Source/JavaScriptCore/ChangeLog

   1 2011-09-26  Geoffrey Garen  <ggaren@apple.com>
   2
   3         REGRESSION (r95912): Conservative marking doesn't filter out pointers to
   4         MarkedBlock metadata
   5         https://bugs.webkit.org/show_bug.cgi?id=68860
   6
   7         Reviewed by Oliver Hunt.
   8
   9         Bencher says no performance change, maybe a 7% speedup on kraken-imaging-darkroom.
  10
  11         * heap/MarkedBlock.h:
  12         (JSC::MarkedBlock::isAtomAligned): Renamed atomMask to atomAlignment mask
  13         because the mask doesn't produce the actual atom number.
  14
  15         (JSC::MarkedBlock::isLiveCell): Testing just for alignment isn't good
  16         enough; we also need to test that a pointer is beyond the metadata section
  17         of a MarkedBlock, to avoid treating random metadata as a JSCell.
  18
  19 2011-09-26  Mark Hahnenberg  <mhahnenberg@apple.com>
  20
  21         Make JSCell::toBoolean non-virtual
  22         https://bugs.webkit.org/show_bug.cgi?id=67727
  23
  24         Reviewed by Geoffrey Garen.
  25
  26         JSCell::toBoolean now manually performs the toBoolean check for objects and strings (where
  27         before it was simply virtual and would crash if its implementation was called).
  28         Its descendants in JSObject and JSString have also been made non-virtual.  JSCell now
  29         explicitly covers all cases of toBoolean, so having a virtual implementation of
  30         JSCell::toBoolean is no longer necessary.  This is part of a larger process of un-virtualizing JSCell.
  31
  32         * JavaScriptCore.exp:
  33         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
  34         * runtime/JSCell.cpp:
  35         * runtime/JSCell.h:
  36         * runtime/JSNotAnObject.cpp:
  37         * runtime/JSNotAnObject.h:
  38         * runtime/JSObject.h:
  39         * runtime/JSString.h:
  40         (JSC::JSCell::toBoolean):
  41         (JSC::JSValue::toBoolean):
  42
  43 2011-09-26  Chris Marrin  <cmarrin@apple.com>
  44
  45         Enable requestAnimationFrame on Windows
  46         https://bugs.webkit.org/show_bug.cgi?id=68397
  47
  48         Reviewed by Simon Fraser.
  49
  50         Enabled REQUEST_ANIMATION_FRAME_TIMER for Windows
  51
  52         * wtf/Platform.h:
  53
  54 2011-09-26  Noel Gordon  <noel.gordon@gmail.com>
  55
  56         [Chromium] Remove DFGAliasTracker.h references from gyp project files
  57         https://bugs.webkit.org/show_bug.cgi?id=68787
  58
  59         Reviewed by Geoffrey Garen.
  60
  61         DFG/DFGAliasTracker.h was removed in r95389.  Cleanup (remove) references
  62         to that file from the gyp project files.
  63
  64         * JavaScriptCore.gypi:
  65
  66 2011-09-26  Zoltan Herczeg  <zherczeg@webkit.org>
  67
  68         [Qt]REGRESSION(r95865): It made 4 tests crash
  69         https://bugs.webkit.org/show_bug.cgi?id=68780
  70
  71         Reviewed by Oliver Hunt.
  72
  73         emitJumpSlowCaseIfNotJSCell(...) cannot be moved
  74         away since the next load depends on it.
  75
  76         * jit/JITPropertyAccess32_64.cpp:
  77         (JSC::JIT::emit_op_put_by_val):
  78
  79 2011-09-25  Mark Hahnenberg  <mhahnenberg@apple.com>
  80
  81         Add custom vtable struct to ClassInfo struct
  82         https://bugs.webkit.org/show_bug.cgi?id=68567
  83
  84         Reviewed by Oliver Hunt.
  85
  86         Declared/defined the MethodTable struct and added it to the ClassInfo struct.
  87         Also defined the CREATE_METHOD_TABLE macro to generate these method tables
  88         succinctly where they need to be defined.
  89
  90         Also added to it the first function to use this macro, visitChildren.
  91
  92         This is part of the process of getting rid of all C++ virtual methods in JSCell.
  93         Eventually all virtual functions in JSCell that can't easily be converted to
  94         non-virtual functions will be put into this custom vtable structure.
  95         * runtime/ClassInfo.h:
  96
  97         Added the CREATE_METHOD_TABLE macro call as the last argument to each of the
  98         ClassInfo structs declared in these classes.  This saves us from having to visit
  99         each s_info definition in the future when we add more methods to the MethodTable.
 100         * API/JSCallbackConstructor.cpp:
 101         * API/JSCallbackFunction.cpp:
 102         * API/JSCallbackObject.cpp:
 103         * JavaScriptCore.exp:
 104         * runtime/Arguments.cpp:
 105         * runtime/ArrayConstructor.cpp:
 106         * runtime/ArrayPrototype.cpp:
 107         * runtime/BooleanObject.cpp:
 108         * runtime/BooleanPrototype.cpp:
 109         * runtime/DateConstructor.cpp:
 110         * runtime/DateInstance.cpp:
 111         * runtime/DatePrototype.cpp:
 112         * runtime/ErrorInstance.cpp:
 113         * runtime/ErrorPrototype.cpp:
 114         * runtime/ExceptionHelpers.cpp:
 115         * runtime/Executable.cpp:
 116         * runtime/GetterSetter.cpp:
 117         * runtime/InternalFunction.cpp:
 118         * runtime/JSAPIValueWrapper.cpp:
 119         * runtime/JSActivation.cpp:
 120         * runtime/JSArray.cpp:
 121         * runtime/JSByteArray.cpp:
 122         * runtime/JSFunction.cpp:
 123         * runtime/JSGlobalObject.cpp:
 124         * runtime/JSONObject.cpp:
 125         * runtime/JSObject.cpp:
 126         * runtime/JSPropertyNameIterator.cpp:
 127         * runtime/JSString.cpp:
 128         * runtime/MathObject.cpp:
 129         * runtime/NativeErrorConstructor.cpp:
 130         * runtime/NumberConstructor.cpp:
 131         * runtime/NumberObject.cpp:
 132         * runtime/NumberPrototype.cpp:
 133         * runtime/ObjectConstructor.cpp:
 134         * runtime/ObjectPrototype.cpp:
 135         * runtime/RegExp.cpp:
 136         * runtime/RegExpConstructor.cpp:
 137         * runtime/RegExpObject.cpp:
 138         * runtime/RegExpPrototype.cpp:
 139         * runtime/ScopeChain.cpp:
 140         * runtime/StringConstructor.cpp:
 141         * runtime/StringObject.cpp:
 142         * runtime/StringPrototype.cpp:
 143         * runtime/Structure.cpp:
 144         * runtime/StructureChain.cpp:
 145
 146         Had to make visitChildren and visitChildrenVirtual protected instead of private
 147         because some of the subclasses of JSWrapperObject need access to JSWrapperObject's
 148         visitChildren function pointer in their vtable since they don't provide their own
 149         implementation. Same for RegExpObject.
 150         * runtime/JSWrapperObject.h:
 151         * runtime/RegExpObject.h:
 152
 153 2011-09-25  Adam Barth  <abarth@webkit.org>
 154
 155         Finish removing PLATFORM(BREWMP) by removing associated code
 156         https://bugs.webkit.org/show_bug.cgi?id=68779
 157
 158         Reviewed by Sam Weinig.
 159
 160         * JavaScriptCore.gyp/JavaScriptCore.gyp:
 161         * JavaScriptCore.gypi:
 162         * gyp/JavaScriptCore.gyp:
 163         * wscript:
 164         * wtf/FastMalloc.cpp:
 165         (WTF::fastMallocSize):
 166         * wtf/Vector.h:
 167         * wtf/brew: Removed.
 168         * wtf/brew/MainThreadBrew.cpp: Removed.
 169         * wtf/brew/OwnPtrBrew.cpp: Removed.
 170         * wtf/brew/RefPtrBrew.h: Removed.
 171         * wtf/brew/ShellBrew.h: Removed.
 172         * wtf/brew/StringBrew.cpp: Removed.
 173         * wtf/brew/SystemMallocBrew.h: Removed.
 174         * wtf/unicode/brew: Removed.
 175         * wtf/unicode/brew/UnicodeBrew.cpp: Removed.
 176         * wtf/unicode/brew/UnicodeBrew.h: Removed.
 177
 178 2011-09-25  Filip Pizlo  <fpizlo@apple.com>
 179
 180         DFG JIT does not count speculation successes correctly
 181         https://bugs.webkit.org/show_bug.cgi?id=68785
 182
 183         Reviewed by Geoffrey Garen.
 184
 185         * dfg/DFGJITCompiler.cpp:
 186         (JSC::DFG::JITCompiler::compileEntry):
 187         (JSC::DFG::JITCompiler::compileBody):
 188         * dfg/DFGOperations.cpp:
 189
 190 2011-09-25  Filip Pizlo  <fpizlo@apple.com>
 191
 192         DFG support for op_resolve_global is not enabled
 193         https://bugs.webkit.org/show_bug.cgi?id=68786
 194
 195         Reviewed by Geoffrey Garen.
 196
 197         * dfg/DFGCapabilities.h:
 198         (JSC::DFG::canCompileOpcode):
 199
 200 2011-09-25  Filip Pizlo  <fpizlo@apple.com>
 201
 202         DFG static prediction code is no longer needed and should be removed
 203         https://bugs.webkit.org/show_bug.cgi?id=68784
 204
 205         Reviewed by Oliver Hunt.
 206
 207         This gets rid of static prediction code, and ensures that we do not
 208         try to compile code where dynamic predictions are not available.
 209         This is accomplished by immediately performing an OSR exit wherever
 210         a value is retrieved for which no predictions exist.
 211
 212         This also adds value profiling for this on functions used for calls.
 213
 214         The heuristics for deciding when to optimize code are also tweaked,
 215         since it is now profitable to optimize sooner. This may need to be
 216         tweaked further, but this patch only makes minimal changes.
 217
 218         This results in a 16% speed-up on Kraken/ai-astar, leading to a 3%
 219         overall win on Kraken.  It's neutral elsewhere.
 220
 221         * bytecode/CodeBlock.cpp:
 222         (JSC::CodeBlock::shouldOptimizeNow):
 223         (JSC::CodeBlock::dumpValueProfiles):
 224         * bytecode/CodeBlock.h:
 225         * bytecode/PredictedType.cpp:
 226         (JSC::predictionToString):
 227         * bytecode/PredictedType.h:
 228         (JSC::isCellPrediction):
 229         (JSC::isObjectPrediction):
 230         (JSC::isFinalObjectPrediction):
 231         (JSC::isStringPrediction):
 232         (JSC::isArrayPrediction):
 233         (JSC::isInt32Prediction):
 234         (JSC::isDoublePrediction):
 235         (JSC::isNumberPrediction):
 236         (JSC::isBooleanPrediction):
 237         (JSC::mergePredictions):
 238         * bytecode/PredictionTracker.h:
 239         (JSC::PredictionTracker::predictArgument):
 240         (JSC::PredictionTracker::predict):
 241         (JSC::PredictionTracker::predictGlobalVar):
 242         * bytecode/ValueProfile.cpp:
 243         (JSC::ValueProfile::computeUpdatedPrediction):
 244         * dfg/DFGByteCodeParser.cpp:
 245         (JSC::DFG::ByteCodeParser::set):
 246         (JSC::DFG::ByteCodeParser::addCall):
 247         (JSC::DFG::ByteCodeParser::getPrediction):
 248         (JSC::DFG::ByteCodeParser::parseBlock):
 249         * dfg/DFGGraph.cpp:
 250         (JSC::DFG::Graph::predictArgumentTypes):
 251         * dfg/DFGGraph.h:
 252         (JSC::DFG::Graph::predict):
 253         (JSC::DFG::Graph::predictGlobalVar):
 254         (JSC::DFG::Graph::getMethodCheckPrediction):
 255         (JSC::DFG::Graph::getJSConstantPrediction):
 256         (JSC::DFG::Graph::getPrediction):
 257         * dfg/DFGJITCodeGenerator.cpp:
 258         (JSC::DFG::JITCodeGenerator::writeBarrier):
 259         (JSC::DFG::JITCodeGenerator::emitBranch):
 260         * dfg/DFGJITCompiler.h:
 261         (JSC::DFG::JITCompiler::getPrediction):
 262         * dfg/DFGNode.h:
 263         (JSC::DFG::Node::valueOfJSConstantNode):
 264         (JSC::DFG::Node::isInt32Constant):
 265         (JSC::DFG::Node::isDoubleConstant):
 266         (JSC::DFG::Node::isNumberConstant):
 267         (JSC::DFG::Node::isBooleanConstant):
 268         (JSC::DFG::Node::predict):
 269         * dfg/DFGPropagator.cpp:
 270         (JSC::DFG::Propagator::Propagator):
 271         (JSC::DFG::Propagator::propagateNodePredictions):
 272         (JSC::DFG::Propagator::fixupNode):
 273         (JSC::DFG::Propagator::isPredictedNumerical):
 274         (JSC::DFG::Propagator::logicalNotIsPure):
 275         * dfg/DFGSpeculativeJIT.cpp:
 276         (JSC::DFG::SpeculativeJIT::compile):
 277         * dfg/DFGSpeculativeJIT.h:
 278         (JSC::DFG::SpeculativeJIT::shouldSpeculateInteger):
 279         (JSC::DFG::SpeculativeJIT::shouldSpeculateDouble):
 280         (JSC::DFG::SpeculativeJIT::shouldSpeculateNumber):
 281         (JSC::DFG::SpeculativeJIT::shouldNotSpeculateInteger):
 282         (JSC::DFG::SpeculativeJIT::shouldSpeculateFinalObject):
 283         (JSC::DFG::SpeculativeJIT::shouldSpeculateArray):
 284         (JSC::DFG::SpeculativeJIT::shouldSpeculateObject):
 285         (JSC::DFG::SpeculativeJIT::shouldSpeculateCell):
 286         * jit/JIT.cpp:
 287         (JSC::JIT::privateCompile):
 288
 289 2011-09-25  Filip Pizlo  <fpizlo@apple.com>
 290
 291         DFG JIT Construct opcode takes a this argument even though it's
 292         not passed
 293         https://bugs.webkit.org/show_bug.cgi?id=68782
 294
 295         Reviewed by Oliver Hunt.
 296
 297         This is performance-neutral, mostly. It's a slight speed-up on
 298         v8-splay.
 299
 300         * dfg/DFGByteCodeParser.cpp:
 301         (JSC::DFG::ByteCodeParser::addCall):
 302         * dfg/DFGJITCodeGenerator.cpp:
 303         (JSC::DFG::JITCodeGenerator::emitCall):
 304
 305 2011-09-25  Filip Pizlo  <fpizlo@apple.com>
 306
 307         DFG tracking of the value in cachedResultRegister does not handle
 308         op_mov correctly
 309         https://bugs.webkit.org/show_bug.cgi?id=68781
 310
 311         Reviewed by Oliver Hunt.
 312
 313         This takes the simplest approach: it makes the old JIT dumber rather
 314         than making the DFG JIT smarter. This is performance-neutral.
 315
 316         * jit/JIT.h:
 317         (JSC::JIT::canBeOptimized):
 318         * jit/JITOpcodes.cpp:
 319         (JSC::JIT::emit_op_mov):
 320
 321 2011-09-25  Adam Barth  <abarth@webkit.org>
 322
 323         Remove PLATFORM(HAIKU) and associated code
 324         https://bugs.webkit.org/show_bug.cgi?id=68774
 325
 326         Reviewed by Sam Weinig.
 327
 328         * JavaScriptCore.gyp/JavaScriptCore.gyp:
 329         * JavaScriptCore.gypi:
 330         * gyp/JavaScriptCore.gyp:
 331         * heap/MachineStackMarker.cpp:
 332         * wtf/PageAllocation.h:
 333         * wtf/Platform.h:
 334         * wtf/StackBounds.cpp:
 335         * wtf/haiku: Removed.
 336         * wtf/haiku/MainThreadHaiku.cpp: Removed.
 337         * wtf/haiku/StringHaiku.cpp: Removed.
 338         * wtf/text/WTFString.h:
 339
 340 2011-09-24  Adam Barth  <abarth@webkit.org>
 341
 342         Always enable ENABLE(OFFLINE_WEB_APPLICATIONS)
 343         https://bugs.webkit.org/show_bug.cgi?id=68767
 344
 345         Reviewed by Eric Seidel.
 346
 347         * Configurations/FeatureDefines.xcconfig:
 348
 349 2011-09-24  Filip Pizlo  <fpizlo@apple.com>
 350
 351         JIT implementation of put_by_val increments m_length instead of setting
 352         it to index+1
 353         https://bugs.webkit.org/show_bug.cgi?id=68766
 354
 355         Reviewed by Geoffrey Garen.
 356
 357         * jit/JITPropertyAccess.cpp:
 358         (JSC::JIT::emit_op_put_by_val):
 359
 360 2011-09-24  Geoffrey Garen  <ggaren@apple.com>
 361
 362         More build fixage.
 363
 364         * heap/ConservativeRoots.cpp: Our system of #includes, it is chaos.
 365
 366 2011-09-24  Filip Pizlo  <fpizlo@apple.com>
 367
 368         The DFG should not attempt to guess types in the absence of value
 369         profiles
 370         https://bugs.webkit.org/show_bug.cgi?id=68677
 371
 372         Reviewed by Oliver Hunt.
 373
 374         This adds the ForceOSRExit node, which is ignored by the propagator
 375         and virtual register allocator (and hence ensuring that liveness analysis
 376         works correctly), but forces terminateSpeculativeExecution() in the
 377         back-end. This appears to be a slight speed-up on benchmark averages,
 378         with ~5% swings on individual benchmarks, in both directions. But it's
 379         never a regression on any average, and appears to be a ~1% progression
 380         in the SunSpider average.
 381
 382         This also adds a bit better debugging support in the old JIT and in DFG,
 383         as this was necessary to debug the much more frequent OSR transitions
 384         that occur with this change.
 385
 386         * dfg/DFGByteCodeParser.cpp:
 387         (JSC::DFG::ByteCodeParser::addCall):
 388         (JSC::DFG::ByteCodeParser::getStrongPrediction):
 389         (JSC::DFG::ByteCodeParser::parseBlock):
 390         * dfg/DFGJITCompiler.cpp:
 391         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
 392         * dfg/DFGNode.h:
 393         * dfg/DFGPropagator.cpp:
 394         (JSC::DFG::Propagator::propagateNodePredictions):
 395         * dfg/DFGSpeculativeJIT.cpp:
 396         (JSC::DFG::SpeculativeJIT::compile):
 397         * jit/JIT.cpp:
 398         (JSC::JIT::privateCompileMainPass):
 399         (JSC::JIT::privateCompileSlowCases):
 400         (JSC::JIT::privateCompile):
 401         * jit/JIT.h:
 402
 403 2011-09-24  Geoffrey Garen  <ggaren@apple.com>
 404
 405         Some Windows build fixage.
 406
 407         * heap/MarkedBlock.cpp:
 408         (JSC::MarkedBlock::sweep):
 409         * heap/MarkedBlock.h:
 410         (JSC::MarkedBlock::isLive): Show the compiler that all control paths
 411         return a value. There, there, compiler. Everything's going to be OK.
 412
 413         * runtime/JSCell.h:
 414         (JSC::JSCell::setVPtr): Oops! Unrename this function.
 415
 416 2011-09-24  Geoffrey Garen  <ggaren@apple.com>
 417
 418         Allocate new objects unmarked
 419         https://bugs.webkit.org/show_bug.cgi?id=68764
 420
 421         Reviewed by Oliver Hunt.
 422
 423         This is a pre-requisite to using the mark bit to determine object age.
 424
 425         ~2% v8 speedup, mostly due to a 12% v8-splay speedup.
 426
 427         * heap/MarkedBlock.h:
 428         (JSC::MarkedBlock::isLive):
 429         (JSC::MarkedBlock::isLiveCell): These two functions are the reason for
 430         this patch. They can now determine object liveness without relying on
 431         newly allocated objects having their mark bits set. Each MarkedBlock
 432         now has a state variable that tells us how to determine whether its
 433         cells are live. (This new state variable supercedes the old one about
 434         destructor state. The rest of this patch is just refactoring to support
 435         the invariants of this new state variable without introducing a
 436         performance regression.)
 437
 438         (JSC::MarkedBlock::didConsumeFreeList): New function for updating interal
 439         state when a block becomes fully allocated.
 440
 441         (JSC::MarkedBlock::clearMarks): Folded a state change to 'Marked' into
 442         this function because, logically, clearing all mark bits is the first
 443         step in saying "mark bits now exactly reflect object liveness".
 444
 445         (JSC::MarkedBlock::markCountIsZero): Renamed from isEmpty() to clarify
 446         that this function only tells you about the mark bits, so it's only
 447         meaningful if you've put the mark bits into a meaningful state before
 448         calling it.
 449
 450         (JSC::MarkedBlock::forEachCell): Changed to use isLive() helper function
 451         instead of testing mark bits, since mark bits are not always the right
 452         way to find out if an object is live anymore. (New objects are live, but
 453         not marked.)
 454
 455         * heap/MarkedBlock.cpp:
 456         (JSC::MarkedBlock::recycle):
 457         (JSC::MarkedBlock::MarkedBlock): Folded all initialization -- even
 458         initialization when recycling an old block -- into the MarkedBlock
 459         constructor, for simplicity.
 460
 461         (JSC::MarkedBlock::callDestructor): Inlined for speed. Always check for
 462         a zapped cell before running a destructor, and always zap after
 463         running a destructor. This does not seem to be expensive, and the
 464         alternative just creates a too-confusing matrix of possible cell states
 465         ((zombie undestructed cell + zombie destructed cell + zapped destructed
 466         cell) * 5! permutations for progressing through block states = "Oh my!").
 467
 468         (JSC::MarkedBlock::specializedSweep):
 469         (JSC::MarkedBlock::sweep): Maintained and expanded a pre-existing
 470         optimization to use template specialization to constant fold lots of
 471         branches and elide certain operations entirely during a sweep. Merged
 472         four or five functions that were logically about sweeping into this one
 473         function pair, so there's only one way to do things now, it's
 474         automatically correct, and it's always fast.
 475
 476         (JSC::MarkedBlock::zapFreeList): Renamed this function to be more explicit
 477         about exactly what it does, and to honor the new block state system.
 478
 479         * heap/AllocationSpace.cpp:
 480         (JSC::AllocationSpace::allocateBlock): Updated for rename.
 481
 482         (JSC::AllocationSpace::freeBlocks): Updated for changed interface.
 483
 484         (JSC::TakeIfUnmarked::TakeIfUnmarked):
 485         (JSC::TakeIfUnmarked::operator()):
 486         (JSC::TakeIfUnmarked::returnValue): Just like isEmpty() above, renamed
 487         to clarify that this functor only tests the mark bits, so it's only
 488         valid if you've put the mark bits into a meaningful state before
 489         calling it.
 490
 491         (JSC::AllocationSpace::shrink): Updated for rename.
 492
 493         * heap/AllocationSpace.h:
 494         (JSC::AllocationSpace::canonicalizeCellLivenessData): Renamed to be a
 495         little more specific about what we're making canonical.
 496
 497         (JSC::AllocationSpace::forEachCell): Updated for rename.
 498
 499         (JSC::AllocationSpace::forEachBlock): No need to canonicalize cell
 500         liveness data before iterating blocks -- clients that want iterated
 501         blocks to have valid cell lieveness data should make this call for
 502         themselves. (And not all clients want it.)
 503
 504         * heap/ConservativeRoots.cpp:
 505         (JSC::ConservativeRoots::genericAddPointer): Updated for rename. Removed
 506         obsolete comment.
 507
 508         * heap/Heap.cpp:
 509         (JSC::CountFunctor::ClearMarks::operator()): Removed call to notify...()
 510         because clearMarks() now does that implicitly.
 511
 512         (JSC::Heap::destroy): Make sure to canonicalize before tear-down, since
 513         tear-down tests cell liveness when running destructors.
 514
 515         (JSC::Heap::markRoots):
 516         (JSC::Heap::collect): Moved weak reference harvesting out of markRoots()
 517         and into collect, since it strictly depends on root marking, and does
 518         not contribute to root marking.
 519
 520         (JSC::Heap::canonicalizeCellLivenessData): Renamed to be a little more
 521         specific about what we're making canonical.
 522
 523         * heap/Heap.h:
 524         (JSC::Heap::forEachProtectedCell): No need to canonicalize cell liveness
 525         data before iterating protected cells, since we know they're all live,
 526         and don't need to test for it.
 527
 528         * heap/Local.h:
 529         (JSC::::set): Can't make the same ASSERT we used to because we just don't
 530         have the mark bits for it anymore. Perhaps we can bring this ASSERT back
 531         in a weaker form in the future.
 532
 533         * heap/MarkedSpace.cpp:
 534         (JSC::MarkedSpace::addBlock):
 535         (JSC::MarkedSpace::removeBlock): Updated for interface change.
 536         (JSC::MarkedSpace::canonicalizeCellLivenessData): Renamed to be a little more
 537         specific about what we're making canonical.
 538
 539         * heap/MarkedSpace.h:
 540         (JSC::MarkedSpace::allocate):
 541         (JSC::MarkedSpace::SizeClass::SizeClass):
 542         (JSC::MarkedSpace::SizeClass::resetAllocator):
 543         (JSC::MarkedSpace::SizeClass::zapFreeList): Simplified this allocator
 544         functionality a bit. We now track only one block -- "currentBlock" --
 545         and rely on its internal state to know whether it has more cells to
 546         allocate.
 547
 548         * heap/Weak.h:
 549         (JSC::Weak::set): Can't make the same ASSERT we used to because we just don't
 550         have the mark bits for it anymore. Perhaps we can bring this ASSERT back
 551         in a weaker form in the future.
 552
 553         * runtime/JSCell.h:
 554         (JSC::JSCell::vptr):
 555         (JSC::JSCell::zap):
 556         (JSC::JSCell::isZapped):
 557         (JSC::isZapped): Made zapping a property of JSCell, for a little abstraction.
 558         In the future, exactly how a JSCell zaps itself will change, as the
 559         internal representation of JSCell changes.
 560
 561 2011-09-24  Filip Pizlo  <fpizlo@apple.com>
 562
 563         DFG JIT should not eagerly initialize integer tags in the register file
 564         https://bugs.webkit.org/show_bug.cgi?id=68763
 565
 566         Reviewed by Oliver Hunt.
 567
 568         * dfg/DFGJITCompiler.cpp:
 569         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
 570         * dfg/DFGSpeculativeJIT.cpp:
 571         (JSC::DFG::ValueRecovery::dump):
 572         (JSC::DFG::OSRExit::OSRExit):
 573         (JSC::DFG::SpeculativeJIT::compile):
 574         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
 575         * dfg/DFGSpeculativeJIT.h:
 576         (JSC::DFG::ValueRecovery::alreadyInRegisterFileAsUnboxedInt32):
 577         (JSC::DFG::OSRExit::operandForArgument):
 578         (JSC::DFG::OSRExit::operandForIndex):
 579         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
 580
 581 2011-09-23  Yuqiang Xian  <yuqiang.xian@intel.com>
 582
 583         Add JSVALUE32_64 support to DFG JIT
 584         https://bugs.webkit.org/show_bug.cgi?id=67460
 585
 586         Reviewed by Gavin Barraclough.
 587
 588         This is the initial attempt to add JSVALUE32_64 support to DFG JIT.
 589         It's tested on IA32 Linux EFL port currently. It still cannot run
 590         all the test cases and benchmarks so should be turned off now.
 591
 592         The major work includes:
 593         1) dealing with JSVALUE32_64 data format in DFG JIT;
 594         2) bindings between 64-bit JS Value and 32-bit registers;
 595         3) handling of function calls. Currently for DFG operation function
 596         calls we follow the X86 cdecl calling convention on Linux, and the
 597         implementation is in a naive way by pushing the arguments into stack
 598         one by one.
 599
 600         The known issues include:
 601         1) some code duplicates unnecessarily, especially in Speculative JIT
 602         code generation, where most of the operations on SpeculataInteger /
 603         SpeculateDouble should be identical to the JSVALUE64 code. Refactoring
 604         is needed in the future;
 605         2) lack of op_call and op_construct support, comparing to current
 606         JSVALUE64 DFG;
 607         3) currently integer speculations assume to be StrictInt32;
 608         4) lack of JSBoolean speculations;
 609         5) boxing and unboxing doubles could be improved;
 610         6) DFG X86 register description is different with the baseline JIT,
 611         the timeoutCheckRegister is used for general purpose usage;
 612         7) calls to runtime functions with primitive double parameters (e.g.
 613         fmod) don't work. Support needs to be added to the assembler to
 614         implement the mechanism of passing double parameters for X86 cdecl
 615         convention.
 616
 617         And there should be many other hidden bugs which should be exposed and
 618         resolved in later debugging process.
 619
 620         * CMakeListsEfl.txt:
 621         * assembler/MacroAssemblerX86.h:
 622         (JSC::MacroAssemblerX86::loadDouble):
 623         (JSC::MacroAssemblerX86::storeDouble):
 624         * assembler/X86Assembler.h:
 625         (JSC::X86Assembler::movsd_rm):
 626         * bytecode/StructureStubInfo.h:
 627         * dfg/DFGByteCodeParser.cpp:
 628         (JSC::DFG::ByteCodeParser::parseBlock):
 629         * dfg/DFGCapabilities.h:
 630         (JSC::DFG::canCompileOpcode):
 631         * dfg/DFGFPRInfo.h:
 632         (JSC::DFG::FPRInfo::debugName):
 633         * dfg/DFGGPRInfo.h:
 634         (JSC::DFG::GPRInfo::toRegister):
 635         (JSC::DFG::GPRInfo::toIndex):
 636         (JSC::DFG::GPRInfo::debugName):
 637         * dfg/DFGGenerationInfo.h:
 638         (JSC::DFG::needDataFormatConversion):
 639         (JSC::DFG::GenerationInfo::initJSValue):
 640         (JSC::DFG::GenerationInfo::initDouble):
 641         (JSC::DFG::GenerationInfo::gpr):
 642         (JSC::DFG::GenerationInfo::tagGPR):
 643         (JSC::DFG::GenerationInfo::payloadGPR):
 644         (JSC::DFG::GenerationInfo::fpr):
 645         (JSC::DFG::GenerationInfo::fillJSValue):
 646         (JSC::DFG::GenerationInfo::fillCell):
 647         (JSC::DFG::GenerationInfo::fillDouble):
 648         * dfg/DFGJITCodeGenerator.cpp:
 649         * dfg/DFGJITCodeGenerator.h:
 650         (JSC::DFG::JITCodeGenerator::allocate):
 651         (JSC::DFG::JITCodeGenerator::use):
 652         (JSC::DFG::JITCodeGenerator::registersMatched):
 653         (JSC::DFG::JITCodeGenerator::silentSpillGPR):
 654         (JSC::DFG::JITCodeGenerator::silentFillGPR):
 655         (JSC::DFG::JITCodeGenerator::silentFillFPR):
 656         (JSC::DFG::JITCodeGenerator::silentSpillAllRegisters):
 657         (JSC::DFG::JITCodeGenerator::silentFillAllRegisters):
 658         (JSC::DFG::JITCodeGenerator::boxDouble):
 659         (JSC::DFG::JITCodeGenerator::unboxDouble):
 660         (JSC::DFG::JITCodeGenerator::spill):
 661         (JSC::DFG::addressOfDoubleConstant):
 662         (JSC::DFG::integerResult):
 663         (JSC::DFG::jsValueResult):
 664         (JSC::DFG::setupResults):
 665         (JSC::DFG::callOperation):
 666         (JSC::JSValueOperand::JSValueOperand):
 667         (JSC::JSValueOperand::~JSValueOperand):
 668         (JSC::JSValueOperand::isDouble):
 669         (JSC::JSValueOperand::fill):
 670         (JSC::JSValueOperand::tagGPR):
 671         (JSC::JSValueOperand::payloadGPR):
 672         (JSC::JSValueOperand::fpr):
 673         (JSC::GPRTemporary::~GPRTemporary):
 674         (JSC::GPRTemporary::gpr):
 675         (JSC::GPRResult2::GPRResult2):
 676         * dfg/DFGJITCodeGenerator32_64.cpp: Added.
 677         (JSC::DFG::JITCodeGenerator::clearGenerationInfo):
 678         (JSC::DFG::JITCodeGenerator::fillInteger):
 679         (JSC::DFG::JITCodeGenerator::fillDouble):
 680         (JSC::DFG::JITCodeGenerator::fillJSValue):
 681         (JSC::DFG::JITCodeGenerator::fillStorage):
 682         (JSC::DFG::JITCodeGenerator::useChildren):
 683         (JSC::DFG::JITCodeGenerator::isStrictInt32):
 684         (JSC::DFG::JITCodeGenerator::isKnownInteger):
 685         (JSC::DFG::JITCodeGenerator::isKnownNumeric):
 686         (JSC::DFG::JITCodeGenerator::isKnownCell):
 687         (JSC::DFG::JITCodeGenerator::isKnownNotInteger):
 688         (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
 689         (JSC::DFG::JITCodeGenerator::isKnownBoolean):
 690         (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToNumber):
 691         (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
 692         (JSC::DFG::JITCodeGenerator::nonSpeculativeUInt32ToNumber):
 693         (JSC::DFG::JITCodeGenerator::nonSpeculativeKnownConstantArithOp):
 694         (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
 695         (JSC::DFG::JITCodeGenerator::nonSpeculativeArithMod):
 696         (JSC::DFG::JITCodeGenerator::nonSpeculativeCheckHasInstance):
 697         (JSC::DFG::JITCodeGenerator::nonSpeculativeInstanceOf):
 698         (JSC::DFG::JITCodeGenerator::cachedGetById):
 699         (JSC::DFG::JITCodeGenerator::writeBarrier):
 700         (JSC::DFG::JITCodeGenerator::cachedPutById):
 701         (JSC::DFG::JITCodeGenerator::cachedGetMethod):
 702         (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompareNull):
 703         (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranchNull):
 704         (JSC::DFG::JITCodeGenerator::nonSpeculativeCompareNull):
 705         (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
 706         (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
 707         (JSC::DFG::JITCodeGenerator::nonSpeculativeCompare):
 708         (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
 709         (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeStrictEq):
 710         (JSC::DFG::JITCodeGenerator::nonSpeculativeStrictEq):
 711         (JSC::DFG::JITCodeGenerator::emitBranch):
 712         (JSC::DFG::JITCodeGenerator::nonSpeculativeLogicalNot):
 713         (JSC::DFG::JITCodeGenerator::emitCall):
 714         (JSC::DFG::JITCodeGenerator::speculationCheck):
 715         (JSC::DFG::dataFormatString):
 716         (JSC::DFG::JITCodeGenerator::dump):
 717         (JSC::DFG::JITCodeGenerator::checkConsistency):
 718         (JSC::DFG::GPRTemporary::GPRTemporary):
 719         (JSC::DFG::FPRTemporary::FPRTemporary):
 720         * dfg/DFGJITCompiler.cpp:
 721         * dfg/DFGJITCompiler.h:
 722         (JSC::DFG::JITCompiler::tagForGlobalVar):
 723         (JSC::DFG::JITCompiler::payloadForGlobalVar):
 724         (JSC::DFG::JITCompiler::appendCallWithExceptionCheck):
 725         (JSC::DFG::JITCompiler::addressOfDoubleConstant):
 726         (JSC::DFG::JITCompiler::boxDouble):
 727         (JSC::DFG::JITCompiler::unboxDouble):
 728         (JSC::DFG::JITCompiler::addPropertyAccess):
 729         (JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord):
 730         * dfg/DFGJITCompiler32_64.cpp: Added.
 731         (JSC::DFG::JITCompiler::fillNumericToDouble):
 732         (JSC::DFG::JITCompiler::fillInt32ToInteger):
 733         (JSC::DFG::JITCompiler::fillToJS):
 734         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
 735         (JSC::DFG::JITCompiler::linkOSRExits):
 736         (JSC::DFG::JITCompiler::compileEntry):
 737         (JSC::DFG::JITCompiler::compileBody):
 738         (JSC::DFG::JITCompiler::link):
 739         (JSC::DFG::JITCompiler::compile):
 740         (JSC::DFG::JITCompiler::compileFunction):
 741         (JSC::DFG::JITCompiler::jitAssertIsInt32):
 742         (JSC::DFG::JITCompiler::jitAssertIsJSInt32):
 743         (JSC::DFG::JITCompiler::jitAssertIsJSNumber):
 744         (JSC::DFG::JITCompiler::jitAssertIsJSDouble):
 745         (JSC::DFG::JITCompiler::jitAssertIsCell):
 746         (JSC::DFG::JITCompiler::emitCount):
 747         (JSC::DFG::JITCompiler::setSamplingFlag):
 748         (JSC::DFG::JITCompiler::clearSamplingFlag):
 749         * dfg/DFGJITCompilerInlineMethods.h: Added.
 750         (JSC::DFG::JITCompiler::emitLoadTag):
 751         (JSC::DFG::JITCompiler::emitLoadPayload):
 752         (JSC::DFG::JITCompiler::emitLoad):
 753         (JSC::DFG::JITCompiler::emitLoad2):
 754         (JSC::DFG::JITCompiler::emitLoadDouble):
 755         (JSC::DFG::JITCompiler::emitLoadInt32ToDouble):
 756         (JSC::DFG::JITCompiler::emitStore):
 757         (JSC::DFG::JITCompiler::emitStoreInt32):
 758         (JSC::DFG::JITCompiler::emitStoreCell):
 759         (JSC::DFG::JITCompiler::emitStoreBool):
 760         (JSC::DFG::JITCompiler::emitStoreDouble):
 761         * dfg/DFGNode.h:
 762         * dfg/DFGOperations.cpp:
 763         * dfg/DFGRepatch.cpp:
 764         (JSC::DFG::generateProtoChainAccessStub):
 765         (JSC::DFG::tryCacheGetByID):
 766         (JSC::DFG::tryBuildGetByIDList):
 767         (JSC::DFG::tryCachePutByID):
 768         * dfg/DFGSpeculativeJIT.cpp:
 769         * dfg/DFGSpeculativeJIT.h:
 770         (JSC::DFG::ValueRecovery::inGPR):
 771         (JSC::DFG::ValueRecovery::inPair):
 772         (JSC::DFG::ValueRecovery::tagGPR):
 773         (JSC::DFG::ValueRecovery::payloadGPR):
 774         * dfg/DFGSpeculativeJIT32_64.cpp: Added.
 775         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
 776         (JSC::DFG::ValueSource::dump):
 777         (JSC::DFG::ValueRecovery::dump):
 778         (JSC::DFG::OSRExit::OSRExit):
 779         (JSC::DFG::OSRExit::dump):
 780         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
 781         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
 782         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
 783         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 784         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
 785         (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
 786         (JSC::DFG::SpeculativeJIT::convertToDouble):
 787         (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
 788         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
 789         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
 790         (JSC::DFG::SpeculativeJIT::compare):
 791         (JSC::DFG::SpeculativeJIT::compile):
 792         (JSC::DFG::SpeculativeJIT::compileMovHint):
 793         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
 794         (JSC::DFG::SpeculativeJIT::initializeVariableTypes):
 795         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
 796         * runtime/JSValue.h:
 797
 798 2011-09-23  Filip Pizlo  <fpizlo@apple.com>
 799
 800         wtf/BitVector.h has a variety of bugs which manifest when the
 801         vector grows beyond 63 bits
 802         https://bugs.webkit.org/show_bug.cgi?id=68746
 803
 804         Reviewed by Oliver Hunt.
 805
 806         Out-of-lined slow path code in BitVector so that not every user
 807         of CodeBlock ends up having to compile it. Fixed a variety of
 808         index computation and size computation bugs.
 809
 810         I have not seen these issues manifest themselves, but they are
 811         blocking a patch that uses BitVector more aggressively.
 812
 813         * GNUmakefile.list.am:
 814         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
 815         * JavaScriptCore.xcodeproj/project.pbxproj:
 816         * wtf/BitVector.cpp: Added.
 817         (BitVector::BitVector):
 818         (BitVector::operator=):
 819         (BitVector::resize):
 820         (BitVector::clearAll):
 821         (BitVector::OutOfLineBits::create):
 822         (BitVector::OutOfLineBits::destroy):
 823         (BitVector::resizeOutOfLine):
 824         * wtf/BitVector.h:
 825         (WTF::BitVector::ensureSize):
 826         (WTF::BitVector::get):
 827         (WTF::BitVector::set):
 828         (WTF::BitVector::clear):
 829         (WTF::BitVector::byteCount):
 830         (WTF::BitVector::OutOfLineBits::numWords):
 831         (WTF::BitVector::OutOfLineBits::bits):
 832         (WTF::BitVector::outOfLineBits):
 833         * wtf/CMakeLists.txt:
 834         * wtf/wtf.pri:
 835
 836 2011-09-23  Adam Klein  <adamk@chromium.org>
 837
 838         Add ENABLE_MUTATION_OBSERVERS feature flag
 839         https://bugs.webkit.org/show_bug.cgi?id=68732
 840
 841         Reviewed by Ojan Vafai.
 842
 843         This flag will guard an implementation of the "Mutation Observers" proposed in
 844         http://lists.w3.org/Archives/Public/public-webapps/2011JulSep/1622.html
 845
 846         * Configurations/FeatureDefines.xcconfig:
 847
 848 2011-09-23  Mark Hahnenberg  <mhahnenberg@apple.com>
 849
 850         De-virtualize JSCell::getJSNumber
 851         https://bugs.webkit.org/show_bug.cgi?id=68651
 852
 853         Reviewed by Oliver Hunt.
 854
 855         Added a new JSType to check whether or not something is a
 856         NumberObject (which includes NumberPrototype) in TypeInfo::isNumberObject because there's not
 857         currently a better way to determine whether something is indeed a NumberObject.
 858         Also de-virtualized JSCell::getJSNumber, having it check the TypeInfo
 859         for whether the object is a NumberObject or not.  This patch is part of
 860         the larger process of de-virtualizing JSCell.
 861
 862         * JavaScriptCore.exp:
 863         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 864         * runtime/JSCell.cpp:
 865         (JSC::JSCell::getJSNumber):
 866         * runtime/JSCell.h:
 867         (JSC::JSValue::getJSNumber):
 868         * runtime/JSType.h:
 869         * runtime/JSTypeInfo.h:
 870         (JSC::TypeInfo::isNumberObject):
 871         * runtime/JSValue.h:
 872         * runtime/NumberObject.cpp:
 873         (JSC::NumberObject::getJSNumber):
 874         * runtime/NumberObject.h:
 875         (JSC::NumberObject::createStructure):
 876         * runtime/NumberPrototype.h:
 877         (JSC::NumberPrototype::createStructure):
 878
 879 2011-09-23  Filip Pizlo  <fpizlo@apple.com>
 880
 881         Resolve opcodes should have value profiling.
 882         https://bugs.webkit.org/show_bug.cgi?id=68723
 883
 884         Reviewed by Oliver Hunt.
 885
 886         This adds value profiling to all forms of op_resolve in the
 887         old JIT, and patches that information into the DFG along with
 888         performing the appropriate type propagation.
 889
 890         * dfg/DFGByteCodeParser.cpp:
 891         (JSC::DFG::ByteCodeParser::parseBlock):
 892         * dfg/DFGGraph.h:
 893         (JSC::DFG::Graph::predict):
 894         * dfg/DFGNode.h:
 895         (JSC::DFG::Node::hasIdentifier):
 896         (JSC::DFG::Node::resolveGlobalDataIndex):
 897         (JSC::DFG::Node::hasPrediction):
 898         * dfg/DFGPropagator.cpp:
 899         (JSC::DFG::Propagator::propagateNodePredictions):
 900         * dfg/DFGSpeculativeJIT.cpp:
 901         (JSC::DFG::SpeculativeJIT::compile):
 902         * jit/JITOpcodes.cpp:
 903         (JSC::JIT::emit_op_resolve):
 904         (JSC::JIT::emit_op_resolve_base):
 905         (JSC::JIT::emit_op_resolve_skip):
 906         (JSC::JIT::emit_op_resolve_global):
 907         (JSC::JIT::emitSlow_op_resolve_global):
 908         (JSC::JIT::emit_op_resolve_with_base):
 909         (JSC::JIT::emit_op_resolve_with_this):
 910         (JSC::JIT::emitSlow_op_resolve_global_dynamic):
 911         * jit/JITStubCall.h:
 912         (JSC::JITStubCall::callWithValueProfiling):
 913
 914 2011-09-23  Oliver Hunt  <oliver@apple.com>
 915
 916         Fix windows build.
 917
 918         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 919
 920 2011-09-23  Gavin Barraclough  <barraclough@apple.com>
 921
 922         Strict mode does not work in non-trivial nested functions.
 923         https://bugs.webkit.org/show_bug.cgi?id=68740
 924
 925         Reviewed by Oliver Hunt.
 926
 927         Function-info caching does not preserve all state that it should.
 928
 929         * parser/JSParser.cpp:
 930         (JSC::JSParser::Scope::saveFunctionInfo):
 931         (JSC::JSParser::Scope::restoreFunctionInfo):
 932         (JSC::JSParser::parseFunctionInfo):
 933         * parser/SourceProviderCacheItem.h:
 934
 935 2011-09-23  Filip Pizlo  <fpizlo@apple.com>
 936
 937         ValueToDouble handling in prediction propagation should be ASSERT_NOT_REACHED
 938         https://bugs.webkit.org/show_bug.cgi?id=68724
 939
 940         Reviewed by Oliver Hunt.
 941
 942         * dfg/DFGPropagator.cpp:
 943         (JSC::DFG::Propagator::propagateNodePredictions):
 944
 945 2011-09-23  Oliver Hunt  <oliver@apple.com>
 946
 947         Build fix.
 948
 949         * JavaScriptCore.xcodeproj/project.pbxproj:
 950
 951 2011-09-23  Filip Pizlo  <fpizlo@apple.com>
 952
 953         DFG implementation of PutScopedVar corrupts register allocation
 954         https://bugs.webkit.org/show_bug.cgi?id=68735
 955
 956         Reviewed by Oliver Hunt.
 957
 958         * dfg/DFGSpeculativeJIT.cpp:
 959         (JSC::DFG::SpeculativeJIT::compile):
 960
 961 2011-09-23  Oliver Hunt  <oliver@apple.com>
 962
 963         Make write barriers actually do something when enabled
 964         https://bugs.webkit.org/show_bug.cgi?id=68717
 965
 966         Reviewed by Geoffrey Garen.
 967
 968         Add a basic card marking style write barrier to JSC (currently
 969         turned off).  This requires two scratch registers in the JIT
 970         so there was some register re-arranging to satisfy that requirement.
 971         Happily this produced a minor perf bump in sunspider (~0.5%).
 972
 973         Turning the barriers on causes an overall regression of around 1.5%
 974
 975         * JavaScriptCore.exp:
 976         * JavaScriptCore.xcodeproj/project.pbxproj:
 977         * assembler/MacroAssemblerX86Common.h:
 978         (JSC::MacroAssemblerX86Common::store8):
 979         * assembler/X86Assembler.h:
 980         (JSC::X86Assembler::movb_i8m):
 981         * dfg/DFGJITCodeGenerator.cpp:
 982         (JSC::DFG::JITCodeGenerator::isKnownNotCell):
 983         (JSC::DFG::JITCodeGenerator::writeBarrier):
 984         (JSC::DFG::JITCodeGenerator::markCellCard):
 985         (JSC::DFG::JITCodeGenerator::cachedPutById):
 986         * dfg/DFGJITCodeGenerator.h:
 987         * dfg/DFGRepatch.cpp:
 988         (JSC::DFG::tryCachePutByID):
 989         * dfg/DFGSpeculativeJIT.cpp:
 990         (JSC::DFG::SpeculativeJIT::compile):
 991         * heap/CardSet.h: Added.
 992         (JSC::CardSet::CardSet):
 993         (JSC::::cardForAtom):
 994         (JSC::::cardMarkedForAtom):
 995         (JSC::::markCardForAtom):
 996         * heap/Heap.cpp:
 997         * heap/Heap.h:
 998         (JSC::Heap::addressOfCardFor):
 999         (JSC::Heap::writeBarrierFastCase):
1000         * heap/MarkedBlock.h:
1001         (JSC::MarkedBlock::setDirtyObject):
1002         (JSC::MarkedBlock::addressOfCardFor):
1003         (JSC::MarkedBlock::offsetOfCards):
1004         * jit/JIT.h:
1005         * jit/JITPropertyAccess.cpp:
1006         (JSC::JIT::emit_op_put_by_val):
1007         (JSC::JIT::emit_op_put_by_id):
1008         (JSC::JIT::privateCompilePutByIdTransition):
1009         (JSC::JIT::emit_op_put_scoped_var):
1010         (JSC::JIT::emit_op_put_global_var):
1011         (JSC::JIT::emitWriteBarrier):
1012         * jit/JITPropertyAccess32_64.cpp:
1013         (JSC::JIT::emit_op_put_by_val):
1014         (JSC::JIT::emit_op_put_by_id):
1015         (JSC::JIT::emitSlow_op_put_by_id):
1016         (JSC::JIT::privateCompilePutByIdTransition):
1017         (JSC::JIT::emit_op_put_scoped_var):
1018         (JSC::JIT::emit_op_put_global_var):
1019
1020 2011-09-23  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
1021
1022         https://bugs.webkit.org/show_bug.cgi?id=68077
1023         SH4 assemblers doesn't refer to executable memory handle.
1024
1025         Reviewed by Gavin Barraclough.
1026
1027         * assembler/MacroAssemblerSH4.h:
1028         (JSC::MacroAssemblerSH4::branch8):
1029         * assembler/SH4Assembler.h:
1030         (JSC::SH4Assembler::executableCopy):
1031
1032 2011-09-23  Oliver Hunt  <oliver@apple.com>
1033
1034         PutScopedVar nodes should report that it has a var number
1035         https://bugs.webkit.org/show_bug.cgi?id=68721
1036
1037         Reviewed by Anders Carlsson.
1038
1039         Another assertion fix.
1040
1041         * dfg/DFGNode.h:
1042         (JSC::DFG::Node::hasVarNumber):
1043
1044 2011-09-23  Oliver Hunt  <oliver@apple.com>
1045
1046         Add a bunch of unhandled node types to the propagator
1047         https://bugs.webkit.org/show_bug.cgi?id=68716
1048
1049         Reviewed by Darin Adler.
1050
1051         Remove the ASSERT_NOT_REACHED() default for debug builds in the
1052         prediction propagator, this way unhandled nodes will just cause
1053         compile time failures rather than failing at some point in the
1054         future.
1055
1056         * dfg/DFGPropagator.cpp:
1057         (JSC::DFG::Propagator::propagateNodePredictions):
1058
1059 2011-09-23  Mark Hahnenberg  <mhahnenberg@apple.com>
1060
1061         Add static version of JSCell::visitChildren
1062         https://bugs.webkit.org/show_bug.cgi?id=68404
1063
1064         Reviewed by Darin Adler.
1065
1066         In this patch we just extract the bodies of the virtual visitChildren methods
1067         throughout the JSCell inheritance hierarchy out into static methods, which are
1068         now called from the virtual methods.  This is an intermediate step in trying to
1069         move the virtual-ness of visitChildren into our own custom vtable stored in
1070         ClassInfo.  We need to convert the methods to static methods in order to be
1071         able to more easily store and refer to them in our custom vtable since normal
1072         member methods store some implicit information in their types, making it
1073         impossible to store them generically in ClassInfo.
1074
1075         * API/JSCallbackObject.h:
1076         (JSC::JSCallbackObject::visitChildrenVirtual):
1077         (JSC::JSCallbackObject::visitChildren):
1078         * JavaScriptCore.exp:
1079         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1080         * debugger/DebuggerActivation.cpp:
1081         (JSC::DebuggerActivation::visitChildrenVirtual):
1082         (JSC::DebuggerActivation::visitChildren):
1083         * debugger/DebuggerActivation.h:
1084         * heap/MarkStack.cpp:
1085         (JSC::SlotVisitor::visitChildren):
1086         (JSC::SlotVisitor::drain):
1087         * runtime/Arguments.cpp:
1088         (JSC::Arguments::visitChildrenVirtual):
1089         (JSC::Arguments::visitChildren):
1090         * runtime/Arguments.h:
1091         * runtime/Executable.cpp:
1092         (JSC::EvalExecutable::visitChildrenVirtual):
1093         (JSC::EvalExecutable::visitChildren):
1094         (JSC::ProgramExecutable::visitChildrenVirtual):
1095         (JSC::ProgramExecutable::visitChildren):
1096         (JSC::FunctionExecutable::visitChildrenVirtual):
1097         (JSC::FunctionExecutable::visitChildren):
1098         * runtime/Executable.h:
1099         * runtime/GetterSetter.cpp:
1100         (JSC::GetterSetter::visitChildrenVirtual):
1101         (JSC::GetterSetter::visitChildren):
1102         * runtime/GetterSetter.h:
1103         * runtime/JSActivation.cpp:
1104         (JSC::JSActivation::visitChildrenVirtual):
1105         (JSC::JSActivation::visitChildren):
1106         * runtime/JSActivation.h:
1107         * runtime/JSArray.cpp:
1108         (JSC::JSArray::visitChildrenVirtual):
1109         (JSC::JSArray::visitChildren):
1110         * runtime/JSArray.h:
1111         * runtime/JSBoundFunction.cpp:
1112         (JSC::JSBoundFunction::visitChildrenVirtual):
1113         (JSC::JSBoundFunction::visitChildren):
1114         * runtime/JSBoundFunction.h:
1115         * runtime/JSCell.h:
1116         (JSC::JSCell::visitChildrenVirtual):
1117         (JSC::JSCell::visitChildren):
1118         * runtime/JSFunction.cpp:
1119         (JSC::JSFunction::visitChildrenVirtual):
1120         (JSC::JSFunction::visitChildren):
1121         * runtime/JSFunction.h:
1122         * runtime/JSGlobalObject.cpp:
1123         (JSC::JSGlobalObject::visitChildrenVirtual):
1124         (JSC::JSGlobalObject::visitChildren):
1125         * runtime/JSGlobalObject.h:
1126         * runtime/JSObject.cpp:
1127         (JSC::JSObject::visitChildrenVirtual):
1128         (JSC::JSObject::visitChildren):
1129         * runtime/JSObject.h:
1130         (JSC::JSObject::visitChildrenDirect):
1131         * runtime/JSPropertyNameIterator.cpp:
1132         (JSC::JSPropertyNameIterator::visitChildrenVirtual):
1133         (JSC::JSPropertyNameIterator::visitChildren):
1134         * runtime/JSPropertyNameIterator.h:
1135         * runtime/JSStaticScopeObject.cpp:
1136         (JSC::JSStaticScopeObject::visitChildrenVirtual):
1137         (JSC::JSStaticScopeObject::visitChildren):
1138         * runtime/JSStaticScopeObject.h:
1139         * runtime/JSWrapperObject.cpp:
1140         (JSC::JSWrapperObject::visitChildrenVirtual):
1141         (JSC::JSWrapperObject::visitChildren):
1142         * runtime/JSWrapperObject.h:
1143         * runtime/NativeErrorConstructor.cpp:
1144         (JSC::NativeErrorConstructor::visitChildrenVirtual):
1145         (JSC::NativeErrorConstructor::visitChildren):
1146         * runtime/NativeErrorConstructor.h:
1147         * runtime/RegExpObject.cpp:
1148         (JSC::RegExpObject::visitChildrenVirtual):
1149         (JSC::RegExpObject::visitChildren):
1150         * runtime/RegExpObject.h:
1151         * runtime/ScopeChain.cpp:
1152         (JSC::ScopeChainNode::visitChildrenVirtual):
1153         (JSC::ScopeChainNode::visitChildren):
1154         * runtime/ScopeChain.h:
1155         * runtime/Structure.cpp:
1156         (JSC::Structure::visitChildrenVirtual):
1157         (JSC::Structure::visitChildren):
1158         * runtime/Structure.h:
1159         * runtime/StructureChain.cpp:
1160         (JSC::StructureChain::visitChildrenVirtual):
1161         (JSC::StructureChain::visitChildren):
1162         * runtime/StructureChain.h:
1163
1164 2011-09-23  Oliver Hunt  <oliver@apple.com>
1165
1166         Node propagation doesn't handle PutScopedVar
1167         https://bugs.webkit.org/show_bug.cgi?id=68713
1168
1169         Reviewed by Sam Weinig.
1170
1171         This was causing assertion failures.
1172
1173         * dfg/DFGPropagator.cpp:
1174         (JSC::DFG::Propagator::propagateNodePredictions):
1175
1176 2011-09-23  Anders Carlsson  <andersca@apple.com>
1177
1178         Make sure to define OVERRIDE and FINAL for older builds of clang.
1179
1180         * wtf/Compiler.h:
1181
1182 2011-09-23  Gavin Barraclough  <barraclough@apple.com>
1183
1184         Implement op_resolve_global in the DFG JIT
1185         https://bugs.webkit.org/show_bug.cgi?id=68704
1186
1187         Reviewed by Oliver Hunt.
1188
1189         This is performance neutral, but increases coverage.
1190
1191         * dfg/DFGByteCodeParser.cpp:
1192         (JSC::DFG::ByteCodeParser::ByteCodeParser):
1193         (JSC::DFG::ByteCodeParser::parseBlock):
1194         * dfg/DFGNode.h:
1195         (JSC::DFG::Node::hasIdentifier):
1196         (JSC::DFG::Node::resolveInfoIndex):
1197         * dfg/DFGOperations.cpp:
1198         * dfg/DFGOperations.h:
1199         * dfg/DFGSpeculativeJIT.cpp:
1200         (JSC::DFG::SpeculativeJIT::compile):
1201
1202 2011-09-23  Mark Rowe  <mrowe@apple.com>
1203
1204         Define BUILDING_ON_LION / TARGETING_LION when appropriate in Platform.h.
1205
1206         * wtf/Platform.h:
1207
1208 2011-09-22  Anders Carlsson  <andersca@apple.com>
1209
1210         We should add support for OVERRIDE and FINAL annotations
1211         https://bugs.webkit.org/show_bug.cgi?id=68654
1212
1213         Reviewed by David Hyatt.
1214
1215         Add OVERRIDE and FINAL macros for compilers that support them.
1216
1217         * wtf/Compiler.h:
1218
1219 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1220
1221         GetScopedVar should have value profiling
1222         https://bugs.webkit.org/show_bug.cgi?id=68676
1223
1224         Reviewed by Oliver Hunt.
1225
1226         Added GetScopedVar value profiling and predictin propagation.
1227         Added GetScopeChain to CSE.
1228
1229         * dfg/DFGByteCodeParser.cpp:
1230         (JSC::DFG::ByteCodeParser::parseBlock):
1231         * dfg/DFGGraph.h:
1232         (JSC::DFG::Graph::predict):
1233         * dfg/DFGNode.h:
1234         (JSC::DFG::Node::hasPrediction):
1235         * dfg/DFGPropagator.cpp:
1236         (JSC::DFG::Propagator::propagateNodePredictions):
1237         (JSC::DFG::Propagator::getScopeChainLoadElimination):
1238         (JSC::DFG::Propagator::performNodeCSE):
1239         * jit/JITPropertyAccess.cpp:
1240         (JSC::JIT::emit_op_get_scoped_var):
1241
1242 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1243
1244         PPC build fix, part 3.
1245
1246         * runtime/Executable.cpp:
1247         (JSC::FunctionExecutable::compileForConstructInternal):
1248
1249 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1250
1251         Another PPC build fix.
1252
1253         * runtime/Executable.cpp:
1254         * runtime/Executable.h:
1255
1256 2011-09-22  Dean Jackson  <dino@apple.com>
1257
1258         Add ENABLE_CSS_FILTERS
1259         https://bugs.webkit.org/show_bug.cgi?id=68652
1260
1261         Reviewed by Simon Fraser.
1262
1263         * Configurations/FeatureDefines.xcconfig:
1264
1265 2011-09-22  Gavin Barraclough  <barraclough@apple.com>
1266
1267         Incorrect this value passed to callbacks.
1268         https://bugs.webkit.org/show_bug.cgi?id=68668
1269
1270         Reviewed by Oliver Hunt.
1271
1272         From Array/String prototype function.  Should be undefined, but
1273         global object is passed instead (this is visible for strict callbacks).
1274
1275         * runtime/ArrayPrototype.cpp:
1276         (JSC::arrayProtoFuncSort):
1277         (JSC::arrayProtoFuncFilter):
1278         (JSC::arrayProtoFuncMap):
1279         (JSC::arrayProtoFuncEvery):
1280         (JSC::arrayProtoFuncForEach):
1281         (JSC::arrayProtoFuncSome):
1282         * runtime/JSArray.cpp:
1283         (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
1284         (JSC::JSArray::sort):
1285         * runtime/StringPrototype.cpp:
1286         (JSC::stringProtoFuncReplace):
1287
1288 2011-09-22  Gavin Barraclough  <barraclough@apple.com>
1289
1290         Function.prototype.bind.length shoudl be 1.
1291
1292         Rubber stamped by Olier Hunt.
1293
1294         * runtime/FunctionPrototype.cpp:
1295         (JSC::FunctionPrototype::addFunctionProperties):
1296
1297 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1298
1299         PPC build fix.
1300
1301         * bytecode/CodeBlock.h:
1302
1303 2011-09-22  Gavin Barraclough  <barraclough@apple.com>
1304
1305         Windows build fix pt. 2
1306
1307         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1308
1309 2011-09-22  Gavin Barraclough  <barraclough@apple.com>
1310
1311         Windows build fix pt. 1
1312
1313         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1314
1315 2011-09-21  Filip Pizlo  <fpizlo@apple.com>
1316
1317         DFG JIT does not support to_primitive or strcat
1318         https://bugs.webkit.org/show_bug.cgi?id=68582
1319
1320         Reviewed by Darin Adler.
1321
1322         This adds functional support for to_primitive and strcat. It focuses
1323         on minimizing the amount of code emitted on to_primitive (if we know
1324         that it is a primitive or can speculate cheaply, then we omit the
1325         slow path) and on keeping the implementation of strcat simple while
1326         leveraging whatever optimizations we have already. In particular,
1327         unlike the Call and Construct nodes which require extending the size
1328         of the DFG's callee registers, StrCat takes advantage of the fact
1329         that no JS code can run while StrCat is in progress and uses a
1330         scratch buffer, rather than the register file, to store the list of
1331         values to concatenate. This was done mainly to keep the code simple,
1332         but there are probably other benefits to keeping call frame sizes
1333         down. Essentially, this patch ensures that the presence of an
1334         op_strcat does not mess up any other optimizations we might do while
1335         ensuring that if you do execute it, it'll work about as well as you'd
1336         expect.
1337
1338         When combined with the previous patch for integer division, this is a
1339         14% speed-up on Kraken. Without it, it would have been a 2% loss.
1340
1341         * assembler/AbstractMacroAssembler.h:
1342         (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
1343         * dfg/DFGByteCodeParser.cpp:
1344         (JSC::DFG::ByteCodeParser::parseBlock):
1345         * dfg/DFGCapabilities.h:
1346         (JSC::DFG::canCompileOpcode):
1347         * dfg/DFGJITCodeGenerator.h:
1348         (JSC::DFG::JITCodeGenerator::callOperation):
1349         * dfg/DFGJITCompiler.cpp:
1350         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
1351         * dfg/DFGNode.h:
1352         * dfg/DFGOperations.cpp:
1353         * dfg/DFGOperations.h:
1354         * dfg/DFGPropagator.cpp:
1355         (JSC::DFG::Propagator::propagateNodePredictions):
1356         (JSC::DFG::Propagator::performNodeCSE):
1357         * dfg/DFGSpeculativeJIT.cpp:
1358         (JSC::DFG::SpeculativeJIT::compile):
1359         * runtime/JSGlobalData.cpp:
1360         (JSC::JSGlobalData::JSGlobalData):
1361         (JSC::JSGlobalData::~JSGlobalData):
1362         * runtime/JSGlobalData.h:
1363         (JSC::JSGlobalData::scratchBufferForSize):
1364
1365 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1366
1367         DFG JIT should support integer division
1368         https://bugs.webkit.org/show_bug.cgi?id=68597
1369
1370         Reviewed by Darin Adler.
1371
1372         This adds support for ArithDiv speculating integer, and speculating
1373         that the result is integer (i.e. remainder = 0).
1374
1375         This is a 4% win on Kraken and a 1% loss on V8.
1376
1377         * bytecode/CodeBlock.h:
1378         * dfg/DFGByteCodeParser.cpp:
1379         (JSC::DFG::ByteCodeParser::makeDivSafe):
1380         (JSC::DFG::ByteCodeParser::parseBlock):
1381         * dfg/DFGNode.h:
1382         (JSC::DFG::Node::hasArithNodeFlags):
1383         * dfg/DFGPropagator.cpp:
1384         (JSC::DFG::Propagator::propagateArithNodeFlags):
1385         (JSC::DFG::Propagator::propagateNodePredictions):
1386         (JSC::DFG::Propagator::fixupNode):
1387         * dfg/DFGSpeculativeJIT.cpp:
1388         (JSC::DFG::SpeculativeJIT::compile):
1389         * jit/JITArithmetic.cpp:
1390         (JSC::JIT::emit_op_div):
1391
1392 2011-09-22  Oliver Hunt  <oliver@apple.com>
1393
1394         Implement put_scoped_var in the DFG jit
1395         https://bugs.webkit.org/show_bug.cgi?id=68653
1396
1397         Reviewed by Gavin Barraclough.
1398
1399         Naive implementation of put_scoped_var.  Same story as the
1400         get_scoped_var implementation, although I've hoisted scope
1401         object acquisition into a separate dfg node.  Ideally in the
1402         future we would reuse the resolved scope chain object, but
1403         for now we don't.
1404
1405         * dfg/DFGByteCodeParser.cpp:
1406         (JSC::DFG::ByteCodeParser::parseBlock):
1407         * dfg/DFGCapabilities.h:
1408         (JSC::DFG::canCompileOpcode):
1409         * dfg/DFGNode.h:
1410         (JSC::DFG::Node::hasScopeChainDepth):
1411         (JSC::DFG::Node::scopeChainDepth):
1412         * dfg/DFGPropagator.cpp:
1413         (JSC::DFG::Propagator::propagateNodePredictions):
1414         * dfg/DFGSpeculativeJIT.cpp:
1415         (JSC::DFG::SpeculativeJIT::compile):
1416
1417 2011-09-22  Gavin Barraclough  <barraclough@apple.com>
1418
1419         Implement Function.prototype.bind
1420         https://bugs.webkit.org/show_bug.cgi?id=26382
1421
1422         Reviewed by Sam Weinig.
1423
1424         This patch provides a basic functional implementation
1425         for Function.bind. It should (hopefully!) be fully
1426         functionally correct, and the bound functions can be
1427         called to quickly (since they are a subclass of
1428         JSFunction, not InternalFunction), but we'll probably
1429         want to follow up with some optimization work to keep
1430         bound calls in JIT code.
1431
1432         * JavaScriptCore.JSVALUE32_64only.exp:
1433         * JavaScriptCore.JSVALUE64only.exp:
1434         * JavaScriptCore.exp:
1435         * JavaScriptCore.xcodeproj/project.pbxproj:
1436         * jit/JITStubs.cpp:
1437         (JSC::JITThunks::hostFunctionStub):
1438         * jit/JITStubs.h:
1439         * jsc.cpp:
1440         (GlobalObject::addFunction):
1441         * runtime/CommonIdentifiers.h:
1442         * runtime/ConstructData.h:
1443         * runtime/Executable.h:
1444         (JSC::NativeExecutable::NativeExecutable):
1445         * runtime/FunctionPrototype.cpp:
1446         (JSC::FunctionPrototype::addFunctionProperties):
1447         (JSC::functionProtoFuncBind):
1448         * runtime/FunctionPrototype.h:
1449         * runtime/JSBoundFunction.cpp: Added.
1450         (JSC::boundFunctionCall):
1451         (JSC::boundFunctionConstruct):
1452         (JSC::JSBoundFunction::create):
1453         (JSC::JSBoundFunction::hasInstance):
1454         (JSC::JSBoundFunction::getOwnPropertySlot):
1455         (JSC::JSBoundFunction::getOwnPropertyDescriptor):
1456         (JSC::JSBoundFunction::JSBoundFunction):
1457         (JSC::JSBoundFunction::finishCreation):
1458         * runtime/JSBoundFunction.h: Added.
1459         (JSC::JSBoundFunction::targetFunction):
1460         (JSC::JSBoundFunction::boundThis):
1461         (JSC::JSBoundFunction::boundArgs):
1462         (JSC::JSBoundFunction::createStructure):
1463         * runtime/JSFunction.cpp:
1464         (JSC::JSFunction::create):
1465         (JSC::JSFunction::finishCreation):
1466         (JSC::createDescriptorForThrowingProperty):
1467         (JSC::JSFunction::getOwnPropertySlot):
1468         * runtime/JSFunction.h:
1469         * runtime/JSGlobalData.cpp:
1470         (JSC::JSGlobalData::getHostFunction):
1471         * runtime/JSGlobalData.h:
1472         * runtime/JSGlobalObject.cpp:
1473         (JSC::JSGlobalObject::reset):
1474         (JSC::JSGlobalObject::visitChildren):
1475         * runtime/JSGlobalObject.h:
1476         (JSC::JSGlobalObject::boundFunctionStructure):
1477         * runtime/Lookup.cpp:
1478         (JSC::setUpStaticFunctionSlot):
1479
1480 2011-09-22  Oliver Hunt  <oliver@apple.com>
1481
1482         Implement get_scoped_var in the DFG
1483         https://bugs.webkit.org/show_bug.cgi?id=68640
1484
1485         Reviewed by Gavin Barraclough.
1486
1487         Naive implementation of get_scoped_var in the DFG.  Essentially this
1488         is the bare minimum required to get correct behaviour, so there's no
1489         load/store coalescing or type profiling involved, even though these
1490         would be wins.  No impact on SunSpider or V8.
1491
1492         * dfg/DFGByteCodeParser.cpp:
1493         (JSC::DFG::ByteCodeParser::parseBlock):
1494         * dfg/DFGCapabilities.h:
1495         (JSC::DFG::canCompileOpcode):
1496         * dfg/DFGNode.h:
1497         (JSC::DFG::Node::hasVarNumber):
1498         (JSC::DFG::Node::hasScopeChainDepth):
1499         (JSC::DFG::Node::scopeChainDepth):
1500         * dfg/DFGPropagator.cpp:
1501         (JSC::DFG::Propagator::propagateNodePredictions):
1502         * dfg/DFGSpeculativeJIT.cpp:
1503         (JSC::DFG::SpeculativeJIT::compile):
1504
1505 2011-09-22  Adam Roben  <aroben@apple.com>
1506
1507         Remove FindSafari from all our .sln files
1508
1509         It isn't used anymore, so there's no point in building it.
1510
1511         Part of <http://webkit.org/b/68628> Remove FindSafari
1512
1513         Reviewed by Steve Falkenburg.
1514
1515         * JavaScriptCore.vcproj/JavaScriptCore.sln:
1516
1517 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1518
1519         32-bit call code clobbers the function cell tag
1520         https://bugs.webkit.org/show_bug.cgi?id=68606
1521
1522         Reviewed by Csaba Osztrogonác.
1523
1524         This is a minimalistic fix: it simply emits code to restore the
1525         cell tag on the slow path, if we know that we failed due to
1526         emitCallIfNotType.
1527
1528         * jit/JITCall32_64.cpp:
1529         (JSC::JIT::compileOpCallVarargsSlowCase):
1530         (JSC::JIT::compileOpCallSlowCase):
1531
1532 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1533
1534         Add missing addPtr->add32 mapping for X86.
1535
1536         Rubber stamped by Sam Weinig.
1537
1538         * assembler/MacroAssembler.h:
1539         (JSC::MacroAssembler::addPtr):
1540
1541 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1542
1543         Add missing addDouble for AbsoluteAddress to X86
1544
1545         Rubber stamped by Geoff Garen.
1546
1547         * assembler/MacroAssemblerX86.h:
1548         (JSC::MacroAssemblerX86::addDouble):
1549         * assembler/X86Assembler.h:
1550         (JSC::X86Assembler::addsd_mr):
1551         (JSC::X86Assembler::cvtsi2sd_rr):
1552         (JSC::X86Assembler::cvtsi2sd_mr):
1553
1554 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1555
1556         Build fix following fix for bug #68586.
1557
1558         * jit/JIT.cpp:
1559         * jit/JITInlineMethods.h:
1560
1561 2011-09-21  Filip Pizlo  <fpizlo@apple.com>
1562
1563         DFG JIT should be able to compile op_throw
1564         https://bugs.webkit.org/show_bug.cgi?id=68571
1565
1566         Reviewed by Geoffrey Garen.
1567
1568         This compiles op_throw in the simplest way possible: it's an OSR
1569         point back to the old JIT. This is a good step towards increasing
1570         coverage, particularly on Kraken, but it's neutral because the
1571         same functions that do throw also use some other unsupported
1572         opcodes.
1573
1574         * dfg/DFGByteCodeParser.cpp:
1575         (JSC::DFG::ByteCodeParser::parseBlock):
1576         * dfg/DFGCapabilities.h:
1577         (JSC::DFG::canCompileOpcode):
1578         * dfg/DFGNode.h:
1579         * dfg/DFGPropagator.cpp:
1580         (JSC::DFG::Propagator::propagateNodePredictions):
1581         * dfg/DFGSpeculativeJIT.cpp:
1582         (JSC::DFG::SpeculativeJIT::compile):
1583
1584 2011-09-21  Filip Pizlo  <fpizlo@apple.com>
1585
1586         DFG should support continuous optimization
1587         https://bugs.webkit.org/show_bug.cgi?id=68329
1588
1589         Reviewed by Geoffrey Garen.
1590
1591         This adds the ability to reoptimize a code block if speculation
1592         failures happen frequently. 6% speed-up on Kraken, 1% slow-down
1593         on V8, neutral on SunSpider.
1594
1595         * CMakeLists.txt:
1596         * GNUmakefile.list.am:
1597         * JavaScriptCore.pro:
1598         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1599         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
1600         * JavaScriptCore.xcodeproj/project.pbxproj:
1601         * bytecode/CodeBlock.cpp:
1602         (JSC::CodeBlock::CodeBlock):
1603         (JSC::ProgramCodeBlock::jettison):
1604         (JSC::EvalCodeBlock::jettison):
1605         (JSC::FunctionCodeBlock::jettison):
1606         (JSC::CodeBlock::shouldOptimizeNow):
1607         (JSC::CodeBlock::dumpValueProfiles):
1608         * bytecode/CodeBlock.h:
1609         * dfg/DFGByteCodeParser.cpp:
1610         (JSC::DFG::ByteCodeParser::getStrongPrediction):
1611         * dfg/DFGJITCompiler.cpp:
1612         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
1613         (JSC::DFG::JITCompiler::compileEntry):
1614         (JSC::DFG::JITCompiler::compileBody):
1615         * dfg/DFGJITCompiler.h:
1616         (JSC::DFG::JITCompiler::noticeOSREntry):
1617         * dfg/DFGOSREntry.cpp:
1618         (JSC::DFG::prepareOSREntry):
1619         * dfg/DFGOSREntry.h:
1620         (JSC::DFG::getOSREntryDataBytecodeIndex):
1621         * dfg/DFGSpeculativeJIT.cpp:
1622         (JSC::DFG::SpeculativeJIT::compile):
1623         * heap/ConservativeRoots.cpp:
1624         (JSC::ConservativeRoots::ConservativeRoots):
1625         (JSC::ConservativeRoots::~ConservativeRoots):
1626         (JSC::DummyMarkHook::mark):
1627         (JSC::ConservativeRoots::genericAddPointer):
1628         (JSC::ConservativeRoots::genericAddSpan):
1629         (JSC::ConservativeRoots::add):
1630         * heap/ConservativeRoots.h:
1631         * heap/Heap.cpp:
1632         (JSC::Heap::addJettisonCodeBlock):
1633         (JSC::Heap::markRoots):
1634         * heap/Heap.h:
1635         * heap/JettisonedCodeBlocks.cpp: Added.
1636         (JSC::JettisonedCodeBlocks::JettisonedCodeBlocks):
1637         (JSC::JettisonedCodeBlocks::~JettisonedCodeBlocks):
1638         (JSC::JettisonedCodeBlocks::addCodeBlock):
1639         (JSC::JettisonedCodeBlocks::clearMarks):
1640         (JSC::JettisonedCodeBlocks::deleteUnmarkedCodeBlocks):
1641         (JSC::JettisonedCodeBlocks::traceCodeBlocks):
1642         * heap/JettisonedCodeBlocks.h: Added.
1643         (JSC::JettisonedCodeBlocks::mark):
1644         * interpreter/RegisterFile.cpp:
1645         (JSC::RegisterFile::gatherConservativeRoots):
1646         * interpreter/RegisterFile.h:
1647         * jit/JITStubs.cpp:
1648         (JSC::DEFINE_STUB_FUNCTION):
1649         * runtime/Executable.cpp:
1650         (JSC::jettisonCodeBlock):
1651         (JSC::EvalExecutable::jettisonOptimizedCode):
1652         (JSC::ProgramExecutable::jettisonOptimizedCode):
1653         (JSC::FunctionExecutable::jettisonOptimizedCodeForCall):
1654         (JSC::FunctionExecutable::jettisonOptimizedCodeForConstruct):
1655         * runtime/Executable.h:
1656         (JSC::FunctionExecutable::jettisonOptimizedCodeFor):
1657         * wtf/BitVector.h: Added.
1658         (WTF::BitVector::BitVector):
1659         (WTF::BitVector::~BitVector):
1660         (WTF::BitVector::operator=):
1661         (WTF::BitVector::size):
1662         (WTF::BitVector::ensureSize):
1663         (WTF::BitVector::resize):
1664         (WTF::BitVector::clearAll):
1665         (WTF::BitVector::get):
1666         (WTF::BitVector::set):
1667         (WTF::BitVector::clear):
1668         (WTF::BitVector::bitsInPointer):
1669         (WTF::BitVector::maxInlineBits):
1670         (WTF::BitVector::byteCount):
1671         (WTF::BitVector::makeInlineBits):
1672         (WTF::BitVector::OutOfLineBits::numBits):
1673         (WTF::BitVector::OutOfLineBits::numWords):
1674         (WTF::BitVector::OutOfLineBits::bits):
1675         (WTF::BitVector::OutOfLineBits::create):
1676         (WTF::BitVector::OutOfLineBits::destroy):
1677         (WTF::BitVector::OutOfLineBits::OutOfLineBits):
1678         (WTF::BitVector::isInline):
1679         (WTF::BitVector::outOfLineBits):
1680         (WTF::BitVector::resizeOutOfLine):
1681         (WTF::BitVector::bits):
1682
1683 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1684
1685         Add X86 GPRInfo for DFG JIT.
1686         https://bugs.webkit.org/show_bug.cgi?id=68586
1687
1688         Reviewed by Geoff Garen.
1689
1690         * dfg/DFGGPRInfo.h:
1691         (JSC::DFG::GPRInfo::toRegister):
1692         (JSC::DFG::GPRInfo::toIndex):
1693         (JSC::DFG::GPRInfo::debugName):
1694
1695 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1696
1697         Should support value profiling on CPU(X86)
1698         https://bugs.webkit.org/show_bug.cgi?id=68575
1699
1700         Reviewed by Sam Weinig.
1701
1702         Fix verbose profiling in ToT (SlowCaseProfile had been
1703         partially renamed to RareCaseProfile), add in-memory
1704         bucket counter for CPU(X86), move JIT::m_canBeOptimized
1705         out of the DFG_JIT ifdef.
1706
1707         * bytecode/CodeBlock.cpp:
1708         (JSC::CodeBlock::resetRareCaseProfiles):
1709         (JSC::CodeBlock::dumpValueProfiles):
1710         * bytecode/CodeBlock.h:
1711         * dfg/DFGByteCodeParser.cpp:
1712         (JSC::DFG::ByteCodeParser::makeSafe):
1713         * jit/JIT.cpp:
1714         (JSC::JIT::privateCompileSlowCases):
1715         (JSC::JIT::privateCompile):
1716         * jit/JIT.h:
1717         * jit/JITInlineMethods.h:
1718         (JSC::JIT::emitValueProfilingSite):
1719
1720 2011-09-21  Filip Pizlo  <fpizlo@apple.com>
1721
1722         DFG does not support compiling functions as constructors
1723         https://bugs.webkit.org/show_bug.cgi?id=68500
1724
1725         Reviewed by Oliver Hunt.
1726
1727         This adds support for compiling constructors to the DFG. It's a
1728         1% speed-up on V8, mostly due to a 6% speed-up on early-boyer.
1729         It's also a 13% win on access-binary-trees, but it's neutral in
1730         the SunSpider and Kraken averages.
1731
1732         * dfg/DFGByteCodeParser.cpp:
1733         (JSC::DFG::ByteCodeParser::parseBlock):
1734         * dfg/DFGCapabilities.h:
1735         (JSC::DFG::mightCompileFunctionForConstruct):
1736         (JSC::DFG::canCompileOpcode):
1737         * dfg/DFGNode.h:
1738         * dfg/DFGOperations.cpp:
1739         * dfg/DFGOperations.h:
1740         * dfg/DFGPropagator.cpp:
1741         (JSC::DFG::Propagator::propagateNodePredictions):
1742         (JSC::DFG::Propagator::performNodeCSE):
1743         * dfg/DFGSpeculativeJIT.cpp:
1744         (JSC::DFG::SpeculativeJIT::compile):
1745         * runtime/Executable.cpp:
1746         (JSC::FunctionExecutable::compileOptimizedForConstruct):
1747         (JSC::FunctionExecutable::compileForConstructInternal):
1748         * runtime/Executable.h:
1749         (JSC::FunctionExecutable::compileForConstruct):
1750         (JSC::FunctionExecutable::compileFor):
1751         (JSC::FunctionExecutable::compileOptimizedFor):
1752
1753 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1754
1755         Replace jsFunctionVPtr compares with a type check on the Structure.
1756         https://bugs.webkit.org/show_bug.cgi?id=68557
1757
1758         Reviewed by Oliver Hunt.
1759
1760         This will permit calls to still optimize to subclasses of JSFunction
1761         that have the correct type (but a different C++ vptr).
1762
1763         This patch stops passing the globalData into numerous functions.
1764
1765         * dfg/DFGByteCodeParser.cpp:
1766         (JSC::DFG::ByteCodeParser::parseBlock):
1767         * dfg/DFGGraph.h:
1768         (JSC::DFG::Graph::isFunctionConstant):
1769         (JSC::DFG::Graph::valueOfFunctionConstant):
1770         * dfg/DFGJITCompiler.h:
1771         (JSC::DFG::JITCompiler::isFunctionConstant):
1772         (JSC::DFG::JITCompiler::valueOfFunctionConstant):
1773         * dfg/DFGOperations.cpp:
1774         * interpreter/Interpreter.cpp:
1775         (JSC::Interpreter::privateExecute):
1776         * jit/JIT.h:
1777         * jit/JITCall.cpp:
1778         (JSC::JIT::compileOpCallVarargs):
1779         (JSC::JIT::compileOpCallSlowCase):
1780         * jit/JITCall32_64.cpp:
1781         (JSC::JIT::compileOpCallVarargs):
1782         (JSC::JIT::compileOpCallSlowCase):
1783         * jit/JITInlineMethods.h:
1784         (JSC::JIT::emitJumpIfNotType):
1785         * jit/JITStubs.cpp:
1786         (JSC::DEFINE_STUB_FUNCTION):
1787         * runtime/Executable.h:
1788         (JSC::isHostFunction):
1789         * runtime/JSFunction.h:
1790         (JSC::JSFunction::createStructure):
1791         * runtime/JSObject.cpp:
1792         (JSC::JSObject::put):
1793         (JSC::JSObject::putWithAttributes):
1794         * runtime/JSObject.h:
1795         (JSC::getJSFunction):
1796         (JSC::JSObject::putDirect):
1797         (JSC::JSObject::putDirectWithoutTransition):
1798         * runtime/JSType.h:
1799
1800 2011-09-21  Geoffrey Garen  <ggaren@apple.com>
1801
1802         Removed WTFTHREADDATA_MULTITHREADED, making it always true
1803         https://bugs.webkit.org/show_bug.cgi?id=68549
1804
1805         Reviewed by Darin Adler.
1806
1807         Another part of making threads exist in WebKit.
1808
1809         * wtf/WTFThreadData.cpp:
1810         * wtf/WTFThreadData.h:
1811         (WTF::wtfThreadData):
1812
1813 2011-09-21  Dan Bernstein  <mitz@apple.com>
1814
1815         JavaScriptCore Part of: Prevent the WebKit frameworks from defining inappropriately-named Objective-C classes
1816         https://bugs.webkit.org/show_bug.cgi?id=68451
1817
1818         Reviewed by Darin Adler.
1819
1820         * JavaScriptCore.xcodeproj/project.pbxproj: Added a script build phase that invokes
1821         check-for-inappropriate-objc-class-names, allowing only class names prefixed with "JS".
1822
1823 2011-09-20  Gavin Barraclough  <barraclough@apple.com>
1824
1825         MacroAssembler fixes.
1826         https://bugs.webkit.org/show_bug.cgi?id=68494
1827
1828         Reviewed by Sam Weinig.
1829
1830         Add X86-64's 3 operand or32 to other MacroAssembler, fix load32's [const] void* mismatch
1831
1832         * assembler/MacroAssembler.h:
1833         (JSC::MacroAssembler::orPtr):
1834         (JSC::MacroAssembler::loadPtr):
1835         * assembler/MacroAssemblerARM.h:
1836         (JSC::MacroAssemblerARM::or32):
1837         * assembler/MacroAssemblerARMv7.h:
1838         (JSC::MacroAssemblerARMv7::or32):
1839         * assembler/MacroAssemblerMIPS.h:
1840         (JSC::MacroAssemblerMIPS::or32):
1841         * assembler/MacroAssemblerSH4.h:
1842         (JSC::MacroAssemblerSH4::or32):
1843         (JSC::MacroAssemblerSH4::load32):
1844         * assembler/MacroAssemblerX86.h:
1845         (JSC::MacroAssemblerX86::load32):
1846         * assembler/MacroAssemblerX86_64.h:
1847         (JSC::MacroAssemblerX86_64::load32):
1848
1849 2011-09-20  Geoffrey Garen  <ggaren@apple.com>
1850
1851         Some Heap cleanup.
1852
1853         Reviewed by Beth Dakin.
1854
1855         * heap/MarkedBlock.cpp:
1856         (JSC::MarkedBlock::blessNewBlock): Removed blessNewBlockForSlowPath()
1857         because it was unused; renamed blessNewBlockForFastPath() to blessNewBlock()
1858         since there is only one now.
1859
1860         * heap/MarkedBlock.h: Removed ownerSet-related stuff since it was unused.
1861         Updated mark bit overhead calculation. Deployed atomsPerBlock in one
1862         place where we were recalculating it.
1863
1864         * heap/MarkedSpace.cpp:
1865         (JSC::MarkedSpace::addBlock): Updated for rename.
1866
1867 2011-09-20  Filip Pizlo  <fpizlo@apple.com>
1868
1869         DFG JIT always speculates integer on modulo
1870         https://bugs.webkit.org/show_bug.cgi?id=68485
1871
1872         Reviewed by Oliver Hunt.
1873
1874         Added support for double modulo, which is a call to fmod().
1875         Also added support for recording the old JIT's statistics
1876         on op_mod and propagating them along the graph. Finally,
1877         fixed a goof in the ArithNodeFlags propagation logic that
1878         was made obvious when I started testing ArithMod.
1879
1880         * dfg/DFGByteCodeParser.cpp:
1881         (JSC::DFG::ByteCodeParser::makeSafe):
1882         (JSC::DFG::ByteCodeParser::parseBlock):
1883         * dfg/DFGNode.h:
1884         (JSC::DFG::Node::hasArithNodeFlags):
1885         * dfg/DFGPropagator.cpp:
1886         (JSC::DFG::Propagator::propagateArithNodeFlags):
1887         (JSC::DFG::Propagator::propagateNodePredictions):
1888         (JSC::DFG::Propagator::fixupNode):
1889         * dfg/DFGSpeculativeJIT.cpp:
1890         (JSC::DFG::SpeculativeJIT::compile):
1891
1892 2011-09-20  ChangSeok Oh  <shivamidow@gmail.com>
1893
1894         [GTK] requestAnimationFrame support for gtk port
1895         https://bugs.webkit.org/show_bug.cgi?id=66280
1896
1897         Reviewed by Martin Robinson.
1898
1899         Let GTK port use REQUEST_ANIMATION_FRAME_TIMER.
1900
1901         * wtf/Platform.h:
1902
1903 2011-09-20  Filip Pizlo  <fpizlo@apple.com>
1904
1905         DFG JIT performs too many negative zero checks, and too many
1906         overflow checks
1907         https://bugs.webkit.org/show_bug.cgi?id=68430
1908
1909         Reviewed by Oliver Hunt.
1910
1911         This adds comprehensive support for deciding how to perform an
1912         arithmetic operations based on a combination of overflow profiling,
1913         negative zero profiling, value profiling, and a static analysis of
1914         how the results of these operations get used.
1915
1916         This is a 72% speed-up on stanford-crypto-sha256-iterative, and a
1917         2.5% speed-up on the Kraken average, a 1.4% speed-up on the V8
1918         geomean, and neutral on SunSpider. It's also an 8.5% speed-up on
1919         V8-crypto, because apparenty everything we do speeds up crypto.
1920
1921         * dfg/DFGByteCodeParser.cpp:
1922         (JSC::DFG::ByteCodeParser::toInt32):
1923         (JSC::DFG::ByteCodeParser::toNumber):
1924         (JSC::DFG::ByteCodeParser::isSmallInt32Constant):
1925         (JSC::DFG::ByteCodeParser::valueOfInt32Constant):
1926         (JSC::DFG::ByteCodeParser::weaklyPredictInt32):
1927         (JSC::DFG::ByteCodeParser::makeSafe):
1928         (JSC::DFG::ByteCodeParser::handleMinMax):
1929         (JSC::DFG::ByteCodeParser::handleIntrinsic):
1930         (JSC::DFG::ByteCodeParser::parseBlock):
1931         (JSC::DFG::ByteCodeParser::processPhiStack):
1932         (JSC::DFG::ByteCodeParser::parse):
1933         * dfg/DFGGraph.cpp:
1934         (JSC::DFG::Graph::dump):
1935         * dfg/DFGJITCodeGenerator.cpp:
1936         (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
1937         * dfg/DFGNode.h:
1938         (JSC::DFG::nodeUsedAsNumber):
1939         (JSC::DFG::nodeCanTruncateInteger):
1940         (JSC::DFG::nodeCanIgnoreNegativeZero):
1941         (JSC::DFG::nodeCanSpeculateInteger):
1942         (JSC::DFG::arithNodeFlagsAsString):
1943         (JSC::DFG::Node::Node):
1944         (JSC::DFG::Node::hasArithNodeFlags):
1945         (JSC::DFG::Node::rawArithNodeFlags):
1946         (JSC::DFG::Node::arithNodeFlags):
1947         (JSC::DFG::Node::arithNodeFlagsForCompare):
1948         (JSC::DFG::Node::setArithNodeFlag):
1949         (JSC::DFG::Node::mergeArithNodeFlags):
1950         * dfg/DFGPropagator.cpp:
1951         (JSC::DFG::Propagator::fixpoint):
1952         (JSC::DFG::Propagator::isNotNegZero):
1953         (JSC::DFG::Propagator::isNotZero):
1954         (JSC::DFG::Propagator::propagateArithNodeFlags):
1955         (JSC::DFG::Propagator::propagateArithNodeFlagsForward):
1956         (JSC::DFG::Propagator::propagateArithNodeFlagsBackward):
1957         (JSC::DFG::Propagator::propagateNodePredictions):
1958         (JSC::DFG::Propagator::propagatePredictionsForward):
1959         (JSC::DFG::Propagator::propagatePredictionsBackward):
1960         (JSC::DFG::Propagator::toDouble):
1961         (JSC::DFG::Propagator::fixupNode):
1962         (JSC::DFG::Propagator::fixup):
1963         (JSC::DFG::Propagator::startIndexForChildren):
1964         (JSC::DFG::Propagator::endIndexForPureCSE):
1965         (JSC::DFG::Propagator::pureCSE):
1966         (JSC::DFG::Propagator::clobbersWorld):
1967         (JSC::DFG::Propagator::setReplacement):
1968         (JSC::DFG::Propagator::performNodeCSE):
1969         (JSC::DFG::Propagator::localCSE):
1970         * dfg/DFGSpeculativeJIT.cpp:
1971         (JSC::DFG::SpeculativeJIT::compile):
1972         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
1973
1974 2011-09-19  Oliver Hunt  <oliver@apple.com>
1975
1976         Refactor Heap allocation logic into separate AllocationSpace class
1977         https://bugs.webkit.org/show_bug.cgi?id=68409
1978
1979         Reviewed by Gavin Barraclough.
1980
1981         This patch hoists direct manipulation of the MarkedSpace and related
1982         data out of Heap and into a separate class.  This will allow us to
1983         have multiple allocation spaces in future, so easing the way towards
1984         having GC'd backing stores for objects.
1985
1986         * CMakeLists.txt:
1987         * GNUmakefile.list.am:
1988         * JavaScriptCore.exp:
1989         * JavaScriptCore.gypi:
1990         * JavaScriptCore.pro:
1991         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1992         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1993         * JavaScriptCore.xcodeproj/project.pbxproj:
1994         * debugger/Debugger.cpp:
1995         (JSC::Debugger::recompileAllJSFunctions):
1996         * heap/AllocationSpace.cpp: Added.
1997         (JSC::AllocationSpace::tryAllocate):
1998         (JSC::AllocationSpace::allocateSlowCase):
1999         (JSC::AllocationSpace::allocateBlock):
2000         (JSC::AllocationSpace::freeBlocks):
2001         (JSC::TakeIfEmpty::TakeIfEmpty):
2002         (JSC::TakeIfEmpty::operator()):
2003         (JSC::TakeIfEmpty::returnValue):
2004         (JSC::AllocationSpace::shrink):
2005         * heap/AllocationSpace.h: Added.
2006         (JSC::AllocationSpace::AllocationSpace):
2007         (JSC::AllocationSpace::blocks):
2008         (JSC::AllocationSpace::sizeClassFor):
2009         (JSC::AllocationSpace::setHighWaterMark):
2010         (JSC::AllocationSpace::highWaterMark):
2011         (JSC::AllocationSpace::canonicalizeBlocks):
2012         (JSC::AllocationSpace::resetAllocator):
2013         (JSC::AllocationSpace::forEachCell):
2014         (JSC::AllocationSpace::forEachBlock):
2015         (JSC::AllocationSpace::allocate):
2016         * heap/Heap.cpp:
2017         (JSC::Heap::Heap):
2018         (JSC::Heap::reportExtraMemoryCostSlowCase):
2019         (JSC::Heap::getConservativeRegisterRoots):
2020         (JSC::Heap::markRoots):
2021         (JSC::Heap::clearMarks):
2022         (JSC::Heap::sweep):
2023         (JSC::Heap::objectCount):
2024         (JSC::Heap::size):
2025         (JSC::Heap::capacity):
2026         (JSC::Heap::globalObjectCount):
2027         (JSC::Heap::objectTypeCounts):
2028         (JSC::Heap::collect):
2029         (JSC::Heap::canonicalizeBlocks):
2030         (JSC::Heap::resetAllocator):
2031         (JSC::Heap::freeBlocks):
2032         (JSC::Heap::shrink):
2033         * heap/Heap.h:
2034         (JSC::Heap::objectSpace):
2035         (JSC::Heap::sizeClassForObject):
2036         (JSC::Heap::allocate):
2037         * jit/JITInlineMethods.h:
2038         (JSC::JIT::emitAllocateBasicJSObject):
2039         * runtime/JSGlobalData.cpp:
2040         (JSC::JSGlobalData::recompileAllJSFunctions):
2041         (JSC::JSGlobalData::releaseExecutableMemory):
2042
2043 2011-09-19  Geoffrey Garen  <ggaren@apple.com>
2044
2045         Removed BREWMP* platform #ifdefs
2046         https://bugs.webkit.org/show_bug.cgi?id=68425
2047
2048         BREWMP* has no maintainer, and this is dead code.
2049
2050         Reviewed by Darin Adler.
2051
2052         * heap/MarkStack.h:
2053         (JSC::::shrinkAllocation):
2054         * jit/ExecutableAllocator.h:
2055         (JSC::ExecutableAllocator::cacheFlush):
2056         * runtime/TimeoutChecker.cpp:
2057         (JSC::getCPUTime):
2058         * wtf/Assertions.cpp:
2059         * wtf/Assertions.h:
2060         * wtf/CurrentTime.cpp:
2061         * wtf/DateMath.cpp:
2062         (WTF::calculateUTCOffset):
2063         * wtf/FastMalloc.cpp:
2064         (WTF::fastMalloc):
2065         (WTF::fastCalloc):
2066         (WTF::fastMallocSize):
2067         * wtf/FastMalloc.h:
2068         * wtf/MainThread.cpp:
2069         * wtf/MathExtras.h:
2070         * wtf/OwnPtrCommon.h:
2071         * wtf/Platform.h:
2072         * wtf/RandomNumber.cpp:
2073         (WTF::randomNumber):
2074         * wtf/RandomNumberSeed.h:
2075         (WTF::initializeRandomNumberGenerator):
2076         * wtf/text/WTFString.h:
2077         * wtf/unicode/Unicode.h:
2078
2079 2011-09-20  Adam Roben  <aroben@apple.com>
2080
2081         Windows build fix after r95523
2082
2083         * wtf/CheckedArithmetic.h: Added stdint.h so we can have int64_t defined.
2084
2085 2011-09-18  Filip Pizlo  <fpizlo@apple.com>
2086
2087         DFG JIT does not speculate aggressively enough on GetById
2088         https://bugs.webkit.org/show_bug.cgi?id=68320
2089
2090         Reviewed by Oliver Hunt.
2091
2092         This adds the ability to access properties directly, by offset.
2093         This optimization kicks in when at the time of DFG compilation,
2094         it appears that the given get_by_id is self-cached by the old JIT.
2095         Two new opcodes get introduced: CheckStructure and GetByOffset.
2096         CheckStructure performs a speculation check on the object's
2097         structure, and returns the storage pointer. GetByOffset performs
2098         a direct read of the field from the storage pointer. Both
2099         CheckStructure and GetByOffset can be CSE'd, so that we can
2100         eliminate redundant structure checks, and redundant reads of the
2101         same field.
2102
2103         This is a 4% speed-up on V8, a 2% slow-down on Kraken, and
2104         neutral on SunSpider.
2105
2106         * bytecode/PredictedType.cpp:
2107         (JSC::predictionFromClassInfo):
2108         (JSC::predictionFromStructure):
2109         (JSC::predictionFromCell):
2110         * bytecode/PredictedType.h:
2111         * dfg/DFGByteCodeParser.cpp:
2112         (JSC::DFG::ByteCodeParser::parseBlock):
2113         * dfg/DFGGenerationInfo.h:
2114         (JSC::DFG::dataFormatToString):
2115         (JSC::DFG::needDataFormatConversion):
2116         (JSC::DFG::GenerationInfo::initStorage):
2117         (JSC::DFG::GenerationInfo::spill):
2118         (JSC::DFG::GenerationInfo::fillStorage):
2119         * dfg/DFGGraph.h:
2120         (JSC::DFG::Graph::predict):
2121         (JSC::DFG::Graph::getPrediction):
2122         * dfg/DFGJITCodeGenerator.cpp:
2123         (JSC::DFG::JITCodeGenerator::fillInteger):
2124         (JSC::DFG::JITCodeGenerator::fillDouble):
2125         (JSC::DFG::JITCodeGenerator::fillJSValue):
2126         (JSC::DFG::JITCodeGenerator::fillStorage):
2127         (JSC::DFG::GPRTemporary::GPRTemporary):
2128         * dfg/DFGJITCodeGenerator.h:
2129         (JSC::DFG::JITCodeGenerator::silentSpillGPR):
2130         (JSC::DFG::JITCodeGenerator::silentFillGPR):
2131         (JSC::DFG::JITCodeGenerator::spill):
2132         (JSC::DFG::JITCodeGenerator::storageResult):
2133         (JSC::DFG::StorageOperand::StorageOperand):
2134         (JSC::DFG::StorageOperand::~StorageOperand):
2135         (JSC::DFG::StorageOperand::index):
2136         (JSC::DFG::StorageOperand::gpr):
2137         (JSC::DFG::StorageOperand::use):
2138         * dfg/DFGNode.h:
2139         (JSC::DFG::OpInfo::OpInfo):
2140         (JSC::DFG::Node::Node):
2141         (JSC::DFG::Node::hasPrediction):
2142         (JSC::DFG::Node::hasStructure):
2143         (JSC::DFG::Node::structure):
2144         (JSC::DFG::Node::hasStorageAccessData):
2145         (JSC::DFG::Node::storageAccessDataIndex):
2146         * dfg/DFGPropagator.cpp:
2147         (JSC::DFG::Propagator::propagateNode):
2148         (JSC::DFG::Propagator::globalVarLoadElimination):
2149         (JSC::DFG::Propagator::getMethodLoadElimination):
2150         (JSC::DFG::Propagator::checkStructureLoadElimination):
2151         (JSC::DFG::Propagator::getByOffsetLoadElimination):
2152         (JSC::DFG::Propagator::performNodeCSE):
2153         * dfg/DFGSpeculativeJIT.cpp:
2154         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
2155         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
2156         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
2157         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
2158         (JSC::DFG::SpeculativeJIT::compile):
2159         * wtf/StdLibExtras.h:
2160         (WTF::safeCast):
2161
2162 2011-09-19  Mark Hahnenberg  <mhahnenberg@apple.com>
2163
2164         Remove toPrimitive from JSCell
2165         https://bugs.webkit.org/show_bug.cgi?id=67875
2166
2167         Reviewed by Darin Adler.
2168
2169         Part of the refactoring process to un-virtualize JSCell.  We move
2170         all of the implicit functionality provided by the virtual toPrimitive method
2171         in JSCell to be explicit in JSValue::toPrimitive and JSCell:toPrimitive while
2172         also de-virtualizing JSCell::toPrimitive.
2173
2174         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2175         * runtime/JSCell.cpp:
2176         (JSC::JSCell::toPrimitive):
2177         * runtime/JSCell.h:
2178
2179         We replace JSNotAnObject::toPrimitive with defaultValue, which it overrides from
2180         JSObject.  This pushes the virtual method further down, enabling us to get rid
2181         of the virtual call in JSCell.  Eventually we'll probably have to deal with this
2182         again, but we'll cross that bridge when we come to it.
2183         * runtime/JSNotAnObject.cpp:
2184         (JSC::JSNotAnObject::defaultValue):
2185         * runtime/JSNotAnObject.h:
2186         * runtime/JSObject.h:
2187         * runtime/JSString.h:
2188
2189 2011-09-19  Geoffrey Garen  <ggaren@apple.com>
2190
2191         Removed ENABLE_LAZY_BLOCK_FREEING and related #ifdefs
2192         https://bugs.webkit.org/show_bug.cgi?id=68424
2193
2194         As discussed on webkit-dev. All ports build with threads enabled in JSC now.
2195
2196         This may break WinCE and other ports that have not built and tested with
2197         this configuration. I've filed bugs for port maintainers. It's time for
2198         WebKit to move forward.
2199
2200         Reviewed by Mark Rowe.
2201
2202         * heap/Heap.cpp:
2203         (JSC::Heap::Heap):
2204         (JSC::Heap::~Heap):
2205         (JSC::Heap::destroy):
2206         (JSC::Heap::blockFreeingThreadMain):
2207         (JSC::Heap::allocateBlock):
2208         (JSC::Heap::freeBlocks):
2209         (JSC::Heap::releaseFreeBlocks):
2210         * heap/Heap.h:
2211         * wtf/Platform.h:
2212
2213 2011-09-19  Geoffrey Garen  <ggaren@apple.com>
2214
2215         Removed ENABLE_WTF_MULTIPLE_THREADS and related #ifdefs
2216         https://bugs.webkit.org/show_bug.cgi?id=68423
2217
2218         As discussed on webkit-dev. All ports build with threads enabled in WTF now.
2219
2220         This may break WinCE and other ports that have not built and tested with
2221         this configuration. I've filed bugs for port maintainers. It's time for
2222         WebKit to move forward.
2223
2224         Reviewed by Mark Rowe.
2225
2226         * wtf/CryptographicallyRandomNumber.cpp:
2227         (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomNumber):
2228         (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomValues):
2229         * wtf/FastMalloc.cpp:
2230         * wtf/Platform.h:
2231         * wtf/RandomNumber.cpp:
2232         (WTF::randomNumber):
2233         * wtf/RefCountedLeakCounter.cpp:
2234         (WTF::RefCountedLeakCounter::increment):
2235         (WTF::RefCountedLeakCounter::decrement):
2236         * wtf/ThreadingPthreads.cpp:
2237         (WTF::initializeThreading):
2238         * wtf/ThreadingWin.cpp:
2239         (WTF::initializeThreading):
2240         * wtf/dtoa.cpp:
2241         (WTF::pow5mult):
2242         * wtf/gtk/ThreadingGtk.cpp:
2243         (WTF::initializeThreading):
2244         * wtf/qt/ThreadingQt.cpp:
2245         (WTF::initializeThreading):
2246
2247 2011-09-19  Geoffrey Garen  <ggaren@apple.com>
2248
2249         Removed ENABLE_JSC_MULTIPLE_THREADS and related #ifdefs.
2250         https://bugs.webkit.org/show_bug.cgi?id=68422
2251
2252         As discussed on webkit-dev. All ports build with threads enabled in JSC now.
2253
2254         This may break WinCE and other ports that have not built and tested with
2255         this configuration. I've filed bugs for port maintainers. It's time for
2256         WebKit to move forward.
2257
2258         Reviewed by Sam Weinig.
2259
2260         * API/APIShims.h:
2261         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
2262         * API/JSContextRef.cpp:
2263         * heap/MachineStackMarker.cpp:
2264         (JSC::MachineThreads::MachineThreads):
2265         (JSC::MachineThreads::~MachineThreads):
2266         (JSC::MachineThreads::gatherConservativeRoots):
2267         * heap/MachineStackMarker.h:
2268         * runtime/InitializeThreading.cpp:
2269         (JSC::initializeThreadingOnce):
2270         (JSC::initializeThreading):
2271         * runtime/JSGlobalData.cpp:
2272         (JSC::JSGlobalData::sharedInstance):
2273         * runtime/JSGlobalData.h:
2274         (JSC::JSGlobalData::makeUsableFromMultipleThreads):
2275         * runtime/JSLock.cpp:
2276         * runtime/Structure.cpp:
2277         * wtf/Platform.h:
2278
2279 2011-09-19  Sheriff Bot  <webkit.review.bot@gmail.com>
2280
2281         Unreviewed, rolling out r95493 and r95496.
2282         http://trac.webkit.org/changeset/95493
2283         http://trac.webkit.org/changeset/95496
2284         https://bugs.webkit.org/show_bug.cgi?id=68418
2285
2286         Broke Windows build (Requested by rniwa on #webkit).
2287
2288         * CMakeLists.txt:
2289         * GNUmakefile.list.am:
2290         * JavaScriptCore.exp:
2291         * JavaScriptCore.gypi:
2292         * JavaScriptCore.pro:
2293         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2294         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2295         * JavaScriptCore.xcodeproj/project.pbxproj:
2296         * debugger/Debugger.cpp:
2297         (JSC::Debugger::recompileAllJSFunctions):
2298         * heap/AllocationSpace.cpp: Removed.
2299         * heap/AllocationSpace.h: Removed.
2300         * heap/Heap.cpp:
2301         (JSC::CountFunctor::TakeIfEmpty::TakeIfEmpty):
2302         (JSC::CountFunctor::TakeIfEmpty::operator()):
2303         (JSC::CountFunctor::TakeIfEmpty::returnValue):
2304         (JSC::Heap::Heap):
2305         (JSC::Heap::reportExtraMemoryCostSlowCase):
2306         (JSC::Heap::tryAllocate):
2307         (JSC::Heap::allocateSlowCase):
2308         (JSC::Heap::getConservativeRegisterRoots):
2309         (JSC::Heap::markRoots):
2310         (JSC::Heap::clearMarks):
2311         (JSC::Heap::sweep):
2312         (JSC::Heap::objectCount):
2313         (JSC::Heap::size):
2314         (JSC::Heap::capacity):
2315         (JSC::Heap::globalObjectCount):
2316         (JSC::Heap::objectTypeCounts):
2317         (JSC::Heap::collect):
2318         (JSC::Heap::canonicalizeBlocks):
2319         (JSC::Heap::resetAllocator):
2320         (JSC::Heap::allocateBlock):
2321         (JSC::Heap::freeBlocks):
2322         (JSC::Heap::shrink):
2323         * heap/Heap.h:
2324         (JSC::Heap::markedSpace):
2325         (JSC::Heap::forEachCell):
2326         (JSC::Heap::forEachBlock):
2327         (JSC::Heap::sizeClassFor):
2328         (JSC::Heap::allocate):
2329         * jit/JITInlineMethods.h:
2330         (JSC::JIT::emitAllocateBasicJSObject):
2331         * runtime/JSGlobalData.cpp:
2332         (JSC::JSGlobalData::recompileAllJSFunctions):
2333         (JSC::JSGlobalData::releaseExecutableMemory):
2334
2335 2011-09-19  Gavin Barraclough  <barraclough@apple.com>
2336
2337         Errrk, missed stylebot comments in last commit.
2338
2339         * runtime/StringPrototype.cpp:
2340         (JSC::stringProtoFuncSplit):
2341
2342 2011-09-19  Gavin Barraclough  <barraclough@apple.com>
2343
2344         String#split is buggy
2345         https://bugs.webkit.org/show_bug.cgi?id=68348
2346
2347         Reviewed by Sam Weinig.
2348
2349         * runtime/StringPrototype.cpp:
2350         (JSC::jsStringWithReuse):
2351             - added helper function to reuse original JSString value.
2352         (JSC::stringProtoFuncSplit):
2353             - Rewritten from the spec.
2354         * tests/mozilla/ecma/String/15.5.4.8-2.js:
2355         (getTestCases):
2356             - This test is not ES5 compliant.
2357
2358 2011-09-19  Geoffrey Garen  <ggaren@apple.com>
2359
2360         Removed lots of friend declarations from JSCell, so we can more
2361         effectively make use of private and protected.
2362
2363         Reviewed by Sam Weinig.
2364
2365         * runtime/JSCell.h: Removed MSVCBugWorkaround because it was a lot of
2366         confusion for not much safety.
2367         (JSC::JSCell::operator new): Made this public because it is used by a
2368         few clients, and not really dangerous.
2369
2370         * runtime/JSObject.cpp:
2371         (JSC::JSObject::put):
2372         (JSC::JSObject::deleteProperty):
2373         (JSC::JSObject::defineGetter):
2374         (JSC::JSObject::defineSetter):
2375         (JSC::JSObject::getPropertySpecificValue):
2376         (JSC::JSObject::getOwnPropertyNames):
2377         (JSC::JSObject::seal):
2378         (JSC::JSObject::freeze):
2379         (JSC::JSObject::preventExtensions):
2380         (JSC::JSObject::removeDirect):
2381         (JSC::JSObject::createInheritorID):
2382         (JSC::JSObject::allocatePropertyStorage):
2383         (JSC::JSObject::getOwnPropertyDescriptor):
2384         * runtime/JSObject.h:
2385         (JSC::JSObject::getDirect):
2386         (JSC::JSObject::getDirectLocation):
2387         (JSC::JSObject::hasCustomProperties):
2388         (JSC::JSObject::hasGetterSetterProperties):
2389         (JSC::JSObject::isSealed):
2390         (JSC::JSObject::isFrozen):
2391         (JSC::JSObject::isExtensible):
2392         (JSC::JSObject::flattenDictionaryObject):
2393         (JSC::JSObject::finishCreation):
2394         (JSC::JSObject::prototype):
2395         (JSC::JSObject::setPrototype):
2396         (JSC::JSObject::inlineGetOwnPropertySlot):
2397         (JSC::JSCell::fastGetOwnProperty):
2398         (JSC::JSObject::putDirectInternal):
2399         (JSC::JSObject::putDirectWithoutTransition):
2400         (JSC::JSObject::transitionTo):
2401         (JSC::JSObject::visitChildrenDirect): Changed all use of m_structure to
2402         structure() / setStructure(), so we don't have to be a friend of JSCell.
2403
2404         * runtime/Structure.h:
2405         (JSC::JSCell::setStructure): Added, to avoid direct access by JSObject
2406         to JSCell::m_structure.
2407
2408 2011-09-19  Adam Barth  <abarth@webkit.org>
2409
2410         Always enable ENABLE(EVENTSOURCE)
2411         https://bugs.webkit.org/show_bug.cgi?id=68414
2412
2413         Reviewed by Eric Seidel.
2414
2415         * Configurations/FeatureDefines.xcconfig:
2416
2417 2011-09-19  Eli Fidler  <efidler@rim.com>
2418
2419         Enable JSC_MULTIPLE_THREADS for OS(QNX).
2420         https://bugs.webkit.org/show_bug.cgi?id=68047
2421
2422         Reviewed by Daniel Bates.
2423
2424         SA_RESTART was required for SIGUSR2-based debugging, but is not
2425         present on QNX. This debugging doesn't seem critical to
2426         JSC_MULTIPLE_THREADS, so allow it to proceed.
2427
2428         * heap/MachineStackMarker.cpp:
2429         (JSC::MachineThreads::Thread::Thread):
2430         (JSC::getPlatformThreadRegisters):
2431         (JSC::otherThreadStackPointer):
2432         (JSC::freePlatformThreadRegisters):
2433         * wtf/Platform.h: enable PTHREADS for OS(QNX)
2434
2435 2011-09-19  Oliver Hunt  <oliver@apple.com>
2436
2437         Windows build fix.
2438
2439         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2440
2441 2011-09-19  Oliver Hunt  <oliver@apple.com>
2442
2443         Refactor Heap allocation logic into separate AllocationSpace class
2444         https://bugs.webkit.org/show_bug.cgi?id=68409
2445
2446         Reviewed by Gavin Barraclough.
2447
2448         This patch hoists direct manipulation of the MarkedSpace and related
2449         data out of Heap and into a separate class.  This will allow us to
2450         have multiple allocation spaces in future, so easing the way towards
2451         having GC'd backing stores for objects.
2452
2453         * CMakeLists.txt:
2454         * GNUmakefile.list.am:
2455         * JavaScriptCore.exp:
2456         * JavaScriptCore.gypi:
2457         * JavaScriptCore.pro:
2458         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2459         * JavaScriptCore.xcodeproj/project.pbxproj:
2460         * debugger/Debugger.cpp:
2461         (JSC::Debugger::recompileAllJSFunctions):
2462         * heap/AllocationSpace.cpp: Added.
2463         (JSC::AllocationSpace::tryAllocate):
2464         (JSC::AllocationSpace::allocateSlowCase):
2465         (JSC::AllocationSpace::allocateBlock):
2466         (JSC::AllocationSpace::freeBlocks):
2467         (JSC::TakeIfEmpty::TakeIfEmpty):
2468         (JSC::TakeIfEmpty::operator()):
2469         (JSC::TakeIfEmpty::returnValue):
2470         (JSC::AllocationSpace::shrink):
2471         * heap/AllocationSpace.h: Added.
2472         (JSC::AllocationSpace::AllocationSpace):
2473         (JSC::AllocationSpace::blocks):
2474         (JSC::AllocationSpace::sizeClassFor):
2475         (JSC::AllocationSpace::setHighWaterMark):
2476         (JSC::AllocationSpace::highWaterMark):
2477         (JSC::AllocationSpace::canonicalizeBlocks):
2478         (JSC::AllocationSpace::resetAllocator):
2479         (JSC::AllocationSpace::forEachCell):
2480         (JSC::AllocationSpace::forEachBlock):
2481         (JSC::AllocationSpace::allocate):
2482         * heap/Heap.cpp:
2483         (JSC::Heap::Heap):
2484         (JSC::Heap::reportExtraMemoryCostSlowCase):
2485         (JSC::Heap::getConservativeRegisterRoots):
2486         (JSC::Heap::markRoots):
2487         (JSC::Heap::clearMarks):
2488         (JSC::Heap::sweep):
2489         (JSC::Heap::objectCount):
2490         (JSC::Heap::size):
2491         (JSC::Heap::capacity):
2492         (JSC::Heap::globalObjectCount):
2493         (JSC::Heap::objectTypeCounts):
2494         (JSC::Heap::collect):
2495         (JSC::Heap::canonicalizeBlocks):
2496         (JSC::Heap::resetAllocator):
2497         (JSC::Heap::freeBlocks):
2498         (JSC::Heap::shrink):
2499         * heap/Heap.h:
2500         (JSC::Heap::objectSpace):
2501         (JSC::Heap::sizeClassForObject):
2502         (JSC::Heap::allocate):
2503         * jit/JITInlineMethods.h:
2504         (JSC::JIT::emitAllocateBasicJSObject):
2505         * runtime/JSGlobalData.cpp:
2506         (JSC::JSGlobalData::recompileAllJSFunctions):
2507         (JSC::JSGlobalData::releaseExecutableMemory):
2508
2509 2011-09-19  Adam Roben  <aroben@apple.com>
2510
2511         Windows build fix after r95310
2512
2513         * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops: Added
2514         include\private\JavaScriptCore to the include path so DFGIntrinsic.h can be found.
2515
2516 2011-09-19  Filip Pizlo  <fpizlo@apple.com>
2517
2518         DFG speculation failures should act as additional value profiles
2519         https://bugs.webkit.org/show_bug.cgi?id=68335
2520
2521         Reviewed by Oliver Hunt.
2522
2523         This adds slow-case counters to the old JIT. It also ensures that
2524         negative zero in multiply is handled carefully. The old JIT
2525         previously took slow path if the result of a multiply was zero,
2526         which, without any changes, would cause the DFG to think that
2527         every such multiply produced a double result.
2528
2529         This also fixes a bug in the old JIT's handling of decrements. It
2530         would take the slow path if the result was zero, but not if it
2531         underflowed.
2532
2533         By itself, this would be a 1% slow-down on V8 and Kraken. But then
2534         I wrote optimizations in the DFG that take advantage of this new
2535         information. It's no longer the case that every multiply needs to
2536         do a check for negative zero; it only happens if the negative
2537         zero is ignored.
2538
2539         This results in a 12% speed-up on v8-crypto, for a 1.4% geomean
2540         speed-up in V8. It's mostly neutral on Kraken. I can see an
2541         0.5% slow-down and it appears to be significant.
2542
2543         * bytecode/CodeBlock.cpp:
2544         (JSC::CodeBlock::resetRareCaseProfiles):
2545         (JSC::CodeBlock::dumpValueProfiles):
2546         * bytecode/CodeBlock.h:
2547         * bytecode/ValueProfile.h:
2548         (JSC::RareCaseProfile::RareCaseProfile):
2549         (JSC::getRareCaseProfileBytecodeOffset):
2550         * dfg/DFGByteCodeParser.cpp:
2551         (JSC::DFG::ByteCodeParser::toInt32):
2552         (JSC::DFG::ByteCodeParser::makeSafe):
2553         (JSC::DFG::ByteCodeParser::parseBlock):
2554         * dfg/DFGJITCodeGenerator.cpp:
2555         (JSC::DFG::GPRTemporary::GPRTemporary):
2556         * dfg/DFGJITCodeGenerator.h:
2557         * dfg/DFGNode.h:
2558         * dfg/DFGPropagator.cpp:
2559         (JSC::DFG::Propagator::propagateNode):
2560         (JSC::DFG::Propagator::fixupNode):
2561         (JSC::DFG::Propagator::clobbersWorld):
2562         (JSC::DFG::Propagator::performNodeCSE):
2563         * dfg/DFGSpeculativeJIT.cpp:
2564         (JSC::DFG::SpeculativeJIT::compile):
2565         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
2566         * jit/JIT.cpp:
2567         (JSC::JIT::privateCompileSlowCases):
2568         * jit/JIT.h:
2569         (JSC::JIT::linkDummySlowCase):
2570         * jit/JITArithmetic.cpp:
2571         (JSC::JIT::emit_op_post_dec):
2572         (JSC::JIT::emit_op_pre_dec):
2573         (JSC::JIT::compileBinaryArithOp):
2574         (JSC::JIT::emit_op_add):
2575         (JSC::JIT::emitSlow_op_add):
2576         * jit/JITInlineMethods.h:
2577         (JSC::JIT::addSlowCase):
2578
2579 2011-09-19  Adam Roben  <aroben@apple.com>
2580
2581         Windows build fix after r94575
2582
2583         * JavaScriptCore.vcproj/JavaScriptCore.sln: Relinearized project dependencies. testRegExp
2584         now builds just before FindSafari.
2585
2586 2011-09-19  Sheriff Bot  <webkit.review.bot@gmail.com>
2587
2588         Unreviewed, rolling out r95466.
2589         http://trac.webkit.org/changeset/95466
2590         https://bugs.webkit.org/show_bug.cgi?id=68389
2591
2592         Incorrect version of the patch. (Requested by mhahnenberg on
2593         #webkit).
2594
2595         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2596         * runtime/JSCell.cpp:
2597         (JSC::JSCell::toPrimitive):
2598         * runtime/JSCell.h:
2599         (JSC::JSCell::JSValue::toPrimitive):
2600         * runtime/JSNotAnObject.cpp:
2601         (JSC::JSNotAnObject::toPrimitive):
2602         * runtime/JSNotAnObject.h:
2603         * runtime/JSObject.h:
2604         * runtime/JSString.h:
2605
2606 2011-09-19  Mark Hahnenberg  <mhahnenberg@apple.com>
2607
2608         Remove toPrimitive from JSCell
2609         https://bugs.webkit.org/show_bug.cgi?id=67875
2610
2611         Reviewed by Geoffrey Garen.
2612
2613         Part of the refactoring process to un-virtualize JSCell.  We move
2614         all of the implicit functionality provided by the virtual toPrimitive method
2615         in JSCell to be explicit in JSValue::toPrimitive and JSCell:toPrimitive while
2616         also de-virtualizing JSCell::toPrimitive.
2617
2618         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2619         * runtime/JSCell.cpp:
2620         (JSC::JSCell::toPrimitive):
2621         * runtime/JSCell.h:
2622
2623         We replace JSNotAnObject::toPrimitive with defaultValue, which it overrides from
2624         JSObject.  This pushes the virtual method further down, enabling us to get rid
2625         of the virtual call in JSCell.  Eventually we'll probably have to deal with this
2626         again, but we'll cross that bridge when we come to it.
2627         * runtime/JSNotAnObject.cpp:
2628         (JSC::JSNotAnObject::defaultValue):
2629         * runtime/JSNotAnObject.h:
2630         * runtime/JSObject.h:
2631         * runtime/JSString.h:
2632         (JSC::JSValue::toPrimitive):
2633
2634 2011-09-19  Oliver Hunt  <oliver@apple.com>
2635
2636         Build fix.
2637
2638         * jit/JITPropertyAccess32_64.cpp:
2639         (JSC::JIT::compileGetDirectOffset):
2640
2641 2011-09-19  Oliver Hunt  <oliver@apple.com>
2642
2643         Rename NewSpace.{h,cpp} to MarkedSpace.{h,cpp}
2644         https://bugs.webkit.org/show_bug.cgi?id=68376
2645
2646         Reviewed by Gavin Barraclough.
2647
2648         Renamed the the MarkedSpace files to match new name, and
2649         updated the relevant references.
2650
2651         * CMakeLists.txt:
2652         * GNUmakefile.list.am:
2653         * JavaScriptCore.gypi:
2654         * JavaScriptCore.pro:
2655         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2656         * JavaScriptCore.xcodeproj/project.pbxproj:
2657         * heap/Heap.h:
2658         * heap/MarkedSpace.cpp: Renamed from Source/JavaScriptCore/heap/NewSpace.cpp.
2659         (JSC::MarkedSpace::MarkedSpace):
2660         (JSC::MarkedSpace::addBlock):
2661         (JSC::MarkedSpace::removeBlock):
2662         (JSC::MarkedSpace::resetAllocator):
2663         (JSC::MarkedSpace::canonicalizeBlocks):
2664         * heap/MarkedSpace.h: Renamed from Source/JavaScriptCore/heap/NewSpace.h.
2665         (JSC::MarkedSpace::waterMark):
2666         (JSC::MarkedSpace::highWaterMark):
2667         (JSC::MarkedSpace::setHighWaterMark):
2668         (JSC::MarkedSpace::sizeClassFor):
2669         (JSC::MarkedSpace::allocate):
2670         (JSC::MarkedSpace::forEachBlock):
2671         (JSC::MarkedSpace::SizeClass::SizeClass):
2672         (JSC::MarkedSpace::SizeClass::resetAllocator):
2673         (JSC::MarkedSpace::SizeClass::canonicalizeBlock):
2674         * runtime/JSCell.h:
2675
2676 2011-09-19  Oliver Hunt  <oliver@apple.com>
2677
2678         Rename NewSpace to MarkedSpace
2679         https://bugs.webkit.org/show_bug.cgi?id=68375
2680
2681         Reviewed by Gavin Barraclough.
2682
2683         Rename NewSpace to a more accurate name, and update all uses.
2684         This patch doesn't rename the files themselves as that will
2685         just make the patch appear bigger than it is.
2686
2687         * JavaScriptCore.exp:
2688         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2689         * heap/Heap.cpp:
2690         (JSC::CountFunctor::TakeIfEmpty::TakeIfEmpty):
2691         (JSC::CountFunctor::TakeIfEmpty::operator()):
2692         (JSC::Heap::Heap):
2693         (JSC::Heap::reportExtraMemoryCostSlowCase):
2694         (JSC::Heap::tryAllocate):
2695         (JSC::Heap::allocateSlowCase):
2696         (JSC::Heap::collect):
2697         (JSC::Heap::canonicalizeBlocks):
2698         (JSC::Heap::resetAllocator):
2699         (JSC::Heap::isValidAllocation):
2700         (JSC::Heap::shrink):
2701         * heap/Heap.h:
2702         (JSC::Heap::markedSpace):
2703         (JSC::Heap::sizeClassFor):
2704         (JSC::Heap::allocate):
2705         * heap/NewSpace.cpp:
2706         (JSC::MarkedSpace::MarkedSpace):
2707         (JSC::MarkedSpace::addBlock):
2708         (JSC::MarkedSpace::removeBlock):
2709         (JSC::MarkedSpace::resetAllocator):
2710         (JSC::MarkedSpace::canonicalizeBlocks):
2711         * heap/NewSpace.h:
2712         (JSC::MarkedSpace::waterMark):
2713         (JSC::MarkedSpace::highWaterMark):
2714         (JSC::MarkedSpace::setHighWaterMark):
2715         (JSC::MarkedSpace::sizeClassFor):
2716         (JSC::MarkedSpace::allocate):
2717         (JSC::MarkedSpace::forEachBlock):
2718         (JSC::MarkedSpace::SizeClass::SizeClass):
2719         (JSC::MarkedSpace::SizeClass::resetAllocator):
2720         (JSC::MarkedSpace::SizeClass::canonicalizeBlock):
2721         * jit/JITInlineMethods.h:
2722         (JSC::JIT::emitAllocateBasicJSObject):
2723
2724 2011-09-19  Peter Rybin  <peter.rybin@gmail.com>
2725
2726         TextPosition refactoring: Merge ZeroBasedNumber and OneBasedNumber classes
2727         https://bugs.webkit.org/show_bug.cgi?id=63541
2728
2729         Reviewed by Adam Barth.
2730
2731         * parser/SourceProvider.h:
2732         (JSC::SourceProvider::startPosition):
2733         * wtf/text/TextPosition.h:
2734         (WTF::OrdinalNumber::fromZeroBasedInt):
2735         (WTF::OrdinalNumber::fromOneBasedInt):
2736         (WTF::OrdinalNumber::OrdinalNumber):
2737         (WTF::OrdinalNumber::zeroBasedInt):
2738         (WTF::OrdinalNumber::oneBasedInt):
2739         (WTF::OrdinalNumber::operator==):
2740         (WTF::OrdinalNumber::operator!=):
2741         (WTF::OrdinalNumber::first):
2742         (WTF::OrdinalNumber::beforeFirst):
2743         (WTF::TextPosition::TextPosition):
2744         (WTF::TextPosition::minimumPosition):
2745         (WTF::TextPosition::belowRangePosition):
2746
2747 2011-09-19  Dan Bernstein  <mitz@apple.com>
2748
2749         JavaScriptCore part of [mac] WebKit contains Objective-C classes that are not prefixed with its standard prefixes
2750         https://bugs.webkit.org/show_bug.cgi?id=68323
2751
2752         Reviewed by Sam Weinig.
2753
2754         Renamed WTFMainThreadCaller to JSWTFMainThreadCaller.
2755
2756         * wtf/mac/MainThreadMac.mm:
2757         (WTF::initializeMainThreadPlatform):
2758         (WTF::initializeMainThreadToProcessMainThreadPlatform):
2759
2760 2011-09-19  Oliver Hunt  <oliver@apple.com>
2761
2762         Remove direct property slot pointers from the instruction stream
2763         https://bugs.webkit.org/show_bug.cgi?id=68373
2764
2765         Reviewed by Gavin Barraclough.
2766
2767         Use an indirect load to access prototype properties rather than directly
2768         storing the property address in the instruction stream.  This should allow
2769         further optimisations in future, and also provides a 0.5% win to sunspider.
2770
2771         * dfg/DFGRepatch.cpp:
2772         (JSC::DFG::generateProtoChainAccessStub):
2773         * jit/JITPropertyAccess.cpp:
2774         (JSC::JIT::compileGetDirectOffset):
2775         * jit/JITPropertyAccess32_64.cpp:
2776         (JSC::JIT::compileGetDirectOffset):
2777         * runtime/JSObject.h:
2778         (JSC::JSObject::addressOfPropertyStorage):
2779
2780 2011-09-19  Oliver Hunt  <oliver@apple.com>
2781
2782         Remove bump allocator
2783         https://bugs.webkit.org/show_bug.cgi?id=68370
2784
2785         Reviewed by Sam Weinig.
2786
2787         Can't do anything with this allocator currently, and it's
2788         increasing the complexity of the GC code.  Slight progression
2789         on SunSpider, slight regression (undoing the original progression)
2790         in V8.
2791
2792         * heap/Heap.cpp:
2793         (JSC::Heap::collect):
2794         * heap/Heap.h:
2795         * heap/NewSpace.cpp:
2796         (JSC::NewSpace::NewSpace):
2797         * heap/NewSpace.h:
2798         (JSC::NewSpace::allocate):
2799         * runtime/JSObject.cpp:
2800         (JSC::JSObject::allocatePropertyStorage):
2801         * runtime/JSObject.h:
2802         (JSC::JSObject::~JSObject):
2803         (JSC::JSObject::visitChildrenDirect):
2804         * runtime/StorageBarrier.h:
2805         (JSC::StorageBarrier::set):
2806
2807 2011-09-19  Carlos Garcia Campos  <cgarcia@igalia.com>
2808
2809         [GTK] Fix distcheck build
2810         https://bugs.webkit.org/show_bug.cgi?id=68346
2811
2812         Reviewed by Philippe Normand.
2813
2814         * GNUmakefile.list.am:
2815
2816 2011-09-19  Carlos Garcia Campos  <cgarcia@igalia.com>
2817
2818         [GTK] Fix distcheck build
2819         https://bugs.webkit.org/show_bug.cgi?id=68241
2820
2821         Reviewed by Martin Robinson.
2822
2823         * GNUmakefile.list.am:
2824
2825 2011-09-18  Dan Bernstein  <mitz@apple.com>
2826
2827         Removed ProfilerServer.
2828
2829         Reviewed by Mark Rowe.
2830
2831         * JavaScriptCore.gypi:
2832         * JavaScriptCore.xcodeproj/project.pbxproj:
2833         * profiler/ProfilerServer.h: Removed.
2834         * profiler/ProfilerServer.mm: Removed.
2835         * runtime/JSGlobalData.cpp:
2836         (JSC::JSGlobalData::JSGlobalData):
2837         * wscript:
2838
2839 2011-09-17  Filip Pizlo  <fpizlo@apple.com>
2840
2841         DFG JIT should inline Math.min, Math.max, and Math.sqrt
2842         https://bugs.webkit.org/show_bug.cgi?id=68318
2843
2844         Reviewed by Gavin Barraclough.
2845
2846         Adds Math.min, Math.max, and Math.sqrt intrinsics. Adds support for
2847         a function to have an intrinsic but not a thunk generator. This is
2848         a 7% speed-up on access-nbody, and neutral elsewhere, mainly because
2849         we're still not DFG compiling the bulk of the hot code in Kraken audio
2850         benchmarks.
2851
2852         * create_hash_table:
2853         * dfg/DFGByteCodeParser.cpp:
2854         (JSC::DFG::ByteCodeParser::handleMinMax):
2855         (JSC::DFG::ByteCodeParser::handleIntrinsic):
2856         * dfg/DFGIntrinsic.h:
2857         * dfg/DFGNode.h:
2858         * dfg/DFGPropagator.cpp:
2859         (JSC::DFG::Propagator::propagateNode):
2860         (JSC::DFG::Propagator::fixupNode):
2861         * dfg/DFGSpeculativeJIT.cpp:
2862         (JSC::DFG::SpeculativeJIT::compile):
2863         * jit/JITStubs.cpp:
2864         (JSC::JITThunks::hostFunctionStub):
2865         * runtime/Lookup.cpp:
2866         (JSC::setUpStaticFunctionSlot):
2867
2868 2011-09-18  Nico Weber  <thakis@chromium.org>
2869
2870         Remove two files from JavaScriptCore.gypi that were removed in r95240
2871         https://bugs.webkit.org/show_bug.cgi?id=68327
2872
2873         Unreviewed, build warning fix.
2874
2875         * JavaScriptCore.gypi:
2876
2877 2011-09-17  Oliver Hunt  <oliver@apple.com>
2878
2879         Remove special case handling of inline storage from the JIT
2880         https://bugs.webkit.org/show_bug.cgi?id=68319
2881
2882         Reviewed by Gavin Barraclough.
2883
2884         Simplify logic used for reading and writing to property storage
2885         by removing the special cases for inline storage.  This has no
2886         perf impact.
2887
2888         * dfg/DFGRepatch.cpp:
2889         (JSC::DFG::generateProtoChainAccessStub):
2890         (JSC::DFG::tryBuildGetByIDList):
2891         * jit/JIT.h:
2892         * jit/JITPropertyAccess.cpp:
2893         (JSC::JIT::compilePutDirectOffset):
2894         (JSC::JIT::compileGetDirectOffset):
2895         (JSC::JIT::privateCompilePutByIdTransition):
2896         (JSC::JIT::privateCompileGetByIdSelfList):
2897         * jit/JITPropertyAccess32_64.cpp:
2898         (JSC::JIT::compilePutDirectOffset):
2899         (JSC::JIT::compileGetDirectOffset):
2900         (JSC::JIT::privateCompilePutByIdTransition):
2901         (JSC::JIT::privateCompileGetByIdSelfList):
2902
2903 2011-09-17  Filip Pizlo  <fpizlo@apple.com>
2904
2905         DFG JIT does not have full block-local CSE
2906         https://bugs.webkit.org/show_bug.cgi?id=68316
2907
2908         Reviewed by Oliver Hunt.
2909
2910         This adds block-local CSE to the DFG. CSE runs in the propagator just after
2911         type propagation. It is part of the propagator itself because it needs to
2912         use the propagator's internal data structures to determine which operations
2913         may have side effects. Because it changes the live-ranges of nodes, the
2914         virtual register allocator had to be moved into the propagator so that it
2915         runs after CSE. To ensure that the back-end knows to keep the inputs to
2916         any eliminated node alive for OSR, a new node type, Phantom, was introduced.
2917         It is a no-op but prolonges the live-range of its inputs.
2918
2919         This is an 80% speed-up on imaging-gaussian-blur, and a 10% speed-up on
2920         Kraken.
2921
2922         * JavaScriptCore.xcodeproj/project.pbxproj:
2923         * dfg/DFGAliasTracker.h: Removed.
2924         * dfg/DFGByteCodeParser.cpp:
2925         (JSC::DFG::ByteCodeParser::parseBlock):
2926         (JSC::DFG::ByteCodeParser::parse):
2927         * dfg/DFGGraph.cpp:
2928         (JSC::DFG::Graph::dump):
2929         * dfg/DFGGraph.h:
2930         (JSC::DFG::MethodCheckData::operator==):
2931         (JSC::DFG::MethodCheckData::operator!=):
2932         * dfg/DFGNode.h:
2933         (JSC::DFG::Node::hasVirtualRegister):
2934         (JSC::DFG::Node::setRefCount):
2935         * dfg/DFGPropagator.cpp:
2936         (JSC::DFG::Propagator::Propagator):
2937         (JSC::DFG::Propagator::fixpoint):
2938         (JSC::DFG::Propagator::propagateNode):
2939         (JSC::DFG::Propagator::canonicalize):
2940         (JSC::DFG::Propagator::computeStartIndex):
2941         (JSC::DFG::Propagator::startIndex):
2942         (JSC::DFG::Propagator::pureCSE):
2943         (JSC::DFG::Propagator::globalVarLoadElimination):
2944         (JSC::DFG::Propagator::getByValLoadElimination):
2945         (JSC::DFG::Propagator::getMethodLoadElimination):
2946         (JSC::DFG::Propagator::performSubstitution):
2947         (JSC::DFG::Propagator::setReplacement):
2948         (JSC::DFG::Propagator::performNodeCSE):
2949         (JSC::DFG::Propagator::performBlockCSE):
2950         (JSC::DFG::Propagator::localCSE):
2951         (JSC::DFG::Propagator::allocateVirtualRegisters):
2952         (JSC::DFG::propagate):
2953         * dfg/DFGSpeculativeJIT.cpp:
2954         (JSC::DFG::SpeculativeJIT::compile):
2955
2956 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
2957
2958         method_check should repatch itself if it finds that the new structure(s)
2959         are the result of transitions from the old structure(s)
2960         https://bugs.webkit.org/show_bug.cgi?id=68294
2961
2962         Reviewed by Gavin Barraclough.
2963
2964         Previously a patched method_check would slow-path to get_by_id. Now it
2965         slow-paths to method_check_update, which attempts to correct the
2966         method_check due to structure transitions before bailing to get_by_id.
2967
2968         This is a 1-2% speed-up on some benchmarks and is not a slow-down
2969         anywhere, leading to a 0.6% speed-up on the Kraken geomean.
2970
2971         * jit/JITPropertyAccess.cpp:
2972         (JSC::JIT::patchMethodCallProto):
2973         * jit/JITStubs.cpp:
2974         (JSC::DEFINE_STUB_FUNCTION):
2975         * jit/JITStubs.h:
2976         * runtime/Structure.h:
2977         (JSC::Structure::transitivelyTransitionedFrom):
2978
2979 2011-09-16  Ryosuke Niwa  <rniwa@webkit.org>
2980
2981         Touch Platform.h in the hope to fix SnowLeopard Intel Release (WebKit2 Tests).
2982
2983         * wtf/Platform.h:
2984
2985 2011-09-16  Sam Weinig  <sam@webkit.org>
2986
2987         Rename APIValueWrapper type to APIValueWrapperType for consistency
2988         https://bugs.webkit.org/show_bug.cgi?id=68306
2989
2990         Reviewed by Anders Carlsson.
2991
2992         * runtime/JSAPIValueWrapper.h:
2993         (JSC::JSAPIValueWrapper::createStructure):
2994         Update name.
2995
2996         * runtime/JSType.h:
2997         Update name and un-indent.
2998
2999         * runtime/Structure.h:
3000         (JSC::JSCell::isAPIValueWrapper):
3001         Update name.
3002
3003 2011-09-16  Sam Weinig  <sam@webkit.org>
3004
3005         Remove unused isStrictModeFunction function
3006         https://bugs.webkit.org/show_bug.cgi?id=68305
3007
3008         Reviewed by Anders Carlsson.
3009
3010         * runtime/JSObject.h:
3011         (JSC::JSObject::isStrictModeFunction):
3012
3013 2011-09-16  Sam Weinig  <sam@webkit.org>
3014
3015         Cleanup JSTypeInfo a bit
3016         https://bugs.webkit.org/show_bug.cgi?id=68289
3017
3018         Reviewed by Anders Carlsson.
3019
3020         * dfg/DFGOperations.cpp:
3021         * jit/JITStubs.cpp:
3022         (JSC::DEFINE_STUB_FUNCTION):
3023         Replace direct access to flags() with predicate.
3024
3025         * runtime/JSObject.h:
3026         (JSC::JSFinalObject::createStructure):
3027         Pass FinalObjectType instead of using special IsJSFinalObject.
3028
3029         * runtime/JSTypeInfo.h:
3030         (JSC::TypeInfo::TypeInfo):
3031         Add additional assert that you should no object should OverridesHasInstance but not have ImplementsHasInstance set.
3032
3033         (JSC::TypeInfo::isFinalObject):
3034         Added.
3035
3036         (JSC::TypeInfo::masqueradesAsUndefined):
3037         (JSC::TypeInfo::implementsHasInstance):
3038         (JSC::TypeInfo::isEnvironmentRecord):
3039         (JSC::TypeInfo::overridesHasInstance):
3040         (JSC::TypeInfo::implementsDefaultHasInstance):
3041         (JSC::TypeInfo::overridesGetOwnPropertySlot):
3042         (JSC::TypeInfo::overridesVisitChildren):
3043         (JSC::TypeInfo::overridesGetPropertyNames):
3044         (JSC::TypeInfo::prohibitsPropertyCaching):
3045         (JSC::TypeInfo::isSetOnFlags1):
3046         (JSC::TypeInfo::isSetOnFlags2):
3047         Replace direct bit twiddling with helper functions.
3048
3049         * runtime/Structure.cpp:
3050         (JSC::Structure::Structure):
3051         Use new isFinalObject() predicate.
3052
3053 2011-09-16  Gavin Barraclough  <barraclough@apple.com>
3054
3055         Unsigned bit shift fails under certain conditions in 32 bit builds
3056         https://bugs.webkit.org/show_bug.cgi?id=68166
3057
3058         Reviewed by Geoff Garen.
3059
3060         The major bug here is that the slow case (which handles shifts of
3061         doubles) doesn't check for negative results from an unsigned shift
3062         (which should be unsigned, and as such can't be represented by a
3063         signed integer immediate).  The implementation is also flawed for
3064         shifts by negative shift amounts (treats as shift by zero).
3065
3066         * jit/JITArithmetic32_64.cpp:
3067         (JSC::JIT::emitRightShift):
3068         (JSC::JIT::emitRightShiftSlowCase):
3069
3070 2011-09-16  Geoffrey Garen  <ggaren@apple.com>
3071
3072         Removed undetectable style.filter.
3073
3074         Reviewed by Sam Weinig.
3075
3076         This feature was added in http://trac.webkit.org/changeset/15557 to
3077         support housingmaps.com. But housingmaps.com no longer needs this hack,
3078         we don't know of other websites that need it, and we don't know of
3079         any other browsers that have implemented this feature.
3080
3081         * GNUmakefile.list.am:
3082         * JavaScriptCore.gypi:
3083         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3084         * JavaScriptCore.xcodeproj/project.pbxproj:
3085         * runtime/JSTypeInfo.h:
3086         * runtime/StringObjectThatMasqueradesAsUndefined.h: Removed.
3087
3088 2011-09-15  Sam Weinig  <sam@webkit.org>
3089
3090         Prepare JSTypes for more Object subtypes
3091         https://bugs.webkit.org/show_bug.cgi?id=68200
3092
3093         Reviewed by Gavin Barraclough.
3094
3095         * dfg/DFGJITCompiler.h:
3096         (JSC::DFG::JITCompiler::branchIfNotObject):
3097         * jit/JITInlineMethods.h:
3098         (JSC::JIT::emitJumpIfNotObject):
3099         * runtime/JSGlobalObject.h:
3100         (JSC::Structure::prototypeForLookup):
3101         * runtime/JSObject.h:
3102         (JSC::JSObject::finishCreation):
3103         * runtime/JSType.h:
3104         * runtime/JSTypeInfo.h:
3105         (JSC::TypeInfo::type):
3106         (JSC::TypeInfo::isObject):
3107         (JSC::TypeInfo::isFinal):
3108         (JSC::TypeInfo::prohibitsPropertyCaching):
3109         * runtime/NativeErrorConstructor.h:
3110         (JSC::NativeErrorConstructor::finishCreation):
3111         * runtime/Operations.cpp:
3112         (JSC::jsIsObjectType):
3113         * runtime/Structure.cpp:
3114         (JSC::Structure::addPropertyTransitionToExistingStructure):
3115         (JSC::Structure::addPropertyTransition):
3116         * runtime/Structure.h:
3117         (JSC::Structure::isObject):
3118         (JSC::JSCell::isObject):
3119
3120 2011-09-16  Geoffrey Garen  <ggaren@apple.com>
3121
3122         Rolled back in r95201 with test failure fixed.
3123
3124         I missed two cases of jumpSlowToHot in rshift -- these cases need to be
3125         sure to initialize regT1 to the int tag, since it will otherwise hold
3126         the top 32 bits of a double.
3127
3128         * jit/JIT.h:
3129         * jit/JITArithmetic32_64.cpp:
3130         (JSC::JIT::emit_op_lshift):
3131         (JSC::JIT::emitRightShift):
3132         (JSC::JIT::emitRightShiftSlowCase):
3133         (JSC::JIT::emit_op_bitand):
3134         (JSC::JIT::emit_op_bitor):
3135         (JSC::JIT::emit_op_bitxor):
3136         (JSC::JIT::emit_op_bitnot):
3137         (JSC::JIT::emit_op_post_inc):
3138         (JSC::JIT::emit_op_post_dec):
3139         (JSC::JIT::emit_op_pre_inc):
3140         (JSC::JIT::emit_op_pre_dec):
3141         * jit/JITInlineMethods.h:
3142         (JSC::JIT::emitStoreAndMapInt32):
3143
3144 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
3145
3146         Unreviewed Windows build fix after 95318.
3147
3148         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3149
3150 2011-09-16  Adam Roben  <aroben@apple.com>
3151
3152         Windows build fix after r95310
3153
3154         * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added include\private\JavaScriptCore to the
3155         include path so DFGIntrinsic.h can be found.
3156
3157 2011-09-16  Gavin Barraclough  <barraclough@apple.com>
3158
3159         Rationalize JSObject::putDirect* methods
3160         https://bugs.webkit.org/show_bug.cgi?id=68274
3161
3162         Reviewed by Sam Weinig.
3163
3164         Delete the *Function variants. These are overall inefficient,
3165         in the way they get the name back from the function rather
3166         than just passing it in.
3167
3168         * JavaScriptCore.exp:
3169         * jsc.cpp:
3170         (GlobalObject::finishCreation):
3171         (GlobalObject::addFunction):
3172         * runtime/FunctionPrototype.cpp:
3173         (JSC::FunctionPrototype::addFunctionProperties):
3174         * runtime/JSGlobalObject.cpp:
3175         (JSC::JSGlobalObject::reset):
3176         * runtime/JSObject.cpp:
3177         (JSC::JSObject::put):
3178         (JSC::JSObject::putWithAttributes):
3179         (JSC::JSObject::defineGetter):
3180         (JSC::JSObject::defineSetter):
3181         * runtime/JSObject.h:
3182         (JSC::JSObject::putDirect):
3183         (JSC::JSObject::putDirectWithoutTransition):
3184         * runtime/Lookup.cpp:
3185         (JSC::setUpStaticFunctionSlot):
3186         * runtime/Lookup.h:
3187         (JSC::lookupPut):
3188
3189 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
3190
3191         Unreviewed build fix for Windows.
3192
3193         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3194
3195 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
3196
3197         Unreviewed build fix for non-DFG builds.
3198
3199         * runtime/Executable.h:
3200         (JSC::NativeExecutable::finishCreation):
3201
3202 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
3203
3204         DFG JIT should inline Math.abs
3205         https://bugs.webkit.org/show_bug.cgi?id=68227
3206
3207         Reviewed by Oliver Hunt.
3208
3209         This adds the ability to track intrinsic functions throughout the
3210         host function infrastructure, so that the DFG can easily query
3211         whether or not a call's target is intrinsic, and if so, which
3212         intrinsic it is.
3213
3214         On top of this, it adds Math.abs intrinsics to DFG. Call(Math.abs)
3215         is transformed into ValueToNumber<-ArithAbs nodes. These nodes
3216         then get optimized using the usual tricks.
3217
3218         Also had to make a completely unrelated change to
3219         DateInstanceCache.h in order to fix a preexisting alphabetical
3220         sorting problem in JSGlobalData.h
3221
3222         This results in a big win in imaging-gaussian-blur: 61% faster
3223         than before. The net win on Kraken is around 13%.
3224
3225         * JavaScriptCore.xcodeproj/project.pbxproj:
3226         * create_hash_table:
3227         * dfg/DFGByteCodeParser.cpp:
3228         (JSC::DFG::ByteCodeParser::parseBlock):
3229         * dfg/DFGGraph.h:
3230         (JSC::DFG::Graph::isFunctionConstant):
3231         (JSC::DFG::Graph::valueOfFunctionConstant):
3232         * dfg/DFGIntrinsic.h: Added.
3233         * dfg/DFGJITCodeGenerator.h:
3234         (JSC::DFG::JITCodeGenerator::isFunctionConstant):
3235         (JSC::DFG::JITCodeGenerator::valueOfFunctionConstant):
3236         * dfg/DFGJITCompiler.h:
3237         (JSC::DFG::JITCompiler::isFunctionConstant):
3238         (JSC::DFG::JITCompiler::valueOfFunctionConstant):
3239         * dfg/DFGNode.h:
3240         * dfg/DFGPropagator.cpp:
3241         (JSC::DFG::Propagator::propagateNode):
3242         * dfg/DFGSpeculativeJIT.cpp:
3243         (JSC::DFG::SpeculativeJIT::compile):
3244         * jit/JITStubs.cpp:
3245         (JSC::JITThunks::hostFunctionStub):
3246         * jit/JITStubs.h:
3247         * runtime/DateInstanceCache.h:
3248         * runtime/Executable.cpp:
3249         (JSC::ExecutableBase::intrinsic):
3250         (JSC::NativeExecutable::intrinsic):
3251         * runtime/Executable.h:
3252         (JSC::NativeExecutable::create):
3253         (JSC::NativeExecutable::finishCreation):
3254         * runtime/JSGlobalData.cpp:
3255         (JSC::JSGlobalData::getHostFunction):
3256         * runtime/JSGlobalData.h:
3257         * runtime/Lookup.cpp:
3258         (JSC::HashTable::createTable):
3259         (JSC::setUpStaticFunctionSlot):
3260         * runtime/Lookup.h:
3261         (JSC::HashEntry::initialize):
3262         (JSC::HashEntry::intrinsic):
3263
3264 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
3265
3266         REGRESSION: Reproducible crash below SlotVisitor::harvestWeakReferences
3267         using Domino's online ordering
3268         https://bugs.webkit.org/show_bug.cgi?id=68220
3269
3270         Reviewed by Oliver Hunt.
3271
3272         Weak handle processing can result in new objects being marked, which
3273         results in new WeakReferencesHarvesters being added. But weak
3274         reference harvesters are only processed before weak handle processing,
3275         so there's the risk that a weak reference harvester will persist
3276         until the next collection, by which time it may have been deleted.
3277
3278         * heap/Heap.cpp:
3279         (JSC::Heap::markRoots):
3280
3281 2011-09-16  Csaba Osztrogonác  <ossy@webkit.org>
3282
3283         REGRESSION(r95201): It made two tests fail
3284         https://bugs.webkit.org/show_bug.cgi?id=68230
3285
3286         Unreviewed rolling out r95201.
3287
3288         * jit/JIT.h:
3289         * jit/JITArithmetic32_64.cpp:
3290         (JSC::JIT::emit_op_lshift):
3291         (JSC::JIT::emitRightShift):
3292         (JSC::JIT::emit_op_bitand):
3293         (JSC::JIT::emit_op_bitor):
3294         (JSC::JIT::emit_op_bitxor):
3295         (JSC::JIT::emit_op_bitnot):
3296         (JSC::JIT::emit_op_post_inc):
3297         (JSC::JIT::emit_op_post_dec):
3298         (JSC::JIT::emit_op_pre_inc):
3299         (JSC::JIT::emit_op_pre_dec):
3300         * jit/JITInlineMethods.h:
3301
3302 2011-09-15  Filip Pizlo  <fpizlo@apple.com>
3303
3304         DFG JIT does not optimize method_check
3305         https://bugs.webkit.org/show_bug.cgi?id=68215
3306
3307         Reviewed by Oliver Hunt.
3308
3309         MethodCallLinkInfo and StructureStubInfo are now searchable by
3310         bytecodeIndex, so that DFG::ByteCodeParser can use that information
3311         to determine how to optimize GetMethod.
3312
3313         A new node op has been added to DFG: CheckMethod. This is a variant
3314         of GetMethod that has been optimized for the case that GetMethod
3315         always takes the fast path. CheckMethod results in only a very
3316         small amount of code (two loads and two branches in the worst case,
3317         one load and one branch in the best case). CheckMethod behaves as
3318         if it were a constant.
3319
3320         Introduced the notion that a DFG node that is not JSConstant
3321         behaves as a constant. CheckMethod uses this functionality.
3322
3323         This is a 3% speed-up on Kraken, and a small speed-up on V8.
3324         Appears to be neutral on SunSpider.
3325
3326         * bytecode/CodeBlock.h:
3327         (JSC::getStructureStubInfoBytecodeIndex):
3328         (JSC::getMethodCallLinkInfoBytecodeIndex):
3329         * bytecode/PredictedType.cpp:
3330         (JSC::predictionFromCell):
3331         (JSC::predictionFromValue):
3332         * bytecode/PredictedType.h:
3333         * bytecode/StructureStubInfo.h:
3334         * dfg/DFGAliasTracker.h:
3335         (JSC::DFG::AliasTracker::recordGetMethod):
3336         * dfg/DFGByteCodeParser.cpp:
3337         (JSC::DFG::ByteCodeParser::parseBlock):
3338         * dfg/DFGGraph.cpp:
3339         (JSC::DFG::Graph::dump):
3340         * dfg/DFGGraph.h:
3341         (JSC::DFG::Graph::getMethodCheckPrediction):
3342         (JSC::DFG::Graph::getPrediction):
3343         (JSC::DFG::Graph::isConstant):
3344         (JSC::DFG::Graph::isJSConstant):
3345         (JSC::DFG::Graph::valueOfJSConstant):
3346         (JSC::DFG::Graph::valueOfInt32Constant):
3347         (JSC::DFG::Graph::valueOfNumberConstant):
3348         (JSC::DFG::Graph::valueOfBooleanConstant):
3349         (JSC::DFG::Graph::valueOfJSConstantNode):
3350         * dfg/DFGJITCodeGenerator.cpp:
3351         (JSC::DFG::JITCodeGenerator::fillInteger):
3352         (JSC::DFG::JITCodeGenerator::fillDouble):
3353         (JSC::DFG::JITCodeGenerator::fillJSValue):
3354         (JSC::DFG::JITCodeGenerator::isKnownNotInteger):
3355         (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
3356         * dfg/DFGJITCodeGenerator.h:
3357         (JSC::DFG::JITCodeGenerator::silentSpillFPR):
3358         (JSC::DFG::JITCodeGenerator::silentFillGPR):
3359         (JSC::DFG::JITCodeGenerator::silentFillFPR):
3360         * dfg/DFGJITCompiler.cpp:
3361         (JSC::DFG::JITCompiler::fillNumericToDouble):
3362         (JSC::DFG::JITCompiler::fillInt32ToInteger):
3363         (JSC::DFG::JITCompiler::fillToJS):
3364         * dfg/DFGNode.h:
3365         (JSC::DFG::Node::hasConstant):
3366         (JSC::DFG::Node::hasIdentifier):
3367         (JSC::DFG::Node::hasMethodCheckData):
3368         (JSC::DFG::Node::methodCheckDataIndex):
3369         (JSC::DFG::Node::valueOfJSConstant):
3370         * dfg/DFGPropagator.cpp:
3371         (JSC::DFG::Propagator::propagateNode):
3372         * dfg/DFGSpeculativeJIT.cpp:
3373         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
3374         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
3375         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
3376         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
3377         (JSC::DFG::SpeculativeJIT::compile):
3378         * jit/JIT.cpp:
3379         (JSC::JIT::privateCompile):
3380         * jit/JIT.h:
3381         (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
3382         (JSC::MethodCallCompilationInfo::MethodCallCompilationInfo):
3383         * jit/JITPropertyAccess.cpp:
3384         (JSC::JIT::emit_op_method_check):
3385         (JSC::JIT::compileGetByIdHotPath):
3386         (JSC::JIT::emit_op_put_by_id):
3387         * jit/JITPropertyAccess32_64.cpp:
3388         (JSC::JIT::emit_op_method_check):
3389         (JSC::JIT::compileGetByIdHotPath):
3390         (JSC::JIT::emit_op_put_by_id):
3391         * runtime/JSCell.h:
3392         (JSC::JSCell::JSCell::structureAddress):
3393
3394 2011-09-15  Adam Barth  <abarth@webkit.org>
3395
3396         Rename ENABLE(DATABASE) to ENABLE(SQL_DATABASE)
3397         https://bugs.webkit.org/show_bug.cgi?id=68205
3398
3399         Reviewed by Eric Seidel.
3400
3401         * Configurations/FeatureDefines.xcconfig:
3402         * wtf/Platform.h:
3403
3404 2011-09-15  Mark Hahnenberg  <mhahnenberg@apple.com>
3405
3406         Unzip initialization lists and constructors in JSCell hierarchy (7/7)
3407         https://bugs.webkit.org/show_bug.cgi?id=68122
3408
3409         Reviewed by Geoffrey Garen.
3410
3411         Completed the seventh and final level of the refactoring to add finishCreation()
3412         methods to all classes within the JSCell hierarchy with non-trivial
3413         constructor bodies.
3414
3415         JSCallbackObject was missed in previous patches due to the fact that
3416         it's non-obvious (at least to my script) that it is in the JSCell hierarchy, so
3417         this is just a bit of retroactive cleanup.
3418
3419         * API/JSCallbackObject.h:
3420         (JSC::JSCallbackObject::create):
3421         * API/JSCallbackObjectFunctions.h:
3422         (JSC::::JSCallbackObject):
3423
3424 2011-09-15  Filip Pizlo  <fpizlo@apple.com>
3425
3426         The DFG non-speculative JIT is no longer used and should be removed.
3427         https://bugs.webkit.org/show_bug.cgi?id=68177
3428
3429         Reviewed by Geoffrey Garen.
3430
3431         This removes the non-speculative JIT and everything that relied on it,
3432         including the ability to turn on DFG but not tiered compilation the,
3433         ability to perform speculation failure into non-speculative JIT code,
3434         and the ability to statically terminate speculation.
3435
3436         * GNUmakefile.list.am:
3437         * JavaScriptCore.pro:
3438         * JavaScriptCore.xcodeproj/project.pbxproj:
3439         * bytecode/CodeBlock.h:
3440         * bytecompiler/BytecodeGenerator.cpp:
3441         (JSC::BytecodeGenerator::emitLoopHint):
3442         * dfg/DFGByteCodeParser.cpp:
3443         (JSC::DFG::ByteCodeParser::ByteCodeParser):
3444         (JSC::DFG::ByteCodeParser::getStrongPrediction):
3445         (JSC::DFG::ByteCodeParser::parseBlock):
3446         * dfg/DFGDriver.cpp:
3447         (JSC::DFG::compile):
3448         * dfg/DFGGenerationInfo.h:
3449         * dfg/DFGGraph.cpp:
3450         (JSC::DFG::Graph::predictArgumentTypes):
3451         * dfg/DFGJITCodeGenerator.cpp:
3452         * dfg/DFGJITCompiler.cpp:
3453         (JSC::DFG::JITCompiler::linkOSRExits):
3454         (JSC::DFG::JITCompiler::compileBody):
3455         * dfg/DFGJITCompiler.h:
3456         * dfg/DFGNode.h:
3457         * dfg/DFGNonSpeculativeJIT.cpp: Removed.
3458         * dfg/DFGNonSpeculativeJIT.h: Removed.
3459         * dfg/DFGOSREntry.cpp:
3460         (JSC::DFG::prepareOSREntry):
3461         * dfg/DFGPropagator.cpp:
3462         * dfg/DFGPropagator.h:
3463         * dfg/DFGSpeculativeJIT.cpp:
3464         (JSC::DFG::SpeculativeJIT::compile):
3465         * dfg/DFGSpeculativeJIT.h:
3466         (JSC::DFG::SpeculativeJIT::osrExits):
3467         (JSC::DFG::SpeculativeJIT::speculationRecovery):
3468         (JSC::DFG::SpeculativeJIT::speculationCheck):
3469         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
3470         * jit/JIT.cpp:
3471         (JSC::JIT::privateCompileMainPass):
3472         (JSC::JIT::privateCompile):
3473         * jit/JIT.h:
3474         * jit/JITCode.h:
3475         (JSC::JITCode::bottomTierJIT):
3476         * runtime/JSGlobalData.cpp:
3477         (JSC::JSGlobalData::JSGlobalData):
3478         (JSC::JSGlobalData::~JSGlobalData):
3479         * runtime/JSGlobalData.h:
3480         * wtf/Platform.h:
3481
3482 2011-09-15  Eric Seidel  <eric@webkit.org>
3483
3484         Remove ENABLE(SVG_AS_IMAGE) since all major ports have it on by default
3485         https://bugs.webkit.org/show_bug.cgi?id=68182
3486
3487         Reviewed by Adam Barth.
3488
3489         * Configurations/FeatureDefines.xcconfig:
3490
3491 2011-09-15  Filip Pizlo  <fpizlo@apple.com>
3492
3493         DFG speculative JIT sometimes asserts that a value is not a number
3494         even when it doesn't know anything about the number
3495         https://bugs.webkit.org/show_bug.cgi?id=68189
3496
3497         Reviewed by Oliver Hunt.
3498
3499         * dfg/DFGGenerationInfo.h:
3500         (JSC::DFG::GenerationInfo::isUnknownJS):
3501         * dfg/DFGJITCodeGenerator.cpp:
3502         (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
3503
3504 2011-09-15  Filip Pizlo  <fpizlo@apple.com>
3505
3506         All of the functionality in the non-speculative JIT should be
3507         available to the speculative JIT via helper methods
3508         https://bugs.webkit.org/show_bug.cgi?id=68186
3509
3510         Reviewed by Oliver Hunt.
3511
3512         Stole all of the goodness from NonSpeculativeJIT and placed it
3513         in JITCodeGenerator.  Left all of the badness (i.e. subtle code
3514         duplication with SpeculativeJIT, etc).  This is in preparation
3515         for removing the NonSpeculativeJIT entirely, but having its
3516         goodness available for reuse in the SpeculativeJIT if necessary.
3517
3518         * dfg/DFGJITCodeGenerator.cpp:
3519         (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToNumber):
3520         (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
3521         (JSC::DFG::JITCodeGenerator::nonSpeculativeUInt32ToNumber):
3522         (JSC::DFG::JITCodeGenerator::nonSpeculativeKnownConstantArithOp):
3523         (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
3524         (JSC::DFG::JITCodeGenerator::nonSpeculativeArithMod):
3525         (JSC::DFG::JITCodeGenerator::nonSpeculativeCheckHasInstance):
3526         (JSC::DFG::JITCodeGenerator::nonSpeculativeInstanceOf):
3527         * dfg/DFGJITCodeGenerator.h:
3528         (JSC::DFG::JITCodeGenerator::nonSpeculativeAdd):
3529         (JSC::DFG::JITCodeGenerator::nonSpeculativeArithSub):
3530         * dfg/DFGNonSpeculativeJIT.cpp:
3531         (JSC::DFG::NonSpeculativeJIT::compile):
3532         * dfg/DFGNonSpeculativeJIT.h:
3533
3534 2011-09-15  Sheriff Bot  <webkit.review.bot@gmail.com>
3535
3536         Unreviewed, rolling out r95167.
3537         http://trac.webkit.org/changeset/95167
3538         https://bugs.webkit.org/show_bug.cgi?id=68191
3539
3540         Patch needs further work. (Requested by mhahnenberg on
3541         #webkit).
3542
3543         * JavaScriptCore.exp:
3544         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3545         * runtime/JSCell.cpp:
3546         (JSC::JSCell::toBoolean):
3547         * runtime/JSCell.h:
3548         (JSC::JSCell::JSValue::toBoolean):
3549         * runtime/JSNotAnObject.cpp:
3550         (JSC::JSNotAnObject::toBoolean):
3551         * runtime/JSNotAnObject.h:
3552         * runtime/JSObject.h:
3553         * runtime/JSString.h:
3554         * runtime/StringObjectThatMasqueradesAsUndefined.h:
3555         (JSC::StringObjectThatMasqueradesAsUndefined::toBoolean):
3556
3557 2011-09-15  Filip Pizlo  <fpizlo@apple.com>
3558
3559         Unreviewed build fix for platforms that expect a linkable symbol
3560         for primitive static const's.
3561
3562         * bytecode/CodeBlock.h:
3563         * jit/JIT.cpp:
3564         (JSC::JIT::emitOptimizationCheck):
3565
3566 2011-09-15  Filip Pizlo  <fpizlo@apple.com>
3567
3568         Unreviewed build fix for assertion on existence of alternative
3569         CodeBlock.
3570
3571         * dfg/DFGGraph.cpp:
3572         (JSC::DFG::Graph::predictArgumentTypes):
3573
3574 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
3575
3576         Value profiles collect no information for global variables
3577         https://bugs.webkit.org/show_bug.cgi?id=68143
3578
3579         Reviewed by Geoffrey Garen.
3580
3581         17% speed-up on string-fasta.  Neutral elsewhere.
3582
3583         * dfg/DFGByteCodeParser.cpp:
3584         (JSC::DFG::ByteCodeParser::getStrongPrediction):
3585         (JSC::DFG::ByteCodeParser::stronglyPredict):
3586         (JSC::DFG::ByteCodeParser::parseBlock):
3587         * jit/JITPropertyAccess.cpp:
3588         (JSC::JIT::emit_op_get_global_var):
3589
3590 2011-09-15  Eric Seidel  <eric@webkit.org>
3591
3592         Remove ENABLE_SVG_ANIMATION as all major ports have it on by default
3593         https://bugs.webkit.org/show_bug.cgi?id=68022
3594
3595         Reviewed by Ryosuke Niwa.
3596
3597         * Configurations/FeatureDefines.xcconfig:
3598
3599 2011-09-15  Gavin Barraclough  <barraclough@apple.com>
3600
3601         Ooops, revert accidentally commited unreviewed changes.
3602
3603         * jit/JITOpcodes32_64.cpp:
3604         (JSC::JIT::emit_op_jfalse):
3605         (JSC::JIT::emit_op_jtrue):
3606         * jit/JSInterfaceJIT.h:
3607         * runtime/JSValue.h:
3608
3609 2011-09-15  Sheriff Bot  <webkit.review.bot@gmail.com>
3610
3611         Unreviewed, rolling out r95163.
3612         http://trac.webkit.org/changeset/95163
3613         https://bugs.webkit.org/show_bug.cgi?id=68180
3614
3615         [Qt] The QT_GCC_X variables were removed in Qt5 by accident.
3616         (Requested by darktears on #webkit).
3617
3618         * JavaScriptCore.pro:
3619
3620 2011-09-15  Gavin Barraclough  <barraclough@apple.com>
3621
3622         Windows build fix p1.
3623
3624         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3625         * jit/JITOpcodes32_64.cpp:
3626         (JSC::JIT::emit_op_jfalse):
3627         (JSC::JIT::emit_op_jtrue):
3628         * jit/JSInterfaceJIT.h:
3629         * runtime/JSValue.h:
3630
3631 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
3632
3633         Tiered compilation should be enabled by default on platforms
3634         that support the DFG JIT
3635         https://bugs.webkit.org/show_bug.cgi?id=68136
3636
3637         Reviewed by Sam Weinig.
3638
3639         Neutral on SunSpider, 4% speed-up on V8, and 19% speed-up on
3640         Kraken.  Large progressions on some benchmarks, including
3641         3x on imaging-desaturate.
3642
3643         * wtf/Platform.h:
3644
3645 2011-09-15  Gavin Barraclough  <barraclough@apple.com>
3646
3647         devirtualize preventExtensions
3648         https://bugs.webkit.org/show_bug.cgi?id=68176
3649
3650         Reviewed by Oliver Hunt.
3651
3652         This is virtual due to problems in JSFunction putting the prototype
3653         property, but we can fix this problem a different way, just setting
3654         the checkReadOnly flag to false in the put.
3655
3656         * runtime/JSFunction.cpp:
3657         (JSC::JSFunction::getOwnPropertySlot):
3658         * runtime/JSFunction.h:
3659         * runtime/JSObject.h:
3660
3661 2011-09-15  Geoffrey Garen  <ggaren@apple.com>
3662
3663         Value chaining for JSValue32_64 bitops.
3664
3665         Reviewed by Sam Weinig.
3666
3667         SunSpider says 2.3% faster, v8 ~1% faster (mostly due to crypto).
3668
3669         * jit/JIT.h:
3670         * jit/JITInlineMethods.h:
3671         (JSC::JIT::emitStoreAndMapInt32): New int32 helper function for stores
3672         that can chain their results, which is the common case.
3673
3674         * jit/JITArithmetic32_64.cpp:
3675         (JSC::JIT::emit_op_lshift):
3676         (JSC::JIT::emitRightShift):
3677         (JSC::JIT::emit_op_bitand):
3678         (JSC::JIT::emit_op_bitor):
3679         (JSC::JIT::emit_op_bitxor):
3680         (JSC::JIT::emit_op_bitnot):
3681         (JSC::JIT::emit_op_pre_inc):
3682         (JSC::JIT::emit_op_pre_dec): Deployed new function.
3683         (JSC::JIT::emit_op_post_inc):
3684         (JSC::JIT::emit_op_post_dec): Had to reorder these functions so they
3685         computed their result values last, to make them elligible for chaining.
3686
3687 2011-09-15  Adam Roben  <aroben@apple.com>
3688
3689         Clang build fix after r95172
3690
3691         * dfg/DFGSpeculativeJIT.h:
3692         (JSC::DFG::SpeculativeJIT::shouldSpeculateFinalObject):
3693         (JSC::DFG::SpeculativeJIT::shouldSpeculateArray):
3694         Added parentheses to make precendence clear.
3695
3696 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
3697
3698         DFG does not speculate aggressively enough on comparisons
3699         https://bugs.webkit.org/show_bug.cgi?id=68138
3700
3701         Reviewed by Oliver Hunt.
3702
3703         This is a 75% speed-up on Kraken/ai-astar.  It's a 1% win on
3704         V8 and an 8.5% win on Kraken.  Neutral on SunSpider.
3705
3706         * dfg/DFGSpeculativeJIT.cpp:
3707         (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
3708         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
3709         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
3710         (JSC::DFG::SpeculativeJIT::compare):
3711         * dfg/DFGSpeculativeJIT.h:
3712         (JSC::DFG::SpeculativeJIT::shouldSpeculateFinalObject):
3713         (JSC::DFG::SpeculativeJIT::shouldSpeculateArray):
3714         (JSC::DFG::SpeculativeJIT::shouldSpeculateObject):
3715         (JSC::DFG::SpeculativeJIT::shouldSpeculateCell):
3716
3717 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
3718
3719         DFG JIT does not leverage integer speculations on branches
3720         https://bugs.webkit.org/show_bug.cgi?id=68140
3721
3722         Reviewed by Oliver Hunt.
3723
3724         * dfg/DFGJITCodeGenerator.cpp:
3725         (JSC::DFG::JITCodeGenerator::isStrictInt32):
3726         * dfg/DFGJITCodeGenerator.h:
3727         * dfg/DFGSpeculativeJIT.cpp:
3728         (JSC::DFG::SpeculativeJIT::compile):
3729
3730 2011-09-14  Gavin Barraclough  <barraclough@apple.com>
3731
3732         [n]stricteq code is bogus in JSValue32_64 JIT
3733         https://bugs.webkit.org/show_bug.cgi?id=68141
3734
3735         Reviewed by Sam Weinig.
3736
3737         The code tries to check for both ints or cells, but this check also
3738         catches cases where values that are undefined, null, etc (probably
3739         was incorrectly assuming cell was the 2nd highest tag?).
3740
3741         Also, there is no need not to handle int on the fast path.
3742         stricteq is just a case of comparing the payloads, if we:
3743             * handle cases of differing tags on a slow path
3744             * handle doubles a slow path
3745             * handle both-are-string on a slow path
3746
3747         * jit/JITOpcodes32_64.cpp:
3748         (JSC::JIT::compileOpStrictEq):
3749         (JSC::JIT::emitSlow_op_stricteq):
3750         (JSC::JIT::emitSlow_op_nstricteq):
3751
3752 2011-09-14  Mark Hahnenberg  <mhahnenberg@apple.com>
3753
3754         Make JSCell::toBoolean non-virtual
3755         https://bugs.webkit.org/show_bug.cgi?id=67727
3756
3757         Reviewed by Sam Weinig.
3758
3759         JSCell::toBoolean now manually performs the toBoolean check for objects and strings (where
3760         before it was simply virtual and would crash if its implementation was called).
3761         Its descendants in JSObject and JSString have also been made non-virtual.  JSCell now
3762         explicitly covers all cases of toBoolean, so having a virtual implementation of
3763         JSCell::toBoolean is no longer necessary.  This is part of a larger process of un-virtualizing JSCell.
3764
3765         * JavaScriptCore.exp:
3766         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3767         * runtime/JSCell.cpp:
3768         * runtime/JSCell.h:
3769         * runtime/JSNotAnObject.cpp:
3770         * runtime/JSNotAnObject.h:
3771         * runtime/JSObject.h:
3772         * runtime/JSString.h:
3773         (JSC::JSCell::toBoolean):
3774         (JSC::JSValue::toBoolean):
3775         * runtime/StringObjectThatMasqueradesAsUndefined.h:
3776
3777 2011-09-14  Alexis Menard  <alexis.menard@openbossa.org>
3778
3779         [Qt] Replace QT_GCC_X as they don't exist in Qt5 anymore.
3780         https://bugs.webkit.org/show_bug.cgi?id=68114
3781
3782         Reviewed by Kenneth Rohde Christiansen.
3783
3784         Use the new GCC_X variables defined in WebKit.pri to replace
3785         the usage of QT_GCC_X.
3786
3787         * JavaScriptCore.pro:
3788
3789 2011-09-14  Sheriff Bot  <webkit.review.bot@gmail.com>
3790
3791         Unreviewed, rolling out r95145.
3792         http://trac.webkit.org/changeset/95145
3793         https://bugs.webkit.org/show_bug.cgi?id=68139
3794
3795         The GTK+ build is working now, so revert this trial build fix.
3796         (Requested by mrobinson on #webkit).
3797
3798         * GNUmakefile.list.am:
3799
3800 2011-09-14  Patrick Gansterer  <paroga@webkit.org>
3801
3802         Port MachineStackMarker to Windows ARM and MIPS
3803         https://bugs.webkit.org/show_bug.cgi?id=68068
3804
3805         Reviewed by Geoffrey Garen.
3806
3807         Use the correct memeber of the CONTEXT struct for the stackpointer for CPU(ARM) and CPU(MIPS).
3808         Only query CONTEXT_INTEGER and CONTEXT_CONTROL, since CONTEXT_SEGMENTS isn't defined for
3809         CPU(ARM) and CPU(MIPS) and the stackpointer is defined in the CONTEXT_CONTROL section for
3810         CPU(ARM), CPU(X86) and CPU(X86_64) and in the CONTEXT_INTEGER section for CPU(MIPS).
3811
3812         * heap/MachineStackMarker.cpp:
3813         (JSC::getPlatformThreadRegisters):
3814         (JSC::otherThreadStackPointer):
3815
3816 2011-09-12  Filip Pizlo  <fpizlo@apple.com>
3817
3818         DFG JIT always speculates that ValueAdd is a numeric addition
3819         https://bugs.webkit.org/show_bug.cgi?id=67956
3820
3821         Reviewed by Geoffrey Garen.
3822
3823         * dfg/DFGJITCodeGenerator.cpp:
3824         (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
3825         * dfg/DFGJITCodeGenerator.h:
3826         * dfg/DFGNonSpeculativeJIT.cpp:
3827         (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
3828         (JSC::DFG::NonSpeculativeJIT::basicArithOp):
3829         * dfg/DFGOperations.cpp:
3830         * dfg/DFGOperations.h:
3831         * dfg/DFGSpeculativeJIT.cpp:
3832         (JSC::DFG::SpeculativeJIT::compile):
3833         * dfg/DFGSpeculativeJIT.h:
3834         (JSC::DFG::SpeculativeJIT::shouldSpeculateNumber):
3835
3836 2011-09-14  Anders Carlsson  <andersca@apple.com>
3837
3838         Stop building BinarySemaphore to see if that's what's breaking the GTK+ build.
3839
3840         * GNUmakefile.list.am:
3841
3842 2011-09-14  Anders Carlsson  <andersca@apple.com>
3843
3844         This is getting old. Yet another build fix attempt.
3845
3846         * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
3847
3848 2011-09-14  Anders Carlsson  <andersca@apple.com>
3849
3850         Yet another build fix attempt.
3851
3852         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
3853
3854 2011-09-14  Anders Carlsson  <andersca@apple.com>
3855
3856         How I &quot;love&quot; Visual Studio...
3857
3858         Try to fix build again.
3859
3860         * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
3861
3862 2011-09-14  Anders Carlsson  <andersca@apple.com>
3863
3864         Try to fix Windows build.
3865
3866         * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
3867
3868 2011-09-14  Anders Carlsson  <andersca@apple.com>
3869
3870         Add BinarySemaphore class from WebKit2 to WTF
3871         https://bugs.webkit.org/show_bug.cgi?id=68132
3872
3873         Reviewed by Sam Weinig.
3874
3875         * GNUmakefile.list.am:
3876         * JavaScriptCore.gypi:
3877         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
3878         * JavaScriptCore.xcodeproj/project.pbxproj:
3879         * wtf/CMakeLists.txt:
3880         Update build systems.
3881
3882         * wtf/threads: Added.
3883         * wtf/threads/BinarySemaphore.cpp: Copied from Source/WebKit2/Platform/CoreIPC/BinarySemaphore.cpp.
3884         * wtf/threads/BinarySemaphore.h: Copied from Source/WebKit2/Platform/CoreIPC/BinarySemaphore.h.
3885         * wtf/threads/win: Added.
3886         * wtf/threads/win/BinarySemaphoreWin.cpp: Copied from Source/WebKit2/Platform/CoreIPC/win/BinarySemaphoreWin.cpp.
3887
3888 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
3889
3890         Unreviewed build fix for Interpreter.
3891
3892         * interpreter/Interpreter.cpp:
3893         (JSC::Interpreter::privateExecute):
3894
3895 2011-09-14  Anders Carlsson  <andersca@apple.com>
3896
3897         Add wtf/threads and wtf/threads/win, so we can be sure that the EWS
3898         bots can correctly build the patch in https://bugs.webkit.org/show_bug.cgi?id=68132
3899
3900         Rubber-stamped by Sam Weinig.
3901
3902         * wtf/threads: Added.
3903         * wtf/threads/win: Added.
3904
3905 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
3906
3907         DFG JIT should not speculate integer if the value is always going to be
3908         used as a double anyway
3909         https://bugs.webkit.org/show_bug.cgi?id=68127
3910
3911         Reviewed by Oliver Hunt.
3912
3913         Added a ValueToDouble node, which is a variant of ValueToNumber that
3914         hints that it will only be used as a double and never as an integer.
3915         Thus, it turns off integer speculation even if the value profiler
3916         told us that the value source is an int. The logic for converting a
3917         ValueToNumber into a ValueToDouble is found in Propagator.
3918
3919         This appears to be a 22% speed-up in imaging-darkroom.
3920
3921         * dfg/DFGNode.h:
3922         * dfg/DFGNonSpeculativeJIT.cpp:
3923         (JSC::DFG::NonSpeculativeJIT::compile):
3924         * dfg/DFGPropagator.cpp:
3925         (JSC::DFG::Propagator::fixpoint):
3926         (JSC::DFG::Propagator::toDouble):
3927         (JSC::DFG::Propagator::fixupNode):
3928         (JSC::DFG::Propagator::fixup):
3929         * dfg/DFGSpeculativeJIT.cpp:
3930         (JSC::DFG::SpeculativeJIT::compile):
3931         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
3932
3933 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
3934
3935         Tiered compilation heuristics do not account for value profile fullness
3936         https://bugs.webkit.org/show_bug.cgi?id=68116
3937
3938         Reviewed by Oliver Hunt.
3939
3940         Tiered compilation avoids invoking the DFG JIT if it finds that value
3941         profiles contain insufficient information. Instead, it produces a
3942         prediction from the current value profile, and then clears the value
3943         profile. This allows the value profile to heat up from scratch for
3944         some number of additional executions. The new profiles will then be
3945         merged with the previous prediction. Once the amount of information
3946         in predictions is enough according to heuristics in CodeBlock.cpp,
3947         DFG optimization is allowed to proceed.
3948
3949         * CMakeLists.txt:
3950         * GNUmakefile.list.am:
3951         * JavaScriptCore.pro:
3952         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3953         * JavaScriptCore.xcodeproj/project.pbxproj:
3954         * bytecode/CodeBlock.cpp:
3955         (JSC::CodeBlock::CodeBlock):
3956         (JSC::CodeBlock::~CodeBlock):
3957         (JSC::CodeBlock::visitAggregate):
3958         (JSC::CodeBlock::visitWeakReferences):
3959         (JSC::CodeBlock::shouldOptimizeNow):
3960         (JSC::CodeBlock::dumpValueProfiles):
3961         * bytecode/CodeBlock.h:
3962         * bytecode/PredictedType.cpp:
3963         (JSC::predictionToString):
3964         * bytecode/PredictedType.h:
3965         * bytecode/ValueProfile.cpp: Added.
3966         (JSC::ValueProfile::computeStatistics):
3967         (JSC::ValueProfile::computeUpdatedPrediction):
3968         * bytecode/ValueProfile.h:
3969         (JSC::ValueProfile::ValueProfile):
3970         (JSC::ValueProfile::classInfo):
3971         (JSC::ValueProfile::numberOfSamples):
3972         (JSC::ValueProfile::totalNumberOfSamples):
3973         (JSC::ValueProfile::isLive):
3974         (JSC::ValueProfile::numberOfInt32s):
3975         (JSC::ValueProfile::numberOfDoubles):
3976         (JSC::ValueProfile::numberOfBooleans):
3977         (JSC::ValueProfile::dump):
3978         (JSC::getValueProfileBytecodeOffset):
3979         * dfg/DFGByteCodeParser.cpp:
3980         (JSC::DFG::ByteCodeParser::stronglyPredict):
3981         * dfg/DFGGraph.cpp:
3982         (JSC::DFG::Graph::predictArgumentTypes):
3983         * dfg/DFGJITCompiler.cpp:
3984         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
3985         (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
3986         * jit/JIT.cpp:
3987         (JSC::JIT::emitOptimizationCheck):
3988         * jit/JITInlineMethods.h:
3989         (JSC::JIT::emitValueProfilingSite):
3990         * jit/JITStubs.cpp:
3991         (JSC::DEFINE_STUB_FUNCTION):
3992
3993 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
3994
3995         DFG should not speculate that the child of LogicalNot is a boolean if
3996         predictions tell us otherwise
3997         https://bugs.webkit.org/show_bug.cgi?id=68118
3998
3999         Reviewed by Geoffrey Garen.
4000
4001         * dfg/DFGJITCodeGenerator.cpp:
4002         (JSC::DFG::JITCodeGenerator::nonSpeculativeLogicalNot):
4003         * dfg/DFGJITCodeGenerator.h:
4004         * dfg/DFGNonSpeculativeJIT.cpp:
4005         (JSC::DFG::NonSpeculativeJIT::compile):
4006         * dfg/DFGSpeculativeJIT.cpp:
4007         (JSC::DFG::SpeculativeJIT::compile):
4008
4009 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
4010
4011         Unreviewed build fix.  Turn off tiered compilation.
4012
4013         * wtf/Platform.h:
4014
4015 2011-09-13  Filip Pizlo  <fpizlo@apple.com>
4016
4017         Prediction tracking is not precise enough
4018         https://bugs.webkit.org/show_bug.cgi?id=67993
4019
4020         Reviewed by Oliver Hunt.
4021
4022         Added a richer set of type predictions, including JSFinalObject, JSString,
4023         object that is not a JSFinalObject or JSArray (ObjectOther), some object
4024         but we don't or care know what kind (SomeObject), definitely an object,
4025         cell that is not an object or JSString, an value that is none of the above
4026         (so either Undefined or Null). Made the propagator and value profiler work
4027         with the new types.
4028
4029         Performance is neutral, because the DFG JIT does not take advantage of this
4030         new knowledge yet.
4031
4032         In the process of writing predictionToString() (which is now considerably
4033         more complex) I decided to finally add a BoundsCheckedPointer, which
4034         should come in handy in other places, like at least the OSR scratch buffer
4035         and the CompactJITCodeMap. It's great for cases where you want to
4036         do pointer arithmetic, you want to have assertions about the
4037         pointer not going out of bounds, but you don't want to write those
4038         assertions yourself.
4039
4040         This also required refactoring inherits(), since the ValueProfiler may
4041         want to do the equivalent of inherits() but given two ClassInfo's.
4042
4043         * GNUmakefile.list.am:
4044         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
4045         * JavaScriptCore.xcodeproj/project.pbxproj:
4046         * bytecode/PredictedType.cpp: Added.
4047         (JSC::predictionToString):
4048         (JSC::makePrediction):
4049