Source/JavaScriptCore/ChangeLog

   1 2018-09-24  Saam Barati  <sbarati@apple.com>
   2
   3         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
   4         https://bugs.webkit.org/show_bug.cgi?id=189922
   5         <rdar://problem/44651275>
   6
   7         Reviewed by Mark Lam.
   8
   9         The implementation was first getting the length to iterate up to,
  10         then getting the starting index. However, getting the starting
  11         index may perform effects. e.g, it could change the length of the
  12         array. This changes it so we verify the length is still valid.
  13
  14         * runtime/ArrayPrototype.cpp:
  15         (JSC::arrayProtoFuncIndexOf):
  16
  17 2018-09-24  Tadeu Zagallo  <tzagallo@apple.com>
  18
  19         offlineasm: fix macro scoping
  20         https://bugs.webkit.org/show_bug.cgi?id=189902
  21
  22         Reviewed by Mark Lam.
  23
  24         In the code below, the reference to `f` in `g`, which should refer to
  25         the outer macro definition will instead refer to the f argument of the
  26         anonymous macro passed to `g`. That leads to this code failing to
  27         compile (f expected 0 args but got 1).
  28
  29         ```
  30         macro f(x)
  31             move x, t0
  32         end
  33
  34         macro g(fn)
  35             fn(macro () f(42) end)
  36         end
  37
  38         g(macro(f) f() end)
  39         ```
  40
  41         * offlineasm/ast.rb:
  42         * offlineasm/transform.rb:
  43
  44 2018-09-24  Tadeu Zagallo  <tzagallo@apple.com>
  45
  46         Add forEach method for iterating CodeBlock's ValueProfiles
  47         https://bugs.webkit.org/show_bug.cgi?id=189897
  48
  49         Reviewed by Mark Lam.
  50
  51         Add method to abstract how we find ValueProfiles in a CodeBlock in
  52         preparation for https://bugs.webkit.org/show_bug.cgi?id=189785, when
  53         ValueProfiles will be stored in the MetadataTable.
  54
  55         * bytecode/CodeBlock.cpp:
  56         (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
  57         (JSC::CodeBlock::updateAllValueProfilePredictions):
  58         (JSC::CodeBlock::shouldOptimizeNow):
  59         (JSC::CodeBlock::dumpValueProfiles):
  60         * bytecode/CodeBlock.h:
  61         (JSC::CodeBlock::forEachValueProfile):
  62         (JSC::CodeBlock::numberOfArgumentValueProfiles):
  63         (JSC::CodeBlock::valueProfileForArgument):
  64         (JSC::CodeBlock::numberOfValueProfiles):
  65         (JSC::CodeBlock::valueProfile):
  66         (JSC::CodeBlock::totalNumberOfValueProfiles): Deleted.
  67         (JSC::CodeBlock::getFromAllValueProfiles): Deleted.
  68         * tools/HeapVerifier.cpp:
  69         (JSC::HeapVerifier::validateJSCell):
  70
  71 2018-09-24  Saam barati  <sbarati@apple.com>
  72
  73         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
  74         https://bugs.webkit.org/show_bug.cgi?id=189682
  75         <rdar://problem/43557315>
  76
  77         Reviewed by Mark Lam.
  78
  79         Otherwise, if we have code like this:
  80         ```
  81         a: Arguments
  82         b: GetButterfly(@a)
  83         c: ForceExit
  84         d: GetArrayLength(@a, @b)
  85         ```
  86         it will get transformed into this invalid DFG IR:
  87         ```
  88         a: PhantomArguments
  89         b: Check(@a)
  90         c: ForceExit
  91         d: GetArrayLength(@a, @b)
  92         ```
  93
  94         And we will fail DFG validation since @b does not have a result.
  95
  96         The fix is to just remove all nodes after the ForceExit and plant an
  97         Unreachable after it. So the above code program will now turn into this:
  98         ```
  99         a: PhantomArguments
 100         b: Check(@a)
 101         c: ForceExit
 102         e: Unreachable
 103         ```
 104
 105         * dfg/DFGArgumentsEliminationPhase.cpp:
 106
 107 2018-09-22  Saam barati  <sbarati@apple.com>
 108
 109         The sampling should not use Strong<CodeBlock> in its machineLocation field
 110         https://bugs.webkit.org/show_bug.cgi?id=189319
 111
 112         Reviewed by Filip Pizlo.
 113
 114         The sampling profiler has a CLI mode where we gather information about inline
 115         call frames. That data structure was using a Strong<CodeBlock>. We were
 116         constructing this Strong<CodeBlock> during GC concurrently to processing all
 117         the Strong handles. This is a bug since we end up corrupting that data
 118         structure. This patch fixes this by just making this data structure use the
 119         sampling profiler's mechanism for holding onto and properly visiting heap pointers.
 120
 121         * inspector/agents/InspectorScriptProfilerAgent.cpp:
 122         (Inspector::InspectorScriptProfilerAgent::trackingComplete):
 123         * runtime/SamplingProfiler.cpp:
 124         (JSC::SamplingProfiler::processUnverifiedStackTraces):
 125
 126         (JSC::SamplingProfiler::reportTopFunctions):
 127         (JSC::SamplingProfiler::reportTopBytecodes):
 128         These CLI helpers needed a DeferGC otherwise we may end up deadlocking when we
 129         cause a GC to happen while already holding the sampling profiler's
 130         lock.
 131
 132 2018-09-21  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 133
 134         [JSC] Enable LLInt ASM interpreter on X64 and ARM64 in non JIT configuration
 135         https://bugs.webkit.org/show_bug.cgi?id=189778
 136
 137         Reviewed by Keith Miller.
 138
 139         LLInt ASM interpreter is 2x and 15% faster than CLoop interpreter on
 140         Linux and macOS respectively. We would like to enable it for non JIT
 141         configurations in X86_64 and ARM64.
 142
 143         This patch enables LLInt for non JIT builds in X86_64 and ARM64 architectures.
 144         Previously, we switch LLInt ASM interpreter and CLoop by using ENABLE(JIT)
 145         configuration. But it is wrong in the new scenario since we have a build
 146         configuration that uses LLInt ASM interpreter and JIT is disabled. We introduce
 147         ENABLE(C_LOOP) option, which represents that we use CLoop. And we replace
 148         ENABLE(JIT) with ENABLE(C_LOOP) if the previous ENABLE(JIT) is essentially just
 149         related to LLInt ASM interpreter and not related to JIT.
 150
 151         We also replace some ENABLE(JIT) configurations with ENABLE(ASSEMBLER).
 152         ENABLE(ASSEMBLER) is now enabled even if we disable JIT since MacroAssembler
 153         has machine register information that is used in LLInt ASM interpreter.
 154
 155         * API/tests/PingPongStackOverflowTest.cpp:
 156         (testPingPongStackOverflow):
 157         * CMakeLists.txt:
 158         * JavaScriptCore.xcodeproj/project.pbxproj:
 159         * assembler/MaxFrameExtentForSlowPathCall.h:
 160         * bytecode/CallReturnOffsetToBytecodeOffset.h: Removed. It is no longer used.
 161         * bytecode/CodeBlock.cpp:
 162         (JSC::CodeBlock::finishCreation):
 163         * bytecode/CodeBlock.h:
 164         (JSC::CodeBlock::calleeSaveRegisters const):
 165         (JSC::CodeBlock::numberOfLLIntBaselineCalleeSaveRegisters):
 166         (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters):
 167         (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters):
 168         * bytecode/Opcode.h:
 169         (JSC::padOpcodeName):
 170         * heap/Heap.cpp:
 171         (JSC::Heap::gatherJSStackRoots):
 172         (JSC::Heap::stopThePeriphery):
 173         * interpreter/CLoopStack.cpp:
 174         * interpreter/CLoopStack.h:
 175         * interpreter/CLoopStackInlines.h:
 176         * interpreter/EntryFrame.h:
 177         * interpreter/Interpreter.cpp:
 178         (JSC::Interpreter::Interpreter):
 179         (JSC::UnwindFunctor::copyCalleeSavesToEntryFrameCalleeSavesBuffer const):
 180         * interpreter/Interpreter.h:
 181         * interpreter/StackVisitor.cpp:
 182         (JSC::StackVisitor::Frame::calleeSaveRegisters):
 183         * interpreter/VMEntryRecord.h:
 184         * jit/ExecutableAllocator.h:
 185         * jit/FPRInfo.h:
 186         (WTF::printInternal):
 187         * jit/GPRInfo.cpp:
 188         * jit/GPRInfo.h:
 189         (WTF::printInternal):
 190         * jit/HostCallReturnValue.cpp:
 191         (JSC::getHostCallReturnValueWithExecState): Moved. They are used in LLInt ASM interpreter too.
 192         * jit/HostCallReturnValue.h:
 193         * jit/JITOperations.cpp:
 194         (JSC::getHostCallReturnValueWithExecState): Deleted.
 195         * jit/JITOperationsMSVC64.cpp:
 196         * jit/Reg.cpp:
 197         * jit/Reg.h:
 198         * jit/RegisterAtOffset.cpp:
 199         * jit/RegisterAtOffset.h:
 200         * jit/RegisterAtOffsetList.cpp:
 201         * jit/RegisterAtOffsetList.h:
 202         * jit/RegisterMap.h:
 203         * jit/RegisterSet.cpp:
 204         * jit/RegisterSet.h:
 205         * jit/TempRegisterSet.cpp:
 206         * jit/TempRegisterSet.h:
 207         * llint/LLIntCLoop.cpp:
 208         * llint/LLIntCLoop.h:
 209         * llint/LLIntData.cpp:
 210         (JSC::LLInt::initialize):
 211         (JSC::LLInt::Data::performAssertions):
 212         * llint/LLIntData.h:
 213         * llint/LLIntOfflineAsmConfig.h:
 214         * llint/LLIntOpcode.h:
 215         * llint/LLIntPCRanges.h:
 216         * llint/LLIntSlowPaths.cpp:
 217         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 218         * llint/LLIntSlowPaths.h:
 219         * llint/LLIntThunks.cpp:
 220         * llint/LowLevelInterpreter.cpp:
 221         * llint/LowLevelInterpreter.h:
 222         * runtime/JSCJSValue.h:
 223         * runtime/MachineContext.h:
 224         * runtime/SamplingProfiler.cpp:
 225         (JSC::SamplingProfiler::processUnverifiedStackTraces): Enable SamplingProfiler
 226         for LLInt ASM interpreter with non JIT configuration.
 227         * runtime/TestRunnerUtils.cpp:
 228         (JSC::optimizeNextInvocation):
 229         * runtime/VM.cpp:
 230         (JSC::VM::VM):
 231         (JSC::VM::getHostFunction):
 232         (JSC::VM::updateSoftReservedZoneSize):
 233         (JSC::sanitizeStackForVM):
 234         (JSC::VM::committedStackByteCount):
 235         * runtime/VM.h:
 236         * runtime/VMInlines.h:
 237         (JSC::VM::ensureStackCapacityFor):
 238         (JSC::VM::isSafeToRecurseSoft const):
 239
 240 2018-09-21  Keith Miller  <keith_miller@apple.com>
 241
 242         Add Promise SPI
 243         https://bugs.webkit.org/show_bug.cgi?id=189809
 244
 245         Reviewed by Saam Barati.
 246
 247         The Patch adds new SPI to create promises. It's mostly SPI because
 248         I want to see how internal users react to it before we make it
 249         public.
 250
 251         This patch adds a couple of new Obj-C SPI methods. The first
 252         creates a new promise using the same API that JS does where the
 253         user provides an executor callback. If an exception is raised
 254         in/to that callback the promise is automagically rejected. The
 255         other methods create a pre-resolved or rejected promise as this
 256         appears to be a common way to initialize a promise.
 257
 258         I was also considering adding a second version of executor API
 259         where it would catch specific Obj-C exceptions. This would work by
 260         taking a Class paramter and checking isKindOfClass: on the
 261         exception. I decided against this as nothing else in our API
 262         handles Obj-C exceptions. I'm pretty sure the VM will end up in a
 263         corrupt state if an Obj-C exception unwinds through JS frames.
 264
 265         This patch adds a new C function that will create a "deferred"
 266         promise. A deferred promise is a style of creating promise/futures
 267         where the resolve and reject functions are passed as outputs of a
 268         function. I went with this style for the C SPI because we don't have
 269         any concept of forwarding exceptions in the C API.
 270
 271         In order to make the C API work I refactored a bit of the promise code
 272         so that we can call a static method on JSDeferredPromise and just get
 273         the components without allocating an extra cell wrapper.
 274
 275         * API/JSContext.mm:
 276         (+[JSContext currentCallee]):
 277         * API/JSObjectRef.cpp:
 278         (JSObjectMakeDeferredPromise):
 279         * API/JSObjectRefPrivate.h:
 280         * API/JSValue.mm:
 281         (+[JSValue valueWithNewPromiseInContext:fromExecutor:]):
 282         (+[JSValue valueWithNewPromiseResolvedWithResult:inContext:]):
 283         (+[JSValue valueWithNewPromiseRejectedWithReason:inContext:]):
 284         * API/JSValuePrivate.h: Added.
 285         * API/JSVirtualMachine.mm:
 286         * API/JSVirtualMachinePrivate.h:
 287         * API/tests/testapi.c:
 288         (main):
 289         * API/tests/testapi.cpp:
 290         (APIContext::operator JSC::ExecState*):
 291         (TestAPI::failed const):
 292         (TestAPI::check):
 293         (TestAPI::basicSymbol):
 294         (TestAPI::symbolsTypeof):
 295         (TestAPI::symbolsGetPropertyForKey):
 296         (TestAPI::symbolsSetPropertyForKey):
 297         (TestAPI::symbolsHasPropertyForKey):
 298         (TestAPI::symbolsDeletePropertyForKey):
 299         (TestAPI::promiseResolveTrue):
 300         (TestAPI::promiseRejectTrue):
 301         (testCAPIViaCpp):
 302         (TestAPI::run): Deleted.
 303         * API/tests/testapi.mm:
 304         (testObjectiveCAPIMain):
 305         (promiseWithExecutor):
 306         (promiseRejectOnJSException):
 307         (promiseCreateResolved):
 308         (promiseCreateRejected):
 309         (parallelPromiseResolveTest):
 310         (testObjectiveCAPI):
 311         * JavaScriptCore.xcodeproj/project.pbxproj:
 312         * runtime/JSInternalPromiseDeferred.cpp:
 313         (JSC::JSInternalPromiseDeferred::create):
 314         * runtime/JSPromise.h:
 315         * runtime/JSPromiseConstructor.cpp:
 316         (JSC::constructPromise):
 317         * runtime/JSPromiseDeferred.cpp:
 318         (JSC::JSPromiseDeferred::createDeferredData):
 319         (JSC::JSPromiseDeferred::create):
 320         (JSC::JSPromiseDeferred::finishCreation):
 321         (JSC::newPromiseCapability): Deleted.
 322         * runtime/JSPromiseDeferred.h:
 323         (JSC::JSPromiseDeferred::promise const):
 324         (JSC::JSPromiseDeferred::resolve const):
 325         (JSC::JSPromiseDeferred::reject const):
 326
 327 2018-09-21  Ryan Haddad  <ryanhaddad@apple.com>
 328
 329         Unreviewed, rolling out r236359.
 330
 331         Broke the Windows build.
 332
 333         Reverted changeset:
 334
 335         "Add Promise SPI"
 336         https://bugs.webkit.org/show_bug.cgi?id=189809
 337         https://trac.webkit.org/changeset/236359
 338
 339 2018-09-21  Mark Lam  <mark.lam@apple.com>
 340
 341         JSRopeString::resolveRope() wrongly assumes that tryGetValue() passes it a valid ExecState.
 342         https://bugs.webkit.org/show_bug.cgi?id=189855
 343         <rdar://problem/44680181>
 344
 345         Reviewed by Filip Pizlo.
 346
 347         tryGetValue() always passes a nullptr to JSRopeString::resolveRope() for the
 348         ExecState* argument.  This is intentional so that resolveRope() does not throw
 349         in the event of an OutOfMemory error.  Hence, JSRopeString::resolveRope() should
 350         get the VM from the cell instead of via the ExecState.
 351
 352         Also removed an obsolete and unused field in JSString.
 353
 354         * runtime/JSString.cpp:
 355         (JSC::JSRopeString::resolveRope const):
 356         (JSC::JSRopeString::outOfMemory const):
 357         * runtime/JSString.h:
 358         (JSC::JSString::tryGetValue const):
 359
 360 2018-09-21  Michael Saboff  <msaboff@apple.com>
 361
 362         Add functions to measure memory footprint to JSC
 363         https://bugs.webkit.org/show_bug.cgi?id=189768
 364
 365         Reviewed by Saam Barati.
 366
 367         Rolling this back in again.
 368
 369         Provide system memory metrics for the current process to aid in memory reduction measurement and
 370         tuning using native JS tests.
 371
 372         * jsc.cpp:
 373         (MemoryFootprint::now):
 374         (MemoryFootprint::resetPeak):
 375         (GlobalObject::finishCreation):
 376         (JSCMemoryFootprint::JSCMemoryFootprint):
 377         (JSCMemoryFootprint::createStructure):
 378         (JSCMemoryFootprint::create):
 379         (JSCMemoryFootprint::finishCreation):
 380         (JSCMemoryFootprint::addProperty):
 381         (functionResetMemoryPeak):
 382
 383 2018-09-21  Keith Miller  <keith_miller@apple.com>
 384
 385         Add Promise SPI
 386         https://bugs.webkit.org/show_bug.cgi?id=189809
 387
 388         Reviewed by Saam Barati.
 389
 390         The Patch adds new SPI to create promises. It's mostly SPI because
 391         I want to see how internal users react to it before we make it
 392         public.
 393
 394         This patch adds a couple of new Obj-C SPI methods. The first
 395         creates a new promise using the same API that JS does where the
 396         user provides an executor callback. If an exception is raised
 397         in/to that callback the promise is automagically rejected. The
 398         other methods create a pre-resolved or rejected promise as this
 399         appears to be a common way to initialize a promise.
 400
 401         I was also considering adding a second version of executor API
 402         where it would catch specific Obj-C exceptions. This would work by
 403         taking a Class paramter and checking isKindOfClass: on the
 404         exception. I decided against this as nothing else in our API
 405         handles Obj-C exceptions. I'm pretty sure the VM will end up in a
 406         corrupt state if an Obj-C exception unwinds through JS frames.
 407
 408         This patch adds a new C function that will create a "deferred"
 409         promise. A deferred promise is a style of creating promise/futures
 410         where the resolve and reject functions are passed as outputs of a
 411         function. I went with this style for the C SPI because we don't have
 412         any concept of forwarding exceptions in the C API.
 413
 414         In order to make the C API work I refactored a bit of the promise code
 415         so that we can call a static method on JSDeferredPromise and just get
 416         the components without allocating an extra cell wrapper.
 417
 418         * API/JSContext.mm:
 419         (+[JSContext currentCallee]):
 420         * API/JSObjectRef.cpp:
 421         (JSObjectMakeDeferredPromise):
 422         * API/JSObjectRefPrivate.h:
 423         * API/JSValue.mm:
 424         (+[JSValue valueWithNewPromiseInContext:fromExecutor:]):
 425         (+[JSValue valueWithNewPromiseResolvedWithResult:inContext:]):
 426         (+[JSValue valueWithNewPromiseRejectedWithReason:inContext:]):
 427         * API/JSValuePrivate.h: Added.
 428         * API/JSVirtualMachine.mm:
 429         * API/JSVirtualMachinePrivate.h:
 430         * API/tests/testapi.c:
 431         (main):
 432         * API/tests/testapi.cpp:
 433         (APIContext::operator JSC::ExecState*):
 434         (TestAPI::failed const):
 435         (TestAPI::check):
 436         (TestAPI::basicSymbol):
 437         (TestAPI::symbolsTypeof):
 438         (TestAPI::symbolsGetPropertyForKey):
 439         (TestAPI::symbolsSetPropertyForKey):
 440         (TestAPI::symbolsHasPropertyForKey):
 441         (TestAPI::symbolsDeletePropertyForKey):
 442         (TestAPI::promiseResolveTrue):
 443         (TestAPI::promiseRejectTrue):
 444         (testCAPIViaCpp):
 445         (TestAPI::run): Deleted.
 446         * API/tests/testapi.mm:
 447         (testObjectiveCAPIMain):
 448         (promiseWithExecutor):
 449         (promiseRejectOnJSException):
 450         (promiseCreateResolved):
 451         (promiseCreateRejected):
 452         (parallelPromiseResolveTest):
 453         (testObjectiveCAPI):
 454         * JavaScriptCore.xcodeproj/project.pbxproj:
 455         * runtime/JSInternalPromiseDeferred.cpp:
 456         (JSC::JSInternalPromiseDeferred::create):
 457         * runtime/JSPromise.h:
 458         * runtime/JSPromiseConstructor.cpp:
 459         (JSC::constructPromise):
 460         * runtime/JSPromiseDeferred.cpp:
 461         (JSC::JSPromiseDeferred::createDeferredData):
 462         (JSC::JSPromiseDeferred::create):
 463         (JSC::JSPromiseDeferred::finishCreation):
 464         (JSC::newPromiseCapability): Deleted.
 465         * runtime/JSPromiseDeferred.h:
 466         (JSC::JSPromiseDeferred::promise const):
 467         (JSC::JSPromiseDeferred::resolve const):
 468         (JSC::JSPromiseDeferred::reject const):
 469
 470 2018-09-21  Truitt Savell  <tsavell@apple.com>
 471
 472         Rebaseline tests after changes in https://trac.webkit.org/changeset/236321/webkit
 473         https://bugs.webkit.org/show_bug.cgi?id=156674
 474
 475         Unreviewed Test Gardening
 476
 477         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
 478         * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
 479
 480 2018-09-21  Mike Gorse  <mgorse@suse.com>
 481
 482         Build tools should work when the /usr/bin/python is python3
 483         https://bugs.webkit.org/show_bug.cgi?id=156674
 484
 485         Reviewed by Michael Catanzaro.
 486
 487         * Scripts/cssmin.py:
 488         * Scripts/generate-js-builtins.py:
 489         (do_open):
 490         (generate_bindings_for_builtins_files):
 491         * Scripts/generateIntlCanonicalizeLanguage.py:
 492         * Scripts/jsmin.py:
 493         (JavascriptMinify.minify.write):
 494         (JavascriptMinify):
 495         (JavascriptMinify.minify):
 496         * Scripts/make-js-file-arrays.py:
 497         (chunk):
 498         (main):
 499         * Scripts/wkbuiltins/__init__.py:
 500         * Scripts/wkbuiltins/builtins_generate_combined_header.py:
 501         (generate_section_for_global_private_code_name_macro):
 502         * Scripts/wkbuiltins/builtins_generate_internals_wrapper_header.py:
 503         (BuiltinsInternalsWrapperHeaderGenerator.__init__):
 504         * Scripts/wkbuiltins/builtins_generate_internals_wrapper_implementation.py:
 505         (BuiltinsInternalsWrapperImplementationGenerator.__init__):
 506         * Scripts/wkbuiltins/builtins_model.py:
 507         (BuiltinFunction.__lt__):
 508         (BuiltinsCollection.copyrights):
 509         (BuiltinsCollection._parse_functions):
 510         * disassembler/udis86/ud_opcode.py:
 511         (UdOpcodeTables.pprint.printWalk):
 512         * generate-bytecode-files:
 513         * inspector/scripts/codegen/__init__.py:
 514         * inspector/scripts/codegen/cpp_generator.py:
 515         * inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py:
 516         (CppAlternateBackendDispatcherHeaderGenerator.generate_output):
 517         * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
 518         (CppBackendDispatcherHeaderGenerator.domains_to_generate):
 519         (CppBackendDispatcherHeaderGenerator.generate_output):
 520         (CppBackendDispatcherHeaderGenerator._generate_dispatcher_declarations_for_domain):
 521         * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
 522         (CppBackendDispatcherImplementationGenerator.domains_to_generate):
 523         (CppBackendDispatcherImplementationGenerator.generate_output):
 524         * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
 525         (CppFrontendDispatcherHeaderGenerator.domains_to_generate):
 526         (CppFrontendDispatcherHeaderGenerator.generate_output):
 527         * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
 528         (CppFrontendDispatcherImplementationGenerator.domains_to_generate):
 529         (CppFrontendDispatcherImplementationGenerator.generate_output):
 530         * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
 531         (CppProtocolTypesHeaderGenerator.generate_output):
 532         (CppProtocolTypesHeaderGenerator._generate_forward_declarations):
 533         * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
 534         (CppProtocolTypesImplementationGenerator.generate_output):
 535         (CppProtocolTypesImplementationGenerator._generate_enum_conversion_methods_for_domain):
 536         (CppProtocolTypesImplementationGenerator._generate_enum_mapping_and_conversion_methods):
 537         (CppProtocolTypesImplementationGenerator._generate_open_field_names):
 538         (CppProtocolTypesImplementationGenerator._generate_builders_for_domain):
 539         (CppProtocolTypesImplementationGenerator._generate_assertion_for_object_declaration):
 540         * inspector/scripts/codegen/generate_js_backend_commands.py:
 541         (JSBackendCommandsGenerator.should_generate_domain):
 542         (JSBackendCommandsGenerator.domains_to_generate):
 543         (JSBackendCommandsGenerator.generate_output):
 544         (JSBackendCommandsGenerator.generate_domain):
 545         * inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:
 546         (ObjCBackendDispatcherHeaderGenerator.domains_to_generate):
 547         (ObjCBackendDispatcherHeaderGenerator.generate_output):
 548         * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
 549         (ObjCBackendDispatcherImplementationGenerator.domains_to_generate):
 550         (ObjCBackendDispatcherImplementationGenerator.generate_output):
 551         (ObjCBackendDispatcherImplementationGenerator._generate_success_block_for_command):
 552         * inspector/scripts/codegen/generate_objc_configuration_header.py:
 553         * inspector/scripts/codegen/generate_objc_configuration_implementation.py:
 554         * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
 555         (ObjCFrontendDispatcherImplementationGenerator.domains_to_generate):
 556         (ObjCFrontendDispatcherImplementationGenerator.generate_output):
 557         (ObjCFrontendDispatcherImplementationGenerator._generate_event):
 558         * inspector/scripts/codegen/generate_objc_header.py:
 559         (ObjCHeaderGenerator.generate_output):
 560         (ObjCHeaderGenerator._generate_type_interface):
 561         * inspector/scripts/codegen/generate_objc_internal_header.py:
 562         (ObjCInternalHeaderGenerator.generate_output):
 563         * inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py:
 564         (ObjCProtocolTypeConversionsHeaderGenerator.domains_to_generate):
 565         (ObjCProtocolTypeConversionsHeaderGenerator.generate_output):
 566         * inspector/scripts/codegen/generate_objc_protocol_type_conversions_implementation.py:
 567         (ObjCProtocolTypeConversionsImplementationGenerator.domains_to_generate):
 568         * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
 569         (ObjCProtocolTypesImplementationGenerator.domains_to_generate):
 570         (ObjCProtocolTypesImplementationGenerator.generate_output):
 571         (ObjCProtocolTypesImplementationGenerator.generate_type_implementation):
 572         (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_required_members):
 573         * inspector/scripts/codegen/generator.py:
 574         (Generator.non_supplemental_domains):
 575         (Generator.open_fields):
 576         (Generator.calculate_types_requiring_shape_assertions):
 577         (Generator._traverse_and_assign_enum_values):
 578         (Generator.stylized_name_for_enum_value):
 579         * inspector/scripts/codegen/models.py:
 580         (find_duplicates):
 581         * inspector/scripts/codegen/objc_generator.py:
 582         * wasm/generateWasm.py:
 583         (opcodeIterator):
 584         * yarr/generateYarrCanonicalizeUnicode:
 585         * yarr/generateYarrUnicodePropertyTables.py:
 586         * yarr/hasher.py:
 587         (stringHash):
 588
 589 2018-09-21  Tomas Popela  <tpopela@redhat.com>
 590
 591         [ARM] Build broken on armv7hl after r235517
 592         https://bugs.webkit.org/show_bug.cgi?id=189831
 593
 594         Reviewed by Yusuke Suzuki.
 595
 596         Add missing implementation of patchebleBranch8() for traditional ARM.
 597
 598         * assembler/MacroAssemblerARM.h:
 599         (JSC::MacroAssemblerARM::patchableBranch8):
 600
 601 2018-09-20  Ryan Haddad  <ryanhaddad@apple.com>
 602
 603         Unreviewed, rolling out r236293.
 604
 605         Internal build still broken.
 606
 607         Reverted changeset:
 608
 609         "Add functions to measure memory footprint to JSC"
 610         https://bugs.webkit.org/show_bug.cgi?id=189768
 611         https://trac.webkit.org/changeset/236293
 612
 613 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 614
 615         [JSC] Heap::reportExtraMemoryVisited shows contention if we have many JSString
 616         https://bugs.webkit.org/show_bug.cgi?id=189558
 617
 618         Reviewed by Mark Lam.
 619
 620         When running web-tooling-benchmark postcss test on Linux JSCOnly port, we get the following result in `perf report`.
 621
 622             10.95%  AutomaticThread  libJavaScriptCore.so.1.0.0  [.] JSC::Heap::reportExtraMemoryVisited
 623
 624         This is because postcss produces bunch of JSString, which require reportExtraMemoryVisited calls in JSString::visitChildren.
 625         And since reportExtraMemoryVisited attempts to update atomic counter, if we have bunch of marking threads, it becomes super contended.
 626
 627         This patch reduces the frequency of updating the atomic counter. Each SlotVisitor has per-SlotVisitor m_extraMemorySize counter.
 628         And we propagate this value to the global atomic counter when rebalance happens.
 629
 630         We also reduce HeapCell::heap() access by using `vm.heap`.
 631
 632         * heap/SlotVisitor.cpp:
 633         (JSC::SlotVisitor::didStartMarking):
 634         (JSC::SlotVisitor::propagateExternalMemoryVisitedIfNecessary):
 635         (JSC::SlotVisitor::drain):
 636         (JSC::SlotVisitor::performIncrementOfDraining):
 637         * heap/SlotVisitor.h:
 638         * heap/SlotVisitorInlines.h:
 639         (JSC::SlotVisitor::reportExtraMemoryVisited):
 640         * runtime/JSString.cpp:
 641         (JSC::JSRopeString::resolveRopeToAtomicString const):
 642         (JSC::JSRopeString::resolveRope const):
 643         * runtime/JSString.h:
 644         (JSC::JSString::finishCreation):
 645         * wasm/js/JSWebAssemblyInstance.cpp:
 646         (JSC::JSWebAssemblyInstance::finishCreation):
 647         * wasm/js/JSWebAssemblyMemory.cpp:
 648         (JSC::JSWebAssemblyMemory::finishCreation):
 649
 650 2018-09-20  Michael Saboff  <msaboff@apple.com>
 651
 652         Add functions to measure memory footprint to JSC
 653         https://bugs.webkit.org/show_bug.cgi?id=189768
 654
 655         Reviewed by Saam Barati.
 656
 657         Rolling this back in.
 658
 659         Provide system memory metrics for the current process to aid in memory reduction measurement and
 660         tuning using native JS tests.
 661
 662         * jsc.cpp:
 663         (MemoryFootprint::now):
 664         (MemoryFootprint::resetPeak):
 665         (GlobalObject::finishCreation):
 666         (JSCMemoryFootprint::JSCMemoryFootprint):
 667         (JSCMemoryFootprint::createStructure):
 668         (JSCMemoryFootprint::create):
 669         (JSCMemoryFootprint::finishCreation):
 670         (JSCMemoryFootprint::addProperty):
 671         (functionResetMemoryPeak):
 672
 673 2018-09-20  Ryan Haddad  <ryanhaddad@apple.com>
 674
 675         Unreviewed, rolling out r236235.
 676
 677         Breaks internal builds.
 678
 679         Reverted changeset:
 680
 681         "Add functions to measure memory footprint to JSC"
 682         https://bugs.webkit.org/show_bug.cgi?id=189768
 683         https://trac.webkit.org/changeset/236235
 684
 685 2018-09-20  Fujii Hironori  <Hironori.Fujii@sony.com>
 686
 687         [Win][Clang] JITMathIC.h: error: missing 'template' keyword prior to dependent template name 'retagged'
 688         https://bugs.webkit.org/show_bug.cgi?id=189730
 689
 690         Reviewed by Saam Barati.
 691
 692         Clang for Windows can't compile the workaround for MSVC quirk in generateOutOfLine.
 693
 694         * jit/JITMathIC.h:
 695         (generateOutOfLine): Append "&& !COMPILER(CLANG)" to "#if COMPILER(MSVC)".
 696
 697 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 698
 699         [JSC] Optimize Array#indexOf in C++ runtime
 700         https://bugs.webkit.org/show_bug.cgi?id=189507
 701
 702         Reviewed by Saam Barati.
 703
 704         C++ Array#indexOf runtime function takes so much time in babylon benchmark in
 705         web-tooling-benchmark. While our DFG and FTL has Array#indexOf optimization
 706         and actually it is working well, C++ Array#indexOf is called significant amount
 707         of time before tiering up, and it takes 6.74% of jsc main thread samples according
 708         to perf command in Linux. This is because C++ Array#indexOf is too generic and
 709         misses the chance to optimize JSArray cases.
 710
 711         This patch adds JSArray fast path for Array#indexOf. If we know that indexed
 712         access to the given JSArray is non-observable and indexing type is good for the fast
 713         path, we go to the fast path. This makes sampling of Array#indexOf 3.83% in
 714         babylon web-tooling-benchmark.
 715
 716         * runtime/ArrayPrototype.cpp:
 717         (JSC::arrayProtoFuncIndexOf):
 718         * runtime/JSArray.h:
 719         * runtime/JSArrayInlines.h:
 720         (JSC::JSArray::canDoFastIndexedAccess):
 721         (JSC::toLength):
 722         * runtime/JSCJSValueInlines.h:
 723         (JSC::JSValue::JSValue):
 724         * runtime/JSGlobalObject.h:
 725         * runtime/JSGlobalObjectInlines.h:
 726         (JSC::JSGlobalObject::isArrayPrototypeIndexedAccessFastAndNonObservable):
 727         (JSC::JSGlobalObject::isArrayPrototypeIteratorProtocolFastAndNonObservable):
 728         * runtime/MathCommon.h:
 729         (JSC::canBeStrictInt32):
 730         (JSC::canBeInt32):
 731
 732 2018-09-19  Michael Saboff  <msaboff@apple.com>
 733
 734         Add functions to measure memory footprint to JSC
 735         https://bugs.webkit.org/show_bug.cgi?id=189768
 736
 737         Reviewed by Saam Barati.
 738
 739         Provide system memory metrics for the current process to aid in memory reduction measurement and
 740         tuning using native JS tests.
 741
 742         * jsc.cpp:
 743         (MemoryFootprint::now):
 744         (MemoryFootprint::resetPeak):
 745         (GlobalObject::finishCreation):
 746         (JSCMemoryFootprint::JSCMemoryFootprint):
 747         (JSCMemoryFootprint::createStructure):
 748         (JSCMemoryFootprint::create):
 749         (JSCMemoryFootprint::finishCreation):
 750         (JSCMemoryFootprint::addProperty):
 751         (functionResetMemoryPeak):
 752
 753 2018-09-19  Saam barati  <sbarati@apple.com>
 754
 755         CheckStructureOrEmpty should pass in a tempGPR to emitStructureCheck since it may jump over that code
 756         https://bugs.webkit.org/show_bug.cgi?id=189703
 757
 758         Reviewed by Mark Lam.
 759
 760         This fixes a crash that a TypeProfiler change revealed.
 761
 762         * dfg/DFGSpeculativeJIT64.cpp:
 763         (JSC::DFG::SpeculativeJIT::compile):
 764
 765 2018-09-19  Saam barati  <sbarati@apple.com>
 766
 767         AI rule for MultiPutByOffset executes its effects in the wrong order
 768         https://bugs.webkit.org/show_bug.cgi?id=189757
 769         <rdar://problem/43535257>
 770
 771         Reviewed by Michael Saboff.
 772
 773         The AI rule for MultiPutByOffset was executing effects in the wrong order.
 774         It first executed the transition effects and the effects on the base, and
 775         then executed the filtering effects on the value being stored. However, you
 776         can end up with the wrong type when the base and the value being stored
 777         are the same. E.g, in a program like `o.f = o`. These effects need to happen
 778         in the opposite order, modeling what happens in the runtime executing of
 779         MultiPutByOffset.
 780
 781         * dfg/DFGAbstractInterpreterInlines.h:
 782         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
 783
 784 2018-09-18  Mark Lam  <mark.lam@apple.com>
 785
 786         Ensure that ForInContexts are invalidated if their loop local is over-written.
 787         https://bugs.webkit.org/show_bug.cgi?id=189571
 788         <rdar://problem/44402277>
 789
 790         Reviewed by Saam Barati.
 791
 792         Instead of hunting down every place in the BytecodeGenerator that potentially
 793         needs to invalidate an enclosing ForInContext (if one exists), we simply iterate
 794         the bytecode range of the loop body when the ForInContext is popped, and
 795         invalidate the context if we ever find the loop temp variable over-written.
 796
 797         This has 2 benefits:
 798         1. It ensures that every type of opcode that can write to the loop temp will be
 799            handled appropriately, not just the op_mov that we've hunted down.
 800         2. It avoids us having to check the BytecodeGenerator's m_forInContextStack
 801            every time we emit an op_mov (or other opcodes that can write to a local)
 802            even when we're not inside a for-in loop.
 803
 804         JSC benchmarks show that that this change is performance neutral.
 805
 806         * bytecompiler/BytecodeGenerator.cpp:
 807         (JSC::BytecodeGenerator::pushIndexedForInScope):
 808         (JSC::BytecodeGenerator::popIndexedForInScope):
 809         (JSC::BytecodeGenerator::pushStructureForInScope):
 810         (JSC::BytecodeGenerator::popStructureForInScope):
 811         (JSC::ForInContext::finalize):
 812         (JSC::StructureForInContext::finalize):
 813         (JSC::IndexedForInContext::finalize):
 814         (JSC::BytecodeGenerator::invalidateForInContextForLocal): Deleted.
 815         * bytecompiler/BytecodeGenerator.h:
 816         (JSC::ForInContext::ForInContext):
 817         (JSC::ForInContext::bodyBytecodeStartOffset const):
 818         (JSC::StructureForInContext::StructureForInContext):
 819         (JSC::IndexedForInContext::IndexedForInContext):
 820         * bytecompiler/NodesCodegen.cpp:
 821         (JSC::PostfixNode::emitResolve):
 822         (JSC::PrefixNode::emitResolve):
 823         (JSC::ReadModifyResolveNode::emitBytecode):
 824         (JSC::AssignResolveNode::emitBytecode):
 825         (JSC::EmptyLetExpression::emitBytecode):
 826         (JSC::ForInNode::emitLoopHeader):
 827         (JSC::ForOfNode::emitBytecode):
 828         (JSC::BindingNode::bindValue const):
 829         (JSC::AssignmentElementNode::bindValue const):
 830         * runtime/CommonSlowPaths.cpp:
 831         (JSC::SLOW_PATH_DECL):
 832
 833 2018-09-17  Devin Rousso  <drousso@apple.com>
 834
 835         Web Inspector: generate CSSKeywordCompletions from backend values
 836         https://bugs.webkit.org/show_bug.cgi?id=189041
 837
 838         Reviewed by Joseph Pecoraro.
 839
 840         * inspector/protocol/CSS.json:
 841         Include an optional `aliases` array and `inherited` boolean for `CSSPropertyInfo`.
 842
 843 2018-09-17  Saam barati  <sbarati@apple.com>
 844
 845         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
 846         https://bugs.webkit.org/show_bug.cgi?id=189676
 847         <rdar://problem/39682897>
 848
 849         Reviewed by Michael Saboff.
 850
 851         Because the incoming value may be TDZ, CheckStructure may end up crashing.
 852         Since the Type Profile does not currently record TDZ values in any of its
 853         data structures, this is not a semantic change in how it will show you data.
 854         It just fixes crashes when we emit a CheckStructure and the incoming value
 855         is TDZ.
 856
 857         * dfg/DFGFixupPhase.cpp:
 858         (JSC::DFG::FixupPhase::fixupNode):
 859         * dfg/DFGNode.h:
 860         (JSC::DFG::Node::convertToCheckStructureOrEmpty):
 861
 862 2018-09-17  Darin Adler  <darin@apple.com>
 863
 864         Use OpaqueJSString rather than JSRetainPtr inside WebKit
 865         https://bugs.webkit.org/show_bug.cgi?id=189652
 866
 867         Reviewed by Saam Barati.
 868
 869         * API/JSCallbackObjectFunctions.h: Removed an uneeded include of
 870         JSStringRef.h.
 871
 872         * API/JSContext.mm:
 873         (-[JSContext evaluateScript:withSourceURL:]): Use OpaqueJSString::create rather
 874         than JSStringCreateWithCFString, simplifying the code and also obviating the
 875         need for explicit JSStringRelease.
 876         (-[JSContext setName:]): Ditto.
 877
 878         * API/JSStringRef.cpp:
 879         (JSStringIsEqualToUTF8CString): Use adoptRef rather than explicit JSStringRelease.
 880         It seems that additional optimization is possible, obviating the need to allocate
 881         an OpaqueJSString, but that's true almost everywhere else in this patch, too.
 882
 883         * API/JSValue.mm:
 884         (+[JSValue valueWithNewRegularExpressionFromPattern:flags:inContext:]): Use
 885         OpaqueJSString::create and adoptRef as appropriate.
 886         (+[JSValue valueWithNewErrorFromMessage:inContext:]): Ditto.
 887         (+[JSValue valueWithNewSymbolFromDescription:inContext:]): Ditto.
 888         (performPropertyOperation): Ditto.
 889         (-[JSValue invokeMethod:withArguments:]): Ditto.
 890         (valueToObjectWithoutCopy): Ditto.
 891         (containerValueToObject): Ditto.
 892         (valueToString): Ditto.
 893         (objectToValueWithoutCopy): Ditto.
 894         (objectToValue): Ditto.
 895
 896 2018-09-08  Darin Adler  <darin@apple.com>
 897
 898         Streamline JSRetainPtr, fix leaks of JSString and JSGlobalContext
 899         https://bugs.webkit.org/show_bug.cgi?id=189455
 900
 901         Reviewed by Keith Miller.
 902
 903         * API/JSObjectRef.cpp:
 904         (OpaqueJSPropertyNameArray): Use Ref<OpaqueJSString> instead of
 905         JSRetainPtr<JSStringRef>.
 906         (JSObjectCopyPropertyNames): Remove now-unneeded use of leakRef and
 907         adopt constructor.
 908         (JSPropertyNameArrayGetNameAtIndex): Use ptr() instead of get() since
 909         the array elements are now Ref.
 910
 911         * API/JSRetainPtr.h: While JSRetainPtr is written as a template,
 912         it only works for two specific unrelated types, JSStringRef and
 913         JSGlobalContextRef. Simplified the default constructor using data
 914         member initialization. Prepared to make the adopt constructor private
 915         (got everything compiling that way, then made it public again so that
 916         Apple internal software will still build). Got rid of unneeded
 917         templated constructor and assignment operator, since it's not relevant
 918         since there is no inheritance between JSRetainPtr template types.
 919         Added WARN_UNUSED_RETURN to leakRef as in RefPtr and RetainPtr.
 920         Added move constructor and move assignment operator for slightly better
 921         performance. Simplified implementations of various member functions
 922         so they are more obviously correct, by using leakPtr in more of them
 923         and using std::exchange to make the flow of values more obvious.
 924
 925         * API/JSValue.mm:
 926         (+[JSValue valueWithNewSymbolFromDescription:inContext:]): Added a
 927         missing JSStringRelease to fix a leak.
 928
 929         * API/tests/CustomGlobalObjectClassTest.c:
 930         (customGlobalObjectClassTest): Added a JSGlobalContextRelease to fix a leak.
 931         (globalObjectSetPrototypeTest): Ditto.
 932         (globalObjectPrivatePropertyTest): Ditto.
 933
 934         * API/tests/ExecutionTimeLimitTest.cpp:
 935         (testResetAfterTimeout): Added a call to JSStringRelease to fix a leak.
 936         (testExecutionTimeLimit): Ditto, lots more.
 937
 938         * API/tests/FunctionOverridesTest.cpp:
 939         (testFunctionOverrides): Added a call to JSStringRelease to fix a leak.
 940
 941         * API/tests/JSObjectGetProxyTargetTest.cpp:
 942         (testJSObjectGetProxyTarget): Added a call to JSGlobalContextRelease to fix
 943         a leak.
 944
 945         * API/tests/PingPongStackOverflowTest.cpp:
 946         (testPingPongStackOverflow): Added calls to JSGlobalContextRelease and
 947         JSStringRelease to fix leaks.
 948
 949         * API/tests/testapi.c:
 950         (throwException): Added. Helper function for repeated idiom where we want
 951         to throw an exception, but with additional JSStringRelease calls so we don't
 952         have to leak just to keep the code simpler to read.
 953         (MyObject_getProperty): Use throwException.
 954         (MyObject_setProperty): Ditto.
 955         (MyObject_deleteProperty): Ditto.
 956         (isValueEqualToString): Added. Helper function for an idiom where we check
 957         if something is a string and then if it's equal to a particular string
 958         constant, but a version that has an additional JSStringRelease call so we
 959         don't have to leak just to keep the code simpler to read.
 960         (MyObject_callAsFunction): Use isValueEqualToString and throwException.
 961         (MyObject_callAsConstructor): Ditto.
 962         (MyObject_hasInstance): Ditto.
 963         (globalContextNameTest): Added a JSGlobalContextRelease to fix a leak.
 964         (testMarkingConstraintsAndHeapFinalizers): Ditto.
 965
 966 2018-09-14  Saam barati  <sbarati@apple.com>
 967
 968         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
 969         https://bugs.webkit.org/show_bug.cgi?id=189628
 970         <rdar://problem/39481690>
 971
 972         Reviewed by Mark Lam.
 973
 974         An Availability may point to a Node. And that Node may be removed from
 975         the graph, e.g, it's freed and its memory is no longer owned by Graph.
 976         This patch makes it so we no longer dump this metadata by default. If
 977         this metadata is interesting to you, you'll need to go in and change
 978         Graph::dump to dump the needed metadata.
 979
 980         * dfg/DFGGraph.cpp:
 981         (JSC::DFG::Graph::dump):
 982
 983 2018-09-14  Mark Lam  <mark.lam@apple.com>
 984
 985         Refactor some ForInContext code for better encapsulation.
 986         https://bugs.webkit.org/show_bug.cgi?id=189626
 987         <rdar://problem/44466415>
 988
 989         Reviewed by Keith Miller.
 990
 991         1. Add a ForInContext::m_type field to store the context type.  This does not
 992            increase the class size, but eliminates the need for a virtual call to get the
 993            type.
 994
 995            Note: we still need a virtual destructor because we'll be mingling
 996            IndexedForInContexts and StructureForInContexts in the BytecodeGenerator::m_forInContextStack.
 997
 998         2. Add ForInContext::isIndexedForInContext() and ForInContext::isStructureForInContext()
 999            convenience methods.
1000
1001         3. Add ForInContext::asIndexedForInContext() and ForInContext::asStructureForInContext()
1002            to do the casting to the subclass types.  This ensures that we'll properly
1003            assert that the casting is legal.
1004
1005         * bytecompiler/BytecodeGenerator.cpp:
1006         (JSC::BytecodeGenerator::emitGetByVal):
1007         (JSC::BytecodeGenerator::popIndexedForInScope):
1008         (JSC::BytecodeGenerator::popStructureForInScope):
1009         * bytecompiler/BytecodeGenerator.h:
1010         (JSC::ForInContext::type const):
1011         (JSC::ForInContext::isIndexedForInContext const):
1012         (JSC::ForInContext::isStructureForInContext const):
1013         (JSC::ForInContext::asIndexedForInContext):
1014         (JSC::ForInContext::asStructureForInContext):
1015         (JSC::ForInContext::ForInContext):
1016         (JSC::StructureForInContext::StructureForInContext):
1017         (JSC::IndexedForInContext::IndexedForInContext):
1018         (JSC::ForInContext::~ForInContext): Deleted.
1019
1020 2018-09-14  Devin Rousso  <webkit@devinrousso.com>
1021
1022         Web Inspector: Record actions performed on ImageBitmapRenderingContext
1023         https://bugs.webkit.org/show_bug.cgi?id=181341
1024
1025         Reviewed by Joseph Pecoraro.
1026
1027         * inspector/protocol/Recording.json:
1028         * inspector/scripts/codegen/generator.py:
1029
1030 2018-09-14  Mike Gorse  <mgorse@suse.com>
1031
1032         builtins directory causes name conflict on Python 3
1033         https://bugs.webkit.org/show_bug.cgi?id=189552
1034
1035         Reviewed by Michael Catanzaro.
1036
1037         * CMakeLists.txt: builtins -> wkbuiltins.
1038         * DerivedSources.make: builtins -> wkbuiltins.
1039         * Scripts/generate-js-builtins.py: import wkbuiltins, rather than
1040           builtins.
1041         * Scripts/wkbuiltins/__init__.py: Renamed from Source/JavaScriptCore/Scripts/builtins/__init__.py.
1042         * Scripts/wkbuiltins/builtins_generate_combined_header.py: Renamed from Source/JavaScriptCore/Scripts/builtins/builtins_generate_combined_header.py.
1043         * Scripts/wkbuiltins/builtins_generate_internals_wrapper_implementation.py: Renamed from Source/JavaScriptCore/Scripts/builtins/builtins_generate_internals_wrapper_implementation.py.
1044         * Scripts/wkbuiltins/builtins_generate_separate_header.py: Renamed from Source/JavaScriptCore/Scripts/builtins/builtins_generate_separate_header.py.
1045         * Scripts/wkbuiltins/builtins_generate_separate_implementation.py: Renamed from Source/JavaScriptCore/Scripts/builtins/builtins_generate_separate_implementation.py.
1046         * Scripts/wkbuiltins/builtins_generate_wrapper_header.py: Renamed from Source/JavaScriptCore/Scripts/builtins/builtins_generate_wrapper_header.py.
1047         * Scripts/wkbuiltins/builtins_generate_wrapper_implementation.py: Renamed from Source/JavaScriptCore/Scripts/builtins/builtins_generate_wrapper_implementation.py.
1048         * Scripts/wkbuiltins/builtins_generator.py: Renamed from Source/JavaScriptCore/Scripts/builtins/builtins_generator.py.
1049         * Scripts/wkbuiltins/builtins_model.py: Renamed from Source/JavaScriptCore/Scripts/builtins/builtins_model.py.
1050         * Scripts/wkbuiltins/builtins_templates.py: Renamed from Source/JavaScriptCore/Scripts/builtins/builtins_templates.py.
1051         * Scripts/wkbuiltins/wkbuiltins.py: Renamed from Source/JavaScriptCore/Scripts/builtins/builtins.py.
1052         * JavaScriptCore.xcodeproj/project.pbxproj: Update for the renaming.
1053
1054 2018-09-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1055
1056         [WebAssembly] Inline WasmContext accessor functions
1057         https://bugs.webkit.org/show_bug.cgi?id=189416
1058
1059         Reviewed by Saam Barati.
1060
1061         WasmContext accessor functions are very small while it resides in the critical path of
1062         JS to Wasm function call. This patch makes them inline to improve performance.
1063         This change improves a small benchmark (calling JS to Wasm function 1e7 times) from 320ms to 270ms.
1064
1065         * JavaScriptCore.xcodeproj/project.pbxproj:
1066         * Sources.txt:
1067         * interpreter/CallFrame.cpp:
1068         * jit/AssemblyHelpers.cpp:
1069         * wasm/WasmB3IRGenerator.cpp:
1070         * wasm/WasmContextInlines.h: Renamed from Source/JavaScriptCore/wasm/WasmContext.cpp.
1071         (JSC::Wasm::Context::useFastTLS):
1072         (JSC::Wasm::Context::load const):
1073         (JSC::Wasm::Context::store):
1074         * wasm/WasmMemoryInformation.cpp:
1075         * wasm/WasmModuleParser.cpp: Include <wtf/SHA1.h> due to changes of unified source combinations.
1076         * wasm/js/JSToWasm.cpp:
1077         * wasm/js/WebAssemblyFunction.cpp:
1078
1079 2018-09-12  David Kilzer  <ddkilzer@apple.com>
1080
1081         Move JavaScriptCore files to match Xcode project hierarchy
1082         <https://webkit.org/b/189574>
1083
1084         Reviewed by Filip Pizlo.
1085
1086         * API/JSAPIValueWrapper.cpp: Rename from Source/JavaScriptCore/runtime/JSAPIValueWrapper.cpp.
1087         * API/JSAPIValueWrapper.h: Rename from Source/JavaScriptCore/runtime/JSAPIValueWrapper.h.
1088         * CMakeLists.txt: Update for new path to
1089         generateYarrUnicodePropertyTables.py, hasher.py and
1090         JSAPIValueWrapper.h.
1091         * DerivedSources.make: Ditto. Add missing dependency on
1092         hasher.py captured by CMakeLists.txt.
1093         * JavaScriptCore.xcodeproj/project.pbxproj: Update for new file
1094         reference paths. Add hasher.py library to project.
1095         * Sources.txt: Update for new path to
1096         JSAPIValueWrapper.cpp.
1097         * runtime/JSImmutableButterfly.h: Add missing includes
1098         after changes to Sources.txt and regenerating unified
1099         sources.
1100         * runtime/RuntimeType.h: Ditto.
1101         * yarr/generateYarrUnicodePropertyTables.py: Rename from Source/JavaScriptCore/Scripts/generateYarrUnicodePropertyTables.py.
1102         * yarr/hasher.py: Rename from Source/JavaScriptCore/Scripts/hasher.py.
1103
1104 2018-09-12  David Kilzer  <ddkilzer@apple.com>
1105
1106         Let Xcode have its way with the JavaScriptCore project
1107
1108         * JavaScriptCore.xcodeproj/project.pbxproj:
1109
1110 2018-09-12  Guillaume Emont  <guijemont@igalia.com>
1111
1112         Add IGNORE_WARNING_.* macros
1113         https://bugs.webkit.org/show_bug.cgi?id=188996
1114
1115         Reviewed by Michael Catanzaro.
1116
1117         * API/JSCallbackObject.h:
1118         * API/tests/testapi.c:
1119         * assembler/LinkBuffer.h:
1120         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
1121         * b3/B3LowerToAir.cpp:
1122         * b3/B3Opcode.cpp:
1123         * b3/B3Type.h:
1124         * b3/B3TypeMap.h:
1125         * b3/B3Width.h:
1126         * b3/air/AirArg.cpp:
1127         * b3/air/AirArg.h:
1128         * b3/air/AirCode.h:
1129         * bytecode/Opcode.h:
1130         (JSC::padOpcodeName):
1131         * dfg/DFGSpeculativeJIT.cpp:
1132         (JSC::DFG::SpeculativeJIT::speculateNumber):
1133         (JSC::DFG::SpeculativeJIT::speculateMisc):
1134         * dfg/DFGSpeculativeJIT64.cpp:
1135         * ftl/FTLOutput.h:
1136         * jit/CCallHelpers.h:
1137         (JSC::CCallHelpers::calculatePokeOffset):
1138         * llint/LLIntData.cpp:
1139         * llint/LLIntSlowPaths.cpp:
1140         (JSC::LLInt::slowPathLogF):
1141         * runtime/ConfigFile.cpp:
1142         (JSC::ConfigFile::canonicalizePaths):
1143         * runtime/JSDataViewPrototype.cpp:
1144         * runtime/JSGenericTypedArrayViewConstructor.h:
1145         * runtime/JSGenericTypedArrayViewPrototype.h:
1146         * runtime/Options.cpp:
1147         (JSC::Options::setAliasedOption):
1148         * tools/CodeProfiling.cpp:
1149         * wasm/WasmSections.h:
1150         * wasm/generateWasmValidateInlinesHeader.py:
1151
1152 == Rolled over to ChangeLog-2018-09-11 ==