Source/JavaScriptCore/ChangeLog

   1 2017-04-04  Mark Lam  <mark.lam@apple.com>
   2
   3         On ARM64, DFG::SpeculativeJIT::compileArithMod() failed to ensure result is of DataFormatInt32.
   4         https://bugs.webkit.org/show_bug.cgi?id=170473
   5         <rdar://problem/29912391>
   6
   7         Reviewed by Saam Barati.
   8
   9         In Unchecked mode, when DFG::SpeculativeJIT::compileArithMod() detects that the
  10         divisor is 0, we want it to return 0.  The result is expected to be of
  11         DataFormatIn32.
  12
  13         The ARM implementation just returns the value in the divisor register.  However,
  14         the divisor in this case can be of DataFormatJSInt32.  On ARM64, returning the
  15         divisor register yields the wrong result format because the same register also
  16         holds the upper 32-bit of the JSValue encoding.  The fix is to return an
  17         immediate 0 instead.
  18
  19         Also turned on the assertion in jitAssertIsInt32 for ARM64.  This assertion being
  20         disabled may have contributed to this bug going unnoticed all this time.
  21
  22         * dfg/DFGSpeculativeJIT.cpp:
  23         (JSC::DFG::SpeculativeJIT::compileArithMod):
  24         * jit/AssemblyHelpers.cpp:
  25         (JSC::AssemblyHelpers::jitAssertIsInt32):
  26
  27 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
  28
  29         Air::eliminateDeadCode should not repeatedly process the same live instructions
  30         https://bugs.webkit.org/show_bug.cgi?id=170490
  31
  32         Reviewed by Keith Miller.
  33
  34         This makes the eliminateDeadCode() fixpoint somewhat worklist-based: we track the set
  35         of Insts that might be dead. Every time we detect that one is live, we remove it from
  36         the set. This is a big (>2x) speed-up because lots of Insts are immediately found to
  37         be live.
  38
  39         This is a ~1% wasm -O1 compile time progression.
  40
  41         * b3/air/AirEliminateDeadCode.cpp:
  42         (JSC::B3::Air::eliminateDeadCode):
  43
  44 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
  45
  46         Air::eliminateDeadCode() should not use a HashSet
  47         https://bugs.webkit.org/show_bug.cgi?id=170487
  48
  49         Reviewed by Saam Barati.
  50
  51         Introduce TmpSet, which is like a HashSet<Tmp>. Use this to make eliminateDeadCode()
  52         about 50% faster, resulting in a 1% wasm -O1 compile time progression.
  53
  54         * JavaScriptCore.xcodeproj/project.pbxproj:
  55         * b3/air/AirEliminateDeadCode.cpp:
  56         (JSC::B3::Air::eliminateDeadCode):
  57         * b3/air/AirTmpSet.h: Added.
  58         (JSC::B3::Air::TmpSet::TmpSet):
  59         (JSC::B3::Air::TmpSet::add):
  60         (JSC::B3::Air::TmpSet::remove):
  61         (JSC::B3::Air::TmpSet::contains):
  62         (JSC::B3::Air::TmpSet::size):
  63         (JSC::B3::Air::TmpSet::isEmpty):
  64         (JSC::B3::Air::TmpSet::iterator::iterator):
  65         (JSC::B3::Air::TmpSet::iterator::operator*):
  66         (JSC::B3::Air::TmpSet::iterator::operator++):
  67         (JSC::B3::Air::TmpSet::iterator::operator==):
  68         (JSC::B3::Air::TmpSet::iterator::operator!=):
  69         (JSC::B3::Air::TmpSet::begin):
  70         (JSC::B3::Air::TmpSet::end):
  71
  72 2017-04-04  Keith Miller  <keith_miller@apple.com>
  73
  74         WebAssembly: ModuleInformation should be a ref counted thing that can be shared across threads.
  75         https://bugs.webkit.org/show_bug.cgi?id=170478
  76
  77         Reviewed by Saam Barati.
  78
  79         ModuleInformation has been moved to its own file and is now
  80         ThreadSafeRefCounted.  All the Strings we used to keep in the
  81         ModuleInformation have been switched to Vector<LChar> this has the
  82         advantage that it can be passed across threads. However, this does
  83         mean that we need to decode the utf8 strings in each thread. This
  84         is likely not a problem because:
  85
  86         1) most modules have few imports/exports/custom sections.
  87         2) most of the time they are ascii so the conversion is cheap.
  88         3) we only have to do it once per thread, and there shouldn't be too many.
  89
  90         This patch also removes
  91         moduleSignatureIndicesToUniquedSignatureIndices since that
  92         information can already be recovered from the
  93         SignatureInformation.
  94
  95         * JavaScriptCore.xcodeproj/project.pbxproj:
  96         * jsc.cpp:
  97         (functionTestWasmModuleFunctions):
  98         * runtime/Identifier.h:
  99         (JSC::Identifier::fromString):
 100         * wasm/WasmB3IRGenerator.cpp:
 101         (JSC::Wasm::parseAndCompile):
 102         * wasm/WasmB3IRGenerator.h:
 103         * wasm/WasmFormat.cpp:
 104         (JSC::Wasm::makeString):
 105         (JSC::Wasm::ModuleInformation::~ModuleInformation): Deleted.
 106         * wasm/WasmFormat.h:
 107         (JSC::Wasm::makeString):
 108         (JSC::Wasm::ModuleInformation::functionIndexSpaceSize): Deleted.
 109         (JSC::Wasm::ModuleInformation::isImportedFunctionFromFunctionIndexSpace): Deleted.
 110         (JSC::Wasm::ModuleInformation::signatureIndexFromFunctionIndexSpace): Deleted.
 111         (JSC::Wasm::ModuleInformation::importFunctionCount): Deleted.
 112         (JSC::Wasm::ModuleInformation::internalFunctionCount): Deleted.
 113         * wasm/WasmFunctionParser.h:
 114         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
 115         * wasm/WasmModuleInformation.cpp: Copied from Source/JavaScriptCore/wasm/WasmValidate.h.
 116         (JSC::Wasm::ModuleInformation::~ModuleInformation):
 117         * wasm/WasmModuleInformation.h: Added.
 118         (JSC::Wasm::ModuleInformation::functionIndexSpaceSize):
 119         (JSC::Wasm::ModuleInformation::isImportedFunctionFromFunctionIndexSpace):
 120         (JSC::Wasm::ModuleInformation::signatureIndexFromFunctionIndexSpace):
 121         (JSC::Wasm::ModuleInformation::importFunctionCount):
 122         (JSC::Wasm::ModuleInformation::internalFunctionCount):
 123         (JSC::Wasm::ModuleInformation::ModuleInformation):
 124         * wasm/WasmModuleParser.cpp:
 125         * wasm/WasmModuleParser.h:
 126         (JSC::Wasm::ModuleParser::ModuleParser):
 127         * wasm/WasmParser.h:
 128         (JSC::Wasm::Parser<SuccessType>::consumeUTF8String):
 129         * wasm/WasmPlan.cpp:
 130         (JSC::Wasm::Plan::Plan):
 131         (JSC::Wasm::Plan::parseAndValidateModule):
 132         (JSC::Wasm::Plan::prepare):
 133         (JSC::Wasm::Plan::compileFunctions):
 134         (JSC::Wasm::Plan::complete):
 135         (JSC::Wasm::Plan::cancel):
 136         * wasm/WasmPlan.h:
 137         (JSC::Wasm::Plan::internalFunctionCount):
 138         (JSC::Wasm::Plan::takeModuleInformation):
 139         * wasm/WasmSignature.cpp:
 140         (JSC::Wasm::SignatureInformation::get):
 141         * wasm/WasmSignature.h:
 142         * wasm/WasmValidate.cpp:
 143         (JSC::Wasm::validateFunction):
 144         * wasm/WasmValidate.h:
 145         * wasm/js/JSWebAssemblyHelpers.h:
 146         (JSC::createSourceBufferFromValue):
 147         * wasm/js/JSWebAssemblyModule.cpp:
 148         (JSC::JSWebAssemblyModule::createStub):
 149         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
 150         (JSC::JSWebAssemblyModule::finishCreation):
 151         * wasm/js/JSWebAssemblyModule.h:
 152         (JSC::JSWebAssemblyModule::moduleInformation):
 153         (JSC::JSWebAssemblyModule::source):
 154         * wasm/js/WebAssemblyInstanceConstructor.cpp:
 155         (JSC::constructJSWebAssemblyInstance):
 156         * wasm/js/WebAssemblyModuleConstructor.cpp:
 157         (JSC::WebAssemblyModuleConstructor::createModule):
 158         * wasm/js/WebAssemblyModulePrototype.cpp:
 159         (JSC::webAssemblyModuleProtoCustomSections):
 160         (JSC::webAssemblyModuleProtoImports):
 161         (JSC::webAssemblyModuleProtoExports):
 162         * wasm/js/WebAssemblyModuleRecord.cpp:
 163         (JSC::WebAssemblyModuleRecord::link):
 164         * wasm/js/WebAssemblyModuleRecord.h:
 165         * wasm/js/WebAssemblyPrototype.cpp:
 166         (JSC::webAssemblyCompileFunc):
 167         (JSC::instantiate):
 168         (JSC::compileAndInstantiate):
 169
 170 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 171
 172         B3::fixSSA() needs a tune-up
 173         https://bugs.webkit.org/show_bug.cgi?id=170485
 174
 175         Reviewed by Saam Barati.
 176
 177         After the various optimizations to liveness, register allocation, and other phases, the
 178         fixSSA() phase now looks like one of the top offenders. This includes a bunch of
 179         changes to make this phase run faster. This is a ~7% wasm -O1 compile time progression.
 180
 181         Here's what I did:
 182
 183         - We now use IndexSparseSet instead of IndexMap for tracking variable values. This
 184           makes it cheaper to chew through small blocks while there is a non-trivial number of
 185           total variables.
 186
 187         - We now do a "local SSA conversion" pass before anything else. This eliminates
 188           obvious Get's. If we were using temporary Variables, it would eliminate many of
 189           those. That's useful for when we use demoteValues() and duplciateTails(). For wasm
 190           -O1, we mainly care about the fact that it makes a bunch of Set's dead.
 191
 192         - We now do a Set DCE pass after the local SSA but before SSA conversion. This ensures
 193           that any block-local live intervals of Variables disappear and don't need further
 194           consideration.
 195
 196         - We now cache the reaching defs calculation.
 197
 198         - We now perform the reaching defs calculation lazily.
 199
 200         * b3/B3FixSSA.cpp:
 201         (JSC::B3::demoteValues):
 202         (JSC::B3::fixSSA):
 203         * b3/B3SSACalculator.cpp:
 204         (JSC::B3::SSACalculator::reachingDefAtTail):
 205         * b3/B3VariableLiveness.cpp:
 206         (JSC::B3::VariableLiveness::VariableLiveness):
 207         * b3/air/AirLiveness.h:
 208         (JSC::B3::Air::Liveness::Liveness):
 209         * dfg/DFGLivenessAnalysisPhase.cpp:
 210         (JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase): Deleted.
 211         (JSC::DFG::LivenessAnalysisPhase::run): Deleted.
 212         (JSC::DFG::LivenessAnalysisPhase::processBlock): Deleted.
 213
 214 2017-04-04  Joseph Pecoraro  <pecoraro@apple.com>
 215
 216         Remove stale LLVM Header Path includes from JavaScriptCore
 217         https://bugs.webkit.org/show_bug.cgi?id=170483
 218
 219         Reviewed by Mark Lam.
 220
 221         * Configurations/Base.xcconfig:
 222
 223 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 224
 225         B3::LowerToAir incorrectly selects BitXor(AtomicStrongCAS(...), $1)
 226         https://bugs.webkit.org/show_bug.cgi?id=169867
 227
 228         Reviewed by Saam Barati.
 229
 230         The BitXor(AtomicWeakCAS(...), $1) optimization makes a lot of sense because we an fold the
 231         BitXor into the CAS condition read-out. But there is no version of this that is profitable or
 232         correct for AtomicStrongCAS. The inversion case is handled by Equal(AtomicStrongCAS(...), ...)
 233         becoming NotEqual(AtomicStrongCAS(...), ...), and we alraedy handle that separately.
 234
 235         So, the fix here is to make the BitXor CAS pattern only recognize AtomicWeakCAS.
 236
 237         * b3/B3LowerToAir.cpp:
 238         (JSC::B3::Air::LowerToAir::lower):
 239         * b3/testb3.cpp:
 240         (JSC::B3::testAtomicStrongCAS):
 241
 242 2017-04-04  Saam Barati  <sbarati@apple.com>
 243
 244         WebAssembly: JSWebAssemblyCallee should not be a JSCell
 245         https://bugs.webkit.org/show_bug.cgi?id=170135
 246
 247         Reviewed by Michael Saboff.
 248
 249         This patch is perhaps the last big change to the design of fundamental
 250         Wasm API to allow for PIC. It changes JSWebAssemblyCallee into a thing
 251         called Wasm::Callee. It serves the same purpose as before, except
 252         Wasm::Callee is not a JSCell. I had to refactor the various parts of the
 253         runtime that will see CallFrame's with Wasm::Callee's in the callee slot.
 254         Thankfully, the parts of the runtime that Wasm touches are limited. The
 255         main refactoring is changing the exception handling code, such as taking
 256         a stack trace, to be friendly to seeing a non JSCell callee.
 257
 258         The callee() function on ExecState now returns a class I added in this
 259         patch called CalleeBits. CalleeBits will tell you if the callee is a
 260         JSCell or a Wasm::Callee. We tag Wasm::Callee's with a 1 in their lower
 261         bit so we can easily tell what is and isn't a Wasm::Callee.
 262
 263         The stub that calls out from Wasm to JS still puts a JSCell callee
 264         into the call frame, even though the callee logically represents a
 265         Wasm frame. The reason for this is that we use the call IC infrastructure
 266         to make a call out to JS code, and the code that writes the IC expects
 267         a JSCell as the callee. This is knowingly part of our design. When we
 268         do structured cloning of Wasm Modules, we'll need to regenerate these
 269         JS call stubs.
 270
 271         * API/JSContextRef.cpp:
 272         (BacktraceFunctor::operator()):
 273         * CMakeLists.txt:
 274         * JavaScriptCore.xcodeproj/project.pbxproj:
 275         * debugger/Debugger.cpp:
 276         (JSC::Debugger::pauseIfNeeded):
 277         (JSC::Debugger::currentDebuggerCallFrame):
 278         * debugger/DebuggerCallFrame.cpp:
 279         (JSC::DebuggerCallFrame::create):
 280         (JSC::DebuggerCallFrame::DebuggerCallFrame):
 281         (JSC::DebuggerCallFrame::currentPosition):
 282         (JSC::DebuggerCallFrame::positionForCallFrame):
 283         * debugger/DebuggerCallFrame.h:
 284         * interpreter/CallFrame.cpp:
 285         (JSC::CallFrame::vmEntryGlobalObject):
 286         (JSC::CallFrame::wasmAwareLexicalGlobalObject):
 287         (JSC::CallFrame::isAnyWasmCallee):
 288         (JSC::CallFrame::callerSourceOrigin):
 289         * interpreter/CallFrame.h:
 290         (JSC::ExecState::calleeAsValue):
 291         (JSC::ExecState::jsCallee):
 292         (JSC::ExecState::callee):
 293         (JSC::ExecState::unsafeCallee):
 294         (JSC::ExecState::scope):
 295         (JSC::ExecState::iterate):
 296         * interpreter/CalleeBits.h: Added.
 297         (JSC::CalleeBits::CalleeBits):
 298         (JSC::CalleeBits::operator=):
 299         (JSC::CalleeBits::boxWasm):
 300         (JSC::CalleeBits::isWasm):
 301         (JSC::CalleeBits::isCell):
 302         (JSC::CalleeBits::asCell):
 303         (JSC::CalleeBits::asWasmCallee):
 304         (JSC::CalleeBits::rawPtr):
 305         * interpreter/Interpreter.cpp:
 306         (JSC::GetStackTraceFunctor::operator()):
 307         (JSC::Interpreter::getStackTrace):
 308         (JSC::notifyDebuggerOfUnwinding):
 309         (JSC::UnwindFunctor::UnwindFunctor):
 310         (JSC::UnwindFunctor::operator()):
 311         (JSC::UnwindFunctor::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
 312         (JSC::Interpreter::unwind):
 313         (JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):
 314         * interpreter/Interpreter.h:
 315         * interpreter/Register.h:
 316         (JSC::Register::pointer):
 317         * interpreter/ShadowChicken.cpp:
 318         (JSC::ShadowChicken::update):
 319         * interpreter/ShadowChickenInlines.h:
 320         (JSC::ShadowChicken::iterate):
 321         * interpreter/StackVisitor.cpp:
 322         (JSC::StackVisitor::StackVisitor):
 323         (JSC::StackVisitor::readFrame):
 324         (JSC::StackVisitor::readNonInlinedFrame):
 325         (JSC::StackVisitor::readInlinedFrame):
 326         (JSC::StackVisitor::Frame::calleeSaveRegisters):
 327         (JSC::StackVisitor::Frame::functionName):
 328         (JSC::StackVisitor::Frame::dump):
 329         * interpreter/StackVisitor.h:
 330         (JSC::StackVisitor::Frame::callee):
 331         (JSC::StackVisitor::visit):
 332         * jit/Repatch.cpp:
 333         (JSC::linkFor):
 334         (JSC::linkPolymorphicCall):
 335         * jsc.cpp:
 336         (callWasmFunction):
 337         (functionTestWasmModuleFunctions):
 338         * runtime/ArrayPrototype.cpp:
 339         * runtime/Error.cpp:
 340         (JSC::addErrorInfoAndGetBytecodeOffset):
 341         * runtime/ErrorInstance.cpp:
 342         (JSC::ErrorInstance::finishCreation):
 343         * runtime/JSCell.cpp:
 344         (JSC::JSCell::isAnyWasmCallee): Deleted.
 345         * runtime/JSCell.h:
 346         * runtime/JSCellInlines.h:
 347         (JSC::ExecState::vm):
 348         * runtime/JSFunction.cpp:
 349         (JSC::RetrieveArgumentsFunctor::operator()):
 350         (JSC::RetrieveCallerFunctionFunctor::operator()):
 351         * runtime/JSGlobalObject.cpp:
 352         * runtime/SamplingProfiler.cpp:
 353         (JSC::FrameWalker::recordJSFrame):
 354         (JSC::SamplingProfiler::processUnverifiedStackTraces):
 355         * runtime/SamplingProfiler.h:
 356         (JSC::SamplingProfiler::UnprocessedStackFrame::UnprocessedStackFrame):
 357         * runtime/StackFrame.cpp:
 358         (JSC::StackFrame::sourceURL):
 359         (JSC::StackFrame::functionName):
 360         * runtime/StackFrame.h:
 361         (JSC::StackFrame::wasm):
 362         * runtime/VM.cpp:
 363         (JSC::VM::VM):
 364         (JSC::VM::throwException):
 365         * runtime/VM.h:
 366         * wasm/JSWebAssembly.h:
 367         * wasm/WasmB3IRGenerator.cpp:
 368         * wasm/WasmBinding.cpp:
 369         (JSC::Wasm::wasmToWasm):
 370         * wasm/WasmCallee.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp.
 371         (JSC::Wasm::Callee::Callee):
 372         (JSC::JSWebAssemblyCallee::JSWebAssemblyCallee): Deleted.
 373         (JSC::JSWebAssemblyCallee::finishCreation): Deleted.
 374         (JSC::JSWebAssemblyCallee::destroy): Deleted.
 375         * wasm/WasmCallee.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.h.
 376         (JSC::Wasm::Callee::create):
 377         (JSC::JSWebAssemblyCallee::create): Deleted.
 378         (JSC::JSWebAssemblyCallee::createStructure): Deleted.
 379         (JSC::JSWebAssemblyCallee::entrypoint): Deleted.
 380         (JSC::JSWebAssemblyCallee::calleeSaveRegisters): Deleted.
 381         * wasm/WasmContext.h:
 382         * wasm/WasmPlan.cpp:
 383         * wasm/WasmPlan.h:
 384         * wasm/WasmPlanInlines.h:
 385         (JSC::Wasm::Plan::initializeCallees):
 386         * wasm/WasmThunks.cpp:
 387         (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
 388         * wasm/js/JSWebAssemblyCallee.cpp: Removed.
 389         * wasm/js/JSWebAssemblyCallee.h: Removed.
 390         * wasm/js/JSWebAssemblyCodeBlock.cpp:
 391         (JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
 392         (JSC::JSWebAssemblyCodeBlock::initialize):
 393         (JSC::JSWebAssemblyCodeBlock::visitChildren):
 394         * wasm/js/JSWebAssemblyCodeBlock.h:
 395         (JSC::JSWebAssemblyCodeBlock::create):
 396         (JSC::JSWebAssemblyCodeBlock::jsEntrypointCalleeFromFunctionIndexSpace):
 397         (JSC::JSWebAssemblyCodeBlock::wasmEntrypointCalleeFromFunctionIndexSpace):
 398         (JSC::JSWebAssemblyCodeBlock::wasmToJsCallStubForImport):
 399         (JSC::JSWebAssemblyCodeBlock::offsetOfImportWasmToJSStub):
 400         (JSC::JSWebAssemblyCodeBlock::setJSEntrypointCallee):
 401         (JSC::JSWebAssemblyCodeBlock::setWasmEntrypointCallee):
 402         (JSC::JSWebAssemblyCodeBlock::offsetOfImportStubs):
 403         (JSC::JSWebAssemblyCodeBlock::allocationSize):
 404         (JSC::JSWebAssemblyCodeBlock::importWasmToJSStub):
 405         (JSC::JSWebAssemblyCodeBlock::callees): Deleted.
 406         (JSC::JSWebAssemblyCodeBlock::offsetOfCallees): Deleted.
 407         * wasm/js/JSWebAssemblyInstance.h:
 408         (JSC::JSWebAssemblyInstance::webAssemblyToJSCallee):
 409         * wasm/js/JSWebAssemblyModule.cpp:
 410         * wasm/js/WebAssemblyFunction.cpp:
 411         (JSC::callWebAssemblyFunction):
 412         (JSC::WebAssemblyFunction::create):
 413         (JSC::WebAssemblyFunction::WebAssemblyFunction):
 414         (JSC::WebAssemblyFunction::visitChildren):
 415         (JSC::WebAssemblyFunction::finishCreation):
 416         * wasm/js/WebAssemblyFunction.h:
 417         (JSC::WebAssemblyFunction::wasmEntrypoint):
 418         (JSC::WebAssemblyFunction::jsEntrypoint):
 419         (JSC::WebAssemblyFunction::offsetOfWasmEntrypoint):
 420         (JSC::WebAssemblyFunction::offsetOfWasmEntryPointCode): Deleted.
 421         * wasm/js/WebAssemblyModuleConstructor.cpp:
 422         * wasm/js/WebAssemblyModuleRecord.cpp:
 423         (JSC::WebAssemblyModuleRecord::link):
 424         (JSC::WebAssemblyModuleRecord::evaluate):
 425
 426 2017-04-04  Keith Miller  <keith_miller@apple.com>
 427
 428         WasmBench asserts in debug jsc
 429         https://bugs.webkit.org/show_bug.cgi?id=170462
 430
 431         Reviewed by Saam Barati.
 432
 433         The assertion should have been an if.
 434
 435         * wasm/WasmWorklist.cpp:
 436
 437 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 438
 439         Air::lowerAfterRegAlloc should bail early if it finds no Shuffles or ColdCCalls
 440         https://bugs.webkit.org/show_bug.cgi?id=170305
 441
 442         Reviewed by Saam Barati.
 443
 444         This reduces and sometimes completely eliminates the need to run lowerAfterRegAlloc().
 445
 446         This lowers the Shuffle for the arguments of a CCall before register allocation unless
 447         the CCall arguments require a real shuffle (like if the CCall arguments were argument
 448         registers). This lowers a ColdCCall like a CCall for optLevel<2.
 449
 450         Finally, lowerAfterRegAlloc() now checks if there are any Shuffles or CCalls before it
 451         does anything else. For wasm at -O1, this means that the phase doesn't run at all. This
 452         is a ~3% wasm -O1 compile time progression.
 453
 454         To make this easy, I changed optLevel into a property of Procedure and Code rather than
 455         an argument we thread through everything. I like how Procedure and Code are dumping
 456         ground classes. This does not bother me. Note that I cloned optLevel into Procedure and
 457         Code so that it's cheap to query inside Air phases.
 458
 459         * b3/B3Compile.cpp:
 460         (JSC::B3::compile):
 461         * b3/B3Compile.h:
 462         * b3/B3Generate.cpp:
 463         (JSC::B3::prepareForGeneration):
 464         (JSC::B3::generateToAir):
 465         * b3/B3Generate.h:
 466         * b3/B3Procedure.cpp:
 467         (JSC::B3::Procedure::setOptLevel):
 468         * b3/B3Procedure.h:
 469         (JSC::B3::Procedure::optLevel):
 470         * b3/air/AirCode.h:
 471         (JSC::B3::Air::Code::isPinned):
 472         (JSC::B3::Air::Code::setOptLevel):
 473         (JSC::B3::Air::Code::optLevel):
 474         * b3/air/AirEmitShuffle.cpp:
 475         (JSC::B3::Air::ShufflePair::bank):
 476         (JSC::B3::Air::ShufflePair::opcode):
 477         (JSC::B3::Air::ShufflePair::inst):
 478         (JSC::B3::Air::emitShuffle):
 479         * b3/air/AirEmitShuffle.h:
 480         (JSC::B3::Air::moveFor):
 481         * b3/air/AirGenerate.cpp:
 482         (JSC::B3::Air::prepareForGeneration):
 483         * b3/air/AirGenerate.h:
 484         * b3/air/AirLowerAfterRegAlloc.cpp:
 485         (JSC::B3::Air::lowerAfterRegAlloc):
 486         * b3/air/AirLowerMacros.cpp:
 487         (JSC::B3::Air::lowerMacros):
 488         * b3/testb3.cpp:
 489         (JSC::B3::compileProc):
 490         * wasm/WasmB3IRGenerator.cpp:
 491         (JSC::Wasm::parseAndCompile):
 492
 493 2017-04-04  Filip Pizlo  <fpizlo@apple.com>
 494
 495         Don't need to Air::reportUsedRegisters for wasm at -O1
 496         https://bugs.webkit.org/show_bug.cgi?id=170459
 497
 498         Reviewed by Saam Barati.
 499
 500         I did some refactorings to Liveness<> to try to understand its performance. Based on
 501         this I concluded that the bigger immediate issue is just removing unnecessary phases
 502         from -O1.
 503
 504         This removes Air::reportUsedRegisters() from -O1 if the user has indicated that he is
 505         not interested in StackmapGenerationParams::usedRegisters(). The logic here is a bit
 506         weird because of how Air does spill code generation. The register allocator's spiller
 507         will emit spill code using identifiable spill slots, which allows subsequent phases to
 508         register-allocate the spill slots. We do this by a forward flow CSE phase called
 509         fixObviousSpills (which is a terrible name since there is no longer anything obvious
 510         about some of the spills that this phase can fix!). As is most natural for CSEs over
 511         3AC, it rewires the uses of redundant computations rather than removing the redundant
 512         computations. This means that if a spill got "fixed", there may be either or both of
 513         the following:
 514
 515         - Dead loads from the stack.
 516         - Dead stores to the stack.
 517
 518         We know that a load from the stack is dead if the register is dead at the point of the
 519         load. We know that a store to the stack is dead if the spill slot is dead at the point
 520         of the store.
 521
 522         Unfortunately, liveness analysis - over either registers or spill slots - is expensive.
 523
 524         Fortunately, allocateStack() already does liveness analysis over spill slots. So, we
 525         baked elimination of stores to the stack into that phase. That aspect of clean-up after
 526         the spill CSE comes for free.
 527
 528         Also fortunately for the FTL, we have to do reportUsedRegisters() anyway. This is a
 529         phase that enables StackmapGenerationParams::usedRegisters() to work, which then
 530         enables the FTL's patchpoints to do crazy slow-path live range splitting. So, Air's
 531         strategy for the load fix-up after spill CSE is to do it as part of
 532         reportUsedRegisters().
 533
 534         This patch introduces the Procedure::setNeedsUsedRegisters() API. But if you set
 535         needsUsedRegisters to false then we will still run reportUsedRegisters() at -O2 as an
 536         optimization - it removes dead loads from the stack that are left behind from
 537         fixObviousSpills().
 538
 539         This is a ~6% compile time progression at -O1.
 540
 541         * b3/B3Procedure.h:
 542         (JSC::B3::Procedure::setNeedsUsedRegisters):
 543         (JSC::B3::Procedure::needsUsedRegisters):
 544         * b3/B3StackmapGenerationParams.h:
 545         * b3/B3VariableLiveness.cpp:
 546         (JSC::B3::VariableLiveness::VariableLiveness):
 547         * b3/air/AirCode.cpp:
 548         (JSC::B3::Air::Code::needsUsedRegisters):
 549         * b3/air/AirCode.h:
 550         * b3/air/AirGenerate.cpp:
 551         (JSC::B3::Air::prepareForGeneration):
 552         * b3/air/AirLiveness.h:
 553         (JSC::B3::Air::Liveness::Liveness):
 554         * wasm/WasmB3IRGenerator.cpp:
 555         (JSC::Wasm::parseAndCompile):
 556
 557 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 558
 559         Air liveness should build constraints and solve them rather than repeatedly parsing IR
 560         https://bugs.webkit.org/show_bug.cgi?id=170421
 561
 562         Reviewed by Saam Barati.
 563
 564         Inst::forEach<> is expensive. The LivenessAdapter uses forEach with a particularly
 565         gnarly lambda that has many extra checks. Therefore, a lot of the time spent in
 566         liveness analysis is just recomputing forEach<> and that lambda to get uses and defs.
 567
 568         This introduces LivenessConstraints<>, which is a liveness constraint system based on
 569         Adapter. It basically caches the results of doing forEach. It'll give you the uses and
 570         defs at each instruction boundary.
 571
 572         This is a ~5% compile time progression at optLevel=1. It's also a ~3% compile time
 573         progression at optLevel=2.
 574
 575         * JavaScriptCore.xcodeproj/project.pbxproj:
 576         * b3/air/AirLivenessAdapter.h:
 577         (JSC::B3::Air::LivenessAdapter::LivenessAdapter):
 578         (JSC::B3::Air::LivenessAdapter::forEachUse):
 579         (JSC::B3::Air::LivenessAdapter::forEachDef):
 580         * b3/air/AirLivenessConstraints.h: Added.
 581         (JSC::B3::Air::LivenessConstraints::Actions::Actions):
 582         (JSC::B3::Air::LivenessConstraints::LivenessConstraints):
 583         (JSC::B3::Air::LivenessConstraints::at):
 584
 585 2017-04-03  Mark Lam  <mark.lam@apple.com>
 586
 587         Fix incorrect capacity delta calculation reported in SparseArrayValueMap::add().
 588         https://bugs.webkit.org/show_bug.cgi?id=170412
 589         <rdar://problem/29697336>
 590
 591         Reviewed by Filip Pizlo.
 592
 593         Here's an example of code that will trigger underflow in the "deprecatedExtraMemory"
 594         reported by SparseArrayValueMap::add() that is added to Heap::m_deprecatedExtraMemorySize:
 595
 596             arr = new Array;
 597             Object.defineProperty(arr, 18, ({writable: true, configurable: true}));
 598             for (var i = 0; i < 3; ++i) {
 599                 Array.prototype.push.apply(arr, ["", () => {}, {}]);
 600                 Array.prototype.sort.apply(arr, [() => {}, []]);
 601             }
 602
 603         However, Heap::m_deprecatedExtraMemorySize is only 1 of 3 values that are added
 604         up to form the result of Heap::extraMemorySize().  Heap::m_extraMemorySize and
 605         Heap::m_arrayBuffers.size() are the other 2.
 606
 607         While Heap::m_arrayBuffers.size() is bounded by actual allocated memory, both
 608         Heap::m_deprecatedExtraMemorySize and Heap::m_extraMemorySize are added to
 609         without any bounds checks, and they are only reset to 0 at the start of a full
 610         GC.  As a result, if we have a long sequence of eden GCs with a lot of additions
 611         to Heap::m_extraMemorySize and/or Heap::m_deprecatedExtraMemorySize, then these
 612         values could theoretically overflow.  Coupling this with the underflow from
 613         SparseArrayValueMap::add(), the result for Heap::extraMemorySize() can easily
 614         overflow.  Note: Heap::extraMemorySize() is used to compute the value
 615         currentHeapSize.
 616
 617         If multiple conditions line up just right, the above overflows can result in this
 618         debug assertion failure during an eden GC:
 619
 620             ASSERT(currentHeapSize >= m_sizeAfterLastCollect);
 621
 622         Otherwise, the effects of the overflows will only result in the computed
 623         currentHeapSize not being representative of actual memory usage, and therefore,
 624         a full GC may be triggered earlier or later than is ideal.
 625
 626         This patch ensures that SparseArrayValueMap::add() cannot underflow
 627         Heap::m_deprecatedExtraMemorySize.  It also adds overflows checks in the
 628         calculations of Heap::m_deprecatedExtraMemorySize, Heap::m_extraMemorySize, and
 629         Heap::extraMemorySize() so that their values are saturated appropriately to
 630         ensure that GC collections are triggered based on representative memory usage.
 631
 632         * heap/Heap.cpp:
 633         (JSC::Heap::deprecatedReportExtraMemorySlowCase):
 634         (JSC::Heap::extraMemorySize):
 635         (JSC::Heap::updateAllocationLimits):
 636         (JSC::Heap::reportExtraMemoryVisited):
 637         * runtime/SparseArrayValueMap.cpp:
 638         (JSC::SparseArrayValueMap::add):
 639
 640 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 641
 642         Move the Liveness<> adapters from AirLiveness.h to AirLivenessAdapter.h.
 643
 644         Rubber stamped by Keith Miller.
 645
 646         This will make it easier to write other code that uses those adapters.
 647
 648         * JavaScriptCore.xcodeproj/project.pbxproj:
 649         * b3/air/AirLiveness.h:
 650         (JSC::B3::Air::LivenessAdapter::LivenessAdapter): Deleted.
 651         (JSC::B3::Air::LivenessAdapter::blockSize): Deleted.
 652         (JSC::B3::Air::LivenessAdapter::forEachUse): Deleted.
 653         (JSC::B3::Air::LivenessAdapter::forEachDef): Deleted.
 654         (JSC::B3::Air::TmpLivenessAdapter::TmpLivenessAdapter): Deleted.
 655         (JSC::B3::Air::TmpLivenessAdapter::numIndices): Deleted.
 656         (JSC::B3::Air::TmpLivenessAdapter::acceptsBank): Deleted.
 657         (JSC::B3::Air::TmpLivenessAdapter::acceptsRole): Deleted.
 658         (JSC::B3::Air::TmpLivenessAdapter::valueToIndex): Deleted.
 659         (JSC::B3::Air::TmpLivenessAdapter::indexToValue): Deleted.
 660         (JSC::B3::Air::StackSlotLivenessAdapter::StackSlotLivenessAdapter): Deleted.
 661         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices): Deleted.
 662         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsBank): Deleted.
 663         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsRole): Deleted.
 664         (JSC::B3::Air::StackSlotLivenessAdapter::valueToIndex): Deleted.
 665         (JSC::B3::Air::StackSlotLivenessAdapter::indexToValue): Deleted.
 666         * b3/air/AirLivenessAdapter.h: Added.
 667         (JSC::B3::Air::LivenessAdapter::LivenessAdapter):
 668         (JSC::B3::Air::LivenessAdapter::blockSize):
 669         (JSC::B3::Air::LivenessAdapter::forEachUse):
 670         (JSC::B3::Air::LivenessAdapter::forEachDef):
 671         (JSC::B3::Air::TmpLivenessAdapter::TmpLivenessAdapter):
 672         (JSC::B3::Air::TmpLivenessAdapter::numIndices):
 673         (JSC::B3::Air::TmpLivenessAdapter::acceptsBank):
 674         (JSC::B3::Air::TmpLivenessAdapter::acceptsRole):
 675         (JSC::B3::Air::TmpLivenessAdapter::valueToIndex):
 676         (JSC::B3::Air::TmpLivenessAdapter::indexToValue):
 677         (JSC::B3::Air::StackSlotLivenessAdapter::StackSlotLivenessAdapter):
 678         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
 679         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsBank):
 680         (JSC::B3::Air::StackSlotLivenessAdapter::acceptsRole):
 681         (JSC::B3::Air::StackSlotLivenessAdapter::valueToIndex):
 682         (JSC::B3::Air::StackSlotLivenessAdapter::indexToValue):
 683
 684 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 685
 686         WTF::Liveness should have an API that focuses on actions at instruction boundaries
 687         https://bugs.webkit.org/show_bug.cgi?id=170407
 688
 689         Reviewed by Keith Miller.
 690
 691         Adopt changes to the WTF::Liveness<> API. Instead of having separate functions for the
 692         early/late versions of uses and defs, we now have just a use/def API. Those
 693         automatically take care of eary/late issues as needed.
 694
 695         This reduces the API surface between WTF::Liveness<> and its clients, which makes it
 696         easier to implement some other optimizations I'm thinking about.
 697
 698         * b3/B3VariableLiveness.h:
 699         (JSC::B3::VariableLivenessAdapter::forEachUse):
 700         (JSC::B3::VariableLivenessAdapter::forEachDef):
 701         (JSC::B3::VariableLivenessAdapter::forEachEarlyUse): Deleted.
 702         (JSC::B3::VariableLivenessAdapter::forEachLateUse): Deleted.
 703         (JSC::B3::VariableLivenessAdapter::forEachEarlyDef): Deleted.
 704         (JSC::B3::VariableLivenessAdapter::forEachLateDef): Deleted.
 705         * b3/air/AirLiveness.h:
 706         (JSC::B3::Air::LivenessAdapter::blockSize):
 707         (JSC::B3::Air::LivenessAdapter::forEachUse):
 708         (JSC::B3::Air::LivenessAdapter::forEachDef):
 709         (JSC::B3::Air::LivenessAdapter::forEachEarlyUse): Deleted.
 710         (JSC::B3::Air::LivenessAdapter::forEachLateUse): Deleted.
 711         (JSC::B3::Air::LivenessAdapter::forEachEarlyDef): Deleted.
 712         (JSC::B3::Air::LivenessAdapter::forEachLateDef): Deleted.
 713
 714 2017-04-03  Filip Pizlo  <fpizlo@apple.com>
 715
 716         Inst::forEachArg could compile to more compact code
 717         https://bugs.webkit.org/show_bug.cgi?id=170406
 718
 719         Reviewed by Sam Weinig.
 720
 721         Prior to this change, Inst::forEachArg compiled to a ginormous ALWAYS_INLINE switch statement.
 722         It had one case for each opcode, and then each of those cases would have a switch statement over
 723         the number of operands. Then the cases of that switch statement would have a sequence of calls to
 724         the passed lambda. This meant that every user of forEachArg would generate an insane amount of
 725         code. It also meant that the inlining achieved nothing, since the lambda would surely then not
 726         be inlined - and if it was, then the icache pressure due to code bloat would surely negate any
 727         benefits.
 728
 729         This replaces that code with a loop over a compact look-up table. We use the opcode and number of
 730         operands as keys into that look-up table. The table only takes about 20KB. It has one byte for
 731         each argument in each overload of each opcode.
 732
 733         I can't measure any reproducible change in performance, but the JavaScriptCore framework binary
 734         shrinks by 2.7 MB. This is a 15% reduction in JavaScriptCore binary size.
 735
 736         * JavaScriptCore.xcodeproj/project.pbxproj:
 737         * b3/B3Width.h:
 738         * b3/air/AirCustom.h:
 739         (JSC::B3::Air::PatchCustom::forEachArg):
 740         * b3/air/AirFormTable.h: Added.
 741         (JSC::B3::Air::decodeFormRole):
 742         (JSC::B3::Air::decodeFormBank):
 743         (JSC::B3::Air::decodeFormWidth):
 744         * b3/air/AirInst.h:
 745         * b3/air/opcode_generator.rb:
 746
 747 2017-04-03  Keith Miller  <keith_miller@apple.com>
 748
 749         WebAssembly: remove lastAllocatedMode from Memory
 750         https://bugs.webkit.org/show_bug.cgi?id=170405
 751
 752         Reviewed by Mark Lam.
 753
 754         It's not used anymore so there isn't any point in keeping it around.
 755
 756         * wasm/WasmMemory.cpp:
 757         (JSC::Wasm::Memory::createImpl):
 758         (JSC::Wasm::Memory::lastAllocatedMode): Deleted.
 759         * wasm/WasmMemory.h:
 760
 761 2017-04-03  Zan Dobersek  <zdobersek@igalia.com>
 762
 763         [jsc] Add patchableJumpSize() for MIPS
 764         https://bugs.webkit.org/show_bug.cgi?id=169716
 765
 766         Reviewed by Yusuke Suzuki.
 767
 768         * assembler/MIPSAssembler.h:
 769         (JSC::MIPSAssembler::patchableJumpSize): Added.
 770         * assembler/MacroAssemblerMIPS.h:
 771         (JSC::MacroAssemblerMIPS::patchableJumpSize): Added.
 772
 773 2017-04-03  Guillaume Emont  <guijemont@igalia.com>
 774
 775         [jsc] implement MIPSAssembler::relinkJumpToNop()
 776         https://bugs.webkit.org/show_bug.cgi?id=169720
 777
 778         Reviewed by Yusuke Suzuki.
 779
 780         * assembler/MIPSAssembler.h:
 781         (JSC::MIPSAssembler::relinkJumpToNop): Added.
 782
 783 2017-04-02  Carlos Garcia Campos  <cgarcia@igalia.com>
 784
 785         Share implementation of JSRunLoopTimer::timerDidFire
 786         https://bugs.webkit.org/show_bug.cgi?id=170392
 787
 788         Reviewed by Michael Catanzaro.
 789
 790         The code is cross-platform but it's duplicated in CF and GLib implementations, it could be shared instead.
 791
 792         * runtime/JSRunLoopTimer.cpp:
 793         (JSC::JSRunLoopTimer::timerDidFire): Move common implementation here.
 794         (JSC::JSRunLoopTimer::setRunLoop): Use timerDidFireCallback.
 795         (JSC::JSRunLoopTimer::timerDidFireCallback): Call JSRunLoopTimer::timerDidFire().
 796         * runtime/JSRunLoopTimer.h:
 797
 798 2017-04-01  Oleksandr Skachkov  <gskachkov@gmail.com>
 799
 800         Object with numerical keys with gaps gets filled by NaN values
 801         https://bugs.webkit.org/show_bug.cgi?id=164412
 802
 803         Reviewed by Mark Lam.
 804
 805         This patch fixes issue when object have two properties
 806         with name as number. The issue appears when during invoking
 807         convertDoubleToArrayStorage, array is filled by pNaN and
 808         method converting it to real NaN. This happeneds because a
 809         pNaN in a Double array is a hole, and Double arrays cannot
 810         have NaN values. To fix issue we need to check value and
 811         clear it if it pNaN.
 812
 813         * runtime/JSObject.cpp:
 814         (JSC::JSObject::convertDoubleToArrayStorage):
 815
 816 2017-03-31  Saam Barati  <sbarati@apple.com>
 817
 818         WebAssembly: Make our calls out to JS PIC friendly
 819         https://bugs.webkit.org/show_bug.cgi?id=170261
 820
 821         Reviewed by Keith Miller.
 822
 823         This patch removes a direct call from the module to the Wasm to JS stub.
 824         Instead, we do an indirect call to the stub by loading the stub's executable
 825         address off of the CodeBlock. This is to make the code we emit for comply with
 826         requirements needed for PIC.
 827
 828         Adding this indirection is not ideal. Although this patch is neutral on
 829         WasmBench, we really want to get back to a world where we have an IC
 830         call infrastructure. This patch is obviously a regression on some
 831         types of programs. I've filed this bug to make sure we implement a
 832         PIC compliant Wasm to JS call IC:
 833         https://bugs.webkit.org/show_bug.cgi?id=170375
 834
 835         * wasm/WasmB3IRGenerator.cpp:
 836         * wasm/WasmFormat.h:
 837         * wasm/WasmPlan.cpp:
 838         (JSC::Wasm::Plan::complete):
 839         * wasm/js/JSWebAssemblyCodeBlock.cpp:
 840         (JSC::JSWebAssemblyCodeBlock::initialize):
 841         * wasm/js/JSWebAssemblyCodeBlock.h:
 842         (JSC::JSWebAssemblyCodeBlock::create):
 843         (JSC::JSWebAssemblyCodeBlock::offsetOfImportWasmToJSStub):
 844         (JSC::JSWebAssemblyCodeBlock::offsetOfCallees):
 845         (JSC::JSWebAssemblyCodeBlock::allocationSize):
 846         (JSC::JSWebAssemblyCodeBlock::importWasmToJSStub):
 847         * wasm/js/JSWebAssemblyInstance.cpp:
 848         (JSC::JSWebAssemblyInstance::addUnitializedCodeBlock):
 849         * wasm/js/JSWebAssemblyInstance.h:
 850         (JSC::JSWebAssemblyInstance::offsetOfCodeBlock):
 851
 852 2017-03-31  Keith Miller  <keith_miller@apple.com>
 853
 854         WebAssembly: webAssemblyB3OptimizationLevel should use defaultB3OptLevel by default
 855         https://bugs.webkit.org/show_bug.cgi?id=170378
 856
 857         Reviewed by Saam Barati.
 858
 859         * runtime/Options.h:
 860         * wasm/WasmB3IRGenerator.h:
 861
 862 2017-03-31  Keith Miller  <keith_miller@apple.com>
 863
 864         WebAssembly: Add compilation level option
 865         https://bugs.webkit.org/show_bug.cgi?id=170374
 866
 867         Reviewed by Mark Lam.
 868
 869         This patch adds an option, webAssemblyB3OptimizationLevel, which
 870         changes the optimization mode wasm passes to B3.
 871
 872         * runtime/Options.h:
 873         * wasm/WasmPlan.cpp:
 874         (JSC::Wasm::Plan::compileFunctions):
 875
 876 2017-03-31  Saam Barati  <sbarati@apple.com>
 877
 878         WebAssembly: Strip WasmParser and WasmFunctionParser from knowing about VM
 879         https://bugs.webkit.org/show_bug.cgi?id=170312
 880
 881         Reviewed by Mark Lam.
 882
 883         This is another step towards PIC-ifying Wasm. This patch removes
 884         the VM field that is no longer used.
 885
 886         * wasm/WasmB3IRGenerator.cpp:
 887         (JSC::Wasm::parseAndCompile):
 888         * wasm/WasmB3IRGenerator.h:
 889         * wasm/WasmFunctionParser.h:
 890         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
 891         * wasm/WasmModuleParser.h:
 892         (JSC::Wasm::ModuleParser::ModuleParser):
 893         * wasm/WasmParser.h:
 894         (JSC::Wasm::Parser<SuccessType>::Parser):
 895         * wasm/WasmPlan.cpp:
 896         (JSC::Wasm::Plan::parseAndValidateModule):
 897         (JSC::Wasm::Plan::compileFunctions):
 898         * wasm/WasmValidate.cpp:
 899         (JSC::Wasm::validateFunction):
 900         * wasm/WasmValidate.h:
 901
 902 2017-03-31  Saam Barati  <sbarati@apple.com>
 903
 904         WebAssembly: Ref count Signature and SignatureInformation should not care about VM
 905         https://bugs.webkit.org/show_bug.cgi?id=170316
 906
 907         Reviewed by Keith Miller.
 908
 909         This is yet again another step towards PIC-ifying Wasm.
 910         Signature should be ref counted so we can tell when
 911         no code is holding onto a Signature. This makes it easy
 912         to free unused Signatures. Also, this patch rids SignatureInfo
 913         of any VM knowledge. Now, there is just a single SignatureInfo that
 914         lives in a process.
 915
 916         * runtime/VM.h:
 917         * wasm/WasmB3IRGenerator.cpp:
 918         (JSC::Wasm::createJSToWasmWrapper):
 919         (JSC::Wasm::parseAndCompile):
 920         * wasm/WasmB3IRGenerator.h:
 921         * wasm/WasmBinding.cpp:
 922         (JSC::Wasm::wasmToJs):
 923         * wasm/WasmCallingConvention.h:
 924         (JSC::Wasm::CallingConvention::loadArguments):
 925         * wasm/WasmFormat.h:
 926         * wasm/WasmFunctionParser.h:
 927         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
 928         * wasm/WasmModuleParser.cpp:
 929         * wasm/WasmPlan.cpp:
 930         (JSC::Wasm::Plan::parseAndValidateModule):
 931         (JSC::Wasm::Plan::compileFunctions):
 932         (JSC::Wasm::Plan::complete):
 933         * wasm/WasmSignature.cpp:
 934         (JSC::Wasm::Signature::hash):
 935         (JSC::Wasm::Signature::tryCreate):
 936         (JSC::Wasm::SignatureInformation::SignatureInformation):
 937         (JSC::Wasm::SignatureInformation::singleton):
 938         (JSC::Wasm::SignatureInformation::adopt):
 939         (JSC::Wasm::SignatureInformation::get):
 940         (JSC::Wasm::SignatureInformation::tryCleanup):
 941         (JSC::Wasm::Signature::create): Deleted.
 942         (JSC::Wasm::Signature::createInvalid): Deleted.
 943         (JSC::Wasm::Signature::destroy): Deleted.
 944         (JSC::Wasm::SignatureInformation::~SignatureInformation): Deleted.
 945         * wasm/WasmSignature.h:
 946         (JSC::Wasm::Signature::allocatedSize):
 947         (JSC::Wasm::Signature::operator==):
 948         * wasm/WasmValidate.cpp:
 949         (JSC::Wasm::validateFunction):
 950         * wasm/WasmValidate.h:
 951         * wasm/js/JSWebAssemblyModule.cpp:
 952         (JSC::JSWebAssemblyModule::destroy):
 953         * wasm/js/WebAssemblyFunction.cpp:
 954         (JSC::callWebAssemblyFunction):
 955         * wasm/js/WebAssemblyFunction.h:
 956         * wasm/js/WebAssemblyModuleRecord.cpp:
 957         (JSC::WebAssemblyModuleRecord::link):
 958         (JSC::WebAssemblyModuleRecord::evaluate):
 959         * wasm/js/WebAssemblyWrapperFunction.cpp:
 960         (JSC::WebAssemblyWrapperFunction::create):
 961         * wasm/js/WebAssemblyWrapperFunction.h:
 962
 963 2017-03-31  Mark Lam  <mark.lam@apple.com>
 964
 965         Array.prototype.splice() should not be using JSArray::tryCreateForInitializationPrivate().
 966         https://bugs.webkit.org/show_bug.cgi?id=170303
 967         <rdar://problem/31358281>
 968
 969         Reviewed by Filip Pizlo.
 970
 971         This is because it needs to call getProperty() later to get the values for
 972         initializing the array.  getProperty() can execute arbitrary code and potentially
 973         trigger the GC.  This is not allowed for clients of JSArray::tryCreateForInitializationPrivate().
 974
 975         * runtime/ArrayPrototype.cpp:
 976         (JSC::arrayProtoFuncSplice):
 977         (JSC::copySplicedArrayElements): Deleted.
 978
 979 2017-03-31  Oleksandr Skachkov  <gskachkov@gmail.com>
 980
 981         String.prototype.replace incorrectly applies "special replacement parameters" when passed a function
 982         https://bugs.webkit.org/show_bug.cgi?id=170151
 983
 984         Reviewed by Saam Barati.
 985
 986         This patch fixes issue for String.prototype.replace when passed a function
 987         with special symbols "$$". It happeneds because substituteBackreferences applies
 988         unconditionally, but according to the spec it should be applied only for text
 989         21.1.3.16.8 https://tc39.github.io/ecma262/#sec-string.prototype.replace
 990
 991         * runtime/StringPrototype.cpp:
 992         (JSC::replaceUsingStringSearch):
 993
 994 2017-03-30  Saam Barati  <sbarati@apple.com>
 995
 996         WebAssembly: When Wasm calls to C, it should use Wasm::Context* instead of ExecState* to get VM
 997         https://bugs.webkit.org/show_bug.cgi?id=170185
 998
 999         Reviewed by Michael Saboff.
1000
1001         This is one more step in the direction of PIC-ified Wasm.
1002         When we lift WasmCallee above VM, we will no longer be
1003         able to get VM from ExecState*. This patch ensures that
1004         we don't do that from within the Wasm runtime. Instead,
1005         we use the Wasm::Context* to get the VM.
1006
1007         This patch also adds a new class, Wasm::Thunks. There
1008         is a single Wasm::Thunks that lives in the process. It
1009         is responsible for generating a thunk that Wasm relies on.
1010         The only such thunk right now is the exception throwing
1011         thunk.
1012
1013         This patch also rids WasmFaultSignalHandler from any knowledge
1014         of VM. Previously, it relied on VM to get the exception handling
1015         thunk.
1016
1017         The only part of the Wasm runtime that will be allowed
1018         to get VM& from ExecState will be WasmBinding. In the
1019         future, we plan to keep the calls out to JS to keep
1020         a JSCell as the callee.
1021
1022         * JavaScriptCore.xcodeproj/project.pbxproj:
1023         * dfg/DFGOSREntry.cpp:
1024         (JSC::DFG::prepareOSREntry):
1025         * ftl/FTLOSRExitCompiler.cpp:
1026         (JSC::FTL::compileStub):
1027         * interpreter/Interpreter.cpp:
1028         (JSC::UnwindFunctor::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
1029         * jit/AssemblyHelpers.cpp:
1030         (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
1031         (JSC::AssemblyHelpers::copyCalleeSavesToVMEntryFrameCalleeSavesBufferImpl):
1032         * jit/AssemblyHelpers.h:
1033         (JSC::AssemblyHelpers::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
1034         * jit/ThunkGenerators.cpp:
1035         (JSC::throwExceptionFromWasmThunkGenerator): Deleted.
1036         * jit/ThunkGenerators.h:
1037         * runtime/InitializeThreading.cpp:
1038         (JSC::initializeThreading):
1039         * runtime/VM.cpp:
1040         (JSC::VM::VM):
1041         (JSC::VM::getAllCalleeSaveRegisterOffsets):
1042         * runtime/VM.h:
1043         (JSC::VM::topVMEntryFrameOffset):
1044         (JSC::VM::getAllCalleeSaveRegisterOffsets): Deleted.
1045         * wasm/WasmB3IRGenerator.cpp:
1046         (JSC::Wasm::B3IRGenerator::emitExceptionCheck):
1047         * wasm/WasmFaultSignalHandler.cpp:
1048         (JSC::Wasm::trapHandler):
1049         * wasm/WasmMemory.cpp:
1050         (JSC::Wasm::tryGetFastMemory):
1051         * wasm/WasmThunks.cpp: Added.
1052         (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
1053         (JSC::Wasm::Thunks::initialize):
1054         (JSC::Wasm::Thunks::singleton):
1055         (JSC::Wasm::Thunks::stub):
1056         (JSC::Wasm::Thunks::existingStub):
1057         * wasm/WasmThunks.h: Added.
1058         * wasm/js/JSWebAssemblyInstance.cpp:
1059         (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
1060         * wasm/js/JSWebAssemblyInstance.h:
1061         (JSC::JSWebAssemblyInstance::offsetOfVM):
1062         * wasm/js/JSWebAssemblyMemory.cpp:
1063         (JSC::JSWebAssemblyMemory::grow):
1064         * wasm/js/JSWebAssemblyMemory.h:
1065         * wasm/js/WebAssemblyMemoryPrototype.cpp:
1066         (JSC::webAssemblyMemoryProtoFuncGrow):
1067
1068 2017-03-30  Mark Lam  <mark.lam@apple.com>
1069
1070         IntlObject should not be using JSArray::initializeIndex().
1071         https://bugs.webkit.org/show_bug.cgi?id=170302
1072         <rdar://problem/31356918>
1073
1074         Reviewed by Saam Barati.
1075
1076         JSArray::initializeIndex() is only meant to be used with arrays created using
1077         JSArray::tryCreateForInitializationPrivate() under very constrained conditions.
1078
1079         * runtime/IntlObject.cpp:
1080         (JSC::canonicalizeLocaleList):
1081         (JSC::intlObjectFuncGetCanonicalLocales):
1082
1083 2017-03-30  Filip Pizlo  <fpizlo@apple.com>
1084
1085         Air should support linear scan for optLevel<2
1086         https://bugs.webkit.org/show_bug.cgi?id=170161
1087
1088         Reviewed by Saam Barati.
1089
1090         This changes the default opt level of B3 to 2. It makes the other opt levels useful by adding a
1091         new register allocator. This new linear scan allocator will produce significantly worse code.
1092         But it will produce that code a lot faster than IRC or Briggs.
1093
1094         The opt levels are:
1095             0: no optimizations, linear scan
1096             1: some optimizations, linear scan
1097             2: full optimizations, graph coloring (IRC or Briggs based on CPU)
1098
1099         What we used to call optLevel=1 is not called optLevel=2, or better yet,
1100         optLevel=B3::defaultOptLevel(). We no longer have anything like the old optLevel=0 (which did no
1101         optimizations but ran graph coloring).
1102
1103         allocateRegistersByLinearScan() faithfully implements Massimiliano Poletto and Vivek Sarkar's
1104         famous algorithm. It uses the variant that handles clobbered registers by avoiding assigning
1105         ranges to those registers if the range overlaps a clobber. It's engineered to allocate registers
1106         very quickly and generate inefficient code without falling off a cliff.
1107
1108         The new optLevel=1 speeds up B3 by a factor of 2, and results in a 80% throughput regression.
1109         Linear scan runs 4.7x faster than graph coloring on average.
1110
1111         * CMakeLists.txt:
1112         * JavaScriptCore.xcodeproj/project.pbxproj:
1113         * b3/B3BasicBlockUtils.h:
1114         (JSC::B3::blocksInPreOrder):
1115         (JSC::B3::blocksInPostOrder):
1116         * b3/B3BlockWorklist.h:
1117         * b3/B3CFG.h:
1118         (JSC::B3::CFG::newMap):
1119         * b3/B3Common.h:
1120         (JSC::B3::defaultOptLevel):
1121         * b3/B3Compile.h:
1122         * b3/B3DuplicateTails.cpp:
1123         * b3/B3EliminateCommonSubexpressions.cpp:
1124         * b3/B3FixSSA.cpp:
1125         (JSC::B3::demoteValues):
1126         (JSC::B3::fixSSA):
1127         * b3/B3FixSSA.h:
1128         * b3/B3Generate.cpp:
1129         (JSC::B3::prepareForGeneration):
1130         (JSC::B3::generateToAir):
1131         * b3/B3Generate.h:
1132         * b3/B3HeapRange.cpp: Removed.
1133         * b3/B3HeapRange.h:
1134         (JSC::B3::HeapRange::HeapRange): Deleted.
1135         (JSC::B3::HeapRange::top): Deleted.
1136         (JSC::B3::HeapRange::operator==): Deleted.
1137         (JSC::B3::HeapRange::operator!=): Deleted.
1138         (JSC::B3::HeapRange::operator|): Deleted.
1139         (JSC::B3::HeapRange::operator bool): Deleted.
1140         (JSC::B3::HeapRange::begin): Deleted.
1141         (JSC::B3::HeapRange::end): Deleted.
1142         (JSC::B3::HeapRange::overlaps): Deleted.
1143         * b3/B3LowerToAir.cpp:
1144         * b3/B3MoveConstants.cpp:
1145         * b3/B3PhiChildren.h:
1146         * b3/B3Procedure.cpp:
1147         (JSC::B3::Procedure::dump):
1148         (JSC::B3::Procedure::deleteOrphans):
1149         (JSC::B3::Procedure::setBlockOrderImpl):
1150         * b3/B3ReduceDoubleToFloat.cpp:
1151         * b3/B3ReduceStrength.cpp:
1152         * b3/B3SSACalculator.h:
1153         * b3/B3UseCounts.h:
1154         * b3/air/AirAllocateRegistersByGraphColoring.cpp:
1155         * b3/air/AirAllocateRegistersByLinearScan.cpp: Added.
1156         (JSC::B3::Air::allocateRegistersByLinearScan):
1157         * b3/air/AirAllocateRegistersByLinearScan.h: Added.
1158         * b3/air/AirAllocateStack.cpp:
1159         (JSC::B3::Air::allocateStack):
1160         * b3/air/AirArg.cpp:
1161         (WTF::printInternal):
1162         * b3/air/AirArg.h:
1163         (JSC::B3::Air::Arg::activeAt):
1164         (JSC::B3::Air::Arg::timing):
1165         (JSC::B3::Air::Arg::forEachPhase):
1166         * b3/air/AirBasicBlock.h:
1167         * b3/air/AirBlockWorklist.h:
1168         * b3/air/AirCFG.h:
1169         (JSC::B3::Air::CFG::newMap):
1170         * b3/air/AirEliminateDeadCode.cpp:
1171         (JSC::B3::Air::eliminateDeadCode):
1172         * b3/air/AirFixObviousSpills.cpp:
1173         * b3/air/AirFixPartialRegisterStalls.cpp:
1174         (JSC::B3::Air::fixPartialRegisterStalls):
1175         * b3/air/AirFixSpillsAfterTerminals.cpp: Added.
1176         (JSC::B3::Air::fixSpillsAfterTerminals):
1177         * b3/air/AirFixSpillsAfterTerminals.h: Added.
1178         * b3/air/AirGenerate.cpp:
1179         (JSC::B3::Air::prepareForGeneration):
1180         (JSC::B3::Air::generate):
1181         * b3/air/AirGenerate.h:
1182         * b3/air/AirGenerationContext.h:
1183         * b3/air/AirInsertionSet.h:
1184         * b3/air/AirInst.cpp:
1185         (JSC::B3::Air::Inst::needsPadding):
1186         * b3/air/AirLowerAfterRegAlloc.cpp:
1187         (JSC::B3::Air::lowerAfterRegAlloc):
1188         * b3/air/AirLowerEntrySwitch.cpp:
1189         (JSC::B3::Air::lowerEntrySwitch):
1190         * b3/air/AirOpcode.opcodes:
1191         * b3/air/AirPhaseInsertionSet.cpp: Added.
1192         (JSC::B3::Air::PhaseInsertionSet::execute):
1193         * b3/air/AirPhaseInsertionSet.h: Added.
1194         (JSC::B3::Air::PhaseInsertion::PhaseInsertion):
1195         (JSC::B3::Air::PhaseInsertion::phase):
1196         (JSC::B3::Air::PhaseInsertion::operator<):
1197         (JSC::B3::Air::PhaseInsertionSet::PhaseInsertionSet):
1198         (JSC::B3::Air::PhaseInsertionSet::appendInsertion):
1199         (JSC::B3::Air::PhaseInsertionSet::insertInst):
1200         (JSC::B3::Air::PhaseInsertionSet::insert):
1201         * b3/air/AirRegLiveness.h:
1202         (JSC::B3::Air::RegLiveness::LocalCalc::LocalCalc):
1203         * b3/air/AirSpillEverything.cpp:
1204         (JSC::B3::Air::spillEverything):
1205         * b3/air/AirTmp.cpp:
1206         * b3/air/AirTmp.h:
1207         (JSC::B3::Air::Tmp::tmpForIndex):
1208         * b3/air/AirTmpInlines.h:
1209         (JSC::B3::Air::Tmp::Indexed::Indexed):
1210         (JSC::B3::Air::Tmp::Indexed::index):
1211         (JSC::B3::Air::Tmp::AbsolutelyIndexed::AbsolutelyIndexed):
1212         (JSC::B3::Air::Tmp::AbsolutelyIndexed::index):
1213         (JSC::B3::Air::Tmp::indexed):
1214         (JSC::B3::Air::Tmp::absolutelyIndexed):
1215         (JSC::B3::Air::Tmp::tmpForAbsoluteIndex):
1216         * b3/testb3.cpp:
1217         (JSC::B3::compile):
1218         (JSC::B3::testMulLoadTwice):
1219         * jit/RegisterSet.h:
1220         (JSC::RegisterSet::add):
1221         (JSC::RegisterSet::remove):
1222         * runtime/Options.h:
1223         * wasm/WasmB3IRGenerator.h:
1224
1225 2017-03-30  Youenn Fablet  <youenn@apple.com>
1226
1227         Clean up RTCDataChannel
1228         https://bugs.webkit.org/show_bug.cgi?id=169732
1229
1230         Reviewed by Chris Dumez.
1231
1232         * runtime/CommonIdentifiers.h: Adding RTCDataChannelEvent.
1233
1234 2017-03-30  Saam Barati  <sbarati@apple.com>
1235
1236         WebAssembly: pass Wasm::Context* to vmEntryToWasm when not using fast TLS
1237         https://bugs.webkit.org/show_bug.cgi?id=170182
1238
1239         Reviewed by Mark Lam.
1240
1241         This is one more step in the direction of PIC-ified Wasm.
1242         I'm removing assumptions that a wasm callee is a cell. We used to use
1243         the callee to get the WasmContext off the callee's VM. Instead,
1244         this patch makes it so that we pass in the context as a parameter
1245         to the JS entrypoint.
1246
1247         * heap/MarkedBlock.h:
1248         (JSC::MarkedBlock::offsetOfVM): Deleted.
1249         * jit/AssemblyHelpers.cpp:
1250         (JSC::AssemblyHelpers::loadWasmContext):
1251         (JSC::AssemblyHelpers::storeWasmContext):
1252         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister):
1253         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister):
1254         * jsc.cpp:
1255         (functionTestWasmModuleFunctions):
1256         * runtime/VM.h:
1257         (JSC::VM::wasmContextOffset): Deleted.
1258         * wasm/WasmB3IRGenerator.cpp:
1259         (JSC::Wasm::B3IRGenerator::materializeWasmContext):
1260         (JSC::Wasm::B3IRGenerator::restoreWasmContext):
1261         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1262         (JSC::Wasm::createJSToWasmWrapper):
1263         * wasm/WasmContext.cpp:
1264         (JSC::Wasm::loadContext):
1265         (JSC::Wasm::storeContext):
1266         (JSC::loadWasmContext): Deleted.
1267         (JSC::storeWasmContext): Deleted.
1268         * wasm/WasmContext.h:
1269         (JSC::Wasm::useFastTLS):
1270         (JSC::Wasm::useFastTLSForContext):
1271         * wasm/WasmMemoryInformation.cpp:
1272         (JSC::Wasm::PinnedRegisterInfo::get):
1273         * wasm/WasmMemoryInformation.h:
1274         (JSC::Wasm::useFastTLS): Deleted.
1275         (JSC::Wasm::useFastTLSForWasmContext): Deleted.
1276         * wasm/js/WebAssemblyFunction.cpp:
1277         (JSC::callWebAssemblyFunction):
1278
1279 2017-03-30  JF Bastien  <jfbastien@apple.com>
1280
1281         WebAssembly: fix misc JS API implementation inconsistencies
1282         https://bugs.webkit.org/show_bug.cgi?id=170187
1283
1284         Reviewed by Keith Miller.
1285
1286         Auto-generate lookup tables.
1287         Methods should be on prototype.
1288         Exception returns should be idiomatic.
1289
1290         * wasm/JSWebAssembly.cpp: validate / compile / instantiate should
1291         be on the prototype
1292         (JSC::JSWebAssembly::create):
1293         (JSC::JSWebAssembly::finishCreation):
1294         (JSC::reject): Deleted.
1295         (JSC::webAssemblyCompileFunc): Deleted.
1296         (JSC::resolve): Deleted.
1297         (JSC::instantiate): Deleted.
1298         (JSC::compileAndInstantiate): Deleted.
1299         (JSC::webAssemblyInstantiateFunc): Deleted.
1300         (JSC::webAssemblyValidateFunc): Deleted.
1301         * wasm/JSWebAssembly.h:
1302         * wasm/js/WebAssemblyMemoryPrototype.cpp: move from JSWebAssembly.cpp
1303         (JSC::webAssemblyMemoryProtoFuncBuffer):
1304         (JSC::WebAssemblyMemoryPrototype::create):
1305         (JSC::WebAssemblyMemoryPrototype::finishCreation):
1306         * wasm/js/WebAssemblyMemoryPrototype.h:
1307         * wasm/js/WebAssemblyPrototype.cpp:
1308         (JSC::reject):
1309         (JSC::webAssemblyCompileFunc):
1310         (JSC::resolve):
1311         (JSC::instantiate):
1312         (JSC::compileAndInstantiate):
1313         (JSC::webAssemblyInstantiateFunc):
1314         (JSC::webAssemblyValidateFunc):
1315         (JSC::webAssemblyFunctionValidate): Deleted.
1316         (JSC::webAssemblyFunctionCompile): Deleted.
1317         * wasm/js/WebAssemblyTablePrototype.cpp:
1318         (JSC::webAssemblyTableProtoFuncGrow):
1319         (JSC::webAssemblyTableProtoFuncGet):
1320         (JSC::webAssemblyTableProtoFuncSet):
1321         (JSC::WebAssemblyTablePrototype::create):
1322         (JSC::WebAssemblyTablePrototype::finishCreation):
1323         * wasm/js/WebAssemblyTablePrototype.h:
1324
1325 2017-03-29  Keith Miller  <keith_miller@apple.com>
1326
1327         Unreviewed, fix the build, again. Hopefully for the last time, again!
1328
1329         * runtime/Options.cpp:
1330
1331 2017-03-29  Keith Miller  <keith_miller@apple.com>
1332
1333         Unreviewed, fix the build, again. Hopefully for the last time!
1334
1335         * runtime/Options.cpp:
1336         (JSC::parse):
1337
1338 2017-03-29  Keith Miller  <keith_miller@apple.com>
1339
1340         Unreviewed, windows build fix.
1341
1342         * runtime/Options.cpp:
1343         (JSC::parse):
1344
1345 2017-03-29  Keith Miller  <keith_miller@apple.com>
1346
1347         WebAssembly: B3IRGenerator should pool constants
1348         https://bugs.webkit.org/show_bug.cgi?id=170266
1349
1350         Reviewed by Filip Pizlo.
1351
1352         This patch adds a HashMap to B3IRGenerator that contains all the constants used in a function.
1353         B3IRGenerator then uses an InsertionSet to add all those constants to the root BB. This doesn't
1354         appear to be a compile time improvement but it could be valuable in the future.
1355
1356         * b3/B3Opcode.h:
1357         (JSC::B3::opcodeForConstant):
1358         * b3/B3Procedure.cpp:
1359         (JSC::B3::Procedure::addConstant):
1360         * b3/B3Procedure.h:
1361         * wasm/WasmB3IRGenerator.cpp:
1362         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1363         (JSC::Wasm::B3IRGenerator::constant):
1364         (JSC::Wasm::B3IRGenerator::insertConstants):
1365         (JSC::Wasm::B3IRGenerator::addConstant):
1366         (JSC::Wasm::B3IRGenerator::dump):
1367         (JSC::Wasm::parseAndCompile):
1368         (JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv):
1369         (JSC::Wasm::B3IRGenerator::zeroForType): Deleted.
1370         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
1371         (generateConstCode):
1372
1373 2017-03-29  Saam Barati  <sbarati@apple.com>
1374
1375         LinkBuffer and ExecutableAllocator shouldn't have anything to do with VM
1376         https://bugs.webkit.org/show_bug.cgi?id=170210
1377
1378         Reviewed by Mark Lam.
1379
1380         This is one more step in the direction of PIC-ified Wasm.
1381         LinkBuffer and ExecutableAllocator have no business knowing about VM.
1382
1383         * assembler/LinkBuffer.cpp:
1384         (JSC::LinkBuffer::allocate):
1385         * assembler/LinkBuffer.h:
1386         (JSC::LinkBuffer::LinkBuffer):
1387         (JSC::LinkBuffer::vm): Deleted.
1388         * b3/B3Compile.cpp:
1389         (JSC::B3::compile):
1390         * b3/B3Compile.h:
1391         * b3/air/testair.cpp:
1392         * b3/testb3.cpp:
1393         (JSC::B3::compileProc):
1394         (JSC::B3::compileAndRun):
1395         (JSC::B3::testLoadAcq42):
1396         (JSC::B3::testAddArgZeroImmZDef):
1397         (JSC::B3::testAddLoadTwice):
1398         (JSC::B3::testMulLoadTwice):
1399         (JSC::B3::testMulAddArgsLeft):
1400         (JSC::B3::testMulAddArgsRight):
1401         (JSC::B3::testMulAddArgsLeft32):
1402         (JSC::B3::testMulAddArgsRight32):
1403         (JSC::B3::testMulSubArgsLeft):
1404         (JSC::B3::testMulSubArgsRight):
1405         (JSC::B3::testMulSubArgsLeft32):
1406         (JSC::B3::testMulSubArgsRight32):
1407         (JSC::B3::testMulNegArgs):
1408         (JSC::B3::testMulNegArgs32):
1409         (JSC::B3::testCompareFloatToDoubleThroughPhi):
1410         (JSC::B3::testDoubleToFloatThroughPhi):
1411         (JSC::B3::testReduceFloatToDoubleValidates):
1412         (JSC::B3::testDoubleProducerPhiToFloatConversion):
1413         (JSC::B3::testDoubleProducerPhiToFloatConversionWithDoubleConsumer):
1414         (JSC::B3::testDoubleProducerPhiWithNonFloatConst):
1415         (JSC::B3::testIToD64Arg):
1416         (JSC::B3::testIToF64Arg):
1417         (JSC::B3::testIToD32Arg):
1418         (JSC::B3::testIToF32Arg):
1419         (JSC::B3::testIToD64Mem):
1420         (JSC::B3::testIToF64Mem):
1421         (JSC::B3::testIToD32Mem):
1422         (JSC::B3::testIToF32Mem):
1423         (JSC::B3::testIToDReducedToIToF64Arg):
1424         (JSC::B3::testIToDReducedToIToF32Arg):
1425         (JSC::B3::testStoreRelAddLoadAcq32):
1426         (JSC::B3::testStoreRelAddLoadAcq8):
1427         (JSC::B3::testStoreRelAddFenceLoadAcq8):
1428         (JSC::B3::testStoreRelAddLoadAcq16):
1429         (JSC::B3::testStoreRelAddLoadAcq64):
1430         (JSC::B3::testBranch):
1431         (JSC::B3::testBranchPtr):
1432         (JSC::B3::testDiamond):
1433         (JSC::B3::testBranchNotEqual):
1434         (JSC::B3::testBranchNotEqualCommute):
1435         (JSC::B3::testBranchNotEqualNotEqual):
1436         (JSC::B3::testBranchEqual):
1437         (JSC::B3::testBranchEqualEqual):
1438         (JSC::B3::testBranchEqualCommute):
1439         (JSC::B3::testBranchEqualEqual1):
1440         (JSC::B3::testBranchLoadPtr):
1441         (JSC::B3::testBranchLoad32):
1442         (JSC::B3::testBranchLoad8S):
1443         (JSC::B3::testBranchLoad8Z):
1444         (JSC::B3::testBranchLoad16S):
1445         (JSC::B3::testBranchLoad16Z):
1446         (JSC::B3::testBranch8WithLoad8ZIndex):
1447         (JSC::B3::testComplex):
1448         (JSC::B3::testSimpleCheck):
1449         (JSC::B3::testCheckFalse):
1450         (JSC::B3::testCheckTrue):
1451         (JSC::B3::testCheckLessThan):
1452         (JSC::B3::testCheckMegaCombo):
1453         (JSC::B3::testCheckTrickyMegaCombo):
1454         (JSC::B3::testCheckTwoMegaCombos):
1455         (JSC::B3::testCheckTwoNonRedundantMegaCombos):
1456         (JSC::B3::testCheckAddImm):
1457         (JSC::B3::testCheckAddImmCommute):
1458         (JSC::B3::testCheckAddImmSomeRegister):
1459         (JSC::B3::testCheckAdd):
1460         (JSC::B3::testCheckAdd64):
1461         (JSC::B3::testCheckAddFold):
1462         (JSC::B3::testCheckAddFoldFail):
1463         (JSC::B3::testCheckAddSelfOverflow64):
1464         (JSC::B3::testCheckAddSelfOverflow32):
1465         (JSC::B3::testCheckSubImm):
1466         (JSC::B3::testCheckSubBadImm):
1467         (JSC::B3::testCheckSub):
1468         (JSC::B3::testCheckSub64):
1469         (JSC::B3::testCheckSubFold):
1470         (JSC::B3::testCheckSubFoldFail):
1471         (JSC::B3::testCheckNeg):
1472         (JSC::B3::testCheckNeg64):
1473         (JSC::B3::testCheckMul):
1474         (JSC::B3::testCheckMulMemory):
1475         (JSC::B3::testCheckMul2):
1476         (JSC::B3::testCheckMul64):
1477         (JSC::B3::testCheckMulFold):
1478         (JSC::B3::testCheckMulFoldFail):
1479         (JSC::B3::testCheckMul64SShr):
1480         (JSC::B3::testSwitch):
1481         (JSC::B3::testSwitchChillDiv):
1482         (JSC::B3::testSwitchTargettingSameBlock):
1483         (JSC::B3::testSwitchTargettingSameBlockFoldPathConstant):
1484         (JSC::B3::testBasicSelect):
1485         (JSC::B3::testSelectTest):
1486         (JSC::B3::testSelectCompareDouble):
1487         (JSC::B3::testSelectDouble):
1488         (JSC::B3::testSelectDoubleTest):
1489         (JSC::B3::testSelectDoubleCompareDouble):
1490         (JSC::B3::testSelectFloatCompareFloat):
1491         (JSC::B3::testSelectFold):
1492         (JSC::B3::testSelectInvert):
1493         (JSC::B3::testCheckSelect):
1494         (JSC::B3::testCheckSelectCheckSelect):
1495         (JSC::B3::testCheckSelectAndCSE):
1496         (JSC::B3::testTrivialInfiniteLoop):
1497         (JSC::B3::testFoldPathEqual):
1498         (JSC::B3::testLShiftSelf32):
1499         (JSC::B3::testRShiftSelf32):
1500         (JSC::B3::testURShiftSelf32):
1501         (JSC::B3::testLShiftSelf64):
1502         (JSC::B3::testRShiftSelf64):
1503         (JSC::B3::testURShiftSelf64):
1504         (JSC::B3::testPatchpointDoubleRegs):
1505         (JSC::B3::testSpillDefSmallerThanUse):
1506         (JSC::B3::testSpillUseLargerThanDef):
1507         (JSC::B3::testLateRegister):
1508         (JSC::B3::testInterpreter):
1509         (JSC::B3::testEntrySwitchSimple):
1510         (JSC::B3::testEntrySwitchNoEntrySwitch):
1511         (JSC::B3::testEntrySwitchWithCommonPaths):
1512         (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
1513         (JSC::B3::testEntrySwitchLoop):
1514         (JSC::B3::testSomeEarlyRegister):
1515         (JSC::B3::testTerminalPatchpointThatNeedsToBeSpilled):
1516         (JSC::B3::testTerminalPatchpointThatNeedsToBeSpilled2):
1517         (JSC::B3::testPatchpointTerminalReturnValue):
1518         (JSC::B3::testMemoryFence):
1519         (JSC::B3::testStoreFence):
1520         (JSC::B3::testLoadFence):
1521         (JSC::B3::testPCOriginMapDoesntInsertNops):
1522         (JSC::B3::testPinRegisters):
1523         (JSC::B3::testX86LeaAddAddShlLeft):
1524         (JSC::B3::testX86LeaAddAddShlRight):
1525         (JSC::B3::testX86LeaAddAdd):
1526         (JSC::B3::testX86LeaAddShlRight):
1527         (JSC::B3::testX86LeaAddShlLeftScale1):
1528         (JSC::B3::testX86LeaAddShlLeftScale2):
1529         (JSC::B3::testX86LeaAddShlLeftScale4):
1530         (JSC::B3::testX86LeaAddShlLeftScale8):
1531         (JSC::B3::testAddShl32):
1532         (JSC::B3::testAddShl64):
1533         (JSC::B3::testAddShl65):
1534         (JSC::B3::testLoadBaseIndexShift2):
1535         (JSC::B3::testLoadBaseIndexShift32):
1536         (JSC::B3::testOptimizeMaterialization):
1537         (JSC::B3::testAtomicWeakCAS):
1538         (JSC::B3::testAtomicStrongCAS):
1539         (JSC::B3::testAtomicXchg):
1540         (JSC::B3::testDepend32):
1541         (JSC::B3::testDepend64):
1542         (JSC::B3::testWasmBoundsCheck):
1543         (JSC::B3::testWasmAddress):
1544         (JSC::B3::run):
1545         (JSC::B3::compile): Deleted.
1546         * bytecode/PolymorphicAccess.cpp:
1547         (JSC::PolymorphicAccess::regenerate):
1548         * dfg/DFGJITCompiler.cpp:
1549         (JSC::DFG::JITCompiler::compile):
1550         (JSC::DFG::JITCompiler::compileFunction):
1551         * dfg/DFGLazyJSValue.cpp:
1552         (JSC::DFG::LazyJSValue::emit):
1553         * dfg/DFGOSRExitCompiler.cpp:
1554         * dfg/DFGSpeculativeJIT32_64.cpp:
1555         (JSC::DFG::SpeculativeJIT::emitCall):
1556         * dfg/DFGSpeculativeJIT64.cpp:
1557         (JSC::DFG::SpeculativeJIT::emitCall):
1558         * dfg/DFGThunks.cpp:
1559         (JSC::DFG::osrExitGenerationThunkGenerator):
1560         (JSC::DFG::osrEntryThunkGenerator):
1561         * ftl/FTLCompile.cpp:
1562         (JSC::FTL::compile):
1563         * ftl/FTLLazySlowPath.cpp:
1564         (JSC::FTL::LazySlowPath::generate):
1565         * ftl/FTLLink.cpp:
1566         (JSC::FTL::link):
1567         * ftl/FTLLowerDFGToB3.cpp:
1568         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
1569         (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
1570         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
1571         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
1572         (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
1573         * ftl/FTLOSRExitCompiler.cpp:
1574         (JSC::FTL::compileStub):
1575         * ftl/FTLOSRExitHandle.cpp:
1576         (JSC::FTL::OSRExitHandle::emitExitThunk):
1577         * ftl/FTLSlowPathCall.cpp:
1578         (JSC::FTL::SlowPathCallContext::makeCall):
1579         * ftl/FTLSlowPathCall.h:
1580         (JSC::FTL::callOperation):
1581         * ftl/FTLState.h:
1582         * ftl/FTLThunks.cpp:
1583         (JSC::FTL::genericGenerationThunkGenerator):
1584         (JSC::FTL::slowPathCallThunkGenerator):
1585         * ftl/FTLThunks.h:
1586         (JSC::FTL::generateIfNecessary):
1587         (JSC::FTL::Thunks::getSlowPathCallThunk):
1588         * jit/AssemblyHelpers.cpp:
1589         (JSC::AssemblyHelpers::emitDumbVirtualCall):
1590         * jit/AssemblyHelpers.h:
1591         * jit/ExecutableAllocator.cpp:
1592         (JSC::ExecutableAllocator::initializeAllocator):
1593         (JSC::ExecutableAllocator::singleton):
1594         (JSC::ExecutableAllocator::ExecutableAllocator):
1595         (JSC::ExecutableAllocator::allocate):
1596         * jit/ExecutableAllocator.h:
1597         * jit/JIT.cpp:
1598         (JSC::JIT::compileWithoutLinking):
1599         * jit/JITCall.cpp:
1600         (JSC::JIT::compileCallEvalSlowCase):
1601         * jit/JITMathIC.h:
1602         (JSC::JITMathIC::generateOutOfLine):
1603         * jit/JITOpcodes.cpp:
1604         (JSC::JIT::privateCompileHasIndexedProperty):
1605         * jit/JITOpcodes32_64.cpp:
1606         (JSC::JIT::privateCompileHasIndexedProperty):
1607         * jit/JITOperations.cpp:
1608         * jit/JITOperations.h:
1609         * jit/JITPropertyAccess.cpp:
1610         (JSC::JIT::stringGetByValStubGenerator):
1611         (JSC::JIT::privateCompileGetByVal):
1612         (JSC::JIT::privateCompileGetByValWithCachedId):
1613         (JSC::JIT::privateCompilePutByVal):
1614         (JSC::JIT::privateCompilePutByValWithCachedId):
1615         * jit/JITPropertyAccess32_64.cpp:
1616         (JSC::JIT::stringGetByValStubGenerator):
1617         * jit/JITStubRoutine.h:
1618         * jit/Repatch.cpp:
1619         (JSC::ftlThunkAwareRepatchCall):
1620         (JSC::linkPolymorphicCall):
1621         * jit/SpecializedThunkJIT.h:
1622         (JSC::SpecializedThunkJIT::finalize):
1623         * jit/ThunkGenerators.cpp:
1624         (JSC::throwExceptionFromCallSlowPathGenerator):
1625         (JSC::linkCallThunkGenerator):
1626         (JSC::linkPolymorphicCallThunkGenerator):
1627         (JSC::virtualThunkFor):
1628         (JSC::nativeForGenerator):
1629         (JSC::arityFixupGenerator):
1630         (JSC::unreachableGenerator):
1631         (JSC::boundThisNoArgsFunctionCallGenerator):
1632         (JSC::throwExceptionFromWasmThunkGenerator):
1633         * llint/LLIntThunks.cpp:
1634         (JSC::LLInt::generateThunkWithJumpTo):
1635         * runtime/SamplingProfiler.cpp:
1636         (JSC::SamplingProfiler::takeSample):
1637         * runtime/VM.cpp:
1638         (JSC::VM::VM):
1639         * runtime/VM.h:
1640         * runtime/VMTraps.cpp:
1641         (JSC::VMTraps::tryInstallTrapBreakpoints):
1642         * tools/VMInspector.cpp:
1643         * wasm/WasmBinding.cpp:
1644         (JSC::Wasm::wasmToJs):
1645         (JSC::Wasm::wasmToWasm):
1646         (JSC::Wasm::exitStubGenerator):
1647         * wasm/WasmPlan.cpp:
1648         (JSC::Wasm::Plan::complete):
1649         * yarr/YarrJIT.cpp:
1650         (JSC::Yarr::YarrGenerator::compile):
1651         (JSC::Yarr::jitCompile):
1652
1653 2017-03-29  Keith Miller  <keith_miller@apple.com>
1654
1655         WebAssembly: Worklist should periodically check in to see if there are higher priority jobs to do.
1656         https://bugs.webkit.org/show_bug.cgi?id=170204
1657
1658         Reviewed by Saam Barati.
1659
1660         This patch makes it so that Wasm::Plan's compileFunctions method can return periodically
1661         to its caller. The main use for this is if a user asynchronously compiles a wasm module
1662         then later synchronously compiles another module. In this case we want to be able to pause
1663         compilation of other worklists.
1664
1665         This patch also adds support for size_t Options.
1666
1667         * runtime/Options.cpp:
1668         (JSC::parse):
1669         (JSC::Option::dump):
1670         (JSC::Option::operator==):
1671         * runtime/Options.h:
1672         * wasm/WasmPlan.cpp:
1673         (JSC::Wasm::Plan::moveToState):
1674         (JSC::Wasm::Plan::ThreadCountHolder::~ThreadCountHolder):
1675         (JSC::Wasm::Plan::compileFunctions):
1676         * wasm/WasmPlan.h:
1677         * wasm/WasmWorklist.cpp:
1678
1679 2017-03-29  Mark Lam  <mark.lam@apple.com>
1680
1681         Remove obsolete references to HeapTimer in JavaScriptCore.order.
1682         https://bugs.webkit.org/show_bug.cgi?id=170252
1683
1684         Reviewed by Saam Barati.
1685
1686         The HeapTimer was renamed to JSRunLoopTimer back in r214504.  These HeapTimer
1687         entries are now no longer meaningful.
1688
1689         * JavaScriptCore.order:
1690
1691 2017-03-29  JF Bastien  <jfbastien@apple.com>
1692
1693         WebAssembly: add shell-only Memory mode helper
1694         https://bugs.webkit.org/show_bug.cgi?id=170227
1695
1696         Reviewed by Mark Lam.
1697
1698         * jsc.cpp:
1699         (GlobalObject::finishCreation):
1700         (functionWebAssemblyMemoryMode):
1701         * wasm/WasmMemory.h:
1702         * wasm/js/JSWebAssemblyInstance.h:
1703         * wasm/js/JSWebAssemblyMemory.h:
1704
1705 2017-03-29  Keith Miller  <keith_miller@apple.com>
1706
1707         WebAssembly: pack OpcodeOrigin to fit in a pointer
1708         https://bugs.webkit.org/show_bug.cgi?id=170244
1709
1710         Reviewed by Michael Saboff.
1711
1712         This patch makes it so we don't have to have allocate the OpcodeOrigin and can just
1713         pack all the data into the pointer B3::Origin already has.
1714
1715         * wasm/WasmB3IRGenerator.cpp:
1716         (JSC::Wasm::parseAndCompile):
1717         * wasm/WasmOpcodeOrigin.cpp:
1718         (JSC::Wasm::OpcodeOrigin::dump):
1719         * wasm/WasmOpcodeOrigin.h:
1720         (JSC::Wasm::OpcodeOrigin::OpcodeOrigin):
1721         (JSC::Wasm::OpcodeOrigin::opcode):
1722         (JSC::Wasm::OpcodeOrigin::location):
1723
1724 2017-03-29  JF Bastien  <jfbastien@apple.com>
1725
1726         WebAssembly: NFC s/goto/lambda/g
1727         https://bugs.webkit.org/show_bug.cgi?id=170242
1728
1729         Reviewed by Mark Lam.
1730
1731         Lambdas are more in-style than the goto I just used.
1732
1733         * wasm/WasmMemory.cpp:
1734         (JSC::Wasm::tryGetFastMemory):
1735
1736 2017-03-28  Saam Barati  <sbarati@apple.com>
1737
1738         AssemblyHelpers should not have a VM field
1739         https://bugs.webkit.org/show_bug.cgi?id=170207
1740
1741         Reviewed by Yusuke Suzuki.
1742
1743         APIs that need VM should take one as a parameter. When doing position
1744         independent code for Wasm, we can't tie code generation to a VM.
1745
1746         * b3/B3Compile.cpp:
1747         (JSC::B3::compile):
1748         * b3/air/testair.cpp:
1749         * b3/testb3.cpp:
1750         (JSC::B3::testEntrySwitchSimple):
1751         (JSC::B3::testEntrySwitchNoEntrySwitch):
1752         (JSC::B3::testEntrySwitchWithCommonPaths):
1753         (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
1754         (JSC::B3::testEntrySwitchLoop):
1755         * bytecode/AccessCase.cpp:
1756         (JSC::AccessCase::generateWithGuard):
1757         (JSC::AccessCase::generateImpl):
1758         * bytecode/DOMJITAccessCasePatchpointParams.cpp:
1759         (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
1760         * bytecode/InlineAccess.cpp:
1761         (JSC::InlineAccess::dumpCacheSizesAndCrash):
1762         (JSC::InlineAccess::generateSelfPropertyAccess):
1763         (JSC::InlineAccess::generateSelfPropertyReplace):
1764         (JSC::InlineAccess::generateArrayLength):
1765         (JSC::InlineAccess::rewireStubAsJump):
1766         * bytecode/InlineAccess.h:
1767         * bytecode/PolymorphicAccess.cpp:
1768         (JSC::AccessGenerationState::emitExplicitExceptionHandler):
1769         (JSC::PolymorphicAccess::regenerate):
1770         * bytecode/PolymorphicAccess.h:
1771         (JSC::AccessGenerationState::AccessGenerationState):
1772         * dfg/DFGJITCompiler.cpp:
1773         (JSC::DFG::JITCompiler::JITCompiler):
1774         (JSC::DFG::JITCompiler::compileExceptionHandlers):
1775         (JSC::DFG::JITCompiler::link):
1776         (JSC::DFG::JITCompiler::compile):
1777         (JSC::DFG::JITCompiler::compileFunction):
1778         (JSC::DFG::JITCompiler::exceptionCheck):
1779         * dfg/DFGJITCompiler.h:
1780         (JSC::DFG::JITCompiler::exceptionCheckWithCallFrameRollback):
1781         (JSC::DFG::JITCompiler::fastExceptionCheck):
1782         (JSC::DFG::JITCompiler::vm):
1783         * dfg/DFGOSRExitCompiler.cpp:
1784         * dfg/DFGOSRExitCompiler.h:
1785         * dfg/DFGOSRExitCompiler32_64.cpp:
1786         (JSC::DFG::OSRExitCompiler::compileExit):
1787         * dfg/DFGOSRExitCompiler64.cpp:
1788         (JSC::DFG::OSRExitCompiler::compileExit):
1789         * dfg/DFGOSRExitCompilerCommon.cpp:
1790         (JSC::DFG::adjustAndJumpToTarget):
1791         * dfg/DFGOSRExitCompilerCommon.h:
1792         * dfg/DFGSpeculativeJIT.cpp:
1793         (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
1794         (JSC::DFG::SpeculativeJIT::checkArray):
1795         (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
1796         (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
1797         (JSC::DFG::SpeculativeJIT::compileMakeRope):
1798         (JSC::DFG::SpeculativeJIT::compileGetGlobalObject):
1799         (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
1800         (JSC::DFG::SpeculativeJIT::compileCreateActivation):
1801         (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
1802         (JSC::DFG::SpeculativeJIT::compileSpread):
1803         (JSC::DFG::SpeculativeJIT::compileArraySlice):
1804         (JSC::DFG::SpeculativeJIT::compileNukeStructureAndSetButterfly):
1805         (JSC::DFG::SpeculativeJIT::compileNewStringObject):
1806         (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
1807         (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
1808         * dfg/DFGSpeculativeJIT.h:
1809         (JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize):
1810         (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
1811         (JSC::DFG::SpeculativeJIT::emitAllocateVariableSizedJSObject):
1812         (JSC::DFG::SpeculativeJIT::emitAllocateDestructibleObject):
1813         * dfg/DFGSpeculativeJIT32_64.cpp:
1814         (JSC::DFG::SpeculativeJIT::emitCall):
1815         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
1816         (JSC::DFG::SpeculativeJIT::emitBranch):
1817         (JSC::DFG::SpeculativeJIT::compile):
1818         * dfg/DFGSpeculativeJIT64.cpp:
1819         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
1820         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
1821         (JSC::DFG::SpeculativeJIT::emitCall):
1822         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
1823         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
1824         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
1825         (JSC::DFG::SpeculativeJIT::emitBranch):
1826         (JSC::DFG::SpeculativeJIT::compile):
1827         (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
1828         * dfg/DFGThunks.cpp:
1829         (JSC::DFG::osrEntryThunkGenerator):
1830         * ftl/FTLCompile.cpp:
1831         (JSC::FTL::compile):
1832         * ftl/FTLJITFinalizer.h:
1833         * ftl/FTLLazySlowPath.cpp:
1834         (JSC::FTL::LazySlowPath::generate):
1835         * ftl/FTLLazySlowPathCall.h:
1836         (JSC::FTL::createLazyCallGenerator):
1837         * ftl/FTLLink.cpp:
1838         (JSC::FTL::link):
1839         * ftl/FTLLowerDFGToB3.cpp:
1840         (JSC::FTL::DFG::LowerDFGToB3::lower):
1841         (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
1842         (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
1843         (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
1844         (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
1845         (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
1846         (JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
1847         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
1848         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
1849         (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
1850         (JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull):
1851         (JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
1852         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
1853         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
1854         (JSC::FTL::DFG::LowerDFGToB3::compileCheckTraps):
1855         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
1856         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
1857         (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
1858         (JSC::FTL::DFG::LowerDFGToB3::buildTypeOf):
1859         * ftl/FTLOSRExitCompiler.cpp:
1860         (JSC::FTL::compileStub):
1861         * ftl/FTLSlowPathCall.h:
1862         (JSC::FTL::callOperation):
1863         * ftl/FTLState.h:
1864         (JSC::FTL::State::vm):
1865         * ftl/FTLThunks.cpp:
1866         (JSC::FTL::genericGenerationThunkGenerator):
1867         (JSC::FTL::slowPathCallThunkGenerator):
1868         * jit/AssemblyHelpers.cpp:
1869         (JSC::AssemblyHelpers::jitReleaseAssertNoException):
1870         (JSC::AssemblyHelpers::callExceptionFuzz):
1871         (JSC::AssemblyHelpers::emitJumpIfException):
1872         (JSC::AssemblyHelpers::emitExceptionCheck):
1873         (JSC::AssemblyHelpers::emitNonPatchableExceptionCheck):
1874         (JSC::AssemblyHelpers::emitLoadStructure):
1875         (JSC::AssemblyHelpers::emitRandomThunk):
1876         (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
1877         (JSC::AssemblyHelpers::emitConvertValueToBoolean):
1878         (JSC::AssemblyHelpers::debugCall):
1879         * jit/AssemblyHelpers.h:
1880         (JSC::AssemblyHelpers::AssemblyHelpers):
1881         (JSC::AssemblyHelpers::codeBlock):
1882         (JSC::AssemblyHelpers::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
1883         (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMEntryFrameCalleeSavesBuffer):
1884         (JSC::AssemblyHelpers::barrierBranch):
1885         (JSC::AssemblyHelpers::barrierStoreLoadFence):
1886         (JSC::AssemblyHelpers::mutatorFence):
1887         (JSC::AssemblyHelpers::storeButterfly):
1888         (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly):
1889         (JSC::AssemblyHelpers::jumpIfMutatorFenceNotNeeded):
1890         (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
1891         (JSC::AssemblyHelpers::emitAllocateJSObject):
1892         (JSC::AssemblyHelpers::emitAllocateVariableSizedCell):
1893         (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
1894         (JSC::AssemblyHelpers::emitAllocateDestructibleObject):
1895         (JSC::AssemblyHelpers::vm): Deleted.
1896         (JSC::AssemblyHelpers::debugCall): Deleted.
1897         * jit/CCallHelpers.cpp:
1898         (JSC::CCallHelpers::ensureShadowChickenPacket):
1899         * jit/CCallHelpers.h:
1900         (JSC::CCallHelpers::CCallHelpers):
1901         (JSC::CCallHelpers::jumpToExceptionHandler):
1902         * jit/JIT.cpp:
1903         (JSC::JIT::emitEnterOptimizationCheck):
1904         (JSC::JIT::privateCompileExceptionHandlers):
1905         * jit/JIT.h:
1906         (JSC::JIT::exceptionCheck):
1907         (JSC::JIT::exceptionCheckWithCallFrameRollback):
1908         * jit/JITMathIC.h:
1909         (JSC::JITMathIC::generateOutOfLine):
1910         * jit/JITOpcodes.cpp:
1911         (JSC::JIT::emit_op_instanceof):
1912         (JSC::JIT::emit_op_is_undefined):
1913         (JSC::JIT::emit_op_jfalse):
1914         (JSC::JIT::emit_op_jeq_null):
1915         (JSC::JIT::emit_op_jneq_null):
1916         (JSC::JIT::emit_op_jtrue):
1917         (JSC::JIT::emit_op_throw):
1918         (JSC::JIT::emit_op_catch):
1919         (JSC::JIT::emit_op_eq_null):
1920         (JSC::JIT::emit_op_neq_null):
1921         (JSC::JIT::emitSlow_op_loop_hint):
1922         (JSC::JIT::emit_op_log_shadow_chicken_prologue):
1923         (JSC::JIT::emit_op_log_shadow_chicken_tail):
1924         * jit/JITOpcodes32_64.cpp:
1925         (JSC::JIT::privateCompileCTINativeCall):
1926         (JSC::JIT::emit_op_new_object):
1927         (JSC::JIT::emit_op_jfalse):
1928         (JSC::JIT::emit_op_jtrue):
1929         (JSC::JIT::emit_op_throw):
1930         (JSC::JIT::emit_op_catch):
1931         (JSC::JIT::emit_op_create_this):
1932         (JSC::JIT::emit_op_log_shadow_chicken_prologue):
1933         (JSC::JIT::emit_op_log_shadow_chicken_tail):
1934         * jit/JITPropertyAccess.cpp:
1935         (JSC::JIT::emitWriteBarrier):
1936         * jit/JSInterfaceJIT.h:
1937         (JSC::JSInterfaceJIT::JSInterfaceJIT):
1938         (JSC::JSInterfaceJIT::vm):
1939         * jit/Repatch.cpp:
1940         (JSC::tryCacheGetByID):
1941         (JSC::tryCachePutByID):
1942         (JSC::linkPolymorphicCall):
1943         (JSC::resetGetByID):
1944         (JSC::resetPutByID):
1945         * jit/SetupVarargsFrame.cpp:
1946         (JSC::emitSetupVarargsFrameFastCase):
1947         * jit/SetupVarargsFrame.h:
1948         * jit/SpecializedThunkJIT.h:
1949         (JSC::SpecializedThunkJIT::loadArgumentWithSpecificClass):
1950         * jit/ThunkGenerators.cpp:
1951         (JSC::throwExceptionFromCallSlowPathGenerator):
1952         (JSC::linkCallThunkGenerator):
1953         (JSC::linkPolymorphicCallThunkGenerator):
1954         (JSC::virtualThunkFor):
1955         (JSC::nativeForGenerator):
1956         (JSC::randomThunkGenerator):
1957         (JSC::boundThisNoArgsFunctionCallGenerator):
1958         (JSC::throwExceptionFromWasmThunkGenerator):
1959         * wasm/WasmB3IRGenerator.cpp:
1960         (JSC::Wasm::parseAndCompile):
1961         * wasm/WasmBinding.cpp:
1962         (JSC::Wasm::wasmToJs):
1963         (JSC::Wasm::wasmToWasm):
1964
1965 2017-03-28  Keith Miller  <keith_miller@apple.com>
1966
1967         WebAssembly: We should have Origins
1968         https://bugs.webkit.org/show_bug.cgi?id=170217
1969
1970         Reviewed by Mark Lam.
1971
1972         This patch adds wasm origins for B3::Values, called OpcodeOrigin. Currently,
1973         OpcodeOrigin just tracks the original opcode and the location of that opcode.
1974
1975         Here's a sample:
1976
1977         BB#0: ; frequency = 1.000000
1978             Int64 @4 = Patchpoint(generator = 0x10f487fa8, earlyClobbered = [], lateClobbered = [], usedRegisters = [], resultConstraint = SomeRegister)
1979             Int64 @5 = FramePointer()
1980             Void @8 = Store(@4, @5, offset = 24, ControlDependent|Writes:Top)
1981             Int64 @10 = Const64(0)
1982             Void @12 = Store($0(@10), @5, offset = 16, ControlDependent|Writes:Top)
1983             Int64 @13 = Patchpoint(generator = 0x10f4be7f0, earlyClobbered = [], lateClobbered = [], usedRegisters = [], resultConstraint = SomeRegister, ExitsSideways|ControlDependent|WritesPinned|ReadsPinned|Fence|Writes:Top|Reads:Top)
1984             Int64 @16 = ArgumentReg(%rdi)
1985             Int64 @18 = ArgumentReg(%rsi)
1986             Int32 @22 = Trunc(@18, Wasm: {opcode: I64Rotl, location: 5})
1987             Int64 @23 = RotL(@16, @22, Wasm: {opcode: I64Rotl, location: 5})
1988             Void @27 = Return(@23, Terminal, Wasm: {opcode: End, location: 6})
1989
1990         * JavaScriptCore.xcodeproj/project.pbxproj:
1991         * b3/B3Value.cpp:
1992         (JSC::B3::Value::deepDump):
1993         * wasm/WasmB3IRGenerator.cpp:
1994         (JSC::Wasm::B3IRGenerator::setParser):
1995         (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
1996         (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
1997         (JSC::Wasm::B3IRGenerator::emitLoadOp):
1998         (JSC::Wasm::B3IRGenerator::emitStoreOp):
1999         (JSC::Wasm::B3IRGenerator::addConstant):
2000         (JSC::Wasm::B3IRGenerator::addLoop):
2001         (JSC::Wasm::B3IRGenerator::unify):
2002         (JSC::Wasm::parseAndCompile):
2003         (JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv):
2004         (JSC::Wasm::getMemoryBaseAndSize): Deleted.
2005         * wasm/WasmFunctionParser.h:
2006         (JSC::Wasm::FunctionParser::currentOpcode):
2007         (JSC::Wasm::FunctionParser::currentOpcodeStartingOffset):
2008         (JSC::Wasm::FunctionParser<Context>::FunctionParser):
2009         * wasm/WasmOpcodeOrigin.cpp: Added.
2010         (JSC::Wasm::OpcodeOrigin::dump):
2011         * wasm/WasmOpcodeOrigin.h: Added.
2012         (JSC::Wasm::OpcodeOrigin::OpcodeOrigin):
2013         * wasm/WasmValidate.cpp:
2014         (JSC::Wasm::Validate::setParser):
2015         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
2016         (CodeGenerator.generate):
2017         (generateB3OpCode):
2018         (generateConstCode):
2019
2020 2017-03-28  JF Bastien  <jfbastien@apple.com>
2021
2022         WebAssembly: option to crash if no fast memory is available
2023         https://bugs.webkit.org/show_bug.cgi?id=170219
2024
2025         Reviewed by Mark Lam.
2026
2027         * runtime/Options.h:
2028         * wasm/WasmMemory.cpp:
2029         (JSC::Wasm::webAssemblyCouldntGetFastMemory):
2030         (JSC::Wasm::tryGetFastMemory):
2031
2032 2017-03-28  Mark Lam  <mark.lam@apple.com>
2033
2034         The Mutator should not be able to steal the conn if the Collector hasn't reached the NotRunning phase yet.
2035         https://bugs.webkit.org/show_bug.cgi?id=170213
2036         <rdar://problem/30755345>
2037
2038         Reviewed by Filip Pizlo.
2039
2040         The current condition for stealing the conn isn't tight enough.  Restricting the
2041         stealing to when m_currentPhase == NotRunning ensures that the Collector is
2042         really done running.
2043
2044         No test because this issue only manifests with a race condition that is difficult
2045         to reproduce on demand.
2046
2047         * heap/Heap.cpp:
2048         (JSC::Heap::requestCollection):
2049
2050 2017-03-28  Keith Miller  <keith_miller@apple.com>
2051
2052         WebAssembly: Make WebAssembly.instantiate/compile truly asynchronous
2053         https://bugs.webkit.org/show_bug.cgi?id=169187
2054
2055         Reviewed by Saam Barati.
2056
2057         This patch allows WebAssembly compilations to happen asynchronously.
2058         To do so, it refactors how much of the compilation happens and adds
2059         new infrastructure for async promises.
2060
2061         First, there is a new class, PromiseDeferredTimer that lives on
2062         the VM.  PromiseDeferredTimer will manage the life-cycle of async
2063         pending promises and any dependencies that promise
2064         needs. PromiseDeferredTimer automagically releases the pending
2065         promise and dependencies once the JSPromiseDeferred is resolved or
2066         rejected. Additionally, PromiseDeferredTimer provides a mechanism
2067         to poll the run-loop whenever the async task needs to synchronize
2068         with the JS thread. Normally, that will be whenever the async task
2069         finishes. In the case of Web Assembly we also use this feature for
2070         the compile + instantiate case, where we might have more work
2071         after the first async task completes (more on that later).
2072
2073         The next class is Wasm::Worklist, which is used to manage Wasm
2074         compilation tasks. The worklist class works similarly to the
2075         DFG/FTL Worklists. It has a pool of threads that it manages. One
2076         interesting aspect of Wasm Worklist is that it can synchronously
2077         compile a plan that is already potentially running
2078         asynchronously. This can occur if a user calls
2079         WebAssembly.instantiate() then new WebAssembly.instantiate() on
2080         the same module. In that case the Wasm Worklist will bump the
2081         priority of the running pending Plan and block the JS thread.
2082
2083         This patch also makes some of the Wasm Plan code cleaner. Since we
2084         now defer all compilation to instantiation time, we no longer need
2085         to guess at which memory we are going to get. Also, Wasm Plans now
2086         track the work they have done with a state enum.
2087
2088         Finally, this patch makes renamed HeapTimer to JSRunLoopTimer. It
2089         also adds changes test262AsyncTest to a more generic testing
2090         infrastructure. Now, in addition to the old functionality, you can
2091         call asyncTest() with the number of tests you expect. When the jsc
2092         CLI exits, it will guarantee that asyncTestPassed() is called that
2093         many times.
2094
2095         * CMakeLists.txt:
2096         * JavaScriptCore.xcodeproj/project.pbxproj:
2097         * heap/GCActivityCallback.h:
2098         * heap/IncrementalSweeper.cpp:
2099         (JSC::IncrementalSweeper::scheduleTimer):
2100         (JSC::IncrementalSweeper::IncrementalSweeper):
2101         * heap/IncrementalSweeper.h:
2102         * heap/StopIfNecessaryTimer.cpp:
2103         (JSC::StopIfNecessaryTimer::StopIfNecessaryTimer):
2104         * heap/StopIfNecessaryTimer.h:
2105         * heap/StrongInlines.h:
2106         * jsc.cpp:
2107         (GlobalObject::finishCreation):
2108         (printInternal):
2109         (functionAsyncTestStart):
2110         (functionAsyncTestPassed):
2111         (functionTestWasmModuleFunctions):
2112         (CommandLine::parseArguments):
2113         (runJSC):
2114         * runtime/JSPromiseDeferred.cpp:
2115         (JSC::JSPromiseDeferred::resolve):
2116         (JSC::JSPromiseDeferred::reject):
2117         * runtime/JSPromiseDeferred.h:
2118         (JSC::JSPromiseDeferred::promiseAsyncPending):
2119         * runtime/JSRunLoopTimer.cpp: Renamed from Source/JavaScriptCore/heap/HeapTimer.cpp.
2120         (JSC::JSRunLoopTimer::JSRunLoopTimer):
2121         (JSC::JSRunLoopTimer::setRunLoop):
2122         (JSC::JSRunLoopTimer::~JSRunLoopTimer):
2123         (JSC::JSRunLoopTimer::timerDidFire):
2124         (JSC::JSRunLoopTimer::scheduleTimer):
2125         (JSC::JSRunLoopTimer::cancelTimer):
2126         (JSC::JSRunLoopTimer::invalidate):
2127         * runtime/JSRunLoopTimer.h: Copied from Source/JavaScriptCore/heap/HeapTimer.h.
2128         * runtime/Options.h:
2129         * runtime/PromiseDeferredTimer.cpp: Added.
2130         (JSC::PromiseDeferredTimer::PromiseDeferredTimer):
2131         (JSC::PromiseDeferredTimer::doWork):
2132         (JSC::PromiseDeferredTimer::runRunLoop):
2133         (JSC::PromiseDeferredTimer::addPendingPromise):
2134         (JSC::PromiseDeferredTimer::cancelPendingPromise):
2135         (JSC::PromiseDeferredTimer::scheduleWorkSoon):
2136         (JSC::PromiseDeferredTimer::scheduleBlockedTask):
2137         * runtime/PromiseDeferredTimer.h: Renamed from Source/JavaScriptCore/heap/HeapTimer.h.
2138         (JSC::PromiseDeferredTimer::stopRunningTasks):
2139         * runtime/VM.cpp:
2140         (JSC::VM::VM):
2141         (JSC::VM::~VM):
2142         * runtime/VM.h:
2143         * wasm/JSWebAssembly.cpp:
2144         (JSC::reject):
2145         (JSC::webAssemblyCompileFunc):
2146         (JSC::resolve):
2147         (JSC::instantiate):
2148         (JSC::compileAndInstantiate):
2149         (JSC::webAssemblyInstantiateFunc):
2150         (JSC::webAssemblyValidateFunc):
2151         * wasm/WasmB3IRGenerator.cpp:
2152         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
2153         (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
2154         (JSC::Wasm::B3IRGenerator::memoryKind):
2155         (JSC::Wasm::parseAndCompile):
2156         * wasm/WasmB3IRGenerator.h:
2157         * wasm/WasmFormat.h:
2158         (JSC::Wasm::ModuleInformation::internalFunctionCount):
2159         * wasm/WasmFunctionParser.h:
2160         * wasm/WasmMemory.h:
2161         * wasm/WasmMemoryInformation.cpp:
2162         (JSC::Wasm::MemoryInformation::MemoryInformation):
2163         * wasm/WasmMemoryInformation.h:
2164         (JSC::Wasm::MemoryInformation::maximum):
2165         (JSC::Wasm::MemoryInformation::hasReservedMemory): Deleted.
2166         (JSC::Wasm::MemoryInformation::takeReservedMemory): Deleted.
2167         (JSC::Wasm::MemoryInformation::mode): Deleted.
2168         * wasm/WasmModuleParser.cpp:
2169         * wasm/WasmModuleParser.h:
2170         (JSC::Wasm::ModuleParser::ModuleParser):
2171         * wasm/WasmPlan.cpp:
2172         (JSC::Wasm::Plan::Plan):
2173         (JSC::Wasm::Plan::stateString):
2174         (JSC::Wasm::Plan::moveToState):
2175         (JSC::Wasm::Plan::fail):
2176         (JSC::Wasm::Plan::parseAndValidateModule):
2177         (JSC::Wasm::Plan::prepare):
2178         (JSC::Wasm::Plan::ThreadCountHolder::ThreadCountHolder):
2179         (JSC::Wasm::Plan::ThreadCountHolder::~ThreadCountHolder):
2180         (JSC::Wasm::Plan::compileFunctions):
2181         (JSC::Wasm::Plan::complete):
2182         (JSC::Wasm::Plan::waitForCompletion):
2183         (JSC::Wasm::Plan::cancel):
2184         (JSC::Wasm::Plan::run): Deleted.
2185         (JSC::Wasm::Plan::initializeCallees): Deleted.
2186         * wasm/WasmPlan.h:
2187         (JSC::Wasm::Plan::dontFinalize):
2188         (JSC::Wasm::Plan::exports):
2189         (JSC::Wasm::Plan::internalFunctionCount):
2190         (JSC::Wasm::Plan::takeModuleInformation):
2191         (JSC::Wasm::Plan::takeCallLinkInfos):
2192         (JSC::Wasm::Plan::takeWasmExitStubs):
2193         (JSC::Wasm::Plan::setModeAndPromise):
2194         (JSC::Wasm::Plan::mode):
2195         (JSC::Wasm::Plan::pendingPromise):
2196         (JSC::Wasm::Plan::vm):
2197         (JSC::Wasm::Plan::errorMessage):
2198         (JSC::Wasm::Plan::failed):
2199         (JSC::Wasm::Plan::hasWork):
2200         (JSC::Wasm::Plan::hasBeenPrepared):
2201         * wasm/WasmPlanInlines.h: Copied from Source/JavaScriptCore/wasm/WasmB3IRGenerator.h.
2202         (JSC::Wasm::Plan::initializeCallees):
2203         * wasm/WasmValidate.cpp:
2204         * wasm/WasmWorklist.cpp: Added.
2205         (JSC::Wasm::Worklist::priorityString):
2206         (JSC::Wasm::Worklist::QueueElement::setToNextPriority):
2207         (JSC::Wasm::Worklist::iterate):
2208         (JSC::Wasm::Worklist::enqueue):
2209         (JSC::Wasm::Worklist::completePlanSynchronously):
2210         (JSC::Wasm::Worklist::stopAllPlansForVM):
2211         (JSC::Wasm::Worklist::Worklist):
2212         (JSC::Wasm::Worklist::~Worklist):
2213         (JSC::Wasm::existingWorklistOrNull):
2214         (JSC::Wasm::ensureWorklist):
2215         * wasm/WasmWorklist.h: Added.
2216         (JSC::Wasm::Worklist::nextTicket):
2217         (JSC::Wasm::Worklist::Comparator::operator()):
2218         * wasm/js/JSWebAssemblyCallee.h:
2219         * wasm/js/JSWebAssemblyCodeBlock.cpp:
2220         (JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
2221         (JSC::JSWebAssemblyCodeBlock::initialize):
2222         (JSC::JSWebAssemblyCodeBlock::isSafeToRun):
2223         * wasm/js/JSWebAssemblyCodeBlock.h:
2224         (JSC::JSWebAssemblyCodeBlock::create):
2225         (JSC::JSWebAssemblyCodeBlock::initialized):
2226         (JSC::JSWebAssemblyCodeBlock::plan):
2227         (JSC::JSWebAssemblyCodeBlock::runnable):
2228         (JSC::JSWebAssemblyCodeBlock::errorMessage):
2229         (JSC::JSWebAssemblyCodeBlock::callees):
2230         * wasm/js/JSWebAssemblyHelpers.h:
2231         (JSC::createSourceBufferFromValue):
2232         * wasm/js/JSWebAssemblyInstance.cpp:
2233         (JSC::JSWebAssemblyInstance::finishCreation):
2234         (JSC::JSWebAssemblyInstance::visitChildren):
2235         (JSC::JSWebAssemblyInstance::addUnitializedCodeBlock):
2236         (JSC::JSWebAssemblyInstance::finalizeCreation):
2237         (JSC::JSWebAssemblyInstance::create):
2238         (JSC::JSWebAssemblyInstance::setMemory): Deleted.
2239         * wasm/js/JSWebAssemblyInstance.h:
2240         (JSC::JSWebAssemblyInstance::codeBlock):
2241         (JSC::JSWebAssemblyInstance::initialized):
2242         (JSC::JSWebAssemblyInstance::module):
2243         (JSC::JSWebAssemblyInstance::importFunction):
2244         (JSC::JSWebAssemblyInstance::setMemory):
2245         (JSC::JSWebAssemblyInstance::table):
2246         (JSC::JSWebAssemblyInstance::importFunctions):
2247         (JSC::JSWebAssemblyInstance::setImportFunction): Deleted.
2248         (JSC::JSWebAssemblyInstance::setTable): Deleted.
2249         * wasm/js/JSWebAssemblyModule.cpp:
2250         (JSC::JSWebAssemblyModule::createStub):
2251         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
2252         (JSC::JSWebAssemblyModule::finishCreation):
2253         (JSC::JSWebAssemblyModule::setCodeBlock):
2254         (JSC::JSWebAssemblyModule::buildCodeBlock): Deleted.
2255         (JSC::JSWebAssemblyModule::create): Deleted.
2256         (JSC::JSWebAssemblyModule::codeBlock): Deleted.
2257         * wasm/js/JSWebAssemblyModule.h:
2258         (JSC::JSWebAssemblyModule::moduleInformation):
2259         (JSC::JSWebAssemblyModule::codeBlock):
2260         (JSC::JSWebAssemblyModule::source):
2261         (JSC::JSWebAssemblyModule::takeReservedMemory): Deleted.
2262         (JSC::JSWebAssemblyModule::codeBlockFor): Deleted.
2263         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2264         (JSC::constructJSWebAssemblyInstance):
2265         (JSC::WebAssemblyInstanceConstructor::createInstance): Deleted.
2266         * wasm/js/WebAssemblyModuleConstructor.cpp:
2267         (JSC::WebAssemblyModuleConstructor::createModule):
2268         * wasm/js/WebAssemblyModulePrototype.cpp:
2269         (JSC::webAssemblyModuleProtoImports):
2270         (JSC::webAssemblyModuleProtoExports):
2271         * wasm/js/WebAssemblyModuleRecord.cpp:
2272         (JSC::WebAssemblyModuleRecord::finishCreation):
2273         (JSC::WebAssemblyModuleRecord::link):
2274         (JSC::WebAssemblyModuleRecord::evaluate):
2275         * wasm/js/WebAssemblyModuleRecord.h:
2276
2277 2017-03-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2278
2279         WebAssembly: add fallback to use pinned register to load/store state
2280         https://bugs.webkit.org/show_bug.cgi?id=169773
2281
2282         Reviewed by Saam Barati.
2283
2284         This patch adds a new pinned register to hold JSWebAssemblyInstance,
2285         which is used to represent the context of running Wasm code.
2286         While we use fast TLS to hold the context in macOS, we do not have
2287         any system reserved fast TLS slot in the other systems. This pinned
2288         register approach is used in these systems. These changes decouple
2289         VM from Wasm module to make Wasm module position independent code.
2290
2291         While using fast TLS could be beneficial in x64 systems which number of
2292         registers is relatively small, pinned register approach could be
2293         beneficial in ARM64 which has plenty of registers. In macOS, we can
2294         switch the implementation with the runtime flag. Thus macOS port can
2295         compare the performance and decide which implementation is used after
2296         landing this patch.
2297
2298         * heap/MarkedBlock.h:
2299         (JSC::MarkedBlock::offsetOfVM):
2300         * jit/AssemblyHelpers.cpp:
2301         (JSC::AssemblyHelpers::loadWasmContext):
2302         (JSC::AssemblyHelpers::storeWasmContext):
2303         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister):
2304         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister):
2305         * jit/AssemblyHelpers.h:
2306         (JSC::AssemblyHelpers::loadWasmContext): Deleted.
2307         (JSC::AssemblyHelpers::storeWasmContext): Deleted.
2308         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister): Deleted.
2309         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister): Deleted.
2310         * jit/Repatch.cpp:
2311         (JSC::webAssemblyOwner):
2312         (JSC::linkFor):
2313         (JSC::linkPolymorphicCall):
2314         (JSC::isWebAssemblyToJSCallee): Deleted.
2315         * jit/ThunkGenerators.cpp:
2316         (JSC::throwExceptionFromWasmThunkGenerator):
2317         * llint/LLIntData.cpp:
2318         (JSC::LLInt::Data::performAssertions):
2319         * llint/LowLevelInterpreter.asm:
2320         * runtime/JSCell.cpp:
2321         (JSC::JSCell::isAnyWasmCallee):
2322         * runtime/JSCellInlines.h:
2323         (JSC::isWebAssemblyToJSCallee):
2324         * runtime/JSType.h:
2325         * runtime/StackFrame.cpp:
2326         (JSC::StackFrame::functionName):
2327         * runtime/VM.cpp:
2328         (JSC::VM::VM):
2329         * runtime/VM.h:
2330         (JSC::VM::wasmContextOffset):
2331         * wasm/WasmB3IRGenerator.cpp:
2332         (JSC::Wasm::B3IRGenerator::materializeWasmContext):
2333         (JSC::Wasm::B3IRGenerator::restoreWasmContext):
2334         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
2335         (JSC::Wasm::getMemoryBaseAndSize):
2336         (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
2337         (JSC::Wasm::createJSToWasmWrapper):
2338         (JSC::Wasm::loadWasmContext): Deleted.
2339         (JSC::Wasm::storeWasmContext): Deleted.
2340         (JSC::Wasm::restoreWebAssemblyGlobalState): Deleted.
2341         * wasm/WasmBinding.cpp:
2342         (JSC::Wasm::wasmToJs):
2343         * wasm/WasmContext.cpp:
2344         (JSC::loadWasmContext):
2345         (JSC::storeWasmContext):
2346         * wasm/WasmContext.h:
2347         * wasm/WasmMemoryInformation.cpp:
2348         (JSC::Wasm::getPinnedRegisters):
2349         (JSC::Wasm::PinnedRegisterInfo::get):
2350         (JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):
2351         * wasm/WasmMemoryInformation.h:
2352         (JSC::Wasm::PinnedRegisterInfo::toSave):
2353         (JSC::Wasm::useFastTLS):
2354         (JSC::Wasm::useFastTLSForWasmContext):
2355         * wasm/js/JSWebAssemblyInstance.cpp:
2356         (JSC::JSWebAssemblyInstance::finishCreation):
2357         (JSC::JSWebAssemblyInstance::visitChildren):
2358         * wasm/js/JSWebAssemblyInstance.h:
2359         (JSC::JSWebAssemblyInstance::offsetOfCallee):
2360         * wasm/js/JSWebAssemblyModule.cpp:
2361         (JSC::JSWebAssemblyModule::finishCreation):
2362         (JSC::JSWebAssemblyModule::visitChildren):
2363         * wasm/js/JSWebAssemblyModule.h:
2364         (JSC::JSWebAssemblyModule::callee):
2365         * wasm/js/WebAssemblyFunction.cpp:
2366         (JSC::callWebAssemblyFunction):
2367         (JSC::WebAssemblyFunction::create):
2368         * wasm/js/WebAssemblyToJSCallee.cpp:
2369         (JSC::WebAssemblyToJSCallee::create):
2370         (JSC::WebAssemblyToJSCallee::createStructure):
2371         (JSC::WebAssemblyToJSCallee::finishCreation):
2372         (JSC::WebAssemblyToJSCallee::visitChildren):
2373         (JSC::WebAssemblyToJSCallee::destroy): Deleted.
2374         * wasm/js/WebAssemblyToJSCallee.h:
2375
2376 2017-03-28  Brian Burg  <bburg@apple.com>
2377
2378         Web Inspector: Add "Disable Caches" option that only applies to the inspected page while Web Inspector is open
2379         https://bugs.webkit.org/show_bug.cgi?id=169865
2380         <rdar://problem/31250573>
2381
2382         Reviewed by Joseph Pecoraro.
2383
2384         * inspector/protocol/Network.json:
2385         Rename the command for disabling resource caching to match the WebCore::Page
2386         flag. This also removes the possibility that this could be confused for the old,
2387         buggy command that this patch rips out.
2388
2389 2017-03-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2390
2391         [JSC] Move platformThreadSignal to WTF
2392         https://bugs.webkit.org/show_bug.cgi?id=170097
2393
2394         Reviewed by Mark Lam.
2395
2396         It is a small clean up towards https://bugs.webkit.org/show_bug.cgi?id=170027.
2397         platformThreadSignal uses PlatformThread in JSC, but it can be implemented in
2398         WTF ThreadIdentifier.
2399
2400         * runtime/JSLock.cpp:
2401         (JSC::JSLock::lock):
2402         * runtime/JSLock.h:
2403         (JSC::JSLock::ownerThread):
2404         (JSC::JSLock::currentThreadIsHoldingLock):
2405         * runtime/PlatformThread.h:
2406         (JSC::platformThreadSignal): Deleted.
2407         * runtime/VM.h:
2408         (JSC::VM::ownerThread):
2409         * runtime/VMTraps.cpp:
2410         (JSC::VMTraps::SignalSender::send):
2411
2412 2017-03-28  JF Bastien  <jfbastien@apple.com>
2413
2414         WebAssembly: implement Module imports/exports
2415         https://bugs.webkit.org/show_bug.cgi?id=166982
2416
2417         Reviewed by Saam Barati.
2418
2419         As defined in: https://github.com/WebAssembly/design/commit/18cbacb90cd3584dd5c9aa3d392e4e55f66af6ab
2420
2421         * wasm/WasmFormat.h:
2422         (JSC::Wasm::makeString): use uppercase instead, it was only used
2423         for diagnostic but is now used for the expected JS property's
2424         capitalization
2425         * wasm/js/WebAssemblyModulePrototype.cpp:
2426         (JSC::webAssemblyModuleProtoImports):
2427         (JSC::webAssemblyModuleProtoExports):
2428
2429 2017-03-27  JF Bastien  <jfbastien@apple.com>
2430
2431         WebAssembly: JSWebAssemblyCodeBlock.h belongs in JavaScriptCore/wasm/js not JavaScriptCore/wasm
2432         https://bugs.webkit.org/show_bug.cgi?id=170160
2433
2434         Reviewed by Mark Lam.
2435
2436         * JavaScriptCore.xcodeproj/project.pbxproj:
2437         * wasm/js/JSWebAssemblyCodeBlock.h: Renamed from Source/JavaScriptCore/wasm/JSWebAssemblyCodeBlock.h.
2438
2439 2017-03-27  JF Bastien  <jfbastien@apple.com>
2440
2441         WebAssembly: misc memory testing
2442         https://bugs.webkit.org/show_bug.cgi?id=170137
2443
2444         Reviewed by Keith Miller.
2445
2446         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2447         (JSC::WebAssemblyInstanceConstructor::createInstance): improve error messages
2448
2449 2017-03-27  Michael Saboff  <msaboff@apple.com>
2450
2451         Add ARM64 system instructions to disassembler
2452         https://bugs.webkit.org/show_bug.cgi?id=170084
2453
2454         Reviewed by Saam Barati.
2455
2456         This changes adds support for MRS and MSR instructions, and refactors the DMB
2457         disassembly to handle all of the barrier instructions.
2458
2459         * disassembler/ARM64/A64DOpcode.cpp:
2460         (JSC::ARM64Disassembler::A64DOpcodeMSRImmediate::format):
2461         (JSC::ARM64Disassembler::A64DOpcodeMSROrMRSRegister::format):
2462         (JSC::ARM64Disassembler::A64DOpcodeSystemSync::format):
2463         (JSC::ARM64Disassembler::A64DOpcodeDmb::format): Deleted.
2464         * disassembler/ARM64/A64DOpcode.h:
2465         (JSC::ARM64Disassembler::A64DOpcodeSystem::lBit):
2466         (JSC::ARM64Disassembler::A64DOpcodeSystem::op0):
2467         (JSC::ARM64Disassembler::A64DOpcodeSystem::op1):
2468         (JSC::ARM64Disassembler::A64DOpcodeSystem::crN):
2469         (JSC::ARM64Disassembler::A64DOpcodeSystem::crM):
2470         (JSC::ARM64Disassembler::A64DOpcodeSystem::op2):
2471         (JSC::ARM64Disassembler::A64DOpcodeMSROrMRSRegister::opName):
2472         (JSC::ARM64Disassembler::A64DOpcodeMSROrMRSRegister::systemRegister):
2473         (JSC::ARM64Disassembler::A64DOpcodeSystemSync::opName):
2474         (JSC::ARM64Disassembler::A64DOpcodeSystemSync::option):
2475         (JSC::ARM64Disassembler::A64DOpcodeDmb::opName): Deleted.
2476         (JSC::ARM64Disassembler::A64DOpcodeDmb::option): Deleted.
2477         (JSC::ARM64Disassembler::A64DOpcodeDmb::crM): Deleted.
2478
2479 2017-03-26  Filip Pizlo  <fpizlo@apple.com>
2480
2481         B3::fixSSA should do liveness pruning
2482         https://bugs.webkit.org/show_bug.cgi?id=170111
2483
2484         Reviewed by Saam Barati.
2485
2486         This moves all of the logic of Air::Liveness<> to WTF::Liveness<> and then uses that to
2487         create B3::VariableLiveness. Then this uses VariableLiveness::LiveAtHead to prune Phi
2488         construction.
2489
2490         This makes B3::fixSSA run twice as fast. This is a 13% progression on WasmBench compile
2491         times.
2492
2493         * CMakeLists.txt:
2494         * JavaScriptCore.xcodeproj/project.pbxproj:
2495         * b3/B3BasicBlock.h:
2496         (JSC::B3::BasicBlock::get):
2497         * b3/B3FixSSA.cpp:
2498         (JSC::B3::fixSSA):
2499         * b3/B3VariableLiveness.cpp: Added.
2500         (JSC::B3::VariableLiveness::VariableLiveness):
2501         (JSC::B3::VariableLiveness::~VariableLiveness):
2502         * b3/B3VariableLiveness.h: Added.
2503         (JSC::B3::VariableLivenessAdapter::VariableLivenessAdapter):
2504         (JSC::B3::VariableLivenessAdapter::numIndices):
2505         (JSC::B3::VariableLivenessAdapter::valueToIndex):
2506         (JSC::B3::VariableLivenessAdapter::indexToValue):
2507         (JSC::B3::VariableLivenessAdapter::blockSize):
2508         (JSC::B3::VariableLivenessAdapter::forEachEarlyUse):
2509         (JSC::B3::VariableLivenessAdapter::forEachLateUse):
2510         (JSC::B3::VariableLivenessAdapter::forEachEarlyDef):
2511         (JSC::B3::VariableLivenessAdapter::forEachLateDef):
2512         * b3/air/AirCFG.h: Added.
2513         (JSC::B3::Air::CFG::CFG):
2514         (JSC::B3::Air::CFG::root):
2515         (JSC::B3::Air::CFG::newMap):
2516         (JSC::B3::Air::CFG::successors):
2517         (JSC::B3::Air::CFG::predecessors):
2518         (JSC::B3::Air::CFG::index):
2519         (JSC::B3::Air::CFG::node):
2520         (JSC::B3::Air::CFG::numNodes):
2521         (JSC::B3::Air::CFG::dump):
2522         * b3/air/AirCode.cpp:
2523         (JSC::B3::Air::Code::Code):
2524         * b3/air/AirCode.h:
2525         (JSC::B3::Air::Code::cfg):
2526         * b3/air/AirLiveness.h:
2527         (JSC::B3::Air::LivenessAdapter::LivenessAdapter):
2528         (JSC::B3::Air::LivenessAdapter::blockSize):
2529         (JSC::B3::Air::LivenessAdapter::forEachEarlyUse):
2530         (JSC::B3::Air::LivenessAdapter::forEachLateUse):
2531         (JSC::B3::Air::LivenessAdapter::forEachEarlyDef):
2532         (JSC::B3::Air::LivenessAdapter::forEachLateDef):
2533         (JSC::B3::Air::TmpLivenessAdapter::TmpLivenessAdapter):
2534         (JSC::B3::Air::TmpLivenessAdapter::numIndices):
2535         (JSC::B3::Air::StackSlotLivenessAdapter::StackSlotLivenessAdapter):
2536         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
2537         (JSC::B3::Air::StackSlotLivenessAdapter::indexToValue):
2538         (JSC::B3::Air::Liveness::Liveness):
2539         (JSC::B3::Air::Liveness::LocalCalc::LocalCalc): Deleted.
2540         (JSC::B3::Air::Liveness::LocalCalc::Iterable::Iterable): Deleted.
2541         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::iterator): Deleted.
2542         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator++): Deleted.
2543         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator*): Deleted.
2544         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator==): Deleted.
2545         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator!=): Deleted.
2546         (JSC::B3::Air::Liveness::LocalCalc::Iterable::begin): Deleted.
2547         (JSC::B3::Air::Liveness::LocalCalc::Iterable::end): Deleted.
2548         (JSC::B3::Air::Liveness::LocalCalc::Iterable::contains): Deleted.
2549         (JSC::B3::Air::Liveness::LocalCalc::live): Deleted.
2550         (JSC::B3::Air::Liveness::LocalCalc::isLive): Deleted.
2551         (JSC::B3::Air::Liveness::LocalCalc::execute): Deleted.
2552         (JSC::B3::Air::Liveness::rawLiveAtHead): Deleted.
2553         (JSC::B3::Air::Liveness::Iterable::Iterable): Deleted.
2554         (JSC::B3::Air::Liveness::Iterable::iterator::iterator): Deleted.
2555         (JSC::B3::Air::Liveness::Iterable::iterator::operator*): Deleted.
2556         (JSC::B3::Air::Liveness::Iterable::iterator::operator++): Deleted.
2557         (JSC::B3::Air::Liveness::Iterable::iterator::operator==): Deleted.
2558         (JSC::B3::Air::Liveness::Iterable::iterator::operator!=): Deleted.
2559         (JSC::B3::Air::Liveness::Iterable::begin): Deleted.
2560         (JSC::B3::Air::Liveness::Iterable::end): Deleted.
2561         (JSC::B3::Air::Liveness::Iterable::contains): Deleted.
2562         (JSC::B3::Air::Liveness::liveAtHead): Deleted.
2563         (JSC::B3::Air::Liveness::liveAtTail): Deleted.
2564         (JSC::B3::Air::Liveness::workset): Deleted.
2565
2566 2017-03-25  Filip Pizlo  <fpizlo@apple.com>
2567
2568         Air::Liveness shouldn't need HashSets
2569         https://bugs.webkit.org/show_bug.cgi?id=170102
2570
2571         Reviewed by Yusuke Suzuki.
2572
2573         This converts Air::Liveness<> to no longer use HashSets or BitVectors. This turns out to be
2574         easy because it's cheap enough to do a sorted merge of the things being added to liveAtHead and
2575         the things in the predecessors' liveAtTail. This turns out to be faster - it's a 2% overall
2576         compile time progression on WasmBench.
2577
2578         * b3/B3LowerToAir.cpp:
2579         (JSC::B3::Air::LowerToAir::lower): Add a FIXME unrelated to this patch.
2580         * b3/air/AirLiveness.h:
2581         (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
2582         (JSC::B3::Air::AbstractLiveness::LocalCalc::LocalCalc):
2583         (JSC::B3::Air::AbstractLiveness::rawLiveAtHead):
2584         (JSC::B3::Air::AbstractLiveness::liveAtHead):
2585         (JSC::B3::Air::AbstractLiveness::liveAtTail):
2586         * b3/air/AirTmp.h:
2587         (JSC::B3::Air::Tmp::bank):
2588         (JSC::B3::Air::Tmp::tmpIndex):
2589         * dfg/DFGStoreBarrierClusteringPhase.cpp:
2590
2591 2017-03-26  Filip Pizlo  <fpizlo@apple.com>
2592
2593         Air should use RegisterSet for RegLiveness
2594         https://bugs.webkit.org/show_bug.cgi?id=170108
2595
2596         Reviewed by Yusuke Suzuki.
2597
2598         The biggest change here is the introduction of the new RegLiveness class. This is a
2599         drop-in replacement for the old RegLiveness, which was a specialization of
2600         AbstractLiveness<>, but it's about 30% faster. It gets its speed boost from just using
2601         sets everywhere, which is efficient for registers since RegisterSet is just two (on
2602         x86-64) or three 32-bit (on ARM64) statically allocated words. This looks like a 1%
2603         compile time progression on WasmBench.
2604
2605         * CMakeLists.txt:
2606         * JavaScriptCore.xcodeproj/project.pbxproj:
2607         * b3/B3TimingScope.cpp: Records phase timing totals.
2608         (JSC::B3::TimingScope::TimingScope):
2609         (JSC::B3::TimingScope::~TimingScope):
2610         * b3/B3TimingScope.h:
2611         * b3/air/AirAllocateRegistersByGraphColoring.cpp:
2612         (JSC::B3::Air::allocateRegistersByGraphColoring):
2613         * b3/air/AirLiveness.h: Move code around and rename a bit to make it more like RegLiveness; in particular we want the `iterator` to be called `iterator` not `Iterator`, and we want it to be internal to its iterable. Also rename this template to Liveness, to match the header filename.
2614         (JSC::B3::Air::Liveness::Liveness):
2615         (JSC::B3::Air::Liveness::LocalCalc::LocalCalc):
2616         (JSC::B3::Air::Liveness::LocalCalc::Iterable::Iterable):
2617         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::iterator):
2618         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator++):
2619         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator*):
2620         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator==):
2621         (JSC::B3::Air::Liveness::LocalCalc::Iterable::iterator::operator!=):
2622         (JSC::B3::Air::Liveness::LocalCalc::Iterable::begin):
2623         (JSC::B3::Air::Liveness::LocalCalc::Iterable::end):
2624         (JSC::B3::Air::Liveness::Iterable::Iterable):
2625         (JSC::B3::Air::Liveness::Iterable::iterator::iterator):
2626         (JSC::B3::Air::RegLivenessAdapter::RegLivenessAdapter): Deleted.
2627         (JSC::B3::Air::RegLivenessAdapter::numIndices): Deleted.
2628         (JSC::B3::Air::RegLivenessAdapter::acceptsBank): Deleted.
2629         (JSC::B3::Air::RegLivenessAdapter::acceptsRole): Deleted.
2630         (JSC::B3::Air::RegLivenessAdapter::valueToIndex): Deleted.
2631         (JSC::B3::Air::RegLivenessAdapter::indexToValue): Deleted.
2632         (JSC::B3::Air::AbstractLiveness::AbstractLiveness): Deleted.
2633         (JSC::B3::Air::AbstractLiveness::LocalCalc::LocalCalc): Deleted.
2634         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::Iterator): Deleted.
2635         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator++): Deleted.
2636         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator*): Deleted.
2637         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator==): Deleted.
2638         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterator::operator!=): Deleted.
2639         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::Iterable): Deleted.
2640         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::begin): Deleted.
2641         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::end): Deleted.
2642         (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::contains): Deleted.
2643         (JSC::B3::Air::AbstractLiveness::LocalCalc::live): Deleted.
2644         (JSC::B3::Air::AbstractLiveness::LocalCalc::isLive): Deleted.
2645         (JSC::B3::Air::AbstractLiveness::LocalCalc::execute): Deleted.
2646         (JSC::B3::Air::AbstractLiveness::rawLiveAtHead): Deleted.
2647         (JSC::B3::Air::AbstractLiveness::Iterable::Iterable): Deleted.
2648         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::iterator): Deleted.
2649         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator*): Deleted.
2650         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator++): Deleted.
2651         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator==): Deleted.
2652         (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator!=): Deleted.
2653         (JSC::B3::Air::AbstractLiveness::Iterable::begin): Deleted.
2654         (JSC::B3::Air::AbstractLiveness::Iterable::end): Deleted.
2655         (JSC::B3::Air::AbstractLiveness::Iterable::contains): Deleted.
2656         (JSC::B3::Air::AbstractLiveness::liveAtHead): Deleted.
2657         (JSC::B3::Air::AbstractLiveness::liveAtTail): Deleted.
2658         (JSC::B3::Air::AbstractLiveness::workset): Deleted.
2659         * b3/air/AirLogRegisterPressure.cpp:
2660         * b3/air/AirLowerAfterRegAlloc.cpp:
2661         * b3/air/AirRegLiveness.cpp: Added.
2662         (JSC::B3::Air::RegLiveness::RegLiveness):
2663         (JSC::B3::Air::RegLiveness::~RegLiveness):
2664         (JSC::B3::Air::RegLiveness::LocalCalc::execute):
2665         * b3/air/AirRegLiveness.h: Added.
2666         (JSC::B3::Air::RegLiveness::LocalCalc::LocalCalc):
2667         (JSC::B3::Air::RegLiveness::LocalCalc::live):
2668         (JSC::B3::Air::RegLiveness::LocalCalc::isLive):
2669         (JSC::B3::Air::RegLiveness::liveAtHead):
2670         (JSC::B3::Air::RegLiveness::liveAtTail):
2671         * b3/air/AirReportUsedRegisters.cpp:
2672         * jit/RegisterSet.h:
2673         (JSC::RegisterSet::add):
2674         (JSC::RegisterSet::remove):
2675         (JSC::RegisterSet::contains):
2676         (JSC::RegisterSet::subsumes):
2677         (JSC::RegisterSet::iterator::iterator):
2678         (JSC::RegisterSet::iterator::operator*):
2679         (JSC::RegisterSet::iterator::operator++):
2680         (JSC::RegisterSet::iterator::operator==):
2681         (JSC::RegisterSet::iterator::operator!=):
2682         (JSC::RegisterSet::begin):
2683         (JSC::RegisterSet::end):
2684
2685 2017-03-25  Filip Pizlo  <fpizlo@apple.com>
2686
2687         Fix wasm by returning after we do TLS.
2688
2689         Rubber stamped by Keith Miller.
2690
2691         * jit/AssemblyHelpers.h:
2692         (JSC::AssemblyHelpers::storeWasmContext):
2693
2694 2017-03-24  Mark Lam  <mark.lam@apple.com>
2695
2696         Add some instrumentation in Heap::resumeThePeriphery() to help debug an issue.
2697         https://bugs.webkit.org/show_bug.cgi?id=170086
2698         <rdar://problem/31253673>
2699
2700         Reviewed by Saam Barati.
2701
2702         Adding some instrumentation in Heap::resumeThePeriphery() to dump some Heap state
2703         just before we RELEASE_ASSERT_NOT_REACHED.
2704
2705         * heap/Heap.cpp:
2706         (JSC::Heap::resumeThePeriphery):
2707
2708 2017-03-24  JF Bastien  <jfbastien@apple.com>
2709
2710         WebAssembly: store state in TLS instead of on VM
2711         https://bugs.webkit.org/show_bug.cgi?id=169611
2712
2713         Reviewed by Filip Pizlo.
2714
2715         Using thread-local storage instead of VM makes code more position
2716         independent. We used to store the WebAssembly top Instance (the
2717         latest one in the call stack) on VM, now we instead store it in
2718         TLS. This top Instance is used to access a bunch of state such as
2719         Memory location, size, table (for call_indirect), etc.
2720
2721         Instead of calling it "top", which is confusing, we now just call
2722         it WasmContext.
2723
2724         Making the code PIC means future patches will be able to
2725         postMessage and structured clone into IDB without having to
2726         recompile the code. This wasn't possible before because we
2727         hard-coded the address of VM at compilation time. That doesn't
2728         work between workers, and doesn't work across reloads (which IDB
2729         is intended to do).
2730
2731         It'll also potentially make code faster once we start tuning
2732         what's in TLS, what's in which of the 4 free slots, and what's in
2733         pinned registers. I'm leaving this tuning for later because
2734         there's lower lying fruit for us to pick.
2735
2736         * CMakeLists.txt:
2737         * JavaScriptCore.xcodeproj/project.pbxproj:
2738         * assembler/AbstractMacroAssembler.h:
2739         * assembler/AllowMacroScratchRegisterUsageIf.h: Copied from assembler/AllowMacroScratchRegisterUsage.h.
2740         (JSC::AllowMacroScratchRegisterUsageIf::AllowMacroScratchRegisterUsageIf):
2741         (JSC::AllowMacroScratchRegisterUsageIf::~AllowMacroScratchRegisterUsageIf):
2742         * assembler/MacroAssembler.h:
2743         (JSC::MacroAssembler::storeToTLSPtr): we previously didn't have
2744         the code required to store to TLS, only to load
2745         * assembler/MacroAssemblerARM64.h:
2746         (JSC::MacroAssemblerARM64::loadFromTLSPtrNeedsMacroScratchRegister):
2747         (JSC::MacroAssemblerARM64::storeToTLS32):
2748         (JSC::MacroAssemblerARM64::storeToTLS64):
2749         (JSC::MacroAssemblerARM64::storeToTLSPtrNeedsMacroScratchRegister):
2750         * assembler/MacroAssemblerX86Common.h:
2751         (JSC::MacroAssemblerX86Common::loadFromTLSPtrNeedsMacroScratchRegister):
2752         (JSC::MacroAssemblerX86Common::storeToTLS32):
2753         (JSC::MacroAssemblerX86Common::storeToTLSPtrNeedsMacroScratchRegister):
2754         * assembler/MacroAssemblerX86_64.h:
2755         (JSC::MacroAssemblerX86_64::loadFromTLS64): was loading 32-bit instead of 64-bit
2756         (JSC::MacroAssemblerX86_64::storeToTLS64):
2757         * assembler/X86Assembler.h:
2758         (JSC::X86Assembler::movl_rm):
2759         (JSC::X86Assembler::movq_rm):
2760         * b3/testb3.cpp:
2761         (JSC::B3::testFastTLSLoad):
2762         (JSC::B3::testFastTLSStore):
2763         (JSC::B3::run):
2764         * jit/AssemblyHelpers.h:
2765         (JSC::AssemblyHelpers::loadWasmContext):
2766         (JSC::AssemblyHelpers::storeWasmContext):
2767         (JSC::AssemblyHelpers::loadWasmContextNeedsMacroScratchRegister):
2768         (JSC::AssemblyHelpers::storeWasmContextNeedsMacroScratchRegister):
2769         * jit/Repatch.cpp:
2770         (JSC::webAssemblyOwner):
2771         * jit/ThunkGenerators.cpp:
2772         (JSC::throwExceptionFromWasmThunkGenerator):
2773         * runtime/Options.h:
2774         * runtime/VM.cpp:
2775         (JSC::VM::VM):
2776         * runtime/VM.h:
2777         * wasm/WasmB3IRGenerator.cpp:
2778         (JSC::Wasm::loadWasmContext):
2779         (JSC::Wasm::storeWasmContext):
2780         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
2781         (JSC::Wasm::getMemoryBaseAndSize):
2782         (JSC::Wasm::restoreWebAssemblyGlobalState):
2783         (JSC::Wasm::createJSToWasmWrapper):
2784         (JSC::Wasm::parseAndCompile):
2785         * wasm/WasmBinding.cpp:
2786         (JSC::Wasm::materializeImportJSCell):
2787         (JSC::Wasm::wasmToJs):
2788         (JSC::Wasm::wasmToWasm):
2789         * wasm/WasmContext.cpp: Added.
2790         (JSC::loadWasmContext):
2791         (JSC::storeWasmContext):
2792         * wasm/WasmContext.h: Added. Replaces "top" JSWebAssemblyInstance.
2793         * wasm/js/WebAssemblyFunction.cpp:
2794         (JSC::callWebAssemblyFunction):
2795         * wasm/js/WebAssemblyInstanceConstructor.h:
2796
2797 2017-03-24  JF Bastien  <jfbastien@apple.com>
2798
2799         WebAssembly: spec-tests/memory.wast.js fails in debug
2800         https://bugs.webkit.org/show_bug.cgi?id=169794
2801
2802         Reviewed by Keith Miller.
2803
2804         The failure was due to empty memories (with maximum size 0). Those
2805         only occur in tests and in code that's trying to trip us. This
2806         patch adds memory mode "none" which represents no memory. It can
2807         work with either bounds checked or signaling code because it never
2808         contains loads and stores.
2809
2810         The spec tests which were failing did the following:
2811             > (module (memory (data)) (func (export "memsize") (result i32) (current_memory)))
2812             > (assert_return (invoke "memsize") (i32.const 0))
2813             > (module (memory (data "")) (func (export "memsize") (result i32) (current_memory)))
2814             > (assert_return (invoke "memsize") (i32.const 0))
2815             > (module (memory (data "x")) (func (export "memsize") (result i32) (current_memory)))
2816             > (assert_return (invoke "memsize") (i32.const 1))
2817
2818         * wasm/WasmB3IRGenerator.cpp:
2819         (JSC::Wasm::B3IRGenerator::memoryKind):
2820         * wasm/WasmMemory.cpp:
2821         (JSC::Wasm::tryGetFastMemory):
2822         (JSC::Wasm::releaseFastMemory):
2823         (JSC::Wasm::Memory::Memory):
2824         (JSC::Wasm::Memory::createImpl):
2825         (JSC::Wasm::Memory::create):
2826         (JSC::Wasm::Memory::grow):
2827         (JSC::Wasm::Memory::makeString):
2828         * wasm/WasmMemory.h:
2829         * wasm/WasmMemoryInformation.cpp:
2830         (JSC::Wasm::MemoryInformation::MemoryInformation):
2831         * wasm/js/JSWebAssemblyCodeBlock.cpp:
2832         (JSC::JSWebAssemblyCodeBlock::isSafeToRun):
2833         * wasm/js/JSWebAssemblyModule.cpp:
2834         (JSC::JSWebAssemblyModule::codeBlock):
2835         (JSC::JSWebAssemblyModule::finishCreation):
2836         * wasm/js/JSWebAssemblyModule.h:
2837         (JSC::JSWebAssemblyModule::codeBlock):
2838         (JSC::JSWebAssemblyModule::codeBlockFor):
2839
2840 2017-03-24  Mark Lam  <mark.lam@apple.com>
2841
2842         Array memcpy'ing fast paths should check if we're having a bad time if they cannot handle it.
2843         https://bugs.webkit.org/show_bug.cgi?id=170064
2844         <rdar://problem/31246098>
2845
2846         Reviewed by Geoffrey Garen.
2847
2848         * runtime/ArrayPrototype.cpp:
2849         (JSC::arrayProtoPrivateFuncConcatMemcpy):
2850         * runtime/JSArray.cpp:
2851         (JSC::JSArray::fastSlice):
2852
2853 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2854
2855         [JSC] Use jsNontrivialString agressively for ToString(Int52)
2856         https://bugs.webkit.org/show_bug.cgi?id=170002
2857
2858         Reviewed by Sam Weinig.
2859
2860         We use the same logic used for Int32 to use jsNontvirialString.
2861         After single character check, produced string is always longer than 1.
2862         Thus, we can use jsNontrivialString.
2863
2864         * runtime/NumberPrototype.cpp:
2865         (JSC::int52ToString):
2866
2867 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2868
2869         [JSC] Use WeakRandom for SamplingProfiler interval fluctuation
2870         https://bugs.webkit.org/show_bug.cgi?id=170045
2871
2872         Reviewed by Mark Lam.
2873
2874         It is unnecessary to use cryptographicallyRandomNumber for SamplingProfiler
2875         interval fluctuation. Use WeakRandom instead.
2876
2877         * runtime/SamplingProfiler.cpp:
2878         (JSC::SamplingProfiler::SamplingProfiler):
2879         (JSC::SamplingProfiler::timerLoop):
2880         * runtime/SamplingProfiler.h:
2881
2882 2017-03-23  Mark Lam  <mark.lam@apple.com>
2883
2884         Array.prototype.splice behaves incorrectly when the VM is "having a bad time".
2885         https://bugs.webkit.org/show_bug.cgi?id=170025
2886         <rdar://problem/31228679>
2887
2888         Reviewed by Saam Barati.
2889
2890         * runtime/ArrayPrototype.cpp:
2891         (JSC::copySplicedArrayElements):
2892         (JSC::arrayProtoFuncSplice):
2893
2894 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2895
2896         [JSC][DFG] Make addShouldSpeculateAnyInt more conservative to avoid regression caused by Double <-> Int52 conversions
2897         https://bugs.webkit.org/show_bug.cgi?id=169998
2898
2899         Reviewed by Saam Barati.
2900
2901         Double <-> Int52 and JSValue <-> Int52 conversions are not so cheap. Thus, Int52Rep is super carefully emitted.
2902         We make addShouldSpeculateAnyInt more conservative to avoid regressions caused by the above conversions.
2903         We select ArithAdd(Int52, Int52) only when this calculation is beneficial compared to added Int52Rep conversions.
2904
2905         This patch tighten the conditions of addShouldSpeculateAnyInt.
2906
2907         1. Honor DoubleConstant.
2908
2909         When executing imaging-darkroom, we have a thing like that,
2910
2911             132:< 2:loc36> DoubleConstant(Double|UseAsOther, AnyIntAsDouble, Double: 4607182418800017408, 1.000000, bc#114)
2912             1320:< 1:loc38>        Int52Rep(Check:Int32:@82, Int52|PureInt, Int32, Exits, bc#114)
2913             1321:< 1:loc39>        Int52Constant(Int52|PureInt, Boolint32Nonboolint32Int52, Double: 4607182418800017408, 1.000000, bc#114)
2914             133:<!3:loc39> ArithSub(Int52Rep:@1320<Int52>, Int52Rep:@1321<Int52>, Int52|MustGen, Int52, CheckOverflow, Exits, bc#114)
2915
2916         The LHS of ArithSub says predicting Boolint32, and the rhs says AnyIntAsDouble. Thus we select ArithSub(Int52, Int52) instead
2917         of ArithSub(Double, Double). However, it soon causes OSR exits. In imaging-darkroom, LHS's Int32 prediction will be broken.
2918         While speculating Int32 in the above situation is reasonable approach since the given LHS says predicting Int32, this causes
2919         severe performance regression.
2920
2921         Previously, we always select ArithSub(Double, Double). So accidentally, we do not encounter this misprediction issue.
2922
2923         One thing can be found that we have DoubleConstant in the RHS. It means that we have `1.0` instead of `1` in the code.
2924         We can see the code like `lhs - 1.0` instead of `lhs - 1` in imaging-darkroom. It offers good information that lhs and
2925         the resulting value would be double. Handling the above ArithSub in double seems more appropriate rather than handling
2926         it in Int52.
2927
2928         So, in this patch, we honor DoubleConstant. If we find DoubleConstant on one operand, we give up selecting
2929         Arith[Sub,Add](Int52, Int52). This change removes OSR exits occurr in imaging-darkroom right now.
2930
2931         2. Two Int52Rep(Double) conversions are not desirable.
2932
2933         We allow AnyInt ArithAdd only when the one operand of the binary operation should be speculated AnyInt. It is a bit conservative
2934         decision. This is because Double to Int52 conversion is not so cheap. Frequent back-and-forth conversions between Double and Int52
2935         rather hurt the performance. If the one operand of the operation is already Int52, the cost for constructing ArithAdd becomes
2936         cheap since only one Double to Int52 conversion could be required.
2937         This recovers some regression in assorted tests while keeping kraken crypto improvements.
2938
2939         3. Avoid frequent Int52 to JSValue conversions.
2940
2941         Int52 to JSValue conversion is not so cheap. Thus, we would like to avoid such situations. So, in this patch, we allow
2942         Arith(Int52, Int52) with AnyIntAsDouble operand only when the node is used as number. By doing so, we avoid the case like,
2943         converting Int52, performing ArithAdd, and soon converting back to JSValue.
2944
2945         The above 3 changes recover the regression measured in microbenchmarks/int52-back-and-forth.js and assorted benchmarks.
2946         And still it keeps kraken crypto improvements.
2947
2948                                                    baseline                  patched
2949
2950         imaging-darkroom                       201.112+-3.192      ^     189.532+-2.883         ^ definitely 1.0611x faster
2951         stanford-crypto-pbkdf2                 103.953+-2.325            100.926+-2.396           might be 1.0300x faster
2952         stanford-crypto-sha256-iterative        35.103+-1.071      ?      36.049+-1.143         ? might be 1.0270x slower
2953
2954         * dfg/DFGGraph.h:
2955         (JSC::DFG::Graph::addShouldSpeculateAnyInt):
2956
2957 == Rolled over to ChangeLog-2017-03-23 ==