler::rshift32):
3831         (JSC::MacroAssembler::urshift32):
3832         * assembler/MacroAssemblerARMv7.h:
3833         (MacroAssemblerARMv7):
3834         (JSC::MacroAssemblerARMv7::scratchRegisterForBlinding):
3835         (JSC::MacroAssemblerARMv7::shouldBlindForSpecificArch):
3836         * assembler/MacroAssemblerX86_64.h:
3837         (JSC::MacroAssemblerX86_64::branchSubPtr):
3838         (MacroAssemblerX86_64):
3839         (JSC::MacroAssemblerX86_64::scratchRegisterForBlinding):
3840         * dfg/DFGJITCompiler.cpp:
3841         (JSC::DFG::JITCompiler::linkOSRExits):
3842         (JSC::DFG::JITCompiler::compileBody):
3843         (JSC::DFG::JITCompiler::compileFunction):
3844         * dfg/DFGOSRExitCompiler32_64.cpp:
3845         (JSC::DFG::OSRExitCompiler::compileExit):
3846         * dfg/DFGOSRExitCompiler64.cpp:
3847         (JSC::DFG::OSRExitCompiler::compileExit):
3848         * dfg/DFGSpeculativeJIT.cpp:
3849         (JSC::DFG::SpeculativeJIT::compile):
3850         (JSC::DFG::SpeculativeJIT::compileArithSub):
3851         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
3852         * dfg/DFGSpeculativeJIT.h:
3853         (JSC::DFG::SpeculativeJIT::callOperation):
3854         * dfg/DFGSpeculativeJIT32_64.cpp:
3855         (JSC::DFG::SpeculativeJIT::emitCall):
3856         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
3857         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
3858         (JSC::DFG::SpeculativeJIT::compile):
3859         * dfg/DFGSpeculativeJIT64.cpp:
3860         (JSC::DFG::SpeculativeJIT::emitCall):
3861         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
3862         (JSC::DFG::SpeculativeJIT::compile):
3863         * jit/JIT.cpp:
3864         (JSC::JIT::privateCompileSlowCases):
3865         (JSC::JIT::privateCompile):
3866         * jit/JITArithmetic.cpp:
3867         (JSC::JIT::compileBinaryArithOp):
3868         (JSC::JIT::emit_op_add):
3869         (JSC::JIT::emit_op_mul):
3870         (JSC::JIT::emit_op_div):
3871         * jit/JITArithmetic32_64.cpp:
3872         (JSC::JIT::emitAdd32Constant):
3873         (JSC::JIT::emitSub32Constant):
3874         (JSC::JIT::emitBinaryDoubleOp):
3875         (JSC::JIT::emitSlow_op_mul):
3876         (JSC::JIT::emit_op_div):
3877         * jit/JITCall.cpp:
3878         (JSC::JIT::compileLoadVarargs):
3879         * jit/JITCall32_64.cpp:
3880         (JSC::JIT::compileLoadVarargs):
3881         * jit/JITInlineMethods.h:
3882         (JSC::JIT::updateTopCallFrame):
3883         (JSC::JIT::emitValueProfilingSite):
3884         * jit/JITOpcodes32_64.cpp:
3885         (JSC::JIT::emitSlow_op_jfalse):
3886         (JSC::JIT::emitSlow_op_jtrue):
3887         * jit/JITStubCall.h:
3888         (JITStubCall):
3889         (JSC::JITStubCall::addArgument):
3890         * yarr/YarrJIT.cpp:
3891         (JSC::Yarr::YarrGenerator::backtrack):
3892
3893 2012-03-05  Gavin Barraclough  <barraclough@apple.com>
3894
3895         putByIndex should throw in strict mode
3896         https://bugs.webkit.org/show_bug.cgi?id=80335
3897
3898         Reviewed by Filip Pizlo.
3899
3900         We'll need to pass an additional parameter.
3901
3902         Part 1 - rename JSValue::put() for integer indices to JSValue::putByIndex()
3903         to match the method in the MethodTable, make this take a parameter indicating
3904         whether the put should throw. This fixes the cases where the base of the put
3905         is a primitive.
3906
3907         * dfg/DFGOperations.cpp:
3908         (DFG):
3909         (JSC::DFG::putByVal):
3910         (JSC::DFG::operationPutByValInternal):
3911         * interpreter/Interpreter.cpp:
3912         (JSC::Interpreter::execute):
3913         (JSC::Interpreter::privateExecute):
3914         * jit/JITStubs.cpp:
3915         (JSC::DEFINE_STUB_FUNCTION):
3916         * llint/LLIntSlowPaths.cpp:
3917         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3918         * runtime/JSObject.h:
3919         (JSC::JSValue::putByIndex):
3920         * runtime/JSValue.cpp:
3921         (JSC):
3922         * runtime/JSValue.h:
3923         (JSValue):
3924
3925 2012-03-05  Sam Weinig  <sam@webkit.org>
3926
3927         Add support for hosting layers in the window server in WebKit2
3928         <rdar://problem/10400246>
3929         https://bugs.webkit.org/show_bug.cgi?id=80310
3930
3931         Reviewed by Anders Carlsson.
3932
3933         * wtf/Platform.h:
3934         Add HAVE_LAYER_HOSTING_IN_WINDOW_SERVER.
3935
3936 2012-03-05  Filip Pizlo  <fpizlo@apple.com>
3937
3938         Unreviewed, attempted build fix for !ENABLE(JIT) after r109705.
3939
3940         * bytecode/ExecutionCounter.cpp:
3941         (JSC::ExecutionCounter::applyMemoryUsageHeuristics):
3942         * bytecode/ExecutionCounter.h:
3943
3944 2012-03-05  Patrick Gansterer  <paroga@webkit.org>
3945
3946         Unreviewed. Build fix for !ENABLE(JIT) after r109705.
3947
3948         * bytecode/ExecutionCounter.cpp:
3949         * bytecode/ExecutionCounter.h:
3950
3951 2012-03-05  Andy Wingo  <wingo@igalia.com>
3952
3953         Lexer: Specialize character predicates for LChar, UChar
3954         https://bugs.webkit.org/show_bug.cgi?id=79677
3955
3956         Reviewed by Oliver Hunt.
3957
3958         This patch specializes isIdentStart, isIdentPart, isWhiteSpace,
3959         and isLineTerminator to perform a more limited number of checks if
3960         the lexer is being instantiated to work on LChar sequences.  This
3961         is about a 1.5% win on the --parse-only suite, here.
3962
3963         * parser/Lexer.cpp:
3964         (JSC::isLatin1): New static helper, specialized for LChar and
3965         UChar.
3966         (JSC::typesOfLatin1Characters): Rename from
3967         typesOfASCIICharacters, and expand to the range of the LChar
3968         type.  All uses of isASCII are changed to use isLatin1.  Generated
3969         using libunistring.
3970         (JSC::isNonLatin1IdentStart):
3971         (JSC::isIdentStart):
3972         (JSC::isNonLatin1IdentPart):
3973         (JSC::isIdentPart):
3974         (JSC::Lexer::shiftLineTerminator):
3975         (JSC::Lexer::parseIdentifier):
3976         (JSC::Lexer::parseIdentifierSlowCase):
3977         (JSC::Lexer::parseStringSlowCase):
3978         (JSC::Lexer::parseMultilineComment):
3979         (JSC::Lexer::lex):
3980         (JSC::Lexer::scanRegExp):
3981         (JSC::Lexer::skipRegExp): Sprinkle static_cast<T>(_) around.
3982         * parser/Lexer.h:
3983         (JSC::Lexer::isWhiteSpace):
3984         (JSC::Lexer::isLineTerminator):
3985         * KeywordLookupGenerator.py:
3986         (Trie.printAsC): Declare specialized isIdentPart static functions.
3987
3988 2012-03-05  Carlos Garcia Campos  <cgarcia@igalia.com>
3989
3990         Unreviewed. Fix make distcheck.
3991
3992         * GNUmakefile.list.am: Add missing header file.
3993
3994 2012-03-05  Andy Wingo  <wingo@igalia.com>
3995
3996         WTF: Micro-optimize cleanup of empty vectors and hash tables
3997         https://bugs.webkit.org/show_bug.cgi?id=79903
3998
3999         Reviewed by Michael Saboff and Geoffrey Garen.
4000
4001         This patch speeds up cleanup of vectors and hash tables whose
4002         backing store was never allocated.  This is the case by default
4003         for most vectors / hash tables that never had any entries added.
4004
4005         The result for me is that calling checkSyntax 1000 times on
4006         conc