Source/JavaScriptCore/ChangeLog

   1 2016-12-09  Filip Pizlo  <fpizlo@apple.com>
   2
   3         GC might be forced to look at a nuked object due to ordering of AllocatePropertyStorage, MaterializeNewObject, and PutStructure
   4         https://bugs.webkit.org/show_bug.cgi?id=165672
   5
   6         Reviewed by Geoffrey Garen.
   7
   8         We need to make sure that the shady stuff in a property put happens after the
   9         PutByOffset, since the PutByOffset is the place where we materialize. More generally, we
  10         should strive to not have any fenceposts between Nodes where a GC would be illegal.
  11
  12         This gets us most of the way there by separating NukeStructureAndSetButterfly from
  13         [Re]AllocatePropertyStorage. A transitioning put will now look something like:
  14
  15             GetButterfly
  16             ReallocatePropertyStorage
  17             PutByOffset
  18             NukeStructureAndSetButterfly
  19             PutStructure
  20
  21         Previously the structure would get nuked by ReallocatePropertyStorage, so if we placed
  22         an object materialization just after it (before the PutByOffset) then any GC that
  23         completed at that safepoint would encounter an unresolved visit race due to seeing a
  24         nuked structure. We cannot have nuked structures at safepoints, and this change makes
  25         sure that we don't - at least until someone tries to sink to the PutStructure. We will
  26         eventually have to create a combined SetStructureAndButterfly node, but we don't need it
  27         yet.
  28
  29         This also fixes a goof where the DFG's AllocatePropertyStorage was nulling the structure
  30         instead of nuking it. This could easily have caused many crashes in GC.
  31
  32         * dfg/DFGAbstractInterpreterInlines.h:
  33         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
  34         * dfg/DFGByteCodeParser.cpp:
  35         (JSC::DFG::ByteCodeParser::handlePutById):
  36         * dfg/DFGClobberize.h:
  37         (JSC::DFG::clobberize):
  38         * dfg/DFGClobbersExitState.cpp:
  39         (JSC::DFG::clobbersExitState):
  40         * dfg/DFGConstantFoldingPhase.cpp:
  41         (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
  42         * dfg/DFGDoesGC.cpp:
  43         (JSC::DFG::doesGC):
  44         * dfg/DFGFixupPhase.cpp:
  45         (JSC::DFG::FixupPhase::fixupNode):
  46         * dfg/DFGMayExit.cpp:
  47         * dfg/DFGNodeType.h:
  48         * dfg/DFGOperations.cpp:
  49         * dfg/DFGOperations.h:
  50         * dfg/DFGPredictionPropagationPhase.cpp:
  51         * dfg/DFGSafeToExecute.h:
  52         (JSC::DFG::safeToExecute):
  53         * dfg/DFGSpeculativeJIT.cpp:
  54         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
  55         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
  56         (JSC::DFG::SpeculativeJIT::compileNukeStructureAndSetButterfly):
  57         * dfg/DFGSpeculativeJIT.h:
  58         * dfg/DFGSpeculativeJIT32_64.cpp:
  59         (JSC::DFG::SpeculativeJIT::compile):
  60         * dfg/DFGSpeculativeJIT64.cpp:
  61         (JSC::DFG::SpeculativeJIT::compile):
  62         * dfg/DFGStoreBarrierInsertionPhase.cpp:
  63         * dfg/DFGTypeCheckHoistingPhase.cpp:
  64         (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
  65         * ftl/FTLCapabilities.cpp:
  66         (JSC::FTL::canCompile):
  67         * ftl/FTLLowerDFGToB3.cpp:
  68         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
  69         (JSC::FTL::DFG::LowerDFGToB3::compileNukeStructureAndSetButterfly):
  70         (JSC::FTL::DFG::LowerDFGToB3::storageForTransition):
  71         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
  72         (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
  73         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
  74         * runtime/Options.cpp:
  75         (JSC::recomputeDependentOptions):
  76         * runtime/Options.h: Fix a bug - make it possible to turn on concurrent GC optionally again.
  77
  78 2016-12-09  Chris Dumez  <cdumez@apple.com>
  79
  80         Inline JSCell::toObject()
  81         https://bugs.webkit.org/show_bug.cgi?id=165679
  82
  83         Reviewed by Geoffrey Garen.
  84
  85         Inline JSCell::toObject() as it shows on Speedometer profiles.
  86
  87         * runtime/JSCell.cpp:
  88         (JSC::JSCell::toObjectSlow):
  89         (JSC::JSCell::toObject): Deleted.
  90         * runtime/JSCell.h:
  91         * runtime/JSCellInlines.h:
  92         (JSC::JSCell::toObject):
  93
  94 2016-12-09  Geoffrey Garen  <ggaren@apple.com>
  95
  96         Deploy OrdinalNumber in JSC::SourceCode
  97         https://bugs.webkit.org/show_bug.cgi?id=165687
  98
  99         Reviewed by Michael Saboff.
 100
 101         We have a lot of confusion between 1-based and 0-based counting in line
 102         and column numbers. Let's use OrdinalNumber to clear up the confusion.
 103
 104         * bytecode/UnlinkedFunctionExecutable.cpp:
 105         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
 106         (JSC::UnlinkedFunctionExecutable::link):
 107         * bytecompiler/BytecodeGenerator.h:
 108         (JSC::BytecodeGenerator::emitExpressionInfo):
 109         * inspector/JSInjectedScriptHost.cpp:
 110         (Inspector::JSInjectedScriptHost::functionDetails):
 111         * parser/Lexer.cpp:
 112         (JSC::Lexer<T>::setCode):
 113         * parser/Parser.cpp:
 114         (JSC::Parser<LexerType>::Parser):
 115         * parser/Parser.h:
 116         (JSC::Parser<LexerType>::parse):
 117         * parser/SourceCode.h:
 118         (JSC::SourceCode::SourceCode):
 119         (JSC::SourceCode::firstLine):
 120         (JSC::SourceCode::startColumn):
 121         * runtime/CodeCache.cpp:
 122         (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
 123         * runtime/ScriptExecutable.h:
 124         (JSC::ScriptExecutable::firstLine):
 125         (JSC::ScriptExecutable::startColumn):
 126         * tools/CodeProfile.h:
 127         (JSC::CodeProfile::CodeProfile):
 128
 129 2016-12-09  Saam Barati  <sbarati@apple.com>
 130
 131         WebAssembly JS API: implement importing and defining Memory
 132         https://bugs.webkit.org/show_bug.cgi?id=164134
 133
 134         Reviewed by Keith Miller.
 135
 136         This patch implements the WebAssembly.Memory object. It refactors
 137         the code to now associate a Memory with the instance instead of
 138         the Module.
 139
 140         * CMakeLists.txt:
 141         * JavaScriptCore.xcodeproj/project.pbxproj:
 142         * jsc.cpp:
 143         (functionTestWasmModuleFunctions):
 144         * runtime/VM.h:
 145         * shell/CMakeLists.txt:
 146         * testWasm.cpp: Removed.
 147         This has bitrotted. I'm removing it.
 148
 149         * wasm/WasmB3IRGenerator.cpp:
 150         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
 151         (JSC::Wasm::sizeOfLoadOp):
 152         (JSC::Wasm::createJSToWasmWrapper):
 153         (JSC::Wasm::parseAndCompile):
 154         * wasm/WasmB3IRGenerator.h:
 155         * wasm/WasmFormat.cpp:
 156         (JSC::Wasm::ModuleInformation::~ModuleInformation): Deleted.
 157         * wasm/WasmFormat.h:
 158         * wasm/WasmMemory.cpp:
 159         (JSC::Wasm::Memory::Memory):
 160         * wasm/WasmMemory.h:
 161         (JSC::Wasm::Memory::size):
 162         (JSC::Wasm::Memory::initial):
 163         (JSC::Wasm::Memory::maximum):
 164         (JSC::Wasm::Memory::pinnedRegisters): Deleted.
 165         * wasm/WasmMemoryInformation.cpp: Added.
 166         (JSC::Wasm::MemoryInformation::MemoryInformation):
 167         * wasm/WasmMemoryInformation.h: Added.
 168         (JSC::Wasm::MemoryInformation::MemoryInformation):
 169         (JSC::Wasm::MemoryInformation::pinnedRegisters):
 170         (JSC::Wasm::MemoryInformation::initial):
 171         (JSC::Wasm::MemoryInformation::maximum):
 172         (JSC::Wasm::MemoryInformation::isImport):
 173         (JSC::Wasm::MemoryInformation::operator bool):
 174         * wasm/WasmModuleParser.cpp:
 175         (JSC::Wasm::ModuleParser::parseImport):
 176         (JSC::Wasm::ModuleParser::parseMemoryHelper):
 177         (JSC::Wasm::ModuleParser::parseMemory):
 178         (JSC::Wasm::ModuleParser::parseExport):
 179         * wasm/WasmModuleParser.h:
 180         * wasm/WasmPageCount.h: Added. Implement a new way of describing Wasm
 181         pages and then asking for how many bytes a quantity of pages is. This
 182         class also makes it clear when we're talking about bytes or pages.
 183
 184         (JSC::Wasm::PageCount::PageCount):
 185         (JSC::Wasm::PageCount::bytes):
 186         (JSC::Wasm::PageCount::isValid):
 187         (JSC::Wasm::PageCount::max):
 188         (JSC::Wasm::PageCount::operator bool):
 189         (JSC::Wasm::PageCount::operator<):
 190         (JSC::Wasm::PageCount::operator>):
 191         (JSC::Wasm::PageCount::operator>=):
 192         * wasm/WasmPlan.cpp:
 193         (JSC::Wasm::Plan::run):
 194         * wasm/WasmPlan.h:
 195         (JSC::Wasm::Plan::memory): Deleted.
 196         * wasm/WasmValidate.cpp:
 197         (JSC::Wasm::Validate::hasMemory):
 198         (JSC::Wasm::Validate::Validate):
 199         (JSC::Wasm::validateFunction):
 200         * wasm/WasmValidate.h:
 201         * wasm/generateWasmValidateInlinesHeader.py:
 202         * wasm/js/JSWebAssemblyInstance.cpp:
 203         (JSC::JSWebAssemblyInstance::visitChildren):
 204         * wasm/js/JSWebAssemblyInstance.h:
 205         (JSC::JSWebAssemblyInstance::memory):
 206         (JSC::JSWebAssemblyInstance::setMemory):
 207         (JSC::JSWebAssemblyInstance::offsetOfImportFunctions):
 208         (JSC::JSWebAssemblyInstance::allocationSize):
 209         * wasm/js/JSWebAssemblyMemory.cpp:
 210         (JSC::JSWebAssemblyMemory::create):
 211         (JSC::JSWebAssemblyMemory::JSWebAssemblyMemory):
 212         (JSC::JSWebAssemblyMemory::buffer):
 213         (JSC::JSWebAssemblyMemory::visitChildren):
 214         * wasm/js/JSWebAssemblyMemory.h:
 215         (JSC::JSWebAssemblyMemory::memory):
 216         * wasm/js/WebAssemblyFunction.cpp:
 217         (JSC::callWebAssemblyFunction):
 218         * wasm/js/WebAssemblyInstanceConstructor.cpp:
 219         Handle importing and creating of memory according
 220         to the spec. This also does the needed validation
 221         of making sure the memory defined in the module
 222         is compatible with the imported memory.
 223
 224         (JSC::constructJSWebAssemblyInstance):
 225         * wasm/js/WebAssemblyMemoryConstructor.cpp:
 226         (JSC::constructJSWebAssemblyMemory):
 227         (JSC::callJSWebAssemblyMemory):
 228         * wasm/js/WebAssemblyMemoryPrototype.cpp:
 229         (JSC::webAssemblyMemoryProtoFuncBuffer):
 230         (JSC::WebAssemblyMemoryPrototype::create):
 231         (JSC::WebAssemblyMemoryPrototype::finishCreation):
 232         * wasm/js/WebAssemblyMemoryPrototype.h:
 233         * wasm/js/WebAssemblyModuleRecord.cpp:
 234         (JSC::WebAssemblyModuleRecord::finishCreation):
 235         (JSC::WebAssemblyModuleRecord::link):
 236
 237 2016-12-09  Joseph Pecoraro  <pecoraro@apple.com>
 238
 239         Web Inspector: Some resources fetched via Fetch API do not have data
 240         https://bugs.webkit.org/show_bug.cgi?id=165230
 241         <rdar://problem/29449220>
 242
 243         Reviewed by Alex Christensen.
 244
 245         * inspector/protocol/Page.json:
 246         Add new Fetch Page.ResourceType.
 247
 248 2016-12-09  Geoffrey Garen  <ggaren@apple.com>
 249
 250         TextPosition and OrdinalNumber should be more like idiomatic numbers
 251         https://bugs.webkit.org/show_bug.cgi?id=165678
 252
 253         Reviewed by Filip Pizlo.
 254
 255         Adopt default constructor.
 256
 257         * API/JSBase.cpp:
 258         (JSEvaluateScript):
 259         (JSCheckScriptSyntax):
 260         * API/JSObjectRef.cpp:
 261         (JSObjectMakeFunction):
 262         * API/JSScriptRef.cpp:
 263         (OpaqueJSScript::OpaqueJSScript):
 264         * jsc.cpp:
 265         (functionCheckModuleSyntax):
 266         * parser/SourceCode.h:
 267         (JSC::makeSource):
 268         * parser/SourceProvider.h:
 269         (JSC::StringSourceProvider::create):
 270         (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
 271         * runtime/FunctionConstructor.cpp:
 272         (JSC::constructFunction):
 273         * runtime/ModuleLoaderPrototype.cpp:
 274         (JSC::moduleLoaderPrototypeParseModule):
 275
 276 2016-12-09  Filip Pizlo  <fpizlo@apple.com>
 277
 278         Unreviewed, disable concurrent GC for real.
 279
 280         * runtime/Options.cpp:
 281         (JSC::recomputeDependentOptions):
 282
 283 2016-12-09  Filip Pizlo  <fpizlo@apple.com>
 284
 285         Unreviewed, disable concurrent GC while crashes get investigated.
 286
 287         * runtime/Options.cpp:
 288         (JSC::recomputeDependentOptions):
 289
 290 2016-12-09  Filip Pizlo  <fpizlo@apple.com>
 291
 292         JSSegmentedVariableObject should keep its state private
 293
 294         Rubber stamped by Michael Saboff.
 295
 296         Its state fields were protected for no reason. They really should be private because
 297         you have to know to obey a particular concurrency protocol when accessing them.
 298
 299         * runtime/JSSegmentedVariableObject.h:
 300
 301 2016-12-09  Csaba Osztrogonác  <ossy@webkit.org>
 302
 303         Unreviewed ARM buildfix after 209570.
 304
 305         * assembler/MacroAssemblerARM.h:
 306         (JSC::MacroAssemblerARM::or32): Added.
 307
 308 2016-12-08  JF Bastien  <jfbastien@apple.com>
 309
 310         WebAssembly: JSC::link* shouldn't need a CodeBlock
 311         https://bugs.webkit.org/show_bug.cgi?id=165591
 312
 313         Reviewed by Keith Miller.
 314
 315         Allow linking without a CodeBlock, which WebAssembly's wasm -> JS stubs does. This needs to work for polymorphic and virtual calls. This patch adds corresponding tests for this.
 316
 317         * assembler/LinkBuffer.cpp:
 318         (JSC::shouldDumpDisassemblyFor): don't look at the tier option if there isn't a CodeBlock, only look at the global one. This is a WebAssembly function, so the tier information is irrelevant.
 319         * jit/Repatch.cpp:
 320         (JSC::isWebAssemblyToJSCallee): this is used in the link* functions below
 321         (JSC::linkFor):
 322         (JSC::linkVirtualFor):
 323         (JSC::linkPolymorphicCall):
 324         * runtime/Options.h: add an option to change the maximum number of polymorphic calls in stubs from wasm to JS, which will come in handy when we try to tune performance or try merging some of the WebAssembly stubs
 325         * wasm/WasmBinding.cpp:
 326         (JSC::Wasm::importStubGenerator): remove the breakpoint since the code now works
 327         * wasm/js/WebAssemblyToJSCallee.h:
 328
 329 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
 330
 331         MultiPutByOffset should get a barrier if it transitions
 332         https://bugs.webkit.org/show_bug.cgi?id=165646
 333
 334         Reviewed by Keith Miller.
 335
 336         Previously, if we knew that we were storing a non-cell but we needed to transition, we
 337         would fail to add the barrier but the FTL's lowering expected the barrier to be there.
 338
 339         Strictly, we need to "consider" the barrier on MultiPutByOffset if the value is
 340         possibly a cell or if the MultiPutByOffset may transition. Then "considering" the
 341         barrier implies checking if the base is possibly old.
 342
 343         But because the barrier is so cheap anyway, this patch implements something safer: we
 344         just consider the barrier on MultiPutByOffset unconditionally, which opts it out of any
 345         barrier optimizations other than those based on the predicted state of the base. Those
 346         optimizations are already sound - for example they use doesGC() to detect safepoints
 347         and that function correctly predicts when MultiPutByOffset could GC.
 348
 349         Because the barrier optimizations are only a very small speed-up, I think it's great to
 350         fix bugs by weakening the optimizer without cleverness.
 351
 352         * dfg/DFGFixupPhase.cpp:
 353         * dfg/DFGStoreBarrierInsertionPhase.cpp:
 354         * heap/MarkedBlock.cpp:
 355         (JSC::MarkedBlock::assertValidCell):
 356
 357 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
 358
 359         Enable concurrent GC on ARM64
 360         https://bugs.webkit.org/show_bug.cgi?id=165643
 361
 362         Reviewed by Saam Barati.
 363
 364         It looks stable enough to enable.
 365
 366         * assembler/CPU.h:
 367         (JSC::useGCFences): Deleted.
 368         * bytecode/PolymorphicAccess.cpp:
 369         (JSC::AccessCase::generateImpl):
 370         * dfg/DFGSpeculativeJIT.cpp:
 371         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
 372         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
 373         * ftl/FTLLowerDFGToB3.cpp:
 374         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
 375         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
 376         (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
 377         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
 378         * jit/AssemblyHelpers.h:
 379         (JSC::AssemblyHelpers::mutatorFence):
 380         (JSC::AssemblyHelpers::storeButterfly):
 381         (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly):
 382         (JSC::AssemblyHelpers::emitInitializeInlineStorage):
 383         (JSC::AssemblyHelpers::emitInitializeOutOfLineStorage):
 384         * runtime/Options.cpp:
 385         (JSC::recomputeDependentOptions):
 386
 387 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
 388
 389         Disable collectContinuously if not useConcurrentGC
 390
 391         Rubber stamped by Geoffrey Garen.
 392
 393         * runtime/Options.cpp:
 394         (JSC::recomputeDependentOptions):
 395
 396 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
 397
 398         Unreviewed, fix cloop build.
 399
 400         * runtime/JSObject.h:
 401
 402 2016-12-06  Filip Pizlo  <fpizlo@apple.com>
 403
 404         Concurrent GC should be stable enough to land enabled on X86_64
 405         https://bugs.webkit.org/show_bug.cgi?id=164990
 406
 407         Reviewed by Geoffrey Garen.
 408
 409         This fixes a ton of performance and correctness bugs revealed by getting the concurrent GC to
 410         be stable enough to land enabled.
 411
 412         I had to redo the JSObject::visitChildren concurrency protocol again. This time I think it's
 413         even more correct than ever!
 414
 415         This is an enormous win on JetStream/splay-latency and Octane/SplayLatency. It looks to be
 416         mostly neutral on everything else, though Speedometer is showing statistically weak signs of a
 417         slight regression.
 418
 419         * API/JSAPIWrapperObject.mm: Added locking.
 420         (JSC::JSAPIWrapperObject::visitChildren):
 421         * API/JSCallbackObject.h: Added locking.
 422         (JSC::JSCallbackObjectData::visitChildren):
 423         (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
 424         (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
 425         (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
 426         * CMakeLists.txt:
 427         * JavaScriptCore.xcodeproj/project.pbxproj:
 428         * bytecode/CodeBlock.cpp:
 429         (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): This had a TOCTOU race on shouldJettisonDueToOldAge.
 430         (JSC::EvalCodeCache::visitAggregate): Moved to EvalCodeCache.cpp.
 431         * bytecode/DirectEvalCodeCache.cpp: Added. Outlined some functions and made them use locks.
 432         (JSC::DirectEvalCodeCache::setSlow):
 433         (JSC::DirectEvalCodeCache::clear):
 434         (JSC::DirectEvalCodeCache::visitAggregate):
 435         * bytecode/DirectEvalCodeCache.h:
 436         (JSC::DirectEvalCodeCache::set):
 437         (JSC::DirectEvalCodeCache::clear): Deleted.
 438         * bytecode/UnlinkedCodeBlock.cpp: Added locking.
 439         (JSC::UnlinkedCodeBlock::visitChildren):
 440         (JSC::UnlinkedCodeBlock::setInstructions):
 441         (JSC::UnlinkedCodeBlock::shrinkToFit):
 442         * bytecode/UnlinkedCodeBlock.h: Added locking.
 443         (JSC::UnlinkedCodeBlock::addRegExp):
 444         (JSC::UnlinkedCodeBlock::addConstant):
 445         (JSC::UnlinkedCodeBlock::addFunctionDecl):
 446         (JSC::UnlinkedCodeBlock::addFunctionExpr):
 447         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary):
 448         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
 449         * debugger/Debugger.cpp: Use the right delete API.
 450         (JSC::Debugger::recompileAllJSFunctions):
 451         * dfg/DFGAbstractInterpreterInlines.h:
 452         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Fix a pre-existing bug in ToFunction constant folding.
 453         * dfg/DFGClobberize.h: Add support for nuking.
 454         (JSC::DFG::clobberize):
 455         * dfg/DFGClobbersExitState.cpp: Add support for nuking.
 456         (JSC::DFG::clobbersExitState):
 457         * dfg/DFGFixupPhase.cpp: Add support for nuking.
 458         (JSC::DFG::FixupPhase::fixupNode):
 459         (JSC::DFG::FixupPhase::indexForChecks):
 460         (JSC::DFG::FixupPhase::originForCheck):
 461         (JSC::DFG::FixupPhase::speculateForBarrier):
 462         (JSC::DFG::FixupPhase::insertCheck):
 463         (JSC::DFG::FixupPhase::fixupChecksInBlock):
 464         * dfg/DFGSpeculativeJIT.cpp: Add support for nuking.
 465         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
 466         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
 467         * ftl/FTLLowerDFGToB3.cpp: Add support for nuking.
 468         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
 469         (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
 470         (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
 471         (JSC::FTL::DFG::LowerDFGToB3::nukeStructureAndSetButterfly):
 472         (JSC::FTL::DFG::LowerDFGToB3::setButterfly): Deleted.
 473         * heap/CodeBlockSet.cpp: We need to be more careful about the CodeBlockSet workflow during GC, since we will allocate CodeBlocks in eden while collecting.
 474         (JSC::CodeBlockSet::clearMarksForFullCollection):
 475         (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
 476         * heap/Heap.cpp: Added code to measure max pauses. Added a better collectContinuously mode.
 477         (JSC::Heap::lastChanceToFinalize): Stop the collectContinuously thread.
 478         (JSC::Heap::harvestWeakReferences): Inline SlotVisitor::harvestWeakReferences.
 479         (JSC::Heap::finalizeUnconditionalFinalizers): Inline SlotVisitor::finalizeUnconditionalReferences.
 480         (JSC::Heap::markToFixpoint): We need to do some MarkedSpace stuff before every conservative scan, rather than just at the start of marking, so we now call prepareForConservativeScan() before each conservative scan. Also call a less-parallel version of drainInParallel when the mutator is running.
 481         (JSC::Heap::collectInThread): Inline Heap::prepareForAllocation().
 482         (JSC::Heap::stopIfNecessarySlow): We need to be more careful about ensuring that we run finalization before and after stopping. Also, we should sanitize stack when stopping the world.
 483         (JSC::Heap::acquireAccessSlow): Add some optional debug prints.
 484         (JSC::Heap::handleNeedFinalize): Assert that we are running this when the world is not stopped.
 485         (JSC::Heap::finalize): Remove the old collectContinuously code.
 486         (JSC::Heap::requestCollection): We don't need to sanitize stack here anymore.
 487         (JSC::Heap::notifyIsSafeToCollect): Start the collectContinuously thread. It will request collection 1 KHz.
 488         (JSC::Heap::prepareForAllocation): Deleted.
 489         (JSC::Heap::preventCollection): Prevent any new concurrent GCs from being initiated.
 490         (JSC::Heap::allowCollection):
 491         (JSC::Heap::forEachSlotVisitor): Allows us to safely iterate slot visitors.
 492         * heap/Heap.h:
 493         * heap/HeapInlines.h:
 494         (JSC::Heap::writeBarrier): If the 'to' cell is not NewWhite then it could be AnthraciteOrBlack. During a full collection, objects may be AnthraciteOrBlack from a previous GC. Turns out, we don't benefit from this optimization so we can just kill it.
 495         * heap/HeapSnapshotBuilder.cpp:
 496         (JSC::HeapSnapshotBuilder::buildSnapshot): This needs to use PreventCollectionScope to ensure snapshot soundness.
 497         * heap/ListableHandler.h:
 498         (JSC::ListableHandler::isOnList): Useful helper.
 499         * heap/LockDuringMarking.h:
 500         (JSC::lockDuringMarking): It's a locker that only locks while we're marking.
 501         * heap/MarkedAllocator.cpp:
 502         (JSC::MarkedAllocator::addBlock): Hold the bitvector lock while resizing.
 503         * heap/MarkedBlock.cpp: Hold the bitvector lock while accessing the bitvectors while the mutator is running.
 504         * heap/MarkedSpace.cpp:
 505         (JSC::MarkedSpace::prepareForConservativeScan): We used to do this in prepareForMarking, but we need to do it before each conservative scan not just before marking.
 506         (JSC::MarkedSpace::prepareForMarking): Remove the logic moved to prepareForConservativeScan.
 507         * heap/MarkedSpace.h:
 508         * heap/PreventCollectionScope.h: Added.
 509         * heap/SlotVisitor.cpp: Refactored drainFromShared so that we can write a similar function called drainInParallelPassively.
 510         (JSC::SlotVisitor::updateMutatorIsStopped): Update whether we can use "fast" scanning.
 511         (JSC::SlotVisitor::mutatorIsStoppedIsUpToDate):
 512         (JSC::SlotVisitor::didReachTermination):
 513         (JSC::SlotVisitor::hasWork):
 514         (JSC::SlotVisitor::drain): This now uses the rightToRun lock to allow the main GC thread to safepoint the workers.
 515         (JSC::SlotVisitor::drainFromShared):
 516         (JSC::SlotVisitor::drainInParallelPassively): This runs marking with one fewer threads than normal. It's useful for when we have resumed the mutator, since then the mutator has a better chance of getting on a core.
 517         (JSC::SlotVisitor::addWeakReferenceHarvester):
 518         (JSC::SlotVisitor::addUnconditionalFinalizer):
 519         (JSC::SlotVisitor::harvestWeakReferences): Deleted.
 520         (JSC::SlotVisitor::finalizeUnconditionalFinalizers): Deleted.
 521         * heap/SlotVisitor.h:
 522         * heap/SlotVisitorInlines.h: Outline stuff.
 523         (JSC::SlotVisitor::addWeakReferenceHarvester): Deleted.
 524         (JSC::SlotVisitor::addUnconditionalFinalizer): Deleted.
 525         * runtime/InferredType.cpp: This needed thread safety.
 526         (JSC::InferredType::visitChildren): This needs to keep its structure finalizer alive until it runs.
 527         (JSC::InferredType::set):
 528         (JSC::InferredType::InferredStructureFinalizer::finalizeUnconditionally):
 529         * runtime/InferredType.h:
 530         * runtime/InferredValue.cpp: This needed thread safety.
 531         (JSC::InferredValue::visitChildren):
 532         (JSC::InferredValue::ValueCleanup::finalizeUnconditionally):
 533         * runtime/JSArray.cpp:
 534         (JSC::JSArray::unshiftCountSlowCase): Update to use new butterfly API.
 535         (JSC::JSArray::unshiftCountWithArrayStorage): Update to use new butterfly API.
 536         * runtime/JSArrayBufferView.cpp:
 537         (JSC::JSArrayBufferView::visitChildren): Thread safety.
 538         * runtime/JSCell.h:
 539         (JSC::JSCell::setStructureIDDirectly): This is used for nuking the structure.
 540         (JSC::JSCell::InternalLocker::InternalLocker): Deleted. The cell is now the lock.
 541         (JSC::JSCell::InternalLocker::~InternalLocker): Deleted. The cell is now the lock.
 542         * runtime/JSCellInlines.h:
 543         (JSC::JSCell::structure): Clean this up.
 544         (JSC::JSCell::lock): The cell is now the lock.
 545         (JSC::JSCell::tryLock):
 546         (JSC::JSCell::unlock):
 547         (JSC::JSCell::isLocked):
 548         (JSC::JSCell::lockInternalLock): Deleted.
 549         (JSC::JSCell::unlockInternalLock): Deleted.
 550         * runtime/JSFunction.cpp:
 551         (JSC::JSFunction::visitChildren): Thread safety.
 552         * runtime/JSGenericTypedArrayViewInlines.h:
 553         (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren): Thread safety.
 554         (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory): Thread safety.
 555         * runtime/JSObject.cpp:
 556         (JSC::JSObject::markAuxiliaryAndVisitOutOfLineProperties): Factor out this "easy" step of butterfly visiting.
 557         (JSC::JSObject::visitButterfly): Make this achieve 100% precision about structure-butterfly relationships. This relies on the mutator "nuking" the structure prior to "locked" structure-butterfly transitions.
 558         (JSC::JSObject::visitChildren): Use the new, nicer API.
 559         (JSC::JSFinalObject::visitChildren): Use the new, nicer API.
 560         (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists): Use the new butterfly API.
 561         (JSC::JSObject::createInitialUndecided): Use the new butterfly API.
 562         (JSC::JSObject::createInitialInt32): Use the new butterfly API.
 563         (JSC::JSObject::createInitialDouble): Use the new butterfly API.
 564         (JSC::JSObject::createInitialContiguous): Use the new butterfly API.
 565         (JSC::JSObject::createArrayStorage): Use the new butterfly API.
 566         (JSC::JSObject::convertUndecidedToContiguous): Use the new butterfly API.
 567         (JSC::JSObject::convertUndecidedToArrayStorage): Use the new butterfly API.
 568         (JSC::JSObject::convertInt32ToArrayStorage): Use the new butterfly API.
 569         (JSC::JSObject::convertDoubleToContiguous): Use the new butterfly API.
 570         (JSC::JSObject::convertDoubleToArrayStorage): Use the new butterfly API.
 571         (JSC::JSObject::convertContiguousToArrayStorage): Use the new butterfly API.
 572         (JSC::JSObject::increaseVectorLength): Use the new butterfly API.
 573         (JSC::JSObject::shiftButterflyAfterFlattening): Use the new butterfly API.
 574         * runtime/JSObject.h:
 575         (JSC::JSObject::setButterfly): This now does all of the fences. Only use this when you are not also transitioning the structure or the structure's lastOffset.
 576         (JSC::JSObject::nukeStructureAndSetButterfly): Use this when doing locked structure-butterfly transitions.
 577         * runtime/JSObjectInlines.h:
 578         (JSC::JSObject::putDirectWithoutTransition): Use the newly factored out API.
 579         (JSC::JSObject::prepareToPutDirectWithoutTransition): Factor this out!
 580         (JSC::JSObject::putDirectInternal): Use the newly factored out API.
 581         * runtime/JSPropertyNameEnumerator.cpp:
 582         (JSC::JSPropertyNameEnumerator::finishCreation): Locks!
 583         (JSC::JSPropertyNameEnumerator::visitChildren): Locks!
 584         * runtime/JSSegmentedVariableObject.cpp:
 585         (JSC::JSSegmentedVariableObject::visitChildren): Locks!
 586         * runtime/JSString.cpp:
 587         (JSC::JSString::visitChildren): Thread safety.
 588         * runtime/ModuleProgramExecutable.cpp:
 589         (JSC::ModuleProgramExecutable::visitChildren): Thread safety.
 590         * runtime/Options.cpp: For now we disable concurrent GC on not-X86_64.
 591         (JSC::recomputeDependentOptions):
 592         * runtime/Options.h: Change the default max GC parallelism to 8. I don't know why it was still 7.
 593         * runtime/SamplingProfiler.cpp:
 594         (JSC::SamplingProfiler::stackTracesAsJSON): This needs to defer GC before grabbing its lock.
 595         * runtime/SparseArrayValueMap.cpp: This needed thread safety.
 596         (JSC::SparseArrayValueMap::add):
 597         (JSC::SparseArrayValueMap::remove):
 598         (JSC::SparseArrayValueMap::visitChildren):
 599         * runtime/SparseArrayValueMap.h:
 600         * runtime/Structure.cpp: This had a race between addNewPropertyTransition and visitChildren.
 601         (JSC::Structure::Structure):
 602         (JSC::Structure::materializePropertyTable):
 603         (JSC::Structure::addNewPropertyTransition):
 604         (JSC::Structure::flattenDictionaryStructure):
 605         (JSC::Structure::add): Help out with nuking support - the m_offset needs to play along.
 606         (JSC::Structure::visitChildren):
 607         * runtime/Structure.h: Make some useful things public - like the notion of a lastOffset.
 608         * runtime/StructureChain.cpp:
 609         (JSC::StructureChain::visitChildren): Thread safety!
 610         * runtime/StructureChain.h: Thread safety!
 611         * runtime/StructureIDTable.cpp:
 612         (JSC::StructureIDTable::allocateID): Ensure that we don't get nuked IDs.
 613         * runtime/StructureIDTable.h: Add the notion of a nuked ID! It's a bit that the runtime never sees except during specific shady actions like locked structure-butterfly transitions. "Nuking" tells the GC to steer clear and rescan once we fire the barrier.
 614         (JSC::nukedStructureIDBit):
 615         (JSC::nuke):
 616         (JSC::isNuked):
 617         (JSC::decontaminate):
 618         * runtime/StructureInlines.h:
 619         (JSC::Structure::hasIndexingHeader): Better API.
 620         (JSC::Structure::add):
 621         * runtime/VM.cpp: Better GC interaction.
 622         (JSC::VM::ensureWatchdog):
 623         (JSC::VM::deleteAllLinkedCode):
 624         (JSC::VM::deleteAllCode):
 625         * runtime/VM.h:
 626         (JSC::VM::getStructure): Why wasn't this always an API!
 627         * runtime/WebAssemblyExecutable.cpp:
 628         (JSC::WebAssemblyExecutable::visitChildren): Thread safety.
 629
 630 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
 631
 632         Enable SharedArrayBuffer, remove the flag
 633         https://bugs.webkit.org/show_bug.cgi?id=165614
 634
 635         Rubber stamped by Geoffrey Garen.
 636
 637         * runtime/JSGlobalObject.cpp:
 638         (JSC::JSGlobalObject::init):
 639         * runtime/RuntimeFlags.h:
 640
 641 2016-12-08  JF Bastien  <jfbastien@apple.com>
 642
 643         WebAssembly JS API: wire up Instance imports
 644         https://bugs.webkit.org/show_bug.cgi?id=165118
 645
 646         Reviewed by Saam Barati.
 647
 648         Change a bunch of the WebAssembly object model, and pipe the
 649         necessary changes to be able to call JS imports from
 650         WebAssembly. This will make it easier to call_indirect, and
 651         unblock many other missing features.
 652
 653         As a follow-up I need to teach JSC::linkFor to live without a
 654         CodeBlock: wasm doesn't have one and the IC patching is sad. We'll
 655         switch on the callee (or its type?) and then use that as the owner
 656         (because the callee is alive if the instance is alive, ditto
 657         module, and module owns the CallLinkInfo).
 658
 659         * CMakeLists.txt:
 660         * JavaScriptCore.xcodeproj/project.pbxproj:
 661         * interpreter/CallFrame.h:
 662         (JSC::ExecState::callee): give access to the callee as a JSCell
 663         * jit/RegisterSet.cpp: dead code from previous WebAssembly implementation
 664         * jsc.cpp:
 665         (callWasmFunction):
 666         (functionTestWasmModuleFunctions):
 667         * runtime/JSCellInlines.h:
 668         (JSC::ExecState::vm): check callee instead of jsCallee: wasm only has a JSCell and not a JSObject
 669         * runtime/VM.cpp:
 670         (JSC::VM::VM): store the "top" WebAssembly.Instance on entry to WebAssembly (and restore the previous one on exit)
 671         * runtime/VM.h:
 672         * testWasm.cpp:
 673         (runWasmTests):
 674         * wasm/JSWebAssembly.h:
 675         * wasm/WasmB3IRGenerator.cpp:
 676         (JSC::Wasm::B3IRGenerator::B3IRGenerator): pass unlinked calls around to shorten their lifetime: they're ony needed until the Plan is done
 677         (JSC::Wasm::B3IRGenerator::addCall):
 678         (JSC::Wasm::createJSToWasmWrapper):
 679         (JSC::Wasm::parseAndCompile): also pass in the function index space, so that imports can be signature-checked along with internal functions
 680         * wasm/WasmB3IRGenerator.h:
 681         * wasm/WasmBinding.cpp: Added.
 682         (JSC::Wasm::importStubGenerator): stubs from wasm to JS
 683         * wasm/WasmBinding.h: Copied from Source/JavaScriptCore/wasm/WasmValidate.h.
 684         * wasm/WasmCallingConvention.h:
 685         (JSC::Wasm::CallingConvention::setupFrameInPrologue):
 686         * wasm/WasmFormat.h: fix the object model
 687         (JSC::Wasm::CallableFunction::CallableFunction):
 688         * wasm/WasmFunctionParser.h: simplify some of the failure condition checks
 689         (JSC::Wasm::FunctionParser<Context>::FunctionParser): need function index space, not just internal functions
 690         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 691         * wasm/WasmModuleParser.cpp: early-create some of the structures which will be needed later
 692         (JSC::Wasm::ModuleParser::parseImport):
 693         (JSC::Wasm::ModuleParser::parseFunction):
 694         (JSC::Wasm::ModuleParser::parseMemory):
 695         (JSC::Wasm::ModuleParser::parseExport):
 696         (JSC::Wasm::ModuleParser::parseCode):
 697         * wasm/WasmModuleParser.h:
 698         (JSC::Wasm::ModuleParser::functionIndexSpace):
 699         (JSC::Wasm::ModuleParser::functionLocations):
 700         * wasm/WasmParser.h:
 701         (JSC::Wasm::Parser::consumeUTF8String):
 702         * wasm/WasmPlan.cpp: pass around the wasm objects at the right time, reducing their lifetime and making it easier to pass them around when needed
 703         (JSC::Wasm::Plan::run):
 704         (JSC::Wasm::Plan::initializeCallees):
 705         * wasm/WasmPlan.h:
 706         (JSC::Wasm::Plan::exports):
 707         (JSC::Wasm::Plan::internalFunctionCount):
 708         (JSC::Wasm::Plan::jsToWasmEntryPointForFunction):
 709         (JSC::Wasm::Plan::takeModuleInformation):
 710         (JSC::Wasm::Plan::takeCallLinkInfos):
 711         (JSC::Wasm::Plan::takeWasmToJSStubs):
 712         (JSC::Wasm::Plan::takeFunctionIndexSpace):
 713         * wasm/WasmValidate.cpp: check function index space instead of only internal functions
 714         (JSC::Wasm::Validate::addCall):
 715         (JSC::Wasm::validateFunction):
 716         * wasm/WasmValidate.h:
 717         * wasm/js/JSWebAssemblyCallee.cpp:
 718         (JSC::JSWebAssemblyCallee::finishCreation):
 719         * wasm/js/JSWebAssemblyCallee.h:
 720         (JSC::JSWebAssemblyCallee::create):
 721         (JSC::JSWebAssemblyCallee::jsToWasmEntryPoint):
 722         * wasm/js/JSWebAssemblyInstance.cpp:
 723         (JSC::JSWebAssemblyInstance::create):
 724         (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
 725         (JSC::JSWebAssemblyInstance::visitChildren):
 726         * wasm/js/JSWebAssemblyInstance.h: hold the import functions off the end of the Instance
 727         (JSC::JSWebAssemblyInstance::importFunction):
 728         (JSC::JSWebAssemblyInstance::importFunctions):
 729         (JSC::JSWebAssemblyInstance::setImportFunction):
 730         (JSC::JSWebAssemblyInstance::offsetOfImportFunctions):
 731         (JSC::JSWebAssemblyInstance::offsetOfImportFunction):
 732         (JSC::JSWebAssemblyInstance::allocationSize):
 733         * wasm/js/JSWebAssemblyModule.cpp:
 734         (JSC::JSWebAssemblyModule::create):
 735         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
 736         (JSC::JSWebAssemblyModule::visitChildren):
 737         * wasm/js/JSWebAssemblyModule.h: hold the link call info, the import function stubs, and the function index space
 738         (JSC::JSWebAssemblyModule::signatureForFunctionIndexSpace):
 739         (JSC::JSWebAssemblyModule::importCount):
 740         (JSC::JSWebAssemblyModule::calleeFromFunctionIndexSpace):
 741         * wasm/js/WebAssemblyFunction.cpp:
 742         (JSC::callWebAssemblyFunction): set top Instance on VM
 743         * wasm/js/WebAssemblyFunction.h:
 744         (JSC::WebAssemblyFunction::instance):
 745         * wasm/js/WebAssemblyInstanceConstructor.cpp:
 746         (JSC::constructJSWebAssemblyInstance): handle function imports
 747         * wasm/js/WebAssemblyModuleConstructor.cpp:
 748         (JSC::constructJSWebAssemblyModule): generate the stubs for import functions
 749         * wasm/js/WebAssemblyModuleRecord.cpp:
 750         (JSC::WebAssemblyModuleRecord::link):
 751         * wasm/js/WebAssemblyToJSCallee.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp.
 752         (JSC::WebAssemblyToJSCallee::create): dummy JSCell singleton which lives on the VM, and is put as the callee in the import stub's frame to identified it when unwinding
 753         (JSC::WebAssemblyToJSCallee::createStructure):
 754         (JSC::WebAssemblyToJSCallee::WebAssemblyToJSCallee):
 755         (JSC::WebAssemblyToJSCallee::finishCreation):
 756         (JSC::WebAssemblyToJSCallee::destroy):
 757         * wasm/js/WebAssemblyToJSCallee.h: Copied from Source/JavaScriptCore/wasm/WasmB3IRGenerator.h.
 758
 759 2016-12-08  Mark Lam  <mark.lam@apple.com>
 760
 761         Enable JSC restricted options by default in the jsc shell.
 762         https://bugs.webkit.org/show_bug.cgi?id=165615
 763
 764         Reviewed by Keith Miller.
 765
 766         The jsc shell is only used for debugging and development testing.  We should
 767         allow it to use restricted options like JSC_useDollarVM even for release builds.
 768
 769         * jsc.cpp:
 770         (jscmain):
 771         * runtime/Options.cpp:
 772         (JSC::Options::enableRestrictedOptions):
 773         (JSC::Options::isAvailable):
 774         (JSC::allowRestrictedOptions): Deleted.
 775         * runtime/Options.h:
 776
 777 2016-12-08  Chris Dumez  <cdumez@apple.com>
 778
 779         Unreviewed, rolling out r209489.
 780
 781         Likely caused large regressions on JetStream, Sunspider and
 782         Speedometer
 783
 784         Reverted changeset:
 785
 786         "Add system trace points for JavaScript VM entry/exit"
 787         https://bugs.webkit.org/show_bug.cgi?id=165550
 788         http://trac.webkit.org/changeset/209489
 789
 790 2016-12-08  Keith Miller  <keith_miller@apple.com>
 791
 792         Move LEB tests to API tests
 793         https://bugs.webkit.org/show_bug.cgi?id=165586
 794
 795         Reviewed by Saam Barati.
 796
 797         Delete old stuff.
 798
 799         * testWasm.cpp:
 800         (printUsageStatement):
 801         (CommandLine::parseArguments):
 802         (main):
 803         (runLEBTests): Deleted.
 804
 805 2016-12-07  JF Bastien  <jfbastien@apple.com>
 806
 807         Cleanup WebAssembly's RETURN_IF_EXCEPTION
 808         https://bugs.webkit.org/show_bug.cgi?id=165595
 809
 810         Reviewed by Filip Pizlo.
 811
 812         * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
 813         (JSC::constructJSWebAssemblyCompileError):
 814         * wasm/js/WebAssemblyFunction.cpp:
 815         (JSC::callWebAssemblyFunction):
 816         * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
 817         (JSC::constructJSWebAssemblyRuntimeError):
 818
 819 2016-12-07  Geoffrey Garen  <ggaren@apple.com>
 820
 821         Renamed SourceCode members to match their accessor names
 822         https://bugs.webkit.org/show_bug.cgi?id=165573
 823
 824         Reviewed by Keith Miller.
 825
 826         startChar => startOffset
 827         endChar => endOffset
 828
 829         * parser/UnlinkedSourceCode.h:
 830         (JSC::UnlinkedSourceCode::UnlinkedSourceCode):
 831         (JSC::UnlinkedSourceCode::view):
 832         (JSC::UnlinkedSourceCode::startOffset):
 833         (JSC::UnlinkedSourceCode::endOffset):
 834         (JSC::UnlinkedSourceCode::length):
 835
 836 2016-12-07  Keith Miller  <keith_miller@apple.com>
 837
 838         Add more missing trivial wasm ops.
 839         https://bugs.webkit.org/show_bug.cgi?id=165564
 840
 841         Reviewed by Geoffrey Garen.
 842
 843         This patch adds the nop, drop, and tee_local opcodes.
 844         It also fixes an issue where we were not generating
 845         the proper enums for the grow_memory and current_memory
 846         opcodes.
 847
 848         * wasm/WasmFunctionParser.h:
 849         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 850         * wasm/generateWasmOpsHeader.py:
 851
 852 2016-12-07  Geoffrey Garen  <ggaren@apple.com>
 853
 854         Renamed source => parentSource
 855         https://bugs.webkit.org/show_bug.cgi?id=165570
 856
 857         Reviewed by Keith Miller.
 858
 859         For less confuse.
 860
 861         * bytecode/UnlinkedFunctionExecutable.cpp:
 862         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
 863
 864 2016-12-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 865
 866         [JSC] Drop translate phase in module loader
 867         https://bugs.webkit.org/show_bug.cgi?id=164861
 868
 869         Reviewed by Saam Barati.
 870
 871         Originally, this "translate" phase was introduced to the module loader.
 872         However, recent rework discussion[1] starts dropping this phase.
 873         And this "translate" phase is meaningless in the browser side module loader
 874         since this phase originally mimics the node.js's translation hook (like,
 875         transpiling CoffeeScript source to JavaScript).
 876
 877         This "translate" phase is not necessary for the exposed HTML5
 878         <script type="module"> tag right now. Once the module loader pipeline is
 879         redefined and specified, we need to update the current loader anyway.
 880         So dropping "translate" phase right now is OK.
 881
 882         This a bit simplifies the current module loader pipeline.
 883
 884         [1]: https://github.com/whatwg/loader/issues/147
 885
 886         * builtins/ModuleLoaderPrototype.js:
 887         (newRegistryEntry):
 888         (fulfillFetch):
 889         (requestFetch):
 890         (requestInstantiate):
 891         (provide):
 892         (fulfillTranslate): Deleted.
 893         (requestTranslate): Deleted.
 894         * bytecode/BytecodeIntrinsicRegistry.cpp:
 895         (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
 896         * jsc.cpp:
 897         * runtime/JSGlobalObject.cpp:
 898         * runtime/JSGlobalObject.h:
 899         * runtime/JSModuleLoader.cpp:
 900         (JSC::JSModuleLoader::translate): Deleted.
 901         * runtime/JSModuleLoader.h:
 902         * runtime/ModuleLoaderPrototype.cpp:
 903         (JSC::moduleLoaderPrototypeInstantiate):
 904         (JSC::moduleLoaderPrototypeTranslate): Deleted.
 905
 906 2016-12-07  Joseph Pecoraro  <pecoraro@apple.com>
 907
 908         Web Inspector: Add ability to distinguish if a Script was parsed as a module
 909         https://bugs.webkit.org/show_bug.cgi?id=164900
 910         <rdar://problem/29323817>
 911
 912         Reviewed by Timothy Hatcher.
 913
 914         * inspector/agents/InspectorDebuggerAgent.cpp:
 915         (Inspector::InspectorDebuggerAgent::didParseSource):
 916         * inspector/protocol/Debugger.json:
 917         Add an optional event parameter to distinguish if a script was a module or not.
 918
 919 2016-12-07  Simon Fraser  <simon.fraser@apple.com>
 920
 921         Add system trace points for JavaScript VM entry/exit
 922         https://bugs.webkit.org/show_bug.cgi?id=165550
 923
 924         Reviewed by Tim Horton.
 925
 926         Add trace points for entry/exit into/out of the JS VM.
 927
 928         * runtime/VMEntryScope.cpp:
 929         (JSC::VMEntryScope::VMEntryScope):
 930         (JSC::VMEntryScope::~VMEntryScope):
 931
 932 2016-12-06  Keith Miller  <keith_miller@apple.com>
 933
 934         Add support for truncation operators
 935         https://bugs.webkit.org/show_bug.cgi?id=165519
 936
 937         Reviewed by Geoffrey Garen.
 938
 939         This patch adds initial support for truncation operators. The current patch
 940         does range based out of bounds checking, in the future we should use system
 941         register flags on ARM and other tricks on X86 improve the performance of
 942         these opcodes.
 943
 944         * assembler/MacroAssemblerARM64.h:
 945         (JSC::MacroAssemblerARM64::branchTruncateDoubleToInt32):
 946         (JSC::MacroAssemblerARM64::truncateDoubleToInt64):
 947         (JSC::MacroAssemblerARM64::truncateDoubleToUint64):
 948         (JSC::MacroAssemblerARM64::truncateFloatToInt32):
 949         (JSC::MacroAssemblerARM64::truncateFloatToUint32):
 950         (JSC::MacroAssemblerARM64::truncateFloatToInt64):
 951         (JSC::MacroAssemblerARM64::truncateFloatToUint64):
 952         * assembler/MacroAssemblerX86Common.h:
 953         (JSC::MacroAssemblerX86Common::truncateFloatToInt32):
 954         (JSC::MacroAssemblerX86Common::truncateDoubleToUint32): Deleted.
 955         * assembler/MacroAssemblerX86_64.h:
 956         (JSC::MacroAssemblerX86_64::truncateDoubleToUint32):
 957         (JSC::MacroAssemblerX86_64::truncateDoubleToInt64):
 958         (JSC::MacroAssemblerX86_64::truncateDoubleToUint64):
 959         (JSC::MacroAssemblerX86_64::truncateFloatToUint32):
 960         (JSC::MacroAssemblerX86_64::truncateFloatToInt64):
 961         (JSC::MacroAssemblerX86_64::truncateFloatToUint64):
 962         * assembler/X86Assembler.h:
 963         (JSC::X86Assembler::cvttss2si_rr):
 964         (JSC::X86Assembler::cvttss2siq_rr):
 965         * wasm/WasmB3IRGenerator.cpp:
 966         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF64>):
 967         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF32>):
 968         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF64>):
 969         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF32>):
 970         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF64>):
 971         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF64>):
 972         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF32>):
 973         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF32>):
 974         * wasm/WasmFunctionParser.h:
 975         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 976
 977 2016-12-07  Joseph Pecoraro  <pecoraro@apple.com>
 978
 979         Web Inspector: Remove unused and mostly untested Page domain commands and events
 980         https://bugs.webkit.org/show_bug.cgi?id=165507
 981
 982         Reviewed by Brian Burg.
 983
 984         Remove unused and unsupported commands and events.
 985
 986           - Page.setDocumentContent
 987           - Page.getScriptExecutionStatus
 988           - Page.setScriptExecutionDisabled
 989           - Page.handleJavaScriptDialog
 990           - Page.javascriptDialogOpening
 991           - Page.javascriptDialogClosed
 992           - Page.scriptsEnabled
 993
 994         * inspector/protocol/Page.json:
 995
 996 2016-12-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 997
 998         [JSC] Merge PromiseReactions
 999         https://bugs.webkit.org/show_bug.cgi?id=165526
1000
1001         Reviewed by Sam Weinig.
1002
1003         Our promise implementation has two arrays per Promise; promiseFulfillReactions and promiseRejectReactions.
1004         And everytime we call `promise.then`, we create two promise reactions for fullfill and reject.
1005         However, these two reactions and the arrays for reactions can be merged into one array and one reaction.
1006         It reduces the unnecessary object allocations.
1007
1008         No behavior change.
1009
1010         * builtins/BuiltinNames.h:
1011         * builtins/PromiseOperations.js:
1012         (globalPrivate.newPromiseReaction):
1013         (globalPrivate.triggerPromiseReactions):
1014         (globalPrivate.rejectPromise):
1015         (globalPrivate.fulfillPromise):
1016         (globalPrivate.promiseReactionJob):
1017         (globalPrivate.initializePromise):
1018         * builtins/PromisePrototype.js:
1019         (then):
1020         * runtime/JSPromise.cpp:
1021         (JSC::JSPromise::finishCreation):
1022
1023 2016-12-06  Mark Lam  <mark.lam@apple.com>
1024
1025         GetByID IC is wrongly unwrapping the global proxy this value for getter/setters.
1026         https://bugs.webkit.org/show_bug.cgi?id=165401
1027
1028         Reviewed by Saam Barati.
1029
1030         When the this value for a property access is the JS global and that property
1031         access is via a GetterSetter, the underlying getter / setter functions would
1032         expect the this value they receive to be the JSProxy instance instead of the
1033         JSGlobalObject.  This is consistent with how the LLINT and runtime code behaves.
1034         The IC code should behave the same way.
1035
1036         Also added some ASSERTs to document invariants in the code, and help detect
1037         bugs sooner if the code gets changed in a way that breaks those invariants in
1038         the future.
1039
1040         * bytecode/PolymorphicAccess.cpp:
1041         (JSC::AccessCase::generateImpl):
1042
1043 2016-12-06  Joseph Pecoraro  <pecoraro@apple.com>
1044
1045         DumpRenderTree ASSERT in JSC::ExecutableBase::isHostFunction seen on bots
1046         https://bugs.webkit.org/show_bug.cgi?id=165497
1047         <rdar://problem/29538973>
1048
1049         Reviewed by Saam Barati.
1050
1051         * inspector/agents/InspectorScriptProfilerAgent.cpp:
1052         (Inspector::InspectorScriptProfilerAgent::trackingComplete):
1053         Defer collection when extracting and processing the samples to avoid
1054         any objects held by the samples from getting collected while processing.
1055         This is because while processing we call into functions that can
1056         allocate and we must prevent those functions from syncing with the
1057         GC thread which may collect other sample data yet to be processed.
1058
1059 2016-12-06  Alexey Proskuryakov  <ap@apple.com>
1060
1061         Correct SDKROOT values in xcconfig files
1062         https://bugs.webkit.org/show_bug.cgi?id=165487
1063         rdar://problem/29539209
1064
1065         Reviewed by Dan Bernstein.
1066
1067         Fix suggested by Dan Bernstein.
1068
1069         * Configurations/DebugRelease.xcconfig:
1070
1071 2016-12-06  Saam Barati  <sbarati@apple.com>
1072
1073         Remove old Wasm object model
1074         https://bugs.webkit.org/show_bug.cgi?id=165481
1075
1076         Reviewed by Keith Miller and Mark Lam.
1077
1078         It's confusing to see code that consults both the old
1079         Wasm object model alongside the new one. The old object
1080         model is not a thing, and it's not being used. Let's
1081         remove it now to prevent further confusion.
1082
1083         * CMakeLists.txt:
1084         * JavaScriptCore.xcodeproj/project.pbxproj:
1085         * bytecode/CodeBlock.cpp:
1086         (JSC::CodeBlock::finalizeLLIntInlineCaches):
1087         (JSC::CodeBlock::replacement):
1088         (JSC::CodeBlock::computeCapabilityLevel):
1089         (JSC::CodeBlock::updateAllPredictions):
1090         * bytecode/CodeBlock.h:
1091         * bytecode/WebAssemblyCodeBlock.cpp: Removed.
1092         * bytecode/WebAssemblyCodeBlock.h: Removed.
1093         * dfg/DFGCapabilities.cpp:
1094         (JSC::DFG::isSupportedForInlining):
1095         * interpreter/Interpreter.cpp:
1096         (JSC::GetStackTraceFunctor::operator()):
1097         (JSC::UnwindFunctor::operator()):
1098         (JSC::isWebAssemblyExecutable): Deleted.
1099         * jit/JITOperations.cpp:
1100         * jit/Repatch.cpp:
1101         (JSC::linkPolymorphicCall):
1102         * llint/LLIntSlowPaths.cpp:
1103         (JSC::LLInt::setUpCall):
1104         * runtime/ExecutableBase.cpp:
1105         (JSC::ExecutableBase::clearCode):
1106         * runtime/ExecutableBase.h:
1107         (JSC::ExecutableBase::isWebAssemblyExecutable): Deleted.
1108         * runtime/JSFunction.cpp:
1109         * runtime/JSFunction.h:
1110         * runtime/JSFunctionInlines.h:
1111         (JSC::JSFunction::isBuiltinFunction):
1112         * runtime/VM.cpp:
1113         (JSC::VM::VM):
1114         * runtime/VM.h:
1115         * runtime/WebAssemblyExecutable.cpp: Removed.
1116         * runtime/WebAssemblyExecutable.h: Removed.
1117
1118 2016-12-06  JF Bastien  <jfbastien@apple.com>
1119
1120         PureNaN: fix typo
1121         https://bugs.webkit.org/show_bug.cgi?id=165493
1122
1123         Reviewed by Mark Lam.
1124
1125         * runtime/PureNaN.h:
1126
1127 2016-12-06  Mark Lam  <mark.lam@apple.com>
1128
1129         Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
1130         https://bugs.webkit.org/show_bug.cgi?id=165227
1131         <rdar://problem/29442665>
1132
1133         Reviewed by Saam Barati.
1134
1135         * runtime/JSObject.cpp:
1136         (JSC::JSObject::setPrototypeWithCycleCheck):
1137         - This is where we check for immutable prototype exotic objects and refuse to set
1138           the prototype if needed.
1139           See https://tc39.github.io/ecma262/#sec-immutable-prototype-exotic-objects.
1140
1141         * runtime/JSTypeInfo.h:
1142         (JSC::TypeInfo::isImmutablePrototypeExoticObject):
1143         * runtime/Structure.h:
1144         - Add flag for declaring immutable prototype exotic objects.
1145
1146         * runtime/ObjectPrototype.h:
1147         - Declare that Object.prototype is an immutable prototype exotic object.
1148           See https://tc39.github.io/ecma262/#sec-properties-of-the-object-prototype-object.
1149
1150         * runtime/ObjectConstructor.cpp:
1151         (JSC::objectConstructorSetPrototypeOf):
1152         - Use better error messages.
1153
1154 2016-12-04  Darin Adler  <darin@apple.com>
1155
1156         Use ASCIICType more, and improve it a little bit
1157         https://bugs.webkit.org/show_bug.cgi?id=165360
1158
1159         Reviewed by Sam Weinig.
1160
1161         * inspector/InspectorValues.cpp:
1162         (Inspector::readHexDigits): Use isASCIIHexDigit.
1163         (Inspector::hextoInt): Deleted.
1164         (decodeString): Use toASCIIHexValue.
1165
1166         * runtime/JSGlobalObjectFunctions.cpp:
1167         (JSC::parseDigit): Use isASCIIDigit, isASCIIUpper, and isASCIILower.
1168
1169         * runtime/StringPrototype.cpp:
1170         (JSC::substituteBackreferencesSlow): Use isASCIIDigit.
1171
1172 2016-12-06  Csaba Osztrogonác  <ossy@webkit.org>
1173
1174         Add storeFence support for ARMv7
1175         https://bugs.webkit.org/show_bug.cgi?id=164733
1176
1177         Reviewed by Saam Barati.
1178
1179         * assembler/ARMAssembler.h:
1180         (JSC::ARMAssembler::dmbISHST): Added.
1181         * assembler/ARMv7Assembler.h: Typo fixed, DMB has only T1 encoding.
1182         (JSC::ARMv7Assembler::dmbSY):
1183         (JSC::ARMv7Assembler::dmbISHST): Added.
1184         * assembler/MacroAssemblerARM.h:
1185         (JSC::MacroAssemblerARM::storeFence):
1186         * assembler/MacroAssemblerARMv7.h:
1187         (JSC::MacroAssemblerARMv7::storeFence):
1188
1189 2016-12-05  Matt Baker  <mattbaker@apple.com>
1190
1191         Web Inspector: remove ASSERT from InspectorDebuggerAgent::derefAsyncCallData
1192         https://bugs.webkit.org/show_bug.cgi?id=165413
1193         <rdar://problem/29517587>
1194
1195         Reviewed by Brian Burg.
1196
1197         DOMTimer::removeById can call into InspectorInstrumentation with an
1198         invalid identifier, so don't assert that async call data exists.
1199
1200         * inspector/agents/InspectorDebuggerAgent.cpp:
1201         (Inspector::InspectorDebuggerAgent::derefAsyncCallData):
1202
1203 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
1204
1205         Fixed a bug in my last patch.
1206
1207         Unreviewed.
1208
1209         * bytecode/UnlinkedFunctionExecutable.h: Restore the conversion to
1210         one-based counting.
1211
1212 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
1213
1214         Moved start and end column linking into helper functions
1215         https://bugs.webkit.org/show_bug.cgi?id=165422
1216
1217         Reviewed by Sam Weinig.
1218
1219         * bytecode/UnlinkedFunctionExecutable.cpp:
1220         (JSC::UnlinkedFunctionExecutable::link):
1221         * bytecode/UnlinkedFunctionExecutable.h:
1222
1223 2016-12-05  Mark Lam  <mark.lam@apple.com>
1224
1225         Fix JSC files so that we can build a release build with NDEBUG #undef'ed.
1226         https://bugs.webkit.org/show_bug.cgi?id=165409
1227
1228         Reviewed by Keith Miller.
1229
1230         This allows us to run a release build with DEBUG ASSERTs enabled.
1231
1232         * bytecode/BytecodeLivenessAnalysis.cpp:
1233         * bytecode/UnlinkedEvalCodeBlock.cpp:
1234         * bytecode/UnlinkedFunctionCodeBlock.cpp:
1235         * bytecode/UnlinkedModuleProgramCodeBlock.cpp:
1236         * bytecode/UnlinkedProgramCodeBlock.cpp:
1237         * runtime/EvalExecutable.cpp:
1238
1239 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
1240
1241         Renamed source => parentSource
1242         https://bugs.webkit.org/show_bug.cgi?id=165419
1243
1244         Reviewed by Saam Barati.
1245
1246         This should help clarify that a FunctionExecutable holds the source
1247         code to its *parent* scope, and not its own SourceCode.
1248
1249         * builtins/BuiltinExecutables.cpp:
1250         (JSC::BuiltinExecutables::createExecutable):
1251         * bytecode/UnlinkedFunctionExecutable.cpp:
1252         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
1253         (JSC::UnlinkedFunctionExecutable::link):
1254         * bytecode/UnlinkedFunctionExecutable.h:
1255
1256 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
1257
1258         ScriptExecutable should not contain a copy of firstLine and startColumn
1259         https://bugs.webkit.org/show_bug.cgi?id=165415
1260
1261         Reviewed by Keith Miller.
1262
1263         We already have this data in SourceCode.
1264
1265         It's super confusing to have two copies of this data, where one is
1266         allowed to mutate. In reality, your line and column number never change.
1267
1268         * bytecode/UnlinkedFunctionExecutable.cpp:
1269         (JSC::UnlinkedFunctionExecutable::link):
1270         * runtime/CodeCache.cpp:
1271         (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
1272         * runtime/CodeCache.h:
1273         (JSC::generateUnlinkedCodeBlock):
1274         * runtime/FunctionExecutable.cpp:
1275         (JSC::FunctionExecutable::FunctionExecutable):
1276         * runtime/FunctionExecutable.h:
1277         * runtime/ScriptExecutable.cpp:
1278         (JSC::ScriptExecutable::ScriptExecutable):
1279         (JSC::ScriptExecutable::newCodeBlockFor):
1280         * runtime/ScriptExecutable.h:
1281         (JSC::ScriptExecutable::firstLine):
1282         (JSC::ScriptExecutable::startColumn):
1283         (JSC::ScriptExecutable::recordParse):
1284
1285 2016-12-05  Caitlin Potter  <caitp@igalia.com>
1286
1287         [JSC] report unexpected token when "async" is followed by identifier
1288         https://bugs.webkit.org/show_bug.cgi?id=165091
1289
1290         Reviewed by Mark Lam.
1291
1292         Report a SyntaxError, in order to report correct error in contexts
1293         an async ArrowFunction cannot occur. Also corrects errors in comment
1294         describing JSTokenType bitfield, which was added in r209293.
1295
1296         * parser/Parser.cpp:
1297         (JSC::Parser<LexerType>::parseMemberExpression):
1298         * parser/ParserTokens.h:
1299
1300 2016-12-05  Keith Miller  <keith_miller@apple.com>
1301
1302         Add Wasm i64 to i32 conversion.
1303         https://bugs.webkit.org/show_bug.cgi?id=165378
1304
1305         Reviewed by Filip Pizlo.
1306
1307         It turns out the wrap operation is just B3's Trunc.
1308
1309         * wasm/wasm.json:
1310
1311 2016-12-05  Joseph Pecoraro  <pecoraro@apple.com>
1312
1313         REGRESSION(r208985): SafariForWebKitDevelopment Symbol Not Found looking for method with WTF::Optional
1314         https://bugs.webkit.org/show_bug.cgi?id=165351
1315
1316         Reviewed by Yusuke Suzuki.
1317
1318         Some versions of Safari expect:
1319
1320             Inspector::BackendDispatcher::reportProtocolError(WTF::Optional<long>, Inspector::BackendDispatcher::CommonErrorCode, WTF::String const&)
1321
1322         Which we had updated to use std::optional. Expose a version with the original
1323         Symbol for these Safaris. This stub will just call through to the new version.
1324
1325         * inspector/InspectorBackendDispatcher.cpp:
1326         (Inspector::BackendDispatcher::reportProtocolError):
1327         * inspector/InspectorBackendDispatcher.h:
1328
1329 2016-12-05  Konstantin Tokarev  <annulen@yandex.ru>
1330
1331         Add __STDC_FORMAT_MACROS before inttypes.h is included
1332         https://bugs.webkit.org/show_bug.cgi?id=165374
1333
1334         We need formatting macros like PRIu64 to be available in all places where
1335         inttypes.h header is used. All these usages get inttypes.h definitions
1336         via wtf/Assertions.h header, except SQLiteFileSystem.cpp where formatting
1337         macros are not used anymore since r185129.
1338
1339         This patch fixes multiple build errors with MinGW and reduces number of
1340         independent __STDC_FORMAT_MACROS uses in the code base.
1341
1342         Reviewed by Darin Adler.
1343
1344         * disassembler/ARM64/A64DOpcode.cpp: Removed __STDC_FORMAT_MACROS
1345         because it is obtained via Assertions.h now
1346         * disassembler/ARM64Disassembler.cpp: Ditto.
1347
1348 2016-12-04  Keith Miller  <keith_miller@apple.com>
1349
1350         Add support for Wasm ctz and popcnt
1351         https://bugs.webkit.org/show_bug.cgi?id=165369
1352
1353         Reviewed by Saam Barati.
1354
1355         * assembler/MacroAssemblerARM64.h:
1356         (JSC::MacroAssemblerARM64::countTrailingZeros32):
1357         (JSC::MacroAssemblerARM64::countTrailingZeros64):
1358         * assembler/MacroAssemblerX86Common.cpp:
1359         * assembler/MacroAssemblerX86Common.h:
1360         (JSC::MacroAssemblerX86Common::countTrailingZeros32):
1361         (JSC::MacroAssemblerX86Common::supportsBMI1):
1362         (JSC::MacroAssemblerX86Common::ctzAfterBsf):
1363         * assembler/MacroAssemblerX86_64.h:
1364         (JSC::MacroAssemblerX86_64::countTrailingZeros64):
1365         * assembler/X86Assembler.h:
1366         (JSC::X86Assembler::tzcnt_rr):
1367         (JSC::X86Assembler::tzcntq_rr):
1368         (JSC::X86Assembler::bsf_rr):
1369         (JSC::X86Assembler::bsfq_rr):
1370         * wasm/WasmB3IRGenerator.cpp:
1371         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Ctz>):
1372         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Ctz>):
1373         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Popcnt>):
1374         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Popcnt>):
1375         * wasm/WasmFunctionParser.h:
1376         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1377
1378 2016-12-04  Saam Barati  <sbarati@apple.com>
1379
1380         We should have a Wasm callee
1381         https://bugs.webkit.org/show_bug.cgi?id=165163
1382
1383         Reviewed by Keith Miller.
1384
1385         This patch adds JSWebAssemblyCallee and stores it into the
1386         callee slot in the call frame as part of the prologue of a
1387         wasm function. This is the first step in implementing
1388         unwinding from/through wasm frames. We will use the callee
1389         to identify that a machine frame belongs to wasm code.
1390
1391         * CMakeLists.txt:
1392         * JavaScriptCore.xcodeproj/project.pbxproj:
1393         * jsc.cpp:
1394         (callWasmFunction):
1395         (functionTestWasmModuleFunctions):
1396         * llint/LowLevelInterpreter64.asm:
1397         * runtime/JSGlobalObject.cpp:
1398         * runtime/VM.cpp:
1399         (JSC::VM::VM):
1400         * runtime/VM.h:
1401         * wasm/JSWebAssembly.h:
1402         * wasm/WasmB3IRGenerator.cpp:
1403         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1404         (JSC::Wasm::parseAndCompile):
1405         * wasm/WasmCallingConvention.h:
1406         (JSC::Wasm::CallingConvention::setupFrameInPrologue):
1407         * wasm/WasmFormat.h:
1408         * wasm/WasmPlan.cpp:
1409         (JSC::Wasm::Plan::initializeCallees):
1410         * wasm/WasmPlan.h:
1411         (JSC::Wasm::Plan::compiledFunction):
1412         (JSC::Wasm::Plan::getCompiledFunctions): Deleted.
1413         * wasm/js/JSWebAssemblyCallee.cpp: Added.
1414         (JSC::JSWebAssemblyCallee::JSWebAssemblyCallee):
1415         (JSC::JSWebAssemblyCallee::finishCreation):
1416         (JSC::JSWebAssemblyCallee::destroy):
1417         * wasm/js/JSWebAssemblyCallee.h: Added.
1418         (JSC::JSWebAssemblyCallee::create):
1419         (JSC::JSWebAssemblyCallee::createStructure):
1420         (JSC::JSWebAssemblyCallee::jsEntryPoint):
1421         * wasm/js/JSWebAssemblyModule.cpp:
1422         (JSC::JSWebAssemblyModule::create):
1423         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
1424         (JSC::JSWebAssemblyModule::visitChildren):
1425         * wasm/js/JSWebAssemblyModule.h:
1426         (JSC::JSWebAssemblyModule::moduleInformation):
1427         (JSC::JSWebAssemblyModule::callee):
1428         (JSC::JSWebAssemblyModule::callees):
1429         (JSC::JSWebAssemblyModule::offsetOfCallees):
1430         (JSC::JSWebAssemblyModule::allocationSize):
1431         (JSC::JSWebAssemblyModule::compiledFunctions): Deleted.
1432         * wasm/js/WebAssemblyFunction.cpp:
1433         (JSC::callWebAssemblyFunction):
1434         (JSC::WebAssemblyFunction::create):
1435         (JSC::WebAssemblyFunction::visitChildren):
1436         (JSC::WebAssemblyFunction::finishCreation):
1437         * wasm/js/WebAssemblyFunction.h:
1438         (JSC::WebAssemblyFunction::webAssemblyCallee):
1439         (JSC::WebAssemblyFunction::instance):
1440         (JSC::WebAssemblyFunction::signature):
1441         (JSC::CallableWebAssemblyFunction::CallableWebAssemblyFunction): Deleted.
1442         (JSC::WebAssemblyFunction::webAssemblyFunctionCell): Deleted.
1443         * wasm/js/WebAssemblyFunctionCell.cpp:
1444         (JSC::WebAssemblyFunctionCell::create): Deleted.
1445         (JSC::WebAssemblyFunctionCell::WebAssemblyFunctionCell): Deleted.
1446         (JSC::WebAssemblyFunctionCell::destroy): Deleted.
1447         (JSC::WebAssemblyFunctionCell::createStructure): Deleted.
1448         * wasm/js/WebAssemblyFunctionCell.h:
1449         (JSC::WebAssemblyFunctionCell::function): Deleted.
1450         * wasm/js/WebAssemblyModuleConstructor.cpp:
1451         (JSC::constructJSWebAssemblyModule):
1452         * wasm/js/WebAssemblyModuleRecord.cpp:
1453         (JSC::WebAssemblyModuleRecord::link):
1454
1455 2016-12-04  Matt Baker  <mattbaker@apple.com>
1456
1457         Web Inspector: Assertion Failures breakpoint should respect global Breakpoints enabled setting
1458         https://bugs.webkit.org/show_bug.cgi?id=165277
1459         <rdar://problem/29467098>
1460
1461         Reviewed by Mark Lam.
1462
1463         * inspector/agents/InspectorDebuggerAgent.cpp:
1464         (Inspector::InspectorDebuggerAgent::handleConsoleAssert):
1465         Check that breakpoints are active before pausing.
1466
1467 2016-12-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1468
1469         Refactor SymbolImpl layout
1470         https://bugs.webkit.org/show_bug.cgi?id=165247
1471
1472         Reviewed by Darin Adler.
1473
1474         Use SymbolImpl::{create, createNullSymbol} instead.
1475
1476         * runtime/PrivateName.h:
1477         (JSC::PrivateName::PrivateName):
1478
1479 2016-12-03  JF Bastien  <jfbastien@apple.com>
1480
1481         WebAssembly: update binary format to 0xD version
1482         https://bugs.webkit.org/show_bug.cgi?id=165345
1483
1484         Reviewed by Keith Miller.
1485
1486         As described in the following PR: https://github.com/WebAssembly/design/pull/836
1487         Originally committed in r209175, reverted in r209242, and fixed in r209284.
1488
1489         * wasm/WasmB3IRGenerator.cpp:
1490         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1491         (JSC::Wasm::B3IRGenerator::zeroForType):
1492         (JSC::Wasm::B3IRGenerator::addConstant):
1493         (JSC::Wasm::createJSWrapper):
1494         * wasm/WasmCallingConvention.h:
1495         (JSC::Wasm::CallingConvention::marshallArgument):
1496         * wasm/WasmFormat.cpp:
1497         (JSC::Wasm::toString): Deleted.
1498         * wasm/WasmFormat.h:
1499         (JSC::Wasm::isValueType):
1500         (JSC::Wasm::toB3Type): Deleted.
1501         * wasm/WasmFunctionParser.h:
1502         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1503         * wasm/WasmModuleParser.cpp:
1504         (JSC::Wasm::ModuleParser::parse):
1505         (JSC::Wasm::ModuleParser::parseType):
1506         * wasm/WasmModuleParser.h:
1507         * wasm/WasmParser.h:
1508         (JSC::Wasm::Parser::parseResultType):
1509         * wasm/generateWasm.py:
1510         (Wasm.__init__):
1511         * wasm/generateWasmOpsHeader.py:
1512         (cppMacro):
1513         (typeMacroizer):
1514         (opcodeMacroizer):
1515         * wasm/js/WebAssemblyFunction.cpp:
1516         (JSC::callWebAssemblyFunction):
1517         * wasm/wasm.json:
1518
1519 2016-12-02  Keith Miller  <keith_miller@apple.com>
1520
1521         Add Wasm copysign
1522         https://bugs.webkit.org/show_bug.cgi?id=165355
1523
1524         Reviewed by Filip Pizlo.
1525
1526         This patch also makes two other important changes:
1527
1528         1) allows for i64 constants in the B3 generator language.
1529         2) Fixes a bug with F64ConvertUI64 where the operation returned a Float instead
1530            of a Double in B3.
1531
1532         * wasm/WasmB3IRGenerator.cpp:
1533         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
1534         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
1535         (CodeGenerator.generateOpcode):
1536         (generateConstCode):
1537         (generateI32ConstCode): Deleted.
1538         * wasm/wasm.json:
1539
1540 2016-12-03  Commit Queue  <commit-queue@webkit.org>
1541
1542         Unreviewed, rolling out r209298.
1543         https://bugs.webkit.org/show_bug.cgi?id=165359
1544
1545         broke the build (Requested by smfr on #webkit).
1546
1547         Reverted changeset:
1548
1549         "Add Wasm copysign"
1550         https://bugs.webkit.org/show_bug.cgi?id=165355
1551         http://trac.webkit.org/changeset/209298
1552
1553 2016-12-02  Keith Miller  <keith_miller@apple.com>
1554
1555         Add Wasm copysign
1556         https://bugs.webkit.org/show_bug.cgi?id=165355
1557
1558         Reviewed by Filip Pizlo.
1559
1560         This patch also makes two other important changes:
1561
1562         1) allows for i64 constants in the B3 generator language.
1563         2) Fixes a bug with F64ConvertUI64 where the operation returned a Float instead
1564            of a Double in B3.
1565
1566         * wasm/WasmB3IRGenerator.cpp:
1567         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
1568         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
1569         (CodeGenerator.generateOpcode):
1570         (generateConstCode):
1571         (generateI32ConstCode): Deleted.
1572         * wasm/wasm.json:
1573
1574 2016-12-02  Keith Miller  <keith_miller@apple.com>
1575
1576         Unreviewed, fix git having a breakdown over trying to reland a rollout.
1577
1578 2016-12-02  Keith Miller  <keith_miller@apple.com>
1579
1580         Add Wasm floating point nearest and trunc
1581         https://bugs.webkit.org/show_bug.cgi?id=165339
1582
1583         Reviewed by Saam Barati.
1584
1585         This patch also allows any wasm primitive type to be passed as a
1586         string.
1587
1588         * assembler/MacroAssemblerARM64.h:
1589         (JSC::MacroAssemblerARM64::nearestIntDouble):
1590         (JSC::MacroAssemblerARM64::nearestIntFloat):
1591         (JSC::MacroAssemblerARM64::truncDouble):
1592         (JSC::MacroAssemblerARM64::truncFloat):
1593         * assembler/MacroAssemblerX86Common.h:
1594         (JSC::MacroAssemblerX86Common::nearestIntDouble):
1595         (JSC::MacroAssemblerX86Common::nearestIntFloat):
1596         * jsc.cpp:
1597         (box):
1598         * wasm/WasmB3IRGenerator.cpp:
1599         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
1600         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
1601         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Nearest>):
1602         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Nearest>):
1603         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Trunc>):
1604         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Trunc>):
1605         * wasm/WasmFunctionParser.h:
1606         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1607
1608 2016-12-02  Caitlin Potter  <caitp@igalia.com>
1609
1610 [JSC] add additional bit to JSTokenType bitfield
1611         https://bugs.webkit.org/show_bug.cgi?id=165091
1612
1613         Reviewed by Geoffrey Garen.
1614
1615         Avoid overflow which causes keyword tokens to be treated as unary
1616         tokens now that "async" is tokenized as a keyword, by granting an
1617         additional 64 bits to be occupied by token IDs.
1618
1619         * parser/ParserTokens.h:
1620
1621 2016-12-02  Andy Estes  <aestes@apple.com>
1622
1623         [Cocoa] Adopt the PRODUCT_BUNDLE_IDENTIFIER build setting
1624         https://bugs.webkit.org/show_bug.cgi?id=164492
1625
1626         Reviewed by Dan Bernstein.
1627
1628         * Configurations/JavaScriptCore.xcconfig: Set PRODUCT_BUNDLE_IDENTIFIER to
1629         com.apple.$(PRODUCT_NAME:rfc1034identifier).
1630         * Info.plist: Changed CFBundleIdentifier's value from com.apple.${PRODUCT_NAME} to
1631         ${PRODUCT_BUNDLE_IDENTIFIER}.
1632
1633 2016-12-02  JF Bastien  <jfbastien@apple.com>
1634
1635         WebAssembly: mark WasmOps.h as private
1636         https://bugs.webkit.org/show_bug.cgi?id=165335
1637
1638         Reviewed by Mark Lam.
1639
1640         * JavaScriptCore.xcodeproj/project.pbxproj: WasmOps.h will be used by non-JSC and should therefore be private
1641
1642 2016-12-02  Commit Queue  <commit-queue@webkit.org>
1643
1644         Unreviewed, rolling out r209275 and r209276.
1645         https://bugs.webkit.org/show_bug.cgi?id=165348
1646
1647         "broke the arm build" (Requested by keith_miller on #webkit).
1648
1649         Reverted changesets:
1650
1651         "Add Wasm floating point nearest and trunc"
1652         https://bugs.webkit.org/show_bug.cgi?id=165339
1653         http://trac.webkit.org/changeset/209275
1654
1655         "Unreviewed, forgot to change instruction after renaming."
1656         http://trac.webkit.org/changeset/209276
1657
1658 2016-12-02  Keith Miller  <keith_miller@apple.com>
1659
1660         Unreviewed, forgot to change instruction after renaming.
1661
1662         * assembler/MacroAssemblerARM64.h:
1663         (JSC::MacroAssemblerARM64::nearestIntDouble):
1664         (JSC::MacroAssemblerARM64::nearestIntFloat):
1665
1666 2016-12-02  Keith Miller  <keith_miller@apple.com>
1667
1668         Add Wasm floating point nearest and trunc
1669         https://bugs.webkit.org/show_bug.cgi?id=165339
1670
1671         Reviewed by Filip Pizlo.
1672
1673         This patch also allows any wasm primitive type to be passed as a
1674         string.
1675
1676         * assembler/MacroAssemblerARM64.h:
1677         (JSC::MacroAssemblerARM64::nearestIntDouble):
1678         (JSC::MacroAssemblerARM64::nearestIntFloat):
1679         (JSC::MacroAssemblerARM64::truncDouble):
1680         (JSC::MacroAssemblerARM64::truncFloat):
1681         * assembler/MacroAssemblerX86Common.h:
1682         (JSC::MacroAssemblerX86Common::nearestIntDouble):
1683         (JSC::MacroAssemblerX86Common::nearestIntFloat):
1684         * jsc.cpp:
1685         (box):
1686         * wasm/WasmB3IRGenerator.cpp:
1687         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
1688         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
1689         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Nearest>):
1690         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Nearest>):
1691         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Trunc>):
1692         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Trunc>):
1693         * wasm/WasmFunctionParser.h:
1694         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1695
1696 2016-12-02  JF Bastien  <jfbastien@apple.com>
1697
1698         WebAssembly: revert patch causing odd breakage
1699         https://bugs.webkit.org/show_bug.cgi?id=165308
1700
1701         Unreviewed.
1702
1703         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
1704         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
1705
1706         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
1707
1708         * wasm/WasmB3IRGenerator.cpp:
1709         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1710         (JSC::Wasm::B3IRGenerator::zeroForType):
1711         (JSC::Wasm::B3IRGenerator::addConstant):
1712         (JSC::Wasm::createJSWrapper):
1713         * wasm/WasmCallingConvention.h:
1714         (JSC::Wasm::CallingConvention::marshallArgument):
1715         * wasm/WasmFormat.cpp:
1716         (JSC::Wasm::toString):
1717         * wasm/WasmFormat.h:
1718         (JSC::Wasm::toB3Type):
1719         * wasm/WasmFunctionParser.h:
1720         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1721         * wasm/WasmModuleParser.cpp:
1722         (JSC::Wasm::ModuleParser::parse):
1723         (JSC::Wasm::ModuleParser::parseType):
1724         * wasm/WasmModuleParser.h:
1725         * wasm/WasmParser.h:
1726         (JSC::Wasm::Parser::parseResultType):
1727         * wasm/generateWasm.py:
1728         (Wasm.__init__):
1729         * wasm/generateWasmOpsHeader.py:
1730         (cppMacro):
1731         (opcodeMacroizer):
1732         (typeMacroizer): Deleted.
1733         * wasm/js/WebAssemblyFunction.cpp:
1734         (JSC::callWebAssemblyFunction):
1735         * wasm/wasm.json:
1736
1737 2016-12-01  Brian Burg  <bburg@apple.com>
1738
1739         Remote Inspector: fix weird typo in generated ObjC protocol type initializer implementations
1740         https://bugs.webkit.org/show_bug.cgi?id=165295
1741         <rdar://problem/29427778>
1742
1743         Reviewed by Joseph Pecoraro.
1744
1745         Remove a stray semicolon appended after custom initializer signatures.
1746         This is a syntax error when building with less lenient compiler warnings.
1747
1748         * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
1749         (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_required_members):
1750         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
1751         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
1752         * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
1753         * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
1754         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
1755         * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
1756         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
1757
1758 2016-12-01  Saam Barati  <sbarati@apple.com>
1759
1760         Rename CallFrame::callee() to CallFrame::jsCallee()
1761         https://bugs.webkit.org/show_bug.cgi?id=165293
1762
1763         Reviewed by Keith Miller.
1764
1765         Wasm will soon have its own Callee that doesn't derive
1766         from JSObject, but derives from JSCell. I want to introduce
1767         a new function like:
1768         ```
1769         CalleeBase* CallFrame::callee()
1770         ```
1771
1772         once we have a Wasm callee. It only makes sense to name that
1773         function callee() and rename the current one turn to:
1774         ```
1775         JSObject* CallFrame::jsCallee()
1776         ```
1777
1778         * API/APICallbackFunction.h:
1779         (JSC::APICallbackFunction::call):
1780         (JSC::APICallbackFunction::construct):
1781         * API/JSCallbackObjectFunctions.h:
1782         (JSC::JSCallbackObject<Parent>::construct):
1783         (JSC::JSCallbackObject<Parent>::call):
1784         * debugger/DebuggerCallFrame.cpp:
1785         (JSC::DebuggerCallFrame::scope):
1786         (JSC::DebuggerCallFrame::type):
1787         * interpreter/CallFrame.cpp:
1788         (JSC::CallFrame::friendlyFunctionName):
1789         * interpreter/CallFrame.h:
1790         (JSC::ExecState::jsCallee):
1791         (JSC::ExecState::callee): Deleted.
1792         * interpreter/Interpreter.cpp:
1793         (JSC::Interpreter::dumpRegisters):
1794         (JSC::notifyDebuggerOfUnwinding):
1795         * interpreter/ShadowChicken.cpp:
1796         (JSC::ShadowChicken::update):
1797         * interpreter/StackVisitor.cpp:
1798         (JSC::StackVisitor::readNonInlinedFrame):
1799         * llint/LLIntSlowPaths.cpp:
1800         (JSC::LLInt::traceFunctionPrologue):
1801         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1802         * runtime/ArrayConstructor.cpp:
1803         (JSC::constructArrayWithSizeQuirk):
1804         * runtime/AsyncFunctionConstructor.cpp:
1805         (JSC::callAsyncFunctionConstructor):
1806         (JSC::constructAsyncFunctionConstructor):
1807         * runtime/BooleanConstructor.cpp:
1808         (JSC::constructWithBooleanConstructor):
1809         * runtime/ClonedArguments.cpp:
1810         (JSC::ClonedArguments::createWithInlineFrame):
1811         * runtime/CommonSlowPaths.h:
1812         (JSC::CommonSlowPaths::arityCheckFor):
1813         * runtime/DateConstructor.cpp:
1814         (JSC::constructWithDateConstructor):
1815         * runtime/DirectArguments.cpp:
1816         (JSC::DirectArguments::createByCopying):
1817         * runtime/Error.h:
1818         (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
1819         (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
1820         * runtime/ErrorConstructor.cpp:
1821         (JSC::Interpreter::constructWithErrorConstructor):
1822         (JSC::Interpreter::callErrorConstructor):
1823         * runtime/FunctionConstructor.cpp:
1824         (JSC::constructWithFunctionConstructor):
1825         (JSC::callFunctionConstructor):
1826         * runtime/GeneratorFunctionConstructor.cpp:
1827         (JSC::callGeneratorFunctionConstructor):
1828         (JSC::constructGeneratorFunctionConstructor):
1829         * runtime/InternalFunction.cpp:
1830         (JSC::InternalFunction::createSubclassStructure):
1831         * runtime/IntlCollator.cpp:
1832         (JSC::IntlCollator::initializeCollator):
1833         * runtime/IntlCollatorConstructor.cpp:
1834         (JSC::constructIntlCollator):
1835         (JSC::callIntlCollator):
1836         (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
1837         * runtime/IntlDateTimeFormat.cpp:
1838         (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
1839         * runtime/IntlDateTimeFormatConstructor.cpp:
1840         (JSC::constructIntlDateTimeFormat):
1841         (JSC::callIntlDateTimeFormat):
1842         (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
1843         * runtime/IntlNumberFormat.cpp:
1844         (JSC::IntlNumberFormat::initializeNumberFormat):
1845         * runtime/IntlNumberFormatConstructor.cpp:
1846         (JSC::constructIntlNumberFormat):
1847         (JSC::callIntlNumberFormat):
1848         (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
1849         * runtime/IntlObject.cpp:
1850         (JSC::canonicalizeLocaleList):
1851         (JSC::defaultLocale):
1852         (JSC::lookupSupportedLocales):
1853         (JSC::intlObjectFuncGetCanonicalLocales):
1854         * runtime/JSArrayBufferConstructor.cpp:
1855         (JSC::constructArrayBuffer):
1856         * runtime/JSArrayBufferPrototype.cpp:
1857         (JSC::arrayBufferProtoFuncSlice):
1858         * runtime/JSBoundFunction.cpp:
1859         (JSC::boundThisNoArgsFunctionCall):
1860         (JSC::boundFunctionCall):
1861         (JSC::boundThisNoArgsFunctionConstruct):
1862         (JSC::boundFunctionConstruct):
1863         * runtime/JSCellInlines.h:
1864         (JSC::ExecState::vm):
1865         * runtime/JSCustomGetterSetterFunction.cpp:
1866         (JSC::JSCustomGetterSetterFunction::customGetterSetterFunctionCall):
1867         * runtime/JSFunction.cpp:
1868         (JSC::callHostFunctionAsConstructor):
1869         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
1870         (JSC::constructGenericTypedArrayView):
1871         * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
1872         (JSC::genericTypedArrayViewProtoFuncSlice):
1873         (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
1874         * runtime/JSGlobalObjectFunctions.cpp:
1875         (JSC::globalFuncEval):
1876         * runtime/JSInternalPromiseConstructor.cpp:
1877         (JSC::constructPromise):
1878         * runtime/JSMapIterator.cpp:
1879         (JSC::JSMapIterator::createPair):
1880         (JSC::JSMapIterator::clone):
1881         * runtime/JSNativeStdFunction.cpp:
1882         (JSC::runStdFunction):
1883         * runtime/JSPromiseConstructor.cpp:
1884         (JSC::constructPromise):
1885         * runtime/JSPropertyNameIterator.cpp:
1886         (JSC::JSPropertyNameIterator::clone):
1887         * runtime/JSScope.h:
1888         (JSC::ExecState::lexicalGlobalObject):
1889         * runtime/JSSetIterator.cpp:
1890         (JSC::JSSetIterator::createPair):
1891         (JSC::JSSetIterator::clone):
1892         * runtime/JSStringIterator.cpp:
1893         (JSC::JSStringIterator::clone):
1894         * runtime/MapConstructor.cpp:
1895         (JSC::constructMap):
1896         * runtime/MapPrototype.cpp:
1897         (JSC::mapProtoFuncValues):
1898         (JSC::mapProtoFuncEntries):
1899         (JSC::mapProtoFuncKeys):
1900         (JSC::privateFuncMapIterator):
1901         * runtime/NativeErrorConstructor.cpp:
1902         (JSC::Interpreter::constructWithNativeErrorConstructor):
1903         (JSC::Interpreter::callNativeErrorConstructor):
1904         * runtime/ObjectConstructor.cpp:
1905         (JSC::constructObject):
1906         * runtime/ProxyObject.cpp:
1907         (JSC::performProxyCall):
1908         (JSC::performProxyConstruct):
1909         * runtime/ProxyRevoke.cpp:
1910         (JSC::performProxyRevoke):
1911         * runtime/RegExpConstructor.cpp:
1912         (JSC::constructWithRegExpConstructor):
1913         (JSC::callRegExpConstructor):
1914         * runtime/ScopedArguments.cpp:
1915         (JSC::ScopedArguments::createByCopying):
1916         * runtime/SetConstructor.cpp:
1917         (JSC::constructSet):
1918         * runtime/SetPrototype.cpp:
1919         (JSC::setProtoFuncValues):
1920         (JSC::setProtoFuncEntries):
1921         (JSC::privateFuncSetIterator):
1922         * runtime/StringConstructor.cpp:
1923         (JSC::constructWithStringConstructor):
1924         * runtime/StringPrototype.cpp:
1925         (JSC::stringProtoFuncIterator):
1926         * runtime/WeakMapConstructor.cpp:
1927         (JSC::constructWeakMap):
1928         * runtime/WeakSetConstructor.cpp:
1929         (JSC::constructWeakSet):
1930         * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
1931         (JSC::constructJSWebAssemblyCompileError):
1932         * wasm/js/WebAssemblyFunction.cpp:
1933         (JSC::callWebAssemblyFunction):
1934         * wasm/js/WebAssemblyModuleConstructor.cpp:
1935         (JSC::constructJSWebAssemblyModule):
1936         * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
1937         (JSC::constructJSWebAssemblyRuntimeError):
1938
1939 2016-12-01  Brian Burg  <bburg@apple.com>
1940
1941         Web Inspector: generated code should use a framework-style import for *ProtocolArrayConversions.h
1942         https://bugs.webkit.org/show_bug.cgi?id=165281
1943         <rdar://problem/29427778>
1944
1945         Reviewed by Joseph Pecoraro.
1946
1947         * inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py:
1948         (ObjCProtocolTypeConversionsHeaderGenerator.generate_output):
1949         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
1950         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
1951         * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
1952         * inspector/scripts/tests/expected/enum-values.json-result:
1953         * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
1954         * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
1955         * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
1956         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
1957         * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
1958         * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
1959         * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
1960         * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
1961         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
1962
1963 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
1964
1965         SourceCodeKey should use unlinked source code
1966         https://bugs.webkit.org/show_bug.cgi?id=165286
1967
1968         Reviewed by Saam Barati.
1969
1970         This patch splits out UnlinkedSourceCode from SourceCode, and deploys
1971         UnlinkedSourceCode in SourceCodeKey.
1972
1973         It's misleading to store SourceCode in SourceCodeKey because SourceCode
1974         has an absolute location whereas unlinked cached code has no location.
1975
1976         I plan to deploy UnlinkedSourceCode in more places, to indicate code
1977         that has no absolute location.
1978
1979         * JavaScriptCore.xcodeproj/project.pbxproj:
1980         * parser/SourceCode.cpp:
1981         (JSC::UnlinkedSourceCode::toUTF8):
1982         (JSC::SourceCode::toUTF8): Deleted.
1983         * parser/SourceCode.h:
1984         (JSC::SourceCode::SourceCode):
1985         (JSC::SourceCode::startColumn):
1986         (JSC::SourceCode::isHashTableDeletedValue): Deleted.
1987         (JSC::SourceCode::hash): Deleted.
1988         (JSC::SourceCode::view): Deleted.
1989         (JSC::SourceCode::providerID): Deleted.
1990         (JSC::SourceCode::isNull): Deleted.
1991         (JSC::SourceCode::provider): Deleted.
1992         (JSC::SourceCode::startOffset): Deleted.
1993         (JSC::SourceCode::endOffset): Deleted.
1994         (JSC::SourceCode::length): Deleted. Move a bunch of stuff in to a new
1995         base class, UnlinkedSourceCode.
1996
1997         * parser/SourceCodeKey.h:
1998         (JSC::SourceCodeKey::SourceCodeKey): Use UnlinkedSourceCode since code
1999         in the cache has no location.
2000
2001         * parser/UnlinkedSourceCode.h: Copied from Source/JavaScriptCore/parser/SourceCode.h.
2002         (JSC::UnlinkedSourceCode::UnlinkedSourceCode):
2003         (JSC::UnlinkedSourceCode::provider):
2004         (JSC::SourceCode::SourceCode): Deleted.
2005         (JSC::SourceCode::isHashTableDeletedValue): Deleted.
2006         (JSC::SourceCode::hash): Deleted.
2007         (JSC::SourceCode::view): Deleted.
2008         (JSC::SourceCode::providerID): Deleted.
2009         (JSC::SourceCode::isNull): Deleted.
2010         (JSC::SourceCode::provider): Deleted.
2011         (JSC::SourceCode::firstLine): Deleted.
2012         (JSC::SourceCode::startColumn): Deleted.
2013         (JSC::SourceCode::startOffset): Deleted.
2014         (JSC::SourceCode::endOffset): Deleted.
2015         (JSC::SourceCode::length): Deleted.
2016         (JSC::makeSource): Deleted.
2017         (JSC::SourceCode::subExpression): Deleted.
2018
2019         * runtime/CodeCache.h: Use UnlinkedSourceCode in the cache.
2020
2021 2016-12-01  Keith Miller  <keith_miller@apple.com>
2022
2023         Add wasm int to floating point opcodes
2024         https://bugs.webkit.org/show_bug.cgi?id=165252
2025
2026         Reviewed by Geoffrey Garen.
2027
2028         This patch adds support for the Wasm integral type => floating point
2029         type conversion opcodes. Most of these were already supported by B3
2030         however there was no support for uint64 to float/double. Unfortunately,
2031         AFAIK x86_64 does not have a single instruction that performs this
2032         conversion. Since there is a signed conversion instruction on x86 we
2033         use that for all uint64s that don't have the top bit set. If they do have
2034         the top bit set we need to divide by 2 (rounding up) then convert the number
2035         with the signed conversion then double the result.
2036
2037         * assembler/MacroAssemblerX86_64.h:
2038         (JSC::MacroAssemblerX86_64::convertUInt64ToDouble):
2039         (JSC::MacroAssemblerX86_64::convertUInt64ToFloat):
2040         * jsc.cpp:
2041         (valueWithTypeOfWasmValue):
2042         (box):
2043         (functionTestWasmModuleFunctions):
2044         * wasm/WasmB3IRGenerator.cpp:
2045         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
2046         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
2047         * wasm/WasmFunctionParser.h:
2048         (JSC::Wasm::FunctionParser<Context>::parseExpression):
2049         * wasm/wasm.json:
2050
2051 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
2052
2053         Renamed EvalCodeCache => DirectEvalCodeCache
2054         https://bugs.webkit.org/show_bug.cgi?id=165271
2055
2056         Reviewed by Saam Barati.
2057
2058         We only use this cache for DirectEval, not IndirectEval.
2059
2060         * JavaScriptCore.xcodeproj/project.pbxproj:
2061         * bytecode/CodeBlock.cpp:
2062         (JSC::DirectEvalCodeCache::visitAggregate):
2063         (JSC::CodeBlock::stronglyVisitStrongReferences):
2064         (JSC::EvalCodeCache::visitAggregate): Deleted.
2065         * bytecode/CodeBlock.h:
2066         (JSC::CodeBlock::directEvalCodeCache):
2067         (JSC::CodeBlock::evalCodeCache): Deleted.
2068         * bytecode/DirectEvalCodeCache.h: Copied from Source/JavaScriptCore/bytecode/EvalCodeCache.h.
2069         (JSC::EvalCodeCache::CacheKey::CacheKey): Deleted.
2070         (JSC::EvalCodeCache::CacheKey::hash): Deleted.
2071         (JSC::EvalCodeCache::CacheKey::isEmptyValue): Deleted.
2072         (JSC::EvalCodeCache::CacheKey::operator==): Deleted.
2073         (JSC::EvalCodeCache::CacheKey::isHashTableDeletedValue): Deleted.
2074         (JSC::EvalCodeCache::CacheKey::Hash::hash): Deleted.
2075         (JSC::EvalCodeCache::CacheKey::Hash::equal): Deleted.
2076         (JSC::EvalCodeCache::tryGet): Deleted.
2077         (JSC::EvalCodeCache::set): Deleted.
2078         (JSC::EvalCodeCache::isEmpty): Deleted.
2079         (JSC::EvalCodeCache::clear): Deleted.
2080         * bytecode/EvalCodeCache.h: Removed.
2081         * interpreter/Interpreter.cpp:
2082         (JSC::eval):
2083         * runtime/DirectEvalExecutable.cpp:
2084         (JSC::DirectEvalExecutable::create):
2085
2086 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
2087
2088         Removed some unnecessary indirection in code generation
2089         https://bugs.webkit.org/show_bug.cgi?id=165264
2090
2091         Reviewed by Keith Miller.
2092
2093         There's no need to route through JSGlobalObject when producing code --
2094         it just made the code harder to read.
2095
2096         This patch moves functions from JSGlobalObject to their singleton
2097         call sites.
2098
2099         * runtime/CodeCache.cpp:
2100         (JSC::CodeCache::getUnlinkedEvalCodeBlock):
2101         (JSC::CodeCache::getUnlinkedGlobalEvalCodeBlock): Deleted.
2102         * runtime/CodeCache.h:
2103         * runtime/DirectEvalExecutable.cpp:
2104         (JSC::DirectEvalExecutable::create):
2105         * runtime/IndirectEvalExecutable.cpp:
2106         (JSC::IndirectEvalExecutable::create):
2107         * runtime/JSGlobalObject.cpp:
2108         (JSC::JSGlobalObject::createProgramCodeBlock): Deleted.
2109         (JSC::JSGlobalObject::createLocalEvalCodeBlock): Deleted.
2110         (JSC::JSGlobalObject::createGlobalEvalCodeBlock): Deleted.
2111         (JSC::JSGlobalObject::createModuleProgramCodeBlock): Deleted.
2112         * runtime/JSGlobalObject.h:
2113         * runtime/ModuleProgramExecutable.cpp:
2114         (JSC::ModuleProgramExecutable::create):
2115         * runtime/ProgramExecutable.cpp:
2116         (JSC::ProgramExecutable::initializeGlobalProperties):
2117         * runtime/ProgramExecutable.h:
2118
2119 2016-11-30  Darin Adler  <darin@apple.com>
2120
2121         Roll out StringBuilder changes from the previous patch.
2122         They were a slowdown on a Kraken JSON test.
2123
2124         * runtime/JSONObject.cpp:
2125         Roll out changes from below.
2126
2127 2016-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2128
2129         [JSC] Specifying same module entry point multiple times cause TypeError
2130         https://bugs.webkit.org/show_bug.cgi?id=164858
2131
2132         Reviewed by Saam Barati.
2133
2134         Allow importing the same module multiple times. Previously, when specifying the same
2135         module in the <script type="module" src="here">, it throws TypeError.
2136
2137         * builtins/ModuleLoaderPrototype.js:
2138         (requestFetch):
2139         (requestTranslate):
2140         (requestInstantiate):
2141         (requestSatisfy):
2142
2143 2016-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2144
2145         WebAssembly JS API: export a module namespace object instead of a module environment
2146         https://bugs.webkit.org/show_bug.cgi?id=165121
2147
2148         Reviewed by Saam Barati.
2149
2150         This patch setup AbstractModuleRecord further for WebAssemblyModuleRecord.
2151         For exported entries in a wasm instance, we set up exported entries for
2152         AbstractModuleRecord. This allows us to export WASM exported functions in
2153         the module handling code.
2154
2155         Since the exported entries in the abstract module record are correctly
2156         instantiated, the module namespace object for WASM module also starts
2157         working correctly. So we start exposing the module namespace object
2158         as `instance.exports` instead of the module environment object.
2159
2160         And we move SourceCode, lexicalVariables, and declaredVariables fields to
2161         JSModuleRecord since they are related to JS source code (in the spec words,
2162         they are related to the source text module record).
2163
2164         * runtime/AbstractModuleRecord.cpp:
2165         (JSC::AbstractModuleRecord::AbstractModuleRecord):
2166         * runtime/AbstractModuleRecord.h:
2167         (JSC::AbstractModuleRecord::sourceCode): Deleted.
2168         (JSC::AbstractModuleRecord::declaredVariables): Deleted.
2169         (JSC::AbstractModuleRecord::lexicalVariables): Deleted.
2170         * runtime/JSModuleRecord.cpp:
2171         (JSC::JSModuleRecord::JSModuleRecord):
2172         * runtime/JSModuleRecord.h:
2173         (JSC::JSModuleRecord::sourceCode):
2174         (JSC::JSModuleRecord::declaredVariables):
2175         (JSC::JSModuleRecord::lexicalVariables):
2176         * wasm/WasmFormat.cpp:
2177         * wasm/js/JSWebAssemblyInstance.cpp:
2178         (JSC::JSWebAssemblyInstance::finishCreation):
2179         * wasm/js/WebAssemblyFunction.cpp:
2180         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2181         (JSC::constructJSWebAssemblyInstance):
2182         * wasm/js/WebAssemblyModuleRecord.cpp:
2183         (JSC::WebAssemblyModuleRecord::create):
2184         (JSC::WebAssemblyModuleRecord::WebAssemblyModuleRecord):
2185         (JSC::WebAssemblyModuleRecord::finishCreation):
2186         WebAssemblyModuleRecord::link should perform linking things.
2187         So allocating exported entries should be done here.
2188         (JSC::WebAssemblyModuleRecord::link):
2189         * wasm/js/WebAssemblyModuleRecord.h:
2190
2191 2016-11-30  Mark Lam  <mark.lam@apple.com>
2192
2193         TypeInfo::OutOfLineTypeFlags should be 16 bits in size.
2194         https://bugs.webkit.org/show_bug.cgi?id=165224
2195
2196         Reviewed by Saam Barati.
2197
2198         There's no reason for OutOfLineTypeFlags to be constraint to 8 bits since the
2199         space is available to us.  Making OutOfLineTypeFlags 16 bits brings TypeInfo up
2200         to 32 bits in size from the current 24 bits.
2201
2202         * runtime/JSTypeInfo.h:
2203         (JSC::TypeInfo::TypeInfo):
2204
2205 2016-11-30  Joseph Pecoraro  <pecoraro@apple.com>
2206
2207         REGRESSION: inspector/sampling-profiler/* LayoutTests are flaky timeouts
2208         https://bugs.webkit.org/show_bug.cgi?id=164388
2209         <rdar://problem/29101555>
2210
2211         Reviewed by Saam Barati.
2212
2213         There was a possibility of a deadlock between the main thread and the GC thread
2214         with the SamplingProfiler lock when Inspector is processing samples to send to
2215         the frontend. The Inspector (main thread) was holding the SamplingProfiler lock
2216         while processing samples, which runs JavaScript that could trigger a GC, and
2217         GC then tries to acquire the SamplingProfiler lock to process unprocessed samples.
2218
2219         A simple solution here is to tighten the bounds of when Inspector holds the
2220         SamplingProfiler lock. It only needs the lock when extracting samples from
2221         the SamplingProfiler. It doesn't need to hold the lock for processing those
2222         samples, which is what can run script and cause a GC.
2223
2224         * inspector/agents/InspectorScriptProfilerAgent.cpp:
2225         (Inspector::InspectorScriptProfilerAgent::trackingComplete):
2226         Tighten bounds of this lock to only where it is needed.
2227
2228 2016-11-30  Mark Lam  <mark.lam@apple.com>
2229
2230         Proxy is not allowed in the global prototype chain.
2231         https://bugs.webkit.org/show_bug.cgi?id=165205
2232
2233         Reviewed by Geoffrey Garen.
2234
2235         * runtime/ProgramExecutable.cpp:
2236         (JSC::ProgramExecutable::initializeGlobalProperties):
2237         - We'll now throw a TypeError if we detect a Proxy in the global prototype chain.
2238
2239 2016-11-30  Commit Queue  <commit-queue@webkit.org>
2240
2241         Unreviewed, rolling out r209112.
2242         https://bugs.webkit.org/show_bug.cgi?id=165208
2243
2244         "It regressed Octane/Raytrace and JetStream" (Requested by
2245         saamyjoon on #webkit).
2246
2247         Reverted changeset:
2248
2249         "We should support CreateThis in the FTL"
2250         https://bugs.webkit.org/show_bug.cgi?id=164904
2251         http://trac.webkit.org/changeset/209112
2252
2253 2016-11-30  Darin Adler  <darin@apple.com>
2254
2255         Streamline and speed up tokenizer and segmented string classes
2256         https://bugs.webkit.org/show_bug.cgi?id=165003
2257
2258         Reviewed by Sam Weinig.
2259
2260         * runtime/JSONObject.cpp:
2261         (JSC::Stringifier::appendStringifiedValue): Use viewWithUnderlyingString when calling
2262         StringBuilder::appendQuotedJSONString, since it now takes a StringView and there is
2263         no benefit in creating a String for that function if one doesn't already exist.
2264
2265 2016-11-29  JF Bastien  <jfbastien@apple.com>
2266
2267         WebAssembly JS API: improve Instance
2268         https://bugs.webkit.org/show_bug.cgi?id=164757
2269
2270         Reviewed by Keith Miller.
2271
2272         An Instance's `exports` property wasn't populated with exports.
2273
2274         According to the spec [0], `exports` should present itself as a WebAssembly
2275         Module Record. In order to do this we need to split JSModuleRecord into
2276         AbstractModuleRecord (without the `link` and `evaluate` functions), and
2277         JSModuleRecord (which implements link and evaluate). We can then have a separate
2278         WebAssemblyModuleRecord which shares most of the implementation.
2279
2280         `exports` then maps function names to WebAssemblyFunction and
2281         WebAssemblyFunctionCell, which call into the B3-generated WebAssembly code.
2282
2283         A follow-up patch will do imports.
2284
2285         A few things of note:
2286
2287          - Use Identifier instead of String. They get uniqued, we need them for the JSModuleNamespaceObject. This is safe because JSWebAssemblyModule creation is on the main thread.
2288          - JSWebAssemblyInstance needs to refer to the JSWebAssemblyModule used to create it, because the module owns the code, identifiers, etc. The world would be very sad if it got GC'd.
2289          - Instance.exports shouldn't use putWithoutTransition because it affects all Structures, whereas here each instance needs its own exports.
2290          - Expose the compiled functions, and pipe them to the InstanceConstructor. Start moving things around to split JSModuleRecord out into JS and WebAssembly parts.
2291
2292           [0]: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-constructor
2293
2294         * CMakeLists.txt:
2295         * JavaScriptCore.xcodeproj/project.pbxproj:
2296         * runtime/AbstractModuleRecord.cpp: Copied from Source/JavaScriptCore/runtime/JSModuleRecord.cpp, which I split in two
2297         (JSC::AbstractModuleRecord::AbstractModuleRecord):
2298         (JSC::AbstractModuleRecord::destroy):
2299         (JSC::AbstractModuleRecord::finishCreation):
2300         (JSC::AbstractModuleRecord::visitChildren):
2301         (JSC::AbstractModuleRecord::appendRequestedModule):
2302         (JSC::AbstractModuleRecord::addStarExportEntry):
2303         (JSC::AbstractModuleRecord::addImportEntry):
2304         (JSC::AbstractModuleRecord::addExportEntry):
2305         (JSC::identifierToJSValue):
2306         (JSC::AbstractModuleRecord::hostResolveImportedModule):
2307         (JSC::AbstractModuleRecord::ResolveQuery::ResolveQuery):
2308         (JSC::AbstractModuleRecord::ResolveQuery::isEmptyValue):
2309         (JSC::AbstractModuleRecord::ResolveQuery::isDeletedValue):
2310         (JSC::AbstractModuleRecord::ResolveQuery::Hash::hash):
2311         (JSC::AbstractModuleRecord::ResolveQuery::Hash::equal):
2312         (JSC::AbstractModuleRecord::cacheResolution):
2313         (JSC::getExportedNames):
2314         (JSC::AbstractModuleRecord::getModuleNamespace):
2315         (JSC::printableName):
2316         (JSC::AbstractModuleRecord::dump):
2317         * runtime/AbstractModuleRecord.h: Copied from Source/JavaScriptCore/runtime/JSModuleRecord.h.
2318         (JSC::AbstractModuleRecord::ImportEntry::isNamespace):
2319         (JSC::AbstractModuleRecord::sourceCode):
2320         (JSC::AbstractModuleRecord::moduleKey):
2321         (JSC::AbstractModuleRecord::requestedModules):
2322         (JSC::AbstractModuleRecord::exportEntries):
2323         (JSC::AbstractModuleRecord::importEntries):
2324         (JSC::AbstractModuleRecord::starExportEntries):
2325         (JSC::AbstractModuleRecord::declaredVariables):
2326         (JSC::AbstractModuleRecord::lexicalVariables):
2327         (JSC::AbstractModuleRecord::moduleEnvironment):
2328         * runtime/JSGlobalObject.cpp:
2329         (JSC::JSGlobalObject::init):
2330         (JSC::JSGlobalObject::visitChildren):
2331         * runtime/JSGlobalObject.h:
2332         (JSC::JSGlobalObject::webAssemblyModuleRecordStructure):
2333         (JSC::JSGlobalObject::webAssemblyFunctionStructure):
2334         * runtime/JSModuleEnvironment.cpp:
2335         (JSC::JSModuleEnvironment::create):
2336         (JSC::JSModuleEnvironment::finishCreation):
2337         (JSC::JSModuleEnvironment::getOwnPropertySlot):
2338         (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
2339         (JSC::JSModuleEnvironment::put):
2340         (JSC::JSModuleEnvironment::deleteProperty):
2341         * runtime/JSModuleEnvironment.h:
2342         (JSC::JSModuleEnvironment::create):
2343         (JSC::JSModuleEnvironment::offsetOfModuleRecord):
2344         (JSC::JSModuleEnvironment::allocationSize):
2345         (JSC::JSModuleEnvironment::moduleRecord):
2346         (JSC::JSModuleEnvironment::moduleRecordSlot):
2347         * runtime/JSModuleNamespaceObject.cpp:
2348         (JSC::JSModuleNamespaceObject::finishCreation):
2349         (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
2350         * runtime/JSModuleNamespaceObject.h:
2351         (JSC::JSModuleNamespaceObject::create):
2352         (JSC::JSModuleNamespaceObject::moduleRecord):
2353         * runtime/JSModuleRecord.cpp:
2354         (JSC::JSModuleRecord::createStructure):
2355         (JSC::JSModuleRecord::create):
2356         (JSC::JSModuleRecord::JSModuleRecord):
2357         (JSC::JSModuleRecord::destroy):
2358         (JSC::JSModuleRecord::finishCreation):
2359         (JSC::JSModuleRecord::visitChildren):
2360         (JSC::JSModuleRecord::instantiateDeclarations):
2361         * runtime/JSModuleRecord.h:
2362         * runtime/JSScope.cpp:
2363         (JSC::abstractAccess):
2364         (JSC::JSScope::collectClosureVariablesUnderTDZ):
2365         * runtime/VM.cpp:
2366         (JSC::VM::VM):
2367         * runtime/VM.h:
2368         * wasm/JSWebAssembly.h:
2369         * wasm/WasmFormat.h: use Identifier instead of String
2370         * wasm/WasmModuleParser.cpp:
2371         (JSC::Wasm::ModuleParser::parse):
2372         (JSC::Wasm::ModuleParser::parseType):
2373         (JSC::Wasm::ModuleParser::parseImport): fix off-by-one
2374         (JSC::Wasm::ModuleParser::parseFunction):
2375         (JSC::Wasm::ModuleParser::parseExport):
2376         * wasm/WasmModuleParser.h:
2377         (JSC::Wasm::ModuleParser::ModuleParser):
2378         * wasm/WasmPlan.cpp:
2379         (JSC::Wasm::Plan::run):
2380         * wasm/js/JSWebAssemblyInstance.cpp:
2381         (JSC::JSWebAssemblyInstance::create):
2382         (JSC::JSWebAssemblyInstance::finishCreation):
2383         (JSC::JSWebAssemblyInstance::visitChildren):
2384         * wasm/js/JSWebAssemblyInstance.h:
2385         (JSC::JSWebAssemblyInstance::module):
2386         * wasm/js/JSWebAssemblyModule.cpp:
2387         (JSC::JSWebAssemblyModule::create):
2388         (JSC::JSWebAssemblyModule::finishCreation):
2389         (JSC::JSWebAssemblyModule::visitChildren):
2390         * wasm/js/JSWebAssemblyModule.h:
2391         (JSC::JSWebAssemblyModule::moduleInformation):
2392         (JSC::JSWebAssemblyModule::compiledFunctions):
2393         (JSC::JSWebAssemblyModule::exportSymbolTable):
2394         * wasm/js/WebAssemblyFunction.cpp: Added.
2395         (JSC::callWebAssemblyFunction):
2396         (JSC::WebAssemblyFunction::create):
2397         (JSC::WebAssemblyFunction::createStructure):
2398         (JSC::WebAssemblyFunction::WebAssemblyFunction):
2399         (JSC::WebAssemblyFunction::visitChildren):
2400         (JSC::WebAssemblyFunction::finishCreation):
2401         * wasm/js/WebAssemblyFunction.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h.
2402         (JSC::CallableWebAssemblyFunction::CallableWebAssemblyFunction):
2403         (JSC::WebAssemblyFunction::webAssemblyFunctionCell):
2404         * wasm/js/WebAssemblyFunctionCell.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h.
2405         (JSC::WebAssemblyFunctionCell::create):
2406         (JSC::WebAssemblyFunctionCell::WebAssemblyFunctionCell):
2407         (JSC::WebAssemblyFunctionCell::destroy):
2408         (JSC::WebAssemblyFunctionCell::createStructure):
2409         * wasm/js/WebAssemblyFunctionCell.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h.
2410         (JSC::WebAssemblyFunctionCell::function):
2411         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2412         (JSC::constructJSWebAssemblyInstance):
2413         * wasm/js/WebAssemblyModuleConstructor.cpp:
2414         (JSC::constructJSWebAssemblyModule):
2415         * wasm/js/WebAssemblyModuleRecord.cpp: Added.
2416         (JSC::WebAssemblyModuleRecord::createStructure):
2417         (JSC::WebAssemblyModuleRecord::create):
2418         (JSC::WebAssemblyModuleRecord::WebAssemblyModuleRecord):
2419         (JSC::WebAssemblyModuleRecord::destroy):
2420         (JSC::WebAssemblyModuleRecord::finishCreation):
2421         (JSC::WebAssemblyModuleRecord::visitChildren):
2422         (JSC::WebAssemblyModuleRecord::link):
2423         (JSC::WebAssemblyModuleRecord::evaluate):
2424         * wasm/js/WebAssemblyModuleRecord.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h.
2425
2426 2016-11-29  Saam Barati  <sbarati@apple.com>
2427
2428         We should be able optimize the pattern where we spread a function's rest parameter to another call
2429         https://bugs.webkit.org/show_bug.cgi?id=163865
2430
2431         Reviewed by Filip Pizlo.
2432
2433         This patch optimizes the following patterns to prevent both the allocation
2434         of the rest parameter, and the execution of the iterator protocol:
2435
2436         ```
2437         function foo(...args) {
2438             let arr = [...args];
2439         }
2440
2441         and
2442
2443         function foo(...args) {
2444             bar(...args);
2445         }
2446         ```
2447
2448         To do this, I've extended the arguments elimination phase to reason
2449         about Spread and NewArrayWithSpread. I've added two new nodes, PhantomSpread
2450         and PhantomNewArrayWithSpread. PhantomSpread is only allowed over rest
2451         parameters that don't escape. If the rest parameter *does* escape, we can't
2452         convert the spread into a phantom because it would not be sound w.r.t JS
2453         semantics because we would be reading from the call frame even though
2454         the rest array may have changed.
2455
2456         Note that NewArrayWithSpread also understands what to do when one of its
2457         arguments is PhantomSpread(@PhantomCreateRest) even if it itself is escaped.
2458
2459         PhantomNewArrayWithSpread is only allowed over a series of
2460         PhantomSpread(@PhantomCreateRest) nodes. Like with PhantomSpread, PhantomNewArrayWithSpread
2461         is only allowed if none of its arguments that are being spread are escaped
2462         and if it itself is not escaped.
2463
2464         Because there is a dependency between a node being a candidate and
2465         the escaped state of the node's children, I've extended the notion
2466         of escaping a node inside the arguments elimination phase. Now, when
2467         any node is escaped, we must consider all other candidates that are may
2468         now no longer be valid.
2469
2470         For example:
2471
2472         ```
2473         function foo(...args) {
2474             escape(args);
2475             bar(...args);
2476         }
2477         ```
2478
2479         In the above program, we don't know if the function call to escape()
2480         modifies args, therefore, the spread can not become phantom because
2481         the execution of the spread may not be as simple as reading the
2482         arguments from the call frame.
2483
2484         Unfortunately, the arguments elimination phase does not consider control
2485         flow when doing its escape analysis. It would be good to integrate this
2486         phase with the object allocation sinking phase. To see why, consider
2487         an example where we don't eliminate the spread and allocation of the rest
2488         parameter even though we could:
2489
2490         ```
2491         function foo(rareCondition, ...args) {
2492             bar(...args);
2493             if (rareCondition)
2494                 baz(args);
2495         }
2496         ```
2497
2498         There are only a few users of the PhantomSpread and PhantomNewArrayWithSpread
2499         nodes. PhantomSpread is only used by PhantomNewArrayWithSpread and NewArrayWithSpread.
2500         PhantomNewArrayWithSpread is only used by ForwardVarargs and the various
2501         *Call*ForwardVarargs nodes. The users of these phantoms know how to produce
2502         what the phantom node would have produced. For example, NewArrayWithSpread
2503         knows how to produce the values that would have been produced by PhantomSpread(@PhantomCreateRest)
2504         by directly reading from the call frame.
2505
2506         This patch is a 6% speedup on my MBP on ES6SampleBench.
2507
2508         * b3/B3LowerToAir.cpp:
2509         (JSC::B3::Air::LowerToAir::tryAppendLea):
2510         * b3/B3ValueRep.h:
2511         * builtins/BuiltinExecutables.cpp:
2512         (JSC::BuiltinExecutables::createDefaultConstructor):
2513         * dfg/DFGAbstractInterpreterInlines.h:
2514         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2515         * dfg/DFGArgumentsEliminationPhase.cpp:
2516         * dfg/DFGClobberize.h:
2517         (JSC::DFG::clobberize):
2518         * dfg/DFGDoesGC.cpp:
2519         (JSC::DFG::doesGC):
2520         * dfg/DFGFixupPhase.cpp:
2521         (JSC::DFG::FixupPhase::fixupNode):
2522         * dfg/DFGForAllKills.h:
2523         (JSC::DFG::forAllKillsInBlock):
2524         * dfg/DFGNode.h:
2525         (JSC::DFG::Node::hasConstant):
2526         (JSC::DFG::Node::constant):
2527         (JSC::DFG::Node::bitVector):
2528         (JSC::DFG::Node::isPhantomAllocation):
2529         * dfg/DFGNodeType.h:
2530         * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
2531         (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
2532         (JSC::DFG::LocalOSRAvailabilityCalculator::LocalOSRAvailabilityCalculator):
2533         (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
2534         * dfg/DFGOSRAvailabilityAnalysisPhase.h:
2535         * dfg/DFGObjectAllocationSinkingPhase.cpp:
2536         * dfg/DFGPreciseLocalClobberize.h:
2537         (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
2538         * dfg/DFGPredictionPropagationPhase.cpp:
2539         * dfg/DFGPromotedHeapLocation.cpp:
2540         (WTF::printInternal):
2541         * dfg/DFGPromotedHeapLocation.h:
2542         * dfg/DFGSafeToExecute.h:
2543         (JSC::DFG::safeToExecute):
2544         * dfg/DFGSpeculativeJIT32_64.cpp:
2545         (JSC::DFG::SpeculativeJIT::compile):
2546         * dfg/DFGSpeculativeJIT64.cpp:
2547         (JSC::DFG::SpeculativeJIT::compile):
2548         * dfg/DFGValidate.cpp:
2549         * ftl/FTLCapabilities.cpp:
2550         (JSC::FTL::canCompile):
2551         * ftl/FTLLowerDFGToB3.cpp:
2552         (JSC::FTL::DFG::LowerDFGToB3::LowerDFGToB3):
2553         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
2554         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
2555         (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
2556         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
2557         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
2558         (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
2559         (JSC::FTL::DFG::LowerDFGToB3::getSpreadLengthFromInlineCallFrame):
2560         (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargsWithSpread):
2561         * ftl/FTLOperations.cpp:
2562         (JSC::FTL::operationPopulateObjectInOSR):
2563         (JSC::FTL::operationMaterializeObjectInOSR):
2564         * jit/SetupVarargsFrame.cpp:
2565         (JSC::emitSetupVarargsFrameFastCase):
2566         * jsc.cpp:
2567         (GlobalObject::finishCreation):
2568         (functionMaxArguments):
2569         * runtime/JSFixedArray.h:
2570         (JSC::JSFixedArray::createFromArray):
2571
2572 2016-11-29  Commit Queue  <commit-queue@webkit.org>
2573
2574         Unreviewed, rolling out r209058 and r209074.
2575         https://bugs.webkit.org/show_bug.cgi?id=165188
2576
2577         These changes caused API test StringBuilderTest.Equal to crash
2578         and/or fail. (Requested by ryanhaddad on #webkit).
2579
2580         Reverted changesets:
2581
2582         "Streamline and speed up tokenizer and segmented string
2583         classes"
2584         https://bugs.webkit.org/show_bug.cgi?id=165003
2585         http://trac.webkit.org/changeset/209058
2586
2587         "REGRESSION (r209058): API test StringBuilderTest.Equal
2588         crashing"
2589         https://bugs.webkit.org/show_bug.cgi?id=165142
2590         http://trac.webkit.org/changeset/209074
2591
2592 2016-11-29  Caitlin Potter  <caitp@igalia.com>
2593
2594         [JSC] always wrap AwaitExpression operand in a new Promise
2595         https://bugs.webkit.org/show_bug.cgi?id=165181
2596
2597         Reviewed by Yusuke Suzuki.
2598
2599         Ensure operand of AwaitExpression is wrapped in a new Promise by
2600         explicitly creating a new Promise Capability and invoking its
2601         resolve callback. This avoids the specified short-circuit for
2602         Promise.resolve().
2603
2604         * builtins/AsyncFunctionPrototype.js:
2605         (globalPrivate.asyncFunctionResume):
2606
2607 2016-11-29  Saam Barati  <sbarati@apple.com>
2608
2609         We should support CreateThis in the FTL
2610         https://bugs.webkit.org/show_bug.cgi?id=164904
2611
2612         Reviewed by Geoffrey Garen.
2613
2614         * ftl/FTLAbstractHeapRepository.h:
2615         * ftl/FTLCapabilities.cpp:
2616         (JSC::FTL::canCompile):
2617         * ftl/FTLLowerDFGToB3.cpp:
2618         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
2619         (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
2620         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
2621         (JSC::FTL::DFG::LowerDFGToB3::compileCreateThis):
2622         (JSC::FTL::DFG::LowerDFGToB3::storeStructure):
2623         (JSC::FTL::DFG::LowerDFGToB3::allocateCell):
2624         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
2625         (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
2626         (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
2627         * runtime/Structure.h:
2628
2629 2016-11-29  Mark Lam  <mark.lam@apple.com>
2630
2631         Fix exception scope verification failures in runtime/RegExp* files.
2632         https://bugs.webkit.org/show_bug.cgi?id=165054
2633
2634         Reviewed by Saam Barati.
2635
2636         Also replaced returning JSValue() with returning { }.
2637
2638         * runtime/RegExpConstructor.cpp:
2639         (JSC::toFlags):
2640         (JSC::regExpCreate):
2641         (JSC::constructRegExp):
2642         * runtime/RegExpObject.cpp:
2643         (JSC::RegExpObject::defineOwnProperty):
2644         (JSC::collectMatches):
2645         (JSC::RegExpObject::matchGlobal):
2646         * runtime/RegExpObjectInlines.h:
2647         (JSC::getRegExpObjectLastIndexAsUnsigned):
2648         (JSC::RegExpObject::execInline):
2649         (JSC::RegExpObject::matchInline):
2650         * runtime/RegExpPrototype.cpp:
2651         (JSC::regExpProtoFuncCompile):
2652         (JSC::flagsString):
2653         (JSC::regExpProtoFuncToString):
2654         (JSC::regExpProtoFuncSplitFast):
2655
2656 2016-11-29  Andy Estes  <aestes@apple.com>
2657
2658         [Cocoa] Enable two clang warnings recommended by Xcode
2659         https://bugs.webkit.org/show_bug.cgi?id=164498
2660
2661         Reviewed by Mark Lam.
2662
2663         * Configurations/Base.xcconfig: Enabled CLANG_WARN_INFINITE_RECURSION and CLANG_WARN_SUSPICIOUS_MOVE.
2664
2665 2016-11-29  Keith Miller  <keith_miller@apple.com>
2666
2667         Add simple way to implement Wasm ops that require more than one B3 opcode
2668         https://bugs.webkit.org/show_bug.cgi?id=165129
2669
2670         Reviewed by Geoffrey Garen.
2671
2672         This patch adds a simple way to show the B3IRGenerator opcode script how
2673         to generate code for Wasm opcodes that do not have a one to one mapping.
2674         The syntax is pretty simple right now. There are only three things one
2675         can use as of this patch (although more things might be added in the future)
2676         1) Wasm opcode arguments: These are referred to as @<argument_number>. For example,
2677            I32.sub would map to Sub(@0, @1).
2678         2) 32-bit int constants: These are reffered to as i32(<value>). For example, i32.inc
2679            would map to Add(@0, i32(1))
2680         3) B3 opcodes: These are referred to as the B3 opcode name followed by the B3Value's constructor
2681            arguments. A value may take the result of another value as an argument. For example, you can do
2682            Div(Mul(@0, Add(@0, i32(1))), i32(2)) if there was a b3 opcode that computed the sum from 1 to n.
2683
2684         These scripts are used to implement Wasm's eqz and floating point max/min opcodes. This patch
2685         also adds missing support for the Wasm Neg opcodes.
2686
2687         * jsc.cpp:
2688         (box):
2689         (functionTestWasmModuleFunctions):
2690         * wasm/WasmB3IRGenerator.cpp:
2691         (JSC::Wasm::toB3Op): Deleted.
2692         * wasm/WasmFunctionParser.h:
2693         (JSC::Wasm::FunctionParser<Context>::parseBody):
2694         * wasm/WasmModuleParser.cpp:
2695         (JSC::Wasm::ModuleParser::parseType):
2696         * wasm/WasmParser.h:
2697         (JSC::Wasm::Parser::parseUInt8):
2698         (JSC::Wasm::Parser::parseValueType):
2699         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
2700         (Source):
2701         (Source.__init__):
2702         (read):
2703         (lex):
2704         (CodeGenerator):
2705         (CodeGenerator.__init__):
2706         (CodeGenerator.advance):
2707         (CodeGenerator.token):
2708         (CodeGenerator.parseError):
2709         (CodeGenerator.consume):
2710         (CodeGenerator.generateParameters):
2711         (CodeGenerator.generateOpcode):
2712         (CodeGenerator.generate):
2713         (temp):
2714         (generateB3OpCode):
2715         (generateI32ConstCode):
2716         (generateB3Code):
2717         (generateSimpleCode):
2718         * wasm/wasm.json:
2719
2720 2016-11-29  Mark Lam  <mark.lam@apple.com>
2721
2722         Fix exception scope verification failures in ProxyConstructor.cpp and ProxyObject.cpp.
2723         https://bugs.webkit.org/show_bug.cgi?id=165053
2724
2725         Reviewed by Saam Barati.
2726
2727         Also replaced returning JSValue() with returning { }.
2728
2729         * runtime/ProxyConstructor.cpp:
2730         (JSC::constructProxyObject):
2731         * runtime/ProxyObject.cpp:
2732         (JSC::ProxyObject::structureForTarget):
2733         (JSC::performProxyGet):
2734         (JSC::ProxyObject::performInternalMethodGetOwnProperty):
2735         (JSC::ProxyObject::performHasProperty):
2736         (JSC::ProxyObject::getOwnPropertySlotCommon):
2737         (JSC::ProxyObject::performPut):
2738         (JSC::ProxyObject::putByIndexCommon):
2739         (JSC::performProxyCall):
2740         (JSC::performProxyConstruct):
2741         (JSC::ProxyObject::performDelete):
2742         (JSC::ProxyObject::performPreventExtensions):
2743         (JSC::ProxyObject::performIsExtensible):
2744         (JSC::ProxyObject::performDefineOwnProperty):
2745         (JSC::ProxyObject::performGetOwnPropertyNames):
2746         (JSC::ProxyObject::performSetPrototype):
2747         (JSC::ProxyObject::performGetPrototype):
2748
2749 2016-11-28  Matt Baker  <mattbaker@apple.com>
2750
2751         Web Inspector: Debugger should have an option for showing asynchronous call stacks
2752         https://bugs.webkit.org/show_bug.cgi?id=163230
2753         <rdar://problem/28698683>
2754
2755         Reviewed by Joseph Pecoraro.
2756
2757         * inspector/ScriptCallFrame.cpp:
2758         (Inspector::ScriptCallFrame::isNative):
2759         Encapsulate check for native code source URL.
2760
2761         * inspector/ScriptCallFrame.h:
2762         * inspector/ScriptCallStack.cpp:
2763         (Inspector::ScriptCallStack::firstNonNativeCallFrame):
2764         (Inspector::ScriptCallStack::buildInspectorArray):
2765         * inspector/ScriptCallStack.h:
2766         Replace use of Console::StackTrace with Array<Console::CallFrame>.
2767
2768         * inspector/agents/InspectorDebuggerAgent.cpp:
2769         (Inspector::InspectorDebuggerAgent::disable):
2770         (Inspector::InspectorDebuggerAgent::setAsyncStackTraceDepth):
2771         Set number of async frames to store (including boundary frames).
2772         A value of zero disables recording of async call stacks.
2773
2774         (Inspector::InspectorDebuggerAgent::buildAsyncStackTrace):
2775         Helper function for building a linked list StackTraces.
2776         (Inspector::InspectorDebuggerAgent::didScheduleAsyncCall):
2777         Store a call stack for the script that scheduled the async call.
2778         If the call repeats (e.g. setInterval), the starting reference count is
2779         set to 1. This ensures that dereffing after dispatch won't clear the stack.
2780         If another async call is currently being dispatched, increment the
2781         AsyncCallData reference count for that call.
2782
2783         (Inspector::InspectorDebuggerAgent::didCancelAsyncCall):
2784         Decrement the reference count for the canceled call.
2785
2786         (Inspector::InspectorDebuggerAgent::willDispatchAsyncCall):
2787         Set the identifier for the async callback currently being dispatched,
2788         so that if the debugger pauses during dispatch a stack trace can be
2789         associated with the pause location. If an async call is already being
2790         dispatched, which could be the case when a script schedules an async
2791         call in a nested runloop, do nothing.
2792
2793         (Inspector::InspectorDebuggerAgent::didDispatchAsyncCall):
2794         Decrement the reference count for the canceled call.
2795         (Inspector::InspectorDebuggerAgent::didPause):
2796         If a stored stack trace exists for this location, convert to a protocol
2797         object and send to the frontend.
2798
2799         (Inspector::InspectorDebuggerAgent::didClearGlobalObject):
2800         (Inspector::InspectorDebuggerAgent::clearAsyncStackTraceData):
2801         (Inspector::InspectorDebuggerAgent::refAsyncCallData):
2802         Increment AsyncCallData reference count.
2803         (Inspector::InspectorDebuggerAgent::derefAsyncCallData):
2804         Decrement AsyncCallData reference count. If zero, deref its parent
2805         (if it exists) and remove the AsyncCallData entry.
2806
2807         * inspector/agents/InspectorDebuggerAgent.h:
2808
2809         * inspector/protocol/Console.json:
2810         * inspector/protocol/Network.json:
2811         Replace use of Console.StackTrace with array of Console.CallFrame.
2812
2813         * inspector/protocol/Debugger.json:
2814         New protocol command and event data.
2815
2816 2016-11-28  Darin Adler  <darin@apple.com>
2817
2818         Streamline and speed up tokenizer and segmented string classes
2819         https://bugs.webkit.org/show_bug.cgi?id=165003
2820
2821         Reviewed by Sam Weinig.
2822
2823         * runtime/JSONObject.cpp:
2824         (JSC::Stringifier::appendStringifiedValue): Use viewWithUnderlyingString when calling
2825         StringBuilder::appendQuotedJSONString, since it now takes a StringView and there is
2826         no benefit in creating a String for that function if one doesn't already exist.
2827
2828 2016-11-21  Mark Lam  <mark.lam@apple.com>
2829
2830         Fix exception scope verification failures in runtime/Intl* files.
2831         https://bugs.webkit.org/show_bug.cgi?id=165014
2832
2833         Reviewed by Saam Barati.
2834
2835         * runtime/IntlCollatorConstructor.cpp:
2836         (JSC::constructIntlCollator):
2837         (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
2838         * runtime/IntlCollatorPrototype.cpp:
2839         (JSC::IntlCollatorPrototypeFuncResolvedOptions):
2840         * runtime/IntlDateTimeFormatConstructor.cpp:
2841         (JSC::constructIntlDateTimeFormat):
2842         (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
2843         * runtime/IntlDateTimeFormatPrototype.cpp:
2844         (JSC::IntlDateTimeFormatFuncFormatDateTime):
2845         (JSC::IntlDateTimeFormatPrototypeGetterFormat):
2846         (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
2847         * runtime/IntlNumberFormatConstructor.cpp:
2848         (JSC::constructIntlNumberFormat):
2849         (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
2850         * runtime/IntlNumberFormatPrototype.cpp:
2851         (JSC::IntlNumberFormatFuncFormatNumber):
2852         (JSC::IntlNumberFormatPrototypeGetterFormat):
2853         (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
2854         * runtime/IntlObject.cpp:
2855         (JSC::lookupSupportedLocales):
2856         * runtime/IntlObjectInlines.h:
2857         (JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):
2858
2859 2016-11-28  Mark Lam  <mark.lam@apple.com>
2860
2861         Fix exception scope verification failures in IteratorOperations.h.
2862         https://bugs.webkit.org/show_bug.cgi?id=165015
2863
2864         Reviewed by Saam Barati.
2865
2866         * runtime/IteratorOperations.h:
2867         (JSC::forEachInIterable):
2868
2869 2016-11-28  Mark Lam  <mark.lam@apple.com>
2870
2871         Fix exception scope verification failures in JSArray* files.
2872         https://bugs.webkit.org/show_bug.cgi?id=165016
2873
2874         Reviewed by Saam Barati.
2875
2876         * runtime/JSArray.cpp:
2877         (JSC::JSArray::defineOwnProperty):
2878         (JSC::JSArray::put):
2879         (JSC::JSArray::setLength):
2880         (JSC::JSArray::pop):
2881         (JSC::JSArray::push):
2882         (JSC::JSArray::unshiftCountWithAnyIndexingType):
2883         * runtime/JSArrayBuffer.cpp:
2884         (JSC::JSArrayBuffer::put):
2885         (JSC::JSArrayBuffer::defineOwnProperty):
2886         * runtime/JSArrayInlines.h:
2887         (JSC::getLength):
2888         (JSC::toLength):
2889
2890 2016-11-28  Mark Lam  <mark.lam@apple.com>
2891
2892         Fix exception scope verification failures in JSDataView.cpp.
2893         https://bugs.webkit.org/show_bug.cgi?id=165020
2894
2895         Reviewed by Saam Barati.
2896
2897         * runtime/JSDataView.cpp:
2898         (JSC::JSDataView::put):
2899
2900 2016-11-28  Mark Lam  <mark.lam@apple.com>
2901
2902         Fix exception scope verification failures in JSFunction.cpp.
2903         https://bugs.webkit.org/show_bug.cgi?id=165021
2904
2905         Reviewed by Saam Barati.
2906
2907         * runtime/JSFunction.cpp:
2908         (JSC::JSFunction::put):
2909         (JSC::JSFunction::defineOwnProperty):
2910
2911 2016-11-28  Mark Lam  <mark.lam@apple.com>
2912
2913         Fix exception scope verification failures in runtime/JSGenericTypedArrayView* files.
2914         https://bugs.webkit.org/show_bug.cgi?id=165022
2915
2916         Reviewed by Saam Barati.
2917
2918         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
2919         (JSC::constructGenericTypedArrayViewFromIterator):
2920         (JSC::constructGenericTypedArrayViewWithArguments):
2921         (JSC::constructGenericTypedArrayView):
2922         * runtime/JSGenericTypedArrayViewInlines.h:
2923         (JSC::JSGenericTypedArrayView<Adaptor>::set):
2924         (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
2925         * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
2926         (JSC::speciesConstruct):
2927         (JSC::genericTypedArrayViewProtoFuncSet):
2928         (JSC::genericTypedArrayViewProtoFuncJoin):
2929         (JSC::genericTypedArrayViewProtoFuncSlice):
2930         (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
2931
2932 2016-11-28  Mark Lam  <mark.lam@apple.com>
2933
2934         Fix exception scope verification failures in runtime/Operations.cpp/h.
2935         https://bugs.webkit.org/show_bug.cgi?id=165046
2936
2937         Reviewed by Saam Barati.
2938
2939         Also switched to using returning { } instead of JSValue().
2940
2941         * runtime/Operations.cpp:
2942         (JSC::jsAddSlowCase):
2943         (JSC::jsIsObjectTypeOrNull):
2944         * runtime/Operations.h:
2945         (JSC::jsStringFromRegisterArray):
2946         (JSC::jsStringFromArguments):
2947         (JSC::jsLess):
2948         (JSC::jsLessEq):
2949
2950 2016-11-28  Mark Lam  <mark.lam@apple.com>
2951
2952         Fix exception scope verification failures in JSScope.cpp.
2953         https://bugs.webkit.org/show_bug.cgi?id=165047
2954
2955         Reviewed by Saam Barati.
2956
2957         * runtime/JSScope.cpp:
2958         (JSC::JSScope::resolve):
2959
2960 2016-11-28  Mark Lam  <mark.lam@apple.com>
2961
2962         Fix exception scope verification failures in JSTypedArrayViewPrototype.cpp.
2963         https://bugs.webkit.org/show_bug.cgi?id=165049
2964
2965         Reviewed by Saam Barati.
2966
2967         * runtime/JSTypedArrayViewPrototype.cpp:
2968         (JSC::typedArrayViewPrivateFuncSort):
2969         (JSC::typedArrayViewProtoFuncSet):
2970         (JSC::typedArrayViewProtoFuncCopyWithin):
2971         (JSC::typedArrayViewProtoFuncIncludes):
2972         (JSC::typedArrayViewProtoFuncLastIndexOf):
2973         (JSC::typedArrayViewProtoFuncIndexOf):
2974         (JSC::typedArrayViewProtoFuncJoin):
2975         (JSC::typedArrayViewProtoGetterFuncBuffer):
2976         (JSC::typedArrayViewProtoGetterFuncLength):
2977         (JSC::typedArrayViewProtoGetterFuncByteLength):
2978         (JSC::typedArrayViewProtoGetterFuncByteOffset):
2979         (JSC::typedArrayViewProtoFuncReverse):
2980         (JSC::typedArrayViewPrivateFuncSubarrayCreate):
2981         (JSC::typedArrayViewProtoFuncSlice):
2982
2983 2016-11-28  Mark Lam  <mark.lam@apple.com>
2984
2985         Fix exception scope verification failures in runtime/Map* files.
2986         https://bugs.webkit.org/show_bug.cgi?id=165050
2987
2988         Reviewed by Saam Barati.
2989
2990         * runtime/MapConstructor.cpp:
2991         (JSC::constructMap):
2992         * runtime/MapIteratorPrototype.cpp:
2993         (JSC::MapIteratorPrototypeFuncNext):
2994         * runtime/MapPrototype.cpp:
2995         (JSC::privateFuncMapIteratorNext):
2996
2997 2016-11-28  Mark Lam  <mark.lam@apple.com>
2998
2999         Fix exception scope verification failures in more miscellaneous files.
3000         https://bugs.webkit.org/show_bug.cgi?id=165102
3001
3002         Reviewed by Saam Barati.
3003
3004         * wasm/js/WebAssemblyInstanceConstructor.cpp:
3005         (JSC::constructJSWebAssemblyInstance):
3006
3007 2016-11-28  Mark Lam  <mark.lam@apple.com>
3008
3009         Fix exception scope verification failures in runtime/Weak* files.
3010         https://bugs.webkit.org/show_bug.cgi?id=165096
3011
3012         Reviewed by Geoffrey Garen.
3013
3014         * runtime/WeakMapConstructor.cpp:
3015         (JSC::constructWeakMap):
3016         * runtime/WeakMapPrototype.cpp:
3017         (JSC::protoFuncWeakMapSet):
3018         * runtime/WeakSetConstructor.cpp:
3019         (JSC::constructWeakSet):
3020         * runtime/WeakSetPrototype.cpp:
3021         (JSC::protoFuncWeakSetAdd):
3022
3023 2016-11-28  Mark Lam  <mark.lam@apple.com>
3024
3025         Fix exception scope verification failures in runtime/String* files.
3026         https://bugs.webkit.org/show_bug.cgi?id=165067
3027
3028         Reviewed by Saam Barati.
3029
3030         * runtime/StringConstructor.cpp:
3031         (JSC::stringFromCodePoint):
3032         (JSC::constructWithStringConstructor):
3033         * runtime/StringObject.cpp:
3034         (JSC::StringObject::put):
3035         (JSC::StringObject::putByIndex):
3036         (JSC::StringObject::defineOwnProperty):
3037         * runtime/StringPrototype.cpp:
3038         (JSC::jsSpliceSubstrings):
3039         (JSC::jsSpliceSubstringsWithSeparators):
3040         (JSC::replaceUsingRegExpSearch):
3041         (JSC::replaceUsingStringSearch):
3042         (JSC::repeatCharacter):
3043         (JSC::replace):
3044         (JSC::stringProtoFuncReplaceUsingStringSearch):
3045         (JSC::stringProtoFuncCharAt):
3046         (JSC::stringProtoFuncCodePointAt):
3047         (JSC::stringProtoFuncConcat):
3048         (JSC::stringProtoFuncIndexOf):
3049         (JSC::stringProtoFuncLastIndexOf):
3050         (JSC::splitStringByOneCharacterImpl):
3051         (JSC::stringProtoFuncSplitFast):
3052         (JSC::stringProtoFuncSubstring):
3053         (JSC::stringProtoFuncToLowerCase):
3054         (JSC::stringProtoFuncToUpperCase):
3055         (JSC::toLocaleCase):
3056         (JSC::trimString):
3057         (JSC::stringProtoFuncIncludes):
3058         (JSC::builtinStringIncludesInternal):
3059         (JSC::stringProtoFuncIterator):
3060         (JSC::normalize):
3061         (JSC::stringProtoFuncNormalize):
3062
3063 2016-11-28  Mark Lam  <mark.lam@apple.com>
3064
3065         Fix exception scope verification failures in ObjectConstructor.cpp and ObjectPrototype.cpp.
3066         https://bugs.webkit.org/show_bug.cgi?id=165051
3067
3068         Reviewed by Saam Barati.
3069
3070         Also,
3071         1. Replaced returning JSValue() with returning { }.
3072         2. Replaced uses of exec->propertyNames() with vm.propertyNames.
3073
3074         * runtime/ObjectConstructor.cpp:
3075         (JSC::constructObject):
3076         (JSC::objectConstructorGetPrototypeOf):
3077         (JSC::objectConstructorGetOwnPropertyDescriptor):
3078         (JSC::objectConstructorGetOwnPropertyDescriptors):
3079         (JSC::objectConstructorGetOwnPropertyNames):
3080         (JSC::objectConstructorGetOwnPropertySymbols):
3081         (JSC::objectConstructorKeys):
3082         (JSC::ownEnumerablePropertyKeys):
3083         (JSC::toPropertyDescriptor):
3084         (JSC::defineProperties):
3085         (JSC::objectConstructorDefineProperties):
3086         (JSC::objectConstructorCreate):
3087         (JSC::setIntegrityLevel):
3088         (JSC::objectConstructorSeal):
3089         (JSC::objectConstructorPreventExtensions):
3090         (JSC::objectConstructorIsSealed):
3091         (JSC::objectConstructorIsFrozen):
3092         (JSC::ownPropertyKeys):
3093         * runtime/ObjectPrototype.cpp:
3094         (JSC::objectProtoFuncValueOf):
3095         (JSC::objectProtoFuncHasOwnProperty):
3096         (JSC::objectProtoFuncIsPrototypeOf):
3097         (JSC::objectProtoFuncDefineGetter):
3098         (JSC::objectProtoFuncDefineSetter):
3099         (JSC::objectProtoFuncLookupGetter):
3100         (JSC::objectProtoFuncLookupSetter):
3101         (JSC::objectProtoFuncToLocaleString):
3102         (JSC::objectProtoFuncToString):
3103
3104 2016-11-26  Mark Lam  <mark.lam@apple.com>
3105
3106         Fix exception scope verification failures in miscellaneous files.
3107         https://bugs.webkit.org/show_bug.cgi?id=165055
3108
3109         Reviewed by Saam Barati.
3110
3111         * runtime/MathObject.cpp:
3112         (JSC::mathProtoFuncIMul):
3113         * runtime/ModuleLoaderPrototype.cpp:
3114         (JSC::moduleLoaderPrototypeParseModule):
3115         (JSC::moduleLoaderPrototypeRequestedModules):
3116         * runtime/NativeErrorConstructor.cpp:
3117         (JSC::Interpreter::constructWithNativeErrorConstructor):
3118         * runtime/NumberConstructor.cpp:
3119         (JSC::constructWithNumberConstructor):
3120         * runtime/SetConstructor.cpp:
3121         (JSC::constructSet):
3122         * runtime/SetIteratorPrototype.cpp:
3123         (JSC::SetIteratorPrototypeFuncNext):
3124         * runtime/SparseArrayValueMap.cpp:
3125         (JSC::SparseArrayValueMap::putEntry):
3126         (JSC::SparseArrayEntry::put):
3127         * runtime/TemplateRegistry.cpp:
3128         (JSC::TemplateRegistry::getTemplateObject):
3129
3130 2016-11-28  Mark Lam  <mark.lam@apple.com>
3131
3132         Fix exception scope verification failures in ReflectObject.cpp.
3133         https://bugs.webkit.org/show_bug.cgi?id=165066
3134
3135         Reviewed by Saam Barati.
3136
3137         * runtime/ReflectObject.cpp:
3138         (JSC::reflectObjectConstruct):
3139         (JSC::reflectObjectDefineProperty):
3140         (JSC::reflectObjectEnumerate):
3141         (JSC::reflectObjectGet):
3142         (JSC::reflectObjectGetOwnPropertyDescriptor):
3143         (JSC::reflectObjectGetPrototypeOf):
3144         (JSC::reflectObjectOwnKeys):
3145         (JSC::reflectObjectSet):
3146
3147 2016-11-24  Mark Lam  <mark.lam@apple.com>
3148
3149         Fix exception scope verification failures in ArrayConstructor.cpp and ArrayPrototype.cpp.
3150         https://bugs.webkit.org/show_bug.cgi?id=164972
3151
3152         Reviewed by Geoffrey Garen.
3153
3154         * runtime/ArrayConstructor.cpp:
3155         (JSC::constructArrayWithSizeQuirk):
3156         * runtime/ArrayPrototype.cpp:
3157         (JSC::getProperty):
3158         (JSC::putLength):
3159         (JSC::speciesWatchpointsValid):
3160         (JSC::speciesConstructArray):
3161         (JSC::shift):
3162         (JSC::unshift):
3163         (JSC::arrayProtoFuncToString):
3164         (JSC::arrayProtoFuncToLocaleString):
3165         (JSC::slowJoin):
3166         (JSC::fastJoin):
3167         (JSC::arrayProtoFuncJoin):
3168         (JSC::arrayProtoFuncPop):
3169         (JSC::arrayProtoFuncPush):
3170         (JSC::arrayProtoFuncReverse):
3171         (JSC::arrayProtoFuncShift):
3172         (JSC::arrayProtoFuncSlice):
3173         (JSC::arrayProtoFuncSplice):
3174         (JSC::arrayProtoFuncUnShift):
3175         (JSC::arrayProtoFuncIndexOf):
3176         (JSC::arrayProtoFuncLastIndexOf):
3177         (JSC::concatAppendOne):
3178         (JSC::arrayProtoPrivateFuncConcatMemcpy):
3179         (JSC::ArrayPrototype::attemptToInitializeSpeciesWatchpoint):
3180
3181 2016-11-28  Mark Lam  <mark.lam@apple.com>
3182
3183         Fix exception scope verification failures in LLIntSlowPaths.cpp.
3184         https://bugs.webkit.org/show_bug.cgi?id=164969
3185
3186         Reviewed by Geoffrey Garen.
3187
3188         * llint/LLIntSlowPaths.cpp:
3189         (JSC::LLInt::getByVal):
3190         (JSC::LLInt::setUpCall):
3191         (JSC::LLInt::varargsSetup):
3192         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3193
3194 2016-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3195
3196         [WTF] Import std::optional reference implementation as WTF::Optional
3197         https://bugs.webkit.org/show_bug.cgi?id=164199
3198
3199         Reviewed by Saam Barati and Sam Weinig.
3200
3201         Previous WTF::Optional::operator= is not compatible to std::optional::operator=.
3202         std::optional::emplace has the same semantics to the previous one.
3203         So we change the code to use it.
3204
3205         * Scripts/builtins/builtins_templates.py:
3206         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
3207         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
3208         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
3209         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
3210         * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
3211         * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
3212         * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
3213         * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
3214         * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
3215         * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
3216         * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
3217         * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
3218         * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
3219         * assembler/MacroAssemblerARM64.h:
3220         (JSC::MacroAssemblerARM64::commuteCompareToZeroIntoTest):
3221         * assembler/MacroAssemblerX86Common.h:
3222         (JSC::MacroAssemblerX86Common::commuteCompareToZeroIntoTest):
3223         * b3/B3CheckSpecial.cpp:
3224         (JSC::B3::CheckSpecial::forEachArg):
3225         (JSC::B3::CheckSpecial::shouldTryAliasingDef):
3226         * b3/B3CheckSpecial.h:
3227         * b3/B3LowerToAir.cpp:
3228         (JSC::B3::Air::LowerToAir::scaleForShl):
3229         (JSC::B3::Air::LowerToAir::effectiveAddr):
3230         (JSC::B3::Air::LowerToAir::tryAppendLea):
3231         * b3/B3Opcode.cpp:
3232         (JSC::B3::invertedCompare):
3233         * b3/B3Opcode.h:
3234         * b3/B3PatchpointSpecial.cpp:
3235         (JSC::B3::PatchpointSpecial::forEachArg):
3236         * b3/B3StackmapSpecial.cpp:
3237         (JSC::B3::StackmapSpecial::forEachArgImpl):
3238         * b3/B3StackmapSpecial.h:
3239         * b3/B3Value.cpp:
3240         (JSC::B3::Value::invertedCompare):
3241         * b3/air/AirArg.h:
3242         (JSC::B3::Air::Arg::isValidScale):
3243         (JSC::B3::Air::Arg::isValidAddrForm):
3244         (JSC::B3::Air::Arg::isValidIndexForm):
3245         (JSC::B3::Air::Arg::isValidForm):
3246         * b3/air/AirCustom.h:
3247         (JSC::B3::Air::PatchCustom::shouldTryAliasingDef):
3248         * b3/air/AirFixObviousSpills.cpp:
3249         * b3/air/AirInst.h:
3250         * b3/air/AirInstInlines.h:
3251         (JSC::B3::Air::Inst::shouldTryAliasingDef):
3252         * b3/air/AirIteratedRegisterCoalescing.cpp:
3253         * b3/air/AirSpecial.cpp:
3254         (JSC::B3::Air::Special::shouldTryAliasingDef):
3255         * b3/air/AirSpecial.h:
3256         * bytecode/BytecodeGeneratorification.cpp:
3257         (JSC::BytecodeGeneratorification::storageForGeneratorLocal):
3258         * bytecode/CodeBlock.cpp:
3259         (JSC::CodeBlock::findPC):
3260         (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex):
3261         * bytecode/CodeBlock.h:
3262         * bytecode/UnlinkedFunctionExecutable.cpp:
3263         (JSC::UnlinkedFunctionExecutable::link):
3264         * bytecode/UnlinkedFunctionExecutable.h:
3265         * bytecompiler/BytecodeGenerator.h:
3266         * bytecompiler/NodesCodegen.cpp:
3267         (JSC::PropertyListNode::emitPutConstantProperty):
3268         (JSC::ObjectPatternNode::bindValue):
3269         * debugger/Debugger.cpp:
3270         (JSC::Debugger::resolveBreakpoint):
3271         * debugger/DebuggerCallFrame.cpp:
3272         (JSC::DebuggerCallFrame::currentPosition):
3273         * debugger/DebuggerParseData.cpp:
3274         (JSC::DebuggerPausePositions::breakpointLocationForLineColumn):
3275         * debugger/DebuggerParseData.h:
3276         * debugger/ScriptProfilingScope.h:
3277         * dfg/DFGAbstractInterpreterInlines.h:
3278         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3279         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeDoubleUnaryOpEffects):
3280         * dfg/DFGJITCode.cpp:
3281         (JSC::DFG::JITCode::findPC):
3282         * dfg/DFGJITCode.h:
3283         * dfg/DFGOperations.cpp:
3284         (JSC::DFG::operationPutByValInternal):
3285         * dfg/DFGSlowPathGenerator.h:
3286         (JSC::DFG::SlowPathGenerator::generate):
3287         * dfg/DFGSpeculativeJIT.cpp:
3288         (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
3289         (JSC::DFG::SpeculativeJIT::emitUntypedBitOp):
3290         (JSC::DFG::SpeculativeJIT::emitUntypedRightShiftBitOp):
3291         (JSC::DFG::SpeculativeJIT::compileMathIC):
3292         (JSC::DFG::SpeculativeJIT::compileArithDiv):
3293         (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
3294         * dfg/DFGSpeculativeJIT.h:
3295         * dfg/DFGSpeculativeJIT32_64.cpp:
3296         (JSC::DFG::SpeculativeJIT::compile):
3297         * dfg/DFGSpeculativeJIT64.cpp:
3298         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
3299         (JSC::DFG::SpeculativeJIT::emitBranch):
3300         (JSC::DFG::SpeculativeJIT::compile):
3301         * dfg/DFGStrengthReductionPhase.cpp:
3302         (JSC::DFG::StrengthReductionPhase::handleNode):
3303         * ftl/FTLJITCode.cpp:
3304         (JSC::FTL::JITCode::findPC):
3305         * ftl/FTLJITCode.h:
3306         * heap/Heap.cpp:
3307         (JSC::Heap::collectAsync):
3308         (JSC::Heap::collectSync):
3309         (JSC::Heap::collectInThread):
3310         (JSC::Heap::requestCollection):
3311         (JSC::Heap::willStartCollection):
3312         (JSC::Heap::didFinishCollection):
3313         (JSC::Heap::shouldDoFullCollection):
3314         * heap/Heap.h:
3315         (JSC::Heap::collectionScope):
3316         * heap/HeapSnapshot.cpp:
3317         (JSC::HeapSnapshot::nodeForCell):
3318         (JSC::HeapSnapshot::nodeForObjectIdentifier):
3319         * heap/HeapSnapshot.h:
3320         * inspector/InspectorBackendDispatcher.cpp:
3321         (Inspector::BackendDispatcher::dispatch):
3322         (Inspector::BackendDispatcher::sendPendingErrors):
3323         (Inspector::BackendDispatcher::reportProtocolError):
3324         * inspector/InspectorBackendDispatcher.h:
3325         * inspector/agents/InspectorHeapAgent.cpp:
3326         (Inspector::InspectorHeapAgent::nodeForHeapObjectIdentifier):
3327         (Inspector::InspectorHeapAgent::getPreview):
3328         (Inspector::InspectorHeapAgent::getRemoteObject):
3329         * inspector/agents/InspectorHeapAgent.h:
3330         * inspector/remote/RemoteConnectionToTarget.h:
3331         * inspector/remote/RemoteConnectionToTarget.mm:
3332         (Inspector::RemoteConnectionToTarget::targetIdentifier):
3333         (Inspector::RemoteConnectionToTarget::setup):
3334         * inspector/remote/RemoteInspector.h:
3335         * inspector/remote/RemoteInspector.mm:
3336         (Inspector::RemoteInspector::updateClientCapabilities):
3337         * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
3338         (_generate_declarations_for_enum_conversion_methods):
3339         (_generate_declarations_for_enum_conversion_methods.return_type_with_export_macro):
3340         * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
3341         (CppProtocolTypesImplementationGenerator._generate_enum_conversion_methods_for_domain.generate_conversion_method_body):
3342         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
3343         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
3344         * inspector/scripts/tests/expected/enum-values.json-result:
3345         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
3346         * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
3347         * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
3348         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
3349         * jit/JITCode.h:
3350         (JSC::JITCode::findPC):
3351         * jit/JITDivGenerator.cpp:
3352         (JSC::JITDivGenerator::generateFastPath):
3353         * jit/JITOperations.cpp:
3354         * jit/PCToCodeOriginMap.cpp:
3355         (JSC::PCToCodeOriginMap::findPC):
3356         * jit/PCToCodeOriginMap.h:
3357         * jsc.cpp:
3358         (WTF::RuntimeArray::getOwnPropertySlot):
3359         * llint/LLIntSlowPaths.cpp:
3360         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3361         * parser/ModuleAnalyzer.cpp:
3362         (JSC::ModuleAnalyzer::exportVariable):
3363         * runtime/ConcurrentJSLock.h:
3364         (JSC::ConcurrentJSLocker::ConcurrentJSLocker):
3365         * runtime/DefinePropertyAttributes.h:
3366         (JSC::DefinePropertyAttributes::writable):
3367         (JSC::DefinePropertyAttributes::configurable):
3368         (JSC::DefinePropertyAttributes::enumerable):
3369         * runtime/GenericArgumentsInlines.h:
3370         (JSC::GenericArguments<Type>::getOwnPropertySlot):
3371         (JSC::GenericArguments<Type>::put):
3372         (JSC::GenericArguments<Type>::deleteProperty):
3373         (JSC::GenericArguments<Type>::defineOwnProperty):
3374         * runtime/HasOwnPropertyCache.h:
3375         (JSC::HasOwnPropertyCache::get):
3376         * runtime/HashMapImpl.h:
3377         (JSC::concurrentJSMapHash):
3378         * runtime/Identifier.h:
3379         (JSC::parseIndex):
3380         * runtime/JSArray.cpp:
3381         (JSC::JSArray::defineOwnProperty):
3382         * runtime/JSCJSValue.cpp:
3383         (JSC::JSValue::toNumberFromPrimitive):
3384         (JSC::JSValue::putToPrimitive):
3385         * runtime/JSCJSValue.h:
3386         * runtime/JSGenericTypedArrayView.h:
3387         (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValueWithoutCoercion):
3388         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
3389         (JSC::constructGenericTypedArrayViewWithArguments):
3390         (JSC::constructGenericTypedArrayView):
3391         * runtime/JSGenericTypedArrayViewInlines.h:
3392         (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
3393         (JSC::JSGenericTypedArrayView<Adaptor>::put):
3394         * runtime/JSModuleRecord.cpp:
3395         * runtime/JSModuleRecord.h:
3396         * runtime/JSObject.cpp:
3397         (JSC::JSObject::putDirectAccessor):
3398         (JSC::JSObject::deleteProperty):
3399         (JSC::JSObject::putDirectMayBeIndex):
3400         (JSC::JSObject::defineOwnProperty):
3401         * runtime/JSObject.h:
3402         (JSC::JSObject::getOwnPropertySlot):
3403         (JSC::JSObject::getPropertySlot):
3404         (JSC::JSObject::putOwnDataPropertyMayBeIndex):
3405         * runtime/JSObjectInlines.h:
3406         (JSC::JSObject::putInline):
3407         * runtime/JSString.cpp:
3408         (JSC::JSString::getStringPropertyDescriptor):
3409         * runtime/JSString.h:
3410         (JSC::JSString::getStringPropertySlot):
3411         * runtime/LiteralParser.cpp:
3412         (JSC::LiteralParser<CharType>::parse):
3413         * runtime/MathCommon.h:
3414         (JSC::safeReciprocalForDivByConst):
3415         * runtime/ObjectPrototype.cpp:
3416         (JSC::objectProtoFuncHasOwnProperty):
3417         * runtime/PropertyDescriptor.h:
3418         (JSC::toPropertyDescriptor):
3419         * runtime/PropertyName.h:
3420         (JSC::parseIndex):
3421         * runtime/SamplingProfiler.cpp:
3422         (JSC::SamplingProfiler::processUnverifiedStackTraces):
3423         * runtime/StringObject.cpp:
3424         (JSC::StringObject::put):
3425         (JSC::isStringOwnProperty):
3426         (JSC::StringObject::deleteProperty):
3427         * runtime/ToNativeFromValue.h:
3428         (JSC::toNativeFromValueWithoutCoercion):
3429         * runtime/TypedArrayAdaptors.h:
3430         (JSC::IntegralTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
3431         (JSC::IntegralTypedArrayAdaptor::toNativeFromUint32WithoutCoercion):
3432         (JSC::IntegralTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
3433         (JSC::FloatTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
3434         (JSC::FloatTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
3435         (JSC::Uint8ClampedAdaptor::toNativeFromInt32WithoutCoercion):
3436         (JSC::Uint8ClampedAdaptor::toNativeFromDoubleWithoutCoercion):
3437
3438 2016-11-26  Sam Weinig  <sam@webkit.org>
3439
3440         Convert IntersectionObserver over to using RuntimeEnabledFeatures so it can be properly excluded from script
3441         https://bugs.webkit.org/show_bug.cgi?id=164965
3442
3443         Reviewed by Simon Fraser.
3444
3445         * runtime/CommonIdentifiers.h:
3446         Add identifiers needed for RuntimeEnabledFeatures.
3447
3448 2016-11-23  Zan Dobersek  <zdobersek@igalia.com>
3449
3450         Remove ENABLE_ASSEMBLER_WX_EXCLUSIVE code
3451         https://bugs.webkit.org/show_bug.cgi?id=165027
3452
3453         Reviewed by Darin Adler.
3454
3455         Remove the code guarded with ENABLE(ASSEMBLER_WX_EXCLUSIVE).
3456         No port enables this and the guarded code doesn't build at all,
3457         so it's safe to say it's abandoned.
3458
3459         * jit/ExecutableAllocator.cpp:
3460         (JSC::ExecutableAllocator::initializeAllocator):
3461         (JSC::ExecutableAllocator::ExecutableAllocator):
3462         (JSC::ExecutableAllocator::reprotectRegion): Deleted.
3463
3464 2016-11-18  Mark Lam  <mark.lam@apple.com>
3465
3466         Fix exception scope verification failures in JSC profiler files.
3467         https://bugs.webkit.org/show_bug.cgi?id=164971
3468
3469         Reviewed by Saam Barati.
3470
3471         * profiler/ProfilerBytecodeSequence.cpp:
3472         (JSC::Profiler::BytecodeSequence::addSequenceProperties):
3473         * profiler/ProfilerCompilation.cpp:
3474         (JSC::Profiler::Compilation::toJS):
3475         * profiler/ProfilerDatabase.cpp:
3476         (JSC::Profiler::Database::toJS):
3477         (JSC::Profiler::Database::toJSON):
3478         * profiler/ProfilerOSRExitSite.cpp:
3479         (JSC::Profiler::OSRExitSite::toJS):
3480         * profiler/ProfilerOriginStack.cpp:
3481         (JSC::Profiler::OriginStack::toJS):
3482
3483 2016-11-22  Mark Lam  <mark.lam@apple.com>
3484
3485         Fix exception scope verification failures in JSONObject.cpp.
3486         https://bugs.webkit.org/show_bug.cgi?id=165025
3487
3488         Reviewed by Saam Barati.
3489
3490         * runtime/JSONObject.cpp:
3491         (JSC::gap):
3492         (JSC::Stringifier::Stringifier):
3493         (JSC::Stringifier::stringify):
3494         (JSC::Stringifier::toJSON):
3495         (JSC::Stringifier::appendStringifiedValue):
3496         (JSC::Stringifier::Holder::appendNextProperty):
3497         (JSC::Walker::walk):
3498         (JSC::JSONProtoFuncParse):
3499         (JSC::JSONProtoFuncStringify):
3500         (JSC::JSONStringify):
3501
3502 2016-11-21  Mark Lam  <mark.lam@apple.com>
3503
3504         Removed an extra space character at the end of line.
3505
3506         Not reviewed.
3507
3508         * runtime/JSCell.cpp:
3509         (JSC::JSCell::toNumber):
3510
3511 2016-11-21  Mark Lam  <mark.lam@apple.com>
3512
3513         Fix exception scope verification failures in FunctionConstructor.cpp.
3514         https://bugs.webkit.org/show_bug.cgi?id=165011
3515
3516         Reviewed by Saam Barati.
3517
3518         * runtime/FunctionConstructor.cpp:
3519         (JSC::constructFunction):
3520         (JSC::constructFunctionSkippingEvalEnabledCheck):
3521
3522 2016-11-21  Mark Lam  <mark.lam@apple.com>
3523
3524         Fix exception scope verification failures in GetterSetter.cpp.
3525         https://bugs.webkit.org/show_bug.cgi?id=165013
3526
3527         Reviewed by Saam Barati.
3528
3529         * runtime/GetterSetter.cpp:
3530         (JSC::callGetter):
3531         (JSC::callSetter):
3532
3533 2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3534
3535         Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
3536         https://bugs.webkit.org/show_bug.cgi?id=164898
3537
3538         Reviewed by Darin Adler.
3539
3540         The callsite object (JSArray) of tagged template literal is managed by WeakGCMap since
3541         same tagged template literal need to return an identical object.
3542         The problem is that we used TemplateRegistryKey as the key of the WeakGCMap. WeakGCMap
3543         can prune its entries in the collector thread. At that time, this TemplateRegistryKey
3544         is deallocated. Since it includes String (and then, StringImpl), we accidentally call
3545         ref(), deref() and StringImpl::destroy() in the different thread from the main thread
3546         while this TemplateRegistryKey is allocated in the main thread.
3547
3548         Instead, we use TemplateRegistryKey* as the key of WeakGCMap. Then, to keep its liveness
3549         while the entry of the WeakGCMap is alive, the callsite object has the reference to
3550         the JSTemplateRegistryKey. And it holds Ref<TemplateRegistryKey>.
3551
3552         And now we need to lookup WeakGCMap with TemplateRegistryKey*. To do so, we create
3553         interning system for TemplateRegistryKey. It is similar to AtomicStringTable and
3554         SymbolRegistry. TemplateRegistryKey is allocated from this table. This table atomize the
3555         TemplateRegistryKey. So we can use the pointer comparison between TemplateRegistryKey.
3556         It allows us to lookup the entry from WeakGCMap by TemplateRegistryKey*.
3557
3558         * CMakeLists.txt:
3559         * JavaScriptCore.xcodeproj/project.pbxproj:
3560         * builtins/BuiltinNames.h:
3561         * bytecompiler/BytecodeGenerator.cpp:
3562         (JSC::BytecodeGenerator::addTemplateRegistryKeyConstant):
3563         (JSC::BytecodeGenerator::emitGetTemplateObject):
3564         * bytecompiler/BytecodeGenerator.h:
3565         * runtime/JSGlobalObject.cpp:
3566         (JSC::getTemplateObject):
3567         * runtime/JSTemplateRegistryKey.cpp:
3568         (JSC::JSTemplateRegistryKey::JSTemplateRegistryKey):
3569         (JSC::JSTemplateRegistryKey::create):
3570         * runtime/JSTemplateRegistryKey.h:
3571         * runtime/TemplateRegistry.cpp:
3572         (JSC::TemplateRegistry::getTemplateObject):
3573         * runtime/TemplateRegistry.h:
3574         * runtime/TemplateRegistryKey.cpp: Copied from Source/JavaScriptCore/runtime/TemplateRegistry.h.
3575         (JSC::TemplateRegistryKey::~TemplateRegistryKey):
3576         * runtime/TemplateRegistryKey.h:
3577         (JSC::TemplateRegistryKey::calculateHash):
3578         (JSC::TemplateRegistryKey::create):
3579         (JSC::TemplateRegistryKey::TemplateRegistryKey):
3580         * runtime/TemplateRegistryKeyTable.cpp: Added.
3581         (JSC::TemplateRegistryKeyTranslator::hash):
3582         (JSC::TemplateRegistryKeyTranslator::equal):
3583         (JSC::TemplateRegistryKeyTranslator::translate):
3584         (JSC::TemplateRegistryKeyTable::~TemplateRegistryKeyTable):
3585         (JSC::TemplateRegistryKeyTable::createKey):
3586         (JSC::TemplateRegistryKeyTable::unregister):
3587         * runtime/TemplateRegistryKeyTable.h: Copied from Source/JavaScriptCore/runtime/JSTemplateRegistryKey.h.
3588         (JSC::TemplateRegistryKeyTable::KeyHash::hash):
3589         (JSC::TemplateRegistryKeyTable::KeyHash::equal):
3590         * runtime/VM.h:
3591         (JSC::VM::templateRegistryKeyTable):
3592
3593 2016-11-21  Mark Lam  <mark.lam@apple.com>
3594
3595         Fix exception scope verification failures in runtime/Error* files.
3596         https://bugs.webkit.org/show_bug.cgi?id=164998
3597
3598         Reviewed by Darin Adler.
3599
3600         * runtime/ErrorConstructor.cpp:
3601         (JSC::Interpreter::constructWithErrorConstructor):
3602         * runtime/ErrorInstance.cpp:
3603         (JSC::ErrorInstance::create):
3604         * runtime/ErrorInstance.h:
3605         * runtime/ErrorPrototype.cpp:
3606         (JSC::errorProtoFuncToString):
3607
3608 2016-11-21  Mark Lam  <mark.lam@apple.com>
3609
3610         Fix exception scope verification failures in *Executable.cpp files.
3611         https://bugs.webkit.org/show_bug.cgi?id=164996
3612
3613         Reviewed by Darin Adler.
3614
3615         * runtime/DirectEvalExecutable.cpp:
3616         (JSC::DirectEvalExecutable::create):
3617         * runtime/IndirectEvalExecutable.cpp:
3618         (JSC::IndirectEvalExecutable::create):
3619         * runtime/ProgramExecutable.cpp:
3620         (JSC::ProgramExecutable::initializeGlobalProperties):
3621         * runtime/ScriptExecutable.cpp:
3622         (JSC::ScriptExecutable::prepareForExecutionImpl):
3623
3624 2016-11-20  Zan Dobersek  <zdobersek@igalia.com>
3625
3626         [EncryptedMedia] Make EME API runtime-enabled
3627         https://bugs.webkit.org/show_bug.cgi?id=164927
3628
3629         Reviewed by Jer Noble.
3630
3631         * runtime/CommonIdentifiers.h: Add the necessary identifiers.
3632
3633 2016-11-20  Mark Lam  <mark.lam@apple.com>
3634
3635         Fix exception scope verification failures in ConstructData.cpp.
3636         https://bugs.webkit.org/show_bug.cgi?id=164976
3637
3638         Reviewed by Darin Adler.
3639
3640         * runtime/ConstructData.cpp:
3641         (JSC::construct):
3642
3643 2016-11-20  Mark Lam  <mark.lam@apple.com>
3644
3645         Fix exception scope verification failures in CommonSlowPaths.cpp/h.
3646         https://bugs.webkit.org/show_bug.cgi?id=164975
3647
3648         Reviewed by Darin Adler.
3649
3650         * runtime/CommonSlowPaths.cpp:
3651         (JSC::SLOW_PATH_DECL):
3652         * runtime/CommonSlowPaths.h:
3653         (JSC::CommonSlowPaths::opIn):
3654
3655 2016-11-20  Mark Lam  <mark.lam@apple.com>
3656
3657         Fix exception scope verification failures in DateConstructor.cpp and DatePrototype.cpp.
3658         https://bugs.webkit.org/show_bug.cgi?id=164995
3659
3660         Reviewed by Darin Adler.
3661
3662         * runtime/DateConstructor.cpp:
3663         (JSC::millisecondsFromComponents):
3664         (JSC::constructDate):
3665         * runtime/DatePrototype.cpp:
3666         (JSC::dateProtoFuncToPrimitiveSymbol):
3667
3668 2016-11-20  Caitlin Potter  <caitp@igalia.com>
3669
3670         [JSC] speed up parsing of async functions
3671         https://bugs.webkit.org/show_bug.cgi?id=164808
3672
3673         Reviewed by Yusuke Suzuki.
3674
3675         Minor adjustments to Parser in order to mitigate slowdown with async
3676         function parsing enabled:
3677
3678           - Tokenize "async" as a keyword
3679           - Perform less branching in various areas of the Parser
3680
3681         * parser/Keywords.table:
3682         * parser/Parser.cpp:
3683         (JSC::Parser<LexerType>::parseStatementListItem):
3684         (JSC::Parser<LexerType>::parseStatement):
3685         (JSC::Parser<LexerType>::maybeParseAsyncFunctionDeclarationStatement):
3686         (JSC::Parser<LexerType>::parseClass):
3687         (JSC::Parser<LexerType>::parseExportDeclaration):
3688         (JSC::Parser<LexerType>::parseAssignmentExpression):
3689         (JSC::Parser<LexerType>::parseProperty):
3690         (JSC::Parser<LexerType>::createResolveAndUseVariable):
3691         (JSC::Parser<LexerType>::parsePrimaryExpression):
3692         (JSC::Parser<LexerType>::parseMemberExpression):
3693         (JSC::Parser<LexerType>::printUnexpectedTokenText):
3694         * parser/Parser.h:
3695         (JSC::isAnyContextualKeyword):
3696         (JSC::isIdentifierOrAnyContextualKeyword):
3697         (JSC::isSafeContextualKeyword):
3698         (JSC::Parser::matchSpecIdentifier):
3699         * parser/ParserTokens.h:
3700         * runtime/CommonIdentifiers.h:
3701
3702 2016-11-19  Mark Lam  <mark.lam@apple.com>
3703
3704         Add --timeoutMultiplier option to allow some tests more time to run.
3705         https://bugs.webkit.org/show_bug.cgi?id=164951
3706
3707         Reviewed by Yusuke Suzuki.
3708
3709         * jsc.cpp:
3710         (timeoutThreadMain):
3711         - Modified to factor in a timeout multiplier that can adjust the timeout duration.
3712         (startTimeoutThreadIfNeeded):
3713         - Moved the code that starts the timeout thread here from main() so that we can
3714         call it after command line args have been parsed instead.
3715         (main):
3716         - Deleted old timeout thread starting code.
3717         (CommandLine::parseArguments):
3718         - Added parsing of the --timeoutMultiplier option.
3719         (jscmain):
3720         - Start the timeout thread if needed after we've parsed the command line args.
3721
3722 2016-11-19  Mark Lam  <mark.lam@apple.com>
3723
3724         Fix missing exception checks in JSC inspector files.
3725         https://bugs.webkit.org/show_bug.cgi?id=164959
3726
3727         Reviewed by Saam Barati.
3728
3729         * inspector/JSInjectedScriptHost.cpp:
3730         (Inspector::JSInjectedScriptHost::getInternalProperties):
3731         (Inspector::JSInjectedScriptHost::weakMapEntries):
3732         (Inspector::JSInjectedScriptHost::weakSetEntries):
3733         (Inspector::JSInjectedScriptHost::iteratorEntries):
3734         * inspector/JSJavaScriptCallFrame.cpp:
3735         (Inspector::JSJavaScriptCallFrame::scopeDescriptions):
3736
3737 2016-11-18  Mark Lam  <mark.lam@apple.com>
3738
3739         Fix missing exception checks in DFGOperations.cpp.
3740         https://bugs.webkit.org/show_bug.cgi?id=164958
3741
3742         Reviewed by Geoffrey Garen.
3743
3744         * dfg/DFGOperations.cpp:
3745
3746 2016-11-18  Mark Lam  <mark.lam@apple.com>
3747
3748         Fix exception scope verification failures in ShadowChicken.cpp.
3749         https://bugs.webkit.org/show_bug.cgi?id=164966
3750
3751         Reviewed by Saam Barati.
3752
3753         * interpreter/ShadowChicken.cpp:
3754         (JSC::ShadowChicken::functionsOnStack):
3755
3756 2016-11-18  Jeremy Jones  <jeremyj@apple.com>
3757
3758         Add runtime flag to enable pointer lock. Enable pointer lock feature for mac.
3759         https://bugs.webkit.org/show_bug.cgi?id=163801
3760
3761         Reviewed by Simon Fraser.
3762
3763         * Configurations/FeatureDefines.xcconfig:
3764
3765 2016-11-18  Filip Pizlo  <fpizlo@apple.com>
3766
3767         Unreviewed, fix cloop.
3768
3769         * bytecode/CodeBlock.cpp:
3770         (JSC::CodeBlock::stronglyVisitStrongReferences):
3771
3772 2016-11-18  Filip Pizlo  <fpizlo@apple.com>
3773
3774         Concurrent GC should be able to run splay in debug mode and earley/raytrace in release mode with no perf regression
3775         https://bugs.webkit.org/show_bug.cgi?id=164282
3776
3777         Reviewed by Geoffrey Garen and Oliver Hunt.
3778
3779         The two three remaining bugs were:
3780
3781         - Improper ordering inside putDirectWithoutTransition() and friends. We need to make sure
3782           that the GC doesn't see the store to Structure::m_offset until we've resized the butterfly.
3783           That proved a bit tricky. On the other hand, this means that we could probably remove the
3784           requirement that the GC holds the Structure lock in some cases. I haven't removed that lock
3785           yet because I still think it might protect some weird cases, and it doesn't seem to cost us
3786           anything.
3787
3788         - CodeBlock's GC strategy needed to be made thread-safe (visitWeakly, visitChildren, and
3789           their friends now hold locks) and incremental-safe (we need to update predictions in the
3790           finalizer to make sure we clear anything that was put into a value profile towards the end
3791           of GC).
3792
3793         - The GC timeslicing scheduler needed to be made a bit more aggressive to deal with
3794           generational workloads like earley, raytrace, and CDjs. Once I got those benchmarks to run,
3795           I found that they would do many useless iterations of GC because they wouldn't pause long
3796           enough after rescanning weak references and roots. I added a bunch of knobs for forcing a
3797           pause. In the end, I realized that I could get the desired effect by putting a ceiling on
3798           mutator utilization. We want the GC to finish quickly if it is possible to do so, even if
3799           the amount of allocation that the mutator had done is low. Having a utilization ceiling
3800           seems to accomplish this for benchmarks with trivial heaps (earley and raytrace) as well as
3801           huge heaps (like CDjs in its "large" configuration).
3802
3803         This preserves splay performance, makes the concurrent GC more stable, and makes the
3804         concurrent GC not a perf regression on earley or raytrace. It seems to give us great CDjs
3805         performance as well, but this is still hard to tell because we crash a lot in that benchmark.
3806
3807         * bytecode/CodeBlock.cpp:
3808         (JSC::CodeBlock::CodeBlock):
3809         (JSC::CodeBlock::visitWeakly):
3810         (JSC::CodeBlock::visitChildren):
3811         (JSC::CodeBlock::shouldVisitStrongly):
3812         (JSC::CodeBlock::shouldJettisonDueToOldAge):
3813         (JSC::CodeBlock::propagateTransitions):
3814         (JSC::CodeBlock::determineLiveness):
3815         (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences):
3816         (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally):
3817         (JSC::CodeBlock::visitOSRExitTargets):
3818         (JSC::CodeBlock::stronglyVisitStrongReferences):
3819         (JSC::CodeBlock::stronglyVisitWeakReferences):
3820         * bytecode/CodeBlock.h:
3821         (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled):
3822         * heap/CodeBlockSet.cpp:
3823         (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
3824         * heap/Heap.cpp:
3825         (JSC::Heap::ResumeTheWorldScope::ResumeTheWorldScope):
3826         (JSC::Heap::markToFixpoint):
3827         (JSC::Heap::beginMarking):
3828         (JSC::Heap::addToRememberedSet):
3829         (JSC::Heap::collectInThread):
3830         * heap/Heap.h:
3831         * heap/HeapInlines.h:
3832         (JSC::Heap::mutatorFence):
3833         * heap/MarkedBlock.cpp:
3834         * runtime/JSCellInlines.h:
3835         (JSC::JSCell::finishCreation):
3836         * runtime/JSObjectInlines.h:
3837         (JSC::JSObject::putDirectWithoutTransition):
3838         (JSC::JSObject::putDirectInternal):
3839         * runtime/Options.h:
3840         * runtime/Structure.cpp:
3841         (JSC::Structure::add):
3842         * runtime/Structure.h:
3843         * runtime/StructureInlines.h:
3844         (JSC::Structure::add):
3845
3846 2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
3847
3848         Web Inspector: Generator functions should have a displayable name when shown in stack traces
3849         https://bugs.webkit.org/show_bug.cgi?id=164844
3850         <rdar://problem/29300697>
3851
3852         Reviewed by Yusuke Suzuki.
3853
3854         * parser/SyntaxChecker.h:
3855         (JSC::SyntaxChecker::createGeneratorFunctionBody):
3856         * parser/ASTBuilder.h:
3857         (JSC::ASTBuilder::createGeneratorFunctionBody):
3858         New way to create a generator function with an inferred name.
3859
3860         * parser/Parser.cpp:
3861         (JSC::Parser<LexerType>::parseInner):
3862         (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
3863         * parser/Parser.h:
3864         Pass on the name of the generator wrapper function so we can
3865         use it on the inner generator function.
3866
3867 2016-11-17  Ryosuke Niwa  <rniwa@webkit.org>
3868
3869         Add an experimental API to find elements across shadow boundaries
3870         https://bugs.webkit.org/show_bug.cgi?id=164851
3871         <rdar://problem/28220092>
3872
3873         Reviewed by Sam Weinig.
3874
3875         * runtime/CommonIdentifiers.h:
3876
3877 2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
3878
3879         [JSC] Drop arguments.caller
3880         https://bugs.webkit.org/show_bug.cgi?id=164859
3881
3882         Reviewed by Saam Barati.
3883
3884         Originally, some JavaScript engine has `arguments.caller` property.
3885         But it easily causes some information leaks and it becomes obstacles
3886         for secure ECMAScript (SES). In ES5, we make it deprecated in strict
3887         mode. To do so, we explicitly set "caller" getter throwing TypeError
3888         to arguments in strict mode.
3889
3890         But now, there is no modern engine which supports `arguments.caller`
3891         in sloppy mode. So the original compatibility problem is gone and
3892         "caller" getter in the strict mode arguments becomes meaningless.
3893
3894         ES2017 drops this from the spec. In this patch, we also drop this
3895         `arguments.caller` in strict mode support.
3896
3897         Note that Function#caller is still alive.
3898
3899         * runtime/ClonedArguments.cpp:
3900         (JSC::ClonedArguments::getOwnPropertySlot):
3901         (JSC::ClonedArguments::put):
3902         (JSC::ClonedArguments::deleteProperty):
3903         (JSC::ClonedArguments::defineOwnProperty):
3904         (JSC::ClonedArguments::materializeSpecials):
3905
3906 2016-11-17  Mark Lam  <mark.lam@apple.com>
3907
3908         Inlining should be disallowed when JSC_alwaysUseShadowChicken=true.
3909         https://bugs.webkit.org/show_bug.cgi?id=164893
3910         <rdar://problem/29146436>
3911
3912         Reviewed by Saam Barati.
3913
3914         * runtime/Options.cpp:
3915         (JSC::recomputeDependentOptions):
3916
3917 2016-11-17  Filip Pizlo  <fpizlo@apple.com>
3918
3919         Speculatively disable eager object zero-fill on not-x86 to let the bots decide if that's a problem
3920         https://bugs.webkit.org/show_bug.cgi?id=164885
3921
3922         Reviewed by Mark Lam.
3923
3924         This adds a useGCFences() function that we use to guard all eager object zero-fill and the
3925         related fences. It currently returns true only on x86().
3926
3927         The goal here is to get the bots to tell us if this code is responsible for perf issues on
3928         any non-x86 platforms. We have a few different paths that we can pursue if this turns out
3929         to be the case. Eager zero-fill is merely the easiest way to optimize out some fences, but
3930         we could get rid of it and instead teach B3 how to think about fences.
3931
3932         * assembler/CPU.h:
3933         (JSC::useGCFences):
3934         * bytecode/PolymorphicAccess.cpp:
3935         (JSC::AccessCase::generateImpl):
3936         * dfg/DFGSpeculativeJIT.cpp:
3937         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
3938         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
3939         * ftl/FTLLowerDFGToB3.cpp:
3940         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
3941         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
3942         (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
3943         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
3944         (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
3945         (JSC::FTL::DFG::LowerDFGToB3::setButterfly):
3946         * jit/AssemblyHelpers.h:
3947         (JSC::AssemblyHelpers::mutatorFence):
3948         (JSC::AssemblyHelpers::storeButterfly):
3949         (JSC::AssemblyHelpers::emitInitializeInlineStorage):
3950         (JSC::AssemblyHelpers::emitInitializeOutOfLineStorage):
3951
3952 2016-11-17  Keith Miller  <keith_miller@apple.com>
3953
3954         Add rotate to Wasm
3955         https://bugs.webkit.org/show_bug.cgi?id=164871
3956
3957         Reviewed by Filip Pizlo.