8ffb49c1174bd5059ced36bcc8116abaf2b45192
[WebKit-https.git] / Source / JavaScriptCore / ChangeLog
1 2015-09-16  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2
3         Implement indirect calls in WebAssembly
4         https://bugs.webkit.org/show_bug.cgi?id=149100
5
6         Reviewed by Geoffrey Garen.
7
8         This patch implement indirect calls for WebAssembly files generated by
9         pack-asmjs <https://github.com/WebAssembly/polyfill-prototype-1>.
10         pack-asmjs uses the same indirect call model as asm.js. In asm.js, an
11         indirect call looks like this:
12             t[i & n](...)
13         where t is a variable referring to an array of functions with the same
14         signature, i is an integer expression, n is an integer that is equal to
15         (t.length - 1), and t.length is a power of two. pack-asmjs does not
16         use the '&' operator nor n in the WebAssembly output, but the semantics
17         is still the same as asm.js.
18
19         * tests/stress/wasm-calls.js:
20         * tests/stress/wasm/calls.wasm:
21         * wasm/WASMFormat.h:
22         * wasm/WASMFunctionCompiler.h:
23         (JSC::WASMFunctionCompiler::buildCallIndirect):
24         * wasm/WASMFunctionParser.cpp:
25         (JSC::WASMFunctionParser::parseExpressionI32):
26         (JSC::WASMFunctionParser::parseExpressionF32):
27         (JSC::WASMFunctionParser::parseExpressionF64):
28         (JSC::WASMFunctionParser::parseCallIndirect):
29         * wasm/WASMFunctionParser.h:
30         * wasm/WASMFunctionSyntaxChecker.h:
31         (JSC::WASMFunctionSyntaxChecker::buildCallIndirect):
32         * wasm/WASMModuleParser.cpp:
33         (JSC::WASMModuleParser::parseFunctionPointerTableSection):
34         (JSC::WASMModuleParser::parseFunctionDefinitionSection):
35
36 2015-09-16  Sukolsak Sakshuwong  <sukolsak@gmail.com>
37
38         Fix 32-bit build issues in WebAssembly
39         https://bugs.webkit.org/show_bug.cgi?id=149240
40
41         Reviewed by Geoffrey Garen.
42
43         Fix the syntax error and replace the instructions that are not available on
44         64-bit platforms.
45
46         * wasm/WASMFunctionCompiler.h:
47         (JSC::WASMFunctionCompiler::startFunction):
48         (JSC::WASMFunctionCompiler::endFunction):
49         (JSC::WASMFunctionCompiler::buildReturn):
50         (JSC::WASMFunctionCompiler::callAndUnboxResult):
51         (JSC::WASMFunctionCompiler::loadValueAndConvertToDouble):
52
53 2015-09-16  Geoffrey Garen  <ggaren@apple.com>
54
55         JavaScriptCore should discard baseline code after some time
56         https://bugs.webkit.org/show_bug.cgi?id=149220
57
58         Reviewed by Saam Barati.
59
60         This is a bit more complicated than discarding optimized code because
61         the engine previously assumed that we would never discard baseline code.
62
63         * bytecode/CodeBlock.cpp:
64         (JSC::CodeBlock::CodeBlock): Record creation time (and compute time since
65         creation) instead of install time because CodeBlocks can be installed
66         more than once, and we don't want to have to worry about edge cases
67         created by CodeBlocks seeming to get younger.
68
69         (JSC::CodeBlock::visitAggregate): Be explicit about only doing the 
70         weak reference fixpoint for optimized CodeBlocks. We used to avoid the
71         fixpoint for baseline CodeBlocks implicitly, since they would always
72         visit themselves strongly right away. But now baseline CodeBlocks might
73         not visit themselves strongly, since they might choose to jettison due
74         to old age.
75
76         (JSC::CodeBlock::shouldVisitStrongly): Add old age as a reason not to
77         visit ourselves strongly, so that baseline CodeBlocks can jettison due
78         to old age.
79
80         (JSC::CodeBlock::shouldJettisonDueToWeakReference): Be explicit about
81         only jettisoning optimized CodeBlocks due to weak references so that we
82         don't confuse ourselves into thinking that we will jettison a baseline
83         CodeBlock due to weak references.
84
85         (JSC::CodeBlock::shouldJettisonDueToOldAge): Updated to use creation time.
86
87         (JSC::CodeBlock::visitOSRExitTargets): Clarify a comment and add an
88         ASSERT to help record some things I discovered while debugging.
89
90         (JSC::CodeBlock::jettison): Allow a baseline CodeBlock to jettison. Don't
91         assume that we have an alternative or a profiler.
92
93         (JSC::CodeBlock::install): Deleted.
94         * bytecode/CodeBlock.h:
95         (JSC::CodeBlock::releaseAlternative): Deleted.
96         (JSC::CodeBlock::setInstallTime): Deleted.
97         (JSC::CodeBlock::timeSinceInstall): Deleted.
98
99         * dfg/DFGOSRExitPreparation.cpp:
100         (JSC::DFG::prepareCodeOriginForOSRExit): Simplified the computation of
101         baseline CodeBlock.
102
103         * dfg/DFGPlan.cpp:
104         (JSC::DFG::Plan::checkLivenessAndVisitChildren): Be sure to strongly
105         visit our inline callframes because we assume that an optimized CodeBlock
106         will keep its OSR exit targets alive, but the CodeBlock object won't be
107         able to mark them for itself until compilation has completed (since it
108         won't have a JITCode object yet).
109
110         * dfg/DFGToFTLDeferredCompilationCallback.cpp:
111         (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
112         Updated for interface change.
113
114         * jit/JITCode.h:
115         (JSC::JITCode::timeToLive): Provide a time to live for interpreter and
116         baseline code, so they will jettison when old. Use seconds in our
117         code so that we don't need comments. Make DFG 2X interpreter+baseline,
118         and FTL 2X DFG+interpreter+baseline, also matching the time we allot
119         before throwing away all code.
120
121         * jit/JITToDFGDeferredCompilationCallback.cpp:
122         (JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
123         * llint/LLIntSlowPaths.cpp:
124         (JSC::LLInt::jitCompileAndSetHeuristics): Updated for interface change.
125
126         * runtime/Executable.cpp:
127         (JSC::ScriptExecutable::installCode): Allow our caller to install nullptr,
128         since we need to do this when jettisoning a baseline CodeBlock. Require
129         our caller to specify the details of the installation because we can't
130         rely on a non-null CodeBlock in order to compute them.
131
132         (JSC::ScriptExecutable::newCodeBlockFor):
133         (JSC::ScriptExecutable::prepareForExecutionImpl):
134         * runtime/Executable.h:
135         (JSC::ScriptExecutable::recordParse): Updated for interface change.
136
137         * runtime/Options.h: Renamed the CodeBlock liveness option since it now
138         controls baseline and optimized code.
139
140 2015-09-16  Geoffrey Garen  <ggaren@apple.com>
141
142         Remove obsolete code for deleting CodeBlocks
143         https://bugs.webkit.org/show_bug.cgi?id=149231
144
145         Reviewed by Mark Lam.
146
147         * heap/Heap.cpp:
148         (JSC::Heap::deleteAllCodeBlocks): ASSERT that we're called in a valid
149         state, and do the compiler waiting ourselves instead of having our
150         caller do it. This is more appropriate to our new limited use.
151
152         (JSC::Heap::collectImpl):
153         (JSC::Heap::deleteOldCode): Deleted. Don't call deleteAllCodeBlocks
154         periodically because it's not such a good idea to delete everything
155         at once, and CodeBlocks now have a more precise individual policy for
156         when to delete. Also, this function used to fail all or nearly all of
157         the time because its invariants that we were not executing or compiling
158         could not be met.
159
160         * heap/Heap.h:
161
162         * jsc.cpp:
163         (GlobalObject::finishCreation):
164         (functionDeleteAllCompiledCode): Deleted.
165         * tests/stress/deleteAllCompiledCode.js: Removed. Removed this testing
166         code because it did not do what it thought it did. All of this code
167         was guaranteed to no-op since it would run JavaScript to call a function
168         that would return early because JavaScript was running.
169
170         * runtime/VM.cpp:
171         (JSC::VM::deleteAllCode): This code is simpler now becaue 
172         heap.deleteAllCodeBlocks does some work for us.
173
174         * runtime/VMEntryScope.cpp:
175         (JSC::VMEntryScope::VMEntryScope): Don't delete code on VM entry. This
176         policy was old, and it dated back to a time when we 
177
178             (a) couldn't run in the interpreter if compilation failed;
179
180             (b) didn't reduce the rate of compilation in response to executable
181             memory pressure;
182
183             (c) didn't throw away individual CodeBlocks automatically.
184
185 2015-09-16  Michael Saboff  <msaboff@apple.com>
186
187         [ES6] Implement tail calls in the LLInt and Baseline JIT
188         https://bugs.webkit.org/show_bug.cgi?id=148661
189
190         Fix for the breakage of Speedometer/Full.html (https://bugs.webkit.org/show_bug.cgi?id=149162).
191
192         Reviewed by Filip Pizlo.
193         Changed SetupVarargsFrame.cpp::emitSetVarargsFrame to align the callframe size to be a
194         multiple of stackAlignmentRegisters() in addition to the location of the new frame.
195
196         Fixed Reviewed by Filip Pizlo.
197
198         * CMakeLists.txt:
199         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
200         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
201         * JavaScriptCore.xcodeproj/project.pbxproj:
202         * assembler/AbortReason.h:
203         * assembler/AbstractMacroAssembler.h:
204         (JSC::AbstractMacroAssembler::Call::Call):
205         (JSC::AbstractMacroAssembler::repatchNearCall):
206         (JSC::AbstractMacroAssembler::repatchCompact):
207         * assembler/CodeLocation.h:
208         (JSC::CodeLocationNearCall::CodeLocationNearCall):
209         (JSC::CodeLocationNearCall::callMode):
210         (JSC::CodeLocationCommon::callAtOffset):
211         (JSC::CodeLocationCommon::nearCallAtOffset):
212         (JSC::CodeLocationCommon::dataLabelPtrAtOffset):
213         * assembler/LinkBuffer.h:
214         (JSC::LinkBuffer::locationOfNearCall):
215         (JSC::LinkBuffer::locationOf):
216         * assembler/MacroAssemblerARM.h:
217         (JSC::MacroAssemblerARM::nearCall):
218         (JSC::MacroAssemblerARM::nearTailCall):
219         (JSC::MacroAssemblerARM::call):
220         (JSC::MacroAssemblerARM::linkCall):
221         * assembler/MacroAssemblerARM64.h:
222         (JSC::MacroAssemblerARM64::nearCall):
223         (JSC::MacroAssemblerARM64::nearTailCall):
224         (JSC::MacroAssemblerARM64::ret):
225         (JSC::MacroAssemblerARM64::linkCall):
226         * assembler/MacroAssemblerARMv7.h:
227         (JSC::MacroAssemblerARMv7::nearCall):
228         (JSC::MacroAssemblerARMv7::nearTailCall):
229         (JSC::MacroAssemblerARMv7::call):
230         (JSC::MacroAssemblerARMv7::linkCall):
231         * assembler/MacroAssemblerMIPS.h:
232         (JSC::MacroAssemblerMIPS::nearCall):
233         (JSC::MacroAssemblerMIPS::nearTailCall):
234         (JSC::MacroAssemblerMIPS::call):
235         (JSC::MacroAssemblerMIPS::linkCall):
236         (JSC::MacroAssemblerMIPS::repatchCall):
237         * assembler/MacroAssemblerSH4.h:
238         (JSC::MacroAssemblerSH4::call):
239         (JSC::MacroAssemblerSH4::nearTailCall):
240         (JSC::MacroAssemblerSH4::nearCall):
241         (JSC::MacroAssemblerSH4::linkCall):
242         (JSC::MacroAssemblerSH4::repatchCall):
243         * assembler/MacroAssemblerX86.h:
244         (JSC::MacroAssemblerX86::linkCall):
245         * assembler/MacroAssemblerX86Common.h:
246         (JSC::MacroAssemblerX86Common::breakpoint):
247         (JSC::MacroAssemblerX86Common::nearTailCall):
248         (JSC::MacroAssemblerX86Common::nearCall):
249         * assembler/MacroAssemblerX86_64.h:
250         (JSC::MacroAssemblerX86_64::linkCall):
251         * bytecode/BytecodeList.json:
252         * bytecode/BytecodeUseDef.h:
253         (JSC::computeUsesForBytecodeOffset):
254         (JSC::computeDefsForBytecodeOffset):
255         * bytecode/CallLinkInfo.h:
256         (JSC::CallLinkInfo::callTypeFor):
257         (JSC::CallLinkInfo::isVarargsCallType):
258         (JSC::CallLinkInfo::CallLinkInfo):
259         (JSC::CallLinkInfo::specializationKind):
260         (JSC::CallLinkInfo::callModeFor):
261         (JSC::CallLinkInfo::callMode):
262         (JSC::CallLinkInfo::isTailCall):
263         (JSC::CallLinkInfo::isVarargs):
264         (JSC::CallLinkInfo::registerPreservationMode):
265         * bytecode/CallLinkStatus.cpp:
266         (JSC::CallLinkStatus::computeFromLLInt):
267         * bytecode/CodeBlock.cpp:
268         (JSC::CodeBlock::dumpBytecode):
269         (JSC::CodeBlock::CodeBlock):
270         * bytecompiler/BytecodeGenerator.cpp:
271         (JSC::BytecodeGenerator::BytecodeGenerator):
272         (JSC::BytecodeGenerator::emitCallInTailPosition):
273         (JSC::BytecodeGenerator::emitCallEval):
274         (JSC::BytecodeGenerator::emitCall):
275         (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
276         (JSC::BytecodeGenerator::emitConstructVarargs):
277         * bytecompiler/NodesCodegen.cpp:
278         (JSC::CallArguments::CallArguments):
279         (JSC::LabelNode::emitBytecode):
280         * dfg/DFGByteCodeParser.cpp:
281         (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
282         * ftl/FTLLowerDFGToLLVM.cpp:
283         (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
284         * interpreter/Interpreter.h:
285         (JSC::Interpreter::isCallBytecode):
286         (JSC::calleeFrameForVarargs):
287         * jit/CCallHelpers.h:
288         (JSC::CCallHelpers::jumpToExceptionHandler):
289         (JSC::CCallHelpers::prepareForTailCallSlow):
290         * jit/JIT.cpp:
291         (JSC::JIT::privateCompileMainPass):
292         (JSC::JIT::privateCompileSlowCases):
293         * jit/JIT.h:
294         * jit/JITCall.cpp:
295         (JSC::JIT::compileOpCall):
296         (JSC::JIT::compileOpCallSlowCase):
297         (JSC::JIT::emit_op_call):
298         (JSC::JIT::emit_op_tail_call):
299         (JSC::JIT::emit_op_call_eval):
300         (JSC::JIT::emit_op_call_varargs):
301         (JSC::JIT::emit_op_tail_call_varargs):
302         (JSC::JIT::emit_op_construct_varargs):
303         (JSC::JIT::emitSlow_op_call):
304         (JSC::JIT::emitSlow_op_tail_call):
305         (JSC::JIT::emitSlow_op_call_eval):
306         (JSC::JIT::emitSlow_op_call_varargs):
307         (JSC::JIT::emitSlow_op_tail_call_varargs):
308         (JSC::JIT::emitSlow_op_construct_varargs):
309         * jit/JITCall32_64.cpp:
310         (JSC::JIT::emitSlow_op_call):
311         (JSC::JIT::emitSlow_op_tail_call):
312         (JSC::JIT::emitSlow_op_call_eval):
313         (JSC::JIT::emitSlow_op_call_varargs):
314         (JSC::JIT::emitSlow_op_tail_call_varargs):
315         (JSC::JIT::emitSlow_op_construct_varargs):
316         (JSC::JIT::emit_op_call):
317         (JSC::JIT::emit_op_tail_call):
318         (JSC::JIT::emit_op_call_eval):
319         (JSC::JIT::emit_op_call_varargs):
320         (JSC::JIT::emit_op_tail_call_varargs):
321         (JSC::JIT::emit_op_construct_varargs):
322         (JSC::JIT::compileOpCall):
323         (JSC::JIT::compileOpCallSlowCase):
324         * jit/JITInlines.h:
325         (JSC::JIT::emitNakedCall):
326         (JSC::JIT::emitNakedTailCall):
327         (JSC::JIT::updateTopCallFrame):
328         * jit/JITOperations.cpp:
329         * jit/JITOperations.h:
330         * jit/Repatch.cpp:
331         (JSC::linkVirtualFor):
332         (JSC::linkPolymorphicCall):
333         * jit/SetupVarargsFrame.cpp:
334         (JSC::emitSetVarargsFrame):
335         * jit/ThunkGenerators.cpp:
336         (JSC::throwExceptionFromCallSlowPathGenerator):
337         (JSC::slowPathFor):
338         (JSC::linkCallThunkGenerator):
339         (JSC::virtualThunkFor):
340         (JSC::arityFixupGenerator):
341         (JSC::unreachableGenerator):
342         (JSC::baselineGetterReturnThunkGenerator):
343         * jit/ThunkGenerators.h:
344         * llint/LowLevelInterpreter.asm:
345         * llint/LowLevelInterpreter32_64.asm:
346         * llint/LowLevelInterpreter64.asm:
347         * runtime/CommonSlowPaths.h:
348         (JSC::CommonSlowPaths::arityCheckFor):
349         (JSC::CommonSlowPaths::opIn):
350
351 2015-09-15  Michael Saboff  <msaboff@apple.com>
352
353         Rollout r189774 and 189818.
354
355         Broke Speedometer/Full.html
356
357         Not reviewed.
358
359         * CMakeLists.txt:
360         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
361         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
362         * JavaScriptCore.xcodeproj/project.pbxproj:
363         * assembler/AbortReason.h:
364         * assembler/AbstractMacroAssembler.h:
365         (JSC::AbstractMacroAssembler::Call::Call):
366         (JSC::AbstractMacroAssembler::repatchNearCall):
367         (JSC::AbstractMacroAssembler::repatchCompact):
368         * assembler/CodeLocation.h:
369         (JSC::CodeLocationNearCall::CodeLocationNearCall):
370         (JSC::CodeLocationCommon::callAtOffset):
371         (JSC::CodeLocationCommon::nearCallAtOffset):
372         (JSC::CodeLocationCommon::dataLabelPtrAtOffset):
373         (JSC::CodeLocationNearCall::callMode): Deleted.
374         * assembler/LinkBuffer.h:
375         (JSC::LinkBuffer::locationOfNearCall):
376         (JSC::LinkBuffer::locationOf):
377         * assembler/MacroAssemblerARM.h:
378         (JSC::MacroAssemblerARM::nearCall):
379         (JSC::MacroAssemblerARM::call):
380         (JSC::MacroAssemblerARM::linkCall):
381         (JSC::MacroAssemblerARM::nearTailCall): Deleted.
382         * assembler/MacroAssemblerARM64.h:
383         (JSC::MacroAssemblerARM64::nearCall):
384         (JSC::MacroAssemblerARM64::ret):
385         (JSC::MacroAssemblerARM64::linkCall):
386         (JSC::MacroAssemblerARM64::nearTailCall): Deleted.
387         * assembler/MacroAssemblerARMv7.h:
388         (JSC::MacroAssemblerARMv7::nearCall):
389         (JSC::MacroAssemblerARMv7::call):
390         (JSC::MacroAssemblerARMv7::linkCall):
391         (JSC::MacroAssemblerARMv7::nearTailCall): Deleted.
392         * assembler/MacroAssemblerMIPS.h:
393         (JSC::MacroAssemblerMIPS::nearCall):
394         (JSC::MacroAssemblerMIPS::call):
395         (JSC::MacroAssemblerMIPS::linkCall):
396         (JSC::MacroAssemblerMIPS::repatchCall):
397         (JSC::MacroAssemblerMIPS::nearTailCall): Deleted.
398         * assembler/MacroAssemblerSH4.h:
399         (JSC::MacroAssemblerSH4::call):
400         (JSC::MacroAssemblerSH4::nearCall):
401         (JSC::MacroAssemblerSH4::linkCall):
402         (JSC::MacroAssemblerSH4::repatchCall):
403         (JSC::MacroAssemblerSH4::nearTailCall): Deleted.
404         * assembler/MacroAssemblerX86.h:
405         (JSC::MacroAssemblerX86::linkCall):
406         * assembler/MacroAssemblerX86Common.h:
407         (JSC::MacroAssemblerX86Common::breakpoint):
408         (JSC::MacroAssemblerX86Common::nearCall):
409         (JSC::MacroAssemblerX86Common::nearTailCall): Deleted.
410         * assembler/MacroAssemblerX86_64.h:
411         (JSC::MacroAssemblerX86_64::linkCall):
412         * bytecode/BytecodeList.json:
413         * bytecode/BytecodeUseDef.h:
414         (JSC::computeUsesForBytecodeOffset):
415         (JSC::computeDefsForBytecodeOffset):
416         * bytecode/CallLinkInfo.h:
417         (JSC::CallLinkInfo::callTypeFor):
418         (JSC::CallLinkInfo::CallLinkInfo):
419         (JSC::CallLinkInfo::specializationKind):
420         (JSC::CallLinkInfo::registerPreservationMode):
421         (JSC::CallLinkInfo::isVarargsCallType): Deleted.
422         (JSC::CallLinkInfo::callModeFor): Deleted.
423         (JSC::CallLinkInfo::callMode): Deleted.
424         (JSC::CallLinkInfo::isTailCall): Deleted.
425         (JSC::CallLinkInfo::isVarargs): Deleted.
426         * bytecode/CallLinkStatus.cpp:
427         (JSC::CallLinkStatus::computeFromLLInt):
428         * bytecode/CodeBlock.cpp:
429         (JSC::CodeBlock::dumpBytecode):
430         (JSC::CodeBlock::CodeBlock):
431         * bytecompiler/BytecodeGenerator.cpp:
432         (JSC::BytecodeGenerator::BytecodeGenerator):
433         (JSC::BytecodeGenerator::emitCallInTailPosition):
434         (JSC::BytecodeGenerator::emitCallEval):
435         (JSC::BytecodeGenerator::emitCall):
436         (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
437         (JSC::BytecodeGenerator::emitConstructVarargs):
438         * bytecompiler/NodesCodegen.cpp:
439         (JSC::CallArguments::CallArguments):
440         (JSC::LabelNode::emitBytecode):
441         * dfg/DFGByteCodeParser.cpp:
442         (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
443         * ftl/FTLLowerDFGToLLVM.cpp:
444         (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
445         * interpreter/Interpreter.h:
446         (JSC::Interpreter::isCallBytecode):
447         * jit/CCallHelpers.h:
448         (JSC::CCallHelpers::jumpToExceptionHandler):
449         (JSC::CCallHelpers::prepareForTailCallSlow): Deleted.
450         * jit/JIT.cpp:
451         (JSC::JIT::privateCompileMainPass):
452         (JSC::JIT::privateCompileSlowCases):
453         * jit/JIT.h:
454         * jit/JITCall.cpp:
455         (JSC::JIT::compileOpCall):
456         (JSC::JIT::compileOpCallSlowCase):
457         (JSC::JIT::emit_op_call):
458         (JSC::JIT::emit_op_call_eval):
459         (JSC::JIT::emit_op_call_varargs):
460         (JSC::JIT::emit_op_construct_varargs):
461         (JSC::JIT::emitSlow_op_call):
462         (JSC::JIT::emitSlow_op_call_eval):
463         (JSC::JIT::emitSlow_op_call_varargs):
464         (JSC::JIT::emitSlow_op_construct_varargs):
465         (JSC::JIT::emit_op_tail_call): Deleted.
466         (JSC::JIT::emit_op_tail_call_varargs): Deleted.
467         (JSC::JIT::emitSlow_op_tail_call): Deleted.
468         (JSC::JIT::emitSlow_op_tail_call_varargs): Deleted.
469         * jit/JITCall32_64.cpp:
470         (JSC::JIT::emitSlow_op_call):
471         (JSC::JIT::emitSlow_op_call_eval):
472         (JSC::JIT::emitSlow_op_call_varargs):
473         (JSC::JIT::emitSlow_op_construct_varargs):
474         (JSC::JIT::emit_op_call):
475         (JSC::JIT::emit_op_call_eval):
476         (JSC::JIT::emit_op_call_varargs):
477         (JSC::JIT::emit_op_construct_varargs):
478         (JSC::JIT::compileOpCall):
479         (JSC::JIT::compileOpCallSlowCase):
480         (JSC::JIT::emitSlow_op_tail_call): Deleted.
481         (JSC::JIT::emitSlow_op_tail_call_varargs): Deleted.
482         (JSC::JIT::emit_op_tail_call): Deleted.
483         (JSC::JIT::emit_op_tail_call_varargs): Deleted.
484         * jit/JITInlines.h:
485         (JSC::JIT::emitNakedCall):
486         (JSC::JIT::updateTopCallFrame):
487         (JSC::JIT::emitNakedTailCall): Deleted.
488         * jit/JITOperations.cpp:
489         * jit/JITOperations.h:
490         * jit/Repatch.cpp:
491         (JSC::linkVirtualFor):
492         (JSC::linkPolymorphicCall):
493         * jit/ThunkGenerators.cpp:
494         (JSC::throwExceptionFromCallSlowPathGenerator):
495         (JSC::slowPathFor):
496         (JSC::linkCallThunkGenerator):
497         (JSC::virtualThunkFor):
498         (JSC::arityFixupGenerator):
499         (JSC::baselineGetterReturnThunkGenerator):
500         (JSC::unreachableGenerator): Deleted.
501         * jit/ThunkGenerators.h:
502         * llint/LowLevelInterpreter.asm:
503         * llint/LowLevelInterpreter32_64.asm:
504         * llint/LowLevelInterpreter64.asm:
505         * runtime/CommonSlowPaths.h:
506         (JSC::CommonSlowPaths::arityCheckFor):
507         (JSC::CommonSlowPaths::opIn):
508         * tests/stress/mutual-tail-call-no-stack-overflow.js: Removed.
509         * tests/stress/tail-call-no-stack-overflow.js: Removed.
510         * tests/stress/tail-call-recognize.js: Removed.
511         * tests/stress/tail-call-varargs-no-stack-overflow.js: Removed.
512         * tests/stress/tail-calls-dont-overwrite-live-stack.js: Removed.
513
514 2015-09-15  Sukolsak Sakshuwong  <sukolsak@gmail.com>
515
516         Implement imported global variables in WebAssembly
517         https://bugs.webkit.org/show_bug.cgi?id=149206
518
519         Reviewed by Filip Pizlo.
520
521         Values can now be imported to a WebAssembly module through properties of
522         the imports object that is passed to loadWebAssembly(). In order to
523         avoid any side effect when accessing the imports object, we check that
524         the properties are data properties. We also check that each value is a
525         primitive and is not a Symbol. According to the ECMA262 6.0 spec,
526         calling ToNumber() on a primitive that is not a Symbol should not cause
527         any side effect.[1]
528
529         [1]: http://www.ecma-international.org/ecma-262/6.0/#sec-tonumber
530
531         * tests/stress/wasm-globals.js:
532         * tests/stress/wasm/globals.wasm:
533         * wasm/WASMModuleParser.cpp:
534         (JSC::WASMModuleParser::parseModule):
535         (JSC::WASMModuleParser::parseGlobalSection):
536         * wasm/WASMModuleParser.h:
537
538 2015-09-15  Sukolsak Sakshuwong  <sukolsak@gmail.com>
539
540         Fix asm.js errors in WebAssembly tests
541         https://bugs.webkit.org/show_bug.cgi?id=149203
542
543         Reviewed by Geoffrey Garen.
544
545         Our WebAssembly implementation uses asm.js for testing. Using Firefox to
546         parse asm.js reveals many errors that are not caught by pack-asmjs. For
547         example,
548         - asm.js does not allow the use of the multiplication operator (*) to
549           multiply two integers, because the result can be so large that some
550           lower bits of precision are lost. Math.imul is used instead.
551         - an int variable must be coerced to either signed (via x|0) or unsigned
552           (via x>>>0) before it's returned.
553
554         * tests/stress/wasm-arithmetic-int32.js:
555         * tests/stress/wasm-calls.js:
556         * tests/stress/wasm-control-flow.js:
557         * tests/stress/wasm-globals.js:
558         * tests/stress/wasm-locals.js:
559         * tests/stress/wasm-relational.js:
560         * tests/stress/wasm/control-flow.wasm:
561
562 2015-09-15  Ryosuke Niwa  <rniwa@webkit.org>
563
564         Add ShadowRoot interface and Element.prototype.attachShadow
565         https://bugs.webkit.org/show_bug.cgi?id=149187
566
567         Reviewed by Antti Koivisto.
568
569         * Configurations/FeatureDefines.xcconfig:
570
571 2015-09-15  Joseph Pecoraro  <pecoraro@apple.com>
572
573         Web Inspector: Paused Debugger prevents page reload
574         https://bugs.webkit.org/show_bug.cgi?id=148174
575
576         Reviewed by Brian Burg.
577
578         * debugger/Debugger.h:
579         (JSC::Debugger::suppressAllPauses):
580         (JSC::Debugger::setSuppressAllPauses):
581         * debugger/Debugger.cpp:
582         (JSC::Debugger::Debugger):
583         (JSC::Debugger::pauseIfNeeded):
584         * inspector/agents/InspectorDebuggerAgent.h:
585         * inspector/agents/InspectorDebuggerAgent.cpp:
586         (Inspector::InspectorDebuggerAgent::setSuppressAllPauses):
587         Provide a way to suppress pauses.
588
589 2015-09-15  Sukolsak Sakshuwong  <sukolsak@gmail.com>
590
591         Implement calls to JavaScript functions in WebAssembly
592         https://bugs.webkit.org/show_bug.cgi?id=149093
593
594         Reviewed by Filip Pizlo.
595
596         This patch implements calls to JavaScript functions in WebAssembly.
597         WebAssembly functions can only call JavaScript functions that are
598         imported to their module via an object that is passed into
599         loadWebAssembly(). References to JavaScript functions are resolved at
600         the module's load time, just like asm.js.
601
602         * jsc.cpp:
603         (GlobalObject::finishCreation):
604         (functionLoadWebAssembly):
605         * tests/stress/wasm-calls.js:
606         * tests/stress/wasm/calls.wasm:
607         * wasm/JSWASMModule.cpp:
608         (JSC::JSWASMModule::visitChildren):
609         * wasm/JSWASMModule.h:
610         (JSC::JSWASMModule::importedFunctions):
611         * wasm/WASMFunctionCompiler.h:
612         (JSC::WASMFunctionCompiler::buildCallImport):
613         * wasm/WASMFunctionParser.cpp:
614         (JSC::WASMFunctionParser::parseExpressionI32):
615         (JSC::WASMFunctionParser::parseExpressionF64):
616         (JSC::WASMFunctionParser::parseCallImport):
617         * wasm/WASMFunctionParser.h:
618         * wasm/WASMFunctionSyntaxChecker.h:
619         (JSC::WASMFunctionSyntaxChecker::buildCallInternal):
620         (JSC::WASMFunctionSyntaxChecker::buildCallImport):
621         (JSC::WASMFunctionSyntaxChecker::updateTempStackHeightForCall):
622         * wasm/WASMModuleParser.cpp:
623         (JSC::WASMModuleParser::WASMModuleParser):
624         (JSC::WASMModuleParser::parse):
625         (JSC::WASMModuleParser::parseModule):
626         (JSC::WASMModuleParser::parseFunctionImportSection):
627         (JSC::WASMModuleParser::getImportedValue):
628         (JSC::parseWebAssembly):
629         * wasm/WASMModuleParser.h:
630
631 2015-09-15  Csaba Osztrogon√°c  <ossy@webkit.org>
632
633         Fix the !ENABLE(DFG_JIT) build after r188696
634         https://bugs.webkit.org/show_bug.cgi?id=149158
635
636         Reviewed by Yusuke Suzuki.
637
638         * bytecode/GetByIdStatus.cpp:
639         * bytecode/GetByIdStatus.h:
640
641 2015-09-15  Saam barati  <sbarati@apple.com>
642
643         functions that use try/catch will allocate a top level JSLexicalEnvironment even when it is not necessary
644         https://bugs.webkit.org/show_bug.cgi?id=148169
645
646         Reviewed by Geoffrey Garen.
647
648         We used to do this before we had proper lexical scoping
649         in the bytecode generator. There is absolutely no reason
650         why need to allocate a top-level "var" activation when a
651         function/program uses a "catch" block.
652
653         * parser/ASTBuilder.h:
654         (JSC::ASTBuilder::createTryStatement):
655         (JSC::ASTBuilder::incConstants):
656         (JSC::ASTBuilder::usesThis):
657         (JSC::ASTBuilder::usesArguments):
658         (JSC::ASTBuilder::usesWith):
659         (JSC::ASTBuilder::usesEval):
660         (JSC::ASTBuilder::usesCatch): Deleted.
661         * parser/Nodes.h:
662         (JSC::ScopeNode::isStrictMode):
663         (JSC::ScopeNode::setUsesArguments):
664         (JSC::ScopeNode::usesThis):
665         (JSC::ScopeNode::needsActivation):
666         (JSC::ScopeNode::hasCapturedVariables):
667         (JSC::ScopeNode::captures):
668         (JSC::ScopeNode::needsActivationForMoreThanVariables): Deleted.
669         * parser/ParserModes.h:
670         * runtime/Executable.h:
671         (JSC::ScriptExecutable::usesEval):
672         (JSC::ScriptExecutable::usesArguments):
673         (JSC::ScriptExecutable::needsActivation):
674         (JSC::ScriptExecutable::isStrictMode):
675         (JSC::ScriptExecutable::ecmaMode):
676
677 2015-09-15  Michael Saboff  <msaboff@apple.com>
678
679         REGRESSION(r189774): CLoop doesn't build after r189774
680         https://bugs.webkit.org/show_bug.cgi?id=149171
681
682         Unreviewed build fix for the C Loop.
683
684         Added needed C Loop label opcodes.
685
686         * bytecode/BytecodeList.json:
687
688 2015-09-15  Andy VanWagoner  <thetalecrafter@gmail.com>
689
690         [INTL] Implement supportedLocalesOf on Intl Constructors
691         https://bugs.webkit.org/show_bug.cgi?id=147599
692
693         Reviewed by Benjamin Poulain.
694
695         Implements all of the abstract operations used by supportedLocalesOf,
696         except during canonicalization it does not replace redundant tags,
697         or subtags with their preferred values.
698
699         * icu/unicode/ucal.h: Added.
700         * icu/unicode/udat.h: Added.
701         * icu/unicode/umisc.h: Added.
702         * icu/unicode/unum.h: Added.
703         * icu/unicode/utypes.h: Clear the U_SHOW_CPLUSPLUS_API flag to prevent C++ headers from being included.
704         * runtime/CommonIdentifiers.h: Adde localeMatcher.
705         * runtime/IntlCollatorConstructor.cpp:
706         (JSC::IntlCollatorConstructorFuncSupportedLocalesOf): Implemented.
707         * runtime/IntlDateTimeFormatConstructor.cpp:
708         (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf): Implemented.
709         * runtime/IntlNumberFormatConstructor.cpp:
710         (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf): Implemented.
711         * runtime/IntlObject.cpp:
712         (JSC::canonicalizeLanguageTag):
713         (JSC::getCanonicalLangTag):
714         (JSC::getPrivateUseLangTag):
715         (JSC::getGrandfatheredLangTag):
716         (JSC::canonicalizeLocaleList):
717         (JSC::bestAvailableLocale):
718         (JSC::lookupSupportedLocales):
719         (JSC::bestFitSupportedLocales):
720         (JSC::supportedLocales):
721         (JSC::getIntlStringOption):
722         (JSC::getIntlBooleanOption):
723         * runtime/IntlObject.h:
724         * runtime/JSCJSValue.h: Added toLength.
725         * runtime/JSCJSValue.cpp: Added toLength.
726         (JSC::JSValue::toLength): Implement ToLength from ECMA 262 6.0 7.1.15
727         * runtime/JSGlobalObject.cpp:
728         (JSC::JSGlobalObject::intlCollatorAvailableLocales): Added lazy locale list.
729         (JSC::JSGlobalObject::intlDateTimeFormatAvailableLocales): Added lazy locale list.
730         (JSC::JSGlobalObject::intlNumberFormatAvailableLocales): Added lazy locale list.
731         * runtime/JSGlobalObject.h:
732
733 2015-09-14  Saam barati  <sbarati@apple.com>
734
735         rename callFrameForThrow to callFrameForCatch
736         https://bugs.webkit.org/show_bug.cgi?id=149136
737
738         Reviewed by Michael Saboff.
739
740         We use "callFrameForThrow" to mean the call frame in
741         which we're catching the exception. The field name
742         should accurately represent its purpose by being
743         named "callFrameForCatch".
744
745         * jit/CCallHelpers.h:
746         (JSC::CCallHelpers::jumpToExceptionHandler):
747         * jit/JITExceptions.cpp:
748         (JSC::genericUnwind):
749         * jit/JITOpcodes.cpp:
750         (JSC::JIT::emit_op_catch):
751         * jit/JITOpcodes32_64.cpp:
752         (JSC::JIT::emit_op_catch):
753         * jit/JITOperations.cpp:
754         * llint/LowLevelInterpreter32_64.asm:
755         * llint/LowLevelInterpreter64.asm:
756         * runtime/VM.h:
757         (JSC::VM::exceptionOffset):
758         (JSC::VM::callFrameForCatchOffset):
759         (JSC::VM::targetMachinePCForThrowOffset):
760         (JSC::VM::callFrameForThrowOffset): Deleted.
761
762 2015-09-14  Basile Clement  <basile_clement@apple.com>
763
764         [ES6] Implement tail calls in the LLInt and Baseline JIT
765         https://bugs.webkit.org/show_bug.cgi?id=148661
766
767         Reviewed by Filip Pizlo.
768
769         This patch introduces two new opcodes, op_tail_call and
770         op_tail_call_varargs, to perform tail calls, and implements them in the
771         LLInt and baseline JIT. Their use prevents DFG and FTL compilation for
772         now. They are currently implemented by sliding the call frame and
773         masquerading as our own caller right before performing an actual call.
774
775         This required to change the operationLink family of operation to return
776         a SlowPathReturnType instead of a char* in order to distinguish between
777         exception cases and actual call cases. We introduce a new FrameAction
778         enum that indicates whether to reuse (non-exceptional tail call) or
779         keep the current call frame (non-tail call, and exceptional cases).
780
781         This is also a semantics change, since the Function.caller property is
782         now leaking tail calls. Since tail calls are only used in strict mode,
783         which poisons this property, the only way of seeing this semantics
784         change is when a sloppy function calls a strict function that then
785         tail-calls a sloppy function. Previously, the second sloppy function's
786         caller would have been the strict function (i.e. raises a TypeError
787         when the .caller attribute is accessed), while it is now the first
788         sloppy function. Tests have been updated to reflect that.
789
790         This also changes the assumptions we make about call frames. In order
791         to be relatively efficient, we want to be able to compute the frame
792         size based only on the argument count, which was not possible
793         previously. To enable this, we now enforce at the bytecode generator,
794         DFG and FTL level that any space reserved for a call frame is
795         stack-aligned, which allows to easily compute its size when performing
796         a tail call. In all the "special call cases" (calls from native code,
797         inlined cache calls, etc.), we are starting the frame at the current
798         stack pointer and thus will always have a stack-aligned frame size.
799
800         Finally, this patch adds a couple of tests to check that tail calls run
801         in constant stack space, as well as tests checking that tail calls are
802         recognized correctly. Those tests use the handy aforementioned leaking
803         of tail calls through Function.caller to detect tail calls. 
804
805         Given that this patch only implements tail calls for the LLInt and
806         Baseline JIT, tail calls are disabled by default.  Until changes are
807         landed for all tiers, tail call testing and use requires the
808         --enableTailCalls=true or equivalent.
809
810         * CMakeLists.txt:
811         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
812         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
813         * JavaScriptCore.xcodeproj/project.pbxproj:
814         * assembler/AbortReason.h:
815         * assembler/AbstractMacroAssembler.h:
816         (JSC::AbstractMacroAssembler::Call::Call):
817         (JSC::AbstractMacroAssembler::repatchNearCall):
818         (JSC::AbstractMacroAssembler::repatchCompact):
819         * assembler/CodeLocation.h:
820         (JSC::CodeLocationNearCall::CodeLocationNearCall):
821         (JSC::CodeLocationNearCall::callMode):
822         (JSC::CodeLocationCommon::callAtOffset):
823         (JSC::CodeLocationCommon::nearCallAtOffset):
824         (JSC::CodeLocationCommon::dataLabelPtrAtOffset):
825         * assembler/LinkBuffer.h:
826         (JSC::LinkBuffer::locationOfNearCall):
827         (JSC::LinkBuffer::locationOf):
828         * assembler/MacroAssemblerARM.h:
829         (JSC::MacroAssemblerARM::nearCall):
830         (JSC::MacroAssemblerARM::nearTailCall):
831         (JSC::MacroAssemblerARM::call):
832         (JSC::MacroAssemblerARM::linkCall):
833         * assembler/MacroAssemblerARM64.h:
834         (JSC::MacroAssemblerARM64::nearCall):
835         (JSC::MacroAssemblerARM64::nearTailCall):
836         (JSC::MacroAssemblerARM64::ret):
837         (JSC::MacroAssemblerARM64::linkCall):
838         * assembler/MacroAssemblerARMv7.h:
839         (JSC::MacroAssemblerARMv7::nearCall):
840         (JSC::MacroAssemblerARMv7::nearTailCall):
841         (JSC::MacroAssemblerARMv7::call):
842         (JSC::MacroAssemblerARMv7::linkCall):
843         * assembler/MacroAssemblerMIPS.h:
844         (JSC::MacroAssemblerMIPS::nearCall):
845         (JSC::MacroAssemblerMIPS::nearTailCall):
846         (JSC::MacroAssemblerMIPS::call):
847         (JSC::MacroAssemblerMIPS::linkCall):
848         (JSC::MacroAssemblerMIPS::repatchCall):
849         * assembler/MacroAssemblerSH4.h:
850         (JSC::MacroAssemblerSH4::call):
851         (JSC::MacroAssemblerSH4::nearTailCall):
852         (JSC::MacroAssemblerSH4::nearCall):
853         (JSC::MacroAssemblerSH4::linkCall):
854         (JSC::MacroAssemblerSH4::repatchCall):
855         * assembler/MacroAssemblerX86.h:
856         (JSC::MacroAssemblerX86::linkCall):
857         * assembler/MacroAssemblerX86Common.h:
858         (JSC::MacroAssemblerX86Common::breakpoint):
859         (JSC::MacroAssemblerX86Common::nearTailCall):
860         (JSC::MacroAssemblerX86Common::nearCall):
861         * assembler/MacroAssemblerX86_64.h:
862         (JSC::MacroAssemblerX86_64::linkCall):
863         * bytecode/BytecodeList.json:
864         * bytecode/BytecodeUseDef.h:
865         (JSC::computeUsesForBytecodeOffset):
866         (JSC::computeDefsForBytecodeOffset):
867         * bytecode/CallLinkInfo.h:
868         (JSC::CallLinkInfo::callTypeFor):
869         (JSC::CallLinkInfo::isVarargsCallType):
870         (JSC::CallLinkInfo::CallLinkInfo):
871         (JSC::CallLinkInfo::specializationKind):
872         (JSC::CallLinkInfo::callModeFor):
873         (JSC::CallLinkInfo::callMode):
874         (JSC::CallLinkInfo::isTailCall):
875         (JSC::CallLinkInfo::isVarargs):
876         (JSC::CallLinkInfo::registerPreservationMode):
877         * bytecode/CallLinkStatus.cpp:
878         (JSC::CallLinkStatus::computeFromLLInt):
879         * bytecode/CallMode.cpp: Added.
880         (WTF::printInternal):
881         * bytecode/CallMode.h: Added.
882         * bytecode/CodeBlock.cpp:
883         (JSC::CodeBlock::dumpBytecode):
884         (JSC::CodeBlock::CodeBlock):
885         * bytecompiler/BytecodeGenerator.cpp:
886         (JSC::BytecodeGenerator::BytecodeGenerator):
887         (JSC::BytecodeGenerator::emitCallInTailPosition):
888         (JSC::BytecodeGenerator::emitCallEval):
889         (JSC::BytecodeGenerator::emitCall):
890         (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
891         (JSC::BytecodeGenerator::emitConstructVarargs):
892         * bytecompiler/NodesCodegen.cpp:
893         (JSC::CallArguments::CallArguments):
894         (JSC::LabelNode::emitBytecode):
895         * dfg/DFGByteCodeParser.cpp:
896         (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
897         * ftl/FTLLowerDFGToLLVM.cpp:
898         (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
899         * interpreter/Interpreter.h:
900         (JSC::Interpreter::isCallBytecode):
901         * jit/CCallHelpers.h:
902         (JSC::CCallHelpers::jumpToExceptionHandler):
903         (JSC::CCallHelpers::prepareForTailCallSlow):
904         * jit/JIT.cpp:
905         (JSC::JIT::privateCompileMainPass):
906         (JSC::JIT::privateCompileSlowCases):
907         * jit/JIT.h:
908         * jit/JITCall.cpp:
909         (JSC::JIT::compileOpCall):
910         (JSC::JIT::compileOpCallSlowCase):
911         (JSC::JIT::emit_op_call):
912         (JSC::JIT::emit_op_tail_call):
913         (JSC::JIT::emit_op_call_eval):
914         (JSC::JIT::emit_op_call_varargs):
915         (JSC::JIT::emit_op_tail_call_varargs):
916         (JSC::JIT::emit_op_construct_varargs):
917         (JSC::JIT::emitSlow_op_call):
918         (JSC::JIT::emitSlow_op_tail_call):
919         (JSC::JIT::emitSlow_op_call_eval):
920         (JSC::JIT::emitSlow_op_call_varargs):
921         (JSC::JIT::emitSlow_op_tail_call_varargs):
922         (JSC::JIT::emitSlow_op_construct_varargs):
923         * jit/JITCall32_64.cpp:
924         (JSC::JIT::emitSlow_op_call):
925         (JSC::JIT::emitSlow_op_tail_call):
926         (JSC::JIT::emitSlow_op_call_eval):
927         (JSC::JIT::emitSlow_op_call_varargs):
928         (JSC::JIT::emitSlow_op_tail_call_varargs):
929         (JSC::JIT::emitSlow_op_construct_varargs):
930         (JSC::JIT::emit_op_call):
931         (JSC::JIT::emit_op_tail_call):
932         (JSC::JIT::emit_op_call_eval):
933         (JSC::JIT::emit_op_call_varargs):
934         (JSC::JIT::emit_op_tail_call_varargs):
935         (JSC::JIT::emit_op_construct_varargs):
936         (JSC::JIT::compileOpCall):
937         (JSC::JIT::compileOpCallSlowCase):
938         * jit/JITInlines.h:
939         (JSC::JIT::emitNakedCall):
940         (JSC::JIT::emitNakedTailCall):
941         (JSC::JIT::updateTopCallFrame):
942         * jit/JITOperations.cpp:
943         * jit/JITOperations.h:
944         * jit/Repatch.cpp:
945         (JSC::linkVirtualFor):
946         (JSC::linkPolymorphicCall):
947         * jit/ThunkGenerators.cpp:
948         (JSC::throwExceptionFromCallSlowPathGenerator):
949         (JSC::slowPathFor):
950         (JSC::linkCallThunkGenerator):
951         (JSC::virtualThunkFor):
952         (JSC::arityFixupGenerator):
953         (JSC::unreachableGenerator):
954         (JSC::baselineGetterReturnThunkGenerator):
955         * jit/ThunkGenerators.h:
956         * llint/LowLevelInterpreter.asm:
957         * llint/LowLevelInterpreter32_64.asm:
958         * llint/LowLevelInterpreter64.asm:
959         * runtime/CommonSlowPaths.h:
960         (JSC::CommonSlowPaths::arityCheckFor):
961         (JSC::CommonSlowPaths::opIn):
962         * runtime/Options.h:
963         * tests/stress/mutual-tail-call-no-stack-overflow.js: Added.
964         (shouldThrow):
965         (sloppyCountdown.even):
966         (sloppyCountdown.odd):
967         (strictCountdown.even):
968         (strictCountdown.odd):
969         (strictCountdown):
970         (odd):
971         (even):
972         * tests/stress/tail-call-no-stack-overflow.js: Added.
973         (shouldThrow):
974         (strictLoop):
975         (strictLoopArityFixup1):
976         (strictLoopArityFixup2):
977         * tests/stress/tail-call-recognize.js: Added.
978         (callerMustBeRun):
979         (callerMustBeStrict):
980         (runTests):
981         * tests/stress/tail-call-varargs-no-stack-overflow.js: Added.
982         (shouldThrow):
983         (strictLoop):
984         * tests/stress/tail-calls-dont-overwrite-live-stack.js: Added.
985         (tail):
986         (obj.method):
987         (obj.get fromNative):
988         (getThis):
989
990 2015-09-14  Filip Pizlo  <fpizlo@apple.com>
991
992         LLInt get/put inline caches shouldn't use tons of opcodes
993         https://bugs.webkit.org/show_bug.cgi?id=149106
994
995         Reviewed by Geoffrey Garen.
996
997         Our LLInt get/put inline caches currently use separate opcodes to reduce branching. For
998         example, instead of having get_by_id branch on the kind of offset (inline or
999         out-of-line), we have two get_by_id instructions: get_by_id and get_by_id_out_of_line.
1000         But the problem with this approach is that it doesn't scale. In the property type
1001         inference work (https://bugs.webkit.org/show_bug.cgi?id=148610), we need each kind of put
1002         inline cache to support 11 different kinds of type checks. It seemed ridiculous to add 60
1003         new put_by_id opcodes (there are currently 6 variants of put_by_id, so after adding type
1004         checks, we'd have 6 * 11 = 66 variants of put_by_id).
1005
1006         So, this patch completely changes the strategy to mostly using branching inside the
1007         opcode implementation. It's unlikely to have a performance effect. For example, the long
1008         road to generational GC caused a seemingly prohibitive regression in LLInt inline caches,
1009         and yet nobody noticed. The regression was because the inline cache was in terms of the
1010         structure, not the structure ID, so the code was doing a structure ID table lookup. If we
1011         didn't notice that, then we probably won't notice a couple new branches. (Also, this
1012         patch fixes that regression - the code no longer does such lookups except in the one
1013         unavoidable case in put_by_id transition chain checking.)
1014
1015         This patch also turns the isDirect operand of put_by_id into a flags field. I will use
1016         this flags field to encode the desired type check in bug 148610.
1017
1018         This patch has no effect on performance according to run-jsc-benchmarks.
1019
1020         Relanding this patch with LLInt fixes for non-x86. Previous attempts to fix non-x86 LLInt
1021         build also caused every 64-bit test to crash on every platform. So the patch got rolled
1022         out. This fixes the non-x86 LLInt build while also ensuring that 64-bit platforms don't
1023         crash.
1024
1025         * CMakeLists.txt:
1026         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1027         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1028         * JavaScriptCore.xcodeproj/project.pbxproj:
1029         * bytecode/BytecodeList.json:
1030         * bytecode/BytecodeUseDef.h:
1031         (JSC::computeUsesForBytecodeOffset):
1032         (JSC::computeDefsForBytecodeOffset):
1033         * bytecode/CodeBlock.cpp:
1034         (JSC::CodeBlock::printGetByIdOp):
1035         (JSC::CodeBlock::printGetByIdCacheStatus):
1036         (JSC::CodeBlock::printPutByIdCacheStatus):
1037         (JSC::CodeBlock::dumpBytecode):
1038         (JSC::CodeBlock::CodeBlock):
1039         (JSC::CodeBlock::propagateTransitions):
1040         (JSC::CodeBlock::finalizeLLIntInlineCaches):
1041         * bytecode/CodeBlock.h:
1042         * bytecode/GetByIdStatus.cpp:
1043         (JSC::GetByIdStatus::computeFromLLInt):
1044         * bytecode/Instruction.h:
1045         (JSC::Instruction::Instruction):
1046         * bytecode/PutByIdFlags.cpp: Added.
1047         (WTF::printInternal):
1048         * bytecode/PutByIdFlags.h: Added.
1049         * bytecode/PutByIdStatus.cpp:
1050         (JSC::PutByIdStatus::computeFromLLInt):
1051         * bytecode/UnlinkedCodeBlock.h:
1052         (JSC::UnlinkedInstruction::UnlinkedInstruction):
1053         * bytecompiler/BytecodeGenerator.cpp:
1054         (JSC::BytecodeGenerator::emitPutById):
1055         (JSC::BytecodeGenerator::emitDirectPutById):
1056         * dfg/DFGByteCodeParser.cpp:
1057         (JSC::DFG::ByteCodeParser::parseBlock):
1058         * dfg/DFGCapabilities.cpp:
1059         (JSC::DFG::capabilityLevel):
1060         * jit/JIT.cpp:
1061         (JSC::JIT::privateCompileMainPass):
1062         (JSC::JIT::privateCompileSlowCases):
1063         * jit/JITPropertyAccess.cpp:
1064         (JSC::JIT::emit_op_put_by_id):
1065         * jit/JITPropertyAccess32_64.cpp:
1066         (JSC::JIT::emit_op_put_by_id):
1067         * llint/LLIntSlowPaths.cpp:
1068         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1069         * llint/LowLevelInterpreter32_64.asm:
1070         * llint/LowLevelInterpreter64.asm:
1071
1072 2015-09-14  Commit Queue  <commit-queue@webkit.org>
1073
1074         Unreviewed, rolling out r189751, r189752, and r189754.
1075         https://bugs.webkit.org/show_bug.cgi?id=149143
1076
1077         caused crashes everywhere (Requested by alexchristensen on
1078         #webkit).
1079
1080         Reverted changesets:
1081
1082         "LLInt get/put inline caches shouldn't use tons of opcodes"
1083         https://bugs.webkit.org/show_bug.cgi?id=149106
1084         http://trac.webkit.org/changeset/189751
1085
1086         "Unreviewed, fix non-x86 LLInt build."
1087         http://trac.webkit.org/changeset/189752
1088
1089         "Unreviewed, really fix non-x86 LLInt build without also
1090         breaking everything else."
1091         http://trac.webkit.org/changeset/189754
1092
1093 2015-09-14  Filip Pizlo  <fpizlo@apple.com>
1094
1095         Unreviewed, really fix non-x86 LLInt build without also breaking everything else.
1096
1097         * llint/LowLevelInterpreter64.asm:
1098
1099 2015-09-14  Filip Pizlo  <fpizlo@apple.com>
1100
1101         Unreviewed, fix non-x86 LLInt build.
1102
1103         * llint/LowLevelInterpreter64.asm:
1104
1105 2015-09-13  Filip Pizlo  <fpizlo@apple.com>
1106
1107         LLInt get/put inline caches shouldn't use tons of opcodes
1108         https://bugs.webkit.org/show_bug.cgi?id=149106
1109
1110         Reviewed by Geoffrey Garen.
1111
1112         Our LLInt get/put inline caches currently use separate opcodes to reduce branching. For
1113         example, instead of having get_by_id branch on the kind of offset (inline or
1114         out-of-line), we have two get_by_id instructions: get_by_id and get_by_id_out_of_line.
1115         But the problem with this approach is that it doesn't scale. In the property type
1116         inference work (https://bugs.webkit.org/show_bug.cgi?id=148610), we need each kind of put
1117         inline cache to support 11 different kinds of type checks. It seemed ridiculous to add 60
1118         new put_by_id opcodes (there are currently 6 variants of put_by_id, so after adding type
1119         checks, we'd have 6 * 11 = 66 variants of put_by_id).
1120
1121         So, this patch completely changes the strategy to mostly using branching inside the
1122         opcode implementation. It's unlikely to have a performance effect. For example, the long
1123         road to generational GC caused a seemingly prohibitive regression in LLInt inline caches,
1124         and yet nobody noticed. The regression was because the inline cache was in terms of the
1125         structure, not the structure ID, so the code was doing a structure ID table lookup. If we
1126         didn't notice that, then we probably won't notice a couple new branches. (Also, this
1127         patch fixes that regression - the code no longer does such lookups except in the one
1128         unavoidable case in put_by_id transition chain checking.)
1129
1130         This patch also turns the isDirect operand of put_by_id into a flags field. I will use
1131         this flags field to encode the desired type check in bug 148610.
1132
1133         This patch has no effect on performance according to run-jsc-benchmarks.
1134
1135         * CMakeLists.txt:
1136         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1137         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1138         * JavaScriptCore.xcodeproj/project.pbxproj:
1139         * bytecode/BytecodeList.json:
1140         * bytecode/BytecodeUseDef.h:
1141         (JSC::computeUsesForBytecodeOffset):
1142         (JSC::computeDefsForBytecodeOffset):
1143         * bytecode/CodeBlock.cpp:
1144         (JSC::CodeBlock::printGetByIdOp):
1145         (JSC::CodeBlock::printGetByIdCacheStatus):
1146         (JSC::CodeBlock::printPutByIdCacheStatus):
1147         (JSC::CodeBlock::dumpBytecode):
1148         (JSC::CodeBlock::CodeBlock):
1149         (JSC::CodeBlock::propagateTransitions):
1150         (JSC::CodeBlock::finalizeLLIntInlineCaches):
1151         * bytecode/CodeBlock.h:
1152         * bytecode/GetByIdStatus.cpp:
1153         (JSC::GetByIdStatus::computeFromLLInt):
1154         * bytecode/Instruction.h:
1155         (JSC::Instruction::Instruction):
1156         * bytecode/PutByIdFlags.cpp: Added.
1157         (WTF::printInternal):
1158         * bytecode/PutByIdFlags.h: Added.
1159         * bytecode/PutByIdStatus.cpp:
1160         (JSC::PutByIdStatus::computeFromLLInt):
1161         * bytecode/UnlinkedCodeBlock.h:
1162         (JSC::UnlinkedInstruction::UnlinkedInstruction):
1163         * bytecompiler/BytecodeGenerator.cpp:
1164         (JSC::BytecodeGenerator::emitPutById):
1165         (JSC::BytecodeGenerator::emitDirectPutById):
1166         * dfg/DFGAbstractInterpreterInlines.h:
1167         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1168         * dfg/DFGByteCodeParser.cpp:
1169         (JSC::DFG::ByteCodeParser::parseBlock):
1170         * dfg/DFGCapabilities.cpp:
1171         (JSC::DFG::capabilityLevel):
1172         * jit/JIT.cpp:
1173         (JSC::JIT::privateCompileMainPass):
1174         (JSC::JIT::privateCompileSlowCases):
1175         * jit/JITPropertyAccess.cpp:
1176         (JSC::JIT::emit_op_put_by_id):
1177         * jit/JITPropertyAccess32_64.cpp:
1178         (JSC::JIT::emit_op_put_by_id):
1179         * llint/LLIntSlowPaths.cpp:
1180         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1181         * llint/LowLevelInterpreter32_64.asm:
1182         * llint/LowLevelInterpreter64.asm:
1183
1184 2015-09-14  Alex Christensen  <achristensen@webkit.org>
1185
1186         Progress towards CMake on Mac.
1187         https://bugs.webkit.org/show_bug.cgi?id=149123
1188
1189         Reviewed by Chris Dumez.
1190
1191         * CMakeLists.txt:
1192         Make forwarding headers for the replay subdirectory.
1193         * PlatformMac.cmake:
1194         Make forwarding headers for the generated inspector headers. 
1195         They should eventually either be packaged correctly with JavaScriptCore headers and included correctly.
1196
1197 2015-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1198
1199         [ES6] Cache the resolution result in JSModuleRecord
1200         https://bugs.webkit.org/show_bug.cgi?id=148896
1201
1202         Reviewed by Saam Barati.
1203
1204         The resolveExport operation is frequently called. For example,
1205         1. When instantiating the module environment, we call it for each exported name and imported
1206            name.
1207         2. When linking the imported module environment to the code block, we call it to resolve the
1208            resolution.
1209         3. When looking up the property from the namespace object, we call it to look up the original
1210            module for the imported binding.
1211         4. When creating the namespace object, we need to collect all the exported names from the module
1212            and need to resolve them by calling resolveExport.
1213
1214         However, resolveExport takes some cost. It traces the imported modules and resolves the reference
1215         queried by the original module.
1216
1217         The resolveExport operation is pure function; given a module record and an export name,
1218         it always returns the same result. So we cache resolution results in the module record to avoid
1219         repeated resolveExport calls with the same arguments.
1220         Here, we only cache the correctly resolved references, since,
1221         1. We rarely looked up the non-correctly-resolved ones. In the linking phase, attempting to
1222            resolve non-correctly-resolved ones throws a syntax error. So only namespace object creation
1223            phase does it in a syntax valid script.
1224         2. This strategy limits the size of the cache map. The number of the correctly exported bindings
1225            is defined by the modules' code. So the size does not become infinitely large.
1226
1227         Currently, the all modules cannot be linked twice. For example,
1228
1229           graph 1
1230
1231           -> (A) -> (B)
1232
1233           graph 2
1234
1235           -> (C) -> (A) -> (B)
1236
1237         We cannot test the behavior now because when executing the graph 2, (A) and (B) are already linked,
1238         it raises an error in the current loader spec. But it should be allowed[1] since it will occur when
1239         there is multiple module tag in WebCore.
1240
1241         [1]: https://github.com/whatwg/loader/issues/41
1242
1243         * runtime/JSModuleRecord.cpp:
1244         (JSC::JSModuleRecord::ResolveQuery::Hash::hash):
1245         (JSC::JSModuleRecord::ResolveQuery::Hash::equal):
1246         (JSC::JSModuleRecord::cacheResolution):
1247         (JSC::ResolveQueryHash::hash): Deleted.
1248         (JSC::ResolveQueryHash::equal): Deleted.
1249         (JSC::resolveExportLoop): Deleted.
1250         * runtime/JSModuleRecord.h:
1251         * tests/modules/caching-should-not-make-ambiguous.js: Added.
1252         * tests/modules/caching-should-not-make-ambiguous/A.js: Added.
1253         * tests/modules/caching-should-not-make-ambiguous/B.js: Added.
1254         * tests/modules/caching-should-not-make-ambiguous/C.js: Added.
1255         * tests/modules/caching-should-not-make-ambiguous/D.js: Added.
1256         * tests/modules/caching-should-not-make-ambiguous/main.js: Added.
1257         * tests/modules/different-view.js: Added.
1258         (from.string_appeared_here.shouldThrow):
1259         * tests/modules/different-view/A.js: Added.
1260         * tests/modules/different-view/B.js: Added.
1261         * tests/modules/different-view/C.js: Added.
1262         * tests/modules/different-view/D.js: Added.
1263         * tests/modules/different-view/E.js: Added.
1264         * tests/modules/different-view/main.js: Added.
1265         * tests/modules/fallback-ambiguous.js: Added.
1266         (from.string_appeared_here.shouldThrow):
1267         * tests/modules/fallback-ambiguous/A.js: Added.
1268         * tests/modules/fallback-ambiguous/B.js: Added.
1269         * tests/modules/fallback-ambiguous/C.js: Added.
1270         * tests/modules/fallback-ambiguous/D.js: Added.
1271         * tests/modules/fallback-ambiguous/E.js: Added.
1272         * tests/modules/fallback-ambiguous/main.js: Added.
1273         * tests/modules/self-star-link.js: Added.
1274         * tests/modules/self-star-link/A.js: Added.
1275         * tests/modules/self-star-link/B.js: Added.
1276         * tests/modules/self-star-link/C.js: Added.
1277         * tests/modules/self-star-link/D.js: Added.
1278         * tests/modules/self-star-link/E.js: Added.
1279         * tests/modules/uncacheable-when-see-star.js: Added.
1280         * tests/modules/uncacheable-when-see-star/A-pre.js: Added.
1281         * tests/modules/uncacheable-when-see-star/A.js: Added.
1282         * tests/modules/uncacheable-when-see-star/B.js: Added.
1283         * tests/modules/uncacheable-when-see-star/C.js: Added.
1284         * tests/modules/uncacheable-when-see-star/D.js: Added.
1285         * tests/modules/uncacheable-when-see-star/E-pre.js: Added.
1286         * tests/modules/uncacheable-when-see-star/E.js: Added.
1287         * tests/modules/uncacheable-when-see-star/main1.js: Added.
1288         * tests/modules/uncacheable-when-see-star/main2.js: Added.
1289
1290 2015-09-14  Sukolsak Sakshuwong  <sukolsak@gmail.com>
1291
1292         Implement the arithmetic instructions for floats in WebAssembly
1293         https://bugs.webkit.org/show_bug.cgi?id=149102
1294
1295         Reviewed by Geoffrey Garen.
1296
1297         This patch implements the arithmetic instructions for floats (float32)
1298         in WebAssembly by converting the float operands to doubles, performing
1299         the equivalent double instructions, and converting the result back to
1300         float. The asm.js spec says that "As proved in 'When is double rounding
1301         innocuous?' (Figueroa 1995), both the 32- and 64-bit versions of
1302         standard arithmetic operations produce equivalent results when given
1303         32-bit inputs and coerced to 32-bit outputs."
1304         (http://asmjs.org/spec/latest/#floatish)
1305
1306         This patch also pads WebAssembly call frames by maxFrameExtentForSlowPathCall,
1307         so that there is no need to adjust the stack pointer every time we make
1308         a slow path call.
1309
1310         * tests/stress/wasm-arithmetic-float32.js:
1311         * tests/stress/wasm/arithmetic-float32.wasm:
1312         * wasm/WASMFunctionCompiler.h:
1313         (JSC::WASMFunctionCompiler::startFunction):
1314         (JSC::WASMFunctionCompiler::buildUnaryF32):
1315         (JSC::WASMFunctionCompiler::buildBinaryF32):
1316         (JSC::WASMFunctionCompiler::callOperation):
1317         (JSC::WASMFunctionCompiler::callAndUnboxResult):
1318         (JSC::WASMFunctionCompiler::endFunction): Deleted.
1319         (JSC::WASMFunctionCompiler::buildBinaryI32): Deleted.
1320         * wasm/WASMFunctionParser.cpp:
1321         (JSC::WASMFunctionParser::parseExpressionF32):
1322         (JSC::WASMFunctionParser::parseUnaryExpressionF32):
1323         (JSC::WASMFunctionParser::parseBinaryExpressionF32):
1324         * wasm/WASMFunctionParser.h:
1325         * wasm/WASMFunctionSyntaxChecker.h:
1326         (JSC::WASMFunctionSyntaxChecker::buildUnaryF32):
1327         (JSC::WASMFunctionSyntaxChecker::buildBinaryF32):
1328
1329 2015-09-13  Geoffrey Garen  <ggaren@apple.com>
1330
1331         Eden GC should not try to jettison old CodeBlocks in the remembered set
1332         https://bugs.webkit.org/show_bug.cgi?id=149108
1333
1334         Reviewed by Saam Barati.
1335
1336         All we know about objects in the remembered set is that they must be
1337         visited. We don't know whether they're referenced or not because we
1338         won't mark the objects that point to them.
1339
1340         Therefore, it's incorrect for a CodeBlock to consider jettisoning
1341         itself when it's marked as a part of the remembered set: Some
1342         old object might have visited the CodeBlock strongly if given the chance.
1343
1344         I believe this doesn't cause any problems currently because we happen
1345         to visit all strong references to all CodeBlocks elligible for jettison
1346         during every GC.
1347
1348         However, this behavior is a logical oddity that tripped me up, and I
1349         believe it will start causing real problems once we start to jettison
1350         baseline CodeBlocks, since we do not visit all strong references to all
1351         baseline CodeBlocks during every GC.
1352
1353         * heap/CodeBlockSet.cpp:
1354         (JSC::CodeBlockSet::clearMarksForEdenCollection):
1355         (JSC::CodeBlockSet::traceMarked): Be sure to visit the remembered set
1356         strongly, in order to prohibit jettisoning.
1357
1358         (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
1359         * heap/CodeBlockSet.h: Track the remembered set during eden GCs.
1360
1361 2015-09-11  Filip Pizlo  <fpizlo@apple.com>
1362
1363         REGRESSION(r189585): run-perf-tests Speedometer fails with a console error
1364         https://bugs.webkit.org/show_bug.cgi?id=149066
1365
1366         Reviewed by Michael Saboff.
1367
1368         The bug here was that the new IC code was calling actionForCell() more than once. That's
1369         illegal, since when actionForCell() returns RetryCacheLater, it means that it changed some
1370         object's Structure. The Repatch code was doing things like "if (actionForCell(blah) ==
1371         AttemptToCache)" in more than one place, so that if the first such expression was false, then
1372         we'd fall through to the next one. It's possible for the first call to return RetryCacheLater,
1373         in which case our view of the world just got clobbered and we need to return, and then the
1374         second call will probably return AttemptToCache because it *thinks* that we had bailed the last
1375         time and we're now in a future IC invocation.
1376
1377         The solution is to cache the actionForCell() result. This is a bit tricky, because we need to
1378         do this after we check if we're in a proxy.
1379
1380         Debugging bugs like these requires adding ad hoc bisection code in various places. We already
1381         had the basic hooks for this. This patch makes those hooks a bit more useful. In the case of
1382         the LLInt->JIT tier-up hooks, it adds a CodeBlock* argument so that we can bisect based on the
1383         CodeBlock. In the case of Repatch, it puts the Options::forceICFailure() check in a helper
1384         function that also takes ExecState*, which allows us to bisect on either CodeBlock or
1385         CodeOrigin.
1386
1387         * jit/Repatch.cpp:
1388         (JSC::actionForCell):
1389         (JSC::forceICFailure):
1390         (JSC::tryCacheGetByID):
1391         (JSC::tryCachePutByID):
1392         (JSC::tryRepatchIn):
1393         * llint/LLIntSlowPaths.cpp:
1394         (JSC::LLInt::shouldJIT):
1395         (JSC::LLInt::jitCompileAndSetHeuristics):
1396         (JSC::LLInt::entryOSR):
1397         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1398         * tests/stress/retry-cache-later.js:
1399
1400 2015-09-11  Sukolsak Sakshuwong  <sukolsak@gmail.com>
1401
1402         Implement the relational instructions for floats in WebAssembly
1403         https://bugs.webkit.org/show_bug.cgi?id=149080
1404
1405         Reviewed by Geoffrey Garen.
1406
1407         This patch implements the relational instructions for floats (float32)
1408         in WebAssembly by converting float operands to doubles and then
1409         comparing them using the existing double comparison instructions in the
1410         macro assembler.
1411
1412         * tests/stress/wasm-relational.js:
1413         * tests/stress/wasm/relational.wasm:
1414         * wasm/WASMFunctionCompiler.h:
1415         (JSC::WASMFunctionCompiler::buildRelationalF32):
1416         * wasm/WASMFunctionParser.cpp:
1417         (JSC::WASMFunctionParser::parseExpressionI32):
1418         (JSC::WASMFunctionParser::parseRelationalF32ExpressionI32):
1419         * wasm/WASMFunctionParser.h:
1420         * wasm/WASMFunctionSyntaxChecker.h:
1421         (JSC::WASMFunctionSyntaxChecker::buildRelationalF32):
1422
1423 2015-09-11  Nan Wang  <n_wang@apple.com>
1424
1425         AX: ARIA 1.1 @aria-current
1426         https://bugs.webkit.org/show_bug.cgi?id=146012
1427
1428         Reviewed by Chris Fleizach.
1429
1430         Updated inspector to support aria-current.
1431
1432         * inspector/protocol/DOM.json:
1433
1434 2015-09-11  Sukolsak Sakshuwong  <sukolsak@gmail.com>
1435
1436         Add initial support for floats in WebAsssembly
1437         https://bugs.webkit.org/show_bug.cgi?id=149062
1438
1439         Reviewed by Geoffrey Garen.
1440
1441         Implement the ConstantPoolIndex, Immediate, GetLocal, and GetGlobal
1442         instructions for floats (float32) in WebAssembly.
1443
1444         * tests/stress/wasm-arithmetic-float32.js: Added.
1445         (shouldBe):
1446         * tests/stress/wasm-globals.js:
1447         * tests/stress/wasm-type-conversion.js:
1448         * tests/stress/wasm/arithmetic-float32.wasm: Added.
1449         * tests/stress/wasm/globals.wasm:
1450         * tests/stress/wasm/type-conversion.wasm:
1451         * wasm/WASMConstants.h:
1452         * wasm/WASMFunctionCompiler.h:
1453         (JSC::WASMFunctionCompiler::buildSetLocal):
1454         (JSC::WASMFunctionCompiler::buildReturn):
1455         (JSC::WASMFunctionCompiler::buildImmediateF32):
1456         (JSC::WASMFunctionCompiler::buildGetLocal):
1457         * wasm/WASMFunctionParser.cpp:
1458         (JSC::WASMFunctionParser::parseExpression):
1459         (JSC::WASMFunctionParser::parseExpressionF32):
1460         (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionF32):
1461         (JSC::WASMFunctionParser::parseImmediateExpressionF32):
1462         (JSC::WASMFunctionParser::parseGetLocalExpressionF32):
1463         (JSC::WASMFunctionParser::parseGetGlobalExpressionF32):
1464         * wasm/WASMFunctionParser.h:
1465         * wasm/WASMFunctionSyntaxChecker.h:
1466         (JSC::WASMFunctionSyntaxChecker::buildImmediateF32):
1467         * wasm/WASMReader.cpp:
1468         (JSC::WASMReader::readOpExpressionF32):
1469         * wasm/WASMReader.h:
1470
1471 2015-09-11  Geoffrey Garen  <ggaren@apple.com>
1472
1473         Try to fix the CLOOP build.
1474
1475         Unreviewed.
1476
1477         * bytecode/CodeBlock.cpp:
1478         (JSC::CodeBlock::finalizeBaselineJITInlineCaches):
1479         (JSC::CodeBlock::finalizeUnconditionally):
1480
1481 2015-09-11  Csaba Osztrogon√°c  <ossy@webkit.org>
1482
1483         [EFL] Fix WASM build
1484         https://bugs.webkit.org/show_bug.cgi?id=149065
1485
1486         Reviewed by Darin Adler.
1487
1488         * wasm/WASMFunctionParser.cpp:
1489
1490 2015-09-11  Geoffrey Garen  <ggaren@apple.com>
1491
1492         JavaScriptCore should discard optimized code after some time
1493         https://bugs.webkit.org/show_bug.cgi?id=149048
1494
1495         Reviewed by Michael Saboff.
1496
1497         This patch adds a new jettison type -- JettisonDueToOldAge -- and starts
1498         using it for DFG and FTL code. Baseline and LLInt code will come in a
1499         follow-up patch.
1500
1501         The primary goal is to save memory. Some popular websites leave about 10MB
1502         of dead code sitting around immediately after they finish loading.
1503
1504         Throwing away code periodically might also save us from profiling
1505         pathologies that lead to performance dead ends.
1506
1507         * bytecode/CodeBlock.cpp:
1508         (JSC::CodeBlock::visitAggregate): Updated for rename, and removed a
1509         stale comment.
1510
1511         (JSC::CodeBlock::shouldVisitStrongly): Renamed to shouldVisitStrongly
1512         because the practical effect of this function is to trigger a call to
1513         visitStrongly.
1514
1515         (JSC::CodeBlock::isKnownToBeLiveDuringGC): Check the
1516         m_visitStronglyHasBeenCalled flag instead of
1517         shouldImmediatelyAssumeLivenessDuringScan / shouldVisitStrongly because
1518         m_visitStronglyHasBeenCalled can be set by anybody even if the CodeBlock
1519         would not otherwise visit itself strongly.
1520
1521         (JSC::CodeBlock::shouldJettisonDueToWeakReference): New helper function
1522         for readability.
1523
1524         (JSC::CodeBlock::shouldJettisonDueToOldAge): New helper function that
1525         tells if a CodeBlock is old enough for deletion.
1526
1527         (JSC::CodeBlock::determineLiveness): There's no need to check
1528         shouldImmediatelyAssumeLivenessDuringScan here because we will not call
1529         this function if shouldImmediatelyAssumeLivenessDuringScan is true.
1530         Also, it's just not clear -- if someone chooses to call this function --
1531         that it would be safe to ignore them simply because
1532         shouldImmediatelyAssumeLivenessDuringScan was true.
1533
1534         (JSC::CodeBlock::finalizeLLIntInlineCaches): Moved code out into a helper
1535         function to make the main function more readable.
1536
1537         (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Ditto.
1538
1539         (JSC::CodeBlock::finalizeUnconditionally): Added code for jettisoning a
1540         CodeBlock if it is too old. Moved large sections of code into helper
1541         functions to aid readability in this function.
1542
1543         (JSC::CodeBlock::jettison): Account for the fact that we might jettison
1544         a CodeBlock without OSR exit and without requiring a stack shoot-down.
1545
1546         * bytecode/CodeBlock.h:
1547         (JSC::CodeBlock::setInstallTime):
1548         (JSC::CodeBlock::timeSinceInstall): Track CodeBlock age to help us
1549         decide when to delete.
1550
1551         * jit/JITCode.h:
1552         (JSC::JITCode::timeToLive): Static limits on CodeBlock lifetime. I got
1553         these numbers from the place where numbers come from. 
1554
1555         * profiler/ProfilerJettisonReason.cpp:
1556         (WTF::printInternal):
1557         * profiler/ProfilerJettisonReason.h: Updated for new jettison type.
1558
1559         * runtime/Executable.cpp:
1560         (JSC::ScriptExecutable::installCode): Record install time so that we
1561         can measure how old a CodeBlock is.
1562
1563 2015-09-11  Andreas Kling  <akling@apple.com>
1564
1565         [JSC] Weak should only accept cell pointees.
1566         <https://webkit.org/b/148955>
1567
1568         Reviewed by Geoffrey Garen.
1569
1570         Since WeakImpls only support pointing to JSCell derived objects,
1571         enforce that at compile time by having the API use JSCell* instead of JSValue.
1572
1573         WeakHandleOwner callbacks now get JSCell& and JSCell*& respectively instead
1574         of wrapping the cell pointer in a Handle<Unknown>.
1575
1576         Also added a static_assert so Weak<T> can't be instantiated with a T that's
1577         not convertible to JSCell.
1578
1579         * API/JSAPIWrapperObject.mm:
1580         (JSAPIWrapperObjectHandleOwner::finalize):
1581         (JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots):
1582         (JSC::JSAPIWrapperObject::finishCreation):
1583         * API/JSManagedValue.mm:
1584         (JSManagedValueHandleOwner::isReachableFromOpaqueRoots):
1585         (JSManagedValueHandleOwner::finalize):
1586         * builtins/BuiltinExecutables.cpp:
1587         (JSC::BuiltinExecutables::finalize):
1588         * builtins/BuiltinExecutables.h:
1589         * heap/Heap.cpp:
1590         (JSC::Heap::addFinalizer):
1591         (JSC::Heap::FinalizerOwner::finalize):
1592         * heap/Heap.h:
1593         * heap/WeakBlock.cpp:
1594         (JSC::WeakBlock::visit):
1595         (JSC::WeakBlock::reap):
1596         * heap/WeakHandleOwner.cpp:
1597         (JSC::WeakHandleOwner::isReachableFromOpaqueRoots):
1598         (JSC::WeakHandleOwner::finalize):
1599         * heap/WeakHandleOwner.h:
1600         * heap/WeakImpl.h:
1601         (JSC::WeakImpl::WeakImpl):
1602         (JSC::WeakImpl::state):
1603         (JSC::WeakImpl::cell):
1604         (JSC::WeakImpl::asWeakImpl):
1605         (JSC::WeakImpl::jsValue): Deleted.
1606         * heap/WeakInlines.h:
1607         (JSC::Weak<T>::Weak):
1608         (JSC::>):
1609         (JSC::Weak<T>::operator):
1610         (JSC::Weak<T>::get):
1611         (JSC::Weak<T>::was):
1612         * heap/WeakSet.h:
1613         * heap/WeakSetInlines.h:
1614         (JSC::WeakSet::allocate):
1615         (JSC::WeakBlock::finalize):
1616         * jit/JITThunks.cpp:
1617         (JSC::JITThunks::finalize):
1618         * jit/JITThunks.h:
1619         * jsc.cpp:
1620         (WTF::ElementHandleOwner::isReachableFromOpaqueRoots): Deleted.
1621         * runtime/JSCell.h:
1622         (JSC::jsCast):
1623         * runtime/RegExpCache.cpp:
1624         (JSC::RegExpCache::finalize):
1625         * runtime/RegExpCache.h:
1626         * runtime/Structure.cpp:
1627         (JSC::StructureTransitionTable::singleTransition):
1628         (JSC::StructureTransitionTable::setSingleTransition):
1629
1630 2015-09-10  Sukolsak Sakshuwong  <sukolsak@gmail.com>
1631
1632         Implement switch statements in WebAssembly
1633         https://bugs.webkit.org/show_bug.cgi?id=149051
1634
1635         Reviewed by Geoffrey Garen.
1636
1637         This patch implements switch statements in WebAssembly using the
1638         JSC::BinarySwitch class.
1639
1640         * tests/stress/wasm-control-flow.js:
1641         * tests/stress/wasm/control-flow.wasm:
1642         * wasm/WASMFunctionCompiler.h:
1643         (JSC::WASMFunctionCompiler::buildSwitch):
1644         * wasm/WASMFunctionParser.cpp:
1645         (JSC::WASMFunctionParser::parseSwitchStatement):
1646         * wasm/WASMFunctionSyntaxChecker.h:
1647         (JSC::WASMFunctionSyntaxChecker::buildSwitch):
1648
1649 2015-09-10  Filip Pizlo  <fpizlo@apple.com>
1650
1651         Structure should be able to tell you if it had ever been a dictionary
1652         https://bugs.webkit.org/show_bug.cgi?id=149047
1653
1654         Reviewed by Mark Lam.
1655
1656         Introduces the hasBeenDictionary flag to Structure, which tells you if this structure or
1657         any of its ancestors is a dictionary. We already implicitly tracked this for DFG
1658         watchpoint optimizations, so this is mainly just decoupling that existing logic from
1659         watchpoints. Having Structure::hasBeenDictionary() enables some of the heuristics in the
1660         property type inference work (https://bugs.webkit.org/show_bug.cgi?id=148610).
1661
1662         * runtime/Structure.cpp:
1663         (JSC::Structure::Structure):
1664         (JSC::Structure::toDictionaryTransition):
1665         (JSC::Structure::dump):
1666         * runtime/Structure.h:
1667
1668 2015-09-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1669
1670         Unreviewed, fix Windows file loading in JSC shell after r189583
1671         https://bugs.webkit.org/show_bug.cgi?id=148917
1672
1673         Should load the script files with the binary mode.
1674         Since these loading functions are only used for the simple test scripts,
1675         we just use ftell / fseek now.
1676
1677         * jsc.cpp:
1678         (fillBufferWithContentsOfFile):
1679
1680 2015-09-10  Michael Saboff  <msaboff@apple.com>
1681
1682         REGRESSION(r189575): Appears to break ARM64 linux builds
1683         https://bugs.webkit.org/show_bug.cgi?id=149044
1684
1685         Reviewed by Filip Pizlo.
1686
1687         Changed the use of the ARM64 "fp", a register alias, to be "x29", the real register name.
1688
1689         * llint/LowLevelInterpreter.asm:
1690
1691 2015-09-09  Filip Pizlo  <fpizlo@apple.com>
1692
1693         There should be one stub hanging off an inline cache that contains code for all of the cases, rather than forming a linked list consisting of one stub per case
1694         https://bugs.webkit.org/show_bug.cgi?id=148717
1695
1696         Reviewed by Michael Saboff.
1697
1698         This is a major rewrite of the JSC get/put/in inline caches (ICs), motivated by the need to add
1699         fancy new kinds of inline caches for property type inference (https://webkit.org/b/148610).
1700
1701         Previously, our inline caches had some problems that made them difficult to work with. It was
1702         impossible to change any code that was previously generated by the IC except by blowing the
1703         whole IC away, the ICs scaled poorly if there were many cases, and there was a lot of duplicate
1704         and ad hoc code.
1705
1706         Impossible to regenerate a previously generated stub: Say that some access (o.f = v) causes our
1707         IC code to emit some stub; let's call it stub1. Then later we find that we need to emit a
1708         different stub, stub2, where we think that stub2 might subsume stub1. We say that stub2
1709         subsumes stub1 if failing to execute stub2 to completion means that we are guaranteed to fail
1710         to execute stub1 to completion. This could happen in trunk if stub2 has the same base structure
1711         as stub1 but different prototype conditions. It could happen with property type inference if
1712         stub2 has a looser type check on v than stub1 did. Currently, if this happened, we would emit
1713         stub2 and have its slow path jump to stub1. Hence, we would still end up executing the checks
1714         of stub1 before falling through to the slow path. This gets bad when there are many stubs.
1715         Stub1 might be in front of a bunch of other stubs, so when we add stub2, we will end up
1716         executing both stub2's and stub1's checks before falling through to the other stubs. It would
1717         be better if we could remove stub1 from the list at this point. But since stub1 could be linked
1718         to from a different stub that we had already generated, we'd have to have a way of patching
1719         stubs or regenerating them from scratch. This is currenty impossible because we just don't keep
1720         around enough meta-data to mess with a stub after it's generated. After this change, we never
1721         link new stubs onto a linked list of pre-existing stubs; instead each IC will have one stub
1722         hanging off of it and we always regenerate that one stub from scratch. That one stub contains
1723         either a BinarySwitch or a branch cascade to select one of the AccessCases. Each AccessCase is
1724         an object that describes everything we need to regenerate it in the future. This means that
1725         when we add a new case to an IC stub, we can figure out which previous cases this one subsumes.
1726
1727         Poor scalability when there are many cases: Previously, the cases of a polymorphic inline cache
1728         formed a linked list of branches. This meant that the complexity of an inline cache grew
1729         linearly with the number of cases. This change turns this into a BinarySwitch in most cases,
1730         leading to logarithmic scaling.
1731
1732         Duplicate code between get, put, and in: The code for op_get_by_id, op_put_by_id, and op_in
1733         inline caches grew independently and ended up having a lot of duplicate code. We had the worst
1734         kinds of duplicate code. In some cases, the code was copy-pasted. In other cases, we wrote code
1735         that felt like it was new despite the fact that it was logically identical to code that was
1736         already written elsewhere. The main sources of duplication were in selecting a scratch
1737         register, checking all of the ObjectPropertyConditions and the base structure, the pro forma
1738         involved in generating a stub, and the data structures needed to describe all of the access
1739         cases. This change deduplicates all of that code. Now, all of those ICs use the same classes:
1740         the PolymorphicAccess and AccessCase. There is code in those classes that handles all of the
1741         common things, and for the most part the only code that actually specializes for the kind of
1742         access is in some switch statement in AccessCase::generate().
1743
1744         Special-casing of array length and string length: Previously, array.length and string.length
1745         were handled in an ad hoc manner in the get_by_id repatching code. The handling was separate
1746         from the polymorphic get_by_id handling, which meant that we could not handle polymorphic
1747         length accesses if one of the length cases was either array or string length. For example, if
1748         you had "o.length" where the length was either array length or a vanilla length property, then
1749         the get_by_id inline cache would either emit a monomorphic stub for array length, or a
1750         monomorphic stub for the vanilla length property, but never a polymorphic stub (or list) that
1751         could do both. This change addresses this problem by folding array length and string length
1752         into the polymorphic get_by_id code.
1753
1754         This was meant to be a perf-neutral change to enable property type inference, but it ended up
1755         being a 1% Octane speed-up, mainly because of a 14% speed-up in raytrace. This isn't too
1756         surprising, since that test does use inline caches a lot and this change makes inline caches
1757         more scalable.
1758
1759         This also fixes and adds a test for a BinarySwitch bug. BinarySwitch had an optimization for
1760         consecutive integer cases. Using it on typed array structures triggers this bug. It's a hard
1761         bug to trigger any other way because our other switch optimizations will usually use a jump
1762         table in case of consecutive integers.
1763
1764         * CMakeLists.txt:
1765         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1766         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1767         * JavaScriptCore.xcodeproj/project.pbxproj:
1768         * assembler/MacroAssemblerCodeRef.h:
1769         (JSC::MacroAssemblerCodePtr::dumpWithName):
1770         * bytecode/CodeBlock.cpp:
1771         (JSC::CodeBlock::printGetByIdCacheStatus):
1772         (JSC::CodeBlock::printPutByIdCacheStatus):
1773         (JSC::CodeBlock::propagateTransitions):
1774         (JSC::CodeBlock::getByValInfoMap):
1775         (JSC::CodeBlock::addStubInfo):
1776         (JSC::CodeBlock::findStubInfo):
1777         * bytecode/CodeBlock.h:
1778         (JSC::CodeBlock::stubInfoBegin):
1779         (JSC::CodeBlock::stubInfoEnd):
1780         * bytecode/GetByIdStatus.cpp:
1781         (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
1782         * bytecode/PolymorphicAccess.cpp: Copied from Source/JavaScriptCore/bytecode/PolymorphicGetByIdList.cpp.
1783         (JSC::AccessGenerationState::addWatchpoint):
1784         (JSC::AccessGenerationState::restoreScratch):
1785         (JSC::AccessGenerationState::succeed):
1786         (JSC::AccessCase::AccessCase):
1787         (JSC::AccessCase::get):
1788         (JSC::AccessCase::replace):
1789         (JSC::AccessCase::transition):
1790         (JSC::AccessCase::setter):
1791         (JSC::AccessCase::in):
1792         (JSC::AccessCase::getLength):
1793         (JSC::AccessCase::~AccessCase):
1794         (JSC::AccessCase::fromStructureStubInfo):
1795         (JSC::AccessCase::clone):
1796         (JSC::AccessCase::guardedByStructureCheck):
1797         (JSC::AccessCase::alternateBase):
1798         (JSC::AccessCase::canReplace):
1799         (JSC::AccessCase::dump):
1800         (JSC::AccessCase::visitWeak):
1801         (JSC::AccessCase::generateWithGuard):
1802         (JSC::AccessCase::generate):
1803         (JSC::PolymorphicAccess::PolymorphicAccess):
1804         (JSC::PolymorphicAccess::~PolymorphicAccess):
1805         (JSC::PolymorphicAccess::regenerateWithCases):
1806         (JSC::PolymorphicAccess::regenerateWithCase):
1807         (JSC::PolymorphicAccess::visitWeak):
1808         (JSC::PolymorphicAccess::dump):
1809         (JSC::PolymorphicAccess::regenerate):
1810         (WTF::printInternal):
1811         (JSC::GetByIdAccess::GetByIdAccess): Deleted.
1812         (JSC::GetByIdAccess::~GetByIdAccess): Deleted.
1813         (JSC::GetByIdAccess::fromStructureStubInfo): Deleted.
1814         (JSC::GetByIdAccess::visitWeak): Deleted.
1815         (JSC::PolymorphicGetByIdList::PolymorphicGetByIdList): Deleted.
1816         (JSC::PolymorphicGetByIdList::from): Deleted.
1817         (JSC::PolymorphicGetByIdList::~PolymorphicGetByIdList): Deleted.
1818         (JSC::PolymorphicGetByIdList::currentSlowPathTarget): Deleted.
1819         (JSC::PolymorphicGetByIdList::addAccess): Deleted.
1820         (JSC::PolymorphicGetByIdList::isFull): Deleted.
1821         (JSC::PolymorphicGetByIdList::isAlmostFull): Deleted.
1822         (JSC::PolymorphicGetByIdList::didSelfPatching): Deleted.
1823         (JSC::PolymorphicGetByIdList::visitWeak): Deleted.
1824         * bytecode/PolymorphicAccess.h: Copied from Source/JavaScriptCore/bytecode/PolymorphicGetByIdList.h.
1825         (JSC::AccessCase::isGet):
1826         (JSC::AccessCase::isPut):
1827         (JSC::AccessCase::isIn):
1828         (JSC::AccessCase::type):
1829         (JSC::AccessCase::offset):
1830         (JSC::AccessCase::viaProxy):
1831         (JSC::AccessCase::structure):
1832         (JSC::AccessCase::newStructure):
1833         (JSC::AccessCase::conditionSet):
1834         (JSC::AccessCase::additionalSet):
1835         (JSC::AccessCase::customSlotBase):
1836         (JSC::AccessCase::doesCalls):
1837         (JSC::AccessCase::callLinkInfo):
1838         (JSC::AccessCase::RareData::RareData):
1839         (JSC::PolymorphicAccess::isEmpty):
1840         (JSC::PolymorphicAccess::size):
1841         (JSC::PolymorphicAccess::at):
1842         (JSC::PolymorphicAccess::operator[]):
1843         (JSC::GetByIdAccess::GetByIdAccess): Deleted.
1844         (JSC::GetByIdAccess::isSet): Deleted.
1845         (JSC::GetByIdAccess::operator!): Deleted.
1846         (JSC::GetByIdAccess::type): Deleted.
1847         (JSC::GetByIdAccess::structure): Deleted.
1848         (JSC::GetByIdAccess::conditionSet): Deleted.
1849         (JSC::GetByIdAccess::stubRoutine): Deleted.
1850         (JSC::GetByIdAccess::doesCalls): Deleted.
1851         (JSC::PolymorphicGetByIdList::isEmpty): Deleted.
1852         (JSC::PolymorphicGetByIdList::size): Deleted.
1853         (JSC::PolymorphicGetByIdList::at): Deleted.
1854         (JSC::PolymorphicGetByIdList::operator[]): Deleted.
1855         * bytecode/PolymorphicAccessStructureList.h: Removed.
1856         * bytecode/PolymorphicGetByIdList.cpp: Removed.
1857         * bytecode/PolymorphicGetByIdList.h: Removed.
1858         * bytecode/PolymorphicPutByIdList.cpp: Removed.
1859         * bytecode/PolymorphicPutByIdList.h: Removed.
1860         * bytecode/PutByIdStatus.cpp:
1861         (JSC::PutByIdStatus::computeForStubInfo):
1862         * bytecode/StructureStubInfo.cpp:
1863         (JSC::StructureStubInfo::deref):
1864         (JSC::StructureStubInfo::addAccessCase):
1865         (JSC::StructureStubInfo::reset):
1866         (JSC::StructureStubInfo::visitWeakReferences):
1867         * bytecode/StructureStubInfo.h:
1868         (JSC::StructureStubInfo::StructureStubInfo):
1869         (JSC::StructureStubInfo::initGetByIdSelf):
1870         (JSC::StructureStubInfo::initPutByIdReplace):
1871         (JSC::StructureStubInfo::initStub):
1872         (JSC::StructureStubInfo::setSeen):
1873         (JSC::getStructureStubInfoCodeOrigin):
1874         (JSC::isGetByIdAccess): Deleted.
1875         (JSC::isPutByIdAccess): Deleted.
1876         (JSC::isInAccess): Deleted.
1877         (JSC::StructureStubInfo::initGetByIdList): Deleted.
1878         (JSC::StructureStubInfo::initPutByIdTransition): Deleted.
1879         (JSC::StructureStubInfo::initPutByIdList): Deleted.
1880         (JSC::StructureStubInfo::initInList): Deleted.
1881         (JSC::StructureStubInfo::addWatchpoint): Deleted.
1882         * dfg/DFGSpeculativeJIT.cpp:
1883         (JSC::DFG::SpeculativeJIT::compileIn):
1884         * ftl/FTLCompile.cpp:
1885         (JSC::FTL::mmAllocateDataSection):
1886         * jit/AccessorCallJITStubRoutine.cpp: Removed.
1887         * jit/AccessorCallJITStubRoutine.h: Removed.
1888         * jit/AssemblyHelpers.h:
1889         (JSC::AssemblyHelpers::branchIfEmpty):
1890         (JSC::AssemblyHelpers::branchStructure):
1891         (JSC::AssemblyHelpers::boxBooleanPayload):
1892         (JSC::AssemblyHelpers::boxBoolean):
1893         (JSC::AssemblyHelpers::boxInt32):
1894         * jit/BinarySwitch.cpp:
1895         (JSC::BinarySwitch::BinarySwitch):
1896         (JSC::BinarySwitch::build):
1897         (JSC::BinarySwitch::Case::dump):
1898         (JSC::BinarySwitch::BranchCode::dump):
1899         * jit/BinarySwitch.h:
1900         (JSC::BinarySwitch::Case::operator<):
1901         (JSC::BinarySwitch::BranchCode::BranchCode):
1902         * jit/JIT.h:
1903         * jit/JITInlineCacheGenerator.cpp:
1904         (JSC::garbageStubInfo):
1905         (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
1906         (JSC::JITByIdGenerator::JITByIdGenerator):
1907         (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
1908         (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
1909         * jit/JITInlineCacheGenerator.h:
1910         (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
1911         (JSC::JITInlineCacheGenerator::stubInfo):
1912         (JSC::JITByIdGenerator::JITByIdGenerator):
1913         (JSC::JITByIdGenerator::reportSlowPathCall):
1914         * jit/JITOperations.cpp:
1915         * jit/Repatch.cpp:
1916         (JSC::repatchCall):
1917         (JSC::repatchByIdSelfAccess):
1918         (JSC::resetGetByIDCheckAndLoad):
1919         (JSC::resetPutByIDCheckAndLoad):
1920         (JSC::replaceWithJump):
1921         (JSC::tryCacheGetByID):
1922         (JSC::repatchGetByID):
1923         (JSC::appropriateGenericPutByIdFunction):
1924         (JSC::appropriateOptimizingPutByIdFunction):
1925         (JSC::tryCachePutByID):
1926         (JSC::repatchPutByID):
1927         (JSC::tryRepatchIn):
1928         (JSC::repatchIn):
1929         (JSC::resetGetByID):
1930         (JSC::resetPutByID):
1931         (JSC::checkObjectPropertyCondition): Deleted.
1932         (JSC::checkObjectPropertyConditions): Deleted.
1933         (JSC::emitRestoreScratch): Deleted.
1934         (JSC::linkRestoreScratch): Deleted.
1935         (JSC::toString): Deleted.
1936         (JSC::kindFor): Deleted.
1937         (JSC::customFor): Deleted.
1938         (JSC::generateByIdStub): Deleted.
1939         (JSC::patchJumpToGetByIdStub): Deleted.
1940         (JSC::tryBuildGetByIDList): Deleted.
1941         (JSC::buildGetByIDList): Deleted.
1942         (JSC::appropriateListBuildingPutByIdFunction): Deleted.
1943         (JSC::emitPutReplaceStub): Deleted.
1944         (JSC::emitPutTransitionStub): Deleted.
1945         (JSC::tryBuildPutByIdList): Deleted.
1946         (JSC::buildPutByIdList): Deleted.
1947         * jit/ScratchRegisterAllocator.cpp:
1948         (JSC::ScratchRegisterAllocator::lock):
1949         (JSC::ScratchRegisterAllocator::allocateScratch):
1950         * jit/ScratchRegisterAllocator.h:
1951         (JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
1952         * jsc.cpp:
1953         (GlobalObject::finishCreation):
1954         (functionQuit):
1955         (functionAbort):
1956         (functionFalse1):
1957         (functionFalse2):
1958         * runtime/Options.h:
1959         * tests/stress/array-message-passing.js: Added.
1960         (window.addEventListener):
1961         (window.postMessage):
1962         (window._handleEvents):
1963         (testPassed):
1964         (testFailed):
1965         (classCompare):
1966         (bufferCompare):
1967         (viewCompare):
1968         (typedArrayCompare):
1969         (dataViewCompare):
1970         (dataViewCompare2):
1971         (dataViewCompare3):
1972         (createBuffer):
1973         (createTypedArray):
1974         (createTypedArrayOverBuffer):
1975         (new.DataView):
1976         (testList.testList.concat.basicBufferTypes.map):
1977         (doneTest):
1978
1979 2015-09-10  Geoffrey Garen  <ggaren@apple.com>
1980
1981         CodeBlock::codeType() doesn't need to compute anything
1982         https://bugs.webkit.org/show_bug.cgi?id=149039
1983
1984         Reviewed by Michael Saboff.
1985
1986         CodeBlock already has an m_codeType data member.
1987
1988         * bytecode/CodeBlock.h:
1989         (JSC::CodeBlock::codeType):
1990         (JSC::CodeBlock::putByIdContext):
1991
1992 2015-09-10  Sukolsak Sakshuwong  <sukolsak@gmail.com>
1993
1994         Implement global variables in WebAssembly
1995         https://bugs.webkit.org/show_bug.cgi?id=149031
1996
1997         Reviewed by Geoffrey Garen.
1998
1999         This patch implements global variables in WebAssembly. There are two
2000         types of global variables in the current format that we use (the format
2001         used by <https://github.com/WebAssembly/polyfill-prototype-1>): internal
2002         global variables and imported global variables. This patch does not yet
2003         import values for imported global variables. It will be done in a
2004         subsequent patch.
2005
2006         * tests/stress/wasm-globals.js: Added.
2007         (shouldBe):
2008         * tests/stress/wasm/globals.wasm: Added.
2009         * wasm/JSWASMModule.h:
2010         (JSC::JSWASMModule::globalVariables):
2011         * wasm/WASMFunctionCompiler.h:
2012         (JSC::WASMFunctionCompiler::buildSetGlobal):
2013         (JSC::WASMFunctionCompiler::buildGetGlobal):
2014         * wasm/WASMFunctionParser.cpp:
2015         (JSC::WASMFunctionParser::parseStatement):
2016         (JSC::WASMFunctionParser::parseSetGlobalStatement):
2017         (JSC::WASMFunctionParser::parseExpressionI32):
2018         (JSC::WASMFunctionParser::parseGetGlobalExpressionI32):
2019         (JSC::WASMFunctionParser::parseExpressionF64):
2020         (JSC::WASMFunctionParser::parseGetGlobalExpressionF64):
2021         * wasm/WASMFunctionParser.h:
2022         * wasm/WASMFunctionSyntaxChecker.h:
2023         (JSC::WASMFunctionSyntaxChecker::buildSetGlobal):
2024         (JSC::WASMFunctionSyntaxChecker::buildGetGlobal):
2025         * wasm/WASMModuleParser.cpp:
2026         (JSC::WASMModuleParser::parseGlobalSection):
2027
2028 2015-09-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2029
2030         Consider long module path name case in Windows
2031         https://bugs.webkit.org/show_bug.cgi?id=148917
2032
2033         Reviewed by Alex Christensen.
2034
2035         The local file system module loader in the JSC shell manages the module files by the absolute path.
2036         However, in Windows, _MAX_PATH is defined as 260. So if the path like the current working directory or the path to the module is long,
2037         it will be truncated by the API and it fail to open the file.
2038         In JSC tests in Apple Windows buildbot, since the current working directory is long enough, the tests failed.
2039
2040         This patch introduces the following 3 tweaks.
2041
2042         1. When retrieving the current working path, we use GetCurrentDirectoryW instead of _getcwd.
2043            GetCurrentDirectoryW allows the long path while _getcwd automatically truncate the result by the _MAX_PATH.
2044
2045         2. Before opening the module file, we prepend "\\?\" to the path. It converts the local file path to the long UNC path
2046            which allows longer path names.
2047
2048         3. Since Windows ASCII API accepts the characters in the current code page, we use the Unicode APIs like _wfopen instead.
2049
2050         And enable the once disabled module tests in Windows.
2051
2052         Since this functionality is the part of the JSC shell to run the module tests, it is now implemented in jsc.cpp.
2053
2054         * jsc.cpp:
2055         (stringFromUTF):
2056         (jscSource):
2057         (extractDirectoryName):
2058         (currentWorkingDirectory):
2059         (convertShebangToJSComment):
2060         (fillBufferWithContentsOfFile):
2061         (fetchScriptFromLocalFileSystem):
2062         (fetchModuleFromLocalFileSystem):
2063         (GlobalObject::moduleLoaderFetch):
2064         (functionRun):
2065         (functionLoad):
2066         (functionReadFile):
2067         (functionCheckSyntax):
2068         (functionLoadModule):
2069         (runWithScripts):
2070         (runInteractive):
2071         * tests/modules.yaml:
2072
2073 2015-09-10  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2074
2075         Convert arguments to WebAssembly functions to the declared types
2076         https://bugs.webkit.org/show_bug.cgi?id=149033
2077
2078         Reviewed by Geoffrey Garen.
2079
2080         This patch checks the types of arguments to WebAssembly functions and
2081         converts them to the declared types. This is necessary because:
2082         - For example, if a function expects an argument of type double and we
2083           pass 1.0 to it, it will get a JSValue of an integer, not a double.
2084         - We should follow asm.js's behavior for now, because we want to be able
2085           to test WebAssembly apps against asm.js apps. asm.js does type
2086           coercion on arguments by using int|0, Math.fround(float), and +double.
2087
2088         * jit/JITOperations.h:
2089         * tests/stress/wasm-type-conversion.js: Added.
2090         (shouldBe):
2091         (two.valueOf):
2092         * tests/stress/wasm/type-conversion.wasm: Added.
2093         * wasm/WASMFunctionCompiler.h:
2094         (JSC::operationConvertJSValueToInt32):
2095         (JSC::operationConvertJSValueToDouble):
2096         (JSC::WASMFunctionCompiler::startFunction):
2097         (JSC::WASMFunctionCompiler::appendCallSetResult):
2098         (JSC::WASMFunctionCompiler::callOperation):
2099         (JSC::WASMFunctionCompiler::loadValueAndConvertToInt32):
2100         (JSC::WASMFunctionCompiler::loadValueAndConvertToDouble):
2101
2102 2015-09-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2103
2104         JSInternalPromiseDeferred should inherit JSPromiseDeferred
2105         https://bugs.webkit.org/show_bug.cgi?id=149027
2106
2107         Reviewed by Darin Adler.
2108
2109         JSInternalPromiseDeferred is constructed by using JSPromiseDeferred implementation.
2110         So the class info of JSInternalPromiseDeferred should inherit JSPromiseDeferred.
2111
2112         * runtime/JSInternalPromiseDeferred.cpp:
2113
2114 2015-09-10  Michael Saboff  <msaboff@apple.com>
2115
2116         Add support for Callee-Saves registers
2117         https://bugs.webkit.org/show_bug.cgi?id=148666
2118
2119         Reviewed by Filip Pizlo.
2120
2121         We save platform callee save registers right below the call frame header,
2122         in the location(s) starting with VirtualRegister 0.  This local space is
2123         allocated in the bytecode compiler.  This space is the maximum space
2124         needed for the callee registers that the LLInt and baseline JIT use,
2125         rounded up to a stack aligned number of VirtualRegisters.
2126         The LLInt explicitly saves and restores the registers in the macros
2127         preserveCalleeSavesUsedByLLInt and restoreCalleeSavesUsedByLLInt.
2128         The JITs saves and restores callee saves registers by what registers
2129         are included in m_calleeSaveRegisters in the code block.
2130
2131         Added handling of callee save register restoration to exception handling.
2132         The basic flow is when an exception is thrown or one is recognized to
2133         have been generated in C++ code, we save the current state of all
2134         callee save registers to VM::calleeSaveRegistersBuffer.  As we unwind
2135         looking for the corresponding catch, we copy the callee saves from call 
2136         frames to the same VM::calleeSaveRegistersBuffer.  This is done for all
2137         call frames on the stack up to but not including the call frame that has
2138         the corresponding catch block.  When we process the catch, we restore
2139         the callee save registers with the contents of VM::calleeSaveRegistersBuffer.
2140         If there isn't a catch, then handleUncaughtException will restore callee
2141         saves before it returns back to the calling C++.
2142
2143         Eliminated callee saves registers as free registers for various thunk
2144         generators as the callee saves may not have been saved by the function
2145         calling the thunk.
2146
2147         Added code to transition callee saves from one VM's format to the another
2148         as part of OSR entry and OSR exit.
2149
2150         Cleaned up the static RegisterSet's including adding one for LLInt and 
2151         baseline JIT callee saves and one to be used to allocate local registers
2152         not including the callee saves or other special registers.
2153
2154         Moved ftl/FTLRegisterAtOffset.{cpp,h} to jit/RegisterAtOffset.{cpp,h}.
2155         Factored out the vector of RegisterAtOffsets in ftl/FTLUnwindInfo.{cpp,h}
2156         into a new class in jit/RegisterAtOffsetList.{cpp,h}.
2157         Eliminted UnwindInfo and changed UnwindInfo::parse() into a standalone
2158         function named parseUnwindInfo.  That standalone function now returns
2159         the callee saves RegisterAtOffsetList.  This is stored in the CodeBlock
2160         and used instead of UnwindInfo.
2161
2162         Turned off register preservation thunks for outgoing calls from FTL
2163         generated code.  THey'll be removed in a subsequent patch.
2164
2165         Changed specialized thinks to save and restore the contents of
2166         tagTypeNumberRegister and tagMaskRegister as they can be called by FTL
2167         compiled functions.  We materialize those tag registers for the thunk's
2168         use and then restore the prior contents on function exit.
2169
2170         Also removed the arity check fail return thunk since it is now the
2171         caller's responsibility to restore the stack pointer.
2172
2173         Removed saving of callee save registers and materialization of special
2174         tag registers for 64 bit platforms from vmEntryToJavaScript and
2175         vmEntryToNative.
2176
2177         * CMakeLists.txt:
2178         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2179         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2180         * JavaScriptCore.xcodeproj/project.pbxproj:
2181         * ftl/FTLJITCode.h:
2182         * ftl/FTLRegisterAtOffset.cpp: Removed.
2183         * ftl/FTLRegisterAtOffset.h: Removed.
2184         * ftl/FTLUnwindInfo.cpp:
2185         (JSC::FTL::parseUnwindInfo):
2186         (JSC::FTL::UnwindInfo::UnwindInfo): Deleted.
2187         (JSC::FTL::UnwindInfo::~UnwindInfo): Deleted.
2188         (JSC::FTL::UnwindInfo::parse): Deleted.
2189         (JSC::FTL::UnwindInfo::dump): Deleted.
2190         (JSC::FTL::UnwindInfo::find): Deleted.
2191         (JSC::FTL::UnwindInfo::indexOf): Deleted.
2192         * ftl/FTLUnwindInfo.h:
2193         (JSC::RegisterAtOffset::dump):
2194         * jit/RegisterAtOffset.cpp: Added.
2195         * jit/RegisterAtOffset.h: Added.
2196         (JSC::RegisterAtOffset::RegisterAtOffset):
2197         (JSC::RegisterAtOffset::operator!):
2198         (JSC::RegisterAtOffset::reg):
2199         (JSC::RegisterAtOffset::offset):
2200         (JSC::RegisterAtOffset::offsetAsIndex):
2201         (JSC::RegisterAtOffset::operator==):
2202         (JSC::RegisterAtOffset::operator<):
2203         (JSC::RegisterAtOffset::getReg):
2204         * jit/RegisterAtOffsetList.cpp: Added.
2205         (JSC::RegisterAtOffsetList::RegisterAtOffsetList):
2206         (JSC::RegisterAtOffsetList::sort):
2207         (JSC::RegisterAtOffsetList::dump):
2208         (JSC::RegisterAtOffsetList::find):
2209         (JSC::RegisterAtOffsetList::indexOf):
2210         * jit/RegisterAtOffsetList.h: Added.
2211         (JSC::RegisterAtOffsetList::clear):
2212         (JSC::RegisterAtOffsetList::size):
2213         (JSC::RegisterAtOffsetList::at):
2214         (JSC::RegisterAtOffsetList::append):
2215         Move and refactored use of FTLRegisterAtOffset to RegisterAtOffset.
2216         Added RegisterAtOffset and RegisterAtOffsetList to build configurations.
2217         Remove FTLRegisterAtOffset files.
2218
2219         * bytecode/CallLinkInfo.h:
2220         (JSC::CallLinkInfo::setUpCallFromFTL):
2221         Turned off FTL register preservation thunks.
2222
2223         * bytecode/CodeBlock.cpp:
2224         (JSC::CodeBlock::CodeBlock):
2225         (JSC::CodeBlock::setCalleeSaveRegisters):
2226         (JSC::roundCalleeSaveSpaceAsVirtualRegisters):
2227         (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters):
2228         (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters):
2229         * bytecode/CodeBlock.h:
2230         (JSC::CodeBlock::numberOfLLIntBaselineCalleeSaveRegisters):
2231         (JSC::CodeBlock::calleeSaveRegisters):
2232         (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters):
2233         (JSC::CodeBlock::optimizeAfterWarmUp):
2234         (JSC::CodeBlock::numberOfDFGCompiles):
2235         Methods to manage a set of callee save registers.  Also to allocate the appropriate
2236         number of VirtualRegisters for callee saves.
2237
2238         * bytecompiler/BytecodeGenerator.cpp:
2239         (JSC::BytecodeGenerator::BytecodeGenerator):
2240         (JSC::BytecodeGenerator::allocateCalleeSaveSpace):
2241         * bytecompiler/BytecodeGenerator.h:
2242         Allocate the appropriate number of VirtualRegisters for callee saves needed by LLInt or baseline JIT.
2243
2244         * dfg/DFGJITCompiler.cpp:
2245         (JSC::DFG::JITCompiler::compileEntry):
2246         (JSC::DFG::JITCompiler::compileSetupRegistersForEntry):
2247         (JSC::DFG::JITCompiler::compileBody):
2248         (JSC::DFG::JITCompiler::compileExceptionHandlers):
2249         (JSC::DFG::JITCompiler::compile):
2250         (JSC::DFG::JITCompiler::compileFunction):
2251         * dfg/DFGJITCompiler.h:
2252         * interpreter/Interpreter.cpp:
2253         (JSC::UnwindFunctor::operator()):
2254         (JSC::UnwindFunctor::copyCalleeSavesToVMCalleeSavesBuffer):
2255         * dfg/DFGPlan.cpp:
2256         (JSC::DFG::Plan::compileInThreadImpl):
2257         * dfg/DFGSpeculativeJIT.cpp:
2258         (JSC::DFG::SpeculativeJIT::usedRegisters):
2259         * dfg/DFGSpeculativeJIT32_64.cpp:
2260         (JSC::DFG::SpeculativeJIT::compile):
2261         * dfg/DFGSpeculativeJIT64.cpp:
2262         (JSC::DFG::SpeculativeJIT::compile):
2263         * dfg/DFGStackLayoutPhase.cpp:
2264         (JSC::DFG::StackLayoutPhase::run):
2265         * ftl/FTLCompile.cpp:
2266         (JSC::FTL::fixFunctionBasedOnStackMaps):
2267         (JSC::FTL::compile):
2268         * ftl/FTLLink.cpp:
2269         (JSC::FTL::link):
2270         * ftl/FTLOSRExitCompiler.cpp:
2271         (JSC::FTL::compileStub):
2272         * ftl/FTLThunks.cpp:
2273         (JSC::FTL::osrExitGenerationThunkGenerator):
2274         * jit/ArityCheckFailReturnThunks.cpp: Removed.
2275         * jit/ArityCheckFailReturnThunks.h: Removed.
2276         * jit/JIT.cpp:
2277         (JSC::JIT::emitEnterOptimizationCheck):
2278         (JSC::JIT::privateCompile):
2279         (JSC::JIT::privateCompileExceptionHandlers):
2280         * jit/JITCall32_64.cpp:
2281         (JSC::JIT::emit_op_ret):
2282         * jit/JITExceptions.cpp:
2283         (JSC::genericUnwind):
2284         * jit/JITExceptions.h:
2285         * jit/JITOpcodes.cpp:
2286         (JSC::JIT::emit_op_end):
2287         (JSC::JIT::emit_op_ret):
2288         (JSC::JIT::emit_op_throw):
2289         (JSC::JIT::emit_op_catch):
2290         (JSC::JIT::emit_op_enter):
2291         (JSC::JIT::emitSlow_op_loop_hint):
2292         * jit/JITOpcodes32_64.cpp:
2293         (JSC::JIT::emit_op_end):
2294         (JSC::JIT::emit_op_throw):
2295         (JSC::JIT::emit_op_catch):
2296         * jit/JITOperations.cpp:
2297         * jit/Repatch.cpp:
2298         (JSC::generateByIdStub):
2299         * jit/ThunkGenerators.cpp:
2300         * llint/LLIntData.cpp:
2301         (JSC::LLInt::Data::performAssertions):
2302         * llint/LLIntSlowPaths.cpp:
2303         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2304         * llint/LowLevelInterpreter.asm:
2305         * llint/LowLevelInterpreter32_64.asm:
2306         * llint/LowLevelInterpreter64.asm:
2307         (JSC::throwExceptionFromCallSlowPathGenerator):
2308         (JSC::arityFixupGenerator):
2309         * runtime/CommonSlowPaths.cpp:
2310         (JSC::setupArityCheckData):
2311         * runtime/CommonSlowPaths.h:
2312         (JSC::CommonSlowPaths::arityCheckFor):
2313         Emit code to save and restore callee save registers and materialize tagTypeNumberRegister
2314         and tagMaskRegister.
2315         Handle callee saves when tiering up.
2316         Copy callee saves register contents to VM::calleeSaveRegistersBuffer at beginning of
2317         exception processing.
2318         Process callee save registers in frames when unwinding from an exception.
2319         Restore callee saves register contents from VM::calleeSaveRegistersBuffer on catch.
2320         Use appropriate register set to make sure we don't allocate a callee save register when
2321         compiling a thunk.
2322         Helper to populate tagTypeNumberRegister and tagMaskRegister with the appropriate
2323         constants.
2324         Removed arity fixup return thunks.
2325
2326         * dfg/DFGOSREntry.cpp:
2327         (JSC::DFG::prepareOSREntry):
2328         * dfg/DFGOSRExitCompiler32_64.cpp:
2329         (JSC::DFG::OSRExitCompiler::compileExit):
2330         * dfg/DFGOSRExitCompiler64.cpp:
2331         (JSC::DFG::OSRExitCompiler::compileExit):
2332         * dfg/DFGOSRExitCompilerCommon.cpp:
2333         (JSC::DFG::reifyInlinedCallFrames):
2334         (JSC::DFG::adjustAndJumpToTarget):
2335         Restore callee saves from the DFG and save the appropriate ones for the baseline JIT.
2336         Materialize the tag registers on 64 bit platforms.
2337
2338         * jit/AssemblyHelpers.h:
2339         (JSC::AssemblyHelpers::emitSaveCalleeSavesFor):
2340         (JSC::AssemblyHelpers::emitRestoreCalleeSavesFor):
2341         (JSC::AssemblyHelpers::emitSaveCalleeSaves):
2342         (JSC::AssemblyHelpers::emitRestoreCalleeSaves):
2343         (JSC::AssemblyHelpers::copyCalleeSavesToVMCalleeSavesBuffer):
2344         (JSC::AssemblyHelpers::restoreCalleeSavesFromVMCalleeSavesBuffer):
2345         (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMCalleeSavesBuffer):
2346         (JSC::AssemblyHelpers::emitMaterializeTagCheckRegisters):
2347         New helpers to save and restore callee saves as well as materialize the tag registers
2348         contents.
2349
2350         * jit/FPRInfo.h:
2351         * jit/GPRInfo.h:
2352         (JSC::GPRInfo::toRegister):
2353         Updated to include FP callee save registers.  Added number of callee saves registers and
2354         cleanup register aliases that collide with callee save registers.
2355
2356         * jit/JITPropertyAccess.cpp:
2357         (JSC::JIT::emitGetByValWithCachedId):
2358         (JSC::JIT::emitPutByValWithCachedId):
2359         (JSC::JIT::emit_op_get_by_id):
2360         (JSC::JIT::emit_op_put_by_id):
2361         * jit/JITPropertyAccess32_64.cpp:
2362         (JSC::JIT::emitGetByValWithCachedId):
2363         (JSC::JIT::emitPutByValWithCachedId):
2364         (JSC::JIT::emit_op_get_by_id):
2365         (JSC::JIT::emit_op_put_by_id):
2366         Uses new stubUnavailableRegisters register set to limit what registers are available for 
2367         temporaries.
2368
2369         * jit/RegisterSet.cpp:
2370         (JSC::RegisterSet::stubUnavailableRegisters):
2371         (JSC::RegisterSet::calleeSaveRegisters):
2372         (JSC::RegisterSet::llintBaselineCalleeSaveRegisters):
2373         (JSC::RegisterSet::dfgCalleeSaveRegisters):
2374         (JSC::RegisterSet::ftlCalleeSaveRegisters):
2375         * jit/RegisterSet.h:
2376         New register sets with the callee saves used by various tiers as well as one listing registers
2377         not availble to stub code.
2378
2379         * jit/SpecializedThunkJIT.h:
2380         (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
2381         (JSC::SpecializedThunkJIT::loadDoubleArgument):
2382         (JSC::SpecializedThunkJIT::returnJSValue):
2383         (JSC::SpecializedThunkJIT::returnDouble):
2384         (JSC::SpecializedThunkJIT::returnInt32):
2385         (JSC::SpecializedThunkJIT::returnJSCell):
2386         (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
2387         (JSC::SpecializedThunkJIT::emitSaveThenMaterializeTagRegisters):
2388         (JSC::SpecializedThunkJIT::emitRestoreSavedTagRegisters):
2389         (JSC::SpecializedThunkJIT::tagReturnAsInt32):
2390         * jit/ThunkGenerators.cpp:
2391         (JSC::nativeForGenerator):
2392         Changed to save and restore existing tag register contents as the may contain other values.
2393         After saving the existing values, we materialize the tag constants.
2394
2395         * jit/TempRegisterSet.h:
2396         (JSC::TempRegisterSet::getFPRByIndex):
2397         (JSC::TempRegisterSet::getFreeFPR):
2398         (JSC::TempRegisterSet::setByIndex):
2399         * offlineasm/arm64.rb:
2400         * offlineasm/registers.rb:
2401         Added methods for floating point registers to support callee save FP registers.
2402
2403         * jit/JITArithmetic32_64.cpp:
2404         (JSC::JIT::emit_op_mod):
2405         Removed unnecessary #if CPU(X86_64) check to this 32 bit only file.
2406
2407         * offlineasm/x86.rb:
2408         Fixed Windows callee saves naming.
2409
2410         * runtime/VM.cpp:
2411         (JSC::VM::VM):
2412         * runtime/VM.h:
2413         (JSC::VM::calleeSaveRegistersBufferOffset):
2414         (JSC::VM::getAllCalleeSaveRegistersMap):
2415         Provide a RegisterSaveMap that has all registers that might be saved.  Added a callee save buffer to be
2416         used for OSR exit and for exception processing in a future patch.
2417
2418 2015-09-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2419
2420         ModuleProgramExecutable should provide CodeBlock to ScriptExecutable::forEachCodeBlock
2421         https://bugs.webkit.org/show_bug.cgi?id=149028
2422
2423         Reviewed by Michael Saboff.
2424
2425         ModuleProgramExecutable should provide CodeBlock since ModuleProgramExecutable inherits
2426         ScriptExecutable.
2427
2428         * bytecode/CodeBlock.h:
2429         (JSC::ScriptExecutable::forEachCodeBlock):
2430
2431 2015-09-09  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2432
2433         Implement internal calls in WebAssembly
2434         https://bugs.webkit.org/show_bug.cgi?id=148998
2435
2436         Reviewed by Filip Pizlo.
2437
2438         This patch implements internal calls to functions that return a 32-bit
2439         integer in WebAssembly.
2440
2441         * tests/stress/wasm-calls.js: Added.
2442         (shouldBe):
2443         * tests/stress/wasm/calls.wasm: Added.
2444         * wasm/WASMFunctionCompiler.h:
2445         (JSC::WASMFunctionCompiler::WASMFunctionCompiler):
2446         (JSC::WASMFunctionCompiler::endFunction):
2447         (JSC::WASMFunctionCompiler::buildCallInternal):
2448         (JSC::WASMFunctionCompiler::appendExpressionList):
2449         (JSC::WASMFunctionCompiler::emitNakedCall):
2450         (JSC::WASMFunctionCompiler::boxArgumentsAndAdjustStackPointer):
2451         (JSC::WASMFunctionCompiler::callAndUnboxResult):
2452         * wasm/WASMFunctionParser.cpp:
2453         (JSC::WASMFunctionParser::compile):
2454         (JSC::WASMFunctionParser::parseExpressionI32):
2455         (JSC::WASMFunctionParser::parseCallInternalExpressionI32):
2456         (JSC::WASMFunctionParser::parseCallArguments):
2457         (JSC::WASMFunctionParser::parseCallInternal):
2458         * wasm/WASMFunctionParser.h:
2459         * wasm/WASMFunctionSyntaxChecker.h:
2460         (JSC::WASMFunctionSyntaxChecker::buildCallInternal):
2461         (JSC::WASMFunctionSyntaxChecker::appendExpressionList):
2462
2463 2015-09-09  Commit Queue  <commit-queue@webkit.org>
2464
2465         Unreviewed, rolling out r189522.
2466         https://bugs.webkit.org/show_bug.cgi?id=149020
2467
2468         "Caused a ~4% Speedometer regression" (Requested by cdumez on
2469         #webkit).
2470
2471         Reverted changeset:
2472
2473         "Function.prototype.bind: Bound functions must use the
2474         [[Prototype]] of their target function instead of
2475         Function.prototype"
2476         https://bugs.webkit.org/show_bug.cgi?id=145605
2477         http://trac.webkit.org/changeset/189522
2478
2479 2015-09-09  Geoffrey Garen  <ggaren@apple.com>
2480
2481         Fix the no-DFG build.
2482
2483         Unreviewed.
2484
2485         * bytecode/CodeBlock.cpp:
2486         (JSC::CodeBlock::visitOSRExitTargets):
2487         (JSC::CodeBlock::stronglyVisitStrongReferences):
2488
2489 2015-09-09  Geoffrey Garen  <ggaren@apple.com>
2490
2491         CodeBlocks should strongly visit their OSR exit targets
2492         https://bugs.webkit.org/show_bug.cgi?id=148988
2493
2494         Reviewed by Saam Barati.
2495
2496         CodeBlocks jump to their OSR exit targets, so we need to keep them alive
2497         explicitly.
2498
2499         This is a step toward throwing away CodeBlocks, which is only safe
2500         if we keep alive logically in-use CodeBlocks.
2501
2502         * bytecode/CodeBlock.cpp:
2503         (JSC::CodeBlock::CodeBlock):
2504         (JSC::CodeBlock::visitStrongly): Added a flag to indicate if visit
2505         strongly had been performed yet, since we are likely to revisit
2506         the same CodeBlock many times now.
2507
2508         (JSC::CodeBlock::visitOSRExitTargets):
2509         (JSC::CodeBlock::stronglyVisitStrongReferences): Do the visiting.
2510
2511         * bytecode/CodeBlock.h:
2512         (JSC::CodeBlock::clearMarks):
2513         (JSC::CodeBlockSet::mark): Added a helper function for clearing out
2514         two flags.
2515
2516 2015-09-09  Geoffrey Garen  <ggaren@apple.com>
2517
2518         Unreviewed, rolling back in r189516.
2519         https://bugs.webkit.org/show_bug.cgi?id=148989
2520
2521         Restored changeset:
2522
2523         "GC should be able to discover new strong CodeBlock references
2524         during marking"
2525         https://bugs.webkit.org/show_bug.cgi?id=148981
2526         http://trac.webkit.org/changeset/189516
2527
2528         This patch caused infinite recursion on Windows because of a pre-existing
2529         logical error in the non-parallel GC configuration. Even in non-parallel
2530         GC, we must set the mark bit on a CodeBlock to avoid marking it twice
2531         (or, in the case of our crash, infinitely recursively).
2532
2533 2015-09-09  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2534
2535         Implement the relational instructions for doubles in WebAssembly
2536         https://bugs.webkit.org/show_bug.cgi?id=148999
2537
2538         Reviewed by Filip Pizlo.
2539
2540         Implements the relational instructions for doubles (float64) in
2541         WebAssembly. Also pass the values into the test functions as Mark Lam
2542         suggested in https://bugs.webkit.org/show_bug.cgi?id=148882#c3
2543
2544         * tests/stress/wasm-relational.js:
2545         * tests/stress/wasm/relational.wasm:
2546         * wasm/WASMFunctionCompiler.h:
2547         (JSC::WASMFunctionCompiler::buildRelationalF64):
2548         * wasm/WASMFunctionParser.cpp:
2549         (JSC::WASMFunctionParser::parseExpressionI32):
2550         (JSC::WASMFunctionParser::parseRelationalF64ExpressionI32):
2551         * wasm/WASMFunctionParser.h:
2552         * wasm/WASMFunctionSyntaxChecker.h:
2553         (JSC::WASMFunctionSyntaxChecker::buildRelationalI32):
2554         (JSC::WASMFunctionSyntaxChecker::buildRelationalF64):
2555
2556 2015-09-09  Saam barati  <sbarati@apple.com>
2557
2558         DFG should have a debugging option that runs a phase that flushes all locals
2559         https://bugs.webkit.org/show_bug.cgi?id=148916
2560
2561         Reviewed by Filip Pizlo.
2562
2563         There is now an option to enable the DFG's new MaximalFlushInsertionPhase
2564         phase to run. This phase ensures that we keep all locals and arguments flushed
2565         to the stack at all places in the CFG. This phase is helpful for finding
2566         a class of bugs where enabling this phase to run removes the bug.
2567         This may also be useful in the development of a faster debugger
2568         that doesn't capture all variables.
2569
2570         * CMakeLists.txt:
2571         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2572         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2573         * JavaScriptCore.xcodeproj/project.pbxproj:
2574         * dfg/DFGMaximalFlushInsertionPhase.cpp: Added.
2575         (JSC::DFG::MaximalFlushInsertionPhase::MaximalFlushInsertionPhase):
2576         (JSC::DFG::MaximalFlushInsertionPhase::run):
2577         (JSC::DFG::MaximalFlushInsertionPhase::treatRegularBlock):
2578         (JSC::DFG::MaximalFlushInsertionPhase::treatRootBlock):
2579         (JSC::DFG::MaximalFlushInsertionPhase::newVariableAccessData):
2580         (JSC::DFG::performMaximalFlushInsertion):
2581         * dfg/DFGMaximalFlushInsertionPhase.h: Added.
2582         * dfg/DFGPlan.cpp:
2583         (JSC::DFG::Plan::compileInThreadImpl):
2584         * runtime/Options.cpp:
2585         (JSC::recomputeDependentOptions):
2586         * runtime/Options.h:
2587
2588 2015-09-08  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2589
2590         Refactor the test for the arithmetic instructions in WebAssembly
2591         https://bugs.webkit.org/show_bug.cgi?id=148983
2592
2593         Reviewed by Mark Lam.
2594
2595         Pass the values into the test functions as Mark Lam suggested in
2596         https://bugs.webkit.org/show_bug.cgi?id=148882#c3
2597
2598         * tests/stress/wasm-arithmetic-int32.js: Added.
2599         (shouldBe):
2600         (shouldThrow):
2601         * tests/stress/wasm-arithmetic.js: Removed.
2602         (shouldBe): Deleted.
2603         (shouldThrow): Deleted.
2604         * tests/stress/wasm/arithmetic-int32.wasm: Added.
2605         * tests/stress/wasm/arithmetic.wasm: Removed.
2606
2607 2015-09-08  Benjamin Poulain  <bpoulain@apple.com>
2608
2609         [JSC] reduce the amount of memory access needed for LivenessAnalysisPhase
2610         https://bugs.webkit.org/show_bug.cgi?id=148414
2611
2612         Reviewed by Mark Lam.
2613
2614         LivenessAnalysisPhase still causes a huge number of cache miss.
2615         This patch reduces the amount of accesses needed by the HashTables.
2616
2617         * dfg/DFGBasicBlock.h:
2618         * dfg/DFGLivenessAnalysisPhase.cpp:
2619         (JSC::DFG::LivenessAnalysisPhase::run):
2620         (JSC::DFG::LivenessAnalysisPhase::process):
2621
2622 2015-09-08  Myles C. Maxfield  <mmaxfield@apple.com>
2623
2624         Prospective build fix after r189517
2625
2626         Unreviewed.
2627
2628         * heap/MachineStackMarker.cpp:
2629         (JSC::MachineThreads::Thread::captureStack):
2630
2631 2015-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2632
2633         Unify symbolTableGet and Put in JSLexicalEnvironment and JSSymbolTableObject
2634         https://bugs.webkit.org/show_bug.cgi?id=148783
2635
2636         Reviewed by Geoffrey Garen.
2637
2638         Unify the symbolTableGet and symbolTablePut into JSSymbolTableObject's one.
2639         Since symbolTablePutWithAttributes in JSLexicalEnvironment is not used, we drop that function.
2640
2641         * runtime/JSEnvironmentRecord.h:
2642         (JSC::JSEnvironmentRecord::isValidScopeOffset):
2643         (JSC::JSEnvironmentRecord::variableAt):
2644         (JSC::JSEnvironmentRecord::isValid): Deleted.
2645         * runtime/JSGlobalLexicalEnvironment.cpp:
2646         (JSC::JSGlobalLexicalEnvironment::put):
2647         * runtime/JSGlobalObject.cpp:
2648         (JSC::JSGlobalObject::put):
2649         * runtime/JSLexicalEnvironment.cpp:
2650         (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
2651         (JSC::JSLexicalEnvironment::getOwnPropertySlot):
2652         (JSC::JSLexicalEnvironment::put):
2653         (JSC::JSLexicalEnvironment::symbolTableGet): Deleted.
2654         (JSC::JSLexicalEnvironment::symbolTablePut): Deleted.
2655         (JSC::JSLexicalEnvironment::symbolTablePutWithAttributes): Deleted.
2656         * runtime/JSLexicalEnvironment.h:
2657         * runtime/JSModuleRecord.cpp:
2658         (JSC::JSModuleRecord::instantiateDeclarations):
2659         * runtime/JSSegmentedVariableObject.h:
2660         (JSC::JSSegmentedVariableObject::isValidScopeOffset):
2661         * runtime/JSSymbolTableObject.h:
2662         (JSC::symbolTableGet):
2663         (JSC::symbolTablePut):
2664         (JSC::symbolTablePutTouchWatchpointSet):
2665         (JSC::symbolTablePutInvalidateWatchpointSet):
2666         (JSC::symbolTablePutWithAttributesTouchWatchpointSet):
2667         (JSC::symbolTablePutWithAttributes): Deleted.
2668
2669 2015-09-08  Commit Queue  <commit-queue@webkit.org>
2670
2671         Unreviewed, rolling out r189516.
2672         https://bugs.webkit.org/show_bug.cgi?id=148989
2673
2674         broke tests on windows (Requested by alexchristensen on
2675         #webkit).
2676
2677         Reverted changeset:
2678
2679         "GC should be able to discover new strong CodeBlock references
2680         during marking"
2681         https://bugs.webkit.org/show_bug.cgi?id=148981
2682         http://trac.webkit.org/changeset/189516
2683
2684 2015-09-08  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2685
2686         Remove unused DFG::dfgConvertJSValueToInt32()
2687         https://bugs.webkit.org/show_bug.cgi?id=148986
2688
2689         Reviewed by Geoffrey Garen.
2690
2691         Remove unused DFG::dfgConvertJSValueToInt32() and also remove
2692         DFG::JITCompiler::callOperation(D_JITOperation_EJ operation, ...) which
2693         was introduced in Bug 69806 for dfgConvertJSValueToNumber() and is no
2694         longer used.
2695
2696         * dfg/DFGOperations.cpp:
2697         * dfg/DFGOperations.h:
2698         * dfg/DFGSpeculativeJIT.h:
2699         (JSC::DFG::SpeculativeJIT::callOperation): Deleted.
2700
2701 2015-09-08  Matthew Hill  <matthew.jh@outlook.com>
2702
2703         Function.prototype.bind: Bound functions must use the [[Prototype]] of their target function instead of Function.prototype
2704         https://bugs.webkit.org/show_bug.cgi?id=145605
2705
2706         Reviewed by Geoffrey Garen.
2707
2708         * runtime/JSBoundFunction.cpp:
2709         (JSC::JSBoundFunction::create):
2710         * tests/es6.yaml:
2711
2712 2015-09-08  Mark Lam  <mark.lam@apple.com>
2713
2714         Fixed a bad comment r189517.
2715
2716         Not reviewed.
2717
2718         * heap/MachineStackMarker.cpp:
2719         (JSC::osRedZoneAdjustment):
2720
2721 2015-09-08  Geoffrey Garen  <ggaren@apple.com>
2722
2723         InlineCallFrames shouldn't be strongly marked by CodeBlock
2724         https://bugs.webkit.org/show_bug.cgi?id=146613
2725
2726         Reviewed by Saam Barati.
2727
2728         This code was vestigial an unnecessary, so I removed it.
2729
2730         * bytecode/CodeBlock.cpp:
2731         (JSC::CodeBlock::stronglyVisitStrongReferences):
2732         * bytecode/InlineCallFrame.cpp:
2733         (JSC::InlineCallFrame::calleeConstant):
2734         (JSC::InlineCallFrame::calleeForCallFrame):
2735         (JSC::InlineCallFrame::visitAggregate): Deleted.
2736         * bytecode/InlineCallFrame.h:
2737         (JSC::InlineCallFrame::specializationKind):
2738         * bytecode/InlineCallFrameSet.cpp:
2739         (JSC::InlineCallFrameSet::add):
2740         (JSC::InlineCallFrameSet::visitAggregate): Deleted.
2741         * bytecode/InlineCallFrameSet.h:
2742         (JSC::InlineCallFrameSet::begin):
2743         (JSC::InlineCallFrameSet::end):
2744
2745 2015-09-08  Mark Lam  <mark.lam@apple.com>
2746
2747         GC stack scan should include ABI red zone.
2748         https://bugs.webkit.org/show_bug.cgi?id=148976
2749
2750         Reviewed by Geoffrey Garen and Benjamin Poulain.
2751
2752         The x86_64 ABI section 3.2.2[1] and ARM64 ABI[2] both state that there is a
2753         128 byte red zone below the stack pointer (reserved by the OS), and that
2754         "functions may use this area for temporary data that is not needed across
2755         function calls".
2756
2757         Hence, it is possible for a thread to store JSCell pointers in the red zone
2758         area, and the conservative GC thread scanner needs to scan that area as well.
2759
2760         Note: the red zone should not be scanned for the GC thread itself (in
2761         gatherFromCurrentThread()).  This because we're guaranteed that there will
2762         be GC frames below the lowest (top of stack) frame that we need to scan.
2763         Hence, we are guaranteed that there are no red zone areas there containing
2764         JSObject pointers of relevance.
2765
2766         No test added for this issue because the issue relies on:
2767         1. the compiler tool chain generating code that stores local variables
2768            containing the sole reference to a JS object (that needs to be kept
2769            alive) in the stack red zone, and
2770         2. GC has to run on another thread while that red zone containing the
2771            JS object reference is in use. 
2772
2773         These conditions require a race that cannot be reliably reproduced.
2774
2775         [1]: http://people.freebsd.org/~obrien/amd64-elf-abi.pdf
2776         [2]: https://developer.apple.com/library/ios/documentation/Xcode/Conceptual/iPhoneOSABIReference/Articles/ARM64FunctionCallingConventions.html#//apple_ref/doc/uid/TP40013702-SW7
2777
2778         * heap/MachineStackMarker.cpp:
2779         (JSC::MachineThreads::Thread::Thread):
2780         (JSC::MachineThreads::Thread::createForCurrentThread):
2781         (JSC::MachineThreads::Thread::freeRegisters):
2782         (JSC::osRedZoneAdjustment):
2783         (JSC::MachineThreads::Thread::captureStack):
2784
2785 2015-09-08  Geoffrey Garen  <ggaren@apple.com>
2786
2787         GC should be able to discover new strong CodeBlock references during marking
2788         https://bugs.webkit.org/show_bug.cgi?id=148981
2789
2790         Reviewed by Mark Lam.
2791
2792         Previously, we required a strong reference to register itself before the
2793         first visit to a CodeBlock. Now, we can discover a strong reference at
2794         any time during the marking phase.
2795
2796         * bytecode/CodeBlock.cpp:
2797         (JSC::CodeBlock::CodeBlock): Remove the two strong reference state
2798         variables from CodeBlock. Now, a strong reference immediately marks
2799         the CodeBlock and its references at the moment of its discovery, and no
2800         separate state is required.
2801
2802         (JSC::CodeBlock::visitStrongly): New helper function for establishing
2803         a strong reference to a CodeBlock.
2804
2805         (JSC::CodeBlock::visitAggregate): Adopt helper function above.
2806
2807         (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan): Updated
2808         for state removal.
2809
2810         (JSC::CodeBlock::isKnownToBeLiveDuringGC): Ditto.
2811
2812         (JSC::CodeBlock::stronglyVisitWeakReferences): Be sure to record that
2813         we have proven liveness (by virtue of marking all the references the
2814         proof would check). This is required so that the CodeBlock knows itself
2815         to be live, and it is also an optimization to avoid testing weak references
2816         after we have already visited them.
2817
2818         * bytecode/CodeBlock.h:
2819         (JSC::CodeBlock::clearMarks):
2820         (JSC::CodeBlockSet::mark):
2821         (JSC::CodeBlockSet::clearMarks): Deleted. Updated for state removal.
2822
2823         * dfg/DFGPlan.cpp:
2824         (JSC::DFG::Plan::clearCodeBlockMarks):
2825         (JSC::DFG::Plan::checkLivenessAndVisitChildren):
2826         * dfg/DFGPlan.h: No need to use a CodeBlockSet in order to mark anymore.
2827
2828         * dfg/DFGWorklist.cpp:
2829         (JSC::DFG::Worklist::completeAllPlansForVM):
2830         (JSC::DFG::Worklist::clearCodeBlockMarks):
2831         (JSC::DFG::Worklist::resumeAllThreads):
2832         (JSC::DFG::Worklist::visitWeakReferences):
2833         (JSC::DFG::completeAllPlansForVM):
2834         (JSC::DFG::clearCodeBlockMarks):
2835         * dfg/DFGWorklist.h:
2836         (JSC::DFG::worklistForIndexOrNull): No need to use a CodeBlockSet in order
2837         to mark anymore.
2838
2839         * heap/CodeBlockSet.cpp:
2840         (JSC::CodeBlockSet::clearMarksForFullCollection):
2841         (JSC::CodeBlockSet::clearMarksForEdenCollection):
2842         (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
2843         (JSC::CodeBlockSet::traceMarked):
2844         (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
2845         (JSC::CodeBlockSet::dump):
2846         * heap/CodeBlockSet.h: Keep the currently executing CodeBlocks in RefPtrs
2847         since we can no longer rely on the m_currentlyExecuting bit to keep them
2848         alive. (A currently executing CodeBlock may not be referenced by its
2849         Executable because it may since have been replaced by another CodeBlock.
2850         This is common in the cases of OSR entry and exit.)
2851
2852         * heap/Heap.cpp:
2853         (JSC::Heap::markRoots):
2854         (JSC::Heap::visitCompilerWorklistWeakReferences):
2855         (JSC::Heap::visitWeakHandles): No need to trace the list of CodeBlocks
2856         on the stack in the weak reference fixpoint because we no longer overload
2857         "on the stack" to include CodeBlocks referenced by the compiler.
2858
2859 2015-09-08  Andreas Kling  <akling@apple.com>
2860
2861         [JSC] Remove unused Heap::getConservativeRegisterRoots().
2862         <https://webkit.org/b/148974>
2863
2864         Reviewed by Geoffrey Garen.
2865
2866         Spotted this unused stack root gathering helper in Heap. Let's lose it.
2867
2868         * heap/Heap.cpp:
2869         (JSC::Heap::getConservativeRegisterRoots): Deleted.
2870         * interpreter/JSStack.cpp:
2871         (JSC::JSStack::gatherConservativeRoots): Deleted.
2872         * interpreter/JSStack.h:
2873         (JSC::JSStack::gatherConservativeRoots): Deleted.
2874
2875 2015-09-08  Sukolsak Sakshuwong  <sukolsak@gmail.com>
2876
2877         Implement control flow statements in WebAssembly
2878         https://bugs.webkit.org/show_bug.cgi?id=148934
2879
2880         Reviewed by Geoffrey Garen.
2881
2882         This patch implements if, while, do, label, break, and continue
2883         statements in WebAssembly. Switches will be implemented in a subsequent
2884         patch.
2885
2886         * tests/stress/wasm-control-flow.js: Added.
2887         (shouldBe):
2888         * tests/stress/wasm/control-flow.wasm: Added.
2889         * wasm/WASMFunctionCompiler.h:
2890         (JSC::WASMFunctionCompiler::linkTarget):
2891         (JSC::WASMFunctionCompiler::jumpToTarget):
2892         (JSC::WASMFunctionCompiler::jumpToTargetIf):
2893         (JSC::WASMFunctionCompiler::startLoop):
2894         (JSC::WASMFunctionCompiler::endLoop):
2895         (JSC::WASMFunctionCompiler::startSwitch):
2896         (JSC::WASMFunctionCompiler::endSwitch):
2897         (JSC::WASMFunctionCompiler::startLabel):
2898         (JSC::WASMFunctionCompiler::endLabel):
2899         (JSC::WASMFunctionCompiler::breakTarget):
2900         (JSC::WASMFunctionCompiler::continueTarget):
2901         (JSC::WASMFunctionCompiler::breakLabelTarget):
2902         (JSC::WASMFunctionCompiler::continueLabelTarget):
2903         * wasm/WASMFunctionParser.cpp:
2904         (JSC::WASMFunctionParser::parseIfStatement):
2905         (JSC::WASMFunctionParser::parseIfElseStatement):
2906         (JSC::WASMFunctionParser::parseWhileStatement):
2907         (JSC::WASMFunctionParser::parseDoStatement):
2908         (JSC::WASMFunctionParser::parseLabelStatement):
2909         (JSC::WASMFunctionParser::parseBreakStatement):
2910         (JSC::WASMFunctionParser::parseBreakLabelStatement):
2911         (JSC::WASMFunctionParser::parseContinueStatement):
2912         (JSC::WASMFunctionParser::parseContinueLabelStatement):
2913         * wasm/WASMFunctionParser.h:
2914         * wasm/WASMFunctionSyntaxChecker.h:
2915         (JSC::WASMFunctionSyntaxChecker::linkTarget):
2916         (JSC::WASMFunctionSyntaxChecker::jumpToTarget):
2917         (JSC::WASMFunctionSyntaxChecker::jumpToTargetIf):
2918         (JSC::WASMFunctionSyntaxChecker::startLoop):
2919         (JSC::WASMFunctionSyntaxChecker::endLoop):
2920         (JSC::WASMFunctionSyntaxChecker::startSwitch):
2921         (JSC::WASMFunctionSyntaxChecker::endSwitch):
2922         (JSC::WASMFunctionSyntaxChecker::startLabel):
2923         (JSC::WASMFunctionSyntaxChecker::endLabel):
2924         (JSC::WASMFunctionSyntaxChecker::breakTarget):
2925         (JSC::WASMFunctionSyntaxChecker::continueTarget):
2926         (JSC::WASMFunctionSyntaxChecker::breakLabelTarget):
2927         (JSC::WASMFunctionSyntaxChecker::continueLabelTarget):
2928
2929 2015-09-08  Per Arne Vollan  <peavo@outlook.com>
2930
2931         [Win] Compile errors in inspector code.
2932         https://bugs.webkit.org/show_bug.cgi?id=148977
2933
2934         Reviewed by Alex Christensen.
2935
2936         Include definition of class FrontendRouter before use.
2937
2938         * inspector/InspectorBackendDispatcher.h:
2939         * inspector/JSGlobalObjectInspectorController.h:
2940
2941 2015-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2942
2943         [ES6] Implement computed accessors
2944         https://bugs.webkit.org/show_bug.cgi?id=147883
2945
2946         Reviewed by Geoffrey Garen.
2947
2948         Patch by Yusuke Suzuki <utatane.tea@gmail.com> and Matthew Mirman <mmirman@apple.com>.
2949
2950         Implement the computed accessors functionality for class syntax and object literal syntax.
2951         Added new opcodes, op_put_getter_by_val and op_put_setter_by_val. LLInt and baseline JIT support them.
2952         As the same to the other accessor opcodes (like op_put_getter_by_id etc.), DFG / FTL does not support
2953         them. This is handled here[1].
2954
2955         [1]: https://bugs.webkit.org/show_bug.cgi?id=148860
2956
2957         * bytecode/BytecodeList.json:
2958         * bytecode/BytecodeUseDef.h:
2959         (JSC::computeUsesForBytecodeOffset):
2960         (JSC::computeDefsForBytecodeOffset):
2961         * bytecode/CodeBlock.cpp:
2962         (JSC::CodeBlock::dumpBytecode):
2963         * bytecompiler/BytecodeGenerator.cpp:
2964         (JSC::BytecodeGenerator::emitPutGetterByVal):
2965         (JSC::BytecodeGenerator::emitPutSetterByVal):
2966         * bytecompiler/BytecodeGenerator.h:
2967         * bytecompiler/NodesCodegen.cpp:
2968         (JSC::PropertyListNode::emitBytecode):
2969         * jit/JIT.cpp:
2970         (JSC::JIT::privateCompileMainPass):
2971         * jit/JIT.h:
2972         * jit/JITInlines.h:
2973         (JSC::JIT::callOperation):
2974         * jit/JITOperations.cpp:
2975         * jit/JITOperations.h:
2976         * jit/JITPropertyAccess.cpp:
2977         (JSC::JIT::emit_op_put_getter_by_val):
2978         (JSC::JIT::emit_op_put_setter_by_val):
2979         * jit/JITPropertyAccess32_64.cpp:
2980         (JSC::JIT::emit_op_put_getter_by_val):
2981         (JSC::JIT::emit_op_put_setter_by_val):
2982         * llint/LLIntSlowPaths.cpp:
2983         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2984         * llint/LLIntSlowPaths.h:
2985         * llint/LowLevelInterpreter.asm:
2986         * parser/ASTBuilder.h:
2987         (JSC::ASTBuilder::createGetterOrSetterProperty):
2988         * parser/Parser.cpp:
2989         (JSC::Parser<LexerType>::parseClass):
2990         (JSC::Parser<LexerType>::parseGetterSetter):
2991         * parser/SyntaxChecker.h:
2992         (JSC::SyntaxChecker::createGetterOrSetterProperty):
2993         * tests/es6.yaml:
2994         * tests/stress/computed-accessor-parsing.js: Added.
2995         (testShouldNotThrow):
2996         (testShouldThrow):
2997         (Val.prototype.get string_appeared_here):
2998         (Val):
2999         * tests/stress/computed-accessor.js: Added.
3000         (shouldBe):
3001         (.):
3002         * tests/stress/duplicate-computed-accessors.js: Added.
3003         (shouldBe):
3004
3005 2015-09-08  Saam barati  <sbarati@apple.com>
3006
3007         baseline JIT should emit better code for UnresolvedProperty in resolve_scope/get_from_scope/put_to_scope
3008         https://bugs.webkit.org/show_bug.cgi?id=148895
3009
3010         Reviewed by Geoffrey Garen.
3011
3012         Previously, if a resolve_scope/get_from_scope/put_to_scope with
3013         UnresolvedProperty made it to the baseline JIT, we would hard compile
3014         a jump to the slow path. This is bad and slow. Because UnresolvedProperty
3015         tries to update itself to something more useful, and succeeds at doing so
3016         with high probability, we should be emitting code that checks to see if the 
3017         slow path has performed an update, and if it has, execute more efficient code 
3018         and not go to the slow path (unless it needs to for var injection check failure, 
3019         or other check failures). This increases the speed of this code greatly because 
3020         we may decide to compile a program/function before certain resolve_scope/get_from_scope/put_to_scope 
3021         operations ever execute. And now, the baseline JIT code better adapts to such
3022         compilation scenarios.
3023
3024         * bytecode/Watchpoint.h:
3025         (JSC::WatchpointSet::isBeingWatched):
3026         (JSC::WatchpointSet::addressOfState):
3027         (JSC::WatchpointSet::offsetOfState):
3028         (JSC::WatchpointSet::addressOfSetIsNotEmpty):
3029         * jit/JIT.cpp:
3030         (JSC::JIT::emitNotifyWrite):
3031         (JSC::JIT::assertStackPointerOffset):
3032         * jit/JIT.h:
3033         * jit/JITPropertyAccess.cpp:
3034         (JSC::JIT::emit_op_resolve_scope):
3035         (JSC::JIT::emitSlow_op_resolve_scope):
3036         (JSC::JIT::emitGetGlobalProperty):
3037         (JSC::JIT::emitGetVarFromPointer):
3038         (JSC::JIT::emitGetVarFromIndirectPointer):
3039         (JSC::JIT::emitGetClosureVar):
3040         (JSC::JIT::emit_op_get_from_scope):
3041         (JSC::JIT::emitSlow_op_get_from_scope):
3042         (JSC::JIT::emitPutGlobalProperty):
3043         (JSC::JIT::emitPutGlobalVariable):
3044         (JSC::JIT::emitPutGlobalVariableIndirect):
3045         (JSC::JIT::emitPutClosureVar):
3046         (JSC::JIT::emit_op_put_to_scope):
3047         (JSC::JIT::emitSlow_op_put_to_scope):
3048         * jit/JITPropertyAccess32_64.cpp:
3049         (JSC::JIT::emit_op_resolve_scope):
3050         (JSC::JIT::emitSlow_op_resolve_scope):
3051         (JSC::JIT::emitGetGlobalProperty):
3052         (JSC::JIT::emitGetVarFromPointer):
3053         (JSC::JIT::emitGetVarFromIndirectPointer):
3054         (JSC::JIT::emitGetClosureVar):
3055         (JSC::JIT::emit_op_get_from_scope):
3056         (JSC::JIT::emitSlow_op_get_from_scope):
3057         (JSC::JIT::emitPutGlobalProperty):
3058         (JSC::JIT::emitPutGlobalVariable):
3059         (JSC::JIT::emitPutGlobalVariableIndirect):
3060         (JSC::JIT::emitPutClosureVar):
3061         (JSC::JIT::emit_op_put_to_scope):
3062         (JSC::JIT::emitSlow_op_put_to_scope):
3063         * runtime/CommonSlowPaths.h:
3064         (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
3065         (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
3066         * runtime/JSScope.cpp:
3067         (JSC::abstractAccess):
3068         * tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property/first.js:
3069         (foo):
3070
3071 2015-09-08  Sukolsak Sakshuwong  <sukolsak@gmail.com>
3072
3073         Implement all the arithmetic and logical instructions in WebAssembly
3074         https://bugs.webkit.org/show_bug.cgi?id=148882
3075
3076         Reviewed by Mark Lam.
3077
3078         This patch implements all the arithmetic and logical instructions for
3079         32-bit integers in WebAssembly.
3080
3081         * tests/stress/wasm-arithmetic.js:
3082         * tests/stress/wasm/arithmetic.wasm:
3083         * wasm/WASMFunctionCompiler.h:
3084         (JSC::WASMFunctionCompiler::buildUnaryI32):
3085         (JSC::WASMFunctionCompiler::buildBinaryI32):
3086         * wasm/WASMFunctionParser.cpp:
3087         (JSC::WASMFunctionParser::parseExpressionI32):
3088         (JSC::WASMFunctionParser::parseUnaryExpressionI32):
3089         * wasm/WASMFunctionParser.h:
3090         * wasm/WASMFunctionSyntaxChecker.h:
3091         (JSC::WASMFunctionSyntaxChecker::buildUnaryI32):
3092
3093 2015-09-08  Filip Pizlo  <fpizlo@apple.com>
3094
3095         Unreviewed, fix debug by removing an assertion that is not correct anymore.
3096
3097         * jit/Repatch.cpp:
3098         (JSC::linkFor):
3099
3100 2015-09-08  Sukolsak Sakshuwong  <sukolsak@gmail.com>
3101
3102         Add initial support for doubles in WebAssembly
3103         https://bugs.webkit.org/show_bug.cgi?id=148913
3104
3105         Reviewed by Filip Pizlo.
3106
3107         Implement the ConstantPoolIndex, Immediate, and GetLocal instructions
3108         for doubles (float64) in WebAssembly.
3109
3110         * tests/stress/wasm-arithmetic-float64.js: Added.
3111         (shouldBe):
3112         * tests/stress/wasm/arithmetic-float64.wasm: Added.
3113         * wasm/WASMConstants.h:
3114         * wasm/WASMFunctionCompiler.h:
3115         (JSC::WASMFunctionCompiler::buildSetLocal):
3116         (JSC::WASMFunctionCompiler::buildReturn):
3117         (JSC::WASMFunctionCompiler::buildImmediateI32):
3118         (JSC::WASMFunctionCompiler::buildImmediateF64):
3119         (JSC::WASMFunctionCompiler::buildGetLocal):
3120         * wasm/WASMFunctionParser.cpp:
3121         (JSC::WASMFunctionParser::parseExpression):
3122         (JSC::WASMFunctionParser::parseExpressionF64):
3123         (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionF64):
3124         (JSC::WASMFunctionParser::parseImmediateExpressionF64):
3125         (JSC::WASMFunctionParser::parseGetLocalExpressionF64):
3126         * wasm/WASMFunctionParser.h:
3127         * wasm/WASMFunctionSyntaxChecker.h:
3128         (JSC::WASMFunctionSyntaxChecker::buildImmediateF64):
3129         * wasm/WASMReader.cpp:
3130         (JSC::WASMReader::readOpExpressionF64):
3131         * wasm/WASMReader.h:
3132
3133 2015-09-06  Filip Pizlo  <fpizlo@apple.com>
3134
3135         CallLinkInfo inside StructureStubInfo should not use polymorphic stubs
3136         https://bugs.webkit.org/show_bug.cgi?id=148915
3137
3138         Reviewed by Mark Lam.
3139
3140         There is a subtle bug where if we reset a get_by_id IC that had a getter stub that in
3141         turn had a polymorphic call stub, then the GC won't know to keep the getter stub alive.
3142         This patch documents the bug in a FIXME and disables polymorphic call optimizations for
3143         getters. It also just so happens that the polymorphic call optimizations usually don't
3144         benefit getters, since it's hard to create polymorphism at the point of call without also
3145         introducing polymorphism in the base object's structure.
3146
3147         The added test doesn't reproduce the problem, because it's hard to get the GC to delete
3148         all of the stubs.
3149
3150         * bytecode/CallLinkInfo.h:
3151         (JSC::CallLinkInfo::CallLinkInfo):
3152         (JSC::CallLinkInfo::setCallLocations):
3153         (JSC::CallLinkInfo::allowStubs):
3154         (JSC::CallLinkInfo::disallowStubs):
3155         (JSC::CallLinkInfo::setUpCallFromFTL):
3156         * jit/Repatch.cpp:
3157         (JSC::generateByIdStub):
3158         (JSC::linkFor):
3159         (JSC::linkPolymorphicCall):
3160         * tests/stress/poly-call-stub-in-getter-stub.js: Added.
3161         (foo):
3162         (makeGetter):
3163
3164 2015-09-07  Filip Pizlo  <fpizlo@apple.com>
3165
3166         The put_by_id IC store barrier contract should benefit transition over replace
3167         https://bugs.webkit.org/show_bug.cgi?id=148943
3168
3169         Reviewed by Mark Lam.
3170
3171         Previously, we would only emit a barrier if the value being stored was possibly a cell, so
3172         the transition stub code generator would have to emit a barrier for the store of the
3173         structure, just in case the structure was newer than the base object.
3174
3175         This changes the contract so that the put_by_id callsite would always have a barrier on the
3176         base (except if it proved that the base was brand new). That way, the transition doesn't have
3177         to have a barrier unless it allocates.
3178
3179         This is meant to be a perf-neutral change that I need for the IC refactoring in
3180         https://bugs.webkit.org/show_bug.cgi?id=148717.
3181
3182         * dfg/DFGFixupPhase.cpp:
3183         (JSC::DFG::FixupPhase::fixupNode):
3184         * dfg/DFGStoreBarrierInsertionPhase.cpp:
3185         * jit/Repatch.cpp:
3186         (JSC::emitPutTransitionStub):
3187
3188 2015-09-07  Alex Christensen  <achristensen@webkit.org>
3189
3190         Windows non-cygwin build fix after r189333.
3191
3192         SVN on Windows (non-cygwin) doesn't like having the * character in file names.
3193         I replaced "*" with "star" in some of Geoff's new tests.
3194
3195         * tests/es6.yaml:
3196         Changed all _*_ to _star_
3197         * tests/es6/generators_yield_*_arrays.js: Removed.
3198         * tests/es6/generators_yield_*_astral_plane_strings.js: Removed.
3199         * tests/es6/generators_yield_*_generator_instances.js: Removed.
3200         * tests/es6/generators_yield_*_generic_iterables.js: Removed.
3201         * tests/es6/generators_yield_*_instances_of_iterables.js: Removed.
3202         * tests/es6/generators_yield_*_iterator_closing.js: Removed.
3203         * tests/es6/generators_yield_*_iterator_closing_via_throw.js: Removed.
3204         * tests/es6/generators_yield_*_on_non-iterables_is_a_runtime_error.js: Removed.
3205         * tests/es6/generators_yield_*_sparse_arrays.js: Removed.
3206         * tests/es6/generators_yield_*_strings.js: Removed.
3207         * tests/es6/generators_yield_star_arrays.js: Copied from tests/es6/generators_yield_*_arrays.js.
3208         * tests/es6/generators_yield_star_astral_plane_strings.js: Copied from tests/es6/generators_yield_*_astral_plane_strings.js.
3209         * tests/es6/generators_yield_star_generator_instances.js: Copied from tests/es6/generators_yield_*_generator_instances.js.
3210         * tests/es6/generators_yield_star_generic_iterables.js: Copied from tests/es6/generators_yield_*_generic_iterables.js.
3211         * tests/es6/generators_yield_star_instances_of_iterables.js: Copied from tests/es6/generators_yield_*_instances_of_iterables.js.
3212         * tests/es6/generators_yield_star_iterator_closing.js: Copied from tests/es6/generators_yield_*_iterator_closing.js.
3213         * tests/es6/generators_yield_star_iterator_closing_via_throw.js: Copied from tests/es6/generators_yield_*_iterator_closing_via_throw.js.
3214         * tests/es6/generators_yield_star_on_non-iterables_is_a_runtime_error.js: Copied from tests/es6/generators_yield_*_on_non-iterables_is_a_runtime_error.js.
3215         * tests/es6/generators_yield_star_sparse_arrays.js: Copied from tests/es6/generators_yield_*_sparse_arrays.js.
3216         * tests/es6/generators_yield_star_strings.js: Copied from tests/es6/generators_yield_*_strings.js.
3217
3218 2015-09-06  Mark Lam  <mark.lam@apple.com>
3219
3220         Gardening: fix broken Windows build after r189454.
3221
3222         Not reviewed.
3223
3224         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
3225         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
3226
3227 2015-09-06  Sukolsak Sakshuwong  <sukolsak@gmail.com>
3228
3229         Implement the relational instructions in WebAssembly
3230         https://bugs.webkit.org/show_bug.cgi?id=148838
3231
3232         Reviewed by Saam Barati.
3233
3234         This patch implements the relational instructions for 32-bit integers in
3235         WebAssembly.
3236
3237         * tests/stress/wasm-arithmetic.js:
3238         * tests/stress/wasm-locals.js:
3239         * tests/stress/wasm-relational.js: Added.
3240         (shouldBe):
3241         * tests/stress/wasm/arithmetic.wasm: Renamed from Source/JavaScriptCore/tests/stress/wasm-arithmetic.wasm.
3242         * tests/stress/wasm/locals.wasm: Renamed from Source/JavaScriptCore/tests/stress/wasm-locals.wasm.
3243         * tests/stress/wasm/relational.wasm: Added.
3244         * wasm/WASMFunctionCompiler.h:
3245         (JSC::WASMFunctionCompiler::buildRelationalI32):
3246         * wasm/WASMFunctionParser.cpp:
3247         (JSC::WASMFunctionParser::parseExpressionI32):
3248         (JSC::WASMFunctionParser::parseRelationalI32ExpressionI32):
3249         * wasm/WASMFunctionParser.h:
3250         * wasm/WASMFunctionSyntaxChecker.h:
3251         (JSC::WASMFunctionSyntaxChecker::buildRelationalI32):
3252
3253 2015-09-06  Mark Lam  <mark.lam@apple.com>
3254
3255         StackOverflow stack unwinding should stop at native frames.
3256         https://bugs.webkit.org/show_bug.cgi?id=148749
3257
3258         Reviewed by Michael Saboff.
3259
3260         In the present code, after ping-pong'ing back and forth between native and JS
3261         code a few times, if we have a stack overflow on re-entry into the VM to run
3262         JS code's whose stack frame would overflow the JS stack, the code will end up
3263         unwinding past the native function that is making the call to re-enter the VM.
3264         As a result, any clean up code (e.g. destructors for stack variables) in the
3265         skipped native function frame (and its chain of native function callers) will
3266         not be called.
3267
3268         This patch is based on the Michael Saboff's fix of this issue landed on the
3269         jsc-tailcall branch: http://trac.webkit.org/changeset/188555
3270
3271         We now check for the case where there are no JS frames to unwind since the
3272         last native frame, and treat the exception as an unhandled exception.  The
3273         native function is responsible for further propagating the exception if needed.
3274
3275         Other supporting work:
3276         1. Remove vm->vmEntryFrameForThrow.  It should always be the same as
3277            vm->topVMEntryFrame.
3278         2. Change operationThrowStackOverflowError() to use the throwStackOverflowError()
3279            helper function instead of rolling its own.
3280         3. Added a test that exercises this edge case.  The test should not hang or crash.
3281
3282         * API/tests/PingPongStackOverflowTest.cpp: Added.
3283         (PingPongStackOverflowObject_hasInstance):
3284         (testPingPongStackOverflow):
3285         * API/tests/PingPongStackOverflowTest.h: Added.
3286         * API/tests/testapi.c:
3287         (main):
3288         * JavaScriptCore.xcodeproj/project.pbxproj:
3289         * interpreter/CallFrame.h:
3290         (JSC::ExecState::operator=):
3291         (JSC::ExecState::callerFrame):
3292         (JSC::ExecState::callerFrameOrVMEntryFrame):
3293         (JSC::ExecState::argIndexForRegister):
3294         (JSC::ExecState::callerFrameAndPC):
3295         * interpreter/Interpreter.cpp:
3296         (JSC::UnwindFunctor::UnwindFunctor):
3297         (JSC::UnwindFunctor::operator()):
3298         (JSC::Interpreter::unwind):
3299         * interpreter/Interpreter.h:
3300         (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
3301         (JSC::Interpreter::sampler):
3302         * jit/CCallHelpers.h:
3303         (JSC::CCallHelpers::jumpToExceptionHandler):
3304         * jit/JITExceptions.cpp:
3305         (JSC::genericUnwind):
3306         * jit/JITExceptions.h:
3307         * jit/JITOpcodes.cpp:
3308         (JSC::JIT::emit_op_catch):
3309         * jit/JITOpcodes32_64.cpp:
3310         (JSC::JIT::emit_op_catch):
3311         * jit/JITOperations.cpp:
3312         * llint/LowLevelInterpreter32_64.asm:
3313         * llint/LowLevelInterpreter64.asm:
3314         * runtime/VM.h:
3315         (JSC::VM::exceptionOffset):
3316         (JSC::VM::callFrameForThrowOffset):
3317         (JSC::VM::vmEntryFrameForThrowOffset): Deleted.
3318         (JSC::VM::topVMEntryFrameOffset): Deleted.
3319
3320 2015-09-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3321
3322         Unreviewed, disable module tests in Windows until name resolution is fixed
3323         https://bugs.webkit.org/show_bug.cgi?id=148689
3324
3325         Until bug[1] is fixed, we disable the module tests.
3326         Since the local file system name resolution is just implemented in jsc.cpp and
3327         is intended to be used for the module tests, it does not affect JSC framework
3328         and WebKit itself.
3329
3330         [1]: https://bugs.webkit.org/show_bug.cgi?id=148917
3331
3332         * tests/modules.yaml:
3333
3334 2015-09-06  Sukolsak Sakshuwong  <sukolsak@gmail.com>
3335
3336         Simplify JIT::emit_op_mod()
3337         https://bugs.webkit.org/show_bug.cgi?id=148908
3338
3339         Reviewed by Michael Saboff.
3340
3341         The IDIV instruction on x86 divides the value in the EDX:EAX registers
3342         by the source operand and stores the quotient in EAX and the remainder
3343         in EDX. Therefore, we store the values that we don't want to be
3344         overwritten by IDIV in registers that are not EAX or EDX. This patch
3345         makes the intention clearer and makes the code easier to read.
3346
3347         * jit/JITArithmetic.cpp:
3348         (JSC::JIT::emit_op_mod):
3349
3350 2015-09-05  Mark Lam  <mark.lam@apple.com>
3351
3352         Fix JSDollarVMPrototype after r189160.
3353         https://bugs.webkit.org/show_bug.cgi?id=148900
3354
3355         Reviewed by Michael Saboff.
3356
3357         JSDollarVMPrototype needs to be updated to match http://trac.webkit.org/changeset/189160 i.e.
3358         remove the use of JSC::Function bit in its property attributes.
3359
3360         * tools/JSDollarVMPrototype.cpp:
3361         (JSC::JSDollarVMPrototype::finishCreation):
3362
3363 2015-09-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3364
3365         Unreviewed, fix the module name resolution in Windows
3366         https://bugs.webkit.org/show_bug.cgi?id=148689
3367
3368         Attempt to fix the module name resolution in Windows.
3369         A module name is represented as the UNIX path under the current module tests.
3370         This fix split the module name with '/' instead of pathSeparator().
3371
3372         This is only utilized by the jsc.cpp for the local module tests.
3373         So, WebKit production and JavaScriptCore framework are not affected by this change.
3374
3375         * jsc.cpp:
3376         (ModuleName::startsWithRoot):
3377         (ModuleName::ModuleName):
3378         (resolvePath):
3379         (GlobalObject::moduleLoaderResolve):
3380
3381 2015-09-05  Brian Burg  <bburg@apple.com>
3382
3383         Web Inspector: tighten up lifetimes for Agent-owned objects, and initialize agents using contexts
3384         https://bugs.webkit.org/show_bug.cgi?id=148625
3385
3386         Reviewed by Joseph Pecoraro.
3387
3388         All agents own their domain-specific frontend and backend dispatchers. Change so that
3389         they are initialized in constructors rather than when a frontend connects or disconnects.
3390         This may cause additional memory use, but this can be counteracted by lazily creating
3391         some agents that are not required for other agents to function (i.e., runtime and page agents).
3392
3393         To avoid adding frontend/backend dispatcher arguments to every single agent constructor,
3394         change agent construction to take a AgentContext or a subclass of it. This provides agents with
3395         references to objects in the owning InspectorEnvironment subclass that are guaranteed to
3396         outlive all agents. AgentContext and its subclasses follow the existing Agent class hierarchy.
3397
3398         * inspector/InspectorAgentBase.h:
3399         (Inspector::JSAgentContext::JSAgentContext):
3400         * inspector/JSGlobalObjectInspectorController.cpp:
3401         (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
3402         (Inspector::JSGlobalObjectInspectorController::connectFrontend):
3403         (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
3404         (Inspector::JSGlobalObjectInspectorController::disconnectAllFrontends):
3405         (Inspector::JSGlobalObjectInspectorController::appendExtraAgent):
3406         * inspector/JSGlobalObjectInspectorController.h:
3407         * inspector/agents/InspectorAgent.cpp:
3408         (Inspector::InspectorAgent::InspectorAgent):
3409         (Inspector::InspectorAgent::didCreateFrontendAndBackend):
3410         (Inspector::InspectorAgent::willDestroyFrontendAndBackend):
3411         * inspector/agents/InspectorAgent.h:
3412         * inspector/agents/InspectorConsoleAgent.cpp:
3413         (Inspector::InspectorConsoleAgent::InspectorConsoleAgent):
3414         (Inspector::InspectorConsoleAgent::didCreateFrontendAndBackend):
3415         (Inspector::InspectorConsoleAgent::willDestroyFrontendAndBackend):
3416         * inspector/agents/InspectorConsoleAgent.h:
3417         * inspector/agents/InspectorDebuggerAgent.cpp:
3418         (Inspector::InspectorDebuggerAgent::InspectorDebuggerAgent):
3419         (Inspector::InspectorDebuggerAgent::didCreateFrontendAndBackend):
3420         (Inspector::InspectorDebuggerAgent::willDestroyFrontendAndBackend):
3421         * inspector/agents/InspectorDebuggerAgent.h:
3422         * inspector/agents/InspectorRuntimeAgent.cpp:
3423         (Inspector::InspectorRuntimeAgent::InspectorRuntimeAgent):
3424         * inspector/agents/InspectorRuntimeAgent.h:
3425         * inspector/agents/JSGlobalObjectConsoleAgent.cpp:
3426         (Inspector::JSGlobalObjectConsoleAgent::JSGlobalObjectConsoleAgent):
3427         * inspector/agents/JSGlobalObjectConsoleAgent.h:
3428         * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
3429         (Inspector::JSGlobalObjectDebuggerAgent::JSGlobalObjectDebuggerAgent):
3430         * inspector/agents/JSGlobalObjectDebuggerAgent.h:
3431         * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
3432         (Inspector::JSGlobalObjectRuntimeAgent::JSGlobalObjectRuntimeAgent):
3433         (Inspector::JSGlobalObjectRuntimeAgent::didCreateFrontendAndBackend):
3434         * inspector/agents/JSGlobalObjectRuntimeAgent.h:
3435         * inspector/augmentable/AlternateDispatchableAgent.h:
3436         * inspector/augmentable/AugmentableInspectorController.h: Alternate agents should
3437         have access to frontend router and backend dispatcher at construction time.
3438         
3439         * inspector/scripts/codegen/cpp_generator_templates.py:
3440         * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
3441         (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
3442         * inspector/scripts/codegen/objc_generator_templates.py:
3443
3444 2015-09-04  Brian Burg  <bburg@apple.com>
3445
3446         Web Inspector: agents should send messages through FrontendRouter instead of FrontendChannel
3447         https://bugs.webkit.org/show_bug.cgi?id=148492
3448
3449         Reviewed by Joseph Pecoraro.
3450
3451         Replace uses of FrontendChannel with FrontendRouter. Minor cleanups along the way.  
3452
3453         Make AgentRegistry automatically signal discardAgent() in its destructor, since it always
3454         gets executed in the owning controller's destructor anyway.
3455
3456         * inspector/InspectorAgentBase.h:
3457         * inspector/InspectorAgentRegistry.cpp:
3458         (Inspector::AgentRegistry::~AgentRegistry):
3459         (Inspector::AgentRegistry::didCreateFrontendAndBackend):
3460         (Inspector::AgentRegistry::willDestroyFrontendAndBackend):
3461         (Inspector::AgentRegistry::discardAgents): Deleted.
3462         * inspector/InspectorAgentRegistry.h:
3463         * inspector/InspectorBackendDispatcher.cpp:
3464         * inspector/InspectorFrontendRouter.cpp:
3465         (Inspector::FrontendRouter::leakChannel): Deleted, no longer necessary.
3466         * inspector/InspectorFrontendRouter.h:
3467         * inspector/JSGlobalObjectInspectorController.cpp:
3468         (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
3469         (Inspector::JSGlobalObjectInspectorController::connectFrontend):
3470         (Inspector::JSGlobalObjectInspectorController::appendExtraAgent):
3471         (Inspector::JSGlobalObjectInspectorController::~JSGlobalObjectInspectorController):
3472         * inspector/JSGlobalObjectInspectorController.h:
3473         * inspector/agents/InspectorAgent.cpp:
3474         (Inspector::InspectorAgent::didCreateFrontendAndBackend):
3475         * inspector/agents/InspectorAgent.h:
3476         * inspector/agents/InspectorConsoleAgent.cpp:
3477         (Inspector::InspectorConsoleAgent::didCreateFrontendAndBackend):
3478         * inspector/agents/InspectorConsoleAgent.h:
3479         * inspector/agents/InspectorDebuggerAgent.cpp:
3480         (Inspector::InspectorDebuggerAgent::didCreateFrontendAndBackend):
3481         * inspector/agents/InspectorDebuggerAgent.h:
3482         * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
3483         (Inspector::JSGlobalObjectRuntimeAgent::didCreateFrontendAndBackend):
3484         * inspector/agents/JSGlobalObjectRuntimeAgent.h:
3485         * inspector/augmentable/AlternateDispatchableAgent.h:
3486         * inspector/remote/RemoteInspectorDebuggable.cpp:
3487         * inspector/scripts/codegen/cpp_generator_templates.py:
3488         * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
3489         (CppBackendDispatcherImplementationGenerator.generate_output):
3490         * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
3491         (CppFrontendDispatcherHeaderGenerator.generate_output.FrontendRouter):
3492         (CppFrontendDispatcherHeaderGenerator.generate_output):
3493         * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
3494         (CppFrontendDispatcherImplementationGenerator.generate_output):
3495         (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
3496         * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
3497         (ObjCConfigurationImplementationGenerator.generate_output):
3498         * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
3499         (ObjCFrontendDispatcherImplementationGenerator.generate_output):
3500
3501 2015-09-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3502
3503         [ES6] Enable ES6 Module in JSC shell by default
3504         https://bugs.webkit.org/show_bug.cgi?id=148689
3505
3506         Reviewed by Geoffrey Garen.
3507
3508         Enable ES6 Modules in JSC shell by default. Compile time flag is left for WebCore.
3509         Since the entry point to evaluate the modules are completely separated from the usual
3510         entry point to evaluate the script, we can safely enable ES6 modules in JSC shell.
3511
3512         And add bunch of tests for ES6 Modules.
3513
3514         * jsc.cpp:
3515         (GlobalObject::finishCreation):
3516         (functionLoadModule):
3517         (runWithScripts):
3518         (printUsageStatement): Deleted.
3519         (CommandLine::parseArguments): Deleted.
3520         * parser/Parser.cpp:
3521         (JSC::Parser<LexerType>::parseInner): Deleted.
3522         * tests/modules.yaml: Added.
3523         * tests/modules/aliasing.js: Added.
3524         * tests/modules/aliasing/drink-2.js: Added.
3525         (export.let.Cappuccino.string_appeared_here.export.changeCappuccino):
3526         * tests/modules/aliasing/drink.js: Added.
3527         (export.changeCocoa):
3528         * tests/modules/cyclic-may-produce-tdz.js: Added.
3529         * tests/modules/cyclic-may-produce-tdz/1.js: Added.
3530         * tests/modules/cyclic-may-produce-tdz/2.js: Added.
3531         * tests/modules/default-error/main.js: Added.
3532         * tests/modules/default-value-case-should-be-copied.js: Added.
3533         * tests/modules/default-value-case-should-be-copied/module.js: Added.
3534         (export.changeValue):
3535         * tests/modules/defaults.js: Added.
3536         * tests/modules/defaults/Cappuccino.js: Added.
3537         * tests/modules/defaults/Cocoa.js: Added.
3538         (export.default.Cocoa):
3539         * tests/modules/defaults/Matcha.js: Added.
3540         * tests/modules/destructuring-export.js: Added.
3541         * tests/modules/destructuring-export/array.js: Added.
3542         * tests/modules/destructuring-export/main.js: Added.
3543         * tests/modules/execution-order-cyclic.js: Added.
3544         * tests/modules/execution-order-cyclic/1.js: Added.
3545         * tests/modules/execution-order-cyclic/10.js: Added.
3546         * tests/modules/execution-order-cyclic/11.js: Added.
3547         * tests/modules/execution-order-cyclic/2.js: Added.
3548         * tests/modules/execution-order-cyclic/3.js: Added.
3549         * tests/modules/execution-order-cyclic/4.js: Added.
3550         * tests/modules/execution-order-cyclic/5.js: Added.
3551         * tests/modules/execution-order-cyclic/6.js: Added.
3552         * tests/modules/execution-order-cyclic/7.js: Added.
3553         * tests/modules/execution-order-cyclic/8.js: Added.
3554         * tests/modules/execution-order-cyclic/9.js: Added.
3555         * tests/modules/execution-order-dag.js: Added.
3556         * tests/modules/execution-order-dag/1.js: Added.
3557         * tests/modules/execution-order-dag/10.js: Added.
3558         * tests/modules/execution-order-dag/2.js: Added.
3559         * tests/modules/execution-order-dag/3.js: Added.
3560         * tests/modules/execution-order-dag/4.js: Added.
3561         * tests/modules/execution-order-dag/5.js: Added.
3562         * tests/modules/execution-order-dag/6.js: Added.
3563         * tests/modules/execution-order-dag/7.js: Added.
3564         * tests/modules/execution-order-dag/8.js: Added.
3565         * tests/modules/execution-order-dag/9.js: Added.
3566         * tests/modules/execution-order-depth.js: Added.
3567         * tests/modules/execution-order-depth/1.js: Added.
3568         * tests/modules/execution-order-depth/2.js: Added.
3569         * tests/modules/execution-order-depth/3.js: Added.
3570         * tests/modules/execution-order-self.js: Added.
3571         * tests/modules/execution-order-sibling.js: Added.
3572         * tests/modules/execution-order-sibling/1.js: Added.
3573         * tests/modules/execution-order-sibling/2.js: Added.
3574         * tests/modules/execution-order-sibling/3.js: Added.
3575         * tests/modules/execution-order-tree.js: Added.
3576         * tests/modules/execution-order-tree/1.js: Added.
3577         * tests/modules/execution-order-tree/10.js: Added.
3578         * tests/modules/execution-order-tree/11.js: Added.
3579         * tests/modules/execution-order-tree/2.js: Added.
3580         * tests/modules/execution-order-tree/3.js: Added.
3581         * tests/modules/execution-order-tree/4.js: Added.
3582         * tests/modules/execution-order-tree/5.js: Added.
3583         * tests/modules/execution-order-tree/6.js: Added.
3584         * tests/modules/execution-order-tree/7.js: Added.
3585         * tests/modules/execution-order-tree/8.js: Added.
3586         * tests/modules/execution-order-tree/9.js: Added.
3587         * tests/modules/export-conflict-ok.js: Added.
3588         * tests/modules/export-conflict-ok/A.js: Added.
3589         * tests/modules/export-conflict-ok/B.js: Added.
3590         * tests/modules/export-conflict-ok/main.js: Added.
3591         * tests/modules/export-from.js: Added.
3592         * tests/modules/export-from/main.js: Added.
3593         * tests/modules/export-from/second.js: Added.
3594         * tests/modules/export-with-declarations-list.js: Added.
3595         * tests/modules/export-with-declarations-list/main.js: Added.
3596         * tests/modules/exported-function-may-be-called-before-module-is-executed.js: Added.
3597         * tests/modules/exported-function-may-be-called-before-module-is-executed/1.js: Added.
3598         * tests/modules/exported-function-may-be-called-before-module-is-executed/2.js: Added.
3599         (export.add):
3600         (export.raise):
3601         * tests/modules/import-error.js: Added.
3602         * tests/modules/import-error/export-ambiguous-1.js: Added.
3603         * tests/modules/import-error/export-ambiguous-2.js: Added.
3604         * tests/modules/import-error/export-ambiguous.js: Added.
3605         * tests/modules/import-error/export-default-from-star-2.js: Added.
3606         (export.default.Cocoa):
3607         * tests/modules/import-error/export-default-from-star.js: Added.
3608         * tests/modules/import-error/export-not-found.js: Added.
3609         * tests/modules/import-error/import-ambiguous.js: Added.
3610         * tests/modules/import-error/import-default-from-star.js: Added.
3611         * tests/modules/import-error/import-not-found.js: Added.
3612         * tests/modules/imported-bindings-are-immutable.js: Added.
3613         * tests/modules/imported-bindings-are-immutable/bindings.js: Added.
3614         (export.functionDeclaration):
3615         (export.classDeclaration):
3616         * tests/modules/imported-bindings-can-be-changed-in-original-module.js: Added.
3617         * tests/modules/imported-bindings-can-be-changed-in-original-module/bindings.js: Added.
3618         * tests/modules/indirect-export-error.js: Added.
3619         * tests/modules/indirect-export-error/indirect-export-ambiguous-2.js: Added.
3620         * tests/modules/indirect-export-error/indirect-export-ambiguous-3.js: Added.
3621         * tests/modules/indirect-export-error/indirect-export-ambiguous-4.js: Added.
3622         * tests/modules/indirect-export-error/indirect-export-ambiguous.js: Added.
3623         * tests/modules/indirect-export-error/indirect-export-default-2.js: Added.
3624         * tests/modules/indirect-export-error/indirect-export-default-3.js: Added.
3625         (export.default.Cocoa):
3626         * tests/modules/indirect-export-error/indirect-export-default.js: Added.
3627         * tests/modules/indirect-export-error/indirect-export-not-found-2.js: Added.
3628         * tests/modules/indirect-export-error/indirect-export-not-found.js: Added.
3629         * tests/modules/module-eval.js: Added.
3630         * tests/modules/module-eval/A.js: Added.
3631         * tests/modules/module-eval/B.js: Added.
3632         * tests/modules/module-eval/drink.js: Added.
3633         * tests/modules/module-is-strict-code.js: Added.
3634         * tests/modules/namespace-ambiguous.js: Added.
3635         * tests/modules/namespace-ambiguous/ambiguous-2.js: Added.
3636         * tests/modules/namespace-ambiguous/ambiguous-3.js: Added.
3637         * tests/modules/namespace-ambiguous/ambiguous-4.js: Added.
3638         * tests/modules/namespace-ambiguous/ambiguous.js: Added.
3639         * tests/modules/namespace-error.js: Added.
3640         * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-2.js: Added.
3641         * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-3.js: Added.
3642         * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-4.js: Added.
3643         * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-5.js: Added.
3644         * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-6.js: Added.
3645         * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-7.js: Added.
3646         * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity.js: Added.
3647         * tests/modules/namespace-tdz.js: Added.
3648         * tests/modules/namespace-tdz/A.js: Added.
3649         * tests/modules/namespace-tdz/B.js: Added.
3650         (export.later):
3651         * tests/modules/namespace-tdz/main.js: Added.
3652         * tests/modules/namespace.js: Added.
3653         * tests/modules/namespace/additional-drink.js: Added.
3654         * tests/modules/namespace/drink.js: Added.
3655         (export.default.changeCappuccino):
3656         * tests/modules/namespace/more-additional-drink.js: Added.
3657         * tests/modules/resources/assert.js: Added.
3658         (export.shouldBe):
3659         (export.shouldThrow):
3660         * tests/modules/scopes.js: Added.
3661         * tests/modules/scopes/additional-drink.js: Added.
3662         * tests/modules/scopes/drink.js: Added.
3663         (export.default.changeCappuccino):
3664         * tests/modules/scopes/more-additional-drink.js: Added.
3665         * tests/modules/this-should-be-undefined.js: Added.
3666         * tests/stress/modules-syntax-error-with-names.js:
3667         * tests/stress/modules-syntax-error.js:
3668         * tests/stress/modules-syntax.js:
3669
3670 2015-09-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3671
3672         [ES6] Implement ModuleNamespaceObject
3673         https://bugs.webkit.org/show_bug.cgi?id=148705
3674
3675         Reviewed by Geoffrey Garen.
3676
3677         Implement Module namespace object.
3678         That is used when importing the module with the form `import * as namespace from "mod"`.
3679         The module namespace object is non-extensible object that has the bindings to the original module
3680         as the property.
3681
3682         * CMakeLists.txt:
3683         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3684         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
3685         * JavaScriptCore.xcodeproj/project.pbxproj:
3686         * runtime/JSGlobalObject.cpp:
3687         (JSC::JSGlobalObject::init):
3688         (JSC::JSGlobalObject::visitChildren):
3689         * runtime/JSGlobalObject.h:
3690         (JSC::JSGlobalObject::moduleNamespaceObjectStructure):
3691         * runtime/JSModuleNamespaceObject.cpp: Added.
3692         (JSC::JSModuleNamespaceObject::JSModuleNamespaceObject):
3693         (JSC::JSModuleNamespaceObject::finishCreation):
3694         (JSC::JSModuleNamespaceObject::destroy):
3695         (JSC::JSModuleNamespaceObject::visitChildren):
3696         (JSC::callbackGetter):
3697         (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
3698         (JSC::JSModuleNamespaceObject::put):
3699         (JSC::JSModuleNamespaceObject::putByIndex):
3700         (JSC::JSModuleNamespaceObject::deleteProperty):
3701         (JSC::JSModuleNamespaceObject::getOwnPropertyNames):
3702         (JSC::JSModuleNamespaceObject::defineOwnProperty):
3703         (JSC::moduleNamespaceObjectSymbolIterator):
3704         * runtime/JSModuleNamespaceObject.h: Added.
3705         (JSC::JSModuleNamespaceObject::create):
3706         (JSC::JSModuleNamespaceObject::createStructure):
3707         (JSC::JSModuleNamespaceObject::moduleRecord):
3708         * runtime/JSModuleRecord.cpp:
3709         (JSC::JSModuleRecord::visitChildren):
3710         (JSC::getExportedNames):
3711         (JSC::JSModuleRecord::getModuleNamespace):
3712         (JSC::JSModuleRecord::instantiateDeclarations):
3713         * runtime/JSModuleRecord.h:
3714
3715 2015-09-04  Mark Lam  <mark.lam@apple.com>
3716
3717         Rollout r189411, r189413: Broke JSC tests.
3718
3719         Not reviewed.
3720
3721         * API/tests/PingPongStackOverflowTest.cpp: Removed.
3722         * API/tests/PingPongStackOverflowTest.h: Removed.
3723         * API/tests/testapi.c:
3724         (main):
3725         * JavaScriptCore.xcodeproj/project.pbxproj:
3726         * interpreter/CallFrame.h:
3727         (JSC::ExecState::operator=):
3728         (JSC::ExecState::callerFrame):
3729         (JSC::ExecState::argIndexForRegister):
3730         (JSC::ExecState::callerFrameOrVMEntryFrame):
3731         (JSC::ExecState::callerFrameAndPC):
3732         * interpreter/Interpreter.cpp:
3733         (JSC::UnwindFunctor::UnwindFunctor):
3734         (JSC::UnwindFunctor::operator()):
3735         (JSC::Interpreter::unwind):
3736         * interpreter/Interpreter.h:
3737         (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
3738         (JSC::Interpreter::sampler):
3739         * jit/CCallHelpers.h:
3740         (JSC::CCallHelpers::jumpToExceptionHandler):
3741         * jit/JITExceptions.cpp:
3742         (JSC::genericUnwind):
3743         * jit/JITExceptions.h:
3744         * jit/JITOpcodes.cpp:
3745         (JSC::JIT::emit_op_catch):
3746         * jit/JITOpcodes32_64.cpp:
3747         (JSC::JIT::emit_op_catch):
3748         * jit/JITOperations.cpp:
3749         * llint/LowLevelInterpreter32_64.asm:
3750         * llint/LowLevelInterpreter64.asm:
3751         * runtime/VM.h:
3752         (JSC::VM::exceptionOffset):
3753         (JSC::VM::vmEntryFrameForThrowOffset):
3754         (JSC::VM::topVMEntryFrameOffset):
3755         (JSC::VM::callFrameForThrowOffset):
3756
3757 2015-09-04  Joseph Pecoraro  <pecoraro@apple.com>
3758
3759         Web Inspector: Test Runtime.saveResult and $n values
3760         https://bugs.webkit.org/show_bug.cgi?id=148837
3761
3762         Reviewed by Timothy Hatcher.
3763
3764         * inspector/InjectedScriptSource.js:
3765         (InjectedScript.prototype._evaluateOn):
3766         We don't need to be in the console object group to put the value
3767         in the saved results list. That strong reference will ensure $n
3768         values are always alive even if other object groups were used
3769         when creating and subsequently released.
3770
3771 2015-09-04  Mark Lam  <mark.lam@apple.com>
3772
3773         [Follow up] StackOverflow stack unwinding should stop at native frames.
3774         https://bugs.webkit.org/show_bug.cgi?id=148749
3775
3776         Rubber stamped by Michael Saboff.
3777
3778         Speculative fix for jsc test failure.
3779
3780         * interpreter/Interpreter.cpp:
3781         (JSC::Interpreter::unwind):
3782
3783 2015-09-04  Mark Lam  <mark.lam@apple.com>
3784
3785         StackOverflow stack unwinding should stop at native frames.
3786         https://bugs.webkit.org/show_bug.cgi?id=148749
3787
3788         Reviewed by Michael Saboff.
3789
3790         In the present code, after ping-pong'ing back and forth between native and JS
3791         code a few times, if we have a stack overflow on re-entry into the VM to run
3792         JS code's whose stack frame would overflow the JS stack, the code will end up
3793         unwinding past the native function that is making the call to re-enter the VM.
3794         As a result, any clean up code (e.g. destructors for stack variables) in the
3795         skipped native function frame (and its chain of native function callers) will
3796         not be called.
3797
3798         This patch is based on the Michael Saboff's fix of this issue landed on the
3799         jsc-tailcall branch: http://trac.webkit.org/changeset/188555
3800
3801         We now check for the case where there are no JS frames to unwind since the
3802         last native frame, and treat the exception as an unhandled exception.  The
3803         native function is responsible for further propagating the exception if needed.
3804
3805         Other supporting work:
3806         1. Remove vm->vmEntryFrameForThrow.  It should always be the same as
3807            vm->topVMEntryFrame.
3808         2. Change operationThrowStackOverflowError() to use the throwStackOverflowError()
3809            helper function instead of rolling its own.
3810         3. In the LLINT vm entry, set vm->topVMEntryFrame as soon as the entry frame is
3811            fully initialized (instead of waiting).  With this, we can always reliably
3812            tell which VMEntryFrame is on top.
3813         4. Added a test that exercises this edge case.  The test should not hang or crash.
3814
3815         * API/tests/PingPongStackOverflowTest.cpp: Added.
3816         (PingPongStackOverflowObject_hasInstance):
3817         (testPingPongStackOverflow):
3818         * API/tests/PingPongStackOverflowTest.h: Added.
3819         * API/tests/testapi.c:
3820         (main):
3821         * JavaScriptCore.xcodeproj/project.pbxproj:
3822         * interpreter/Interpreter.cpp:
3823         (JSC::unwindCallFrame):
3824         (JSC::getStackFrameCodeType):
3825         (JSC::UnwindFunctor::UnwindFunctor):
3826         (JSC::UnwindFunctor::operator()):
3827         (JSC::Interpreter::unwind):
3828         * interpreter/Interpreter.h:
3829         (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
3830         (JSC::NativeCallFrameTracerWithRestore::NativeCallFrameTracerWithRestore):
3831         (JSC::NativeCallFrameTracerWithRestore::~NativeCallFrameTracerWithRestore):
3832         (JSC::Interpreter::sampler):
3833         * jit/CCallHelpers.h:
3834         (JSC::CCallHelpers::jumpToExceptionHandler):
3835         * jit/JITExceptions.cpp:
3836         (JSC::genericUnwind):
3837         * jit/JITExceptions.h:
3838         * jit/JITOpcodes.cpp:
3839         (JSC::JIT::emit_op_catch):
3840         * jit/JITOpcodes32_64.cpp:
3841         (JSC::JIT::emit_op_catch):
3842         * jit/JITOperations.cpp:
3843         * llint/LowLevelInterpreter32_64.asm:
3844         * llint/LowLevelInterpreter64.asm:
3845         * runtime/VM.h:
3846         (JSC::VM::exceptionOffset):
3847         (JSC::VM::callFrameForThrowOffset):
3848         (JSC::VM::vmEntryFrameForThrowOffset): Deleted.
3849         (JSC::VM::topVMEntryFrameOffset): Deleted.
3850
3851 2015-09-04  Sukolsak Sakshuwong  <sukolsak@gmail.com>
3852
3853         Implement the division and modulo instructions in WebAssembly
3854         https://bugs.webkit.org/show_bug.cgi?id=148791
3855
3856         Reviewed by Geoffrey Garen.
3857
3858         This patch implements the unsigned division, signed modulo, and unsigned
3859         modulo instructions for 32-bit integers in WebAssembly. It also
3860         implements the context pool index instructions, which are needed for
3861         testing. (pack-asmjs puts numbers that are used more than once in the
3862         constant pool.)
3863
3864         * assembler/X86Assembler.h:
3865         (JSC::X86Assembler::divl_r):
3866         * tests/stress/wasm-arithmetic.js:
3867         * tests/stress/wasm-arithmetic.wasm:
3868         * wasm/WASMFunctionCompiler.h:
3869         (JSC::operationMod):
3870         (JSC::operationUnsignedDiv):
3871         (JSC::operationUnsignedMod):
3872         (JSC::WASMFunctionCompiler::buildBinaryI32):
3873         (JSC::WASMFunctionCompiler::callOperation):
3874         * wasm/WASMFunctionParser.cpp:
3875         (JSC::WASMFunctionParser::parseExpressionI32):
3876         (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionI32):
3877  &nbs