Source/JavaScriptCore/ChangeLog

   1 2011-09-27  Carlos Garcia Campos  <cgarcia@igalia.com>
   2
   3         [GTK] Reorganize header files
   4         https://bugs.webkit.org/show_bug.cgi?id=65616
   5
   6         Reviewed by Martin Robinson.
   7
   8         Install header files under $libwebkitgtkincludedir/JavaScriptCore.
   9
  10         * GNUmakefile.am: Use $libwebkitgtkincludedir.
  11         * javascriptcoregtk.pc.in: Use webkitgtk-<api-version> as include dir.
  12
  13 2011-09-26  Geoffrey Garen  <ggaren@apple.com>
  14
  15         REGRESSION (r95912): Conservative marking doesn't filter out pointers to
  16         MarkedBlock metadata
  17         https://bugs.webkit.org/show_bug.cgi?id=68860
  18
  19         Reviewed by Oliver Hunt.
  20
  21         Bencher says no performance change, maybe a 7% speedup on kraken-imaging-darkroom.
  22
  23         * heap/MarkedBlock.h:
  24         (JSC::MarkedBlock::isAtomAligned): Renamed atomMask to atomAlignment mask
  25         because the mask doesn't produce the actual atom number.
  26
  27         (JSC::MarkedBlock::isLiveCell): Testing just for alignment isn't good
  28         enough; we also need to test that a pointer is beyond the metadata section
  29         of a MarkedBlock, to avoid treating random metadata as a JSCell.
  30
  31 2011-09-26  Mark Hahnenberg  <mhahnenberg@apple.com>
  32
  33         Make JSCell::toBoolean non-virtual
  34         https://bugs.webkit.org/show_bug.cgi?id=67727
  35
  36         Reviewed by Geoffrey Garen.
  37
  38         JSCell::toBoolean now manually performs the toBoolean check for objects and strings (where
  39         before it was simply virtual and would crash if its implementation was called).
  40         Its descendants in JSObject and JSString have also been made non-virtual.  JSCell now
  41         explicitly covers all cases of toBoolean, so having a virtual implementation of
  42         JSCell::toBoolean is no longer necessary.  This is part of a larger process of un-virtualizing JSCell.
  43
  44         * JavaScriptCore.exp:
  45         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
  46         * runtime/JSCell.cpp:
  47         * runtime/JSCell.h:
  48         * runtime/JSNotAnObject.cpp:
  49         * runtime/JSNotAnObject.h:
  50         * runtime/JSObject.h:
  51         * runtime/JSString.h:
  52         (JSC::JSCell::toBoolean):
  53         (JSC::JSValue::toBoolean):
  54
  55 2011-09-26  Chris Marrin  <cmarrin@apple.com>
  56
  57         Enable requestAnimationFrame on Windows
  58         https://bugs.webkit.org/show_bug.cgi?id=68397
  59
  60         Reviewed by Simon Fraser.
  61
  62         Enabled REQUEST_ANIMATION_FRAME_TIMER for Windows
  63
  64         * wtf/Platform.h:
  65
  66 2011-09-26  Noel Gordon  <noel.gordon@gmail.com>
  67
  68         [Chromium] Remove DFGAliasTracker.h references from gyp project files
  69         https://bugs.webkit.org/show_bug.cgi?id=68787
  70
  71         Reviewed by Geoffrey Garen.
  72
  73         DFG/DFGAliasTracker.h was removed in r95389.  Cleanup (remove) references
  74         to that file from the gyp project files.
  75
  76         * JavaScriptCore.gypi:
  77
  78 2011-09-26  Zoltan Herczeg  <zherczeg@webkit.org>
  79
  80         [Qt]REGRESSION(r95865): It made 4 tests crash
  81         https://bugs.webkit.org/show_bug.cgi?id=68780
  82
  83         Reviewed by Oliver Hunt.
  84
  85         emitJumpSlowCaseIfNotJSCell(...) cannot be moved
  86         away since the next load depends on it.
  87
  88         * jit/JITPropertyAccess32_64.cpp:
  89         (JSC::JIT::emit_op_put_by_val):
  90
  91 2011-09-25  Mark Hahnenberg  <mhahnenberg@apple.com>
  92
  93         Add custom vtable struct to ClassInfo struct
  94         https://bugs.webkit.org/show_bug.cgi?id=68567
  95
  96         Reviewed by Oliver Hunt.
  97
  98         Declared/defined the MethodTable struct and added it to the ClassInfo struct.
  99         Also defined the CREATE_METHOD_TABLE macro to generate these method tables
 100         succinctly where they need to be defined.
 101
 102         Also added to it the first function to use this macro, visitChildren.
 103
 104         This is part of the process of getting rid of all C++ virtual methods in JSCell.
 105         Eventually all virtual functions in JSCell that can't easily be converted to
 106         non-virtual functions will be put into this custom vtable structure.
 107         * runtime/ClassInfo.h:
 108
 109         Added the CREATE_METHOD_TABLE macro call as the last argument to each of the
 110         ClassInfo structs declared in these classes.  This saves us from having to visit
 111         each s_info definition in the future when we add more methods to the MethodTable.
 112         * API/JSCallbackConstructor.cpp:
 113         * API/JSCallbackFunction.cpp:
 114         * API/JSCallbackObject.cpp:
 115         * JavaScriptCore.exp:
 116         * runtime/Arguments.cpp:
 117         * runtime/ArrayConstructor.cpp:
 118         * runtime/ArrayPrototype.cpp:
 119         * runtime/BooleanObject.cpp:
 120         * runtime/BooleanPrototype.cpp:
 121         * runtime/DateConstructor.cpp:
 122         * runtime/DateInstance.cpp:
 123         * runtime/DatePrototype.cpp:
 124         * runtime/ErrorInstance.cpp:
 125         * runtime/ErrorPrototype.cpp:
 126         * runtime/ExceptionHelpers.cpp:
 127         * runtime/Executable.cpp:
 128         * runtime/GetterSetter.cpp:
 129         * runtime/InternalFunction.cpp:
 130         * runtime/JSAPIValueWrapper.cpp:
 131         * runtime/JSActivation.cpp:
 132         * runtime/JSArray.cpp:
 133         * runtime/JSByteArray.cpp:
 134         * runtime/JSFunction.cpp:
 135         * runtime/JSGlobalObject.cpp:
 136         * runtime/JSONObject.cpp:
 137         * runtime/JSObject.cpp:
 138         * runtime/JSPropertyNameIterator.cpp:
 139         * runtime/JSString.cpp:
 140         * runtime/MathObject.cpp:
 141         * runtime/NativeErrorConstructor.cpp:
 142         * runtime/NumberConstructor.cpp:
 143         * runtime/NumberObject.cpp:
 144         * runtime/NumberPrototype.cpp:
 145         * runtime/ObjectConstructor.cpp:
 146         * runtime/ObjectPrototype.cpp:
 147         * runtime/RegExp.cpp:
 148         * runtime/RegExpConstructor.cpp:
 149         * runtime/RegExpObject.cpp:
 150         * runtime/RegExpPrototype.cpp:
 151         * runtime/ScopeChain.cpp:
 152         * runtime/StringConstructor.cpp:
 153         * runtime/StringObject.cpp:
 154         * runtime/StringPrototype.cpp:
 155         * runtime/Structure.cpp:
 156         * runtime/StructureChain.cpp:
 157
 158         Had to make visitChildren and visitChildrenVirtual protected instead of private
 159         because some of the subclasses of JSWrapperObject need access to JSWrapperObject's
 160         visitChildren function pointer in their vtable since they don't provide their own
 161         implementation. Same for RegExpObject.
 162         * runtime/JSWrapperObject.h:
 163         * runtime/RegExpObject.h:
 164
 165 2011-09-25  Adam Barth  <abarth@webkit.org>
 166
 167         Finish removing PLATFORM(BREWMP) by removing associated code
 168         https://bugs.webkit.org/show_bug.cgi?id=68779
 169
 170         Reviewed by Sam Weinig.
 171
 172         * JavaScriptCore.gyp/JavaScriptCore.gyp:
 173         * JavaScriptCore.gypi:
 174         * gyp/JavaScriptCore.gyp:
 175         * wscript:
 176         * wtf/FastMalloc.cpp:
 177         (WTF::fastMallocSize):
 178         * wtf/Vector.h:
 179         * wtf/brew: Removed.
 180         * wtf/brew/MainThreadBrew.cpp: Removed.
 181         * wtf/brew/OwnPtrBrew.cpp: Removed.
 182         * wtf/brew/RefPtrBrew.h: Removed.
 183         * wtf/brew/ShellBrew.h: Removed.
 184         * wtf/brew/StringBrew.cpp: Removed.
 185         * wtf/brew/SystemMallocBrew.h: Removed.
 186         * wtf/unicode/brew: Removed.
 187         * wtf/unicode/brew/UnicodeBrew.cpp: Removed.
 188         * wtf/unicode/brew/UnicodeBrew.h: Removed.
 189
 190 2011-09-25  Filip Pizlo  <fpizlo@apple.com>
 191
 192         DFG JIT does not count speculation successes correctly
 193         https://bugs.webkit.org/show_bug.cgi?id=68785
 194
 195         Reviewed by Geoffrey Garen.
 196
 197         * dfg/DFGJITCompiler.cpp:
 198         (JSC::DFG::JITCompiler::compileEntry):
 199         (JSC::DFG::JITCompiler::compileBody):
 200         * dfg/DFGOperations.cpp:
 201
 202 2011-09-25  Filip Pizlo  <fpizlo@apple.com>
 203
 204         DFG support for op_resolve_global is not enabled
 205         https://bugs.webkit.org/show_bug.cgi?id=68786
 206
 207         Reviewed by Geoffrey Garen.
 208
 209         * dfg/DFGCapabilities.h:
 210         (JSC::DFG::canCompileOpcode):
 211
 212 2011-09-25  Filip Pizlo  <fpizlo@apple.com>
 213
 214         DFG static prediction code is no longer needed and should be removed
 215         https://bugs.webkit.org/show_bug.cgi?id=68784
 216
 217         Reviewed by Oliver Hunt.
 218
 219         This gets rid of static prediction code, and ensures that we do not
 220         try to compile code where dynamic predictions are not available.
 221         This is accomplished by immediately performing an OSR exit wherever
 222         a value is retrieved for which no predictions exist.
 223
 224         This also adds value profiling for this on functions used for calls.
 225
 226         The heuristics for deciding when to optimize code are also tweaked,
 227         since it is now profitable to optimize sooner. This may need to be
 228         tweaked further, but this patch only makes minimal changes.
 229
 230         This results in a 16% speed-up on Kraken/ai-astar, leading to a 3%
 231         overall win on Kraken.  It's neutral elsewhere.
 232
 233         * bytecode/CodeBlock.cpp:
 234         (JSC::CodeBlock::shouldOptimizeNow):
 235         (JSC::CodeBlock::dumpValueProfiles):
 236         * bytecode/CodeBlock.h:
 237         * bytecode/PredictedType.cpp:
 238         (JSC::predictionToString):
 239         * bytecode/PredictedType.h:
 240         (JSC::isCellPrediction):
 241         (JSC::isObjectPrediction):
 242         (JSC::isFinalObjectPrediction):
 243         (JSC::isStringPrediction):
 244         (JSC::isArrayPrediction):
 245         (JSC::isInt32Prediction):
 246         (JSC::isDoublePrediction):
 247         (JSC::isNumberPrediction):
 248         (JSC::isBooleanPrediction):
 249         (JSC::mergePredictions):
 250         * bytecode/PredictionTracker.h:
 251         (JSC::PredictionTracker::predictArgument):
 252         (JSC::PredictionTracker::predict):
 253         (JSC::PredictionTracker::predictGlobalVar):
 254         * bytecode/ValueProfile.cpp:
 255         (JSC::ValueProfile::computeUpdatedPrediction):
 256         * dfg/DFGByteCodeParser.cpp:
 257         (JSC::DFG::ByteCodeParser::set):
 258         (JSC::DFG::ByteCodeParser::addCall):
 259         (JSC::DFG::ByteCodeParser::getPrediction):
 260         (JSC::DFG::ByteCodeParser::parseBlock):
 261         * dfg/DFGGraph.cpp:
 262         (JSC::DFG::Graph::predictArgumentTypes):
 263         * dfg/DFGGraph.h:
 264         (JSC::DFG::Graph::predict):
 265         (JSC::DFG::Graph::predictGlobalVar):
 266         (JSC::DFG::Graph::getMethodCheckPrediction):
 267         (JSC::DFG::Graph::getJSConstantPrediction):
 268         (JSC::DFG::Graph::getPrediction):
 269         * dfg/DFGJITCodeGenerator.cpp:
 270         (JSC::DFG::JITCodeGenerator::writeBarrier):
 271         (JSC::DFG::JITCodeGenerator::emitBranch):
 272         * dfg/DFGJITCompiler.h:
 273         (JSC::DFG::JITCompiler::getPrediction):
 274         * dfg/DFGNode.h:
 275         (JSC::DFG::Node::valueOfJSConstantNode):
 276         (JSC::DFG::Node::isInt32Constant):
 277         (JSC::DFG::Node::isDoubleConstant):
 278         (JSC::DFG::Node::isNumberConstant):
 279         (JSC::DFG::Node::isBooleanConstant):
 280         (JSC::DFG::Node::predict):
 281         * dfg/DFGPropagator.cpp:
 282         (JSC::DFG::Propagator::Propagator):
 283         (JSC::DFG::Propagator::propagateNodePredictions):
 284         (JSC::DFG::Propagator::fixupNode):
 285         (JSC::DFG::Propagator::isPredictedNumerical):
 286         (JSC::DFG::Propagator::logicalNotIsPure):
 287         * dfg/DFGSpeculativeJIT.cpp:
 288         (JSC::DFG::SpeculativeJIT::compile):
 289         * dfg/DFGSpeculativeJIT.h:
 290         (JSC::DFG::SpeculativeJIT::shouldSpeculateInteger):
 291         (JSC::DFG::SpeculativeJIT::shouldSpeculateDouble):
 292         (JSC::DFG::SpeculativeJIT::shouldSpeculateNumber):
 293         (JSC::DFG::SpeculativeJIT::shouldNotSpeculateInteger):
 294         (JSC::DFG::SpeculativeJIT::shouldSpeculateFinalObject):
 295         (JSC::DFG::SpeculativeJIT::shouldSpeculateArray):
 296         (JSC::DFG::SpeculativeJIT::shouldSpeculateObject):
 297         (JSC::DFG::SpeculativeJIT::shouldSpeculateCell):
 298         * jit/JIT.cpp:
 299         (JSC::JIT::privateCompile):
 300
 301 2011-09-25  Filip Pizlo  <fpizlo@apple.com>
 302
 303         DFG JIT Construct opcode takes a this argument even though it's
 304         not passed
 305         https://bugs.webkit.org/show_bug.cgi?id=68782
 306
 307         Reviewed by Oliver Hunt.
 308
 309         This is performance-neutral, mostly. It's a slight speed-up on
 310         v8-splay.
 311
 312         * dfg/DFGByteCodeParser.cpp:
 313         (JSC::DFG::ByteCodeParser::addCall):
 314         * dfg/DFGJITCodeGenerator.cpp:
 315         (JSC::DFG::JITCodeGenerator::emitCall):
 316
 317 2011-09-25  Filip Pizlo  <fpizlo@apple.com>
 318
 319         DFG tracking of the value in cachedResultRegister does not handle
 320         op_mov correctly
 321         https://bugs.webkit.org/show_bug.cgi?id=68781
 322
 323         Reviewed by Oliver Hunt.
 324
 325         This takes the simplest approach: it makes the old JIT dumber rather
 326         than making the DFG JIT smarter. This is performance-neutral.
 327
 328         * jit/JIT.h:
 329         (JSC::JIT::canBeOptimized):
 330         * jit/JITOpcodes.cpp:
 331         (JSC::JIT::emit_op_mov):
 332
 333 2011-09-25  Adam Barth  <abarth@webkit.org>
 334
 335         Remove PLATFORM(HAIKU) and associated code
 336         https://bugs.webkit.org/show_bug.cgi?id=68774
 337
 338         Reviewed by Sam Weinig.
 339
 340         * JavaScriptCore.gyp/JavaScriptCore.gyp:
 341         * JavaScriptCore.gypi:
 342         * gyp/JavaScriptCore.gyp:
 343         * heap/MachineStackMarker.cpp:
 344         * wtf/PageAllocation.h:
 345         * wtf/Platform.h:
 346         * wtf/StackBounds.cpp:
 347         * wtf/haiku: Removed.
 348         * wtf/haiku/MainThreadHaiku.cpp: Removed.
 349         * wtf/haiku/StringHaiku.cpp: Removed.
 350         * wtf/text/WTFString.h:
 351
 352 2011-09-24  Adam Barth  <abarth@webkit.org>
 353
 354         Always enable ENABLE(OFFLINE_WEB_APPLICATIONS)
 355         https://bugs.webkit.org/show_bug.cgi?id=68767
 356
 357         Reviewed by Eric Seidel.
 358
 359         * Configurations/FeatureDefines.xcconfig:
 360
 361 2011-09-24  Filip Pizlo  <fpizlo@apple.com>
 362
 363         JIT implementation of put_by_val increments m_length instead of setting
 364         it to index+1
 365         https://bugs.webkit.org/show_bug.cgi?id=68766
 366
 367         Reviewed by Geoffrey Garen.
 368
 369         * jit/JITPropertyAccess.cpp:
 370         (JSC::JIT::emit_op_put_by_val):
 371
 372 2011-09-24  Geoffrey Garen  <ggaren@apple.com>
 373
 374         More build fixage.
 375
 376         * heap/ConservativeRoots.cpp: Our system of #includes, it is chaos.
 377
 378 2011-09-24  Filip Pizlo  <fpizlo@apple.com>
 379
 380         The DFG should not attempt to guess types in the absence of value
 381         profiles
 382         https://bugs.webkit.org/show_bug.cgi?id=68677
 383
 384         Reviewed by Oliver Hunt.
 385
 386         This adds the ForceOSRExit node, which is ignored by the propagator
 387         and virtual register allocator (and hence ensuring that liveness analysis
 388         works correctly), but forces terminateSpeculativeExecution() in the
 389         back-end. This appears to be a slight speed-up on benchmark averages,
 390         with ~5% swings on individual benchmarks, in both directions. But it's
 391         never a regression on any average, and appears to be a ~1% progression
 392         in the SunSpider average.
 393
 394         This also adds a bit better debugging support in the old JIT and in DFG,
 395         as this was necessary to debug the much more frequent OSR transitions
 396         that occur with this change.
 397
 398         * dfg/DFGByteCodeParser.cpp:
 399         (JSC::DFG::ByteCodeParser::addCall):
 400         (JSC::DFG::ByteCodeParser::getStrongPrediction):
 401         (JSC::DFG::ByteCodeParser::parseBlock):
 402         * dfg/DFGJITCompiler.cpp:
 403         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
 404         * dfg/DFGNode.h:
 405         * dfg/DFGPropagator.cpp:
 406         (JSC::DFG::Propagator::propagateNodePredictions):
 407         * dfg/DFGSpeculativeJIT.cpp:
 408         (JSC::DFG::SpeculativeJIT::compile):
 409         * jit/JIT.cpp:
 410         (JSC::JIT::privateCompileMainPass):
 411         (JSC::JIT::privateCompileSlowCases):
 412         (JSC::JIT::privateCompile):
 413         * jit/JIT.h:
 414
 415 2011-09-24  Geoffrey Garen  <ggaren@apple.com>
 416
 417         Some Windows build fixage.
 418
 419         * heap/MarkedBlock.cpp:
 420         (JSC::MarkedBlock::sweep):
 421         * heap/MarkedBlock.h:
 422         (JSC::MarkedBlock::isLive): Show the compiler that all control paths
 423         return a value. There, there, compiler. Everything's going to be OK.
 424
 425         * runtime/JSCell.h:
 426         (JSC::JSCell::setVPtr): Oops! Unrename this function.
 427
 428 2011-09-24  Geoffrey Garen  <ggaren@apple.com>
 429
 430         Allocate new objects unmarked
 431         https://bugs.webkit.org/show_bug.cgi?id=68764
 432
 433         Reviewed by Oliver Hunt.
 434
 435         This is a pre-requisite to using the mark bit to determine object age.
 436
 437         ~2% v8 speedup, mostly due to a 12% v8-splay speedup.
 438
 439         * heap/MarkedBlock.h:
 440         (JSC::MarkedBlock::isLive):
 441         (JSC::MarkedBlock::isLiveCell): These two functions are the reason for
 442         this patch. They can now determine object liveness without relying on
 443         newly allocated objects having their mark bits set. Each MarkedBlock
 444         now has a state variable that tells us how to determine whether its
 445         cells are live. (This new state variable supercedes the old one about
 446         destructor state. The rest of this patch is just refactoring to support
 447         the invariants of this new state variable without introducing a
 448         performance regression.)
 449
 450         (JSC::MarkedBlock::didConsumeFreeList): New function for updating interal
 451         state when a block becomes fully allocated.
 452
 453         (JSC::MarkedBlock::clearMarks): Folded a state change to 'Marked' into
 454         this function because, logically, clearing all mark bits is the first
 455         step in saying "mark bits now exactly reflect object liveness".
 456
 457         (JSC::MarkedBlock::markCountIsZero): Renamed from isEmpty() to clarify
 458         that this function only tells you about the mark bits, so it's only
 459         meaningful if you've put the mark bits into a meaningful state before
 460         calling it.
 461
 462         (JSC::MarkedBlock::forEachCell): Changed to use isLive() helper function
 463         instead of testing mark bits, since mark bits are not always the right
 464         way to find out if an object is live anymore. (New objects are live, but
 465         not marked.)
 466
 467         * heap/MarkedBlock.cpp:
 468         (JSC::MarkedBlock::recycle):
 469         (JSC::MarkedBlock::MarkedBlock): Folded all initialization -- even
 470         initialization when recycling an old block -- into the MarkedBlock
 471         constructor, for simplicity.
 472
 473         (JSC::MarkedBlock::callDestructor): Inlined for speed. Always check for
 474         a zapped cell before running a destructor, and always zap after
 475         running a destructor. This does not seem to be expensive, and the
 476         alternative just creates a too-confusing matrix of possible cell states
 477         ((zombie undestructed cell + zombie destructed cell + zapped destructed
 478         cell) * 5! permutations for progressing through block states = "Oh my!").
 479
 480         (JSC::MarkedBlock::specializedSweep):
 481         (JSC::MarkedBlock::sweep): Maintained and expanded a pre-existing
 482         optimization to use template specialization to constant fold lots of
 483         branches and elide certain operations entirely during a sweep. Merged
 484         four or five functions that were logically about sweeping into this one
 485         function pair, so there's only one way to do things now, it's
 486         automatically correct, and it's always fast.
 487
 488         (JSC::MarkedBlock::zapFreeList): Renamed this function to be more explicit
 489         about exactly what it does, and to honor the new block state system.
 490
 491         * heap/AllocationSpace.cpp:
 492         (JSC::AllocationSpace::allocateBlock): Updated for rename.
 493
 494         (JSC::AllocationSpace::freeBlocks): Updated for changed interface.
 495
 496         (JSC::TakeIfUnmarked::TakeIfUnmarked):
 497         (JSC::TakeIfUnmarked::operator()):
 498         (JSC::TakeIfUnmarked::returnValue): Just like isEmpty() above, renamed
 499         to clarify that this functor only tests the mark bits, so it's only
 500         valid if you've put the mark bits into a meaningful state before
 501         calling it.
 502
 503         (JSC::AllocationSpace::shrink): Updated for rename.
 504
 505         * heap/AllocationSpace.h:
 506         (JSC::AllocationSpace::canonicalizeCellLivenessData): Renamed to be a
 507         little more specific about what we're making canonical.
 508
 509         (JSC::AllocationSpace::forEachCell): Updated for rename.
 510
 511         (JSC::AllocationSpace::forEachBlock): No need to canonicalize cell
 512         liveness data before iterating blocks -- clients that want iterated
 513         blocks to have valid cell lieveness data should make this call for
 514         themselves. (And not all clients want it.)
 515
 516         * heap/ConservativeRoots.cpp:
 517         (JSC::ConservativeRoots::genericAddPointer): Updated for rename. Removed
 518         obsolete comment.
 519
 520         * heap/Heap.cpp:
 521         (JSC::CountFunctor::ClearMarks::operator()): Removed call to notify...()
 522         because clearMarks() now does that implicitly.
 523
 524         (JSC::Heap::destroy): Make sure to canonicalize before tear-down, since
 525         tear-down tests cell liveness when running destructors.
 526
 527         (JSC::Heap::markRoots):
 528         (JSC::Heap::collect): Moved weak reference harvesting out of markRoots()
 529         and into collect, since it strictly depends on root marking, and does
 530         not contribute to root marking.
 531
 532         (JSC::Heap::canonicalizeCellLivenessData): Renamed to be a little more
 533         specific about what we're making canonical.
 534
 535         * heap/Heap.h:
 536         (JSC::Heap::forEachProtectedCell): No need to canonicalize cell liveness
 537         data before iterating protected cells, since we know they're all live,
 538         and don't need to test for it.
 539
 540         * heap/Local.h:
 541         (JSC::::set): Can't make the same ASSERT we used to because we just don't
 542         have the mark bits for it anymore. Perhaps we can bring this ASSERT back
 543         in a weaker form in the future.
 544
 545         * heap/MarkedSpace.cpp:
 546         (JSC::MarkedSpace::addBlock):
 547         (JSC::MarkedSpace::removeBlock): Updated for interface change.
 548         (JSC::MarkedSpace::canonicalizeCellLivenessData): Renamed to be a little more
 549         specific about what we're making canonical.
 550
 551         * heap/MarkedSpace.h:
 552         (JSC::MarkedSpace::allocate):
 553         (JSC::MarkedSpace::SizeClass::SizeClass):
 554         (JSC::MarkedSpace::SizeClass::resetAllocator):
 555         (JSC::MarkedSpace::SizeClass::zapFreeList): Simplified this allocator
 556         functionality a bit. We now track only one block -- "currentBlock" --
 557         and rely on its internal state to know whether it has more cells to
 558         allocate.
 559
 560         * heap/Weak.h:
 561         (JSC::Weak::set): Can't make the same ASSERT we used to because we just don't
 562         have the mark bits for it anymore. Perhaps we can bring this ASSERT back
 563         in a weaker form in the future.
 564
 565         * runtime/JSCell.h:
 566         (JSC::JSCell::vptr):
 567         (JSC::JSCell::zap):
 568         (JSC::JSCell::isZapped):
 569         (JSC::isZapped): Made zapping a property of JSCell, for a little abstraction.
 570         In the future, exactly how a JSCell zaps itself will change, as the
 571         internal representation of JSCell changes.
 572
 573 2011-09-24  Filip Pizlo  <fpizlo@apple.com>
 574
 575         DFG JIT should not eagerly initialize integer tags in the register file
 576         https://bugs.webkit.org/show_bug.cgi?id=68763
 577
 578         Reviewed by Oliver Hunt.
 579
 580         * dfg/DFGJITCompiler.cpp:
 581         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
 582         * dfg/DFGSpeculativeJIT.cpp:
 583         (JSC::DFG::ValueRecovery::dump):
 584         (JSC::DFG::OSRExit::OSRExit):
 585         (JSC::DFG::SpeculativeJIT::compile):
 586         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
 587         * dfg/DFGSpeculativeJIT.h:
 588         (JSC::DFG::ValueRecovery::alreadyInRegisterFileAsUnboxedInt32):
 589         (JSC::DFG::OSRExit::operandForArgument):
 590         (JSC::DFG::OSRExit::operandForIndex):
 591         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
 592
 593 2011-09-23  Yuqiang Xian  <yuqiang.xian@intel.com>
 594
 595         Add JSVALUE32_64 support to DFG JIT
 596         https://bugs.webkit.org/show_bug.cgi?id=67460
 597
 598         Reviewed by Gavin Barraclough.
 599
 600         This is the initial attempt to add JSVALUE32_64 support to DFG JIT.
 601         It's tested on IA32 Linux EFL port currently. It still cannot run
 602         all the test cases and benchmarks so should be turned off now.
 603
 604         The major work includes:
 605         1) dealing with JSVALUE32_64 data format in DFG JIT;
 606         2) bindings between 64-bit JS Value and 32-bit registers;
 607         3) handling of function calls. Currently for DFG operation function
 608         calls we follow the X86 cdecl calling convention on Linux, and the
 609         implementation is in a naive way by pushing the arguments into stack
 610         one by one.
 611
 612         The known issues include:
 613         1) some code duplicates unnecessarily, especially in Speculative JIT
 614         code generation, where most of the operations on SpeculataInteger /
 615         SpeculateDouble should be identical to the JSVALUE64 code. Refactoring
 616         is needed in the future;
 617         2) lack of op_call and op_construct support, comparing to current
 618         JSVALUE64 DFG;
 619         3) currently integer speculations assume to be StrictInt32;
 620         4) lack of JSBoolean speculations;
 621         5) boxing and unboxing doubles could be improved;
 622         6) DFG X86 register description is different with the baseline JIT,
 623         the timeoutCheckRegister is used for general purpose usage;
 624         7) calls to runtime functions with primitive double parameters (e.g.
 625         fmod) don't work. Support needs to be added to the assembler to
 626         implement the mechanism of passing double parameters for X86 cdecl
 627         convention.
 628
 629         And there should be many other hidden bugs which should be exposed and
 630         resolved in later debugging process.
 631
 632         * CMakeListsEfl.txt:
 633         * assembler/MacroAssemblerX86.h:
 634         (JSC::MacroAssemblerX86::loadDouble):
 635         (JSC::MacroAssemblerX86::storeDouble):
 636         * assembler/X86Assembler.h:
 637         (JSC::X86Assembler::movsd_rm):
 638         * bytecode/StructureStubInfo.h:
 639         * dfg/DFGByteCodeParser.cpp:
 640         (JSC::DFG::ByteCodeParser::parseBlock):
 641         * dfg/DFGCapabilities.h:
 642         (JSC::DFG::canCompileOpcode):
 643         * dfg/DFGFPRInfo.h:
 644         (JSC::DFG::FPRInfo::debugName):
 645         * dfg/DFGGPRInfo.h:
 646         (JSC::DFG::GPRInfo::toRegister):
 647         (JSC::DFG::GPRInfo::toIndex):
 648         (JSC::DFG::GPRInfo::debugName):
 649         * dfg/DFGGenerationInfo.h:
 650         (JSC::DFG::needDataFormatConversion):
 651         (JSC::DFG::GenerationInfo::initJSValue):
 652         (JSC::DFG::GenerationInfo::initDouble):
 653         (JSC::DFG::GenerationInfo::gpr):
 654         (JSC::DFG::GenerationInfo::tagGPR):
 655         (JSC::DFG::GenerationInfo::payloadGPR):
 656         (JSC::DFG::GenerationInfo::fpr):
 657         (JSC::DFG::GenerationInfo::fillJSValue):
 658         (JSC::DFG::GenerationInfo::fillCell):
 659         (JSC::DFG::GenerationInfo::fillDouble):
 660         * dfg/DFGJITCodeGenerator.cpp:
 661         * dfg/DFGJITCodeGenerator.h:
 662         (JSC::DFG::JITCodeGenerator::allocate):
 663         (JSC::DFG::JITCodeGenerator::use):
 664         (JSC::DFG::JITCodeGenerator::registersMatched):
 665         (JSC::DFG::JITCodeGenerator::silentSpillGPR):
 666         (JSC::DFG::JITCodeGenerator::silentFillGPR):
 667         (JSC::DFG::JITCodeGenerator::silentFillFPR):
 668         (JSC::DFG::JITCodeGenerator::silentSpillAllRegisters):
 669         (JSC::DFG::JITCodeGenerator::silentFillAllRegisters):
 670         (JSC::DFG::JITCodeGenerator::boxDouble):
 671         (JSC::DFG::JITCodeGenerator::unboxDouble):
 672         (JSC::DFG::JITCodeGenerator::spill):
 673         (JSC::DFG::addressOfDoubleConstant):
 674         (JSC::DFG::integerResult):
 675         (JSC::DFG::jsValueResult):
 676         (JSC::DFG::setupResults):
 677         (JSC::DFG::callOperation):
 678         (JSC::JSValueOperand::JSValueOperand):
 679         (JSC::JSValueOperand::~JSValueOperand):
 680         (JSC::JSValueOperand::isDouble):
 681         (JSC::JSValueOperand::fill):
 682         (JSC::JSValueOperand::tagGPR):
 683         (JSC::JSValueOperand::payloadGPR):
 684         (JSC::JSValueOperand::fpr):
 685         (JSC::GPRTemporary::~GPRTemporary):
 686         (JSC::GPRTemporary::gpr):
 687         (JSC::GPRResult2::GPRResult2):
 688         * dfg/DFGJITCodeGenerator32_64.cpp: Added.
 689         (JSC::DFG::JITCodeGenerator::clearGenerationInfo):
 690         (JSC::DFG::JITCodeGenerator::fillInteger):
 691         (JSC::DFG::JITCodeGenerator::fillDouble):
 692         (JSC::DFG::JITCodeGenerator::fillJSValue):
 693         (JSC::DFG::JITCodeGenerator::fillStorage):
 694         (JSC::DFG::JITCodeGenerator::useChildren):
 695         (JSC::DFG::JITCodeGenerator::isStrictInt32):
 696         (JSC::DFG::JITCodeGenerator::isKnownInteger):
 697         (JSC::DFG::JITCodeGenerator::isKnownNumeric):
 698         (JSC::DFG::JITCodeGenerator::isKnownCell):
 699         (JSC::DFG::JITCodeGenerator::isKnownNotInteger):
 700         (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
 701         (JSC::DFG::JITCodeGenerator::isKnownBoolean):
 702         (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToNumber):
 703         (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
 704         (JSC::DFG::JITCodeGenerator::nonSpeculativeUInt32ToNumber):
 705         (JSC::DFG::JITCodeGenerator::nonSpeculativeKnownConstantArithOp):
 706         (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
 707         (JSC::DFG::JITCodeGenerator::nonSpeculativeArithMod):
 708         (JSC::DFG::JITCodeGenerator::nonSpeculativeCheckHasInstance):
 709         (JSC::DFG::JITCodeGenerator::nonSpeculativeInstanceOf):
 710         (JSC::DFG::JITCodeGenerator::cachedGetById):
 711         (JSC::DFG::JITCodeGenerator::writeBarrier):
 712         (JSC::DFG::JITCodeGenerator::cachedPutById):
 713         (JSC::DFG::JITCodeGenerator::cachedGetMethod):
 714         (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompareNull):
 715         (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranchNull):
 716         (JSC::DFG::JITCodeGenerator::nonSpeculativeCompareNull):
 717         (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
 718         (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
 719         (JSC::DFG::JITCodeGenerator::nonSpeculativeCompare):
 720         (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
 721         (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeStrictEq):
 722         (JSC::DFG::JITCodeGenerator::nonSpeculativeStrictEq):
 723         (JSC::DFG::JITCodeGenerator::emitBranch):
 724         (JSC::DFG::JITCodeGenerator::nonSpeculativeLogicalNot):
 725         (JSC::DFG::JITCodeGenerator::emitCall):
 726         (JSC::DFG::JITCodeGenerator::speculationCheck):
 727         (JSC::DFG::dataFormatString):
 728         (JSC::DFG::JITCodeGenerator::dump):
 729         (JSC::DFG::JITCodeGenerator::checkConsistency):
 730         (JSC::DFG::GPRTemporary::GPRTemporary):
 731         (JSC::DFG::FPRTemporary::FPRTemporary):
 732         * dfg/DFGJITCompiler.cpp:
 733         * dfg/DFGJITCompiler.h:
 734         (JSC::DFG::JITCompiler::tagForGlobalVar):
 735         (JSC::DFG::JITCompiler::payloadForGlobalVar):
 736         (JSC::DFG::JITCompiler::appendCallWithExceptionCheck):
 737         (JSC::DFG::JITCompiler::addressOfDoubleConstant):
 738         (JSC::DFG::JITCompiler::boxDouble):
 739         (JSC::DFG::JITCompiler::unboxDouble):
 740         (JSC::DFG::JITCompiler::addPropertyAccess):
 741         (JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord):
 742         * dfg/DFGJITCompiler32_64.cpp: Added.
 743         (JSC::DFG::JITCompiler::fillNumericToDouble):
 744         (JSC::DFG::JITCompiler::fillInt32ToInteger):
 745         (JSC::DFG::JITCompiler::fillToJS):
 746         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
 747         (JSC::DFG::JITCompiler::linkOSRExits):
 748         (JSC::DFG::JITCompiler::compileEntry):
 749         (JSC::DFG::JITCompiler::compileBody):
 750         (JSC::DFG::JITCompiler::link):
 751         (JSC::DFG::JITCompiler::compile):
 752         (JSC::DFG::JITCompiler::compileFunction):
 753         (JSC::DFG::JITCompiler::jitAssertIsInt32):
 754         (JSC::DFG::JITCompiler::jitAssertIsJSInt32):
 755         (JSC::DFG::JITCompiler::jitAssertIsJSNumber):
 756         (JSC::DFG::JITCompiler::jitAssertIsJSDouble):
 757         (JSC::DFG::JITCompiler::jitAssertIsCell):
 758         (JSC::DFG::JITCompiler::emitCount):
 759         (JSC::DFG::JITCompiler::setSamplingFlag):
 760         (JSC::DFG::JITCompiler::clearSamplingFlag):
 761         * dfg/DFGJITCompilerInlineMethods.h: Added.
 762         (JSC::DFG::JITCompiler::emitLoadTag):
 763         (JSC::DFG::JITCompiler::emitLoadPayload):
 764         (JSC::DFG::JITCompiler::emitLoad):
 765         (JSC::DFG::JITCompiler::emitLoad2):
 766         (JSC::DFG::JITCompiler::emitLoadDouble):
 767         (JSC::DFG::JITCompiler::emitLoadInt32ToDouble):
 768         (JSC::DFG::JITCompiler::emitStore):
 769         (JSC::DFG::JITCompiler::emitStoreInt32):
 770         (JSC::DFG::JITCompiler::emitStoreCell):
 771         (JSC::DFG::JITCompiler::emitStoreBool):
 772         (JSC::DFG::JITCompiler::emitStoreDouble):
 773         * dfg/DFGNode.h:
 774         * dfg/DFGOperations.cpp:
 775         * dfg/DFGRepatch.cpp:
 776         (JSC::DFG::generateProtoChainAccessStub):
 777         (JSC::DFG::tryCacheGetByID):
 778         (JSC::DFG::tryBuildGetByIDList):
 779         (JSC::DFG::tryCachePutByID):
 780         * dfg/DFGSpeculativeJIT.cpp:
 781         * dfg/DFGSpeculativeJIT.h:
 782         (JSC::DFG::ValueRecovery::inGPR):
 783         (JSC::DFG::ValueRecovery::inPair):
 784         (JSC::DFG::ValueRecovery::tagGPR):
 785         (JSC::DFG::ValueRecovery::payloadGPR):
 786         * dfg/DFGSpeculativeJIT32_64.cpp: Added.
 787         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
 788         (JSC::DFG::ValueSource::dump):
 789         (JSC::DFG::ValueRecovery::dump):
 790         (JSC::DFG::OSRExit::OSRExit):
 791         (JSC::DFG::OSRExit::dump):
 792         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
 793         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
 794         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
 795         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 796         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
 797         (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
 798         (JSC::DFG::SpeculativeJIT::convertToDouble):
 799         (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
 800         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
 801         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
 802         (JSC::DFG::SpeculativeJIT::compare):
 803         (JSC::DFG::SpeculativeJIT::compile):
 804         (JSC::DFG::SpeculativeJIT::compileMovHint):
 805         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
 806         (JSC::DFG::SpeculativeJIT::initializeVariableTypes):
 807         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
 808         * runtime/JSValue.h:
 809
 810 2011-09-23  Filip Pizlo  <fpizlo@apple.com>
 811
 812         wtf/BitVector.h has a variety of bugs which manifest when the
 813         vector grows beyond 63 bits
 814         https://bugs.webkit.org/show_bug.cgi?id=68746
 815
 816         Reviewed by Oliver Hunt.
 817
 818         Out-of-lined slow path code in BitVector so that not every user
 819         of CodeBlock ends up having to compile it. Fixed a variety of
 820         index computation and size computation bugs.
 821
 822         I have not seen these issues manifest themselves, but they are
 823         blocking a patch that uses BitVector more aggressively.
 824
 825         * GNUmakefile.list.am:
 826         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
 827         * JavaScriptCore.xcodeproj/project.pbxproj:
 828         * wtf/BitVector.cpp: Added.
 829         (BitVector::BitVector):
 830         (BitVector::operator=):
 831         (BitVector::resize):
 832         (BitVector::clearAll):
 833         (BitVector::OutOfLineBits::create):
 834         (BitVector::OutOfLineBits::destroy):
 835         (BitVector::resizeOutOfLine):
 836         * wtf/BitVector.h:
 837         (WTF::BitVector::ensureSize):
 838         (WTF::BitVector::get):
 839         (WTF::BitVector::set):
 840         (WTF::BitVector::clear):
 841         (WTF::BitVector::byteCount):
 842         (WTF::BitVector::OutOfLineBits::numWords):
 843         (WTF::BitVector::OutOfLineBits::bits):
 844         (WTF::BitVector::outOfLineBits):
 845         * wtf/CMakeLists.txt:
 846         * wtf/wtf.pri:
 847
 848 2011-09-23  Adam Klein  <adamk@chromium.org>
 849
 850         Add ENABLE_MUTATION_OBSERVERS feature flag
 851         https://bugs.webkit.org/show_bug.cgi?id=68732
 852
 853         Reviewed by Ojan Vafai.
 854
 855         This flag will guard an implementation of the "Mutation Observers" proposed in
 856         http://lists.w3.org/Archives/Public/public-webapps/2011JulSep/1622.html
 857
 858         * Configurations/FeatureDefines.xcconfig:
 859
 860 2011-09-23  Mark Hahnenberg  <mhahnenberg@apple.com>
 861
 862         De-virtualize JSCell::getJSNumber
 863         https://bugs.webkit.org/show_bug.cgi?id=68651
 864
 865         Reviewed by Oliver Hunt.
 866
 867         Added a new JSType to check whether or not something is a
 868         NumberObject (which includes NumberPrototype) in TypeInfo::isNumberObject because there's not
 869         currently a better way to determine whether something is indeed a NumberObject.
 870         Also de-virtualized JSCell::getJSNumber, having it check the TypeInfo
 871         for whether the object is a NumberObject or not.  This patch is part of
 872         the larger process of de-virtualizing JSCell.
 873
 874         * JavaScriptCore.exp:
 875         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 876         * runtime/JSCell.cpp:
 877         (JSC::JSCell::getJSNumber):
 878         * runtime/JSCell.h:
 879         (JSC::JSValue::getJSNumber):
 880         * runtime/JSType.h:
 881         * runtime/JSTypeInfo.h:
 882         (JSC::TypeInfo::isNumberObject):
 883         * runtime/JSValue.h:
 884         * runtime/NumberObject.cpp:
 885         (JSC::NumberObject::getJSNumber):
 886         * runtime/NumberObject.h:
 887         (JSC::NumberObject::createStructure):
 888         * runtime/NumberPrototype.h:
 889         (JSC::NumberPrototype::createStructure):
 890
 891 2011-09-23  Filip Pizlo  <fpizlo@apple.com>
 892
 893         Resolve opcodes should have value profiling.
 894         https://bugs.webkit.org/show_bug.cgi?id=68723
 895
 896         Reviewed by Oliver Hunt.
 897
 898         This adds value profiling to all forms of op_resolve in the
 899         old JIT, and patches that information into the DFG along with
 900         performing the appropriate type propagation.
 901
 902         * dfg/DFGByteCodeParser.cpp:
 903         (JSC::DFG::ByteCodeParser::parseBlock):
 904         * dfg/DFGGraph.h:
 905         (JSC::DFG::Graph::predict):
 906         * dfg/DFGNode.h:
 907         (JSC::DFG::Node::hasIdentifier):
 908         (JSC::DFG::Node::resolveGlobalDataIndex):
 909         (JSC::DFG::Node::hasPrediction):
 910         * dfg/DFGPropagator.cpp:
 911         (JSC::DFG::Propagator::propagateNodePredictions):
 912         * dfg/DFGSpeculativeJIT.cpp:
 913         (JSC::DFG::SpeculativeJIT::compile):
 914         * jit/JITOpcodes.cpp:
 915         (JSC::JIT::emit_op_resolve):
 916         (JSC::JIT::emit_op_resolve_base):
 917         (JSC::JIT::emit_op_resolve_skip):
 918         (JSC::JIT::emit_op_resolve_global):
 919         (JSC::JIT::emitSlow_op_resolve_global):
 920         (JSC::JIT::emit_op_resolve_with_base):
 921         (JSC::JIT::emit_op_resolve_with_this):
 922         (JSC::JIT::emitSlow_op_resolve_global_dynamic):
 923         * jit/JITStubCall.h:
 924         (JSC::JITStubCall::callWithValueProfiling):
 925
 926 2011-09-23  Oliver Hunt  <oliver@apple.com>
 927
 928         Fix windows build.
 929
 930         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 931
 932 2011-09-23  Gavin Barraclough  <barraclough@apple.com>
 933
 934         Strict mode does not work in non-trivial nested functions.
 935         https://bugs.webkit.org/show_bug.cgi?id=68740
 936
 937         Reviewed by Oliver Hunt.
 938
 939         Function-info caching does not preserve all state that it should.
 940
 941         * parser/JSParser.cpp:
 942         (JSC::JSParser::Scope::saveFunctionInfo):
 943         (JSC::JSParser::Scope::restoreFunctionInfo):
 944         (JSC::JSParser::parseFunctionInfo):
 945         * parser/SourceProviderCacheItem.h:
 946
 947 2011-09-23  Filip Pizlo  <fpizlo@apple.com>
 948
 949         ValueToDouble handling in prediction propagation should be ASSERT_NOT_REACHED
 950         https://bugs.webkit.org/show_bug.cgi?id=68724
 951
 952         Reviewed by Oliver Hunt.
 953
 954         * dfg/DFGPropagator.cpp:
 955         (JSC::DFG::Propagator::propagateNodePredictions):
 956
 957 2011-09-23  Oliver Hunt  <oliver@apple.com>
 958
 959         Build fix.
 960
 961         * JavaScriptCore.xcodeproj/project.pbxproj:
 962
 963 2011-09-23  Filip Pizlo  <fpizlo@apple.com>
 964
 965         DFG implementation of PutScopedVar corrupts register allocation
 966         https://bugs.webkit.org/show_bug.cgi?id=68735
 967
 968         Reviewed by Oliver Hunt.
 969
 970         * dfg/DFGSpeculativeJIT.cpp:
 971         (JSC::DFG::SpeculativeJIT::compile):
 972
 973 2011-09-23  Oliver Hunt  <oliver@apple.com>
 974
 975         Make write barriers actually do something when enabled
 976         https://bugs.webkit.org/show_bug.cgi?id=68717
 977
 978         Reviewed by Geoffrey Garen.
 979
 980         Add a basic card marking style write barrier to JSC (currently
 981         turned off).  This requires two scratch registers in the JIT
 982         so there was some register re-arranging to satisfy that requirement.
 983         Happily this produced a minor perf bump in sunspider (~0.5%).
 984
 985         Turning the barriers on causes an overall regression of around 1.5%
 986
 987         * JavaScriptCore.exp:
 988         * JavaScriptCore.xcodeproj/project.pbxproj:
 989         * assembler/MacroAssemblerX86Common.h:
 990         (JSC::MacroAssemblerX86Common::store8):
 991         * assembler/X86Assembler.h:
 992         (JSC::X86Assembler::movb_i8m):
 993         * dfg/DFGJITCodeGenerator.cpp:
 994         (JSC::DFG::JITCodeGenerator::isKnownNotCell):
 995         (JSC::DFG::JITCodeGenerator::writeBarrier):
 996         (JSC::DFG::JITCodeGenerator::markCellCard):
 997         (JSC::DFG::JITCodeGenerator::cachedPutById):
 998         * dfg/DFGJITCodeGenerator.h:
 999         * dfg/DFGRepatch.cpp:
1000         (JSC::DFG::tryCachePutByID):
1001         * dfg/DFGSpeculativeJIT.cpp:
1002         (JSC::DFG::SpeculativeJIT::compile):
1003         * heap/CardSet.h: Added.
1004         (JSC::CardSet::CardSet):
1005         (JSC::::cardForAtom):
1006         (JSC::::cardMarkedForAtom):
1007         (JSC::::markCardForAtom):
1008         * heap/Heap.cpp:
1009         * heap/Heap.h:
1010         (JSC::Heap::addressOfCardFor):
1011         (JSC::Heap::writeBarrierFastCase):
1012         * heap/MarkedBlock.h:
1013         (JSC::MarkedBlock::setDirtyObject):
1014         (JSC::MarkedBlock::addressOfCardFor):
1015         (JSC::MarkedBlock::offsetOfCards):
1016         * jit/JIT.h:
1017         * jit/JITPropertyAccess.cpp:
1018         (JSC::JIT::emit_op_put_by_val):
1019         (JSC::JIT::emit_op_put_by_id):
1020         (JSC::JIT::privateCompilePutByIdTransition):
1021         (JSC::JIT::emit_op_put_scoped_var):
1022         (JSC::JIT::emit_op_put_global_var):
1023         (JSC::JIT::emitWriteBarrier):
1024         * jit/JITPropertyAccess32_64.cpp:
1025         (JSC::JIT::emit_op_put_by_val):
1026         (JSC::JIT::emit_op_put_by_id):
1027         (JSC::JIT::emitSlow_op_put_by_id):
1028         (JSC::JIT::privateCompilePutByIdTransition):
1029         (JSC::JIT::emit_op_put_scoped_var):
1030         (JSC::JIT::emit_op_put_global_var):
1031
1032 2011-09-23  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
1033
1034         https://bugs.webkit.org/show_bug.cgi?id=68077
1035         SH4 assemblers doesn't refer to executable memory handle.
1036
1037         Reviewed by Gavin Barraclough.
1038
1039         * assembler/MacroAssemblerSH4.h:
1040         (JSC::MacroAssemblerSH4::branch8):
1041         * assembler/SH4Assembler.h:
1042         (JSC::SH4Assembler::executableCopy):
1043
1044 2011-09-23  Oliver Hunt  <oliver@apple.com>
1045
1046         PutScopedVar nodes should report that it has a var number
1047         https://bugs.webkit.org/show_bug.cgi?id=68721
1048
1049         Reviewed by Anders Carlsson.
1050
1051         Another assertion fix.
1052
1053         * dfg/DFGNode.h:
1054         (JSC::DFG::Node::hasVarNumber):
1055
1056 2011-09-23  Oliver Hunt  <oliver@apple.com>
1057
1058         Add a bunch of unhandled node types to the propagator
1059         https://bugs.webkit.org/show_bug.cgi?id=68716
1060
1061         Reviewed by Darin Adler.
1062
1063         Remove the ASSERT_NOT_REACHED() default for debug builds in the
1064         prediction propagator, this way unhandled nodes will just cause
1065         compile time failures rather than failing at some point in the
1066         future.
1067
1068         * dfg/DFGPropagator.cpp:
1069         (JSC::DFG::Propagator::propagateNodePredictions):
1070
1071 2011-09-23  Mark Hahnenberg  <mhahnenberg@apple.com>
1072
1073         Add static version of JSCell::visitChildren
1074         https://bugs.webkit.org/show_bug.cgi?id=68404
1075
1076         Reviewed by Darin Adler.
1077
1078         In this patch we just extract the bodies of the virtual visitChildren methods
1079         throughout the JSCell inheritance hierarchy out into static methods, which are
1080         now called from the virtual methods.  This is an intermediate step in trying to
1081         move the virtual-ness of visitChildren into our own custom vtable stored in
1082         ClassInfo.  We need to convert the methods to static methods in order to be
1083         able to more easily store and refer to them in our custom vtable since normal
1084         member methods store some implicit information in their types, making it
1085         impossible to store them generically in ClassInfo.
1086
1087         * API/JSCallbackObject.h:
1088         (JSC::JSCallbackObject::visitChildrenVirtual):
1089         (JSC::JSCallbackObject::visitChildren):
1090         * JavaScriptCore.exp:
1091         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1092         * debugger/DebuggerActivation.cpp:
1093         (JSC::DebuggerActivation::visitChildrenVirtual):
1094         (JSC::DebuggerActivation::visitChildren):
1095         * debugger/DebuggerActivation.h:
1096         * heap/MarkStack.cpp:
1097         (JSC::SlotVisitor::visitChildren):
1098         (JSC::SlotVisitor::drain):
1099         * runtime/Arguments.cpp:
1100         (JSC::Arguments::visitChildrenVirtual):
1101         (JSC::Arguments::visitChildren):
1102         * runtime/Arguments.h:
1103         * runtime/Executable.cpp:
1104         (JSC::EvalExecutable::visitChildrenVirtual):
1105         (JSC::EvalExecutable::visitChildren):
1106         (JSC::ProgramExecutable::visitChildrenVirtual):
1107         (JSC::ProgramExecutable::visitChildren):
1108         (JSC::FunctionExecutable::visitChildrenVirtual):
1109         (JSC::FunctionExecutable::visitChildren):
1110         * runtime/Executable.h:
1111         * runtime/GetterSetter.cpp:
1112         (JSC::GetterSetter::visitChildrenVirtual):
1113         (JSC::GetterSetter::visitChildren):
1114         * runtime/GetterSetter.h:
1115         * runtime/JSActivation.cpp:
1116         (JSC::JSActivation::visitChildrenVirtual):
1117         (JSC::JSActivation::visitChildren):
1118         * runtime/JSActivation.h:
1119         * runtime/JSArray.cpp:
1120         (JSC::JSArray::visitChildrenVirtual):
1121         (JSC::JSArray::visitChildren):
1122         * runtime/JSArray.h:
1123         * runtime/JSBoundFunction.cpp:
1124         (JSC::JSBoundFunction::visitChildrenVirtual):
1125         (JSC::JSBoundFunction::visitChildren):
1126         * runtime/JSBoundFunction.h:
1127         * runtime/JSCell.h:
1128         (JSC::JSCell::visitChildrenVirtual):
1129         (JSC::JSCell::visitChildren):
1130         * runtime/JSFunction.cpp:
1131         (JSC::JSFunction::visitChildrenVirtual):
1132         (JSC::JSFunction::visitChildren):
1133         * runtime/JSFunction.h:
1134         * runtime/JSGlobalObject.cpp:
1135         (JSC::JSGlobalObject::visitChildrenVirtual):
1136         (JSC::JSGlobalObject::visitChildren):
1137         * runtime/JSGlobalObject.h:
1138         * runtime/JSObject.cpp:
1139         (JSC::JSObject::visitChildrenVirtual):
1140         (JSC::JSObject::visitChildren):
1141         * runtime/JSObject.h:
1142         (JSC::JSObject::visitChildrenDirect):
1143         * runtime/JSPropertyNameIterator.cpp:
1144         (JSC::JSPropertyNameIterator::visitChildrenVirtual):
1145         (JSC::JSPropertyNameIterator::visitChildren):
1146         * runtime/JSPropertyNameIterator.h:
1147         * runtime/JSStaticScopeObject.cpp:
1148         (JSC::JSStaticScopeObject::visitChildrenVirtual):
1149         (JSC::JSStaticScopeObject::visitChildren):
1150         * runtime/JSStaticScopeObject.h:
1151         * runtime/JSWrapperObject.cpp:
1152         (JSC::JSWrapperObject::visitChildrenVirtual):
1153         (JSC::JSWrapperObject::visitChildren):
1154         * runtime/JSWrapperObject.h:
1155         * runtime/NativeErrorConstructor.cpp:
1156         (JSC::NativeErrorConstructor::visitChildrenVirtual):
1157         (JSC::NativeErrorConstructor::visitChildren):
1158         * runtime/NativeErrorConstructor.h:
1159         * runtime/RegExpObject.cpp:
1160         (JSC::RegExpObject::visitChildrenVirtual):
1161         (JSC::RegExpObject::visitChildren):
1162         * runtime/RegExpObject.h:
1163         * runtime/ScopeChain.cpp:
1164         (JSC::ScopeChainNode::visitChildrenVirtual):
1165         (JSC::ScopeChainNode::visitChildren):
1166         * runtime/ScopeChain.h:
1167         * runtime/Structure.cpp:
1168         (JSC::Structure::visitChildrenVirtual):
1169         (JSC::Structure::visitChildren):
1170         * runtime/Structure.h:
1171         * runtime/StructureChain.cpp:
1172         (JSC::StructureChain::visitChildrenVirtual):
1173         (JSC::StructureChain::visitChildren):
1174         * runtime/StructureChain.h:
1175
1176 2011-09-23  Oliver Hunt  <oliver@apple.com>
1177
1178         Node propagation doesn't handle PutScopedVar
1179         https://bugs.webkit.org/show_bug.cgi?id=68713
1180
1181         Reviewed by Sam Weinig.
1182
1183         This was causing assertion failures.
1184
1185         * dfg/DFGPropagator.cpp:
1186         (JSC::DFG::Propagator::propagateNodePredictions):
1187
1188 2011-09-23  Anders Carlsson  <andersca@apple.com>
1189
1190         Make sure to define OVERRIDE and FINAL for older builds of clang.
1191
1192         * wtf/Compiler.h:
1193
1194 2011-09-23  Gavin Barraclough  <barraclough@apple.com>
1195
1196         Implement op_resolve_global in the DFG JIT
1197         https://bugs.webkit.org/show_bug.cgi?id=68704
1198
1199         Reviewed by Oliver Hunt.
1200
1201         This is performance neutral, but increases coverage.
1202
1203         * dfg/DFGByteCodeParser.cpp:
1204         (JSC::DFG::ByteCodeParser::ByteCodeParser):
1205         (JSC::DFG::ByteCodeParser::parseBlock):
1206         * dfg/DFGNode.h:
1207         (JSC::DFG::Node::hasIdentifier):
1208         (JSC::DFG::Node::resolveInfoIndex):
1209         * dfg/DFGOperations.cpp:
1210         * dfg/DFGOperations.h:
1211         * dfg/DFGSpeculativeJIT.cpp:
1212         (JSC::DFG::SpeculativeJIT::compile):
1213
1214 2011-09-23  Mark Rowe  <mrowe@apple.com>
1215
1216         Define BUILDING_ON_LION / TARGETING_LION when appropriate in Platform.h.
1217
1218         * wtf/Platform.h:
1219
1220 2011-09-22  Anders Carlsson  <andersca@apple.com>
1221
1222         We should add support for OVERRIDE and FINAL annotations
1223         https://bugs.webkit.org/show_bug.cgi?id=68654
1224
1225         Reviewed by David Hyatt.
1226
1227         Add OVERRIDE and FINAL macros for compilers that support them.
1228
1229         * wtf/Compiler.h:
1230
1231 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1232
1233         GetScopedVar should have value profiling
1234         https://bugs.webkit.org/show_bug.cgi?id=68676
1235
1236         Reviewed by Oliver Hunt.
1237
1238         Added GetScopedVar value profiling and predictin propagation.
1239         Added GetScopeChain to CSE.
1240
1241         * dfg/DFGByteCodeParser.cpp:
1242         (JSC::DFG::ByteCodeParser::parseBlock):
1243         * dfg/DFGGraph.h:
1244         (JSC::DFG::Graph::predict):
1245         * dfg/DFGNode.h:
1246         (JSC::DFG::Node::hasPrediction):
1247         * dfg/DFGPropagator.cpp:
1248         (JSC::DFG::Propagator::propagateNodePredictions):
1249         (JSC::DFG::Propagator::getScopeChainLoadElimination):
1250         (JSC::DFG::Propagator::performNodeCSE):
1251         * jit/JITPropertyAccess.cpp:
1252         (JSC::JIT::emit_op_get_scoped_var):
1253
1254 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1255
1256         PPC build fix, part 3.
1257
1258         * runtime/Executable.cpp:
1259         (JSC::FunctionExecutable::compileForConstructInternal):
1260
1261 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1262
1263         Another PPC build fix.
1264
1265         * runtime/Executable.cpp:
1266         * runtime/Executable.h:
1267
1268 2011-09-22  Dean Jackson  <dino@apple.com>
1269
1270         Add ENABLE_CSS_FILTERS
1271         https://bugs.webkit.org/show_bug.cgi?id=68652
1272
1273         Reviewed by Simon Fraser.
1274
1275         * Configurations/FeatureDefines.xcconfig:
1276
1277 2011-09-22  Gavin Barraclough  <barraclough@apple.com>
1278
1279         Incorrect this value passed to callbacks.
1280         https://bugs.webkit.org/show_bug.cgi?id=68668
1281
1282         Reviewed by Oliver Hunt.
1283
1284         From Array/String prototype function.  Should be undefined, but
1285         global object is passed instead (this is visible for strict callbacks).
1286
1287         * runtime/ArrayPrototype.cpp:
1288         (JSC::arrayProtoFuncSort):
1289         (JSC::arrayProtoFuncFilter):
1290         (JSC::arrayProtoFuncMap):
1291         (JSC::arrayProtoFuncEvery):
1292         (JSC::arrayProtoFuncForEach):
1293         (JSC::arrayProtoFuncSome):
1294         * runtime/JSArray.cpp:
1295         (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
1296         (JSC::JSArray::sort):
1297         * runtime/StringPrototype.cpp:
1298         (JSC::stringProtoFuncReplace):
1299
1300 2011-09-22  Gavin Barraclough  <barraclough@apple.com>
1301
1302         Function.prototype.bind.length shoudl be 1.
1303
1304         Rubber stamped by Olier Hunt.
1305
1306         * runtime/FunctionPrototype.cpp:
1307         (JSC::FunctionPrototype::addFunctionProperties):
1308
1309 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1310
1311         PPC build fix.
1312
1313         * bytecode/CodeBlock.h:
1314
1315 2011-09-22  Gavin Barraclough  <barraclough@apple.com>
1316
1317         Windows build fix pt. 2
1318
1319         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1320
1321 2011-09-22  Gavin Barraclough  <barraclough@apple.com>
1322
1323         Windows build fix pt. 1
1324
1325         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1326
1327 2011-09-21  Filip Pizlo  <fpizlo@apple.com>
1328
1329         DFG JIT does not support to_primitive or strcat
1330         https://bugs.webkit.org/show_bug.cgi?id=68582
1331
1332         Reviewed by Darin Adler.
1333
1334         This adds functional support for to_primitive and strcat. It focuses
1335         on minimizing the amount of code emitted on to_primitive (if we know
1336         that it is a primitive or can speculate cheaply, then we omit the
1337         slow path) and on keeping the implementation of strcat simple while
1338         leveraging whatever optimizations we have already. In particular,
1339         unlike the Call and Construct nodes which require extending the size
1340         of the DFG's callee registers, StrCat takes advantage of the fact
1341         that no JS code can run while StrCat is in progress and uses a
1342         scratch buffer, rather than the register file, to store the list of
1343         values to concatenate. This was done mainly to keep the code simple,
1344         but there are probably other benefits to keeping call frame sizes
1345         down. Essentially, this patch ensures that the presence of an
1346         op_strcat does not mess up any other optimizations we might do while
1347         ensuring that if you do execute it, it'll work about as well as you'd
1348         expect.
1349
1350         When combined with the previous patch for integer division, this is a
1351         14% speed-up on Kraken. Without it, it would have been a 2% loss.
1352
1353         * assembler/AbstractMacroAssembler.h:
1354         (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
1355         * dfg/DFGByteCodeParser.cpp:
1356         (JSC::DFG::ByteCodeParser::parseBlock):
1357         * dfg/DFGCapabilities.h:
1358         (JSC::DFG::canCompileOpcode):
1359         * dfg/DFGJITCodeGenerator.h:
1360         (JSC::DFG::JITCodeGenerator::callOperation):
1361         * dfg/DFGJITCompiler.cpp:
1362         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
1363         * dfg/DFGNode.h:
1364         * dfg/DFGOperations.cpp:
1365         * dfg/DFGOperations.h:
1366         * dfg/DFGPropagator.cpp:
1367         (JSC::DFG::Propagator::propagateNodePredictions):
1368         (JSC::DFG::Propagator::performNodeCSE):
1369         * dfg/DFGSpeculativeJIT.cpp:
1370         (JSC::DFG::SpeculativeJIT::compile):
1371         * runtime/JSGlobalData.cpp:
1372         (JSC::JSGlobalData::JSGlobalData):
1373         (JSC::JSGlobalData::~JSGlobalData):
1374         * runtime/JSGlobalData.h:
1375         (JSC::JSGlobalData::scratchBufferForSize):
1376
1377 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1378
1379         DFG JIT should support integer division
1380         https://bugs.webkit.org/show_bug.cgi?id=68597
1381
1382         Reviewed by Darin Adler.
1383
1384         This adds support for ArithDiv speculating integer, and speculating
1385         that the result is integer (i.e. remainder = 0).
1386
1387         This is a 4% win on Kraken and a 1% loss on V8.
1388
1389         * bytecode/CodeBlock.h:
1390         * dfg/DFGByteCodeParser.cpp:
1391         (JSC::DFG::ByteCodeParser::makeDivSafe):
1392         (JSC::DFG::ByteCodeParser::parseBlock):
1393         * dfg/DFGNode.h:
1394         (JSC::DFG::Node::hasArithNodeFlags):
1395         * dfg/DFGPropagator.cpp:
1396         (JSC::DFG::Propagator::propagateArithNodeFlags):
1397         (JSC::DFG::Propagator::propagateNodePredictions):
1398         (JSC::DFG::Propagator::fixupNode):
1399         * dfg/DFGSpeculativeJIT.cpp:
1400         (JSC::DFG::SpeculativeJIT::compile):
1401         * jit/JITArithmetic.cpp:
1402         (JSC::JIT::emit_op_div):
1403
1404 2011-09-22  Oliver Hunt  <oliver@apple.com>
1405
1406         Implement put_scoped_var in the DFG jit
1407         https://bugs.webkit.org/show_bug.cgi?id=68653
1408
1409         Reviewed by Gavin Barraclough.
1410
1411         Naive implementation of put_scoped_var.  Same story as the
1412         get_scoped_var implementation, although I've hoisted scope
1413         object acquisition into a separate dfg node.  Ideally in the
1414         future we would reuse the resolved scope chain object, but
1415         for now we don't.
1416
1417         * dfg/DFGByteCodeParser.cpp:
1418         (JSC::DFG::ByteCodeParser::parseBlock):
1419         * dfg/DFGCapabilities.h:
1420         (JSC::DFG::canCompileOpcode):
1421         * dfg/DFGNode.h:
1422         (JSC::DFG::Node::hasScopeChainDepth):
1423         (JSC::DFG::Node::scopeChainDepth):
1424         * dfg/DFGPropagator.cpp:
1425         (JSC::DFG::Propagator::propagateNodePredictions):
1426         * dfg/DFGSpeculativeJIT.cpp:
1427         (JSC::DFG::SpeculativeJIT::compile):
1428
1429 2011-09-22  Gavin Barraclough  <barraclough@apple.com>
1430
1431         Implement Function.prototype.bind
1432         https://bugs.webkit.org/show_bug.cgi?id=26382
1433
1434         Reviewed by Sam Weinig.
1435
1436         This patch provides a basic functional implementation
1437         for Function.bind. It should (hopefully!) be fully
1438         functionally correct, and the bound functions can be
1439         called to quickly (since they are a subclass of
1440         JSFunction, not InternalFunction), but we'll probably
1441         want to follow up with some optimization work to keep
1442         bound calls in JIT code.
1443
1444         * JavaScriptCore.JSVALUE32_64only.exp:
1445         * JavaScriptCore.JSVALUE64only.exp:
1446         * JavaScriptCore.exp:
1447         * JavaScriptCore.xcodeproj/project.pbxproj:
1448         * jit/JITStubs.cpp:
1449         (JSC::JITThunks::hostFunctionStub):
1450         * jit/JITStubs.h:
1451         * jsc.cpp:
1452         (GlobalObject::addFunction):
1453         * runtime/CommonIdentifiers.h:
1454         * runtime/ConstructData.h:
1455         * runtime/Executable.h:
1456         (JSC::NativeExecutable::NativeExecutable):
1457         * runtime/FunctionPrototype.cpp:
1458         (JSC::FunctionPrototype::addFunctionProperties):
1459         (JSC::functionProtoFuncBind):
1460         * runtime/FunctionPrototype.h:
1461         * runtime/JSBoundFunction.cpp: Added.
1462         (JSC::boundFunctionCall):
1463         (JSC::boundFunctionConstruct):
1464         (JSC::JSBoundFunction::create):
1465         (JSC::JSBoundFunction::hasInstance):
1466         (JSC::JSBoundFunction::getOwnPropertySlot):
1467         (JSC::JSBoundFunction::getOwnPropertyDescriptor):
1468         (JSC::JSBoundFunction::JSBoundFunction):
1469         (JSC::JSBoundFunction::finishCreation):
1470         * runtime/JSBoundFunction.h: Added.
1471         (JSC::JSBoundFunction::targetFunction):
1472         (JSC::JSBoundFunction::boundThis):
1473         (JSC::JSBoundFunction::boundArgs):
1474         (JSC::JSBoundFunction::createStructure):
1475         * runtime/JSFunction.cpp:
1476         (JSC::JSFunction::create):
1477         (JSC::JSFunction::finishCreation):
1478         (JSC::createDescriptorForThrowingProperty):
1479         (JSC::JSFunction::getOwnPropertySlot):
1480         * runtime/JSFunction.h:
1481         * runtime/JSGlobalData.cpp:
1482         (JSC::JSGlobalData::getHostFunction):
1483         * runtime/JSGlobalData.h:
1484         * runtime/JSGlobalObject.cpp:
1485         (JSC::JSGlobalObject::reset):
1486         (JSC::JSGlobalObject::visitChildren):
1487         * runtime/JSGlobalObject.h:
1488         (JSC::JSGlobalObject::boundFunctionStructure):
1489         * runtime/Lookup.cpp:
1490         (JSC::setUpStaticFunctionSlot):
1491
1492 2011-09-22  Oliver Hunt  <oliver@apple.com>
1493
1494         Implement get_scoped_var in the DFG
1495         https://bugs.webkit.org/show_bug.cgi?id=68640
1496
1497         Reviewed by Gavin Barraclough.
1498
1499         Naive implementation of get_scoped_var in the DFG.  Essentially this
1500         is the bare minimum required to get correct behaviour, so there's no
1501         load/store coalescing or type profiling involved, even though these
1502         would be wins.  No impact on SunSpider or V8.
1503
1504         * dfg/DFGByteCodeParser.cpp:
1505         (JSC::DFG::ByteCodeParser::parseBlock):
1506         * dfg/DFGCapabilities.h:
1507         (JSC::DFG::canCompileOpcode):
1508         * dfg/DFGNode.h:
1509         (JSC::DFG::Node::hasVarNumber):
1510         (JSC::DFG::Node::hasScopeChainDepth):
1511         (JSC::DFG::Node::scopeChainDepth):
1512         * dfg/DFGPropagator.cpp:
1513         (JSC::DFG::Propagator::propagateNodePredictions):
1514         * dfg/DFGSpeculativeJIT.cpp:
1515         (JSC::DFG::SpeculativeJIT::compile):
1516
1517 2011-09-22  Adam Roben  <aroben@apple.com>
1518
1519         Remove FindSafari from all our .sln files
1520
1521         It isn't used anymore, so there's no point in building it.
1522
1523         Part of <http://webkit.org/b/68628> Remove FindSafari
1524
1525         Reviewed by Steve Falkenburg.
1526
1527         * JavaScriptCore.vcproj/JavaScriptCore.sln:
1528
1529 2011-09-22  Filip Pizlo  <fpizlo@apple.com>
1530
1531         32-bit call code clobbers the function cell tag
1532         https://bugs.webkit.org/show_bug.cgi?id=68606
1533
1534         Reviewed by Csaba Osztrogonác.
1535
1536         This is a minimalistic fix: it simply emits code to restore the
1537         cell tag on the slow path, if we know that we failed due to
1538         emitCallIfNotType.
1539
1540         * jit/JITCall32_64.cpp:
1541         (JSC::JIT::compileOpCallVarargsSlowCase):
1542         (JSC::JIT::compileOpCallSlowCase):
1543
1544 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1545
1546         Add missing addPtr->add32 mapping for X86.
1547
1548         Rubber stamped by Sam Weinig.
1549
1550         * assembler/MacroAssembler.h:
1551         (JSC::MacroAssembler::addPtr):
1552
1553 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1554
1555         Add missing addDouble for AbsoluteAddress to X86
1556
1557         Rubber stamped by Geoff Garen.
1558
1559         * assembler/MacroAssemblerX86.h:
1560         (JSC::MacroAssemblerX86::addDouble):
1561         * assembler/X86Assembler.h:
1562         (JSC::X86Assembler::addsd_mr):
1563         (JSC::X86Assembler::cvtsi2sd_rr):
1564         (JSC::X86Assembler::cvtsi2sd_mr):
1565
1566 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1567
1568         Build fix following fix for bug #68586.
1569
1570         * jit/JIT.cpp:
1571         * jit/JITInlineMethods.h:
1572
1573 2011-09-21  Filip Pizlo  <fpizlo@apple.com>
1574
1575         DFG JIT should be able to compile op_throw
1576         https://bugs.webkit.org/show_bug.cgi?id=68571
1577
1578         Reviewed by Geoffrey Garen.
1579
1580         This compiles op_throw in the simplest way possible: it's an OSR
1581         point back to the old JIT. This is a good step towards increasing
1582         coverage, particularly on Kraken, but it's neutral because the
1583         same functions that do throw also use some other unsupported
1584         opcodes.
1585
1586         * dfg/DFGByteCodeParser.cpp:
1587         (JSC::DFG::ByteCodeParser::parseBlock):
1588         * dfg/DFGCapabilities.h:
1589         (JSC::DFG::canCompileOpcode):
1590         * dfg/DFGNode.h:
1591         * dfg/DFGPropagator.cpp:
1592         (JSC::DFG::Propagator::propagateNodePredictions):
1593         * dfg/DFGSpeculativeJIT.cpp:
1594         (JSC::DFG::SpeculativeJIT::compile):
1595
1596 2011-09-21  Filip Pizlo  <fpizlo@apple.com>
1597
1598         DFG should support continuous optimization
1599         https://bugs.webkit.org/show_bug.cgi?id=68329
1600
1601         Reviewed by Geoffrey Garen.
1602
1603         This adds the ability to reoptimize a code block if speculation
1604         failures happen frequently. 6% speed-up on Kraken, 1% slow-down
1605         on V8, neutral on SunSpider.
1606
1607         * CMakeLists.txt:
1608         * GNUmakefile.list.am:
1609         * JavaScriptCore.pro:
1610         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1611         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
1612         * JavaScriptCore.xcodeproj/project.pbxproj:
1613         * bytecode/CodeBlock.cpp:
1614         (JSC::CodeBlock::CodeBlock):
1615         (JSC::ProgramCodeBlock::jettison):
1616         (JSC::EvalCodeBlock::jettison):
1617         (JSC::FunctionCodeBlock::jettison):
1618         (JSC::CodeBlock::shouldOptimizeNow):
1619         (JSC::CodeBlock::dumpValueProfiles):
1620         * bytecode/CodeBlock.h:
1621         * dfg/DFGByteCodeParser.cpp:
1622         (JSC::DFG::ByteCodeParser::getStrongPrediction):
1623         * dfg/DFGJITCompiler.cpp:
1624         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
1625         (JSC::DFG::JITCompiler::compileEntry):
1626         (JSC::DFG::JITCompiler::compileBody):
1627         * dfg/DFGJITCompiler.h:
1628         (JSC::DFG::JITCompiler::noticeOSREntry):
1629         * dfg/DFGOSREntry.cpp:
1630         (JSC::DFG::prepareOSREntry):
1631         * dfg/DFGOSREntry.h:
1632         (JSC::DFG::getOSREntryDataBytecodeIndex):
1633         * dfg/DFGSpeculativeJIT.cpp:
1634         (JSC::DFG::SpeculativeJIT::compile):
1635         * heap/ConservativeRoots.cpp:
1636         (JSC::ConservativeRoots::ConservativeRoots):
1637         (JSC::ConservativeRoots::~ConservativeRoots):
1638         (JSC::DummyMarkHook::mark):
1639         (JSC::ConservativeRoots::genericAddPointer):
1640         (JSC::ConservativeRoots::genericAddSpan):
1641         (JSC::ConservativeRoots::add):
1642         * heap/ConservativeRoots.h:
1643         * heap/Heap.cpp:
1644         (JSC::Heap::addJettisonCodeBlock):
1645         (JSC::Heap::markRoots):
1646         * heap/Heap.h:
1647         * heap/JettisonedCodeBlocks.cpp: Added.
1648         (JSC::JettisonedCodeBlocks::JettisonedCodeBlocks):
1649         (JSC::JettisonedCodeBlocks::~JettisonedCodeBlocks):
1650         (JSC::JettisonedCodeBlocks::addCodeBlock):
1651         (JSC::JettisonedCodeBlocks::clearMarks):
1652         (JSC::JettisonedCodeBlocks::deleteUnmarkedCodeBlocks):
1653         (JSC::JettisonedCodeBlocks::traceCodeBlocks):
1654         * heap/JettisonedCodeBlocks.h: Added.
1655         (JSC::JettisonedCodeBlocks::mark):
1656         * interpreter/RegisterFile.cpp:
1657         (JSC::RegisterFile::gatherConservativeRoots):
1658         * interpreter/RegisterFile.h:
1659         * jit/JITStubs.cpp:
1660         (JSC::DEFINE_STUB_FUNCTION):
1661         * runtime/Executable.cpp:
1662         (JSC::jettisonCodeBlock):
1663         (JSC::EvalExecutable::jettisonOptimizedCode):
1664         (JSC::ProgramExecutable::jettisonOptimizedCode):
1665         (JSC::FunctionExecutable::jettisonOptimizedCodeForCall):
1666         (JSC::FunctionExecutable::jettisonOptimizedCodeForConstruct):
1667         * runtime/Executable.h:
1668         (JSC::FunctionExecutable::jettisonOptimizedCodeFor):
1669         * wtf/BitVector.h: Added.
1670         (WTF::BitVector::BitVector):
1671         (WTF::BitVector::~BitVector):
1672         (WTF::BitVector::operator=):
1673         (WTF::BitVector::size):
1674         (WTF::BitVector::ensureSize):
1675         (WTF::BitVector::resize):
1676         (WTF::BitVector::clearAll):
1677         (WTF::BitVector::get):
1678         (WTF::BitVector::set):
1679         (WTF::BitVector::clear):
1680         (WTF::BitVector::bitsInPointer):
1681         (WTF::BitVector::maxInlineBits):
1682         (WTF::BitVector::byteCount):
1683         (WTF::BitVector::makeInlineBits):
1684         (WTF::BitVector::OutOfLineBits::numBits):
1685         (WTF::BitVector::OutOfLineBits::numWords):
1686         (WTF::BitVector::OutOfLineBits::bits):
1687         (WTF::BitVector::OutOfLineBits::create):
1688         (WTF::BitVector::OutOfLineBits::destroy):
1689         (WTF::BitVector::OutOfLineBits::OutOfLineBits):
1690         (WTF::BitVector::isInline):
1691         (WTF::BitVector::outOfLineBits):
1692         (WTF::BitVector::resizeOutOfLine):
1693         (WTF::BitVector::bits):
1694
1695 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1696
1697         Add X86 GPRInfo for DFG JIT.
1698         https://bugs.webkit.org/show_bug.cgi?id=68586
1699
1700         Reviewed by Geoff Garen.
1701
1702         * dfg/DFGGPRInfo.h:
1703         (JSC::DFG::GPRInfo::toRegister):
1704         (JSC::DFG::GPRInfo::toIndex):
1705         (JSC::DFG::GPRInfo::debugName):
1706
1707 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1708
1709         Should support value profiling on CPU(X86)
1710         https://bugs.webkit.org/show_bug.cgi?id=68575
1711
1712         Reviewed by Sam Weinig.
1713
1714         Fix verbose profiling in ToT (SlowCaseProfile had been
1715         partially renamed to RareCaseProfile), add in-memory
1716         bucket counter for CPU(X86), move JIT::m_canBeOptimized
1717         out of the DFG_JIT ifdef.
1718
1719         * bytecode/CodeBlock.cpp:
1720         (JSC::CodeBlock::resetRareCaseProfiles):
1721         (JSC::CodeBlock::dumpValueProfiles):
1722         * bytecode/CodeBlock.h:
1723         * dfg/DFGByteCodeParser.cpp:
1724         (JSC::DFG::ByteCodeParser::makeSafe):
1725         * jit/JIT.cpp:
1726         (JSC::JIT::privateCompileSlowCases):
1727         (JSC::JIT::privateCompile):
1728         * jit/JIT.h:
1729         * jit/JITInlineMethods.h:
1730         (JSC::JIT::emitValueProfilingSite):
1731
1732 2011-09-21  Filip Pizlo  <fpizlo@apple.com>
1733
1734         DFG does not support compiling functions as constructors
1735         https://bugs.webkit.org/show_bug.cgi?id=68500
1736
1737         Reviewed by Oliver Hunt.
1738
1739         This adds support for compiling constructors to the DFG. It's a
1740         1% speed-up on V8, mostly due to a 6% speed-up on early-boyer.
1741         It's also a 13% win on access-binary-trees, but it's neutral in
1742         the SunSpider and Kraken averages.
1743
1744         * dfg/DFGByteCodeParser.cpp:
1745         (JSC::DFG::ByteCodeParser::parseBlock):
1746         * dfg/DFGCapabilities.h:
1747         (JSC::DFG::mightCompileFunctionForConstruct):
1748         (JSC::DFG::canCompileOpcode):
1749         * dfg/DFGNode.h:
1750         * dfg/DFGOperations.cpp:
1751         * dfg/DFGOperations.h:
1752         * dfg/DFGPropagator.cpp:
1753         (JSC::DFG::Propagator::propagateNodePredictions):
1754         (JSC::DFG::Propagator::performNodeCSE):
1755         * dfg/DFGSpeculativeJIT.cpp:
1756         (JSC::DFG::SpeculativeJIT::compile):
1757         * runtime/Executable.cpp:
1758         (JSC::FunctionExecutable::compileOptimizedForConstruct):
1759         (JSC::FunctionExecutable::compileForConstructInternal):
1760         * runtime/Executable.h:
1761         (JSC::FunctionExecutable::compileForConstruct):
1762         (JSC::FunctionExecutable::compileFor):
1763         (JSC::FunctionExecutable::compileOptimizedFor):
1764
1765 2011-09-21  Gavin Barraclough  <barraclough@apple.com>
1766
1767         Replace jsFunctionVPtr compares with a type check on the Structure.
1768         https://bugs.webkit.org/show_bug.cgi?id=68557
1769
1770         Reviewed by Oliver Hunt.
1771
1772         This will permit calls to still optimize to subclasses of JSFunction
1773         that have the correct type (but a different C++ vptr).
1774
1775         This patch stops passing the globalData into numerous functions.
1776
1777         * dfg/DFGByteCodeParser.cpp:
1778         (JSC::DFG::ByteCodeParser::parseBlock):
1779         * dfg/DFGGraph.h:
1780         (JSC::DFG::Graph::isFunctionConstant):
1781         (JSC::DFG::Graph::valueOfFunctionConstant):
1782         * dfg/DFGJITCompiler.h:
1783         (JSC::DFG::JITCompiler::isFunctionConstant):
1784         (JSC::DFG::JITCompiler::valueOfFunctionConstant):
1785         * dfg/DFGOperations.cpp:
1786         * interpreter/Interpreter.cpp:
1787         (JSC::Interpreter::privateExecute):
1788         * jit/JIT.h:
1789         * jit/JITCall.cpp:
1790         (JSC::JIT::compileOpCallVarargs):
1791         (JSC::JIT::compileOpCallSlowCase):
1792         * jit/JITCall32_64.cpp:
1793         (JSC::JIT::compileOpCallVarargs):
1794         (JSC::JIT::compileOpCallSlowCase):
1795         * jit/JITInlineMethods.h:
1796         (JSC::JIT::emitJumpIfNotType):
1797         * jit/JITStubs.cpp:
1798         (JSC::DEFINE_STUB_FUNCTION):
1799         * runtime/Executable.h:
1800         (JSC::isHostFunction):
1801         * runtime/JSFunction.h:
1802         (JSC::JSFunction::createStructure):
1803         * runtime/JSObject.cpp:
1804         (JSC::JSObject::put):
1805         (JSC::JSObject::putWithAttributes):
1806         * runtime/JSObject.h:
1807         (JSC::getJSFunction):
1808         (JSC::JSObject::putDirect):
1809         (JSC::JSObject::putDirectWithoutTransition):
1810         * runtime/JSType.h:
1811
1812 2011-09-21  Geoffrey Garen  <ggaren@apple.com>
1813
1814         Removed WTFTHREADDATA_MULTITHREADED, making it always true
1815         https://bugs.webkit.org/show_bug.cgi?id=68549
1816
1817         Reviewed by Darin Adler.
1818
1819         Another part of making threads exist in WebKit.
1820
1821         * wtf/WTFThreadData.cpp:
1822         * wtf/WTFThreadData.h:
1823         (WTF::wtfThreadData):
1824
1825 2011-09-21  Dan Bernstein  <mitz@apple.com>
1826
1827         JavaScriptCore Part of: Prevent the WebKit frameworks from defining inappropriately-named Objective-C classes
1828         https://bugs.webkit.org/show_bug.cgi?id=68451
1829
1830         Reviewed by Darin Adler.
1831
1832         * JavaScriptCore.xcodeproj/project.pbxproj: Added a script build phase that invokes
1833         check-for-inappropriate-objc-class-names, allowing only class names prefixed with "JS".
1834
1835 2011-09-20  Gavin Barraclough  <barraclough@apple.com>
1836
1837         MacroAssembler fixes.
1838         https://bugs.webkit.org/show_bug.cgi?id=68494
1839
1840         Reviewed by Sam Weinig.
1841
1842         Add X86-64's 3 operand or32 to other MacroAssembler, fix load32's [const] void* mismatch
1843
1844         * assembler/MacroAssembler.h:
1845         (JSC::MacroAssembler::orPtr):
1846         (JSC::MacroAssembler::loadPtr):
1847         * assembler/MacroAssemblerARM.h:
1848         (JSC::MacroAssemblerARM::or32):
1849         * assembler/MacroAssemblerARMv7.h:
1850         (JSC::MacroAssemblerARMv7::or32):
1851         * assembler/MacroAssemblerMIPS.h:
1852         (JSC::MacroAssemblerMIPS::or32):
1853         * assembler/MacroAssemblerSH4.h:
1854         (JSC::MacroAssemblerSH4::or32):
1855         (JSC::MacroAssemblerSH4::load32):
1856         * assembler/MacroAssemblerX86.h:
1857         (JSC::MacroAssemblerX86::load32):
1858         * assembler/MacroAssemblerX86_64.h:
1859         (JSC::MacroAssemblerX86_64::load32):
1860
1861 2011-09-20  Geoffrey Garen  <ggaren@apple.com>
1862
1863         Some Heap cleanup.
1864
1865         Reviewed by Beth Dakin.
1866
1867         * heap/MarkedBlock.cpp:
1868         (JSC::MarkedBlock::blessNewBlock): Removed blessNewBlockForSlowPath()
1869         because it was unused; renamed blessNewBlockForFastPath() to blessNewBlock()
1870         since there is only one now.
1871
1872         * heap/MarkedBlock.h: Removed ownerSet-related stuff since it was unused.
1873         Updated mark bit overhead calculation. Deployed atomsPerBlock in one
1874         place where we were recalculating it.
1875
1876         * heap/MarkedSpace.cpp:
1877         (JSC::MarkedSpace::addBlock): Updated for rename.
1878
1879 2011-09-20  Filip Pizlo  <fpizlo@apple.com>
1880
1881         DFG JIT always speculates integer on modulo
1882         https://bugs.webkit.org/show_bug.cgi?id=68485
1883
1884         Reviewed by Oliver Hunt.
1885
1886         Added support for double modulo, which is a call to fmod().
1887         Also added support for recording the old JIT's statistics
1888         on op_mod and propagating them along the graph. Finally,
1889         fixed a goof in the ArithNodeFlags propagation logic that
1890         was made obvious when I started testing ArithMod.
1891
1892         * dfg/DFGByteCodeParser.cpp:
1893         (JSC::DFG::ByteCodeParser::makeSafe):
1894         (JSC::DFG::ByteCodeParser::parseBlock):
1895         * dfg/DFGNode.h:
1896         (JSC::DFG::Node::hasArithNodeFlags):
1897         * dfg/DFGPropagator.cpp:
1898         (JSC::DFG::Propagator::propagateArithNodeFlags):
1899         (JSC::DFG::Propagator::propagateNodePredictions):
1900         (JSC::DFG::Propagator::fixupNode):
1901         * dfg/DFGSpeculativeJIT.cpp:
1902         (JSC::DFG::SpeculativeJIT::compile):
1903
1904 2011-09-20  ChangSeok Oh  <shivamidow@gmail.com>
1905
1906         [GTK] requestAnimationFrame support for gtk port
1907         https://bugs.webkit.org/show_bug.cgi?id=66280
1908
1909         Reviewed by Martin Robinson.
1910
1911         Let GTK port use REQUEST_ANIMATION_FRAME_TIMER.
1912
1913         * wtf/Platform.h:
1914
1915 2011-09-20  Filip Pizlo  <fpizlo@apple.com>
1916
1917         DFG JIT performs too many negative zero checks, and too many
1918         overflow checks
1919         https://bugs.webkit.org/show_bug.cgi?id=68430
1920
1921         Reviewed by Oliver Hunt.
1922
1923         This adds comprehensive support for deciding how to perform an
1924         arithmetic operations based on a combination of overflow profiling,
1925         negative zero profiling, value profiling, and a static analysis of
1926         how the results of these operations get used.
1927
1928         This is a 72% speed-up on stanford-crypto-sha256-iterative, and a
1929         2.5% speed-up on the Kraken average, a 1.4% speed-up on the V8
1930         geomean, and neutral on SunSpider. It's also an 8.5% speed-up on
1931         V8-crypto, because apparenty everything we do speeds up crypto.
1932
1933         * dfg/DFGByteCodeParser.cpp:
1934         (JSC::DFG::ByteCodeParser::toInt32):
1935         (JSC::DFG::ByteCodeParser::toNumber):
1936         (JSC::DFG::ByteCodeParser::isSmallInt32Constant):
1937         (JSC::DFG::ByteCodeParser::valueOfInt32Constant):
1938         (JSC::DFG::ByteCodeParser::weaklyPredictInt32):
1939         (JSC::DFG::ByteCodeParser::makeSafe):
1940         (JSC::DFG::ByteCodeParser::handleMinMax):
1941         (JSC::DFG::ByteCodeParser::handleIntrinsic):
1942         (JSC::DFG::ByteCodeParser::parseBlock):
1943         (JSC::DFG::ByteCodeParser::processPhiStack):
1944         (JSC::DFG::ByteCodeParser::parse):
1945         * dfg/DFGGraph.cpp:
1946         (JSC::DFG::Graph::dump):
1947         * dfg/DFGJITCodeGenerator.cpp:
1948         (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
1949         * dfg/DFGNode.h:
1950         (JSC::DFG::nodeUsedAsNumber):
1951         (JSC::DFG::nodeCanTruncateInteger):
1952         (JSC::DFG::nodeCanIgnoreNegativeZero):
1953         (JSC::DFG::nodeCanSpeculateInteger):
1954         (JSC::DFG::arithNodeFlagsAsString):
1955         (JSC::DFG::Node::Node):
1956         (JSC::DFG::Node::hasArithNodeFlags):
1957         (JSC::DFG::Node::rawArithNodeFlags):
1958         (JSC::DFG::Node::arithNodeFlags):
1959         (JSC::DFG::Node::arithNodeFlagsForCompare):
1960         (JSC::DFG::Node::setArithNodeFlag):
1961         (JSC::DFG::Node::mergeArithNodeFlags):
1962         * dfg/DFGPropagator.cpp:
1963         (JSC::DFG::Propagator::fixpoint):
1964         (JSC::DFG::Propagator::isNotNegZero):
1965         (JSC::DFG::Propagator::isNotZero):
1966         (JSC::DFG::Propagator::propagateArithNodeFlags):
1967         (JSC::DFG::Propagator::propagateArithNodeFlagsForward):
1968         (JSC::DFG::Propagator::propagateArithNodeFlagsBackward):
1969         (JSC::DFG::Propagator::propagateNodePredictions):
1970         (JSC::DFG::Propagator::propagatePredictionsForward):
1971         (JSC::DFG::Propagator::propagatePredictionsBackward):
1972         (JSC::DFG::Propagator::toDouble):
1973         (JSC::DFG::Propagator::fixupNode):
1974         (JSC::DFG::Propagator::fixup):
1975         (JSC::DFG::Propagator::startIndexForChildren):
1976         (JSC::DFG::Propagator::endIndexForPureCSE):
1977         (JSC::DFG::Propagator::pureCSE):
1978         (JSC::DFG::Propagator::clobbersWorld):
1979         (JSC::DFG::Propagator::setReplacement):
1980         (JSC::DFG::Propagator::performNodeCSE):
1981         (JSC::DFG::Propagator::localCSE):
1982         * dfg/DFGSpeculativeJIT.cpp:
1983         (JSC::DFG::SpeculativeJIT::compile):
1984         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
1985
1986 2011-09-19  Oliver Hunt  <oliver@apple.com>
1987
1988         Refactor Heap allocation logic into separate AllocationSpace class
1989         https://bugs.webkit.org/show_bug.cgi?id=68409
1990
1991         Reviewed by Gavin Barraclough.
1992
1993         This patch hoists direct manipulation of the MarkedSpace and related
1994         data out of Heap and into a separate class.  This will allow us to
1995         have multiple allocation spaces in future, so easing the way towards
1996         having GC'd backing stores for objects.
1997
1998         * CMakeLists.txt:
1999         * GNUmakefile.list.am:
2000         * JavaScriptCore.exp:
2001         * JavaScriptCore.gypi:
2002         * JavaScriptCore.pro:
2003         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2004         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2005         * JavaScriptCore.xcodeproj/project.pbxproj:
2006         * debugger/Debugger.cpp:
2007         (JSC::Debugger::recompileAllJSFunctions):
2008         * heap/AllocationSpace.cpp: Added.
2009         (JSC::AllocationSpace::tryAllocate):
2010         (JSC::AllocationSpace::allocateSlowCase):
2011         (JSC::AllocationSpace::allocateBlock):
2012         (JSC::AllocationSpace::freeBlocks):
2013         (JSC::TakeIfEmpty::TakeIfEmpty):
2014         (JSC::TakeIfEmpty::operator()):
2015         (JSC::TakeIfEmpty::returnValue):
2016         (JSC::AllocationSpace::shrink):
2017         * heap/AllocationSpace.h: Added.
2018         (JSC::AllocationSpace::AllocationSpace):
2019         (JSC::AllocationSpace::blocks):
2020         (JSC::AllocationSpace::sizeClassFor):
2021         (JSC::AllocationSpace::setHighWaterMark):
2022         (JSC::AllocationSpace::highWaterMark):
2023         (JSC::AllocationSpace::canonicalizeBlocks):
2024         (JSC::AllocationSpace::resetAllocator):
2025         (JSC::AllocationSpace::forEachCell):
2026         (JSC::AllocationSpace::forEachBlock):
2027         (JSC::AllocationSpace::allocate):
2028         * heap/Heap.cpp:
2029         (JSC::Heap::Heap):
2030         (JSC::Heap::reportExtraMemoryCostSlowCase):
2031         (JSC::Heap::getConservativeRegisterRoots):
2032         (JSC::Heap::markRoots):
2033         (JSC::Heap::clearMarks):
2034         (JSC::Heap::sweep):
2035         (JSC::Heap::objectCount):
2036         (JSC::Heap::size):
2037         (JSC::Heap::capacity):
2038         (JSC::Heap::globalObjectCount):
2039         (JSC::Heap::objectTypeCounts):
2040         (JSC::Heap::collect):
2041         (JSC::Heap::canonicalizeBlocks):
2042         (JSC::Heap::resetAllocator):
2043         (JSC::Heap::freeBlocks):
2044         (JSC::Heap::shrink):
2045         * heap/Heap.h:
2046         (JSC::Heap::objectSpace):
2047         (JSC::Heap::sizeClassForObject):
2048         (JSC::Heap::allocate):
2049         * jit/JITInlineMethods.h:
2050         (JSC::JIT::emitAllocateBasicJSObject):
2051         * runtime/JSGlobalData.cpp:
2052         (JSC::JSGlobalData::recompileAllJSFunctions):
2053         (JSC::JSGlobalData::releaseExecutableMemory):
2054
2055 2011-09-19  Geoffrey Garen  <ggaren@apple.com>
2056
2057         Removed BREWMP* platform #ifdefs
2058         https://bugs.webkit.org/show_bug.cgi?id=68425
2059
2060         BREWMP* has no maintainer, and this is dead code.
2061
2062         Reviewed by Darin Adler.
2063
2064         * heap/MarkStack.h:
2065         (JSC::::shrinkAllocation):
2066         * jit/ExecutableAllocator.h:
2067         (JSC::ExecutableAllocator::cacheFlush):
2068         * runtime/TimeoutChecker.cpp:
2069         (JSC::getCPUTime):
2070         * wtf/Assertions.cpp:
2071         * wtf/Assertions.h:
2072         * wtf/CurrentTime.cpp:
2073         * wtf/DateMath.cpp:
2074         (WTF::calculateUTCOffset):
2075         * wtf/FastMalloc.cpp:
2076         (WTF::fastMalloc):
2077         (WTF::fastCalloc):
2078         (WTF::fastMallocSize):
2079         * wtf/FastMalloc.h:
2080         * wtf/MainThread.cpp:
2081         * wtf/MathExtras.h:
2082         * wtf/OwnPtrCommon.h:
2083         * wtf/Platform.h:
2084         * wtf/RandomNumber.cpp:
2085         (WTF::randomNumber):
2086         * wtf/RandomNumberSeed.h:
2087         (WTF::initializeRandomNumberGenerator):
2088         * wtf/text/WTFString.h:
2089         * wtf/unicode/Unicode.h:
2090
2091 2011-09-20  Adam Roben  <aroben@apple.com>
2092
2093         Windows build fix after r95523
2094
2095         * wtf/CheckedArithmetic.h: Added stdint.h so we can have int64_t defined.
2096
2097 2011-09-18  Filip Pizlo  <fpizlo@apple.com>
2098
2099         DFG JIT does not speculate aggressively enough on GetById
2100         https://bugs.webkit.org/show_bug.cgi?id=68320
2101
2102         Reviewed by Oliver Hunt.
2103
2104         This adds the ability to access properties directly, by offset.
2105         This optimization kicks in when at the time of DFG compilation,
2106         it appears that the given get_by_id is self-cached by the old JIT.
2107         Two new opcodes get introduced: CheckStructure and GetByOffset.
2108         CheckStructure performs a speculation check on the object's
2109         structure, and returns the storage pointer. GetByOffset performs
2110         a direct read of the field from the storage pointer. Both
2111         CheckStructure and GetByOffset can be CSE'd, so that we can
2112         eliminate redundant structure checks, and redundant reads of the
2113         same field.
2114
2115         This is a 4% speed-up on V8, a 2% slow-down on Kraken, and
2116         neutral on SunSpider.
2117
2118         * bytecode/PredictedType.cpp:
2119         (JSC::predictionFromClassInfo):
2120         (JSC::predictionFromStructure):
2121         (JSC::predictionFromCell):
2122         * bytecode/PredictedType.h:
2123         * dfg/DFGByteCodeParser.cpp:
2124         (JSC::DFG::ByteCodeParser::parseBlock):
2125         * dfg/DFGGenerationInfo.h:
2126         (JSC::DFG::dataFormatToString):
2127         (JSC::DFG::needDataFormatConversion):
2128         (JSC::DFG::GenerationInfo::initStorage):
2129         (JSC::DFG::GenerationInfo::spill):
2130         (JSC::DFG::GenerationInfo::fillStorage):
2131         * dfg/DFGGraph.h:
2132         (JSC::DFG::Graph::predict):
2133         (JSC::DFG::Graph::getPrediction):
2134         * dfg/DFGJITCodeGenerator.cpp:
2135         (JSC::DFG::JITCodeGenerator::fillInteger):
2136         (JSC::DFG::JITCodeGenerator::fillDouble):
2137         (JSC::DFG::JITCodeGenerator::fillJSValue):
2138         (JSC::DFG::JITCodeGenerator::fillStorage):
2139         (JSC::DFG::GPRTemporary::GPRTemporary):
2140         * dfg/DFGJITCodeGenerator.h:
2141         (JSC::DFG::JITCodeGenerator::silentSpillGPR):
2142         (JSC::DFG::JITCodeGenerator::silentFillGPR):
2143         (JSC::DFG::JITCodeGenerator::spill):
2144         (JSC::DFG::JITCodeGenerator::storageResult):
2145         (JSC::DFG::StorageOperand::StorageOperand):
2146         (JSC::DFG::StorageOperand::~StorageOperand):
2147         (JSC::DFG::StorageOperand::index):
2148         (JSC::DFG::StorageOperand::gpr):
2149         (JSC::DFG::StorageOperand::use):
2150         * dfg/DFGNode.h:
2151         (JSC::DFG::OpInfo::OpInfo):
2152         (JSC::DFG::Node::Node):
2153         (JSC::DFG::Node::hasPrediction):
2154         (JSC::DFG::Node::hasStructure):
2155         (JSC::DFG::Node::structure):
2156         (JSC::DFG::Node::hasStorageAccessData):
2157         (JSC::DFG::Node::storageAccessDataIndex):
2158         * dfg/DFGPropagator.cpp:
2159         (JSC::DFG::Propagator::propagateNode):
2160         (JSC::DFG::Propagator::globalVarLoadElimination):
2161         (JSC::DFG::Propagator::getMethodLoadElimination):
2162         (JSC::DFG::Propagator::checkStructureLoadElimination):
2163         (JSC::DFG::Propagator::getByOffsetLoadElimination):
2164         (JSC::DFG::Propagator::performNodeCSE):
2165         * dfg/DFGSpeculativeJIT.cpp:
2166         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
2167         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
2168         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
2169         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
2170         (JSC::DFG::SpeculativeJIT::compile):
2171         * wtf/StdLibExtras.h:
2172         (WTF::safeCast):
2173
2174 2011-09-19  Mark Hahnenberg  <mhahnenberg@apple.com>
2175
2176         Remove toPrimitive from JSCell
2177         https://bugs.webkit.org/show_bug.cgi?id=67875
2178
2179         Reviewed by Darin Adler.
2180
2181         Part of the refactoring process to un-virtualize JSCell.  We move
2182         all of the implicit functionality provided by the virtual toPrimitive method
2183         in JSCell to be explicit in JSValue::toPrimitive and JSCell:toPrimitive while
2184         also de-virtualizing JSCell::toPrimitive.
2185
2186         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2187         * runtime/JSCell.cpp:
2188         (JSC::JSCell::toPrimitive):
2189         * runtime/JSCell.h:
2190
2191         We replace JSNotAnObject::toPrimitive with defaultValue, which it overrides from
2192         JSObject.  This pushes the virtual method further down, enabling us to get rid
2193         of the virtual call in JSCell.  Eventually we'll probably have to deal with this
2194         again, but we'll cross that bridge when we come to it.
2195         * runtime/JSNotAnObject.cpp:
2196         (JSC::JSNotAnObject::defaultValue):
2197         * runtime/JSNotAnObject.h:
2198         * runtime/JSObject.h:
2199         * runtime/JSString.h:
2200
2201 2011-09-19  Geoffrey Garen  <ggaren@apple.com>
2202
2203         Removed ENABLE_LAZY_BLOCK_FREEING and related #ifdefs
2204         https://bugs.webkit.org/show_bug.cgi?id=68424
2205
2206         As discussed on webkit-dev. All ports build with threads enabled in JSC now.
2207
2208         This may break WinCE and other ports that have not built and tested with
2209         this configuration. I've filed bugs for port maintainers. It's time for
2210         WebKit to move forward.
2211
2212         Reviewed by Mark Rowe.
2213
2214         * heap/Heap.cpp:
2215         (JSC::Heap::Heap):
2216         (JSC::Heap::~Heap):
2217         (JSC::Heap::destroy):
2218         (JSC::Heap::blockFreeingThreadMain):
2219         (JSC::Heap::allocateBlock):
2220         (JSC::Heap::freeBlocks):
2221         (JSC::Heap::releaseFreeBlocks):
2222         * heap/Heap.h:
2223         * wtf/Platform.h:
2224
2225 2011-09-19  Geoffrey Garen  <ggaren@apple.com>
2226
2227         Removed ENABLE_WTF_MULTIPLE_THREADS and related #ifdefs
2228         https://bugs.webkit.org/show_bug.cgi?id=68423
2229
2230         As discussed on webkit-dev. All ports build with threads enabled in WTF now.
2231
2232         This may break WinCE and other ports that have not built and tested with
2233         this configuration. I've filed bugs for port maintainers. It's time for
2234         WebKit to move forward.
2235
2236         Reviewed by Mark Rowe.
2237
2238         * wtf/CryptographicallyRandomNumber.cpp:
2239         (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomNumber):
2240         (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomValues):
2241         * wtf/FastMalloc.cpp:
2242         * wtf/Platform.h:
2243         * wtf/RandomNumber.cpp:
2244         (WTF::randomNumber):
2245         * wtf/RefCountedLeakCounter.cpp:
2246         (WTF::RefCountedLeakCounter::increment):
2247         (WTF::RefCountedLeakCounter::decrement):
2248         * wtf/ThreadingPthreads.cpp:
2249         (WTF::initializeThreading):
2250         * wtf/ThreadingWin.cpp:
2251         (WTF::initializeThreading):
2252         * wtf/dtoa.cpp:
2253         (WTF::pow5mult):
2254         * wtf/gtk/ThreadingGtk.cpp:
2255         (WTF::initializeThreading):
2256         * wtf/qt/ThreadingQt.cpp:
2257         (WTF::initializeThreading):
2258
2259 2011-09-19  Geoffrey Garen  <ggaren@apple.com>
2260
2261         Removed ENABLE_JSC_MULTIPLE_THREADS and related #ifdefs.
2262         https://bugs.webkit.org/show_bug.cgi?id=68422
2263
2264         As discussed on webkit-dev. All ports build with threads enabled in JSC now.
2265
2266         This may break WinCE and other ports that have not built and tested with
2267         this configuration. I've filed bugs for port maintainers. It's time for
2268         WebKit to move forward.
2269
2270         Reviewed by Sam Weinig.
2271
2272         * API/APIShims.h:
2273         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
2274         * API/JSContextRef.cpp:
2275         * heap/MachineStackMarker.cpp:
2276         (JSC::MachineThreads::MachineThreads):
2277         (JSC::MachineThreads::~MachineThreads):
2278         (JSC::MachineThreads::gatherConservativeRoots):
2279         * heap/MachineStackMarker.h:
2280         * runtime/InitializeThreading.cpp:
2281         (JSC::initializeThreadingOnce):
2282         (JSC::initializeThreading):
2283         * runtime/JSGlobalData.cpp:
2284         (JSC::JSGlobalData::sharedInstance):
2285         * runtime/JSGlobalData.h:
2286         (JSC::JSGlobalData::makeUsableFromMultipleThreads):
2287         * runtime/JSLock.cpp:
2288         * runtime/Structure.cpp:
2289         * wtf/Platform.h:
2290
2291 2011-09-19  Sheriff Bot  <webkit.review.bot@gmail.com>
2292
2293         Unreviewed, rolling out r95493 and r95496.
2294         http://trac.webkit.org/changeset/95493
2295         http://trac.webkit.org/changeset/95496
2296         https://bugs.webkit.org/show_bug.cgi?id=68418
2297
2298         Broke Windows build (Requested by rniwa on #webkit).
2299
2300         * CMakeLists.txt:
2301         * GNUmakefile.list.am:
2302         * JavaScriptCore.exp:
2303         * JavaScriptCore.gypi:
2304         * JavaScriptCore.pro:
2305         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2306         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2307         * JavaScriptCore.xcodeproj/project.pbxproj:
2308         * debugger/Debugger.cpp:
2309         (JSC::Debugger::recompileAllJSFunctions):
2310         * heap/AllocationSpace.cpp: Removed.
2311         * heap/AllocationSpace.h: Removed.
2312         * heap/Heap.cpp:
2313         (JSC::CountFunctor::TakeIfEmpty::TakeIfEmpty):
2314         (JSC::CountFunctor::TakeIfEmpty::operator()):
2315         (JSC::CountFunctor::TakeIfEmpty::returnValue):
2316         (JSC::Heap::Heap):
2317         (JSC::Heap::reportExtraMemoryCostSlowCase):
2318         (JSC::Heap::tryAllocate):
2319         (JSC::Heap::allocateSlowCase):
2320         (JSC::Heap::getConservativeRegisterRoots):
2321         (JSC::Heap::markRoots):
2322         (JSC::Heap::clearMarks):
2323         (JSC::Heap::sweep):
2324         (JSC::Heap::objectCount):
2325         (JSC::Heap::size):
2326         (JSC::Heap::capacity):
2327         (JSC::Heap::globalObjectCount):
2328         (JSC::Heap::objectTypeCounts):
2329         (JSC::Heap::collect):
2330         (JSC::Heap::canonicalizeBlocks):
2331         (JSC::Heap::resetAllocator):
2332         (JSC::Heap::allocateBlock):
2333         (JSC::Heap::freeBlocks):
2334         (JSC::Heap::shrink):
2335         * heap/Heap.h:
2336         (JSC::Heap::markedSpace):
2337         (JSC::Heap::forEachCell):
2338         (JSC::Heap::forEachBlock):
2339         (JSC::Heap::sizeClassFor):
2340         (JSC::Heap::allocate):
2341         * jit/JITInlineMethods.h:
2342         (JSC::JIT::emitAllocateBasicJSObject):
2343         * runtime/JSGlobalData.cpp:
2344         (JSC::JSGlobalData::recompileAllJSFunctions):
2345         (JSC::JSGlobalData::releaseExecutableMemory):
2346
2347 2011-09-19  Gavin Barraclough  <barraclough@apple.com>
2348
2349         Errrk, missed stylebot comments in last commit.
2350
2351         * runtime/StringPrototype.cpp:
2352         (JSC::stringProtoFuncSplit):
2353
2354 2011-09-19  Gavin Barraclough  <barraclough@apple.com>
2355
2356         String#split is buggy
2357         https://bugs.webkit.org/show_bug.cgi?id=68348
2358
2359         Reviewed by Sam Weinig.
2360
2361         * runtime/StringPrototype.cpp:
2362         (JSC::jsStringWithReuse):
2363             - added helper function to reuse original JSString value.
2364         (JSC::stringProtoFuncSplit):
2365             - Rewritten from the spec.
2366         * tests/mozilla/ecma/String/15.5.4.8-2.js:
2367         (getTestCases):
2368             - This test is not ES5 compliant.
2369
2370 2011-09-19  Geoffrey Garen  <ggaren@apple.com>
2371
2372         Removed lots of friend declarations from JSCell, so we can more
2373         effectively make use of private and protected.
2374
2375         Reviewed by Sam Weinig.
2376
2377         * runtime/JSCell.h: Removed MSVCBugWorkaround because it was a lot of
2378         confusion for not much safety.
2379         (JSC::JSCell::operator new): Made this public because it is used by a
2380         few clients, and not really dangerous.
2381
2382         * runtime/JSObject.cpp:
2383         (JSC::JSObject::put):
2384         (JSC::JSObject::deleteProperty):
2385         (JSC::JSObject::defineGetter):
2386         (JSC::JSObject::defineSetter):
2387         (JSC::JSObject::getPropertySpecificValue):
2388         (JSC::JSObject::getOwnPropertyNames):
2389         (JSC::JSObject::seal):
2390         (JSC::JSObject::freeze):
2391         (JSC::JSObject::preventExtensions):
2392         (JSC::JSObject::removeDirect):
2393         (JSC::JSObject::createInheritorID):
2394         (JSC::JSObject::allocatePropertyStorage):
2395         (JSC::JSObject::getOwnPropertyDescriptor):
2396         * runtime/JSObject.h:
2397         (JSC::JSObject::getDirect):
2398         (JSC::JSObject::getDirectLocation):
2399         (JSC::JSObject::hasCustomProperties):
2400         (JSC::JSObject::hasGetterSetterProperties):
2401         (JSC::JSObject::isSealed):
2402         (JSC::JSObject::isFrozen):
2403         (JSC::JSObject::isExtensible):
2404         (JSC::JSObject::flattenDictionaryObject):
2405         (JSC::JSObject::finishCreation):
2406         (JSC::JSObject::prototype):
2407         (JSC::JSObject::setPrototype):
2408         (JSC::JSObject::inlineGetOwnPropertySlot):
2409         (JSC::JSCell::fastGetOwnProperty):
2410         (JSC::JSObject::putDirectInternal):
2411         (JSC::JSObject::putDirectWithoutTransition):
2412         (JSC::JSObject::transitionTo):
2413         (JSC::JSObject::visitChildrenDirect): Changed all use of m_structure to
2414         structure() / setStructure(), so we don't have to be a friend of JSCell.
2415
2416         * runtime/Structure.h:
2417         (JSC::JSCell::setStructure): Added, to avoid direct access by JSObject
2418         to JSCell::m_structure.
2419
2420 2011-09-19  Adam Barth  <abarth@webkit.org>
2421
2422         Always enable ENABLE(EVENTSOURCE)
2423         https://bugs.webkit.org/show_bug.cgi?id=68414
2424
2425         Reviewed by Eric Seidel.
2426
2427         * Configurations/FeatureDefines.xcconfig:
2428
2429 2011-09-19  Eli Fidler  <efidler@rim.com>
2430
2431         Enable JSC_MULTIPLE_THREADS for OS(QNX).
2432         https://bugs.webkit.org/show_bug.cgi?id=68047
2433
2434         Reviewed by Daniel Bates.
2435
2436         SA_RESTART was required for SIGUSR2-based debugging, but is not
2437         present on QNX. This debugging doesn't seem critical to
2438         JSC_MULTIPLE_THREADS, so allow it to proceed.
2439
2440         * heap/MachineStackMarker.cpp:
2441         (JSC::MachineThreads::Thread::Thread):
2442         (JSC::getPlatformThreadRegisters):
2443         (JSC::otherThreadStackPointer):
2444         (JSC::freePlatformThreadRegisters):
2445         * wtf/Platform.h: enable PTHREADS for OS(QNX)
2446
2447 2011-09-19  Oliver Hunt  <oliver@apple.com>
2448
2449         Windows build fix.
2450
2451         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2452
2453 2011-09-19  Oliver Hunt  <oliver@apple.com>
2454
2455         Refactor Heap allocation logic into separate AllocationSpace class
2456         https://bugs.webkit.org/show_bug.cgi?id=68409
2457
2458         Reviewed by Gavin Barraclough.
2459
2460         This patch hoists direct manipulation of the MarkedSpace and related
2461         data out of Heap and into a separate class.  This will allow us to
2462         have multiple allocation spaces in future, so easing the way towards
2463         having GC'd backing stores for objects.
2464
2465         * CMakeLists.txt:
2466         * GNUmakefile.list.am:
2467         * JavaScriptCore.exp:
2468         * JavaScriptCore.gypi:
2469         * JavaScriptCore.pro:
2470         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2471         * JavaScriptCore.xcodeproj/project.pbxproj:
2472         * debugger/Debugger.cpp:
2473         (JSC::Debugger::recompileAllJSFunctions):
2474         * heap/AllocationSpace.cpp: Added.
2475         (JSC::AllocationSpace::tryAllocate):
2476         (JSC::AllocationSpace::allocateSlowCase):
2477         (JSC::AllocationSpace::allocateBlock):
2478         (JSC::AllocationSpace::freeBlocks):
2479         (JSC::TakeIfEmpty::TakeIfEmpty):
2480         (JSC::TakeIfEmpty::operator()):
2481         (JSC::TakeIfEmpty::returnValue):
2482         (JSC::AllocationSpace::shrink):
2483         * heap/AllocationSpace.h: Added.
2484         (JSC::AllocationSpace::AllocationSpace):
2485         (JSC::AllocationSpace::blocks):
2486         (JSC::AllocationSpace::sizeClassFor):
2487         (JSC::AllocationSpace::setHighWaterMark):
2488         (JSC::AllocationSpace::highWaterMark):
2489         (JSC::AllocationSpace::canonicalizeBlocks):
2490         (JSC::AllocationSpace::resetAllocator):
2491         (JSC::AllocationSpace::forEachCell):
2492         (JSC::AllocationSpace::forEachBlock):
2493         (JSC::AllocationSpace::allocate):
2494         * heap/Heap.cpp:
2495         (JSC::Heap::Heap):
2496         (JSC::Heap::reportExtraMemoryCostSlowCase):
2497         (JSC::Heap::getConservativeRegisterRoots):
2498         (JSC::Heap::markRoots):
2499         (JSC::Heap::clearMarks):
2500         (JSC::Heap::sweep):
2501         (JSC::Heap::objectCount):
2502         (JSC::Heap::size):
2503         (JSC::Heap::capacity):
2504         (JSC::Heap::globalObjectCount):
2505         (JSC::Heap::objectTypeCounts):
2506         (JSC::Heap::collect):
2507         (JSC::Heap::canonicalizeBlocks):
2508         (JSC::Heap::resetAllocator):
2509         (JSC::Heap::freeBlocks):
2510         (JSC::Heap::shrink):
2511         * heap/Heap.h:
2512         (JSC::Heap::objectSpace):
2513         (JSC::Heap::sizeClassForObject):
2514         (JSC::Heap::allocate):
2515         * jit/JITInlineMethods.h:
2516         (JSC::JIT::emitAllocateBasicJSObject):
2517         * runtime/JSGlobalData.cpp:
2518         (JSC::JSGlobalData::recompileAllJSFunctions):
2519         (JSC::JSGlobalData::releaseExecutableMemory):
2520
2521 2011-09-19  Adam Roben  <aroben@apple.com>
2522
2523         Windows build fix after r95310
2524
2525         * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops: Added
2526         include\private\JavaScriptCore to the include path so DFGIntrinsic.h can be found.
2527
2528 2011-09-19  Filip Pizlo  <fpizlo@apple.com>
2529
2530         DFG speculation failures should act as additional value profiles
2531         https://bugs.webkit.org/show_bug.cgi?id=68335
2532
2533         Reviewed by Oliver Hunt.
2534
2535         This adds slow-case counters to the old JIT. It also ensures that
2536         negative zero in multiply is handled carefully. The old JIT
2537         previously took slow path if the result of a multiply was zero,
2538         which, without any changes, would cause the DFG to think that
2539         every such multiply produced a double result.
2540
2541         This also fixes a bug in the old JIT's handling of decrements. It
2542         would take the slow path if the result was zero, but not if it
2543         underflowed.
2544
2545         By itself, this would be a 1% slow-down on V8 and Kraken. But then
2546         I wrote optimizations in the DFG that take advantage of this new
2547         information. It's no longer the case that every multiply needs to
2548         do a check for negative zero; it only happens if the negative
2549         zero is ignored.
2550
2551         This results in a 12% speed-up on v8-crypto, for a 1.4% geomean
2552         speed-up in V8. It's mostly neutral on Kraken. I can see an
2553         0.5% slow-down and it appears to be significant.
2554
2555         * bytecode/CodeBlock.cpp:
2556         (JSC::CodeBlock::resetRareCaseProfiles):
2557         (JSC::CodeBlock::dumpValueProfiles):
2558         * bytecode/CodeBlock.h:
2559         * bytecode/ValueProfile.h:
2560         (JSC::RareCaseProfile::RareCaseProfile):
2561         (JSC::getRareCaseProfileBytecodeOffset):
2562         * dfg/DFGByteCodeParser.cpp:
2563         (JSC::DFG::ByteCodeParser::toInt32):
2564         (JSC::DFG::ByteCodeParser::makeSafe):
2565         (JSC::DFG::ByteCodeParser::parseBlock):
2566         * dfg/DFGJITCodeGenerator.cpp:
2567         (JSC::DFG::GPRTemporary::GPRTemporary):
2568         * dfg/DFGJITCodeGenerator.h:
2569         * dfg/DFGNode.h:
2570         * dfg/DFGPropagator.cpp:
2571         (JSC::DFG::Propagator::propagateNode):
2572         (JSC::DFG::Propagator::fixupNode):
2573         (JSC::DFG::Propagator::clobbersWorld):
2574         (JSC::DFG::Propagator::performNodeCSE):
2575         * dfg/DFGSpeculativeJIT.cpp:
2576         (JSC::DFG::SpeculativeJIT::compile):
2577         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
2578         * jit/JIT.cpp:
2579         (JSC::JIT::privateCompileSlowCases):
2580         * jit/JIT.h:
2581         (JSC::JIT::linkDummySlowCase):
2582         * jit/JITArithmetic.cpp:
2583         (JSC::JIT::emit_op_post_dec):
2584         (JSC::JIT::emit_op_pre_dec):
2585         (JSC::JIT::compileBinaryArithOp):
2586         (JSC::JIT::emit_op_add):
2587         (JSC::JIT::emitSlow_op_add):
2588         * jit/JITInlineMethods.h:
2589         (JSC::JIT::addSlowCase):
2590
2591 2011-09-19  Adam Roben  <aroben@apple.com>
2592
2593         Windows build fix after r94575
2594
2595         * JavaScriptCore.vcproj/JavaScriptCore.sln: Relinearized project dependencies. testRegExp
2596         now builds just before FindSafari.
2597
2598 2011-09-19  Sheriff Bot  <webkit.review.bot@gmail.com>
2599
2600         Unreviewed, rolling out r95466.
2601         http://trac.webkit.org/changeset/95466
2602         https://bugs.webkit.org/show_bug.cgi?id=68389
2603
2604         Incorrect version of the patch. (Requested by mhahnenberg on
2605         #webkit).
2606
2607         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2608         * runtime/JSCell.cpp:
2609         (JSC::JSCell::toPrimitive):
2610         * runtime/JSCell.h:
2611         (JSC::JSCell::JSValue::toPrimitive):
2612         * runtime/JSNotAnObject.cpp:
2613         (JSC::JSNotAnObject::toPrimitive):
2614         * runtime/JSNotAnObject.h:
2615         * runtime/JSObject.h:
2616         * runtime/JSString.h:
2617
2618 2011-09-19  Mark Hahnenberg  <mhahnenberg@apple.com>
2619
2620         Remove toPrimitive from JSCell
2621         https://bugs.webkit.org/show_bug.cgi?id=67875
2622
2623         Reviewed by Geoffrey Garen.
2624
2625         Part of the refactoring process to un-virtualize JSCell.  We move
2626         all of the implicit functionality provided by the virtual toPrimitive method
2627         in JSCell to be explicit in JSValue::toPrimitive and JSCell:toPrimitive while
2628         also de-virtualizing JSCell::toPrimitive.
2629
2630         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2631         * runtime/JSCell.cpp:
2632         (JSC::JSCell::toPrimitive):
2633         * runtime/JSCell.h:
2634
2635         We replace JSNotAnObject::toPrimitive with defaultValue, which it overrides from
2636         JSObject.  This pushes the virtual method further down, enabling us to get rid
2637         of the virtual call in JSCell.  Eventually we'll probably have to deal with this
2638         again, but we'll cross that bridge when we come to it.
2639         * runtime/JSNotAnObject.cpp:
2640         (JSC::JSNotAnObject::defaultValue):
2641         * runtime/JSNotAnObject.h:
2642         * runtime/JSObject.h:
2643         * runtime/JSString.h:
2644         (JSC::JSValue::toPrimitive):
2645
2646 2011-09-19  Oliver Hunt  <oliver@apple.com>
2647
2648         Build fix.
2649
2650         * jit/JITPropertyAccess32_64.cpp:
2651         (JSC::JIT::compileGetDirectOffset):
2652
2653 2011-09-19  Oliver Hunt  <oliver@apple.com>
2654
2655         Rename NewSpace.{h,cpp} to MarkedSpace.{h,cpp}
2656         https://bugs.webkit.org/show_bug.cgi?id=68376
2657
2658         Reviewed by Gavin Barraclough.
2659
2660         Renamed the the MarkedSpace files to match new name, and
2661         updated the relevant references.
2662
2663         * CMakeLists.txt:
2664         * GNUmakefile.list.am:
2665         * JavaScriptCore.gypi:
2666         * JavaScriptCore.pro:
2667         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2668         * JavaScriptCore.xcodeproj/project.pbxproj:
2669         * heap/Heap.h:
2670         * heap/MarkedSpace.cpp: Renamed from Source/JavaScriptCore/heap/NewSpace.cpp.
2671         (JSC::MarkedSpace::MarkedSpace):
2672         (JSC::MarkedSpace::addBlock):
2673         (JSC::MarkedSpace::removeBlock):
2674         (JSC::MarkedSpace::resetAllocator):
2675         (JSC::MarkedSpace::canonicalizeBlocks):
2676         * heap/MarkedSpace.h: Renamed from Source/JavaScriptCore/heap/NewSpace.h.
2677         (JSC::MarkedSpace::waterMark):
2678         (JSC::MarkedSpace::highWaterMark):
2679         (JSC::MarkedSpace::setHighWaterMark):
2680         (JSC::MarkedSpace::sizeClassFor):
2681         (JSC::MarkedSpace::allocate):
2682         (JSC::MarkedSpace::forEachBlock):
2683         (JSC::MarkedSpace::SizeClass::SizeClass):
2684         (JSC::MarkedSpace::SizeClass::resetAllocator):
2685         (JSC::MarkedSpace::SizeClass::canonicalizeBlock):
2686         * runtime/JSCell.h:
2687
2688 2011-09-19  Oliver Hunt  <oliver@apple.com>
2689
2690         Rename NewSpace to MarkedSpace
2691         https://bugs.webkit.org/show_bug.cgi?id=68375
2692
2693         Reviewed by Gavin Barraclough.
2694
2695         Rename NewSpace to a more accurate name, and update all uses.
2696         This patch doesn't rename the files themselves as that will
2697         just make the patch appear bigger than it is.
2698
2699         * JavaScriptCore.exp:
2700         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2701         * heap/Heap.cpp:
2702         (JSC::CountFunctor::TakeIfEmpty::TakeIfEmpty):
2703         (JSC::CountFunctor::TakeIfEmpty::operator()):
2704         (JSC::Heap::Heap):
2705         (JSC::Heap::reportExtraMemoryCostSlowCase):
2706         (JSC::Heap::tryAllocate):
2707         (JSC::Heap::allocateSlowCase):
2708         (JSC::Heap::collect):
2709         (JSC::Heap::canonicalizeBlocks):
2710         (JSC::Heap::resetAllocator):
2711         (JSC::Heap::isValidAllocation):
2712         (JSC::Heap::shrink):
2713         * heap/Heap.h:
2714         (JSC::Heap::markedSpace):
2715         (JSC::Heap::sizeClassFor):
2716         (JSC::Heap::allocate):
2717         * heap/NewSpace.cpp:
2718         (JSC::MarkedSpace::MarkedSpace):
2719         (JSC::MarkedSpace::addBlock):
2720         (JSC::MarkedSpace::removeBlock):
2721         (JSC::MarkedSpace::resetAllocator):
2722         (JSC::MarkedSpace::canonicalizeBlocks):
2723         * heap/NewSpace.h:
2724         (JSC::MarkedSpace::waterMark):
2725         (JSC::MarkedSpace::highWaterMark):
2726         (JSC::MarkedSpace::setHighWaterMark):
2727         (JSC::MarkedSpace::sizeClassFor):
2728         (JSC::MarkedSpace::allocate):
2729         (JSC::MarkedSpace::forEachBlock):
2730         (JSC::MarkedSpace::SizeClass::SizeClass):
2731         (JSC::MarkedSpace::SizeClass::resetAllocator):
2732         (JSC::MarkedSpace::SizeClass::canonicalizeBlock):
2733         * jit/JITInlineMethods.h:
2734         (JSC::JIT::emitAllocateBasicJSObject):
2735
2736 2011-09-19  Peter Rybin  <peter.rybin@gmail.com>
2737
2738         TextPosition refactoring: Merge ZeroBasedNumber and OneBasedNumber classes
2739         https://bugs.webkit.org/show_bug.cgi?id=63541
2740
2741         Reviewed by Adam Barth.
2742
2743         * parser/SourceProvider.h:
2744         (JSC::SourceProvider::startPosition):
2745         * wtf/text/TextPosition.h:
2746         (WTF::OrdinalNumber::fromZeroBasedInt):
2747         (WTF::OrdinalNumber::fromOneBasedInt):
2748         (WTF::OrdinalNumber::OrdinalNumber):
2749         (WTF::OrdinalNumber::zeroBasedInt):
2750         (WTF::OrdinalNumber::oneBasedInt):
2751         (WTF::OrdinalNumber::operator==):
2752         (WTF::OrdinalNumber::operator!=):
2753         (WTF::OrdinalNumber::first):
2754         (WTF::OrdinalNumber::beforeFirst):
2755         (WTF::TextPosition::TextPosition):
2756         (WTF::TextPosition::minimumPosition):
2757         (WTF::TextPosition::belowRangePosition):
2758
2759 2011-09-19  Dan Bernstein  <mitz@apple.com>
2760
2761         JavaScriptCore part of [mac] WebKit contains Objective-C classes that are not prefixed with its standard prefixes
2762         https://bugs.webkit.org/show_bug.cgi?id=68323
2763
2764         Reviewed by Sam Weinig.
2765
2766         Renamed WTFMainThreadCaller to JSWTFMainThreadCaller.
2767
2768         * wtf/mac/MainThreadMac.mm:
2769         (WTF::initializeMainThreadPlatform):
2770         (WTF::initializeMainThreadToProcessMainThreadPlatform):
2771
2772 2011-09-19  Oliver Hunt  <oliver@apple.com>
2773
2774         Remove direct property slot pointers from the instruction stream
2775         https://bugs.webkit.org/show_bug.cgi?id=68373
2776
2777         Reviewed by Gavin Barraclough.
2778
2779         Use an indirect load to access prototype properties rather than directly
2780         storing the property address in the instruction stream.  This should allow
2781         further optimisations in future, and also provides a 0.5% win to sunspider.
2782
2783         * dfg/DFGRepatch.cpp:
2784         (JSC::DFG::generateProtoChainAccessStub):
2785         * jit/JITPropertyAccess.cpp:
2786         (JSC::JIT::compileGetDirectOffset):
2787         * jit/JITPropertyAccess32_64.cpp:
2788         (JSC::JIT::compileGetDirectOffset):
2789         * runtime/JSObject.h:
2790         (JSC::JSObject::addressOfPropertyStorage):
2791
2792 2011-09-19  Oliver Hunt  <oliver@apple.com>
2793
2794         Remove bump allocator
2795         https://bugs.webkit.org/show_bug.cgi?id=68370
2796
2797         Reviewed by Sam Weinig.
2798
2799         Can't do anything with this allocator currently, and it's
2800         increasing the complexity of the GC code.  Slight progression
2801         on SunSpider, slight regression (undoing the original progression)
2802         in V8.
2803
2804         * heap/Heap.cpp:
2805         (JSC::Heap::collect):
2806         * heap/Heap.h:
2807         * heap/NewSpace.cpp:
2808         (JSC::NewSpace::NewSpace):
2809         * heap/NewSpace.h:
2810         (JSC::NewSpace::allocate):
2811         * runtime/JSObject.cpp:
2812         (JSC::JSObject::allocatePropertyStorage):
2813         * runtime/JSObject.h:
2814         (JSC::JSObject::~JSObject):
2815         (JSC::JSObject::visitChildrenDirect):
2816         * runtime/StorageBarrier.h:
2817         (JSC::StorageBarrier::set):
2818
2819 2011-09-19  Carlos Garcia Campos  <cgarcia@igalia.com>
2820
2821         [GTK] Fix distcheck build
2822         https://bugs.webkit.org/show_bug.cgi?id=68346
2823
2824         Reviewed by Philippe Normand.
2825
2826         * GNUmakefile.list.am:
2827
2828 2011-09-19  Carlos Garcia Campos  <cgarcia@igalia.com>
2829
2830         [GTK] Fix distcheck build
2831         https://bugs.webkit.org/show_bug.cgi?id=68241
2832
2833         Reviewed by Martin Robinson.
2834
2835         * GNUmakefile.list.am:
2836
2837 2011-09-18  Dan Bernstein  <mitz@apple.com>
2838
2839         Removed ProfilerServer.
2840
2841         Reviewed by Mark Rowe.
2842
2843         * JavaScriptCore.gypi:
2844         * JavaScriptCore.xcodeproj/project.pbxproj:
2845         * profiler/ProfilerServer.h: Removed.
2846         * profiler/ProfilerServer.mm: Removed.
2847         * runtime/JSGlobalData.cpp:
2848         (JSC::JSGlobalData::JSGlobalData):
2849         * wscript:
2850
2851 2011-09-17  Filip Pizlo  <fpizlo@apple.com>
2852
2853         DFG JIT should inline Math.min, Math.max, and Math.sqrt
2854         https://bugs.webkit.org/show_bug.cgi?id=68318
2855
2856         Reviewed by Gavin Barraclough.
2857
2858         Adds Math.min, Math.max, and Math.sqrt intrinsics. Adds support for
2859         a function to have an intrinsic but not a thunk generator. This is
2860         a 7% speed-up on access-nbody, and neutral elsewhere, mainly because
2861         we're still not DFG compiling the bulk of the hot code in Kraken audio
2862         benchmarks.
2863
2864         * create_hash_table:
2865         * dfg/DFGByteCodeParser.cpp:
2866         (JSC::DFG::ByteCodeParser::handleMinMax):
2867         (JSC::DFG::ByteCodeParser::handleIntrinsic):
2868         * dfg/DFGIntrinsic.h:
2869         * dfg/DFGNode.h:
2870         * dfg/DFGPropagator.cpp:
2871         (JSC::DFG::Propagator::propagateNode):
2872         (JSC::DFG::Propagator::fixupNode):
2873         * dfg/DFGSpeculativeJIT.cpp:
2874         (JSC::DFG::SpeculativeJIT::compile):
2875         * jit/JITStubs.cpp:
2876         (JSC::JITThunks::hostFunctionStub):
2877         * runtime/Lookup.cpp:
2878         (JSC::setUpStaticFunctionSlot):
2879
2880 2011-09-18  Nico Weber  <thakis@chromium.org>
2881
2882         Remove two files from JavaScriptCore.gypi that were removed in r95240
2883         https://bugs.webkit.org/show_bug.cgi?id=68327
2884
2885         Unreviewed, build warning fix.
2886
2887         * JavaScriptCore.gypi:
2888
2889 2011-09-17  Oliver Hunt  <oliver@apple.com>
2890
2891         Remove special case handling of inline storage from the JIT
2892         https://bugs.webkit.org/show_bug.cgi?id=68319
2893
2894         Reviewed by Gavin Barraclough.
2895
2896         Simplify logic used for reading and writing to property storage
2897         by removing the special cases for inline storage.  This has no
2898         perf impact.
2899
2900         * dfg/DFGRepatch.cpp:
2901         (JSC::DFG::generateProtoChainAccessStub):
2902         (JSC::DFG::tryBuildGetByIDList):
2903         * jit/JIT.h:
2904         * jit/JITPropertyAccess.cpp:
2905         (JSC::JIT::compilePutDirectOffset):
2906         (JSC::JIT::compileGetDirectOffset):
2907         (JSC::JIT::privateCompilePutByIdTransition):
2908         (JSC::JIT::privateCompileGetByIdSelfList):
2909         * jit/JITPropertyAccess32_64.cpp:
2910         (JSC::JIT::compilePutDirectOffset):
2911         (JSC::JIT::compileGetDirectOffset):
2912         (JSC::JIT::privateCompilePutByIdTransition):
2913         (JSC::JIT::privateCompileGetByIdSelfList):
2914
2915 2011-09-17  Filip Pizlo  <fpizlo@apple.com>
2916
2917         DFG JIT does not have full block-local CSE
2918         https://bugs.webkit.org/show_bug.cgi?id=68316
2919
2920         Reviewed by Oliver Hunt.
2921
2922         This adds block-local CSE to the DFG. CSE runs in the propagator just after
2923         type propagation. It is part of the propagator itself because it needs to
2924         use the propagator's internal data structures to determine which operations
2925         may have side effects. Because it changes the live-ranges of nodes, the
2926         virtual register allocator had to be moved into the propagator so that it
2927         runs after CSE. To ensure that the back-end knows to keep the inputs to
2928         any eliminated node alive for OSR, a new node type, Phantom, was introduced.
2929         It is a no-op but prolonges the live-range of its inputs.
2930
2931         This is an 80% speed-up on imaging-gaussian-blur, and a 10% speed-up on
2932         Kraken.
2933
2934         * JavaScriptCore.xcodeproj/project.pbxproj:
2935         * dfg/DFGAliasTracker.h: Removed.
2936         * dfg/DFGByteCodeParser.cpp:
2937         (JSC::DFG::ByteCodeParser::parseBlock):
2938         (JSC::DFG::ByteCodeParser::parse):
2939         * dfg/DFGGraph.cpp:
2940         (JSC::DFG::Graph::dump):
2941         * dfg/DFGGraph.h:
2942         (JSC::DFG::MethodCheckData::operator==):
2943         (JSC::DFG::MethodCheckData::operator!=):
2944         * dfg/DFGNode.h:
2945         (JSC::DFG::Node::hasVirtualRegister):
2946         (JSC::DFG::Node::setRefCount):
2947         * dfg/DFGPropagator.cpp:
2948         (JSC::DFG::Propagator::Propagator):
2949         (JSC::DFG::Propagator::fixpoint):
2950         (JSC::DFG::Propagator::propagateNode):
2951         (JSC::DFG::Propagator::canonicalize):
2952         (JSC::DFG::Propagator::computeStartIndex):
2953         (JSC::DFG::Propagator::startIndex):
2954         (JSC::DFG::Propagator::pureCSE):
2955         (JSC::DFG::Propagator::globalVarLoadElimination):
2956         (JSC::DFG::Propagator::getByValLoadElimination):
2957         (JSC::DFG::Propagator::getMethodLoadElimination):
2958         (JSC::DFG::Propagator::performSubstitution):
2959         (JSC::DFG::Propagator::setReplacement):
2960         (JSC::DFG::Propagator::performNodeCSE):
2961         (JSC::DFG::Propagator::performBlockCSE):
2962         (JSC::DFG::Propagator::localCSE):
2963         (JSC::DFG::Propagator::allocateVirtualRegisters):
2964         (JSC::DFG::propagate):
2965         * dfg/DFGSpeculativeJIT.cpp:
2966         (JSC::DFG::SpeculativeJIT::compile):
2967
2968 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
2969
2970         method_check should repatch itself if it finds that the new structure(s)
2971         are the result of transitions from the old structure(s)
2972         https://bugs.webkit.org/show_bug.cgi?id=68294
2973
2974         Reviewed by Gavin Barraclough.
2975
2976         Previously a patched method_check would slow-path to get_by_id. Now it
2977         slow-paths to method_check_update, which attempts to correct the
2978         method_check due to structure transitions before bailing to get_by_id.
2979
2980         This is a 1-2% speed-up on some benchmarks and is not a slow-down
2981         anywhere, leading to a 0.6% speed-up on the Kraken geomean.
2982
2983         * jit/JITPropertyAccess.cpp:
2984         (JSC::JIT::patchMethodCallProto):
2985         * jit/JITStubs.cpp:
2986         (JSC::DEFINE_STUB_FUNCTION):
2987         * jit/JITStubs.h:
2988         * runtime/Structure.h:
2989         (JSC::Structure::transitivelyTransitionedFrom):
2990
2991 2011-09-16  Ryosuke Niwa  <rniwa@webkit.org>
2992
2993         Touch Platform.h in the hope to fix SnowLeopard Intel Release (WebKit2 Tests).
2994
2995         * wtf/Platform.h:
2996
2997 2011-09-16  Sam Weinig  <sam@webkit.org>
2998
2999         Rename APIValueWrapper type to APIValueWrapperType for consistency
3000         https://bugs.webkit.org/show_bug.cgi?id=68306
3001
3002         Reviewed by Anders Carlsson.
3003
3004         * runtime/JSAPIValueWrapper.h:
3005         (JSC::JSAPIValueWrapper::createStructure):
3006         Update name.
3007
3008         * runtime/JSType.h:
3009         Update name and un-indent.
3010
3011         * runtime/Structure.h:
3012         (JSC::JSCell::isAPIValueWrapper):
3013         Update name.
3014
3015 2011-09-16  Sam Weinig  <sam@webkit.org>
3016
3017         Remove unused isStrictModeFunction function
3018         https://bugs.webkit.org/show_bug.cgi?id=68305
3019
3020         Reviewed by Anders Carlsson.
3021
3022         * runtime/JSObject.h:
3023         (JSC::JSObject::isStrictModeFunction):
3024
3025 2011-09-16  Sam Weinig  <sam@webkit.org>
3026
3027         Cleanup JSTypeInfo a bit
3028         https://bugs.webkit.org/show_bug.cgi?id=68289
3029
3030         Reviewed by Anders Carlsson.
3031
3032         * dfg/DFGOperations.cpp:
3033         * jit/JITStubs.cpp:
3034         (JSC::DEFINE_STUB_FUNCTION):
3035         Replace direct access to flags() with predicate.
3036
3037         * runtime/JSObject.h:
3038         (JSC::JSFinalObject::createStructure):
3039         Pass FinalObjectType instead of using special IsJSFinalObject.
3040
3041         * runtime/JSTypeInfo.h:
3042         (JSC::TypeInfo::TypeInfo):
3043         Add additional assert that you should no object should OverridesHasInstance but not have ImplementsHasInstance set.
3044
3045         (JSC::TypeInfo::isFinalObject):
3046         Added.
3047
3048         (JSC::TypeInfo::masqueradesAsUndefined):
3049         (JSC::TypeInfo::implementsHasInstance):
3050         (JSC::TypeInfo::isEnvironmentRecord):
3051         (JSC::TypeInfo::overridesHasInstance):
3052         (JSC::TypeInfo::implementsDefaultHasInstance):
3053         (JSC::TypeInfo::overridesGetOwnPropertySlot):
3054         (JSC::TypeInfo::overridesVisitChildren):
3055         (JSC::TypeInfo::overridesGetPropertyNames):
3056         (JSC::TypeInfo::prohibitsPropertyCaching):
3057         (JSC::TypeInfo::isSetOnFlags1):
3058         (JSC::TypeInfo::isSetOnFlags2):
3059         Replace direct bit twiddling with helper functions.
3060
3061         * runtime/Structure.cpp:
3062         (JSC::Structure::Structure):
3063         Use new isFinalObject() predicate.
3064
3065 2011-09-16  Gavin Barraclough  <barraclough@apple.com>
3066
3067         Unsigned bit shift fails under certain conditions in 32 bit builds
3068         https://bugs.webkit.org/show_bug.cgi?id=68166
3069
3070         Reviewed by Geoff Garen.
3071
3072         The major bug here is that the slow case (which handles shifts of
3073         doubles) doesn't check for negative results from an unsigned shift
3074         (which should be unsigned, and as such can't be represented by a
3075         signed integer immediate).  The implementation is also flawed for
3076         shifts by negative shift amounts (treats as shift by zero).
3077
3078         * jit/JITArithmetic32_64.cpp:
3079         (JSC::JIT::emitRightShift):
3080         (JSC::JIT::emitRightShiftSlowCase):
3081
3082 2011-09-16  Geoffrey Garen  <ggaren@apple.com>
3083
3084         Removed undetectable style.filter.
3085
3086         Reviewed by Sam Weinig.
3087
3088         This feature was added in http://trac.webkit.org/changeset/15557 to
3089         support housingmaps.com. But housingmaps.com no longer needs this hack,
3090         we don't know of other websites that need it, and we don't know of
3091         any other browsers that have implemented this feature.
3092
3093         * GNUmakefile.list.am:
3094         * JavaScriptCore.gypi:
3095         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3096         * JavaScriptCore.xcodeproj/project.pbxproj:
3097         * runtime/JSTypeInfo.h:
3098         * runtime/StringObjectThatMasqueradesAsUndefined.h: Removed.
3099
3100 2011-09-15  Sam Weinig  <sam@webkit.org>
3101
3102         Prepare JSTypes for more Object subtypes
3103         https://bugs.webkit.org/show_bug.cgi?id=68200
3104
3105         Reviewed by Gavin Barraclough.
3106
3107         * dfg/DFGJITCompiler.h:
3108         (JSC::DFG::JITCompiler::branchIfNotObject):
3109         * jit/JITInlineMethods.h:
3110         (JSC::JIT::emitJumpIfNotObject):
3111         * runtime/JSGlobalObject.h:
3112         (JSC::Structure::prototypeForLookup):
3113         * runtime/JSObject.h:
3114         (JSC::JSObject::finishCreation):
3115         * runtime/JSType.h:
3116         * runtime/JSTypeInfo.h:
3117         (JSC::TypeInfo::type):
3118         (JSC::TypeInfo::isObject):
3119         (JSC::TypeInfo::isFinal):
3120         (JSC::TypeInfo::prohibitsPropertyCaching):
3121         * runtime/NativeErrorConstructor.h:
3122         (JSC::NativeErrorConstructor::finishCreation):
3123         * runtime/Operations.cpp:
3124         (JSC::jsIsObjectType):
3125         * runtime/Structure.cpp:
3126         (JSC::Structure::addPropertyTransitionToExistingStructure):
3127         (JSC::Structure::addPropertyTransition):
3128         * runtime/Structure.h:
3129         (JSC::Structure::isObject):
3130         (JSC::JSCell::isObject):
3131
3132 2011-09-16  Geoffrey Garen  <ggaren@apple.com>
3133
3134         Rolled back in r95201 with test failure fixed.
3135
3136         I missed two cases of jumpSlowToHot in rshift -- these cases need to be
3137         sure to initialize regT1 to the int tag, since it will otherwise hold
3138         the top 32 bits of a double.
3139
3140         * jit/JIT.h:
3141         * jit/JITArithmetic32_64.cpp:
3142         (JSC::JIT::emit_op_lshift):
3143         (JSC::JIT::emitRightShift):
3144         (JSC::JIT::emitRightShiftSlowCase):
3145         (JSC::JIT::emit_op_bitand):
3146         (JSC::JIT::emit_op_bitor):
3147         (JSC::JIT::emit_op_bitxor):
3148         (JSC::JIT::emit_op_bitnot):
3149         (JSC::JIT::emit_op_post_inc):
3150         (JSC::JIT::emit_op_post_dec):
3151         (JSC::JIT::emit_op_pre_inc):
3152         (JSC::JIT::emit_op_pre_dec):
3153         * jit/JITInlineMethods.h:
3154         (JSC::JIT::emitStoreAndMapInt32):
3155
3156 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
3157
3158         Unreviewed Windows build fix after 95318.
3159
3160         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3161
3162 2011-09-16  Adam Roben  <aroben@apple.com>
3163
3164         Windows build fix after r95310
3165
3166         * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added include\private\JavaScriptCore to the
3167         include path so DFGIntrinsic.h can be found.
3168
3169 2011-09-16  Gavin Barraclough  <barraclough@apple.com>
3170
3171         Rationalize JSObject::putDirect* methods
3172         https://bugs.webkit.org/show_bug.cgi?id=68274
3173
3174         Reviewed by Sam Weinig.
3175
3176         Delete the *Function variants. These are overall inefficient,
3177         in the way they get the name back from the function rather
3178         than just passing it in.
3179
3180         * JavaScriptCore.exp:
3181         * jsc.cpp:
3182         (GlobalObject::finishCreation):
3183         (GlobalObject::addFunction):
3184         * runtime/FunctionPrototype.cpp:
3185         (JSC::FunctionPrototype::addFunctionProperties):
3186         * runtime/JSGlobalObject.cpp:
3187         (JSC::JSGlobalObject::reset):
3188         * runtime/JSObject.cpp:
3189         (JSC::JSObject::put):
3190         (JSC::JSObject::putWithAttributes):
3191         (JSC::JSObject::defineGetter):
3192         (JSC::JSObject::defineSetter):
3193         * runtime/JSObject.h:
3194         (JSC::JSObject::putDirect):
3195         (JSC::JSObject::putDirectWithoutTransition):
3196         * runtime/Lookup.cpp:
3197         (JSC::setUpStaticFunctionSlot):
3198         * runtime/Lookup.h:
3199         (JSC::lookupPut):
3200
3201 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
3202
3203         Unreviewed build fix for Windows.
3204
3205         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3206
3207 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
3208
3209         Unreviewed build fix for non-DFG builds.
3210
3211         * runtime/Executable.h:
3212         (JSC::NativeExecutable::finishCreation):
3213
3214 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
3215
3216         DFG JIT should inline Math.abs
3217         https://bugs.webkit.org/show_bug.cgi?id=68227
3218
3219         Reviewed by Oliver Hunt.
3220
3221         This adds the ability to track intrinsic functions throughout the
3222         host function infrastructure, so that the DFG can easily query
3223         whether or not a call's target is intrinsic, and if so, which
3224         intrinsic it is.
3225
3226         On top of this, it adds Math.abs intrinsics to DFG. Call(Math.abs)
3227         is transformed into ValueToNumber<-ArithAbs nodes. These nodes
3228         then get optimized using the usual tricks.
3229
3230         Also had to make a completely unrelated change to
3231         DateInstanceCache.h in order to fix a preexisting alphabetical
3232         sorting problem in JSGlobalData.h
3233
3234         This results in a big win in imaging-gaussian-blur: 61% faster
3235         than before. The net win on Kraken is around 13%.
3236
3237         * JavaScriptCore.xcodeproj/project.pbxproj:
3238         * create_hash_table:
3239         * dfg/DFGByteCodeParser.cpp:
3240         (JSC::DFG::ByteCodeParser::parseBlock):
3241         * dfg/DFGGraph.h:
3242         (JSC::DFG::Graph::isFunctionConstant):
3243         (JSC::DFG::Graph::valueOfFunctionConstant):
3244         * dfg/DFGIntrinsic.h: Added.
3245         * dfg/DFGJITCodeGenerator.h:
3246         (JSC::DFG::JITCodeGenerator::isFunctionConstant):
3247         (JSC::DFG::JITCodeGenerator::valueOfFunctionConstant):
3248         * dfg/DFGJITCompiler.h:
3249         (JSC::DFG::JITCompiler::isFunctionConstant):
3250         (JSC::DFG::JITCompiler::valueOfFunctionConstant):
3251         * dfg/DFGNode.h:
3252         * dfg/DFGPropagator.cpp:
3253         (JSC::DFG::Propagator::propagateNode):
3254         * dfg/DFGSpeculativeJIT.cpp:
3255         (JSC::DFG::SpeculativeJIT::compile):
3256         * jit/JITStubs.cpp:
3257         (JSC::JITThunks::hostFunctionStub):
3258         * jit/JITStubs.h:
3259         * runtime/DateInstanceCache.h:
3260         * runtime/Executable.cpp:
3261         (JSC::ExecutableBase::intrinsic):
3262         (JSC::NativeExecutable::intrinsic):
3263         * runtime/Executable.h:
3264         (JSC::NativeExecutable::create):
3265         (JSC::NativeExecutable::finishCreation):
3266         * runtime/JSGlobalData.cpp:
3267         (JSC::JSGlobalData::getHostFunction):
3268         * runtime/JSGlobalData.h:
3269         * runtime/Lookup.cpp:
3270         (JSC::HashTable::createTable):
3271         (JSC::setUpStaticFunctionSlot):
3272         * runtime/Lookup.h:
3273         (JSC::HashEntry::initialize):
3274         (JSC::HashEntry::intrinsic):
3275
3276 2011-09-16  Filip Pizlo  <fpizlo@apple.com>
3277
3278         REGRESSION: Reproducible crash below SlotVisitor::harvestWeakReferences
3279         using Domino's online ordering
3280         https://bugs.webkit.org/show_bug.cgi?id=68220
3281
3282         Reviewed by Oliver Hunt.
3283
3284         Weak handle processing can result in new objects being marked, which
3285         results in new WeakReferencesHarvesters being added. But weak
3286         reference harvesters are only processed before weak handle processing,
3287         so there's the risk that a weak reference harvester will persist
3288         until the next collection, by which time it may have been deleted.
3289
3290         * heap/Heap.cpp:
3291         (JSC::Heap::markRoots):
3292
3293 2011-09-16  Csaba Osztrogonác  <ossy@webkit.org>
3294
3295         REGRESSION(r95201): It made two tests fail
3296         https://bugs.webkit.org/show_bug.cgi?id=68230
3297
3298         Unreviewed rolling out r95201.
3299
3300         * jit/JIT.h:
3301         * jit/JITArithmetic32_64.cpp:
3302         (JSC::JIT::emit_op_lshift):
3303         (JSC::JIT::emitRightShift):
3304         (JSC::JIT::emit_op_bitand):
3305         (JSC::JIT::emit_op_bitor):
3306         (JSC::JIT::emit_op_bitxor):
3307         (JSC::JIT::emit_op_bitnot):
3308         (JSC::JIT::emit_op_post_inc):
3309         (JSC::JIT::emit_op_post_dec):
3310         (JSC::JIT::emit_op_pre_inc):
3311         (JSC::JIT::emit_op_pre_dec):
3312         * jit/JITInlineMethods.h:
3313
3314 2011-09-15  Filip Pizlo  <fpizlo@apple.com>
3315
3316         DFG JIT does not optimize method_check
3317         https://bugs.webkit.org/show_bug.cgi?id=68215
3318
3319         Reviewed by Oliver Hunt.
3320
3321         MethodCallLinkInfo and StructureStubInfo are now searchable by
3322         bytecodeIndex, so that DFG::ByteCodeParser can use that information
3323         to determine how to optimize GetMethod.
3324
3325         A new node op has been added to DFG: CheckMethod. This is a variant
3326         of GetMethod that has been optimized for the case that GetMethod
3327         always takes the fast path. CheckMethod results in only a very
3328         small amount of code (two loads and two branches in the worst case,
3329         one load and one branch in the best case). CheckMethod behaves as
3330         if it were a constant.
3331
3332         Introduced the notion that a DFG node that is not JSConstant
3333         behaves as a constant. CheckMethod uses this functionality.
3334
3335         This is a 3% speed-up on Kraken, and a small speed-up on V8.
3336         Appears to be neutral on SunSpider.
3337
3338         * bytecode/CodeBlock.h:
3339         (JSC::getStructureStubInfoBytecodeIndex):
3340         (JSC::getMethodCallLinkInfoBytecodeIndex):
3341         * bytecode/PredictedType.cpp:
3342         (JSC::predictionFromCell):
3343         (JSC::predictionFromValue):
3344         * bytecode/PredictedType.h:
3345         * bytecode/StructureStubInfo.h:
3346         * dfg/DFGAliasTracker.h:
3347         (JSC::DFG::AliasTracker::recordGetMethod):
3348         * dfg/DFGByteCodeParser.cpp:
3349         (JSC::DFG::ByteCodeParser::parseBlock):
3350         * dfg/DFGGraph.cpp:
3351         (JSC::DFG::Graph::dump):
3352         * dfg/DFGGraph.h:
3353         (JSC::DFG::Graph::getMethodCheckPrediction):
3354         (JSC::DFG::Graph::getPrediction):
3355         (JSC::DFG::Graph::isConstant):
3356         (JSC::DFG::Graph::isJSConstant):
3357         (JSC::DFG::Graph::valueOfJSConstant):
3358         (JSC::DFG::Graph::valueOfInt32Constant):
3359         (JSC::DFG::Graph::valueOfNumberConstant):
3360         (JSC::DFG::Graph::valueOfBooleanConstant):
3361         (JSC::DFG::Graph::valueOfJSConstantNode):
3362         * dfg/DFGJITCodeGenerator.cpp:
3363         (JSC::DFG::JITCodeGenerator::fillInteger):
3364         (JSC::DFG::JITCodeGenerator::fillDouble):
3365         (JSC::DFG::JITCodeGenerator::fillJSValue):
3366         (JSC::DFG::JITCodeGenerator::isKnownNotInteger):
3367         (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
3368         * dfg/DFGJITCodeGenerator.h:
3369         (JSC::DFG::JITCodeGenerator::silentSpillFPR):
3370         (JSC::DFG::JITCodeGenerator::silentFillGPR):
3371         (JSC::DFG::JITCodeGenerator::silentFillFPR):
3372         * dfg/DFGJITCompiler.cpp:
3373         (JSC::DFG::JITCompiler::fillNumericToDouble):
3374         (JSC::DFG::JITCompiler::fillInt32ToInteger):
3375         (JSC::DFG::JITCompiler::fillToJS):
3376         * dfg/DFGNode.h:
3377         (JSC::DFG::Node::hasConstant):
3378         (JSC::DFG::Node::hasIdentifier):
3379         (JSC::DFG::Node::hasMethodCheckData):
3380         (JSC::DFG::Node::methodCheckDataIndex):
3381         (JSC::DFG::Node::valueOfJSConstant):
3382         * dfg/DFGPropagator.cpp:
3383         (JSC::DFG::Propagator::propagateNode):
3384         * dfg/DFGSpeculativeJIT.cpp:
3385         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
3386         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
3387         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
3388         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
3389         (JSC::DFG::SpeculativeJIT::compile):
3390         * jit/JIT.cpp:
3391         (JSC::JIT::privateCompile):
3392         * jit/JIT.h:
3393         (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
3394         (JSC::MethodCallCompilationInfo::MethodCallCompilationInfo):
3395         * jit/JITPropertyAccess.cpp:
3396         (JSC::JIT::emit_op_method_check):
3397         (JSC::JIT::compileGetByIdHotPath):
3398         (JSC::JIT::emit_op_put_by_id):
3399         * jit/JITPropertyAccess32_64.cpp:
3400         (JSC::JIT::emit_op_method_check):
3401         (JSC::JIT::compileGetByIdHotPath):
3402         (JSC::JIT::emit_op_put_by_id):
3403         * runtime/JSCell.h:
3404         (JSC::JSCell::JSCell::structureAddress):
3405
3406 2011-09-15  Adam Barth  <abarth@webkit.org>
3407
3408         Rename ENABLE(DATABASE) to ENABLE(SQL_DATABASE)
3409         https://bugs.webkit.org/show_bug.cgi?id=68205
3410
3411         Reviewed by Eric Seidel.
3412
3413         * Configurations/FeatureDefines.xcconfig:
3414         * wtf/Platform.h:
3415
3416 2011-09-15  Mark Hahnenberg  <mhahnenberg@apple.com>
3417
3418         Unzip initialization lists and constructors in JSCell hierarchy (7/7)
3419         https://bugs.webkit.org/show_bug.cgi?id=68122
3420
3421         Reviewed by Geoffrey Garen.
3422
3423         Completed the seventh and final level of the refactoring to add finishCreation()
3424         methods to all classes within the JSCell hierarchy with non-trivial
3425         constructor bodies.
3426
3427         JSCallbackObject was missed in previous patches due to the fact that
3428         it's non-obvious (at least to my script) that it is in the JSCell hierarchy, so
3429         this is just a bit of retroactive cleanup.
3430
3431         * API/JSCallbackObject.h:
3432         (JSC::JSCallbackObject::create):
3433         * API/JSCallbackObjectFunctions.h:
3434         (JSC::::JSCallbackObject):
3435
3436 2011-09-15  Filip Pizlo  <fpizlo@apple.com>
3437
3438         The DFG non-speculative JIT is no longer used and should be removed.
3439         https://bugs.webkit.org/show_bug.cgi?id=68177
3440
3441         Reviewed by Geoffrey Garen.
3442
3443         This removes the non-speculative JIT and everything that relied on it,
3444         including the ability to turn on DFG but not tiered compilation the,
3445         ability to perform speculation failure into non-speculative JIT code,
3446         and the ability to statically terminate speculation.
3447
3448         * GNUmakefile.list.am:
3449         * JavaScriptCore.pro:
3450         * JavaScriptCore.xcodeproj/project.pbxproj:
3451         * bytecode/CodeBlock.h:
3452         * bytecompiler/BytecodeGenerator.cpp: