1 2015-09-16 Sukolsak Sakshuwong <sukolsak@gmail.com>
3 Implement indirect calls in WebAssembly
4 https://bugs.webkit.org/show_bug.cgi?id=149100
6 Reviewed by Geoffrey Garen.
8 This patch implement indirect calls for WebAssembly files generated by
9 pack-asmjs <https://github.com/WebAssembly/polyfill-prototype-1>.
10 pack-asmjs uses the same indirect call model as asm.js. In asm.js, an
11 indirect call looks like this:
13 where t is a variable referring to an array of functions with the same
14 signature, i is an integer expression, n is an integer that is equal to
15 (t.length - 1), and t.length is a power of two. pack-asmjs does not
16 use the '&' operator nor n in the WebAssembly output, but the semantics
17 is still the same as asm.js.
19 * tests/stress/wasm-calls.js:
20 * tests/stress/wasm/calls.wasm:
22 * wasm/WASMFunctionCompiler.h:
23 (JSC::WASMFunctionCompiler::buildCallIndirect):
24 * wasm/WASMFunctionParser.cpp:
25 (JSC::WASMFunctionParser::parseExpressionI32):
26 (JSC::WASMFunctionParser::parseExpressionF32):
27 (JSC::WASMFunctionParser::parseExpressionF64):
28 (JSC::WASMFunctionParser::parseCallIndirect):
29 * wasm/WASMFunctionParser.h:
30 * wasm/WASMFunctionSyntaxChecker.h:
31 (JSC::WASMFunctionSyntaxChecker::buildCallIndirect):
32 * wasm/WASMModuleParser.cpp:
33 (JSC::WASMModuleParser::parseFunctionPointerTableSection):
34 (JSC::WASMModuleParser::parseFunctionDefinitionSection):
36 2015-09-16 Sukolsak Sakshuwong <sukolsak@gmail.com>
38 Fix 32-bit build issues in WebAssembly
39 https://bugs.webkit.org/show_bug.cgi?id=149240
41 Reviewed by Geoffrey Garen.
43 Fix the syntax error and replace the instructions that are not available on
46 * wasm/WASMFunctionCompiler.h:
47 (JSC::WASMFunctionCompiler::startFunction):
48 (JSC::WASMFunctionCompiler::endFunction):
49 (JSC::WASMFunctionCompiler::buildReturn):
50 (JSC::WASMFunctionCompiler::callAndUnboxResult):
51 (JSC::WASMFunctionCompiler::loadValueAndConvertToDouble):
53 2015-09-16 Geoffrey Garen <ggaren@apple.com>
55 JavaScriptCore should discard baseline code after some time
56 https://bugs.webkit.org/show_bug.cgi?id=149220
58 Reviewed by Saam Barati.
60 This is a bit more complicated than discarding optimized code because
61 the engine previously assumed that we would never discard baseline code.
63 * bytecode/CodeBlock.cpp:
64 (JSC::CodeBlock::CodeBlock): Record creation time (and compute time since
65 creation) instead of install time because CodeBlocks can be installed
66 more than once, and we don't want to have to worry about edge cases
67 created by CodeBlocks seeming to get younger.
69 (JSC::CodeBlock::visitAggregate): Be explicit about only doing the
70 weak reference fixpoint for optimized CodeBlocks. We used to avoid the
71 fixpoint for baseline CodeBlocks implicitly, since they would always
72 visit themselves strongly right away. But now baseline CodeBlocks might
73 not visit themselves strongly, since they might choose to jettison due
76 (JSC::CodeBlock::shouldVisitStrongly): Add old age as a reason not to
77 visit ourselves strongly, so that baseline CodeBlocks can jettison due
80 (JSC::CodeBlock::shouldJettisonDueToWeakReference): Be explicit about
81 only jettisoning optimized CodeBlocks due to weak references so that we
82 don't confuse ourselves into thinking that we will jettison a baseline
83 CodeBlock due to weak references.
85 (JSC::CodeBlock::shouldJettisonDueToOldAge): Updated to use creation time.
87 (JSC::CodeBlock::visitOSRExitTargets): Clarify a comment and add an
88 ASSERT to help record some things I discovered while debugging.
90 (JSC::CodeBlock::jettison): Allow a baseline CodeBlock to jettison. Don't
91 assume that we have an alternative or a profiler.
93 (JSC::CodeBlock::install): Deleted.
94 * bytecode/CodeBlock.h:
95 (JSC::CodeBlock::releaseAlternative): Deleted.
96 (JSC::CodeBlock::setInstallTime): Deleted.
97 (JSC::CodeBlock::timeSinceInstall): Deleted.
99 * dfg/DFGOSRExitPreparation.cpp:
100 (JSC::DFG::prepareCodeOriginForOSRExit): Simplified the computation of
104 (JSC::DFG::Plan::checkLivenessAndVisitChildren): Be sure to strongly
105 visit our inline callframes because we assume that an optimized CodeBlock
106 will keep its OSR exit targets alive, but the CodeBlock object won't be
107 able to mark them for itself until compilation has completed (since it
108 won't have a JITCode object yet).
110 * dfg/DFGToFTLDeferredCompilationCallback.cpp:
111 (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
112 Updated for interface change.
115 (JSC::JITCode::timeToLive): Provide a time to live for interpreter and
116 baseline code, so they will jettison when old. Use seconds in our
117 code so that we don't need comments. Make DFG 2X interpreter+baseline,
118 and FTL 2X DFG+interpreter+baseline, also matching the time we allot
119 before throwing away all code.
121 * jit/JITToDFGDeferredCompilationCallback.cpp:
122 (JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
123 * llint/LLIntSlowPaths.cpp:
124 (JSC::LLInt::jitCompileAndSetHeuristics): Updated for interface change.
126 * runtime/Executable.cpp:
127 (JSC::ScriptExecutable::installCode): Allow our caller to install nullptr,
128 since we need to do this when jettisoning a baseline CodeBlock. Require
129 our caller to specify the details of the installation because we can't
130 rely on a non-null CodeBlock in order to compute them.
132 (JSC::ScriptExecutable::newCodeBlockFor):
133 (JSC::ScriptExecutable::prepareForExecutionImpl):
134 * runtime/Executable.h:
135 (JSC::ScriptExecutable::recordParse): Updated for interface change.
137 * runtime/Options.h: Renamed the CodeBlock liveness option since it now
138 controls baseline and optimized code.
140 2015-09-16 Geoffrey Garen <ggaren@apple.com>
142 Remove obsolete code for deleting CodeBlocks
143 https://bugs.webkit.org/show_bug.cgi?id=149231
145 Reviewed by Mark Lam.
148 (JSC::Heap::deleteAllCodeBlocks): ASSERT that we're called in a valid
149 state, and do the compiler waiting ourselves instead of having our
150 caller do it. This is more appropriate to our new limited use.
152 (JSC::Heap::collectImpl):
153 (JSC::Heap::deleteOldCode): Deleted. Don't call deleteAllCodeBlocks
154 periodically because it's not such a good idea to delete everything
155 at once, and CodeBlocks now have a more precise individual policy for
156 when to delete. Also, this function used to fail all or nearly all of
157 the time because its invariants that we were not executing or compiling
163 (GlobalObject::finishCreation):
164 (functionDeleteAllCompiledCode): Deleted.
165 * tests/stress/deleteAllCompiledCode.js: Removed. Removed this testing
166 code because it did not do what it thought it did. All of this code
167 was guaranteed to no-op since it would run JavaScript to call a function
168 that would return early because JavaScript was running.
171 (JSC::VM::deleteAllCode): This code is simpler now becaue
172 heap.deleteAllCodeBlocks does some work for us.
174 * runtime/VMEntryScope.cpp:
175 (JSC::VMEntryScope::VMEntryScope): Don't delete code on VM entry. This
176 policy was old, and it dated back to a time when we
178 (a) couldn't run in the interpreter if compilation failed;
180 (b) didn't reduce the rate of compilation in response to executable
183 (c) didn't throw away individual CodeBlocks automatically.
185 2015-09-16 Michael Saboff <msaboff@apple.com>
187 [ES6] Implement tail calls in the LLInt and Baseline JIT
188 https://bugs.webkit.org/show_bug.cgi?id=148661
190 Fix for the breakage of Speedometer/Full.html (https://bugs.webkit.org/show_bug.cgi?id=149162).
192 Reviewed by Filip Pizlo.
193 Changed SetupVarargsFrame.cpp::emitSetVarargsFrame to align the callframe size to be a
194 multiple of stackAlignmentRegisters() in addition to the location of the new frame.
196 Fixed Reviewed by Filip Pizlo.
199 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
200 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
201 * JavaScriptCore.xcodeproj/project.pbxproj:
202 * assembler/AbortReason.h:
203 * assembler/AbstractMacroAssembler.h:
204 (JSC::AbstractMacroAssembler::Call::Call):
205 (JSC::AbstractMacroAssembler::repatchNearCall):
206 (JSC::AbstractMacroAssembler::repatchCompact):
207 * assembler/CodeLocation.h:
208 (JSC::CodeLocationNearCall::CodeLocationNearCall):
209 (JSC::CodeLocationNearCall::callMode):
210 (JSC::CodeLocationCommon::callAtOffset):
211 (JSC::CodeLocationCommon::nearCallAtOffset):
212 (JSC::CodeLocationCommon::dataLabelPtrAtOffset):
213 * assembler/LinkBuffer.h:
214 (JSC::LinkBuffer::locationOfNearCall):
215 (JSC::LinkBuffer::locationOf):
216 * assembler/MacroAssemblerARM.h:
217 (JSC::MacroAssemblerARM::nearCall):
218 (JSC::MacroAssemblerARM::nearTailCall):
219 (JSC::MacroAssemblerARM::call):
220 (JSC::MacroAssemblerARM::linkCall):
221 * assembler/MacroAssemblerARM64.h:
222 (JSC::MacroAssemblerARM64::nearCall):
223 (JSC::MacroAssemblerARM64::nearTailCall):
224 (JSC::MacroAssemblerARM64::ret):
225 (JSC::MacroAssemblerARM64::linkCall):
226 * assembler/MacroAssemblerARMv7.h:
227 (JSC::MacroAssemblerARMv7::nearCall):
228 (JSC::MacroAssemblerARMv7::nearTailCall):
229 (JSC::MacroAssemblerARMv7::call):
230 (JSC::MacroAssemblerARMv7::linkCall):
231 * assembler/MacroAssemblerMIPS.h:
232 (JSC::MacroAssemblerMIPS::nearCall):
233 (JSC::MacroAssemblerMIPS::nearTailCall):
234 (JSC::MacroAssemblerMIPS::call):
235 (JSC::MacroAssemblerMIPS::linkCall):
236 (JSC::MacroAssemblerMIPS::repatchCall):
237 * assembler/MacroAssemblerSH4.h:
238 (JSC::MacroAssemblerSH4::call):
239 (JSC::MacroAssemblerSH4::nearTailCall):
240 (JSC::MacroAssemblerSH4::nearCall):
241 (JSC::MacroAssemblerSH4::linkCall):
242 (JSC::MacroAssemblerSH4::repatchCall):
243 * assembler/MacroAssemblerX86.h:
244 (JSC::MacroAssemblerX86::linkCall):
245 * assembler/MacroAssemblerX86Common.h:
246 (JSC::MacroAssemblerX86Common::breakpoint):
247 (JSC::MacroAssemblerX86Common::nearTailCall):
248 (JSC::MacroAssemblerX86Common::nearCall):
249 * assembler/MacroAssemblerX86_64.h:
250 (JSC::MacroAssemblerX86_64::linkCall):
251 * bytecode/BytecodeList.json:
252 * bytecode/BytecodeUseDef.h:
253 (JSC::computeUsesForBytecodeOffset):
254 (JSC::computeDefsForBytecodeOffset):
255 * bytecode/CallLinkInfo.h:
256 (JSC::CallLinkInfo::callTypeFor):
257 (JSC::CallLinkInfo::isVarargsCallType):
258 (JSC::CallLinkInfo::CallLinkInfo):
259 (JSC::CallLinkInfo::specializationKind):
260 (JSC::CallLinkInfo::callModeFor):
261 (JSC::CallLinkInfo::callMode):
262 (JSC::CallLinkInfo::isTailCall):
263 (JSC::CallLinkInfo::isVarargs):
264 (JSC::CallLinkInfo::registerPreservationMode):
265 * bytecode/CallLinkStatus.cpp:
266 (JSC::CallLinkStatus::computeFromLLInt):
267 * bytecode/CodeBlock.cpp:
268 (JSC::CodeBlock::dumpBytecode):
269 (JSC::CodeBlock::CodeBlock):
270 * bytecompiler/BytecodeGenerator.cpp:
271 (JSC::BytecodeGenerator::BytecodeGenerator):
272 (JSC::BytecodeGenerator::emitCallInTailPosition):
273 (JSC::BytecodeGenerator::emitCallEval):
274 (JSC::BytecodeGenerator::emitCall):
275 (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
276 (JSC::BytecodeGenerator::emitConstructVarargs):
277 * bytecompiler/NodesCodegen.cpp:
278 (JSC::CallArguments::CallArguments):
279 (JSC::LabelNode::emitBytecode):
280 * dfg/DFGByteCodeParser.cpp:
281 (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
282 * ftl/FTLLowerDFGToLLVM.cpp:
283 (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
284 * interpreter/Interpreter.h:
285 (JSC::Interpreter::isCallBytecode):
286 (JSC::calleeFrameForVarargs):
287 * jit/CCallHelpers.h:
288 (JSC::CCallHelpers::jumpToExceptionHandler):
289 (JSC::CCallHelpers::prepareForTailCallSlow):
291 (JSC::JIT::privateCompileMainPass):
292 (JSC::JIT::privateCompileSlowCases):
295 (JSC::JIT::compileOpCall):
296 (JSC::JIT::compileOpCallSlowCase):
297 (JSC::JIT::emit_op_call):
298 (JSC::JIT::emit_op_tail_call):
299 (JSC::JIT::emit_op_call_eval):
300 (JSC::JIT::emit_op_call_varargs):
301 (JSC::JIT::emit_op_tail_call_varargs):
302 (JSC::JIT::emit_op_construct_varargs):
303 (JSC::JIT::emitSlow_op_call):
304 (JSC::JIT::emitSlow_op_tail_call):
305 (JSC::JIT::emitSlow_op_call_eval):
306 (JSC::JIT::emitSlow_op_call_varargs):
307 (JSC::JIT::emitSlow_op_tail_call_varargs):
308 (JSC::JIT::emitSlow_op_construct_varargs):
309 * jit/JITCall32_64.cpp:
310 (JSC::JIT::emitSlow_op_call):
311 (JSC::JIT::emitSlow_op_tail_call):
312 (JSC::JIT::emitSlow_op_call_eval):
313 (JSC::JIT::emitSlow_op_call_varargs):
314 (JSC::JIT::emitSlow_op_tail_call_varargs):
315 (JSC::JIT::emitSlow_op_construct_varargs):
316 (JSC::JIT::emit_op_call):
317 (JSC::JIT::emit_op_tail_call):
318 (JSC::JIT::emit_op_call_eval):
319 (JSC::JIT::emit_op_call_varargs):
320 (JSC::JIT::emit_op_tail_call_varargs):
321 (JSC::JIT::emit_op_construct_varargs):
322 (JSC::JIT::compileOpCall):
323 (JSC::JIT::compileOpCallSlowCase):
325 (JSC::JIT::emitNakedCall):
326 (JSC::JIT::emitNakedTailCall):
327 (JSC::JIT::updateTopCallFrame):
328 * jit/JITOperations.cpp:
329 * jit/JITOperations.h:
331 (JSC::linkVirtualFor):
332 (JSC::linkPolymorphicCall):
333 * jit/SetupVarargsFrame.cpp:
334 (JSC::emitSetVarargsFrame):
335 * jit/ThunkGenerators.cpp:
336 (JSC::throwExceptionFromCallSlowPathGenerator):
338 (JSC::linkCallThunkGenerator):
339 (JSC::virtualThunkFor):
340 (JSC::arityFixupGenerator):
341 (JSC::unreachableGenerator):
342 (JSC::baselineGetterReturnThunkGenerator):
343 * jit/ThunkGenerators.h:
344 * llint/LowLevelInterpreter.asm:
345 * llint/LowLevelInterpreter32_64.asm:
346 * llint/LowLevelInterpreter64.asm:
347 * runtime/CommonSlowPaths.h:
348 (JSC::CommonSlowPaths::arityCheckFor):
349 (JSC::CommonSlowPaths::opIn):
351 2015-09-15 Michael Saboff <msaboff@apple.com>
353 Rollout r189774 and 189818.
355 Broke Speedometer/Full.html
360 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
361 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
362 * JavaScriptCore.xcodeproj/project.pbxproj:
363 * assembler/AbortReason.h:
364 * assembler/AbstractMacroAssembler.h:
365 (JSC::AbstractMacroAssembler::Call::Call):
366 (JSC::AbstractMacroAssembler::repatchNearCall):
367 (JSC::AbstractMacroAssembler::repatchCompact):
368 * assembler/CodeLocation.h:
369 (JSC::CodeLocationNearCall::CodeLocationNearCall):
370 (JSC::CodeLocationCommon::callAtOffset):
371 (JSC::CodeLocationCommon::nearCallAtOffset):
372 (JSC::CodeLocationCommon::dataLabelPtrAtOffset):
373 (JSC::CodeLocationNearCall::callMode): Deleted.
374 * assembler/LinkBuffer.h:
375 (JSC::LinkBuffer::locationOfNearCall):
376 (JSC::LinkBuffer::locationOf):
377 * assembler/MacroAssemblerARM.h:
378 (JSC::MacroAssemblerARM::nearCall):
379 (JSC::MacroAssemblerARM::call):
380 (JSC::MacroAssemblerARM::linkCall):
381 (JSC::MacroAssemblerARM::nearTailCall): Deleted.
382 * assembler/MacroAssemblerARM64.h:
383 (JSC::MacroAssemblerARM64::nearCall):
384 (JSC::MacroAssemblerARM64::ret):
385 (JSC::MacroAssemblerARM64::linkCall):
386 (JSC::MacroAssemblerARM64::nearTailCall): Deleted.
387 * assembler/MacroAssemblerARMv7.h:
388 (JSC::MacroAssemblerARMv7::nearCall):
389 (JSC::MacroAssemblerARMv7::call):
390 (JSC::MacroAssemblerARMv7::linkCall):
391 (JSC::MacroAssemblerARMv7::nearTailCall): Deleted.
392 * assembler/MacroAssemblerMIPS.h:
393 (JSC::MacroAssemblerMIPS::nearCall):
394 (JSC::MacroAssemblerMIPS::call):
395 (JSC::MacroAssemblerMIPS::linkCall):
396 (JSC::MacroAssemblerMIPS::repatchCall):
397 (JSC::MacroAssemblerMIPS::nearTailCall): Deleted.
398 * assembler/MacroAssemblerSH4.h:
399 (JSC::MacroAssemblerSH4::call):
400 (JSC::MacroAssemblerSH4::nearCall):
401 (JSC::MacroAssemblerSH4::linkCall):
402 (JSC::MacroAssemblerSH4::repatchCall):
403 (JSC::MacroAssemblerSH4::nearTailCall): Deleted.
404 * assembler/MacroAssemblerX86.h:
405 (JSC::MacroAssemblerX86::linkCall):
406 * assembler/MacroAssemblerX86Common.h:
407 (JSC::MacroAssemblerX86Common::breakpoint):
408 (JSC::MacroAssemblerX86Common::nearCall):
409 (JSC::MacroAssemblerX86Common::nearTailCall): Deleted.
410 * assembler/MacroAssemblerX86_64.h:
411 (JSC::MacroAssemblerX86_64::linkCall):
412 * bytecode/BytecodeList.json:
413 * bytecode/BytecodeUseDef.h:
414 (JSC::computeUsesForBytecodeOffset):
415 (JSC::computeDefsForBytecodeOffset):
416 * bytecode/CallLinkInfo.h:
417 (JSC::CallLinkInfo::callTypeFor):
418 (JSC::CallLinkInfo::CallLinkInfo):
419 (JSC::CallLinkInfo::specializationKind):
420 (JSC::CallLinkInfo::registerPreservationMode):
421 (JSC::CallLinkInfo::isVarargsCallType): Deleted.
422 (JSC::CallLinkInfo::callModeFor): Deleted.
423 (JSC::CallLinkInfo::callMode): Deleted.
424 (JSC::CallLinkInfo::isTailCall): Deleted.
425 (JSC::CallLinkInfo::isVarargs): Deleted.
426 * bytecode/CallLinkStatus.cpp:
427 (JSC::CallLinkStatus::computeFromLLInt):
428 * bytecode/CodeBlock.cpp:
429 (JSC::CodeBlock::dumpBytecode):
430 (JSC::CodeBlock::CodeBlock):
431 * bytecompiler/BytecodeGenerator.cpp:
432 (JSC::BytecodeGenerator::BytecodeGenerator):
433 (JSC::BytecodeGenerator::emitCallInTailPosition):
434 (JSC::BytecodeGenerator::emitCallEval):
435 (JSC::BytecodeGenerator::emitCall):
436 (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
437 (JSC::BytecodeGenerator::emitConstructVarargs):
438 * bytecompiler/NodesCodegen.cpp:
439 (JSC::CallArguments::CallArguments):
440 (JSC::LabelNode::emitBytecode):
441 * dfg/DFGByteCodeParser.cpp:
442 (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
443 * ftl/FTLLowerDFGToLLVM.cpp:
444 (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
445 * interpreter/Interpreter.h:
446 (JSC::Interpreter::isCallBytecode):
447 * jit/CCallHelpers.h:
448 (JSC::CCallHelpers::jumpToExceptionHandler):
449 (JSC::CCallHelpers::prepareForTailCallSlow): Deleted.
451 (JSC::JIT::privateCompileMainPass):
452 (JSC::JIT::privateCompileSlowCases):
455 (JSC::JIT::compileOpCall):
456 (JSC::JIT::compileOpCallSlowCase):
457 (JSC::JIT::emit_op_call):
458 (JSC::JIT::emit_op_call_eval):
459 (JSC::JIT::emit_op_call_varargs):
460 (JSC::JIT::emit_op_construct_varargs):
461 (JSC::JIT::emitSlow_op_call):
462 (JSC::JIT::emitSlow_op_call_eval):
463 (JSC::JIT::emitSlow_op_call_varargs):
464 (JSC::JIT::emitSlow_op_construct_varargs):
465 (JSC::JIT::emit_op_tail_call): Deleted.
466 (JSC::JIT::emit_op_tail_call_varargs): Deleted.
467 (JSC::JIT::emitSlow_op_tail_call): Deleted.
468 (JSC::JIT::emitSlow_op_tail_call_varargs): Deleted.
469 * jit/JITCall32_64.cpp:
470 (JSC::JIT::emitSlow_op_call):
471 (JSC::JIT::emitSlow_op_call_eval):
472 (JSC::JIT::emitSlow_op_call_varargs):
473 (JSC::JIT::emitSlow_op_construct_varargs):
474 (JSC::JIT::emit_op_call):
475 (JSC::JIT::emit_op_call_eval):
476 (JSC::JIT::emit_op_call_varargs):
477 (JSC::JIT::emit_op_construct_varargs):
478 (JSC::JIT::compileOpCall):
479 (JSC::JIT::compileOpCallSlowCase):
480 (JSC::JIT::emitSlow_op_tail_call): Deleted.
481 (JSC::JIT::emitSlow_op_tail_call_varargs): Deleted.
482 (JSC::JIT::emit_op_tail_call): Deleted.
483 (JSC::JIT::emit_op_tail_call_varargs): Deleted.
485 (JSC::JIT::emitNakedCall):
486 (JSC::JIT::updateTopCallFrame):
487 (JSC::JIT::emitNakedTailCall): Deleted.
488 * jit/JITOperations.cpp:
489 * jit/JITOperations.h:
491 (JSC::linkVirtualFor):
492 (JSC::linkPolymorphicCall):
493 * jit/ThunkGenerators.cpp:
494 (JSC::throwExceptionFromCallSlowPathGenerator):
496 (JSC::linkCallThunkGenerator):
497 (JSC::virtualThunkFor):
498 (JSC::arityFixupGenerator):
499 (JSC::baselineGetterReturnThunkGenerator):
500 (JSC::unreachableGenerator): Deleted.
501 * jit/ThunkGenerators.h:
502 * llint/LowLevelInterpreter.asm:
503 * llint/LowLevelInterpreter32_64.asm:
504 * llint/LowLevelInterpreter64.asm:
505 * runtime/CommonSlowPaths.h:
506 (JSC::CommonSlowPaths::arityCheckFor):
507 (JSC::CommonSlowPaths::opIn):
508 * tests/stress/mutual-tail-call-no-stack-overflow.js: Removed.
509 * tests/stress/tail-call-no-stack-overflow.js: Removed.
510 * tests/stress/tail-call-recognize.js: Removed.
511 * tests/stress/tail-call-varargs-no-stack-overflow.js: Removed.
512 * tests/stress/tail-calls-dont-overwrite-live-stack.js: Removed.
514 2015-09-15 Sukolsak Sakshuwong <sukolsak@gmail.com>
516 Implement imported global variables in WebAssembly
517 https://bugs.webkit.org/show_bug.cgi?id=149206
519 Reviewed by Filip Pizlo.
521 Values can now be imported to a WebAssembly module through properties of
522 the imports object that is passed to loadWebAssembly(). In order to
523 avoid any side effect when accessing the imports object, we check that
524 the properties are data properties. We also check that each value is a
525 primitive and is not a Symbol. According to the ECMA262 6.0 spec,
526 calling ToNumber() on a primitive that is not a Symbol should not cause
529 [1]: http://www.ecma-international.org/ecma-262/6.0/#sec-tonumber
531 * tests/stress/wasm-globals.js:
532 * tests/stress/wasm/globals.wasm:
533 * wasm/WASMModuleParser.cpp:
534 (JSC::WASMModuleParser::parseModule):
535 (JSC::WASMModuleParser::parseGlobalSection):
536 * wasm/WASMModuleParser.h:
538 2015-09-15 Sukolsak Sakshuwong <sukolsak@gmail.com>
540 Fix asm.js errors in WebAssembly tests
541 https://bugs.webkit.org/show_bug.cgi?id=149203
543 Reviewed by Geoffrey Garen.
545 Our WebAssembly implementation uses asm.js for testing. Using Firefox to
546 parse asm.js reveals many errors that are not caught by pack-asmjs. For
548 - asm.js does not allow the use of the multiplication operator (*) to
549 multiply two integers, because the result can be so large that some
550 lower bits of precision are lost. Math.imul is used instead.
551 - an int variable must be coerced to either signed (via x|0) or unsigned
552 (via x>>>0) before it's returned.
554 * tests/stress/wasm-arithmetic-int32.js:
555 * tests/stress/wasm-calls.js:
556 * tests/stress/wasm-control-flow.js:
557 * tests/stress/wasm-globals.js:
558 * tests/stress/wasm-locals.js:
559 * tests/stress/wasm-relational.js:
560 * tests/stress/wasm/control-flow.wasm:
562 2015-09-15 Ryosuke Niwa <rniwa@webkit.org>
564 Add ShadowRoot interface and Element.prototype.attachShadow
565 https://bugs.webkit.org/show_bug.cgi?id=149187
567 Reviewed by Antti Koivisto.
569 * Configurations/FeatureDefines.xcconfig:
571 2015-09-15 Joseph Pecoraro <pecoraro@apple.com>
573 Web Inspector: Paused Debugger prevents page reload
574 https://bugs.webkit.org/show_bug.cgi?id=148174
576 Reviewed by Brian Burg.
578 * debugger/Debugger.h:
579 (JSC::Debugger::suppressAllPauses):
580 (JSC::Debugger::setSuppressAllPauses):
581 * debugger/Debugger.cpp:
582 (JSC::Debugger::Debugger):
583 (JSC::Debugger::pauseIfNeeded):
584 * inspector/agents/InspectorDebuggerAgent.h:
585 * inspector/agents/InspectorDebuggerAgent.cpp:
586 (Inspector::InspectorDebuggerAgent::setSuppressAllPauses):
587 Provide a way to suppress pauses.
589 2015-09-15 Sukolsak Sakshuwong <sukolsak@gmail.com>
591 Implement calls to JavaScript functions in WebAssembly
592 https://bugs.webkit.org/show_bug.cgi?id=149093
594 Reviewed by Filip Pizlo.
596 This patch implements calls to JavaScript functions in WebAssembly.
597 WebAssembly functions can only call JavaScript functions that are
598 imported to their module via an object that is passed into
599 loadWebAssembly(). References to JavaScript functions are resolved at
600 the module's load time, just like asm.js.
603 (GlobalObject::finishCreation):
604 (functionLoadWebAssembly):
605 * tests/stress/wasm-calls.js:
606 * tests/stress/wasm/calls.wasm:
607 * wasm/JSWASMModule.cpp:
608 (JSC::JSWASMModule::visitChildren):
609 * wasm/JSWASMModule.h:
610 (JSC::JSWASMModule::importedFunctions):
611 * wasm/WASMFunctionCompiler.h:
612 (JSC::WASMFunctionCompiler::buildCallImport):
613 * wasm/WASMFunctionParser.cpp:
614 (JSC::WASMFunctionParser::parseExpressionI32):
615 (JSC::WASMFunctionParser::parseExpressionF64):
616 (JSC::WASMFunctionParser::parseCallImport):
617 * wasm/WASMFunctionParser.h:
618 * wasm/WASMFunctionSyntaxChecker.h:
619 (JSC::WASMFunctionSyntaxChecker::buildCallInternal):
620 (JSC::WASMFunctionSyntaxChecker::buildCallImport):
621 (JSC::WASMFunctionSyntaxChecker::updateTempStackHeightForCall):
622 * wasm/WASMModuleParser.cpp:
623 (JSC::WASMModuleParser::WASMModuleParser):
624 (JSC::WASMModuleParser::parse):
625 (JSC::WASMModuleParser::parseModule):
626 (JSC::WASMModuleParser::parseFunctionImportSection):
627 (JSC::WASMModuleParser::getImportedValue):
628 (JSC::parseWebAssembly):
629 * wasm/WASMModuleParser.h:
631 2015-09-15 Csaba Osztrogonác <ossy@webkit.org>
633 Fix the !ENABLE(DFG_JIT) build after r188696
634 https://bugs.webkit.org/show_bug.cgi?id=149158
636 Reviewed by Yusuke Suzuki.
638 * bytecode/GetByIdStatus.cpp:
639 * bytecode/GetByIdStatus.h:
641 2015-09-15 Saam barati <sbarati@apple.com>
643 functions that use try/catch will allocate a top level JSLexicalEnvironment even when it is not necessary
644 https://bugs.webkit.org/show_bug.cgi?id=148169
646 Reviewed by Geoffrey Garen.
648 We used to do this before we had proper lexical scoping
649 in the bytecode generator. There is absolutely no reason
650 why need to allocate a top-level "var" activation when a
651 function/program uses a "catch" block.
653 * parser/ASTBuilder.h:
654 (JSC::ASTBuilder::createTryStatement):
655 (JSC::ASTBuilder::incConstants):
656 (JSC::ASTBuilder::usesThis):
657 (JSC::ASTBuilder::usesArguments):
658 (JSC::ASTBuilder::usesWith):
659 (JSC::ASTBuilder::usesEval):
660 (JSC::ASTBuilder::usesCatch): Deleted.
662 (JSC::ScopeNode::isStrictMode):
663 (JSC::ScopeNode::setUsesArguments):
664 (JSC::ScopeNode::usesThis):
665 (JSC::ScopeNode::needsActivation):
666 (JSC::ScopeNode::hasCapturedVariables):
667 (JSC::ScopeNode::captures):
668 (JSC::ScopeNode::needsActivationForMoreThanVariables): Deleted.
669 * parser/ParserModes.h:
670 * runtime/Executable.h:
671 (JSC::ScriptExecutable::usesEval):
672 (JSC::ScriptExecutable::usesArguments):
673 (JSC::ScriptExecutable::needsActivation):
674 (JSC::ScriptExecutable::isStrictMode):
675 (JSC::ScriptExecutable::ecmaMode):
677 2015-09-15 Michael Saboff <msaboff@apple.com>
679 REGRESSION(r189774): CLoop doesn't build after r189774
680 https://bugs.webkit.org/show_bug.cgi?id=149171
682 Unreviewed build fix for the C Loop.
684 Added needed C Loop label opcodes.
686 * bytecode/BytecodeList.json:
688 2015-09-15 Andy VanWagoner <thetalecrafter@gmail.com>
690 [INTL] Implement supportedLocalesOf on Intl Constructors
691 https://bugs.webkit.org/show_bug.cgi?id=147599
693 Reviewed by Benjamin Poulain.
695 Implements all of the abstract operations used by supportedLocalesOf,
696 except during canonicalization it does not replace redundant tags,
697 or subtags with their preferred values.
699 * icu/unicode/ucal.h: Added.
700 * icu/unicode/udat.h: Added.
701 * icu/unicode/umisc.h: Added.
702 * icu/unicode/unum.h: Added.
703 * icu/unicode/utypes.h: Clear the U_SHOW_CPLUSPLUS_API flag to prevent C++ headers from being included.
704 * runtime/CommonIdentifiers.h: Adde localeMatcher.
705 * runtime/IntlCollatorConstructor.cpp:
706 (JSC::IntlCollatorConstructorFuncSupportedLocalesOf): Implemented.
707 * runtime/IntlDateTimeFormatConstructor.cpp:
708 (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf): Implemented.
709 * runtime/IntlNumberFormatConstructor.cpp:
710 (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf): Implemented.
711 * runtime/IntlObject.cpp:
712 (JSC::canonicalizeLanguageTag):
713 (JSC::getCanonicalLangTag):
714 (JSC::getPrivateUseLangTag):
715 (JSC::getGrandfatheredLangTag):
716 (JSC::canonicalizeLocaleList):
717 (JSC::bestAvailableLocale):
718 (JSC::lookupSupportedLocales):
719 (JSC::bestFitSupportedLocales):
720 (JSC::supportedLocales):
721 (JSC::getIntlStringOption):
722 (JSC::getIntlBooleanOption):
723 * runtime/IntlObject.h:
724 * runtime/JSCJSValue.h: Added toLength.
725 * runtime/JSCJSValue.cpp: Added toLength.
726 (JSC::JSValue::toLength): Implement ToLength from ECMA 262 6.0 7.1.15
727 * runtime/JSGlobalObject.cpp:
728 (JSC::JSGlobalObject::intlCollatorAvailableLocales): Added lazy locale list.
729 (JSC::JSGlobalObject::intlDateTimeFormatAvailableLocales): Added lazy locale list.
730 (JSC::JSGlobalObject::intlNumberFormatAvailableLocales): Added lazy locale list.
731 * runtime/JSGlobalObject.h:
733 2015-09-14 Saam barati <sbarati@apple.com>
735 rename callFrameForThrow to callFrameForCatch
736 https://bugs.webkit.org/show_bug.cgi?id=149136
738 Reviewed by Michael Saboff.
740 We use "callFrameForThrow" to mean the call frame in
741 which we're catching the exception. The field name
742 should accurately represent its purpose by being
743 named "callFrameForCatch".
745 * jit/CCallHelpers.h:
746 (JSC::CCallHelpers::jumpToExceptionHandler):
747 * jit/JITExceptions.cpp:
748 (JSC::genericUnwind):
749 * jit/JITOpcodes.cpp:
750 (JSC::JIT::emit_op_catch):
751 * jit/JITOpcodes32_64.cpp:
752 (JSC::JIT::emit_op_catch):
753 * jit/JITOperations.cpp:
754 * llint/LowLevelInterpreter32_64.asm:
755 * llint/LowLevelInterpreter64.asm:
757 (JSC::VM::exceptionOffset):
758 (JSC::VM::callFrameForCatchOffset):
759 (JSC::VM::targetMachinePCForThrowOffset):
760 (JSC::VM::callFrameForThrowOffset): Deleted.
762 2015-09-14 Basile Clement <basile_clement@apple.com>
764 [ES6] Implement tail calls in the LLInt and Baseline JIT
765 https://bugs.webkit.org/show_bug.cgi?id=148661
767 Reviewed by Filip Pizlo.
769 This patch introduces two new opcodes, op_tail_call and
770 op_tail_call_varargs, to perform tail calls, and implements them in the
771 LLInt and baseline JIT. Their use prevents DFG and FTL compilation for
772 now. They are currently implemented by sliding the call frame and
773 masquerading as our own caller right before performing an actual call.
775 This required to change the operationLink family of operation to return
776 a SlowPathReturnType instead of a char* in order to distinguish between
777 exception cases and actual call cases. We introduce a new FrameAction
778 enum that indicates whether to reuse (non-exceptional tail call) or
779 keep the current call frame (non-tail call, and exceptional cases).
781 This is also a semantics change, since the Function.caller property is
782 now leaking tail calls. Since tail calls are only used in strict mode,
783 which poisons this property, the only way of seeing this semantics
784 change is when a sloppy function calls a strict function that then
785 tail-calls a sloppy function. Previously, the second sloppy function's
786 caller would have been the strict function (i.e. raises a TypeError
787 when the .caller attribute is accessed), while it is now the first
788 sloppy function. Tests have been updated to reflect that.
790 This also changes the assumptions we make about call frames. In order
791 to be relatively efficient, we want to be able to compute the frame
792 size based only on the argument count, which was not possible
793 previously. To enable this, we now enforce at the bytecode generator,
794 DFG and FTL level that any space reserved for a call frame is
795 stack-aligned, which allows to easily compute its size when performing
796 a tail call. In all the "special call cases" (calls from native code,
797 inlined cache calls, etc.), we are starting the frame at the current
798 stack pointer and thus will always have a stack-aligned frame size.
800 Finally, this patch adds a couple of tests to check that tail calls run
801 in constant stack space, as well as tests checking that tail calls are
802 recognized correctly. Those tests use the handy aforementioned leaking
803 of tail calls through Function.caller to detect tail calls.
805 Given that this patch only implements tail calls for the LLInt and
806 Baseline JIT, tail calls are disabled by default. Until changes are
807 landed for all tiers, tail call testing and use requires the
808 --enableTailCalls=true or equivalent.
811 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
812 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
813 * JavaScriptCore.xcodeproj/project.pbxproj:
814 * assembler/AbortReason.h:
815 * assembler/AbstractMacroAssembler.h:
816 (JSC::AbstractMacroAssembler::Call::Call):
817 (JSC::AbstractMacroAssembler::repatchNearCall):
818 (JSC::AbstractMacroAssembler::repatchCompact):
819 * assembler/CodeLocation.h:
820 (JSC::CodeLocationNearCall::CodeLocationNearCall):
821 (JSC::CodeLocationNearCall::callMode):
822 (JSC::CodeLocationCommon::callAtOffset):
823 (JSC::CodeLocationCommon::nearCallAtOffset):
824 (JSC::CodeLocationCommon::dataLabelPtrAtOffset):
825 * assembler/LinkBuffer.h:
826 (JSC::LinkBuffer::locationOfNearCall):
827 (JSC::LinkBuffer::locationOf):
828 * assembler/MacroAssemblerARM.h:
829 (JSC::MacroAssemblerARM::nearCall):
830 (JSC::MacroAssemblerARM::nearTailCall):
831 (JSC::MacroAssemblerARM::call):
832 (JSC::MacroAssemblerARM::linkCall):
833 * assembler/MacroAssemblerARM64.h:
834 (JSC::MacroAssemblerARM64::nearCall):
835 (JSC::MacroAssemblerARM64::nearTailCall):
836 (JSC::MacroAssemblerARM64::ret):
837 (JSC::MacroAssemblerARM64::linkCall):
838 * assembler/MacroAssemblerARMv7.h:
839 (JSC::MacroAssemblerARMv7::nearCall):
840 (JSC::MacroAssemblerARMv7::nearTailCall):
841 (JSC::MacroAssemblerARMv7::call):
842 (JSC::MacroAssemblerARMv7::linkCall):
843 * assembler/MacroAssemblerMIPS.h:
844 (JSC::MacroAssemblerMIPS::nearCall):
845 (JSC::MacroAssemblerMIPS::nearTailCall):
846 (JSC::MacroAssemblerMIPS::call):
847 (JSC::MacroAssemblerMIPS::linkCall):
848 (JSC::MacroAssemblerMIPS::repatchCall):
849 * assembler/MacroAssemblerSH4.h:
850 (JSC::MacroAssemblerSH4::call):
851 (JSC::MacroAssemblerSH4::nearTailCall):
852 (JSC::MacroAssemblerSH4::nearCall):
853 (JSC::MacroAssemblerSH4::linkCall):
854 (JSC::MacroAssemblerSH4::repatchCall):
855 * assembler/MacroAssemblerX86.h:
856 (JSC::MacroAssemblerX86::linkCall):
857 * assembler/MacroAssemblerX86Common.h:
858 (JSC::MacroAssemblerX86Common::breakpoint):
859 (JSC::MacroAssemblerX86Common::nearTailCall):
860 (JSC::MacroAssemblerX86Common::nearCall):
861 * assembler/MacroAssemblerX86_64.h:
862 (JSC::MacroAssemblerX86_64::linkCall):
863 * bytecode/BytecodeList.json:
864 * bytecode/BytecodeUseDef.h:
865 (JSC::computeUsesForBytecodeOffset):
866 (JSC::computeDefsForBytecodeOffset):
867 * bytecode/CallLinkInfo.h:
868 (JSC::CallLinkInfo::callTypeFor):
869 (JSC::CallLinkInfo::isVarargsCallType):
870 (JSC::CallLinkInfo::CallLinkInfo):
871 (JSC::CallLinkInfo::specializationKind):
872 (JSC::CallLinkInfo::callModeFor):
873 (JSC::CallLinkInfo::callMode):
874 (JSC::CallLinkInfo::isTailCall):
875 (JSC::CallLinkInfo::isVarargs):
876 (JSC::CallLinkInfo::registerPreservationMode):
877 * bytecode/CallLinkStatus.cpp:
878 (JSC::CallLinkStatus::computeFromLLInt):
879 * bytecode/CallMode.cpp: Added.
880 (WTF::printInternal):
881 * bytecode/CallMode.h: Added.
882 * bytecode/CodeBlock.cpp:
883 (JSC::CodeBlock::dumpBytecode):
884 (JSC::CodeBlock::CodeBlock):
885 * bytecompiler/BytecodeGenerator.cpp:
886 (JSC::BytecodeGenerator::BytecodeGenerator):
887 (JSC::BytecodeGenerator::emitCallInTailPosition):
888 (JSC::BytecodeGenerator::emitCallEval):
889 (JSC::BytecodeGenerator::emitCall):
890 (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
891 (JSC::BytecodeGenerator::emitConstructVarargs):
892 * bytecompiler/NodesCodegen.cpp:
893 (JSC::CallArguments::CallArguments):
894 (JSC::LabelNode::emitBytecode):
895 * dfg/DFGByteCodeParser.cpp:
896 (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
897 * ftl/FTLLowerDFGToLLVM.cpp:
898 (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
899 * interpreter/Interpreter.h:
900 (JSC::Interpreter::isCallBytecode):
901 * jit/CCallHelpers.h:
902 (JSC::CCallHelpers::jumpToExceptionHandler):
903 (JSC::CCallHelpers::prepareForTailCallSlow):
905 (JSC::JIT::privateCompileMainPass):
906 (JSC::JIT::privateCompileSlowCases):
909 (JSC::JIT::compileOpCall):
910 (JSC::JIT::compileOpCallSlowCase):
911 (JSC::JIT::emit_op_call):
912 (JSC::JIT::emit_op_tail_call):
913 (JSC::JIT::emit_op_call_eval):
914 (JSC::JIT::emit_op_call_varargs):
915 (JSC::JIT::emit_op_tail_call_varargs):
916 (JSC::JIT::emit_op_construct_varargs):
917 (JSC::JIT::emitSlow_op_call):
918 (JSC::JIT::emitSlow_op_tail_call):
919 (JSC::JIT::emitSlow_op_call_eval):
920 (JSC::JIT::emitSlow_op_call_varargs):
921 (JSC::JIT::emitSlow_op_tail_call_varargs):
922 (JSC::JIT::emitSlow_op_construct_varargs):
923 * jit/JITCall32_64.cpp:
924 (JSC::JIT::emitSlow_op_call):
925 (JSC::JIT::emitSlow_op_tail_call):
926 (JSC::JIT::emitSlow_op_call_eval):
927 (JSC::JIT::emitSlow_op_call_varargs):
928 (JSC::JIT::emitSlow_op_tail_call_varargs):
929 (JSC::JIT::emitSlow_op_construct_varargs):
930 (JSC::JIT::emit_op_call):
931 (JSC::JIT::emit_op_tail_call):
932 (JSC::JIT::emit_op_call_eval):
933 (JSC::JIT::emit_op_call_varargs):
934 (JSC::JIT::emit_op_tail_call_varargs):
935 (JSC::JIT::emit_op_construct_varargs):
936 (JSC::JIT::compileOpCall):
937 (JSC::JIT::compileOpCallSlowCase):
939 (JSC::JIT::emitNakedCall):
940 (JSC::JIT::emitNakedTailCall):
941 (JSC::JIT::updateTopCallFrame):
942 * jit/JITOperations.cpp:
943 * jit/JITOperations.h:
945 (JSC::linkVirtualFor):
946 (JSC::linkPolymorphicCall):
947 * jit/ThunkGenerators.cpp:
948 (JSC::throwExceptionFromCallSlowPathGenerator):
950 (JSC::linkCallThunkGenerator):
951 (JSC::virtualThunkFor):
952 (JSC::arityFixupGenerator):
953 (JSC::unreachableGenerator):
954 (JSC::baselineGetterReturnThunkGenerator):
955 * jit/ThunkGenerators.h:
956 * llint/LowLevelInterpreter.asm:
957 * llint/LowLevelInterpreter32_64.asm:
958 * llint/LowLevelInterpreter64.asm:
959 * runtime/CommonSlowPaths.h:
960 (JSC::CommonSlowPaths::arityCheckFor):
961 (JSC::CommonSlowPaths::opIn):
963 * tests/stress/mutual-tail-call-no-stack-overflow.js: Added.
965 (sloppyCountdown.even):
966 (sloppyCountdown.odd):
967 (strictCountdown.even):
968 (strictCountdown.odd):
972 * tests/stress/tail-call-no-stack-overflow.js: Added.
975 (strictLoopArityFixup1):
976 (strictLoopArityFixup2):
977 * tests/stress/tail-call-recognize.js: Added.
979 (callerMustBeStrict):
981 * tests/stress/tail-call-varargs-no-stack-overflow.js: Added.
984 * tests/stress/tail-calls-dont-overwrite-live-stack.js: Added.
987 (obj.get fromNative):
990 2015-09-14 Filip Pizlo <fpizlo@apple.com>
992 LLInt get/put inline caches shouldn't use tons of opcodes
993 https://bugs.webkit.org/show_bug.cgi?id=149106
995 Reviewed by Geoffrey Garen.
997 Our LLInt get/put inline caches currently use separate opcodes to reduce branching. For
998 example, instead of having get_by_id branch on the kind of offset (inline or
999 out-of-line), we have two get_by_id instructions: get_by_id and get_by_id_out_of_line.
1000 But the problem with this approach is that it doesn't scale. In the property type
1001 inference work (https://bugs.webkit.org/show_bug.cgi?id=148610), we need each kind of put
1002 inline cache to support 11 different kinds of type checks. It seemed ridiculous to add 60
1003 new put_by_id opcodes (there are currently 6 variants of put_by_id, so after adding type
1004 checks, we'd have 6 * 11 = 66 variants of put_by_id).
1006 So, this patch completely changes the strategy to mostly using branching inside the
1007 opcode implementation. It's unlikely to have a performance effect. For example, the long
1008 road to generational GC caused a seemingly prohibitive regression in LLInt inline caches,
1009 and yet nobody noticed. The regression was because the inline cache was in terms of the
1010 structure, not the structure ID, so the code was doing a structure ID table lookup. If we
1011 didn't notice that, then we probably won't notice a couple new branches. (Also, this
1012 patch fixes that regression - the code no longer does such lookups except in the one
1013 unavoidable case in put_by_id transition chain checking.)
1015 This patch also turns the isDirect operand of put_by_id into a flags field. I will use
1016 this flags field to encode the desired type check in bug 148610.
1018 This patch has no effect on performance according to run-jsc-benchmarks.
1020 Relanding this patch with LLInt fixes for non-x86. Previous attempts to fix non-x86 LLInt
1021 build also caused every 64-bit test to crash on every platform. So the patch got rolled
1022 out. This fixes the non-x86 LLInt build while also ensuring that 64-bit platforms don't
1026 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1027 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1028 * JavaScriptCore.xcodeproj/project.pbxproj:
1029 * bytecode/BytecodeList.json:
1030 * bytecode/BytecodeUseDef.h:
1031 (JSC::computeUsesForBytecodeOffset):
1032 (JSC::computeDefsForBytecodeOffset):
1033 * bytecode/CodeBlock.cpp:
1034 (JSC::CodeBlock::printGetByIdOp):
1035 (JSC::CodeBlock::printGetByIdCacheStatus):
1036 (JSC::CodeBlock::printPutByIdCacheStatus):
1037 (JSC::CodeBlock::dumpBytecode):
1038 (JSC::CodeBlock::CodeBlock):
1039 (JSC::CodeBlock::propagateTransitions):
1040 (JSC::CodeBlock::finalizeLLIntInlineCaches):
1041 * bytecode/CodeBlock.h:
1042 * bytecode/GetByIdStatus.cpp:
1043 (JSC::GetByIdStatus::computeFromLLInt):
1044 * bytecode/Instruction.h:
1045 (JSC::Instruction::Instruction):
1046 * bytecode/PutByIdFlags.cpp: Added.
1047 (WTF::printInternal):
1048 * bytecode/PutByIdFlags.h: Added.
1049 * bytecode/PutByIdStatus.cpp:
1050 (JSC::PutByIdStatus::computeFromLLInt):
1051 * bytecode/UnlinkedCodeBlock.h:
1052 (JSC::UnlinkedInstruction::UnlinkedInstruction):
1053 * bytecompiler/BytecodeGenerator.cpp:
1054 (JSC::BytecodeGenerator::emitPutById):
1055 (JSC::BytecodeGenerator::emitDirectPutById):
1056 * dfg/DFGByteCodeParser.cpp:
1057 (JSC::DFG::ByteCodeParser::parseBlock):
1058 * dfg/DFGCapabilities.cpp:
1059 (JSC::DFG::capabilityLevel):
1061 (JSC::JIT::privateCompileMainPass):
1062 (JSC::JIT::privateCompileSlowCases):
1063 * jit/JITPropertyAccess.cpp:
1064 (JSC::JIT::emit_op_put_by_id):
1065 * jit/JITPropertyAccess32_64.cpp:
1066 (JSC::JIT::emit_op_put_by_id):
1067 * llint/LLIntSlowPaths.cpp:
1068 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1069 * llint/LowLevelInterpreter32_64.asm:
1070 * llint/LowLevelInterpreter64.asm:
1072 2015-09-14 Commit Queue <commit-queue@webkit.org>
1074 Unreviewed, rolling out r189751, r189752, and r189754.
1075 https://bugs.webkit.org/show_bug.cgi?id=149143
1077 caused crashes everywhere (Requested by alexchristensen on
1080 Reverted changesets:
1082 "LLInt get/put inline caches shouldn't use tons of opcodes"
1083 https://bugs.webkit.org/show_bug.cgi?id=149106
1084 http://trac.webkit.org/changeset/189751
1086 "Unreviewed, fix non-x86 LLInt build."
1087 http://trac.webkit.org/changeset/189752
1089 "Unreviewed, really fix non-x86 LLInt build without also
1090 breaking everything else."
1091 http://trac.webkit.org/changeset/189754
1093 2015-09-14 Filip Pizlo <fpizlo@apple.com>
1095 Unreviewed, really fix non-x86 LLInt build without also breaking everything else.
1097 * llint/LowLevelInterpreter64.asm:
1099 2015-09-14 Filip Pizlo <fpizlo@apple.com>
1101 Unreviewed, fix non-x86 LLInt build.
1103 * llint/LowLevelInterpreter64.asm:
1105 2015-09-13 Filip Pizlo <fpizlo@apple.com>
1107 LLInt get/put inline caches shouldn't use tons of opcodes
1108 https://bugs.webkit.org/show_bug.cgi?id=149106
1110 Reviewed by Geoffrey Garen.
1112 Our LLInt get/put inline caches currently use separate opcodes to reduce branching. For
1113 example, instead of having get_by_id branch on the kind of offset (inline or
1114 out-of-line), we have two get_by_id instructions: get_by_id and get_by_id_out_of_line.
1115 But the problem with this approach is that it doesn't scale. In the property type
1116 inference work (https://bugs.webkit.org/show_bug.cgi?id=148610), we need each kind of put
1117 inline cache to support 11 different kinds of type checks. It seemed ridiculous to add 60
1118 new put_by_id opcodes (there are currently 6 variants of put_by_id, so after adding type
1119 checks, we'd have 6 * 11 = 66 variants of put_by_id).
1121 So, this patch completely changes the strategy to mostly using branching inside the
1122 opcode implementation. It's unlikely to have a performance effect. For example, the long
1123 road to generational GC caused a seemingly prohibitive regression in LLInt inline caches,
1124 and yet nobody noticed. The regression was because the inline cache was in terms of the
1125 structure, not the structure ID, so the code was doing a structure ID table lookup. If we
1126 didn't notice that, then we probably won't notice a couple new branches. (Also, this
1127 patch fixes that regression - the code no longer does such lookups except in the one
1128 unavoidable case in put_by_id transition chain checking.)
1130 This patch also turns the isDirect operand of put_by_id into a flags field. I will use
1131 this flags field to encode the desired type check in bug 148610.
1133 This patch has no effect on performance according to run-jsc-benchmarks.
1136 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1137 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1138 * JavaScriptCore.xcodeproj/project.pbxproj:
1139 * bytecode/BytecodeList.json:
1140 * bytecode/BytecodeUseDef.h:
1141 (JSC::computeUsesForBytecodeOffset):
1142 (JSC::computeDefsForBytecodeOffset):
1143 * bytecode/CodeBlock.cpp:
1144 (JSC::CodeBlock::printGetByIdOp):
1145 (JSC::CodeBlock::printGetByIdCacheStatus):
1146 (JSC::CodeBlock::printPutByIdCacheStatus):
1147 (JSC::CodeBlock::dumpBytecode):
1148 (JSC::CodeBlock::CodeBlock):
1149 (JSC::CodeBlock::propagateTransitions):
1150 (JSC::CodeBlock::finalizeLLIntInlineCaches):
1151 * bytecode/CodeBlock.h:
1152 * bytecode/GetByIdStatus.cpp:
1153 (JSC::GetByIdStatus::computeFromLLInt):
1154 * bytecode/Instruction.h:
1155 (JSC::Instruction::Instruction):
1156 * bytecode/PutByIdFlags.cpp: Added.
1157 (WTF::printInternal):
1158 * bytecode/PutByIdFlags.h: Added.
1159 * bytecode/PutByIdStatus.cpp:
1160 (JSC::PutByIdStatus::computeFromLLInt):
1161 * bytecode/UnlinkedCodeBlock.h:
1162 (JSC::UnlinkedInstruction::UnlinkedInstruction):
1163 * bytecompiler/BytecodeGenerator.cpp:
1164 (JSC::BytecodeGenerator::emitPutById):
1165 (JSC::BytecodeGenerator::emitDirectPutById):
1166 * dfg/DFGAbstractInterpreterInlines.h:
1167 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1168 * dfg/DFGByteCodeParser.cpp:
1169 (JSC::DFG::ByteCodeParser::parseBlock):
1170 * dfg/DFGCapabilities.cpp:
1171 (JSC::DFG::capabilityLevel):
1173 (JSC::JIT::privateCompileMainPass):
1174 (JSC::JIT::privateCompileSlowCases):
1175 * jit/JITPropertyAccess.cpp:
1176 (JSC::JIT::emit_op_put_by_id):
1177 * jit/JITPropertyAccess32_64.cpp:
1178 (JSC::JIT::emit_op_put_by_id):
1179 * llint/LLIntSlowPaths.cpp:
1180 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1181 * llint/LowLevelInterpreter32_64.asm:
1182 * llint/LowLevelInterpreter64.asm:
1184 2015-09-14 Alex Christensen <achristensen@webkit.org>
1186 Progress towards CMake on Mac.
1187 https://bugs.webkit.org/show_bug.cgi?id=149123
1189 Reviewed by Chris Dumez.
1192 Make forwarding headers for the replay subdirectory.
1193 * PlatformMac.cmake:
1194 Make forwarding headers for the generated inspector headers.
1195 They should eventually either be packaged correctly with JavaScriptCore headers and included correctly.
1197 2015-09-14 Yusuke Suzuki <utatane.tea@gmail.com>
1199 [ES6] Cache the resolution result in JSModuleRecord
1200 https://bugs.webkit.org/show_bug.cgi?id=148896
1202 Reviewed by Saam Barati.
1204 The resolveExport operation is frequently called. For example,
1205 1. When instantiating the module environment, we call it for each exported name and imported
1207 2. When linking the imported module environment to the code block, we call it to resolve the
1209 3. When looking up the property from the namespace object, we call it to look up the original
1210 module for the imported binding.
1211 4. When creating the namespace object, we need to collect all the exported names from the module
1212 and need to resolve them by calling resolveExport.
1214 However, resolveExport takes some cost. It traces the imported modules and resolves the reference
1215 queried by the original module.
1217 The resolveExport operation is pure function; given a module record and an export name,
1218 it always returns the same result. So we cache resolution results in the module record to avoid
1219 repeated resolveExport calls with the same arguments.
1220 Here, we only cache the correctly resolved references, since,
1221 1. We rarely looked up the non-correctly-resolved ones. In the linking phase, attempting to
1222 resolve non-correctly-resolved ones throws a syntax error. So only namespace object creation
1223 phase does it in a syntax valid script.
1224 2. This strategy limits the size of the cache map. The number of the correctly exported bindings
1225 is defined by the modules' code. So the size does not become infinitely large.
1227 Currently, the all modules cannot be linked twice. For example,
1235 -> (C) -> (A) -> (B)
1237 We cannot test the behavior now because when executing the graph 2, (A) and (B) are already linked,
1238 it raises an error in the current loader spec. But it should be allowed[1] since it will occur when
1239 there is multiple module tag in WebCore.
1241 [1]: https://github.com/whatwg/loader/issues/41
1243 * runtime/JSModuleRecord.cpp:
1244 (JSC::JSModuleRecord::ResolveQuery::Hash::hash):
1245 (JSC::JSModuleRecord::ResolveQuery::Hash::equal):
1246 (JSC::JSModuleRecord::cacheResolution):
1247 (JSC::ResolveQueryHash::hash): Deleted.
1248 (JSC::ResolveQueryHash::equal): Deleted.
1249 (JSC::resolveExportLoop): Deleted.
1250 * runtime/JSModuleRecord.h:
1251 * tests/modules/caching-should-not-make-ambiguous.js: Added.
1252 * tests/modules/caching-should-not-make-ambiguous/A.js: Added.
1253 * tests/modules/caching-should-not-make-ambiguous/B.js: Added.
1254 * tests/modules/caching-should-not-make-ambiguous/C.js: Added.
1255 * tests/modules/caching-should-not-make-ambiguous/D.js: Added.
1256 * tests/modules/caching-should-not-make-ambiguous/main.js: Added.
1257 * tests/modules/different-view.js: Added.
1258 (from.string_appeared_here.shouldThrow):
1259 * tests/modules/different-view/A.js: Added.
1260 * tests/modules/different-view/B.js: Added.
1261 * tests/modules/different-view/C.js: Added.
1262 * tests/modules/different-view/D.js: Added.
1263 * tests/modules/different-view/E.js: Added.
1264 * tests/modules/different-view/main.js: Added.
1265 * tests/modules/fallback-ambiguous.js: Added.
1266 (from.string_appeared_here.shouldThrow):
1267 * tests/modules/fallback-ambiguous/A.js: Added.
1268 * tests/modules/fallback-ambiguous/B.js: Added.
1269 * tests/modules/fallback-ambiguous/C.js: Added.
1270 * tests/modules/fallback-ambiguous/D.js: Added.
1271 * tests/modules/fallback-ambiguous/E.js: Added.
1272 * tests/modules/fallback-ambiguous/main.js: Added.
1273 * tests/modules/self-star-link.js: Added.
1274 * tests/modules/self-star-link/A.js: Added.
1275 * tests/modules/self-star-link/B.js: Added.
1276 * tests/modules/self-star-link/C.js: Added.
1277 * tests/modules/self-star-link/D.js: Added.
1278 * tests/modules/self-star-link/E.js: Added.
1279 * tests/modules/uncacheable-when-see-star.js: Added.
1280 * tests/modules/uncacheable-when-see-star/A-pre.js: Added.
1281 * tests/modules/uncacheable-when-see-star/A.js: Added.
1282 * tests/modules/uncacheable-when-see-star/B.js: Added.
1283 * tests/modules/uncacheable-when-see-star/C.js: Added.
1284 * tests/modules/uncacheable-when-see-star/D.js: Added.
1285 * tests/modules/uncacheable-when-see-star/E-pre.js: Added.
1286 * tests/modules/uncacheable-when-see-star/E.js: Added.
1287 * tests/modules/uncacheable-when-see-star/main1.js: Added.
1288 * tests/modules/uncacheable-when-see-star/main2.js: Added.
1290 2015-09-14 Sukolsak Sakshuwong <sukolsak@gmail.com>
1292 Implement the arithmetic instructions for floats in WebAssembly
1293 https://bugs.webkit.org/show_bug.cgi?id=149102
1295 Reviewed by Geoffrey Garen.
1297 This patch implements the arithmetic instructions for floats (float32)
1298 in WebAssembly by converting the float operands to doubles, performing
1299 the equivalent double instructions, and converting the result back to
1300 float. The asm.js spec says that "As proved in 'When is double rounding
1301 innocuous?' (Figueroa 1995), both the 32- and 64-bit versions of
1302 standard arithmetic operations produce equivalent results when given
1303 32-bit inputs and coerced to 32-bit outputs."
1304 (http://asmjs.org/spec/latest/#floatish)
1306 This patch also pads WebAssembly call frames by maxFrameExtentForSlowPathCall,
1307 so that there is no need to adjust the stack pointer every time we make
1310 * tests/stress/wasm-arithmetic-float32.js:
1311 * tests/stress/wasm/arithmetic-float32.wasm:
1312 * wasm/WASMFunctionCompiler.h:
1313 (JSC::WASMFunctionCompiler::startFunction):
1314 (JSC::WASMFunctionCompiler::buildUnaryF32):
1315 (JSC::WASMFunctionCompiler::buildBinaryF32):
1316 (JSC::WASMFunctionCompiler::callOperation):
1317 (JSC::WASMFunctionCompiler::callAndUnboxResult):
1318 (JSC::WASMFunctionCompiler::endFunction): Deleted.
1319 (JSC::WASMFunctionCompiler::buildBinaryI32): Deleted.
1320 * wasm/WASMFunctionParser.cpp:
1321 (JSC::WASMFunctionParser::parseExpressionF32):
1322 (JSC::WASMFunctionParser::parseUnaryExpressionF32):
1323 (JSC::WASMFunctionParser::parseBinaryExpressionF32):
1324 * wasm/WASMFunctionParser.h:
1325 * wasm/WASMFunctionSyntaxChecker.h:
1326 (JSC::WASMFunctionSyntaxChecker::buildUnaryF32):
1327 (JSC::WASMFunctionSyntaxChecker::buildBinaryF32):
1329 2015-09-13 Geoffrey Garen <ggaren@apple.com>
1331 Eden GC should not try to jettison old CodeBlocks in the remembered set
1332 https://bugs.webkit.org/show_bug.cgi?id=149108
1334 Reviewed by Saam Barati.
1336 All we know about objects in the remembered set is that they must be
1337 visited. We don't know whether they're referenced or not because we
1338 won't mark the objects that point to them.
1340 Therefore, it's incorrect for a CodeBlock to consider jettisoning
1341 itself when it's marked as a part of the remembered set: Some
1342 old object might have visited the CodeBlock strongly if given the chance.
1344 I believe this doesn't cause any problems currently because we happen
1345 to visit all strong references to all CodeBlocks elligible for jettison
1348 However, this behavior is a logical oddity that tripped me up, and I
1349 believe it will start causing real problems once we start to jettison
1350 baseline CodeBlocks, since we do not visit all strong references to all
1351 baseline CodeBlocks during every GC.
1353 * heap/CodeBlockSet.cpp:
1354 (JSC::CodeBlockSet::clearMarksForEdenCollection):
1355 (JSC::CodeBlockSet::traceMarked): Be sure to visit the remembered set
1356 strongly, in order to prohibit jettisoning.
1358 (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
1359 * heap/CodeBlockSet.h: Track the remembered set during eden GCs.
1361 2015-09-11 Filip Pizlo <fpizlo@apple.com>
1363 REGRESSION(r189585): run-perf-tests Speedometer fails with a console error
1364 https://bugs.webkit.org/show_bug.cgi?id=149066
1366 Reviewed by Michael Saboff.
1368 The bug here was that the new IC code was calling actionForCell() more than once. That's
1369 illegal, since when actionForCell() returns RetryCacheLater, it means that it changed some
1370 object's Structure. The Repatch code was doing things like "if (actionForCell(blah) ==
1371 AttemptToCache)" in more than one place, so that if the first such expression was false, then
1372 we'd fall through to the next one. It's possible for the first call to return RetryCacheLater,
1373 in which case our view of the world just got clobbered and we need to return, and then the
1374 second call will probably return AttemptToCache because it *thinks* that we had bailed the last
1375 time and we're now in a future IC invocation.
1377 The solution is to cache the actionForCell() result. This is a bit tricky, because we need to
1378 do this after we check if we're in a proxy.
1380 Debugging bugs like these requires adding ad hoc bisection code in various places. We already
1381 had the basic hooks for this. This patch makes those hooks a bit more useful. In the case of
1382 the LLInt->JIT tier-up hooks, it adds a CodeBlock* argument so that we can bisect based on the
1383 CodeBlock. In the case of Repatch, it puts the Options::forceICFailure() check in a helper
1384 function that also takes ExecState*, which allows us to bisect on either CodeBlock or
1388 (JSC::actionForCell):
1389 (JSC::forceICFailure):
1390 (JSC::tryCacheGetByID):
1391 (JSC::tryCachePutByID):
1392 (JSC::tryRepatchIn):
1393 * llint/LLIntSlowPaths.cpp:
1394 (JSC::LLInt::shouldJIT):
1395 (JSC::LLInt::jitCompileAndSetHeuristics):
1396 (JSC::LLInt::entryOSR):
1397 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1398 * tests/stress/retry-cache-later.js:
1400 2015-09-11 Sukolsak Sakshuwong <sukolsak@gmail.com>
1402 Implement the relational instructions for floats in WebAssembly
1403 https://bugs.webkit.org/show_bug.cgi?id=149080
1405 Reviewed by Geoffrey Garen.
1407 This patch implements the relational instructions for floats (float32)
1408 in WebAssembly by converting float operands to doubles and then
1409 comparing them using the existing double comparison instructions in the
1412 * tests/stress/wasm-relational.js:
1413 * tests/stress/wasm/relational.wasm:
1414 * wasm/WASMFunctionCompiler.h:
1415 (JSC::WASMFunctionCompiler::buildRelationalF32):
1416 * wasm/WASMFunctionParser.cpp:
1417 (JSC::WASMFunctionParser::parseExpressionI32):
1418 (JSC::WASMFunctionParser::parseRelationalF32ExpressionI32):
1419 * wasm/WASMFunctionParser.h:
1420 * wasm/WASMFunctionSyntaxChecker.h:
1421 (JSC::WASMFunctionSyntaxChecker::buildRelationalF32):
1423 2015-09-11 Nan Wang <n_wang@apple.com>
1425 AX: ARIA 1.1 @aria-current
1426 https://bugs.webkit.org/show_bug.cgi?id=146012
1428 Reviewed by Chris Fleizach.
1430 Updated inspector to support aria-current.
1432 * inspector/protocol/DOM.json:
1434 2015-09-11 Sukolsak Sakshuwong <sukolsak@gmail.com>
1436 Add initial support for floats in WebAsssembly
1437 https://bugs.webkit.org/show_bug.cgi?id=149062
1439 Reviewed by Geoffrey Garen.
1441 Implement the ConstantPoolIndex, Immediate, GetLocal, and GetGlobal
1442 instructions for floats (float32) in WebAssembly.
1444 * tests/stress/wasm-arithmetic-float32.js: Added.
1446 * tests/stress/wasm-globals.js:
1447 * tests/stress/wasm-type-conversion.js:
1448 * tests/stress/wasm/arithmetic-float32.wasm: Added.
1449 * tests/stress/wasm/globals.wasm:
1450 * tests/stress/wasm/type-conversion.wasm:
1451 * wasm/WASMConstants.h:
1452 * wasm/WASMFunctionCompiler.h:
1453 (JSC::WASMFunctionCompiler::buildSetLocal):
1454 (JSC::WASMFunctionCompiler::buildReturn):
1455 (JSC::WASMFunctionCompiler::buildImmediateF32):
1456 (JSC::WASMFunctionCompiler::buildGetLocal):
1457 * wasm/WASMFunctionParser.cpp:
1458 (JSC::WASMFunctionParser::parseExpression):
1459 (JSC::WASMFunctionParser::parseExpressionF32):
1460 (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionF32):
1461 (JSC::WASMFunctionParser::parseImmediateExpressionF32):
1462 (JSC::WASMFunctionParser::parseGetLocalExpressionF32):
1463 (JSC::WASMFunctionParser::parseGetGlobalExpressionF32):
1464 * wasm/WASMFunctionParser.h:
1465 * wasm/WASMFunctionSyntaxChecker.h:
1466 (JSC::WASMFunctionSyntaxChecker::buildImmediateF32):
1467 * wasm/WASMReader.cpp:
1468 (JSC::WASMReader::readOpExpressionF32):
1469 * wasm/WASMReader.h:
1471 2015-09-11 Geoffrey Garen <ggaren@apple.com>
1473 Try to fix the CLOOP build.
1477 * bytecode/CodeBlock.cpp:
1478 (JSC::CodeBlock::finalizeBaselineJITInlineCaches):
1479 (JSC::CodeBlock::finalizeUnconditionally):
1481 2015-09-11 Csaba Osztrogonác <ossy@webkit.org>
1483 [EFL] Fix WASM build
1484 https://bugs.webkit.org/show_bug.cgi?id=149065
1486 Reviewed by Darin Adler.
1488 * wasm/WASMFunctionParser.cpp:
1490 2015-09-11 Geoffrey Garen <ggaren@apple.com>
1492 JavaScriptCore should discard optimized code after some time
1493 https://bugs.webkit.org/show_bug.cgi?id=149048
1495 Reviewed by Michael Saboff.
1497 This patch adds a new jettison type -- JettisonDueToOldAge -- and starts
1498 using it for DFG and FTL code. Baseline and LLInt code will come in a
1501 The primary goal is to save memory. Some popular websites leave about 10MB
1502 of dead code sitting around immediately after they finish loading.
1504 Throwing away code periodically might also save us from profiling
1505 pathologies that lead to performance dead ends.
1507 * bytecode/CodeBlock.cpp:
1508 (JSC::CodeBlock::visitAggregate): Updated for rename, and removed a
1511 (JSC::CodeBlock::shouldVisitStrongly): Renamed to shouldVisitStrongly
1512 because the practical effect of this function is to trigger a call to
1515 (JSC::CodeBlock::isKnownToBeLiveDuringGC): Check the
1516 m_visitStronglyHasBeenCalled flag instead of
1517 shouldImmediatelyAssumeLivenessDuringScan / shouldVisitStrongly because
1518 m_visitStronglyHasBeenCalled can be set by anybody even if the CodeBlock
1519 would not otherwise visit itself strongly.
1521 (JSC::CodeBlock::shouldJettisonDueToWeakReference): New helper function
1524 (JSC::CodeBlock::shouldJettisonDueToOldAge): New helper function that
1525 tells if a CodeBlock is old enough for deletion.
1527 (JSC::CodeBlock::determineLiveness): There's no need to check
1528 shouldImmediatelyAssumeLivenessDuringScan here because we will not call
1529 this function if shouldImmediatelyAssumeLivenessDuringScan is true.
1530 Also, it's just not clear -- if someone chooses to call this function --
1531 that it would be safe to ignore them simply because
1532 shouldImmediatelyAssumeLivenessDuringScan was true.
1534 (JSC::CodeBlock::finalizeLLIntInlineCaches): Moved code out into a helper
1535 function to make the main function more readable.
1537 (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Ditto.
1539 (JSC::CodeBlock::finalizeUnconditionally): Added code for jettisoning a
1540 CodeBlock if it is too old. Moved large sections of code into helper
1541 functions to aid readability in this function.
1543 (JSC::CodeBlock::jettison): Account for the fact that we might jettison
1544 a CodeBlock without OSR exit and without requiring a stack shoot-down.
1546 * bytecode/CodeBlock.h:
1547 (JSC::CodeBlock::setInstallTime):
1548 (JSC::CodeBlock::timeSinceInstall): Track CodeBlock age to help us
1549 decide when to delete.
1552 (JSC::JITCode::timeToLive): Static limits on CodeBlock lifetime. I got
1553 these numbers from the place where numbers come from.
1555 * profiler/ProfilerJettisonReason.cpp:
1556 (WTF::printInternal):
1557 * profiler/ProfilerJettisonReason.h: Updated for new jettison type.
1559 * runtime/Executable.cpp:
1560 (JSC::ScriptExecutable::installCode): Record install time so that we
1561 can measure how old a CodeBlock is.
1563 2015-09-11 Andreas Kling <akling@apple.com>
1565 [JSC] Weak should only accept cell pointees.
1566 <https://webkit.org/b/148955>
1568 Reviewed by Geoffrey Garen.
1570 Since WeakImpls only support pointing to JSCell derived objects,
1571 enforce that at compile time by having the API use JSCell* instead of JSValue.
1573 WeakHandleOwner callbacks now get JSCell& and JSCell*& respectively instead
1574 of wrapping the cell pointer in a Handle<Unknown>.
1576 Also added a static_assert so Weak<T> can't be instantiated with a T that's
1577 not convertible to JSCell.
1579 * API/JSAPIWrapperObject.mm:
1580 (JSAPIWrapperObjectHandleOwner::finalize):
1581 (JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots):
1582 (JSC::JSAPIWrapperObject::finishCreation):
1583 * API/JSManagedValue.mm:
1584 (JSManagedValueHandleOwner::isReachableFromOpaqueRoots):
1585 (JSManagedValueHandleOwner::finalize):
1586 * builtins/BuiltinExecutables.cpp:
1587 (JSC::BuiltinExecutables::finalize):
1588 * builtins/BuiltinExecutables.h:
1590 (JSC::Heap::addFinalizer):
1591 (JSC::Heap::FinalizerOwner::finalize):
1593 * heap/WeakBlock.cpp:
1594 (JSC::WeakBlock::visit):
1595 (JSC::WeakBlock::reap):
1596 * heap/WeakHandleOwner.cpp:
1597 (JSC::WeakHandleOwner::isReachableFromOpaqueRoots):
1598 (JSC::WeakHandleOwner::finalize):
1599 * heap/WeakHandleOwner.h:
1601 (JSC::WeakImpl::WeakImpl):
1602 (JSC::WeakImpl::state):
1603 (JSC::WeakImpl::cell):
1604 (JSC::WeakImpl::asWeakImpl):
1605 (JSC::WeakImpl::jsValue): Deleted.
1606 * heap/WeakInlines.h:
1607 (JSC::Weak<T>::Weak):
1609 (JSC::Weak<T>::operator):
1610 (JSC::Weak<T>::get):
1611 (JSC::Weak<T>::was):
1613 * heap/WeakSetInlines.h:
1614 (JSC::WeakSet::allocate):
1615 (JSC::WeakBlock::finalize):
1616 * jit/JITThunks.cpp:
1617 (JSC::JITThunks::finalize):
1620 (WTF::ElementHandleOwner::isReachableFromOpaqueRoots): Deleted.
1623 * runtime/RegExpCache.cpp:
1624 (JSC::RegExpCache::finalize):
1625 * runtime/RegExpCache.h:
1626 * runtime/Structure.cpp:
1627 (JSC::StructureTransitionTable::singleTransition):
1628 (JSC::StructureTransitionTable::setSingleTransition):
1630 2015-09-10 Sukolsak Sakshuwong <sukolsak@gmail.com>
1632 Implement switch statements in WebAssembly
1633 https://bugs.webkit.org/show_bug.cgi?id=149051
1635 Reviewed by Geoffrey Garen.
1637 This patch implements switch statements in WebAssembly using the
1638 JSC::BinarySwitch class.
1640 * tests/stress/wasm-control-flow.js:
1641 * tests/stress/wasm/control-flow.wasm:
1642 * wasm/WASMFunctionCompiler.h:
1643 (JSC::WASMFunctionCompiler::buildSwitch):
1644 * wasm/WASMFunctionParser.cpp:
1645 (JSC::WASMFunctionParser::parseSwitchStatement):
1646 * wasm/WASMFunctionSyntaxChecker.h:
1647 (JSC::WASMFunctionSyntaxChecker::buildSwitch):
1649 2015-09-10 Filip Pizlo <fpizlo@apple.com>
1651 Structure should be able to tell you if it had ever been a dictionary
1652 https://bugs.webkit.org/show_bug.cgi?id=149047
1654 Reviewed by Mark Lam.
1656 Introduces the hasBeenDictionary flag to Structure, which tells you if this structure or
1657 any of its ancestors is a dictionary. We already implicitly tracked this for DFG
1658 watchpoint optimizations, so this is mainly just decoupling that existing logic from
1659 watchpoints. Having Structure::hasBeenDictionary() enables some of the heuristics in the
1660 property type inference work (https://bugs.webkit.org/show_bug.cgi?id=148610).
1662 * runtime/Structure.cpp:
1663 (JSC::Structure::Structure):
1664 (JSC::Structure::toDictionaryTransition):
1665 (JSC::Structure::dump):
1666 * runtime/Structure.h:
1668 2015-09-10 Yusuke Suzuki <utatane.tea@gmail.com>
1670 Unreviewed, fix Windows file loading in JSC shell after r189583
1671 https://bugs.webkit.org/show_bug.cgi?id=148917
1673 Should load the script files with the binary mode.
1674 Since these loading functions are only used for the simple test scripts,
1675 we just use ftell / fseek now.
1678 (fillBufferWithContentsOfFile):
1680 2015-09-10 Michael Saboff <msaboff@apple.com>
1682 REGRESSION(r189575): Appears to break ARM64 linux builds
1683 https://bugs.webkit.org/show_bug.cgi?id=149044
1685 Reviewed by Filip Pizlo.
1687 Changed the use of the ARM64 "fp", a register alias, to be "x29", the real register name.
1689 * llint/LowLevelInterpreter.asm:
1691 2015-09-09 Filip Pizlo <fpizlo@apple.com>
1693 There should be one stub hanging off an inline cache that contains code for all of the cases, rather than forming a linked list consisting of one stub per case
1694 https://bugs.webkit.org/show_bug.cgi?id=148717
1696 Reviewed by Michael Saboff.
1698 This is a major rewrite of the JSC get/put/in inline caches (ICs), motivated by the need to add
1699 fancy new kinds of inline caches for property type inference (https://webkit.org/b/148610).
1701 Previously, our inline caches had some problems that made them difficult to work with. It was
1702 impossible to change any code that was previously generated by the IC except by blowing the
1703 whole IC away, the ICs scaled poorly if there were many cases, and there was a lot of duplicate
1706 Impossible to regenerate a previously generated stub: Say that some access (o.f = v) causes our
1707 IC code to emit some stub; let's call it stub1. Then later we find that we need to emit a
1708 different stub, stub2, where we think that stub2 might subsume stub1. We say that stub2
1709 subsumes stub1 if failing to execute stub2 to completion means that we are guaranteed to fail
1710 to execute stub1 to completion. This could happen in trunk if stub2 has the same base structure
1711 as stub1 but different prototype conditions. It could happen with property type inference if
1712 stub2 has a looser type check on v than stub1 did. Currently, if this happened, we would emit
1713 stub2 and have its slow path jump to stub1. Hence, we would still end up executing the checks
1714 of stub1 before falling through to the slow path. This gets bad when there are many stubs.
1715 Stub1 might be in front of a bunch of other stubs, so when we add stub2, we will end up
1716 executing both stub2's and stub1's checks before falling through to the other stubs. It would
1717 be better if we could remove stub1 from the list at this point. But since stub1 could be linked
1718 to from a different stub that we had already generated, we'd have to have a way of patching
1719 stubs or regenerating them from scratch. This is currenty impossible because we just don't keep
1720 around enough meta-data to mess with a stub after it's generated. After this change, we never
1721 link new stubs onto a linked list of pre-existing stubs; instead each IC will have one stub
1722 hanging off of it and we always regenerate that one stub from scratch. That one stub contains
1723 either a BinarySwitch or a branch cascade to select one of the AccessCases. Each AccessCase is
1724 an object that describes everything we need to regenerate it in the future. This means that
1725 when we add a new case to an IC stub, we can figure out which previous cases this one subsumes.
1727 Poor scalability when there are many cases: Previously, the cases of a polymorphic inline cache
1728 formed a linked list of branches. This meant that the complexity of an inline cache grew
1729 linearly with the number of cases. This change turns this into a BinarySwitch in most cases,
1730 leading to logarithmic scaling.
1732 Duplicate code between get, put, and in: The code for op_get_by_id, op_put_by_id, and op_in
1733 inline caches grew independently and ended up having a lot of duplicate code. We had the worst
1734 kinds of duplicate code. In some cases, the code was copy-pasted. In other cases, we wrote code
1735 that felt like it was new despite the fact that it was logically identical to code that was
1736 already written elsewhere. The main sources of duplication were in selecting a scratch
1737 register, checking all of the ObjectPropertyConditions and the base structure, the pro forma
1738 involved in generating a stub, and the data structures needed to describe all of the access
1739 cases. This change deduplicates all of that code. Now, all of those ICs use the same classes:
1740 the PolymorphicAccess and AccessCase. There is code in those classes that handles all of the
1741 common things, and for the most part the only code that actually specializes for the kind of
1742 access is in some switch statement in AccessCase::generate().
1744 Special-casing of array length and string length: Previously, array.length and string.length
1745 were handled in an ad hoc manner in the get_by_id repatching code. The handling was separate
1746 from the polymorphic get_by_id handling, which meant that we could not handle polymorphic
1747 length accesses if one of the length cases was either array or string length. For example, if
1748 you had "o.length" where the length was either array length or a vanilla length property, then
1749 the get_by_id inline cache would either emit a monomorphic stub for array length, or a
1750 monomorphic stub for the vanilla length property, but never a polymorphic stub (or list) that
1751 could do both. This change addresses this problem by folding array length and string length
1752 into the polymorphic get_by_id code.
1754 This was meant to be a perf-neutral change to enable property type inference, but it ended up
1755 being a 1% Octane speed-up, mainly because of a 14% speed-up in raytrace. This isn't too
1756 surprising, since that test does use inline caches a lot and this change makes inline caches
1759 This also fixes and adds a test for a BinarySwitch bug. BinarySwitch had an optimization for
1760 consecutive integer cases. Using it on typed array structures triggers this bug. It's a hard
1761 bug to trigger any other way because our other switch optimizations will usually use a jump
1762 table in case of consecutive integers.
1765 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1766 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1767 * JavaScriptCore.xcodeproj/project.pbxproj:
1768 * assembler/MacroAssemblerCodeRef.h:
1769 (JSC::MacroAssemblerCodePtr::dumpWithName):
1770 * bytecode/CodeBlock.cpp:
1771 (JSC::CodeBlock::printGetByIdCacheStatus):
1772 (JSC::CodeBlock::printPutByIdCacheStatus):
1773 (JSC::CodeBlock::propagateTransitions):
1774 (JSC::CodeBlock::getByValInfoMap):
1775 (JSC::CodeBlock::addStubInfo):
1776 (JSC::CodeBlock::findStubInfo):
1777 * bytecode/CodeBlock.h:
1778 (JSC::CodeBlock::stubInfoBegin):
1779 (JSC::CodeBlock::stubInfoEnd):
1780 * bytecode/GetByIdStatus.cpp:
1781 (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
1782 * bytecode/PolymorphicAccess.cpp: Copied from Source/JavaScriptCore/bytecode/PolymorphicGetByIdList.cpp.
1783 (JSC::AccessGenerationState::addWatchpoint):
1784 (JSC::AccessGenerationState::restoreScratch):
1785 (JSC::AccessGenerationState::succeed):
1786 (JSC::AccessCase::AccessCase):
1787 (JSC::AccessCase::get):
1788 (JSC::AccessCase::replace):
1789 (JSC::AccessCase::transition):
1790 (JSC::AccessCase::setter):
1791 (JSC::AccessCase::in):
1792 (JSC::AccessCase::getLength):
1793 (JSC::AccessCase::~AccessCase):
1794 (JSC::AccessCase::fromStructureStubInfo):
1795 (JSC::AccessCase::clone):
1796 (JSC::AccessCase::guardedByStructureCheck):
1797 (JSC::AccessCase::alternateBase):
1798 (JSC::AccessCase::canReplace):
1799 (JSC::AccessCase::dump):
1800 (JSC::AccessCase::visitWeak):
1801 (JSC::AccessCase::generateWithGuard):
1802 (JSC::AccessCase::generate):
1803 (JSC::PolymorphicAccess::PolymorphicAccess):
1804 (JSC::PolymorphicAccess::~PolymorphicAccess):
1805 (JSC::PolymorphicAccess::regenerateWithCases):
1806 (JSC::PolymorphicAccess::regenerateWithCase):
1807 (JSC::PolymorphicAccess::visitWeak):
1808 (JSC::PolymorphicAccess::dump):
1809 (JSC::PolymorphicAccess::regenerate):
1810 (WTF::printInternal):
1811 (JSC::GetByIdAccess::GetByIdAccess): Deleted.
1812 (JSC::GetByIdAccess::~GetByIdAccess): Deleted.
1813 (JSC::GetByIdAccess::fromStructureStubInfo): Deleted.
1814 (JSC::GetByIdAccess::visitWeak): Deleted.
1815 (JSC::PolymorphicGetByIdList::PolymorphicGetByIdList): Deleted.
1816 (JSC::PolymorphicGetByIdList::from): Deleted.
1817 (JSC::PolymorphicGetByIdList::~PolymorphicGetByIdList): Deleted.
1818 (JSC::PolymorphicGetByIdList::currentSlowPathTarget): Deleted.
1819 (JSC::PolymorphicGetByIdList::addAccess): Deleted.
1820 (JSC::PolymorphicGetByIdList::isFull): Deleted.
1821 (JSC::PolymorphicGetByIdList::isAlmostFull): Deleted.
1822 (JSC::PolymorphicGetByIdList::didSelfPatching): Deleted.
1823 (JSC::PolymorphicGetByIdList::visitWeak): Deleted.
1824 * bytecode/PolymorphicAccess.h: Copied from Source/JavaScriptCore/bytecode/PolymorphicGetByIdList.h.
1825 (JSC::AccessCase::isGet):
1826 (JSC::AccessCase::isPut):
1827 (JSC::AccessCase::isIn):
1828 (JSC::AccessCase::type):
1829 (JSC::AccessCase::offset):
1830 (JSC::AccessCase::viaProxy):
1831 (JSC::AccessCase::structure):
1832 (JSC::AccessCase::newStructure):
1833 (JSC::AccessCase::conditionSet):
1834 (JSC::AccessCase::additionalSet):
1835 (JSC::AccessCase::customSlotBase):
1836 (JSC::AccessCase::doesCalls):
1837 (JSC::AccessCase::callLinkInfo):
1838 (JSC::AccessCase::RareData::RareData):
1839 (JSC::PolymorphicAccess::isEmpty):
1840 (JSC::PolymorphicAccess::size):
1841 (JSC::PolymorphicAccess::at):
1842 (JSC::PolymorphicAccess::operator[]):
1843 (JSC::GetByIdAccess::GetByIdAccess): Deleted.
1844 (JSC::GetByIdAccess::isSet): Deleted.
1845 (JSC::GetByIdAccess::operator!): Deleted.
1846 (JSC::GetByIdAccess::type): Deleted.
1847 (JSC::GetByIdAccess::structure): Deleted.
1848 (JSC::GetByIdAccess::conditionSet): Deleted.
1849 (JSC::GetByIdAccess::stubRoutine): Deleted.
1850 (JSC::GetByIdAccess::doesCalls): Deleted.
1851 (JSC::PolymorphicGetByIdList::isEmpty): Deleted.
1852 (JSC::PolymorphicGetByIdList::size): Deleted.
1853 (JSC::PolymorphicGetByIdList::at): Deleted.
1854 (JSC::PolymorphicGetByIdList::operator[]): Deleted.
1855 * bytecode/PolymorphicAccessStructureList.h: Removed.
1856 * bytecode/PolymorphicGetByIdList.cpp: Removed.
1857 * bytecode/PolymorphicGetByIdList.h: Removed.
1858 * bytecode/PolymorphicPutByIdList.cpp: Removed.
1859 * bytecode/PolymorphicPutByIdList.h: Removed.
1860 * bytecode/PutByIdStatus.cpp:
1861 (JSC::PutByIdStatus::computeForStubInfo):
1862 * bytecode/StructureStubInfo.cpp:
1863 (JSC::StructureStubInfo::deref):
1864 (JSC::StructureStubInfo::addAccessCase):
1865 (JSC::StructureStubInfo::reset):
1866 (JSC::StructureStubInfo::visitWeakReferences):
1867 * bytecode/StructureStubInfo.h:
1868 (JSC::StructureStubInfo::StructureStubInfo):
1869 (JSC::StructureStubInfo::initGetByIdSelf):
1870 (JSC::StructureStubInfo::initPutByIdReplace):
1871 (JSC::StructureStubInfo::initStub):
1872 (JSC::StructureStubInfo::setSeen):
1873 (JSC::getStructureStubInfoCodeOrigin):
1874 (JSC::isGetByIdAccess): Deleted.
1875 (JSC::isPutByIdAccess): Deleted.
1876 (JSC::isInAccess): Deleted.
1877 (JSC::StructureStubInfo::initGetByIdList): Deleted.
1878 (JSC::StructureStubInfo::initPutByIdTransition): Deleted.
1879 (JSC::StructureStubInfo::initPutByIdList): Deleted.
1880 (JSC::StructureStubInfo::initInList): Deleted.
1881 (JSC::StructureStubInfo::addWatchpoint): Deleted.
1882 * dfg/DFGSpeculativeJIT.cpp:
1883 (JSC::DFG::SpeculativeJIT::compileIn):
1884 * ftl/FTLCompile.cpp:
1885 (JSC::FTL::mmAllocateDataSection):
1886 * jit/AccessorCallJITStubRoutine.cpp: Removed.
1887 * jit/AccessorCallJITStubRoutine.h: Removed.
1888 * jit/AssemblyHelpers.h:
1889 (JSC::AssemblyHelpers::branchIfEmpty):
1890 (JSC::AssemblyHelpers::branchStructure):
1891 (JSC::AssemblyHelpers::boxBooleanPayload):
1892 (JSC::AssemblyHelpers::boxBoolean):
1893 (JSC::AssemblyHelpers::boxInt32):
1894 * jit/BinarySwitch.cpp:
1895 (JSC::BinarySwitch::BinarySwitch):
1896 (JSC::BinarySwitch::build):
1897 (JSC::BinarySwitch::Case::dump):
1898 (JSC::BinarySwitch::BranchCode::dump):
1899 * jit/BinarySwitch.h:
1900 (JSC::BinarySwitch::Case::operator<):
1901 (JSC::BinarySwitch::BranchCode::BranchCode):
1903 * jit/JITInlineCacheGenerator.cpp:
1904 (JSC::garbageStubInfo):
1905 (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
1906 (JSC::JITByIdGenerator::JITByIdGenerator):
1907 (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
1908 (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
1909 * jit/JITInlineCacheGenerator.h:
1910 (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
1911 (JSC::JITInlineCacheGenerator::stubInfo):
1912 (JSC::JITByIdGenerator::JITByIdGenerator):
1913 (JSC::JITByIdGenerator::reportSlowPathCall):
1914 * jit/JITOperations.cpp:
1917 (JSC::repatchByIdSelfAccess):
1918 (JSC::resetGetByIDCheckAndLoad):
1919 (JSC::resetPutByIDCheckAndLoad):
1920 (JSC::replaceWithJump):
1921 (JSC::tryCacheGetByID):
1922 (JSC::repatchGetByID):
1923 (JSC::appropriateGenericPutByIdFunction):
1924 (JSC::appropriateOptimizingPutByIdFunction):
1925 (JSC::tryCachePutByID):
1926 (JSC::repatchPutByID):
1927 (JSC::tryRepatchIn):
1929 (JSC::resetGetByID):
1930 (JSC::resetPutByID):
1931 (JSC::checkObjectPropertyCondition): Deleted.
1932 (JSC::checkObjectPropertyConditions): Deleted.
1933 (JSC::emitRestoreScratch): Deleted.
1934 (JSC::linkRestoreScratch): Deleted.
1935 (JSC::toString): Deleted.
1936 (JSC::kindFor): Deleted.
1937 (JSC::customFor): Deleted.
1938 (JSC::generateByIdStub): Deleted.
1939 (JSC::patchJumpToGetByIdStub): Deleted.
1940 (JSC::tryBuildGetByIDList): Deleted.
1941 (JSC::buildGetByIDList): Deleted.
1942 (JSC::appropriateListBuildingPutByIdFunction): Deleted.
1943 (JSC::emitPutReplaceStub): Deleted.
1944 (JSC::emitPutTransitionStub): Deleted.
1945 (JSC::tryBuildPutByIdList): Deleted.
1946 (JSC::buildPutByIdList): Deleted.
1947 * jit/ScratchRegisterAllocator.cpp:
1948 (JSC::ScratchRegisterAllocator::lock):
1949 (JSC::ScratchRegisterAllocator::allocateScratch):
1950 * jit/ScratchRegisterAllocator.h:
1951 (JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
1953 (GlobalObject::finishCreation):
1958 * runtime/Options.h:
1959 * tests/stress/array-message-passing.js: Added.
1960 (window.addEventListener):
1961 (window.postMessage):
1962 (window._handleEvents):
1968 (typedArrayCompare):
1974 (createTypedArrayOverBuffer):
1976 (testList.testList.concat.basicBufferTypes.map):
1979 2015-09-10 Geoffrey Garen <ggaren@apple.com>
1981 CodeBlock::codeType() doesn't need to compute anything
1982 https://bugs.webkit.org/show_bug.cgi?id=149039
1984 Reviewed by Michael Saboff.
1986 CodeBlock already has an m_codeType data member.
1988 * bytecode/CodeBlock.h:
1989 (JSC::CodeBlock::codeType):
1990 (JSC::CodeBlock::putByIdContext):
1992 2015-09-10 Sukolsak Sakshuwong <sukolsak@gmail.com>
1994 Implement global variables in WebAssembly
1995 https://bugs.webkit.org/show_bug.cgi?id=149031
1997 Reviewed by Geoffrey Garen.
1999 This patch implements global variables in WebAssembly. There are two
2000 types of global variables in the current format that we use (the format
2001 used by <https://github.com/WebAssembly/polyfill-prototype-1>): internal
2002 global variables and imported global variables. This patch does not yet
2003 import values for imported global variables. It will be done in a
2006 * tests/stress/wasm-globals.js: Added.
2008 * tests/stress/wasm/globals.wasm: Added.
2009 * wasm/JSWASMModule.h:
2010 (JSC::JSWASMModule::globalVariables):
2011 * wasm/WASMFunctionCompiler.h:
2012 (JSC::WASMFunctionCompiler::buildSetGlobal):
2013 (JSC::WASMFunctionCompiler::buildGetGlobal):
2014 * wasm/WASMFunctionParser.cpp:
2015 (JSC::WASMFunctionParser::parseStatement):
2016 (JSC::WASMFunctionParser::parseSetGlobalStatement):
2017 (JSC::WASMFunctionParser::parseExpressionI32):
2018 (JSC::WASMFunctionParser::parseGetGlobalExpressionI32):
2019 (JSC::WASMFunctionParser::parseExpressionF64):
2020 (JSC::WASMFunctionParser::parseGetGlobalExpressionF64):
2021 * wasm/WASMFunctionParser.h:
2022 * wasm/WASMFunctionSyntaxChecker.h:
2023 (JSC::WASMFunctionSyntaxChecker::buildSetGlobal):
2024 (JSC::WASMFunctionSyntaxChecker::buildGetGlobal):
2025 * wasm/WASMModuleParser.cpp:
2026 (JSC::WASMModuleParser::parseGlobalSection):
2028 2015-09-10 Yusuke Suzuki <utatane.tea@gmail.com>
2030 Consider long module path name case in Windows
2031 https://bugs.webkit.org/show_bug.cgi?id=148917
2033 Reviewed by Alex Christensen.
2035 The local file system module loader in the JSC shell manages the module files by the absolute path.
2036 However, in Windows, _MAX_PATH is defined as 260. So if the path like the current working directory or the path to the module is long,
2037 it will be truncated by the API and it fail to open the file.
2038 In JSC tests in Apple Windows buildbot, since the current working directory is long enough, the tests failed.
2040 This patch introduces the following 3 tweaks.
2042 1. When retrieving the current working path, we use GetCurrentDirectoryW instead of _getcwd.
2043 GetCurrentDirectoryW allows the long path while _getcwd automatically truncate the result by the _MAX_PATH.
2045 2. Before opening the module file, we prepend "\\?\" to the path. It converts the local file path to the long UNC path
2046 which allows longer path names.
2048 3. Since Windows ASCII API accepts the characters in the current code page, we use the Unicode APIs like _wfopen instead.
2050 And enable the once disabled module tests in Windows.
2052 Since this functionality is the part of the JSC shell to run the module tests, it is now implemented in jsc.cpp.
2057 (extractDirectoryName):
2058 (currentWorkingDirectory):
2059 (convertShebangToJSComment):
2060 (fillBufferWithContentsOfFile):
2061 (fetchScriptFromLocalFileSystem):
2062 (fetchModuleFromLocalFileSystem):
2063 (GlobalObject::moduleLoaderFetch):
2067 (functionCheckSyntax):
2068 (functionLoadModule):
2071 * tests/modules.yaml:
2073 2015-09-10 Sukolsak Sakshuwong <sukolsak@gmail.com>
2075 Convert arguments to WebAssembly functions to the declared types
2076 https://bugs.webkit.org/show_bug.cgi?id=149033
2078 Reviewed by Geoffrey Garen.
2080 This patch checks the types of arguments to WebAssembly functions and
2081 converts them to the declared types. This is necessary because:
2082 - For example, if a function expects an argument of type double and we
2083 pass 1.0 to it, it will get a JSValue of an integer, not a double.
2084 - We should follow asm.js's behavior for now, because we want to be able
2085 to test WebAssembly apps against asm.js apps. asm.js does type
2086 coercion on arguments by using int|0, Math.fround(float), and +double.
2088 * jit/JITOperations.h:
2089 * tests/stress/wasm-type-conversion.js: Added.
2092 * tests/stress/wasm/type-conversion.wasm: Added.
2093 * wasm/WASMFunctionCompiler.h:
2094 (JSC::operationConvertJSValueToInt32):
2095 (JSC::operationConvertJSValueToDouble):
2096 (JSC::WASMFunctionCompiler::startFunction):
2097 (JSC::WASMFunctionCompiler::appendCallSetResult):
2098 (JSC::WASMFunctionCompiler::callOperation):
2099 (JSC::WASMFunctionCompiler::loadValueAndConvertToInt32):
2100 (JSC::WASMFunctionCompiler::loadValueAndConvertToDouble):
2102 2015-09-10 Yusuke Suzuki <utatane.tea@gmail.com>
2104 JSInternalPromiseDeferred should inherit JSPromiseDeferred
2105 https://bugs.webkit.org/show_bug.cgi?id=149027
2107 Reviewed by Darin Adler.
2109 JSInternalPromiseDeferred is constructed by using JSPromiseDeferred implementation.
2110 So the class info of JSInternalPromiseDeferred should inherit JSPromiseDeferred.
2112 * runtime/JSInternalPromiseDeferred.cpp:
2114 2015-09-10 Michael Saboff <msaboff@apple.com>
2116 Add support for Callee-Saves registers
2117 https://bugs.webkit.org/show_bug.cgi?id=148666
2119 Reviewed by Filip Pizlo.
2121 We save platform callee save registers right below the call frame header,
2122 in the location(s) starting with VirtualRegister 0. This local space is
2123 allocated in the bytecode compiler. This space is the maximum space
2124 needed for the callee registers that the LLInt and baseline JIT use,
2125 rounded up to a stack aligned number of VirtualRegisters.
2126 The LLInt explicitly saves and restores the registers in the macros
2127 preserveCalleeSavesUsedByLLInt and restoreCalleeSavesUsedByLLInt.
2128 The JITs saves and restores callee saves registers by what registers
2129 are included in m_calleeSaveRegisters in the code block.
2131 Added handling of callee save register restoration to exception handling.
2132 The basic flow is when an exception is thrown or one is recognized to
2133 have been generated in C++ code, we save the current state of all
2134 callee save registers to VM::calleeSaveRegistersBuffer. As we unwind
2135 looking for the corresponding catch, we copy the callee saves from call
2136 frames to the same VM::calleeSaveRegistersBuffer. This is done for all
2137 call frames on the stack up to but not including the call frame that has
2138 the corresponding catch block. When we process the catch, we restore
2139 the callee save registers with the contents of VM::calleeSaveRegistersBuffer.
2140 If there isn't a catch, then handleUncaughtException will restore callee
2141 saves before it returns back to the calling C++.
2143 Eliminated callee saves registers as free registers for various thunk
2144 generators as the callee saves may not have been saved by the function
2147 Added code to transition callee saves from one VM's format to the another
2148 as part of OSR entry and OSR exit.
2150 Cleaned up the static RegisterSet's including adding one for LLInt and
2151 baseline JIT callee saves and one to be used to allocate local registers
2152 not including the callee saves or other special registers.
2154 Moved ftl/FTLRegisterAtOffset.{cpp,h} to jit/RegisterAtOffset.{cpp,h}.
2155 Factored out the vector of RegisterAtOffsets in ftl/FTLUnwindInfo.{cpp,h}
2156 into a new class in jit/RegisterAtOffsetList.{cpp,h}.
2157 Eliminted UnwindInfo and changed UnwindInfo::parse() into a standalone
2158 function named parseUnwindInfo. That standalone function now returns
2159 the callee saves RegisterAtOffsetList. This is stored in the CodeBlock
2160 and used instead of UnwindInfo.
2162 Turned off register preservation thunks for outgoing calls from FTL
2163 generated code. THey'll be removed in a subsequent patch.
2165 Changed specialized thinks to save and restore the contents of
2166 tagTypeNumberRegister and tagMaskRegister as they can be called by FTL
2167 compiled functions. We materialize those tag registers for the thunk's
2168 use and then restore the prior contents on function exit.
2170 Also removed the arity check fail return thunk since it is now the
2171 caller's responsibility to restore the stack pointer.
2173 Removed saving of callee save registers and materialization of special
2174 tag registers for 64 bit platforms from vmEntryToJavaScript and
2178 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2179 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2180 * JavaScriptCore.xcodeproj/project.pbxproj:
2182 * ftl/FTLRegisterAtOffset.cpp: Removed.
2183 * ftl/FTLRegisterAtOffset.h: Removed.
2184 * ftl/FTLUnwindInfo.cpp:
2185 (JSC::FTL::parseUnwindInfo):
2186 (JSC::FTL::UnwindInfo::UnwindInfo): Deleted.
2187 (JSC::FTL::UnwindInfo::~UnwindInfo): Deleted.
2188 (JSC::FTL::UnwindInfo::parse): Deleted.
2189 (JSC::FTL::UnwindInfo::dump): Deleted.
2190 (JSC::FTL::UnwindInfo::find): Deleted.
2191 (JSC::FTL::UnwindInfo::indexOf): Deleted.
2192 * ftl/FTLUnwindInfo.h:
2193 (JSC::RegisterAtOffset::dump):
2194 * jit/RegisterAtOffset.cpp: Added.
2195 * jit/RegisterAtOffset.h: Added.
2196 (JSC::RegisterAtOffset::RegisterAtOffset):
2197 (JSC::RegisterAtOffset::operator!):
2198 (JSC::RegisterAtOffset::reg):
2199 (JSC::RegisterAtOffset::offset):
2200 (JSC::RegisterAtOffset::offsetAsIndex):
2201 (JSC::RegisterAtOffset::operator==):
2202 (JSC::RegisterAtOffset::operator<):
2203 (JSC::RegisterAtOffset::getReg):
2204 * jit/RegisterAtOffsetList.cpp: Added.
2205 (JSC::RegisterAtOffsetList::RegisterAtOffsetList):
2206 (JSC::RegisterAtOffsetList::sort):
2207 (JSC::RegisterAtOffsetList::dump):
2208 (JSC::RegisterAtOffsetList::find):
2209 (JSC::RegisterAtOffsetList::indexOf):
2210 * jit/RegisterAtOffsetList.h: Added.
2211 (JSC::RegisterAtOffsetList::clear):
2212 (JSC::RegisterAtOffsetList::size):
2213 (JSC::RegisterAtOffsetList::at):
2214 (JSC::RegisterAtOffsetList::append):
2215 Move and refactored use of FTLRegisterAtOffset to RegisterAtOffset.
2216 Added RegisterAtOffset and RegisterAtOffsetList to build configurations.
2217 Remove FTLRegisterAtOffset files.
2219 * bytecode/CallLinkInfo.h:
2220 (JSC::CallLinkInfo::setUpCallFromFTL):
2221 Turned off FTL register preservation thunks.
2223 * bytecode/CodeBlock.cpp:
2224 (JSC::CodeBlock::CodeBlock):
2225 (JSC::CodeBlock::setCalleeSaveRegisters):
2226 (JSC::roundCalleeSaveSpaceAsVirtualRegisters):
2227 (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters):
2228 (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters):
2229 * bytecode/CodeBlock.h:
2230 (JSC::CodeBlock::numberOfLLIntBaselineCalleeSaveRegisters):
2231 (JSC::CodeBlock::calleeSaveRegisters):
2232 (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters):
2233 (JSC::CodeBlock::optimizeAfterWarmUp):
2234 (JSC::CodeBlock::numberOfDFGCompiles):
2235 Methods to manage a set of callee save registers. Also to allocate the appropriate
2236 number of VirtualRegisters for callee saves.
2238 * bytecompiler/BytecodeGenerator.cpp:
2239 (JSC::BytecodeGenerator::BytecodeGenerator):
2240 (JSC::BytecodeGenerator::allocateCalleeSaveSpace):
2241 * bytecompiler/BytecodeGenerator.h:
2242 Allocate the appropriate number of VirtualRegisters for callee saves needed by LLInt or baseline JIT.
2244 * dfg/DFGJITCompiler.cpp:
2245 (JSC::DFG::JITCompiler::compileEntry):
2246 (JSC::DFG::JITCompiler::compileSetupRegistersForEntry):
2247 (JSC::DFG::JITCompiler::compileBody):
2248 (JSC::DFG::JITCompiler::compileExceptionHandlers):
2249 (JSC::DFG::JITCompiler::compile):
2250 (JSC::DFG::JITCompiler::compileFunction):
2251 * dfg/DFGJITCompiler.h:
2252 * interpreter/Interpreter.cpp:
2253 (JSC::UnwindFunctor::operator()):
2254 (JSC::UnwindFunctor::copyCalleeSavesToVMCalleeSavesBuffer):
2256 (JSC::DFG::Plan::compileInThreadImpl):
2257 * dfg/DFGSpeculativeJIT.cpp:
2258 (JSC::DFG::SpeculativeJIT::usedRegisters):
2259 * dfg/DFGSpeculativeJIT32_64.cpp:
2260 (JSC::DFG::SpeculativeJIT::compile):
2261 * dfg/DFGSpeculativeJIT64.cpp:
2262 (JSC::DFG::SpeculativeJIT::compile):
2263 * dfg/DFGStackLayoutPhase.cpp:
2264 (JSC::DFG::StackLayoutPhase::run):
2265 * ftl/FTLCompile.cpp:
2266 (JSC::FTL::fixFunctionBasedOnStackMaps):
2267 (JSC::FTL::compile):
2270 * ftl/FTLOSRExitCompiler.cpp:
2271 (JSC::FTL::compileStub):
2272 * ftl/FTLThunks.cpp:
2273 (JSC::FTL::osrExitGenerationThunkGenerator):
2274 * jit/ArityCheckFailReturnThunks.cpp: Removed.
2275 * jit/ArityCheckFailReturnThunks.h: Removed.
2277 (JSC::JIT::emitEnterOptimizationCheck):
2278 (JSC::JIT::privateCompile):
2279 (JSC::JIT::privateCompileExceptionHandlers):
2280 * jit/JITCall32_64.cpp:
2281 (JSC::JIT::emit_op_ret):
2282 * jit/JITExceptions.cpp:
2283 (JSC::genericUnwind):
2284 * jit/JITExceptions.h:
2285 * jit/JITOpcodes.cpp:
2286 (JSC::JIT::emit_op_end):
2287 (JSC::JIT::emit_op_ret):
2288 (JSC::JIT::emit_op_throw):
2289 (JSC::JIT::emit_op_catch):
2290 (JSC::JIT::emit_op_enter):
2291 (JSC::JIT::emitSlow_op_loop_hint):
2292 * jit/JITOpcodes32_64.cpp:
2293 (JSC::JIT::emit_op_end):
2294 (JSC::JIT::emit_op_throw):
2295 (JSC::JIT::emit_op_catch):
2296 * jit/JITOperations.cpp:
2298 (JSC::generateByIdStub):
2299 * jit/ThunkGenerators.cpp:
2300 * llint/LLIntData.cpp:
2301 (JSC::LLInt::Data::performAssertions):
2302 * llint/LLIntSlowPaths.cpp:
2303 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2304 * llint/LowLevelInterpreter.asm:
2305 * llint/LowLevelInterpreter32_64.asm:
2306 * llint/LowLevelInterpreter64.asm:
2307 (JSC::throwExceptionFromCallSlowPathGenerator):
2308 (JSC::arityFixupGenerator):
2309 * runtime/CommonSlowPaths.cpp:
2310 (JSC::setupArityCheckData):
2311 * runtime/CommonSlowPaths.h:
2312 (JSC::CommonSlowPaths::arityCheckFor):
2313 Emit code to save and restore callee save registers and materialize tagTypeNumberRegister
2314 and tagMaskRegister.
2315 Handle callee saves when tiering up.
2316 Copy callee saves register contents to VM::calleeSaveRegistersBuffer at beginning of
2317 exception processing.
2318 Process callee save registers in frames when unwinding from an exception.
2319 Restore callee saves register contents from VM::calleeSaveRegistersBuffer on catch.
2320 Use appropriate register set to make sure we don't allocate a callee save register when
2322 Helper to populate tagTypeNumberRegister and tagMaskRegister with the appropriate
2324 Removed arity fixup return thunks.
2326 * dfg/DFGOSREntry.cpp:
2327 (JSC::DFG::prepareOSREntry):
2328 * dfg/DFGOSRExitCompiler32_64.cpp:
2329 (JSC::DFG::OSRExitCompiler::compileExit):
2330 * dfg/DFGOSRExitCompiler64.cpp:
2331 (JSC::DFG::OSRExitCompiler::compileExit):
2332 * dfg/DFGOSRExitCompilerCommon.cpp:
2333 (JSC::DFG::reifyInlinedCallFrames):
2334 (JSC::DFG::adjustAndJumpToTarget):
2335 Restore callee saves from the DFG and save the appropriate ones for the baseline JIT.
2336 Materialize the tag registers on 64 bit platforms.
2338 * jit/AssemblyHelpers.h:
2339 (JSC::AssemblyHelpers::emitSaveCalleeSavesFor):
2340 (JSC::AssemblyHelpers::emitRestoreCalleeSavesFor):
2341 (JSC::AssemblyHelpers::emitSaveCalleeSaves):
2342 (JSC::AssemblyHelpers::emitRestoreCalleeSaves):
2343 (JSC::AssemblyHelpers::copyCalleeSavesToVMCalleeSavesBuffer):
2344 (JSC::AssemblyHelpers::restoreCalleeSavesFromVMCalleeSavesBuffer):
2345 (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMCalleeSavesBuffer):
2346 (JSC::AssemblyHelpers::emitMaterializeTagCheckRegisters):
2347 New helpers to save and restore callee saves as well as materialize the tag registers
2352 (JSC::GPRInfo::toRegister):
2353 Updated to include FP callee save registers. Added number of callee saves registers and
2354 cleanup register aliases that collide with callee save registers.
2356 * jit/JITPropertyAccess.cpp:
2357 (JSC::JIT::emitGetByValWithCachedId):
2358 (JSC::JIT::emitPutByValWithCachedId):
2359 (JSC::JIT::emit_op_get_by_id):
2360 (JSC::JIT::emit_op_put_by_id):
2361 * jit/JITPropertyAccess32_64.cpp:
2362 (JSC::JIT::emitGetByValWithCachedId):
2363 (JSC::JIT::emitPutByValWithCachedId):
2364 (JSC::JIT::emit_op_get_by_id):
2365 (JSC::JIT::emit_op_put_by_id):
2366 Uses new stubUnavailableRegisters register set to limit what registers are available for
2369 * jit/RegisterSet.cpp:
2370 (JSC::RegisterSet::stubUnavailableRegisters):
2371 (JSC::RegisterSet::calleeSaveRegisters):
2372 (JSC::RegisterSet::llintBaselineCalleeSaveRegisters):
2373 (JSC::RegisterSet::dfgCalleeSaveRegisters):
2374 (JSC::RegisterSet::ftlCalleeSaveRegisters):
2375 * jit/RegisterSet.h:
2376 New register sets with the callee saves used by various tiers as well as one listing registers
2377 not availble to stub code.
2379 * jit/SpecializedThunkJIT.h:
2380 (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
2381 (JSC::SpecializedThunkJIT::loadDoubleArgument):
2382 (JSC::SpecializedThunkJIT::returnJSValue):
2383 (JSC::SpecializedThunkJIT::returnDouble):
2384 (JSC::SpecializedThunkJIT::returnInt32):
2385 (JSC::SpecializedThunkJIT::returnJSCell):
2386 (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
2387 (JSC::SpecializedThunkJIT::emitSaveThenMaterializeTagRegisters):
2388 (JSC::SpecializedThunkJIT::emitRestoreSavedTagRegisters):
2389 (JSC::SpecializedThunkJIT::tagReturnAsInt32):
2390 * jit/ThunkGenerators.cpp:
2391 (JSC::nativeForGenerator):
2392 Changed to save and restore existing tag register contents as the may contain other values.
2393 After saving the existing values, we materialize the tag constants.
2395 * jit/TempRegisterSet.h:
2396 (JSC::TempRegisterSet::getFPRByIndex):
2397 (JSC::TempRegisterSet::getFreeFPR):
2398 (JSC::TempRegisterSet::setByIndex):
2399 * offlineasm/arm64.rb:
2400 * offlineasm/registers.rb:
2401 Added methods for floating point registers to support callee save FP registers.
2403 * jit/JITArithmetic32_64.cpp:
2404 (JSC::JIT::emit_op_mod):
2405 Removed unnecessary #if CPU(X86_64) check to this 32 bit only file.
2407 * offlineasm/x86.rb:
2408 Fixed Windows callee saves naming.
2413 (JSC::VM::calleeSaveRegistersBufferOffset):
2414 (JSC::VM::getAllCalleeSaveRegistersMap):
2415 Provide a RegisterSaveMap that has all registers that might be saved. Added a callee save buffer to be
2416 used for OSR exit and for exception processing in a future patch.
2418 2015-09-10 Yusuke Suzuki <utatane.tea@gmail.com>
2420 ModuleProgramExecutable should provide CodeBlock to ScriptExecutable::forEachCodeBlock
2421 https://bugs.webkit.org/show_bug.cgi?id=149028
2423 Reviewed by Michael Saboff.
2425 ModuleProgramExecutable should provide CodeBlock since ModuleProgramExecutable inherits
2428 * bytecode/CodeBlock.h:
2429 (JSC::ScriptExecutable::forEachCodeBlock):
2431 2015-09-09 Sukolsak Sakshuwong <sukolsak@gmail.com>
2433 Implement internal calls in WebAssembly
2434 https://bugs.webkit.org/show_bug.cgi?id=148998
2436 Reviewed by Filip Pizlo.
2438 This patch implements internal calls to functions that return a 32-bit
2439 integer in WebAssembly.
2441 * tests/stress/wasm-calls.js: Added.
2443 * tests/stress/wasm/calls.wasm: Added.
2444 * wasm/WASMFunctionCompiler.h:
2445 (JSC::WASMFunctionCompiler::WASMFunctionCompiler):
2446 (JSC::WASMFunctionCompiler::endFunction):
2447 (JSC::WASMFunctionCompiler::buildCallInternal):
2448 (JSC::WASMFunctionCompiler::appendExpressionList):
2449 (JSC::WASMFunctionCompiler::emitNakedCall):
2450 (JSC::WASMFunctionCompiler::boxArgumentsAndAdjustStackPointer):
2451 (JSC::WASMFunctionCompiler::callAndUnboxResult):
2452 * wasm/WASMFunctionParser.cpp:
2453 (JSC::WASMFunctionParser::compile):
2454 (JSC::WASMFunctionParser::parseExpressionI32):
2455 (JSC::WASMFunctionParser::parseCallInternalExpressionI32):
2456 (JSC::WASMFunctionParser::parseCallArguments):
2457 (JSC::WASMFunctionParser::parseCallInternal):
2458 * wasm/WASMFunctionParser.h:
2459 * wasm/WASMFunctionSyntaxChecker.h:
2460 (JSC::WASMFunctionSyntaxChecker::buildCallInternal):
2461 (JSC::WASMFunctionSyntaxChecker::appendExpressionList):
2463 2015-09-09 Commit Queue <commit-queue@webkit.org>
2465 Unreviewed, rolling out r189522.
2466 https://bugs.webkit.org/show_bug.cgi?id=149020
2468 "Caused a ~4% Speedometer regression" (Requested by cdumez on
2473 "Function.prototype.bind: Bound functions must use the
2474 [[Prototype]] of their target function instead of
2476 https://bugs.webkit.org/show_bug.cgi?id=145605
2477 http://trac.webkit.org/changeset/189522
2479 2015-09-09 Geoffrey Garen <ggaren@apple.com>
2481 Fix the no-DFG build.
2485 * bytecode/CodeBlock.cpp:
2486 (JSC::CodeBlock::visitOSRExitTargets):
2487 (JSC::CodeBlock::stronglyVisitStrongReferences):
2489 2015-09-09 Geoffrey Garen <ggaren@apple.com>
2491 CodeBlocks should strongly visit their OSR exit targets
2492 https://bugs.webkit.org/show_bug.cgi?id=148988
2494 Reviewed by Saam Barati.
2496 CodeBlocks jump to their OSR exit targets, so we need to keep them alive
2499 This is a step toward throwing away CodeBlocks, which is only safe
2500 if we keep alive logically in-use CodeBlocks.
2502 * bytecode/CodeBlock.cpp:
2503 (JSC::CodeBlock::CodeBlock):
2504 (JSC::CodeBlock::visitStrongly): Added a flag to indicate if visit
2505 strongly had been performed yet, since we are likely to revisit
2506 the same CodeBlock many times now.
2508 (JSC::CodeBlock::visitOSRExitTargets):
2509 (JSC::CodeBlock::stronglyVisitStrongReferences): Do the visiting.
2511 * bytecode/CodeBlock.h:
2512 (JSC::CodeBlock::clearMarks):
2513 (JSC::CodeBlockSet::mark): Added a helper function for clearing out
2516 2015-09-09 Geoffrey Garen <ggaren@apple.com>
2518 Unreviewed, rolling back in r189516.
2519 https://bugs.webkit.org/show_bug.cgi?id=148989
2523 "GC should be able to discover new strong CodeBlock references
2525 https://bugs.webkit.org/show_bug.cgi?id=148981
2526 http://trac.webkit.org/changeset/189516
2528 This patch caused infinite recursion on Windows because of a pre-existing
2529 logical error in the non-parallel GC configuration. Even in non-parallel
2530 GC, we must set the mark bit on a CodeBlock to avoid marking it twice
2531 (or, in the case of our crash, infinitely recursively).
2533 2015-09-09 Sukolsak Sakshuwong <sukolsak@gmail.com>
2535 Implement the relational instructions for doubles in WebAssembly
2536 https://bugs.webkit.org/show_bug.cgi?id=148999
2538 Reviewed by Filip Pizlo.
2540 Implements the relational instructions for doubles (float64) in
2541 WebAssembly. Also pass the values into the test functions as Mark Lam
2542 suggested in https://bugs.webkit.org/show_bug.cgi?id=148882#c3
2544 * tests/stress/wasm-relational.js:
2545 * tests/stress/wasm/relational.wasm:
2546 * wasm/WASMFunctionCompiler.h:
2547 (JSC::WASMFunctionCompiler::buildRelationalF64):
2548 * wasm/WASMFunctionParser.cpp:
2549 (JSC::WASMFunctionParser::parseExpressionI32):
2550 (JSC::WASMFunctionParser::parseRelationalF64ExpressionI32):
2551 * wasm/WASMFunctionParser.h:
2552 * wasm/WASMFunctionSyntaxChecker.h:
2553 (JSC::WASMFunctionSyntaxChecker::buildRelationalI32):
2554 (JSC::WASMFunctionSyntaxChecker::buildRelationalF64):
2556 2015-09-09 Saam barati <sbarati@apple.com>
2558 DFG should have a debugging option that runs a phase that flushes all locals
2559 https://bugs.webkit.org/show_bug.cgi?id=148916
2561 Reviewed by Filip Pizlo.
2563 There is now an option to enable the DFG's new MaximalFlushInsertionPhase
2564 phase to run. This phase ensures that we keep all locals and arguments flushed
2565 to the stack at all places in the CFG. This phase is helpful for finding
2566 a class of bugs where enabling this phase to run removes the bug.
2567 This may also be useful in the development of a faster debugger
2568 that doesn't capture all variables.
2571 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2572 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2573 * JavaScriptCore.xcodeproj/project.pbxproj:
2574 * dfg/DFGMaximalFlushInsertionPhase.cpp: Added.
2575 (JSC::DFG::MaximalFlushInsertionPhase::MaximalFlushInsertionPhase):
2576 (JSC::DFG::MaximalFlushInsertionPhase::run):
2577 (JSC::DFG::MaximalFlushInsertionPhase::treatRegularBlock):
2578 (JSC::DFG::MaximalFlushInsertionPhase::treatRootBlock):
2579 (JSC::DFG::MaximalFlushInsertionPhase::newVariableAccessData):
2580 (JSC::DFG::performMaximalFlushInsertion):
2581 * dfg/DFGMaximalFlushInsertionPhase.h: Added.
2583 (JSC::DFG::Plan::compileInThreadImpl):
2584 * runtime/Options.cpp:
2585 (JSC::recomputeDependentOptions):
2586 * runtime/Options.h:
2588 2015-09-08 Sukolsak Sakshuwong <sukolsak@gmail.com>
2590 Refactor the test for the arithmetic instructions in WebAssembly
2591 https://bugs.webkit.org/show_bug.cgi?id=148983
2593 Reviewed by Mark Lam.
2595 Pass the values into the test functions as Mark Lam suggested in
2596 https://bugs.webkit.org/show_bug.cgi?id=148882#c3
2598 * tests/stress/wasm-arithmetic-int32.js: Added.
2601 * tests/stress/wasm-arithmetic.js: Removed.
2602 (shouldBe): Deleted.
2603 (shouldThrow): Deleted.
2604 * tests/stress/wasm/arithmetic-int32.wasm: Added.
2605 * tests/stress/wasm/arithmetic.wasm: Removed.
2607 2015-09-08 Benjamin Poulain <bpoulain@apple.com>
2609 [JSC] reduce the amount of memory access needed for LivenessAnalysisPhase
2610 https://bugs.webkit.org/show_bug.cgi?id=148414
2612 Reviewed by Mark Lam.
2614 LivenessAnalysisPhase still causes a huge number of cache miss.
2615 This patch reduces the amount of accesses needed by the HashTables.
2617 * dfg/DFGBasicBlock.h:
2618 * dfg/DFGLivenessAnalysisPhase.cpp:
2619 (JSC::DFG::LivenessAnalysisPhase::run):
2620 (JSC::DFG::LivenessAnalysisPhase::process):
2622 2015-09-08 Myles C. Maxfield <mmaxfield@apple.com>
2624 Prospective build fix after r189517
2628 * heap/MachineStackMarker.cpp:
2629 (JSC::MachineThreads::Thread::captureStack):
2631 2015-09-08 Yusuke Suzuki <utatane.tea@gmail.com>
2633 Unify symbolTableGet and Put in JSLexicalEnvironment and JSSymbolTableObject
2634 https://bugs.webkit.org/show_bug.cgi?id=148783
2636 Reviewed by Geoffrey Garen.
2638 Unify the symbolTableGet and symbolTablePut into JSSymbolTableObject's one.
2639 Since symbolTablePutWithAttributes in JSLexicalEnvironment is not used, we drop that function.
2641 * runtime/JSEnvironmentRecord.h:
2642 (JSC::JSEnvironmentRecord::isValidScopeOffset):
2643 (JSC::JSEnvironmentRecord::variableAt):
2644 (JSC::JSEnvironmentRecord::isValid): Deleted.
2645 * runtime/JSGlobalLexicalEnvironment.cpp:
2646 (JSC::JSGlobalLexicalEnvironment::put):
2647 * runtime/JSGlobalObject.cpp:
2648 (JSC::JSGlobalObject::put):
2649 * runtime/JSLexicalEnvironment.cpp:
2650 (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
2651 (JSC::JSLexicalEnvironment::getOwnPropertySlot):
2652 (JSC::JSLexicalEnvironment::put):
2653 (JSC::JSLexicalEnvironment::symbolTableGet): Deleted.
2654 (JSC::JSLexicalEnvironment::symbolTablePut): Deleted.
2655 (JSC::JSLexicalEnvironment::symbolTablePutWithAttributes): Deleted.
2656 * runtime/JSLexicalEnvironment.h:
2657 * runtime/JSModuleRecord.cpp:
2658 (JSC::JSModuleRecord::instantiateDeclarations):
2659 * runtime/JSSegmentedVariableObject.h:
2660 (JSC::JSSegmentedVariableObject::isValidScopeOffset):
2661 * runtime/JSSymbolTableObject.h:
2662 (JSC::symbolTableGet):
2663 (JSC::symbolTablePut):
2664 (JSC::symbolTablePutTouchWatchpointSet):
2665 (JSC::symbolTablePutInvalidateWatchpointSet):
2666 (JSC::symbolTablePutWithAttributesTouchWatchpointSet):
2667 (JSC::symbolTablePutWithAttributes): Deleted.
2669 2015-09-08 Commit Queue <commit-queue@webkit.org>
2671 Unreviewed, rolling out r189516.
2672 https://bugs.webkit.org/show_bug.cgi?id=148989
2674 broke tests on windows (Requested by alexchristensen on
2679 "GC should be able to discover new strong CodeBlock references
2681 https://bugs.webkit.org/show_bug.cgi?id=148981
2682 http://trac.webkit.org/changeset/189516
2684 2015-09-08 Sukolsak Sakshuwong <sukolsak@gmail.com>
2686 Remove unused DFG::dfgConvertJSValueToInt32()
2687 https://bugs.webkit.org/show_bug.cgi?id=148986
2689 Reviewed by Geoffrey Garen.
2691 Remove unused DFG::dfgConvertJSValueToInt32() and also remove
2692 DFG::JITCompiler::callOperation(D_JITOperation_EJ operation, ...) which
2693 was introduced in Bug 69806 for dfgConvertJSValueToNumber() and is no
2696 * dfg/DFGOperations.cpp:
2697 * dfg/DFGOperations.h:
2698 * dfg/DFGSpeculativeJIT.h:
2699 (JSC::DFG::SpeculativeJIT::callOperation): Deleted.
2701 2015-09-08 Matthew Hill <matthew.jh@outlook.com>
2703 Function.prototype.bind: Bound functions must use the [[Prototype]] of their target function instead of Function.prototype
2704 https://bugs.webkit.org/show_bug.cgi?id=145605
2706 Reviewed by Geoffrey Garen.
2708 * runtime/JSBoundFunction.cpp:
2709 (JSC::JSBoundFunction::create):
2712 2015-09-08 Mark Lam <mark.lam@apple.com>
2714 Fixed a bad comment r189517.
2718 * heap/MachineStackMarker.cpp:
2719 (JSC::osRedZoneAdjustment):
2721 2015-09-08 Geoffrey Garen <ggaren@apple.com>
2723 InlineCallFrames shouldn't be strongly marked by CodeBlock
2724 https://bugs.webkit.org/show_bug.cgi?id=146613
2726 Reviewed by Saam Barati.
2728 This code was vestigial an unnecessary, so I removed it.
2730 * bytecode/CodeBlock.cpp:
2731 (JSC::CodeBlock::stronglyVisitStrongReferences):
2732 * bytecode/InlineCallFrame.cpp:
2733 (JSC::InlineCallFrame::calleeConstant):
2734 (JSC::InlineCallFrame::calleeForCallFrame):
2735 (JSC::InlineCallFrame::visitAggregate): Deleted.
2736 * bytecode/InlineCallFrame.h:
2737 (JSC::InlineCallFrame::specializationKind):
2738 * bytecode/InlineCallFrameSet.cpp:
2739 (JSC::InlineCallFrameSet::add):
2740 (JSC::InlineCallFrameSet::visitAggregate): Deleted.
2741 * bytecode/InlineCallFrameSet.h:
2742 (JSC::InlineCallFrameSet::begin):
2743 (JSC::InlineCallFrameSet::end):
2745 2015-09-08 Mark Lam <mark.lam@apple.com>
2747 GC stack scan should include ABI red zone.
2748 https://bugs.webkit.org/show_bug.cgi?id=148976
2750 Reviewed by Geoffrey Garen and Benjamin Poulain.
2752 The x86_64 ABI section 3.2.2[1] and ARM64 ABI[2] both state that there is a
2753 128 byte red zone below the stack pointer (reserved by the OS), and that
2754 "functions may use this area for temporary data that is not needed across
2757 Hence, it is possible for a thread to store JSCell pointers in the red zone
2758 area, and the conservative GC thread scanner needs to scan that area as well.
2760 Note: the red zone should not be scanned for the GC thread itself (in
2761 gatherFromCurrentThread()). This because we're guaranteed that there will
2762 be GC frames below the lowest (top of stack) frame that we need to scan.
2763 Hence, we are guaranteed that there are no red zone areas there containing
2764 JSObject pointers of relevance.
2766 No test added for this issue because the issue relies on:
2767 1. the compiler tool chain generating code that stores local variables
2768 containing the sole reference to a JS object (that needs to be kept
2769 alive) in the stack red zone, and
2770 2. GC has to run on another thread while that red zone containing the
2771 JS object reference is in use.
2773 These conditions require a race that cannot be reliably reproduced.
2775 [1]: http://people.freebsd.org/~obrien/amd64-elf-abi.pdf
2776 [2]: https://developer.apple.com/library/ios/documentation/Xcode/Conceptual/iPhoneOSABIReference/Articles/ARM64FunctionCallingConventions.html#//apple_ref/doc/uid/TP40013702-SW7
2778 * heap/MachineStackMarker.cpp:
2779 (JSC::MachineThreads::Thread::Thread):
2780 (JSC::MachineThreads::Thread::createForCurrentThread):
2781 (JSC::MachineThreads::Thread::freeRegisters):
2782 (JSC::osRedZoneAdjustment):
2783 (JSC::MachineThreads::Thread::captureStack):
2785 2015-09-08 Geoffrey Garen <ggaren@apple.com>
2787 GC should be able to discover new strong CodeBlock references during marking
2788 https://bugs.webkit.org/show_bug.cgi?id=148981
2790 Reviewed by Mark Lam.
2792 Previously, we required a strong reference to register itself before the
2793 first visit to a CodeBlock. Now, we can discover a strong reference at
2794 any time during the marking phase.
2796 * bytecode/CodeBlock.cpp:
2797 (JSC::CodeBlock::CodeBlock): Remove the two strong reference state
2798 variables from CodeBlock. Now, a strong reference immediately marks
2799 the CodeBlock and its references at the moment of its discovery, and no
2800 separate state is required.
2802 (JSC::CodeBlock::visitStrongly): New helper function for establishing
2803 a strong reference to a CodeBlock.
2805 (JSC::CodeBlock::visitAggregate): Adopt helper function above.
2807 (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan): Updated
2810 (JSC::CodeBlock::isKnownToBeLiveDuringGC): Ditto.
2812 (JSC::CodeBlock::stronglyVisitWeakReferences): Be sure to record that
2813 we have proven liveness (by virtue of marking all the references the
2814 proof would check). This is required so that the CodeBlock knows itself
2815 to be live, and it is also an optimization to avoid testing weak references
2816 after we have already visited them.
2818 * bytecode/CodeBlock.h:
2819 (JSC::CodeBlock::clearMarks):
2820 (JSC::CodeBlockSet::mark):
2821 (JSC::CodeBlockSet::clearMarks): Deleted. Updated for state removal.
2824 (JSC::DFG::Plan::clearCodeBlockMarks):
2825 (JSC::DFG::Plan::checkLivenessAndVisitChildren):
2826 * dfg/DFGPlan.h: No need to use a CodeBlockSet in order to mark anymore.
2828 * dfg/DFGWorklist.cpp:
2829 (JSC::DFG::Worklist::completeAllPlansForVM):
2830 (JSC::DFG::Worklist::clearCodeBlockMarks):
2831 (JSC::DFG::Worklist::resumeAllThreads):
2832 (JSC::DFG::Worklist::visitWeakReferences):
2833 (JSC::DFG::completeAllPlansForVM):
2834 (JSC::DFG::clearCodeBlockMarks):
2835 * dfg/DFGWorklist.h:
2836 (JSC::DFG::worklistForIndexOrNull): No need to use a CodeBlockSet in order
2839 * heap/CodeBlockSet.cpp:
2840 (JSC::CodeBlockSet::clearMarksForFullCollection):
2841 (JSC::CodeBlockSet::clearMarksForEdenCollection):
2842 (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
2843 (JSC::CodeBlockSet::traceMarked):
2844 (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
2845 (JSC::CodeBlockSet::dump):
2846 * heap/CodeBlockSet.h: Keep the currently executing CodeBlocks in RefPtrs
2847 since we can no longer rely on the m_currentlyExecuting bit to keep them
2848 alive. (A currently executing CodeBlock may not be referenced by its
2849 Executable because it may since have been replaced by another CodeBlock.
2850 This is common in the cases of OSR entry and exit.)
2853 (JSC::Heap::markRoots):
2854 (JSC::Heap::visitCompilerWorklistWeakReferences):
2855 (JSC::Heap::visitWeakHandles): No need to trace the list of CodeBlocks
2856 on the stack in the weak reference fixpoint because we no longer overload
2857 "on the stack" to include CodeBlocks referenced by the compiler.
2859 2015-09-08 Andreas Kling <akling@apple.com>
2861 [JSC] Remove unused Heap::getConservativeRegisterRoots().
2862 <https://webkit.org/b/148974>
2864 Reviewed by Geoffrey Garen.
2866 Spotted this unused stack root gathering helper in Heap. Let's lose it.
2869 (JSC::Heap::getConservativeRegisterRoots): Deleted.
2870 * interpreter/JSStack.cpp:
2871 (JSC::JSStack::gatherConservativeRoots): Deleted.
2872 * interpreter/JSStack.h:
2873 (JSC::JSStack::gatherConservativeRoots): Deleted.
2875 2015-09-08 Sukolsak Sakshuwong <sukolsak@gmail.com>
2877 Implement control flow statements in WebAssembly
2878 https://bugs.webkit.org/show_bug.cgi?id=148934
2880 Reviewed by Geoffrey Garen.
2882 This patch implements if, while, do, label, break, and continue
2883 statements in WebAssembly. Switches will be implemented in a subsequent
2886 * tests/stress/wasm-control-flow.js: Added.
2888 * tests/stress/wasm/control-flow.wasm: Added.
2889 * wasm/WASMFunctionCompiler.h:
2890 (JSC::WASMFunctionCompiler::linkTarget):
2891 (JSC::WASMFunctionCompiler::jumpToTarget):
2892 (JSC::WASMFunctionCompiler::jumpToTargetIf):
2893 (JSC::WASMFunctionCompiler::startLoop):
2894 (JSC::WASMFunctionCompiler::endLoop):
2895 (JSC::WASMFunctionCompiler::startSwitch):
2896 (JSC::WASMFunctionCompiler::endSwitch):
2897 (JSC::WASMFunctionCompiler::startLabel):
2898 (JSC::WASMFunctionCompiler::endLabel):
2899 (JSC::WASMFunctionCompiler::breakTarget):
2900 (JSC::WASMFunctionCompiler::continueTarget):
2901 (JSC::WASMFunctionCompiler::breakLabelTarget):
2902 (JSC::WASMFunctionCompiler::continueLabelTarget):
2903 * wasm/WASMFunctionParser.cpp:
2904 (JSC::WASMFunctionParser::parseIfStatement):
2905 (JSC::WASMFunctionParser::parseIfElseStatement):
2906 (JSC::WASMFunctionParser::parseWhileStatement):
2907 (JSC::WASMFunctionParser::parseDoStatement):
2908 (JSC::WASMFunctionParser::parseLabelStatement):
2909 (JSC::WASMFunctionParser::parseBreakStatement):
2910 (JSC::WASMFunctionParser::parseBreakLabelStatement):
2911 (JSC::WASMFunctionParser::parseContinueStatement):
2912 (JSC::WASMFunctionParser::parseContinueLabelStatement):
2913 * wasm/WASMFunctionParser.h:
2914 * wasm/WASMFunctionSyntaxChecker.h:
2915 (JSC::WASMFunctionSyntaxChecker::linkTarget):
2916 (JSC::WASMFunctionSyntaxChecker::jumpToTarget):
2917 (JSC::WASMFunctionSyntaxChecker::jumpToTargetIf):
2918 (JSC::WASMFunctionSyntaxChecker::startLoop):
2919 (JSC::WASMFunctionSyntaxChecker::endLoop):
2920 (JSC::WASMFunctionSyntaxChecker::startSwitch):
2921 (JSC::WASMFunctionSyntaxChecker::endSwitch):
2922 (JSC::WASMFunctionSyntaxChecker::startLabel):
2923 (JSC::WASMFunctionSyntaxChecker::endLabel):
2924 (JSC::WASMFunctionSyntaxChecker::breakTarget):
2925 (JSC::WASMFunctionSyntaxChecker::continueTarget):
2926 (JSC::WASMFunctionSyntaxChecker::breakLabelTarget):
2927 (JSC::WASMFunctionSyntaxChecker::continueLabelTarget):
2929 2015-09-08 Per Arne Vollan <peavo@outlook.com>
2931 [Win] Compile errors in inspector code.
2932 https://bugs.webkit.org/show_bug.cgi?id=148977
2934 Reviewed by Alex Christensen.
2936 Include definition of class FrontendRouter before use.
2938 * inspector/InspectorBackendDispatcher.h:
2939 * inspector/JSGlobalObjectInspectorController.h:
2941 2015-09-08 Yusuke Suzuki <utatane.tea@gmail.com>
2943 [ES6] Implement computed accessors
2944 https://bugs.webkit.org/show_bug.cgi?id=147883
2946 Reviewed by Geoffrey Garen.
2948 Patch by Yusuke Suzuki <utatane.tea@gmail.com> and Matthew Mirman <mmirman@apple.com>.
2950 Implement the computed accessors functionality for class syntax and object literal syntax.
2951 Added new opcodes, op_put_getter_by_val and op_put_setter_by_val. LLInt and baseline JIT support them.
2952 As the same to the other accessor opcodes (like op_put_getter_by_id etc.), DFG / FTL does not support
2953 them. This is handled here[1].
2955 [1]: https://bugs.webkit.org/show_bug.cgi?id=148860
2957 * bytecode/BytecodeList.json:
2958 * bytecode/BytecodeUseDef.h:
2959 (JSC::computeUsesForBytecodeOffset):
2960 (JSC::computeDefsForBytecodeOffset):
2961 * bytecode/CodeBlock.cpp:
2962 (JSC::CodeBlock::dumpBytecode):
2963 * bytecompiler/BytecodeGenerator.cpp:
2964 (JSC::BytecodeGenerator::emitPutGetterByVal):
2965 (JSC::BytecodeGenerator::emitPutSetterByVal):
2966 * bytecompiler/BytecodeGenerator.h:
2967 * bytecompiler/NodesCodegen.cpp:
2968 (JSC::PropertyListNode::emitBytecode):
2970 (JSC::JIT::privateCompileMainPass):
2973 (JSC::JIT::callOperation):
2974 * jit/JITOperations.cpp:
2975 * jit/JITOperations.h:
2976 * jit/JITPropertyAccess.cpp:
2977 (JSC::JIT::emit_op_put_getter_by_val):
2978 (JSC::JIT::emit_op_put_setter_by_val):
2979 * jit/JITPropertyAccess32_64.cpp:
2980 (JSC::JIT::emit_op_put_getter_by_val):
2981 (JSC::JIT::emit_op_put_setter_by_val):
2982 * llint/LLIntSlowPaths.cpp:
2983 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2984 * llint/LLIntSlowPaths.h:
2985 * llint/LowLevelInterpreter.asm:
2986 * parser/ASTBuilder.h:
2987 (JSC::ASTBuilder::createGetterOrSetterProperty):
2988 * parser/Parser.cpp:
2989 (JSC::Parser<LexerType>::parseClass):
2990 (JSC::Parser<LexerType>::parseGetterSetter):
2991 * parser/SyntaxChecker.h:
2992 (JSC::SyntaxChecker::createGetterOrSetterProperty):
2994 * tests/stress/computed-accessor-parsing.js: Added.
2995 (testShouldNotThrow):
2997 (Val.prototype.get string_appeared_here):
2999 * tests/stress/computed-accessor.js: Added.
3002 * tests/stress/duplicate-computed-accessors.js: Added.
3005 2015-09-08 Saam barati <sbarati@apple.com>
3007 baseline JIT should emit better code for UnresolvedProperty in resolve_scope/get_from_scope/put_to_scope
3008 https://bugs.webkit.org/show_bug.cgi?id=148895
3010 Reviewed by Geoffrey Garen.
3012 Previously, if a resolve_scope/get_from_scope/put_to_scope with
3013 UnresolvedProperty made it to the baseline JIT, we would hard compile
3014 a jump to the slow path. This is bad and slow. Because UnresolvedProperty
3015 tries to update itself to something more useful, and succeeds at doing so
3016 with high probability, we should be emitting code that checks to see if the
3017 slow path has performed an update, and if it has, execute more efficient code
3018 and not go to the slow path (unless it needs to for var injection check failure,
3019 or other check failures). This increases the speed of this code greatly because
3020 we may decide to compile a program/function before certain resolve_scope/get_from_scope/put_to_scope
3021 operations ever execute. And now, the baseline JIT code better adapts to such
3022 compilation scenarios.
3024 * bytecode/Watchpoint.h:
3025 (JSC::WatchpointSet::isBeingWatched):
3026 (JSC::WatchpointSet::addressOfState):
3027 (JSC::WatchpointSet::offsetOfState):
3028 (JSC::WatchpointSet::addressOfSetIsNotEmpty):
3030 (JSC::JIT::emitNotifyWrite):
3031 (JSC::JIT::assertStackPointerOffset):
3033 * jit/JITPropertyAccess.cpp:
3034 (JSC::JIT::emit_op_resolve_scope):
3035 (JSC::JIT::emitSlow_op_resolve_scope):
3036 (JSC::JIT::emitGetGlobalProperty):
3037 (JSC::JIT::emitGetVarFromPointer):
3038 (JSC::JIT::emitGetVarFromIndirectPointer):
3039 (JSC::JIT::emitGetClosureVar):
3040 (JSC::JIT::emit_op_get_from_scope):
3041 (JSC::JIT::emitSlow_op_get_from_scope):
3042 (JSC::JIT::emitPutGlobalProperty):
3043 (JSC::JIT::emitPutGlobalVariable):
3044 (JSC::JIT::emitPutGlobalVariableIndirect):
3045 (JSC::JIT::emitPutClosureVar):
3046 (JSC::JIT::emit_op_put_to_scope):
3047 (JSC::JIT::emitSlow_op_put_to_scope):
3048 * jit/JITPropertyAccess32_64.cpp:
3049 (JSC::JIT::emit_op_resolve_scope):
3050 (JSC::JIT::emitSlow_op_resolve_scope):
3051 (JSC::JIT::emitGetGlobalProperty):
3052 (JSC::JIT::emitGetVarFromPointer):
3053 (JSC::JIT::emitGetVarFromIndirectPointer):
3054 (JSC::JIT::emitGetClosureVar):
3055 (JSC::JIT::emit_op_get_from_scope):
3056 (JSC::JIT::emitSlow_op_get_from_scope):
3057 (JSC::JIT::emitPutGlobalProperty):
3058 (JSC::JIT::emitPutGlobalVariable):
3059 (JSC::JIT::emitPutGlobalVariableIndirect):
3060 (JSC::JIT::emitPutClosureVar):
3061 (JSC::JIT::emit_op_put_to_scope):
3062 (JSC::JIT::emitSlow_op_put_to_scope):
3063 * runtime/CommonSlowPaths.h:
3064 (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
3065 (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
3066 * runtime/JSScope.cpp:
3067 (JSC::abstractAccess):
3068 * tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property/first.js:
3071 2015-09-08 Sukolsak Sakshuwong <sukolsak@gmail.com>
3073 Implement all the arithmetic and logical instructions in WebAssembly
3074 https://bugs.webkit.org/show_bug.cgi?id=148882
3076 Reviewed by Mark Lam.
3078 This patch implements all the arithmetic and logical instructions for
3079 32-bit integers in WebAssembly.
3081 * tests/stress/wasm-arithmetic.js:
3082 * tests/stress/wasm/arithmetic.wasm:
3083 * wasm/WASMFunctionCompiler.h:
3084 (JSC::WASMFunctionCompiler::buildUnaryI32):
3085 (JSC::WASMFunctionCompiler::buildBinaryI32):
3086 * wasm/WASMFunctionParser.cpp:
3087 (JSC::WASMFunctionParser::parseExpressionI32):
3088 (JSC::WASMFunctionParser::parseUnaryExpressionI32):
3089 * wasm/WASMFunctionParser.h:
3090 * wasm/WASMFunctionSyntaxChecker.h:
3091 (JSC::WASMFunctionSyntaxChecker::buildUnaryI32):
3093 2015-09-08 Filip Pizlo <fpizlo@apple.com>
3095 Unreviewed, fix debug by removing an assertion that is not correct anymore.
3100 2015-09-08 Sukolsak Sakshuwong <sukolsak@gmail.com>
3102 Add initial support for doubles in WebAssembly
3103 https://bugs.webkit.org/show_bug.cgi?id=148913
3105 Reviewed by Filip Pizlo.
3107 Implement the ConstantPoolIndex, Immediate, and GetLocal instructions
3108 for doubles (float64) in WebAssembly.
3110 * tests/stress/wasm-arithmetic-float64.js: Added.
3112 * tests/stress/wasm/arithmetic-float64.wasm: Added.
3113 * wasm/WASMConstants.h:
3114 * wasm/WASMFunctionCompiler.h:
3115 (JSC::WASMFunctionCompiler::buildSetLocal):
3116 (JSC::WASMFunctionCompiler::buildReturn):
3117 (JSC::WASMFunctionCompiler::buildImmediateI32):
3118 (JSC::WASMFunctionCompiler::buildImmediateF64):
3119 (JSC::WASMFunctionCompiler::buildGetLocal):
3120 * wasm/WASMFunctionParser.cpp:
3121 (JSC::WASMFunctionParser::parseExpression):
3122 (JSC::WASMFunctionParser::parseExpressionF64):
3123 (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionF64):
3124 (JSC::WASMFunctionParser::parseImmediateExpressionF64):
3125 (JSC::WASMFunctionParser::parseGetLocalExpressionF64):
3126 * wasm/WASMFunctionParser.h:
3127 * wasm/WASMFunctionSyntaxChecker.h:
3128 (JSC::WASMFunctionSyntaxChecker::buildImmediateF64):
3129 * wasm/WASMReader.cpp:
3130 (JSC::WASMReader::readOpExpressionF64):
3131 * wasm/WASMReader.h:
3133 2015-09-06 Filip Pizlo <fpizlo@apple.com>
3135 CallLinkInfo inside StructureStubInfo should not use polymorphic stubs
3136 https://bugs.webkit.org/show_bug.cgi?id=148915
3138 Reviewed by Mark Lam.
3140 There is a subtle bug where if we reset a get_by_id IC that had a getter stub that in
3141 turn had a polymorphic call stub, then the GC won't know to keep the getter stub alive.
3142 This patch documents the bug in a FIXME and disables polymorphic call optimizations for
3143 getters. It also just so happens that the polymorphic call optimizations usually don't
3144 benefit getters, since it's hard to create polymorphism at the point of call without also
3145 introducing polymorphism in the base object's structure.
3147 The added test doesn't reproduce the problem, because it's hard to get the GC to delete
3150 * bytecode/CallLinkInfo.h:
3151 (JSC::CallLinkInfo::CallLinkInfo):
3152 (JSC::CallLinkInfo::setCallLocations):
3153 (JSC::CallLinkInfo::allowStubs):
3154 (JSC::CallLinkInfo::disallowStubs):
3155 (JSC::CallLinkInfo::setUpCallFromFTL):
3157 (JSC::generateByIdStub):
3159 (JSC::linkPolymorphicCall):
3160 * tests/stress/poly-call-stub-in-getter-stub.js: Added.
3164 2015-09-07 Filip Pizlo <fpizlo@apple.com>
3166 The put_by_id IC store barrier contract should benefit transition over replace
3167 https://bugs.webkit.org/show_bug.cgi?id=148943
3169 Reviewed by Mark Lam.
3171 Previously, we would only emit a barrier if the value being stored was possibly a cell, so
3172 the transition stub code generator would have to emit a barrier for the store of the
3173 structure, just in case the structure was newer than the base object.
3175 This changes the contract so that the put_by_id callsite would always have a barrier on the
3176 base (except if it proved that the base was brand new). That way, the transition doesn't have
3177 to have a barrier unless it allocates.
3179 This is meant to be a perf-neutral change that I need for the IC refactoring in
3180 https://bugs.webkit.org/show_bug.cgi?id=148717.
3182 * dfg/DFGFixupPhase.cpp:
3183 (JSC::DFG::FixupPhase::fixupNode):
3184 * dfg/DFGStoreBarrierInsertionPhase.cpp:
3186 (JSC::emitPutTransitionStub):
3188 2015-09-07 Alex Christensen <achristensen@webkit.org>
3190 Windows non-cygwin build fix after r189333.
3192 SVN on Windows (non-cygwin) doesn't like having the * character in file names.
3193 I replaced "*" with "star" in some of Geoff's new tests.
3196 Changed all _*_ to _star_
3197 * tests/es6/generators_yield_*_arrays.js: Removed.
3198 * tests/es6/generators_yield_*_astral_plane_strings.js: Removed.
3199 * tests/es6/generators_yield_*_generator_instances.js: Removed.
3200 * tests/es6/generators_yield_*_generic_iterables.js: Removed.
3201 * tests/es6/generators_yield_*_instances_of_iterables.js: Removed.
3202 * tests/es6/generators_yield_*_iterator_closing.js: Removed.
3203 * tests/es6/generators_yield_*_iterator_closing_via_throw.js: Removed.
3204 * tests/es6/generators_yield_*_on_non-iterables_is_a_runtime_error.js: Removed.
3205 * tests/es6/generators_yield_*_sparse_arrays.js: Removed.
3206 * tests/es6/generators_yield_*_strings.js: Removed.
3207 * tests/es6/generators_yield_star_arrays.js: Copied from tests/es6/generators_yield_*_arrays.js.
3208 * tests/es6/generators_yield_star_astral_plane_strings.js: Copied from tests/es6/generators_yield_*_astral_plane_strings.js.
3209 * tests/es6/generators_yield_star_generator_instances.js: Copied from tests/es6/generators_yield_*_generator_instances.js.
3210 * tests/es6/generators_yield_star_generic_iterables.js: Copied from tests/es6/generators_yield_*_generic_iterables.js.
3211 * tests/es6/generators_yield_star_instances_of_iterables.js: Copied from tests/es6/generators_yield_*_instances_of_iterables.js.
3212 * tests/es6/generators_yield_star_iterator_closing.js: Copied from tests/es6/generators_yield_*_iterator_closing.js.
3213 * tests/es6/generators_yield_star_iterator_closing_via_throw.js: Copied from tests/es6/generators_yield_*_iterator_closing_via_throw.js.
3214 * tests/es6/generators_yield_star_on_non-iterables_is_a_runtime_error.js: Copied from tests/es6/generators_yield_*_on_non-iterables_is_a_runtime_error.js.
3215 * tests/es6/generators_yield_star_sparse_arrays.js: Copied from tests/es6/generators_yield_*_sparse_arrays.js.
3216 * tests/es6/generators_yield_star_strings.js: Copied from tests/es6/generators_yield_*_strings.js.
3218 2015-09-06 Mark Lam <mark.lam@apple.com>
3220 Gardening: fix broken Windows build after r189454.
3224 * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
3225 * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
3227 2015-09-06 Sukolsak Sakshuwong <sukolsak@gmail.com>
3229 Implement the relational instructions in WebAssembly
3230 https://bugs.webkit.org/show_bug.cgi?id=148838
3232 Reviewed by Saam Barati.
3234 This patch implements the relational instructions for 32-bit integers in
3237 * tests/stress/wasm-arithmetic.js:
3238 * tests/stress/wasm-locals.js:
3239 * tests/stress/wasm-relational.js: Added.
3241 * tests/stress/wasm/arithmetic.wasm: Renamed from Source/JavaScriptCore/tests/stress/wasm-arithmetic.wasm.
3242 * tests/stress/wasm/locals.wasm: Renamed from Source/JavaScriptCore/tests/stress/wasm-locals.wasm.
3243 * tests/stress/wasm/relational.wasm: Added.
3244 * wasm/WASMFunctionCompiler.h:
3245 (JSC::WASMFunctionCompiler::buildRelationalI32):
3246 * wasm/WASMFunctionParser.cpp:
3247 (JSC::WASMFunctionParser::parseExpressionI32):
3248 (JSC::WASMFunctionParser::parseRelationalI32ExpressionI32):
3249 * wasm/WASMFunctionParser.h:
3250 * wasm/WASMFunctionSyntaxChecker.h:
3251 (JSC::WASMFunctionSyntaxChecker::buildRelationalI32):
3253 2015-09-06 Mark Lam <mark.lam@apple.com>
3255 StackOverflow stack unwinding should stop at native frames.
3256 https://bugs.webkit.org/show_bug.cgi?id=148749
3258 Reviewed by Michael Saboff.
3260 In the present code, after ping-pong'ing back and forth between native and JS
3261 code a few times, if we have a stack overflow on re-entry into the VM to run
3262 JS code's whose stack frame would overflow the JS stack, the code will end up
3263 unwinding past the native function that is making the call to re-enter the VM.
3264 As a result, any clean up code (e.g. destructors for stack variables) in the
3265 skipped native function frame (and its chain of native function callers) will
3268 This patch is based on the Michael Saboff's fix of this issue landed on the
3269 jsc-tailcall branch: http://trac.webkit.org/changeset/188555
3271 We now check for the case where there are no JS frames to unwind since the
3272 last native frame, and treat the exception as an unhandled exception. The
3273 native function is responsible for further propagating the exception if needed.
3275 Other supporting work:
3276 1. Remove vm->vmEntryFrameForThrow. It should always be the same as
3277 vm->topVMEntryFrame.
3278 2. Change operationThrowStackOverflowError() to use the throwStackOverflowError()
3279 helper function instead of rolling its own.
3280 3. Added a test that exercises this edge case. The test should not hang or crash.
3282 * API/tests/PingPongStackOverflowTest.cpp: Added.
3283 (PingPongStackOverflowObject_hasInstance):
3284 (testPingPongStackOverflow):
3285 * API/tests/PingPongStackOverflowTest.h: Added.
3286 * API/tests/testapi.c:
3288 * JavaScriptCore.xcodeproj/project.pbxproj:
3289 * interpreter/CallFrame.h:
3290 (JSC::ExecState::operator=):
3291 (JSC::ExecState::callerFrame):
3292 (JSC::ExecState::callerFrameOrVMEntryFrame):
3293 (JSC::ExecState::argIndexForRegister):
3294 (JSC::ExecState::callerFrameAndPC):
3295 * interpreter/Interpreter.cpp:
3296 (JSC::UnwindFunctor::UnwindFunctor):
3297 (JSC::UnwindFunctor::operator()):
3298 (JSC::Interpreter::unwind):
3299 * interpreter/Interpreter.h:
3300 (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
3301 (JSC::Interpreter::sampler):
3302 * jit/CCallHelpers.h:
3303 (JSC::CCallHelpers::jumpToExceptionHandler):
3304 * jit/JITExceptions.cpp:
3305 (JSC::genericUnwind):
3306 * jit/JITExceptions.h:
3307 * jit/JITOpcodes.cpp:
3308 (JSC::JIT::emit_op_catch):
3309 * jit/JITOpcodes32_64.cpp:
3310 (JSC::JIT::emit_op_catch):
3311 * jit/JITOperations.cpp:
3312 * llint/LowLevelInterpreter32_64.asm:
3313 * llint/LowLevelInterpreter64.asm:
3315 (JSC::VM::exceptionOffset):
3316 (JSC::VM::callFrameForThrowOffset):
3317 (JSC::VM::vmEntryFrameForThrowOffset): Deleted.
3318 (JSC::VM::topVMEntryFrameOffset): Deleted.
3320 2015-09-06 Yusuke Suzuki <utatane.tea@gmail.com>
3322 Unreviewed, disable module tests in Windows until name resolution is fixed
3323 https://bugs.webkit.org/show_bug.cgi?id=148689
3325 Until bug[1] is fixed, we disable the module tests.
3326 Since the local file system name resolution is just implemented in jsc.cpp and
3327 is intended to be used for the module tests, it does not affect JSC framework
3330 [1]: https://bugs.webkit.org/show_bug.cgi?id=148917
3332 * tests/modules.yaml:
3334 2015-09-06 Sukolsak Sakshuwong <sukolsak@gmail.com>
3336 Simplify JIT::emit_op_mod()
3337 https://bugs.webkit.org/show_bug.cgi?id=148908
3339 Reviewed by Michael Saboff.
3341 The IDIV instruction on x86 divides the value in the EDX:EAX registers
3342 by the source operand and stores the quotient in EAX and the remainder
3343 in EDX. Therefore, we store the values that we don't want to be
3344 overwritten by IDIV in registers that are not EAX or EDX. This patch
3345 makes the intention clearer and makes the code easier to read.
3347 * jit/JITArithmetic.cpp:
3348 (JSC::JIT::emit_op_mod):
3350 2015-09-05 Mark Lam <mark.lam@apple.com>
3352 Fix JSDollarVMPrototype after r189160.
3353 https://bugs.webkit.org/show_bug.cgi?id=148900
3355 Reviewed by Michael Saboff.
3357 JSDollarVMPrototype needs to be updated to match http://trac.webkit.org/changeset/189160 i.e.
3358 remove the use of JSC::Function bit in its property attributes.
3360 * tools/JSDollarVMPrototype.cpp:
3361 (JSC::JSDollarVMPrototype::finishCreation):
3363 2015-09-05 Yusuke Suzuki <utatane.tea@gmail.com>
3365 Unreviewed, fix the module name resolution in Windows
3366 https://bugs.webkit.org/show_bug.cgi?id=148689
3368 Attempt to fix the module name resolution in Windows.
3369 A module name is represented as the UNIX path under the current module tests.
3370 This fix split the module name with '/' instead of pathSeparator().
3372 This is only utilized by the jsc.cpp for the local module tests.
3373 So, WebKit production and JavaScriptCore framework are not affected by this change.
3376 (ModuleName::startsWithRoot):
3377 (ModuleName::ModuleName):
3379 (GlobalObject::moduleLoaderResolve):
3381 2015-09-05 Brian Burg <bburg@apple.com>
3383 Web Inspector: tighten up lifetimes for Agent-owned objects, and initialize agents using contexts
3384 https://bugs.webkit.org/show_bug.cgi?id=148625
3386 Reviewed by Joseph Pecoraro.
3388 All agents own their domain-specific frontend and backend dispatchers. Change so that
3389 they are initialized in constructors rather than when a frontend connects or disconnects.
3390 This may cause additional memory use, but this can be counteracted by lazily creating
3391 some agents that are not required for other agents to function (i.e., runtime and page agents).
3393 To avoid adding frontend/backend dispatcher arguments to every single agent constructor,
3394 change agent construction to take a AgentContext or a subclass of it. This provides agents with
3395 references to objects in the owning InspectorEnvironment subclass that are guaranteed to
3396 outlive all agents. AgentContext and its subclasses follow the existing Agent class hierarchy.
3398 * inspector/InspectorAgentBase.h:
3399 (Inspector::JSAgentContext::JSAgentContext):
3400 * inspector/JSGlobalObjectInspectorController.cpp:
3401 (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
3402 (Inspector::JSGlobalObjectInspectorController::connectFrontend):
3403 (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
3404 (Inspector::JSGlobalObjectInspectorController::disconnectAllFrontends):
3405 (Inspector::JSGlobalObjectInspectorController::appendExtraAgent):
3406 * inspector/JSGlobalObjectInspectorController.h:
3407 * inspector/agents/InspectorAgent.cpp:
3408 (Inspector::InspectorAgent::InspectorAgent):
3409 (Inspector::InspectorAgent::didCreateFrontendAndBackend):
3410 (Inspector::InspectorAgent::willDestroyFrontendAndBackend):
3411 * inspector/agents/InspectorAgent.h:
3412 * inspector/agents/InspectorConsoleAgent.cpp:
3413 (Inspector::InspectorConsoleAgent::InspectorConsoleAgent):
3414 (Inspector::InspectorConsoleAgent::didCreateFrontendAndBackend):
3415 (Inspector::InspectorConsoleAgent::willDestroyFrontendAndBackend):
3416 * inspector/agents/InspectorConsoleAgent.h:
3417 * inspector/agents/InspectorDebuggerAgent.cpp:
3418 (Inspector::InspectorDebuggerAgent::InspectorDebuggerAgent):
3419 (Inspector::InspectorDebuggerAgent::didCreateFrontendAndBackend):
3420 (Inspector::InspectorDebuggerAgent::willDestroyFrontendAndBackend):
3421 * inspector/agents/InspectorDebuggerAgent.h:
3422 * inspector/agents/InspectorRuntimeAgent.cpp:
3423 (Inspector::InspectorRuntimeAgent::InspectorRuntimeAgent):
3424 * inspector/agents/InspectorRuntimeAgent.h:
3425 * inspector/agents/JSGlobalObjectConsoleAgent.cpp:
3426 (Inspector::JSGlobalObjectConsoleAgent::JSGlobalObjectConsoleAgent):
3427 * inspector/agents/JSGlobalObjectConsoleAgent.h:
3428 * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
3429 (Inspector::JSGlobalObjectDebuggerAgent::JSGlobalObjectDebuggerAgent):
3430 * inspector/agents/JSGlobalObjectDebuggerAgent.h:
3431 * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
3432 (Inspector::JSGlobalObjectRuntimeAgent::JSGlobalObjectRuntimeAgent):
3433 (Inspector::JSGlobalObjectRuntimeAgent::didCreateFrontendAndBackend):
3434 * inspector/agents/JSGlobalObjectRuntimeAgent.h:
3435 * inspector/augmentable/AlternateDispatchableAgent.h:
3436 * inspector/augmentable/AugmentableInspectorController.h: Alternate agents should
3437 have access to frontend router and backend dispatcher at construction time.
3439 * inspector/scripts/codegen/cpp_generator_templates.py:
3440 * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
3441 (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
3442 * inspector/scripts/codegen/objc_generator_templates.py:
3444 2015-09-04 Brian Burg <bburg@apple.com>
3446 Web Inspector: agents should send messages through FrontendRouter instead of FrontendChannel
3447 https://bugs.webkit.org/show_bug.cgi?id=148492
3449 Reviewed by Joseph Pecoraro.
3451 Replace uses of FrontendChannel with FrontendRouter. Minor cleanups along the way.
3453 Make AgentRegistry automatically signal discardAgent() in its destructor, since it always
3454 gets executed in the owning controller's destructor anyway.
3456 * inspector/InspectorAgentBase.h:
3457 * inspector/InspectorAgentRegistry.cpp:
3458 (Inspector::AgentRegistry::~AgentRegistry):
3459 (Inspector::AgentRegistry::didCreateFrontendAndBackend):
3460 (Inspector::AgentRegistry::willDestroyFrontendAndBackend):
3461 (Inspector::AgentRegistry::discardAgents): Deleted.
3462 * inspector/InspectorAgentRegistry.h:
3463 * inspector/InspectorBackendDispatcher.cpp:
3464 * inspector/InspectorFrontendRouter.cpp:
3465 (Inspector::FrontendRouter::leakChannel): Deleted, no longer necessary.
3466 * inspector/InspectorFrontendRouter.h:
3467 * inspector/JSGlobalObjectInspectorController.cpp:
3468 (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
3469 (Inspector::JSGlobalObjectInspectorController::connectFrontend):
3470 (Inspector::JSGlobalObjectInspectorController::appendExtraAgent):
3471 (Inspector::JSGlobalObjectInspectorController::~JSGlobalObjectInspectorController):
3472 * inspector/JSGlobalObjectInspectorController.h:
3473 * inspector/agents/InspectorAgent.cpp:
3474 (Inspector::InspectorAgent::didCreateFrontendAndBackend):
3475 * inspector/agents/InspectorAgent.h:
3476 * inspector/agents/InspectorConsoleAgent.cpp:
3477 (Inspector::InspectorConsoleAgent::didCreateFrontendAndBackend):
3478 * inspector/agents/InspectorConsoleAgent.h:
3479 * inspector/agents/InspectorDebuggerAgent.cpp:
3480 (Inspector::InspectorDebuggerAgent::didCreateFrontendAndBackend):
3481 * inspector/agents/InspectorDebuggerAgent.h:
3482 * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
3483 (Inspector::JSGlobalObjectRuntimeAgent::didCreateFrontendAndBackend):
3484 * inspector/agents/JSGlobalObjectRuntimeAgent.h:
3485 * inspector/augmentable/AlternateDispatchableAgent.h:
3486 * inspector/remote/RemoteInspectorDebuggable.cpp:
3487 * inspector/scripts/codegen/cpp_generator_templates.py:
3488 * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
3489 (CppBackendDispatcherImplementationGenerator.generate_output):
3490 * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
3491 (CppFrontendDispatcherHeaderGenerator.generate_output.FrontendRouter):
3492 (CppFrontendDispatcherHeaderGenerator.generate_output):
3493 * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
3494 (CppFrontendDispatcherImplementationGenerator.generate_output):
3495 (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
3496 * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
3497 (ObjCConfigurationImplementationGenerator.generate_output):
3498 * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
3499 (ObjCFrontendDispatcherImplementationGenerator.generate_output):
3501 2015-09-05 Yusuke Suzuki <utatane.tea@gmail.com>
3503 [ES6] Enable ES6 Module in JSC shell by default
3504 https://bugs.webkit.org/show_bug.cgi?id=148689
3506 Reviewed by Geoffrey Garen.
3508 Enable ES6 Modules in JSC shell by default. Compile time flag is left for WebCore.
3509 Since the entry point to evaluate the modules are completely separated from the usual
3510 entry point to evaluate the script, we can safely enable ES6 modules in JSC shell.
3512 And add bunch of tests for ES6 Modules.
3515 (GlobalObject::finishCreation):
3516 (functionLoadModule):
3518 (printUsageStatement): Deleted.
3519 (CommandLine::parseArguments): Deleted.
3520 * parser/Parser.cpp:
3521 (JSC::Parser<LexerType>::parseInner): Deleted.
3522 * tests/modules.yaml: Added.
3523 * tests/modules/aliasing.js: Added.
3524 * tests/modules/aliasing/drink-2.js: Added.
3525 (export.let.Cappuccino.string_appeared_here.export.changeCappuccino):
3526 * tests/modules/aliasing/drink.js: Added.
3527 (export.changeCocoa):
3528 * tests/modules/cyclic-may-produce-tdz.js: Added.
3529 * tests/modules/cyclic-may-produce-tdz/1.js: Added.
3530 * tests/modules/cyclic-may-produce-tdz/2.js: Added.
3531 * tests/modules/default-error/main.js: Added.
3532 * tests/modules/default-value-case-should-be-copied.js: Added.
3533 * tests/modules/default-value-case-should-be-copied/module.js: Added.
3534 (export.changeValue):
3535 * tests/modules/defaults.js: Added.
3536 * tests/modules/defaults/Cappuccino.js: Added.
3537 * tests/modules/defaults/Cocoa.js: Added.
3538 (export.default.Cocoa):
3539 * tests/modules/defaults/Matcha.js: Added.
3540 * tests/modules/destructuring-export.js: Added.
3541 * tests/modules/destructuring-export/array.js: Added.
3542 * tests/modules/destructuring-export/main.js: Added.
3543 * tests/modules/execution-order-cyclic.js: Added.
3544 * tests/modules/execution-order-cyclic/1.js: Added.
3545 * tests/modules/execution-order-cyclic/10.js: Added.
3546 * tests/modules/execution-order-cyclic/11.js: Added.
3547 * tests/modules/execution-order-cyclic/2.js: Added.
3548 * tests/modules/execution-order-cyclic/3.js: Added.
3549 * tests/modules/execution-order-cyclic/4.js: Added.
3550 * tests/modules/execution-order-cyclic/5.js: Added.
3551 * tests/modules/execution-order-cyclic/6.js: Added.
3552 * tests/modules/execution-order-cyclic/7.js: Added.
3553 * tests/modules/execution-order-cyclic/8.js: Added.
3554 * tests/modules/execution-order-cyclic/9.js: Added.
3555 * tests/modules/execution-order-dag.js: Added.
3556 * tests/modules/execution-order-dag/1.js: Added.
3557 * tests/modules/execution-order-dag/10.js: Added.
3558 * tests/modules/execution-order-dag/2.js: Added.
3559 * tests/modules/execution-order-dag/3.js: Added.
3560 * tests/modules/execution-order-dag/4.js: Added.
3561 * tests/modules/execution-order-dag/5.js: Added.
3562 * tests/modules/execution-order-dag/6.js: Added.
3563 * tests/modules/execution-order-dag/7.js: Added.
3564 * tests/modules/execution-order-dag/8.js: Added.
3565 * tests/modules/execution-order-dag/9.js: Added.
3566 * tests/modules/execution-order-depth.js: Added.
3567 * tests/modules/execution-order-depth/1.js: Added.
3568 * tests/modules/execution-order-depth/2.js: Added.
3569 * tests/modules/execution-order-depth/3.js: Added.
3570 * tests/modules/execution-order-self.js: Added.
3571 * tests/modules/execution-order-sibling.js: Added.
3572 * tests/modules/execution-order-sibling/1.js: Added.
3573 * tests/modules/execution-order-sibling/2.js: Added.
3574 * tests/modules/execution-order-sibling/3.js: Added.
3575 * tests/modules/execution-order-tree.js: Added.
3576 * tests/modules/execution-order-tree/1.js: Added.
3577 * tests/modules/execution-order-tree/10.js: Added.
3578 * tests/modules/execution-order-tree/11.js: Added.
3579 * tests/modules/execution-order-tree/2.js: Added.
3580 * tests/modules/execution-order-tree/3.js: Added.
3581 * tests/modules/execution-order-tree/4.js: Added.
3582 * tests/modules/execution-order-tree/5.js: Added.
3583 * tests/modules/execution-order-tree/6.js: Added.
3584 * tests/modules/execution-order-tree/7.js: Added.
3585 * tests/modules/execution-order-tree/8.js: Added.
3586 * tests/modules/execution-order-tree/9.js: Added.
3587 * tests/modules/export-conflict-ok.js: Added.
3588 * tests/modules/export-conflict-ok/A.js: Added.
3589 * tests/modules/export-conflict-ok/B.js: Added.
3590 * tests/modules/export-conflict-ok/main.js: Added.
3591 * tests/modules/export-from.js: Added.
3592 * tests/modules/export-from/main.js: Added.
3593 * tests/modules/export-from/second.js: Added.
3594 * tests/modules/export-with-declarations-list.js: Added.
3595 * tests/modules/export-with-declarations-list/main.js: Added.
3596 * tests/modules/exported-function-may-be-called-before-module-is-executed.js: Added.
3597 * tests/modules/exported-function-may-be-called-before-module-is-executed/1.js: Added.
3598 * tests/modules/exported-function-may-be-called-before-module-is-executed/2.js: Added.
3601 * tests/modules/import-error.js: Added.
3602 * tests/modules/import-error/export-ambiguous-1.js: Added.
3603 * tests/modules/import-error/export-ambiguous-2.js: Added.
3604 * tests/modules/import-error/export-ambiguous.js: Added.
3605 * tests/modules/import-error/export-default-from-star-2.js: Added.
3606 (export.default.Cocoa):
3607 * tests/modules/import-error/export-default-from-star.js: Added.
3608 * tests/modules/import-error/export-not-found.js: Added.
3609 * tests/modules/import-error/import-ambiguous.js: Added.
3610 * tests/modules/import-error/import-default-from-star.js: Added.
3611 * tests/modules/import-error/import-not-found.js: Added.
3612 * tests/modules/imported-bindings-are-immutable.js: Added.
3613 * tests/modules/imported-bindings-are-immutable/bindings.js: Added.
3614 (export.functionDeclaration):
3615 (export.classDeclaration):
3616 * tests/modules/imported-bindings-can-be-changed-in-original-module.js: Added.
3617 * tests/modules/imported-bindings-can-be-changed-in-original-module/bindings.js: Added.
3618 * tests/modules/indirect-export-error.js: Added.
3619 * tests/modules/indirect-export-error/indirect-export-ambiguous-2.js: Added.
3620 * tests/modules/indirect-export-error/indirect-export-ambiguous-3.js: Added.
3621 * tests/modules/indirect-export-error/indirect-export-ambiguous-4.js: Added.
3622 * tests/modules/indirect-export-error/indirect-export-ambiguous.js: Added.
3623 * tests/modules/indirect-export-error/indirect-export-default-2.js: Added.
3624 * tests/modules/indirect-export-error/indirect-export-default-3.js: Added.
3625 (export.default.Cocoa):
3626 * tests/modules/indirect-export-error/indirect-export-default.js: Added.
3627 * tests/modules/indirect-export-error/indirect-export-not-found-2.js: Added.
3628 * tests/modules/indirect-export-error/indirect-export-not-found.js: Added.
3629 * tests/modules/module-eval.js: Added.
3630 * tests/modules/module-eval/A.js: Added.
3631 * tests/modules/module-eval/B.js: Added.
3632 * tests/modules/module-eval/drink.js: Added.
3633 * tests/modules/module-is-strict-code.js: Added.
3634 * tests/modules/namespace-ambiguous.js: Added.
3635 * tests/modules/namespace-ambiguous/ambiguous-2.js: Added.
3636 * tests/modules/namespace-ambiguous/ambiguous-3.js: Added.
3637 * tests/modules/namespace-ambiguous/ambiguous-4.js: Added.
3638 * tests/modules/namespace-ambiguous/ambiguous.js: Added.
3639 * tests/modules/namespace-error.js: Added.
3640 * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-2.js: Added.
3641 * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-3.js: Added.
3642 * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-4.js: Added.
3643 * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-5.js: Added.
3644 * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-6.js: Added.
3645 * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-7.js: Added.
3646 * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity.js: Added.
3647 * tests/modules/namespace-tdz.js: Added.
3648 * tests/modules/namespace-tdz/A.js: Added.
3649 * tests/modules/namespace-tdz/B.js: Added.
3651 * tests/modules/namespace-tdz/main.js: Added.
3652 * tests/modules/namespace.js: Added.
3653 * tests/modules/namespace/additional-drink.js: Added.
3654 * tests/modules/namespace/drink.js: Added.
3655 (export.default.changeCappuccino):
3656 * tests/modules/namespace/more-additional-drink.js: Added.
3657 * tests/modules/resources/assert.js: Added.
3659 (export.shouldThrow):
3660 * tests/modules/scopes.js: Added.
3661 * tests/modules/scopes/additional-drink.js: Added.
3662 * tests/modules/scopes/drink.js: Added.
3663 (export.default.changeCappuccino):
3664 * tests/modules/scopes/more-additional-drink.js: Added.
3665 * tests/modules/this-should-be-undefined.js: Added.
3666 * tests/stress/modules-syntax-error-with-names.js:
3667 * tests/stress/modules-syntax-error.js:
3668 * tests/stress/modules-syntax.js:
3670 2015-09-05 Yusuke Suzuki <utatane.tea@gmail.com>
3672 [ES6] Implement ModuleNamespaceObject
3673 https://bugs.webkit.org/show_bug.cgi?id=148705
3675 Reviewed by Geoffrey Garen.
3677 Implement Module namespace object.
3678 That is used when importing the module with the form `import * as namespace from "mod"`.
3679 The module namespace object is non-extensible object that has the bindings to the original module
3683 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3684 * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
3685 * JavaScriptCore.xcodeproj/project.pbxproj:
3686 * runtime/JSGlobalObject.cpp:
3687 (JSC::JSGlobalObject::init):
3688 (JSC::JSGlobalObject::visitChildren):
3689 * runtime/JSGlobalObject.h:
3690 (JSC::JSGlobalObject::moduleNamespaceObjectStructure):
3691 * runtime/JSModuleNamespaceObject.cpp: Added.
3692 (JSC::JSModuleNamespaceObject::JSModuleNamespaceObject):
3693 (JSC::JSModuleNamespaceObject::finishCreation):
3694 (JSC::JSModuleNamespaceObject::destroy):
3695 (JSC::JSModuleNamespaceObject::visitChildren):
3696 (JSC::callbackGetter):
3697 (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
3698 (JSC::JSModuleNamespaceObject::put):
3699 (JSC::JSModuleNamespaceObject::putByIndex):
3700 (JSC::JSModuleNamespaceObject::deleteProperty):
3701 (JSC::JSModuleNamespaceObject::getOwnPropertyNames):
3702 (JSC::JSModuleNamespaceObject::defineOwnProperty):
3703 (JSC::moduleNamespaceObjectSymbolIterator):
3704 * runtime/JSModuleNamespaceObject.h: Added.
3705 (JSC::JSModuleNamespaceObject::create):
3706 (JSC::JSModuleNamespaceObject::createStructure):
3707 (JSC::JSModuleNamespaceObject::moduleRecord):
3708 * runtime/JSModuleRecord.cpp:
3709 (JSC::JSModuleRecord::visitChildren):
3710 (JSC::getExportedNames):
3711 (JSC::JSModuleRecord::getModuleNamespace):
3712 (JSC::JSModuleRecord::instantiateDeclarations):
3713 * runtime/JSModuleRecord.h:
3715 2015-09-04 Mark Lam <mark.lam@apple.com>
3717 Rollout r189411, r189413: Broke JSC tests.
3721 * API/tests/PingPongStackOverflowTest.cpp: Removed.
3722 * API/tests/PingPongStackOverflowTest.h: Removed.
3723 * API/tests/testapi.c:
3725 * JavaScriptCore.xcodeproj/project.pbxproj:
3726 * interpreter/CallFrame.h:
3727 (JSC::ExecState::operator=):
3728 (JSC::ExecState::callerFrame):
3729 (JSC::ExecState::argIndexForRegister):
3730 (JSC::ExecState::callerFrameOrVMEntryFrame):
3731 (JSC::ExecState::callerFrameAndPC):
3732 * interpreter/Interpreter.cpp:
3733 (JSC::UnwindFunctor::UnwindFunctor):
3734 (JSC::UnwindFunctor::operator()):
3735 (JSC::Interpreter::unwind):
3736 * interpreter/Interpreter.h:
3737 (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
3738 (JSC::Interpreter::sampler):
3739 * jit/CCallHelpers.h:
3740 (JSC::CCallHelpers::jumpToExceptionHandler):
3741 * jit/JITExceptions.cpp:
3742 (JSC::genericUnwind):
3743 * jit/JITExceptions.h:
3744 * jit/JITOpcodes.cpp:
3745 (JSC::JIT::emit_op_catch):
3746 * jit/JITOpcodes32_64.cpp:
3747 (JSC::JIT::emit_op_catch):
3748 * jit/JITOperations.cpp:
3749 * llint/LowLevelInterpreter32_64.asm:
3750 * llint/LowLevelInterpreter64.asm:
3752 (JSC::VM::exceptionOffset):
3753 (JSC::VM::vmEntryFrameForThrowOffset):
3754 (JSC::VM::topVMEntryFrameOffset):
3755 (JSC::VM::callFrameForThrowOffset):
3757 2015-09-04 Joseph Pecoraro <pecoraro@apple.com>
3759 Web Inspector: Test Runtime.saveResult and $n values
3760 https://bugs.webkit.org/show_bug.cgi?id=148837
3762 Reviewed by Timothy Hatcher.
3764 * inspector/InjectedScriptSource.js:
3765 (InjectedScript.prototype._evaluateOn):
3766 We don't need to be in the console object group to put the value
3767 in the saved results list. That strong reference will ensure $n
3768 values are always alive even if other object groups were used
3769 when creating and subsequently released.
3771 2015-09-04 Mark Lam <mark.lam@apple.com>
3773 [Follow up] StackOverflow stack unwinding should stop at native frames.
3774 https://bugs.webkit.org/show_bug.cgi?id=148749
3776 Rubber stamped by Michael Saboff.
3778 Speculative fix for jsc test failure.
3780 * interpreter/Interpreter.cpp:
3781 (JSC::Interpreter::unwind):
3783 2015-09-04 Mark Lam <mark.lam@apple.com>
3785 StackOverflow stack unwinding should stop at native frames.
3786 https://bugs.webkit.org/show_bug.cgi?id=148749
3788 Reviewed by Michael Saboff.
3790 In the present code, after ping-pong'ing back and forth between native and JS
3791 code a few times, if we have a stack overflow on re-entry into the VM to run
3792 JS code's whose stack frame would overflow the JS stack, the code will end up
3793 unwinding past the native function that is making the call to re-enter the VM.
3794 As a result, any clean up code (e.g. destructors for stack variables) in the
3795 skipped native function frame (and its chain of native function callers) will
3798 This patch is based on the Michael Saboff's fix of this issue landed on the
3799 jsc-tailcall branch: http://trac.webkit.org/changeset/188555
3801 We now check for the case where there are no JS frames to unwind since the
3802 last native frame, and treat the exception as an unhandled exception. The
3803 native function is responsible for further propagating the exception if needed.
3805 Other supporting work:
3806 1. Remove vm->vmEntryFrameForThrow. It should always be the same as
3807 vm->topVMEntryFrame.
3808 2. Change operationThrowStackOverflowError() to use the throwStackOverflowError()
3809 helper function instead of rolling its own.
3810 3. In the LLINT vm entry, set vm->topVMEntryFrame as soon as the entry frame is
3811 fully initialized (instead of waiting). With this, we can always reliably
3812 tell which VMEntryFrame is on top.
3813 4. Added a test that exercises this edge case. The test should not hang or crash.
3815 * API/tests/PingPongStackOverflowTest.cpp: Added.
3816 (PingPongStackOverflowObject_hasInstance):
3817 (testPingPongStackOverflow):
3818 * API/tests/PingPongStackOverflowTest.h: Added.
3819 * API/tests/testapi.c:
3821 * JavaScriptCore.xcodeproj/project.pbxproj:
3822 * interpreter/Interpreter.cpp:
3823 (JSC::unwindCallFrame):
3824 (JSC::getStackFrameCodeType):
3825 (JSC::UnwindFunctor::UnwindFunctor):
3826 (JSC::UnwindFunctor::operator()):
3827 (JSC::Interpreter::unwind):
3828 * interpreter/Interpreter.h:
3829 (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
3830 (JSC::NativeCallFrameTracerWithRestore::NativeCallFrameTracerWithRestore):
3831 (JSC::NativeCallFrameTracerWithRestore::~NativeCallFrameTracerWithRestore):
3832 (JSC::Interpreter::sampler):
3833 * jit/CCallHelpers.h:
3834 (JSC::CCallHelpers::jumpToExceptionHandler):
3835 * jit/JITExceptions.cpp:
3836 (JSC::genericUnwind):
3837 * jit/JITExceptions.h:
3838 * jit/JITOpcodes.cpp:
3839 (JSC::JIT::emit_op_catch):
3840 * jit/JITOpcodes32_64.cpp:
3841 (JSC::JIT::emit_op_catch):
3842 * jit/JITOperations.cpp:
3843 * llint/LowLevelInterpreter32_64.asm:
3844 * llint/LowLevelInterpreter64.asm:
3846 (JSC::VM::exceptionOffset):
3847 (JSC::VM::callFrameForThrowOffset):
3848 (JSC::VM::vmEntryFrameForThrowOffset): Deleted.
3849 (JSC::VM::topVMEntryFrameOffset): Deleted.
3851 2015-09-04 Sukolsak Sakshuwong <sukolsak@gmail.com>
3853 Implement the division and modulo instructions in WebAssembly
3854 https://bugs.webkit.org/show_bug.cgi?id=148791
3856 Reviewed by Geoffrey Garen.
3858 This patch implements the unsigned division, signed modulo, and unsigned
3859 modulo instructions for 32-bit integers in WebAssembly. It also
3860 implements the context pool index instructions, which are needed for
3861 testing. (pack-asmjs puts numbers that are used more than once in the
3864 * assembler/X86Assembler.h:
3865 (JSC::X86Assembler::divl_r):
3866 * tests/stress/wasm-arithmetic.js:
3867 * tests/stress/wasm-arithmetic.wasm:
3868 * wasm/WASMFunctionCompiler.h:
3869 (JSC::operationMod):
3870 (JSC::operationUnsignedDiv):
3871 (JSC::operationUnsignedMod):
3872 (JSC::WASMFunctionCompiler::buildBinaryI32):
3873 (JSC::WASMFunctionCompiler::callOperation):
3874 * wasm/WASMFunctionParser.cpp:
3875 (JSC::WASMFunctionParser::parseExpressionI32):
3876 (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionI32):
git://git.webkit.org / WebKit-https.git / blob