1 2018-08-17 Saam barati <sbarati@apple.com>
3 intersectionOfPastValuesAtHead must filter values after they've observed an invalidation point
4 https://bugs.webkit.org/show_bug.cgi?id=188707
5 <rdar://problem/43015442>
9 We use the values in intersectionOfPastValuesAtHead to verify that it is safe to
10 OSR enter at the head of a block. We verify it's safe to OSR enter by checking
11 that each incoming value is compatible with its corresponding AbstractValue.
13 The bug is that we were sometimes filtering the intersectionOfPastValuesAtHead
14 with abstract values that were clobbererd. This meant that the value we're
15 verifying with at OSR entry effectively has an infinite structure set because
16 it's clobbered. So, imagine we have code like this:
18 ---> We OSR enter here, and we're clobbered here
23 The abstract value for @base inside intersectionOfPastValuesAtHead has a
24 clobberred structure set, so we'd allow an incoming object with any
25 structure. However, this is wrong because the invalidation point is no
26 longer fulfilling its promise that it filters the structure that @base has.
28 We fix this by filtering the AbstractValues in intersectionOfPastValuesAtHead
29 as if the incoming value may be live past an InvalidationPoint.
30 This places a stricter requirement that to safely OSR enter at any basic
31 block, all incoming values must be compatible as if they lived past
32 the execution of an invalidation point.
34 * dfg/DFGCFAPhase.cpp:
35 (JSC::DFG::CFAPhase::run):
37 2018-08-17 Yusuke Suzuki <yusukesuzuki@slowstart.org> and Fujii Hironori <Hironori.Fujii@sony.com>
39 [JSC] Add GPRReg::InvalidGPRReg and FPRReg::InvalidFPRReg
40 https://bugs.webkit.org/show_bug.cgi?id=188589
43 And reviewed by Yusuke Suzuki for Hironori's change.
45 Since GPRReg(RegisterID) and FPRReg(FPRegisterID) do not include -1 in their enum values,
46 UBSan dumps bunch of warnings "runtime error: load of value 4294967295, which is not a valid value for type 'RegisterID'".
48 - We add InvalidGPRReg and InvalidFPRReg to enum values of GPRReg and FPRReg to suppress the above warnings.
49 - We make GPRReg and FPRReg int8_t enums.
50 - We replace `#define InvalidGPRReg ((JSC::GPRReg)-1)` to `static constexpr GPRReg InvalidGPRReg { GPRReg::InvalidGPRReg };`.
51 - We add operator+/- definition for RegisterIDs as a MSVC workaround. MSVC fails to resolve operator+ and operator-
52 if `enum : int8_t` is used instead of `enum`.
54 * assembler/ARM64Assembler.h:
55 * assembler/ARMAssembler.h:
56 * assembler/ARMv7Assembler.h:
57 * assembler/MIPSAssembler.h:
58 * assembler/MacroAssembler.h:
59 * assembler/X86Assembler.h:
61 (JSC::CCallHelpers::clampArrayToSize):
64 (JSC::JSValueRegs::JSValueRegs):
65 (JSC::JSValueRegs::tagGPR const):
66 (JSC::JSValueRegs::payloadGPR const):
67 (JSC::JSValueSource::JSValueSource):
68 (JSC::JSValueSource::unboxedCell):
69 (JSC::JSValueSource::operator bool const):
70 (JSC::JSValueSource::base const):
71 (JSC::JSValueSource::tagGPR const):
72 (JSC::JSValueSource::payloadGPR const):
73 (JSC::JSValueSource::hasKnownTag const):
75 2018-08-16 Yusuke Suzuki <yusukesuzuki@slowstart.org>
77 [JSC] alignas for RegisterState should respect alignof(RegisterState) too
78 https://bugs.webkit.org/show_bug.cgi?id=188686
80 Reviewed by Saam Barati.
82 RegisterState would have larger alignment than `alignof(void*)`. We use the larger alignment value
83 for `alignof` for RegisterState.
85 * heap/RegisterState.h:
87 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
89 [YARR] Align allocation size in BumpPointerAllocator with sizeof(void*)
90 https://bugs.webkit.org/show_bug.cgi?id=188571
92 Reviewed by Saam Barati.
94 UBSan finds YarrInterpreter performs misaligned accesses. This is because YarrInterpreter
95 allocates DisjunctionContext and ParenthesesDisjunctionContext from BumpPointerAllocator
96 without considering alignment of them. This patch adds DisjunctionContext::allocationSize
97 and ParenthesesDisjunctionContext::allocationSize to calculate allocation sizes for them.
98 The size is always rounded to `sizeof(void*)` so that these classes are always allocated
99 with `sizeof(void*)` alignment. We also ensure the alignments of both classes are less
100 than or equal to `sizeof(void*)` by `static_assert`.
102 * yarr/YarrInterpreter.cpp:
103 (JSC::Yarr::Interpreter::DisjunctionContext::allocationSize):
104 (JSC::Yarr::Interpreter::allocDisjunctionContext):
105 (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
106 (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::getDisjunctionContext):
107 (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::allocationSize):
108 (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
109 (JSC::Yarr::Interpreter::Interpreter):
110 (JSC::Yarr::Interpreter::DisjunctionContext::DisjunctionContext): Deleted.
112 2018-08-15 Keith Miller <keith_miller@apple.com>
114 Remove evernote hacks
115 https://bugs.webkit.org/show_bug.cgi?id=188591
117 Reviewed by Joseph Pecoraro.
119 The hack was added in 2012 and the evernote app seems to work now.
120 It's probably not needed anymore.
122 * API/JSValueRef.cpp:
124 (evernoteHackNeeded): Deleted.
126 2018-08-14 Fujii Hironori <Hironori.Fujii@sony.com>
128 Unreviewed, rolling out r234874 and r234876.
130 WinCairo port can't compile
134 "[JSC] Add GPRReg::InvalidGPRReg and FPRReg::InvalidFPRReg"
135 https://bugs.webkit.org/show_bug.cgi?id=188589
136 https://trac.webkit.org/changeset/234874
138 "Unreviewed, attempt to fix CLoop build"
139 https://bugs.webkit.org/show_bug.cgi?id=188589
140 https://trac.webkit.org/changeset/234876
142 2018-08-14 Saam barati <sbarati@apple.com>
144 HashMap<Ref<P>, V> asserts when V is not zero for its empty value
145 https://bugs.webkit.org/show_bug.cgi?id=188582
147 Reviewed by Sam Weinig.
149 * runtime/SparseArrayValueMap.h:
151 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
153 Unreviewed, attempt to fix CLoop build
154 https://bugs.webkit.org/show_bug.cgi?id=188589
156 * assembler/MacroAssembler.h:
158 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
160 [JSC] Add GPRReg::InvalidGPRReg and FPRReg::InvalidFPRReg
161 https://bugs.webkit.org/show_bug.cgi?id=188589
163 Reviewed by Mark Lam.
165 Since GPRReg(RegisterID) and FPRReg(FPRegisterID) do not include -1 in their enum values,
166 UBSan dumps bunch of warnings "runtime error: load of value 4294967295, which is not a valid value for type 'RegisterID'".
168 1. We add InvalidGPRReg and InvalidFPRReg to enum values of GPRReg and FPRReg to suppress the above warnings.
169 2. We make GPRReg and FPRReg int8_t enums.
170 3. We replace `#define InvalidGPRReg ((JSC::GPRReg)-1)` to `static constexpr GPRReg InvalidGPRReg { GPRReg::InvalidGPRReg };`.
172 * assembler/ARM64Assembler.h:
173 * assembler/ARMAssembler.h:
174 * assembler/ARMv7Assembler.h:
175 * assembler/MIPSAssembler.h:
176 * assembler/X86Assembler.h:
179 (JSC::JSValueRegs::JSValueRegs):
180 (JSC::JSValueRegs::tagGPR const):
181 (JSC::JSValueRegs::payloadGPR const):
182 (JSC::JSValueSource::JSValueSource):
183 (JSC::JSValueSource::unboxedCell):
184 (JSC::JSValueSource::operator bool const):
185 (JSC::JSValueSource::base const):
186 (JSC::JSValueSource::tagGPR const):
187 (JSC::JSValueSource::payloadGPR const):
188 (JSC::JSValueSource::hasKnownTag const):
190 2018-08-14 Keith Miller <keith_miller@apple.com>
192 Add missing availability macro.
193 https://bugs.webkit.org/show_bug.cgi?id=188563
195 Reviewed by Mark Lam.
199 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
201 [JSC] GetByIdStatus::m_wasSeenInJIT is touched in GetByIdStatus::slowVersion
202 https://bugs.webkit.org/show_bug.cgi?id=188560
204 Reviewed by Keith Miller.
206 While GetByIdStatus() / GetByIdStatus(status) constructors do not set m_wasSeenInJIT,
207 it is loaded unconditionally in GetByIdStatus::slowVersion. This access to the
208 uninitialized member field is caught in UBSan. This patch fixes it by adding an initializer
209 `m_wasSeenInJIT { false }`.
211 * bytecode/GetByIdStatus.h:
213 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
215 [DFG] DFGPredictionPropagation should set PrimaryPass when processing invariants
216 https://bugs.webkit.org/show_bug.cgi?id=188557
218 Reviewed by Mark Lam.
220 DFGPredictionPropagationPhase should set PrimaryPass before processing invariants since
221 processing for ArithRound etc.'s invariants requires `m_pass` load. This issue is found
224 * dfg/DFGPredictionPropagationPhase.cpp:
226 2018-08-14 Yusuke Suzuki <yusukesuzuki@slowstart.org>
228 [JSC] Should not rotate constant with 64
229 https://bugs.webkit.org/show_bug.cgi?id=188556
231 Reviewed by Mark Lam.
233 To defend against JIT splaying, we rotate a constant with a randomly generated seed.
234 But if a seed becomes 64, the following code performs `value << 64` where value's type
235 is uint64_t, and it causes undefined behaviors (UBs). This patch limits the seed in the
236 range of [0, 64) not to generate code causing UBs. This is found by UBSan.
238 * assembler/MacroAssembler.h:
239 (JSC::MacroAssembler::generateRotationSeed):
240 (JSC::MacroAssembler::rotationBlindConstant):
242 2018-08-12 Karo Gyoker <karogyoker2+webkit@gmail.com>
244 Disable JIT on IA-32 without SSE2
245 https://bugs.webkit.org/show_bug.cgi?id=188476
247 Reviewed by Michael Catanzaro.
249 Including missing header (MacroAssembler.h) in case of other
250 operating systems than Windows too.
252 * runtime/Options.cpp:
254 2018-08-11 Karo Gyoker <karogyoker2+webkit@gmail.com>
256 Disable JIT on IA-32 without SSE2
257 https://bugs.webkit.org/show_bug.cgi?id=188476
259 Reviewed by Yusuke Suzuki.
261 On IA-32 CPUs without SSE2 most of the webpages cannot load
262 if the JIT is turned on.
264 * runtime/Options.cpp:
265 (JSC::recomputeDependentOptions):
267 2018-08-10 Joseph Pecoraro <pecoraro@apple.com>
269 Web Inspector: console.log fires getters for deep properties
270 https://bugs.webkit.org/show_bug.cgi?id=187542
271 <rdar://problem/42873158>
273 Reviewed by Saam Barati.
275 * inspector/InjectedScriptSource.js:
276 (RemoteObject.prototype._isPreviewableObject):
277 Avoid getters/setters when checking for simple properties to preview.
278 Here we avoid invoking `object[property]` if it could be a user getter.
280 2018-08-10 Keith Miller <keith_miller@apple.com>
282 Slicing an ArrayBuffer with a long number returns an ArrayBuffer with byteLength zero
283 https://bugs.webkit.org/show_bug.cgi?id=185127
285 Reviewed by Saam Barati.
287 Previously, we would truncate the indicies passed to slice to an
288 int. This meant that the value was not getting properly clamped
291 This patch also removes a non-spec compliant check that slice was
292 passed at least one argument.
294 * runtime/ArrayBuffer.cpp:
295 (JSC::ArrayBuffer::clampValue):
296 (JSC::ArrayBuffer::clampIndex const):
297 (JSC::ArrayBuffer::slice const):
298 * runtime/ArrayBuffer.h:
299 (JSC::ArrayBuffer::clampValue): Deleted.
300 (JSC::ArrayBuffer::clampIndex const): Deleted.
301 * runtime/JSArrayBufferPrototype.cpp:
302 (JSC::arrayBufferProtoFuncSlice):
304 2018-08-10 Yusuke Suzuki <yusukesuzuki@slowstart.org>
306 Date.UTC should not return NaN with only Year param
307 https://bugs.webkit.org/show_bug.cgi?id=188378
309 Reviewed by Keith Miller.
311 Date.UTC requires one argument for |year|. But the other ones are optional.
312 This patch fix this handling.
314 * runtime/DateConstructor.cpp:
315 (JSC::millisecondsFromComponents):
317 2018-08-08 Keith Miller <keith_miller@apple.com>
319 Array.prototype.sort should call @toLength instead of ">>> 0"
320 https://bugs.webkit.org/show_bug.cgi?id=188430
322 Reviewed by Saam Barati.
324 Also add a new function to $vm that will fetch a private
325 property. This can be useful for running builtin helper functions.
327 * builtins/ArrayPrototype.js:
329 * tools/JSDollarVM.cpp:
330 (JSC::functionGetPrivateProperty):
331 (JSC::JSDollarVM::finishCreation):
333 2018-08-08 Keith Miller <keith_miller@apple.com>
335 Array.prototype.sort should throw TypeError if param is a not callable object
336 https://bugs.webkit.org/show_bug.cgi?id=188382
338 Reviewed by Saam Barati.
340 Improve spec compatability by checking if the Array.prototype.sort comparator is a function
341 before doing anything else.
343 Also, refactor the various helper functions to use let instead of var.
345 * builtins/ArrayPrototype.js:
346 (sort.stringComparator):
347 (sort.compactSparse):
353 (sort.comparatorSort):
357 2018-08-08 Michael Saboff <msaboff@apple.com>
359 Yarr JIT should include annotations with dumpDisassembly=true
360 https://bugs.webkit.org/show_bug.cgi?id=188415
362 Reviewed by Yusuke Suzuki.
364 Created a YarrDisassembler class that handles annotations similar to the baseline JIT.
365 Given that the Yarr creates matching code bu going through the YarrPattern ops forward and
366 then the backtracking code through the YarrPattern ops in reverse order, the disassembler
367 needs to do the same think.
369 Restructured some of the logging code in YarrPattern to eliminate redundent code and factor
370 out simple methods for what was needed by the YarrDisassembler.
372 Here is abbreviated sample output after this change.
374 Generated JIT code for 8-bit regular expression /ab*c/:
375 Code at [0x469561c03720, 0x469561c03840):
376 0x469561c03720: push %rbp
377 0x469561c03721: mov %rsp, %rbp
379 0x469561c03762: sub $0x40, %rsp
381 0:OpBodyAlternativeBegin minimum size 2
382 0x469561c03766: add $0x2, %esi
383 0x469561c03769: cmp %edx, %esi
384 0x469561c0376b: ja 0x469561c037fa
385 1:OpTerm TypePatternCharacter 'a'
386 0x469561c03771: movzx -0x2(%rdi,%rsi), %eax
387 0x469561c03776: cmp $0x61, %eax
388 0x469561c03779: jnz 0x469561c037e9
389 2:OpTerm TypePatternCharacter 'b' {0,...} greedy
390 0x469561c0377f: xor %r9d, %r9d
391 0x469561c03782: cmp %edx, %esi
392 0x469561c03784: jz 0x469561c037a2
394 0x469561c0379d: jmp 0x469561c03782
395 0x469561c037a2: mov %r9, 0x8(%rsp)
396 3:OpTerm TypePatternCharacter 'c'
397 0x469561c037a7: movzx -0x1(%rdi,%rsi), %eax
398 0x469561c037ac: cmp $0x63, %eax
399 0x469561c037af: jnz 0x469561c037d1
400 4:OpBodyAlternativeEnd
401 0x469561c037b5: add $0x40, %rsp
403 0x469561c037cf: pop %rbp
406 4:OpBodyAlternativeEnd
407 3:OpTerm TypePatternCharacter 'c'
408 2:OpTerm TypePatternCharacter 'b' {0,...} greedy
409 0x469561c037d1: mov 0x8(%rsp), %r9
411 0x469561c037e4: jmp 0x469561c037a2
412 1:OpTerm TypePatternCharacter 'a'
413 0:OpBodyAlternativeBegin minimum size 2
414 0x469561c037e9: mov %rsi, %rax
416 0x469561c0382f: pop %rbp
419 * JavaScriptCore.xcodeproj/project.pbxproj:
421 * runtime/RegExp.cpp:
422 (JSC::RegExp::compile):
423 (JSC::RegExp::compileMatchOnly):
424 * yarr/YarrDisassembler.cpp: Added.
425 (JSC::Yarr::YarrDisassembler::indentString):
426 (JSC::Yarr::YarrDisassembler::YarrDisassembler):
427 (JSC::Yarr::YarrDisassembler::~YarrDisassembler):
428 (JSC::Yarr::YarrDisassembler::dump):
429 (JSC::Yarr::YarrDisassembler::dumpHeader):
430 (JSC::Yarr::YarrDisassembler::dumpVectorForInstructions):
431 (JSC::Yarr::YarrDisassembler::dumpForInstructions):
432 (JSC::Yarr::YarrDisassembler::dumpDisassembly):
433 * yarr/YarrDisassembler.h: Added.
434 (JSC::Yarr::YarrJITInfo::~YarrJITInfo):
435 (JSC::Yarr::YarrDisassembler::setStartOfCode):
436 (JSC::Yarr::YarrDisassembler::setForGenerate):
437 (JSC::Yarr::YarrDisassembler::setForBacktrack):
438 (JSC::Yarr::YarrDisassembler::setEndOfGenerate):
439 (JSC::Yarr::YarrDisassembler::setEndOfBacktrack):
440 (JSC::Yarr::YarrDisassembler::setEndOfCode):
441 (JSC::Yarr::YarrDisassembler::indentString):
443 (JSC::Yarr::YarrGenerator::generate):
444 (JSC::Yarr::YarrGenerator::backtrack):
445 (JSC::Yarr::YarrGenerator::YarrGenerator):
446 (JSC::Yarr::YarrGenerator::compile):
447 (JSC::Yarr::jitCompile):
449 * yarr/YarrPattern.cpp:
450 (JSC::Yarr::dumpCharacterClass):
451 (JSC::Yarr::PatternTerm::dump):
452 (JSC::Yarr::YarrPattern::dumpPatternString):
453 (JSC::Yarr::YarrPattern::dumpPattern):
454 * yarr/YarrPattern.h:
456 2018-08-05 Darin Adler <darin@apple.com>
458 [Cocoa] More tweaks and refactoring to prepare for ARC
459 https://bugs.webkit.org/show_bug.cgi?id=188245
461 Reviewed by Dan Bernstein.
463 * API/JSValue.mm: Use __unsafe_unretained.
464 (JSContainerConvertor::convert): Use auto for compatibility with the above.
465 * API/JSWrapperMap.mm:
466 (allocateConstructorForCustomClass): Use CFTypeRef instead of Protocol *.
467 (-[JSWrapperMap initWithGlobalContextRef:]): Use __unsafe_unretained.
469 * heap/Heap.cpp: Updated include for rename: FoundationSPI.h -> objcSPI.h.
471 2018-08-07 Yusuke Suzuki <yusukesuzuki@slowstart.org>
473 Shrink size of PropertyCondition by packing UniquedStringImpl* and Kind
474 https://bugs.webkit.org/show_bug.cgi?id=188328
476 Reviewed by Saam Barati.
478 Shrinking the size of PropertyCondition can improve memory consumption by a lot.
479 For example, cnn.com can show 7000 persistent StructureStubClearingWatchpoint
480 and 6000 LLIntPrototypeLoadAdaptiveStructureWatchpoint which have PropertyCondition
483 This patch shrinks the size of PropertyCondition by packing UniquedStringImpl* and
484 PropertyCondition::Kind into uint64_t data in 64bit architecture. Since our address
485 are within 48bit, we can put PropertyCondition::Kind in this unused bits.
486 To make it easy, we add WTF::CompactPointerTuple<PointerType, Type>, which automatically
487 folds a pointer and 1byte type into 64bit data.
489 This change shrinks PropertyCondition from 24bytes to 16bytes.
491 * bytecode/PropertyCondition.cpp:
492 (JSC::PropertyCondition::dumpInContext const):
493 (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
494 (JSC::PropertyCondition::validityRequiresImpurePropertyWatchpoint const):
495 (JSC::PropertyCondition::isStillValid const):
496 (JSC::PropertyCondition::isWatchableWhenValid const):
497 * bytecode/PropertyCondition.h:
498 (JSC::PropertyCondition::PropertyCondition):
499 (JSC::PropertyCondition::presenceWithoutBarrier):
500 (JSC::PropertyCondition::absenceWithoutBarrier):
501 (JSC::PropertyCondition::absenceOfSetEffectWithoutBarrier):
502 (JSC::PropertyCondition::equivalenceWithoutBarrier):
503 (JSC::PropertyCondition::hasPrototypeWithoutBarrier):
504 (JSC::PropertyCondition::operator bool const):
505 (JSC::PropertyCondition::kind const):
506 (JSC::PropertyCondition::uid const):
507 (JSC::PropertyCondition::hasOffset const):
508 (JSC::PropertyCondition::hasAttributes const):
509 (JSC::PropertyCondition::hasPrototype const):
510 (JSC::PropertyCondition::hasRequiredValue const):
511 (JSC::PropertyCondition::hash const):
512 (JSC::PropertyCondition::operator== const):
513 (JSC::PropertyCondition::isHashTableDeletedValue const):
514 (JSC::PropertyCondition::watchingRequiresReplacementWatchpoint const):
516 2018-08-07 Mark Lam <mark.lam@apple.com>
518 Use a more specific PtrTag for PlatformRegisters PC and LR.
519 https://bugs.webkit.org/show_bug.cgi?id=188366
520 <rdar://problem/42984123>
522 Reviewed by Keith Miller.
524 Also fixed a bug in linkRegister(), which was previously returning the PC instead
525 of LR. It now returns LR.
527 * runtime/JSCPtrTag.h:
528 * runtime/MachineContext.h:
529 (JSC::MachineContext::instructionPointer):
530 (JSC::MachineContext::linkRegister):
531 * runtime/VMTraps.cpp:
532 (JSC::SignalContext::SignalContext):
533 * tools/SigillCrashAnalyzer.cpp:
534 (JSC::SignalContext::SignalContext):
536 2018-08-07 Karo Gyoker <karogyoker2+webkit@gmail.com>
538 Hardcoded LFENCE instruction
539 https://bugs.webkit.org/show_bug.cgi?id=188145
541 Reviewed by Filip Pizlo.
543 Remove lfence instruction because it is crashing systems without SSE2 and
544 this is not the way how WebKit mitigates Spectre.
546 * runtime/JSLock.cpp:
547 (JSC::JSLock::didAcquireLock):
548 (JSC::JSLock::willReleaseLock):
550 2018-08-04 David Kilzer <ddkilzer@apple.com>
552 REGRESSION (r208953): TemplateObjectDescriptor constructor calculates m_hash on use-after-move variable
553 <https://webkit.org/b/188331>
555 Reviewed by Yusuke Suzuki.
557 * runtime/TemplateObjectDescriptor.h:
558 (JSC::TemplateObjectDescriptor::TemplateObjectDescriptor):
559 Use `m_rawstrings` instead of `rawStrings` to calculate hash.
561 2018-08-03 Saam Barati <sbarati@apple.com>
563 Give the `jsc` shell the JIT entitlement
564 https://bugs.webkit.org/show_bug.cgi?id=188324
565 <rdar://problem/42885806>
567 Reviewed by Dan Bernstein.
569 This should help us in ensuring the system jsc is able to JIT.
571 * Configurations/JSC.xcconfig:
572 * JavaScriptCore.xcodeproj/project.pbxproj:
573 * allow-jit-macOS.entitlements: Added.
575 2018-08-03 Alex Christensen <achristensen@webkit.org>
577 Fix spelling of "overridden"
578 https://bugs.webkit.org/show_bug.cgi?id=188315
580 Reviewed by Darin Adler.
583 * inspector/InjectedScriptSource.js:
585 2018-08-02 Saam Barati <sbarati@apple.com>
587 Reading instructionPointer from PlatformRegisters may fail when using pointer profiling
588 https://bugs.webkit.org/show_bug.cgi?id=188271
589 <rdar://problem/42850884>
591 Reviewed by Michael Saboff.
593 This patch defends against the instructionPointer containing garbage bits.
594 See radar for details.
596 * runtime/MachineContext.h:
597 (JSC::MachineContext::instructionPointer):
598 * runtime/SamplingProfiler.cpp:
599 (JSC::SamplingProfiler::takeSample):
600 * runtime/VMTraps.cpp:
601 (JSC::SignalContext::SignalContext):
602 (JSC::SignalContext::tryCreate):
603 * tools/CodeProfiling.cpp:
604 (JSC::profilingTimer):
605 * tools/SigillCrashAnalyzer.cpp:
606 (JSC::SignalContext::SignalContext):
607 (JSC::SignalContext::tryCreate):
608 (JSC::SignalContext::dump):
609 (JSC::installCrashHandler):
610 * wasm/WasmFaultSignalHandler.cpp:
611 (JSC::Wasm::trapHandler):
613 2018-08-02 David Fenton <david_fenton@apple.com>
615 Unreviewed, rolling out r234489.
617 Caused 50+ crashes and 60+ API failures on iOS
621 "[WTF] Rename String::format to String::deprecatedFormat"
622 https://bugs.webkit.org/show_bug.cgi?id=188191
623 https://trac.webkit.org/changeset/234489
625 2018-08-01 Yusuke Suzuki <utatane.tea@gmail.com>
627 Add self.queueMicrotask(f) on DOMWindow
628 https://bugs.webkit.org/show_bug.cgi?id=188212
630 Reviewed by Ryosuke Niwa.
633 * JavaScriptCore.xcodeproj/project.pbxproj:
635 * runtime/JSGlobalObject.cpp:
637 * runtime/JSMicrotask.cpp: Renamed from Source/JavaScriptCore/runtime/JSJob.cpp.
638 (JSC::createJSMicrotask):
639 Export them to WebCore.
641 (JSC::JSMicrotask::run):
642 * runtime/JSMicrotask.h: Renamed from Source/JavaScriptCore/runtime/JSJob.h.
643 Add another version of JSMicrotask which does not have arguments.
645 2018-08-01 Tomas Popela <tpopela@redhat.com>
647 [WTF] Rename String::format to String::deprecatedFormat
648 https://bugs.webkit.org/show_bug.cgi?id=188191
650 Reviewed by Darin Adler.
652 It should be replaced with string concatenation.
654 * bytecode/CodeBlock.cpp:
655 (JSC::CodeBlock::nameForRegister):
656 * inspector/InjectedScriptBase.cpp:
657 (Inspector::InjectedScriptBase::makeCall):
658 * inspector/InspectorBackendDispatcher.cpp:
659 (Inspector::BackendDispatcher::getPropertyValue):
660 * inspector/agents/InspectorConsoleAgent.cpp:
661 (Inspector::InspectorConsoleAgent::enable):
662 (Inspector::InspectorConsoleAgent::stopTiming):
664 (FunctionJSCStackFunctor::operator() const):
666 (JSC::Lexer<T>::invalidCharacterMessage const):
667 * runtime/IntlDateTimeFormat.cpp:
668 (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
669 * runtime/IntlObject.cpp:
670 (JSC::canonicalizeLocaleList):
671 * runtime/LiteralParser.cpp:
672 (JSC::LiteralParser<CharType>::Lexer::lex):
673 (JSC::LiteralParser<CharType>::Lexer::lexStringSlow):
674 (JSC::LiteralParser<CharType>::parse):
675 * runtime/LiteralParser.h:
676 (JSC::LiteralParser::getErrorMessage):
678 2018-08-01 Andy VanWagoner <andy@vanwagoner.family>
680 [INTL] Allow "unknown" formatToParts types
681 https://bugs.webkit.org/show_bug.cgi?id=188176
683 Reviewed by Darin Adler.
685 Originally extra unexpected field types were marked as "literal", since
686 the spec did not account for these. The ECMA 402 spec has since been updated
687 to specify "unknown" should be used in these cases.
689 Currently there is no known way to reach these cases, so no tests can
690 account for them. Theoretically they shoudn't exist, but they are specified,
691 just to be safe. Marking them as "unknown" instead of "literal" hopefully
692 will make such cases easy to identify if they ever happen.
694 * runtime/IntlDateTimeFormat.cpp:
695 (JSC::IntlDateTimeFormat::partTypeString):
696 * runtime/IntlNumberFormat.cpp:
697 (JSC::IntlNumberFormat::partTypeString):
699 2018-08-01 Andy VanWagoner <andy@vanwagoner.family>
701 [INTL] Implement hourCycle in DateTimeFormat
702 https://bugs.webkit.org/show_bug.cgi?id=188006
704 Reviewed by Darin Adler.
706 Implemented hourCycle, updating both the skeleton and the final pattern.
707 Changed resolveLocale to assume undefined options are not given and null
708 strings actually mean null, which removes the tag extension.
710 * runtime/CommonIdentifiers.h:
711 * runtime/IntlCollator.cpp:
712 (JSC::IntlCollator::initializeCollator):
713 * runtime/IntlDateTimeFormat.cpp:
714 (JSC::IntlDTFInternal::localeData):
715 (JSC::IntlDateTimeFormat::setFormatsFromPattern):
716 (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
717 (JSC::IntlDateTimeFormat::resolvedOptions):
718 * runtime/IntlDateTimeFormat.h:
719 * runtime/IntlObject.cpp:
720 (JSC::resolveLocale):
722 2018-08-01 Keith Miller <keith_miller@apple.com>
724 JSArrayBuffer should have its own JSType
725 https://bugs.webkit.org/show_bug.cgi?id=188231
727 Reviewed by Saam Barati.
729 * runtime/JSArrayBuffer.cpp:
730 (JSC::JSArrayBuffer::createStructure):
734 2018-07-31 Keith Miller <keith_miller@apple.com>
736 Unreviewed 32-bit build fix...
738 * dfg/DFGSpeculativeJIT32_64.cpp:
740 2018-07-31 Keith Miller <keith_miller@apple.com>
742 Long compiling JSC files should not be unified
743 https://bugs.webkit.org/show_bug.cgi?id=188205
745 Reviewed by Saam Barati.
747 The DFGSpeculativeJIT and FTLLowerDFGToB3 files take a long time
748 to compile. Unifying them means touching anything in the same
749 bundle as those files takes a long time to incrementally build.
750 This patch separates those files so they build standalone.
752 * JavaScriptCore.xcodeproj/project.pbxproj:
754 * dfg/DFGSpeculativeJIT64.cpp:
756 2018-07-31 Yusuke Suzuki <utatane.tea@gmail.com>
758 [JSC] Remove unnecessary cellLock() in JSObject's GC marking if IndexingType is contiguous
759 https://bugs.webkit.org/show_bug.cgi?id=188201
761 Reviewed by Keith Miller.
763 We do not reuse the existing butterfly with Contiguous shape for new ArrayStorage butterfly.
764 When converting the butterfly with Contiguous shape to ArrayStorage, we always allocate a
765 new one. So this cellLock() is unnecessary for contiguous shape since contigous shaped butterfly
766 never becomes broken state. This patch removes unnecessary locking.
768 * runtime/JSObject.cpp:
769 (JSC::JSObject::visitButterflyImpl):
771 2018-07-31 Guillaume Emont <guijemont@igalia.com>
773 [JSC] Remove gcc warnings for 32-bit platforms
774 https://bugs.webkit.org/show_bug.cgi?id=187803
776 Reviewed by Yusuke Suzuki.
778 * assembler/MacroAssemblerPrinter.cpp:
779 (JSC::Printer::printPCRegister):
780 (JSC::Printer::printRegisterID):
781 (JSC::Printer::printAddress):
782 * dfg/DFGSpeculativeJIT.cpp:
783 (JSC::DFG::SpeculativeJIT::speculateNumber):
784 (JSC::DFG::SpeculativeJIT::speculateMisc):
785 * jit/CCallHelpers.h:
786 (JSC::CCallHelpers::calculatePokeOffset):
787 * runtime/Options.cpp:
790 2018-07-30 Wenson Hsieh <wenson_hsieh@apple.com>
792 watchOS engineering build is broken after r234227
793 https://bugs.webkit.org/show_bug.cgi?id=188180
795 Reviewed by Keith Miller.
797 In the case where we're building with a `PLATFORM_NAME` of neither "macosx" nor "iphone*",
798 postprocess-headers.sh attempts to delete any usage of the JSC availability macros. However,
799 `JSC_MAC_VERSION_TBA` and `JSC_IOS_VERSION_TBA` still remain, and JSValue.h's usage of
800 `JSC_IOS_VERSION_TBA` causes engineering watchOS builds to fail.
802 To fix this, simply allow the fallback path to remove these macros from JavaScriptCore headers
803 entirely, since there's no relevant version to replace them with.
805 * postprocess-headers.sh:
807 2018-07-30 Keith Miller <keith_miller@apple.com>
809 Clarify conversion rules for JSValue property access API
810 https://bugs.webkit.org/show_bug.cgi?id=188179
812 Reviewed by Geoffrey Garen.
816 2018-07-30 Keith Miller <keith_miller@apple.com>
818 Rename some JSC API functions/types.
819 https://bugs.webkit.org/show_bug.cgi?id=188173
821 Reviewed by Saam Barati.
823 * API/JSObjectRef.cpp:
824 (JSObjectHasPropertyForKey):
825 (JSObjectGetPropertyForKey):
826 (JSObjectSetPropertyForKey):
827 (JSObjectDeletePropertyForKey):
828 (JSObjectHasPropertyKey): Deleted.
829 (JSObjectGetPropertyKey): Deleted.
830 (JSObjectSetPropertyKey): Deleted.
831 (JSObjectDeletePropertyKey): Deleted.
835 (-[JSValue valueForProperty:]):
836 (-[JSValue setValue:forProperty:]):
837 (-[JSValue deleteProperty:]):
838 (-[JSValue hasProperty:]):
839 (-[JSValue defineProperty:descriptor:]):
840 * API/tests/testapi.cpp:
843 2018-07-30 Mark Lam <mark.lam@apple.com>
845 Add a debugging utility to dump the memory layout of a JSCell.
846 https://bugs.webkit.org/show_bug.cgi?id=188157
848 Reviewed by Yusuke Suzuki.
850 This patch adds $vm.dumpCell() and VMInspector::dumpCellMemory() to allow us to
851 dump the memory contents of a cell and if present, its butterfly for debugging
854 Example usage for JS code when JSC_useDollarVM=true:
858 Example usage from C++ code or from lldb:
860 (lldb) p JSC::VMInspector::dumpCellMemory(obj)
862 Some examples of dumps:
864 <0x104bc8260, Object>
865 [0] 0x104bc8260 : 0x010016000000016c header
866 structureID 364 0x16c structure 0x104b721b0
867 indexingTypeAndMisc 0 0x0 NonArray
871 [1] 0x104bc8268 : 0x0000000000000000 butterfly
872 [2] 0x104bc8270 : 0xffff000000000007
873 [3] 0x104bc8278 : 0xffff000000000008
876 [0] 0x104bb4360 : 0x0108210b00000171 header
877 structureID 369 0x171 structure 0x104b723e0
878 indexingTypeAndMisc 11 0xb ArrayWithArrayStorage
882 [1] 0x104bb4368 : 0x00000008000f4718 butterfly
884 hasIndexingHeader YES hasAnyArrayStorage YES
885 publicLength 4 vectorLength 7 indexBias 2
886 preCapacity 2 propertyCapacity 4
888 [0] 0x8000f46e0 : 0x0000000000000000
889 [1] 0x8000f46e8 : 0x0000000000000000
890 <--- propertyCapacity
891 [2] 0x8000f46f0 : 0x0000000000000000
892 [3] 0x8000f46f8 : 0x0000000000000000
893 [4] 0x8000f4700 : 0xffff00000000000d
894 [5] 0x8000f4708 : 0xffff00000000000c
896 [6] 0x8000f4710 : 0x0000000700000004
899 [7] 0x8000f4718 : 0x0000000000000000
900 [8] 0x8000f4720 : 0x0000000400000002
901 <--- indexedProperties
902 [9] 0x8000f4728 : 0xffff000000000008
903 [10] 0x8000f4730 : 0xffff000000000009
904 [11] 0x8000f4738 : 0xffff000000000005
905 [12] 0x8000f4740 : 0xffff000000000006
906 [13] 0x8000f4748 : 0x0000000000000000
907 [14] 0x8000f4750 : 0x0000000000000000
908 [15] 0x8000f4758 : 0x0000000000000000
909 <--- unallocated capacity
910 [16] 0x8000f4760 : 0x0000000000000000
911 [17] 0x8000f4768 : 0x0000000000000000
912 [18] 0x8000f4770 : 0x0000000000000000
913 [19] 0x8000f4778 : 0x0000000000000000
915 * runtime/JSObject.h:
916 * tools/JSDollarVM.cpp:
917 (JSC::functionDumpCell):
918 (JSC::JSDollarVM::finishCreation):
919 * tools/VMInspector.cpp:
920 (JSC::VMInspector::dumpCellMemory):
921 (JSC::IndentationScope::IndentationScope):
922 (JSC::IndentationScope::~IndentationScope):
923 (JSC::VMInspector::dumpCellMemoryToStream):
924 * tools/VMInspector.h:
926 2018-07-27 Mark Lam <mark.lam@apple.com>
928 Add some crash info to Heap::checkConn() RELEASE_ASSERTs.
929 https://bugs.webkit.org/show_bug.cgi?id=188123
930 <rdar://problem/42672268>
932 Reviewed by Keith Miller.
934 1. Add VM::m_id and Heap::m_lastPhase fields. Both of these fit within existing
935 padding space in VM and Heap, and should not cost any measurable perf to
936 initialize and update.
938 2. Add some crash info to the RELEASE_ASSERTs in Heap::checkConn():
940 worldState tells us the value we failed the assertion on.
942 m_lastPhase, m_currentPhase, and m_nextPhase tells us the GC phase transition
945 VM::id(), and VM::numberOfIDs() tells us how many VMs may be in play.
947 VM::isEntered() tells us if the current VM is currently executing JS code.
949 Some of this data may be redundant, but the redundancy is intentional so that
950 we can double check what is really happening at the time of crash.
954 (JSC::Heap::checkConn):
955 (JSC::Heap::changePhase):
961 (JSC::VM::numberOfIDs):
963 (JSC::VM::isEntered const):
965 2018-07-25 Yusuke Suzuki <utatane.tea@gmail.com>
967 [JSC] Record CoW status in ArrayProfile correctly
968 https://bugs.webkit.org/show_bug.cgi?id=187949
970 Reviewed by Saam Barati.
972 In this patch, we simplify asArrayModes: just shifting the value with IndexingMode.
973 This is important since our OSR exit compiler records m_observedArrayModes by calculating
974 ArrayModes with shifting. Since ArrayModes for CoW arrays are incorrectly calculated,
975 our OSR exit compiler records incorrect results in ArrayProfile. And it leads to
976 Array::Generic DFG nodes.
978 * bytecode/ArrayProfile.h:
980 (JSC::ArrayProfile::ArrayProfile):
981 * dfg/DFGOSRExit.cpp:
982 (JSC::DFG::OSRExit::compileExit):
983 * ftl/FTLOSRExitCompiler.cpp:
984 (JSC::FTL::compileStub):
985 * runtime/IndexingType.h:
987 2018-07-26 Andy VanWagoner <andy@vanwagoner.family>
989 [INTL] Remove INTL sub-feature compile flags
990 https://bugs.webkit.org/show_bug.cgi?id=188081
992 Reviewed by Michael Catanzaro.
994 Removed ENABLE_INTL_NUMBER_FORMAT_TO_PARTS and ENABLE_INTL_PLURAL_RULES flags.
995 The runtime flags are still present, and should be relied on instead.
996 The defines for ICU features have also been updated to match HAVE() style.
998 * Configurations/FeatureDefines.xcconfig:
999 * runtime/IntlPluralRules.cpp:
1000 (JSC::IntlPluralRules::resolvedOptions):
1001 (JSC::IntlPluralRules::select):
1002 * runtime/IntlPluralRules.h:
1003 * runtime/Options.h:
1005 2018-07-26 Yusuke Suzuki <utatane.tea@gmail.com>
1007 [JSC] Dump IndexingMode in Structure
1008 https://bugs.webkit.org/show_bug.cgi?id=188085
1010 Reviewed by Keith Miller.
1012 Dump IndexingMode instead of IndexingType.
1014 * runtime/Structure.cpp:
1015 (JSC::Structure::dump const):
1017 2018-07-26 Ross Kirsling <ross.kirsling@sony.com>
1019 String(View) should have a splitAllowingEmptyEntries function instead of a flag parameter
1020 https://bugs.webkit.org/show_bug.cgi?id=187963
1022 Reviewed by Alex Christensen.
1024 * inspector/InspectorBackendDispatcher.cpp:
1025 (Inspector::BackendDispatcher::dispatch):
1027 (ModuleName::ModuleName):
1029 * runtime/IntlObject.cpp:
1030 (JSC::canonicalizeLanguageTag):
1031 (JSC::removeUnicodeLocaleExtension):
1032 Update split/splitAllowingEmptyEntries usage.
1034 2018-07-26 Commit Queue <commit-queue@webkit.org>
1036 Unreviewed, rolling out r234181 and r234189.
1037 https://bugs.webkit.org/show_bug.cgi?id=188075
1039 These are not needed right now (Requested by thorton on
1042 Reverted changesets:
1044 "Enable Web Content Filtering on watchOS"
1045 https://bugs.webkit.org/show_bug.cgi?id=187979
1046 https://trac.webkit.org/changeset/234181
1048 "HAVE(PARENTAL_CONTROLS) should be true on watchOS"
1049 https://bugs.webkit.org/show_bug.cgi?id=187985
1050 https://trac.webkit.org/changeset/234189
1052 2018-07-26 Mark Lam <mark.lam@apple.com>
1054 arrayProtoPrivateFuncConcatMemcpy() should handle copying from an Undecided type array.
1055 https://bugs.webkit.org/show_bug.cgi?id=188065
1056 <rdar://problem/42515726>
1058 Reviewed by Saam Barati.
1060 * runtime/ArrayPrototype.cpp:
1061 (JSC::clearElement):
1062 (JSC::copyElements):
1063 (JSC::arrayProtoPrivateFuncConcatMemcpy):
1065 2018-07-26 Andy VanWagoner <andy@vanwagoner.family>
1067 JSC: Intl API should ignore encoding when parsing BCP 47 language tag from ISO 15897 locale string (passed via LANG)
1068 https://bugs.webkit.org/show_bug.cgi?id=167991
1070 Reviewed by Michael Catanzaro.
1072 Improved the conversion of ICU locales to BCP47 tags, using their preferred method.
1073 Checked locale.isEmpty() before returning it from defaultLocale, so there should be
1074 no more cases where you might have an invalid locale come back from resolveLocale.
1076 * runtime/IntlObject.cpp:
1077 (JSC::convertICULocaleToBCP47LanguageTag):
1078 (JSC::defaultLocale):
1079 (JSC::lookupMatcher):
1080 * runtime/IntlObject.h:
1081 * runtime/JSGlobalObject.cpp:
1082 (JSC::JSGlobalObject::intlCollatorAvailableLocales):
1083 (JSC::JSGlobalObject::intlDateTimeFormatAvailableLocales):
1084 (JSC::JSGlobalObject::intlNumberFormatAvailableLocales):
1085 (JSC::JSGlobalObject::intlPluralRulesAvailableLocales):
1087 2018-07-26 Fujii Hironori <Hironori.Fujii@sony.com>
1089 REGRESSION(r234248) [Win] testapi.c: nonstandard extension used: non-constant aggregate initializer
1090 https://bugs.webkit.org/show_bug.cgi?id=188040
1092 Unreviewed build fix for AppleWin port.
1094 * API/tests/testapi.c: Disabled warning C4204.
1095 (testMarkingConstraintsAndHeapFinalizers): Added an explicit void* cast for weakRefs.
1097 2018-07-26 Fujii Hironori <Hironori.Fujii@sony.com>
1099 [JSC API] We should support the symbol type in our C/Obj-C API
1100 https://bugs.webkit.org/show_bug.cgi?id=175836
1102 Unreviewed build fix for Windows port.
1104 r234227 introduced a compilation error unresolved external symbol
1105 "int __cdecl testCAPIViaCpp(void)" in testapi for Windows ports.
1107 Windows ports are compiling testapi.c as C++ by using /TP switch.
1109 * API/tests/testapi.c:
1110 (main): Removed `::` prefix of ::SetErrorMode Windows API.
1111 (dllLauncherEntryPoint): Converted into C style.
1112 * shell/PlatformWin.cmake: Do not use /TP switch for testapi.c
1114 2018-07-25 Keith Miller <keith_miller@apple.com>
1116 [JSC API] We should support the symbol type in our C/Obj-C API
1117 https://bugs.webkit.org/show_bug.cgi?id=175836
1119 Reviewed by Filip Pizlo.
1121 This patch makes the following API additions:
1122 1) Test if a JSValue/JSValueRef is a symbol via any of the methods API are able to test for the types of other JSValues.
1123 2) Create a symbol on both APIs.
1124 3) Get/Set/Delete/Define property now take ids in the Obj-C API.
1125 4) Add Get/Set/Delete in the C API.
1127 We can do 3 because it is both binary and source compatable with
1128 the existing API. I added (4) because the current property access
1129 APIs only have the ability to get Strings. It was possible to
1130 merge symbols into JSStringRef but that felt confusing and exposes
1131 implementation details of our engine. The new functions match the
1132 same meaning that they have in JS, thus should be forward
1133 compatible with any future language extensions.
1135 Lastly, this patch adds the same availability preproccessing phase
1136 in WebCore to JavaScriptCore, which enables TBA features for
1137 testing on previous releases.
1140 * API/JSBasePrivate.h:
1142 * API/JSContextPrivate.h:
1143 * API/JSContextRef.h:
1144 * API/JSContextRefInternal.h:
1145 * API/JSContextRefPrivate.h:
1146 * API/JSManagedValue.h:
1147 * API/JSObjectRef.cpp:
1148 (JSObjectHasPropertyKey):
1149 (JSObjectGetPropertyKey):
1150 (JSObjectSetPropertyKey):
1151 (JSObjectDeletePropertyKey):
1152 * API/JSObjectRef.h:
1153 * API/JSRemoteInspector.h:
1154 * API/JSTypedArray.h:
1157 (+[JSValue valueWithNewSymbolFromDescription:inContext:]):
1158 (performPropertyOperation):
1159 (-[JSValue valueForProperty:valueForProperty:]):
1160 (-[JSValue setValue:forProperty:setValue:forProperty:]):
1161 (-[JSValue deleteProperty:deleteProperty:]):
1162 (-[JSValue hasProperty:hasProperty:]):
1163 (-[JSValue defineProperty:descriptor:defineProperty:descriptor:]):
1164 (-[JSValue isSymbol]):
1165 (-[JSValue objectForKeyedSubscript:]):
1166 (-[JSValue setObject:forKeyedSubscript:]):
1167 (-[JSValue valueForProperty:]): Deleted.
1168 (-[JSValue setValue:forProperty:]): Deleted.
1169 (-[JSValue deleteProperty:]): Deleted.
1170 (-[JSValue hasProperty:]): Deleted.
1171 (-[JSValue defineProperty:descriptor:]): Deleted.
1172 * API/JSValueRef.cpp:
1175 (JSValueMakeSymbol):
1177 * API/WebKitAvailability.h:
1178 * API/tests/CurrentThisInsideBlockGetterTest.mm:
1179 * API/tests/CustomGlobalObjectClassTest.c:
1180 * API/tests/DateTests.mm:
1181 * API/tests/JSExportTests.mm:
1182 * API/tests/JSNode.c:
1183 * API/tests/JSNodeList.c:
1185 * API/tests/NodeList.c:
1186 * API/tests/minidom.c:
1187 * API/tests/testapi.c:
1189 * API/tests/testapi.cpp: Added.
1190 (APIString::APIString):
1191 (APIString::~APIString):
1192 (APIString::operator JSStringRef):
1193 (APIContext::APIContext):
1194 (APIContext::~APIContext):
1195 (APIContext::operator JSGlobalContextRef):
1196 (APIVector::APIVector):
1197 (APIVector::~APIVector):
1198 (APIVector::append):
1200 (TestAPI::evaluateScript):
1201 (TestAPI::callFunction):
1202 (TestAPI::functionReturnsTrue):
1204 (TestAPI::checkJSAndAPIMatch):
1205 (TestAPI::interestingObjects):
1206 (TestAPI::interestingKeys):
1208 * API/tests/testapi.mm:
1209 (testObjectiveCAPIMain):
1210 * JavaScriptCore.xcodeproj/project.pbxproj:
1212 * postprocess-headers.sh:
1213 * shell/CMakeLists.txt:
1214 * testmem/testmem.mm:
1216 2018-07-25 Andy VanWagoner <andy@vanwagoner.family>
1218 [INTL] Call Typed Array elements toLocaleString with locale and options
1219 https://bugs.webkit.org/show_bug.cgi?id=185796
1221 Reviewed by Keith Miller.
1223 Improve ECMA 402 compliance of typed array toLocaleString, passing along
1224 the locale and options to element toLocaleString calls.
1226 * builtins/TypedArrayPrototype.js:
1229 2018-07-25 Andy VanWagoner <andy@vanwagoner.family>
1231 [INTL] Intl constructor lengths should be configurable
1232 https://bugs.webkit.org/show_bug.cgi?id=187960
1234 Reviewed by Saam Barati.
1236 Removed DontDelete from Intl constructor lengths.
1237 Fixed DateTimeFormat formatToParts length.
1239 * runtime/IntlCollatorConstructor.cpp:
1240 (JSC::IntlCollatorConstructor::finishCreation):
1241 * runtime/IntlDateTimeFormatConstructor.cpp:
1242 (JSC::IntlDateTimeFormatConstructor::finishCreation):
1243 * runtime/IntlDateTimeFormatPrototype.cpp:
1244 (JSC::IntlDateTimeFormatPrototype::finishCreation):
1245 * runtime/IntlNumberFormatConstructor.cpp:
1246 (JSC::IntlNumberFormatConstructor::finishCreation):
1247 * runtime/IntlPluralRulesConstructor.cpp:
1248 (JSC::IntlPluralRulesConstructor::finishCreation):
1250 2018-07-24 Fujii Hironori <Hironori.Fujii@sony.com>
1252 runJITThreadLimitTests is failing
1253 https://bugs.webkit.org/show_bug.cgi?id=187886
1254 <rdar://problem/42561966>
1256 Unreviewed build fix for MSVC.
1258 MSVC doen't support ternary operator without second operand.
1260 * dfg/DFGWorklist.cpp:
1261 (JSC::DFG::getNumberOfDFGCompilerThreads):
1262 (JSC::DFG::getNumberOfFTLCompilerThreads):
1264 2018-07-24 Commit Queue <commit-queue@webkit.org>
1266 Unreviewed, rolling out r234183.
1267 https://bugs.webkit.org/show_bug.cgi?id=187983
1269 cause regression in Kraken gaussian blur and desaturate
1270 (Requested by yusukesuzuki on #webkit).
1274 "[JSC] Record CoW status in ArrayProfile"
1275 https://bugs.webkit.org/show_bug.cgi?id=187949
1276 https://trac.webkit.org/changeset/234183
1278 2018-07-24 Yusuke Suzuki <utatane.tea@gmail.com>
1280 [JSC] Record CoW status in ArrayProfile
1281 https://bugs.webkit.org/show_bug.cgi?id=187949
1283 Reviewed by Saam Barati.
1285 Once CoW array is converted to non-CoW array, subsequent operations are done for this non-CoW array.
1286 Even though these operations are performed onto both CoW and non-CoW arrays in the code, array profiles
1287 in these code typically record only non-CoW arrays since array profiles hold only one StructureID recently
1288 seen. This results emitting CheckStructure for non-CoW arrays in DFG, and it soon causes OSR exits due to
1291 In this patch, we record CoW status in ArrayProfile separately to construct more appropriate DFG::ArrayMode
1292 speculation. To do so efficiently, we store union of seen IndexingMode in ArrayProfile.
1294 This patch removes one of Kraken/stanford-crypto-aes's OSR exit reason, and improves the performance by 6-7%.
1298 stanford-crypto-aes 60.893+-1.346 ^ 57.412+-1.298 ^ definitely 1.0606x faster
1299 stanford-crypto-ccm 62.124+-1.992 58.921+-1.844 might be 1.0544x faster
1301 * bytecode/ArrayProfile.cpp:
1302 (JSC::ArrayProfile::briefDescriptionWithoutUpdating):
1303 * bytecode/ArrayProfile.h:
1304 (JSC::asArrayModes):
1305 We simplify asArrayModes instead of giving up Int8ArrayMode - Float64ArrayMode contiguous sequence.
1307 (JSC::ArrayProfile::ArrayProfile):
1308 (JSC::ArrayProfile::addressOfObservedIndexingModes):
1309 (JSC::ArrayProfile::observedIndexingModes const):
1310 Currently, our macro assembler and offlineasm only support `or32` / `ori` operation onto addresses.
1311 So storing the union of seen IndexingMode in `unsigned` instead.
1313 * dfg/DFGArrayMode.cpp:
1314 (JSC::DFG::ArrayMode::fromObserved):
1315 * dfg/DFGArrayMode.h:
1316 (JSC::DFG::ArrayMode::withProfile const):
1318 (JSC::JIT::compileOpCall):
1319 * jit/JITCall32_64.cpp:
1320 (JSC::JIT::compileOpCall):
1322 (JSC::JIT::emitArrayProfilingSiteWithCell):
1323 * llint/LowLevelInterpreter.asm:
1324 * llint/LowLevelInterpreter32_64.asm:
1325 * llint/LowLevelInterpreter64.asm:
1327 2018-07-24 Tim Horton <timothy_horton@apple.com>
1329 Enable Web Content Filtering on watchOS
1330 https://bugs.webkit.org/show_bug.cgi?id=187979
1331 <rdar://problem/42559346>
1333 Reviewed by Wenson Hsieh.
1335 * Configurations/FeatureDefines.xcconfig:
1337 2018-07-24 Tadeu Zagallo <tzagallo@apple.com>
1339 Don't modify Options when setting JIT thread limits
1340 https://bugs.webkit.org/show_bug.cgi?id=187886
1342 Reviewed by Filip Pizlo.
1344 Previously, when setting the JIT thread limit prior to the worklist
1345 initialization, it'd be set via Options, which didn't work if Options
1346 hadn't been initialized yet. Change it to use a static variable in the
1349 * API/JSVirtualMachine.mm:
1350 (+[JSVirtualMachine setNumberOfDFGCompilerThreads:]):
1351 (+[JSVirtualMachine setNumberOfFTLCompilerThreads:]):
1352 * API/tests/testapi.mm:
1353 (testObjectiveCAPIMain):
1354 * dfg/DFGWorklist.cpp:
1355 (JSC::DFG::getNumberOfDFGCompilerThreads):
1356 (JSC::DFG::getNumberOfFTLCompilerThreads):
1357 (JSC::DFG::setNumberOfDFGCompilerThreads):
1358 (JSC::DFG::setNumberOfFTLCompilerThreads):
1359 (JSC::DFG::ensureGlobalDFGWorklist):
1360 (JSC::DFG::ensureGlobalFTLWorklist):
1361 * dfg/DFGWorklist.h:
1363 2018-07-24 Mark Lam <mark.lam@apple.com>
1365 Refactoring: make DFG::Plan a class.
1366 https://bugs.webkit.org/show_bug.cgi?id=187968
1368 Reviewed by Saam Barati.
1370 This patch makes all the DFG::Plan fields private, and provide accessor methods
1371 for them. This makes it easier to reason about how these fields are used and
1374 * dfg/DFGAbstractInterpreterInlines.h:
1375 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1376 * dfg/DFGByteCodeParser.cpp:
1377 (JSC::DFG::ByteCodeParser::handleCall):
1378 (JSC::DFG::ByteCodeParser::handleVarargsCall):
1379 (JSC::DFG::ByteCodeParser::handleInlining):
1380 (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
1381 (JSC::DFG::ByteCodeParser::handleDOMJITGetter):
1382 (JSC::DFG::ByteCodeParser::handleModuleNamespaceLoad):
1383 (JSC::DFG::ByteCodeParser::handleGetById):
1384 (JSC::DFG::ByteCodeParser::handlePutById):
1385 (JSC::DFG::ByteCodeParser::parseBlock):
1386 (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
1387 (JSC::DFG::ByteCodeParser::parseCodeBlock):
1388 (JSC::DFG::ByteCodeParser::parse):
1389 * dfg/DFGCFAPhase.cpp:
1390 (JSC::DFG::CFAPhase::run):
1391 (JSC::DFG::CFAPhase::injectOSR):
1392 * dfg/DFGClobberize.h:
1393 (JSC::DFG::clobberize):
1394 * dfg/DFGCommonData.cpp:
1395 (JSC::DFG::CommonData::notifyCompilingStructureTransition):
1396 * dfg/DFGCommonData.h:
1397 * dfg/DFGConstantFoldingPhase.cpp:
1398 (JSC::DFG::ConstantFoldingPhase::foldConstants):
1399 * dfg/DFGDriver.cpp:
1400 (JSC::DFG::compileImpl):
1401 * dfg/DFGFinalizer.h:
1402 * dfg/DFGFixupPhase.cpp:
1403 (JSC::DFG::FixupPhase::fixupNode):
1404 (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):
1406 (JSC::DFG::Graph::Graph):
1407 (JSC::DFG::Graph::watchCondition):
1408 (JSC::DFG::Graph::inferredTypeFor):
1409 (JSC::DFG::Graph::requiredRegisterCountForExit):
1410 (JSC::DFG::Graph::registerFrozenValues):
1411 (JSC::DFG::Graph::registerStructure):
1412 (JSC::DFG::Graph::registerAndWatchStructureTransition):
1413 (JSC::DFG::Graph::assertIsRegistered):
1415 (JSC::DFG::Graph::compilation):
1416 (JSC::DFG::Graph::identifiers):
1417 (JSC::DFG::Graph::watchpoints):
1418 * dfg/DFGJITCompiler.cpp:
1419 (JSC::DFG::JITCompiler::JITCompiler):
1420 (JSC::DFG::JITCompiler::link):
1421 (JSC::DFG::JITCompiler::compile):
1422 (JSC::DFG::JITCompiler::compileFunction):
1423 (JSC::DFG::JITCompiler::disassemble):
1424 * dfg/DFGJITCompiler.h:
1425 (JSC::DFG::JITCompiler::addWeakReference):
1426 * dfg/DFGJITFinalizer.cpp:
1427 (JSC::DFG::JITFinalizer::finalize):
1428 (JSC::DFG::JITFinalizer::finalizeFunction):
1429 (JSC::DFG::JITFinalizer::finalizeCommon):
1430 * dfg/DFGOSREntrypointCreationPhase.cpp:
1431 (JSC::DFG::OSREntrypointCreationPhase::run):
1433 (JSC::DFG::Phase::beginPhase):
1435 (JSC::DFG::runAndLog):
1437 (JSC::DFG::Plan::Plan):
1438 (JSC::DFG::Plan::computeCompileTimes const):
1439 (JSC::DFG::Plan::reportCompileTimes const):
1440 (JSC::DFG::Plan::compileInThread):
1441 (JSC::DFG::Plan::compileInThreadImpl):
1442 (JSC::DFG::Plan::isStillValid):
1443 (JSC::DFG::Plan::reallyAdd):
1444 (JSC::DFG::Plan::notifyCompiling):
1445 (JSC::DFG::Plan::notifyReady):
1446 (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
1447 (JSC::DFG::Plan::finalizeAndNotifyCallback):
1448 (JSC::DFG::Plan::key):
1449 (JSC::DFG::Plan::checkLivenessAndVisitChildren):
1450 (JSC::DFG::Plan::finalizeInGC):
1451 (JSC::DFG::Plan::isKnownToBeLiveDuringGC):
1452 (JSC::DFG::Plan::cancel):
1453 (JSC::DFG::Plan::cleanMustHandleValuesIfNecessary):
1455 (JSC::DFG::Plan::canTierUpAndOSREnter const):
1456 (JSC::DFG::Plan::vm const):
1457 (JSC::DFG::Plan::codeBlock):
1458 (JSC::DFG::Plan::mode const):
1459 (JSC::DFG::Plan::osrEntryBytecodeIndex const):
1460 (JSC::DFG::Plan::mustHandleValues const):
1461 (JSC::DFG::Plan::threadData const):
1462 (JSC::DFG::Plan::compilation const):
1463 (JSC::DFG::Plan::finalizer const):
1464 (JSC::DFG::Plan::setFinalizer):
1465 (JSC::DFG::Plan::inlineCallFrames const):
1466 (JSC::DFG::Plan::watchpoints):
1467 (JSC::DFG::Plan::identifiers):
1468 (JSC::DFG::Plan::weakReferences):
1469 (JSC::DFG::Plan::transitions):
1470 (JSC::DFG::Plan::recordedStatuses):
1471 (JSC::DFG::Plan::willTryToTierUp const):
1472 (JSC::DFG::Plan::setWillTryToTierUp):
1473 (JSC::DFG::Plan::tierUpInLoopHierarchy):
1474 (JSC::DFG::Plan::tierUpAndOSREnterBytecodes):
1475 (JSC::DFG::Plan::stage const):
1476 (JSC::DFG::Plan::callback const):
1477 (JSC::DFG::Plan::setCallback):
1478 * dfg/DFGPlanInlines.h:
1479 (JSC::DFG::Plan::iterateCodeBlocksForGC):
1480 * dfg/DFGPreciseLocalClobberize.h:
1481 (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
1482 * dfg/DFGPredictionInjectionPhase.cpp:
1483 (JSC::DFG::PredictionInjectionPhase::run):
1484 * dfg/DFGSafepoint.cpp:
1485 (JSC::DFG::Safepoint::Safepoint):
1486 (JSC::DFG::Safepoint::~Safepoint):
1487 (JSC::DFG::Safepoint::begin):
1488 * dfg/DFGSafepoint.h:
1489 * dfg/DFGSpeculativeJIT.h:
1490 (JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPointer):
1491 (JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPoisonedPointer):
1492 * dfg/DFGStackLayoutPhase.cpp:
1493 (JSC::DFG::StackLayoutPhase::run):
1494 * dfg/DFGStrengthReductionPhase.cpp:
1495 (JSC::DFG::StrengthReductionPhase::handleNode):
1496 * dfg/DFGTierUpCheckInjectionPhase.cpp:
1497 (JSC::DFG::TierUpCheckInjectionPhase::run):
1498 * dfg/DFGTypeCheckHoistingPhase.cpp:
1499 (JSC::DFG::TypeCheckHoistingPhase::disableHoistingAcrossOSREntries):
1500 * dfg/DFGWorklist.cpp:
1501 (JSC::DFG::Worklist::isActiveForVM const):
1502 (JSC::DFG::Worklist::compilationState):
1503 (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
1504 (JSC::DFG::Worklist::removeAllReadyPlansForVM):
1505 (JSC::DFG::Worklist::completeAllReadyPlansForVM):
1506 (JSC::DFG::Worklist::visitWeakReferences):
1507 (JSC::DFG::Worklist::removeDeadPlans):
1508 (JSC::DFG::Worklist::removeNonCompilingPlansForVM):
1509 * dfg/DFGWorklistInlines.h:
1510 (JSC::DFG::Worklist::iterateCodeBlocksForGC):
1511 * ftl/FTLCompile.cpp:
1512 (JSC::FTL::compile):
1515 * ftl/FTLJITFinalizer.cpp:
1516 (JSC::FTL::JITFinalizer::finalizeCommon):
1519 * ftl/FTLLowerDFGToB3.cpp:
1520 (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
1521 (JSC::FTL::DFG::LowerDFGToB3::buildExitArguments):
1522 (JSC::FTL::DFG::LowerDFGToB3::addWeakReference):
1524 (JSC::FTL::State::State):
1526 2018-07-24 Saam Barati <sbarati@apple.com>
1528 Make VM::canUseJIT an inlined function
1529 https://bugs.webkit.org/show_bug.cgi?id=187583
1531 Reviewed by Mark Lam.
1533 We know the answer to this query in initializeThreading after initializing
1534 the executable allocator. This patch makes it so that we just hold this value
1535 in a static variable and have an inlined function that just returns the value
1536 of that static variable.
1538 * runtime/InitializeThreading.cpp:
1539 (JSC::initializeThreading):
1541 (JSC::VM::computeCanUseJIT):
1542 (JSC::VM::canUseJIT): Deleted.
1544 (JSC::VM::canUseJIT):
1546 2018-07-24 Mark Lam <mark.lam@apple.com>
1548 Placate exception check verification after recent changes.
1549 https://bugs.webkit.org/show_bug.cgi?id=187961
1550 <rdar://problem/42545394>
1552 Reviewed by Saam Barati.
1554 * runtime/IntlObject.cpp:
1555 (JSC::intlNumberOption):
1557 2018-07-23 Saam Barati <sbarati@apple.com>
1559 need to didFoldClobberWorld when we constant fold GetByVal
1560 https://bugs.webkit.org/show_bug.cgi?id=187917
1561 <rdar://problem/42505095>
1563 Reviewed by Yusuke Suzuki.
1565 * dfg/DFGAbstractInterpreterInlines.h:
1566 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1568 2018-07-23 Andy VanWagoner <andy@vanwagoner.family>
1570 [INTL] Language tags are not canonicalized
1571 https://bugs.webkit.org/show_bug.cgi?id=185836
1573 Reviewed by Keith Miller.
1575 Canonicalize language tags, replacing deprecated tag parts with the
1576 preferred values. Remove broken support for algorithmic numbering systems,
1577 that can cause an error in icu, and are not supported in other engines.
1579 Generate the lookup functions from the language-subtag-registry.
1581 Also initialize the UNumberFormat in initializeNumberFormat so any
1582 failures are thrown immediately instead of failing to format later.
1585 * DerivedSources.make:
1586 * JavaScriptCore.xcodeproj/project.pbxproj:
1587 * Scripts/generateIntlCanonicalizeLanguage.py: Added.
1588 * runtime/IntlDateTimeFormat.cpp:
1589 (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
1590 * runtime/IntlNumberFormat.cpp:
1591 (JSC::IntlNumberFormat::initializeNumberFormat):
1592 (JSC::IntlNumberFormat::formatNumber):
1593 (JSC::IntlNumberFormat::formatToParts):
1594 (JSC::IntlNumberFormat::createNumberFormat): Deleted.
1595 * runtime/IntlNumberFormat.h:
1596 * runtime/IntlObject.cpp:
1597 (JSC::intlNumberOption):
1598 (JSC::intlDefaultNumberOption):
1599 (JSC::preferredLanguage):
1600 (JSC::preferredRegion):
1601 (JSC::canonicalLangTag):
1602 (JSC::canonicalizeLanguageTag):
1603 (JSC::defaultLocale):
1604 (JSC::removeUnicodeLocaleExtension):
1605 (JSC::numberingSystemsForLocale):
1606 (JSC::grandfatheredLangTag): Deleted.
1607 * runtime/IntlObject.h:
1608 * runtime/IntlPluralRules.cpp:
1609 (JSC::IntlPluralRules::initializePluralRules):
1610 * runtime/JSGlobalObject.cpp:
1611 (JSC::addMissingScriptLocales):
1612 (JSC::JSGlobalObject::intlCollatorAvailableLocales):
1613 (JSC::JSGlobalObject::intlDateTimeFormatAvailableLocales):
1614 (JSC::JSGlobalObject::intlNumberFormatAvailableLocales):
1615 (JSC::JSGlobalObject::intlPluralRulesAvailableLocales):
1616 * ucd/language-subtag-registry.txt: Added.
1618 2018-07-23 Mark Lam <mark.lam@apple.com>
1620 Add some asserts to help diagnose a crash.
1621 https://bugs.webkit.org/show_bug.cgi?id=187915
1622 <rdar://problem/42508166>
1624 Reviewed by Michael Saboff.
1626 Add some asserts to verify that an CodeBlock alternative should always have a
1627 non-null jitCode. Also change a RELEASE_ASSERT_NOT_REACHED() in
1628 CodeBlock::setOptimizationThresholdBasedOnCompilationResult() to a RELEASE_ASSERT()
1629 so that we'll retain the state of the variables that failed the assertion (again
1630 to help with diagnosis).
1632 * bytecode/CodeBlock.cpp:
1633 (JSC::CodeBlock::setAlternative):
1634 (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
1636 (JSC::DFG::Plan::Plan):
1638 2018-07-23 Filip Pizlo <fpizlo@apple.com>
1640 Unreviewed, fix no-JIT build.
1642 * bytecode/CallLinkStatus.cpp:
1643 (JSC::CallLinkStatus::computeFor):
1644 * bytecode/CodeBlock.cpp:
1645 (JSC::CodeBlock::finalizeUnconditionally):
1646 * bytecode/GetByIdStatus.cpp:
1647 (JSC::GetByIdStatus::computeFor):
1648 (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
1649 * bytecode/InByIdStatus.cpp:
1650 * bytecode/PutByIdStatus.cpp:
1651 (JSC::PutByIdStatus::computeForStubInfo):
1653 2018-07-22 Yusuke Suzuki <utatane.tea@gmail.com>
1655 [JSC] GetByIdVariant and InByIdVariant do not need slot base if they are not "hit" variants
1656 https://bugs.webkit.org/show_bug.cgi?id=187891
1658 Reviewed by Saam Barati.
1660 When merging GetByIdVariant and InByIdVariant, we accidentally make merging failed if
1661 two variants are mergeable but they have "Miss" status. We make merging failed if
1662 the merged OPCSet says hasOneSlotBaseCondition() is false. But it is only reasonable
1663 if the variant has "Hit" status. This bug is revealed when we introduce CreateThis in FTL,
1664 which patch have more chances to merge variants.
1666 This patch fixes this issue by checking `!isPropertyUnset()` / `isHit()`. PutByIdVariant
1667 is not related since it does not use this check in Transition case.
1669 * bytecode/GetByIdVariant.cpp:
1670 (JSC::GetByIdVariant::attemptToMerge):
1671 * bytecode/InByIdVariant.cpp:
1672 (JSC::InByIdVariant::attemptToMerge):
1674 2018-07-22 Yusuke Suzuki <utatane.tea@gmail.com>
1676 [DFG] Fold GetByVal if the indexed value is non configurable and non writable
1677 https://bugs.webkit.org/show_bug.cgi?id=186462
1679 Reviewed by Saam Barati.
1681 Non-special DontDelete | ReadOnly properties mean that it won't be changed. If DFG AI can retrieve this
1682 property, AI can fold it into a constant. This type of property can be seen when we use ES6 tagged templates.
1683 Tagged templates' callsite includes indexed properties whose attributes are DontDelete | ReadOnly.
1685 This patch attempts to fold such properties into constant in DFG AI. The challenge is that DFG AI runs
1686 concurrently with the mutator thread. In this patch, we insert WTF::storeStoreFence between value setting
1687 and attributes setting. The attributes must be set after the corresponding value is set. If the loaded
1688 attributes (with WTF::loadLoadFence) include DontDelete | ReadOnly, it means the given value won't be
1689 changed and we can safely use it. We arrange our existing code to use this protocol.
1691 Since GetByVal folding requires the correct Structure & Butterfly pairs, it is only enabled in x86 architecture
1692 since it is TSO. So, our WTF::storeStoreFence in SparseArrayValueMap is also emitted only in x86.
1694 This patch improves SixSpeed/template_string_tag.es6.
1698 template_string_tag.es6 237.0301+-4.8374 ^ 9.8779+-0.3628 ^ definitely 23.9960x faster
1700 * dfg/DFGAbstractInterpreterInlines.h:
1701 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1702 * runtime/JSArray.cpp:
1703 (JSC::JSArray::setLengthWithArrayStorage):
1704 * runtime/JSObject.cpp:
1705 (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
1706 (JSC::JSObject::deletePropertyByIndex):
1707 (JSC::JSObject::getOwnPropertyNames):
1708 (JSC::putIndexedDescriptor):
1709 (JSC::JSObject::defineOwnIndexedProperty):
1710 (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
1711 (JSC::JSObject::putIndexedDescriptor): Deleted.
1712 * runtime/JSObject.h:
1713 * runtime/SparseArrayValueMap.cpp:
1714 (JSC::SparseArrayValueMap::SparseArrayValueMap):
1715 (JSC::SparseArrayValueMap::add):
1716 (JSC::SparseArrayValueMap::putDirect):
1717 (JSC::SparseArrayValueMap::getConcurrently):
1718 (JSC::SparseArrayEntry::get const):
1719 (JSC::SparseArrayEntry::getConcurrently const):
1720 (JSC::SparseArrayEntry::put):
1721 (JSC::SparseArrayEntry::getNonSparseMode const):
1722 (JSC::SparseArrayValueMap::visitChildren):
1723 (JSC::SparseArrayValueMap::~SparseArrayValueMap): Deleted.
1724 * runtime/SparseArrayValueMap.h:
1725 (JSC::SparseArrayEntry::SparseArrayEntry):
1726 (JSC::SparseArrayEntry::attributes const):
1727 (JSC::SparseArrayEntry::forceSet):
1728 (JSC::SparseArrayEntry::asValue):
1730 2018-06-02 Filip Pizlo <fpizlo@apple.com>
1732 We should support CreateThis in the FTL
1733 https://bugs.webkit.org/show_bug.cgi?id=164904
1735 Reviewed by Yusuke Suzuki.
1737 This started with Saam's patch to implement CreateThis in the FTL, but turned into a type
1738 inference adventure.
1740 CreateThis in the FTL was a massive regression in raytrace because it disturbed that
1741 benchmark's extremely perverse way of winning at type inference:
1743 - The benchmark wanted polyvariant devirtualization of an object construction helper. But,
1744 the polyvariant profiler wasn't powerful enough to reliably devirtualize that code. So, the
1745 benchmark was falling back to other mechanisms...
1747 - The construction helper could not tier up into the FTL. When the DFG compiled it, it would
1748 see that the IC had 4 cases. That's too polymorphic for the DFG. So, the DFG would emit a
1749 GetById. Shortly after the DFG compile, that get_by_id would see many more cases, but now
1750 that the helper was compiled by the DFG, the baseline get_by_id would not see those cases.
1751 The DFG's GetById would "hide" those cases. The number of cases the DFG's GetById would see
1752 is larger than our polymorphic list limit (limit = 8, case count = 13, I think).
1754 Note that if the FTL compiles that construction helper, it sees the 4 cases, turns them
1755 into a MultiGetByOffset, then suffers from exits when the new cases hit, and then exits to
1756 baseline, which then sees those cases. Luckily, the FTL was not compiling the construction
1757 helper because it had a CreateThis.
1759 - Compilations that inlined the construction helper would have gotten super lucky with
1760 parse-time constant folding, so they knew what structure the input to the get_by_id would
1761 have at parse time. This is only profitable if the get_by_id parsing computed a
1762 GetByIdStatus that had a finite number of cases. Because the 13 cases were being hidden by
1763 the DFG GetById and GetByIdStatus would only look at the baseline get_by_id, which had 4
1764 cases, we would indeed get a finite number of cases. The parser would then prune those
1765 cases to just one - based on its knowledge of the structure - and that would result in that
1766 get_by_id being folded at parse time to a constant.
1768 - The subsequent op_call would inline based on parse-time knowledge of that constant.
1770 This patch comprehensively fixes these issues, as well as other issues that come up along the
1771 way. The short version is that raytrace was revealing sloppiness in our use of profiling for
1772 type inference. This patch fixes the sloppiness by vastly expanding *polyvariant* profiling,
1773 i.e. the profiling that considers call context. I was encouraged to do this by the fact that
1774 even the old version of polyvariant profiling was a speed-up on JetStream, ARES-6, and
1775 Speedometer 2 (it's easy to measure since it's a runtime flag). So, it seemed worthwhile to
1776 attack raytrace's problem as a shortcoming of polyvariant profiling.
1778 - Polyvariant profiling now consults every DFG or FTL code block that participated in any
1779 subset of the inline stack that includes the IC we're profiling. For example, if we have
1780 an inline stack like foo->bar->baz, with baz on top, then we will consult DFG or FTL
1781 compilations for foo, bar, and baz. In foo, we'll look up foo->bar->baz; in bar we'll look
1782 up bar->baz; etc. This fixes two problems encountered in raytrace. First, it ensures that
1783 a DFG GetById cannot hide anything from the profiling of that get_by_id, since the
1784 polyvariant profiling code will always consult it. Second, it enables raytrace to benefit
1785 from polyvariant profling. Previously, the polyvariant profiler would only look at the
1786 previous DFG compilation of foo and look up foo->bar->baz. But that only works if DFG-foo
1787 had inlined bar and then baz. It may not have done that, because those calls could have
1788 required polyvariant profiling that was only available in the FTL.
1790 - A particularly interesting case is when some IC in foo-baseline is also available in
1791 foo-DFG. This case is encountered by the polyvariant profiler as it walks the inline stack.
1792 In the case of gathering profiling for foo-FTL, the polyvariant profiler finds foo-DFG via
1793 the trivial case of no inline stack. This also means that if foo ever gets inlined, we will
1794 find foo-DFG or foo-FTL in the final case of polyvariant profiling. In those cases, we now
1795 merge the IC of foo-baseline and foo-DFG. This avoids lots of unnecessary recompilations,
1796 because it warns us of historical polymorphism. Historical polymorphism usually means
1797 future polymorphism. IC status code already had some merging functionality, but I needed to
1798 beef it up a lot to make this work right.
1800 - Inlining an inline cache now preserves as much information as profiling. One challenge of
1801 polyvariant profiling is that the FTL compile for bar (that includes bar->baz) could have
1802 inlined an inline cache based on polyvariant profiling. So, when the FTL compile for foo
1803 (that includes foo->bar->baz) asks bar what it knows about that IC inside bar->baz, it will
1804 say "I don't have such an IC". At this point the DFG compilation that included that IC that
1805 gave us the information that we used to inline the IC is no longer alive. To keep us from
1806 losing the information we learned about the IC, there is now a RecordedStatuses data
1807 structure that preserves the statuses we use for inlining ICs. We also filter those
1808 statuses according to things we learn from AI. This further reduces the risk of information
1809 about an IC being forgotten.
1811 - Exit profiling now considers whether or not an exit happened from inline code. This
1812 protects us in the case where the not-inlined version of an IC exited a lot because of
1813 polymorphism that doesn't exist in the inlined version. So, when using polyvariant
1814 profiling data, we consider only inlined exits.
1816 - CallLinkInfo now records when it's repatched to the virtual call thunk. Previously, this
1817 would clear the CallLinkInfo, so CallLinkStatus would fall back to the lastSeenCallee. It's
1818 surprising that we've had this bug.
1820 Altogether this patch is performance-neutral in run-jsc-benchmarks, except for speed-ups in
1821 microbenchmarks and a compile time regression. Octane/deltablue speeds up by ~5%.
1822 Octane/raytrace is regressed by a minuscule amount, which we could make up by implementing
1823 prototype access folding in the bytecode parser and constant folder. That would require some
1824 significant new logic in GetByIdStatus. That would also require a new benchmark - we want to
1825 have a test that captures raytrace's behavior in the case that the parser cannot fold the
1828 This change is a 1.2% regression on V8Spider-CompileTime. That's a smaller regression than
1829 recent compile time progressions, so I think that's an OK trade-off. Also, I would expect a
1830 compile time regression anytime we fill in FTL coverage.
1832 This is neutral on JetStream, ARES-6, and Speedometer2. JetStream agrees that deltablue
1833 speeds up and that raytrace slows down, but these changes balance out and don't affect the
1834 overall score. In ARES-6, it looks like individual tests have some significant 1-2% speed-ups
1835 or slow-downs. Air-steady is definitely ~1.5% faster. Basic-worst is probably 2% slower (p ~
1836 0.1, so it's not very certain). The JetStream, ARES-6, and Speedometer2 overall scores don't
1837 see a significant difference. In all three cases the difference is <0.5% with a high p value,
1838 with JetStream and Speedometer2 being insignificant infinitesimal speed-ups and ARES-6 being
1839 an insignificant infinitesimal slow-down.
1841 Oh, and this change means that the FTL now has 100% coverage of JavaScript. You could do an
1842 eval in a for-in loop in a for-of loop inside a with block that uses try/catch for control
1843 flow in a polymorphic constructor while having a bad time, and we'll still compile it.
1846 * JavaScriptCore.xcodeproj/project.pbxproj:
1848 * bytecode/ByValInfo.h:
1849 * bytecode/BytecodeDumper.cpp:
1850 (JSC::BytecodeDumper<Block>::printGetByIdCacheStatus):
1851 (JSC::BytecodeDumper<Block>::printPutByIdCacheStatus):
1852 (JSC::BytecodeDumper<Block>::printInByIdCacheStatus):
1853 (JSC::BytecodeDumper<Block>::dumpCallLinkStatus):
1854 (JSC::BytecodeDumper<CodeBlock>::dumpCallLinkStatus):
1855 (JSC::BytecodeDumper<Block>::printCallOp):
1856 (JSC::BytecodeDumper<Block>::dumpBytecode):
1857 (JSC::BytecodeDumper<Block>::dumpBlock):
1858 * bytecode/BytecodeDumper.h:
1859 * bytecode/CallLinkInfo.h:
1860 * bytecode/CallLinkStatus.cpp:
1861 (JSC::CallLinkStatus::computeFor):
1862 (JSC::CallLinkStatus::computeExitSiteData):
1863 (JSC::CallLinkStatus::computeFromCallLinkInfo):
1864 (JSC::CallLinkStatus::accountForExits):
1865 (JSC::CallLinkStatus::finalize):
1866 (JSC::CallLinkStatus::filter):
1867 (JSC::CallLinkStatus::computeDFGStatuses): Deleted.
1868 * bytecode/CallLinkStatus.h:
1869 (JSC::CallLinkStatus::operator bool const):
1870 (JSC::CallLinkStatus::operator! const): Deleted.
1871 * bytecode/CallVariant.cpp:
1872 (JSC::CallVariant::finalize):
1873 (JSC::CallVariant::filter):
1874 * bytecode/CallVariant.h:
1875 (JSC::CallVariant::operator bool const):
1876 (JSC::CallVariant::operator! const): Deleted.
1877 * bytecode/CodeBlock.cpp:
1878 (JSC::CodeBlock::dumpBytecode):
1879 (JSC::CodeBlock::propagateTransitions):
1880 (JSC::CodeBlock::finalizeUnconditionally):
1881 (JSC::CodeBlock::getICStatusMap):
1882 (JSC::CodeBlock::resetJITData):
1883 (JSC::CodeBlock::getStubInfoMap): Deleted.
1884 (JSC::CodeBlock::getCallLinkInfoMap): Deleted.
1885 (JSC::CodeBlock::getByValInfoMap): Deleted.
1886 * bytecode/CodeBlock.h:
1887 * bytecode/CodeOrigin.cpp:
1888 (JSC::CodeOrigin::isApproximatelyEqualTo const):
1889 (JSC::CodeOrigin::approximateHash const):
1890 * bytecode/CodeOrigin.h:
1891 (JSC::CodeOrigin::exitingInlineKind const):
1892 * bytecode/DFGExitProfile.cpp:
1893 (JSC::DFG::FrequentExitSite::dump const):
1894 (JSC::DFG::ExitProfile::add):
1895 * bytecode/DFGExitProfile.h:
1896 (JSC::DFG::FrequentExitSite::FrequentExitSite):
1897 (JSC::DFG::FrequentExitSite::operator== const):
1898 (JSC::DFG::FrequentExitSite::subsumes const):
1899 (JSC::DFG::FrequentExitSite::hash const):
1900 (JSC::DFG::FrequentExitSite::inlineKind const):
1901 (JSC::DFG::FrequentExitSite::withInlineKind const):
1902 (JSC::DFG::QueryableExitProfile::hasExitSite const):
1903 (JSC::DFG::QueryableExitProfile::hasExitSiteWithSpecificJITType const):
1904 (JSC::DFG::QueryableExitProfile::hasExitSiteWithSpecificInlineKind const):
1905 * bytecode/ExitFlag.cpp: Added.
1906 (JSC::ExitFlag::dump const):
1907 * bytecode/ExitFlag.h: Added.
1908 (JSC::ExitFlag::ExitFlag):
1909 (JSC::ExitFlag::operator| const):
1910 (JSC::ExitFlag::operator|=):
1911 (JSC::ExitFlag::operator& const):
1912 (JSC::ExitFlag::operator&=):
1913 (JSC::ExitFlag::operator bool const):
1914 (JSC::ExitFlag::isSet const):
1915 * bytecode/ExitingInlineKind.cpp: Added.
1916 (WTF::printInternal):
1917 * bytecode/ExitingInlineKind.h: Added.
1918 * bytecode/GetByIdStatus.cpp:
1919 (JSC::GetByIdStatus::computeFor):
1920 (JSC::GetByIdStatus::computeForStubInfo):
1921 (JSC::GetByIdStatus::slowVersion const):
1922 (JSC::GetByIdStatus::markIfCheap):
1923 (JSC::GetByIdStatus::finalize):
1924 (JSC::GetByIdStatus::hasExitSite): Deleted.
1925 * bytecode/GetByIdStatus.h:
1926 * bytecode/GetByIdVariant.cpp:
1927 (JSC::GetByIdVariant::markIfCheap):
1928 (JSC::GetByIdVariant::finalize):
1929 * bytecode/GetByIdVariant.h:
1930 * bytecode/ICStatusMap.cpp: Added.
1931 (JSC::ICStatusContext::get const):
1932 (JSC::ICStatusContext::isInlined const):
1933 (JSC::ICStatusContext::inlineKind const):
1934 * bytecode/ICStatusMap.h: Added.
1935 * bytecode/ICStatusUtils.cpp: Added.
1936 (JSC::hasBadCacheExitSite):
1937 * bytecode/ICStatusUtils.h:
1938 * bytecode/InstanceOfStatus.cpp:
1939 (JSC::InstanceOfStatus::computeFor):
1940 * bytecode/InstanceOfStatus.h:
1941 * bytecode/PolyProtoAccessChain.h:
1942 * bytecode/PutByIdStatus.cpp:
1943 (JSC::PutByIdStatus::hasExitSite):
1944 (JSC::PutByIdStatus::computeFor):
1945 (JSC::PutByIdStatus::slowVersion const):
1946 (JSC::PutByIdStatus::markIfCheap):
1947 (JSC::PutByIdStatus::finalize):
1948 (JSC::PutByIdStatus::filter):
1949 * bytecode/PutByIdStatus.h:
1950 * bytecode/PutByIdVariant.cpp:
1951 (JSC::PutByIdVariant::markIfCheap):
1952 (JSC::PutByIdVariant::finalize):
1953 * bytecode/PutByIdVariant.h:
1954 (JSC::PutByIdVariant::structureSet const):
1955 * bytecode/RecordedStatuses.cpp: Added.
1956 (JSC::RecordedStatuses::operator=):
1957 (JSC::RecordedStatuses::RecordedStatuses):
1958 (JSC::RecordedStatuses::addCallLinkStatus):
1959 (JSC::RecordedStatuses::addGetByIdStatus):
1960 (JSC::RecordedStatuses::addPutByIdStatus):
1961 (JSC::RecordedStatuses::markIfCheap):
1962 (JSC::RecordedStatuses::finalizeWithoutDeleting):
1963 (JSC::RecordedStatuses::finalize):
1964 (JSC::RecordedStatuses::shrinkToFit):
1965 * bytecode/RecordedStatuses.h: Added.
1966 (JSC::RecordedStatuses::RecordedStatuses):
1967 (JSC::RecordedStatuses::forEachVector):
1968 * bytecode/StructureSet.cpp:
1969 (JSC::StructureSet::markIfCheap const):
1970 (JSC::StructureSet::isStillAlive const):
1971 * bytecode/StructureSet.h:
1972 * bytecode/TerminatedCodeOrigin.h: Added.
1973 (JSC::TerminatedCodeOrigin::TerminatedCodeOrigin):
1974 (JSC::TerminatedCodeOriginHashTranslator::hash):
1975 (JSC::TerminatedCodeOriginHashTranslator::equal):
1976 * bytecode/Watchpoint.cpp:
1977 (WTF::printInternal):
1978 * bytecode/Watchpoint.h:
1979 * dfg/DFGAbstractInterpreter.h:
1980 * dfg/DFGAbstractInterpreterInlines.h:
1981 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1982 (JSC::DFG::AbstractInterpreter<AbstractStateType>::filterICStatus):
1983 * dfg/DFGByteCodeParser.cpp:
1984 (JSC::DFG::ByteCodeParser::handleCall):
1985 (JSC::DFG::ByteCodeParser::handleVarargsCall):
1986 (JSC::DFG::ByteCodeParser::handleDOMJITGetter):
1987 (JSC::DFG::ByteCodeParser::handleModuleNamespaceLoad):
1988 (JSC::DFG::ByteCodeParser::handleGetById):
1989 (JSC::DFG::ByteCodeParser::handlePutById):
1990 (JSC::DFG::ByteCodeParser::parseBlock):
1991 (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
1992 (JSC::DFG::ByteCodeParser::InlineStackEntry::~InlineStackEntry):
1993 (JSC::DFG::ByteCodeParser::parse):
1994 * dfg/DFGClobberize.h:
1995 (JSC::DFG::clobberize):
1996 * dfg/DFGClobbersExitState.cpp:
1997 (JSC::DFG::clobbersExitState):
1998 * dfg/DFGCommonData.h:
1999 * dfg/DFGConstantFoldingPhase.cpp:
2000 (JSC::DFG::ConstantFoldingPhase::foldConstants):
2001 * dfg/DFGDesiredWatchpoints.h:
2002 (JSC::DFG::SetPointerAdaptor::hasBeenInvalidated):
2003 * dfg/DFGDoesGC.cpp:
2005 * dfg/DFGFixupPhase.cpp:
2006 (JSC::DFG::FixupPhase::fixupNode):
2008 (JSC::DFG::Graph::dump):
2009 * dfg/DFGMayExit.cpp:
2011 (JSC::DFG::Node::hasCallLinkStatus):
2012 (JSC::DFG::Node::callLinkStatus):
2013 (JSC::DFG::Node::hasGetByIdStatus):
2014 (JSC::DFG::Node::getByIdStatus):
2015 (JSC::DFG::Node::hasPutByIdStatus):
2016 (JSC::DFG::Node::putByIdStatus):
2017 * dfg/DFGNodeType.h:
2018 * dfg/DFGOSRExitBase.cpp:
2019 (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):
2020 * dfg/DFGObjectAllocationSinkingPhase.cpp:
2022 (JSC::DFG::Plan::reallyAdd):
2023 (JSC::DFG::Plan::checkLivenessAndVisitChildren):
2024 (JSC::DFG::Plan::finalizeInGC):
2026 * dfg/DFGPredictionPropagationPhase.cpp:
2027 * dfg/DFGSafeToExecute.h:
2028 (JSC::DFG::safeToExecute):
2029 * dfg/DFGSpeculativeJIT32_64.cpp:
2030 (JSC::DFG::SpeculativeJIT::compile):
2031 * dfg/DFGSpeculativeJIT64.cpp:
2032 (JSC::DFG::SpeculativeJIT::compile):
2033 * dfg/DFGStrengthReductionPhase.cpp:
2034 (JSC::DFG::StrengthReductionPhase::handleNode):
2035 * dfg/DFGWorklist.cpp:
2036 (JSC::DFG::Worklist::removeDeadPlans):
2037 * ftl/FTLAbstractHeapRepository.h:
2038 * ftl/FTLCapabilities.cpp:
2039 (JSC::FTL::canCompile):
2040 * ftl/FTLLowerDFGToB3.cpp:
2041 (JSC::FTL::DFG::LowerDFGToB3::compileNode):
2042 (JSC::FTL::DFG::LowerDFGToB3::compileCreateThis):
2043 (JSC::FTL::DFG::LowerDFGToB3::compileFilterICStatus):
2044 * jit/PolymorphicCallStubRoutine.cpp:
2045 (JSC::PolymorphicCallStubRoutine::hasEdges const):
2046 (JSC::PolymorphicCallStubRoutine::edges const):
2047 * jit/PolymorphicCallStubRoutine.h:
2048 * profiler/ProfilerBytecodeSequence.cpp:
2049 (JSC::Profiler::BytecodeSequence::BytecodeSequence):
2050 * runtime/FunctionRareData.cpp:
2051 (JSC::FunctionRareData::initializeObjectAllocationProfile):
2052 * runtime/Options.h:
2054 2018-07-21 Yusuke Suzuki <utatane.tea@gmail.com>
2056 [JSC] Use Function / ScopedLambda / RecursableLambda instead of std::function
2057 https://bugs.webkit.org/show_bug.cgi?id=187472
2059 Reviewed by Mark Lam.
2061 std::function allocates memory from standard malloc instead of bmalloc. Instead of
2062 using that, we should use WTF::{Function,ScopedLambda,RecursableLambda}.
2064 This patch attempts to replace std::function with the above WTF function types.
2065 If the function's lifetime can be the same to the stack, we can use ScopedLambda, which
2066 is really efficient. Otherwise, we should use WTF::Function.
2067 For recurring use cases, we can use RecursableLambda.
2069 * assembler/MacroAssembler.cpp:
2070 (JSC::stdFunctionCallback):
2071 (JSC::MacroAssembler::probe):
2072 * assembler/MacroAssembler.h:
2073 * b3/air/AirDisassembler.cpp:
2074 (JSC::B3::Air::Disassembler::dump):
2075 * b3/air/AirDisassembler.h:
2076 * bytecompiler/BytecodeGenerator.cpp:
2077 (JSC::BytecodeGenerator::BytecodeGenerator):
2078 (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
2079 (JSC::BytecodeGenerator::emitEnumeration):
2080 * bytecompiler/BytecodeGenerator.h:
2081 * bytecompiler/NodesCodegen.cpp:
2082 (JSC::ArrayNode::emitBytecode):
2083 (JSC::ApplyFunctionCallDotNode::emitBytecode):
2084 (JSC::ForOfNode::emitBytecode):
2085 * dfg/DFGSpeculativeJIT.cpp:
2086 (JSC::DFG::SpeculativeJIT::addSlowPathGeneratorLambda):
2087 (JSC::DFG::SpeculativeJIT::compileMathIC):
2088 * dfg/DFGSpeculativeJIT.h:
2089 * dfg/DFGSpeculativeJIT64.cpp:
2090 (JSC::DFG::SpeculativeJIT::compile):
2091 * dfg/DFGValidate.cpp:
2092 * ftl/FTLCompile.cpp:
2093 (JSC::FTL::compile):
2094 * heap/HeapSnapshotBuilder.cpp:
2095 (JSC::HeapSnapshotBuilder::json):
2096 * heap/HeapSnapshotBuilder.h:
2097 * interpreter/StackVisitor.cpp:
2098 (JSC::StackVisitor::Frame::dump const):
2099 * interpreter/StackVisitor.h:
2100 * runtime/PromiseDeferredTimer.h:
2102 (JSC::VM::whenIdle):
2103 (JSC::enableProfilerWithRespectToCount):
2104 (JSC::disableProfilerWithRespectToCount):
2106 * runtime/VMEntryScope.cpp:
2107 (JSC::VMEntryScope::addDidPopListener):
2108 * runtime/VMEntryScope.h:
2109 * tools/HeapVerifier.cpp:
2110 (JSC::HeapVerifier::verifyCellList):
2111 (JSC::HeapVerifier::validateCell):
2112 (JSC::HeapVerifier::validateJSCell):
2113 * tools/HeapVerifier.h:
2115 2018-07-20 Michael Saboff <msaboff@apple.com>
2117 DFG AbstractInterpreter: CheckArray filters array modes for DirectArguments/ScopedArguments using only NonArray
2118 https://bugs.webkit.org/show_bug.cgi?id=187827
2119 rdar://problem/42146858
2121 Reviewed by Saam Barati.
2123 When filtering array modes for DirectArguments or ScopedArguments, we need to allow for the possibility
2124 that they can either be NonArray or NonArrayWithArrayStorage (aka ArrayStorageShape).
2125 We can't end up with other shapes, Int32, Double, etc because GenericArguments sets
2126 InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero which will cause us to go down a
2127 putByIndex() path that doesn't change the shape.
2129 * dfg/DFGArrayMode.h:
2130 (JSC::DFG::ArrayMode::arrayModesThatPassFiltering const):
2132 2018-07-20 Yusuke Suzuki <utatane.tea@gmail.com>
2134 [DFG] Fold GetByVal if Array is CoW
2135 https://bugs.webkit.org/show_bug.cgi?id=186459
2137 Reviewed by Saam Barati.
2139 CoW indexing type means that we now tracks the changes in CoW Array by structure. So DFG has a chance to
2140 fold GetByVal if the given array is CoW. This patch folds GetByVal onto the CoW Array. If the structure
2141 is watched and the butterfly is JSImmutableButterfly, we can load the value from this butterfly.
2143 This can be useful since these CoW arrays are used for a storage for constants. Constant-indexed access
2144 to these constant arrays can be folded into an actual constant by this patch.
2148 template_string.es6 4993.9853+-147.5308 ^ 824.1685+-44.1839 ^ definitely 6.0594x faster
2149 template_string_tag.es5 67.0822+-2.0100 ^ 9.3540+-0.5376 ^ definitely 7.1715x faster
2151 * dfg/DFGAbstractInterpreterInlines.h:
2152 (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2154 2018-07-20 Yusuke Suzuki <utatane.tea@gmail.com>
2156 [JSC] Remove cellLock in JSObject::convertContiguousToArrayStorage
2157 https://bugs.webkit.org/show_bug.cgi?id=186602
2159 Reviewed by Saam Barati.
2161 JSObject::convertContiguousToArrayStorage's cellLock() is not necessary since we do not
2162 change the part of the butterfly, length etc. We prove that our procedure is safe, and
2163 drop the cellLock() here.
2165 * runtime/JSObject.cpp:
2166 (JSC::JSObject::convertContiguousToArrayStorage):
2168 2018-07-20 Saam Barati <sbarati@apple.com>
2170 CompareEq should be using KnownOtherUse instead of OtherUse
2171 https://bugs.webkit.org/show_bug.cgi?id=186814
2172 <rdar://problem/39720030>
2174 Reviewed by Filip Pizlo.
2176 CompareEq in fixup phase was doing this:
2177 insertCheck(child, OtherUse)
2178 setUseKind(child, OtherUse)
2179 And in the DFG/FTL backend, it would not emit a check for OtherUse. This could
2180 lead to edge verification crashing because a phase may optimize the check out
2181 by removing the node. However, AI may not be privy to that optimization, and
2182 AI may think the incoming value may not be Other. AI is expecting the DFG/FTL
2183 backend to actually emit a check here, but it does not.
2185 This exact pattern is why we have KnownXYZ use kinds. This patch introduces
2186 KnownOtherUse and changes the above pattern to be:
2187 insertCheck(child, OtherUse)
2188 setUseKind(child, KnownOtherUse)
2190 * dfg/DFGFixupPhase.cpp:
2191 (JSC::DFG::FixupPhase::fixupNode):
2192 * dfg/DFGSafeToExecute.h:
2193 (JSC::DFG::SafeToExecuteEdge::operator()):
2194 * dfg/DFGSpeculativeJIT.cpp:
2195 (JSC::DFG::SpeculativeJIT::speculate):
2196 * dfg/DFGUseKind.cpp:
2197 (WTF::printInternal):
2199 (JSC::DFG::typeFilterFor):
2200 (JSC::DFG::shouldNotHaveTypeCheck):
2201 (JSC::DFG::checkMayCrashIfInputIsEmpty):
2202 * dfg/DFGWatchpointCollectionPhase.cpp:
2203 (JSC::DFG::WatchpointCollectionPhase::handle):
2204 * ftl/FTLCapabilities.cpp:
2205 (JSC::FTL::canCompile):
2206 * ftl/FTLLowerDFGToB3.cpp:
2207 (JSC::FTL::DFG::LowerDFGToB3::compileCompareEq):
2208 (JSC::FTL::DFG::LowerDFGToB3::speculate):
2210 2018-07-20 Yusuke Suzuki <utatane.tea@gmail.com>
2212 [JSC] A bit performance improvement for Object.assign by cleaning up code
2213 https://bugs.webkit.org/show_bug.cgi?id=187852
2215 Reviewed by Saam Barati.
2217 We clean up Object.assign code a bit.
2219 1. Vector and MarkedArgumentBuffer are extracted out from the loop since repeatedly creating MarkedArgumentBuffer is costly.
2220 2. canDoFastPath is not necessary. Restructuring the code to clean up things.
2222 It improves the performance a bit.
2226 object-assign.es6 237.7719+-5.5175 231.2856+-4.6907 might be 1.0280x faster
2228 * runtime/ObjectConstructor.cpp:
2229 (JSC::objectConstructorAssign):
2231 2018-07-19 Carlos Garcia Campos <cgarcia@igalia.com>
2233 [GLIB] jsc_context_evaluate_in_object() should receive an instance when a JSCClass is given
2234 https://bugs.webkit.org/show_bug.cgi?id=187798
2236 Reviewed by Michael Catanzaro.
2238 Because a JSCClass is pretty much useless without an instance in this case. It should be similar to
2239 jsc_value_new_object() because indeed we are creating a new object. This makes destroy function and vtable
2240 functions to work. We can't use JSAPIWrapperObject to wrap this object, because it's a global object, so this
2241 patch adds JSAPIWrapperGlobalObject or that.
2243 * API/glib/JSAPIWrapperGlobalObject.cpp: Added.
2244 (jsAPIWrapperGlobalObjectHandleOwner):
2245 (JSAPIWrapperGlobalObjectHandleOwner::finalize):
2246 (JSC::JSCallbackObject<JSAPIWrapperGlobalObject>::createStructure):
2247 (JSC::JSCallbackObject<JSAPIWrapperGlobalObject>::create):
2248 (JSC::JSAPIWrapperGlobalObject::JSAPIWrapperGlobalObject):
2249 (JSC::JSAPIWrapperGlobalObject::finishCreation):
2250 (JSC::JSAPIWrapperGlobalObject::visitChildren):
2251 * API/glib/JSAPIWrapperGlobalObject.h: Added.
2252 (JSC::JSAPIWrapperGlobalObject::wrappedObject const):
2253 (JSC::JSAPIWrapperGlobalObject::setWrappedObject):
2254 * API/glib/JSCClass.cpp:
2255 (isWrappedObject): Helper to check if the given object is a JSAPIWrapperObject or JSAPIWrapperGlobalObject.
2256 (wrappedObjectClass): Return the class of a wrapped object.
2257 (jscContextForObject): Get the execution context of an object. If the object is a JSAPIWrapperGlobalObject, the
2258 scope extension global object is used instead.
2259 (getProperty): Use isWrappedObject, wrappedObjectClass and jscContextForObject.
2260 (setProperty): Ditto.
2261 (hasProperty): Ditto.
2262 (deleteProperty): Ditto.
2263 (getPropertyNames): Ditto.
2264 (jscClassCreateContextWithJSWrapper): Call jscContextCreateContextWithJSWrapper().
2265 * API/glib/JSCClassPrivate.h:
2266 * API/glib/JSCContext.cpp:
2267 (jscContextCreateContextWithJSWrapper): Call WrapperMap::createContextWithJSWrappper().
2268 (jsc_context_evaluate_in_object): Use jscClassCreateContextWithJSWrapper() when a JSCClass is given.
2269 * API/glib/JSCContext.h:
2270 * API/glib/JSCContextPrivate.h:
2271 * API/glib/JSCWrapperMap.cpp:
2272 (JSC::WrapperMap::createContextWithJSWrappper): Create the new context for jsc_context_evaluate_in_object() here
2273 when a JSCClass is used to create the JSAPIWrapperGlobalObject.
2274 (JSC::WrapperMap::wrappedObject const): Return the wrapped object also in case of JSAPIWrapperGlobalObject.
2275 * API/glib/JSCWrapperMap.h:
2278 2018-07-19 Saam Barati <sbarati@apple.com>
2280 Conservatively make Object.assign's fast path do a two phase protocol of loading everything then storing everything to try to prevent a crash
2281 https://bugs.webkit.org/show_bug.cgi?id=187836
2282 <rdar://problem/42409527>
2284 Reviewed by Mark Lam.
2286 We have crash reports that we're crashing on source->getDirect in Object.assign's
2287 fast path. Mark investigated this and determined we end up with a nullptr for
2288 butterfly. This is curious, because source's Structure indicated that it has
2289 out of line properties. My leading hypothesis for this at the moment is a bit
2290 handwavy, but it's essentially:
2291 - We end up firing a watchpoint when assigning to the target (this can happen
2292 if a watchpoint was set up for storing to that particular field)
2293 - When we fire that watchpoint, we end up doing some kind work on the source,
2294 perhaps causing it to flattenDictionaryStructure. Therefore, we end up
2297 I'm not super convinced this is what we're running into, but just by reading
2298 the code, I think it needs to be something similar to this. Seeing if this change
2299 fixes the crasher will give us good data to determine if something like this is
2300 happening or if the bug is something else entirely.
2302 * runtime/ObjectConstructor.cpp:
2303 (JSC::objectConstructorAssign):
2305 2018-07-19 Commit Queue <commit-queue@webkit.org>
2307 Unreviewed, rolling out r233998.
2308 https://bugs.webkit.org/show_bug.cgi?id=187815
2310 Not needed. (Requested by mlam|a on #webkit).
2314 "Temporarily mitigate a bug where a source provider is null
2315 when it shouldn't be."
2316 https://bugs.webkit.org/show_bug.cgi?id=187812
2317 https://trac.webkit.org/changeset/233998
2319 2018-07-19 Mark Lam <mark.lam@apple.com>
2321 Temporarily mitigate a bug where a source provider is null when it shouldn't be.
2322 https://bugs.webkit.org/show_bug.cgi?id=187812
2323 <rdar://problem/41192691>
2325 Reviewed by Michael Saboff.
2327 Adding a null check to temporarily mitigate https://bugs.webkit.org/show_bug.cgi?id=187811.
2329 * runtime/Error.cpp:
2330 (JSC::addErrorInfo):
2332 2018-07-19 Keith Rollin <krollin@apple.com>
2334 Adjust WEBCORE_EXPORT annotations for LTO
2335 https://bugs.webkit.org/show_bug.cgi?id=187781
2336 <rdar://problem/42351124>
2338 Reviewed by Alex Christensen.
2340 Continuation of Bug 186944. This bug addresses issues not caught
2341 during the first pass of adjustments. The initial work focussed on
2342 macOS; this one addresses issues found when building for iOS. From
2345 Adjust a number of places that result in WebKit's
2346 'check-for-weak-vtables-and-externals' script reporting weak external
2349 ERROR: WebCore has a weak external symbol in it (/Volumes/Data/dev/webkit/OpenSource/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore)
2350 ERROR: A weak external symbol is generated when a symbol is defined in multiple compilation units and is also marked as being exported from the library.
2351 ERROR: A common cause of weak external symbols is when an inline function is listed in the linker export file.
2354 These cases are caused by inline methods being marked with WTF_EXPORT
2355 (or related macro) or with an inline function being in a class marked
2356 as such, and when enabling LTO builds.
2358 For the most part, address these by removing the WEBCORE_EXPORT
2359 annotation from inline methods. In some cases, move the implementation
2360 out-of-line because it's the class that has the WEBCORE_EXPORT on it
2361 and removing the annotation from the class would be too disruptive.
2362 Finally, in other cases, move the implementation out-of-line because
2363 check-for-weak-vtables-and-externals still complains when keeping the
2364 implementation inline and removing the annotation; this seems to
2365 typically (but not always) happen with destructors.
2367 * inspector/remote/RemoteAutomationTarget.cpp:
2368 (Inspector::RemoteAutomationTarget::~RemoteAutomationTarget):
2369 * inspector/remote/RemoteAutomationTarget.h:
2370 * inspector/remote/RemoteInspector.cpp:
2371 (Inspector::RemoteInspector::Client::~Client):
2372 * inspector/remote/RemoteInspector.h:
2374 2018-07-19 Yusuke Suzuki <utatane.tea@gmail.com>
2376 Unreviewed, check scope after performing getPropertySlot in JSON.stringify
2377 https://bugs.webkit.org/show_bug.cgi?id=187807
2379 Properly putting EXCEPTION_ASSERT to tell our exception checker mechanism
2380 that we know that exception occurrence and handle it well.
2382 * runtime/JSONObject.cpp:
2383 (JSC::Stringifier::Holder::appendNextProperty):
2385 2018-07-18 Yusuke Suzuki <utatane.tea@gmail.com>
2387 [JSC] Reduce size of AST nodes
2388 https://bugs.webkit.org/show_bug.cgi?id=187689
2390 Reviewed by Mark Lam.
2392 We clean up AST nodes to reduce size. By doing so, we can reduce the memory consumption
2393 of ParserArena at peak state.
2395 1. Annotate `final` to AST nodes to make them solid. And it allows the compiler to
2396 devirtualize a call to the function which are implemented in a final class.
2398 2. Use default member initializers more.
2400 3. And use `nullptr` instead of `0`.
2402 4. Arrange the layout of AST nodes to reduce the size. It includes changing the order
2403 of classes in multiple inheritance. In particular, StatementNode is decreased from 48
2404 to 40. This decreases the sizes of all the derived Statement nodes.
2406 * parser/NodeConstructors.h:
2408 (JSC::StatementNode::StatementNode):
2409 (JSC::ElementNode::ElementNode):
2410 (JSC::ArrayNode::ArrayNode):
2411 (JSC::PropertyListNode::PropertyListNode):
2412 (JSC::ObjectLiteralNode::ObjectLiteralNode):
2413 (JSC::ArgumentListNode::ArgumentListNode):
2414 (JSC::ArgumentsNode::ArgumentsNode):
2415 (JSC::NewExprNode::NewExprNode):
2416 (JSC::BytecodeIntrinsicNode::BytecodeIntrinsicNode):
2417 (JSC::BinaryOpNode::BinaryOpNode):
2418 (JSC::LogicalOpNode::LogicalOpNode):
2419 (JSC::CommaNode::CommaNode):
2420 (JSC::SourceElements::SourceElements):
2421 (JSC::ClauseListNode::ClauseListNode):
2423 (JSC::FunctionMetadataNode::FunctionMetadataNode):
2424 (JSC::FunctionMetadataNode::operator== const):
2425 (JSC::FunctionMetadataNode::dump const):
2427 (JSC::BooleanNode::value): Deleted.
2428 (JSC::StringNode::value): Deleted.
2429 (JSC::TemplateExpressionListNode::value): Deleted.
2430 (JSC::TemplateExpressionListNode::next): Deleted.
2431 (JSC::TemplateStringNode::cooked): Deleted.
2432 (JSC::TemplateStringNode::raw): Deleted.
2433 (JSC::TemplateStringListNode::value): Deleted.
2434 (JSC::TemplateStringListNode::next): Deleted.
2435 (JSC::TemplateLiteralNode::templateStrings const): Deleted.
2436 (JSC::TemplateLiteralNode::templateExpressions const): Deleted.
2437 (JSC::TaggedTemplateNode::templateLiteral const): Deleted.
2438 (JSC::ResolveNode::identifier const): Deleted.
2439 (JSC::ElementNode::elision const): Deleted.
2440 (JSC::ElementNode::value): Deleted.
2441 (JSC::ElementNode::next): Deleted.
2442 (JSC::ArrayNode::elements const): Deleted.
2443 (JSC::PropertyNode::expressionName const): Deleted.
2444 (JSC::PropertyNode::name const): Deleted.
2445 (JSC::PropertyNode::type const): Deleted.
2446 (JSC::PropertyNode::needsSuperBinding const): Deleted.
2447 (JSC::PropertyNode::isClassProperty const): Deleted.
2448 (JSC::PropertyNode::isStaticClassProperty const): Deleted.
2449 (JSC::PropertyNode::isInstanceClassProperty const): Deleted.
2450 (JSC::PropertyNode::isOverriddenByDuplicate const): Deleted.
2451 (JSC::PropertyNode::setIsOverriddenByDuplicate): Deleted.
2452 (JSC::PropertyNode::putType const): Deleted.
2453 (JSC::BracketAccessorNode::base const): Deleted.
2454 (JSC::BracketAccessorNode::subscript const): Deleted.
2455 (JSC::BracketAccessorNode::subscriptHasAssignments const): Deleted.
2456 (JSC::DotAccessorNode::base const): Deleted.
2457 (JSC::DotAccessorNode::identifier const): Deleted.
2458 (JSC::SpreadExpressionNode::expression const): Deleted.
2459 (JSC::ObjectSpreadExpressionNode::expression const): Deleted.
2460 (JSC::BytecodeIntrinsicNode::type const): Deleted.
2461 (JSC::BytecodeIntrinsicNode::emitter const): Deleted.
2462 (JSC::BytecodeIntrinsicNode::identifier const): Deleted.
2463 (JSC::TypeOfResolveNode::identifier const): Deleted.
2464 (JSC::BitwiseNotNode::expr): Deleted.
2465 (JSC::BitwiseNotNode::expr const): Deleted.
2466 (JSC::AssignResolveNode::identifier const): Deleted.
2467 (JSC::ExprStatementNode::expr const): Deleted.
2468 (JSC::ForOfNode::isForAwait const): Deleted.
2469 (JSC::ReturnNode::value): Deleted.
2470 (JSC::ProgramNode::startColumn const): Deleted.
2471 (JSC::ProgramNode::endColumn const): Deleted.
2472 (JSC::EvalNode::startColumn const): Deleted.
2473 (JSC::EvalNode::endColumn const): Deleted.
2474 (JSC::ModuleProgramNode::startColumn const): Deleted.
2475 (JSC::ModuleProgramNode::endColumn const): Deleted.
2476 (JSC::ModuleProgramNode::moduleScopeData): Deleted.
2477 (JSC::ModuleNameNode::moduleName): Deleted.
2478 (JSC::ImportSpecifierNode::importedName): Deleted.
2479 (JSC::ImportSpecifierNode::localName): Deleted.
2480 (JSC::ImportSpecifierListNode::specifiers const): Deleted.
2481 (JSC::ImportSpecifierListNode::append): Deleted.
2482 (JSC::ImportDeclarationNode::specifierList const): Deleted.
2483 (JSC::ImportDeclarationNode::moduleName const): Deleted.
2484 (JSC::ExportAllDeclarationNode::moduleName const): Deleted.
2485 (JSC::ExportDefaultDeclarationNode::declaration const): Deleted.
2486 (JSC::ExportDefaultDeclarationNode::localName const): Deleted.
2487 (JSC::ExportLocalDeclarationNode::declaration const): Deleted.
2488 (JSC::ExportSpecifierNode::exportedName): Deleted.
2489 (JSC::ExportSpecifierNode::localName): Deleted.
2490 (JSC::ExportSpecifierListNode::specifiers const): Deleted.
2491 (JSC::ExportSpecifierListNode::append): Deleted.
2492 (JSC::ExportNamedDeclarationNode::specifierList const): Deleted.
2493 (JSC::ExportNamedDeclarationNode::moduleName const): Deleted.
2494 (JSC::ArrayPatternNode::appendIndex): Deleted.
2495 (JSC::ObjectPatternNode::appendEntry): Deleted.
2496 (JSC::ObjectPatternNode::setContainsRestElement): Deleted.
2497 (JSC::ObjectPatternNode::setContainsComputedProperty): Deleted.
2498 (JSC::DestructuringAssignmentNode::bindings): Deleted.
2499 (JSC::FunctionParameters::size const): Deleted.
2500 (JSC::FunctionParameters::append): Deleted.
2501 (JSC::FunctionParameters::isSimpleParameterList const): Deleted.
2502 (JSC::FuncDeclNode::metadata): Deleted.
2503 (JSC::CaseClauseNode::expr const): Deleted.
2504 (JSC::CaseClauseNode::setStartOffset): Deleted.
2505 (JSC::ClauseListNode::getClause const): Deleted.
2506 (JSC::ClauseListNode::getNext const): Deleted.
2507 * runtime/ExceptionHelpers.cpp:
2508 * runtime/JSObject.cpp:
2510 2018-07-18 Yusuke Suzuki <utatane.tea@gmail.com>
2512 JSON.stringify should emit non own properties if second array argument includes
2513 https://bugs.webkit.org/show_bug.cgi?id=187724
2515 Reviewed by Mark Lam.
2517 According to the spec[1], JSON.stringify needs to retrieve properties by using [[Get]],
2518 instead of [[GetOwnProperty]]. It means that we would look up a properties defined
2519 in [[Prototype]] or upper objects in the prototype chain. While enumeration is done
2520 by using EnumerableOwnPropertyNames typically, we can pass replacer array including
2521 property names which does not reside in the own properties. Or we can modify the
2522 own properties by deleting properties while JSON.stringify is calling a getter. So,
2523 using [[Get]] instead of [[GetOwnProperty]] is user-visible.
2525 This patch changes getOwnPropertySlot to getPropertySlot to align the behavior to the spec.
2526 The performance of Kraken/json-stringify-tinderbox is neutral.
2528 [1]: https://tc39.github.io/ecma262/#sec-serializejsonproperty
2530 * runtime/JSONObject.cpp:
2531 (JSC::Stringifier::toJSON):
2532 (JSC::Stringifier::toJSONImpl):
2533 (JSC::Stringifier::appendStringifiedValue):
2534 (JSC::Stringifier::Holder::Holder):
2535 (JSC::Stringifier::Holder::appendNextProperty):
2537 2018-07-18 Yusuke Suzuki <utatane.tea@gmail.com>
2539 [JSC] JSON.stringify's replacer should use `isArray` instead of JSArray checks
2540 https://bugs.webkit.org/show_bug.cgi?id=187755
2542 Reviewed by Mark Lam.
2544 JSON.stringify used `inherits<JSArray>(vm)` to determine whether the given replacer is an array replacer.
2545 But this is wrong. According to the spec, we should use `isArray`[1], which accepts Proxies. This difference
2546 makes one test262 test failed.
2548 This patch changes the code to using `isArray()`. And we reorder the evaluations of replacer check and ident space check
2549 to align these checks to the spec's order.
2551 [1]: https://tc39.github.io/ecma262/#sec-json.stringify
2553 * runtime/JSONObject.cpp:
2554 (JSC::Stringifier::Stringifier):
2556 2018-07-18 Yusuke Suzuki <utatane.tea@gmail.com>
2558 [JSC] Root wrapper object in JSON.stringify is not necessary if replacer is not callable
2559 https://bugs.webkit.org/show_bug.cgi?id=187752
2561 Reviewed by Mark Lam.
2563 JSON.stringify has an implicit root wrapper object since we would like to call replacer
2564 with a wrapper object and a property name. While we always create this wrapper object,
2565 it is unnecessary if the given replacer is not callable.
2567 This patch removes wrapper object creation when a replacer is not callable to avoid unnecessary
2568 allocations. This change slightly improves the performance of Kraken/json-stringify-tinderbox.
2572 json-stringify-tinderbox 39.730+-0.590 ^ 38.853+-0.266 ^ definitely 1.0226x faster
2574 * runtime/JSONObject.cpp:
2575 (JSC::Stringifier::isCallableReplacer const):
2576 (JSC::Stringifier::Stringifier):
2577 (JSC::Stringifier::stringify):
2578 (JSC::Stringifier::appendStringifiedValue):
2580 2018-07-18 Carlos Garcia Campos <cgarcia@igalia.com>
2582 [GLIB] Add jsc_context_check_syntax() to GLib API
2583 https://bugs.webkit.org/show_bug.cgi?id=187694
2585 Reviewed by Yusuke Suzuki.
2587 A new function to be able to check for syntax errors without actually evaluating the code.
2589 * API/glib/JSCContext.cpp:
2590 (jsc_context_check_syntax):
2591 * API/glib/JSCContext.h:
2592 * API/glib/docs/jsc-glib-4.0-sections.txt:
2594 2018-07-17 Keith Miller <keith_miller@apple.com>
2596 Revert r233630 since it broke internal wasm benchmarks
2597 https://bugs.webkit.org/show_bug.cgi?id=187746
2601 This patch seems to have broken internal Wasm benchmarks. This
2602 issue is likely due to an underlying bug but let's rollout while
2605 * bytecode/CodeType.h:
2606 * bytecode/UnlinkedCodeBlock.cpp:
2607 (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
2608 * bytecode/UnlinkedCodeBlock.h:
2609 (JSC::UnlinkedCodeBlock::codeType const):
2610 (JSC::UnlinkedCodeBlock::didOptimize const):
2611 (JSC::UnlinkedCodeBlock::setDidOptimize):
2612 * bytecode/VirtualRegister.h:
2613 (JSC::VirtualRegister::VirtualRegister):
2616 2018-07-17 Mark Lam <mark.lam@apple.com>
2618 CodeBlock::baselineVersion() should account for executables with purged codeBlocks.
2619 https://bugs.webkit.org/show_bug.cgi?id=187736
2620 <rdar://problem/42114371>
2622 Reviewed by Michael Saboff.
2624 CodeBlock::baselineVersion() currently checks for a null replacement but does not
2625 account for the fact that that the replacement can also be null due to the
2626 executable having being purged of its codeBlocks due to a memory event (see
2627 ExecutableBase::clearCode()). This patch adds code to account for this.
2629 * bytecode/CodeBlock.cpp:
2630 (JSC::CodeBlock::baselineVersion):
2632 2018-07-16 Yusuke Suzuki <utatane.tea@gmail.com>
2634 [JSC] UnlinkedCodeBlock::shrinkToFit miss m_constantIdentifierSets
2635 https://bugs.webkit.org/show_bug.cgi?id=187709
2637 Reviewed by Mark Lam.
2639 UnlinkedCodeBlock::shrinkToFit accidentally misses m_constantIdentifierSets shrinking.
2641 * bytecode/UnlinkedCodeBlock.cpp:
2642 (JSC::UnlinkedCodeBlock::shrinkToFit):
2644 2018-07-16 Yusuke Suzuki <utatane.tea@gmail.com>
2646 [JSC] Make SourceParseMode small
2647 https://bugs.webkit.org/show_bug.cgi?id=187705
2649 Reviewed by Mark Lam.
2651 Each SourceParseMode is distinct. So we do not need to make it a set-style (power of 2 style).
2652 Originally, this is done to make SourceParseModeSet faster because it is critical in our parser.
2653 But we can keep SourceParseModeSet fast by `1U << mode | set`. And we can make SourceParseMode
2654 within 5 bits. This reduces the size of UnlinkedCodeBlock from 288 to 280.
2656 * parser/ParserModes.h:
2657 (JSC::SourceParseModeSet::SourceParseModeSet):
2658 (JSC::SourceParseModeSet::contains):
2659 (JSC::SourceParseModeSet::mergeSourceParseModes):
2661 2018-07-12 Yusuke Suzuki <utatane.tea@gmail.com>
2663 [JSC] Generator and AsyncGeneratorMethod's prototype is incorrect
2664 https://bugs.webkit.org/show_bug.cgi?id=187585
2666 Reviewed by Darin Adler.
2668 This patch fixes Generator and AsyncGenerator's prototype issues.
2670 1. Generator's default prototype is incorrect when `generator.prototype = null` is performed.
2671 We fix this by changing JSFunction::prototypeForConstruction.
2673 2. AsyncGeneratorMethod is not handled. We change the name isAsyncGeneratorFunctionParseMode
2674 to isAsyncGeneratorWrapperParseMode since it is aligned to Generator's code. And use it well
2675 to fix `prototype` issues for AsyncGeneratorMethod.
2677 * bytecompiler/BytecodeGenerator.cpp:
2678 (JSC::BytecodeGenerator::emitPutAsyncGeneratorFields):
2679 (JSC::BytecodeGenerator::emitNewFunction):
2680 * bytecompiler/NodesCodegen.cpp:
2681 (JSC::FunctionNode::emitBytecode):
2682 * parser/ASTBuilder.h:
2683 (JSC::ASTBuilder::createFunctionMetadata):
2684 * parser/Parser.cpp:
2685 (JSC::getAsynFunctionBodyParseMode):
2686 (JSC::Parser<LexerType>::parseInner):
2687 (JSC::Parser<LexerType>::parseAsyncGeneratorFunctionSourceElements):
2688 * parser/ParserModes.h:
2689 (JSC::isAsyncGeneratorParseMode):
2690 (JSC::isAsyncGeneratorWrapperParseMode):
2691 (JSC::isAsyncGeneratorFunctionParseMode): Deleted.
2692 * runtime/FunctionExecutable.h:
2693 * runtime/JSFunction.cpp:
2694 (JSC::JSFunction::prototypeForConstruction):
2695 (JSC::JSFunction::getOwnPropertySlot):
2697 2018-07-16 Mark Lam <mark.lam@apple.com>
2699 jsc shell's noFTL utility test function should be more robust.
2700 https://bugs.webkit.org/show_bug.cgi?id=187704
2701 <rdar://problem/42231988>
2703 Reviewed by Michael Saboff and Keith Miller.
2707 - only setNeverFTLOptimize() if the function is actually a JS function.
2709 2018-07-15 Carlos Garcia Campos <cgarcia@igalia.com>
2711 [GLIB] Add API to evaluate code using a given object to store global symbols
2712 https://bugs.webkit.org/show_bug.cgi?id=187639
2714 Reviewed by Michael Catanzaro.
2716 Add jsc_context_evaluate_in_object(). It returns a new object as an out parameter. Global symbols in the
2717 evaluated script are added as properties to the new object instead of to the context global object. This is
2718 similar to JS::Evaluate in spider monkey when a scopeChain parameter is passed, but JSC doesn't support using a
2719 scope for assignments, so we have to create a new context and get its global object. This patch also updates
2720 jsc_context_evaluate_with_source_uri() to receive the starting line number for consistency with the new
2721 jsc_context_evaluate_in_object().
2723 * API/glib/JSCContext.cpp:
2724 (jsc_context_evaluate): Pass 0 as line number to jsc_context_evaluate_with_source_uri().
2725 (evaluateScriptInContext): Helper function to evaluate a script in a JSGlobalContextRef.
2726 (jsc_context_evaluate_with_source_uri): Use evaluateScriptInContext().
2727 (jsc_context_evaluate_in_object): Create a new context and set the main context global object as extension
2728 scope of it. Evaluate the script in the new context and get its global object to be returned as parameter.
2729 * API/glib/JSCContext.h:
2730 * API/glib/docs/jsc-glib-4.0-sections.txt:
2732 2018-07-13 Yusuke Suzuki <utatane.tea@gmail.com>
2734 [32bit JSC tests] stress/cow-convert-double-to-contiguous.js and stress/cow-convert-int32-to-contiguous.js are failing
2735 https://bugs.webkit.org/show_bug.cgi?id=187561
2737 Reviewed by Darin Adler.
2739 This patch fixes the issue that CoW array handling is not introduced in 32bit put_by_val code.
2740 We clean up 32bit put_by_val code.
2742 1. We remove inline out-of-bounds recording code since it is done in C operation code. This change
2743 aligns 32bit implementation to 64bit implementation.
2745 2. We add CoW array checking, which is done in 64bit implementation.
2747 * jit/JITPropertyAccess.cpp:
2748 (JSC::JIT::emit_op_put_by_val):
2749 * jit/JITPropertyAccess32_64.cpp:
2750 (JSC::JIT::emit_op_put_by_val):
2751 (JSC::JIT::emitSlow_op_put_by_val):
2753 2018-07-12 Mark Lam <mark.lam@apple.com>
2755 Need to handle CodeBlock::replacement() being null.
2756 https://bugs.webkit.org/show_bug.cgi?id=187569
2757 <rdar://problem/41468692>
2759 Reviewed by Saam Barati.
2761 CodeBlock::replacement() may return a nullptr. Some of our code already checks
2762 for this while others do not. We should add null checks in all the places that
2765 * bytecode/CodeBlock.cpp:
2766 (JSC::CodeBlock::hasOptimizedReplacement):
2767 (JSC::CodeBlock::jettison):
2768 (JSC::CodeBlock::numberOfDFGCompiles):
2769 (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
2770 * dfg/DFGOperations.cpp:
2771 * dfg/DFGToFTLDeferredCompilationCallback.cpp:
2772 (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
2773 (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
2774 * jit/JITOperations.cpp:
2776 2018-07-12 Yusuke Suzuki <utatane.tea@gmail.com>
2778 [JSC] Thread VM& to JSCell::methodTable(VM&)
2779 https://bugs.webkit.org/show_bug.cgi?id=187548
2781 Reviewed by Saam Barati.
2783 This patch threads VM& to methodTable(VM&) and remove methodTable().
2784 We add VM& parameter to estimatedSize() to thread VM& in estimatedSize implementations.
2788 * API/JSCallbackObject.h:
2789 * API/JSCallbackObjectFunctions.h:
2790 (JSC::JSCallbackObject<Parent>::className):
2791 * bytecode/CodeBlock.cpp:
2792 (JSC::CodeBlock::estimatedSize):
2793 * bytecode/CodeBlock.h:
2794 * bytecode/UnlinkedCodeBlock.cpp:
2795 (JSC::UnlinkedCodeBlock::estimatedSize):
2796 * bytecode/UnlinkedCodeBlock.h:
2797 * debugger/DebuggerScope.cpp:
2798 (JSC::DebuggerScope::className):
2799 * debugger/DebuggerScope.h:
2801 (JSC::GatherHeapSnapshotData::GatherHeapSnapshotData):
2802 (JSC::GatherHeapSnapshotData::operator() const):
2803 (JSC::Heap::gatherExtraHeapSnapshotData):
2804 * heap/HeapSnapshotBuilder.cpp:
2805 (JSC::HeapSnapshotBuilder::json):
2806 * runtime/ArrayPrototype.cpp:
2807 (JSC::arrayProtoFuncToString):
2808 * runtime/ClassInfo.h:
2809 * runtime/DirectArguments.cpp:
2810 (JSC::DirectArguments::estimatedSize):
2811 * runtime/DirectArguments.h:
2812 * runtime/HashMapImpl.cpp:
2813 (JSC::HashMapImpl<HashMapBucket>::estimatedSize):
2814 * runtime/HashMapImpl.h:
2815 * runtime/JSArrayBuffer.cpp:
2816 (JSC::JSArrayBuffer::estimatedSize):
2817 * runtime/JSArrayBuffer.h:
2818 * runtime/JSBigInt.cpp:
2819 (JSC::JSBigInt::estimatedSize):
2820 * runtime/JSBigInt.h:
2821 * runtime/JSCell.cpp:
2822 (JSC::JSCell::dump const):
2823 (JSC::JSCell::estimatedSizeInBytes const):
2824 (JSC::JSCell::estimatedSize):
2825 (JSC::JSCell::className):
2827 * runtime/JSCellInlines.h:
2828 * runtime/JSGenericTypedArrayView.h:
2829 * runtime/JSGenericTypedArrayViewInlines.h:
2830 (JSC::JSGenericTypedArrayView<Adaptor>::estimatedSize):
2831 * runtime/JSObject.cpp:
2832 (JSC::JSObject::estimatedSize):
2833 (JSC::JSObject::className):
2834 (JSC::JSObject::toStringName):
2835 (JSC::JSObject::calculatedClassName):
2836 * runtime/JSObject.h:
2837 * runtime/JSProxy.cpp:
2838 (JSC::JSProxy::className):
2839 * runtime/JSProxy.h:
2840 * runtime/JSString.cpp:
2841 (JSC::JSString::estimatedSize):
2842 * runtime/JSString.h:
2843 * runtime/RegExp.cpp:
2844 (JSC::RegExp::estimatedSize):
2846 * runtime/WeakMapImpl.cpp:
2847 (JSC::WeakMapImpl<WeakMapBucket>::estimatedSize):
2848 * runtime/WeakMapImpl.h:
2850 2018-07-11 Commit Queue <commit-queue@webkit.org>
2852 Unreviewed, rolling out r233714.
2853 https://bugs.webkit.org/show_bug.cgi?id=187579
2855 it made tests time out (Requested by pizlo on #webkit).
2859 "Change the reoptimization backoff base to 1.3 from 2"
2860 https://bugs.webkit.org/show_bug.cgi?id=187540
2861 https://trac.webkit.org/changeset/233714
2863 2018-07-11 Carlos Garcia Campos <cgarcia@igalia.com>
2865 [GLIB] Add API to allow creating variadic functions
2866 https://bugs.webkit.org/show_bug.cgi?id=187517
2868 Reviewed by Michael Catanzaro.
2870 Add a _variadic alternate method for jsc_class_add_constructor, jsc_class_add_method and
2871 jsc_value_new_function. In that case the callback always receives a GPtrArray of JSCValue.
2873 * API/glib/JSCCallbackFunction.cpp:
2874 (JSC::JSCCallbackFunction::create): Make the parameters optional.
2875 (JSC::JSCCallbackFunction::JSCCallbackFunction): Ditto.
2876 (JSC::JSCCallbackFunction::call): Handle the case of parameters being nullopt by creating a GPtrArray of
2877 JSCValue for the arguments.
2878 (JSC::JSCCallbackFunction::construct): Ditto.
2879 * API/glib/JSCCallbackFunction.h:
2880 * API/glib/JSCClass.cpp:
2881 (jscClassCreateConstructor): Make the parameters optional.
2882 (jsc_class_add_constructor_variadic): Pass nullopt as parameters to jscClassCreateConstructor.
2883 (jscClassAddMethod): Make the parameters optional.
2884 (jsc_class_add_method_variadic): Pass nullopt as parameters to jscClassAddMethod.
2885 * API/glib/JSCClass.h:
2886 * API/glib/JSCValue.cpp:
2887 (jsc_value_object_define_property_accessor): Update now that parameters are optional.
2888 (jscValueFunctionCreate): Make the parameters optional.
2889 (jsc_value_new_function_variadic): Pass nullopt as parameters to jscValueFunctionCreate.
2890 * API/glib/JSCValue.h:
2891 * API/glib/docs/jsc-glib-4.0-sections.txt:
2893 2018-07-11 Carlos Garcia Campos <cgarcia@igalia.com>
2895 [GLIB] Add jsc_context_get_global_object() to GLib API
2896 https://bugs.webkit.org/show_bug.cgi?id=187515
2898 Reviewed by Michael Catanzaro.
2900 This wasn't exposed because we have convenient methods in JSCContext to get and set properties on the global
2901 object. However, getting the global object could be useful in some cases, for example to give it a well known
2902 name like 'window' in browsers and GJS.
2904 * API/glib/JSCContext.cpp:
2905 (jsc_context_get_global_object):
2906 * API/glib/JSCContext.h:
2907 * API/glib/docs/jsc-glib-4.0-sections.txt:
2909 2018-07-11 Carlos Garcia Campos <cgarcia@igalia.com>
2911 [GLIB] Handle G_TYPE_STRV in glib API
2912 https://bugs.webkit.org/show_bug.cgi?id=187512
2914 Reviewed by Michael Catanzaro.
2916 Add jsc_value_new_array_from_strv() and handle G_TYPE_STRV types in function parameters.
2918 * API/glib/JSCContext.cpp:
2919 (jscContextGValueToJSValue):
2920 (jscContextJSValueToGValue):
2921 * API/glib/JSCValue.cpp:
2922 (jsc_value_new_array_from_strv):
2923 * API/glib/JSCValue.h:
2924 * API/glib/docs/jsc-glib-4.0-sections.txt:
2926 2018-07-11 Yusuke Suzuki <utatane.tea@gmail.com>
2928 Iterator of Array.keys() returns object in wrong order
2929 https://bugs.webkit.org/show_bug.cgi?id=185197
2931 Reviewed by Keith Miller.
2933 * builtins/ArrayIteratorPrototype.js:
2934 (globalPrivate.arrayIteratorValueNext):
2935 (globalPrivate.arrayIteratorKeyNext):
2936 (globalPrivate.arrayIteratorKeyValueNext):
2937 * builtins/AsyncFromSyncIteratorPrototype.js:
2938 * builtins/AsyncGeneratorPrototype.js:
2939 (globalPrivate.asyncGeneratorResolve):
2940 * builtins/GeneratorPrototype.js:
2941 (globalPrivate.generatorResume):
2942 * builtins/MapIteratorPrototype.js:
2943 (globalPrivate.mapIteratorNext):
2944 * builtins/SetIteratorPrototype.js:
2945 (globalPrivate.setIteratorNext):
2946 * builtins/StringIteratorPrototype.js:
2948 * runtime/IteratorOperations.cpp:
2949 (JSC::createIteratorResultObjectStructure):
2950 (JSC::createIteratorResultObject):
2952 2018-07-10 Mark Lam <mark.lam@apple.com>
2954 constructArray() should always allocate the requested length.
2955 https://bugs.webkit.org/show_bug.cgi?id=187543
2956 <rdar://problem/41947884>
2958 Reviewed by Saam Barati.
2960 Currently, it does not when we're having a bad time. We fix this by switching
2961 back to using tryCreateUninitializedRestricted() exclusively in constructArray().
2962 If we detect that a structure transition is possible before we can initialize
2963 the butterfly, we'll go ahead and eagerly initialize the rest of the butterfly.
2964 We will introduce JSArray::eagerlyInitializeButterfly() to handle this.
2966 Also enhanced the DisallowScope and ObjectInitializationScope to support this
2967 eager initialization when needed.
2969 * dfg/DFGOperations.cpp:
2970 - the client of operationNewArrayWithSizeAndHint() (in FTL generated code) expects
2971 the array allocation to always succeed. Adding this RELEASE_ASSERT here makes
2972 it clearer that we encountered an OutOfMemory condition instead of failing in FTL
2973 generated code, which will appear as a generic null pointer dereference.
2975 * runtime/ArrayPrototype.cpp:
2976 (JSC::concatAppendOne):
2977 - the code here clearly wants to check for an allocation failure. Switched to
2978 using JSArray::tryCreate() instead of JSArray::create().
2980 * runtime/DisallowScope.h:
2981 (JSC::DisallowScope::disable):
2982 * runtime/JSArray.cpp:
2983 (JSC::JSArray::tryCreateUninitializedRestricted):
2984 (JSC::JSArray::eagerlyInitializeButterfly):
2985 (JSC::constructArray):
2986 * runtime/JSArray.h:
2987 * runtime/ObjectInitializationScope.cpp:
2988 (JSC::ObjectInitializationScope::notifyInitialized):
2989 * runtime/ObjectInitializationScope.h:
2990 (JSC::ObjectInitializationScope::notifyInitialized):
2992 2018-07-05 Yusuke Suzuki <utatane.tea@gmail.com>
2994 [JSC] Remove getTypedArrayImpl
2995 https://bugs.webkit.org/show_bug.cgi?id=187338
2997 Reviewed by Mark Lam.
2999 getTypedArrayImpl is overridden only by typed arrays and DataView. Since the number of these classes
3000 are limited, we do not need to add this function to MethodTable: dispatching it in JSArrayBufferView is fine.
3001 This patch removes getTypedArrayImpl from MethodTable, and moves it to JSArrayBufferView.
3003 * runtime/ClassInfo.h:
3004 * runtime/GenericTypedArrayView.h:
3005 (JSC::GenericTypedArrayView::data const): Deleted.
3006 (JSC::GenericTypedArrayView::set): Deleted.
3007 (JSC::GenericTypedArrayView::setRange): Deleted.
3008 (JSC::GenericTypedArrayView::zeroRange): Deleted.
3009 (JSC::GenericTypedArrayView::zeroFill): Deleted.
3010 (JSC::GenericTypedArrayView::length const): Deleted.
3011 (JSC::GenericTypedArrayView::item const): Deleted.
3012 (JSC::GenericTypedArrayView::set const): Deleted.
3013 (JSC::GenericTypedArrayView::setNative const): Deleted.
3014 (JSC::GenericTypedArrayView::getRange): Deleted.
3015 (JSC::GenericTypedArrayView::checkInboundData const): Deleted.
3016 (JSC::GenericTypedArrayView::internalByteLength const): Deleted.
3017 * runtime/JSArrayBufferView.cpp:
3018 (JSC::JSArrayBufferView::possiblySharedImpl):
3019 * runtime/JSArrayBufferView.h:
3020 * runtime/JSArrayBufferViewInlines.h:
3021 (JSC::JSArrayBufferView::possiblySharedImpl): Deleted.
3022 * runtime/JSCell.cpp:
3023 (JSC::JSCell::getTypedArrayImpl): Deleted.
3025 * runtime/JSDataView.cpp:
3026 (JSC::JSDataView::getTypedArrayImpl): Deleted.
3027 * runtime/JSDataView.h:
3028 * runtime/JSGenericTypedArrayView.h:
3029 * runtime/JSGenericTypedArrayViewInlines.h:
3030 (JSC::JSGenericTypedArrayView<Adaptor>::getTypedArrayImpl): Deleted.
3032 2018-07-10 Keith Miller <keith_miller@apple.com>
3034 hasOwnProperty returns true for out of bounds property index on TypedArray
3035 https://bugs.webkit.org/show_bug.cgi?id=187520
3037 Reviewed by Saam Barati.
3039 * runtime/JSGenericTypedArrayViewInlines.h:
3040 (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
3042 2018-07-10 Michael Saboff <msaboff@apple.com>
3044 DFG JIT: compileMathIC produces incorrect machine code
3045 https://bugs.webkit.org/show_bug.cgi?id=187537
3047 Reviewed by Saam Barati.
3049 Added checks for constant multipliers in JITMulGenerator::generateInline(). If we have a constant multiplier,
3050 fall back to the fast path generator which handles such cases.
3052 * jit/JITMulGenerator.cpp:
3053 (JSC::JITMulGenerator::generateInline):
3055 2018-07-10 Filip Pizlo <fpizlo@apple.com>
3057 Change the reoptimization backoff base to 1.3 from 2
3058 https://bugs.webkit.org/show_bug.cgi?id=187540
3060 Reviewed by Saam Barati.
3062 I have data that hints at this being a speed-up on JetStream, ARES-6, and Speedometer2.
3064 I also have data that hints that a backoff base of 1 might be even better, but I think that
3065 we want to keep *some* backoff in case we find ourselves in an unmitigated recomp loop.
3067 * bytecode/CodeBlock.cpp:
3068 (JSC::CodeBlock::reoptimizationRetryCounter const):
3069 (JSC::CodeBlock::countReoptimization):
3070 (JSC::CodeBlock::adjustedCounterValue):
3071 * runtime/Options.cpp:
3072 (JSC::recomputeDependentOptions):
3073 * runtime/Options.h:
3075 2018-07-10 Mark Lam <mark.lam@apple.com>
3077 [32-bit JSC tests] ASSERTION FAILED: !butterfly->propertyStorage()[-I - 1].get() under JSC::ObjectInitializationScope::verifyPropertiesAreInitialized.
3078 https://bugs.webkit.org/show_bug.cgi?id=187362
3079 <rdar://problem/42027210>
3081 Reviewed by Saam Barati.
3083 On 32-bit targets, a 0 valued JSValue is not the empty JSValue, but it is a valid
3084 value to use for initializing unused properties. Updated an assertion to account
3087 * runtime/ObjectInitializationScope.cpp:
3088 (JSC::ObjectInitializationScope::verifyPropertiesAreInitialized):
3090 2018-07-10 Michael Saboff <msaboff@apple.com>
3092 YARR: . doesn't match non-BMP Unicode characters in some cases
3093 https://bugs.webkit.org/show_bug.cgi?id=187248
3095 Reviewed by Geoffrey Garen.
3097 The safety check in optimizeAlternative() for moving character classes that only consist of BMP
3098 characters did not take into account that the character class is inverted. In this case, we
3099 represent '.' as "not a newline" using the newline character class with an inverted check.
3100 Clearly that includes non-BMP characters.
3102 The fix is to check that the character class doesn't have non-BMP characters AND it isn't an
3103 inverted use of that character class.
3106 (JSC::Yarr::YarrGenerator::optimizeAlternative):
3108 2018-07-09 Mark Lam <mark.lam@apple.com>
3110 Add --traceLLIntExecution and --traceLLIntSlowPath options.
3111 https://bugs.webkit.org/show_bug.cgi?id=187479
3113 Reviewed by Yusuke Suzuki and Saam Barati.
3115 These options are only available if LLINT_TRACING is enabled in LLIntCommon.h.
3118 1. LLINT_TRACING consolidates and replaces LLINT_EXECUTION_TRACING and LLINT_SLOW_PATH_TRACING.
3119 2. Tracing is now guarded behind runtime options --traceLLIntExecution and --traceLLIntSlowPath.
3120 This makes it such that enabling LLINT_TRACING doesn't means that we'll
3121 continually spammed with logging until we rebuild.
3122 3. Fixed slow path LLINT tracing to work with exception check validation.
3124 * llint/LLIntCommon.h:
3125 * llint/LLIntExceptions.cpp:
3126 (JSC::LLInt::returnToThrow):
3127 (JSC::LLInt::callToThrow):
3128 * llint/LLIntOfflineAsmConfig.h:
3129 * llint/LLIntSlowPaths.cpp:
3130 (JSC::LLInt::slowPathLog):
3131 (JSC::LLInt::slowPathLn):
3132 (JSC::LLInt::slowPathLogF):
3133 (JSC::LLInt::slowPathLogLn):
3134 (JSC::LLInt::llint_trace_operand):
3135 (JSC::LLInt::llint_trace_value):
3136 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3137 (JSC::LLInt::traceFunctionPrologue):
3138 (JSC::LLInt::handleHostCall):
3139 (JSC::LLInt::setUpCall):
3140 * llint/LLIntSlowPaths.h:
3141 * llint/LowLevelInterpreter.asm:
3142 * runtime/CommonSlowPathsExceptions.cpp:
3143 (JSC::CommonSlowPaths::interpreterThrowInCaller):
3144 * runtime/Options.cpp:
3145 (JSC::Options::isAvailable):
3146 * runtime/Options.h:
3148 2018-07-09 Yusuke Suzuki <utatane.tea@gmail.com>
3150 [JSC] Embed RegExp into constant buffer in UnlinkedCodeBlock and CodeBlock
3151 https://bugs.webkit.org/show_bug.cgi?id=187477
3153 Reviewed by Mark Lam.
3155 Before this patch, RegExp* is specially held in m_regexp buffer which resides in CodeBlock's RareData.
3156 However, it is not necessary since JSCells can be reside in a constant buffer.
3157 This patch embeds RegExp* to a constant buffer in UnlinkedCodeBlock and CodeBlock. And remove RegExp
3158 vector from RareData.
3160 We also move the code of dumping RegExp from BytecodeDumper to RegExp::dumpToStream.
3162 * bytecode/BytecodeDumper.cpp:
3163 (JSC::BytecodeDumper<Block>::dumpBytecode):
3164 (JSC::BytecodeDumper<Block>::dumpBlock):
3165 (JSC::regexpToSourceString): Deleted.
3166 (JSC::regexpName): Deleted.
3167 (JSC::BytecodeDumper<Block>::dumpRegExps): Deleted.
3168 * bytecode/BytecodeDumper.h:
3169 * bytecode/CodeBlock.h:
3170 (JSC::CodeBlock::regexp const): Deleted.
3171 (JSC::CodeBlock::numberOfRegExps const): Deleted.
3172 * bytecode/UnlinkedCodeBlock.cpp:
3173 (JSC::UnlinkedCodeBlock::visitChildren):
3174 (JSC::UnlinkedCodeBlock::shrinkToFit):
3175 * bytecode/UnlinkedCodeBlock.h:
3176 (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
3177 (JSC::UnlinkedCodeBlock::numberOfRegExps const): Deleted.
3178 (JSC::UnlinkedCodeBlock::regexp const): Deleted.
3179 * bytecompiler/BytecodeGenerator.cpp:
3180 (JSC::BytecodeGenerator::emitNewRegExp):
3181 (JSC::BytecodeGenerator::addRegExp): Deleted.
3182 * bytecompiler/BytecodeGenerator.h:
3183 * dfg/DFGByteCodeParser.cpp:
3184 (JSC::DFG::ByteCodeParser::parseBlock):
3185 * jit/JITOpcodes.cpp:
3186 (JSC::JIT::emit_op_new_regexp):
3187 * llint/LLIntSlowPaths.cpp:
3188 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3189 * runtime/JSCJSValue.cpp:
3190 (JSC::JSValue::dumpInContextAssumingStructure const):
3191 * runtime/RegExp.cpp:
3192 (JSC::regexpToSourceString):
3193 (JSC::RegExp::dumpToStream):
3196 2018-07-09 Brian Burg <bburg@apple.com>
3198 REGRESSION: Web Inspector no longer pauses in internal injected scripts like WDFindNodes.js
3199 https://bugs.webkit.org/show_bug.cgi?id=187350
3200 <rdar://problem/41728249>
3202 Reviewed by Matt Baker.
3204 Add a new command that toggles whether or not to blackbox internal scripts.
3205 If blackboxed, the scripts will not be shown to the frontend and the debugger will
3206 not pause in source frames from blackboxed scripts. Sometimes we want to break into
3207 those scripts when debugging Web Inspector, WebDriver, or other WebKit-internal code
3208 that injects scripts.
3210 * inspector/agents/InspectorDebuggerAgent.cpp:
3211 (Inspector::InspectorDebuggerAgent::setPauseForInternalScripts):
3212 (Inspector::InspectorDebuggerAgent::didParseSource):
3213 * inspector/agents/InspectorDebuggerAgent.h:
3214 * inspector/protocol/Debugger.json:
3216 2018-07-09 Yusuke Suzuki <utatane.tea@gmail.com>
3218 [JSC] Make some data members of UnlinkedCodeBlock private
3219 https://bugs.webkit.org/show_bug.cgi?id=187467
3221 Reviewed by Mark Lam.
3223 This patch makes m_numVars, m_numCalleeLocals, and m_numParameters of UnlinkedCodeBlock private.
3224 We also remove m_numCapturedVars since it is no longer used.
3226 * bytecode/CodeBlock.cpp:
3227 (JSC::CodeBlock::CodeBlock):
3228 * bytecode/CodeBlock.h:
3229 * bytecode/UnlinkedCodeBlock.cpp:
3230 (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
3231 * bytecode/UnlinkedCodeBlock.h:
3233 2018-07-09 Yusuke Suzuki <utatane.tea@gmail.com>
3235 [JSC] Optimize layout of AccessCase / ProxyableAccessCase to reduce size of ProxyableAccessCase
3236 https://bugs.webkit.org/show_bug.cgi?id=187465
3238 Reviewed by Keith Miller.
3240 ProxyableAccessCase is allocated so frequently and it is persisted so long. Reducing the size
3241 of ProxyableAccessCase can reduce the footprint of many web sites including nytimes.com.
3243 This patch uses a bit complicated layout to reduce ProxyableAccessCase. We add unused bool member
3244 in AccessCase's padding, and use it in ProxyableAccessCase. By doing so, we can reduce the size
3245 of ProxyableAccessCase from 56 to 48. And it also reduces the size of GetterSetterAccessCase
3246 from 104 to 96 since it inherits ProxyableAccessCase.
3248 * bytecode/AccessCase.h:
3249 (JSC::AccessCase::viaProxy const):
3250 (JSC::AccessCase::AccessCase):
3251 * bytecode/ProxyableAccessCase.cpp:
3252 (JSC::ProxyableAccessCase::ProxyableAccessCase):
3253 * bytecode/ProxyableAccessCase.h:
3255 2018-07-08 Yusuke Suzuki <utatane.tea@gmail.com>
3257 Unreviewed, build fix for debug builds after r233630
3258 https://bugs.webkit.org/show_bug.cgi?id=187441
3261 (JSC::JIT::frameRegisterCountFor):
3262 * llint/LLIntEntrypoint.cpp:
3263 (JSC::LLInt::frameRegisterCountFor):
3265 2018-07-08 Yusuke Suzuki <utatane.tea@gmail.com>
3267 [JSC] Optimize layout of CodeBlock to reduce padding
3268 https://bugs.webkit.org/show_bug.cgi?id=187441
3270 Reviewed by Mark Lam.
3272 Arrange the order of members to reduce the size of CodeBlock from 552 to 544.
3273 We also make SourceCodeRepresentation 1 byte since CodeBlock has a vector of this,
3274 Vector<SourceCodeRepresentation> m_constantsSourceCodeRepresentation.
3276 We also move m_numCalleeLocals and m_numVars from `public` to `private` in CodeBlock.
3278 * bytecode/BytecodeDumper.cpp:
3279 (JSC::BytecodeDumper<Block>::dumpBlock):
3280 * bytecode/BytecodeUseDef.h:
3281 (JSC::computeDefsForBytecodeOffset):
3282 * bytecode/CodeBlock.cpp:
3283 (JSC::CodeBlock::CodeBlock):
3284 * bytecode/CodeBlock.h:
3285 (JSC::CodeBlock::numVars const):
3286 * bytecode/UnlinkedCodeBlock.h:
3287 (JSC::UnlinkedCodeBlock::numVars const):
3288 * dfg/DFGByteCodeParser.cpp:
3289 (JSC::DFG::ByteCodeParser::ByteCodeParser):
3290 (JSC::DFG::ByteCodeParser::flushForTerminalImpl):
3291 (JSC::DFG::ByteCodeParser::handleRecursiveTailCall):
3292 (JSC::DFG::ByteCodeParser::inlineCall):
3293 (JSC::DFG::ByteCodeParser::handleGetById):
3294 (JSC::DFG::ByteCodeParser::handlePutById):
3295 (JSC::DFG::ByteCodeParser::parseBlock):
3297 (JSC::DFG::Graph::forAllLocalsLiveInBytecode):
3298 * dfg/DFGOSREntrypointCreationPhase.cpp:
3299 (JSC::DFG::OSREntrypointCreationPhase::run):
3300 * dfg/DFGVariableEventStream.cpp:
3301 (JSC::DFG::VariableEventStream::reconstruct const):
3302 * ftl/FTLOSREntry.cpp:
3303 (JSC::FTL::prepareOSREntry):
3305 (JSC::FTL::State::State):
3306 * interpreter/Interpreter.cpp:
3307 (JSC::Interpreter::dumpRegisters):
3309 (JSC::JIT::frameRegisterCountFor):
3310 * jit/JITOpcodes.cpp:
3311 (JSC::JIT::emit_op_enter):
3312 * jit/JITOpcodes32_64.cpp:
3313 (JSC::JIT::emit_op_enter):
3314 * jit/JITOperations.cpp:
3315 * llint/LLIntEntrypoint.cpp:
3316 (JSC::LLInt::frameRegisterCountFor):
3317 * llint/LLIntSlowPaths.cpp:
3318 (JSC::LLInt::traceFunctionPrologue):
3319 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3320 * runtime/JSCJSValue.h:
3322 2018-07-08 Yusuke Suzuki <utatane.tea@gmail.com>
3324 [JSC] Optimize padding of UnlinkedCodeBlock to shrink
3325 https://bugs.webkit.org/show_bug.cgi?id=187448
3327 Reviewed by Saam Barati.
3329 We optimize the size of CodeType and TriState. And we arrange the layout of UnlinkedCodeBlock.
3330 These optimizations reduce the size of UnlinkedCodeBlock from 304 to 288.
3332 * bytecode/CodeType.h:
3333 * bytecode/UnlinkedCodeBlock.cpp:
3334 (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
3335 * bytecode/UnlinkedCodeBlock.h:
3336 (JSC::UnlinkedCodeBlock::codeType const):
3337 (JSC::UnlinkedCodeBlock::didOptimize const):
3338 (JSC::UnlinkedCodeBlock::setDidOptimize):
3339 * bytecode/VirtualRegister.h:
3341 2018-07-08 Yusuke Suzuki <utatane.tea@gmail.com>
3343 [JSC] Optimize padding of InferredTypeTable by using cellLock
3344 https://bugs.webkit.org/show_bug.cgi?id=187447
git://git.webkit.org / WebKit-https.git / blob