Source/JavaScriptCore/ChangeLog

   1 2016-11-15  Joseph Pecoraro  <pecoraro@apple.com>
   2
   3         Web Inspector: Remove unused and untested Page.setTouchEmulationEnabled command
   4         https://bugs.webkit.org/show_bug.cgi?id=164793
   5
   6         Reviewed by Matt Baker.
   7
   8         * inspector/protocol/Page.json:
   9
  10 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
  11
  12         Unreviewed, build fix for Windows debug build after r208738
  13         https://bugs.webkit.org/show_bug.cgi?id=164727
  14
  15         This static member variable can be touched outside of the JSC project
  16         since inlined MacroAssembler member functions read / write it.
  17         So it should be exported.
  18
  19         * assembler/MacroAssemblerX86Common.h:
  20
  21 2016-11-15  Joseph Pecoraro  <pecoraro@apple.com>
  22
  23         Web Inspector: inspector/worker/debugger-pause.html fails on WebKit1
  24         https://bugs.webkit.org/show_bug.cgi?id=164787
  25
  26         Reviewed by Timothy Hatcher.
  27
  28         * inspector/agents/InspectorDebuggerAgent.cpp:
  29         (Inspector::InspectorDebuggerAgent::cancelPauseOnNextStatement):
  30         Clear this DebuggerAgent state when we resume.
  31
  32 2016-11-15  Filip Pizlo  <fpizlo@apple.com>
  33
  34         It should be possible to disable concurrent GC timeslicing
  35         https://bugs.webkit.org/show_bug.cgi?id=164788
  36
  37         Reviewed by Saam Barati.
  38
  39         Collector timeslicing means that the collector will try to pause once every 2ms. This is
  40         great because it throttles the mutator and prevents it from outpacing the collector. But
  41         it reduces some of the efficacy of the collectContinuously=true configuration: while
  42         it's great that collecting continuously means that the collector will also pause more
  43         frequently and so it will test the pausing code, it also means that the collector will
  44         spend less time running concurrently. The primary purpose of collectContinuously is to
  45         maximize the amount of time that the collector is running concurrently to the mutator to
  46         maximize the likelihood that a race will cause a detectable error.
  47
  48         This adds an option to disable collector timeslicing (useCollectorTimeslicing=false).
  49         The idea is that we will usually use this in conjunction with collectContinuously=true
  50         to find race conditions during marking, but we can also use the two options
  51         independently to focus our testing on other things.
  52
  53         * heap/Heap.cpp:
  54         (JSC::Heap::markToFixpoint):
  55         * heap/SlotVisitor.cpp:
  56         (JSC::SlotVisitor::drainInParallel): We should have added this helper ages ago.
  57         * heap/SlotVisitor.h:
  58         * runtime/Options.h:
  59
  60 2016-11-15  Filip Pizlo  <fpizlo@apple.com>
  61
  62         The concurrent GC should have a timeslicing controller
  63         https://bugs.webkit.org/show_bug.cgi?id=164783
  64
  65         Reviewed by Geoffrey Garen.
  66
  67         This adds a simple control system for deciding when the collector should let the mutator run
  68         and when it should stop the mutator. We definitely have to stop the mutator during certain
  69         collector phases, but during marking - which takes the most time - we can go either way.
  70         Normally we want to let the mutator run, but if the heap size starts to grow then we have to
  71         stop the mutator just to make sure it doesn't get too far ahead of the collector. That could
  72         lead to memory exhaustion, so it's better to just stop in that case.
  73
  74         The controller tries to never stop the mutator for longer than short timeslices. It slices on
  75         a 2ms period (configurable via Options). The amount of that period that the collector spends
  76         with the mutator stopped is determined by the fraction of the collector's concurrent headroom
  77         that has been allocated over. The headroom is currently configured at 50% of what was
  78         allocated before the collector started.
  79
  80         This moves a bunch of parameters into Options so that it's easier to play with different
  81         configurations.
  82
  83         I tried these different values for the period:
  84
  85         1ms: 30% worse than 2ms on splay-latency.
  86         2ms: best score on splay-latency: the tick time above the 99.5% percentile is <2ms.
  87         3ms: 40% worse than 2ms on splay-latency.
  88         4ms: 40% worse than 2ms on splay-latency.
  89
  90         I also tried 100% headroom as an alternate to 50% and found it to be a worse.
  91
  92         This patch is a 2x improvement on splay-latency with the default parameters and concurrent GC
  93         enabled. Prior to this change, the GC didn't have a good bound on its pause times, which
  94         would cause these problems. Concurrent GC is now 5.6x better on splay-latency than no
  95         concurrent GC.
  96
  97         * heap/Heap.cpp:
  98         (JSC::Heap::ResumeTheWorldScope::ResumeTheWorldScope):
  99         (JSC::Heap::markToFixpoint):
 100         (JSC::Heap::collectInThread):
 101         * runtime/Options.h:
 102
 103 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
 104
 105         Unreviewed, build fix for CLoop after r208738
 106         https://bugs.webkit.org/show_bug.cgi?id=164727
 107
 108         * jsc.cpp:
 109         (WTF::DOMJITFunctionObject::unsafeFunction):
 110         (WTF::DOMJITFunctionObject::finishCreation):
 111
 112 2016-11-15  Mark Lam  <mark.lam@apple.com>
 113
 114         The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
 115         https://bugs.webkit.org/show_bug.cgi?id=164781
 116         <rdar://problem/28418590>
 117
 118         Reviewed by Geoffrey Garen and Michael Saboff.
 119
 120         * jsc.cpp:
 121         (functionSetImpureGetterDelegate):
 122
 123 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
 124
 125         [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
 126         https://bugs.webkit.org/show_bug.cgi?id=164727
 127
 128         Reviewed by Filip Pizlo.
 129
 130         While CallDOMGetter can use macro assembler scratch registers, we previiously
 131         assumed that CheckDOM code generator does not use macro assembler scratch registers.
 132         It is currently true in x86 environment. But it is not true in the other environments.
 133
 134         We should not limit DOMJIT::Patchpoint's functionality in such a way. We should allow
 135         arbitrary macro assembler operations inside the DOMJIT::Patchpoint. This patch allows
 136         CheckDOM to use macro assembler scratch registers.
 137
 138         * ftl/FTLLowerDFGToB3.cpp:
 139         (JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
 140         * jsc.cpp:
 141         (WTF::DOMJITFunctionObject::DOMJITFunctionObject):
 142         (WTF::DOMJITFunctionObject::createStructure):
 143         (WTF::DOMJITFunctionObject::create):
 144         (WTF::DOMJITFunctionObject::unsafeFunction):
 145         (WTF::DOMJITFunctionObject::safeFunction):
 146         (WTF::DOMJITFunctionObject::checkDOMJITNode):
 147         (WTF::DOMJITFunctionObject::finishCreation):
 148         (GlobalObject::finishCreation):
 149         (functionCreateDOMJITFunctionObject):
 150
 151 2016-11-14  Geoffrey Garen  <ggaren@apple.com>
 152
 153         CodeCache should stop pretending to cache builtins
 154         https://bugs.webkit.org/show_bug.cgi?id=164750
 155
 156         Reviewed by Saam Barati.
 157
 158         We were passing JSParserBuiltinMode to all CodeCache functions, but the
 159         passed-in value was always NotBuiltin.
 160
 161         Let's stop passing it.
 162
 163         * parser/SourceCodeKey.h:
 164         (JSC::SourceCodeFlags::SourceCodeFlags):
 165         (JSC::SourceCodeKey::SourceCodeKey):
 166         * runtime/CodeCache.cpp:
 167         (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
 168         (JSC::CodeCache::getUnlinkedProgramCodeBlock):
 169         (JSC::CodeCache::getUnlinkedGlobalEvalCodeBlock):
 170         (JSC::CodeCache::getUnlinkedModuleProgramCodeBlock):
 171         (JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):
 172         * runtime/CodeCache.h:
 173         (JSC::generateUnlinkedCodeBlock):
 174         * runtime/JSGlobalObject.cpp:
 175         (JSC::JSGlobalObject::createProgramCodeBlock):
 176         (JSC::JSGlobalObject::createLocalEvalCodeBlock):
 177         (JSC::JSGlobalObject::createGlobalEvalCodeBlock):
 178         (JSC::JSGlobalObject::createModuleProgramCodeBlock):
 179
 180 2016-11-15  Filip Pizlo  <fpizlo@apple.com>
 181
 182         REGRESSION (r208711-r208722): ASSERTION FAILED: hasInlineStorage()
 183         https://bugs.webkit.org/show_bug.cgi?id=164775
 184
 185         Reviewed by Mark Lam and Keith Miller.
 186
 187         We were calling inlineStorage() which asserts that inline storage is not empty. But we
 188         were calling it in a context where it could be empty and that's fine. So, we now call
 189         inlineStorageUnsafe().
 190
 191         * runtime/JSObject.h:
 192         (JSC::JSFinalObject::JSFinalObject):
 193
 194 2016-11-14  Csaba Osztrogonác  <ossy@webkit.org>
 195
 196         [ARM] Unreviewed buildfix after r208720.
 197
 198         * assembler/MacroAssemblerARM.h:
 199         (JSC::MacroAssemblerARM::storeFence): Stub function copied from MacroAssemblerARMv7.h.
 200
 201 2016-11-14  Caitlin Potter  <caitp@igalia.com>
 202
 203         [JSC] do not reference AwaitExpression Promises in async function Promise chain
 204         https://bugs.webkit.org/show_bug.cgi?id=164753
 205
 206         Reviewed by Yusuke Suzuki.
 207
 208         Previously, long-running async functions which contained many AwaitExpressions
 209         would allocate and retain references to intermediate Promise objects for each `await`,
 210         resulting in a memory leak.
 211
 212         To mitigate this leak, a reference to the original Promise (and its resolve and reject
 213         functions) associated with the async function are kept, and passed to each call to
 214         @asyncFunctionResume, while intermediate Promises are discarded. This is done by adding
 215         a new Register to the BytecodeGenerator to hold the PromiseCapability object associated
 216         with an async function wrapper. The capability is used to reject the Promise if an
 217         exception is thrown during parameter initialization, and is used to store the resulting
 218         value once the async function has terminated.
 219
 220         * builtins/AsyncFunctionPrototype.js:
 221         (globalPrivate.asyncFunctionResume):
 222         * bytecompiler/BytecodeGenerator.cpp:
 223         (JSC::BytecodeGenerator::BytecodeGenerator):
 224         * bytecompiler/BytecodeGenerator.h:
 225         (JSC::BytecodeGenerator::promiseCapabilityRegister):
 226         * bytecompiler/NodesCodegen.cpp:
 227         (JSC::FunctionNode::emitBytecode):
 228
 229 2016-11-14  Joseph Pecoraro  <pecoraro@apple.com>
 230
 231         Web Inspector: Worker debugging should pause all targets and view call frames in all targets
 232         https://bugs.webkit.org/show_bug.cgi?id=164305
 233         <rdar://problem/29056192>
 234
 235         Reviewed by Timothy Hatcher.
 236
 237         * inspector/InjectedScriptSource.js:
 238         (InjectedScript.prototype._propertyDescriptors):
 239         Accessing __proto__ does a ToThis(...) conversion on the receiver.
 240         In the case of GlobalObjects (such as WorkerGlobalScope when paused)
 241         this would return undefined and throw an exception. We can use
 242         Object.getPrototypeOf to avoid that conversion and possible error.
 243
 244         * inspector/protocol/Debugger.json:
 245         Provide a new way to effectively `resume` + `pause` immediately.
 246         This must be implemented on the backend to correctly synchronize
 247         the resuming and pausing.
 248
 249         * inspector/agents/InspectorDebuggerAgent.h:
 250         * inspector/agents/InspectorDebuggerAgent.cpp:
 251         (Inspector::InspectorDebuggerAgent::continueUntilNextRunLoop):
 252         Treat this as `resume` and `pause`. Resume now, and trigger
 253         a pause if the VM becomes idle and we didn't pause before then
 254         (such as hitting a breakpoint after we resumed).
 255
 256         (Inspector::InspectorDebuggerAgent::pause):
 257         (Inspector::InspectorDebuggerAgent::resume):
 258         (Inspector::InspectorDebuggerAgent::schedulePauseOnNextStatement):
 259         (Inspector::InspectorDebuggerAgent::cancelPauseOnNextStatement):
 260         Clean up and correct pause on next statement logic.
 261
 262         (Inspector::InspectorDebuggerAgent::registerIdleHandler):
 263         (Inspector::InspectorDebuggerAgent::willStepAndMayBecomeIdle):
 264         (Inspector::InspectorDebuggerAgent::didBecomeIdle):
 265         (Inspector::InspectorDebuggerAgent::didBecomeIdleAfterStepping): Deleted.
 266         The idle handler may now also trigger a pause in the case
 267         where continueUntilNextRunLoop resumed and wants to pause.
 268
 269         (Inspector::InspectorDebuggerAgent::didPause):
 270         Eliminate the useless didPause. The DOMDebugger was keeping track
 271         of its own state that was worse then the state in DebuggerAgent.
 272
 273 2016-11-14  Filip Pizlo  <fpizlo@apple.com>
 274
 275         Unreviewed, fix cloop.
 276
 277         * runtime/JSCellInlines.h:
 278
 279 2016-11-14  Filip Pizlo  <fpizlo@apple.com>
 280
 281         The GC should be optionally concurrent and disabled by default
 282         https://bugs.webkit.org/show_bug.cgi?id=164454
 283
 284         Reviewed by Geoffrey Garen.
 285
 286         This started out as a patch to have the GC scan the stack at the end, and then the
 287         outage happened and I decided to pick a more aggresive target: give the GC a concurrent
 288         mode that can be enabled at runtime, and whose only effect is that it turns on the
 289         ResumeTheWorldScope. This gives our GC a really intuitive workflow: by default, the GC
 290         thread is running solo with the world stopped and the parallel markers converged and
 291         waiting. We have a parallel work scope to enable the parallel markers and now we have a
 292         ResumeTheWorldScope that will optionally resume the world and then stop it again.
 293
 294         It's easy to make a concurrent GC that always instantly crashes. I can't promise that
 295         this one won't do that when you run it. I set a specific goal: I wanted to do >10
 296         concurrent GCs in debug mode with generations, optimizing JITs, and parallel marking
 297         disabled.
 298
 299         To reach this milestone, I needed to do a bunch of stuff:
 300
 301         - The mutator needs a separate mark stack for the barrier, since it will mutate this
 302           stack concurrently to the collector's slot visitors.
 303
 304         - The use of CellState to indicate whether an object is being scanned the first time or
 305           a subsequent time was racy. It fails spectacularly when a barrier is fired at the same
 306           time as visitChildren is running or if the barrier runs at the same time as the GC
 307           marks the same object. So, I split SlotVisitor's mark stacks. It's now the case that
 308           you know why you're being scanned by looking at which stack you came off of.
 309
 310         - All of root marking must be in the collector fixpoint. I renamed markRoots to
 311           markToFixpoint. They say concurrency is hard, but the collector looks more intuitive
 312           this way. We never gained anything from forcing people to make a choice between
 313           scanning something in the fixpoint versus outside of it. Because root scanning is
 314           cheap, we can afford to do it repeatedly, which means all root scanning can now do
 315           constraint-based marking (like: I'll mark you if that thing is marked).
 316
 317         - JSObject::visitChildren's scanning of the butterfly raced with property additions,
 318           indexed storage transitions and resizing, and a bunch of miscellaneous dirty butterfly
 319           reshaping functions - like the one that flattens a dictionary and some sneaky
 320           ArrayStorage transformations. Many of these can be fixed by using store-store fences
 321           in the mutator and load-load fences in the collector. I've adopted the rule that the
 322           collector must always see either a butterfly and structure that match or a newer
 323           butterfly with an older structure, where their age is just one transition apart. This
 324           can be achieved with fences. For the cases where it breaks down, I added a lock to
 325           every JSCell. This is a full-fledged WTF lock that we sneak into two available bits in
 326           the indexingType. See the WTF ChangeLog for details.
 327
 328           The mutator fencing rules are as follows:
 329
 330           - Store-store fence before and after setting the butterfly.
 331           - Store-store fence before setting structure if you had changed the shape of the
 332             butterfly.
 333           - Store-store fence after initializing all fields in an allocation.
 334
 335         - A dictionary Structure can change in strange ways while the GC is trying to scan it.
 336           So, JSObject::visitChildren will now grab the object's structure's lock if the
 337           object's structure is a dictionary. Dictionary structures are 1:1 with their object,
 338           so this does not reduce GC parallelism (super unlikely that the GC will simultaneously
 339           scan an object from two threads).
 340
 341         - The GC can blow away a Structure's property table at any time. As a small consolation,
 342           it's now holding the Structure's lock when it does so. But there was tons of code in
 343           Structure that uses DeferGC to prevent the GC from blowing away the property table.
 344           This doesn't work with concurrent GC, since DeferGC only means that the GC won't run
 345           its safepoint (i.e. stop-the-world code) in the DeferGC region. It will still do
 346           marking and it was the Structure::visitChildren that would delete the table. It turns
 347           out that Structure's reliance on the property table not being deleted was the product
 348           of code rot. We already had functions that would materialize the table on demand. We
 349           were simply making the mistake of saying:
 350
 351               structure->materializePropertyMap();
 352               ...
 353               structure->propertyTable()->things
 354
 355           Instead of saying:
 356
 357               PropertyTable* table = structure->ensurePropertyTable();
 358               ...
 359               table->things
 360
 361           Switching the code to use the latter idiom allowed me to simplify the code a lot while
 362           fixing the race.
 363
 364         - The LLInt's get_by_val handling was broken because the indexing shape constants were
 365           wrong. Once I started putting more things into the IndexingType, that started causing
 366           crashes for me. So I fixed LLInt. That turned out to be a lot of work, since that code
 367           had rotted in subtle ways.
 368
 369         This is a speed-up in SunSpider, probably because of the LLInt fix. This is neutral on
 370         Octane and Kraken. It's a smaller slow-down on LongSpider, but I think we can ignore
 371         that (we don't view LongSpider as an official benchmark). By default, the concurrent GC
 372         is disabled: in all of the places where it would have resumed the world to run marking
 373         concurrently to the mutator, it will just skip the resume step. When you enable
 374         concurrent GC (--useConcurrentGC=true), it can sometimes run Octane/splay to completion.
 375         It seems to perform quite well: on my machine, it improves both splay-throughput and
 376         splay-latency. It's probably unstable for other programs.
 377
 378         * API/JSVirtualMachine.mm:
 379         (-[JSVirtualMachine isOldExternalObject:]):
 380         * assembler/MacroAssemblerARMv7.h:
 381         (JSC::MacroAssemblerARMv7::storeFence):
 382         * bytecode/InlineAccess.cpp:
 383         (JSC::InlineAccess::dumpCacheSizesAndCrash):
 384         (JSC::InlineAccess::generateSelfPropertyAccess):
 385         (JSC::InlineAccess::generateArrayLength):
 386         * bytecode/ObjectAllocationProfile.h:
 387         (JSC::ObjectAllocationProfile::offsetOfInlineCapacity):
 388         (JSC::ObjectAllocationProfile::ObjectAllocationProfile):
 389         (JSC::ObjectAllocationProfile::initialize):
 390         (JSC::ObjectAllocationProfile::inlineCapacity):
 391         (JSC::ObjectAllocationProfile::clear):
 392         * bytecode/PolymorphicAccess.cpp:
 393         (JSC::AccessCase::generateWithGuard):
 394         (JSC::AccessCase::generateImpl):
 395         * dfg/DFGArrayifySlowPathGenerator.h:
 396         * dfg/DFGClobberize.h:
 397         (JSC::DFG::clobberize):
 398         * dfg/DFGOSRExitCompiler32_64.cpp:
 399         (JSC::DFG::OSRExitCompiler::compileExit):
 400         * dfg/DFGOSRExitCompiler64.cpp:
 401         (JSC::DFG::OSRExitCompiler::compileExit):
 402         * dfg/DFGOperations.cpp:
 403         * dfg/DFGPlan.cpp:
 404         (JSC::DFG::Plan::markCodeBlocks):
 405         (JSC::DFG::Plan::rememberCodeBlocks):
 406         * dfg/DFGPlan.h:
 407         * dfg/DFGSpeculativeJIT.cpp:
 408         (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
 409         (JSC::DFG::SpeculativeJIT::checkArray):
 410         (JSC::DFG::SpeculativeJIT::arrayify):
 411         (JSC::DFG::SpeculativeJIT::compileMakeRope):
 412         (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
 413         (JSC::DFG::SpeculativeJIT::compileCreateActivation):
 414         (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
 415         (JSC::DFG::SpeculativeJIT::compileSpread):
 416         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
 417         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
 418         (JSC::DFG::SpeculativeJIT::compileNewStringObject):
 419         (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
 420         (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
 421         * dfg/DFGSpeculativeJIT64.cpp:
 422         (JSC::DFG::SpeculativeJIT::compile):
 423         (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
 424         * dfg/DFGTierUpCheckInjectionPhase.cpp:
 425         (JSC::DFG::TierUpCheckInjectionPhase::run):
 426         * dfg/DFGWorklist.cpp:
 427         (JSC::DFG::Worklist::markCodeBlocks):
 428         (JSC::DFG::Worklist::rememberCodeBlocks):
 429         (JSC::DFG::markCodeBlocks):
 430         (JSC::DFG::completeAllPlansForVM):
 431         (JSC::DFG::rememberCodeBlocks):
 432         * dfg/DFGWorklist.h:
 433         * ftl/FTLAbstractHeapRepository.cpp:
 434         (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
 435         (JSC::FTL::AbstractHeapRepository::computeRangesAndDecorateInstructions):
 436         * ftl/FTLAbstractHeapRepository.h:
 437         * ftl/FTLJITCode.cpp:
 438         (JSC::FTL::JITCode::~JITCode):
 439         * ftl/FTLLowerDFGToB3.cpp:
 440         (JSC::FTL::DFG::LowerDFGToB3::compilePutStructure):
 441         (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
 442         (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
 443         (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
 444         (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
 445         (JSC::FTL::DFG::LowerDFGToB3::compileNewObject):
 446         (JSC::FTL::DFG::LowerDFGToB3::compileNewArray):
 447         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
 448         (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
 449         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayBuffer):
 450         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
 451         (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
 452         (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
 453         (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
 454         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
 455         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
 456         (JSC::FTL::DFG::LowerDFGToB3::splatWords):
 457         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
 458         (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
 459         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
 460         (JSC::FTL::DFG::LowerDFGToB3::isArrayType):
 461         (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
 462         (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
 463         (JSC::FTL::DFG::LowerDFGToB3::setButterfly):
 464         * ftl/FTLOSRExitCompiler.cpp:
 465         (JSC::FTL::compileStub):
 466         * ftl/FTLOutput.cpp:
 467         (JSC::FTL::Output::signExt32ToPtr):
 468         (JSC::FTL::Output::fence):
 469         * ftl/FTLOutput.h:
 470         * heap/CellState.h:
 471         * heap/GCSegmentedArray.h:
 472         * heap/Heap.cpp:
 473         (JSC::Heap::ResumeTheWorldScope::ResumeTheWorldScope):
 474         (JSC::Heap::ResumeTheWorldScope::~ResumeTheWorldScope):
 475         (JSC::Heap::Heap):
 476         (JSC::Heap::~Heap):
 477         (JSC::Heap::harvestWeakReferences):
 478         (JSC::Heap::finalizeUnconditionalFinalizers):
 479         (JSC::Heap::completeAllJITPlans):
 480         (JSC::Heap::markToFixpoint):
 481         (JSC::Heap::gatherStackRoots):
 482         (JSC::Heap::beginMarking):
 483         (JSC::Heap::visitConservativeRoots):
 484         (JSC::Heap::visitCompilerWorklistWeakReferences):
 485         (JSC::Heap::updateObjectCounts):
 486         (JSC::Heap::endMarking):
 487         (JSC::Heap::addToRememberedSet):
 488         (JSC::Heap::collectInThread):
 489         (JSC::Heap::stopTheWorld):
 490         (JSC::Heap::resumeTheWorld):
 491         (JSC::Heap::setGCDidJIT):
 492         (JSC::Heap::setNeedFinalize):
 493         (JSC::Heap::setMutatorWaiting):
 494         (JSC::Heap::clearMutatorWaiting):
 495         (JSC::Heap::finalize):
 496         (JSC::Heap::flushWriteBarrierBuffer):
 497         (JSC::Heap::writeBarrierSlowPath):
 498         (JSC::Heap::canCollect):
 499         (JSC::Heap::reportExtraMemoryVisited):
 500         (JSC::Heap::reportExternalMemoryVisited):
 501         (JSC::Heap::notifyIsSafeToCollect):
 502         (JSC::Heap::markRoots): Deleted.
 503         (JSC::Heap::visitExternalRememberedSet): Deleted.
 504         (JSC::Heap::visitSmallStrings): Deleted.
 505         (JSC::Heap::visitProtectedObjects): Deleted.
 506         (JSC::Heap::visitArgumentBuffers): Deleted.
 507         (JSC::Heap::visitException): Deleted.
 508         (JSC::Heap::visitStrongHandles): Deleted.
 509         (JSC::Heap::visitHandleStack): Deleted.
 510         (JSC::Heap::visitSamplingProfiler): Deleted.
 511         (JSC::Heap::visitTypeProfiler): Deleted.
 512         (JSC::Heap::visitShadowChicken): Deleted.
 513         (JSC::Heap::traceCodeBlocksAndJITStubRoutines): Deleted.
 514         (JSC::Heap::visitWeakHandles): Deleted.
 515         (JSC::Heap::flushOldStructureIDTables): Deleted.
 516         (JSC::Heap::stopAllocation): Deleted.
 517         * heap/Heap.h:
 518         (JSC::Heap::collectorSlotVisitor):
 519         (JSC::Heap::mutatorMarkStack):
 520         (JSC::Heap::mutatorShouldBeFenced):
 521         (JSC::Heap::addressOfMutatorShouldBeFenced):
 522         (JSC::Heap::slotVisitor): Deleted.
 523         (JSC::Heap::notifyIsSafeToCollect): Deleted.
 524         (JSC::Heap::barrierShouldBeFenced): Deleted.
 525         (JSC::Heap::addressOfBarrierShouldBeFenced): Deleted.
 526         * heap/MarkStack.cpp:
 527         (JSC::MarkStackArray::transferTo):
 528         * heap/MarkStack.h:
 529         * heap/MarkedAllocator.cpp:
 530         (JSC::MarkedAllocator::tryAllocateIn):
 531         * heap/MarkedBlock.cpp:
 532         (JSC::MarkedBlock::MarkedBlock):
 533         (JSC::MarkedBlock::Handle::specializedSweep):
 534         (JSC::MarkedBlock::Handle::sweep):
 535         (JSC::MarkedBlock::Handle::sweepHelperSelectMarksMode):
 536         (JSC::MarkedBlock::Handle::stopAllocating):
 537         (JSC::MarkedBlock::Handle::resumeAllocating):
 538         (JSC::MarkedBlock::aboutToMarkSlow):
 539         (JSC::MarkedBlock::Handle::didConsumeFreeList):
 540         (JSC::SetNewlyAllocatedFunctor::SetNewlyAllocatedFunctor): Deleted.
 541         (JSC::SetNewlyAllocatedFunctor::operator()): Deleted.
 542         * heap/MarkedBlock.h:
 543         * heap/MarkedSpace.cpp:
 544         (JSC::MarkedSpace::resumeAllocating):
 545         * heap/SlotVisitor.cpp:
 546         (JSC::SlotVisitor::SlotVisitor):
 547         (JSC::SlotVisitor::~SlotVisitor):
 548         (JSC::SlotVisitor::reset):
 549         (JSC::SlotVisitor::clearMarkStacks):
 550         (JSC::SlotVisitor::appendJSCellOrAuxiliary):
 551         (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
 552         (JSC::SlotVisitor::appendToMarkStack):
 553         (JSC::SlotVisitor::appendToMutatorMarkStack):
 554         (JSC::SlotVisitor::visitChildren):
 555         (JSC::SlotVisitor::donateKnownParallel):
 556         (JSC::SlotVisitor::drain):
 557         (JSC::SlotVisitor::drainFromShared):
 558         (JSC::SlotVisitor::containsOpaqueRoot):
 559         (JSC::SlotVisitor::donateAndDrain):
 560         (JSC::SlotVisitor::mergeOpaqueRoots):
 561         (JSC::SlotVisitor::dump):
 562         (JSC::SlotVisitor::clearMarkStack): Deleted.
 563         (JSC::SlotVisitor::opaqueRootCount): Deleted.
 564         * heap/SlotVisitor.h:
 565         (JSC::SlotVisitor::collectorMarkStack):
 566         (JSC::SlotVisitor::mutatorMarkStack):
 567         (JSC::SlotVisitor::isEmpty):
 568         (JSC::SlotVisitor::bytesVisited):
 569         (JSC::SlotVisitor::markStack): Deleted.
 570         (JSC::SlotVisitor::bytesCopied): Deleted.
 571         * heap/SlotVisitorInlines.h:
 572         (JSC::SlotVisitor::reportExtraMemoryVisited):
 573         (JSC::SlotVisitor::reportExternalMemoryVisited):
 574         * jit/AssemblyHelpers.cpp:
 575         (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
 576         * jit/AssemblyHelpers.h:
 577         (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
 578         (JSC::AssemblyHelpers::barrierStoreLoadFence):
 579         (JSC::AssemblyHelpers::mutatorFence):
 580         (JSC::AssemblyHelpers::storeButterfly):
 581         (JSC::AssemblyHelpers::jumpIfMutatorFenceNotNeeded):
 582         (JSC::AssemblyHelpers::emitInitializeInlineStorage):
 583         (JSC::AssemblyHelpers::emitInitializeOutOfLineStorage):
 584         (JSC::AssemblyHelpers::jumpIfBarrierStoreLoadFenceNotNeeded): Deleted.
 585         * jit/JITInlines.h:
 586         (JSC::JIT::emitArrayProfilingSiteWithCell):
 587         * jit/JITOperations.cpp:
 588         * jit/JITPropertyAccess.cpp:
 589         (JSC::JIT::emit_op_put_to_scope):
 590         (JSC::JIT::emit_op_put_to_arguments):
 591         * llint/LLIntData.cpp:
 592         (JSC::LLInt::Data::performAssertions):
 593         * llint/LowLevelInterpreter.asm:
 594         * llint/LowLevelInterpreter64.asm:
 595         * runtime/ButterflyInlines.h:
 596         (JSC::Butterfly::create):
 597         (JSC::Butterfly::createOrGrowPropertyStorage):
 598         * runtime/ConcurrentJITLock.h:
 599         (JSC::GCSafeConcurrentJITLocker::NoDefer::NoDefer): Deleted.
 600         * runtime/GenericArgumentsInlines.h:
 601         (JSC::GenericArguments<Type>::getOwnPropertySlotByIndex):
 602         (JSC::GenericArguments<Type>::putByIndex):
 603         * runtime/IndexingType.h:
 604         * runtime/JSArray.cpp:
 605         (JSC::JSArray::unshiftCountSlowCase):
 606         (JSC::JSArray::unshiftCountWithArrayStorage):
 607         * runtime/JSCell.h:
 608         (JSC::JSCell::InternalLocker::InternalLocker):
 609         (JSC::JSCell::InternalLocker::~InternalLocker):
 610         (JSC::JSCell::atomicCompareExchangeCellStateWeakRelaxed):
 611         (JSC::JSCell::atomicCompareExchangeCellStateStrong):
 612         (JSC::JSCell::indexingTypeAndMiscOffset):
 613         (JSC::JSCell::indexingTypeOffset): Deleted.
 614         * runtime/JSCellInlines.h:
 615         (JSC::JSCell::JSCell):
 616         (JSC::JSCell::finishCreation):
 617         (JSC::JSCell::indexingTypeAndMisc):
 618         (JSC::JSCell::indexingType):
 619         (JSC::JSCell::setStructure):
 620         (JSC::JSCell::callDestructor):
 621         (JSC::JSCell::lockInternalLock):
 622         (JSC::JSCell::unlockInternalLock):
 623         * runtime/JSObject.cpp:
 624         (JSC::JSObject::visitButterfly):
 625         (JSC::JSObject::visitChildren):
 626         (JSC::JSFinalObject::visitChildren):
 627         (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
 628         (JSC::JSObject::createInitialUndecided):
 629         (JSC::JSObject::createInitialInt32):
 630         (JSC::JSObject::createInitialDouble):
 631         (JSC::JSObject::createInitialContiguous):
 632         (JSC::JSObject::createArrayStorage):
 633         (JSC::JSObject::convertUndecidedToArrayStorage):
 634         (JSC::JSObject::convertInt32ToArrayStorage):
 635         (JSC::JSObject::convertDoubleToArrayStorage):
 636         (JSC::JSObject::convertContiguousToArrayStorage):
 637         (JSC::JSObject::deleteProperty):
 638         (JSC::JSObject::defineOwnIndexedProperty):
 639         (JSC::JSObject::increaseVectorLength):
 640         (JSC::JSObject::ensureLengthSlow):
 641         (JSC::JSObject::reallocateAndShrinkButterfly):
 642         (JSC::JSObject::allocateMoreOutOfLineStorage):
 643         (JSC::JSObject::shiftButterflyAfterFlattening):
 644         (JSC::JSObject::growOutOfLineStorage): Deleted.
 645         * runtime/JSObject.h:
 646         (JSC::JSFinalObject::JSFinalObject):
 647         (JSC::JSObject::setButterfly):
 648         (JSC::JSObject::getOwnNonIndexPropertySlot):
 649         (JSC::JSObject::fillCustomGetterPropertySlot):
 650         (JSC::JSObject::getOwnPropertySlot):
 651         (JSC::JSObject::getPropertySlot):
 652         (JSC::JSObject::setStructureAndButterfly): Deleted.
 653         (JSC::JSObject::setButterflyWithoutChangingStructure): Deleted.
 654         (JSC::JSObject::putDirectInternal): Deleted.
 655         (JSC::JSObject::putDirectWithoutTransition): Deleted.
 656         * runtime/JSObjectInlines.h:
 657         (JSC::JSObject::getPropertySlot):
 658         (JSC::JSObject::getNonIndexPropertySlot):
 659         (JSC::JSObject::putDirectWithoutTransition):
 660         (JSC::JSObject::putDirectInternal):
 661         * runtime/Options.h:
 662         * runtime/SparseArrayValueMap.h:
 663         * runtime/Structure.cpp:
 664         (JSC::Structure::dumpStatistics):
 665         (JSC::Structure::findStructuresAndMapForMaterialization):
 666         (JSC::Structure::materializePropertyTable):
 667         (JSC::Structure::addNewPropertyTransition):
 668         (JSC::Structure::changePrototypeTransition):
 669         (JSC::Structure::attributeChangeTransition):
 670         (JSC::Structure::toDictionaryTransition):
 671         (JSC::Structure::takePropertyTableOrCloneIfPinned):
 672         (JSC::Structure::nonPropertyTransition):
 673         (JSC::Structure::isSealed):
 674         (JSC::Structure::isFrozen):
 675         (JSC::Structure::flattenDictionaryStructure):
 676         (JSC::Structure::pin):
 677         (JSC::Structure::pinForCaching):
 678         (JSC::Structure::willStoreValueSlow):
 679         (JSC::Structure::copyPropertyTableForPinning):
 680         (JSC::Structure::add):
 681         (JSC::Structure::remove):
 682         (JSC::Structure::getPropertyNamesFromStructure):
 683         (JSC::Structure::visitChildren):
 684         (JSC::Structure::materializePropertyMap): Deleted.
 685         (JSC::Structure::addPropertyWithoutTransition): Deleted.
 686         (JSC::Structure::removePropertyWithoutTransition): Deleted.
 687         (JSC::Structure::copyPropertyTable): Deleted.
 688         (JSC::Structure::createPropertyMap): Deleted.
 689         (JSC::PropertyTable::checkConsistency): Deleted.
 690         (JSC::Structure::checkConsistency): Deleted.
 691         * runtime/Structure.h:
 692         * runtime/StructureIDBlob.h:
 693         (JSC::StructureIDBlob::StructureIDBlob):
 694         (JSC::StructureIDBlob::indexingTypeIncludingHistory):
 695         (JSC::StructureIDBlob::setIndexingTypeIncludingHistory):
 696         (JSC::StructureIDBlob::indexingTypeIncludingHistoryOffset):
 697         (JSC::StructureIDBlob::indexingType): Deleted.
 698         (JSC::StructureIDBlob::setIndexingType): Deleted.
 699         (JSC::StructureIDBlob::indexingTypeOffset): Deleted.
 700         * runtime/StructureInlines.h:
 701         (JSC::Structure::get):
 702         (JSC::Structure::checkOffsetConsistency):
 703         (JSC::Structure::checkConsistency):
 704         (JSC::Structure::add):
 705         (JSC::Structure::remove):
 706         (JSC::Structure::addPropertyWithoutTransition):
 707         (JSC::Structure::removePropertyWithoutTransition):
 708         (JSC::Structure::setPropertyTable):
 709         (JSC::Structure::putWillGrowOutOfLineStorage): Deleted.
 710         (JSC::Structure::propertyTable): Deleted.
 711         (JSC::Structure::suggestedNewOutOfLineStorageCapacity): Deleted.
 712
 713 2016-11-14  Keith Miller  <keith_miller@apple.com>
 714
 715         Add Wasm select
 716         https://bugs.webkit.org/show_bug.cgi?id=164743
 717
 718         Reviewed by Saam Barati.
 719
 720         Also, this patch fixes an issue with the jsc.cpp test harness where negative numbers would be sign extended
 721         when they shouldn't be.
 722
 723         * jsc.cpp:
 724         (box):
 725         * wasm/WasmB3IRGenerator.cpp:
 726         * wasm/WasmFunctionParser.h:
 727         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 728         * wasm/WasmValidate.cpp:
 729         (JSC::Wasm::Validate::addSelect):
 730
 731 2016-11-11  Geoffrey Garen  <ggaren@apple.com>
 732
 733         JSC should distinguish between local and global eval
 734         https://bugs.webkit.org/show_bug.cgi?id=164628
 735
 736         Reviewed by Saam Barati.
 737
 738         Local use of the 'eval' keyword and invocation of the global window.eval
 739         function are distinct operations in JavaScript.
 740
 741         This patch splits out LocalEvalExecutable vs GlobalEvalExecutable in
 742         order to help distinguish these operations in code.
 743
 744         Our code used to do some silly things for lack of distinguishing these
 745         cases. For example, it would double cache local eval in CodeCache and
 746         EvalCodeCache. This made CodeCache seem more complicated than it really
 747         was.
 748
 749         * CMakeLists.txt:
 750         * JavaScriptCore.xcodeproj/project.pbxproj: Added some files.
 751
 752         * bytecode/CodeBlock.h:
 753
 754         * bytecode/EvalCodeCache.h:
 755         (JSC::EvalCodeCache::tryGet):
 756         (JSC::EvalCodeCache::set):
 757         (JSC::EvalCodeCache::getSlow): Deleted. Moved code generation out of
 758         the cache to avoid tight coupling. Now the cache just caches.
 759
 760         * bytecode/UnlinkedEvalCodeBlock.h:
 761         * bytecode/UnlinkedFunctionExecutable.cpp:
 762         (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
 763         * bytecode/UnlinkedModuleProgramCodeBlock.h:
 764         * bytecode/UnlinkedProgramCodeBlock.h:
 765         * debugger/DebuggerCallFrame.cpp:
 766         (JSC::DebuggerCallFrame::evaluateWithScopeExtension): Updated for interface
 767         changes.
 768
 769         * interpreter/Interpreter.cpp:
 770         (JSC::eval): Moved code generation here so the cache didn't need to build
 771         it in.
 772
 773         * llint/LLIntOffsetsExtractor.cpp:
 774
 775         * runtime/CodeCache.cpp:
 776         (JSC::CodeCache::getUnlinkedGlobalCodeBlock): No need to check for TDZ
 777         variables any more. We only cache global programs, and global variable
 778         access always does TDZ checks.
 779
 780         (JSC::CodeCache::getUnlinkedProgramCodeBlock):
 781         (JSC::CodeCache::getUnlinkedGlobalEvalCodeBlock):
 782         (JSC::CodeCache::getUnlinkedModuleProgramCodeBlock):
 783         (JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):
 784
 785         (JSC::CodeCache::CodeCache): Deleted.
 786         (JSC::CodeCache::~CodeCache): Deleted.
 787         (JSC::CodeCache::getGlobalCodeBlock): Deleted.
 788         (JSC::CodeCache::getProgramCodeBlock): Deleted.
 789         (JSC::CodeCache::getEvalCodeBlock): Deleted.
 790         (JSC::CodeCache::getModuleProgramCodeBlock): Deleted.
 791         (JSC::CodeCache::getFunctionExecutableFromGlobalCode): Deleted.
 792
 793         * runtime/CodeCache.h:
 794         (JSC::CodeCache::clear):
 795         (JSC::generateUnlinkedCodeBlock): Moved unlinked code block creation
 796         out of the CodeCache class and into a stand-alone function because
 797         we need it for local eval, which does not live in CodeCache.
 798
 799         * runtime/EvalExecutable.cpp:
 800         (JSC::EvalExecutable::create): Deleted.
 801         * runtime/EvalExecutable.h:
 802         (): Deleted.
 803         * runtime/GlobalEvalExecutable.cpp: Added.
 804         (JSC::GlobalEvalExecutable::create):
 805         (JSC::GlobalEvalExecutable::GlobalEvalExecutable):
 806         * runtime/GlobalEvalExecutable.h: Added.
 807         * runtime/LocalEvalExecutable.cpp: Added.
 808         (JSC::LocalEvalExecutable::create):
 809         (JSC::LocalEvalExecutable::LocalEvalExecutable):
 810         * runtime/LocalEvalExecutable.h: Added. Split out Local vs Global
 811         EvalExecutable classes to distinguish these operations in code. The key
 812         difference is that LocalEvalExecutable does not live in the CodeCache
 813         and only lives in the EvalCodeCache.
 814
 815         * runtime/JSGlobalObject.cpp:
 816         (JSC::JSGlobalObject::createProgramCodeBlock):
 817         (JSC::JSGlobalObject::createLocalEvalCodeBlock):
 818         (JSC::JSGlobalObject::createGlobalEvalCodeBlock):
 819         (JSC::JSGlobalObject::createModuleProgramCodeBlock):
 820         (JSC::JSGlobalObject::createEvalCodeBlock): Deleted.
 821         * runtime/JSGlobalObject.h:
 822         * runtime/JSGlobalObjectFunctions.cpp:
 823         (JSC::globalFuncEval):
 824
 825         * runtime/JSScope.cpp:
 826         (JSC::JSScope::collectClosureVariablesUnderTDZ):
 827         (JSC::JSScope::collectVariablesUnderTDZ): Deleted. We don't include
 828         global lexical variables in our concept of TDZ scopes anymore. Global
 829         variable access always does TDZ checks unconditionally. So, only closure
 830         scope accesses give specific consideration to TDZ checks.
 831
 832         * runtime/JSScope.h:
 833
 834 2016-11-14  Caitlin Potter  <caitp@igalia.com>
 835
 836         [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
 837         https://bugs.webkit.org/show_bug.cgi?id=164037
 838
 839         Reviewed by Yusuke Suzuki.
 840
 841         This patch introduces new_async_func / new_async_func_exp into DFG and FTL,
 842         in much the same capacity that https://trac.webkit.org/changeset/194216 added
 843         DFG / FTL support for generators: by adding new DFG nodes (NewAsyncFunction and
 844         PhantomNewAsyncFunction), rather than extending the existing NewFunction node type.
 845
 846         Like NewFunction and PhantomNewFunction, and the Generator variants, allocation of
 847         async wrapper functions may be deferred or eliminated during the allocation sinking
 848         phase.
 849
 850         * dfg/DFGAbstractInterpreterInlines.h:
 851         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
 852         * dfg/DFGByteCodeParser.cpp:
 853         (JSC::DFG::ByteCodeParser::parseBlock):
 854         * dfg/DFGCapabilities.cpp:
 855         (JSC::DFG::capabilityLevel):
 856         * dfg/DFGClobberize.h:
 857         (JSC::DFG::clobberize):
 858         * dfg/DFGClobbersExitState.cpp:
 859         (JSC::DFG::clobbersExitState):
 860         * dfg/DFGDoesGC.cpp:
 861         (JSC::DFG::doesGC):
 862         * dfg/DFGFixupPhase.cpp:
 863         (JSC::DFG::FixupPhase::fixupNode):
 864         * dfg/DFGMayExit.cpp:
 865         * dfg/DFGNode.h:
 866         (JSC::DFG::Node::convertToPhantomNewFunction):
 867         (JSC::DFG::Node::convertToPhantomNewAsyncFunction):
 868         (JSC::DFG::Node::hasCellOperand):
 869         (JSC::DFG::Node::isFunctionAllocation):
 870         (JSC::DFG::Node::isPhantomFunctionAllocation):
 871         (JSC::DFG::Node::isPhantomAllocation):
 872         * dfg/DFGNodeType.h:
 873         * dfg/DFGObjectAllocationSinkingPhase.cpp:
 874         * dfg/DFGPredictionPropagationPhase.cpp:
 875         * dfg/DFGSafeToExecute.h:
 876         (JSC::DFG::safeToExecute):
 877         * dfg/DFGSpeculativeJIT.cpp:
 878         (JSC::DFG::SpeculativeJIT::compileNewFunction):
 879         * dfg/DFGSpeculativeJIT32_64.cpp:
 880         (JSC::DFG::SpeculativeJIT::compile):
 881         * dfg/DFGSpeculativeJIT64.cpp:
 882         (JSC::DFG::SpeculativeJIT::compile):
 883         * dfg/DFGStoreBarrierInsertionPhase.cpp:
 884         * dfg/DFGStructureRegistrationPhase.cpp:
 885         (JSC::DFG::StructureRegistrationPhase::run):
 886         * dfg/DFGValidate.cpp:
 887         * ftl/FTLCapabilities.cpp:
 888         (JSC::FTL::canCompile):
 889         * ftl/FTLLowerDFGToB3.cpp:
 890         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
 891         (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
 892         * ftl/FTLOperations.cpp:
 893         (JSC::FTL::operationPopulateObjectInOSR):
 894         (JSC::FTL::operationMaterializeObjectInOSR):
 895         * runtime/JSGlobalObject.cpp:
 896         (JSC::JSGlobalObject::init):
 897         (JSC::JSGlobalObject::visitChildren):
 898         * runtime/JSGlobalObject.h:
 899         (JSC::JSGlobalObject::asyncFunctionPrototype):
 900         (JSC::JSGlobalObject::asyncFunctionStructure):
 901         (JSC::JSGlobalObject::lazyAsyncFunctionStructure): Deleted.
 902         (JSC::JSGlobalObject::asyncFunctionPrototypeConcurrently): Deleted.
 903         (JSC::JSGlobalObject::asyncFunctionStructureConcurrently): Deleted.
 904
 905 2016-11-14  Mark Lam  <mark.lam@apple.com>
 906
 907         Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
 908         https://bugs.webkit.org/show_bug.cgi?id=164701
 909         <rdar://problem/27462104>
 910
 911         Reviewed by Darin Adler.
 912
 913         The characters8(), characters16(), and operator[] in JSString::SafeView converts
 914         the underlying JSString to a StringView via get(), and then uses the StringView
 915         without first checking if an exception was thrown during the conversion.  This is
 916         unsafe because the conversion may have failed.
 917
 918         Instead, we should remove these 3 convenience methods, and make the caller
 919         explicitly call get() and do the appropriate exception checks before using the
 920         StringView.
 921
 922         * runtime/JSGlobalObjectFunctions.cpp:
 923         (JSC::toStringView):
 924         (JSC::encode):
 925         (JSC::decode):
 926         (JSC::globalFuncParseInt):
 927         (JSC::globalFuncEscape):
 928         (JSC::globalFuncUnescape):
 929         (JSC::toSafeView): Deleted.
 930         * runtime/JSONObject.cpp:
 931         (JSC::JSONProtoFuncParse):
 932         * runtime/JSString.h:
 933         (JSC::JSString::SafeView::length):
 934         (JSC::JSString::SafeView::characters8): Deleted.
 935         (JSC::JSString::SafeView::characters16): Deleted.
 936         (JSC::JSString::SafeView::operator[]): Deleted.
 937         * runtime/StringPrototype.cpp:
 938         (JSC::stringProtoFuncRepeatCharacter):
 939         (JSC::stringProtoFuncCharAt):
 940         (JSC::stringProtoFuncCharCodeAt):
 941         (JSC::stringProtoFuncNormalize):
 942
 943 2016-11-14  Mark Lam  <mark.lam@apple.com>
 944
 945         RegExpObject::exec/match should handle errors gracefully.
 946         https://bugs.webkit.org/show_bug.cgi?id=155145
 947         <rdar://problem/27435934>
 948
 949         Reviewed by Keith Miller.
 950
 951         1. Added some missing exception checks to RegExpObject::execInline() and
 952            RegExpObject::matchInline().
 953         2. Updated related code to work with ExceptionScope verification requirements.
 954
 955         * dfg/DFGOperations.cpp:
 956         * runtime/RegExpObjectInlines.h:
 957         (JSC::RegExpObject::execInline):
 958         (JSC::RegExpObject::matchInline):
 959         * runtime/RegExpPrototype.cpp:
 960         (JSC::regExpProtoFuncTestFast):
 961         (JSC::regExpProtoFuncExec):
 962         (JSC::regExpProtoFuncMatchFast):
 963
 964 2016-11-13  Mark Lam  <mark.lam@apple.com>
 965
 966         Add debugging facility to limit the max single allocation size.
 967         https://bugs.webkit.org/show_bug.cgi?id=164681
 968
 969         Reviewed by Keith Miller.
 970
 971         Added JSC option to set FastMalloc's maxSingleAllocationSize for testing purposes.
 972         This option is only available on Debug builds.
 973
 974         * runtime/Options.cpp:
 975         (JSC::Options::isAvailable):
 976         (JSC::recomputeDependentOptions):
 977         * runtime/Options.h:
 978
 979 2016-11-12  Joseph Pecoraro  <pecoraro@apple.com>
 980
 981         Follow-up fix to r208639.
 982
 983         Unreviewed fix. This is a straightfoward change where I forgot to
 984         switch from uncheckedArgument() to argument() in once case after
 985         dropping an argumentCount check. All other cases do this properly.
 986         This addresses an ASSERT seen on the bots running tests.
 987
 988         * runtime/JSDataViewPrototype.cpp:
 989         (JSC::setData):
 990
 991 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
 992
 993         test262: DataView with explicit undefined byteLength should be the same as it not being present
 994         https://bugs.webkit.org/show_bug.cgi?id=164453
 995
 996         Reviewed by Darin Adler.
 997
 998         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
 999         (JSC::constructGenericTypedArrayView):
1000         Handle the special case of DataView construction with an undefined byteLength value.
1001
1002 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
1003
1004         test262: DataView get methods should allow for missing offset, set methods should allow for missing value
1005         https://bugs.webkit.org/show_bug.cgi?id=164451
1006
1007         Reviewed by Darin Adler.
1008
1009         * runtime/JSDataViewPrototype.cpp:
1010         (JSC::getData):
1011         Missing offset is still valid and will be coerced to 0.
1012
1013         (JSC::setData):
1014         Missing value is still valid and will be coerced to 0.
1015
1016 2016-11-11  Saam Barati  <sbarati@apple.com>
1017
1018         We should have a more concise way of determining when we're varargs calling a function using rest parameters
1019         https://bugs.webkit.org/show_bug.cgi?id=164258
1020
1021         Reviewed by Yusuke Suzuki.
1022
1023         This patch adds two new bytecodes and DFG nodes for the following code patterns:
1024
1025         ```
1026         foo(a, b, ...c)
1027         let x = [a, b, ...c];
1028         ```
1029
1030         To do this, I've introduced two new bytecode operations (and their
1031         corresponding DFG nodes):
1032
1033         op_spread and op_new_array_with_spread.
1034
1035         op_spread takes a single input and performs the ES6 iteration protocol on it.
1036         It returns the result of doing the spread inside a new class I've
1037         made called JSFixedArray. JSFixedArray is a cell with a single 'size'
1038         field and a buffer of values allocated inline in the cell. Abstracting
1039         the protocol into a single node is good because it will make IR analysis
1040         in the future much simpler. For now, it's also good because it allows
1041         us to create fast paths for array iteration (which is quite common).
1042         This fast path allows us to emit really good code for array iteration
1043         inside the DFG/FTL.
1044
1045         op_new_array_with_spread is a variable argument bytecode that also
1046         has a bit vector associated with it. The bit vector indicates if
1047         any particular argument is to be spread or not. Arguments that
1048         are spread are known to be JSFixedArray because we must emit an
1049         op_spread before op_new_array_with_spread consumes the value.
1050         For example, for this array:
1051         [a, b, ...c, d, ...e]
1052         we will have this bit vector:
1053         [0, 0, 1, 0, 1]
1054
1055         The reason I've chosen this IR is that it will make eliminating
1056         a rest allocation for this type of code much easier:
1057
1058         ```
1059         function foo(...args) {
1060             return bar(a, b, ...args);
1061         }
1062         ```
1063
1064         It will be easier to analyze the IR now that the operations
1065         will be described at a high level.
1066
1067         This patch is an ~8% speedup on ES6SampleBench on my MBP.
1068
1069         * CMakeLists.txt:
1070         * DerivedSources.make:
1071         * JavaScriptCore.xcodeproj/project.pbxproj:
1072         * builtins/IteratorHelpers.js: Added.
1073         (performIteration):
1074         * bytecode/BytecodeList.json:
1075         * bytecode/BytecodeUseDef.h:
1076         (JSC::computeUsesForBytecodeOffset):
1077         (JSC::computeDefsForBytecodeOffset):
1078         * bytecode/CodeBlock.cpp:
1079         (JSC::CodeBlock::dumpBytecode):
1080         * bytecode/ObjectPropertyConditionSet.cpp:
1081         (JSC::generateConditionForSelfEquivalence):
1082         * bytecode/ObjectPropertyConditionSet.h:
1083         * bytecode/TrackedReferences.cpp:
1084         (JSC::TrackedReferences::check):
1085         * bytecode/UnlinkedCodeBlock.h:
1086         (JSC::UnlinkedCodeBlock::bitVectors):
1087         (JSC::UnlinkedCodeBlock::bitVector):
1088         (JSC::UnlinkedCodeBlock::addBitVector):
1089         (JSC::UnlinkedCodeBlock::shrinkToFit):
1090         * bytecompiler/BytecodeGenerator.cpp:
1091         (JSC::BytecodeGenerator::emitNewArrayWithSpread):
1092         * bytecompiler/BytecodeGenerator.h:
1093         * bytecompiler/NodesCodegen.cpp:
1094         (JSC::ArrayNode::emitBytecode):
1095         * dfg/DFGAbstractInterpreterInlines.h:
1096         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1097         * dfg/DFGByteCodeParser.cpp:
1098         (JSC::DFG::ByteCodeParser::addToGraph):
1099         (JSC::DFG::ByteCodeParser::parseBlock):
1100         * dfg/DFGCapabilities.cpp:
1101         (JSC::DFG::capabilityLevel):
1102         * dfg/DFGClobberize.h:
1103         (JSC::DFG::clobberize):
1104         * dfg/DFGDoesGC.cpp:
1105         (JSC::DFG::doesGC):
1106         * dfg/DFGFixupPhase.cpp:
1107         (JSC::DFG::FixupPhase::fixupNode):
1108         (JSC::DFG::FixupPhase::watchHavingABadTime):
1109         * dfg/DFGGraph.h:
1110         (JSC::DFG::Graph::isWatchingArrayIteratorProtocolWatchpoint):
1111         * dfg/DFGNode.h:
1112         (JSC::DFG::Node::bitVector):
1113         * dfg/DFGNodeType.h:
1114         * dfg/DFGOperations.cpp:
1115         * dfg/DFGOperations.h:
1116         * dfg/DFGPredictionPropagationPhase.cpp:
1117         * dfg/DFGSafeToExecute.h:
1118         (JSC::DFG::safeToExecute):
1119         * dfg/DFGSpeculativeJIT.cpp:
1120         (JSC::DFG::SpeculativeJIT::compileSpread):
1121         (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):
1122         * dfg/DFGSpeculativeJIT.h:
1123         (JSC::DFG::SpeculativeJIT::callOperation):
1124         * dfg/DFGSpeculativeJIT32_64.cpp:
1125         (JSC::DFG::SpeculativeJIT::compile):
1126         * dfg/DFGSpeculativeJIT64.cpp:
1127         (JSC::DFG::SpeculativeJIT::compile):
1128         * dfg/DFGStructureRegistrationPhase.cpp:
1129         (JSC::DFG::StructureRegistrationPhase::run):
1130         * ftl/FTLAbstractHeapRepository.h:
1131         * ftl/FTLCapabilities.cpp:
1132         (JSC::FTL::canCompile):
1133         * ftl/FTLLowerDFGToB3.cpp:
1134         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1135         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
1136         (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
1137         (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
1138         * jit/AssemblyHelpers.h:
1139         (JSC::AssemblyHelpers::emitAllocateVariableSizedCell):
1140         (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
1141         * jit/JIT.cpp:
1142         (JSC::JIT::privateCompileMainPass):
1143         * jit/JIT.h:
1144         * jit/JITOpcodes.cpp:
1145         (JSC::JIT::emit_op_new_array_with_spread):
1146         (JSC::JIT::emit_op_spread):
1147         * jit/JITOperations.h:
1148         * llint/LLIntData.cpp:
1149         (JSC::LLInt::Data::performAssertions):
1150         * llint/LLIntSlowPaths.cpp:
1151         * llint/LowLevelInterpreter.asm:
1152         * runtime/ArrayIteratorAdaptiveWatchpoint.cpp: Added.
1153         (JSC::ArrayIteratorAdaptiveWatchpoint::ArrayIteratorAdaptiveWatchpoint):
1154         (JSC::ArrayIteratorAdaptiveWatchpoint::handleFire):
1155         * runtime/ArrayIteratorAdaptiveWatchpoint.h: Added.
1156         * runtime/CommonSlowPaths.cpp:
1157         (JSC::SLOW_PATH_DECL):
1158         * runtime/CommonSlowPaths.h:
1159         * runtime/IteratorOperations.h:
1160         (JSC::forEachInIterable):
1161         * runtime/JSCInlines.h:
1162         * runtime/JSFixedArray.cpp: Added.
1163         (JSC::JSFixedArray::visitChildren):
1164         * runtime/JSFixedArray.h: Added.
1165         (JSC::JSFixedArray::createStructure):
1166         (JSC::JSFixedArray::createFromArray):
1167         (JSC::JSFixedArray::get):
1168         (JSC::JSFixedArray::buffer):
1169         (JSC::JSFixedArray::size):
1170         (JSC::JSFixedArray::offsetOfSize):
1171         (JSC::JSFixedArray::offsetOfData):
1172         (JSC::JSFixedArray::create):
1173         (JSC::JSFixedArray::JSFixedArray):
1174         (JSC::JSFixedArray::allocationSize):
1175         * runtime/JSGlobalObject.cpp:
1176         (JSC::JSGlobalObject::JSGlobalObject):
1177         (JSC::JSGlobalObject::init):
1178         (JSC::JSGlobalObject::visitChildren):
1179         (JSC::JSGlobalObject::objectPrototypeIsSane): Deleted.
1180         (JSC::JSGlobalObject::arrayPrototypeChainIsSane): Deleted.
1181         (JSC::JSGlobalObject::stringPrototypeChainIsSane): Deleted.
1182         * runtime/JSGlobalObject.h:
1183         (JSC::JSGlobalObject::arrayIteratorProtocolWatchpoint):
1184         (JSC::JSGlobalObject::iteratorProtocolFunction):
1185         * runtime/JSGlobalObjectInlines.h: Added.
1186         (JSC::JSGlobalObject::objectPrototypeIsSane):
1187         (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
1188         (JSC::JSGlobalObject::stringPrototypeChainIsSane):
1189         (JSC::JSGlobalObject::isArrayIteratorProtocolFastAndNonObservable):
1190         * runtime/JSType.h:
1191         * runtime/VM.cpp:
1192         (JSC::VM::VM):
1193         * runtime/VM.h:
1194
1195 2016-11-11  Keith Miller  <keith_miller@apple.com>
1196
1197         Move Wasm tests to JS
1198         https://bugs.webkit.org/show_bug.cgi?id=164611
1199
1200         Reviewed by Geoffrey Garen.
1201
1202         This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
1203         ommited tests were earliest tests, which tested trivial things, like adding two
1204         constants. Some tests are ommited for other reasons, however. These are:
1205
1206         1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
1207         Tests that would validate the memory of the module once wasm was done with it since that's
1208         not really possible in JS.
1209
1210         In order to make such a translation easier this patch also adds some features to the JS
1211         testing api:
1212
1213         1) Blocks can now be done lexically by adding a lambda as the last argument of the block
1214         opcode. For example one can do:
1215             ...
1216             .Block("i32", b => b.I32Const(1) )
1217
1218         and the nested lambda will automatically have an end attached.
1219
1220         2) The JS testing api can now handle inline signature types.
1221
1222         3) Relocate some code to make it easier to follow and prevent 44 space indentation.
1223
1224         4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
1225         wasm.json without being remapped.
1226
1227         5) Add support for Memory and Function sections to the Builder.
1228
1229         6) Add support for local variables.
1230
1231         On the JSC side, we needed to expose a new function to validate the compiled wasm code
1232         behaves the way we expect. At least until the JS Wasm API is finished. The new validation
1233         function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
1234         number of functions in the blob and tests for each of those functions.
1235
1236         * jsc.cpp:
1237         (GlobalObject::finishCreation):
1238         (box):
1239         (callWasmFunction):
1240         (functionTestWasmModuleFunctions):
1241         * testWasm.cpp:
1242         (checkPlan):
1243         (runWasmTests):
1244         * wasm/WasmB3IRGenerator.cpp:
1245         (JSC::Wasm::parseAndCompile):
1246         * wasm/WasmFunctionParser.h:
1247         (JSC::Wasm::FunctionParser<Context>::parse):
1248         (JSC::Wasm::FunctionParser<Context>::parseBody):
1249         (JSC::Wasm::FunctionParser<Context>::parseBlock): Deleted.
1250         * wasm/WasmModuleParser.cpp:
1251         (JSC::Wasm::ModuleParser::parseMemory):
1252         (JSC::Wasm::ModuleParser::parseExport):
1253         * wasm/WasmPlan.cpp:
1254         (JSC::Wasm::Plan::Plan):
1255         (JSC::Wasm::Plan::run):
1256         * wasm/WasmPlan.h:
1257         * wasm/js/WebAssemblyModuleConstructor.cpp:
1258         (JSC::constructJSWebAssemblyModule):
1259
1260 2016-11-11  Saam Barati  <sbarati@apple.com>
1261
1262         Unreviewed try to fix windows build after https://bugs.webkit.org/show_bug.cgi?id=164650
1263
1264         * dfg/DFGByteCodeParser.cpp:
1265         (JSC::DFG::ByteCodeParser::parseBlock):
1266
1267 2016-11-11  Saam Barati  <sbarati@apple.com>
1268
1269         We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
1270         https://bugs.webkit.org/show_bug.cgi?id=164650
1271
1272         Reviewed by Geoffrey Garen.
1273
1274         Some code was incorrectly holding a lock when recursively calling
1275         back into the bytecode parser's via inlining a put_by_val as a put_by_id.
1276         This can cause a deadlock if the inlinee CodeBlock is something we're
1277         already holding a lock for. I've changed the range of the lock holder
1278         to be as narrow as possible.
1279
1280         * dfg/DFGByteCodeParser.cpp:
1281         (JSC::DFG::ByteCodeParser::parseBlock):
1282
1283 2016-11-11  Chris Dumez  <cdumez@apple.com>
1284
1285         Unreviewed, rolling out r208584.
1286
1287         Seems to have regressed Speedometer by 1% on Mac
1288
1289         Reverted changeset:
1290
1291         "We should have a more concise way of determining when we're
1292         varargs calling a function using rest parameters"
1293         https://bugs.webkit.org/show_bug.cgi?id=164258
1294         http://trac.webkit.org/changeset/208584
1295
1296 2016-11-11  Chris Dumez  <cdumez@apple.com>
1297
1298         Unreviewed, rolling out r208117 and r208160.
1299
1300         Regressed Speedometer by >1.5%
1301
1302         Reverted changesets:
1303
1304         "We should have a way of profiling when a get_by_id is pure
1305         and to emit a PureGetById in the DFG/FTL"
1306         https://bugs.webkit.org/show_bug.cgi?id=163305
1307         http://trac.webkit.org/changeset/208117
1308
1309         "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
1310         out"
1311         https://bugs.webkit.org/show_bug.cgi?id=164227
1312         http://trac.webkit.org/changeset/208160
1313
1314 2016-11-11  Saam Barati  <sbarati@apple.com>
1315
1316         We should have a more concise way of determining when we're varargs calling a function using rest parameters
1317         https://bugs.webkit.org/show_bug.cgi?id=164258
1318
1319         Reviewed by Yusuke Suzuki.
1320
1321         This patch adds two new bytecodes and DFG nodes for the following code patterns:
1322
1323         ```
1324         foo(a, b, ...c)
1325         let x = [a, b, ...c];
1326         ```
1327
1328         To do this, I've introduced two new bytecode operations (and their
1329         corresponding DFG nodes):
1330
1331         op_spread and op_new_array_with_spread.
1332
1333         op_spread takes a single input and performs the ES6 iteration protocol on it.
1334         It returns the result of doing the spread inside a new class I've
1335         made called JSFixedArray. JSFixedArray is a cell with a single 'size'
1336         field and a buffer of values allocated inline in the cell. Abstracting
1337         the protocol into a single node is good because it will make IR analysis
1338         in the future much simpler. For now, it's also good because it allows
1339         us to create fast paths for array iteration (which is quite common).
1340         This fast path allows us to emit really good code for array iteration
1341         inside the DFG/FTL.
1342
1343         op_new_array_with_spread is a variable argument bytecode that also
1344         has a bit vector associated with it. The bit vector indicates if
1345         any particular argument is to be spread or not. Arguments that
1346         are spread are known to be JSFixedArray because we must emit an
1347         op_spread before op_new_array_with_spread consumes the value.
1348         For example, for this array:
1349         [a, b, ...c, d, ...e]
1350         we will have this bit vector:
1351         [0, 0, 1, 0, 1]
1352
1353         The reason I've chosen this IR is that it will make eliminating
1354         a rest allocation for this type of code much easier:
1355
1356         ```
1357         function foo(...args) {
1358             return bar(a, b, ...args);
1359         }
1360         ```
1361
1362         It will be easier to analyze the IR now that the operations
1363         will be described at a high level.
1364
1365         This patch is an ~8% speedup on ES6SampleBench on my MBP.
1366
1367         * CMakeLists.txt:
1368         * DerivedSources.make:
1369         * JavaScriptCore.xcodeproj/project.pbxproj:
1370         * builtins/IteratorHelpers.js: Added.
1371         (performIteration):
1372         * bytecode/BytecodeList.json:
1373         * bytecode/BytecodeUseDef.h:
1374         (JSC::computeUsesForBytecodeOffset):
1375         (JSC::computeDefsForBytecodeOffset):
1376         * bytecode/CodeBlock.cpp:
1377         (JSC::CodeBlock::dumpBytecode):
1378         * bytecode/ObjectPropertyConditionSet.cpp:
1379         (JSC::generateConditionForSelfEquivalence):
1380         * bytecode/ObjectPropertyConditionSet.h:
1381         * bytecode/TrackedReferences.cpp:
1382         (JSC::TrackedReferences::check):
1383         * bytecode/UnlinkedCodeBlock.h:
1384         (JSC::UnlinkedCodeBlock::bitVectors):
1385         (JSC::UnlinkedCodeBlock::bitVector):
1386         (JSC::UnlinkedCodeBlock::addBitVector):
1387         (JSC::UnlinkedCodeBlock::shrinkToFit):
1388         * bytecompiler/BytecodeGenerator.cpp:
1389         (JSC::BytecodeGenerator::emitNewArrayWithSpread):
1390         * bytecompiler/BytecodeGenerator.h:
1391         * bytecompiler/NodesCodegen.cpp:
1392         (JSC::ArrayNode::emitBytecode):
1393         * dfg/DFGAbstractInterpreterInlines.h:
1394         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1395         * dfg/DFGByteCodeParser.cpp:
1396         (JSC::DFG::ByteCodeParser::addToGraph):
1397         (JSC::DFG::ByteCodeParser::parseBlock):
1398         * dfg/DFGCapabilities.cpp:
1399         (JSC::DFG::capabilityLevel):
1400         * dfg/DFGClobberize.h:
1401         (JSC::DFG::clobberize):
1402         * dfg/DFGDoesGC.cpp:
1403         (JSC::DFG::doesGC):
1404         * dfg/DFGFixupPhase.cpp:
1405         (JSC::DFG::FixupPhase::fixupNode):
1406         (JSC::DFG::FixupPhase::watchHavingABadTime):
1407         * dfg/DFGGraph.h:
1408         (JSC::DFG::Graph::isWatchingArrayIteratorProtocolWatchpoint):
1409         * dfg/DFGNode.h:
1410         (JSC::DFG::Node::bitVector):
1411         * dfg/DFGNodeType.h:
1412         * dfg/DFGOperations.cpp:
1413         * dfg/DFGOperations.h:
1414         * dfg/DFGPredictionPropagationPhase.cpp:
1415         * dfg/DFGSafeToExecute.h:
1416         (JSC::DFG::safeToExecute):
1417         * dfg/DFGSpeculativeJIT.cpp:
1418         (JSC::DFG::SpeculativeJIT::compileSpread):
1419         (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):
1420         * dfg/DFGSpeculativeJIT.h:
1421         (JSC::DFG::SpeculativeJIT::callOperation):
1422         * dfg/DFGSpeculativeJIT32_64.cpp:
1423         (JSC::DFG::SpeculativeJIT::compile):
1424         * dfg/DFGSpeculativeJIT64.cpp:
1425         (JSC::DFG::SpeculativeJIT::compile):
1426         * dfg/DFGStructureRegistrationPhase.cpp:
1427         (JSC::DFG::StructureRegistrationPhase::run):
1428         * ftl/FTLAbstractHeapRepository.h:
1429         * ftl/FTLCapabilities.cpp:
1430         (JSC::FTL::canCompile):
1431         * ftl/FTLLowerDFGToB3.cpp:
1432         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1433         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
1434         (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
1435         (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
1436         * jit/AssemblyHelpers.h:
1437         (JSC::AssemblyHelpers::emitAllocateVariableSizedCell):
1438         (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
1439         * jit/JIT.cpp:
1440         (JSC::JIT::privateCompileMainPass):
1441         * jit/JIT.h:
1442         * jit/JITOpcodes.cpp:
1443         (JSC::JIT::emit_op_new_array_with_spread):
1444         (JSC::JIT::emit_op_spread):
1445         * jit/JITOperations.h:
1446         * llint/LLIntData.cpp:
1447         (JSC::LLInt::Data::performAssertions):
1448         * llint/LLIntSlowPaths.cpp:
1449         * llint/LowLevelInterpreter.asm:
1450         * runtime/ArrayIteratorAdaptiveWatchpoint.cpp: Added.
1451         (JSC::ArrayIteratorAdaptiveWatchpoint::ArrayIteratorAdaptiveWatchpoint):
1452         (JSC::ArrayIteratorAdaptiveWatchpoint::handleFire):
1453         * runtime/ArrayIteratorAdaptiveWatchpoint.h: Added.
1454         * runtime/CommonSlowPaths.cpp:
1455         (JSC::SLOW_PATH_DECL):
1456         * runtime/CommonSlowPaths.h:
1457         * runtime/IteratorOperations.h:
1458         (JSC::forEachInIterable):
1459         * runtime/JSCInlines.h:
1460         * runtime/JSFixedArray.cpp: Added.
1461         (JSC::JSFixedArray::visitChildren):
1462         * runtime/JSFixedArray.h: Added.
1463         (JSC::JSFixedArray::createStructure):
1464         (JSC::JSFixedArray::createFromArray):
1465         (JSC::JSFixedArray::get):
1466         (JSC::JSFixedArray::buffer):
1467         (JSC::JSFixedArray::size):
1468         (JSC::JSFixedArray::offsetOfSize):
1469         (JSC::JSFixedArray::offsetOfData):
1470         (JSC::JSFixedArray::create):
1471         (JSC::JSFixedArray::JSFixedArray):
1472         (JSC::JSFixedArray::allocationSize):
1473         * runtime/JSGlobalObject.cpp:
1474         (JSC::JSGlobalObject::JSGlobalObject):
1475         (JSC::JSGlobalObject::init):
1476         (JSC::JSGlobalObject::visitChildren):
1477         (JSC::JSGlobalObject::objectPrototypeIsSane): Deleted.
1478         (JSC::JSGlobalObject::arrayPrototypeChainIsSane): Deleted.
1479         (JSC::JSGlobalObject::stringPrototypeChainIsSane): Deleted.
1480         * runtime/JSGlobalObject.h:
1481         (JSC::JSGlobalObject::arrayIteratorProtocolWatchpoint):
1482         (JSC::JSGlobalObject::iteratorProtocolFunction):
1483         * runtime/JSGlobalObjectInlines.h: Added.
1484         (JSC::JSGlobalObject::objectPrototypeIsSane):
1485         (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
1486         (JSC::JSGlobalObject::stringPrototypeChainIsSane):
1487         (JSC::JSGlobalObject::isArrayIteratorProtocolFastAndNonObservable):
1488         * runtime/JSType.h:
1489         * runtime/VM.cpp:
1490         (JSC::VM::VM):
1491         * runtime/VM.h:
1492
1493 2016-11-10  JF Bastien  <jfbastien@apple.com>
1494
1495         ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
1496         https://bugs.webkit.org/show_bug.cgi?id=164597
1497
1498         Reviewed by Keith Miller.
1499
1500         * wasm/WasmParser.h:
1501         (JSC::Wasm::Parser::parseVarUInt32): move closer to other parsers
1502         (JSC::Wasm::Parser::parseVarUInt64): move closer to other parsers
1503
1504 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
1505
1506         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
1507         https://bugs.webkit.org/show_bug.cgi?id=164450
1508
1509         Reviewed by Darin Adler.
1510
1511         * runtime/JSCJSValue.h:
1512         * runtime/JSCJSValueInlines.h:
1513         (JSC::JSValue::toIndex):
1514         Introduce a method for toIndex, which is used by DataView and TypedArrays
1515         to convert an argument to a number with the possibility of throwing
1516         RangeErrors for negative values. We also throw RangeErrors for large
1517         values, because wherever this is used we expect an unsigned.
1518
1519         * runtime/JSArrayBufferConstructor.cpp:
1520         (JSC::constructArrayBuffer):
1521         * runtime/JSDataViewPrototype.cpp:
1522         (JSC::getData):
1523         (JSC::setData):
1524         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
1525         (JSC::constructGenericTypedArrayViewWithArguments):
1526         (JSC::constructGenericTypedArrayView):
1527         Use toIndex instead of toUint32 where required.
1528
1529 2016-11-10  Mark Lam  <mark.lam@apple.com>
1530
1531         A few bits of minor code clean up.
1532         https://bugs.webkit.org/show_bug.cgi?id=164523
1533
1534         Reviewed by Yusuke Suzuki.
1535
1536         * interpreter/StackVisitor.cpp:
1537         (JSC::StackVisitor::Frame::dump):
1538         - Insert a space to make the dump more legible.
1539
1540         * runtime/Options.h:
1541         - Fixed some typos.
1542
1543         * runtime/StringPrototype.cpp:
1544         (JSC::stringProtoFuncReplaceUsingRegExp):
1545         (JSC::stringProtoFuncReplaceUsingStringSearch):
1546         - Use the VM& that is already available.
1547
1548 2016-11-10  Mark Lam  <mark.lam@apple.com>
1549
1550         Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
1551         https://bugs.webkit.org/show_bug.cgi?id=164600
1552         <rdar://problem/28828676>
1553
1554         Reviewed by Filip Pizlo.
1555
1556         Currently, Graph::methodOfGettingAValueProfileFor() assumes that the operand DFG
1557         node that it is provided with always has a different origin than the node that is
1558         using that operand.  For example, in a DFG graph that looks like this:
1559
1560             a: ...
1561             b: ArithAdd(@a, ...)
1562
1563         ... when emitting speculation checks on @a for the ArithAdd node at @b,
1564         Graph::methodOfGettingAValueProfileFor() is passed @a, and expects @a's to
1565         originate from a different bytecode than @b.  The intent here is to get the
1566         profile for @a so that the OSR exit ramp for @b can update @a's profile with the
1567         observed result type from @a so that future type prediction on incoming args for
1568         the ArithAdd node can take this into consideration.
1569
1570         However, op_negate can be compiled into the following series of nodes:
1571
1572             a: ...
1573             b: BooleanToNumber(@a)
1574             c: DoubleRep(@b)
1575             d: ArithNegate(@c)
1576
1577         All 3 nodes @b, @c, and @d maps to the same op_negate bytecode i.e. they have the
1578         same origin.  When the speculativeJIT emits a speculationCheck for DoubleRep, it
1579         calls Graph::methodOfGettingAValueProfileFor() to get the ArithProfile for the
1580         BooleanToNumber node.  But because all 3 nodes have the same origin,
1581         Graph::methodOfGettingAValueProfileFor() erroneously returns the ArithProfile for
1582         the op_negate.  Subsequently, the OSR exit ramp will modify the ArithProfile of
1583         the op_negate and corrupt its profile.  Instead, what the OSR exit ramp should be
1584         doing is update the ArithProfile of op_negate's operand i.e. BooleanToNumber's
1585         operand @a in this case.
1586
1587         The fix is to always pass the current node we're generating code for (in addition
1588         to the operand node) to Graph::methodOfGettingAValueProfileFor().  This way, we
1589         know the profile is valid if and only if the current node and its operand node
1590         does not have the same origin.
1591
1592         In this patch, we also fixed the following:
1593         1. Teach Graph::methodOfGettingAValueProfileFor() to get the profile for
1594            BooleanToNumber's operand if the operand node it is given is BooleanToNumber.
1595         2. Change JITCompiler::appendExceptionHandlingOSRExit() to explicitly pass an
1596            empty MethodOfGettingAValueProfile().  It was implicitly doing this before.
1597         3. Change SpeculativeJIT::emitInvalidationPoint() to pass an empty
1598            MethodOfGettingAValueProfile().  It has no child node.  Hence, it doesn't
1599            make sense to call Graph::methodOfGettingAValueProfileFor() for a child node
1600            that does not exist.
1601
1602         * dfg/DFGGraph.cpp:
1603         (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
1604         * dfg/DFGGraph.h:
1605         * dfg/DFGJITCompiler.cpp:
1606         (JSC::DFG::JITCompiler::appendExceptionHandlingOSRExit):
1607         * dfg/DFGSpeculativeJIT.cpp:
1608         (JSC::DFG::SpeculativeJIT::speculationCheck):
1609         (JSC::DFG::SpeculativeJIT::emitInvalidationPoint):
1610         * ftl/FTLLowerDFGToB3.cpp:
1611         (JSC::FTL::DFG::LowerDFGToB3::appendOSRExitDescriptor):
1612
1613 2016-11-10  Aaron Chu  <aaron_chu@apple.com>
1614
1615         Web Inspector: AXI: clarify button roles (e.g. toggle or popup button)
1616         https://bugs.webkit.org/show_bug.cgi?id=130726
1617         <rdar://problem/16420420>
1618
1619         Reviewed by Brian Burg.
1620
1621         Add the isPopupButton flag to the AccessibilityProperties type.
1622
1623         * inspector/protocol/DOM.json:
1624
1625 2016-11-10  Csaba Osztrogonác  <ossy@webkit.org>
1626
1627         [ARM] Unreviewed buildfix after r208450.
1628
1629         * assembler/MacroAssemblerARM.h:
1630         (JSC::MacroAssemblerARM::load8SignedExtendTo32): Added.
1631
1632 2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1633
1634         [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
1635         https://bugs.webkit.org/show_bug.cgi?id=164502
1636
1637         Reviewed by Saam Barati.
1638
1639         In many builtin functions, we use `arguments` to just get optional parameters.
1640         While FTL argument elimination can drop `arguments` allocations, it leaves
1641         the allocations in LLInt, Baseline, and DFG. And we found that DFG compiled
1642         Array#map is heavily used in ES6SampleBench/Basic. And it always creates
1643         a meaningless ClonedArguments.
1644
1645         Using ES6 default parameter here is not a solution. It increases the number
1646         of parameters of the CodeBlock (not `function.length`). And the optional
1647         parameters in Array.prototype.xxx methods are not typically passed. For
1648         example, we typically do not pass `thisArg` to `Array.prototype.map` function.
1649         In this case, the arity check frequently fails. It requires the additional C
1650         call to fixup arguments and it becomes pure overhead.
1651
1652         To solve this problem, this patch introduces a new bytecode intrinsic @argument().
1653         This offers the way to retrieve the argument value without increasing the
1654         arity of the function. And if the argument is not passed (out of bounds), it
1655         just returns `undefined`. The semantics of this intrinsic is the same to the C++
1656         ExecState::argument(). This operation does not require `arguments` object. And we
1657         can drop the `argument` references even in lower 3 tiers.
1658
1659         We implement op_get_argument for this intrinsic. And later this will be converted
1660         to DFG GetArgument node. All the tiers handles this feature.
1661
1662         This patch improves ES6SampleBench/Basic 13.8% in steady state. And in summary,
1663         it improves 4.5%.
1664
1665         In the future, we can improve the implementation of the default parameters.
1666         Currently, the default parameter always increases the arity of the function. So
1667         if you do not pass the argument, the arity check fails. But since it is the default
1668         parameter, it is likely that we don't pass the argument. Using op_get_argument to
1669         implement the default parameter can decrease the case in which the arity check
1670         frequently fails. And it can change the builtin implementation to use the ES6
1671         default parameters instead of using the special @argument() intrinsic in the future.
1672         And at that case, the user code also receives the benefit.
1673
1674         ES6SampleBench/Basic.
1675             Baseline:
1676                 Running... Basic ( 1  to go)
1677                 firstIteration:     39.38 ms +- 4.48 ms
1678                 averageWorstCase:   20.79 ms +- 0.96 ms
1679                 steadyState:        1959.22 ms +- 65.55 ms
1680
1681             Patched:
1682                 Running... Basic ( 1  to go)
1683                 firstIteration:     37.85 ms +- 4.09 ms
1684                 averageWorstCase:   18.60 ms +- 0.76 ms
1685                 steadyState:        1721.89 ms +- 57.58 ms
1686
1687         All summary.
1688             Baseline:
1689                 summary:            164.34 ms +- 5.01 ms
1690             Patched:
1691                 summary:            157.26 ms +- 5.96 ms
1692
1693         * builtins/ArrayConstructor.js:
1694         * builtins/ArrayPrototype.js:
1695         (reduce):
1696         (reduceRight):
1697         (every):
1698         (forEach):
1699         (filter):
1700         (map):
1701         (some):
1702         (fill):
1703         (find):
1704         (findIndex):
1705         (includes):
1706         (copyWithin):
1707         * builtins/DatePrototype.js:
1708         (toLocaleString):
1709         (toLocaleDateString):
1710         (toLocaleTimeString):
1711         * builtins/MapPrototype.js:
1712         (forEach):
1713         * builtins/NumberPrototype.js:
1714         (toLocaleString):
1715         * builtins/SetPrototype.js:
1716         (forEach):
1717         * builtins/StringPrototype.js:
1718         (padStart):
1719         (padEnd):
1720         (localeCompare):
1721         * builtins/TypedArrayConstructor.js:
1722         * builtins/TypedArrayPrototype.js:
1723         (every):
1724         (fill):
1725         (find):
1726         (findIndex):
1727         (forEach):
1728         (some):
1729         (reduce):
1730         (reduceRight):
1731         (map):
1732         (filter):
1733         * bytecode/BytecodeIntrinsicRegistry.h:
1734         * bytecode/BytecodeList.json:
1735         * bytecode/BytecodeUseDef.h:
1736         (JSC::computeUsesForBytecodeOffset):
1737         (JSC::computeDefsForBytecodeOffset):
1738         * bytecode/CodeBlock.cpp:
1739         (JSC::CodeBlock::dumpBytecode):
1740         (JSC::CodeBlock::finishCreation):
1741         * bytecompiler/BytecodeGenerator.cpp:
1742         (JSC::BytecodeGenerator::emitGetArgument):
1743         * bytecompiler/BytecodeGenerator.h:
1744         * bytecompiler/NodesCodegen.cpp:
1745         (JSC::BytecodeIntrinsicNode::emit_intrinsic_argument):
1746         * dfg/DFGAbstractInterpreterInlines.h:
1747         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1748         * dfg/DFGByteCodeParser.cpp:
1749         (JSC::DFG::ByteCodeParser::parseBlock):
1750         * dfg/DFGCapabilities.cpp:
1751         (JSC::DFG::capabilityLevel):
1752         * dfg/DFGClobberize.h:
1753         (JSC::DFG::clobberize):
1754         * dfg/DFGDoesGC.cpp:
1755         (JSC::DFG::doesGC):
1756         * dfg/DFGFixupPhase.cpp:
1757         (JSC::DFG::FixupPhase::fixupNode):
1758         * dfg/DFGNode.h:
1759         (JSC::DFG::Node::hasHeapPrediction):
1760         (JSC::DFG::Node::hasArgumentIndex):
1761         (JSC::DFG::Node::argumentIndex):
1762         * dfg/DFGNodeType.h:
1763         * dfg/DFGPreciseLocalClobberize.h:
1764         (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
1765         * dfg/DFGPredictionPropagationPhase.cpp:
1766         * dfg/DFGSafeToExecute.h:
1767         (JSC::DFG::safeToExecute):
1768         * dfg/DFGSpeculativeJIT.cpp:
1769         (JSC::DFG::SpeculativeJIT::compileGetArgument):
1770         * dfg/DFGSpeculativeJIT.h:
1771         * dfg/DFGSpeculativeJIT32_64.cpp:
1772         (JSC::DFG::SpeculativeJIT::compile):
1773         * dfg/DFGSpeculativeJIT64.cpp:
1774         (JSC::DFG::SpeculativeJIT::compile):
1775         * ftl/FTLCapabilities.cpp:
1776         (JSC::FTL::canCompile):
1777         * ftl/FTLLowerDFGToB3.cpp:
1778         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1779         (JSC::FTL::DFG::LowerDFGToB3::compileGetArgument):
1780         * jit/JIT.cpp:
1781         (JSC::JIT::privateCompileMainPass):
1782         * jit/JIT.h:
1783         * jit/JITOpcodes.cpp:
1784         (JSC::JIT::emit_op_get_argument):
1785         * jit/JITOpcodes32_64.cpp:
1786         (JSC::JIT::emit_op_get_argument):
1787         * llint/LowLevelInterpreter32_64.asm:
1788         * llint/LowLevelInterpreter64.asm:
1789
1790 2016-11-08  Joseph Pecoraro  <pecoraro@apple.com>
1791
1792         Web Inspector: DebuggerManager.Event.Resumed introduces test flakiness
1793         https://bugs.webkit.org/show_bug.cgi?id=161951
1794         <rdar://problem/28295767>
1795
1796         Reviewed by Brian Burg.
1797
1798         This removes an ambiguity in the protocol when stepping through
1799         JavaScript. Previously, when paused and issuing a Debugger.step*
1800         command the frontend would always receive a Debugger.resumed event and
1801         then, maybe, a Debugger.paused event indicating we paused again (after
1802         stepping). However, this ambiguity means that the frontend needs to
1803         wait for a short period of time to determine if we really resumed
1804         or not. And even still that decision may be incorrect if the step
1805         takes a sufficiently long period of time.
1806
1807         The new approach removes this ambiguity. Now, in response to a
1808         Debugger.step* command the backend MUST send a single Debugger.paused
1809         event or Debugger.resumed event. Now the frontend knows that the
1810         next Debugger event it receives after issuing the step command is
1811         the result (stepped and paused, or stepped and resumed).
1812
1813         To make resuming consistent in all cases, a Debugger.resume command
1814         will always respond with a Debugger.resumed event.
1815
1816         Finally, Debugger.continueToLocation is treated like a "big step"
1817         in cases where we can resolve the location. If we can't resolve the
1818         location it is treated as a resume, maintaining the old behavior.
1819
1820         * inspector/agents/InspectorDebuggerAgent.h:
1821         * inspector/agents/InspectorDebuggerAgent.cpp:
1822         (Inspector::InspectorDebuggerAgent::stepOver):
1823         (Inspector::InspectorDebuggerAgent::stepInto):
1824         (Inspector::InspectorDebuggerAgent::stepOut):
1825         (Inspector::InspectorDebuggerAgent::willStepAndMayBecomeIdle):
1826         (Inspector::InspectorDebuggerAgent::didBecomeIdleAfterStepping):
1827         When stepping register a VM exit observer so that we can issue
1828         a Debugger.resumed event if the step caused us to exit the VM.
1829
1830         (Inspector::InspectorDebuggerAgent::resume):
1831         Set a flag to issue a Debugger.resumed event once we break out
1832         of the nested run loop.
1833
1834         (Inspector::InspectorDebuggerAgent::didPause):
1835         We are issuing Debugger.paused so clear the state to indicate that
1836         we no longer need to issue Debugger.resumed event, we have paused.
1837
1838         (Inspector::InspectorDebuggerAgent::didContinue):
1839         Only issue the Debugger.resumed event if needed (explicitly asked
1840         to resume).
1841
1842         (Inspector::InspectorDebuggerAgent::continueToLocation):
1843         (Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState):
1844         All places that do continueProgram should be audited. In error cases,
1845         if we are paused and continue we should remember to send Debugger.resumed.
1846
1847         * inspector/protocol/Debugger.json:
1848         Clarify in the protocol description the contract of these methods.
1849
1850 2016-11-09  Joseph Pecoraro  <pecoraro@apple.com>
1851
1852         Web Inspector: Associate Worker Resources with the Worker and not the Page
1853         https://bugs.webkit.org/show_bug.cgi?id=164342
1854         <rdar://problem/29075775>
1855
1856         Reviewed by Timothy Hatcher.
1857
1858         * inspector/protocol/Network.json:
1859         * inspector/protocol/Page.json:
1860         Associate Resource data with a target.
1861
1862 2016-11-09  Keith Miller  <keith_miller@apple.com>
1863
1864         jsc CLI should work with the remote inspector
1865         https://bugs.webkit.org/show_bug.cgi?id=164569
1866
1867         Reviewed by Joseph Pecoraro.
1868
1869         This patch enables using the remote inspector on the jsc CLI.
1870         In order to use the remote inspector, jsc users need to pass an option.
1871
1872         * jsc.cpp:
1873         (CommandLine::parseArguments):
1874         (runJSC):
1875
1876 2016-11-09  Saam Barati  <sbarati@apple.com>
1877
1878         Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
1879         https://bugs.webkit.org/show_bug.cgi?id=164464
1880         <rdar://problem/29131452>
1881
1882         Reviewed by Darin Adler.
1883
1884         We were incorrectly matching this pattern inside the bytecode parser
1885         to return NaN. Instead, we must return:
1886           Infinity for Math.min()
1887          -Infinity for Math.max()
1888
1889         * dfg/DFGByteCodeParser.cpp:
1890         (JSC::DFG::ByteCodeParser::handleMinMax):
1891
1892 2016-11-09  Saam Barati  <sbarati@apple.com>
1893
1894         TypeProfiler and running GC collection on another thread don't play nicely with each other
1895         https://bugs.webkit.org/show_bug.cgi?id=164441
1896         <rdar://problem/29132174>
1897
1898         Reviewed by Geoffrey Garen.
1899
1900         This fix here is simple: we now treat the type profiler log as a GC root.
1901         GC will make sure that we mark any values/structures that are in the log.
1902         It's easy to reason about the correctness of this, and it also solves
1903         the problem that we were clearing the log on the GC thread. Clearing the
1904         log on the GC thread was a problem because when we clear the log, we may
1905         allocate, which we're not allowed to do from the GC thread.
1906
1907         * heap/Heap.cpp:
1908         (JSC::Heap::markRoots):
1909         (JSC::Heap::visitTypeProfiler):
1910         (JSC::Heap::collectInThread):
1911         * heap/Heap.h:
1912         * runtime/TypeProfilerLog.cpp:
1913         (JSC::TypeProfilerLog::processLogEntries):
1914         (JSC::TypeProfilerLog::visit):
1915         * runtime/TypeProfilerLog.h:
1916
1917 2016-11-09  JF Bastien  <jfbastien@apple.com>
1918
1919         WebAssembly: Silence noisy warning
1920         https://bugs.webkit.org/show_bug.cgi?id=164459
1921
1922         Reviewed by Yusuke Suzuki.
1923
1924         * wasm/WasmPlan.cpp:
1925         (JSC::Wasm::Plan::Plan):
1926
1927 2016-11-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1928
1929         [JSC] The implementation of 8 bit operation in MacroAssembler should care about uint8_t / int8_t
1930         https://bugs.webkit.org/show_bug.cgi?id=164432
1931
1932         Reviewed by Michael Saboff.
1933
1934         Except for X86, our supported MacroAssemblers do not have native 8bit instructions.
1935         It means that all the 8bit instructions are converted to 32bit operations by using
1936         scratch registers. For example, ARM64 branch8 implementation is the following.
1937
1938             Jump branch8(RelationCondition cord, Address left, TrustedImm32 right)
1939             {
1940                 TrustedImm32 right8(static_cast<int8_t>(right.m_value));
1941                 load8(left, getCachedMemoryTempRegisterIDAndInvalidate());
1942                 return branch32(cone, memoryTempRegister, right8);
1943             }
1944
1945         The problem is that we exclusively use zero-extended load instruction (load8). Even
1946         for signed RelationConditions, we do not perform sign extension. It makes signed
1947         operations with negative numbers incorrect! Consider the |left| address holds `-1`
1948         in int8_t form. However load8 will load it as 255 into 32bit register. On the other hand,
1949         |right| will be sign extended. If you pass 0 as |right| and LessThan condition, this
1950         branch8 should jump based on the answer of `-1 < 0`. But the current MacroAssembler
1951         performs `255 < 0` in int32_t context and returns the incorrect result.
1952
1953         We should follow the x86 model. So we should select the appropriate load operation and masking
1954         operation based on the RelationCondition. This patch introduces mask8OnCondition and load8OnCondition.
1955         And we use them in 8bit operations including branch8, branchTest8, compare8, and test8.
1956
1957         We intentionally do not change anything on x86 assembler since it has the native signed 8bit operations.
1958
1959         * JavaScriptCore.xcodeproj/project.pbxproj:
1960         * assembler/AbstractMacroAssembler.h:
1961         * assembler/MacroAssembler.h:
1962         (JSC::MacroAssembler::isSigned):
1963         (JSC::MacroAssembler::isUnsigned):
1964         (JSC::MacroAssembler::branchTest8):
1965         * assembler/MacroAssemblerARM.h:
1966         (JSC::MacroAssemblerARM::branch8):
1967         (JSC::MacroAssemblerARM::branchTest8):
1968         (JSC::MacroAssemblerARM::compare8):
1969         (JSC::MacroAssemblerARM::test8):
1970         * assembler/MacroAssemblerARM64.h:
1971         (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
1972         (JSC::MacroAssemblerARM64::branch8):
1973         (JSC::MacroAssemblerARM64::branchTest8):
1974         (JSC::MacroAssemblerARM64::compare8):
1975         (JSC::MacroAssemblerARM64::test8):
1976         * assembler/MacroAssemblerARMv7.h:
1977         (JSC::MacroAssemblerARMv7::branch8):
1978         (JSC::MacroAssemblerARMv7::branchTest8):
1979         (JSC::MacroAssemblerARMv7::compare8):
1980         (JSC::MacroAssemblerARMv7::test8):
1981         * assembler/MacroAssemblerHelpers.h: Added.
1982         (JSC::MacroAssemblerHelpers::isSigned):
1983         (JSC::MacroAssemblerHelpers::isUnsigned):
1984         (JSC::MacroAssemblerHelpers::mask8OnCondition):
1985         (JSC::MacroAssemblerHelpers::load8OnCondition):
1986         * assembler/MacroAssemblerMIPS.h:
1987         (JSC::MacroAssemblerMIPS::branch8):
1988         (JSC::MacroAssemblerMIPS::compare8):
1989         (JSC::MacroAssemblerMIPS::branchTest8):
1990         (JSC::MacroAssemblerMIPS::test8):
1991         * assembler/MacroAssemblerSH4.h:
1992         (JSC::MacroAssemblerSH4::branchTest8):
1993         (JSC::MacroAssemblerSH4::branch8):
1994         (JSC::MacroAssemblerSH4::compare8):
1995         (JSC::MacroAssemblerSH4::test8):
1996         * assembler/MacroAssemblerX86_64.h:
1997         (JSC::MacroAssemblerX86_64::branch8):
1998
1999 2016-11-08  Geoffrey Garen  <ggaren@apple.com>
2000
2001         REGRESSION: date-format-tofte.js is super slow
2002         https://bugs.webkit.org/show_bug.cgi?id=164499
2003
2004         Reviewed by Sam Weinig.
2005
2006         * bytecode/EvalCodeCache.h:
2007         (JSC::EvalCodeCache::CacheKey::operator==): Use character comparison,
2008         not pointer comparison. (This function was always wrong, but I started
2009         calling it in more places.)
2010
2011 2016-11-08  Saam Barati  <sbarati@apple.com>
2012
2013         REGRESSION: Crashes in StringImpl destructor during GC when clearing the HasOwnPropertyCache
2014         https://bugs.webkit.org/show_bug.cgi?id=164433
2015
2016         Reviewed by Mark Lam.
2017
2018         Clearing the HasOwnPropertyCache will call deref() on the StringImpls
2019         in the cache. We were doing this from the collector thread, which is
2020         not allowed. It must be done from the mutator thread. We now clear the
2021         cache in Heap::finalize() which happens before the mutator begins
2022         executing JS after a collection happens.
2023
2024         * heap/Heap.cpp:
2025         (JSC::Heap::collectInThread):
2026         (JSC::Heap::finalize):
2027
2028 2016-11-05  Konstantin Tokarev  <annulen@yandex.ru>
2029
2030         Fixed compilation of LLInt with MinGW
2031         https://bugs.webkit.org/show_bug.cgi?id=164449
2032
2033         Reviewed by Michael Catanzaro.
2034
2035         MinGW uses LLIntAssembly.h with GNU assembler syntax, just like GCC on
2036         other platforms.
2037
2038         * llint/LowLevelInterpreter.cpp: Include LLIntAssembly.h with
2039         appropriate preamble.
2040
2041 2016-11-04  Filip Pizlo  <fpizlo@apple.com>
2042
2043         WTF::ParkingLot should stop using std::chrono because std::chrono::duration casts are prone to overflows
2044         https://bugs.webkit.org/show_bug.cgi?id=152045
2045
2046         Reviewed by Andy Estes.
2047
2048         Probably the nicest example of why this patch is a good idea is the change in
2049         AtomicsObject.cpp.
2050
2051         * jit/ICStats.cpp:
2052         (JSC::ICStats::ICStats):
2053         * runtime/AtomicsObject.cpp:
2054         (JSC::atomicsFuncWait):
2055
2056 2016-11-04  JF Bastien  <jfbastien@apple.com>
2057
2058         testWASM should be very sad if no options are provided
2059         https://bugs.webkit.org/show_bug.cgi?id=164444
2060
2061         Reviewed by Saam Barati.
2062
2063         Detect missing or invalid options on the command line.
2064
2065         * testWasm.cpp:
2066         (CommandLine::parseArguments):
2067
2068 2016-11-04  Mark Lam  <mark.lam@apple.com>
2069
2070         Error description code should be able to handle Symbol values.
2071         https://bugs.webkit.org/show_bug.cgi?id=164436
2072         <rdar://problem/29115583>
2073
2074         Reviewed by Filip Pizlo and Saam Barati.
2075
2076         Previously, we try to toString() the Symbol value, resulting in it throwing an
2077         exception in errorDescriptionForValue() which breaks the invariant that
2078         errorDescriptionForValue() should not throw.
2079
2080         We fixed this by making errorDescriptionForValue() aware of the Symbol type, and
2081         not so a toString() on Symbol values.  Also fixed notAFunctionSourceAppender()
2082         to build a nicer message for Symbol values.
2083
2084         * runtime/ExceptionHelpers.cpp:
2085         (JSC::errorDescriptionForValue):
2086         (JSC::notAFunctionSourceAppender):
2087
2088 2016-11-02  Geoffrey Garen  <ggaren@apple.com>
2089
2090         EvalCodeCache should not give up in strict mode and other cases
2091         https://bugs.webkit.org/show_bug.cgi?id=164357
2092
2093         Reviewed by Michael Saboff.
2094
2095         EvalCodeCache gives up in non-trivial cases because generated eval code
2096         can't soundly migrate from, for example, a let scope to a non-let scope.
2097         The number of cases has grown over time.
2098
2099         Instead, let's cache eval code based on the location of the call to
2100         eval(). That way, we never relocate the code, and it's sound to make
2101         normal assumptions about our surrounding scope.
2102
2103         * bytecode/EvalCodeCache.h:
2104         (JSC::EvalCodeCache::CacheKey::CacheKey): Use CallSiteIndex to uniquely
2105         identify the location of our call to eval().
2106
2107         (JSC::EvalCodeCache::CacheKey::hash):
2108         (JSC::EvalCodeCache::CacheKey::operator==):
2109         (JSC::EvalCodeCache::CacheKey::Hash::equal): Use CallSiteIndex instead
2110         of lots of other flags.
2111
2112         (JSC::EvalCodeCache::tryGet): No need to include details that are implied
2113         by our CallSiteIndex.
2114
2115         (JSC::EvalCodeCache::getSlow): No need to skip caching in complex
2116         situations. We promise we'll never relocate the cached code.
2117
2118         (JSC::EvalCodeCache::isCacheableScope): Deleted.
2119         (JSC::EvalCodeCache::isCacheable): Deleted.
2120
2121         * interpreter/Interpreter.cpp:
2122         (JSC::eval): Pass through a CallSiteIndex to uniquely identify this call
2123         to eval().
2124
2125 2016-11-04  Keith Miller  <keith_miller@apple.com>
2126
2127         Add support for Wasm br_table
2128         https://bugs.webkit.org/show_bug.cgi?id=164429
2129
2130         Reviewed by Michael Saboff.
2131
2132         This patch adds support for Wasm br_table. The Wasm br_table
2133         opcode essentially directly maps to B3's switch opcode.
2134
2135         There are also three other minor changes:
2136         1) all non-argument locals should be initialized to zero at function entry.
2137         2) add new setErrorMessage member to WasmFunctionParser.h
2138         3) return does not decode an extra immediate anymore.
2139
2140         * testWasm.cpp:
2141         (runWasmTests):
2142         * wasm/WasmB3IRGenerator.cpp:
2143         * wasm/WasmFunctionParser.h:
2144         (JSC::Wasm::FunctionParser::setErrorMessage):
2145         (JSC::Wasm::FunctionParser<Context>::parseExpression):
2146         (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
2147         (JSC::Wasm::FunctionParser<Context>::popExpressionStack):
2148         * wasm/WasmValidate.cpp:
2149         (JSC::Wasm::Validate::checkBranchTarget):
2150         (JSC::Wasm::Validate::addBranch):
2151         (JSC::Wasm::Validate::addSwitch):
2152
2153 2016-11-04  JF Bastien  <jfbastien@apple.com>
2154
2155         WebAssembly JS API: implement more sections
2156         https://bugs.webkit.org/show_bug.cgi?id=164023
2157
2158         Reviewed by Keith Miller.
2159
2160         On the JSC side:
2161
2162          - Put in parser stubs for all WebAssembly sections.
2163          - Parse Import, Export sections.
2164          - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
2165          - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
2166          - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
2167          - Remove all remainders of polyfill-prototype-1, and update license.
2168          - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
2169
2170         On the Builder.js testing side:
2171
2172          - Implement Type, Import (function only), Export (function only) sections.
2173          - Check section order and uniqueness.
2174          - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
2175          - Allow re-exporting an import.
2176
2177         * CMakeLists.txt: missing auto-genration
2178         * JavaScriptCore.xcodeproj/project.pbxproj: merge conflict
2179         * testWasm.cpp: update for API changes, no functional change
2180         (checkPlan):
2181         (runWasmTests):
2182         * wasm/WasmFormat.cpp: add a dtor which requires extra headers which I'd rather not include in WasmFormat.h
2183         (JSC::Wasm::ModuleInformation::~ModuleInformation):
2184         * wasm/WasmFormat.h: Add External, Import, Functioninformation, Export, ModuleInformation, CompiledFunction, and remove obsolete stuff which was a holdover from the first implementation (all that code is now gone, so remove its license)
2185         (JSC::Wasm::External::isValid):
2186         * wasm/WasmModuleParser.cpp: simplify some, make names consistent with the WebAssembly section names, check memory allocations so they can fail early
2187         (JSC::Wasm::ModuleParser::parse):
2188         (JSC::Wasm::ModuleParser::parseType):
2189         (JSC::Wasm::ModuleParser::parseImport):
2190         (JSC::Wasm::ModuleParser::parseFunction):
2191         (JSC::Wasm::ModuleParser::parseTable):
2192         (JSC::Wasm::ModuleParser::parseMemory):
2193         (JSC::Wasm::ModuleParser::parseGlobal):
2194         (JSC::Wasm::ModuleParser::parseExport):
2195         (JSC::Wasm::ModuleParser::parseStart):
2196         (JSC::Wasm::ModuleParser::parseElement):
2197         (JSC::Wasm::ModuleParser::parseCode): avoid overflow through function size.
2198         (JSC::Wasm::ModuleParser::parseData):
2199         * wasm/WasmModuleParser.h:
2200         (JSC::Wasm::ModuleParser::moduleInformation):
2201         * wasm/WasmParser.h:
2202         (JSC::Wasm::Parser::consumeUTF8String): add as required by spec
2203         (JSC::Wasm::Parser::parseExternalKind): add as per spec
2204         * wasm/WasmPlan.cpp:
2205         (JSC::Wasm::Plan::Plan): fix some ownership, improve some error messages
2206         * wasm/WasmPlan.h: fix some ownership
2207         (JSC::Wasm::Plan::getModuleInformation):
2208         (JSC::Wasm::Plan::getMemory):
2209         (JSC::Wasm::Plan::compiledFunctionCount):
2210         (JSC::Wasm::Plan::compiledFunction):
2211         (JSC::Wasm::Plan::getCompiledFunctions):
2212         * wasm/WasmSections.h: macroize with description, so that error messages are super pretty. This could be auto-generated.
2213         * wasm/js/JSWebAssemblyModule.cpp:
2214         (JSC::JSWebAssemblyModule::create): take module information
2215         (JSC::JSWebAssemblyModule::JSWebAssemblyModule): ditto
2216         * wasm/js/JSWebAssemblyModule.h:
2217         (JSC::JSWebAssemblyModule::moduleInformation):
2218         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2219         (JSC::constructJSWebAssemblyInstance): check that modules with imports are instantiated with an import object, as per spec. This needs to be tested.
2220         * wasm/js/WebAssemblyMemoryConstructor.cpp:
2221         (JSC::constructJSWebAssemblyMemory):
2222         * wasm/js/WebAssemblyModuleConstructor.cpp:
2223         (JSC::constructJSWebAssemblyModule):
2224         * wasm/js/WebAssemblyTableConstructor.cpp:
2225         (JSC::constructJSWebAssemblyTable):
2226
2227 2016-11-03  Mark Lam  <mark.lam@apple.com>
2228
2229         ClonedArguments need to also support haveABadTime mode.
2230         https://bugs.webkit.org/show_bug.cgi?id=164200
2231         <rdar://problem/27211336>
2232
2233         Reviewed by Geoffrey Garen.
2234
2235         For those who are not familiar with the parlance, "have a bad time" in the VM
2236         means that Object.prototype has been modified in such a way that we can no longer
2237         trivially do indexed property accesses without consulting the Object.prototype.
2238         This defeats JIT indexed put optimizations, and hence, makes the VM "have a
2239         bad time".
2240
2241         Once the VM enters haveABadTime mode, all existing objects are converted to use
2242         slow put storage.  Thereafter, JSArrays are always created with slow put storage.
2243         JSObjects are always created with a blank indexing type.  When a new indexed
2244         property is put into the new object, its indexing type will be converted to the
2245         slow put array indexing type just before we perform the put operation.  This is
2246         how we ensure that the objects will also use slow put storage.
2247
2248         However, ClonedArguments is an object which was previously created unconditionally
2249         to use contiguous storage.  Subsequently, if we try to call Object.preventExtensions()
2250         on that ClonedArguments object, Object.preventExtensions() will:
2251         1. make the ClonedArguments enter dictionary indexing mode, which means it will
2252         2. first ensure that the ClonedArguments is using slow put array storage via
2253            JSObject::ensureArrayStorageSlow().
2254
2255         However, JSObject::ensureArrayStorageSlow() expects that we never see an object
2256         with contiguous storage once we're in haveABadTime mode.  Our ClonedArguments
2257         object did not obey this invariant.
2258
2259         The fix is to make the ClonedArguments factories create objects that use slow put
2260         array storage when in haveABadTime mode.  This means:
2261
2262         1. JSGlobalObject::haveABadTime() now changes m_clonedArgumentsStructure to use
2263            its slow put version.
2264
2265            Also the caching of the slow put version of m_regExpMatchesArrayStructure,
2266            because we only need to create it when we are having a bad time.
2267
2268         2. The ClonedArguments factories now allocates a butterfly with slow put array
2269            storage if we're in haveABadTime mode.
2270
2271            Also added some assertions in ClonedArguments' factory methods to ensure that
2272            the created object has the slow put indexing type when it needsSlowPutIndexing().
2273
2274         3. DFGFixupPhase now watches the havingABadTimeWatchpoint because ClonedArguments'
2275            structure will change when having a bad time.
2276
2277         4. DFGArgumentEliminationPhase and DFGVarargsForwardingPhase need not be changed
2278            because it is still valid to eliminate the creation of the arguments object
2279            even having a bad time, as long as the arguments object does not escape.
2280
2281         5. The DFGAbstractInterpreterInlines now checks for haveABadTime, and sets the
2282            predicted type to be SpecObject.
2283
2284         Note: this issue does not apply to DirectArguments and ScopedArguments because
2285         they use a blank indexing type (just like JSObject).
2286
2287         * dfg/DFGAbstractInterpreterInlines.h:
2288         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2289         * dfg/DFGArrayMode.cpp:
2290         (JSC::DFG::ArrayMode::dump):
2291         * dfg/DFGFixupPhase.cpp:
2292         (JSC::DFG::FixupPhase::fixupNode):
2293         * runtime/ClonedArguments.cpp:
2294         (JSC::ClonedArguments::createEmpty):
2295         (JSC::ClonedArguments::createWithInlineFrame):
2296         (JSC::ClonedArguments::createWithMachineFrame):
2297         (JSC::ClonedArguments::createByCopyingFrom):
2298         (JSC::ClonedArguments::createStructure):
2299         (JSC::ClonedArguments::createSlowPutStructure):
2300         * runtime/ClonedArguments.h:
2301         * runtime/JSGlobalObject.cpp:
2302         (JSC::JSGlobalObject::init):
2303         (JSC::JSGlobalObject::haveABadTime):
2304         (JSC::JSGlobalObject::visitChildren):
2305         * runtime/JSGlobalObject.h:
2306
2307 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
2308
2309         DFG plays fast and loose with the shadow values of a Phi
2310         https://bugs.webkit.org/show_bug.cgi?id=164309
2311
2312         Reviewed by Saam Barati.
2313
2314         Oh boy, what an embarrassing mistake! The style of SSA I like to use avoids block/value
2315         tuples as parameters of a Phi, thereby simplifying CFG transformations and making Phi largely
2316         not a special case for most compiler transforms. It does this by introducing another value
2317         called Upsilon, which stores a value into some Phi.
2318
2319         B3 uses this also. The easiest way to understand what Upsilon/Phi behave like is to look at
2320         the B3->Air lowering. Air is not SSA - it has Tmps that you can assign to and use as many
2321         times as you like. B3 allocates one Tmp per Value, and an extra "phiTmp" for Phis, so that
2322         Phis get two Tmps total. Upsilon stores the value into the phiTmp of the Phi, while Phi moves
2323         the value from its phiTmp to its tmp.
2324
2325         This is necessary to support scenarios like this:
2326
2327             a: Phi()
2328             b: Upsilon(@x, ^a)
2329             c: Use(@a)
2330
2331         Here, we want @c to see @a's value before @b. That's a very basic requirement of SSA: that
2332         the a value (like @a) doesn't change during its lifetime.
2333
2334         Unfortunately, DFG's liveness analysis, abstract interpreter, and integer range optimization
2335         all failed to correctly model Upsilon/Phi this way. They would assume that it's accurate to
2336         model the Upsilon as storing into the Phi directly.
2337
2338         Because DFG does flow analysis over SSA, making it correct means enabling it to speak of the
2339         shadow value. This change addresses this problem by introducing the concept of a
2340         NodeFlowProjection. This is a key that lets us speak of both a Node's primary value and its
2341         optional "shadow" value. Liveness, AI, and integer range are now keyed by NodeFlowProjection
2342         rather than Node*. Conceptually this turns out to be a very simple change, but it does touch
2343         a good amount of code.
2344
2345         This looks to be perf-neutral.
2346
2347         Rolled back in after fixing the debug build.
2348
2349         * CMakeLists.txt:
2350         * JavaScriptCore.xcodeproj/project.pbxproj:
2351         * b3/air/AirLiveness.h:
2352         (JSC::B3::Air::TmpLivenessAdapter::numIndices):
2353         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
2354         (JSC::B3::Air::RegLivenessAdapter::numIndices):
2355         (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
2356         (JSC::B3::Air::TmpLivenessAdapter::maxIndex): Deleted.
2357         (JSC::B3::Air::StackSlotLivenessAdapter::maxIndex): Deleted.
2358         (JSC::B3::Air::RegLivenessAdapter::maxIndex): Deleted.
2359         * dfg/DFGAbstractInterpreter.h:
2360         (JSC::DFG::AbstractInterpreter::forNode):
2361         * dfg/DFGAbstractInterpreterInlines.h:
2362         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2363         (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
2364         (JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
2365         * dfg/DFGAtTailAbstractState.cpp:
2366         (JSC::DFG::AtTailAbstractState::createValueForNode):
2367         (JSC::DFG::AtTailAbstractState::forNode):
2368         * dfg/DFGAtTailAbstractState.h:
2369         * dfg/DFGBasicBlock.h:
2370         * dfg/DFGCombinedLiveness.cpp:
2371         (JSC::DFG::liveNodesAtHead):
2372         * dfg/DFGCombinedLiveness.h:
2373         * dfg/DFGFlowIndexing.cpp: Added.
2374         (JSC::DFG::FlowIndexing::FlowIndexing):
2375         (JSC::DFG::FlowIndexing::~FlowIndexing):
2376         (JSC::DFG::FlowIndexing::recompute):
2377         * dfg/DFGFlowIndexing.h: Added.
2378         (JSC::DFG::FlowIndexing::graph):
2379         (JSC::DFG::FlowIndexing::numIndices):
2380         (JSC::DFG::FlowIndexing::index):
2381         (JSC::DFG::FlowIndexing::shadowIndex):
2382         (JSC::DFG::FlowIndexing::nodeProjection):
2383         * dfg/DFGFlowMap.h: Added.
2384         (JSC::DFG::FlowMap::FlowMap):
2385         (JSC::DFG::FlowMap::resize):
2386         (JSC::DFG::FlowMap::graph):
2387         (JSC::DFG::FlowMap::at):
2388         (JSC::DFG::FlowMap::atShadow):
2389         (WTF::printInternal):
2390         * dfg/DFGGraph.cpp:
2391         (JSC::DFG::Graph::Graph):
2392         * dfg/DFGGraph.h:
2393         (JSC::DFG::Graph::abstractValuesCache): Deleted.
2394         * dfg/DFGInPlaceAbstractState.cpp:
2395         (JSC::DFG::InPlaceAbstractState::InPlaceAbstractState):
2396         (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
2397         (JSC::DFG::setLiveValues):
2398         (JSC::DFG::InPlaceAbstractState::endBasicBlock):
2399         (JSC::DFG::InPlaceAbstractState::merge):
2400         * dfg/DFGInPlaceAbstractState.h:
2401         (JSC::DFG::InPlaceAbstractState::createValueForNode):
2402         (JSC::DFG::InPlaceAbstractState::forNode):
2403         * dfg/DFGIntegerRangeOptimizationPhase.cpp:
2404         * dfg/DFGLivenessAnalysisPhase.cpp:
2405         (JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase):
2406         (JSC::DFG::LivenessAnalysisPhase::run):
2407         (JSC::DFG::LivenessAnalysisPhase::processBlock):
2408         (JSC::DFG::LivenessAnalysisPhase::addChildUse): Deleted.
2409         * dfg/DFGNode.h:
2410         (JSC::DFG::NodeComparator::operator()):
2411         (JSC::DFG::nodeListDump):
2412         (JSC::DFG::nodeMapDump):
2413         (JSC::DFG::nodeValuePairListDump):
2414         (JSC::DFG::nodeComparator): Deleted.
2415         * dfg/DFGNodeAbstractValuePair.cpp: Added.
2416         (JSC::DFG::NodeAbstractValuePair::dump):
2417         * dfg/DFGNodeAbstractValuePair.h: Added.
2418         (JSC::DFG::NodeAbstractValuePair::NodeAbstractValuePair):
2419         * dfg/DFGNodeFlowProjection.cpp: Added.
2420         (JSC::DFG::NodeFlowProjection::dump):
2421         * dfg/DFGNodeFlowProjection.h: Added.
2422         (JSC::DFG::NodeFlowProjection::NodeFlowProjection):
2423         (JSC::DFG::NodeFlowProjection::operator bool):
2424         (JSC::DFG::NodeFlowProjection::kind):
2425         (JSC::DFG::NodeFlowProjection::node):
2426         (JSC::DFG::NodeFlowProjection::operator*):
2427         (JSC::DFG::NodeFlowProjection::operator->):
2428         (JSC::DFG::NodeFlowProjection::hash):
2429         (JSC::DFG::NodeFlowProjection::operator==):
2430         (JSC::DFG::NodeFlowProjection::operator!=):
2431         (JSC::DFG::NodeFlowProjection::operator<):
2432         (JSC::DFG::NodeFlowProjection::operator>):
2433         (JSC::DFG::NodeFlowProjection::operator<=):
2434         (JSC::DFG::NodeFlowProjection::operator>=):
2435         (JSC::DFG::NodeFlowProjection::isHashTableDeletedValue):
2436         (JSC::DFG::NodeFlowProjection::isStillValid):
2437         (JSC::DFG::NodeFlowProjection::forEach):
2438         (JSC::DFG::NodeFlowProjectionHash::hash):
2439         (JSC::DFG::NodeFlowProjectionHash::equal):
2440         * dfg/DFGStoreBarrierInsertionPhase.cpp:
2441
2442 2016-11-03  Commit Queue  <commit-queue@webkit.org>
2443
2444         Unreviewed, rolling out r208364.
2445         https://bugs.webkit.org/show_bug.cgi?id=164402
2446
2447         broke the build (Requested by smfr on #webkit).
2448
2449         Reverted changeset:
2450
2451         "DFG plays fast and loose with the shadow values of a Phi"
2452         https://bugs.webkit.org/show_bug.cgi?id=164309
2453         http://trac.webkit.org/changeset/208364
2454
2455 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
2456
2457         DFG plays fast and loose with the shadow values of a Phi
2458         https://bugs.webkit.org/show_bug.cgi?id=164309
2459
2460         Reviewed by Saam Barati.
2461
2462         Oh boy, what an embarrassing mistake! The style of SSA I like to use avoids block/value
2463         tuples as parameters of a Phi, thereby simplifying CFG transformations and making Phi largely
2464         not a special case for most compiler transforms. It does this by introducing another value
2465         called Upsilon, which stores a value into some Phi.
2466
2467         B3 uses this also. The easiest way to understand what Upsilon/Phi behave like is to look at
2468         the B3->Air lowering. Air is not SSA - it has Tmps that you can assign to and use as many
2469         times as you like. B3 allocates one Tmp per Value, and an extra "phiTmp" for Phis, so that
2470         Phis get two Tmps total. Upsilon stores the value into the phiTmp of the Phi, while Phi moves
2471         the value from its phiTmp to its tmp.
2472
2473         This is necessary to support scenarios like this:
2474
2475             a: Phi()
2476             b: Upsilon(@x, ^a)
2477             c: Use(@a)
2478
2479         Here, we want @c to see @a's value before @b. That's a very basic requirement of SSA: that
2480         the a value (like @a) doesn't change during its lifetime.
2481
2482         Unfortunately, DFG's liveness analysis, abstract interpreter, and integer range optimization
2483         all failed to correctly model Upsilon/Phi this way. They would assume that it's accurate to
2484         model the Upsilon as storing into the Phi directly.
2485
2486         Because DFG does flow analysis over SSA, making it correct means enabling it to speak of the
2487         shadow value. This change addresses this problem by introducing the concept of a
2488         NodeFlowProjection. This is a key that lets us speak of both a Node's primary value and its
2489         optional "shadow" value. Liveness, AI, and integer range are now keyed by NodeFlowProjection
2490         rather than Node*. Conceptually this turns out to be a very simple change, but it does touch
2491         a good amount of code.
2492
2493         This looks to be perf-neutral.
2494
2495         * CMakeLists.txt:
2496         * JavaScriptCore.xcodeproj/project.pbxproj:
2497         * b3/air/AirLiveness.h:
2498         (JSC::B3::Air::TmpLivenessAdapter::numIndices):
2499         (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
2500         (JSC::B3::Air::RegLivenessAdapter::numIndices):
2501         (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
2502         (JSC::B3::Air::TmpLivenessAdapter::maxIndex): Deleted.
2503         (JSC::B3::Air::StackSlotLivenessAdapter::maxIndex): Deleted.
2504         (JSC::B3::Air::RegLivenessAdapter::maxIndex): Deleted.
2505         * dfg/DFGAbstractInterpreter.h:
2506         (JSC::DFG::AbstractInterpreter::forNode):
2507         * dfg/DFGAbstractInterpreterInlines.h:
2508         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2509         (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
2510         (JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
2511         * dfg/DFGAtTailAbstractState.cpp:
2512         (JSC::DFG::AtTailAbstractState::createValueForNode):
2513         (JSC::DFG::AtTailAbstractState::forNode):
2514         * dfg/DFGAtTailAbstractState.h:
2515         * dfg/DFGBasicBlock.h:
2516         * dfg/DFGCombinedLiveness.cpp:
2517         (JSC::DFG::liveNodesAtHead):
2518         * dfg/DFGCombinedLiveness.h:
2519         * dfg/DFGFlowIndexing.cpp: Added.
2520         (JSC::DFG::FlowIndexing::FlowIndexing):
2521         (JSC::DFG::FlowIndexing::~FlowIndexing):
2522         (JSC::DFG::FlowIndexing::recompute):
2523         * dfg/DFGFlowIndexing.h: Added.
2524         (JSC::DFG::FlowIndexing::graph):
2525         (JSC::DFG::FlowIndexing::numIndices):
2526         (JSC::DFG::FlowIndexing::index):
2527         (JSC::DFG::FlowIndexing::shadowIndex):
2528         (JSC::DFG::FlowIndexing::nodeProjection):
2529         * dfg/DFGFlowMap.h: Added.
2530         (JSC::DFG::FlowMap::FlowMap):
2531         (JSC::DFG::FlowMap::resize):
2532         (JSC::DFG::FlowMap::graph):
2533         (JSC::DFG::FlowMap::at):
2534         (JSC::DFG::FlowMap::atShadow):
2535         (WTF::printInternal):
2536         * dfg/DFGGraph.cpp:
2537         (JSC::DFG::Graph::Graph):
2538         * dfg/DFGGraph.h:
2539         (JSC::DFG::Graph::abstractValuesCache): Deleted.
2540         * dfg/DFGInPlaceAbstractState.cpp:
2541         (JSC::DFG::InPlaceAbstractState::InPlaceAbstractState):
2542         (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
2543         (JSC::DFG::setLiveValues):
2544         (JSC::DFG::InPlaceAbstractState::endBasicBlock):
2545         (JSC::DFG::InPlaceAbstractState::merge):
2546         * dfg/DFGInPlaceAbstractState.h:
2547         (JSC::DFG::InPlaceAbstractState::createValueForNode):
2548         (JSC::DFG::InPlaceAbstractState::forNode):
2549         * dfg/DFGIntegerRangeOptimizationPhase.cpp:
2550         * dfg/DFGLivenessAnalysisPhase.cpp:
2551         (JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase):
2552         (JSC::DFG::LivenessAnalysisPhase::run):
2553         (JSC::DFG::LivenessAnalysisPhase::processBlock):
2554         (JSC::DFG::LivenessAnalysisPhase::addChildUse): Deleted.
2555         * dfg/DFGNode.h:
2556         (JSC::DFG::NodeComparator::operator()):
2557         (JSC::DFG::nodeListDump):
2558         (JSC::DFG::nodeMapDump):
2559         (JSC::DFG::nodeValuePairListDump):
2560         (JSC::DFG::nodeComparator): Deleted.
2561         * dfg/DFGNodeAbstractValuePair.cpp: Added.
2562         (JSC::DFG::NodeAbstractValuePair::dump):
2563         * dfg/DFGNodeAbstractValuePair.h: Added.
2564         (JSC::DFG::NodeAbstractValuePair::NodeAbstractValuePair):
2565         * dfg/DFGNodeFlowProjection.cpp: Added.
2566         (JSC::DFG::NodeFlowProjection::dump):
2567         * dfg/DFGNodeFlowProjection.h: Added.
2568         (JSC::DFG::NodeFlowProjection::NodeFlowProjection):
2569         (JSC::DFG::NodeFlowProjection::operator bool):
2570         (JSC::DFG::NodeFlowProjection::kind):
2571         (JSC::DFG::NodeFlowProjection::node):
2572         (JSC::DFG::NodeFlowProjection::operator*):
2573         (JSC::DFG::NodeFlowProjection::operator->):
2574         (JSC::DFG::NodeFlowProjection::hash):
2575         (JSC::DFG::NodeFlowProjection::operator==):
2576         (JSC::DFG::NodeFlowProjection::operator!=):
2577         (JSC::DFG::NodeFlowProjection::operator<):
2578         (JSC::DFG::NodeFlowProjection::operator>):
2579         (JSC::DFG::NodeFlowProjection::operator<=):
2580         (JSC::DFG::NodeFlowProjection::operator>=):
2581         (JSC::DFG::NodeFlowProjection::isHashTableDeletedValue):
2582         (JSC::DFG::NodeFlowProjection::isStillValid):
2583         (JSC::DFG::NodeFlowProjection::forEach):
2584         (JSC::DFG::NodeFlowProjectionHash::hash):
2585         (JSC::DFG::NodeFlowProjectionHash::equal):
2586         * dfg/DFGStoreBarrierInsertionPhase.cpp:
2587
2588 2016-11-03  Keith Miller  <keith_miller@apple.com>
2589
2590         Unreviewed, changelog fix due to failed git rebase..
2591
2592 2016-11-03  Keith Miller  <keith_miller@apple.com>
2593
2594         Wasm starts a new stack whenever it adds a new block and has return types for blocks.
2595         https://bugs.webkit.org/show_bug.cgi?id=164100
2596
2597         Reviewed by Saam Barati.
2598
2599         This patch overhauls much of the Wasm function parser, validator, and B3 IR generator
2600         to work with block return types. In Wasm, blocks can act as expressions and have a
2601         return value. Most of the control flow operators needed to be rewritten in order to
2602         support this feature. To enable return types the function parser needed to be able
2603         to save and restore the expression stack from previous blocks, which is done via the
2604         control stack.
2605
2606         This patch also removes the lazy continuation block system added previously. It's
2607         not clear if there would be any performance win from such a system. There are likely
2608         many other things with orders of magnitude more impact on B3 IR generation. The
2609         complexity cost of such a system is not worth the effort without sufficient evidence
2610         otherwise.
2611
2612         * testWasm.cpp:
2613         (runWasmTests):
2614         * wasm/WasmB3IRGenerator.cpp:
2615         * wasm/WasmFunctionParser.h:
2616         (JSC::Wasm::FunctionParser<Context>::parseBlock):
2617         (JSC::Wasm::FunctionParser<Context>::addReturn):
2618         (JSC::Wasm::FunctionParser<Context>::parseExpression):
2619         (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
2620         (JSC::Wasm::FunctionParser<Context>::popExpressionStack):
2621         * wasm/WasmValidate.cpp:
2622         (JSC::Wasm::Validate::ControlData::hasNonVoidSignature):
2623         (JSC::Wasm::Validate::addElse):
2624         (JSC::Wasm::Validate::addElseToUnreachable):
2625         (JSC::Wasm::Validate::addBranch):
2626         (JSC::Wasm::Validate::endBlock):
2627         (JSC::Wasm::Validate::addEndToUnreachable):
2628         (JSC::Wasm::Validate::dump):
2629         (JSC::Wasm::validateFunction):
2630         (JSC::Wasm::Validate::isContinuationReachable): Deleted.
2631
2632 2016-11-03  Saam Barati  <sbarati@apple.com>
2633
2634         Asking for a value profile prediction should be defensive against not finding a value profile
2635         https://bugs.webkit.org/show_bug.cgi?id=164306
2636
2637         Reviewed by Mark Lam.
2638
2639         Currently, the code that calls CodeBlock::valueProfilePredictionForBytecodeOffset
2640         in the DFG assumes it will always be at a value producing node. However, this isn't
2641         true if we tail call from an inlined setter. When we're at a tail call, we try
2642         to find the first caller that isn't a tail call to see what value the
2643         tail_call produces. If we inline a setter, however, we will end up finding
2644         the put_by_id as our first non-tail-called "caller", and that won't have a
2645         value profile associated with it since it's not a value producing node.
2646         CodeBlock::valueProfilePredictionForBytecodeOffset should be defensive
2647         against finding a null value profile.
2648
2649         * bytecode/CodeBlock.h:
2650         (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
2651         * dfg/DFGByteCodeParser.cpp:
2652         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
2653
2654 2016-11-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2655
2656         Unreviewed, fix CLoop build after r208320.
2657         https://bugs.webkit.org/show_bug.cgi?id=162980
2658
2659         Add required forward declarations.
2660
2661         * domjit/DOMJITHeapRange.cpp:
2662         * domjit/DOMJITSignature.h:
2663         * runtime/VM.h:
2664
2665 2016-11-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2666
2667         [DOMJIT] Add DOMJIT::Signature
2668         https://bugs.webkit.org/show_bug.cgi?id=162980
2669
2670         Reviewed by Saam Barati and Sam Weinig.
2671
2672         This patch introduces a new mechanism called DOMJIT::Signature. We can annotate the function with DOMJIT::Signature.
2673         DOMJIT::Signature has type information of that function. And it also maintains the effect of the function and the
2674         pointer to the unsafe function. The unsafe function means the function without type and argument count checks.
2675         By using these information, we can separate type and argument count checks from the function. And we can emit
2676         these things as DFG checks and convert the function call itself to CallDOM node. CallDOM node can call the unsafe
2677         function directly without any checks. Furthermore, this CallDOM node can represent its own clobberizing rules based
2678         on DOMJIT::Effect maintained by DOMJIT::Signature. It allows us to make opaque Call node to a CallDOM node that
2679         merely reads some part of heap. These changes (1) can drop duplicate type checks in DFG, (2) offer ability to move
2680         CallDOM node to somewhere, and (3) track more detailed heap reads and writes of CallDOM nodes.
2681
2682         We first emit Call node with DOMJIT::Signature in DFGByteCodeParser. And in the fixup phase, we attempt to lower
2683         Call node to CallDOM node with checks & edge filters. This is because we do not know the type predictions in
2684         DFGByteCodeParser phase. If we always emit CallDOM node in DFGByteCodeParser, if we evaluate `div.getAttribute(true)`
2685         thingy, the Uncountable OSR exits repeatedly happen because AI figures out the abstract value is cleared.
2686
2687         Currently, DOMJIT signature only allows the types that can reside in GPR. This is because the types of the unsafe
2688         function arguments are represented as the sequence of void*. In the future, we will extend to accept other types like
2689         float, double etc.
2690
2691         We annotate several functions in Element. In particular, we annotate Element::getAttribute. This allows us to perform
2692         LICM in Dromaeo dom-attr test. In the Dromaeo dom-attr getAttribute test, we can see 32x improvement. (134974.8 v.s. 4203.4)
2693
2694         * JavaScriptCore.xcodeproj/project.pbxproj:
2695         * bytecode/CallVariant.h:
2696         (JSC::CallVariant::functionExecutable):
2697         (JSC::CallVariant::nativeExecutable):
2698         (JSC::CallVariant::signatureFor):
2699         * bytecode/SpeculatedType.h:
2700         (JSC::isNotStringSpeculation):
2701         (JSC::isNotInt32Speculation):
2702         (JSC::isNotBooleanSpeculation):
2703         * dfg/DFGAbstractInterpreterInlines.h:
2704         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2705         * dfg/DFGByteCodeParser.cpp:
2706         (JSC::DFG::ByteCodeParser::addCall):
2707         (JSC::DFG::ByteCodeParser::handleCall):
2708         (JSC::DFG::ByteCodeParser::attemptToInlineCall):
2709         (JSC::DFG::ByteCodeParser::handleInlining):
2710         (JSC::DFG::ByteCodeParser::handleDOMJITCall):
2711         (JSC::DFG::ByteCodeParser::parseBlock):
2712         * dfg/DFGClobberize.h:
2713         (JSC::DFG::clobberize):
2714         * dfg/DFGDoesGC.cpp:
2715         (JSC::DFG::doesGC):
2716         * dfg/DFGFixupPhase.cpp:
2717         (JSC::DFG::FixupPhase::fixupNode):
2718         (JSC::DFG::FixupPhase::attemptToMakeCallDOM):
2719         (JSC::DFG::FixupPhase::fixupCheckDOM):
2720         (JSC::DFG::FixupPhase::fixupCallDOM):
2721         * dfg/DFGNode.cpp:
2722         (JSC::DFG::Node::convertToCallDOM):
2723         * dfg/DFGNode.h:
2724         (JSC::DFG::Node::hasHeapPrediction):
2725         (JSC::DFG::Node::shouldSpeculateNotInt32):
2726         (JSC::DFG::Node::shouldSpeculateNotBoolean):
2727         (JSC::DFG::Node::shouldSpeculateNotString):
2728         (JSC::DFG::Node::hasSignature):
2729         (JSC::DFG::Node::signature):
2730         * dfg/DFGNodeType.h:
2731         * dfg/DFGPredictionPropagationPhase.cpp:
2732         * dfg/DFGSafeToExecute.h:
2733         (JSC::DFG::safeToExecute):
2734         * dfg/DFGSpeculativeJIT.cpp:
2735         (JSC::DFG::SpeculativeJIT::compileCallDOM):
2736         * dfg/DFGSpeculativeJIT.h:
2737         (JSC::DFG::SpeculativeJIT::callOperation):
2738         * dfg/DFGSpeculativeJIT32_64.cpp:
2739         (JSC::DFG::SpeculativeJIT::compile):
2740         * dfg/DFGSpeculativeJIT64.cpp:
2741         (JSC::DFG::SpeculativeJIT::compile):
2742         * domjit/DOMJITEffect.h:
2743         (JSC::DOMJIT::Effect::Effect):
2744         (JSC::DOMJIT::Effect::forWrite):
2745         (JSC::DOMJIT::Effect::forRead):
2746         (JSC::DOMJIT::Effect::forReadWrite):
2747         (JSC::DOMJIT::Effect::forPure):
2748         (JSC::DOMJIT::Effect::forDef):
2749         (JSC::DOMJIT::Effect::mustGenerate):
2750         In clang, we cannot make this Effect constructor constexpr if we use Optional<HeapRange>.
2751         So we use HeapRange::top() for Nullopt def now.
2752
2753         * domjit/DOMJITHeapRange.h:
2754         (JSC::DOMJIT::HeapRange::fromRaw):
2755         (JSC::DOMJIT::HeapRange::operator bool):
2756         (JSC::DOMJIT::HeapRange::operator==):
2757         (JSC::DOMJIT::HeapRange::operator!=):
2758         (JSC::DOMJIT::HeapRange::fromConstant):
2759         * domjit/DOMJITSignature.h: Copied from Source/JavaScriptCore/domjit/DOMJITEffect.h.
2760         (JSC::DOMJIT::Signature::Signature):
2761         (JSC::DOMJIT::Signature::argumentCount):
2762         (JSC::DOMJIT::Signature::checkDOM):
2763         * ftl/FTLCapabilities.cpp:
2764         (JSC::FTL::canCompile):
2765         * ftl/FTLLowerDFGToB3.cpp:
2766         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
2767         (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
2768         * jit/JITOperations.h:
2769         * jit/JITThunks.cpp:
2770         (JSC::JITThunks::hostFunctionStub):
2771         * jit/JITThunks.h:
2772         * runtime/JSBoundFunction.cpp:
2773         (JSC::JSBoundFunction::create):
2774         * runtime/JSCell.h:
2775         * runtime/JSFunction.cpp:
2776         (JSC::JSFunction::create):
2777         * runtime/JSFunction.h:
2778         * runtime/JSNativeStdFunction.cpp:
2779         (JSC::JSNativeStdFunction::create):
2780         * runtime/JSObject.cpp:
2781         (JSC::JSObject::putDirectNativeFunction):
2782         * runtime/JSObject.h:
2783         * runtime/Lookup.h:
2784         (JSC::HashTableValue::functionLength):
2785         (JSC::HashTableValue::signature):
2786         (JSC::reifyStaticProperty):
2787         * runtime/NativeExecutable.cpp:
2788         (JSC::NativeExecutable::create):
2789         (JSC::NativeExecutable::NativeExecutable):
2790         * runtime/NativeExecutable.h:
2791         * runtime/PropertySlot.h:
2792         * runtime/VM.cpp:
2793         (JSC::VM::getHostFunction):
2794         * runtime/VM.h:
2795
2796 2016-11-02  Andreas Kling  <akling@apple.com>
2797
2798         MarkedSpace should have specialized size classes for popular engine objects.
2799         <https://webkit.org/b/164345>
2800
2801         Reviewed by Filip Pizlo.
2802
2803         The MarkedSpace size classes were recently reworked to minimize wasted space
2804         at the end of MarkedBlocks.
2805
2806         However, we know that some specific objects will be allocated in very high volume.
2807         Adding specialized size classes for those object sizes achieves greater utilization
2808         since we're basically guaranteed to allocate them all the time.
2809
2810         Inject specialized size classes for these four objects:
2811
2812             - FunctionCodeBlock
2813                 560 bytes instead of 624
2814                 28 per block instead of 26 (+2)
2815
2816             - FunctionExecutable
2817                 176 bytes instead of 224
2818                 92 per block instead of 72 (+20)
2819
2820             - UnlinkedFunctionCodeBlock
2821                 256 bytes instead of 320
2822                 63 per block instead of 50 (+13)
2823
2824             - UnlinkedFunctionExecutable
2825                 192 bytes instead of 224
2826                 84 per block instead of 72 (+12)
2827
2828         * heap/MarkedSpace.cpp:
2829
2830 2016-11-02  Geoffrey Garen  <ggaren@apple.com>
2831
2832         One file per class for UnlinkedCodeBlock.h/.cpp
2833         https://bugs.webkit.org/show_bug.cgi?id=164348
2834
2835         Reviewed by Saam Barati.
2836
2837         * CMakeLists.txt:
2838         * JavaScriptCore.xcodeproj/project.pbxproj:
2839         * bytecode/FunctionCodeBlock.h:
2840         * bytecode/ModuleProgramCodeBlock.h:
2841         * bytecode/ProgramCodeBlock.h:
2842         * bytecode/UnlinkedCodeBlock.cpp:
2843         (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
2844         (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
2845         (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
2846         (JSC::UnlinkedModuleProgramCodeBlock::destroy): Deleted.
2847         (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
2848         (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
2849         (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
2850         * bytecode/UnlinkedCodeBlock.h:
2851         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
2852         * bytecode/UnlinkedEvalCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
2853         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
2854         (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
2855         (JSC::UnlinkedCodeBlock::estimatedSize): Deleted.
2856         (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
2857         (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
2858         (JSC::dumpLineColumnEntry): Deleted.
2859         (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
2860         (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
2861         (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
2862         (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
2863         (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
2864         (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
2865         (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
2866         (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
2867         (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
2868         (JSC::UnlinkedModuleProgramCodeBlock::destroy): Deleted.
2869         (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
2870         (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
2871         (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
2872         (JSC::UnlinkedCodeBlock::instructions): Deleted.
2873         (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset): Deleted.
2874         (JSC::UnlinkedCodeBlock::handlerForIndex): Deleted.
2875         (JSC::UnlinkedCodeBlock::applyModification): Deleted.
2876         * bytecode/UnlinkedEvalCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
2877         (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
2878         (JSC::UnlinkedSimpleJumpTable::add): Deleted.
2879         (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
2880         (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
2881         (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
2882         (JSC::UnlinkedCodeBlock::usesEval): Deleted.
2883         (JSC::UnlinkedCodeBlock::parseMode): Deleted.
2884         (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
2885         (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
2886         (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
2887         (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
2888         (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
2889         (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
2890         (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
2891         (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
2892         (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
2893         (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
2894         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
2895         (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
2896         (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
2897         (JSC::UnlinkedCodeBlock::addParameter): Deleted.
2898         (JSC::UnlinkedCodeBlock::numParameters): Deleted.
2899         (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
2900         (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
2901         (JSC::UnlinkedCodeBlock::regexp): Deleted.
2902         (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
2903         (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
2904         (JSC::UnlinkedCodeBlock::identifier): Deleted.
2905         (JSC::UnlinkedCodeBlock::identifiers): Deleted.
2906         (JSC::UnlinkedCodeBlock::addConstant): Deleted.
2907         (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
2908         (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
2909         (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
2910         (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
2911         (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
2912         (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
2913         (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
2914         (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
2915         (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
2916         (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
2917         (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
2918         (JSC::UnlinkedCodeBlock::superBinding): Deleted.
2919         (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
2920         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
2921         (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
2922         (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
2923         (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
2924         (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
2925         (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
2926         (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
2927         (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
2928         (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
2929         (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
2930         (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
2931         (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
2932         (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
2933         (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
2934         (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
2935         (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
2936         (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
2937         (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
2938         (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
2939         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
2940         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
2941         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
2942         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
2943         (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
2944         (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
2945         (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
2946         (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
2947         (JSC::UnlinkedCodeBlock::codeType): Deleted.
2948         (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
2949         (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
2950         (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
2951         (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
2952         (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
2953         (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
2954         (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
2955         (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
2956         (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
2957         (JSC::UnlinkedCodeBlock::recordParse): Deleted.
2958         (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
2959         (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
2960         (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
2961         (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
2962         (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
2963         (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
2964         (JSC::UnlinkedCodeBlock::firstLine): Deleted.
2965         (JSC::UnlinkedCodeBlock::lineCount): Deleted.
2966         (JSC::UnlinkedCodeBlock::startColumn): Deleted.
2967         (JSC::UnlinkedCodeBlock::endColumn): Deleted.
2968         (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
2969         (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
2970         (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
2971         (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
2972         (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
2973         (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
2974         (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
2975         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
2976         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
2977         * bytecode/UnlinkedFunctionCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
2978         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
2979         (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
2980         (JSC::UnlinkedCodeBlock::estimatedSize): Deleted.
2981         (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
2982         (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
2983         (JSC::dumpLineColumnEntry): Deleted.
2984         (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
2985         (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
2986         (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
2987         (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
2988         (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
2989         (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
2990         (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
2991         (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
2992         (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
2993         (JSC::UnlinkedModuleProgramCodeBlock::destroy): Deleted.
2994         (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
2995         (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
2996         (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
2997         (JSC::UnlinkedCodeBlock::instructions): Deleted.
2998         (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset): Deleted.
2999         (JSC::UnlinkedCodeBlock::handlerForIndex): Deleted.
3000         (JSC::UnlinkedCodeBlock::applyModification): Deleted.
3001         * bytecode/UnlinkedFunctionCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
3002         (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
3003         (JSC::UnlinkedSimpleJumpTable::add): Deleted.
3004         (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
3005         (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
3006         (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
3007         (JSC::UnlinkedCodeBlock::usesEval): Deleted.
3008         (JSC::UnlinkedCodeBlock::parseMode): Deleted.
3009         (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
3010         (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
3011         (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
3012         (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
3013         (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
3014         (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
3015         (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
3016         (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
3017         (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
3018         (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
3019         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
3020         (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
3021         (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
3022         (JSC::UnlinkedCodeBlock::addParameter): Deleted.
3023         (JSC::UnlinkedCodeBlock::numParameters): Deleted.
3024         (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
3025         (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
3026         (JSC::UnlinkedCodeBlock::regexp): Deleted.
3027         (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
3028         (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
3029         (JSC::UnlinkedCodeBlock::identifier): Deleted.
3030         (JSC::UnlinkedCodeBlock::identifiers): Deleted.
3031         (JSC::UnlinkedCodeBlock::addConstant): Deleted.
3032         (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
3033         (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
3034         (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
3035         (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
3036         (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
3037         (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
3038         (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
3039         (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
3040         (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
3041         (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
3042         (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
3043         (JSC::UnlinkedCodeBlock::superBinding): Deleted.
3044         (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
3045         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
3046         (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
3047         (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
3048         (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
3049         (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
3050         (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
3051         (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
3052         (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
3053         (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
3054         (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
3055         (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
3056         (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
3057         (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
3058         (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
3059         (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
3060         (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
3061         (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
3062         (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
3063         (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
3064         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
3065         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
3066         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
3067         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
3068         (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
3069         (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
3070         (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
3071         (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
3072         (JSC::UnlinkedCodeBlock::codeType): Deleted.
3073         (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
3074         (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
3075         (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
3076         (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
3077         (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
3078         (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
3079         (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
3080         (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
3081         (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
3082         (JSC::UnlinkedCodeBlock::recordParse): Deleted.
3083         (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
3084         (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
3085         (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
3086         (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
3087         (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
3088         (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
3089         (JSC::UnlinkedCodeBlock::firstLine): Deleted.
3090         (JSC::UnlinkedCodeBlock::lineCount): Deleted.
3091         (JSC::UnlinkedCodeBlock::startColumn): Deleted.
3092         (JSC::UnlinkedCodeBlock::endColumn): Deleted.
3093         (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
3094         (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
3095         (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
3096         (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
3097         (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
3098         (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
3099         (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
3100         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
3101         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
3102         * bytecode/UnlinkedFunctionExecutable.cpp:
3103         (JSC::UnlinkedFunctionExecutable::destroy):
3104         * bytecode/UnlinkedGlobalCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
3105         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock):
3106         (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
3107         (JSC::UnlinkedSimpleJumpTable::add): Deleted.
3108         (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
3109         (): Deleted.
3110         (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
3111         (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
3112         (JSC::UnlinkedCodeBlock::usesEval): Deleted.
3113         (JSC::UnlinkedCodeBlock::parseMode): Deleted.
3114         (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
3115         (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
3116         (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
3117         (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
3118         (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
3119         (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
3120         (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
3121         (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
3122         (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
3123         (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
3124         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
3125         (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
3126         (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
3127         (JSC::UnlinkedCodeBlock::addParameter): Deleted.
3128         (JSC::UnlinkedCodeBlock::numParameters): Deleted.
3129         (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
3130         (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
3131         (JSC::UnlinkedCodeBlock::regexp): Deleted.
3132         (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
3133         (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
3134         (JSC::UnlinkedCodeBlock::identifier): Deleted.
3135         (JSC::UnlinkedCodeBlock::identifiers): Deleted.
3136         (JSC::UnlinkedCodeBlock::addConstant): Deleted.
3137         (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
3138         (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
3139         (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
3140         (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
3141         (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
3142         (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
3143         (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
3144         (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
3145         (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
3146         (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
3147         (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
3148         (JSC::UnlinkedCodeBlock::superBinding): Deleted.
3149         (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
3150         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
3151         (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
3152         (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
3153         (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
3154         (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
3155         (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
3156         (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
3157         (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
3158         (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
3159         (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
3160         (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
3161         (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
3162         (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
3163         (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
3164         (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
3165         (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
3166         (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
3167         (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
3168         (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
3169         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
3170         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
3171         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
3172         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
3173         (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
3174         (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
3175         (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
3176         (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
3177         (JSC::UnlinkedCodeBlock::codeType): Deleted.
3178         (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
3179         (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
3180         (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
3181         (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
3182         (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
3183         (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
3184         (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
3185         (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
3186         (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
3187         (JSC::UnlinkedCodeBlock::recordParse): Deleted.
3188         (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
3189         (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
3190         (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
3191         (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
3192         (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
3193         (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
3194         (JSC::UnlinkedCodeBlock::firstLine): Deleted.
3195         (JSC::UnlinkedCodeBlock::lineCount): Deleted.
3196         (JSC::UnlinkedCodeBlock::startColumn): Deleted.
3197         (JSC::UnlinkedCodeBlock::endColumn): Deleted.
3198         (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
3199         (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
3200         (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
3201         (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
3202         (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
3203         (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
3204         (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
3205         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
3206         * bytecode/UnlinkedModuleProgramCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
3207         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
3208         (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
3209         (JSC::UnlinkedCodeBlock::estimatedSize): Deleted.
3210         (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
3211         (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
3212         (JSC::dumpLineColumnEntry): Deleted.
3213         (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
3214         (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
3215         (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
3216         (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
3217         (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
3218         (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
3219         (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
3220         (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
3221         (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
3222         (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
3223         (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
3224         (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
3225         (JSC::UnlinkedCodeBlock::instructions): Deleted.
3226         (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset): Deleted.
3227         (JSC::UnlinkedCodeBlock::handlerForIndex): Deleted.
3228         (JSC::UnlinkedCodeBlock::applyModification): Deleted.
3229         * bytecode/UnlinkedModuleProgramCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
3230         (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
3231         (JSC::UnlinkedSimpleJumpTable::add): Deleted.
3232         (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
3233         (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
3234         (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
3235         (JSC::UnlinkedCodeBlock::usesEval): Deleted.
3236         (JSC::UnlinkedCodeBlock::parseMode): Deleted.
3237         (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
3238         (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
3239         (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
3240         (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
3241         (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
3242         (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
3243         (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
3244         (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
3245         (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
3246         (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
3247         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
3248         (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
3249         (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
3250         (JSC::UnlinkedCodeBlock::addParameter): Deleted.
3251         (JSC::UnlinkedCodeBlock::numParameters): Deleted.
3252         (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
3253         (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
3254         (JSC::UnlinkedCodeBlock::regexp): Deleted.
3255         (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
3256         (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
3257         (JSC::UnlinkedCodeBlock::identifier): Deleted.
3258         (JSC::UnlinkedCodeBlock::identifiers): Deleted.
3259         (JSC::UnlinkedCodeBlock::addConstant): Deleted.
3260         (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
3261         (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
3262         (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
3263         (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
3264         (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
3265         (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
3266         (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
3267         (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
3268         (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
3269         (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
3270         (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
3271         (JSC::UnlinkedCodeBlock::superBinding): Deleted.
3272         (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
3273         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
3274         (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
3275         (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
3276         (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
3277         (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
3278         (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
3279         (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
3280         (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
3281         (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.