Source/JavaScriptCore/ChangeLog

   1 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
   2
   3         Enable SharedArrayBuffer, remove the flag
   4         https://bugs.webkit.org/show_bug.cgi?id=165614
   5
   6         Rubber stamped by Geoffrey Garen.
   7
   8         * runtime/JSGlobalObject.cpp:
   9         (JSC::JSGlobalObject::init):
  10         * runtime/RuntimeFlags.h:
  11
  12 2016-12-08  JF Bastien  <jfbastien@apple.com>
  13
  14         WebAssembly JS API: wire up Instance imports
  15         https://bugs.webkit.org/show_bug.cgi?id=165118
  16
  17         Reviewed by Saam Barati.
  18
  19         Change a bunch of the WebAssembly object model, and pipe the
  20         necessary changes to be able to call JS imports from
  21         WebAssembly. This will make it easier to call_indirect, and
  22         unblock many other missing features.
  23
  24         As a follow-up I need to teach JSC::linkFor to live without a
  25         CodeBlock: wasm doesn't have one and the IC patching is sad. We'll
  26         switch on the callee (or its type?) and then use that as the owner
  27         (because the callee is alive if the instance is alive, ditto
  28         module, and module owns the CallLinkInfo).
  29
  30         * CMakeLists.txt:
  31         * JavaScriptCore.xcodeproj/project.pbxproj:
  32         * interpreter/CallFrame.h:
  33         (JSC::ExecState::callee): give access to the callee as a JSCell
  34         * jit/RegisterSet.cpp: dead code from previous WebAssembly implementation
  35         * jsc.cpp:
  36         (callWasmFunction):
  37         (functionTestWasmModuleFunctions):
  38         * runtime/JSCellInlines.h:
  39         (JSC::ExecState::vm): check callee instead of jsCallee: wasm only has a JSCell and not a JSObject
  40         * runtime/VM.cpp:
  41         (JSC::VM::VM): store the "top" WebAssembly.Instance on entry to WebAssembly (and restore the previous one on exit)
  42         * runtime/VM.h:
  43         * testWasm.cpp:
  44         (runWasmTests):
  45         * wasm/JSWebAssembly.h:
  46         * wasm/WasmB3IRGenerator.cpp:
  47         (JSC::Wasm::B3IRGenerator::B3IRGenerator): pass unlinked calls around to shorten their lifetime: they're ony needed until the Plan is done
  48         (JSC::Wasm::B3IRGenerator::addCall):
  49         (JSC::Wasm::createJSToWasmWrapper):
  50         (JSC::Wasm::parseAndCompile): also pass in the function index space, so that imports can be signature-checked along with internal functions
  51         * wasm/WasmB3IRGenerator.h:
  52         * wasm/WasmBinding.cpp: Added.
  53         (JSC::Wasm::importStubGenerator): stubs from wasm to JS
  54         * wasm/WasmBinding.h: Copied from Source/JavaScriptCore/wasm/WasmValidate.h.
  55         * wasm/WasmCallingConvention.h:
  56         (JSC::Wasm::CallingConvention::setupFrameInPrologue):
  57         * wasm/WasmFormat.h: fix the object model
  58         (JSC::Wasm::CallableFunction::CallableFunction):
  59         * wasm/WasmFunctionParser.h: simplify some of the failure condition checks
  60         (JSC::Wasm::FunctionParser<Context>::FunctionParser): need function index space, not just internal functions
  61         (JSC::Wasm::FunctionParser<Context>::parseExpression):
  62         * wasm/WasmModuleParser.cpp: early-create some of the structures which will be needed later
  63         (JSC::Wasm::ModuleParser::parseImport):
  64         (JSC::Wasm::ModuleParser::parseFunction):
  65         (JSC::Wasm::ModuleParser::parseMemory):
  66         (JSC::Wasm::ModuleParser::parseExport):
  67         (JSC::Wasm::ModuleParser::parseCode):
  68         * wasm/WasmModuleParser.h:
  69         (JSC::Wasm::ModuleParser::functionIndexSpace):
  70         (JSC::Wasm::ModuleParser::functionLocations):
  71         * wasm/WasmParser.h:
  72         (JSC::Wasm::Parser::consumeUTF8String):
  73         * wasm/WasmPlan.cpp: pass around the wasm objects at the right time, reducing their lifetime and making it easier to pass them around when needed
  74         (JSC::Wasm::Plan::run):
  75         (JSC::Wasm::Plan::initializeCallees):
  76         * wasm/WasmPlan.h:
  77         (JSC::Wasm::Plan::exports):
  78         (JSC::Wasm::Plan::internalFunctionCount):
  79         (JSC::Wasm::Plan::jsToWasmEntryPointForFunction):
  80         (JSC::Wasm::Plan::takeModuleInformation):
  81         (JSC::Wasm::Plan::takeCallLinkInfos):
  82         (JSC::Wasm::Plan::takeWasmToJSStubs):
  83         (JSC::Wasm::Plan::takeFunctionIndexSpace):
  84         * wasm/WasmValidate.cpp: check function index space instead of only internal functions
  85         (JSC::Wasm::Validate::addCall):
  86         (JSC::Wasm::validateFunction):
  87         * wasm/WasmValidate.h:
  88         * wasm/js/JSWebAssemblyCallee.cpp:
  89         (JSC::JSWebAssemblyCallee::finishCreation):
  90         * wasm/js/JSWebAssemblyCallee.h:
  91         (JSC::JSWebAssemblyCallee::create):
  92         (JSC::JSWebAssemblyCallee::jsToWasmEntryPoint):
  93         * wasm/js/JSWebAssemblyInstance.cpp:
  94         (JSC::JSWebAssemblyInstance::create):
  95         (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
  96         (JSC::JSWebAssemblyInstance::visitChildren):
  97         * wasm/js/JSWebAssemblyInstance.h: hold the import functions off the end of the Instance
  98         (JSC::JSWebAssemblyInstance::importFunction):
  99         (JSC::JSWebAssemblyInstance::importFunctions):
 100         (JSC::JSWebAssemblyInstance::setImportFunction):
 101         (JSC::JSWebAssemblyInstance::offsetOfImportFunctions):
 102         (JSC::JSWebAssemblyInstance::offsetOfImportFunction):
 103         (JSC::JSWebAssemblyInstance::allocationSize):
 104         * wasm/js/JSWebAssemblyModule.cpp:
 105         (JSC::JSWebAssemblyModule::create):
 106         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
 107         (JSC::JSWebAssemblyModule::visitChildren):
 108         * wasm/js/JSWebAssemblyModule.h: hold the link call info, the import function stubs, and the function index space
 109         (JSC::JSWebAssemblyModule::signatureForFunctionIndexSpace):
 110         (JSC::JSWebAssemblyModule::importCount):
 111         (JSC::JSWebAssemblyModule::calleeFromFunctionIndexSpace):
 112         * wasm/js/WebAssemblyFunction.cpp:
 113         (JSC::callWebAssemblyFunction): set top Instance on VM
 114         * wasm/js/WebAssemblyFunction.h:
 115         (JSC::WebAssemblyFunction::instance):
 116         * wasm/js/WebAssemblyInstanceConstructor.cpp:
 117         (JSC::constructJSWebAssemblyInstance): handle function imports
 118         * wasm/js/WebAssemblyModuleConstructor.cpp:
 119         (JSC::constructJSWebAssemblyModule): generate the stubs for import functions
 120         * wasm/js/WebAssemblyModuleRecord.cpp:
 121         (JSC::WebAssemblyModuleRecord::link):
 122         * wasm/js/WebAssemblyToJSCallee.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp.
 123         (JSC::WebAssemblyToJSCallee::create): dummy JSCell singleton which lives on the VM, and is put as the callee in the import stub's frame to identified it when unwinding
 124         (JSC::WebAssemblyToJSCallee::createStructure):
 125         (JSC::WebAssemblyToJSCallee::WebAssemblyToJSCallee):
 126         (JSC::WebAssemblyToJSCallee::finishCreation):
 127         (JSC::WebAssemblyToJSCallee::destroy):
 128         * wasm/js/WebAssemblyToJSCallee.h: Copied from Source/JavaScriptCore/wasm/WasmB3IRGenerator.h.
 129
 130 2016-12-08  Mark Lam  <mark.lam@apple.com>
 131
 132         Enable JSC restricted options by default in the jsc shell.
 133         https://bugs.webkit.org/show_bug.cgi?id=165615
 134
 135         Reviewed by Keith Miller.
 136
 137         The jsc shell is only used for debugging and development testing.  We should
 138         allow it to use restricted options like JSC_useDollarVM even for release builds.
 139
 140         * jsc.cpp:
 141         (jscmain):
 142         * runtime/Options.cpp:
 143         (JSC::Options::enableRestrictedOptions):
 144         (JSC::Options::isAvailable):
 145         (JSC::allowRestrictedOptions): Deleted.
 146         * runtime/Options.h:
 147
 148 2016-12-08  Chris Dumez  <cdumez@apple.com>
 149
 150         Unreviewed, rolling out r209489.
 151
 152         Likely caused large regressions on JetStream, Sunspider and
 153         Speedometer
 154
 155         Reverted changeset:
 156
 157         "Add system trace points for JavaScript VM entry/exit"
 158         https://bugs.webkit.org/show_bug.cgi?id=165550
 159         http://trac.webkit.org/changeset/209489
 160
 161 2016-12-08  Keith Miller  <keith_miller@apple.com>
 162
 163         Move LEB tests to API tests
 164         https://bugs.webkit.org/show_bug.cgi?id=165586
 165
 166         Reviewed by Saam Barati.
 167
 168         Delete old stuff.
 169
 170         * testWasm.cpp:
 171         (printUsageStatement):
 172         (CommandLine::parseArguments):
 173         (main):
 174         (runLEBTests): Deleted.
 175
 176 2016-12-07  JF Bastien  <jfbastien@apple.com>
 177
 178         Cleanup WebAssembly's RETURN_IF_EXCEPTION
 179         https://bugs.webkit.org/show_bug.cgi?id=165595
 180
 181         Reviewed by Filip Pizlo.
 182
 183         * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
 184         (JSC::constructJSWebAssemblyCompileError):
 185         * wasm/js/WebAssemblyFunction.cpp:
 186         (JSC::callWebAssemblyFunction):
 187         * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
 188         (JSC::constructJSWebAssemblyRuntimeError):
 189
 190 2016-12-07  Geoffrey Garen  <ggaren@apple.com>
 191
 192         Renamed SourceCode members to match their accessor names
 193         https://bugs.webkit.org/show_bug.cgi?id=165573
 194
 195         Reviewed by Keith Miller.
 196
 197         startChar => startOffset
 198         endChar => endOffset
 199
 200         * parser/UnlinkedSourceCode.h:
 201         (JSC::UnlinkedSourceCode::UnlinkedSourceCode):
 202         (JSC::UnlinkedSourceCode::view):
 203         (JSC::UnlinkedSourceCode::startOffset):
 204         (JSC::UnlinkedSourceCode::endOffset):
 205         (JSC::UnlinkedSourceCode::length):
 206
 207 2016-12-07  Keith Miller  <keith_miller@apple.com>
 208
 209         Add more missing trivial wasm ops.
 210         https://bugs.webkit.org/show_bug.cgi?id=165564
 211
 212         Reviewed by Geoffrey Garen.
 213
 214         This patch adds the nop, drop, and tee_local opcodes.
 215         It also fixes an issue where we were not generating
 216         the proper enums for the grow_memory and current_memory
 217         opcodes.
 218
 219         * wasm/WasmFunctionParser.h:
 220         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 221         * wasm/generateWasmOpsHeader.py:
 222
 223 2016-12-07  Geoffrey Garen  <ggaren@apple.com>
 224
 225         Renamed source => parentSource
 226         https://bugs.webkit.org/show_bug.cgi?id=165570
 227
 228         Reviewed by Keith Miller.
 229
 230         For less confuse.
 231
 232         * bytecode/UnlinkedFunctionExecutable.cpp:
 233         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
 234
 235 2016-12-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 236
 237         [JSC] Drop translate phase in module loader
 238         https://bugs.webkit.org/show_bug.cgi?id=164861
 239
 240         Reviewed by Saam Barati.
 241
 242         Originally, this "translate" phase was introduced to the module loader.
 243         However, recent rework discussion[1] starts dropping this phase.
 244         And this "translate" phase is meaningless in the browser side module loader
 245         since this phase originally mimics the node.js's translation hook (like,
 246         transpiling CoffeeScript source to JavaScript).
 247
 248         This "translate" phase is not necessary for the exposed HTML5
 249         <script type="module"> tag right now. Once the module loader pipeline is
 250         redefined and specified, we need to update the current loader anyway.
 251         So dropping "translate" phase right now is OK.
 252
 253         This a bit simplifies the current module loader pipeline.
 254
 255         [1]: https://github.com/whatwg/loader/issues/147
 256
 257         * builtins/ModuleLoaderPrototype.js:
 258         (newRegistryEntry):
 259         (fulfillFetch):
 260         (requestFetch):
 261         (requestInstantiate):
 262         (provide):
 263         (fulfillTranslate): Deleted.
 264         (requestTranslate): Deleted.
 265         * bytecode/BytecodeIntrinsicRegistry.cpp:
 266         (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
 267         * jsc.cpp:
 268         * runtime/JSGlobalObject.cpp:
 269         * runtime/JSGlobalObject.h:
 270         * runtime/JSModuleLoader.cpp:
 271         (JSC::JSModuleLoader::translate): Deleted.
 272         * runtime/JSModuleLoader.h:
 273         * runtime/ModuleLoaderPrototype.cpp:
 274         (JSC::moduleLoaderPrototypeInstantiate):
 275         (JSC::moduleLoaderPrototypeTranslate): Deleted.
 276
 277 2016-12-07  Joseph Pecoraro  <pecoraro@apple.com>
 278
 279         Web Inspector: Add ability to distinguish if a Script was parsed as a module
 280         https://bugs.webkit.org/show_bug.cgi?id=164900
 281         <rdar://problem/29323817>
 282
 283         Reviewed by Timothy Hatcher.
 284
 285         * inspector/agents/InspectorDebuggerAgent.cpp:
 286         (Inspector::InspectorDebuggerAgent::didParseSource):
 287         * inspector/protocol/Debugger.json:
 288         Add an optional event parameter to distinguish if a script was a module or not.
 289
 290 2016-12-07  Simon Fraser  <simon.fraser@apple.com>
 291
 292         Add system trace points for JavaScript VM entry/exit
 293         https://bugs.webkit.org/show_bug.cgi?id=165550
 294
 295         Reviewed by Tim Horton.
 296
 297         Add trace points for entry/exit into/out of the JS VM.
 298
 299         * runtime/VMEntryScope.cpp:
 300         (JSC::VMEntryScope::VMEntryScope):
 301         (JSC::VMEntryScope::~VMEntryScope):
 302
 303 2016-12-06  Keith Miller  <keith_miller@apple.com>
 304
 305         Add support for truncation operators
 306         https://bugs.webkit.org/show_bug.cgi?id=165519
 307
 308         Reviewed by Geoffrey Garen.
 309
 310         This patch adds initial support for truncation operators. The current patch
 311         does range based out of bounds checking, in the future we should use system
 312         register flags on ARM and other tricks on X86 improve the performance of
 313         these opcodes.
 314
 315         * assembler/MacroAssemblerARM64.h:
 316         (JSC::MacroAssemblerARM64::branchTruncateDoubleToInt32):
 317         (JSC::MacroAssemblerARM64::truncateDoubleToInt64):
 318         (JSC::MacroAssemblerARM64::truncateDoubleToUint64):
 319         (JSC::MacroAssemblerARM64::truncateFloatToInt32):
 320         (JSC::MacroAssemblerARM64::truncateFloatToUint32):
 321         (JSC::MacroAssemblerARM64::truncateFloatToInt64):
 322         (JSC::MacroAssemblerARM64::truncateFloatToUint64):
 323         * assembler/MacroAssemblerX86Common.h:
 324         (JSC::MacroAssemblerX86Common::truncateFloatToInt32):
 325         (JSC::MacroAssemblerX86Common::truncateDoubleToUint32): Deleted.
 326         * assembler/MacroAssemblerX86_64.h:
 327         (JSC::MacroAssemblerX86_64::truncateDoubleToUint32):
 328         (JSC::MacroAssemblerX86_64::truncateDoubleToInt64):
 329         (JSC::MacroAssemblerX86_64::truncateDoubleToUint64):
 330         (JSC::MacroAssemblerX86_64::truncateFloatToUint32):
 331         (JSC::MacroAssemblerX86_64::truncateFloatToInt64):
 332         (JSC::MacroAssemblerX86_64::truncateFloatToUint64):
 333         * assembler/X86Assembler.h:
 334         (JSC::X86Assembler::cvttss2si_rr):
 335         (JSC::X86Assembler::cvttss2siq_rr):
 336         * wasm/WasmB3IRGenerator.cpp:
 337         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF64>):
 338         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF32>):
 339         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF64>):
 340         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF32>):
 341         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF64>):
 342         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF64>):
 343         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF32>):
 344         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF32>):
 345         * wasm/WasmFunctionParser.h:
 346         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 347
 348 2016-12-07  Joseph Pecoraro  <pecoraro@apple.com>
 349
 350         Web Inspector: Remove unused and mostly untested Page domain commands and events
 351         https://bugs.webkit.org/show_bug.cgi?id=165507
 352
 353         Reviewed by Brian Burg.
 354
 355         Remove unused and unsupported commands and events.
 356
 357           - Page.setDocumentContent
 358           - Page.getScriptExecutionStatus
 359           - Page.setScriptExecutionDisabled
 360           - Page.handleJavaScriptDialog
 361           - Page.javascriptDialogOpening
 362           - Page.javascriptDialogClosed
 363           - Page.scriptsEnabled
 364
 365         * inspector/protocol/Page.json:
 366
 367 2016-12-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 368
 369         [JSC] Merge PromiseReactions
 370         https://bugs.webkit.org/show_bug.cgi?id=165526
 371
 372         Reviewed by Sam Weinig.
 373
 374         Our promise implementation has two arrays per Promise; promiseFulfillReactions and promiseRejectReactions.
 375         And everytime we call `promise.then`, we create two promise reactions for fullfill and reject.
 376         However, these two reactions and the arrays for reactions can be merged into one array and one reaction.
 377         It reduces the unnecessary object allocations.
 378
 379         No behavior change.
 380
 381         * builtins/BuiltinNames.h:
 382         * builtins/PromiseOperations.js:
 383         (globalPrivate.newPromiseReaction):
 384         (globalPrivate.triggerPromiseReactions):
 385         (globalPrivate.rejectPromise):
 386         (globalPrivate.fulfillPromise):
 387         (globalPrivate.promiseReactionJob):
 388         (globalPrivate.initializePromise):
 389         * builtins/PromisePrototype.js:
 390         (then):
 391         * runtime/JSPromise.cpp:
 392         (JSC::JSPromise::finishCreation):
 393
 394 2016-12-06  Mark Lam  <mark.lam@apple.com>
 395
 396         GetByID IC is wrongly unwrapping the global proxy this value for getter/setters.
 397         https://bugs.webkit.org/show_bug.cgi?id=165401
 398
 399         Reviewed by Saam Barati.
 400
 401         When the this value for a property access is the JS global and that property
 402         access is via a GetterSetter, the underlying getter / setter functions would
 403         expect the this value they receive to be the JSProxy instance instead of the
 404         JSGlobalObject.  This is consistent with how the LLINT and runtime code behaves.
 405         The IC code should behave the same way.
 406
 407         Also added some ASSERTs to document invariants in the code, and help detect
 408         bugs sooner if the code gets changed in a way that breaks those invariants in
 409         the future.
 410
 411         * bytecode/PolymorphicAccess.cpp:
 412         (JSC::AccessCase::generateImpl):
 413
 414 2016-12-06  Joseph Pecoraro  <pecoraro@apple.com>
 415
 416         DumpRenderTree ASSERT in JSC::ExecutableBase::isHostFunction seen on bots
 417         https://bugs.webkit.org/show_bug.cgi?id=165497
 418         <rdar://problem/29538973>
 419
 420         Reviewed by Saam Barati.
 421
 422         * inspector/agents/InspectorScriptProfilerAgent.cpp:
 423         (Inspector::InspectorScriptProfilerAgent::trackingComplete):
 424         Defer collection when extracting and processing the samples to avoid
 425         any objects held by the samples from getting collected while processing.
 426         This is because while processing we call into functions that can
 427         allocate and we must prevent those functions from syncing with the
 428         GC thread which may collect other sample data yet to be processed.
 429
 430 2016-12-06  Alexey Proskuryakov  <ap@apple.com>
 431
 432         Correct SDKROOT values in xcconfig files
 433         https://bugs.webkit.org/show_bug.cgi?id=165487
 434         rdar://problem/29539209
 435
 436         Reviewed by Dan Bernstein.
 437
 438         Fix suggested by Dan Bernstein.
 439
 440         * Configurations/DebugRelease.xcconfig:
 441
 442 2016-12-06  Saam Barati  <sbarati@apple.com>
 443
 444         Remove old Wasm object model
 445         https://bugs.webkit.org/show_bug.cgi?id=165481
 446
 447         Reviewed by Keith Miller and Mark Lam.
 448
 449         It's confusing to see code that consults both the old
 450         Wasm object model alongside the new one. The old object
 451         model is not a thing, and it's not being used. Let's
 452         remove it now to prevent further confusion.
 453
 454         * CMakeLists.txt:
 455         * JavaScriptCore.xcodeproj/project.pbxproj:
 456         * bytecode/CodeBlock.cpp:
 457         (JSC::CodeBlock::finalizeLLIntInlineCaches):
 458         (JSC::CodeBlock::replacement):
 459         (JSC::CodeBlock::computeCapabilityLevel):
 460         (JSC::CodeBlock::updateAllPredictions):
 461         * bytecode/CodeBlock.h:
 462         * bytecode/WebAssemblyCodeBlock.cpp: Removed.
 463         * bytecode/WebAssemblyCodeBlock.h: Removed.
 464         * dfg/DFGCapabilities.cpp:
 465         (JSC::DFG::isSupportedForInlining):
 466         * interpreter/Interpreter.cpp:
 467         (JSC::GetStackTraceFunctor::operator()):
 468         (JSC::UnwindFunctor::operator()):
 469         (JSC::isWebAssemblyExecutable): Deleted.
 470         * jit/JITOperations.cpp:
 471         * jit/Repatch.cpp:
 472         (JSC::linkPolymorphicCall):
 473         * llint/LLIntSlowPaths.cpp:
 474         (JSC::LLInt::setUpCall):
 475         * runtime/ExecutableBase.cpp:
 476         (JSC::ExecutableBase::clearCode):
 477         * runtime/ExecutableBase.h:
 478         (JSC::ExecutableBase::isWebAssemblyExecutable): Deleted.
 479         * runtime/JSFunction.cpp:
 480         * runtime/JSFunction.h:
 481         * runtime/JSFunctionInlines.h:
 482         (JSC::JSFunction::isBuiltinFunction):
 483         * runtime/VM.cpp:
 484         (JSC::VM::VM):
 485         * runtime/VM.h:
 486         * runtime/WebAssemblyExecutable.cpp: Removed.
 487         * runtime/WebAssemblyExecutable.h: Removed.
 488
 489 2016-12-06  JF Bastien  <jfbastien@apple.com>
 490
 491         PureNaN: fix typo
 492         https://bugs.webkit.org/show_bug.cgi?id=165493
 493
 494         Reviewed by Mark Lam.
 495
 496         * runtime/PureNaN.h:
 497
 498 2016-12-06  Mark Lam  <mark.lam@apple.com>
 499
 500         Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
 501         https://bugs.webkit.org/show_bug.cgi?id=165227
 502         <rdar://problem/29442665>
 503
 504         Reviewed by Saam Barati.
 505
 506         * runtime/JSObject.cpp:
 507         (JSC::JSObject::setPrototypeWithCycleCheck):
 508         - This is where we check for immutable prototype exotic objects and refuse to set
 509           the prototype if needed.
 510           See https://tc39.github.io/ecma262/#sec-immutable-prototype-exotic-objects.
 511
 512         * runtime/JSTypeInfo.h:
 513         (JSC::TypeInfo::isImmutablePrototypeExoticObject):
 514         * runtime/Structure.h:
 515         - Add flag for declaring immutable prototype exotic objects.
 516
 517         * runtime/ObjectPrototype.h:
 518         - Declare that Object.prototype is an immutable prototype exotic object.
 519           See https://tc39.github.io/ecma262/#sec-properties-of-the-object-prototype-object.
 520
 521         * runtime/ObjectConstructor.cpp:
 522         (JSC::objectConstructorSetPrototypeOf):
 523         - Use better error messages.
 524
 525 2016-12-04  Darin Adler  <darin@apple.com>
 526
 527         Use ASCIICType more, and improve it a little bit
 528         https://bugs.webkit.org/show_bug.cgi?id=165360
 529
 530         Reviewed by Sam Weinig.
 531
 532         * inspector/InspectorValues.cpp:
 533         (Inspector::readHexDigits): Use isASCIIHexDigit.
 534         (Inspector::hextoInt): Deleted.
 535         (decodeString): Use toASCIIHexValue.
 536
 537         * runtime/JSGlobalObjectFunctions.cpp:
 538         (JSC::parseDigit): Use isASCIIDigit, isASCIIUpper, and isASCIILower.
 539
 540         * runtime/StringPrototype.cpp:
 541         (JSC::substituteBackreferencesSlow): Use isASCIIDigit.
 542
 543 2016-12-06  Csaba Osztrogonác  <ossy@webkit.org>
 544
 545         Add storeFence support for ARMv7
 546         https://bugs.webkit.org/show_bug.cgi?id=164733
 547
 548         Reviewed by Saam Barati.
 549
 550         * assembler/ARMAssembler.h:
 551         (JSC::ARMAssembler::dmbISHST): Added.
 552         * assembler/ARMv7Assembler.h: Typo fixed, DMB has only T1 encoding.
 553         (JSC::ARMv7Assembler::dmbSY):
 554         (JSC::ARMv7Assembler::dmbISHST): Added.
 555         * assembler/MacroAssemblerARM.h:
 556         (JSC::MacroAssemblerARM::storeFence):
 557         * assembler/MacroAssemblerARMv7.h:
 558         (JSC::MacroAssemblerARMv7::storeFence):
 559
 560 2016-12-05  Matt Baker  <mattbaker@apple.com>
 561
 562         Web Inspector: remove ASSERT from InspectorDebuggerAgent::derefAsyncCallData
 563         https://bugs.webkit.org/show_bug.cgi?id=165413
 564         <rdar://problem/29517587>
 565
 566         Reviewed by Brian Burg.
 567
 568         DOMTimer::removeById can call into InspectorInstrumentation with an
 569         invalid identifier, so don't assert that async call data exists.
 570
 571         * inspector/agents/InspectorDebuggerAgent.cpp:
 572         (Inspector::InspectorDebuggerAgent::derefAsyncCallData):
 573
 574 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
 575
 576         Fixed a bug in my last patch.
 577
 578         Unreviewed.
 579
 580         * bytecode/UnlinkedFunctionExecutable.h: Restore the conversion to
 581         one-based counting.
 582
 583 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
 584
 585         Moved start and end column linking into helper functions
 586         https://bugs.webkit.org/show_bug.cgi?id=165422
 587
 588         Reviewed by Sam Weinig.
 589
 590         * bytecode/UnlinkedFunctionExecutable.cpp:
 591         (JSC::UnlinkedFunctionExecutable::link):
 592         * bytecode/UnlinkedFunctionExecutable.h:
 593
 594 2016-12-05  Mark Lam  <mark.lam@apple.com>
 595
 596         Fix JSC files so that we can build a release build with NDEBUG #undef'ed.
 597         https://bugs.webkit.org/show_bug.cgi?id=165409
 598
 599         Reviewed by Keith Miller.
 600
 601         This allows us to run a release build with DEBUG ASSERTs enabled.
 602
 603         * bytecode/BytecodeLivenessAnalysis.cpp:
 604         * bytecode/UnlinkedEvalCodeBlock.cpp:
 605         * bytecode/UnlinkedFunctionCodeBlock.cpp:
 606         * bytecode/UnlinkedModuleProgramCodeBlock.cpp:
 607         * bytecode/UnlinkedProgramCodeBlock.cpp:
 608         * runtime/EvalExecutable.cpp:
 609
 610 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
 611
 612         Renamed source => parentSource
 613         https://bugs.webkit.org/show_bug.cgi?id=165419
 614
 615         Reviewed by Saam Barati.
 616
 617         This should help clarify that a FunctionExecutable holds the source
 618         code to its *parent* scope, and not its own SourceCode.
 619
 620         * builtins/BuiltinExecutables.cpp:
 621         (JSC::BuiltinExecutables::createExecutable):
 622         * bytecode/UnlinkedFunctionExecutable.cpp:
 623         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
 624         (JSC::UnlinkedFunctionExecutable::link):
 625         * bytecode/UnlinkedFunctionExecutable.h:
 626
 627 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
 628
 629         ScriptExecutable should not contain a copy of firstLine and startColumn
 630         https://bugs.webkit.org/show_bug.cgi?id=165415
 631
 632         Reviewed by Keith Miller.
 633
 634         We already have this data in SourceCode.
 635
 636         It's super confusing to have two copies of this data, where one is
 637         allowed to mutate. In reality, your line and column number never change.
 638
 639         * bytecode/UnlinkedFunctionExecutable.cpp:
 640         (JSC::UnlinkedFunctionExecutable::link):
 641         * runtime/CodeCache.cpp:
 642         (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
 643         * runtime/CodeCache.h:
 644         (JSC::generateUnlinkedCodeBlock):
 645         * runtime/FunctionExecutable.cpp:
 646         (JSC::FunctionExecutable::FunctionExecutable):
 647         * runtime/FunctionExecutable.h:
 648         * runtime/ScriptExecutable.cpp:
 649         (JSC::ScriptExecutable::ScriptExecutable):
 650         (JSC::ScriptExecutable::newCodeBlockFor):
 651         * runtime/ScriptExecutable.h:
 652         (JSC::ScriptExecutable::firstLine):
 653         (JSC::ScriptExecutable::startColumn):
 654         (JSC::ScriptExecutable::recordParse):
 655
 656 2016-12-05  Caitlin Potter  <caitp@igalia.com>
 657
 658         [JSC] report unexpected token when "async" is followed by identifier
 659         https://bugs.webkit.org/show_bug.cgi?id=165091
 660
 661         Reviewed by Mark Lam.
 662
 663         Report a SyntaxError, in order to report correct error in contexts
 664         an async ArrowFunction cannot occur. Also corrects errors in comment
 665         describing JSTokenType bitfield, which was added in r209293.
 666
 667         * parser/Parser.cpp:
 668         (JSC::Parser<LexerType>::parseMemberExpression):
 669         * parser/ParserTokens.h:
 670
 671 2016-12-05  Keith Miller  <keith_miller@apple.com>
 672
 673         Add Wasm i64 to i32 conversion.
 674         https://bugs.webkit.org/show_bug.cgi?id=165378
 675
 676         Reviewed by Filip Pizlo.
 677
 678         It turns out the wrap operation is just B3's Trunc.
 679
 680         * wasm/wasm.json:
 681
 682 2016-12-05  Joseph Pecoraro  <pecoraro@apple.com>
 683
 684         REGRESSION(r208985): SafariForWebKitDevelopment Symbol Not Found looking for method with WTF::Optional
 685         https://bugs.webkit.org/show_bug.cgi?id=165351
 686
 687         Reviewed by Yusuke Suzuki.
 688
 689         Some versions of Safari expect:
 690
 691             Inspector::BackendDispatcher::reportProtocolError(WTF::Optional<long>, Inspector::BackendDispatcher::CommonErrorCode, WTF::String const&)
 692
 693         Which we had updated to use std::optional. Expose a version with the original
 694         Symbol for these Safaris. This stub will just call through to the new version.
 695
 696         * inspector/InspectorBackendDispatcher.cpp:
 697         (Inspector::BackendDispatcher::reportProtocolError):
 698         * inspector/InspectorBackendDispatcher.h:
 699
 700 2016-12-05  Konstantin Tokarev  <annulen@yandex.ru>
 701
 702         Add __STDC_FORMAT_MACROS before inttypes.h is included
 703         https://bugs.webkit.org/show_bug.cgi?id=165374
 704
 705         We need formatting macros like PRIu64 to be available in all places where
 706         inttypes.h header is used. All these usages get inttypes.h definitions
 707         via wtf/Assertions.h header, except SQLiteFileSystem.cpp where formatting
 708         macros are not used anymore since r185129.
 709
 710         This patch fixes multiple build errors with MinGW and reduces number of
 711         independent __STDC_FORMAT_MACROS uses in the code base.
 712
 713         Reviewed by Darin Adler.
 714
 715         * disassembler/ARM64/A64DOpcode.cpp: Removed __STDC_FORMAT_MACROS
 716         because it is obtained via Assertions.h now
 717         * disassembler/ARM64Disassembler.cpp: Ditto.
 718
 719 2016-12-04  Keith Miller  <keith_miller@apple.com>
 720
 721         Add support for Wasm ctz and popcnt
 722         https://bugs.webkit.org/show_bug.cgi?id=165369
 723
 724         Reviewed by Saam Barati.
 725
 726         * assembler/MacroAssemblerARM64.h:
 727         (JSC::MacroAssemblerARM64::countTrailingZeros32):
 728         (JSC::MacroAssemblerARM64::countTrailingZeros64):
 729         * assembler/MacroAssemblerX86Common.cpp:
 730         * assembler/MacroAssemblerX86Common.h:
 731         (JSC::MacroAssemblerX86Common::countTrailingZeros32):
 732         (JSC::MacroAssemblerX86Common::supportsBMI1):
 733         (JSC::MacroAssemblerX86Common::ctzAfterBsf):
 734         * assembler/MacroAssemblerX86_64.h:
 735         (JSC::MacroAssemblerX86_64::countTrailingZeros64):
 736         * assembler/X86Assembler.h:
 737         (JSC::X86Assembler::tzcnt_rr):
 738         (JSC::X86Assembler::tzcntq_rr):
 739         (JSC::X86Assembler::bsf_rr):
 740         (JSC::X86Assembler::bsfq_rr):
 741         * wasm/WasmB3IRGenerator.cpp:
 742         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Ctz>):
 743         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Ctz>):
 744         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Popcnt>):
 745         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Popcnt>):
 746         * wasm/WasmFunctionParser.h:
 747         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 748
 749 2016-12-04  Saam Barati  <sbarati@apple.com>
 750
 751         We should have a Wasm callee
 752         https://bugs.webkit.org/show_bug.cgi?id=165163
 753
 754         Reviewed by Keith Miller.
 755
 756         This patch adds JSWebAssemblyCallee and stores it into the
 757         callee slot in the call frame as part of the prologue of a
 758         wasm function. This is the first step in implementing
 759         unwinding from/through wasm frames. We will use the callee
 760         to identify that a machine frame belongs to wasm code.
 761
 762         * CMakeLists.txt:
 763         * JavaScriptCore.xcodeproj/project.pbxproj:
 764         * jsc.cpp:
 765         (callWasmFunction):
 766         (functionTestWasmModuleFunctions):
 767         * llint/LowLevelInterpreter64.asm:
 768         * runtime/JSGlobalObject.cpp:
 769         * runtime/VM.cpp:
 770         (JSC::VM::VM):
 771         * runtime/VM.h:
 772         * wasm/JSWebAssembly.h:
 773         * wasm/WasmB3IRGenerator.cpp:
 774         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
 775         (JSC::Wasm::parseAndCompile):
 776         * wasm/WasmCallingConvention.h:
 777         (JSC::Wasm::CallingConvention::setupFrameInPrologue):
 778         * wasm/WasmFormat.h:
 779         * wasm/WasmPlan.cpp:
 780         (JSC::Wasm::Plan::initializeCallees):
 781         * wasm/WasmPlan.h:
 782         (JSC::Wasm::Plan::compiledFunction):
 783         (JSC::Wasm::Plan::getCompiledFunctions): Deleted.
 784         * wasm/js/JSWebAssemblyCallee.cpp: Added.
 785         (JSC::JSWebAssemblyCallee::JSWebAssemblyCallee):
 786         (JSC::JSWebAssemblyCallee::finishCreation):
 787         (JSC::JSWebAssemblyCallee::destroy):
 788         * wasm/js/JSWebAssemblyCallee.h: Added.
 789         (JSC::JSWebAssemblyCallee::create):
 790         (JSC::JSWebAssemblyCallee::createStructure):
 791         (JSC::JSWebAssemblyCallee::jsEntryPoint):
 792         * wasm/js/JSWebAssemblyModule.cpp:
 793         (JSC::JSWebAssemblyModule::create):
 794         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
 795         (JSC::JSWebAssemblyModule::visitChildren):
 796         * wasm/js/JSWebAssemblyModule.h:
 797         (JSC::JSWebAssemblyModule::moduleInformation):
 798         (JSC::JSWebAssemblyModule::callee):
 799         (JSC::JSWebAssemblyModule::callees):
 800         (JSC::JSWebAssemblyModule::offsetOfCallees):
 801         (JSC::JSWebAssemblyModule::allocationSize):
 802         (JSC::JSWebAssemblyModule::compiledFunctions): Deleted.
 803         * wasm/js/WebAssemblyFunction.cpp:
 804         (JSC::callWebAssemblyFunction):
 805         (JSC::WebAssemblyFunction::create):
 806         (JSC::WebAssemblyFunction::visitChildren):
 807         (JSC::WebAssemblyFunction::finishCreation):
 808         * wasm/js/WebAssemblyFunction.h:
 809         (JSC::WebAssemblyFunction::webAssemblyCallee):
 810         (JSC::WebAssemblyFunction::instance):
 811         (JSC::WebAssemblyFunction::signature):
 812         (JSC::CallableWebAssemblyFunction::CallableWebAssemblyFunction): Deleted.
 813         (JSC::WebAssemblyFunction::webAssemblyFunctionCell): Deleted.
 814         * wasm/js/WebAssemblyFunctionCell.cpp:
 815         (JSC::WebAssemblyFunctionCell::create): Deleted.
 816         (JSC::WebAssemblyFunctionCell::WebAssemblyFunctionCell): Deleted.
 817         (JSC::WebAssemblyFunctionCell::destroy): Deleted.
 818         (JSC::WebAssemblyFunctionCell::createStructure): Deleted.
 819         * wasm/js/WebAssemblyFunctionCell.h:
 820         (JSC::WebAssemblyFunctionCell::function): Deleted.
 821         * wasm/js/WebAssemblyModuleConstructor.cpp:
 822         (JSC::constructJSWebAssemblyModule):
 823         * wasm/js/WebAssemblyModuleRecord.cpp:
 824         (JSC::WebAssemblyModuleRecord::link):
 825
 826 2016-12-04  Matt Baker  <mattbaker@apple.com>
 827
 828         Web Inspector: Assertion Failures breakpoint should respect global Breakpoints enabled setting
 829         https://bugs.webkit.org/show_bug.cgi?id=165277
 830         <rdar://problem/29467098>
 831
 832         Reviewed by Mark Lam.
 833
 834         * inspector/agents/InspectorDebuggerAgent.cpp:
 835         (Inspector::InspectorDebuggerAgent::handleConsoleAssert):
 836         Check that breakpoints are active before pausing.
 837
 838 2016-12-03  Yusuke Suzuki  <utatane.tea@gmail.com>
 839
 840         Refactor SymbolImpl layout
 841         https://bugs.webkit.org/show_bug.cgi?id=165247
 842
 843         Reviewed by Darin Adler.
 844
 845         Use SymbolImpl::{create, createNullSymbol} instead.
 846
 847         * runtime/PrivateName.h:
 848         (JSC::PrivateName::PrivateName):
 849
 850 2016-12-03  JF Bastien  <jfbastien@apple.com>
 851
 852         WebAssembly: update binary format to 0xD version
 853         https://bugs.webkit.org/show_bug.cgi?id=165345
 854
 855         Reviewed by Keith Miller.
 856
 857         As described in the following PR: https://github.com/WebAssembly/design/pull/836
 858         Originally committed in r209175, reverted in r209242, and fixed in r209284.
 859
 860         * wasm/WasmB3IRGenerator.cpp:
 861         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
 862         (JSC::Wasm::B3IRGenerator::zeroForType):
 863         (JSC::Wasm::B3IRGenerator::addConstant):
 864         (JSC::Wasm::createJSWrapper):
 865         * wasm/WasmCallingConvention.h:
 866         (JSC::Wasm::CallingConvention::marshallArgument):
 867         * wasm/WasmFormat.cpp:
 868         (JSC::Wasm::toString): Deleted.
 869         * wasm/WasmFormat.h:
 870         (JSC::Wasm::isValueType):
 871         (JSC::Wasm::toB3Type): Deleted.
 872         * wasm/WasmFunctionParser.h:
 873         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 874         * wasm/WasmModuleParser.cpp:
 875         (JSC::Wasm::ModuleParser::parse):
 876         (JSC::Wasm::ModuleParser::parseType):
 877         * wasm/WasmModuleParser.h:
 878         * wasm/WasmParser.h:
 879         (JSC::Wasm::Parser::parseResultType):
 880         * wasm/generateWasm.py:
 881         (Wasm.__init__):
 882         * wasm/generateWasmOpsHeader.py:
 883         (cppMacro):
 884         (typeMacroizer):
 885         (opcodeMacroizer):
 886         * wasm/js/WebAssemblyFunction.cpp:
 887         (JSC::callWebAssemblyFunction):
 888         * wasm/wasm.json:
 889
 890 2016-12-02  Keith Miller  <keith_miller@apple.com>
 891
 892         Add Wasm copysign
 893         https://bugs.webkit.org/show_bug.cgi?id=165355
 894
 895         Reviewed by Filip Pizlo.
 896
 897         This patch also makes two other important changes:
 898
 899         1) allows for i64 constants in the B3 generator language.
 900         2) Fixes a bug with F64ConvertUI64 where the operation returned a Float instead
 901            of a Double in B3.
 902
 903         * wasm/WasmB3IRGenerator.cpp:
 904         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
 905         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
 906         (CodeGenerator.generateOpcode):
 907         (generateConstCode):
 908         (generateI32ConstCode): Deleted.
 909         * wasm/wasm.json:
 910
 911 2016-12-03  Commit Queue  <commit-queue@webkit.org>
 912
 913         Unreviewed, rolling out r209298.
 914         https://bugs.webkit.org/show_bug.cgi?id=165359
 915
 916         broke the build (Requested by smfr on #webkit).
 917
 918         Reverted changeset:
 919
 920         "Add Wasm copysign"
 921         https://bugs.webkit.org/show_bug.cgi?id=165355
 922         http://trac.webkit.org/changeset/209298
 923
 924 2016-12-02  Keith Miller  <keith_miller@apple.com>
 925
 926         Add Wasm copysign
 927         https://bugs.webkit.org/show_bug.cgi?id=165355
 928
 929         Reviewed by Filip Pizlo.
 930
 931         This patch also makes two other important changes:
 932
 933         1) allows for i64 constants in the B3 generator language.
 934         2) Fixes a bug with F64ConvertUI64 where the operation returned a Float instead
 935            of a Double in B3.
 936
 937         * wasm/WasmB3IRGenerator.cpp:
 938         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
 939         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
 940         (CodeGenerator.generateOpcode):
 941         (generateConstCode):
 942         (generateI32ConstCode): Deleted.
 943         * wasm/wasm.json:
 944
 945 2016-12-02  Keith Miller  <keith_miller@apple.com>
 946
 947         Unreviewed, fix git having a breakdown over trying to reland a rollout.
 948
 949 2016-12-02  Keith Miller  <keith_miller@apple.com>
 950
 951         Add Wasm floating point nearest and trunc
 952         https://bugs.webkit.org/show_bug.cgi?id=165339
 953
 954         Reviewed by Saam Barati.
 955
 956         This patch also allows any wasm primitive type to be passed as a
 957         string.
 958
 959         * assembler/MacroAssemblerARM64.h:
 960         (JSC::MacroAssemblerARM64::nearestIntDouble):
 961         (JSC::MacroAssemblerARM64::nearestIntFloat):
 962         (JSC::MacroAssemblerARM64::truncDouble):
 963         (JSC::MacroAssemblerARM64::truncFloat):
 964         * assembler/MacroAssemblerX86Common.h:
 965         (JSC::MacroAssemblerX86Common::nearestIntDouble):
 966         (JSC::MacroAssemblerX86Common::nearestIntFloat):
 967         * jsc.cpp:
 968         (box):
 969         * wasm/WasmB3IRGenerator.cpp:
 970         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
 971         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
 972         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Nearest>):
 973         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Nearest>):
 974         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Trunc>):
 975         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Trunc>):
 976         * wasm/WasmFunctionParser.h:
 977         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 978
 979 2016-12-02  Caitlin Potter  <caitp@igalia.com>
 980
 981 [JSC] add additional bit to JSTokenType bitfield
 982         https://bugs.webkit.org/show_bug.cgi?id=165091
 983
 984         Reviewed by Geoffrey Garen.
 985
 986         Avoid overflow which causes keyword tokens to be treated as unary
 987         tokens now that "async" is tokenized as a keyword, by granting an
 988         additional 64 bits to be occupied by token IDs.
 989
 990         * parser/ParserTokens.h:
 991
 992 2016-12-02  Andy Estes  <aestes@apple.com>
 993
 994         [Cocoa] Adopt the PRODUCT_BUNDLE_IDENTIFIER build setting
 995         https://bugs.webkit.org/show_bug.cgi?id=164492
 996
 997         Reviewed by Dan Bernstein.
 998
 999         * Configurations/JavaScriptCore.xcconfig: Set PRODUCT_BUNDLE_IDENTIFIER to
1000         com.apple.$(PRODUCT_NAME:rfc1034identifier).
1001         * Info.plist: Changed CFBundleIdentifier's value from com.apple.${PRODUCT_NAME} to
1002         ${PRODUCT_BUNDLE_IDENTIFIER}.
1003
1004 2016-12-02  JF Bastien  <jfbastien@apple.com>
1005
1006         WebAssembly: mark WasmOps.h as private
1007         https://bugs.webkit.org/show_bug.cgi?id=165335
1008
1009         Reviewed by Mark Lam.
1010
1011         * JavaScriptCore.xcodeproj/project.pbxproj: WasmOps.h will be used by non-JSC and should therefore be private
1012
1013 2016-12-02  Commit Queue  <commit-queue@webkit.org>
1014
1015         Unreviewed, rolling out r209275 and r209276.
1016         https://bugs.webkit.org/show_bug.cgi?id=165348
1017
1018         "broke the arm build" (Requested by keith_miller on #webkit).
1019
1020         Reverted changesets:
1021
1022         "Add Wasm floating point nearest and trunc"
1023         https://bugs.webkit.org/show_bug.cgi?id=165339
1024         http://trac.webkit.org/changeset/209275
1025
1026         "Unreviewed, forgot to change instruction after renaming."
1027         http://trac.webkit.org/changeset/209276
1028
1029 2016-12-02  Keith Miller  <keith_miller@apple.com>
1030
1031         Unreviewed, forgot to change instruction after renaming.
1032
1033         * assembler/MacroAssemblerARM64.h:
1034         (JSC::MacroAssemblerARM64::nearestIntDouble):
1035         (JSC::MacroAssemblerARM64::nearestIntFloat):
1036
1037 2016-12-02  Keith Miller  <keith_miller@apple.com>
1038
1039         Add Wasm floating point nearest and trunc
1040         https://bugs.webkit.org/show_bug.cgi?id=165339
1041
1042         Reviewed by Filip Pizlo.
1043
1044         This patch also allows any wasm primitive type to be passed as a
1045         string.
1046
1047         * assembler/MacroAssemblerARM64.h:
1048         (JSC::MacroAssemblerARM64::nearestIntDouble):
1049         (JSC::MacroAssemblerARM64::nearestIntFloat):
1050         (JSC::MacroAssemblerARM64::truncDouble):
1051         (JSC::MacroAssemblerARM64::truncFloat):
1052         * assembler/MacroAssemblerX86Common.h:
1053         (JSC::MacroAssemblerX86Common::nearestIntDouble):
1054         (JSC::MacroAssemblerX86Common::nearestIntFloat):
1055         * jsc.cpp:
1056         (box):
1057         * wasm/WasmB3IRGenerator.cpp:
1058         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
1059         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
1060         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Nearest>):
1061         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Nearest>):
1062         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Trunc>):
1063         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Trunc>):
1064         * wasm/WasmFunctionParser.h:
1065         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1066
1067 2016-12-02  JF Bastien  <jfbastien@apple.com>
1068
1069         WebAssembly: revert patch causing odd breakage
1070         https://bugs.webkit.org/show_bug.cgi?id=165308
1071
1072         Unreviewed.
1073
1074         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
1075         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
1076
1077         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
1078
1079         * wasm/WasmB3IRGenerator.cpp:
1080         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1081         (JSC::Wasm::B3IRGenerator::zeroForType):
1082         (JSC::Wasm::B3IRGenerator::addConstant):
1083         (JSC::Wasm::createJSWrapper):
1084         * wasm/WasmCallingConvention.h:
1085         (JSC::Wasm::CallingConvention::marshallArgument):
1086         * wasm/WasmFormat.cpp:
1087         (JSC::Wasm::toString):
1088         * wasm/WasmFormat.h:
1089         (JSC::Wasm::toB3Type):
1090         * wasm/WasmFunctionParser.h:
1091         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1092         * wasm/WasmModuleParser.cpp:
1093         (JSC::Wasm::ModuleParser::parse):
1094         (JSC::Wasm::ModuleParser::parseType):
1095         * wasm/WasmModuleParser.h:
1096         * wasm/WasmParser.h:
1097         (JSC::Wasm::Parser::parseResultType):
1098         * wasm/generateWasm.py:
1099         (Wasm.__init__):
1100         * wasm/generateWasmOpsHeader.py:
1101         (cppMacro):
1102         (opcodeMacroizer):
1103         (typeMacroizer): Deleted.
1104         * wasm/js/WebAssemblyFunction.cpp:
1105         (JSC::callWebAssemblyFunction):
1106         * wasm/wasm.json:
1107
1108 2016-12-01  Brian Burg  <bburg@apple.com>
1109
1110         Remote Inspector: fix weird typo in generated ObjC protocol type initializer implementations
1111         https://bugs.webkit.org/show_bug.cgi?id=165295
1112         <rdar://problem/29427778>
1113
1114         Reviewed by Joseph Pecoraro.
1115
1116         Remove a stray semicolon appended after custom initializer signatures.
1117         This is a syntax error when building with less lenient compiler warnings.
1118
1119         * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
1120         (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_required_members):
1121         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
1122         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
1123         * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
1124         * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
1125         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
1126         * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
1127         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
1128
1129 2016-12-01  Saam Barati  <sbarati@apple.com>
1130
1131         Rename CallFrame::callee() to CallFrame::jsCallee()
1132         https://bugs.webkit.org/show_bug.cgi?id=165293
1133
1134         Reviewed by Keith Miller.
1135
1136         Wasm will soon have its own Callee that doesn't derive
1137         from JSObject, but derives from JSCell. I want to introduce
1138         a new function like:
1139         ```
1140         CalleeBase* CallFrame::callee()
1141         ```
1142
1143         once we have a Wasm callee. It only makes sense to name that
1144         function callee() and rename the current one turn to:
1145         ```
1146         JSObject* CallFrame::jsCallee()
1147         ```
1148
1149         * API/APICallbackFunction.h:
1150         (JSC::APICallbackFunction::call):
1151         (JSC::APICallbackFunction::construct):
1152         * API/JSCallbackObjectFunctions.h:
1153         (JSC::JSCallbackObject<Parent>::construct):
1154         (JSC::JSCallbackObject<Parent>::call):
1155         * debugger/DebuggerCallFrame.cpp:
1156         (JSC::DebuggerCallFrame::scope):
1157         (JSC::DebuggerCallFrame::type):
1158         * interpreter/CallFrame.cpp:
1159         (JSC::CallFrame::friendlyFunctionName):
1160         * interpreter/CallFrame.h:
1161         (JSC::ExecState::jsCallee):
1162         (JSC::ExecState::callee): Deleted.
1163         * interpreter/Interpreter.cpp:
1164         (JSC::Interpreter::dumpRegisters):
1165         (JSC::notifyDebuggerOfUnwinding):
1166         * interpreter/ShadowChicken.cpp:
1167         (JSC::ShadowChicken::update):
1168         * interpreter/StackVisitor.cpp:
1169         (JSC::StackVisitor::readNonInlinedFrame):
1170         * llint/LLIntSlowPaths.cpp:
1171         (JSC::LLInt::traceFunctionPrologue):
1172         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1173         * runtime/ArrayConstructor.cpp:
1174         (JSC::constructArrayWithSizeQuirk):
1175         * runtime/AsyncFunctionConstructor.cpp:
1176         (JSC::callAsyncFunctionConstructor):
1177         (JSC::constructAsyncFunctionConstructor):
1178         * runtime/BooleanConstructor.cpp:
1179         (JSC::constructWithBooleanConstructor):
1180         * runtime/ClonedArguments.cpp:
1181         (JSC::ClonedArguments::createWithInlineFrame):
1182         * runtime/CommonSlowPaths.h:
1183         (JSC::CommonSlowPaths::arityCheckFor):
1184         * runtime/DateConstructor.cpp:
1185         (JSC::constructWithDateConstructor):
1186         * runtime/DirectArguments.cpp:
1187         (JSC::DirectArguments::createByCopying):
1188         * runtime/Error.h:
1189         (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
1190         (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
1191         * runtime/ErrorConstructor.cpp:
1192         (JSC::Interpreter::constructWithErrorConstructor):
1193         (JSC::Interpreter::callErrorConstructor):
1194         * runtime/FunctionConstructor.cpp:
1195         (JSC::constructWithFunctionConstructor):
1196         (JSC::callFunctionConstructor):
1197         * runtime/GeneratorFunctionConstructor.cpp:
1198         (JSC::callGeneratorFunctionConstructor):
1199         (JSC::constructGeneratorFunctionConstructor):
1200         * runtime/InternalFunction.cpp:
1201         (JSC::InternalFunction::createSubclassStructure):
1202         * runtime/IntlCollator.cpp:
1203         (JSC::IntlCollator::initializeCollator):
1204         * runtime/IntlCollatorConstructor.cpp:
1205         (JSC::constructIntlCollator):
1206         (JSC::callIntlCollator):
1207         (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
1208         * runtime/IntlDateTimeFormat.cpp:
1209         (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
1210         * runtime/IntlDateTimeFormatConstructor.cpp:
1211         (JSC::constructIntlDateTimeFormat):
1212         (JSC::callIntlDateTimeFormat):
1213         (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
1214         * runtime/IntlNumberFormat.cpp:
1215         (JSC::IntlNumberFormat::initializeNumberFormat):
1216         * runtime/IntlNumberFormatConstructor.cpp:
1217         (JSC::constructIntlNumberFormat):
1218         (JSC::callIntlNumberFormat):
1219         (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
1220         * runtime/IntlObject.cpp:
1221         (JSC::canonicalizeLocaleList):
1222         (JSC::defaultLocale):
1223         (JSC::lookupSupportedLocales):
1224         (JSC::intlObjectFuncGetCanonicalLocales):
1225         * runtime/JSArrayBufferConstructor.cpp:
1226         (JSC::constructArrayBuffer):
1227         * runtime/JSArrayBufferPrototype.cpp:
1228         (JSC::arrayBufferProtoFuncSlice):
1229         * runtime/JSBoundFunction.cpp:
1230         (JSC::boundThisNoArgsFunctionCall):
1231         (JSC::boundFunctionCall):
1232         (JSC::boundThisNoArgsFunctionConstruct):
1233         (JSC::boundFunctionConstruct):
1234         * runtime/JSCellInlines.h:
1235         (JSC::ExecState::vm):
1236         * runtime/JSCustomGetterSetterFunction.cpp:
1237         (JSC::JSCustomGetterSetterFunction::customGetterSetterFunctionCall):
1238         * runtime/JSFunction.cpp:
1239         (JSC::callHostFunctionAsConstructor):
1240         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
1241         (JSC::constructGenericTypedArrayView):
1242         * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
1243         (JSC::genericTypedArrayViewProtoFuncSlice):
1244         (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
1245         * runtime/JSGlobalObjectFunctions.cpp:
1246         (JSC::globalFuncEval):
1247         * runtime/JSInternalPromiseConstructor.cpp:
1248         (JSC::constructPromise):
1249         * runtime/JSMapIterator.cpp:
1250         (JSC::JSMapIterator::createPair):
1251         (JSC::JSMapIterator::clone):
1252         * runtime/JSNativeStdFunction.cpp:
1253         (JSC::runStdFunction):
1254         * runtime/JSPromiseConstructor.cpp:
1255         (JSC::constructPromise):
1256         * runtime/JSPropertyNameIterator.cpp:
1257         (JSC::JSPropertyNameIterator::clone):
1258         * runtime/JSScope.h:
1259         (JSC::ExecState::lexicalGlobalObject):
1260         * runtime/JSSetIterator.cpp:
1261         (JSC::JSSetIterator::createPair):
1262         (JSC::JSSetIterator::clone):
1263         * runtime/JSStringIterator.cpp:
1264         (JSC::JSStringIterator::clone):
1265         * runtime/MapConstructor.cpp:
1266         (JSC::constructMap):
1267         * runtime/MapPrototype.cpp:
1268         (JSC::mapProtoFuncValues):
1269         (JSC::mapProtoFuncEntries):
1270         (JSC::mapProtoFuncKeys):
1271         (JSC::privateFuncMapIterator):
1272         * runtime/NativeErrorConstructor.cpp:
1273         (JSC::Interpreter::constructWithNativeErrorConstructor):
1274         (JSC::Interpreter::callNativeErrorConstructor):
1275         * runtime/ObjectConstructor.cpp:
1276         (JSC::constructObject):
1277         * runtime/ProxyObject.cpp:
1278         (JSC::performProxyCall):
1279         (JSC::performProxyConstruct):
1280         * runtime/ProxyRevoke.cpp:
1281         (JSC::performProxyRevoke):
1282         * runtime/RegExpConstructor.cpp:
1283         (JSC::constructWithRegExpConstructor):
1284         (JSC::callRegExpConstructor):
1285         * runtime/ScopedArguments.cpp:
1286         (JSC::ScopedArguments::createByCopying):
1287         * runtime/SetConstructor.cpp:
1288         (JSC::constructSet):
1289         * runtime/SetPrototype.cpp:
1290         (JSC::setProtoFuncValues):
1291         (JSC::setProtoFuncEntries):
1292         (JSC::privateFuncSetIterator):
1293         * runtime/StringConstructor.cpp:
1294         (JSC::constructWithStringConstructor):
1295         * runtime/StringPrototype.cpp:
1296         (JSC::stringProtoFuncIterator):
1297         * runtime/WeakMapConstructor.cpp:
1298         (JSC::constructWeakMap):
1299         * runtime/WeakSetConstructor.cpp:
1300         (JSC::constructWeakSet):
1301         * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
1302         (JSC::constructJSWebAssemblyCompileError):
1303         * wasm/js/WebAssemblyFunction.cpp:
1304         (JSC::callWebAssemblyFunction):
1305         * wasm/js/WebAssemblyModuleConstructor.cpp:
1306         (JSC::constructJSWebAssemblyModule):
1307         * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
1308         (JSC::constructJSWebAssemblyRuntimeError):
1309
1310 2016-12-01  Brian Burg  <bburg@apple.com>
1311
1312         Web Inspector: generated code should use a framework-style import for *ProtocolArrayConversions.h
1313         https://bugs.webkit.org/show_bug.cgi?id=165281
1314         <rdar://problem/29427778>
1315
1316         Reviewed by Joseph Pecoraro.
1317
1318         * inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py:
1319         (ObjCProtocolTypeConversionsHeaderGenerator.generate_output):
1320         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
1321         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
1322         * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
1323         * inspector/scripts/tests/expected/enum-values.json-result:
1324         * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
1325         * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
1326         * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
1327         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
1328         * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
1329         * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
1330         * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
1331         * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
1332         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
1333
1334 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
1335
1336         SourceCodeKey should use unlinked source code
1337         https://bugs.webkit.org/show_bug.cgi?id=165286
1338
1339         Reviewed by Saam Barati.
1340
1341         This patch splits out UnlinkedSourceCode from SourceCode, and deploys
1342         UnlinkedSourceCode in SourceCodeKey.
1343
1344         It's misleading to store SourceCode in SourceCodeKey because SourceCode
1345         has an absolute location whereas unlinked cached code has no location.
1346
1347         I plan to deploy UnlinkedSourceCode in more places, to indicate code
1348         that has no absolute location.
1349
1350         * JavaScriptCore.xcodeproj/project.pbxproj:
1351         * parser/SourceCode.cpp:
1352         (JSC::UnlinkedSourceCode::toUTF8):
1353         (JSC::SourceCode::toUTF8): Deleted.
1354         * parser/SourceCode.h:
1355         (JSC::SourceCode::SourceCode):
1356         (JSC::SourceCode::startColumn):
1357         (JSC::SourceCode::isHashTableDeletedValue): Deleted.
1358         (JSC::SourceCode::hash): Deleted.
1359         (JSC::SourceCode::view): Deleted.
1360         (JSC::SourceCode::providerID): Deleted.
1361         (JSC::SourceCode::isNull): Deleted.
1362         (JSC::SourceCode::provider): Deleted.
1363         (JSC::SourceCode::startOffset): Deleted.
1364         (JSC::SourceCode::endOffset): Deleted.
1365         (JSC::SourceCode::length): Deleted. Move a bunch of stuff in to a new
1366         base class, UnlinkedSourceCode.
1367
1368         * parser/SourceCodeKey.h:
1369         (JSC::SourceCodeKey::SourceCodeKey): Use UnlinkedSourceCode since code
1370         in the cache has no location.
1371
1372         * parser/UnlinkedSourceCode.h: Copied from Source/JavaScriptCore/parser/SourceCode.h.
1373         (JSC::UnlinkedSourceCode::UnlinkedSourceCode):
1374         (JSC::UnlinkedSourceCode::provider):
1375         (JSC::SourceCode::SourceCode): Deleted.
1376         (JSC::SourceCode::isHashTableDeletedValue): Deleted.
1377         (JSC::SourceCode::hash): Deleted.
1378         (JSC::SourceCode::view): Deleted.
1379         (JSC::SourceCode::providerID): Deleted.
1380         (JSC::SourceCode::isNull): Deleted.
1381         (JSC::SourceCode::provider): Deleted.
1382         (JSC::SourceCode::firstLine): Deleted.
1383         (JSC::SourceCode::startColumn): Deleted.
1384         (JSC::SourceCode::startOffset): Deleted.
1385         (JSC::SourceCode::endOffset): Deleted.
1386         (JSC::SourceCode::length): Deleted.
1387         (JSC::makeSource): Deleted.
1388         (JSC::SourceCode::subExpression): Deleted.
1389
1390         * runtime/CodeCache.h: Use UnlinkedSourceCode in the cache.
1391
1392 2016-12-01  Keith Miller  <keith_miller@apple.com>
1393
1394         Add wasm int to floating point opcodes
1395         https://bugs.webkit.org/show_bug.cgi?id=165252
1396
1397         Reviewed by Geoffrey Garen.
1398
1399         This patch adds support for the Wasm integral type => floating point
1400         type conversion opcodes. Most of these were already supported by B3
1401         however there was no support for uint64 to float/double. Unfortunately,
1402         AFAIK x86_64 does not have a single instruction that performs this
1403         conversion. Since there is a signed conversion instruction on x86 we
1404         use that for all uint64s that don't have the top bit set. If they do have
1405         the top bit set we need to divide by 2 (rounding up) then convert the number
1406         with the signed conversion then double the result.
1407
1408         * assembler/MacroAssemblerX86_64.h:
1409         (JSC::MacroAssemblerX86_64::convertUInt64ToDouble):
1410         (JSC::MacroAssemblerX86_64::convertUInt64ToFloat):
1411         * jsc.cpp:
1412         (valueWithTypeOfWasmValue):
1413         (box):
1414         (functionTestWasmModuleFunctions):
1415         * wasm/WasmB3IRGenerator.cpp:
1416         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
1417         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
1418         * wasm/WasmFunctionParser.h:
1419         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1420         * wasm/wasm.json:
1421
1422 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
1423
1424         Renamed EvalCodeCache => DirectEvalCodeCache
1425         https://bugs.webkit.org/show_bug.cgi?id=165271
1426
1427         Reviewed by Saam Barati.
1428
1429         We only use this cache for DirectEval, not IndirectEval.
1430
1431         * JavaScriptCore.xcodeproj/project.pbxproj:
1432         * bytecode/CodeBlock.cpp:
1433         (JSC::DirectEvalCodeCache::visitAggregate):
1434         (JSC::CodeBlock::stronglyVisitStrongReferences):
1435         (JSC::EvalCodeCache::visitAggregate): Deleted.
1436         * bytecode/CodeBlock.h:
1437         (JSC::CodeBlock::directEvalCodeCache):
1438         (JSC::CodeBlock::evalCodeCache): Deleted.
1439         * bytecode/DirectEvalCodeCache.h: Copied from Source/JavaScriptCore/bytecode/EvalCodeCache.h.
1440         (JSC::EvalCodeCache::CacheKey::CacheKey): Deleted.
1441         (JSC::EvalCodeCache::CacheKey::hash): Deleted.
1442         (JSC::EvalCodeCache::CacheKey::isEmptyValue): Deleted.
1443         (JSC::EvalCodeCache::CacheKey::operator==): Deleted.
1444         (JSC::EvalCodeCache::CacheKey::isHashTableDeletedValue): Deleted.
1445         (JSC::EvalCodeCache::CacheKey::Hash::hash): Deleted.
1446         (JSC::EvalCodeCache::CacheKey::Hash::equal): Deleted.
1447         (JSC::EvalCodeCache::tryGet): Deleted.
1448         (JSC::EvalCodeCache::set): Deleted.
1449         (JSC::EvalCodeCache::isEmpty): Deleted.
1450         (JSC::EvalCodeCache::clear): Deleted.
1451         * bytecode/EvalCodeCache.h: Removed.
1452         * interpreter/Interpreter.cpp:
1453         (JSC::eval):
1454         * runtime/DirectEvalExecutable.cpp:
1455         (JSC::DirectEvalExecutable::create):
1456
1457 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
1458
1459         Removed some unnecessary indirection in code generation
1460         https://bugs.webkit.org/show_bug.cgi?id=165264
1461
1462         Reviewed by Keith Miller.
1463
1464         There's no need to route through JSGlobalObject when producing code --
1465         it just made the code harder to read.
1466
1467         This patch moves functions from JSGlobalObject to their singleton
1468         call sites.
1469
1470         * runtime/CodeCache.cpp:
1471         (JSC::CodeCache::getUnlinkedEvalCodeBlock):
1472         (JSC::CodeCache::getUnlinkedGlobalEvalCodeBlock): Deleted.
1473         * runtime/CodeCache.h:
1474         * runtime/DirectEvalExecutable.cpp:
1475         (JSC::DirectEvalExecutable::create):
1476         * runtime/IndirectEvalExecutable.cpp:
1477         (JSC::IndirectEvalExecutable::create):
1478         * runtime/JSGlobalObject.cpp:
1479         (JSC::JSGlobalObject::createProgramCodeBlock): Deleted.
1480         (JSC::JSGlobalObject::createLocalEvalCodeBlock): Deleted.
1481         (JSC::JSGlobalObject::createGlobalEvalCodeBlock): Deleted.
1482         (JSC::JSGlobalObject::createModuleProgramCodeBlock): Deleted.
1483         * runtime/JSGlobalObject.h:
1484         * runtime/ModuleProgramExecutable.cpp:
1485         (JSC::ModuleProgramExecutable::create):
1486         * runtime/ProgramExecutable.cpp:
1487         (JSC::ProgramExecutable::initializeGlobalProperties):
1488         * runtime/ProgramExecutable.h:
1489
1490 2016-11-30  Darin Adler  <darin@apple.com>
1491
1492         Roll out StringBuilder changes from the previous patch.
1493         They were a slowdown on a Kraken JSON test.
1494
1495         * runtime/JSONObject.cpp:
1496         Roll out changes from below.
1497
1498 2016-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1499
1500         [JSC] Specifying same module entry point multiple times cause TypeError
1501         https://bugs.webkit.org/show_bug.cgi?id=164858
1502
1503         Reviewed by Saam Barati.
1504
1505         Allow importing the same module multiple times. Previously, when specifying the same
1506         module in the <script type="module" src="here">, it throws TypeError.
1507
1508         * builtins/ModuleLoaderPrototype.js:
1509         (requestFetch):
1510         (requestTranslate):
1511         (requestInstantiate):
1512         (requestSatisfy):
1513
1514 2016-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1515
1516         WebAssembly JS API: export a module namespace object instead of a module environment
1517         https://bugs.webkit.org/show_bug.cgi?id=165121
1518
1519         Reviewed by Saam Barati.
1520
1521         This patch setup AbstractModuleRecord further for WebAssemblyModuleRecord.
1522         For exported entries in a wasm instance, we set up exported entries for
1523         AbstractModuleRecord. This allows us to export WASM exported functions in
1524         the module handling code.
1525
1526         Since the exported entries in the abstract module record are correctly
1527         instantiated, the module namespace object for WASM module also starts
1528         working correctly. So we start exposing the module namespace object
1529         as `instance.exports` instead of the module environment object.
1530
1531         And we move SourceCode, lexicalVariables, and declaredVariables fields to
1532         JSModuleRecord since they are related to JS source code (in the spec words,
1533         they are related to the source text module record).
1534
1535         * runtime/AbstractModuleRecord.cpp:
1536         (JSC::AbstractModuleRecord::AbstractModuleRecord):
1537         * runtime/AbstractModuleRecord.h:
1538         (JSC::AbstractModuleRecord::sourceCode): Deleted.
1539         (JSC::AbstractModuleRecord::declaredVariables): Deleted.
1540         (JSC::AbstractModuleRecord::lexicalVariables): Deleted.
1541         * runtime/JSModuleRecord.cpp:
1542         (JSC::JSModuleRecord::JSModuleRecord):
1543         * runtime/JSModuleRecord.h:
1544         (JSC::JSModuleRecord::sourceCode):
1545         (JSC::JSModuleRecord::declaredVariables):
1546         (JSC::JSModuleRecord::lexicalVariables):
1547         * wasm/WasmFormat.cpp:
1548         * wasm/js/JSWebAssemblyInstance.cpp:
1549         (JSC::JSWebAssemblyInstance::finishCreation):
1550         * wasm/js/WebAssemblyFunction.cpp:
1551         * wasm/js/WebAssemblyInstanceConstructor.cpp:
1552         (JSC::constructJSWebAssemblyInstance):
1553         * wasm/js/WebAssemblyModuleRecord.cpp:
1554         (JSC::WebAssemblyModuleRecord::create):
1555         (JSC::WebAssemblyModuleRecord::WebAssemblyModuleRecord):
1556         (JSC::WebAssemblyModuleRecord::finishCreation):
1557         WebAssemblyModuleRecord::link should perform linking things.
1558         So allocating exported entries should be done here.
1559         (JSC::WebAssemblyModuleRecord::link):
1560         * wasm/js/WebAssemblyModuleRecord.h:
1561
1562 2016-11-30  Mark Lam  <mark.lam@apple.com>
1563
1564         TypeInfo::OutOfLineTypeFlags should be 16 bits in size.
1565         https://bugs.webkit.org/show_bug.cgi?id=165224
1566
1567         Reviewed by Saam Barati.
1568
1569         There's no reason for OutOfLineTypeFlags to be constraint to 8 bits since the
1570         space is available to us.  Making OutOfLineTypeFlags 16 bits brings TypeInfo up
1571         to 32 bits in size from the current 24 bits.
1572
1573         * runtime/JSTypeInfo.h:
1574         (JSC::TypeInfo::TypeInfo):
1575
1576 2016-11-30  Joseph Pecoraro  <pecoraro@apple.com>
1577
1578         REGRESSION: inspector/sampling-profiler/* LayoutTests are flaky timeouts
1579         https://bugs.webkit.org/show_bug.cgi?id=164388
1580         <rdar://problem/29101555>
1581
1582         Reviewed by Saam Barati.
1583
1584         There was a possibility of a deadlock between the main thread and the GC thread
1585         with the SamplingProfiler lock when Inspector is processing samples to send to
1586         the frontend. The Inspector (main thread) was holding the SamplingProfiler lock
1587         while processing samples, which runs JavaScript that could trigger a GC, and
1588         GC then tries to acquire the SamplingProfiler lock to process unprocessed samples.
1589
1590         A simple solution here is to tighten the bounds of when Inspector holds the
1591         SamplingProfiler lock. It only needs the lock when extracting samples from
1592         the SamplingProfiler. It doesn't need to hold the lock for processing those
1593         samples, which is what can run script and cause a GC.
1594
1595         * inspector/agents/InspectorScriptProfilerAgent.cpp:
1596         (Inspector::InspectorScriptProfilerAgent::trackingComplete):
1597         Tighten bounds of this lock to only where it is needed.
1598
1599 2016-11-30  Mark Lam  <mark.lam@apple.com>
1600
1601         Proxy is not allowed in the global prototype chain.
1602         https://bugs.webkit.org/show_bug.cgi?id=165205
1603
1604         Reviewed by Geoffrey Garen.
1605
1606         * runtime/ProgramExecutable.cpp:
1607         (JSC::ProgramExecutable::initializeGlobalProperties):
1608         - We'll now throw a TypeError if we detect a Proxy in the global prototype chain.
1609
1610 2016-11-30  Commit Queue  <commit-queue@webkit.org>
1611
1612         Unreviewed, rolling out r209112.
1613         https://bugs.webkit.org/show_bug.cgi?id=165208
1614
1615         "It regressed Octane/Raytrace and JetStream" (Requested by
1616         saamyjoon on #webkit).
1617
1618         Reverted changeset:
1619
1620         "We should support CreateThis in the FTL"
1621         https://bugs.webkit.org/show_bug.cgi?id=164904
1622         http://trac.webkit.org/changeset/209112
1623
1624 2016-11-30  Darin Adler  <darin@apple.com>
1625
1626         Streamline and speed up tokenizer and segmented string classes
1627         https://bugs.webkit.org/show_bug.cgi?id=165003
1628
1629         Reviewed by Sam Weinig.
1630
1631         * runtime/JSONObject.cpp:
1632         (JSC::Stringifier::appendStringifiedValue): Use viewWithUnderlyingString when calling
1633         StringBuilder::appendQuotedJSONString, since it now takes a StringView and there is
1634         no benefit in creating a String for that function if one doesn't already exist.
1635
1636 2016-11-29  JF Bastien  <jfbastien@apple.com>
1637
1638         WebAssembly JS API: improve Instance
1639         https://bugs.webkit.org/show_bug.cgi?id=164757
1640
1641         Reviewed by Keith Miller.
1642
1643         An Instance's `exports` property wasn't populated with exports.
1644
1645         According to the spec [0], `exports` should present itself as a WebAssembly
1646         Module Record. In order to do this we need to split JSModuleRecord into
1647         AbstractModuleRecord (without the `link` and `evaluate` functions), and
1648         JSModuleRecord (which implements link and evaluate). We can then have a separate
1649         WebAssemblyModuleRecord which shares most of the implementation.
1650
1651         `exports` then maps function names to WebAssemblyFunction and
1652         WebAssemblyFunctionCell, which call into the B3-generated WebAssembly code.
1653
1654         A follow-up patch will do imports.
1655
1656         A few things of note:
1657
1658          - Use Identifier instead of String. They get uniqued, we need them for the JSModuleNamespaceObject. This is safe because JSWebAssemblyModule creation is on the main thread.
1659          - JSWebAssemblyInstance needs to refer to the JSWebAssemblyModule used to create it, because the module owns the code, identifiers, etc. The world would be very sad if it got GC'd.
1660          - Instance.exports shouldn't use putWithoutTransition because it affects all Structures, whereas here each instance needs its own exports.
1661          - Expose the compiled functions, and pipe them to the InstanceConstructor. Start moving things around to split JSModuleRecord out into JS and WebAssembly parts.
1662
1663           [0]: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-constructor
1664
1665         * CMakeLists.txt:
1666         * JavaScriptCore.xcodeproj/project.pbxproj:
1667         * runtime/AbstractModuleRecord.cpp: Copied from Source/JavaScriptCore/runtime/JSModuleRecord.cpp, which I split in two
1668         (JSC::AbstractModuleRecord::AbstractModuleRecord):
1669         (JSC::AbstractModuleRecord::destroy):
1670         (JSC::AbstractModuleRecord::finishCreation):
1671         (JSC::AbstractModuleRecord::visitChildren):
1672         (JSC::AbstractModuleRecord::appendRequestedModule):
1673         (JSC::AbstractModuleRecord::addStarExportEntry):
1674         (JSC::AbstractModuleRecord::addImportEntry):
1675         (JSC::AbstractModuleRecord::addExportEntry):
1676         (JSC::identifierToJSValue):
1677         (JSC::AbstractModuleRecord::hostResolveImportedModule):
1678         (JSC::AbstractModuleRecord::ResolveQuery::ResolveQuery):
1679         (JSC::AbstractModuleRecord::ResolveQuery::isEmptyValue):
1680         (JSC::AbstractModuleRecord::ResolveQuery::isDeletedValue):
1681         (JSC::AbstractModuleRecord::ResolveQuery::Hash::hash):
1682         (JSC::AbstractModuleRecord::ResolveQuery::Hash::equal):
1683         (JSC::AbstractModuleRecord::cacheResolution):
1684         (JSC::getExportedNames):
1685         (JSC::AbstractModuleRecord::getModuleNamespace):
1686         (JSC::printableName):
1687         (JSC::AbstractModuleRecord::dump):
1688         * runtime/AbstractModuleRecord.h: Copied from Source/JavaScriptCore/runtime/JSModuleRecord.h.
1689         (JSC::AbstractModuleRecord::ImportEntry::isNamespace):
1690         (JSC::AbstractModuleRecord::sourceCode):
1691         (JSC::AbstractModuleRecord::moduleKey):
1692         (JSC::AbstractModuleRecord::requestedModules):
1693         (JSC::AbstractModuleRecord::exportEntries):
1694         (JSC::AbstractModuleRecord::importEntries):
1695         (JSC::AbstractModuleRecord::starExportEntries):
1696         (JSC::AbstractModuleRecord::declaredVariables):
1697         (JSC::AbstractModuleRecord::lexicalVariables):
1698         (JSC::AbstractModuleRecord::moduleEnvironment):
1699         * runtime/JSGlobalObject.cpp:
1700         (JSC::JSGlobalObject::init):
1701         (JSC::JSGlobalObject::visitChildren):
1702         * runtime/JSGlobalObject.h:
1703         (JSC::JSGlobalObject::webAssemblyModuleRecordStructure):
1704         (JSC::JSGlobalObject::webAssemblyFunctionStructure):
1705         * runtime/JSModuleEnvironment.cpp:
1706         (JSC::JSModuleEnvironment::create):
1707         (JSC::JSModuleEnvironment::finishCreation):
1708         (JSC::JSModuleEnvironment::getOwnPropertySlot):
1709         (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
1710         (JSC::JSModuleEnvironment::put):
1711         (JSC::JSModuleEnvironment::deleteProperty):
1712         * runtime/JSModuleEnvironment.h:
1713         (JSC::JSModuleEnvironment::create):
1714         (JSC::JSModuleEnvironment::offsetOfModuleRecord):
1715         (JSC::JSModuleEnvironment::allocationSize):
1716         (JSC::JSModuleEnvironment::moduleRecord):
1717         (JSC::JSModuleEnvironment::moduleRecordSlot):
1718         * runtime/JSModuleNamespaceObject.cpp:
1719         (JSC::JSModuleNamespaceObject::finishCreation):
1720         (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
1721         * runtime/JSModuleNamespaceObject.h:
1722         (JSC::JSModuleNamespaceObject::create):
1723         (JSC::JSModuleNamespaceObject::moduleRecord):
1724         * runtime/JSModuleRecord.cpp:
1725         (JSC::JSModuleRecord::createStructure):
1726         (JSC::JSModuleRecord::create):
1727         (JSC::JSModuleRecord::JSModuleRecord):
1728         (JSC::JSModuleRecord::destroy):
1729         (JSC::JSModuleRecord::finishCreation):
1730         (JSC::JSModuleRecord::visitChildren):
1731         (JSC::JSModuleRecord::instantiateDeclarations):
1732         * runtime/JSModuleRecord.h:
1733         * runtime/JSScope.cpp:
1734         (JSC::abstractAccess):
1735         (JSC::JSScope::collectClosureVariablesUnderTDZ):
1736         * runtime/VM.cpp:
1737         (JSC::VM::VM):
1738         * runtime/VM.h:
1739         * wasm/JSWebAssembly.h:
1740         * wasm/WasmFormat.h: use Identifier instead of String
1741         * wasm/WasmModuleParser.cpp:
1742         (JSC::Wasm::ModuleParser::parse):
1743         (JSC::Wasm::ModuleParser::parseType):
1744         (JSC::Wasm::ModuleParser::parseImport): fix off-by-one
1745         (JSC::Wasm::ModuleParser::parseFunction):
1746         (JSC::Wasm::ModuleParser::parseExport):
1747         * wasm/WasmModuleParser.h:
1748         (JSC::Wasm::ModuleParser::ModuleParser):
1749         * wasm/WasmPlan.cpp:
1750         (JSC::Wasm::Plan::run):
1751         * wasm/js/JSWebAssemblyInstance.cpp:
1752         (JSC::JSWebAssemblyInstance::create):
1753         (JSC::JSWebAssemblyInstance::finishCreation):
1754         (JSC::JSWebAssemblyInstance::visitChildren):
1755         * wasm/js/JSWebAssemblyInstance.h:
1756         (JSC::JSWebAssemblyInstance::module):
1757         * wasm/js/JSWebAssemblyModule.cpp:
1758         (JSC::JSWebAssemblyModule::create):
1759         (JSC::JSWebAssemblyModule::finishCreation):
1760         (JSC::JSWebAssemblyModule::visitChildren):
1761         * wasm/js/JSWebAssemblyModule.h:
1762         (JSC::JSWebAssemblyModule::moduleInformation):
1763         (JSC::JSWebAssemblyModule::compiledFunctions):
1764         (JSC::JSWebAssemblyModule::exportSymbolTable):
1765         * wasm/js/WebAssemblyFunction.cpp: Added.
1766         (JSC::callWebAssemblyFunction):
1767         (JSC::WebAssemblyFunction::create):
1768         (JSC::WebAssemblyFunction::createStructure):
1769         (JSC::WebAssemblyFunction::WebAssemblyFunction):
1770         (JSC::WebAssemblyFunction::visitChildren):
1771         (JSC::WebAssemblyFunction::finishCreation):
1772         * wasm/js/WebAssemblyFunction.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h.
1773         (JSC::CallableWebAssemblyFunction::CallableWebAssemblyFunction):
1774         (JSC::WebAssemblyFunction::webAssemblyFunctionCell):
1775         * wasm/js/WebAssemblyFunctionCell.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h.
1776         (JSC::WebAssemblyFunctionCell::create):
1777         (JSC::WebAssemblyFunctionCell::WebAssemblyFunctionCell):
1778         (JSC::WebAssemblyFunctionCell::destroy):
1779         (JSC::WebAssemblyFunctionCell::createStructure):
1780         * wasm/js/WebAssemblyFunctionCell.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h.
1781         (JSC::WebAssemblyFunctionCell::function):
1782         * wasm/js/WebAssemblyInstanceConstructor.cpp:
1783         (JSC::constructJSWebAssemblyInstance):
1784         * wasm/js/WebAssemblyModuleConstructor.cpp:
1785         (JSC::constructJSWebAssemblyModule):
1786         * wasm/js/WebAssemblyModuleRecord.cpp: Added.
1787         (JSC::WebAssemblyModuleRecord::createStructure):
1788         (JSC::WebAssemblyModuleRecord::create):
1789         (JSC::WebAssemblyModuleRecord::WebAssemblyModuleRecord):
1790         (JSC::WebAssemblyModuleRecord::destroy):
1791         (JSC::WebAssemblyModuleRecord::finishCreation):
1792         (JSC::WebAssemblyModuleRecord::visitChildren):
1793         (JSC::WebAssemblyModuleRecord::link):
1794         (JSC::WebAssemblyModuleRecord::evaluate):
1795         * wasm/js/WebAssemblyModuleRecord.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h.
1796
1797 2016-11-29  Saam Barati  <sbarati@apple.com>
1798
1799         We should be able optimize the pattern where we spread a function's rest parameter to another call
1800         https://bugs.webkit.org/show_bug.cgi?id=163865
1801
1802         Reviewed by Filip Pizlo.
1803
1804         This patch optimizes the following patterns to prevent both the allocation
1805         of the rest parameter, and the execution of the iterator protocol:
1806
1807         ```
1808         function foo(...args) {
1809             let arr = [...args];
1810         }
1811
1812         and
1813
1814         function foo(...args) {
1815             bar(...args);
1816         }
1817         ```
1818
1819         To do this, I've extended the arguments elimination phase to reason
1820         about Spread and NewArrayWithSpread. I've added two new nodes, PhantomSpread
1821         and PhantomNewArrayWithSpread. PhantomSpread is only allowed over rest
1822         parameters that don't escape. If the rest parameter *does* escape, we can't
1823         convert the spread into a phantom because it would not be sound w.r.t JS
1824         semantics because we would be reading from the call frame even though
1825         the rest array may have changed.
1826
1827         Note that NewArrayWithSpread also understands what to do when one of its
1828         arguments is PhantomSpread(@PhantomCreateRest) even if it itself is escaped.
1829
1830         PhantomNewArrayWithSpread is only allowed over a series of
1831         PhantomSpread(@PhantomCreateRest) nodes. Like with PhantomSpread, PhantomNewArrayWithSpread
1832         is only allowed if none of its arguments that are being spread are escaped
1833         and if it itself is not escaped.
1834
1835         Because there is a dependency between a node being a candidate and
1836         the escaped state of the node's children, I've extended the notion
1837         of escaping a node inside the arguments elimination phase. Now, when
1838         any node is escaped, we must consider all other candidates that are may
1839         now no longer be valid.
1840
1841         For example:
1842
1843         ```
1844         function foo(...args) {
1845             escape(args);
1846             bar(...args);
1847         }
1848         ```
1849
1850         In the above program, we don't know if the function call to escape()
1851         modifies args, therefore, the spread can not become phantom because
1852         the execution of the spread may not be as simple as reading the
1853         arguments from the call frame.
1854
1855         Unfortunately, the arguments elimination phase does not consider control
1856         flow when doing its escape analysis. It would be good to integrate this
1857         phase with the object allocation sinking phase. To see why, consider
1858         an example where we don't eliminate the spread and allocation of the rest
1859         parameter even though we could:
1860
1861         ```
1862         function foo(rareCondition, ...args) {
1863             bar(...args);
1864             if (rareCondition)
1865                 baz(args);
1866         }
1867         ```
1868
1869         There are only a few users of the PhantomSpread and PhantomNewArrayWithSpread
1870         nodes. PhantomSpread is only used by PhantomNewArrayWithSpread and NewArrayWithSpread.
1871         PhantomNewArrayWithSpread is only used by ForwardVarargs and the various
1872         *Call*ForwardVarargs nodes. The users of these phantoms know how to produce
1873         what the phantom node would have produced. For example, NewArrayWithSpread
1874         knows how to produce the values that would have been produced by PhantomSpread(@PhantomCreateRest)
1875         by directly reading from the call frame.
1876
1877         This patch is a 6% speedup on my MBP on ES6SampleBench.
1878
1879         * b3/B3LowerToAir.cpp:
1880         (JSC::B3::Air::LowerToAir::tryAppendLea):
1881         * b3/B3ValueRep.h:
1882         * builtins/BuiltinExecutables.cpp:
1883         (JSC::BuiltinExecutables::createDefaultConstructor):
1884         * dfg/DFGAbstractInterpreterInlines.h:
1885         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1886         * dfg/DFGArgumentsEliminationPhase.cpp:
1887         * dfg/DFGClobberize.h:
1888         (JSC::DFG::clobberize):
1889         * dfg/DFGDoesGC.cpp:
1890         (JSC::DFG::doesGC):
1891         * dfg/DFGFixupPhase.cpp:
1892         (JSC::DFG::FixupPhase::fixupNode):
1893         * dfg/DFGForAllKills.h:
1894         (JSC::DFG::forAllKillsInBlock):
1895         * dfg/DFGNode.h:
1896         (JSC::DFG::Node::hasConstant):
1897         (JSC::DFG::Node::constant):
1898         (JSC::DFG::Node::bitVector):
1899         (JSC::DFG::Node::isPhantomAllocation):
1900         * dfg/DFGNodeType.h:
1901         * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
1902         (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
1903         (JSC::DFG::LocalOSRAvailabilityCalculator::LocalOSRAvailabilityCalculator):
1904         (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
1905         * dfg/DFGOSRAvailabilityAnalysisPhase.h:
1906         * dfg/DFGObjectAllocationSinkingPhase.cpp:
1907         * dfg/DFGPreciseLocalClobberize.h:
1908         (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
1909         * dfg/DFGPredictionPropagationPhase.cpp:
1910         * dfg/DFGPromotedHeapLocation.cpp:
1911         (WTF::printInternal):
1912         * dfg/DFGPromotedHeapLocation.h:
1913         * dfg/DFGSafeToExecute.h:
1914         (JSC::DFG::safeToExecute):
1915         * dfg/DFGSpeculativeJIT32_64.cpp:
1916         (JSC::DFG::SpeculativeJIT::compile):
1917         * dfg/DFGSpeculativeJIT64.cpp:
1918         (JSC::DFG::SpeculativeJIT::compile):
1919         * dfg/DFGValidate.cpp:
1920         * ftl/FTLCapabilities.cpp:
1921         (JSC::FTL::canCompile):
1922         * ftl/FTLLowerDFGToB3.cpp:
1923         (JSC::FTL::DFG::LowerDFGToB3::LowerDFGToB3):
1924         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1925         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
1926         (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
1927         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
1928         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
1929         (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
1930         (JSC::FTL::DFG::LowerDFGToB3::getSpreadLengthFromInlineCallFrame):
1931         (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargsWithSpread):
1932         * ftl/FTLOperations.cpp:
1933         (JSC::FTL::operationPopulateObjectInOSR):
1934         (JSC::FTL::operationMaterializeObjectInOSR):
1935         * jit/SetupVarargsFrame.cpp:
1936         (JSC::emitSetupVarargsFrameFastCase):
1937         * jsc.cpp:
1938         (GlobalObject::finishCreation):
1939         (functionMaxArguments):
1940         * runtime/JSFixedArray.h:
1941         (JSC::JSFixedArray::createFromArray):
1942
1943 2016-11-29  Commit Queue  <commit-queue@webkit.org>
1944
1945         Unreviewed, rolling out r209058 and r209074.
1946         https://bugs.webkit.org/show_bug.cgi?id=165188
1947
1948         These changes caused API test StringBuilderTest.Equal to crash
1949         and/or fail. (Requested by ryanhaddad on #webkit).
1950
1951         Reverted changesets:
1952
1953         "Streamline and speed up tokenizer and segmented string
1954         classes"
1955         https://bugs.webkit.org/show_bug.cgi?id=165003
1956         http://trac.webkit.org/changeset/209058
1957
1958         "REGRESSION (r209058): API test StringBuilderTest.Equal
1959         crashing"
1960         https://bugs.webkit.org/show_bug.cgi?id=165142
1961         http://trac.webkit.org/changeset/209074
1962
1963 2016-11-29  Caitlin Potter  <caitp@igalia.com>
1964
1965         [JSC] always wrap AwaitExpression operand in a new Promise
1966         https://bugs.webkit.org/show_bug.cgi?id=165181
1967
1968         Reviewed by Yusuke Suzuki.
1969
1970         Ensure operand of AwaitExpression is wrapped in a new Promise by
1971         explicitly creating a new Promise Capability and invoking its
1972         resolve callback. This avoids the specified short-circuit for
1973         Promise.resolve().
1974
1975         * builtins/AsyncFunctionPrototype.js:
1976         (globalPrivate.asyncFunctionResume):
1977
1978 2016-11-29  Saam Barati  <sbarati@apple.com>
1979
1980         We should support CreateThis in the FTL
1981         https://bugs.webkit.org/show_bug.cgi?id=164904
1982
1983         Reviewed by Geoffrey Garen.
1984
1985         * ftl/FTLAbstractHeapRepository.h:
1986         * ftl/FTLCapabilities.cpp:
1987         (JSC::FTL::canCompile):
1988         * ftl/FTLLowerDFGToB3.cpp:
1989         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1990         (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
1991         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
1992         (JSC::FTL::DFG::LowerDFGToB3::compileCreateThis):
1993         (JSC::FTL::DFG::LowerDFGToB3::storeStructure):
1994         (JSC::FTL::DFG::LowerDFGToB3::allocateCell):
1995         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
1996         (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
1997         (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
1998         * runtime/Structure.h:
1999
2000 2016-11-29  Mark Lam  <mark.lam@apple.com>
2001
2002         Fix exception scope verification failures in runtime/RegExp* files.
2003         https://bugs.webkit.org/show_bug.cgi?id=165054
2004
2005         Reviewed by Saam Barati.
2006
2007         Also replaced returning JSValue() with returning { }.
2008
2009         * runtime/RegExpConstructor.cpp:
2010         (JSC::toFlags):
2011         (JSC::regExpCreate):
2012         (JSC::constructRegExp):
2013         * runtime/RegExpObject.cpp:
2014         (JSC::RegExpObject::defineOwnProperty):
2015         (JSC::collectMatches):
2016         (JSC::RegExpObject::matchGlobal):
2017         * runtime/RegExpObjectInlines.h:
2018         (JSC::getRegExpObjectLastIndexAsUnsigned):
2019         (JSC::RegExpObject::execInline):
2020         (JSC::RegExpObject::matchInline):
2021         * runtime/RegExpPrototype.cpp:
2022         (JSC::regExpProtoFuncCompile):
2023         (JSC::flagsString):
2024         (JSC::regExpProtoFuncToString):
2025         (JSC::regExpProtoFuncSplitFast):
2026
2027 2016-11-29  Andy Estes  <aestes@apple.com>
2028
2029         [Cocoa] Enable two clang warnings recommended by Xcode
2030         https://bugs.webkit.org/show_bug.cgi?id=164498
2031
2032         Reviewed by Mark Lam.
2033
2034         * Configurations/Base.xcconfig: Enabled CLANG_WARN_INFINITE_RECURSION and CLANG_WARN_SUSPICIOUS_MOVE.
2035
2036 2016-11-29  Keith Miller  <keith_miller@apple.com>
2037
2038         Add simple way to implement Wasm ops that require more than one B3 opcode
2039         https://bugs.webkit.org/show_bug.cgi?id=165129
2040
2041         Reviewed by Geoffrey Garen.
2042
2043         This patch adds a simple way to show the B3IRGenerator opcode script how
2044         to generate code for Wasm opcodes that do not have a one to one mapping.
2045         The syntax is pretty simple right now. There are only three things one
2046         can use as of this patch (although more things might be added in the future)
2047         1) Wasm opcode arguments: These are referred to as @<argument_number>. For example,
2048            I32.sub would map to Sub(@0, @1).
2049         2) 32-bit int constants: These are reffered to as i32(<value>). For example, i32.inc
2050            would map to Add(@0, i32(1))
2051         3) B3 opcodes: These are referred to as the B3 opcode name followed by the B3Value's constructor
2052            arguments. A value may take the result of another value as an argument. For example, you can do
2053            Div(Mul(@0, Add(@0, i32(1))), i32(2)) if there was a b3 opcode that computed the sum from 1 to n.
2054
2055         These scripts are used to implement Wasm's eqz and floating point max/min opcodes. This patch
2056         also adds missing support for the Wasm Neg opcodes.
2057
2058         * jsc.cpp:
2059         (box):
2060         (functionTestWasmModuleFunctions):
2061         * wasm/WasmB3IRGenerator.cpp:
2062         (JSC::Wasm::toB3Op): Deleted.
2063         * wasm/WasmFunctionParser.h:
2064         (JSC::Wasm::FunctionParser<Context>::parseBody):
2065         * wasm/WasmModuleParser.cpp:
2066         (JSC::Wasm::ModuleParser::parseType):
2067         * wasm/WasmParser.h:
2068         (JSC::Wasm::Parser::parseUInt8):
2069         (JSC::Wasm::Parser::parseValueType):
2070         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
2071         (Source):
2072         (Source.__init__):
2073         (read):
2074         (lex):
2075         (CodeGenerator):
2076         (CodeGenerator.__init__):
2077         (CodeGenerator.advance):
2078         (CodeGenerator.token):
2079         (CodeGenerator.parseError):
2080         (CodeGenerator.consume):
2081         (CodeGenerator.generateParameters):
2082         (CodeGenerator.generateOpcode):
2083         (CodeGenerator.generate):
2084         (temp):
2085         (generateB3OpCode):
2086         (generateI32ConstCode):
2087         (generateB3Code):
2088         (generateSimpleCode):
2089         * wasm/wasm.json:
2090
2091 2016-11-29  Mark Lam  <mark.lam@apple.com>
2092
2093         Fix exception scope verification failures in ProxyConstructor.cpp and ProxyObject.cpp.
2094         https://bugs.webkit.org/show_bug.cgi?id=165053
2095
2096         Reviewed by Saam Barati.
2097
2098         Also replaced returning JSValue() with returning { }.
2099
2100         * runtime/ProxyConstructor.cpp:
2101         (JSC::constructProxyObject):
2102         * runtime/ProxyObject.cpp:
2103         (JSC::ProxyObject::structureForTarget):
2104         (JSC::performProxyGet):
2105         (JSC::ProxyObject::performInternalMethodGetOwnProperty):
2106         (JSC::ProxyObject::performHasProperty):
2107         (JSC::ProxyObject::getOwnPropertySlotCommon):
2108         (JSC::ProxyObject::performPut):
2109         (JSC::ProxyObject::putByIndexCommon):
2110         (JSC::performProxyCall):
2111         (JSC::performProxyConstruct):
2112         (JSC::ProxyObject::performDelete):
2113         (JSC::ProxyObject::performPreventExtensions):
2114         (JSC::ProxyObject::performIsExtensible):
2115         (JSC::ProxyObject::performDefineOwnProperty):
2116         (JSC::ProxyObject::performGetOwnPropertyNames):
2117         (JSC::ProxyObject::performSetPrototype):
2118         (JSC::ProxyObject::performGetPrototype):
2119
2120 2016-11-28  Matt Baker  <mattbaker@apple.com>
2121
2122         Web Inspector: Debugger should have an option for showing asynchronous call stacks
2123         https://bugs.webkit.org/show_bug.cgi?id=163230
2124         <rdar://problem/28698683>
2125
2126         Reviewed by Joseph Pecoraro.
2127
2128         * inspector/ScriptCallFrame.cpp:
2129         (Inspector::ScriptCallFrame::isNative):
2130         Encapsulate check for native code source URL.
2131
2132         * inspector/ScriptCallFrame.h:
2133         * inspector/ScriptCallStack.cpp:
2134         (Inspector::ScriptCallStack::firstNonNativeCallFrame):
2135         (Inspector::ScriptCallStack::buildInspectorArray):
2136         * inspector/ScriptCallStack.h:
2137         Replace use of Console::StackTrace with Array<Console::CallFrame>.
2138
2139         * inspector/agents/InspectorDebuggerAgent.cpp:
2140         (Inspector::InspectorDebuggerAgent::disable):
2141         (Inspector::InspectorDebuggerAgent::setAsyncStackTraceDepth):
2142         Set number of async frames to store (including boundary frames).
2143         A value of zero disables recording of async call stacks.
2144
2145         (Inspector::InspectorDebuggerAgent::buildAsyncStackTrace):
2146         Helper function for building a linked list StackTraces.
2147         (Inspector::InspectorDebuggerAgent::didScheduleAsyncCall):
2148         Store a call stack for the script that scheduled the async call.
2149         If the call repeats (e.g. setInterval), the starting reference count is
2150         set to 1. This ensures that dereffing after dispatch won't clear the stack.
2151         If another async call is currently being dispatched, increment the
2152         AsyncCallData reference count for that call.
2153
2154         (Inspector::InspectorDebuggerAgent::didCancelAsyncCall):
2155         Decrement the reference count for the canceled call.
2156
2157         (Inspector::InspectorDebuggerAgent::willDispatchAsyncCall):
2158         Set the identifier for the async callback currently being dispatched,
2159         so that if the debugger pauses during dispatch a stack trace can be
2160         associated with the pause location. If an async call is already being
2161         dispatched, which could be the case when a script schedules an async
2162         call in a nested runloop, do nothing.
2163
2164         (Inspector::InspectorDebuggerAgent::didDispatchAsyncCall):
2165         Decrement the reference count for the canceled call.
2166         (Inspector::InspectorDebuggerAgent::didPause):
2167         If a stored stack trace exists for this location, convert to a protocol
2168         object and send to the frontend.
2169
2170         (Inspector::InspectorDebuggerAgent::didClearGlobalObject):
2171         (Inspector::InspectorDebuggerAgent::clearAsyncStackTraceData):
2172         (Inspector::InspectorDebuggerAgent::refAsyncCallData):
2173         Increment AsyncCallData reference count.
2174         (Inspector::InspectorDebuggerAgent::derefAsyncCallData):
2175         Decrement AsyncCallData reference count. If zero, deref its parent
2176         (if it exists) and remove the AsyncCallData entry.
2177
2178         * inspector/agents/InspectorDebuggerAgent.h:
2179
2180         * inspector/protocol/Console.json:
2181         * inspector/protocol/Network.json:
2182         Replace use of Console.StackTrace with array of Console.CallFrame.
2183
2184         * inspector/protocol/Debugger.json:
2185         New protocol command and event data.
2186
2187 2016-11-28  Darin Adler  <darin@apple.com>
2188
2189         Streamline and speed up tokenizer and segmented string classes
2190         https://bugs.webkit.org/show_bug.cgi?id=165003
2191
2192         Reviewed by Sam Weinig.
2193
2194         * runtime/JSONObject.cpp:
2195         (JSC::Stringifier::appendStringifiedValue): Use viewWithUnderlyingString when calling
2196         StringBuilder::appendQuotedJSONString, since it now takes a StringView and there is
2197         no benefit in creating a String for that function if one doesn't already exist.
2198
2199 2016-11-21  Mark Lam  <mark.lam@apple.com>
2200
2201         Fix exception scope verification failures in runtime/Intl* files.
2202         https://bugs.webkit.org/show_bug.cgi?id=165014
2203
2204         Reviewed by Saam Barati.
2205
2206         * runtime/IntlCollatorConstructor.cpp:
2207         (JSC::constructIntlCollator):
2208         (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
2209         * runtime/IntlCollatorPrototype.cpp:
2210         (JSC::IntlCollatorPrototypeFuncResolvedOptions):
2211         * runtime/IntlDateTimeFormatConstructor.cpp:
2212         (JSC::constructIntlDateTimeFormat):
2213         (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
2214         * runtime/IntlDateTimeFormatPrototype.cpp:
2215         (JSC::IntlDateTimeFormatFuncFormatDateTime):
2216         (JSC::IntlDateTimeFormatPrototypeGetterFormat):
2217         (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
2218         * runtime/IntlNumberFormatConstructor.cpp:
2219         (JSC::constructIntlNumberFormat):
2220         (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
2221         * runtime/IntlNumberFormatPrototype.cpp:
2222         (JSC::IntlNumberFormatFuncFormatNumber):
2223         (JSC::IntlNumberFormatPrototypeGetterFormat):
2224         (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
2225         * runtime/IntlObject.cpp:
2226         (JSC::lookupSupportedLocales):
2227         * runtime/IntlObjectInlines.h:
2228         (JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):
2229
2230 2016-11-28  Mark Lam  <mark.lam@apple.com>
2231
2232         Fix exception scope verification failures in IteratorOperations.h.
2233         https://bugs.webkit.org/show_bug.cgi?id=165015
2234
2235         Reviewed by Saam Barati.
2236
2237         * runtime/IteratorOperations.h:
2238         (JSC::forEachInIterable):
2239
2240 2016-11-28  Mark Lam  <mark.lam@apple.com>
2241
2242         Fix exception scope verification failures in JSArray* files.
2243         https://bugs.webkit.org/show_bug.cgi?id=165016
2244
2245         Reviewed by Saam Barati.
2246
2247         * runtime/JSArray.cpp:
2248         (JSC::JSArray::defineOwnProperty):
2249         (JSC::JSArray::put):
2250         (JSC::JSArray::setLength):
2251         (JSC::JSArray::pop):
2252         (JSC::JSArray::push):
2253         (JSC::JSArray::unshiftCountWithAnyIndexingType):
2254         * runtime/JSArrayBuffer.cpp:
2255         (JSC::JSArrayBuffer::put):
2256         (JSC::JSArrayBuffer::defineOwnProperty):
2257         * runtime/JSArrayInlines.h:
2258         (JSC::getLength):
2259         (JSC::toLength):
2260
2261 2016-11-28  Mark Lam  <mark.lam@apple.com>
2262
2263         Fix exception scope verification failures in JSDataView.cpp.
2264         https://bugs.webkit.org/show_bug.cgi?id=165020
2265
2266         Reviewed by Saam Barati.
2267
2268         * runtime/JSDataView.cpp:
2269         (JSC::JSDataView::put):
2270
2271 2016-11-28  Mark Lam  <mark.lam@apple.com>
2272
2273         Fix exception scope verification failures in JSFunction.cpp.
2274         https://bugs.webkit.org/show_bug.cgi?id=165021
2275
2276         Reviewed by Saam Barati.
2277
2278         * runtime/JSFunction.cpp:
2279         (JSC::JSFunction::put):
2280         (JSC::JSFunction::defineOwnProperty):
2281
2282 2016-11-28  Mark Lam  <mark.lam@apple.com>
2283
2284         Fix exception scope verification failures in runtime/JSGenericTypedArrayView* files.
2285         https://bugs.webkit.org/show_bug.cgi?id=165022
2286
2287         Reviewed by Saam Barati.
2288
2289         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
2290         (JSC::constructGenericTypedArrayViewFromIterator):
2291         (JSC::constructGenericTypedArrayViewWithArguments):
2292         (JSC::constructGenericTypedArrayView):
2293         * runtime/JSGenericTypedArrayViewInlines.h:
2294         (JSC::JSGenericTypedArrayView<Adaptor>::set):
2295         (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
2296         * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
2297         (JSC::speciesConstruct):
2298         (JSC::genericTypedArrayViewProtoFuncSet):
2299         (JSC::genericTypedArrayViewProtoFuncJoin):
2300         (JSC::genericTypedArrayViewProtoFuncSlice):
2301         (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
2302
2303 2016-11-28  Mark Lam  <mark.lam@apple.com>
2304
2305         Fix exception scope verification failures in runtime/Operations.cpp/h.
2306         https://bugs.webkit.org/show_bug.cgi?id=165046
2307
2308         Reviewed by Saam Barati.
2309
2310         Also switched to using returning { } instead of JSValue().
2311
2312         * runtime/Operations.cpp:
2313         (JSC::jsAddSlowCase):
2314         (JSC::jsIsObjectTypeOrNull):
2315         * runtime/Operations.h:
2316         (JSC::jsStringFromRegisterArray):
2317         (JSC::jsStringFromArguments):
2318         (JSC::jsLess):
2319         (JSC::jsLessEq):
2320
2321 2016-11-28  Mark Lam  <mark.lam@apple.com>
2322
2323         Fix exception scope verification failures in JSScope.cpp.
2324         https://bugs.webkit.org/show_bug.cgi?id=165047
2325
2326         Reviewed by Saam Barati.
2327
2328         * runtime/JSScope.cpp:
2329         (JSC::JSScope::resolve):
2330
2331 2016-11-28  Mark Lam  <mark.lam@apple.com>
2332
2333         Fix exception scope verification failures in JSTypedArrayViewPrototype.cpp.
2334         https://bugs.webkit.org/show_bug.cgi?id=165049
2335
2336         Reviewed by Saam Barati.
2337
2338         * runtime/JSTypedArrayViewPrototype.cpp:
2339         (JSC::typedArrayViewPrivateFuncSort):
2340         (JSC::typedArrayViewProtoFuncSet):
2341         (JSC::typedArrayViewProtoFuncCopyWithin):
2342         (JSC::typedArrayViewProtoFuncIncludes):
2343         (JSC::typedArrayViewProtoFuncLastIndexOf):
2344         (JSC::typedArrayViewProtoFuncIndexOf):
2345         (JSC::typedArrayViewProtoFuncJoin):
2346         (JSC::typedArrayViewProtoGetterFuncBuffer):
2347         (JSC::typedArrayViewProtoGetterFuncLength):
2348         (JSC::typedArrayViewProtoGetterFuncByteLength):
2349         (JSC::typedArrayViewProtoGetterFuncByteOffset):
2350         (JSC::typedArrayViewProtoFuncReverse):
2351         (JSC::typedArrayViewPrivateFuncSubarrayCreate):
2352         (JSC::typedArrayViewProtoFuncSlice):
2353
2354 2016-11-28  Mark Lam  <mark.lam@apple.com>
2355
2356         Fix exception scope verification failures in runtime/Map* files.
2357         https://bugs.webkit.org/show_bug.cgi?id=165050
2358
2359         Reviewed by Saam Barati.
2360
2361         * runtime/MapConstructor.cpp:
2362         (JSC::constructMap):
2363         * runtime/MapIteratorPrototype.cpp:
2364         (JSC::MapIteratorPrototypeFuncNext):
2365         * runtime/MapPrototype.cpp:
2366         (JSC::privateFuncMapIteratorNext):
2367
2368 2016-11-28  Mark Lam  <mark.lam@apple.com>
2369
2370         Fix exception scope verification failures in more miscellaneous files.
2371         https://bugs.webkit.org/show_bug.cgi?id=165102
2372
2373         Reviewed by Saam Barati.
2374
2375         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2376         (JSC::constructJSWebAssemblyInstance):
2377
2378 2016-11-28  Mark Lam  <mark.lam@apple.com>
2379
2380         Fix exception scope verification failures in runtime/Weak* files.
2381         https://bugs.webkit.org/show_bug.cgi?id=165096
2382
2383         Reviewed by Geoffrey Garen.
2384
2385         * runtime/WeakMapConstructor.cpp:
2386         (JSC::constructWeakMap):
2387         * runtime/WeakMapPrototype.cpp:
2388         (JSC::protoFuncWeakMapSet):
2389         * runtime/WeakSetConstructor.cpp:
2390         (JSC::constructWeakSet):
2391         * runtime/WeakSetPrototype.cpp:
2392         (JSC::protoFuncWeakSetAdd):
2393
2394 2016-11-28  Mark Lam  <mark.lam@apple.com>
2395
2396         Fix exception scope verification failures in runtime/String* files.
2397         https://bugs.webkit.org/show_bug.cgi?id=165067
2398
2399         Reviewed by Saam Barati.
2400
2401         * runtime/StringConstructor.cpp:
2402         (JSC::stringFromCodePoint):
2403         (JSC::constructWithStringConstructor):
2404         * runtime/StringObject.cpp:
2405         (JSC::StringObject::put):
2406         (JSC::StringObject::putByIndex):
2407         (JSC::StringObject::defineOwnProperty):
2408         * runtime/StringPrototype.cpp:
2409         (JSC::jsSpliceSubstrings):
2410         (JSC::jsSpliceSubstringsWithSeparators):
2411         (JSC::replaceUsingRegExpSearch):
2412         (JSC::replaceUsingStringSearch):
2413         (JSC::repeatCharacter):
2414         (JSC::replace):
2415         (JSC::stringProtoFuncReplaceUsingStringSearch):
2416         (JSC::stringProtoFuncCharAt):
2417         (JSC::stringProtoFuncCodePointAt):
2418         (JSC::stringProtoFuncConcat):
2419         (JSC::stringProtoFuncIndexOf):
2420         (JSC::stringProtoFuncLastIndexOf):
2421         (JSC::splitStringByOneCharacterImpl):
2422         (JSC::stringProtoFuncSplitFast):
2423         (JSC::stringProtoFuncSubstring):
2424         (JSC::stringProtoFuncToLowerCase):
2425         (JSC::stringProtoFuncToUpperCase):
2426         (JSC::toLocaleCase):
2427         (JSC::trimString):
2428         (JSC::stringProtoFuncIncludes):
2429         (JSC::builtinStringIncludesInternal):
2430         (JSC::stringProtoFuncIterator):
2431         (JSC::normalize):
2432         (JSC::stringProtoFuncNormalize):
2433
2434 2016-11-28  Mark Lam  <mark.lam@apple.com>
2435
2436         Fix exception scope verification failures in ObjectConstructor.cpp and ObjectPrototype.cpp.
2437         https://bugs.webkit.org/show_bug.cgi?id=165051
2438
2439         Reviewed by Saam Barati.
2440
2441         Also,
2442         1. Replaced returning JSValue() with returning { }.
2443         2. Replaced uses of exec->propertyNames() with vm.propertyNames.
2444
2445         * runtime/ObjectConstructor.cpp:
2446         (JSC::constructObject):
2447         (JSC::objectConstructorGetPrototypeOf):
2448         (JSC::objectConstructorGetOwnPropertyDescriptor):
2449         (JSC::objectConstructorGetOwnPropertyDescriptors):
2450         (JSC::objectConstructorGetOwnPropertyNames):
2451         (JSC::objectConstructorGetOwnPropertySymbols):
2452         (JSC::objectConstructorKeys):
2453         (JSC::ownEnumerablePropertyKeys):
2454         (JSC::toPropertyDescriptor):
2455         (JSC::defineProperties):
2456         (JSC::objectConstructorDefineProperties):
2457         (JSC::objectConstructorCreate):
2458         (JSC::setIntegrityLevel):
2459         (JSC::objectConstructorSeal):
2460         (JSC::objectConstructorPreventExtensions):
2461         (JSC::objectConstructorIsSealed):
2462         (JSC::objectConstructorIsFrozen):
2463         (JSC::ownPropertyKeys):
2464         * runtime/ObjectPrototype.cpp:
2465         (JSC::objectProtoFuncValueOf):
2466         (JSC::objectProtoFuncHasOwnProperty):
2467         (JSC::objectProtoFuncIsPrototypeOf):
2468         (JSC::objectProtoFuncDefineGetter):
2469         (JSC::objectProtoFuncDefineSetter):
2470         (JSC::objectProtoFuncLookupGetter):
2471         (JSC::objectProtoFuncLookupSetter):
2472         (JSC::objectProtoFuncToLocaleString):
2473         (JSC::objectProtoFuncToString):
2474
2475 2016-11-26  Mark Lam  <mark.lam@apple.com>
2476
2477         Fix exception scope verification failures in miscellaneous files.
2478         https://bugs.webkit.org/show_bug.cgi?id=165055
2479
2480         Reviewed by Saam Barati.
2481
2482         * runtime/MathObject.cpp:
2483         (JSC::mathProtoFuncIMul):
2484         * runtime/ModuleLoaderPrototype.cpp:
2485         (JSC::moduleLoaderPrototypeParseModule):
2486         (JSC::moduleLoaderPrototypeRequestedModules):
2487         * runtime/NativeErrorConstructor.cpp:
2488         (JSC::Interpreter::constructWithNativeErrorConstructor):
2489         * runtime/NumberConstructor.cpp:
2490         (JSC::constructWithNumberConstructor):
2491         * runtime/SetConstructor.cpp:
2492         (JSC::constructSet):
2493         * runtime/SetIteratorPrototype.cpp:
2494         (JSC::SetIteratorPrototypeFuncNext):
2495         * runtime/SparseArrayValueMap.cpp:
2496         (JSC::SparseArrayValueMap::putEntry):
2497         (JSC::SparseArrayEntry::put):
2498         * runtime/TemplateRegistry.cpp:
2499         (JSC::TemplateRegistry::getTemplateObject):
2500
2501 2016-11-28  Mark Lam  <mark.lam@apple.com>
2502
2503         Fix exception scope verification failures in ReflectObject.cpp.
2504         https://bugs.webkit.org/show_bug.cgi?id=165066
2505
2506         Reviewed by Saam Barati.
2507
2508         * runtime/ReflectObject.cpp:
2509         (JSC::reflectObjectConstruct):
2510         (JSC::reflectObjectDefineProperty):
2511         (JSC::reflectObjectEnumerate):
2512         (JSC::reflectObjectGet):
2513         (JSC::reflectObjectGetOwnPropertyDescriptor):
2514         (JSC::reflectObjectGetPrototypeOf):
2515         (JSC::reflectObjectOwnKeys):
2516         (JSC::reflectObjectSet):
2517
2518 2016-11-24  Mark Lam  <mark.lam@apple.com>
2519
2520         Fix exception scope verification failures in ArrayConstructor.cpp and ArrayPrototype.cpp.
2521         https://bugs.webkit.org/show_bug.cgi?id=164972
2522
2523         Reviewed by Geoffrey Garen.
2524
2525         * runtime/ArrayConstructor.cpp:
2526         (JSC::constructArrayWithSizeQuirk):
2527         * runtime/ArrayPrototype.cpp:
2528         (JSC::getProperty):
2529         (JSC::putLength):
2530         (JSC::speciesWatchpointsValid):
2531         (JSC::speciesConstructArray):
2532         (JSC::shift):
2533         (JSC::unshift):
2534         (JSC::arrayProtoFuncToString):
2535         (JSC::arrayProtoFuncToLocaleString):
2536         (JSC::slowJoin):
2537         (JSC::fastJoin):
2538         (JSC::arrayProtoFuncJoin):
2539         (JSC::arrayProtoFuncPop):
2540         (JSC::arrayProtoFuncPush):
2541         (JSC::arrayProtoFuncReverse):
2542         (JSC::arrayProtoFuncShift):
2543         (JSC::arrayProtoFuncSlice):
2544         (JSC::arrayProtoFuncSplice):
2545         (JSC::arrayProtoFuncUnShift):
2546         (JSC::arrayProtoFuncIndexOf):
2547         (JSC::arrayProtoFuncLastIndexOf):
2548         (JSC::concatAppendOne):
2549         (JSC::arrayProtoPrivateFuncConcatMemcpy):
2550         (JSC::ArrayPrototype::attemptToInitializeSpeciesWatchpoint):
2551
2552 2016-11-28  Mark Lam  <mark.lam@apple.com>
2553
2554         Fix exception scope verification failures in LLIntSlowPaths.cpp.
2555         https://bugs.webkit.org/show_bug.cgi?id=164969
2556
2557         Reviewed by Geoffrey Garen.
2558
2559         * llint/LLIntSlowPaths.cpp:
2560         (JSC::LLInt::getByVal):
2561         (JSC::LLInt::setUpCall):
2562         (JSC::LLInt::varargsSetup):
2563         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2564
2565 2016-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2566
2567         [WTF] Import std::optional reference implementation as WTF::Optional
2568         https://bugs.webkit.org/show_bug.cgi?id=164199
2569
2570         Reviewed by Saam Barati and Sam Weinig.
2571
2572         Previous WTF::Optional::operator= is not compatible to std::optional::operator=.
2573         std::optional::emplace has the same semantics to the previous one.
2574         So we change the code to use it.
2575
2576         * Scripts/builtins/builtins_templates.py:
2577         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
2578         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
2579         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
2580         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
2581         * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
2582         * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
2583         * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
2584         * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
2585         * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
2586         * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
2587         * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
2588         * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
2589         * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
2590         * assembler/MacroAssemblerARM64.h:
2591         (JSC::MacroAssemblerARM64::commuteCompareToZeroIntoTest):
2592         * assembler/MacroAssemblerX86Common.h:
2593         (JSC::MacroAssemblerX86Common::commuteCompareToZeroIntoTest):
2594         * b3/B3CheckSpecial.cpp:
2595         (JSC::B3::CheckSpecial::forEachArg):
2596         (JSC::B3::CheckSpecial::shouldTryAliasingDef):
2597         * b3/B3CheckSpecial.h:
2598         * b3/B3LowerToAir.cpp:
2599         (JSC::B3::Air::LowerToAir::scaleForShl):
2600         (JSC::B3::Air::LowerToAir::effectiveAddr):
2601         (JSC::B3::Air::LowerToAir::tryAppendLea):
2602         * b3/B3Opcode.cpp:
2603         (JSC::B3::invertedCompare):
2604         * b3/B3Opcode.h:
2605         * b3/B3PatchpointSpecial.cpp:
2606         (JSC::B3::PatchpointSpecial::forEachArg):
2607         * b3/B3StackmapSpecial.cpp:
2608         (JSC::B3::StackmapSpecial::forEachArgImpl):
2609         * b3/B3StackmapSpecial.h:
2610         * b3/B3Value.cpp:
2611         (JSC::B3::Value::invertedCompare):
2612         * b3/air/AirArg.h:
2613         (JSC::B3::Air::Arg::isValidScale):
2614         (JSC::B3::Air::Arg::isValidAddrForm):
2615         (JSC::B3::Air::Arg::isValidIndexForm):
2616         (JSC::B3::Air::Arg::isValidForm):
2617         * b3/air/AirCustom.h:
2618         (JSC::B3::Air::PatchCustom::shouldTryAliasingDef):
2619         * b3/air/AirFixObviousSpills.cpp:
2620         * b3/air/AirInst.h:
2621         * b3/air/AirInstInlines.h:
2622         (JSC::B3::Air::Inst::shouldTryAliasingDef):
2623         * b3/air/AirIteratedRegisterCoalescing.cpp:
2624         * b3/air/AirSpecial.cpp:
2625         (JSC::B3::Air::Special::shouldTryAliasingDef):
2626         * b3/air/AirSpecial.h:
2627         * bytecode/BytecodeGeneratorification.cpp:
2628         (JSC::BytecodeGeneratorification::storageForGeneratorLocal):
2629         * bytecode/CodeBlock.cpp:
2630         (JSC::CodeBlock::findPC):
2631         (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex):
2632         * bytecode/CodeBlock.h:
2633         * bytecode/UnlinkedFunctionExecutable.cpp:
2634         (JSC::UnlinkedFunctionExecutable::link):
2635         * bytecode/UnlinkedFunctionExecutable.h:
2636         * bytecompiler/BytecodeGenerator.h:
2637         * bytecompiler/NodesCodegen.cpp:
2638         (JSC::PropertyListNode::emitPutConstantProperty):
2639         (JSC::ObjectPatternNode::bindValue):
2640         * debugger/Debugger.cpp:
2641         (JSC::Debugger::resolveBreakpoint):
2642         * debugger/DebuggerCallFrame.cpp:
2643         (JSC::DebuggerCallFrame::currentPosition):
2644         * debugger/DebuggerParseData.cpp:
2645         (JSC::DebuggerPausePositions::breakpointLocationForLineColumn):
2646         * debugger/DebuggerParseData.h:
2647         * debugger/ScriptProfilingScope.h:
2648         * dfg/DFGAbstractInterpreterInlines.h:
2649         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2650         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeDoubleUnaryOpEffects):
2651         * dfg/DFGJITCode.cpp:
2652         (JSC::DFG::JITCode::findPC):
2653         * dfg/DFGJITCode.h:
2654         * dfg/DFGOperations.cpp:
2655         (JSC::DFG::operationPutByValInternal):
2656         * dfg/DFGSlowPathGenerator.h:
2657         (JSC::DFG::SlowPathGenerator::generate):
2658         * dfg/DFGSpeculativeJIT.cpp:
2659         (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
2660         (JSC::DFG::SpeculativeJIT::emitUntypedBitOp):
2661         (JSC::DFG::SpeculativeJIT::emitUntypedRightShiftBitOp):
2662         (JSC::DFG::SpeculativeJIT::compileMathIC):
2663         (JSC::DFG::SpeculativeJIT::compileArithDiv):
2664         (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
2665         * dfg/DFGSpeculativeJIT.h:
2666         * dfg/DFGSpeculativeJIT32_64.cpp:
2667         (JSC::DFG::SpeculativeJIT::compile):
2668         * dfg/DFGSpeculativeJIT64.cpp:
2669         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
2670         (JSC::DFG::SpeculativeJIT::emitBranch):
2671         (JSC::DFG::SpeculativeJIT::compile):
2672         * dfg/DFGStrengthReductionPhase.cpp:
2673         (JSC::DFG::StrengthReductionPhase::handleNode):
2674         * ftl/FTLJITCode.cpp:
2675         (JSC::FTL::JITCode::findPC):
2676         * ftl/FTLJITCode.h:
2677         * heap/Heap.cpp:
2678         (JSC::Heap::collectAsync):
2679         (JSC::Heap::collectSync):
2680         (JSC::Heap::collectInThread):
2681         (JSC::Heap::requestCollection):
2682         (JSC::Heap::willStartCollection):
2683         (JSC::Heap::didFinishCollection):
2684         (JSC::Heap::shouldDoFullCollection):
2685         * heap/Heap.h:
2686         (JSC::Heap::collectionScope):
2687         * heap/HeapSnapshot.cpp:
2688         (JSC::HeapSnapshot::nodeForCell):
2689         (JSC::HeapSnapshot::nodeForObjectIdentifier):
2690         * heap/HeapSnapshot.h:
2691         * inspector/InspectorBackendDispatcher.cpp:
2692         (Inspector::BackendDispatcher::dispatch):
2693         (Inspector::BackendDispatcher::sendPendingErrors):
2694         (Inspector::BackendDispatcher::reportProtocolError):
2695         * inspector/InspectorBackendDispatcher.h:
2696         * inspector/agents/InspectorHeapAgent.cpp:
2697         (Inspector::InspectorHeapAgent::nodeForHeapObjectIdentifier):
2698         (Inspector::InspectorHeapAgent::getPreview):
2699         (Inspector::InspectorHeapAgent::getRemoteObject):
2700         * inspector/agents/InspectorHeapAgent.h:
2701         * inspector/remote/RemoteConnectionToTarget.h:
2702         * inspector/remote/RemoteConnectionToTarget.mm:
2703         (Inspector::RemoteConnectionToTarget::targetIdentifier):
2704         (Inspector::RemoteConnectionToTarget::setup):
2705         * inspector/remote/RemoteInspector.h:
2706         * inspector/remote/RemoteInspector.mm:
2707         (Inspector::RemoteInspector::updateClientCapabilities):
2708         * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
2709         (_generate_declarations_for_enum_conversion_methods):
2710         (_generate_declarations_for_enum_conversion_methods.return_type_with_export_macro):
2711         * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
2712         (CppProtocolTypesImplementationGenerator._generate_enum_conversion_methods_for_domain.generate_conversion_method_body):
2713         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
2714         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
2715         * inspector/scripts/tests/expected/enum-values.json-result:
2716         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
2717         * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
2718         * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
2719         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
2720         * jit/JITCode.h:
2721         (JSC::JITCode::findPC):
2722         * jit/JITDivGenerator.cpp:
2723         (JSC::JITDivGenerator::generateFastPath):
2724         * jit/JITOperations.cpp:
2725         * jit/PCToCodeOriginMap.cpp:
2726         (JSC::PCToCodeOriginMap::findPC):
2727         * jit/PCToCodeOriginMap.h:
2728         * jsc.cpp:
2729         (WTF::RuntimeArray::getOwnPropertySlot):
2730         * llint/LLIntSlowPaths.cpp:
2731         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2732         * parser/ModuleAnalyzer.cpp:
2733         (JSC::ModuleAnalyzer::exportVariable):
2734         * runtime/ConcurrentJSLock.h:
2735         (JSC::ConcurrentJSLocker::ConcurrentJSLocker):
2736         * runtime/DefinePropertyAttributes.h:
2737         (JSC::DefinePropertyAttributes::writable):
2738         (JSC::DefinePropertyAttributes::configurable):
2739         (JSC::DefinePropertyAttributes::enumerable):
2740         * runtime/GenericArgumentsInlines.h:
2741         (JSC::GenericArguments<Type>::getOwnPropertySlot):
2742         (JSC::GenericArguments<Type>::put):
2743         (JSC::GenericArguments<Type>::deleteProperty):
2744         (JSC::GenericArguments<Type>::defineOwnProperty):
2745         * runtime/HasOwnPropertyCache.h:
2746         (JSC::HasOwnPropertyCache::get):
2747         * runtime/HashMapImpl.h:
2748         (JSC::concurrentJSMapHash):
2749         * runtime/Identifier.h:
2750         (JSC::parseIndex):
2751         * runtime/JSArray.cpp:
2752         (JSC::JSArray::defineOwnProperty):
2753         * runtime/JSCJSValue.cpp:
2754         (JSC::JSValue::toNumberFromPrimitive):
2755         (JSC::JSValue::putToPrimitive):
2756         * runtime/JSCJSValue.h:
2757         * runtime/JSGenericTypedArrayView.h:
2758         (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValueWithoutCoercion):
2759         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
2760         (JSC::constructGenericTypedArrayViewWithArguments):
2761         (JSC::constructGenericTypedArrayView):
2762         * runtime/JSGenericTypedArrayViewInlines.h:
2763         (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
2764         (JSC::JSGenericTypedArrayView<Adaptor>::put):
2765         * runtime/JSModuleRecord.cpp:
2766         * runtime/JSModuleRecord.h:
2767         * runtime/JSObject.cpp:
2768         (JSC::JSObject::putDirectAccessor):
2769         (JSC::JSObject::deleteProperty):
2770         (JSC::JSObject::putDirectMayBeIndex):
2771         (JSC::JSObject::defineOwnProperty):
2772         * runtime/JSObject.h:
2773         (JSC::JSObject::getOwnPropertySlot):
2774         (JSC::JSObject::getPropertySlot):
2775         (JSC::JSObject::putOwnDataPropertyMayBeIndex):
2776         * runtime/JSObjectInlines.h:
2777         (JSC::JSObject::putInline):
2778         * runtime/JSString.cpp:
2779         (JSC::JSString::getStringPropertyDescriptor):
2780         * runtime/JSString.h:
2781         (JSC::JSString::getStringPropertySlot):
2782         * runtime/LiteralParser.cpp:
2783         (JSC::LiteralParser<CharType>::parse):
2784         * runtime/MathCommon.h:
2785         (JSC::safeReciprocalForDivByConst):
2786         * runtime/ObjectPrototype.cpp:
2787         (JSC::objectProtoFuncHasOwnProperty):
2788         * runtime/PropertyDescriptor.h:
2789         (JSC::toPropertyDescriptor):
2790         * runtime/PropertyName.h:
2791         (JSC::parseIndex):
2792         * runtime/SamplingProfiler.cpp:
2793         (JSC::SamplingProfiler::processUnverifiedStackTraces):
2794         * runtime/StringObject.cpp:
2795         (JSC::StringObject::put):
2796         (JSC::isStringOwnProperty):
2797         (JSC::StringObject::deleteProperty):
2798         * runtime/ToNativeFromValue.h:
2799         (JSC::toNativeFromValueWithoutCoercion):
2800         * runtime/TypedArrayAdaptors.h:
2801         (JSC::IntegralTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
2802         (JSC::IntegralTypedArrayAdaptor::toNativeFromUint32WithoutCoercion):
2803         (JSC::IntegralTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
2804         (JSC::FloatTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
2805         (JSC::FloatTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
2806         (JSC::Uint8ClampedAdaptor::toNativeFromInt32WithoutCoercion):
2807         (JSC::Uint8ClampedAdaptor::toNativeFromDoubleWithoutCoercion):
2808
2809 2016-11-26  Sam Weinig  <sam@webkit.org>
2810
2811         Convert IntersectionObserver over to using RuntimeEnabledFeatures so it can be properly excluded from script
2812         https://bugs.webkit.org/show_bug.cgi?id=164965
2813
2814         Reviewed by Simon Fraser.
2815
2816         * runtime/CommonIdentifiers.h:
2817         Add identifiers needed for RuntimeEnabledFeatures.
2818
2819 2016-11-23  Zan Dobersek  <zdobersek@igalia.com>
2820
2821         Remove ENABLE_ASSEMBLER_WX_EXCLUSIVE code
2822         https://bugs.webkit.org/show_bug.cgi?id=165027
2823
2824         Reviewed by Darin Adler.
2825
2826         Remove the code guarded with ENABLE(ASSEMBLER_WX_EXCLUSIVE).
2827         No port enables this and the guarded code doesn't build at all,
2828         so it's safe to say it's abandoned.
2829
2830         * jit/ExecutableAllocator.cpp:
2831         (JSC::ExecutableAllocator::initializeAllocator):
2832         (JSC::ExecutableAllocator::ExecutableAllocator):
2833         (JSC::ExecutableAllocator::reprotectRegion): Deleted.
2834
2835 2016-11-18  Mark Lam  <mark.lam@apple.com>
2836
2837         Fix exception scope verification failures in JSC profiler files.
2838         https://bugs.webkit.org/show_bug.cgi?id=164971
2839
2840         Reviewed by Saam Barati.
2841
2842         * profiler/ProfilerBytecodeSequence.cpp:
2843         (JSC::Profiler::BytecodeSequence::addSequenceProperties):
2844         * profiler/ProfilerCompilation.cpp:
2845         (JSC::Profiler::Compilation::toJS):
2846         * profiler/ProfilerDatabase.cpp:
2847         (JSC::Profiler::Database::toJS):
2848         (JSC::Profiler::Database::toJSON):
2849         * profiler/ProfilerOSRExitSite.cpp:
2850         (JSC::Profiler::OSRExitSite::toJS):
2851         * profiler/ProfilerOriginStack.cpp:
2852         (JSC::Profiler::OriginStack::toJS):
2853
2854 2016-11-22  Mark Lam  <mark.lam@apple.com>
2855
2856         Fix exception scope verification failures in JSONObject.cpp.
2857         https://bugs.webkit.org/show_bug.cgi?id=165025
2858
2859         Reviewed by Saam Barati.
2860
2861         * runtime/JSONObject.cpp:
2862         (JSC::gap):
2863         (JSC::Stringifier::Stringifier):
2864         (JSC::Stringifier::stringify):
2865         (JSC::Stringifier::toJSON):
2866         (JSC::Stringifier::appendStringifiedValue):
2867         (JSC::Stringifier::Holder::appendNextProperty):
2868         (JSC::Walker::walk):
2869         (JSC::JSONProtoFuncParse):
2870         (JSC::JSONProtoFuncStringify):
2871         (JSC::JSONStringify):
2872
2873 2016-11-21  Mark Lam  <mark.lam@apple.com>
2874
2875         Removed an extra space character at the end of line.
2876
2877         Not reviewed.
2878
2879         * runtime/JSCell.cpp:
2880         (JSC::JSCell::toNumber):
2881
2882 2016-11-21  Mark Lam  <mark.lam@apple.com>
2883
2884         Fix exception scope verification failures in FunctionConstructor.cpp.
2885         https://bugs.webkit.org/show_bug.cgi?id=165011
2886
2887         Reviewed by Saam Barati.
2888
2889         * runtime/FunctionConstructor.cpp:
2890         (JSC::constructFunction):
2891         (JSC::constructFunctionSkippingEvalEnabledCheck):
2892
2893 2016-11-21  Mark Lam  <mark.lam@apple.com>
2894
2895         Fix exception scope verification failures in GetterSetter.cpp.
2896         https://bugs.webkit.org/show_bug.cgi?id=165013
2897
2898         Reviewed by Saam Barati.
2899
2900         * runtime/GetterSetter.cpp:
2901         (JSC::callGetter):
2902         (JSC::callSetter):
2903
2904 2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2905
2906         Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
2907         https://bugs.webkit.org/show_bug.cgi?id=164898
2908
2909         Reviewed by Darin Adler.
2910
2911         The callsite object (JSArray) of tagged template literal is managed by WeakGCMap since
2912         same tagged template literal need to return an identical object.
2913         The problem is that we used TemplateRegistryKey as the key of the WeakGCMap. WeakGCMap
2914         can prune its entries in the collector thread. At that time, this TemplateRegistryKey
2915         is deallocated. Since it includes String (and then, StringImpl), we accidentally call
2916         ref(), deref() and StringImpl::destroy() in the different thread from the main thread
2917         while this TemplateRegistryKey is allocated in the main thread.
2918
2919         Instead, we use TemplateRegistryKey* as the key of WeakGCMap. Then, to keep its liveness
2920         while the entry of the WeakGCMap is alive, the callsite object has the reference to
2921         the JSTemplateRegistryKey. And it holds Ref<TemplateRegistryKey>.
2922
2923         And now we need to lookup WeakGCMap with TemplateRegistryKey*. To do so, we create
2924         interning system for TemplateRegistryKey. It is similar to AtomicStringTable and
2925         SymbolRegistry. TemplateRegistryKey is allocated from this table. This table atomize the
2926         TemplateRegistryKey. So we can use the pointer comparison between TemplateRegistryKey.
2927         It allows us to lookup the entry from WeakGCMap by TemplateRegistryKey*.
2928
2929         * CMakeLists.txt:
2930         * JavaScriptCore.xcodeproj/project.pbxproj:
2931         * builtins/BuiltinNames.h:
2932         * bytecompiler/BytecodeGenerator.cpp:
2933         (JSC::BytecodeGenerator::addTemplateRegistryKeyConstant):
2934         (JSC::BytecodeGenerator::emitGetTemplateObject):
2935         * bytecompiler/BytecodeGenerator.h:
2936         * runtime/JSGlobalObject.cpp:
2937         (JSC::getTemplateObject):
2938         * runtime/JSTemplateRegistryKey.cpp:
2939         (JSC::JSTemplateRegistryKey::JSTemplateRegistryKey):
2940         (JSC::JSTemplateRegistryKey::create):
2941         * runtime/JSTemplateRegistryKey.h:
2942         * runtime/TemplateRegistry.cpp:
2943         (JSC::TemplateRegistry::getTemplateObject):
2944         * runtime/TemplateRegistry.h:
2945         * runtime/TemplateRegistryKey.cpp: Copied from Source/JavaScriptCore/runtime/TemplateRegistry.h.
2946         (JSC::TemplateRegistryKey::~TemplateRegistryKey):
2947         * runtime/TemplateRegistryKey.h:
2948         (JSC::TemplateRegistryKey::calculateHash):
2949         (JSC::TemplateRegistryKey::create):
2950         (JSC::TemplateRegistryKey::TemplateRegistryKey):
2951         * runtime/TemplateRegistryKeyTable.cpp: Added.
2952         (JSC::TemplateRegistryKeyTranslator::hash):
2953         (JSC::TemplateRegistryKeyTranslator::equal):
2954         (JSC::TemplateRegistryKeyTranslator::translate):
2955         (JSC::TemplateRegistryKeyTable::~TemplateRegistryKeyTable):
2956         (JSC::TemplateRegistryKeyTable::createKey):
2957         (JSC::TemplateRegistryKeyTable::unregister):
2958         * runtime/TemplateRegistryKeyTable.h: Copied from Source/JavaScriptCore/runtime/JSTemplateRegistryKey.h.
2959         (JSC::TemplateRegistryKeyTable::KeyHash::hash):
2960         (JSC::TemplateRegistryKeyTable::KeyHash::equal):
2961         * runtime/VM.h:
2962         (JSC::VM::templateRegistryKeyTable):
2963
2964 2016-11-21  Mark Lam  <mark.lam@apple.com>
2965
2966         Fix exception scope verification failures in runtime/Error* files.
2967         https://bugs.webkit.org/show_bug.cgi?id=164998
2968
2969         Reviewed by Darin Adler.
2970
2971         * runtime/ErrorConstructor.cpp:
2972         (JSC::Interpreter::constructWithErrorConstructor):
2973         * runtime/ErrorInstance.cpp:
2974         (JSC::ErrorInstance::create):
2975         * runtime/ErrorInstance.h:
2976         * runtime/ErrorPrototype.cpp:
2977         (JSC::errorProtoFuncToString):
2978
2979 2016-11-21  Mark Lam  <mark.lam@apple.com>
2980
2981         Fix exception scope verification failures in *Executable.cpp files.
2982         https://bugs.webkit.org/show_bug.cgi?id=164996
2983
2984         Reviewed by Darin Adler.
2985
2986         * runtime/DirectEvalExecutable.cpp:
2987         (JSC::DirectEvalExecutable::create):
2988         * runtime/IndirectEvalExecutable.cpp:
2989         (JSC::IndirectEvalExecutable::create):
2990         * runtime/ProgramExecutable.cpp:
2991         (JSC::ProgramExecutable::initializeGlobalProperties):
2992         * runtime/ScriptExecutable.cpp:
2993         (JSC::ScriptExecutable::prepareForExecutionImpl):
2994
2995 2016-11-20  Zan Dobersek  <zdobersek@igalia.com>
2996
2997         [EncryptedMedia] Make EME API runtime-enabled
2998         https://bugs.webkit.org/show_bug.cgi?id=164927
2999
3000         Reviewed by Jer Noble.
3001
3002         * runtime/CommonIdentifiers.h: Add the necessary identifiers.
3003
3004 2016-11-20  Mark Lam  <mark.lam@apple.com>
3005
3006         Fix exception scope verification failures in ConstructData.cpp.
3007         https://bugs.webkit.org/show_bug.cgi?id=164976
3008
3009         Reviewed by Darin Adler.
3010
3011         * runtime/ConstructData.cpp:
3012         (JSC::construct):
3013
3014 2016-11-20  Mark Lam  <mark.lam@apple.com>
3015
3016         Fix exception scope verification failures in CommonSlowPaths.cpp/h.
3017         https://bugs.webkit.org/show_bug.cgi?id=164975
3018
3019         Reviewed by Darin Adler.
3020
3021         * runtime/CommonSlowPaths.cpp:
3022         (JSC::SLOW_PATH_DECL):
3023         * runtime/CommonSlowPaths.h:
3024         (JSC::CommonSlowPaths::opIn):
3025
3026 2016-11-20  Mark Lam  <mark.lam@apple.com>
3027
3028         Fix exception scope verification failures in DateConstructor.cpp and DatePrototype.cpp.
3029         https://bugs.webkit.org/show_bug.cgi?id=164995
3030
3031         Reviewed by Darin Adler.
3032
3033         * runtime/DateConstructor.cpp:
3034         (JSC::millisecondsFromComponents):
3035         (JSC::constructDate):
3036         * runtime/DatePrototype.cpp:
3037         (JSC::dateProtoFuncToPrimitiveSymbol):
3038
3039 2016-11-20  Caitlin Potter  <caitp@igalia.com>
3040
3041         [JSC] speed up parsing of async functions
3042         https://bugs.webkit.org/show_bug.cgi?id=164808
3043
3044         Reviewed by Yusuke Suzuki.
3045
3046         Minor adjustments to Parser in order to mitigate slowdown with async
3047         function parsing enabled:
3048
3049           - Tokenize "async" as a keyword
3050           - Perform less branching in various areas of the Parser
3051
3052         * parser/Keywords.table:
3053         * parser/Parser.cpp:
3054         (JSC::Parser<LexerType>::parseStatementListItem):
3055         (JSC::Parser<LexerType>::parseStatement):
3056         (JSC::Parser<LexerType>::maybeParseAsyncFunctionDeclarationStatement):
3057         (JSC::Parser<LexerType>::parseClass):
3058         (JSC::Parser<LexerType>::parseExportDeclaration):
3059         (JSC::Parser<LexerType>::parseAssignmentExpression):
3060         (JSC::Parser<LexerType>::parseProperty):
3061         (JSC::Parser<LexerType>::createResolveAndUseVariable):
3062         (JSC::Parser<LexerType>::parsePrimaryExpression):
3063         (JSC::Parser<LexerType>::parseMemberExpression):
3064         (JSC::Parser<LexerType>::printUnexpectedTokenText):
3065         * parser/Parser.h:
3066         (JSC::isAnyContextualKeyword):
3067         (JSC::isIdentifierOrAnyContextualKeyword):
3068         (JSC::isSafeContextualKeyword):
3069         (JSC::Parser::matchSpecIdentifier):
3070         * parser/ParserTokens.h:
3071         * runtime/CommonIdentifiers.h:
3072
3073 2016-11-19  Mark Lam  <mark.lam@apple.com>
3074
3075         Add --timeoutMultiplier option to allow some tests more time to run.
3076         https://bugs.webkit.org/show_bug.cgi?id=164951
3077
3078         Reviewed by Yusuke Suzuki.
3079
3080         * jsc.cpp:
3081         (timeoutThreadMain):
3082         - Modified to factor in a timeout multiplier that can adjust the timeout duration.
3083         (startTimeoutThreadIfNeeded):
3084         - Moved the code that starts the timeout thread here from main() so that we can
3085         call it after command line args have been parsed instead.
3086         (main):
3087         - Deleted old timeout thread starting code.
3088         (CommandLine::parseArguments):
3089         - Added parsing of the --timeoutMultiplier option.
3090         (jscmain):
3091         - Start the timeout thread if needed after we've parsed the command line args.
3092
3093 2016-11-19  Mark Lam  <mark.lam@apple.com>
3094
3095         Fix missing exception checks in JSC inspector files.
3096         https://bugs.webkit.org/show_bug.cgi?id=164959
3097
3098         Reviewed by Saam Barati.
3099
3100         * inspector/JSInjectedScriptHost.cpp:
3101         (Inspector::JSInjectedScriptHost::getInternalProperties):
3102         (Inspector::JSInjectedScriptHost::weakMapEntries):
3103         (Inspector::JSInjectedScriptHost::weakSetEntries):
3104         (Inspector::JSInjectedScriptHost::iteratorEntries):
3105         * inspector/JSJavaScriptCallFrame.cpp:
3106         (Inspector::JSJavaScriptCallFrame::scopeDescriptions):
3107
3108 2016-11-18  Mark Lam  <mark.lam@apple.com>
3109
3110         Fix missing exception checks in DFGOperations.cpp.
3111         https://bugs.webkit.org/show_bug.cgi?id=164958
3112
3113         Reviewed by Geoffrey Garen.
3114
3115         * dfg/DFGOperations.cpp:
3116
3117 2016-11-18  Mark Lam  <mark.lam@apple.com>
3118
3119         Fix exception scope verification failures in ShadowChicken.cpp.
3120         https://bugs.webkit.org/show_bug.cgi?id=164966
3121
3122         Reviewed by Saam Barati.
3123
3124         * interpreter/ShadowChicken.cpp:
3125         (JSC::ShadowChicken::functionsOnStack):
3126
3127 2016-11-18  Jeremy Jones  <jeremyj@apple.com>
3128
3129         Add runtime flag to enable pointer lock. Enable pointer lock feature for mac.
3130         https://bugs.webkit.org/show_bug.cgi?id=163801
3131
3132         Reviewed by Simon Fraser.
3133
3134         * Configurations/FeatureDefines.xcconfig:
3135
3136 2016-11-18  Filip Pizlo  <fpizlo@apple.com>
3137
3138         Unreviewed, fix cloop.
3139
3140         * bytecode/CodeBlock.cpp:
3141         (JSC::CodeBlock::stronglyVisitStrongReferences):
3142
3143 2016-11-18  Filip Pizlo  <fpizlo@apple.com>
3144
3145         Concurrent GC should be able to run splay in debug mode and earley/raytrace in release mode with no perf regression
3146         https://bugs.webkit.org/show_bug.cgi?id=164282
3147
3148         Reviewed by Geoffrey Garen and Oliver Hunt.
3149
3150         The two three remaining bugs were:
3151
3152         - Improper ordering inside putDirectWithoutTransition() and friends. We need to make sure
3153           that the GC doesn't see the store to Structure::m_offset until we've resized the butterfly.
3154           That proved a bit tricky. On the other hand, this means that we could probably remove the
3155           requirement that the GC holds the Structure lock in some cases. I haven't removed that lock
3156           yet because I still think it might protect some weird cases, and it doesn't seem to cost us
3157           anything.
3158
3159         - CodeBlock's GC strategy needed to be made thread-safe (visitWeakly, visitChildren, and
3160           their friends now hold locks) and incremental-safe (we need to update predictions in the
3161           finalizer to make sure we clear anything that was put into a value profile towards the end
3162           of GC).
3163
3164         - The GC timeslicing scheduler needed to be made a bit more aggressive to deal with
3165           generational workloads like earley, raytrace, and CDjs. Once I got those benchmarks to run,
3166           I found that they would do many useless iterations of GC because they wouldn't pause long
3167           enough after rescanning weak references and roots. I added a bunch of knobs for forcing a
3168           pause. In the end, I realized that I could get the desired effect by putting a ceiling on
3169           mutator utilization. We want the GC to finish quickly if it is possible to do so, even if
3170           the amount of allocation that the mutator had done is low. Having a utilization ceiling
3171           seems to accomplish this for benchmarks with trivial heaps (earley and raytrace) as well as
3172           huge heaps (like CDjs in its "large" configuration).
3173
3174         This preserves splay performance, makes the concurrent GC more stable, and makes the
3175         concurrent GC not a perf regression on earley or raytrace. It seems to give us great CDjs
3176         performance as well, but this is still hard to tell because we crash a lot in that benchmark.
3177
3178         * bytecode/CodeBlock.cpp:
3179         (JSC::CodeBlock::CodeBlock):
3180         (JSC::CodeBlock::visitWeakly):
3181         (JSC::CodeBlock::visitChildren):
3182         (JSC::CodeBlock::shouldVisitStrongly):
3183         (JSC::CodeBlock::shouldJettisonDueToOldAge):
3184         (JSC::CodeBlock::propagateTransitions):
3185         (JSC::CodeBlock::determineLiveness):
3186         (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences):
3187         (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally):
3188         (JSC::CodeBlock::visitOSRExitTargets):
3189         (JSC::CodeBlock::stronglyVisitStrongReferences):
3190         (JSC::CodeBlock::stronglyVisitWeakReferences):
3191         * bytecode/CodeBlock.h:
3192         (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled):
3193         * heap/CodeBlockSet.cpp:
3194         (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
3195         * heap/Heap.cpp:
3196         (JSC::Heap::ResumeTheWorldScope::ResumeTheWorldScope):
3197         (JSC::Heap::markToFixpoint):
3198         (JSC::Heap::beginMarking):
3199         (JSC::Heap::addToRememberedSet):
3200         (JSC::Heap::collectInThread):
3201         * heap/Heap.h:
3202         * heap/HeapInlines.h:
3203         (JSC::Heap::mutatorFence):
3204         * heap/MarkedBlock.cpp:
3205         * runtime/JSCellInlines.h:
3206         (JSC::JSCell::finishCreation):
3207         * runtime/JSObjectInlines.h:
3208         (JSC::JSObject::putDirectWithoutTransition):
3209         (JSC::JSObject::putDirectInternal):
3210         * runtime/Options.h:
3211         * runtime/Structure.cpp:
3212         (JSC::Structure::add):
3213         * runtime/Structure.h:
3214         * runtime/StructureInlines.h:
3215         (JSC::Structure::add):
3216
3217 2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
3218
3219         Web Inspector: Generator functions should have a displayable name when shown in stack traces
3220         https://bugs.webkit.org/show_bug.cgi?id=164844
3221         <rdar://problem/29300697>
3222
3223         Reviewed by Yusuke Suzuki.
3224
3225         * parser/SyntaxChecker.h:
3226         (JSC::SyntaxChecker::createGeneratorFunctionBody):
3227         * parser/ASTBuilder.h:
3228         (JSC::ASTBuilder::createGeneratorFunctionBody):
3229         New way to create a generator function with an inferred name.
3230
3231         * parser/Parser.cpp:
3232         (JSC::Parser<LexerType>::parseInner):
3233         (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
3234         * parser/Parser.h:
3235         Pass on the name of the generator wrapper function so we can
3236         use it on the inner generator function.
3237
3238 2016-11-17  Ryosuke Niwa  <rniwa@webkit.org>
3239
3240         Add an experimental API to find elements across shadow boundaries
3241         https://bugs.webkit.org/show_bug.cgi?id=164851
3242         <rdar://problem/28220092>
3243
3244         Reviewed by Sam Weinig.
3245
3246         * runtime/CommonIdentifiers.h:
3247
3248 2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
3249
3250         [JSC] Drop arguments.caller
3251         https://bugs.webkit.org/show_bug.cgi?id=164859
3252
3253         Reviewed by Saam Barati.
3254
3255         Originally, some JavaScript engine has `arguments.caller` property.
3256         But it easily causes some information leaks and it becomes obstacles
3257         for secure ECMAScript (SES). In ES5, we make it deprecated in strict
3258         mode. To do so, we explicitly set "caller" getter throwing TypeError
3259         to arguments in strict mode.
3260
3261         But now, there is no modern engine which supports `arguments.caller`
3262         in sloppy mode. So the original compatibility problem is gone and
3263         "caller" getter in the strict mode arguments becomes meaningless.
3264
3265         ES2017 drops this from the spec. In this patch, we also drop this
3266         `arguments.caller` in strict mode support.
3267
3268         Note that Function#caller is still alive.
3269
3270         * runtime/ClonedArguments.cpp:
3271         (JSC::ClonedArguments::getOwnPropertySlot):
3272         (JSC::ClonedArguments::put):
3273         (JSC::ClonedArguments::deleteProperty):
3274         (JSC::ClonedArguments::defineOwnProperty):
3275         (JSC::ClonedArguments::materializeSpecials):
3276
3277 2016-11-17  Mark Lam  <mark.lam@apple.com>
3278
3279         Inlining should be disallowed when JSC_alwaysUseShadowChicken=true.
3280         https://bugs.webkit.org/show_bug.cgi?id=164893
3281         <rdar://problem/29146436>
3282
3283         Reviewed by Saam Barati.
3284
3285         * runtime/Options.cpp:
3286         (JSC::recomputeDependentOptions):
3287
3288 2016-11-17  Filip Pizlo  <fpizlo@apple.com>
3289
3290         Speculatively disable eager object zero-fill on not-x86 to let the bots decide if that's a problem
3291         https://bugs.webkit.org/show_bug.cgi?id=164885
3292
3293         Reviewed by Mark Lam.
3294
3295         This adds a useGCFences() function that we use to guard all eager object zero-fill and the
3296         related fences. It currently returns true only on x86().
3297
3298         The goal here is to get the bots to tell us if this code is responsible for perf issues on
3299         any non-x86 platforms. We have a few different paths that we can pursue if this turns out
3300         to be the case. Eager zero-fill is merely the easiest way to optimize out some fences, but
3301         we could get rid of it and instead teach B3 how to think about fences.
3302
3303         * assembler/CPU.h:
3304         (JSC::useGCFences):
3305         * bytecode/PolymorphicAccess.cpp:
3306         (JSC::AccessCase::generateImpl):
3307         * dfg/DFGSpeculativeJIT.cpp:
3308         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
3309         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
3310         * ftl/FTLLowerDFGToB3.cpp:
3311         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
3312         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
3313         (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
3314         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
3315         (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
3316         (JSC::FTL::DFG::LowerDFGToB3::setButterfly):
3317         * jit/AssemblyHelpers.h:
3318         (JSC::AssemblyHelpers::mutatorFence):
3319         (JSC::AssemblyHelpers::storeButterfly):
3320         (JSC::AssemblyHelpers::emitInitializeInlineStorage):
3321         (JSC::AssemblyHelpers::emitInitializeOutOfLineStorage):
3322
3323 2016-11-17  Keith Miller  <keith_miller@apple.com>
3324
3325         Add rotate to Wasm
3326         https://bugs.webkit.org/show_bug.cgi?id=164871
3327
3328         Reviewed by Filip Pizlo.
3329
3330         Add rotate left and rotate right to Wasm. These directly map to B3 opcodes.
3331         This also moves arm specific transformations of rotate left to lower macros
3332         after optimization. It's a bad idea to have platform specific canonicalizations
3333         in reduce strength since other optimizations may not be aware of it.
3334
3335         Add a bug to do pure CSE after lower macros after optimization since we want to
3336         clean up RotL(value, Neg(Neg(shift))).
3337
3338         * b3/B3Generate.cpp:
3339         (JSC::B3::generateToAir):
3340         * b3/B3LowerMacrosAfterOptimizations.cpp:
3341         * b3/B3ReduceStrength.cpp:
3342         * wasm/wasm.json:
3343
3344 2016-11-17  Keith Miller  <keith_miller@apple.com>
3345
3346         Add sqrt to Wasm
3347         https://bugs.webkit.org/show_bug.cgi?id=164877
3348
3349         Reviewed by Mark Lam.
3350
3351         B3 already has a Sqrt opcode we just need to map Wasm to it.
3352
3353         * wasm/wasm.json:
3354
3355 2016-11-17  Keith Miller  <keith_miller@apple.com>
3356
3357         Add support for rotate in B3 and the relevant assemblers
3358         https://bugs.webkit.org/show_bug.cgi?id=164869
3359
3360         Reviewed by Geoffrey Garen.
3361
3362         This patch runs RotR and RotL (rotate right and left respectively)
3363         through B3 and B3's assemblers. One thing of note is that ARM64 does
3364         not support rotate left instead it allows negative right rotations.
3365
3366         This patch also fixes a theoretical bug in the assembler where
3367         on X86 doing someShiftOp(reg, edx) would instead shift the shift
3368         amount by the value. Additionally, this patch refactors some
3369         of the X86 assembler to use templates when deciding how to format
3370         the appropriate shift instruction.
3371
3372         * assembler/MacroAssemblerARM64.h:
3373         (JSC::MacroAssemblerARM64::rotateRight32):
3374         (JSC::MacroAssemblerARM64::rotateRight64):
3375         * assembler/MacroAssemblerX86Common.h:
3376         (JSC::MacroAssemblerX86Common::rotateRight32):
3377         (JSC::MacroAssemblerX86Common::rotateLeft32):
3378         * assembler/MacroAssemblerX86_64.h:
3379         (JSC::MacroAssemblerX86_64::lshift64):
3380         (JSC::MacroAssemblerX86_64::rshift64):
3381         (JSC::MacroAssemblerX86_64::urshift64):
3382         (JSC::MacroAssemblerX86_64::rotateRight64):
3383         (JSC::MacroAssemblerX86_64::rotateLeft64):
3384         (JSC::MacroAssemblerX86_64::or64):
3385         * assembler/X86Assembler.h:
3386         (JSC::X86Assembler::xorq_rm):
3387         (JSC::X86Assembler::shiftInstruction32):
3388         (JSC::X86Assembler::sarl_i8r):
3389         (JSC::X86Assembler::shrl_i8r):
3390         (JSC::X86Assembler::shll_i8r):
3391         (JSC::X86Assembler::rorl_i8r):
3392         (JSC::X86Assembler::rorl_CLr):
3393         (JSC::X86Assembler::roll_i8r):
3394         (JSC::X86Assembler::roll_CLr):
3395         (JSC::X86Assembler::shiftInstruction64):
3396         (JSC::X86Assembler::sarq_CLr):
3397         (JSC::X86Assembler::sarq_i8r):
3398         (JSC::X86Assembler::shrq_i8r):
3399         (JSC::X86Assembler::shlq_i8r):
3400         (JSC::X86Assembler::rorq_i8r):
3401         (JSC::X86Assembler::rorq_CLr):
3402         (JSC::X86Assembler::rolq_i8r):
3403         (JSC::X86Assembler::rolq_CLr):
3404         * b3/B3Common.h:
3405         (JSC::B3::rotateRight):
3406         (JSC::B3::rotateLeft):
3407         * b3/B3Const32Value.cpp:
3408         (JSC::B3::Const32Value::rotRConstant):
3409         (JSC::B3::Const32Value::rotLConstant):
3410         * b3/B3Const32Value.h:
3411         * b3/B3Const64Value.cpp:
3412         (JSC::B3::Const64Value::rotRConstant):
3413         (JSC::B3::Const64Value::rotLConstant):
3414         * b3/B3Const64Value.h:
3415         * b3/B3LowerToAir.cpp:
3416         (JSC::B3::Air::LowerToAir::lower):
3417         * b3/B3Opcode.cpp:
3418         (WTF::printInternal):