Source/JavaScriptCore/ChangeLog

   1 2016-01-18  Csaba Osztrogonác  <ossy@webkit.org>
   2
   3         [cmake] Add testair to the build system
   4         https://bugs.webkit.org/show_bug.cgi?id=153126
   5
   6         Reviewed by Michael Catanzaro.
   7
   8         * shell/CMakeLists.txt:
   9
  10 2016-01-17  Jeremy Huddleston Sequoia  <jeremyhu@apple.com>
  11
  12         Ensure that CF_AVAILABLE is undefined when building webkit-gtk
  13
  14         https://bugs.webkit.org/show_bug.cgi?id=152720
  15
  16         This change ensures that CF_AVAILABLE is correctly a no-op to
  17         address build failure that was observed when building on older
  18         versions of OSX.  Previously, CF_AVAILABLE may have been unexpectedly
  19         re-defined to the system header value based on include-order.
  20
  21         Reviewed by Michael Catanzaro.
  22
  23         * API/WebKitAvailability.h:
  24
  25 2016-01-17  Julien Brianceau  <jbriance@cisco.com>
  26
  27         [mips] Fix regT2 and regT3 trampling in MacroAssembler
  28         https://bugs.webkit.org/show_bug.cgi?id=153131
  29
  30         Mips $t2 and $t3 registers were used as temporary registers
  31         in MacroAssemblerMIPS.h, whereas they are mapped to regT2
  32         and regT3 in LLInt and GPRInfo.
  33
  34         This patch rearranges register mapping for the mips architecture:
  35         - use $t0 and $t1 as temp registers in LLInt (as in MacroAssembler)
  36         - use $t7 and $t8 as temp registers in MacroAssembler (as in LLInt)
  37         - remove $t6 from temp registers list in LLInt
  38         - update GPRInfo.h accordingly
  39         - add mips macroScratchRegisters() list in RegisterSet.cpp
  40
  41         Reviewed by Michael Saboff.
  42
  43         * assembler/MacroAssemblerMIPS.h:
  44         * jit/GPRInfo.h:
  45         (JSC::GPRInfo::toRegister):
  46         (JSC::GPRInfo::toIndex):
  47         * jit/RegisterSet.cpp:
  48         (JSC::RegisterSet::macroScratchRegisters):
  49         (JSC::RegisterSet::calleeSaveRegisters):
  50         * offlineasm/mips.rb:
  51
  52 2016-01-16  Skachkov Oleksandr  <gskachkov@gmail.com>
  53
  54         [ES6] Arrow function syntax. Arrow function should support the destructuring parameters.
  55         https://bugs.webkit.org/show_bug.cgi?id=146934
  56
  57         Reviewed by Saam Barati.
  58
  59         Added support of destructuring parameters, before arrow function expect only simple parameters,
  60         e.g. (), (x), (x, y) or x in assigment expressio. To support destructuring parameters added
  61         additional check that check for destructuring paramters if check does not pass for simple parameters.
  62
  63         * parser/Parser.cpp:
  64         (JSC::Parser<LexerType>::isArrowFunctionParameters):
  65         (JSC::Parser<LexerType>::parseAssignmentExpression):
  66         * parser/Parser.h:
  67
  68 2016-01-15  Benjamin Poulain  <bpoulain@apple.com>
  69
  70         [JSC] Legalize Memory Offsets for ARM64 before lowering to Air
  71         https://bugs.webkit.org/show_bug.cgi?id=153065
  72
  73         Reviewed by Mark Lam.
  74         Reviewed by Filip Pizlo.
  75
  76         On ARM64, we cannot use signed 32bits offset for memory addressing.
  77         There are two available addressing: signed 9bits and unsigned scaled 12bits.
  78         Air already knows about it.
  79
  80         In this patch, the offsets are changed to something valid for ARM64
  81         prior to lowering. When an offset is invalid, it is just computed
  82         before the instruction and used as the base for addressing.
  83
  84         * JavaScriptCore.xcodeproj/project.pbxproj:
  85         * b3/B3Generate.cpp:
  86         (JSC::B3::generateToAir):
  87         * b3/B3LegalizeMemoryOffsets.cpp: Added.
  88         (JSC::B3::legalizeMemoryOffsets):
  89         * b3/B3LegalizeMemoryOffsets.h: Added.
  90         * b3/B3LowerToAir.cpp:
  91         (JSC::B3::Air::LowerToAir::effectiveAddr): Deleted.
  92         * b3/testb3.cpp:
  93         (JSC::B3::testLoadWithOffsetImpl):
  94         (JSC::B3::testLoadOffsetImm9Max):
  95         (JSC::B3::testLoadOffsetImm9MaxPlusOne):
  96         (JSC::B3::testLoadOffsetImm9MaxPlusTwo):
  97         (JSC::B3::testLoadOffsetImm9Min):
  98         (JSC::B3::testLoadOffsetImm9MinMinusOne):
  99         (JSC::B3::testLoadOffsetScaledUnsignedImm12Max):
 100         (JSC::B3::testLoadOffsetScaledUnsignedOverImm12Max):
 101         (JSC::B3::run):
 102
 103 2016-01-15  Alex Christensen  <achristensen@webkit.org>
 104
 105         Fix internal Windows build
 106         https://bugs.webkit.org/show_bug.cgi?id=153142
 107
 108         Reviewed by Brent Fulgham.
 109
 110         The internal Windows build builds JavaScriptCore from a directory that is not called JavaScriptCore.
 111         Searching for JavaScriptCore/API/APICast.h fails because it is in SomethingElse/API/APICast.h.
 112         Since we are including the JavaScriptCore directory, it is not necessary to have JavaScriptCore in
 113         the forwarding headers, but removing it allows builds form directories that are not named JavaScriptCore.
 114
 115         * ForwardingHeaders/JavaScriptCore/APICast.h:
 116         * ForwardingHeaders/JavaScriptCore/JSBase.h:
 117         * ForwardingHeaders/JavaScriptCore/JSCTestRunnerUtils.h:
 118         * ForwardingHeaders/JavaScriptCore/JSContextRef.h:
 119         * ForwardingHeaders/JavaScriptCore/JSObjectRef.h:
 120         * ForwardingHeaders/JavaScriptCore/JSRetainPtr.h:
 121         * ForwardingHeaders/JavaScriptCore/JSStringRef.h:
 122         * ForwardingHeaders/JavaScriptCore/JSStringRefCF.h:
 123         * ForwardingHeaders/JavaScriptCore/JSValueRef.h:
 124         * ForwardingHeaders/JavaScriptCore/JavaScript.h:
 125         * ForwardingHeaders/JavaScriptCore/JavaScriptCore.h:
 126         * ForwardingHeaders/JavaScriptCore/OpaqueJSString.h:
 127         * ForwardingHeaders/JavaScriptCore/WebKitAvailability.h:
 128
 129 2016-01-15  Per Arne Vollan  <peavo@outlook.com>
 130
 131         [B3][Win64] Compile fixes.
 132         https://bugs.webkit.org/show_bug.cgi?id=153127
 133
 134         Reviewed by Alex Christensen.
 135
 136         MSVC have several overloads of fmod, pow, and ceil. We need to suggest to MSVC
 137         which one we want to use.
 138
 139         * b3/B3LowerMacros.cpp:
 140         * b3/B3LowerMacrosAfterOptimizations.cpp:
 141         * b3/B3MathExtras.cpp:
 142         (JSC::B3::powDoubleInt32):
 143         * b3/B3ReduceStrength.cpp:
 144
 145 2016-01-15  Filip Pizlo  <fpizlo@apple.com>
 146
 147         Air needs a Shuffle instruction
 148         https://bugs.webkit.org/show_bug.cgi?id=152952
 149
 150         Reviewed by Saam Barati.
 151
 152         This adds an instruction called Shuffle. Shuffle allows you to simultaneously perform
 153         multiple moves to perform arbitrary permutations over registers and memory. We call these
 154         rotations. It also allows you to perform "shifts", like (a => b, b => c): after the shift,
 155         c will have b's old value, b will have a's old value, and a will be unchanged. Shifts can
 156         use immediates as their source.
 157
 158         Shuffle is added as a custom instruction, since it has a variable number of arguments. It
 159         takes any number of triplets of arguments, where each triplet describes one mapping of the
 160         shuffle. For example, to represent (a => b, b => c), we might say:
 161
 162             Shuffle %a, %b, 64, %b, %c, 64
 163
 164         Note the "64"s, those are width arguments that describe how many bits of the register are
 165         being moved. Each triplet is referred to as a "shuffle pair". We call it a pair because the
 166         most relevant part of it is the pair of registers or memroy locations (i.e. %a, %b form one
 167         of the pairs in the example). For GP arguments, the width follows ZDef semantics.
 168
 169         In the future, we will be able to use Shuffle for a lot of things. This patch is modest about
 170         how to use it:
 171
 172         - C calling convention argument marshalling. Previously we used move instructions. But that's
 173           problematic since it introduces artificial interference between the argument registers and
 174           the inputs. Using Shuffle removes that interference. This helps a bit.
 175
 176         - Cold C calls. This is what really motivated me to write this patch. If we have a C call on
 177           a cold path, then we want it to appear to the register allocator like it doesn't clobber
 178           any registers. Only after register allocation should we handle the clobbering by simply
 179           saving all of the live volatile registers to the stack. If you imagine the saving and the
 180           argument marshalling, you can see how before the call, we want to have a Shuffle that does
 181           both of those things. This is important. If argument marshalling was separate from the
 182           saving, then we'd still appear to clobber argument registers. Doing them together as one
 183           Shuffle means that the cold call doesn't appear to even clobber the argument registers.
 184
 185         Unfortunately, I was wrong about cold C calls being the dominant problem with our register
 186         allocator right now. Fixing this revealed other problems in my current tuning benchmark,
 187         Octane/encrypt. Nonetheless, this is a small speed-up across the board, and gives us some
 188         functionality we will need to implement other optimizations.
 189
 190         Relanding after fixing production build.
 191
 192         * CMakeLists.txt:
 193         * JavaScriptCore.xcodeproj/project.pbxproj:
 194         * assembler/AbstractMacroAssembler.h:
 195         (JSC::isX86_64):
 196         (JSC::isIOS):
 197         (JSC::optimizeForARMv7IDIVSupported):
 198         * assembler/MacroAssemblerX86Common.h:
 199         (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
 200         (JSC::MacroAssemblerX86Common::swap32):
 201         (JSC::MacroAssemblerX86Common::moveConditionally32):
 202         * assembler/MacroAssemblerX86_64.h:
 203         (JSC::MacroAssemblerX86_64::store64WithAddressOffsetPatch):
 204         (JSC::MacroAssemblerX86_64::swap64):
 205         (JSC::MacroAssemblerX86_64::move64ToDouble):
 206         * assembler/X86Assembler.h:
 207         (JSC::X86Assembler::xchgl_rr):
 208         (JSC::X86Assembler::xchgl_rm):
 209         (JSC::X86Assembler::xchgq_rr):
 210         (JSC::X86Assembler::xchgq_rm):
 211         (JSC::X86Assembler::movl_rr):
 212         * b3/B3CCallValue.h:
 213         * b3/B3Compilation.cpp:
 214         (JSC::B3::Compilation::Compilation):
 215         (JSC::B3::Compilation::~Compilation):
 216         * b3/B3Compilation.h:
 217         (JSC::B3::Compilation::code):
 218         * b3/B3LowerToAir.cpp:
 219         (JSC::B3::Air::LowerToAir::run):
 220         (JSC::B3::Air::LowerToAir::createSelect):
 221         (JSC::B3::Air::LowerToAir::lower):
 222         (JSC::B3::Air::LowerToAir::marshallCCallArgument): Deleted.
 223         * b3/B3OpaqueByproducts.h:
 224         (JSC::B3::OpaqueByproducts::count):
 225         * b3/B3StackmapSpecial.cpp:
 226         (JSC::B3::StackmapSpecial::isArgValidForValue):
 227         (JSC::B3::StackmapSpecial::isArgValidForRep):
 228         * b3/air/AirArg.cpp:
 229         (JSC::B3::Air::Arg::isStackMemory):
 230         (JSC::B3::Air::Arg::isRepresentableAs):
 231         (JSC::B3::Air::Arg::usesTmp):
 232         (JSC::B3::Air::Arg::canRepresent):
 233         (JSC::B3::Air::Arg::isCompatibleType):
 234         (JSC::B3::Air::Arg::dump):
 235         (WTF::printInternal):
 236         * b3/air/AirArg.h:
 237         (JSC::B3::Air::Arg::forEachType):
 238         (JSC::B3::Air::Arg::isWarmUse):
 239         (JSC::B3::Air::Arg::cooled):
 240         (JSC::B3::Air::Arg::isEarlyUse):
 241         (JSC::B3::Air::Arg::imm64):
 242         (JSC::B3::Air::Arg::immPtr):
 243         (JSC::B3::Air::Arg::addr):
 244         (JSC::B3::Air::Arg::special):
 245         (JSC::B3::Air::Arg::widthArg):
 246         (JSC::B3::Air::Arg::operator==):
 247         (JSC::B3::Air::Arg::isImm64):
 248         (JSC::B3::Air::Arg::isSomeImm):
 249         (JSC::B3::Air::Arg::isAddr):
 250         (JSC::B3::Air::Arg::isIndex):
 251         (JSC::B3::Air::Arg::isMemory):
 252         (JSC::B3::Air::Arg::isRelCond):
 253         (JSC::B3::Air::Arg::isSpecial):
 254         (JSC::B3::Air::Arg::isWidthArg):
 255         (JSC::B3::Air::Arg::isAlive):
 256         (JSC::B3::Air::Arg::base):
 257         (JSC::B3::Air::Arg::hasOffset):
 258         (JSC::B3::Air::Arg::offset):
 259         (JSC::B3::Air::Arg::width):
 260         (JSC::B3::Air::Arg::isGPTmp):
 261         (JSC::B3::Air::Arg::isGP):
 262         (JSC::B3::Air::Arg::isFP):
 263         (JSC::B3::Air::Arg::isType):
 264         (JSC::B3::Air::Arg::isGPR):
 265         (JSC::B3::Air::Arg::isValidForm):
 266         (JSC::B3::Air::Arg::forEachTmpFast):
 267         * b3/air/AirBasicBlock.h:
 268         (JSC::B3::Air::BasicBlock::insts):
 269         (JSC::B3::Air::BasicBlock::appendInst):
 270         (JSC::B3::Air::BasicBlock::append):
 271         * b3/air/AirCCallingConvention.cpp: Added.
 272         (JSC::B3::Air::computeCCallingConvention):
 273         (JSC::B3::Air::cCallResult):
 274         (JSC::B3::Air::buildCCall):
 275         * b3/air/AirCCallingConvention.h: Added.
 276         * b3/air/AirCode.h:
 277         (JSC::B3::Air::Code::proc):
 278         * b3/air/AirCustom.cpp: Added.
 279         (JSC::B3::Air::CCallCustom::isValidForm):
 280         (JSC::B3::Air::CCallCustom::generate):
 281         (JSC::B3::Air::ShuffleCustom::isValidForm):
 282         (JSC::B3::Air::ShuffleCustom::generate):
 283         * b3/air/AirCustom.h:
 284         (JSC::B3::Air::PatchCustom::forEachArg):
 285         (JSC::B3::Air::PatchCustom::generate):
 286         (JSC::B3::Air::CCallCustom::forEachArg):
 287         (JSC::B3::Air::CCallCustom::isValidFormStatic):
 288         (JSC::B3::Air::CCallCustom::admitsStack):
 289         (JSC::B3::Air::CCallCustom::hasNonArgNonControlEffects):
 290         (JSC::B3::Air::ColdCCallCustom::forEachArg):
 291         (JSC::B3::Air::ShuffleCustom::forEachArg):
 292         (JSC::B3::Air::ShuffleCustom::isValidFormStatic):
 293         (JSC::B3::Air::ShuffleCustom::admitsStack):
 294         (JSC::B3::Air::ShuffleCustom::hasNonArgNonControlEffects):
 295         * b3/air/AirEmitShuffle.cpp: Added.
 296         (JSC::B3::Air::ShufflePair::dump):
 297         (JSC::B3::Air::emitShuffle):
 298         * b3/air/AirEmitShuffle.h: Added.
 299         (JSC::B3::Air::ShufflePair::ShufflePair):
 300         (JSC::B3::Air::ShufflePair::src):
 301         (JSC::B3::Air::ShufflePair::dst):
 302         (JSC::B3::Air::ShufflePair::width):
 303         * b3/air/AirGenerate.cpp:
 304         (JSC::B3::Air::prepareForGeneration):
 305         * b3/air/AirGenerate.h:
 306         * b3/air/AirInsertionSet.cpp:
 307         (JSC::B3::Air::InsertionSet::insertInsts):
 308         (JSC::B3::Air::InsertionSet::execute):
 309         * b3/air/AirInsertionSet.h:
 310         (JSC::B3::Air::InsertionSet::insertInst):
 311         (JSC::B3::Air::InsertionSet::insert):
 312         * b3/air/AirInst.h:
 313         (JSC::B3::Air::Inst::operator bool):
 314         (JSC::B3::Air::Inst::append):
 315         * b3/air/AirLowerAfterRegAlloc.cpp: Added.
 316         (JSC::B3::Air::lowerAfterRegAlloc):
 317         * b3/air/AirLowerAfterRegAlloc.h: Added.
 318         * b3/air/AirLowerMacros.cpp: Added.
 319         (JSC::B3::Air::lowerMacros):
 320         * b3/air/AirLowerMacros.h: Added.
 321         * b3/air/AirOpcode.opcodes:
 322         * b3/air/AirRegisterPriority.h:
 323         (JSC::B3::Air::regsInPriorityOrder):
 324         * b3/air/testair.cpp: Added.
 325         (hiddenTruthBecauseNoReturnIsStupid):
 326         (usage):
 327         (JSC::B3::Air::compile):
 328         (JSC::B3::Air::invoke):
 329         (JSC::B3::Air::compileAndRun):
 330         (JSC::B3::Air::testSimple):
 331         (JSC::B3::Air::loadConstantImpl):
 332         (JSC::B3::Air::loadConstant):
 333         (JSC::B3::Air::loadDoubleConstant):
 334         (JSC::B3::Air::testShuffleSimpleSwap):
 335         (JSC::B3::Air::testShuffleSimpleShift):
 336         (JSC::B3::Air::testShuffleLongShift):
 337         (JSC::B3::Air::testShuffleLongShiftBackwards):
 338         (JSC::B3::Air::testShuffleSimpleRotate):
 339         (JSC::B3::Air::testShuffleSimpleBroadcast):
 340         (JSC::B3::Air::testShuffleBroadcastAllRegs):
 341         (JSC::B3::Air::testShuffleTreeShift):
 342         (JSC::B3::Air::testShuffleTreeShiftBackward):
 343         (JSC::B3::Air::testShuffleTreeShiftOtherBackward):
 344         (JSC::B3::Air::testShuffleMultipleShifts):
 345         (JSC::B3::Air::testShuffleRotateWithFringe):
 346         (JSC::B3::Air::testShuffleRotateWithLongFringe):
 347         (JSC::B3::Air::testShuffleMultipleRotates):
 348         (JSC::B3::Air::testShuffleShiftAndRotate):
 349         (JSC::B3::Air::testShuffleShiftAllRegs):
 350         (JSC::B3::Air::testShuffleRotateAllRegs):
 351         (JSC::B3::Air::testShuffleSimpleSwap64):
 352         (JSC::B3::Air::testShuffleSimpleShift64):
 353         (JSC::B3::Air::testShuffleSwapMixedWidth):
 354         (JSC::B3::Air::testShuffleShiftMixedWidth):
 355         (JSC::B3::Air::testShuffleShiftMemory):
 356         (JSC::B3::Air::testShuffleShiftMemoryLong):
 357         (JSC::B3::Air::testShuffleShiftMemoryAllRegs):
 358         (JSC::B3::Air::testShuffleShiftMemoryAllRegs64):
 359         (JSC::B3::Air::combineHiLo):
 360         (JSC::B3::Air::testShuffleShiftMemoryAllRegsMixedWidth):
 361         (JSC::B3::Air::testShuffleRotateMemory):
 362         (JSC::B3::Air::testShuffleRotateMemory64):
 363         (JSC::B3::Air::testShuffleRotateMemoryMixedWidth):
 364         (JSC::B3::Air::testShuffleRotateMemoryAllRegs64):
 365         (JSC::B3::Air::testShuffleRotateMemoryAllRegsMixedWidth):
 366         (JSC::B3::Air::testShuffleSwapDouble):
 367         (JSC::B3::Air::testShuffleShiftDouble):
 368         (JSC::B3::Air::run):
 369         (run):
 370         (main):
 371         * b3/testb3.cpp:
 372         (JSC::B3::testCallSimple):
 373         (JSC::B3::testCallRare):
 374         (JSC::B3::testCallRareLive):
 375         (JSC::B3::testCallSimplePure):
 376         (JSC::B3::run):
 377
 378 2016-01-15  Andy VanWagoner  <thetalecrafter@gmail.com>
 379
 380         [INTL] Implement Date.prototype.toLocaleString in ECMA-402
 381         https://bugs.webkit.org/show_bug.cgi?id=147611
 382
 383         Reviewed by Benjamin Poulain.
 384
 385         Expose dateProtoFuncGetTime as thisTimeValue for builtins.
 386         Remove unused code in DateTimeFormat toDateTimeOptions, and make the
 387         function specific to the call in initializeDateTimeFormat. Properly
 388         throw when the options parameter is null.
 389         Add toLocaleString in builtin JavaScript, with it's own specific branch
 390         of toDateTimeOptions.
 391
 392         * CMakeLists.txt:
 393         * DerivedSources.make:
 394         * JavaScriptCore.xcodeproj/project.pbxproj:
 395         * builtins/DatePrototype.js: Added.
 396         (toLocaleString.toDateTimeOptionsAnyAll):
 397         (toLocaleString):
 398         * runtime/CommonIdentifiers.h:
 399         * runtime/DatePrototype.cpp:
 400         (JSC::DatePrototype::finishCreation):
 401         * runtime/DatePrototype.h:
 402         * runtime/IntlDateTimeFormat.cpp:
 403         (JSC::toDateTimeOptionsAnyDate):
 404         (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
 405         (JSC::toDateTimeOptions): Deleted.
 406         * runtime/JSGlobalObject.cpp:
 407         (JSC::JSGlobalObject::init):
 408
 409 2016-01-15  Konstantin Tokarev  <annulen@yandex.ru>
 410
 411         [mips] Implemented emitFunctionPrologue/Epilogue
 412         https://bugs.webkit.org/show_bug.cgi?id=152947
 413
 414         Reviewed by Michael Saboff.
 415
 416         * assembler/MacroAssemblerMIPS.h:
 417         (JSC::MacroAssemblerMIPS::popPair):
 418         (JSC::MacroAssemblerMIPS::pushPair):
 419         * jit/AssemblyHelpers.h:
 420         (JSC::AssemblyHelpers::emitFunctionPrologue):
 421         (JSC::AssemblyHelpers::emitFunctionEpilogueWithEmptyFrame):
 422         (JSC::AssemblyHelpers::emitFunctionEpilogue):
 423
 424 2016-01-15  Commit Queue  <commit-queue@webkit.org>
 425
 426         Unreviewed, rolling out r195084.
 427         https://bugs.webkit.org/show_bug.cgi?id=153132
 428
 429         Broke Production build (Requested by ap on #webkit).
 430
 431         Reverted changeset:
 432
 433         "Air needs a Shuffle instruction"
 434         https://bugs.webkit.org/show_bug.cgi?id=152952
 435         http://trac.webkit.org/changeset/195084
 436
 437 2016-01-15  Julien Brianceau  <jbriance@cisco.com>
 438
 439         [mips] Add countLeadingZeros32 implementation in macro assembler
 440         https://bugs.webkit.org/show_bug.cgi?id=152886
 441
 442         Reviewed by Michael Saboff.
 443
 444         * assembler/MIPSAssembler.h:
 445         (JSC::MIPSAssembler::lui):
 446         (JSC::MIPSAssembler::clz):
 447         (JSC::MIPSAssembler::addiu):
 448         * assembler/MacroAssemblerMIPS.h:
 449         (JSC::MacroAssemblerMIPS::and32):
 450         (JSC::MacroAssemblerMIPS::countLeadingZeros32):
 451         (JSC::MacroAssemblerMIPS::lshift32):
 452
 453 2016-01-14  Filip Pizlo  <fpizlo@apple.com>
 454
 455         Air needs a Shuffle instruction
 456         https://bugs.webkit.org/show_bug.cgi?id=152952
 457
 458         Reviewed by Saam Barati.
 459
 460         This adds an instruction called Shuffle. Shuffle allows you to simultaneously perform
 461         multiple moves to perform arbitrary permutations over registers and memory. We call these
 462         rotations. It also allows you to perform "shifts", like (a => b, b => c): after the shift,
 463         c will have b's old value, b will have a's old value, and a will be unchanged. Shifts can
 464         use immediates as their source.
 465
 466         Shuffle is added as a custom instruction, since it has a variable number of arguments. It
 467         takes any number of triplets of arguments, where each triplet describes one mapping of the
 468         shuffle. For example, to represent (a => b, b => c), we might say:
 469
 470             Shuffle %a, %b, 64, %b, %c, 64
 471
 472         Note the "64"s, those are width arguments that describe how many bits of the register are
 473         being moved. Each triplet is referred to as a "shuffle pair". We call it a pair because the
 474         most relevant part of it is the pair of registers or memroy locations (i.e. %a, %b form one
 475         of the pairs in the example). For GP arguments, the width follows ZDef semantics.
 476
 477         In the future, we will be able to use Shuffle for a lot of things. This patch is modest about
 478         how to use it:
 479
 480         - C calling convention argument marshalling. Previously we used move instructions. But that's
 481           problematic since it introduces artificial interference between the argument registers and
 482           the inputs. Using Shuffle removes that interference. This helps a bit.
 483
 484         - Cold C calls. This is what really motivated me to write this patch. If we have a C call on
 485           a cold path, then we want it to appear to the register allocator like it doesn't clobber
 486           any registers. Only after register allocation should we handle the clobbering by simply
 487           saving all of the live volatile registers to the stack. If you imagine the saving and the
 488           argument marshalling, you can see how before the call, we want to have a Shuffle that does
 489           both of those things. This is important. If argument marshalling was separate from the
 490           saving, then we'd still appear to clobber argument registers. Doing them together as one
 491           Shuffle means that the cold call doesn't appear to even clobber the argument registers.
 492
 493         Unfortunately, I was wrong about cold C calls being the dominant problem with our register
 494         allocator right now. Fixing this revealed other problems in my current tuning benchmark,
 495         Octane/encrypt. Nonetheless, this is a small speed-up across the board, and gives us some
 496         functionality we will need to implement other optimizations.
 497
 498         * CMakeLists.txt:
 499         * JavaScriptCore.xcodeproj/project.pbxproj:
 500         * assembler/AbstractMacroAssembler.h:
 501         (JSC::isX86_64):
 502         (JSC::isIOS):
 503         (JSC::optimizeForARMv7IDIVSupported):
 504         * assembler/MacroAssemblerX86Common.h:
 505         (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
 506         (JSC::MacroAssemblerX86Common::swap32):
 507         (JSC::MacroAssemblerX86Common::moveConditionally32):
 508         * assembler/MacroAssemblerX86_64.h:
 509         (JSC::MacroAssemblerX86_64::store64WithAddressOffsetPatch):
 510         (JSC::MacroAssemblerX86_64::swap64):
 511         (JSC::MacroAssemblerX86_64::move64ToDouble):
 512         * assembler/X86Assembler.h:
 513         (JSC::X86Assembler::xchgl_rr):
 514         (JSC::X86Assembler::xchgl_rm):
 515         (JSC::X86Assembler::xchgq_rr):
 516         (JSC::X86Assembler::xchgq_rm):
 517         (JSC::X86Assembler::movl_rr):
 518         * b3/B3CCallValue.h:
 519         * b3/B3Compilation.cpp:
 520         (JSC::B3::Compilation::Compilation):
 521         (JSC::B3::Compilation::~Compilation):
 522         * b3/B3Compilation.h:
 523         (JSC::B3::Compilation::code):
 524         * b3/B3LowerToAir.cpp:
 525         (JSC::B3::Air::LowerToAir::run):
 526         (JSC::B3::Air::LowerToAir::createSelect):
 527         (JSC::B3::Air::LowerToAir::lower):
 528         (JSC::B3::Air::LowerToAir::marshallCCallArgument): Deleted.
 529         * b3/B3OpaqueByproducts.h:
 530         (JSC::B3::OpaqueByproducts::count):
 531         * b3/B3StackmapSpecial.cpp:
 532         (JSC::B3::StackmapSpecial::isArgValidForValue):
 533         (JSC::B3::StackmapSpecial::isArgValidForRep):
 534         * b3/air/AirArg.cpp:
 535         (JSC::B3::Air::Arg::isStackMemory):
 536         (JSC::B3::Air::Arg::isRepresentableAs):
 537         (JSC::B3::Air::Arg::usesTmp):
 538         (JSC::B3::Air::Arg::canRepresent):
 539         (JSC::B3::Air::Arg::isCompatibleType):
 540         (JSC::B3::Air::Arg::dump):
 541         (WTF::printInternal):
 542         * b3/air/AirArg.h:
 543         (JSC::B3::Air::Arg::forEachType):
 544         (JSC::B3::Air::Arg::isWarmUse):
 545         (JSC::B3::Air::Arg::cooled):
 546         (JSC::B3::Air::Arg::isEarlyUse):
 547         (JSC::B3::Air::Arg::imm64):
 548         (JSC::B3::Air::Arg::immPtr):
 549         (JSC::B3::Air::Arg::addr):
 550         (JSC::B3::Air::Arg::special):
 551         (JSC::B3::Air::Arg::widthArg):
 552         (JSC::B3::Air::Arg::operator==):
 553         (JSC::B3::Air::Arg::isImm64):
 554         (JSC::B3::Air::Arg::isSomeImm):
 555         (JSC::B3::Air::Arg::isAddr):
 556         (JSC::B3::Air::Arg::isIndex):
 557         (JSC::B3::Air::Arg::isMemory):
 558         (JSC::B3::Air::Arg::isRelCond):
 559         (JSC::B3::Air::Arg::isSpecial):
 560         (JSC::B3::Air::Arg::isWidthArg):
 561         (JSC::B3::Air::Arg::isAlive):
 562         (JSC::B3::Air::Arg::base):
 563         (JSC::B3::Air::Arg::hasOffset):
 564         (JSC::B3::Air::Arg::offset):
 565         (JSC::B3::Air::Arg::width):
 566         (JSC::B3::Air::Arg::isGPTmp):
 567         (JSC::B3::Air::Arg::isGP):
 568         (JSC::B3::Air::Arg::isFP):
 569         (JSC::B3::Air::Arg::isType):
 570         (JSC::B3::Air::Arg::isGPR):
 571         (JSC::B3::Air::Arg::isValidForm):
 572         (JSC::B3::Air::Arg::forEachTmpFast):
 573         * b3/air/AirBasicBlock.h:
 574         (JSC::B3::Air::BasicBlock::insts):
 575         (JSC::B3::Air::BasicBlock::appendInst):
 576         (JSC::B3::Air::BasicBlock::append):
 577         * b3/air/AirCCallingConvention.cpp: Added.
 578         (JSC::B3::Air::computeCCallingConvention):
 579         (JSC::B3::Air::cCallResult):
 580         (JSC::B3::Air::buildCCall):
 581         * b3/air/AirCCallingConvention.h: Added.
 582         * b3/air/AirCode.h:
 583         (JSC::B3::Air::Code::proc):
 584         * b3/air/AirCustom.cpp: Added.
 585         (JSC::B3::Air::CCallCustom::isValidForm):
 586         (JSC::B3::Air::CCallCustom::generate):
 587         (JSC::B3::Air::ShuffleCustom::isValidForm):
 588         (JSC::B3::Air::ShuffleCustom::generate):
 589         * b3/air/AirCustom.h:
 590         (JSC::B3::Air::PatchCustom::forEachArg):
 591         (JSC::B3::Air::PatchCustom::generate):
 592         (JSC::B3::Air::CCallCustom::forEachArg):
 593         (JSC::B3::Air::CCallCustom::isValidFormStatic):
 594         (JSC::B3::Air::CCallCustom::admitsStack):
 595         (JSC::B3::Air::CCallCustom::hasNonArgNonControlEffects):
 596         (JSC::B3::Air::ColdCCallCustom::forEachArg):
 597         (JSC::B3::Air::ShuffleCustom::forEachArg):
 598         (JSC::B3::Air::ShuffleCustom::isValidFormStatic):
 599         (JSC::B3::Air::ShuffleCustom::admitsStack):
 600         (JSC::B3::Air::ShuffleCustom::hasNonArgNonControlEffects):
 601         * b3/air/AirEmitShuffle.cpp: Added.
 602         (JSC::B3::Air::ShufflePair::dump):
 603         (JSC::B3::Air::emitShuffle):
 604         * b3/air/AirEmitShuffle.h: Added.
 605         (JSC::B3::Air::ShufflePair::ShufflePair):
 606         (JSC::B3::Air::ShufflePair::src):
 607         (JSC::B3::Air::ShufflePair::dst):
 608         (JSC::B3::Air::ShufflePair::width):
 609         * b3/air/AirGenerate.cpp:
 610         (JSC::B3::Air::prepareForGeneration):
 611         * b3/air/AirGenerate.h:
 612         * b3/air/AirInsertionSet.cpp:
 613         (JSC::B3::Air::InsertionSet::insertInsts):
 614         (JSC::B3::Air::InsertionSet::execute):
 615         * b3/air/AirInsertionSet.h:
 616         (JSC::B3::Air::InsertionSet::insertInst):
 617         (JSC::B3::Air::InsertionSet::insert):
 618         * b3/air/AirInst.h:
 619         (JSC::B3::Air::Inst::operator bool):
 620         (JSC::B3::Air::Inst::append):
 621         * b3/air/AirLowerAfterRegAlloc.cpp: Added.
 622         (JSC::B3::Air::lowerAfterRegAlloc):
 623         * b3/air/AirLowerAfterRegAlloc.h: Added.
 624         * b3/air/AirLowerMacros.cpp: Added.
 625         (JSC::B3::Air::lowerMacros):
 626         * b3/air/AirLowerMacros.h: Added.
 627         * b3/air/AirOpcode.opcodes:
 628         * b3/air/AirRegisterPriority.h:
 629         (JSC::B3::Air::regsInPriorityOrder):
 630         * b3/air/testair.cpp: Added.
 631         (hiddenTruthBecauseNoReturnIsStupid):
 632         (usage):
 633         (JSC::B3::Air::compile):
 634         (JSC::B3::Air::invoke):
 635         (JSC::B3::Air::compileAndRun):
 636         (JSC::B3::Air::testSimple):
 637         (JSC::B3::Air::loadConstantImpl):
 638         (JSC::B3::Air::loadConstant):
 639         (JSC::B3::Air::loadDoubleConstant):
 640         (JSC::B3::Air::testShuffleSimpleSwap):
 641         (JSC::B3::Air::testShuffleSimpleShift):
 642         (JSC::B3::Air::testShuffleLongShift):
 643         (JSC::B3::Air::testShuffleLongShiftBackwards):
 644         (JSC::B3::Air::testShuffleSimpleRotate):
 645         (JSC::B3::Air::testShuffleSimpleBroadcast):
 646         (JSC::B3::Air::testShuffleBroadcastAllRegs):
 647         (JSC::B3::Air::testShuffleTreeShift):
 648         (JSC::B3::Air::testShuffleTreeShiftBackward):
 649         (JSC::B3::Air::testShuffleTreeShiftOtherBackward):
 650         (JSC::B3::Air::testShuffleMultipleShifts):
 651         (JSC::B3::Air::testShuffleRotateWithFringe):
 652         (JSC::B3::Air::testShuffleRotateWithLongFringe):
 653         (JSC::B3::Air::testShuffleMultipleRotates):
 654         (JSC::B3::Air::testShuffleShiftAndRotate):
 655         (JSC::B3::Air::testShuffleShiftAllRegs):
 656         (JSC::B3::Air::testShuffleRotateAllRegs):
 657         (JSC::B3::Air::testShuffleSimpleSwap64):
 658         (JSC::B3::Air::testShuffleSimpleShift64):
 659         (JSC::B3::Air::testShuffleSwapMixedWidth):
 660         (JSC::B3::Air::testShuffleShiftMixedWidth):
 661         (JSC::B3::Air::testShuffleShiftMemory):
 662         (JSC::B3::Air::testShuffleShiftMemoryLong):
 663         (JSC::B3::Air::testShuffleShiftMemoryAllRegs):
 664         (JSC::B3::Air::testShuffleShiftMemoryAllRegs64):
 665         (JSC::B3::Air::combineHiLo):
 666         (JSC::B3::Air::testShuffleShiftMemoryAllRegsMixedWidth):
 667         (JSC::B3::Air::testShuffleRotateMemory):
 668         (JSC::B3::Air::testShuffleRotateMemory64):
 669         (JSC::B3::Air::testShuffleRotateMemoryMixedWidth):
 670         (JSC::B3::Air::testShuffleRotateMemoryAllRegs64):
 671         (JSC::B3::Air::testShuffleRotateMemoryAllRegsMixedWidth):
 672         (JSC::B3::Air::testShuffleSwapDouble):
 673         (JSC::B3::Air::testShuffleShiftDouble):
 674         (JSC::B3::Air::run):
 675         (run):
 676         (main):
 677         * b3/testb3.cpp:
 678         (JSC::B3::testCallSimple):
 679         (JSC::B3::testCallRare):
 680         (JSC::B3::testCallRareLive):
 681         (JSC::B3::testCallSimplePure):
 682         (JSC::B3::run):
 683
 684 2016-01-14  Keith Miller  <keith_miller@apple.com>
 685
 686         Unreviewed mark passing es6 tests as no longer failing.
 687
 688         * tests/es6.yaml:
 689
 690 2016-01-14  Keith Miller  <keith_miller@apple.com>
 691
 692         [ES6] Support subclassing Function.
 693         https://bugs.webkit.org/show_bug.cgi?id=153081
 694
 695         Reviewed by Geoffrey Garen.
 696
 697         This patch enables subclassing the Function object. It also fixes an existing
 698         bug that prevented users from subclassing functions that have a function in
 699         the superclass's prototype property.
 700
 701         * bytecompiler/NodesCodegen.cpp:
 702         (JSC::ClassExprNode::emitBytecode):
 703         * runtime/FunctionConstructor.cpp:
 704         (JSC::constructWithFunctionConstructor):
 705         (JSC::constructFunction):
 706         (JSC::constructFunctionSkippingEvalEnabledCheck):
 707         * runtime/FunctionConstructor.h:
 708         * runtime/JSFunction.cpp:
 709         (JSC::JSFunction::create):
 710         * runtime/JSFunction.h:
 711         (JSC::JSFunction::createImpl):
 712         * runtime/JSFunctionInlines.h:
 713         (JSC::JSFunction::createWithInvalidatedReallocationWatchpoint):
 714         (JSC::JSFunction::JSFunction): Deleted.
 715         * tests/stress/class-subclassing-function.js: Added.
 716
 717 2016-01-13  Carlos Garcia Campos  <cgarcia@igalia.com>
 718
 719         [CMake] Do not use LLVM static libraries for FTL JIT
 720         https://bugs.webkit.org/show_bug.cgi?id=151559
 721
 722         Reviewed by Michael Catanzaro.
 723
 724         Allow ports decide whether to prefer linking to llvm static or
 725         dynamic libraries. This patch only changes the behavior of the GTK
 726         port, other ports can change the default behavior by setting
 727         llvmForJSC_LIBRARIES in their platform specific cmake files.
 728
 729         * CMakeLists.txt: Move llvmForJSC library definition after the
 730         WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS, to allow platform specific
 731         files to set their own llvmForJSC_LIBRARIES. When not set, it
 732         defaults to LLVM_STATIC_LIBRARIES. The command to create
 733         WebKitLLVMLibraryToken.h no longer depends on the static
 734         libraries, since we are going to make the build fail anyway when
 735         not found in case of linking to the static libraries. If platform
 736         specific file defined llvmForJSC_INSTALL_DIR llvmForJSC is also
 737         installed to the given destination.
 738         * PlatformGTK.cmake: Set llvmForJSC_LIBRARIES and
 739         llvmForJSC_INSTALL_DIR.
 740
 741 2016-01-13  Saam barati  <sbarati@apple.com>
 742
 743         NativeExecutable should have a name field
 744         https://bugs.webkit.org/show_bug.cgi?id=153083
 745
 746         Reviewed by Geoffrey Garen.
 747
 748         This is going to help the SamplingProfiler come up
 749         with names for NativeExecutable objects it encounters.
 750
 751         * jit/JITThunks.cpp:
 752         (JSC::JITThunks::finalize):
 753         (JSC::JITThunks::hostFunctionStub):
 754         * jit/JITThunks.h:
 755         * runtime/Executable.h:
 756         * runtime/JSBoundFunction.cpp:
 757         (JSC::JSBoundFunction::create):
 758         * runtime/JSFunction.cpp:
 759         (JSC::JSFunction::create):
 760         (JSC::JSFunction::lookUpOrCreateNativeExecutable):
 761         * runtime/JSFunction.h:
 762         (JSC::JSFunction::createImpl):
 763         * runtime/JSNativeStdFunction.cpp:
 764         (JSC::JSNativeStdFunction::create):
 765         * runtime/VM.cpp:
 766         (JSC::thunkGeneratorForIntrinsic):
 767         (JSC::VM::getHostFunction):
 768         * runtime/VM.h:
 769         (JSC::VM::getCTIStub):
 770         (JSC::VM::exceptionOffset):
 771
 772 2016-01-13  Keith Miller  <keith_miller@apple.com>
 773
 774         [ES6] Support subclassing the String builtin object
 775         https://bugs.webkit.org/show_bug.cgi?id=153068
 776
 777         Reviewed by Michael Saboff.
 778
 779         This patch adds subclassing of strings. Also, this patch fixes a bug where we could have
 780         the wrong indexing type for builtins constructed without storage.
 781
 782         * runtime/PrototypeMap.cpp:
 783         (JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
 784         * runtime/StringConstructor.cpp:
 785         (JSC::constructWithStringConstructor):
 786         * tests/stress/class-subclassing-string.js: Added.
 787         (test):
 788
 789 2016-01-13  Mark Lam  <mark.lam@apple.com>
 790
 791         The StringFromCharCode DFG intrinsic should support untyped operands.
 792         https://bugs.webkit.org/show_bug.cgi?id=153046
 793
 794         Reviewed by Geoffrey Garen.
 795
 796         The current StringFromCharCode DFG intrinsic assumes that its operand charCode
 797         must be an Int32.  This results in 26000+ BadType OSR exits in the LongSpider
 798         crypto-aes benchmark.  With support for Untyped operands, the number of OSR
 799         exits drops to 202.
 800
 801         * dfg/DFGClobberize.h:
 802         (JSC::DFG::clobberize):
 803         * dfg/DFGFixupPhase.cpp:
 804         (JSC::DFG::FixupPhase::fixupNode):
 805         * dfg/DFGOperations.cpp:
 806         * dfg/DFGOperations.h:
 807         * dfg/DFGSpeculativeJIT.cpp:
 808         (JSC::DFG::SpeculativeJIT::compileFromCharCode):
 809         * dfg/DFGSpeculativeJIT.h:
 810         (JSC::DFG::SpeculativeJIT::callOperation):
 811         * dfg/DFGValidate.cpp:
 812         (JSC::DFG::Validate::validate):
 813         * runtime/JSCJSValueInlines.h:
 814         (JSC::JSValue::toUInt32):
 815
 816 2016-01-13  Mark Lam  <mark.lam@apple.com>
 817
 818         Use DFG Graph::binary/unaryArithShouldSpeculateInt32/MachineInt() functions consistently.
 819         https://bugs.webkit.org/show_bug.cgi?id=153080
 820
 821         Reviewed by Geoffrey Garen.
 822
 823         We currently have Graph::mulShouldSpeculateInt32/machineInt() and
 824         Graph::negateShouldSpeculateInt32/MachineInt() functions which are only used by
 825         the ArithMul and ArithNegate nodes.  However, the same tests need to be done for
 826         many other arith nodes in the DFG.  This patch renames these functions as
 827         Graph::binaryArithShouldSpeculateInt32/machineInt() and
 828         Graph::unaryArithShouldSpeculateInt32/MachineInt(), and uses them consistently
 829         in the DFG.
 830
 831         * dfg/DFGFixupPhase.cpp:
 832         (JSC::DFG::FixupPhase::fixupNode):
 833         * dfg/DFGGraph.h:
 834         (JSC::DFG::Graph::addShouldSpeculateMachineInt):
 835         (JSC::DFG::Graph::binaryArithShouldSpeculateInt32):
 836         (JSC::DFG::Graph::binaryArithShouldSpeculateMachineInt):
 837         (JSC::DFG::Graph::unaryArithShouldSpeculateInt32):
 838         (JSC::DFG::Graph::unaryArithShouldSpeculateMachineInt):
 839         (JSC::DFG::Graph::mulShouldSpeculateInt32): Deleted.
 840         (JSC::DFG::Graph::mulShouldSpeculateMachineInt): Deleted.
 841         (JSC::DFG::Graph::negateShouldSpeculateInt32): Deleted.
 842         (JSC::DFG::Graph::negateShouldSpeculateMachineInt): Deleted.
 843         * dfg/DFGPredictionPropagationPhase.cpp:
 844         (JSC::DFG::PredictionPropagationPhase::propagate):
 845         (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
 846
 847 2016-01-13  Joseph Pecoraro  <pecoraro@apple.com>
 848
 849         Web Inspector: Inspector should use the last sourceURL / sourceMappingURL directive
 850         https://bugs.webkit.org/show_bug.cgi?id=153072
 851         <rdar://problem/24168312>
 852
 853         Reviewed by Timothy Hatcher.
 854
 855         * parser/Lexer.cpp:
 856         (JSC::Lexer<T>::parseCommentDirective):
 857         Just keep overwriting the member variable so we end up with
 858         the last directive value.
 859
 860 2016-01-13  Commit Queue  <commit-queue@webkit.org>
 861
 862         Unreviewed, rolling out r194969.
 863         https://bugs.webkit.org/show_bug.cgi?id=153075
 864
 865         This change broke the iOS build (Requested by ryanhaddad on
 866         #webkit).
 867
 868         Reverted changeset:
 869
 870         "[JSC] Legalize Memory Offsets for ARM64 before lowering to
 871         Air"
 872         https://bugs.webkit.org/show_bug.cgi?id=153065
 873         http://trac.webkit.org/changeset/194969
 874
 875 2016-01-13  Benjamin Poulain  <bpoulain@apple.com>
 876
 877         [JSC] Legalize Memory Offsets for ARM64 before lowering to Air
 878         https://bugs.webkit.org/show_bug.cgi?id=153065
 879
 880         Reviewed by Mark Lam.
 881         Reviewed by Filip Pizlo.
 882
 883         On ARM64, we cannot use signed 32bits offset for memory addressing.
 884         There are two available addressing: signed 9bits and unsigned scaled 12bits.
 885         Air already knows about it.
 886
 887         In this patch, the offsets are changed to something valid for ARM64
 888         prior to lowering. When an offset is invalid, it is just computed
 889         before the instruction and used as the base for addressing.
 890
 891         * JavaScriptCore.xcodeproj/project.pbxproj:
 892         * b3/B3Generate.cpp:
 893         (JSC::B3::generateToAir):
 894         * b3/B3LegalizeMemoryOffsets.cpp: Added.
 895         (JSC::B3::legalizeMemoryOffsets):
 896         * b3/B3LegalizeMemoryOffsets.h: Added.
 897         * b3/B3LowerToAir.cpp:
 898         (JSC::B3::Air::LowerToAir::effectiveAddr): Deleted.
 899         * b3/testb3.cpp:
 900         (JSC::B3::testLoadWithOffsetImpl):
 901         (JSC::B3::testLoadOffsetImm9Max):
 902         (JSC::B3::testLoadOffsetImm9MaxPlusOne):
 903         (JSC::B3::testLoadOffsetImm9MaxPlusTwo):
 904         (JSC::B3::testLoadOffsetImm9Min):
 905         (JSC::B3::testLoadOffsetImm9MinMinusOne):
 906         (JSC::B3::testLoadOffsetScaledUnsignedImm12Max):
 907         (JSC::B3::testLoadOffsetScaledUnsignedOverImm12Max):
 908         (JSC::B3::run):
 909
 910 2016-01-12  Per Arne Vollan  <peavo@outlook.com>
 911
 912         [FTL][Win64] Compile error.
 913         https://bugs.webkit.org/show_bug.cgi?id=153031
 914
 915         Reviewed by Brent Fulgham.
 916
 917         The header file dlfcn.h does not exist on Windows.
 918
 919         * ftl/FTLLowerDFGToLLVM.cpp:
 920
 921 2016-01-12  Ryosuke Niwa  <rniwa@webkit.org>
 922
 923         Add a build flag for custom element
 924         https://bugs.webkit.org/show_bug.cgi?id=153005
 925
 926         Reviewed by Alex Christensen.
 927
 928         * Configurations/FeatureDefines.xcconfig:
 929
 930 2016-01-12  Benjamin Poulain  <bpoulain@apple.com>
 931
 932         [JSC] Remove some invalid immediate instruction forms from ARM64 Air
 933         https://bugs.webkit.org/show_bug.cgi?id=153024
 934
 935         Reviewed by Michael Saboff.
 936
 937         * b3/B3BasicBlock.h:
 938         Export the symbols for testb3.
 939
 940         * b3/air/AirOpcode.opcodes:
 941         We had 2 invalid opcodes:
 942         -Compare with immediate just does not exist.
 943         -Test64 with immediate exists but Air does not recognize
 944          the valid form of bit-immediates.
 945
 946         * b3/testb3.cpp:
 947         (JSC::B3::genericTestCompare):
 948         (JSC::B3::testCompareImpl):
 949         Extend the tests to cover what was invalid.
 950
 951 2016-01-12  Benjamin Poulain  <bpoulain@apple.com>
 952
 953         [JSC] JSC does not build with FTL_USES_B3 on ARM64
 954         https://bugs.webkit.org/show_bug.cgi?id=153011
 955
 956         Reviewed by Saam Barati.
 957
 958         Apparently the static const member can only be used for constexpr.
 959         C++ is weird.
 960
 961         * jit/GPRInfo.cpp:
 962         * jit/GPRInfo.h:
 963
 964 2016-01-11  Johan K. Jensen  <jj@johanjensen.dk>
 965
 966         Web Inspector: console.count() shouldn't show a colon in front of a number
 967         https://bugs.webkit.org/show_bug.cgi?id=152038
 968
 969         Reviewed by Brian Burg.
 970
 971         * inspector/agents/InspectorConsoleAgent.cpp:
 972         (Inspector::InspectorConsoleAgent::count):
 973         Do not include title and colon if the title is empty.
 974
 975 2016-01-11  Dan Bernstein  <mitz@apple.com>
 976
 977         Reverted r194317.
 978
 979         Reviewed by Joseph Pecoraro.
 980
 981         r194317 did not contain a change log entry, did not explain the motivation, did not name a
 982         reviewer, and does not seem necessary.
 983
 984         * JavaScriptCore.xcodeproj/project.pbxproj:
 985
 986 2016-01-11  Joseph Pecoraro  <pecoraro@apple.com>
 987
 988         keywords ("super", "delete", etc) should be valid method names
 989         https://bugs.webkit.org/show_bug.cgi?id=144281
 990
 991         Reviewed by Ryosuke Niwa.
 992
 993         * parser/Parser.cpp:
 994         (JSC::Parser<LexerType>::parseClass):
 995         - When parsing "static(" treat it as a method named "static" and not a static method.
 996         - When parsing a keyword treat it like a string method name (get and set are not keywords)
 997         - When parsing a getter / setter method name identifier, allow lookahead to be a keyword
 998
 999         (JSC::Parser<LexerType>::parseGetterSetter):
1000         - When parsing the getter / setter's name, allow it to be a keyword.
1001
1002 2016-01-11  Benjamin Poulain  <bpoulain@apple.com>
1003
1004         [JSC] Add Div/Mod and fix Mul for B3 ARM64
1005         https://bugs.webkit.org/show_bug.cgi?id=152978
1006
1007         Reviewed by Filip Pizlo.
1008
1009         Add the 3 operands forms of Mul.
1010         Remove the form taking immediate on ARM64, there are no such instruction.
1011
1012         Add Div with sdiv.
1013
1014         Unfortunately, I discovered ChillMod's division by zero
1015         makes it non-trivial on ARM64. I just made it into a macro like on x86.
1016
1017         * assembler/MacroAssemblerARM64.h:
1018         (JSC::MacroAssemblerARM64::mul32):
1019         (JSC::MacroAssemblerARM64::mul64):
1020         (JSC::MacroAssemblerARM64::div32):
1021         (JSC::MacroAssemblerARM64::div64):
1022         * b3/B3LowerMacros.cpp:
1023         * b3/B3LowerToAir.cpp:
1024         (JSC::B3::Air::LowerToAir::lower):
1025         * b3/air/AirOpcode.opcodes:
1026
1027 2016-01-11  Keith Miller  <keith_miller@apple.com>
1028
1029         Arrays should use the InternalFunctionAllocationProfile when constructing new Arrays
1030         https://bugs.webkit.org/show_bug.cgi?id=152949
1031
1032         Reviewed by Michael Saboff.
1033
1034         This patch updates Array constructors to use the new InternalFunctionAllocationProfile.
1035
1036         * runtime/ArrayConstructor.cpp:
1037         (JSC::constructArrayWithSizeQuirk):
1038         (JSC::constructWithArrayConstructor):
1039         * runtime/InternalFunction.h:
1040         (JSC::InternalFunction::createStructure):
1041         * runtime/JSGlobalObject.h:
1042         (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation):
1043         (JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation):
1044         (JSC::constructEmptyArray):
1045         (JSC::constructArray):
1046         (JSC::constructArrayNegativeIndexed):
1047         * runtime/PrototypeMap.cpp:
1048         (JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
1049         * runtime/Structure.h:
1050         * runtime/StructureInlines.h:
1051
1052 2016-01-08  Keith Miller  <keith_miller@apple.com>
1053
1054         Use a profile to store allocation structures for subclasses of InternalFunctions
1055         https://bugs.webkit.org/show_bug.cgi?id=152942
1056
1057         Reviewed by Michael Saboff.
1058
1059         This patch adds InternalFunctionAllocationProfile to FunctionRareData, which holds
1060         a cached structure that can be used to quickly allocate any derived class of an InternalFunction.
1061         InternalFunctionAllocationProfile ended up being distinct from ObjectAllocationProfile, due to
1062         constraints imposed by Reflect.construct. Reflect.construct allows the user to pass an arbitrary
1063         constructor as a new.target to any other constructor. This means that a user can pass some
1064         non-derived constructor to an InternalFunction (they can even pass another InternalFunction as the
1065         new.target). If we use the same profile for both InternalFunctions and JS allocations then we always
1066         need to check in both JS code and C++ code that the profiled structure has the same ClassInfo as the
1067         current constructor. By using different profiles, we only need to check the profile in InternalFunctions
1068         as all JS constructed objects share the same ClassInfo (JSFinalObject). This comes at the relatively
1069         low cost of using slightly more memory on FunctionRareData and being slightly more conceptually complex.
1070
1071         Additionally, this patch adds subclassing to some omitted classes.
1072
1073         * API/JSObjectRef.cpp:
1074         (JSObjectMakeDate):
1075         (JSObjectMakeRegExp):
1076         * JavaScriptCore.xcodeproj/project.pbxproj:
1077         * bytecode/InternalFunctionAllocationProfile.h: Added.
1078         (JSC::InternalFunctionAllocationProfile::structure):
1079         (JSC::InternalFunctionAllocationProfile::clear):
1080         (JSC::InternalFunctionAllocationProfile::visitAggregate):
1081         (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
1082         * dfg/DFGByteCodeParser.cpp:
1083         (JSC::DFG::ByteCodeParser::parseBlock):
1084         * dfg/DFGOperations.cpp:
1085         * dfg/DFGSpeculativeJIT32_64.cpp:
1086         (JSC::DFG::SpeculativeJIT::compile):
1087         * dfg/DFGSpeculativeJIT64.cpp:
1088         (JSC::DFG::SpeculativeJIT::compile):
1089         * jit/JITOpcodes.cpp:
1090         (JSC::JIT::emit_op_create_this):
1091         * jit/JITOpcodes32_64.cpp:
1092         (JSC::JIT::emit_op_create_this):
1093         * llint/LowLevelInterpreter32_64.asm:
1094         * llint/LowLevelInterpreter64.asm:
1095         * runtime/BooleanConstructor.cpp:
1096         (JSC::constructWithBooleanConstructor):
1097         * runtime/CommonSlowPaths.cpp:
1098         (JSC::SLOW_PATH_DECL):
1099         * runtime/DateConstructor.cpp:
1100         (JSC::constructDate):
1101         (JSC::constructWithDateConstructor):
1102         * runtime/DateConstructor.h:
1103         * runtime/ErrorConstructor.cpp:
1104         (JSC::Interpreter::constructWithErrorConstructor):
1105         * runtime/FunctionRareData.cpp:
1106         (JSC::FunctionRareData::create):
1107         (JSC::FunctionRareData::visitChildren):
1108         (JSC::FunctionRareData::FunctionRareData):
1109         (JSC::FunctionRareData::initializeObjectAllocationProfile):
1110         (JSC::FunctionRareData::clear):
1111         (JSC::FunctionRareData::finishCreation): Deleted.
1112         (JSC::FunctionRareData::initialize): Deleted.
1113         * runtime/FunctionRareData.h:
1114         (JSC::FunctionRareData::offsetOfObjectAllocationProfile):
1115         (JSC::FunctionRareData::objectAllocationProfile):
1116         (JSC::FunctionRareData::objectAllocationStructure):
1117         (JSC::FunctionRareData::allocationProfileWatchpointSet):
1118         (JSC::FunctionRareData::isObjectAllocationProfileInitialized):
1119         (JSC::FunctionRareData::internalFunctionAllocationStructure):
1120         (JSC::FunctionRareData::createInternalFunctionAllocationStructureFromBase):
1121         (JSC::FunctionRareData::offsetOfAllocationProfile): Deleted.
1122         (JSC::FunctionRareData::allocationProfile): Deleted.
1123         (JSC::FunctionRareData::allocationStructure): Deleted.
1124         (JSC::FunctionRareData::isInitialized): Deleted.
1125         * runtime/InternalFunction.cpp:
1126         (JSC::InternalFunction::createSubclassStructure):
1127         * runtime/InternalFunction.h:
1128         * runtime/JSArrayBufferConstructor.cpp:
1129         (JSC::constructArrayBuffer):
1130         * runtime/JSFunction.cpp:
1131         (JSC::JSFunction::allocateRareData):
1132         (JSC::JSFunction::allocateAndInitializeRareData):
1133         (JSC::JSFunction::initializeRareData):
1134         * runtime/JSFunction.h:
1135         (JSC::JSFunction::rareData):
1136         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
1137         (JSC::constructGenericTypedArrayView):
1138         * runtime/JSObject.h:
1139         (JSC::JSFinalObject::typeInfo):
1140         (JSC::JSFinalObject::createStructure):
1141         * runtime/JSPromiseConstructor.cpp:
1142         (JSC::constructPromise):
1143         * runtime/JSPromiseConstructor.h:
1144         * runtime/JSWeakMap.cpp:
1145         * runtime/JSWeakSet.cpp:
1146         * runtime/MapConstructor.cpp:
1147         (JSC::constructMap):
1148         * runtime/NativeErrorConstructor.cpp:
1149         (JSC::Interpreter::constructWithNativeErrorConstructor):
1150         * runtime/NumberConstructor.cpp:
1151         (JSC::constructWithNumberConstructor):
1152         * runtime/PrototypeMap.cpp:
1153         (JSC::PrototypeMap::createEmptyStructure):
1154         (JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
1155         (JSC::PrototypeMap::emptyObjectStructureForPrototype):
1156         (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
1157         * runtime/PrototypeMap.h:
1158         * runtime/RegExpConstructor.cpp:
1159         (JSC::getRegExpStructure):
1160         (JSC::constructRegExp):
1161         (JSC::constructWithRegExpConstructor):
1162         * runtime/RegExpConstructor.h:
1163         * runtime/SetConstructor.cpp:
1164         (JSC::constructSet):
1165         * runtime/WeakMapConstructor.cpp:
1166         (JSC::constructWeakMap):
1167         * runtime/WeakSetConstructor.cpp:
1168         (JSC::constructWeakSet):
1169         * tests/stress/class-subclassing-misc.js:
1170         (A):
1171         (D):
1172         (E):
1173         (WM):
1174         (WS):
1175         (test):
1176         * tests/stress/class-subclassing-typedarray.js: Added.
1177         (test):
1178
1179 2016-01-11  Per Arne Vollan  <peavo@outlook.com>
1180
1181         [B3][Win64] Compile error.
1182         https://bugs.webkit.org/show_bug.cgi?id=152984
1183
1184         Reviewed by Alex Christensen.
1185
1186         Windows does not have bzero, use memset instead.
1187
1188         * b3/air/AirIteratedRegisterCoalescing.cpp:
1189
1190 2016-01-11  Konstantin Tokarev  <annulen@yandex.ru>
1191
1192         Fixed compilation of JavaScriptCore with GCC 4.8 on 32-bit platforms
1193         https://bugs.webkit.org/show_bug.cgi?id=152923
1194
1195         Reviewed by Alex Christensen.
1196
1197         * jit/CallFrameShuffler.h:
1198         (JSC::CallFrameShuffler::assumeCalleeIsCell):
1199
1200 2016-01-11  Csaba Osztrogonác  <ossy@webkit.org>
1201
1202         [B3] Fix control reaches end of non-void function GCC warnings on Linux
1203         https://bugs.webkit.org/show_bug.cgi?id=152887
1204
1205         Reviewed by Mark Lam.
1206
1207         * b3/B3LowerToAir.cpp:
1208         (JSC::B3::Air::LowerToAir::createBranch):
1209         (JSC::B3::Air::LowerToAir::createCompare):
1210         (JSC::B3::Air::LowerToAir::createSelect):
1211         * b3/B3Type.h:
1212         (JSC::B3::sizeofType):
1213         * b3/air/AirArg.cpp:
1214         (JSC::B3::Air::Arg::isRepresentableAs):
1215         * b3/air/AirArg.h:
1216         (JSC::B3::Air::Arg::isAnyUse):
1217         (JSC::B3::Air::Arg::isColdUse):
1218         (JSC::B3::Air::Arg::isEarlyUse):
1219         (JSC::B3::Air::Arg::isLateUse):
1220         (JSC::B3::Air::Arg::isAnyDef):
1221         (JSC::B3::Air::Arg::isEarlyDef):
1222         (JSC::B3::Air::Arg::isLateDef):
1223         (JSC::B3::Air::Arg::isZDef):
1224         (JSC::B3::Air::Arg::widthForB3Type):
1225         (JSC::B3::Air::Arg::isGP):
1226         (JSC::B3::Air::Arg::isFP):
1227         (JSC::B3::Air::Arg::isType):
1228         (JSC::B3::Air::Arg::isValidForm):
1229         * b3/air/AirCode.h:
1230         (JSC::B3::Air::Code::newTmp):
1231         (JSC::B3::Air::Code::numTmps):
1232
1233 2016-01-11  Filip Pizlo  <fpizlo@apple.com>
1234
1235         Make it easier to introduce exotic instructions to Air
1236         https://bugs.webkit.org/show_bug.cgi?id=152953
1237
1238         Reviewed by Benjamin Poulain.
1239
1240         Currently, you can define new "opcodes" in Air using either:
1241
1242         1) New opcode declared in AirOpcode.opcodes.
1243         2) Patch opcode with a new implementation of Air::Special.
1244
1245         With (1), you are limited to fixed-argument-length instructions. There are other
1246         restrictions as well, like that you can only use the roles that the AirOpcode syntax
1247         supports.
1248
1249         With (2), you can do anything you like, but the instruction will be harder to match
1250         since it will share the same opcode as any other Patch. Also, the instruction will have
1251         the Special argument, which means more busy-work when creating the instruction and
1252         validating it.
1253
1254         This introduces an in-between facility called "custom". This replaces what AirOpcode
1255         previously called "special". A custom instruction is one whose behavior is defined by a
1256         FooCustom struct with some static methods. Calls to those methods are emitted by
1257         opcode_generator.rb.
1258
1259         The "custom" facility is powerful enough to be used to implement Patch, with the caveat
1260         that we now treat the Patch instruction specially in a few places. Those places were
1261         already effectively treating it specially by assuming that only Patch instructions have
1262         a Special as their first argument.
1263
1264         This will let me implement the Shuffle instruction (bug 152952), which I think is needed
1265         for performance work.
1266
1267         * JavaScriptCore.xcodeproj/project.pbxproj:
1268         * b3/air/AirCustom.h: Added.
1269         (JSC::B3::Air::PatchCustom::forEachArg):
1270         (JSC::B3::Air::PatchCustom::isValidFormStatic):
1271         (JSC::B3::Air::PatchCustom::isValidForm):
1272         (JSC::B3::Air::PatchCustom::admitsStack):
1273         (JSC::B3::Air::PatchCustom::hasNonArgNonControlEffects):
1274         (JSC::B3::Air::PatchCustom::generate):
1275         * b3/air/AirHandleCalleeSaves.cpp:
1276         (JSC::B3::Air::handleCalleeSaves):
1277         * b3/air/AirInst.h:
1278         * b3/air/AirInstInlines.h:
1279         (JSC::B3::Air::Inst::forEach):
1280         (JSC::B3::Air::Inst::extraClobberedRegs):
1281         (JSC::B3::Air::Inst::extraEarlyClobberedRegs):
1282         (JSC::B3::Air::Inst::forEachDefWithExtraClobberedRegs):
1283         (JSC::B3::Air::Inst::reportUsedRegisters):
1284         (JSC::B3::Air::Inst::hasSpecial): Deleted.
1285         * b3/air/AirOpcode.opcodes:
1286         * b3/air/AirReportUsedRegisters.cpp:
1287         (JSC::B3::Air::reportUsedRegisters):
1288         * b3/air/opcode_generator.rb:
1289
1290 2016-01-11  Filip Pizlo  <fpizlo@apple.com>
1291
1292         Turn Check(true) into Patchpoint() followed by Oops
1293         https://bugs.webkit.org/show_bug.cgi?id=152968
1294
1295         Reviewed by Benjamin Poulain.
1296
1297         This is an obvious strength reduction to have, especially since if we discover that the
1298         input to the Check is true after some amount of B3 optimization, then stubbing out the rest
1299         of the basic block unlocks CFG simplification opportunities.
1300
1301         It's also a proof-of-concept for the Check->Patchpoint conversion that I'll use once I
1302         implement sinking (bug 152162).
1303
1304         * b3/B3ControlValue.cpp:
1305         (JSC::B3::ControlValue::convertToJump):
1306         (JSC::B3::ControlValue::convertToOops):
1307         (JSC::B3::ControlValue::dumpMeta):
1308         * b3/B3ControlValue.h:
1309         * b3/B3InsertionSet.h:
1310         (JSC::B3::InsertionSet::insertValue):
1311         * b3/B3InsertionSetInlines.h:
1312         (JSC::B3::InsertionSet::insert):
1313         * b3/B3ReduceStrength.cpp:
1314         * b3/B3StackmapValue.h:
1315         * b3/B3Value.h:
1316         * tests/stress/ftl-force-osr-exit.js: Added.
1317
1318 2016-01-11  Benjamin Poulain  <bpoulain@apple.com>
1319
1320         [JSC] When resolving Stack arguments, use addressing from SP when addressing from FP is invalid
1321         https://bugs.webkit.org/show_bug.cgi?id=152840
1322
1323         Reviewed by Mark Lam.
1324
1325         ARM64 has two kinds of addressing with immediates:
1326         -Signed 9bits direct (really only -256 to 255).
1327         -Unsigned 12bits scaled by the load/store size.
1328
1329         When resolving the stack addresses, we easily run
1330         past -256 bytes from FP. Addressing from SP gives us more
1331         room to address the stack efficiently because we can
1332         use unsigned immediates.
1333
1334         * b3/B3StackmapSpecial.cpp:
1335         (JSC::B3::StackmapSpecial::repForArg):
1336         * b3/air/AirAllocateStack.cpp:
1337         (JSC::B3::Air::allocateStack):
1338
1339 2016-01-10  Saam barati  <sbarati@apple.com>
1340
1341         Implement a sampling profiler
1342         https://bugs.webkit.org/show_bug.cgi?id=151713
1343
1344         Reviewed by Filip Pizlo.
1345
1346         This patch implements a sampling profiler for JavaScriptCore
1347         that will be used in the Inspector UI. The implementation works as follows:
1348         We queue the sampling profiler to run a task on a background
1349         thread every 1ms. When the queued task executes, the sampling profiler
1350         will pause the JSC execution thread and attempt to take a stack trace.
1351         The sampling profiler does everything it can to be very careful
1352         while taking this stack trace. Because it's reading arbitrary memory,
1353         the sampling profiler must validate every pointer it reads from.
1354
1355         The sampling profiler tries to get an ExecutableBase for every call frame
1356         it reads. It first tries to read the CodeBlock slot. It does this because
1357         it can be 100% certain that a pointer is a CodeBlock while it's taking a
1358         stack trace. But, not every call frame will have a CodeBlock. So we must read
1359         the call frame's callee. For these stack traces where we read the callee, we
1360         must verify the callee pointer, and the pointer traversal to an ExecutableBase,
1361         on the main JSC execution thread, and not on the thread taking the stack
1362         trace. We do this verification either before we run the marking phase in
1363         GC, or when somebody asks the SamplingProfiler to materialize its data.
1364
1365         The SamplingProfiler must also be careful to not grab any locks while the JSC execution
1366         thread is paused (this means it can't do anything that mallocs) because
1367         that could cause a deadlock. Therefore, the sampling profiler grabs
1368         locks for all data structures it consults before it pauses the JSC
1369         execution thread.
1370
1371         * CMakeLists.txt:
1372         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1373         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1374         * JavaScriptCore.xcodeproj/project.pbxproj:
1375         * bytecode/CodeBlock.h:
1376         (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled):
1377         (JSC::CodeBlockSet::mark):
1378         * dfg/DFGNodeType.h:
1379         * heap/CodeBlockSet.cpp:
1380         (JSC::CodeBlockSet::add):
1381         (JSC::CodeBlockSet::promoteYoungCodeBlocks):
1382         (JSC::CodeBlockSet::clearMarksForFullCollection):
1383         (JSC::CodeBlockSet::lastChanceToFinalize):
1384         (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
1385         (JSC::CodeBlockSet::contains):
1386         (JSC::CodeBlockSet::writeBarrierCurrentlyExecutingCodeBlocks):
1387         (JSC::CodeBlockSet::remove): Deleted.
1388         * heap/CodeBlockSet.h:
1389         (JSC::CodeBlockSet::getLock):
1390         (JSC::CodeBlockSet::iterate):
1391         The sampling pofiler uses the heap's CodeBlockSet to validate
1392         CodeBlock pointers. This data structure must now be under a lock
1393         because we must be certain we're not pausing the JSC execution thread
1394         while it's manipulating this data structure.
1395
1396         * heap/ConservativeRoots.cpp:
1397         (JSC::ConservativeRoots::ConservativeRoots):
1398         (JSC::ConservativeRoots::grow):
1399         (JSC::ConservativeRoots::genericAddPointer):
1400         (JSC::ConservativeRoots::genericAddSpan):
1401         (JSC::ConservativeRoots::add):
1402         (JSC::CompositeMarkHook::CompositeMarkHook):
1403         (JSC::CompositeMarkHook::mark):
1404         * heap/ConservativeRoots.h:
1405         * heap/Heap.cpp:
1406         (JSC::Heap::markRoots):
1407         (JSC::Heap::visitHandleStack):
1408         (JSC::Heap::visitSamplingProfiler):
1409         (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
1410         (JSC::Heap::snapshotMarkedSpace):
1411         * heap/Heap.h:
1412         (JSC::Heap::structureIDTable):
1413         (JSC::Heap::codeBlockSet):
1414         * heap/MachineStackMarker.cpp:
1415         (pthreadSignalHandlerSuspendResume):
1416         (JSC::getCurrentPlatformThread):
1417         (JSC::MachineThreads::MachineThreads):
1418         (JSC::MachineThreads::~MachineThreads):
1419         (JSC::MachineThreads::Thread::createForCurrentThread):
1420         (JSC::MachineThreads::Thread::operator==):
1421         (JSC::isThreadInList):
1422         (JSC::MachineThreads::addCurrentThread):
1423         (JSC::MachineThreads::machineThreadForCurrentThread):
1424         (JSC::MachineThreads::removeThread):
1425         (JSC::MachineThreads::gatherFromCurrentThread):
1426         (JSC::MachineThreads::Thread::Thread):
1427         (JSC::MachineThreads::Thread::~Thread):
1428         (JSC::MachineThreads::Thread::suspend):
1429         (JSC::MachineThreads::Thread::resume):
1430         (JSC::MachineThreads::Thread::getRegisters):
1431         (JSC::MachineThreads::Thread::Registers::stackPointer):
1432         (JSC::MachineThreads::Thread::Registers::framePointer):
1433         (JSC::MachineThreads::Thread::Registers::instructionPointer):
1434         (JSC::MachineThreads::Thread::freeRegisters):
1435         (JSC::MachineThreads::tryCopyOtherThreadStacks):
1436         (JSC::pthreadSignalHandlerSuspendResume): Deleted.
1437         (JSC::MachineThreads::Thread::operator!=): Deleted.
1438         * heap/MachineStackMarker.h:
1439         (JSC::MachineThreads::Thread::operator!=):
1440         (JSC::MachineThreads::getLock):
1441         (JSC::MachineThreads::threadsListHead):
1442         We can now ask a MachineThreads::Thread for its frame pointer
1443         and program counter on darwin and windows platforms. efl
1444         and gtk implementations will happen in another patch.
1445
1446         * heap/MarkedBlockSet.h:
1447         (JSC::MarkedBlockSet::getLock):
1448         (JSC::MarkedBlockSet::add):
1449         (JSC::MarkedBlockSet::remove):
1450         (JSC::MarkedBlockSet::recomputeFilter):
1451         (JSC::MarkedBlockSet::filter):
1452         (JSC::MarkedBlockSet::set):
1453         * heap/MarkedSpace.cpp:
1454         (JSC::Free::Free):
1455         (JSC::Free::operator()):
1456         (JSC::FreeOrShrink::FreeOrShrink):
1457         (JSC::FreeOrShrink::operator()):
1458         (JSC::MarkedSpace::~MarkedSpace):
1459         (JSC::MarkedSpace::isPagedOut):
1460         (JSC::MarkedSpace::freeBlock):
1461         (JSC::MarkedSpace::freeOrShrinkBlock):
1462         (JSC::MarkedSpace::shrink):
1463         * heap/MarkedSpace.h:
1464         (JSC::MarkedSpace::forEachLiveCell):
1465         (JSC::MarkedSpace::forEachDeadCell):
1466         * interpreter/CallFrame.h:
1467         (JSC::ExecState::calleeAsValue):
1468         (JSC::ExecState::callee):
1469         (JSC::ExecState::unsafeCallee):
1470         (JSC::ExecState::codeBlock):
1471         (JSC::ExecState::scope):
1472         * jit/ExecutableAllocator.cpp:
1473         (JSC::ExecutableAllocator::dumpProfile):
1474         (JSC::ExecutableAllocator::getLock):
1475         (JSC::ExecutableAllocator::isValidExecutableMemory):
1476         * jit/ExecutableAllocator.h:
1477         * jit/ExecutableAllocatorFixedVMPool.cpp:
1478         (JSC::ExecutableAllocator::allocate):
1479         (JSC::ExecutableAllocator::isValidExecutableMemory):
1480         (JSC::ExecutableAllocator::getLock):
1481         (JSC::ExecutableAllocator::committedByteCount):
1482         The sampling profiler consults the ExecutableAllocator to check
1483         if the frame pointer it reads is in executable allocated memory.
1484
1485         * jsc.cpp:
1486         (GlobalObject::finishCreation):
1487         (functionCheckModuleSyntax):
1488         (functionStartSamplingProfiler):
1489         (functionSamplingProfilerStackTraces):
1490         * llint/LLIntPCRanges.h: Added.
1491         (JSC::LLInt::isLLIntPC):
1492         * offlineasm/asm.rb:
1493         I added the ability to test whether the PC is executing
1494         LLInt code because this code is not part of the memory
1495         our executable allocator allocates.
1496
1497         * runtime/Executable.h:
1498         (JSC::ExecutableBase::isModuleProgramExecutable):
1499         (JSC::ExecutableBase::isExecutableType):
1500         (JSC::ExecutableBase::isHostFunction):
1501         * runtime/JSLock.cpp:
1502         (JSC::JSLock::didAcquireLock):
1503         (JSC::JSLock::unlock):
1504         * runtime/Options.h:
1505         * runtime/SamplingProfiler.cpp: Added.
1506         (JSC::reportStats):
1507         (JSC::FrameWalker::FrameWalker):
1508         (JSC::FrameWalker::walk):
1509         (JSC::FrameWalker::wasValidWalk):
1510         (JSC::FrameWalker::advanceToParentFrame):
1511         (JSC::FrameWalker::isAtTop):
1512         (JSC::FrameWalker::resetAtMachineFrame):
1513         (JSC::FrameWalker::isValidFramePointer):
1514         (JSC::FrameWalker::isValidCodeBlock):
1515         (JSC::FrameWalker::tryToGetExecutableFromCallee):
1516         The FrameWalker class is used to walk the stack in a safe
1517         manner. It doesn't do anything that would deadlock, and it
1518         validates all pointers that it sees.
1519
1520         (JSC::SamplingProfiler::SamplingProfiler):
1521         (JSC::SamplingProfiler::~SamplingProfiler):
1522         (JSC::SamplingProfiler::visit):
1523         (JSC::SamplingProfiler::shutdown):
1524         (JSC::SamplingProfiler::start):
1525         (JSC::SamplingProfiler::stop):
1526         (JSC::SamplingProfiler::pause):
1527         (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread):
1528         (JSC::SamplingProfiler::dispatchIfNecessary):
1529         (JSC::SamplingProfiler::dispatchFunction):
1530         (JSC::SamplingProfiler::noticeJSLockAcquisition):
1531         (JSC::SamplingProfiler::noticeVMEntry):
1532         (JSC::SamplingProfiler::observeStackTrace):
1533         (JSC::SamplingProfiler::clearData):
1534         (JSC::displayName):
1535         (JSC::startLine):
1536         (JSC::startColumn):
1537         (JSC::sourceID):
1538         (JSC::url):
1539         (JSC::SamplingProfiler::stacktracesAsJSON):
1540         * runtime/SamplingProfiler.h: Added.
1541         (JSC::SamplingProfiler::getLock):
1542         (JSC::SamplingProfiler::setTimingInterval):
1543         (JSC::SamplingProfiler::stackTraces):
1544         * runtime/VM.cpp:
1545         (JSC::VM::VM):
1546         (JSC::VM::~VM):
1547         (JSC::VM::setLastStackTop):
1548         (JSC::VM::createContextGroup):
1549         (JSC::VM::ensureWatchdog):
1550         (JSC::VM::ensureSamplingProfiler):
1551         (JSC::thunkGeneratorForIntrinsic):
1552         * runtime/VM.h:
1553         (JSC::VM::watchdog):
1554         (JSC::VM::isSafeToRecurse):
1555         (JSC::VM::lastStackTop):
1556         (JSC::VM::scratchBufferForSize):
1557         (JSC::VM::samplingProfiler):
1558         (JSC::VM::setShouldRewriteConstAsVar):
1559         (JSC::VM::setLastStackTop): Deleted.
1560         * runtime/VMEntryScope.cpp:
1561         (JSC::VMEntryScope::VMEntryScope):
1562         * tests/stress/sampling-profiler: Added.
1563         * tests/stress/sampling-profiler-anonymous-function.js: Added.
1564         (foo):
1565         (baz):
1566         * tests/stress/sampling-profiler-basic.js: Added.
1567         (bar):
1568         (foo):
1569         (nothing):
1570         (top):
1571         (jaz):
1572         (kaz):
1573         (checkInlining):
1574         * tests/stress/sampling-profiler-deep-stack.js: Added.
1575         (foo):
1576         (hellaDeep):
1577         (start):
1578         * tests/stress/sampling-profiler-microtasks.js: Added.
1579         (testResults):
1580         (loop.jaz):
1581         (loop):
1582         * tests/stress/sampling-profiler/samplingProfiler.js: Added.
1583         (assert):
1584         (let.nodePrototype.makeChildIfNeeded):
1585         (makeNode):
1586         (updateCallingContextTree):
1587         (doesTreeHaveStackTrace):
1588         (makeTree):
1589         (runTest):
1590         (dumpTree):
1591         * tools/JSDollarVMPrototype.cpp:
1592         (JSC::JSDollarVMPrototype::isInObjectSpace):
1593         (JSC::JSDollarVMPrototype::isInStorageSpace):
1594         * yarr/YarrJIT.cpp:
1595         (JSC::Yarr::YarrGenerator::generateEnter):
1596         (JSC::Yarr::YarrGenerator::generateReturn):
1597         (JSC::Yarr::YarrGenerator::YarrGenerator):
1598         (JSC::Yarr::YarrGenerator::compile):
1599         (JSC::Yarr::jitCompile):
1600         We now have a boolean that's set to true when
1601         we're executing a RegExp, and to false otherwise.
1602         The boolean lives off of VM.
1603
1604         * CMakeLists.txt:
1605         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1606         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1607         * JavaScriptCore.xcodeproj/project.pbxproj:
1608         * bytecode/CodeBlock.h:
1609         (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled):
1610         (JSC::CodeBlockSet::mark):
1611         * dfg/DFGNodeType.h:
1612         * heap/CodeBlockSet.cpp:
1613         (JSC::CodeBlockSet::add):
1614         (JSC::CodeBlockSet::promoteYoungCodeBlocks):
1615         (JSC::CodeBlockSet::clearMarksForFullCollection):
1616         (JSC::CodeBlockSet::lastChanceToFinalize):
1617         (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
1618         (JSC::CodeBlockSet::contains):
1619         (JSC::CodeBlockSet::writeBarrierCurrentlyExecutingCodeBlocks):
1620         (JSC::CodeBlockSet::remove): Deleted.
1621         * heap/CodeBlockSet.h:
1622         (JSC::CodeBlockSet::getLock):
1623         (JSC::CodeBlockSet::iterate):
1624         * heap/ConservativeRoots.cpp:
1625         (JSC::ConservativeRoots::ConservativeRoots):
1626         (JSC::ConservativeRoots::genericAddPointer):
1627         (JSC::ConservativeRoots::add):
1628         (JSC::CompositeMarkHook::CompositeMarkHook):
1629         (JSC::CompositeMarkHook::mark):
1630         * heap/ConservativeRoots.h:
1631         * heap/Heap.cpp:
1632         (JSC::Heap::markRoots):
1633         (JSC::Heap::visitHandleStack):
1634         (JSC::Heap::visitSamplingProfiler):
1635         (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
1636         * heap/Heap.h:
1637         (JSC::Heap::structureIDTable):
1638         (JSC::Heap::codeBlockSet):
1639         * heap/HeapInlines.h:
1640         (JSC::Heap::didFreeBlock):
1641         (JSC::Heap::isPointerGCObject):
1642         (JSC::Heap::isValueGCObject):
1643         * heap/MachineStackMarker.cpp:
1644         (pthreadSignalHandlerSuspendResume):
1645         (JSC::getCurrentPlatformThread):
1646         (JSC::MachineThreads::MachineThreads):
1647         (JSC::MachineThreads::~MachineThreads):
1648         (JSC::MachineThreads::Thread::createForCurrentThread):
1649         (JSC::MachineThreads::Thread::operator==):
1650         (JSC::isThreadInList):
1651         (JSC::MachineThreads::addCurrentThread):
1652         (JSC::MachineThreads::machineThreadForCurrentThread):
1653         (JSC::MachineThreads::removeThread):
1654         (JSC::MachineThreads::gatherFromCurrentThread):
1655         (JSC::MachineThreads::Thread::Thread):
1656         (JSC::MachineThreads::Thread::~Thread):
1657         (JSC::MachineThreads::Thread::suspend):
1658         (JSC::MachineThreads::Thread::resume):
1659         (JSC::MachineThreads::Thread::getRegisters):
1660         (JSC::MachineThreads::Thread::Registers::stackPointer):
1661         (JSC::MachineThreads::Thread::Registers::framePointer):
1662         (JSC::MachineThreads::Thread::Registers::instructionPointer):
1663         (JSC::MachineThreads::Thread::freeRegisters):
1664         (JSC::pthreadSignalHandlerSuspendResume): Deleted.
1665         (JSC::MachineThreads::Thread::operator!=): Deleted.
1666         * heap/MachineStackMarker.h:
1667         (JSC::MachineThreads::Thread::operator!=):
1668         (JSC::MachineThreads::getLock):
1669         (JSC::MachineThreads::threadsListHead):
1670         * heap/MarkedBlockSet.h:
1671         * heap/MarkedSpace.cpp:
1672         (JSC::Free::Free):
1673         (JSC::Free::operator()):
1674         (JSC::FreeOrShrink::FreeOrShrink):
1675         (JSC::FreeOrShrink::operator()):
1676         * interpreter/CallFrame.h:
1677         (JSC::ExecState::calleeAsValue):
1678         (JSC::ExecState::callee):
1679         (JSC::ExecState::unsafeCallee):
1680         (JSC::ExecState::codeBlock):
1681         (JSC::ExecState::scope):
1682         * jit/ExecutableAllocator.cpp:
1683         (JSC::ExecutableAllocator::dumpProfile):
1684         (JSC::ExecutableAllocator::getLock):
1685         (JSC::ExecutableAllocator::isValidExecutableMemory):
1686         * jit/ExecutableAllocator.h:
1687         * jit/ExecutableAllocatorFixedVMPool.cpp:
1688         (JSC::ExecutableAllocator::allocate):
1689         (JSC::ExecutableAllocator::isValidExecutableMemory):
1690         (JSC::ExecutableAllocator::getLock):
1691         (JSC::ExecutableAllocator::committedByteCount):
1692         * jsc.cpp:
1693         (GlobalObject::finishCreation):
1694         (functionCheckModuleSyntax):
1695         (functionPlatformSupportsSamplingProfiler):
1696         (functionStartSamplingProfiler):
1697         (functionSamplingProfilerStackTraces):
1698         * llint/LLIntPCRanges.h: Added.
1699         (JSC::LLInt::isLLIntPC):
1700         * offlineasm/asm.rb:
1701         * runtime/Executable.h:
1702         (JSC::ExecutableBase::isModuleProgramExecutable):
1703         (JSC::ExecutableBase::isExecutableType):
1704         (JSC::ExecutableBase::isHostFunction):
1705         * runtime/JSLock.cpp:
1706         (JSC::JSLock::didAcquireLock):
1707         (JSC::JSLock::unlock):
1708         * runtime/Options.h:
1709         * runtime/SamplingProfiler.cpp: Added.
1710         (JSC::reportStats):
1711         (JSC::FrameWalker::FrameWalker):
1712         (JSC::FrameWalker::walk):
1713         (JSC::FrameWalker::wasValidWalk):
1714         (JSC::FrameWalker::advanceToParentFrame):
1715         (JSC::FrameWalker::isAtTop):
1716         (JSC::FrameWalker::resetAtMachineFrame):
1717         (JSC::FrameWalker::isValidFramePointer):
1718         (JSC::FrameWalker::isValidCodeBlock):
1719         (JSC::SamplingProfiler::SamplingProfiler):
1720         (JSC::SamplingProfiler::~SamplingProfiler):
1721         (JSC::SamplingProfiler::processUnverifiedStackTraces):
1722         (JSC::SamplingProfiler::visit):
1723         (JSC::SamplingProfiler::shutdown):
1724         (JSC::SamplingProfiler::start):
1725         (JSC::SamplingProfiler::stop):
1726         (JSC::SamplingProfiler::pause):
1727         (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread):
1728         (JSC::SamplingProfiler::dispatchIfNecessary):
1729         (JSC::SamplingProfiler::dispatchFunction):
1730         (JSC::SamplingProfiler::noticeJSLockAcquisition):
1731         (JSC::SamplingProfiler::noticeVMEntry):
1732         (JSC::SamplingProfiler::clearData):
1733         (JSC::displayName):
1734         (JSC::SamplingProfiler::stacktracesAsJSON):
1735         (WTF::printInternal):
1736         * runtime/SamplingProfiler.h: Added.
1737         (JSC::SamplingProfiler::StackFrame::StackFrame):
1738         (JSC::SamplingProfiler::getLock):
1739         (JSC::SamplingProfiler::setTimingInterval):
1740         (JSC::SamplingProfiler::stackTraces):
1741         * runtime/VM.cpp:
1742         (JSC::VM::VM):
1743         (JSC::VM::~VM):
1744         (JSC::VM::setLastStackTop):
1745         (JSC::VM::createContextGroup):
1746         (JSC::VM::ensureWatchdog):
1747         (JSC::VM::ensureSamplingProfiler):
1748         (JSC::thunkGeneratorForIntrinsic):
1749         * runtime/VM.h:
1750         (JSC::VM::watchdog):
1751         (JSC::VM::samplingProfiler):
1752         (JSC::VM::isSafeToRecurse):
1753         (JSC::VM::lastStackTop):
1754         (JSC::VM::scratchBufferForSize):
1755         (JSC::VM::setLastStackTop): Deleted.
1756         * runtime/VMEntryScope.cpp:
1757         (JSC::VMEntryScope::VMEntryScope):
1758         * tests/stress/sampling-profiler: Added.
1759         * tests/stress/sampling-profiler-anonymous-function.js: Added.
1760         (platformSupportsSamplingProfiler.foo):
1761         (platformSupportsSamplingProfiler.baz):
1762         (platformSupportsSamplingProfiler):
1763         * tests/stress/sampling-profiler-basic.js: Added.
1764         (platformSupportsSamplingProfiler.bar):
1765         (platformSupportsSamplingProfiler.foo):
1766         (platformSupportsSamplingProfiler.nothing):
1767         (platformSupportsSamplingProfiler.top):
1768         (platformSupportsSamplingProfiler.jaz):
1769         (platformSupportsSamplingProfiler.kaz):
1770         (platformSupportsSamplingProfiler.checkInlining):
1771         (platformSupportsSamplingProfiler):
1772         * tests/stress/sampling-profiler-deep-stack.js: Added.
1773         (platformSupportsSamplingProfiler.foo):
1774         (platformSupportsSamplingProfiler.let.hellaDeep):
1775         (platformSupportsSamplingProfiler.let.start):
1776         (platformSupportsSamplingProfiler):
1777         * tests/stress/sampling-profiler-microtasks.js: Added.
1778         (platformSupportsSamplingProfiler.testResults):
1779         (platformSupportsSamplingProfiler):
1780         (platformSupportsSamplingProfiler.loop.jaz):
1781         (platformSupportsSamplingProfiler.loop):
1782         * tests/stress/sampling-profiler/samplingProfiler.js: Added.
1783         (assert):
1784         (let.nodePrototype.makeChildIfNeeded):
1785         (makeNode):
1786         (updateCallingContextTree):
1787         (doesTreeHaveStackTrace):
1788         (makeTree):
1789         (runTest):
1790         (dumpTree):
1791         * yarr/YarrJIT.cpp:
1792         (JSC::Yarr::YarrGenerator::generateEnter):
1793         (JSC::Yarr::YarrGenerator::generateReturn):
1794         (JSC::Yarr::YarrGenerator::YarrGenerator):
1795         (JSC::Yarr::YarrGenerator::compile):
1796         (JSC::Yarr::jitCompile):
1797
1798 2016-01-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1799
1800         [JSC] Iterating over a Set/Map is too slow
1801         https://bugs.webkit.org/show_bug.cgi?id=152691
1802
1803         Reviewed by Saam Barati.
1804
1805         Set#forEach and Set & for-of are very slow. There are 2 reasons.
1806
1807         1. forEach is implemented in C++. And typically, taking JS callback and calling it from C++.
1808
1809         C++ to JS transition seems costly. perf result in Linux machine shows this.
1810
1811             Samples: 23K of event 'cycles', Event count (approx.): 21446074385
1812             34.04%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::Interpreter::execute(JSC::CallFrameClosure&)
1813             20.48%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] vmEntryToJavaScript
1814              9.80%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
1815              7.95%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::setProtoFuncForEach(JSC::ExecState*)
1816              5.65%  jsc  perf-22854.map                      [.] 0x00007f5d2c204a6f
1817
1818         Writing forEach in JS eliminates this.
1819
1820             Samples: 23K of event 'cycles', Event count (approx.): 21255691651
1821             62.91%  jsc  perf-22890.map                      [.] 0x00007fd117c0a3b9
1822             24.89%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::privateFuncSetIteratorNext(JSC::ExecState*)
1823              0.29%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::CodeBlock::updateAllPredictionsAndCountLiveness(unsigned int&, unsigned int&)
1824              0.24%  jsc  [vdso]                              [.] 0x00000000000008e8
1825              0.22%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::CodeBlock::predictedMachineCodeSize()
1826              0.16%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] WTF::MetaAllocator::currentStatistics()
1827              0.15%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::Lexer<unsigned char>::lex(JSC::JSToken*, unsigned int, bool)
1828
1829         2. Iterator result object allocation is costly.
1830
1831         Iterator result object allocation is costly. Even if the (1) is solved, when executing Set & for-of, perf result shows very slow performance due to (2).
1832
1833             Samples: 108K of event 'cycles', Event count (approx.): 95529273748
1834             18.02%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::createIteratorResultObject(JSC::ExecState*, JSC::JSValue, bool)
1835             15.68%  jsc  jsc                                 [.] JSC::JSObject::putDirect(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int)
1836             14.18%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::PrototypeMap::emptyObjectStructureForPrototype(JSC::JSObject*, unsigned int)
1837             13.40%  jsc  perf-25420.map                      [.] 0x00007fce158006a1
1838              6.79%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::StructureTransitionTable::get(WTF::UniquedStringImpl*, unsigned int) const
1839
1840         In the long term, we should implement SetIterator#next in JS and make the iterator result object allocation written in JS to encourage object allocation elimination in FTL.
1841         But seeing the perf result, we can find the easy to fix bottleneck in the current implementation.
1842         Every time createIteratorResultObject creates the empty object and use putDirect to store properties.
1843         The pre-baked Structure* with `done` and `value` properties makes this implementation fast.
1844
1845         After these improvements, the micro benchmark[1] shows the following.
1846
1847         old:
1848             Linked List x 212,776 ops/sec ±0.21% (162 runs sampled)
1849             Array x 376,156 ops/sec ±0.20% (162 runs sampled)
1850             Array forEach x 17,345 ops/sec ±0.99% (137 runs sampled)
1851             Array for-of x 16,518 ops/sec ±0.58% (160 runs sampled)
1852             Set forEach x 13,263 ops/sec ±0.20% (162 runs sampled)
1853             Set for-of x 4,732 ops/sec ±0.34% (123 runs sampled)
1854
1855         new:
1856             Linked List x 210,833 ops/sec ±0.28% (161 runs sampled)
1857             Array x 371,347 ops/sec ±0.36% (162 runs sampled)
1858             Array forEach x 17,460 ops/sec ±0.84% (136 runs sampled)
1859             Array for-of x 16,188 ops/sec ±1.27% (158 runs sampled)
1860             Set forEach x 23,684 ops/sec ±2.46% (139 runs sampled)
1861             Set for-of x 12,176 ops/sec ±0.54% (157 runs sampled)
1862
1863         Set#forEach becomes comparable to Array#forEach. And Set#forEach and Set & for-of are improved (1.79x, and 2.57x).
1864         After this optimizations, they are still much slower than linked list and array.
1865         This should be optimized in the long term.
1866
1867         [1]: https://gist.github.com/Constellation/8db5f5b8f12fe7e283d0
1868
1869         * CMakeLists.txt:
1870         * DerivedSources.make:
1871         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1872         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1873         * JavaScriptCore.xcodeproj/project.pbxproj:
1874         * builtins/MapPrototype.js: Copied from Source/JavaScriptCore/runtime/IteratorOperations.h.
1875         (forEach):
1876         * builtins/SetPrototype.js: Copied from Source/JavaScriptCore/runtime/IteratorOperations.h.
1877         (forEach):
1878         * runtime/CommonIdentifiers.h:
1879         * runtime/IteratorOperations.cpp:
1880         (JSC::createIteratorResultObjectStructure):
1881         (JSC::createIteratorResultObject):
1882         * runtime/IteratorOperations.h:
1883         * runtime/JSGlobalObject.cpp:
1884         (JSC::JSGlobalObject::init):
1885         (JSC::JSGlobalObject::visitChildren):
1886         * runtime/JSGlobalObject.h:
1887         (JSC::JSGlobalObject::iteratorResultObjectStructure):
1888         (JSC::JSGlobalObject::iteratorResultStructure): Deleted.
1889         (JSC::JSGlobalObject::iteratorResultStructureOffset): Deleted.
1890         * runtime/MapPrototype.cpp:
1891         (JSC::MapPrototype::getOwnPropertySlot):
1892         (JSC::privateFuncIsMap):
1893         (JSC::privateFuncMapIterator):
1894         (JSC::privateFuncMapIteratorNext):
1895         (JSC::MapPrototype::finishCreation): Deleted.
1896         (JSC::mapProtoFuncForEach): Deleted.
1897         * runtime/MapPrototype.h:
1898         * runtime/SetPrototype.cpp:
1899         (JSC::SetPrototype::getOwnPropertySlot):
1900         (JSC::privateFuncIsSet):
1901         (JSC::privateFuncSetIterator):
1902         (JSC::privateFuncSetIteratorNext):
1903         (JSC::SetPrototype::finishCreation): Deleted.
1904         (JSC::setProtoFuncForEach): Deleted.
1905         * runtime/SetPrototype.h:
1906
1907 2016-01-10  Filip Pizlo  <fpizlo@apple.com>
1908
1909         Unreviewed, fix ARM64 build.
1910
1911         * b3/air/AirOpcode.opcodes:
1912
1913 2016-01-10  Filip Pizlo  <fpizlo@apple.com>
1914
1915         B3 should reduce Trunc(BitOr(value, constant)) where !(constant & 0xffffffff) to Trunc(value)
1916         https://bugs.webkit.org/show_bug.cgi?id=152955
1917
1918         Reviewed by Saam Barati.
1919
1920         This happens when we box an int32 and then immediately unbox it.
1921
1922         This makes an enormous difference on AsmBench/FloatMM. It's a 2x speed-up on that
1923         benchmark. It's neutral elsewhere.
1924
1925         * b3/B3ReduceStrength.cpp:
1926         * b3/testb3.cpp:
1927         (JSC::B3::testPowDoubleByIntegerLoop):
1928         (JSC::B3::testTruncOrHigh):
1929         (JSC::B3::testTruncOrLow):
1930         (JSC::B3::testBitAndOrHigh):
1931         (JSC::B3::testBitAndOrLow):
1932         (JSC::B3::zero):
1933         (JSC::B3::run):
1934
1935 2016-01-10  Skachkov Oleksandr  <gskachkov@gmail.com>
1936
1937         [ES6] Arrow function syntax. Get rid of JSArrowFunction and use standard JSFunction class
1938         https://bugs.webkit.org/show_bug.cgi?id=149855
1939
1940         Reviewed by Saam Barati.
1941
1942         JSArrowFunction.h/cpp were removed from JavaScriptCore, because now is used new approach for storing
1943         'this', 'arguments' and 'super'
1944
1945         * CMakeLists.txt:
1946         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1947         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1948         * JavaScriptCore.xcodeproj/project.pbxproj:
1949         * dfg/DFGAbstractInterpreterInlines.h:
1950         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1951         * dfg/DFGSpeculativeJIT.cpp:
1952         (JSC::DFG::SpeculativeJIT::compileNewFunction):
1953         * dfg/DFGStructureRegistrationPhase.cpp:
1954         (JSC::DFG::StructureRegistrationPhase::run):
1955         * ftl/FTLAbstractHeapRepository.cpp:
1956         * ftl/FTLAbstractHeapRepository.h:
1957         * ftl/FTLLowerDFGToLLVM.cpp:
1958         (JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction):
1959         * interpreter/Interpreter.cpp:
1960         * interpreter/Interpreter.h:
1961         * jit/JITOpcodes.cpp:
1962         * jit/JITOpcodes32_64.cpp:
1963         * jit/JITOperations.cpp:
1964         * jit/JITOperations.h:
1965         * llint/LLIntOffsetsExtractor.cpp:
1966         * llint/LLIntSlowPaths.cpp:
1967         * runtime/JSArrowFunction.cpp: Removed.
1968         * runtime/JSArrowFunction.h: Removed.
1969         * runtime/JSGlobalObject.cpp:
1970         * runtime/JSGlobalObject.h:
1971
1972 2016-01-10  Filip Pizlo  <fpizlo@apple.com>
1973
1974         It should be possible to run liveness over registers without also tracking Tmps
1975         https://bugs.webkit.org/show_bug.cgi?id=152963
1976
1977         Reviewed by Saam Barati.
1978
1979         This adds a RegLivenessAdapter so that we can run Liveness over registers. This makes it
1980         easier to write certain kinds of phases, like ReportUsedRegisters. I anticipate writing more
1981         code like that for handling cold function calls. It also makes code like that somewhat more
1982         scalable, since we're no longer using HashSets.
1983
1984         Currently, the way we track sets of registers is with a BitVector. Normally, we use the
1985         RegisterSet class, which wraps BitVector, so that we can add()/contains() on Reg's. But in
1986         the liveness analysis, everything gets turned into an index. So, we want to use BitVector
1987         directly. To do that, I needed to make the BitVector API look a bit more like a set API. I
1988         think that this is good, because the lack of set methods (add/remove/contains) has caused
1989         bugs in the past. This makes BitVector have methods both for set operations on bits and array
1990         operations on bits. I think that's good, since BitVector gets used in both contexts.
1991
1992         * b3/B3IndexSet.h:
1993         (JSC::B3::IndexSet::Iterable::iterator::iterator):
1994         (JSC::B3::IndexSet::Iterable::begin):
1995         (JSC::B3::IndexSet::dump):
1996         * b3/air/AirInstInlines.h:
1997         (JSC::B3::Air::ForEach<Tmp>::forEach):
1998         (JSC::B3::Air::ForEach<Arg>::forEach):
1999         (JSC::B3::Air::ForEach<Reg>::forEach):
2000         (JSC::B3::Air::Inst::forEach):
2001         * b3/air/AirLiveness.h:
2002         (JSC::B3::Air::RegLivenessAdapter::RegLivenessAdapter):
2003         (JSC::B3::Air::RegLivenessAdapter::maxIndex):
2004         (JSC::B3::Air::RegLivenessAdapter::acceptsType):
2005         (JSC::B3::Air::RegLivenessAdapter::valueToIndex):
2006         (JSC::B3::Air::RegLivenessAdapter::indexToValue):
2007         * b3/air/AirReportUsedRegisters.cpp:
2008         (JSC::B3::Air::reportUsedRegisters):
2009         * jit/Reg.h:
2010         (JSC::Reg::next):
2011         (JSC::Reg::index):
2012         (JSC::Reg::maxIndex):
2013         (JSC::Reg::isSet):
2014         (JSC::Reg::operator bool):
2015         * jit/RegisterSet.h:
2016         (JSC::RegisterSet::forEach):
2017
2018 2016-01-10  Benjamin Poulain  <bpoulain@apple.com>
2019
2020         [JSC] Make branchMul functional in ARM B3 and minor fixes
2021         https://bugs.webkit.org/show_bug.cgi?id=152889
2022
2023         Reviewed by Mark Lam.
2024
2025         ARM64 does not have a "S" version of MUL setting the flags.
2026         What we do is abstract that in the MacroAssembler. The problem
2027         is that form requires scratch registers.
2028
2029         For simplicity, I just exposed the two scratch registers
2030         for Air. Filip already added the concept of Scratch role,
2031         all I needed was to expose it for opcodes.
2032
2033         * assembler/MacroAssemblerARM64.h:
2034         (JSC::MacroAssemblerARM64::branchMul32):
2035         (JSC::MacroAssemblerARM64::branchMul64):
2036         Expose a version with the scratch registers as arguments.
2037
2038         * b3/B3LowerToAir.cpp:
2039         (JSC::B3::Air::LowerToAir::lower):
2040         Add the new form of CheckMul lowering.
2041
2042         * b3/air/AirOpcode.opcodes:
2043         Expose the new BranchMuls.
2044         Remove all the Test variants that use immediates
2045         since Air can't handle those immediates correctly yet.
2046
2047         * b3/air/opcode_generator.rb:
2048         Expose the Scratch role.
2049
2050         * b3/testb3.cpp:
2051         (JSC::B3::testPatchpointLotsOfLateAnys):
2052         Ooops, the scratch registers were not clobbered. We were just lucky
2053         on x86.
2054
2055 2016-01-10  Benjamin Poulain  <bpoulain@apple.com>
2056
2057         [JSC] B3 is unable to do function calls on ARM64
2058         https://bugs.webkit.org/show_bug.cgi?id=152895
2059
2060         Reviewed by Mark Lam.
2061
2062         Apparently iOS does not follow the ARM64 ABI for function calls.
2063         Instead of giving each value a 8 bytes slot, it must be packed
2064         while preserving alignment.
2065
2066         This patch adds a #ifdef to make function calls functional.
2067
2068         * b3/B3LowerToAir.cpp:
2069         (JSC::B3::Air::LowerToAir::marshallCCallArgument):
2070         (JSC::B3::Air::LowerToAir::lower):
2071
2072 2016-01-09  Filip Pizlo  <fpizlo@apple.com>
2073
2074         Air should support Branch64 with immediates
2075         https://bugs.webkit.org/show_bug.cgi?id=152951
2076
2077         Reviewed by Oliver Hunt.
2078
2079         This doesn't significantly improve performance on any benchmarks, but it's great to get this
2080         obvious omission out of the way.
2081
2082         * assembler/MacroAssemblerX86_64.h:
2083         (JSC::MacroAssemblerX86_64::branch64):
2084         * b3/air/AirOpcode.opcodes:
2085         * b3/testb3.cpp:
2086         (JSC::B3::testPowDoubleByIntegerLoop):
2087         (JSC::B3::testBranch64Equal):
2088         (JSC::B3::testBranch64EqualImm):
2089         (JSC::B3::testBranch64EqualMem):
2090         (JSC::B3::testBranch64EqualMemImm):
2091         (JSC::B3::zero):
2092         (JSC::B3::run):
2093
2094 2016-01-09  Dan Bernstein  <mitz@apple.com>
2095
2096         [Cocoa] Allow overriding the frameworks directory independently of using a staging install path
2097         https://bugs.webkit.org/show_bug.cgi?id=152926
2098
2099         Reviewed by Tim Horton.
2100
2101         Introduce a new build setting, WK_OVERRIDE_FRAMEWORKS_DIR. When not empty, it determines
2102         where the frameworks are installed. Setting USE_STAGING_INSTALL_PATH to YES sets
2103         WK_OVERRIDE_FRAMEWORKS_DIR to $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari.
2104
2105         Account for the possibility of WK_OVERRIDE_FRAMEWORKS_DIR containing spaces.
2106
2107         * Configurations/Base.xcconfig:
2108         - Replace STAGED_FRAMEWORKS_SEARCH_PATH in FRAMEWORK_SEARCH_PATHS with
2109           WK_OVERRIDE_FRAMEWORKS_DIR and add quotes to account for spaces.
2110         - Define JAVASCRIPTCORE_FRAMEWORKS_DIR based on WK_OVERRIDE_FRAMEWORKS_DIR.
2111         * Configurations/JSC.xcconfig:
2112           Add quotes to account for spaces.
2113         * Configurations/ToolExecutable.xcconfig:
2114           Ditto.
2115         * postprocess-headers.sh:
2116           Ditto.
2117
2118 2016-01-09  Mark Lam  <mark.lam@apple.com>
2119
2120         The FTL allocated spill slots for BinaryOps is sometimes inaccurate.
2121         https://bugs.webkit.org/show_bug.cgi?id=152918
2122
2123         Reviewed by Filip Pizlo and Saam Barati.
2124
2125         * ftl/FTLCompile.cpp:
2126         - Updated a comment.
2127         * ftl/FTLLowerDFGToLLVM.cpp:
2128         (JSC::FTL::DFG::LowerDFGToLLVM::lower):
2129         - The code to compute maxNumberOfCatchSpills was unnecessarily allocating an
2130           extra slot for BinaryOps that don't have Untyped operands, and failing to
2131           allocate that extra slot for some binary ops.  This is now fixed.
2132
2133         * tests/stress/ftl-shr-exception.js:
2134         * tests/stress/ftl-xor-exception.js:
2135         - Un-skipped these tests.  They now pass with this patch.
2136
2137 2016-01-09  Andreas Kling  <akling@apple.com>
2138
2139         Use NeverDestroyed instead of DEPRECATED_DEFINE_STATIC_LOCAL
2140         <https://webkit.org/b/152902>
2141
2142         Reviewed by Anders Carlsson.
2143
2144         Mostly mechanical conversion to NeverDestroyed throughout JavaScriptCore.
2145
2146         * API/JSAPIWrapperObject.mm:
2147         (jsAPIWrapperObjectHandleOwner):
2148         * API/JSManagedValue.mm:
2149         (managedValueHandleOwner):
2150         * inspector/agents/InspectorDebuggerAgent.cpp:
2151         (Inspector::objectGroupForBreakpointAction):
2152         * jit/ExecutableAllocator.cpp:
2153         (JSC::DemandExecutableAllocator::allocators):
2154
2155 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2156
2157         FTL B3 should do varargs tail calls and stack overflows
2158         https://bugs.webkit.org/show_bug.cgi?id=152934
2159
2160         Reviewed by Saam Barati.
2161
2162         I was trying to get tail-call-varargs-no-stack-overflow.js.ftl-no-cjit-validate to work and
2163         at first I hit the stack overflow issue and then I hit the varargs tail call issue. That's
2164         why I have two fixes in one change. Now the test passes.
2165
2166         This reduces the number of failures from 13 to 0.
2167
2168         * ftl/FTLLowerDFGToLLVM.cpp:
2169         (JSC::FTL::DFG::LowerDFGToLLVM::lower): Implement stack overflow handling.
2170         (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs): Varargs tail calls need to
2171         append an Oops (i.e. "unreachable").
2172
2173 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2174
2175         B3 needs Neg()
2176         https://bugs.webkit.org/show_bug.cgi?id=152925
2177
2178         Reviewed by Mark Lam.
2179
2180         Previously we said that negation should be represented as Sub(0, x). That's wrong, since
2181         for floats, Sub(0, 0) == 0 while Neg(0) == -0.
2182
2183         One way to solve this would be to say that anyone trying to say Neg(x) where x is a float
2184         should instead say BitXor(x, -0). That's actually correct, but I think that it would be odd
2185         to use bitops to represent floating point operations. Whatever cuteness this would have
2186         bought us would be outweighed by the annoyance of having to write code that matches
2187         Sub(0, x) for integer negation and BitXor(x, -0) for double negation. For example, this
2188         would mean strictly more code for anyone implementing a Neg(Neg(x))=>x strength reduction.
2189         Also, I suspect that the omission of Neg would cause others to make the mistake of using
2190         Sub to represent floating point negation.
2191
2192         So, this introduces a proper Neg() opcode to B3. It's now the canonical way of saying
2193         negation for both ints and floats. For ints, we canonicalize Sub(0, x) to Neg(x). For
2194         floats, we lower it to BitXor(x, -0) on x86.
2195
2196         This reduces the number of failures from 13 to 12.
2197
2198         * assembler/MacroAssemblerX86Common.h:
2199         (JSC::MacroAssemblerX86Common::andFloat):
2200         (JSC::MacroAssemblerX86Common::xorDouble):
2201         (JSC::MacroAssemblerX86Common::xorFloat):
2202         (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
2203         * b3/B3LowerMacrosAfterOptimizations.cpp:
2204         * b3/B3LowerToAir.cpp:
2205         (JSC::B3::Air::LowerToAir::lower):
2206         * b3/B3Opcode.cpp:
2207         (WTF::printInternal):
2208         * b3/B3Opcode.h:
2209         * b3/B3ReduceStrength.cpp:
2210         * b3/B3Validate.cpp:
2211         * b3/B3Value.cpp:
2212         (JSC::B3::Value::effects):
2213         (JSC::B3::Value::key):
2214         (JSC::B3::Value::typeFor):
2215         * b3/air/AirOpcode.opcodes:
2216         * ftl/FTLB3Output.cpp:
2217         (JSC::FTL::Output::lockedStackSlot):
2218         (JSC::FTL::Output::neg):
2219         (JSC::FTL::Output::bitNot):
2220         * ftl/FTLB3Output.h:
2221         (JSC::FTL::Output::chillDiv):
2222         (JSC::FTL::Output::mod):
2223         (JSC::FTL::Output::chillMod):
2224         (JSC::FTL::Output::doubleAdd):
2225         (JSC::FTL::Output::doubleSub):
2226         (JSC::FTL::Output::doubleMul):
2227         (JSC::FTL::Output::doubleDiv):
2228         (JSC::FTL::Output::doubleMod):
2229         (JSC::FTL::Output::doubleNeg):
2230         (JSC::FTL::Output::bitAnd):
2231         (JSC::FTL::Output::bitOr):
2232         (JSC::FTL::Output::neg): Deleted.
2233         * tests/stress/ftl-negate-zero.js: Added. This was already covered by op_negate but since
2234         it's such a glaring bug, I thought having a test for it specifically would be good.
2235
2236 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2237
2238         FTL B3 compile() doesn't clear exception handlers before we add FTL-specific ones
2239         https://bugs.webkit.org/show_bug.cgi?id=152922
2240
2241         Reviewed by Saam Barati.
2242
2243         FTL B3 was generating a handler table that first contained the old baseline handlers keyed
2244         by baseline's bytecode indices and then the FTL handlers keyed by FTL callsite index. That's
2245         wrong, since the FTL code block should not contain any baseline handlers. The fix is to
2246         clear the handlers before generation, sort of like FTL LLVM does.
2247
2248         Also added some stuff to make it easier to inspect the handler table.
2249
2250         This reduces the numbe rof failures from 25 to 13.
2251
2252         * bytecode/CodeBlock.cpp:
2253         (JSC::CodeBlock::dumpBytecode):
2254         (JSC::CodeBlock::dumpExceptionHandlers):
2255         (JSC::CodeBlock::beginDumpProfiling):
2256         * bytecode/CodeBlock.h:
2257         * ftl/FTLB3Compile.cpp:
2258         (JSC::FTL::compile):
2259
2260 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2261
2262         B3 incorrectly turns NotEqual(bool, 1) into Equal(bool, 1) instead of Equal(bool, 0)
2263         https://bugs.webkit.org/show_bug.cgi?id=152916
2264
2265         Reviewed by Mark Lam.
2266
2267         This was causing a failure in an ancient DFG layout test. Thanks, ftl-eager-no-cjit!
2268
2269         This reduces the number of failures from 27 to 25.
2270
2271         * b3/B3ReduceStrength.cpp:
2272
2273 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2274
2275         FTL B3 allocateCell() should not crash
2276         https://bugs.webkit.org/show_bug.cgi?id=152909
2277
2278         Reviewed by Mark Lam.
2279
2280         This code was crashing in some tests that forced GC slow paths because it was stubbed out
2281         due to the use of undef. B3 doesn't have undef. In this case, there's no good reason to use
2282         undef. We can just use zero. Since the path is dead anyway in that case, we weren't gaining
2283         any LLVM optimizations by using undef.
2284
2285         This reduces the number of failures from 35 to 27.
2286
2287         * ftl/FTLLowerDFGToLLVM.cpp:
2288         (JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):
2289
2290 2016-01-08  Filip Pizlo  <fpizlo@apple.com>
2291
2292         FTL B3 fails to realize that binary snippets might choose to omit their fast path
2293         https://bugs.webkit.org/show_bug.cgi?id=152901
2294
2295         Reviewed by Mark Lam.
2296
2297         This reduces the number of failures from 99 to 35.
2298
2299         * ftl/FTLLowerDFGToLLVM.cpp:
2300         (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
2301
2302 2016-01-08  Saam barati  <sbarati@apple.com>
2303
2304         restoreCalleeSavesFromVMCalleeSavesBuffer should use the scratch register
2305         https://bugs.webkit.org/show_bug.cgi?id=152879
2306
2307         Reviewed by Filip Pizlo.
2308
2309         We were clobbering a register we needed when picking
2310         a scratch register inside an FTL OSR Exit.
2311
2312         * dfg/DFGThunks.cpp:
2313         (JSC::DFG::osrEntryThunkGenerator):
2314         * jit/AssemblyHelpers.cpp:
2315         (JSC::AssemblyHelpers::emitRandomThunk):
2316         (JSC::AssemblyHelpers::restoreCalleeSavesFromVMCalleeSavesBuffer):
2317         * jit/AssemblyHelpers.h:
2318         (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMCalleeSavesBuffer):
2319         (JSC::AssemblyHelpers::restoreCalleeSavesFromVMCalleeSavesBuffer): Deleted.
2320         * tests/stress/ftl-put-by-id-setter-exception-interesting-live-state.js:
2321         (foo):
2322
2323 2016-01-08  Mark Lam  <mark.lam@apple.com>
2324
2325         Rolling out: Rename StringFromCharCode to StringFromSingleCharCode.
2326         https://bugs.webkit.org/show_bug.cgi?id=152897
2327
2328         Not reviewed.
2329
2330         * dfg/DFGAbstractInterpreterInlines.h:
2331         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2332         * dfg/DFGByteCodeParser.cpp:
2333         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
2334         * dfg/DFGClobberize.h:
2335         (JSC::DFG::clobberize):
2336         * dfg/DFGDoesGC.cpp:
2337         (JSC::DFG::doesGC):
2338         * dfg/DFGFixupPhase.cpp:
2339         (JSC::DFG::FixupPhase::fixupNode):
2340         * dfg/DFGNodeType.h:
2341         * dfg/DFGOperations.cpp:
2342         * dfg/DFGOperations.h:
2343         * dfg/DFGPredictionPropagationPhase.cpp:
2344         (JSC::DFG::PredictionPropagationPhase::propagate):
2345         * dfg/DFGSafeToExecute.h:
2346         (JSC::DFG::safeToExecute):
2347         * dfg/DFGSpeculativeJIT.cpp:
2348         (JSC::DFG::SpeculativeJIT::compileFromCharCode):
2349         * dfg/DFGSpeculativeJIT32_64.cpp:
2350         (JSC::DFG::SpeculativeJIT::compile):
2351         * dfg/DFGSpeculativeJIT64.cpp:
2352         (JSC::DFG::SpeculativeJIT::compile):
2353         * runtime/StringConstructor.cpp:
2354         (JSC::stringFromCharCode):
2355         (JSC::stringFromSingleCharCode): Deleted.
2356         * runtime/StringConstructor.h:
2357
2358 2016-01-08  Per Arne Vollan  <peavo@outlook.com>
2359
2360         [JSC] Use std::call_once instead of pthread_once when initializing LLVM.
2361         https://bugs.webkit.org/show_bug.cgi?id=152893
2362
2363         Reviewed by Mark Lam.
2364
2365         Use std::call_once since pthreads is not present on all platforms.
2366
2367         * llvm/InitializeLLVM.cpp:
2368         (JSC::initializeLLVMImpl):
2369         (JSC::initializeLLVM):
2370
2371 2016-01-08  Mark Lam  <mark.lam@apple.com>
2372
2373         Rename StringFromCharCode to StringFromSingleCharCode.
2374         https://bugs.webkit.org/show_bug.cgi?id=152897
2375
2376         Reviewed by Daniel Bates.
2377
2378         StringFromSingleCharCode is a better name because the intrinsic it represents
2379         only applies when we are converting from a single char code.  This is purely
2380         a refactoring patch.  There is no semantic change.
2381
2382         * dfg/DFGAbstractInterpreterInlines.h:
2383         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2384         * dfg/DFGByteCodeParser.cpp:
2385         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
2386         * dfg/DFGClobberize.h:
2387         (JSC::DFG::clobberize):
2388         * dfg/DFGDoesGC.cpp:
2389         (JSC::DFG::doesGC):
2390         * dfg/DFGFixupPhase.cpp:
2391         (JSC::DFG::FixupPhase::fixupNode):
2392         * dfg/DFGNodeType.h:
2393         * dfg/DFGOperations.cpp:
2394         * dfg/DFGOperations.h:
2395         * dfg/DFGPredictionPropagationPhase.cpp:
2396         (JSC::DFG::PredictionPropagationPhase::propagate):
2397         * dfg/DFGSafeToExecute.h:
2398         (JSC::DFG::safeToExecute):
2399         * dfg/DFGSpeculativeJIT.cpp:
2400         (JSC::DFG::SpeculativeJIT::compileFromCharCode):
2401         * dfg/DFGSpeculativeJIT32_64.cpp:
2402         (JSC::DFG::SpeculativeJIT::compile):
2403         * dfg/DFGSpeculativeJIT64.cpp:
2404         (JSC::DFG::SpeculativeJIT::compile):
2405         * runtime/StringConstructor.cpp:
2406         (JSC::stringFromCharCode):
2407         (JSC::stringFromSingleCharCode):
2408         * runtime/StringConstructor.h:
2409
2410 2016-01-08  Konstantin Tokarev  <annulen@yandex.ru>
2411
2412         [mips] Fixed unused parameter warnings
2413         https://bugs.webkit.org/show_bug.cgi?id=152885
2414
2415         Reviewed by Mark Lam.
2416
2417         * jit/CCallHelpers.h:
2418         (JSC::CCallHelpers::setupArgumentsWithExecState):
2419
2420 2016-01-08  Konstantin Tokarev  <annulen@yandex.ru>
2421
2422         [mips] Max value of immediate arg of logical ops is 0xffff
2423         https://bugs.webkit.org/show_bug.cgi?id=152884
2424
2425         Reviewed by Michael Saboff.
2426
2427         Replaced imm.m_value < 65535 checks with imm.m_value <= 65535
2428
2429         * assembler/MacroAssemblerMIPS.h:
2430         (JSC::MacroAssemblerMIPS::and32):
2431         (JSC::MacroAssemblerMIPS::or32):
2432
2433 2016-01-08  Konstantin Tokarev  <annulen@yandex.ru>
2434
2435         [mips] Add new or32 implementation after r194613
2436         https://bugs.webkit.org/show_bug.cgi?id=152865
2437
2438         Reviewed by Michael Saboff.
2439
2440         * assembler/MacroAssemblerMIPS.h:
2441         (JSC::MacroAssemblerMIPS::or32):
2442
2443 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2444
2445         FTL B3 lazy slow paths should do exceptions
2446         https://bugs.webkit.org/show_bug.cgi?id=152853
2447
2448         Reviewed by Saam Barati.
2449
2450         This reduces the number of JSC test failures to 97.
2451
2452         * ftl/FTLLowerDFGToLLVM.cpp:
2453         (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
2454         * tests/stress/ftl-new-negative-array-size.js: Added.
2455         (foo):
2456
2457 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2458
2459         Unreviewed, skip more tests that fail.
2460
2461         * tests/stress/ftl-shr-exception.js:
2462         (foo):
2463         * tests/stress/ftl-xor-exception.js:
2464         (foo):
2465
2466 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2467
2468         FTL B3 binary snippets should do exceptions
2469         https://bugs.webkit.org/show_bug.cgi?id=152852
2470
2471         Reviewed by Saam Barati.
2472
2473         This reduces the number of JSC test failures to 110.
2474
2475         * ftl/FTLLowerDFGToLLVM.cpp:
2476         (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
2477         (JSC::FTL::DFG::LowerDFGToLLVM::emitBinaryBitOpSnippet):
2478         (JSC::FTL::DFG::LowerDFGToLLVM::emitRightShiftSnippet):
2479         * tests/stress/ftl-shr-exception.js: Added.
2480         (foo):
2481         (result.foo.valueOf):
2482         * tests/stress/ftl-sub-exception.js: Added.
2483         (foo):
2484         (result.foo.valueOf):
2485         * tests/stress/ftl-xor-exception.js: Added.
2486         (foo):
2487         (result.foo.valueOf):
2488
2489 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2490
2491         Unreviewed, skipping this test. Looks like LLVM can't handle this one, either.
2492
2493         * tests/stress/ftl-call-varargs-bad-args-exception-interesting-live-state.js:
2494         (foo):
2495
2496 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2497
2498         Unreviewed, skipping this test. Looks like LLVM can't handle it.
2499
2500         * tests/stress/ftl-put-by-id-setter-exception-interesting-live-state.js:
2501         (foo):
2502
2503 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2504
2505         FTL B3 JS calls should do exceptions
2506         https://bugs.webkit.org/show_bug.cgi?id=152851
2507
2508         Reviewed by Geoffrey Garen.
2509
2510         This reduces the number of JSC test failures with FTL B3 to 111.
2511
2512         * dfg/DFGSpeculativeJIT64.cpp:
2513         (JSC::DFG::SpeculativeJIT::emitCall):
2514         * ftl/FTLLowerDFGToLLVM.cpp:
2515         (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
2516         (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
2517         (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
2518         * tests/stress/ftl-call-bad-args-exception-interesting-live-state.js: Added.
2519         * tests/stress/ftl-call-bad-callee-exception-interesting-live-state.js: Added.
2520         * tests/stress/ftl-call-exception-interesting-live-state.js: Added.
2521         * tests/stress/ftl-call-exception-no-catch.js: Added.
2522         * tests/stress/ftl-call-exception.js: Added.
2523         * tests/stress/ftl-call-varargs-bad-callee-exception-interesting-live-state.js: Added.
2524         * tests/stress/ftl-call-varargs-exception-interesting-live-state.js: Added.
2525         * tests/stress/ftl-call-varargs-exception-no-catch.js: Added.
2526         * tests/stress/ftl-call-varargs-exception.js: Added.
2527
2528 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2529
2530         FTL B3 PutById should do exceptions
2531         https://bugs.webkit.org/show_bug.cgi?id=152850
2532
2533         Reviewed by Saam Barati.
2534
2535         Implemented PutById exception handling by following the idiom used in GetById. Reduces the
2536         number of JSC test failures to 128.
2537
2538         * ftl/FTLLowerDFGToLLVM.cpp:
2539         (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
2540         * tests/stress/ftl-put-by-id-setter-exception-interesting-live-state.js: Added.
2541         * tests/stress/ftl-put-by-id-setter-exception-no-catch.js: Added.
2542         * tests/stress/ftl-put-by-id-setter-exception.js: Added.
2543         * tests/stress/ftl-put-by-id-slow-exception-interesting-live-state.js: Added.
2544         * tests/stress/ftl-put-by-id-slow-exception-no-catch.js: Added.
2545         * tests/stress/ftl-put-by-id-slow-exception.js: Added.
2546
2547 2016-01-07  Commit Queue  <commit-queue@webkit.org>
2548
2549         Unreviewed, rolling out r194714.
2550         https://bugs.webkit.org/show_bug.cgi?id=152864
2551
2552         it broke many JSC tests when FTL B3 is enabled (Requested by
2553         pizlo on #webkit).
2554
2555         Reverted changeset:
2556
2557         "[JSC] When resolving Stack arguments, use addressing from SP
2558         when addressing from FP is invalid"
2559         https://bugs.webkit.org/show_bug.cgi?id=152840
2560         http://trac.webkit.org/changeset/194714
2561
2562 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2563
2564         [mips] Lower immediates of logical operations.
2565         https://bugs.webkit.org/show_bug.cgi?id=152693
2566
2567         On MIPS immediate operands of andi, ori, and xori are required to be 16-bit
2568         non-negative numbers.
2569
2570         Reviewed by Michael Saboff.
2571
2572         * offlineasm/mips.rb:
2573
2574 2016-01-07  Benjamin Poulain  <bpoulain@apple.com>
2575
2576         [JSC] Update testCheckSubBadImm() for ARM64
2577         https://bugs.webkit.org/show_bug.cgi?id=152846
2578
2579         Reviewed by Mark Lam.
2580
2581         * b3/testb3.cpp:
2582         (JSC::B3::testCheckSubBadImm):
2583         The test was assuming the constant can always be used
2584         as immediate. That's obviously not the case on ARM64.
2585
2586 2016-01-07  Filip Pizlo  <fpizlo@apple.com>
2587
2588         FTL B3 getById() should do exceptions
2589         https://bugs.webkit.org/show_bug.cgi?id=152810
2590
2591         Reviewed by Saam Barati.
2592
2593         This adds abstractions for doing exceptions from patchpoints, and uses them to implement
2594         exceptions from GetById. This covers all of the following ways that a GetById might throw an
2595         exceptions:
2596
2597         - Throw without try/catch from the vmCall() in a GetById(Untyped:)
2598         - Throw with try/catch from the vmCall() in a GetById(Untyped:)
2599         - Throw without try/catch from the callOperation() in the patchpoint of a GetById
2600         - Throw with try/catch from the callOperation() in the patchpoint of a GetById
2601         - Throw without try/catch from the Call IC generated in the patchpoint of a GetById
2602         - Throw with try/catch from the Call IC generated in the patchpoint of a GetById
2603
2604         This requires having a default exception target in FTL-generated code, and ensuring that this
2605         target is generated regardless of whether we have branches to the B3 basic block of the
2606         default exception target. This also requires adding some extra arguments to a
2607         PatchpointValue, and then knowing that the arguments are used for OSR exit and not anything
2608         else. This also requires associating the CallSiteIndex of the patchpoint with the register
2609         set used for exit and with the OSR exit label for the unwind exit.
2610
2611         All of the stuff that you have to worry about when wiring a patchpoint to exception handling
2612         is covered by the new PatchpointExceptionHandle object. You create one by calling
2613         preparePatchpointForExceptions(). This sets up the B3 IR representation of the patchpoint
2614         with stackmap arguments for the exceptional exit, and creates a PatchpointExceptionHandle
2615         object that can be used to create zero or more actual OSR exits. It can create both OSR exits
2616         for operation calls and OSR exits for unwind. You call the
2617         PatchpointExceptionHandle::scheduleExitCreationXXX() methods from the generator callback to
2618         actually get OSR exits.
2619
2620         This API makes heavy use of Box<>, late paths, and link tasks. For example, you can use the
2621         PatchpointExceptionHandle to get a Box<JumpList> that you can append exception jumps to. When
2622         you use this API, it automatically registers a link task that will link the JumpList to the
2623         actual OSR exit label.
2624
2625         This API is very flexible about how you get to the label of the OSR exit. You are encouraged
2626         to use the Box<JumpList> approach, but if you really just need the label, you can also get
2627         a RefPtr<ExceptionTarget> and rely on the fact that the ExceptionTarget object will be able
2628         to vend you the OSR exit label at link-time.
2629
2630         This reduces the number of JSC test failures with FTL B3 from 186 to 133. It also adds a
2631         bunch of new tests specifically for all of the ways you might throw from GetById, and B3
2632         passes all of these new tests. Note that I'm not counting the new tests as part of the
2633         previous 186 test failures (FTL B3 failed all of the new tests prior to this change).
2634
2635         After this change, it should be easy to make all of the other patchpoints also handle
2636         exceptions by just following the preparePatchpointForExceptions() idiom.
2637
2638         * CMakeLists.txt:
2639         * JavaScriptCore.xcodeproj/project.pbxproj:
2640         * b3/B3StackmapValue.h:
2641         * b3/B3ValueRep.cpp:
2642         (JSC::B3::ValueRep::addUsedRegistersTo):
2643         (JSC::B3::ValueRep::usedRegisters):
2644         (JSC::B3::ValueRep::dump):
2645         * b3/B3ValueRep.h:
2646         (JSC::B3::ValueRep::doubleValue):
2647         (JSC::B3::ValueRep::withOffset):
2648         (JSC::B3::ValueRep::usedRegisters):
2649         * ftl/FTLB3Compile.cpp:
2650         (JSC::FTL::compile):
2651         * ftl/FTLB3Output.h:
2652         (JSC::FTL::Output::unreachable):
2653         (JSC::FTL::Output::speculate):
2654         * ftl/FTLExceptionTarget.cpp: Added.
2655         (JSC::FTL::ExceptionTarget::~ExceptionTarget):
2656         (JSC::FTL::ExceptionTarget::label):
2657         (JSC::FTL::ExceptionTarget::jumps):
2658         (JSC::FTL::ExceptionTarget::ExceptionTarget):
2659         * ftl/FTLExceptionTarget.h: Added.
2660         * ftl/FTLJITCode.cpp:
2661         (JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
2662         * ftl/FTLLowerDFGToLLVM.cpp:
2663         (JSC::FTL::DFG::LowerDFGToLLVM::lower):
2664         (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
2665         (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
2666         (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
2667         (JSC::FTL::DFG::LowerDFGToLLVM::compileMakeRope):
2668         (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
2669         (JSC::FTL::DFG::LowerDFGToLLVM::compileIn):
2670         (JSC::FTL::DFG::LowerDFGToLLVM::getById):
2671         (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
2672         (JSC::FTL::DFG::LowerDFGToLLVM::emitBinaryBitOpSnippet):
2673         (JSC::FTL::DFG::LowerDFGToLLVM::emitRightShiftSnippet):
2674         (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
2675         (JSC::FTL::DFG::LowerDFGToLLVM::preparePatchpointForExceptions):
2676         (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
2677         (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
2678         (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
2679         (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
2680         * ftl/FTLPatchpointExceptionHandle.cpp: Added.
2681         (JSC::FTL::PatchpointExceptionHandle::create):
2682         (JSC::FTL::PatchpointExceptionHandle::defaultHandle):
2683         (JSC::FTL::PatchpointExceptionHandle::~PatchpointExceptionHandle):
2684         (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreation):
2685         (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreationForUnwind):
2686         (JSC::FTL::PatchpointExceptionHandle::PatchpointExceptionHandle):
2687         (JSC::FTL::PatchpointExceptionHandle::createHandle):
2688         * ftl/FTLPatchpointExceptionHandle.h: Added.
2689         * ftl/FTLState.cpp:
2690         * ftl/FTLState.h:
2691         (JSC::FTL::verboseCompilationEnabled):
2692         * tests/stress/ftl-get-by-id-getter-exception-interesting-live-state.js: Added.
2693         * tests/stress/ftl-get-by-id-getter-exception-no-catch.js: Added.
2694         * tests/stress/ftl-get-by-id-getter-exception.js: Added.
2695         * tests/stress/ftl-get-by-id-slow-exception-interesting-live-state.js: Added.
2696         * tests/stress/ftl-get-by-id-slow-exception-no-catch.js: Added.
2697         * tests/stress/ftl-get-by-id-slow-exception.js: Added.
2698         * tests/stress/ftl-operation-exception-interesting-live-state.js: Added.
2699         * tests/stress/ftl-operation-exception-no-catch.js: Added.
2700
2701 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2702
2703         [mips] Implemented missing branch patching methods.
2704         https://bugs.webkit.org/show_bug.cgi?id=152845
2705
2706         Reviewed by Michael Saboff.
2707
2708         * assembler/MacroAssemblerMIPS.h:
2709         (JSC::MacroAssemblerMIPS::canJumpReplacePatchableBranch32WithPatch):
2710         (JSC::MacroAssemblerMIPS::startOfPatchableBranch32WithPatchOnAddress):
2711         (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranch32WithPatch):
2712
2713 2016-01-07  Benjamin Poulain  <bpoulain@apple.com>
2714
2715         [JSC] When resolving Stack arguments, use addressing from SP when addressing from FP is invalid
2716         https://bugs.webkit.org/show_bug.cgi?id=152840
2717
2718         Reviewed by Mark Lam.
2719
2720         ARM64 has two kinds of addressing with immediates:
2721         -Signed 9bits direct (really only -256 to 255).
2722         -Unsigned 12bits scaled by the load/store size.
2723
2724         When resolving the stack addresses, we easily run
2725         past -256 bytes from FP. Addressing from SP gives us more
2726         room to address the stack efficiently because we can
2727         use unsigned immediates.
2728
2729         * b3/B3StackmapSpecial.cpp:
2730         (JSC::B3::StackmapSpecial::repForArg):
2731         * b3/air/AirAllocateStack.cpp:
2732         (JSC::B3::Air::allocateStack):
2733
2734 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2735
2736         [mips] Make repatchCall public to fix compilation.
2737         https://bugs.webkit.org/show_bug.cgi?id=152843
2738
2739         Reviewed by Michael Saboff.
2740
2741         * assembler/MacroAssemblerMIPS.h:
2742         (JSC::MacroAssemblerMIPS::repatchCall):
2743         (JSC::MacroAssemblerMIPS::linkCall): Deleted.
2744
2745 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2746
2747         [mips] Replaced subi with addi in getHostCallReturnValue
2748         https://bugs.webkit.org/show_bug.cgi?id=152841
2749
2750         Reviewed by Michael Saboff.
2751
2752         MIPS architecture does not have subi instruction, addi with negative
2753         number should be used instead.
2754
2755         * jit/JITOperations.cpp:
2756
2757 2016-01-07  Mark Lam  <mark.lam@apple.com>
2758
2759         ARMv7 or32(TrustedImm32, AbsoluteAddress) may have a bug with its use of dataTempRegister.
2760         https://bugs.webkit.org/show_bug.cgi?id=152833
2761
2762         Reviewed by Michael Saboff.
2763
2764         Follow-up patch to fix illegal use of memoryTempRegister as the src for ARM64's
2765         store32.
2766
2767         * assembler/MacroAssemblerARM64.h:
2768         (JSC::MacroAssemblerARM64::or32):
2769         (JSC::MacroAssemblerARM64::store):
2770
2771 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2772
2773         [mips] GPRInfo::toArgumentRegister missing
2774         https://bugs.webkit.org/show_bug.cgi?id=152838
2775
2776         Reviewed by Michael Saboff.
2777
2778         * jit/GPRInfo.h:
2779         (JSC::GPRInfo::toArgumentRegister):
2780
2781 2016-01-07  Mark Lam  <mark.lam@apple.com>
2782
2783         ARMv7 or32(TrustedImm32, AbsoluteAddress) may have a bug with its use of dataTempRegister.
2784         https://bugs.webkit.org/show_bug.cgi?id=152833
2785
2786         Reviewed by Benjamin Poulain.
2787
2788         * assembler/MacroAssemblerARM.h:
2789         (JSC::MacroAssemblerARM::or32):
2790         - Added some assertions to make sure it is safe to use ARMRegisters::S0 as a temp.
2791         * assembler/MacroAssemblerARM64.h:
2792         (JSC::MacroAssemblerARM64::or32):
2793         - Implement an optimization that avoids reloading the memoryTempRegister when
2794           the immediate is encodable as an instruction immediate.
2795         * assembler/MacroAssemblerARMv7.h:
2796         (JSC::MacroAssemblerARMv7::or32):
2797         - Added an assertion to make sure it is safe to use the dataTempRegister as a temp.
2798         - Implement an optimization that avoids reloading the memoryTempRegister when
2799           the immediate is encodable as an instruction immediate.  In the event that we
2800           cannot encode the immediate, we'll use the addressTempRegister as a temp, and
2801           reload it later.
2802
2803 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
2804
2805         [CMake] JSC shell sources should include JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES
2806         https://bugs.webkit.org/show_bug.cgi?id=152664
2807
2808         Reviewed by Alex Christensen.
2809
2810         * shell/CMakeLists.txt:
2811
2812 2016-01-06  Joseph Pecoraro  <pecoraro@apple.com>
2813
2814         Web Inspector: CRASH Attempting to pause on CSP violation not inside of script
2815         https://bugs.webkit.org/show_bug.cgi?id=152825
2816         <rdar://problem/24021276>
2817
2818         Reviewed by Timothy Hatcher.
2819
2820         * debugger/Debugger.cpp:
2821         (JSC::Debugger::breakProgram):
2822         We cannot pause if we are not evaluating JavaScript, so bail.
2823
2824 2016-01-07  Benjamin Poulain  <bpoulain@apple.com>
2825
2826         [JSC] Re-enable lea() in Air on ARM64
2827         https://bugs.webkit.org/show_bug.cgi?id=152832
2828
2829         Reviewed by Michael Saboff.
2830
2831         Lea() on the MacroAssembler is not the full x86 Lea (the real one being
2832         x86Lea32()). Instead, it is a addPtr() with SP and a constant.
2833
2834         The instruction is required to implement B3's StackSlot. It is not
2835         safe for big offsets but none of the stack operations are at the moment.
2836
2837         * b3/air/AirOpcode.opcodes:
2838
2839 2016-01-07  Julien Brianceau  <jbriance@cisco.com>
2840
2841         [mips] Add two missing abortWithReason implementations
2842         https://bugs.webkit.org/show_bug.cgi?id=136753
2843
2844         Reviewed by Benjamin Poulain.
2845
2846         * assembler/MacroAssemblerMIPS.h:
2847         (JSC::MacroAssemblerMIPS::memoryFence):
2848         (JSC::MacroAssemblerMIPS::abortWithReason):
2849         (JSC::MacroAssemblerMIPS::readCallTarget):
2850
2851 2016-01-07  Csaba Osztrogonác  <ossy@webkit.org>
2852
2853         Add new or32 implementation to MacroAssemblerARM after r194613
2854         https://bugs.webkit.org/show_bug.cgi?id=152784
2855
2856         Reviewed by Benjamin Poulain.
2857
2858         * assembler/MacroAssemblerARM.h:
2859         (JSC::MacroAssemblerARM::or32):
2860
2861 2016-01-06  Mark Lam  <mark.lam@apple.com>
2862
2863         REGRESSION(r194613): JITMulGenerator needs a scratch GPR on 32-bit too.
2864         https://bugs.webkit.org/show_bug.cgi?id=152805
2865
2866         Reviewed by Michael Saboff.
2867
2868         There aren't enough registers on x86 32-bit to allocate the needed scratch GPR.
2869         So, we'll continue to use one of the result registers as the scratch, and
2870         re-compute the result at the end.
2871
2872         * jit/JITMulGenerator.cpp:
2873         (JSC::JITMulGenerator::generateFastPath):
2874
2875 2016-01-06  Anders Carlsson  <andersca@apple.com>
2876
2877         Add a smart block pointer
2878         https://bugs.webkit.org/show_bug.cgi?id=152799
2879
2880         Reviewed by Tim Horton.
2881
2882         Get rid of RemoteTargetBlock and replace it with WTF::BlockPtr<void ()>.
2883
2884         * inspector/remote/RemoteConnectionToTarget.h:
2885         (Inspector::RemoteTargetBlock::RemoteTargetBlock): Deleted.
2886         (Inspector::RemoteTargetBlock::~RemoteTargetBlock): Deleted.
2887         (Inspector::RemoteTargetBlock::operator=): Deleted.
2888         (Inspector::RemoteTargetBlock::operator()): Deleted.
2889         * inspector/remote/RemoteConnectionToTarget.mm:
2890         (Inspector::RemoteTargetQueueTaskOnGlobalQueue):
2891         (Inspector::RemoteConnectionToTarget::queueTaskOnPrivateRunLoop):
2892
2893 2016-01-06  Benjamin Poulain  <bpoulain@apple.com>
2894
2895         [JSC] More B3 tests passing on ARM64
2896         https://bugs.webkit.org/show_bug.cgi?id=152787
2897
2898         Reviewed by Michael Saboff.
2899
2900         Some more minor bugs.
2901
2902         * assembler/MacroAssemblerARM64.h:
2903         (JSC::MacroAssemblerARM64::urshift64):
2904         The offset was being truncated. That code was just copied
2905         from the 32bits version of urshift.
2906
2907         * b3/B3LowerToAir.cpp:
2908         (JSC::B3::Air::LowerToAir::createGenericCompare):
2909         Very few instructions can encode -1 as immediate.
2910         TST certainly can't. The fallback works for ARM.
2911
2912         * b3/air/AirOpcode.opcodes:
2913         Bit instructions have very specific immediate encoding.
2914         B3 cannot express that properly yet. I disabled those
2915         forms for now. Immediates encoding is something we'll really
2916         have to look into at some point for B3 ARM64.
2917
2918 2016-01-06  Michael Catanzaro  <mcatanzaro@igalia.com>
2919
2920         Silence -Wtautological-compare
2921         https://bugs.webkit.org/show_bug.cgi?id=152768
2922
2923         Reviewed by Saam Barati.
2924
2925         * runtime/Options.cpp:
2926         (JSC::Options::setAliasedOption):
2927
2928 2016-01-06  Filip Pizlo  <fpizlo@apple.com>
2929
2930         Make sure that the basic throw-from-operation mode of throwing makes sense in FTL B3
2931         https://bugs.webkit.org/show_bug.cgi?id=152798
2932
2933         Reviewed by Oliver Hunt.
2934
2935         This really just contains one change: we inline emitBranchToOSRExitIfWillCatchException()
2936         into callCheck(), since that was its only caller. This makes it a bit more clear what is
2937         going on.
2938
2939         It turns out that FTL B3 already handled this case properly. I added a test that I believe
2940         illustrates this. Note that although the test uses GetById, which ordinarily throws
2941         exceptions from inside a patchpoint, it uses it in such a way that the exception is thrown
2942         from the operation call for the non-cell bypass path of a GetById(UntypedUse:).
2943
2944         * ftl/FTLLowerDFGToLLVM.cpp:
2945         (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
2946         (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
2947         (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
2948         (JSC::FTL::DFG::LowerDFGToLLVM::emitBranchToOSRExitIfWillCatchException): Deleted.
2949         * tests/stress/ftl-operation-exception.js: Added.
2950         (foo):
2951
2952 2016-01-06  Joseph Pecoraro  <pecoraro@apple.com>
2953
2954         Web Inspector: Remove duplicate check
2955         https://bugs.webkit.org/show_bug.cgi?id=152792
2956
2957         Reviewed by Timothy Hatcher.
2958
2959         * inspector/InjectedScriptSource.js:
2960         (InjectedScript.RemoteObject.prototype._generatePreview): Deleted.
2961         This method is only called from one place, and it does an equivalent
2962         check before calling this function. Remove the duplicate check.
2963
2964 2016-01-06  Brian Burg  <bburg@apple.com>
2965
2966         Add a WebKit SPI for registering an automation controller with RemoteInspector
2967         https://bugs.webkit.org/show_bug.cgi?id=151576
2968
2969         Reviewed by Dan Bernstein and Joseph Pecoraro.
2970
2971         Given a RemoteInspector endpoint that is instantiated in UIProcess, there
2972         should be a way to delegate automation-related functionality and policy to
2973         clients of WebKit.
2974
2975         This class adds a RemoteInspector::Client interface that serves a delegate.
2976         This is ultimately delegated via _WKAutomationDelegate, which is an SPI
2977         that allows clients to install an Objective-C delegate for automation.
2978
2979         The setting for whether remote automation is allowed is included in the
2980         listing that RemoteInspector sends out. It is updated when RemoteInspector::Client
2981         is assigned, or when the client signals that its capabilities have changed.
2982
2983         * inspector/remote/RemoteInspector.h:
2984         * inspector/remote/RemoteInspector.mm:
2985         (Inspector::RemoteInspector::setRemoteInspectorClient): Added.
2986         (Inspector::RemoteInspector::pushListingsNow):
2987
2988             In the listing, include whether the application supports remote automation.
2989
2990         * inspector/remote/RemoteInspectorConstants.h: Add a constant.
2991
2992 2016-01-05  Keith Miller  <keith_miller@apple.com>
2993
2994         [ES6] Boolean, Number, Map, RegExp, and Set should be subclassable
2995         https://bugs.webkit.org/show_bug.cgi?id=152765
2996
2997         Reviewed by Michael Saboff.
2998
2999         This patch enables subclassing of five more builtins: Boolean, Number, Map, RegExp, and Set.
3000
3001         * runtime/BooleanConstructor.cpp:
3002         (JSC::constructWithBooleanConstructor):
3003         (JSC::constructBoolean): Deleted.
3004         * runtime/BooleanConstructor.h:
3005         * runtime/MapConstructor.cpp:
3006         (JSC::constructMap):
3007         * runtime/NumberConstructor.cpp:
3008         (JSC::constructWithNumberConstructor):
3009         * runtime/RegExpConstructor.cpp:
3010         (JSC::getRegExpStructure):
3011         (JSC::constructRegExp):
3012         * runtime/SetConstructor.cpp:
3013         (JSC::constructSet):
3014         * tests/es6.yaml:
3015         * tests/stress/class-subclassing-misc.js: Added.
3016         (B):
3017         (N):
3018         (M):
3019         (R):
3020         (S):
3021         (test):
3022
3023 2016-01-06  Julien Brianceau  <jbriance@cisco.com>
3024
3025         [mips] Fix branchTruncateDoubleToUint32 implementation in macro assembler
3026         https://bugs.webkit.org/show_bug.cgi?id=152782
3027
3028         Reviewed by Benjamin Poulain.
3029
3030         Already covered by LayoutTests/js/dfg-uint32array-overflow-values test.
3031
3032         * assembler/MacroAssemblerMIPS.h:
3033         (JSC::MacroAssemblerMIPS::branchTruncateDoubleToUint32):
3034
3035 2016-01-06  Julien Brianceau  <jbriance@cisco.com>
3036
3037         [mips] Fix or32 implementation in macro assembler
3038         https://bugs.webkit.org/show_bug.cgi?id=152781
3039
3040         Reviewed by Michael Saboff.
3041
3042         * assembler/MacroAssemblerMIPS.h:
3043         (JSC::MacroAssemblerMIPS::or32):
3044
3045 2016-01-06  Julien Brianceau  <jbriance@cisco.com>
3046
3047         [mips] Add missing branchAdd32 implementation in macro assembler
3048         https://bugs.webkit.org/show_bug.cgi?id=152785
3049
3050         Reviewed by Michael Saboff.
3051
3052         * assembler/MacroAssemblerMIPS.h:
3053         (JSC::MacroAssemblerMIPS::branchAdd32):
3054
3055 2016-01-06  Andy VanWagoner  <thetalecrafter@gmail.com>
3056
3057         [ES6] Date.prototype should be a plain object
3058         https://bugs.webkit.org/show_bug.cgi?id=152574
3059
3060         Reviewed by Benjamin Poulain.
3061
3062         * runtime/DateConstructor.cpp:
3063         (JSC::DateConstructor::finishCreation):
3064         * runtime/DatePrototype.cpp:
3065         (JSC::DatePrototype::DatePrototype):
3066         * runtime/DatePrototype.h:
3067         * tests/mozilla/mozilla-tests.yaml: Expect errors from old Date.prototype as Date instance tests.
3068
3069 2016-01-06  Benjamin Poulain  <bpoulain@apple.com>
3070
3071         [JSC] Get more of testb3 to pass on ARM64
3072         https://bugs.webkit.org/show_bug.cgi?id=152737
3073
3074         Reviewed by Geoffrey Garen.
3075
3076         A bunch of minor bugs and missing function to make most of testb3
3077         run on ARM64.
3078
3079         * JavaScriptCore.xcodeproj/project.pbxproj:
3080         * assembler/ARM64Assembler.h:
3081         (JSC::ARM64Assembler::canEncodePImmOffset):
3082         (JSC::ARM64Assembler::canEncodeSImmOffset):
3083         (JSC::isInt9): Deleted.
3084         (JSC::isUInt12): Deleted.
3085         * assembler/ARMv7Assembler.h:
3086         * assembler/AssemblerCommon.h: Added.
3087         (JSC::isInt9):
3088         (JSC::isUInt12):
3089         (JSC::isValidScaledUImm12):
3090         (JSC::isValidSignedImm9):
3091         * assembler/MacroAssemblerARM64.h:
3092         (JSC::MacroAssemblerARM64::load16SignedExtendTo32):
3093         (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
3094         (JSC::MacroAssemblerARM64::store16):
3095         (JSC::MacroAssemblerARM64::absFloat):
3096         (JSC::MacroAssemblerARM64::loadFloat):
3097         (JSC::MacroAssemblerARM64::storeFloat):
3098         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnsignedImmediate):
3099         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnscaledImmediate):
3100         (JSC::MacroAssemblerARM64::tryLoadSignedWithOffset):
3101         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnsignedImmediate<8>):
3102         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnsignedImmediate<16>):
3103         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnscaledImmediate<8>):
3104         (JSC::MacroAssemblerARM64::loadSignedAddressedByUnscaledImmediate<16>):
3105         * assembler/X86Assembler.h:
3106         * b3/B3LowerToAir.cpp:
3107         (JSC::B3::Air::LowerToAir::effectiveAddr):
3108         (JSC::B3::Air::LowerToAir::lower):
3109         * b3/air/AirArg.h:
3110         (JSC::B3::Air::Arg::isValidImmForm):
3111         (JSC::B3::Air::Arg::isValidAddrForm):
3112         (JSC::B3::Air::Arg::isValidForm):
3113         * b3/air/AirOpcode.opcodes:
3114
3115 2016-01-05  Zan Dobersek  <zdobersek@igalia.com>
3116
3117         [CMake] Remove USE_UDIS86 variable
3118         https://bugs.webkit.org/show_bug.cgi?id=152731
3119
3120         Reviewed by Gyuyoung Kim.
3121
3122         * CMakeLists.txt: Unconditionally build the Udis86-specific files.
3123
3124 2016-01-05  Filip Pizlo  <fpizlo@apple.com>
3125
3126         FTL B3 fails cdjs-tests.yaml/red_black_tree_test.js.ftl-eager-no-cjit
3127         https://bugs.webkit.org/show_bug.cgi?id=152770
3128
3129         Reviewed by Mark Lam.
3130
3131         It turns out that liveness didn't know that the return value GPR or FPR is live at the
3132         return. Consequently, we can end up with code that clobbers the return value register after
3133         the move of the return value into that register. This could happen if we start with
3134         something like:
3135
3136             Move 42(%tmp1), %tmp2
3137             Move 50(%tmp1), %tmp3
3138             Move %tmp3, 58(%tmp1)
3139             Move %tmp2, %rax
3140             Ret
3141
3142         Then we might coalesce %tmp2 with %rax:
3143
3144             Move 42(%tmp1), %rax
3145             Move 50(%tmp1), %tmp3
3146             Move %tmp3, 58(%tmp1)
3147             Ret
3148
3149         But now there is no use of %rax after that first instruction, so %rax appears dead at the
3150         other two Move's. So, the register allocator could then do this:
3151
3152             Move 42(%tmp1), %rax
3153             Move 50(%tmp1), %rax
3154             Move %rax, 58(%tmp1)
3155             Ret
3156
3157         And that's clearly wrong. This patch solves this issue by replacing the old Ret instruction
3158         with Ret32, Ret64, RetFloat, and RetDouble. These all take the return value register as an
3159         argument. They also tell Air which parts of the return value register the caller will
3160         observe. That's great for width analysis.
3161
3162         This resolves a test failure in the CDjs red_black_tree_test. This reduces the total number
3163         of JSC test failures from 217 to 191.
3164
3165         * assembler/MacroAssembler.h:
3166         (JSC::MacroAssembler::oops):
3167         (JSC::MacroAssembler::ret32):
3168         (JSC::MacroAssembler::ret64):
3169         (JSC::MacroAssembler::retFloat):
3170         (JSC::MacroAssembler::retDouble):
3171         (JSC::MacroAssembler::shouldConsiderBlinding):
3172         * b3/B3LowerToAir.cpp:
3173         (JSC::B3::Air::LowerToAir::lower):
3174         * b3/air/AirGenerate.cpp:
3175         (JSC::B3::Air::generate):
3176         * b3/air/AirHandleCalleeSaves.cpp:
3177         (JSC::B3::Air::handleCalleeSaves):
3178         * b3/air/AirOpcode.opcodes:
3179         * b3/air/opcode_generator.rb:
3180
3181 2016-01-05  Keith Miller  <keith_miller@apple.com>
3182
3183         Unreviewed build fix. A symbol was being exported that should not have been.
3184
3185         * runtime/Structure.h:
3186
3187 2016-01-05  Commit Queue  <commit-queue@webkit.org>
3188
3189         Unreviewed, rolling out r194603.
3190         https://bugs.webkit.org/show_bug.cgi?id=152762
3191
3192         This change introduced JSC test failures (Requested by
3193         ryanhaddad on #webkit).
3194
3195         Reverted changeset:
3196
3197         "[ES6] Date.prototype should be a plain object"
3198         https://bugs.webkit.org/show_bug.cgi?id=152574
3199         http://trac.webkit.org/changeset/194603
3200
3201 2016-01-05  Filip Pizlo  <fpizlo@apple.com>
3202
3203         stress/v8-crypto-strict.js.ftl-eager-no-cjit in FTL B3 fails with an assertion in the callframe shuffler
3204         https://bugs.webkit.org/show_bug.cgi?id=152756
3205
3206         Reviewed by Saam Barati.
3207
3208         This fixes a really obvious and dumb tail call bug in FTL B3. I think that tail calls work
3209         for real now. I have no idea why I got any tail call tests to pass before this fix.
3210
3211         * ftl/FTLLowerDFGToLLVM.cpp:
3212         (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
3213
3214 2016-01-04  Mark Lam  <mark.lam@apple.com>
3215
3216         Profiling should detect when multiplication overflows but does not create negative zero.
3217         https://bugs.webkit.org/show_bug.cgi?id=132470
3218
3219         Reviewed by Geoffrey Garen.
3220
3221         * assembler/MacroAssemblerARM64.h:
3222         (JSC::MacroAssemblerARM64::or32):
3223         * assembler/MacroAssemblerARMv7.h:
3224         (JSC::MacroAssemblerARMv7::or32):
3225         - New or32 emitter needed by the mul snippet.
3226
3227         * bytecode/CodeBlock.cpp:
3228         (JSC::CodeBlock::resultProfileForBytecodeOffset):
3229         (JSC::CodeBlock::updateResultProfileForBytecodeOffset): Deleted.
3230         * bytecode/CodeBlock.h:
3231         (JSC::CodeBlock::ensureResultProfile):
3232         (JSC::CodeBlock::addResultProfile): Deleted.
3233         (JSC::CodeBlock::likelyToTakeDeepestSlowCase): Deleted.
3234         - Added a m_bytecodeOffsetToResultProfileIndexMap because we can now add result
3235           profiles in any order (based on runtime execution), not necessarily in bytecode
3236           order at baseline compilation time.
3237
3238         * bytecode/ValueProfile.cpp:
3239         (WTF::printInternal):
3240         * bytecode/ValueProfile.h:
3241         (JSC::ResultProfile::didObserveInt52Overflow):
3242         (JSC::ResultProfile::setObservedInt52Overflow):
3243         - Add new Int52Overflow flags.
3244
3245         * dfg/DFGByteCodeParser.cpp:
3246         (JSC::DFG::ByteCodeParser::makeSafe):
3247         - Now with more straightforward mapping of profiling info.
3248
3249         * dfg/DFGCommon.h:
3250         - Fixed a typo in a comment.
3251
3252         * dfg/DFGNode.h:
3253         (JSC::DFG::Node::arithNodeFlags):
3254         (JSC::DFG::Node::mayHaveNonIntResult):
3255         (JSC::DFG::Node::hasConstantBuffer):
3256         * dfg/DFGNodeFlags.cpp:
3257         (JSC::DFG::dumpNodeFlags):
3258         * dfg/DFGNodeFlags.h:
3259         (JSC::DFG::nodeMayOverflowInt52):
3260         (JSC::DFG::nodeCanSpeculateInt52):
3261         * dfg/DFGPredictionPropagationPhase.cpp:
3262         (JSC::DFG::PredictionPropagationPhase::propagate):
3263         - We now have profiling info for whether the result was ever seen to be a non-Int.
3264           Use this to make a better prediction.
3265
3266         * jit/JITArithmetic.cpp:
3267         (JSC::JIT::emit_op_div):
3268         (JSC::JIT::emit_op_mul):
3269         - Switch to using CodeBlock::ensureResultProfile().  ResultProfiles can now be
3270           created at any time (including the slow path), not just in bytecode order
3271           during baseline compilation.
3272
3273         * jit/JITMulGenerator.cpp:
3274         (JSC::JITMulGenerator::generateFastPath):
3275         - Removed the fast path profiling code for NegZero because we'll go to the slow
3276           path anyway.  Let the slow path do the profiling for us.
3277         - Added profiling for NegZero and potential Int52 overflows in the fast path
3278           that does double math.
3279
3280         * runtime/CommonSlowPaths.cpp:
3281         (JSC::updateResultProfileForBinaryArithOp):
3282         - Removed the RETURN_WITH_RESULT_PROFILING macro (2 less macros), and just use
3283           the RETURN_WITH_PROFILING macro instead with a call to
3284           updateResultProfileForBinaryArithOp().  This makes it clear what we're doing
3285           to do profiling in each case, and also allows us to do custom profiling for
3286           each opcode if needed.  However, so far, we always call
3287           updateResultProfileForBinaryArithOp().
3288
3289 2016-01-05  Keith Miller  <keith_miller@apple.com>
3290
3291         [ES6] Arrays should be subclassable.
3292         https://bugs.webkit.org/show_bug.cgi?id=152706
3293
3294         Reviewed by Benjamin Poulain.
3295
3296         This patch enables full subclassing of Arrays. We do this by fetching the new.target's prototype property
3297         in the Array constructor and transitioning the old structure to have the new prototype. This method has
3298         two downsides. The first is that we clobber the transition watchpoint on the base structure. The second,
3299         which is currently very significant but should be fixed in a future patch, is that we allocate a new
3300         structure for each new derived class we allocate.
3301
3302         * runtime/ArrayConstructor.cpp:
3303         (JSC::constructArrayWithSizeQuirk):
3304         (JSC::constructWithArrayConstructor):
3305         (JSC::callArrayConstructor):
3306         * runtime/ArrayConstructor.h:
3307         * runtime/JSGlobalObject.h:
3308         (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation):
3309         (JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation):
3310         (JSC::constructEmptyArray):
3311         (JSC::constructArray):
3312         (JSC::constructArrayNegativeIndexed):
3313         * runtime/PrototypeMap.h:
3314         * runtime/Structure.h:
3315         * runtime/StructureInlines.h:
3316         (JSC::Structure::createSubclassStructure):
3317         * tests/es6.yaml:
3318         * tests/stress/class-subclassing-array.js: Added.
3319         (A):
3320         (B.prototype.get 1):
3321         (B):
3322         (C):
3323         (test):
3324
3325 2016-01-05  Filip Pizlo  <fpizlo@apple.com>
3326
3327         regress/script-tests/deltablue-varargs.js.ftl-no-cjit-no-put-stack-validate on FTL B3 gets a B3 validation failure
3328         https://bugs.webkit.org/show_bug.cgi?id=152754
3329
3330         Reviewed by Geoffrey Garen and Saam Barati.
3331
3332         It turns out that the FTL was creating orphans. Rather than making the FTL handle them by
3333         itself, I gave B3 the power to eliminate them for you. I also made the dumper print them
3334         since otherwise, you wouldn't know anything about the orphan when looking at a validation
3335         failure or other kind of procedure dump.
3336
3337         * b3/B3IndexSet.h:
3338         (JSC::B3::IndexSet::add):
3339         (JSC::B3::IndexSet::addAll):
3340         (JSC::B3::IndexSet::remove):
3341         * b3/B3Procedure.cpp:
3342         (JSC::B3::Procedure::dump):
3343         (JSC::B3::Procedure::deleteValue):
3344         (JSC::B3::Procedure::deleteOrphans):
3345         (JSC::B3::Procedure::dominators):
3346         * b3/B3Procedure.h:
3347         (JSC::B3::Procedure::cfg):
3348         * ftl/FTLLowerDFGToLLVM.cpp:
3349         (JSC::FTL::DFG::LowerDFGToLLVM::lower):
3350
3351 2015-12-24  Mark Lam  <mark.lam@apple.com>
3352
3353         Re-landing: Add validation of JSC options to catch typos.
3354         https://bugs.webkit.org/show_bug.cgi?id=152549
3355
3356         Reviewed by Benjamin Poulain.
3357
3358         1. If a JSC_xxx option is found and xxx is not a valid option, we will now log
3359            an error message.
3360         2. If a --xxx jsc option is specified, but xxx is not a valid option, we will
3361            now log an error message.
3362         3. Added JSC_validateOptions, which if set to true will cause the VM to crash if
3363            an invalid option was seen during options parsing.
3364
3365         In this version for re-landing, I removed the change where I disallowed -- options
3366         after the script name.  Apparently, we have some test harnesses that do append the
3367         -- options after the script name.
3368
3369         * jsc.cpp:
3370         (CommandLine::parseArguments):
3371         * runtime/Options.cpp:
3372         (JSC::Options::initialize):
3373         * runtime/Options.h:
3374
3375 2016-01-05  Filip Pizlo  <fpizlo@apple.com>
3376
3377         FTL B3 should do ArithNegate
3378         https://bugs.webkit.org/show_bug.cgi?id=152745
3379
3380         Reviewed by Geoffrey Garen.
3381
3382         * ftl/FTLLowerDFGToLLVM.cpp:
3383         (JSC::FTL::DFG::LowerDFGToLLVM::compileArithNegate):