Source/JavaScriptCore/ChangeLog

   1 2012-03-02  Filip Pizlo  <fpizlo@apple.com>
   2
   3         When getting the line number of a call into a call frame with no code block, it's
   4         incorrect to rely on the returnPC
   5         https://bugs.webkit.org/show_bug.cgi?id=80195
   6
   7         Reviewed by Oliver Hunt.
   8
   9         * interpreter/Interpreter.cpp:
  10         (JSC::getCallerInfo):
  11         * jit/JITCall.cpp:
  12         (JSC::JIT::compileLoadVarargs):
  13
  14 2012-03-02  Han Hojong  <hojong.han@samsung.com>
  15
  16         Expected results updated for checking type conversion
  17         https://bugs.webkit.org/show_bug.cgi?id=80138
  18
  19         Reviewed by Gavin Barraclough.
  20
  21         * tests/mozilla/ecma/TypeConversion/9.3.1-3.js:
  22
  23 2012-03-02  Kenichi Ishibashi  <bashi@chromium.org>
  24
  25         Adding WebSocket per-frame DEFLATE extension
  26         https://bugs.webkit.org/show_bug.cgi?id=77522
  27
  28         Added USE(ZLIB) flag.
  29
  30         Reviewed by Kent Tamura.
  31
  32         * wtf/Platform.h:
  33
  34 2012-03-02  Filip Pizlo  <fpizlo@apple.com>
  35
  36         Unreviewed build fix for platforms that have DFG_JIT disabled but PARALLEL_GC enabled.
  37
  38         * bytecode/CodeBlock.cpp:
  39         (JSC::CodeBlock::visitAggregate):
  40
  41 2012-03-01  Filip Pizlo  <fpizlo@apple.com>
  42
  43         DFGCodeBlocks should not trace CodeBlocks that are also going to be traced by
  44         virtue of being in the transitive closure
  45         https://bugs.webkit.org/show_bug.cgi?id=80098
  46
  47         Reviewed by Anders Carlsson.
  48
  49         If DFGCodeBlocks traces a CodeBlock that might also be traced via its owner Executable,
  50         then you might have the visitAggregate() method called concurrently by multiple threads.
  51         This is benign on 64-bit -- visitAggregate() and everything it calls turns out to be
  52         racy and slightly imprecise but not unsound. But on 32-bit, visitAggregate() may crash
  53         due to word tearing in ValueProfile bucket updates inside of computeUpdatedPrediction().
  54
  55         It would seem that the fix is just to have DFGCodeBlocks not trace CodeBlocks that are
  56         not jettisoned. But CodeBlocks may be jettisoned later during the GC, so it must trace
  57         any CodeBlock that it knows to be live by virtue of it being reachable from the stack.
  58         Hence the real fix is to make sure that concurrent calls into CodeBlock::visitAggregate()
  59         don't lead to two threads racing over each other as they clobber state. This patch
  60         achieves this with a simple CAS loop: whichever thread wins the CAS race (which is
  61         trivially linearizable) will get to trace the CodeBlock; all other threads give up and
  62         go home.
  63
  64         Unfortunately there will be no new tests. It's possible to reproduce this maybe 1/10
  65         times by running V8-v6's raytrace repeatedly, using the V8 harness hacked to rerun it
  66         even when it's gotten sufficient counts. But that takes a while - sometimes up to a
  67         minute to get a crash. I have no other reliable repro case.
  68
  69         * bytecode/CodeBlock.cpp:
  70         (JSC::CodeBlock::visitAggregate):
  71         * bytecode/CodeBlock.h:
  72         (DFGData):
  73         * heap/DFGCodeBlocks.cpp:
  74         (JSC::DFGCodeBlocks::clearMarks):
  75
  76 2012-03-01  Filip Pizlo  <fpizlo@apple.com>
  77
  78         The JIT should not crash the entire process just because there is not enough executable
  79         memory, if the LLInt is enabled
  80         https://bugs.webkit.org/show_bug.cgi?id=79962
  81
  82         Reviewed by Csaba Osztrogonác.
  83
  84         Fix for ARM, SH4.
  85
  86         * assembler/AssemblerBufferWithConstantPool.h:
  87         (JSC::AssemblerBufferWithConstantPool::executableCopy):
  88
  89 2012-03-01  Ryosuke Niwa  <rniwa@webkit.org>
  90
  91         Revert my change. Broke builds.
  92         Source/JavaScriptCore/wtf/Atomics.h:188: error: redefinition of 'bool WTF::weakCompareAndSwap(volatile uintptr_t*, uintptr_t, uintptr_t)'
  93         Source/JavaScriptCore/wtf/Atomics.h:122: error: 'bool WTF::weakCompareAndSwap(volatile unsigned int*, unsigned int, unsigned i
  94
  95         * wtf/Atomics.h:
  96         (WTF):
  97         (WTF::weakCompareAndSwap):
  98
  99 2012-03-01  Ryosuke Niwa  <rniwa@webkit.org>
 100
 101         Gcc build fix.
 102
 103         Rubber-stamped by Filip Pizlo.
 104
 105         * wtf/Atomics.h:
 106         (WTF):
 107         (WTF::weakCompareAndSwap):
 108
 109 2012-03-01  Gavin Barraclough  <barraclough@apple.com>
 110
 111         ES5.1-15.3.5.4. prohibits Function.caller from [[Get]]ting a strict caller
 112         https://bugs.webkit.org/show_bug.cgi?id=80011
 113
 114         Reviewed by Oliver Hunt.
 115
 116         Also, fix getting the caller from within a bound function, for within a getter,
 117         or setter (make our implementation match other browsers).
 118
 119         * interpreter/Interpreter.cpp:
 120         (JSC::getCallerInfo):
 121             - Allow this to get the caller of host functions.
 122         (JSC::Interpreter::retrieveCallerFromVMCode):
 123             - This should use getCallerInfo, and should skip over function bindings.
 124         * runtime/JSFunction.cpp:
 125         (JSC::JSFunction::callerGetter):
 126             - This should never return a strict-mode function.
 127
 128 2012-03-01  Yuqiang Xian  <yuqiang.xian@intel.com>
 129
 130         DFG local CSE for a node can be terminated earlier
 131         https://bugs.webkit.org/show_bug.cgi?id=80014
 132
 133         Reviewed by Filip Pizlo.
 134
 135         When one of the node's childredn is met in the process of back traversing
 136         the nodes, we don't need to traverse the remaining nodes.
 137         This is performance neutral on SunSpider, V8 and Kraken.
 138
 139         * dfg/DFGCSEPhase.cpp:
 140         (JSC::DFG::CSEPhase::pureCSE):
 141         (JSC::DFG::CSEPhase::impureCSE):
 142         (JSC::DFG::CSEPhase::getByValLoadElimination):
 143         (JSC::DFG::CSEPhase::checkFunctionElimination):
 144         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
 145         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
 146         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
 147         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
 148
 149 2012-02-29  Yuqiang Xian  <yuqiang.xian@intel.com>
 150
 151         DFG BasicBlocks should not require that their nodes have continuous indices in the graph
 152         https://bugs.webkit.org/show_bug.cgi?id=79899
 153
 154         Reviewed by Filip Pizlo.
 155
 156         This will make it more convenient to insert nodes into the DFG.
 157         With this capability we now place the Phi nodes in the corresponding
 158         blocks.
 159         Local CSE is modified to not to rely on the assumption of continuous
 160         node indices in a block.
 161         This is performance neutral on SunSpider, V8 and Kraken.
 162
 163         * dfg/DFGAbstractState.cpp:
 164         (JSC::DFG::AbstractState::AbstractState):
 165         (JSC::DFG::AbstractState::beginBasicBlock):
 166         (JSC::DFG::AbstractState::execute):
 167         (JSC::DFG::AbstractState::clobberStructures):
 168         (JSC::DFG::AbstractState::mergeToSuccessors):
 169         (JSC::DFG::AbstractState::dump):
 170         * dfg/DFGAbstractState.h:
 171         (JSC::DFG::AbstractState::forNode):
 172         (AbstractState):
 173         * dfg/DFGArithNodeFlagsInferencePhase.cpp:
 174         (ArithNodeFlagsInferencePhase):
 175         * dfg/DFGBasicBlock.h:
 176         (JSC::DFG::BasicBlock::BasicBlock):
 177         (BasicBlock):
 178         * dfg/DFGByteCodeParser.cpp:
 179         (JSC::DFG::ByteCodeParser::addToGraph):
 180         (ByteCodeParser):
 181         (JSC::DFG::ByteCodeParser::insertPhiNode):
 182         (JSC::DFG::ByteCodeParser::handleInlining):
 183         (JSC::DFG::ByteCodeParser::parseBlock):
 184         (JSC::DFG::ByteCodeParser::processPhiStack):
 185         (JSC::DFG::ByteCodeParser::linkBlock):
 186         (JSC::DFG::ByteCodeParser::determineReachability):
 187         (JSC::DFG::ByteCodeParser::parseCodeBlock):
 188         * dfg/DFGCFAPhase.cpp:
 189         (JSC::DFG::CFAPhase::performBlockCFA):
 190         (CFAPhase):
 191         * dfg/DFGCSEPhase.cpp:
 192         (JSC::DFG::CSEPhase::CSEPhase):
 193         (JSC::DFG::CSEPhase::endIndexForPureCSE):
 194         (JSC::DFG::CSEPhase::pureCSE):
 195         (JSC::DFG::CSEPhase::impureCSE):
 196         (JSC::DFG::CSEPhase::globalVarLoadElimination):
 197         (JSC::DFG::CSEPhase::getByValLoadElimination):
 198         (JSC::DFG::CSEPhase::checkFunctionElimination):
 199         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
 200         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
 201         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
 202         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
 203         (JSC::DFG::CSEPhase::getScopeChainLoadElimination):
 204         (JSC::DFG::CSEPhase::performNodeCSE):
 205         (JSC::DFG::CSEPhase::performBlockCSE):
 206         (CSEPhase):
 207         * dfg/DFGGraph.cpp:
 208         (JSC::DFG::Graph::dump):
 209         * dfg/DFGPhase.cpp:
 210         (JSC::DFG::Phase::beginPhase):
 211         * dfg/DFGSpeculativeJIT.cpp:
 212         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
 213         (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
 214         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
 215         (JSC::DFG::SpeculativeJIT::compile):
 216         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
 217         (JSC::DFG::SpeculativeJIT::compileStrictEq):
 218         * dfg/DFGSpeculativeJIT.h:
 219         (SpeculativeJIT):
 220         (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
 221         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
 222         * dfg/DFGSpeculativeJIT32_64.cpp:
 223         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
 224         * dfg/DFGSpeculativeJIT64.cpp:
 225         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
 226         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
 227         (JSC::DFG::VirtualRegisterAllocationPhase::run):
 228
 229 2012-02-29  Filip Pizlo  <fpizlo@apple.com>
 230
 231         The JIT should not crash the entire process just because there is not
 232         enough executable memory, if the LLInt is enabled
 233         https://bugs.webkit.org/show_bug.cgi?id=79962
 234         <rdar://problem/10922215>
 235
 236         Unreviewed, adding forgotten file.
 237
 238         * jit/JITCompilationEffort.h: Added.
 239         (JSC):
 240
 241 2012-02-29  Filip Pizlo  <fpizlo@apple.com>
 242
 243         The JIT should not crash the entire process just because there is not
 244         enough executable memory, if the LLInt is enabled
 245         https://bugs.webkit.org/show_bug.cgi?id=79962
 246         <rdar://problem/10922215>
 247
 248         Reviewed by Gavin Barraclough.
 249
 250         Added the notion of JITCompilationEffort. If we're JIT'ing as a result of
 251         a tier-up, then we set it to JITCompilationCanFail. Otherwise it's
 252         JITCompilationMustSucceed. This preserves the old behavior of LLInt is
 253         disabled or if we're compiling something that can't be interpreted (like
 254         an OSR exit stub).
 255
 256         * JavaScriptCore.xcodeproj/project.pbxproj:
 257         * assembler/ARMAssembler.cpp:
 258         (JSC::ARMAssembler::executableCopy):
 259         * assembler/ARMAssembler.h:
 260         (ARMAssembler):
 261         * assembler/AssemblerBuffer.h:
 262         (JSC::AssemblerBuffer::executableCopy):
 263         * assembler/LinkBuffer.h:
 264         (JSC::LinkBuffer::LinkBuffer):
 265         (JSC::LinkBuffer::~LinkBuffer):
 266         (LinkBuffer):
 267         (JSC::LinkBuffer::didFailToAllocate):
 268         (JSC::LinkBuffer::isValid):
 269         (JSC::LinkBuffer::linkCode):
 270         (JSC::LinkBuffer::performFinalization):
 271         * assembler/MIPSAssembler.h:
 272         (JSC::MIPSAssembler::executableCopy):
 273         * assembler/SH4Assembler.h:
 274         (JSC::SH4Assembler::executableCopy):
 275         * assembler/X86Assembler.h:
 276         (JSC::X86Assembler::executableCopy):
 277         (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
 278         * bytecode/CodeBlock.cpp:
 279         (JSC::ProgramCodeBlock::jitCompileImpl):
 280         (JSC::EvalCodeBlock::jitCompileImpl):
 281         (JSC::FunctionCodeBlock::jitCompileImpl):
 282         * bytecode/CodeBlock.h:
 283         (JSC::CodeBlock::jitCompile):
 284         (CodeBlock):
 285         (ProgramCodeBlock):
 286         (EvalCodeBlock):
 287         (FunctionCodeBlock):
 288         * dfg/DFGDriver.cpp:
 289         (JSC::DFG::compile):
 290         * dfg/DFGJITCompiler.cpp:
 291         (JSC::DFG::JITCompiler::compile):
 292         (JSC::DFG::JITCompiler::compileFunction):
 293         * dfg/DFGJITCompiler.h:
 294         (JITCompiler):
 295         * jit/ExecutableAllocator.cpp:
 296         (JSC::DemandExecutableAllocator::allocateNewSpace):
 297         (JSC::ExecutableAllocator::allocate):
 298         * jit/ExecutableAllocator.h:
 299         (ExecutableAllocator):
 300         * jit/ExecutableAllocatorFixedVMPool.cpp:
 301         (JSC::ExecutableAllocator::allocate):
 302         * jit/JIT.cpp:
 303         (JSC::JIT::privateCompile):
 304         * jit/JIT.h:
 305         (JSC::JIT::compile):
 306         (JIT):
 307         * jit/JITCompilationEffort.h: Added.
 308         (JSC):
 309         * jit/JITDriver.h:
 310         (JSC::jitCompileIfAppropriate):
 311         (JSC::jitCompileFunctionIfAppropriate):
 312         * llint/LLIntSlowPaths.cpp:
 313         (LLInt):
 314         (JSC::LLInt::jitCompileAndSetHeuristics):
 315         (JSC::LLInt::entryOSR):
 316         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 317         * runtime/Executable.cpp:
 318         (JSC::EvalExecutable::jitCompile):
 319         (JSC::ProgramExecutable::jitCompile):
 320         (JSC::FunctionExecutable::jitCompileForCall):
 321         (JSC::FunctionExecutable::jitCompileForConstruct):
 322         * runtime/Executable.h:
 323         (EvalExecutable):
 324         (ProgramExecutable):
 325         (FunctionExecutable):
 326         (JSC::FunctionExecutable::jitCompileFor):
 327         * runtime/ExecutionHarness.h:
 328         (JSC::prepareForExecution):
 329         (JSC::prepareFunctionForExecution):
 330
 331 2012-02-29  No'am Rosenthal  <noam.rosenthal@nokia.com>
 332
 333         [Qt][WK2] Get rid of the #ifdef mess in LayerTreeHost[Proxy]
 334         https://bugs.webkit.org/show_bug.cgi?id=79501
 335
 336         Enable WTF_USE_UI_SIDE_COMPOSITING for Qt.
 337
 338         Reviewed by Kenneth Rohde Christiansen.
 339
 340         * wtf/Platform.h:
 341
 342 2012-02-29  Gavin Barraclough  <barraclough@apple.com>
 343
 344         Rubber stamped by Oliver Hunt.
 345
 346         * tests/mozilla/ecma_2/RegExp/constructor-001.js:
 347         * tests/mozilla/ecma_2/RegExp/function-001.js:
 348         * tests/mozilla/ecma_2/RegExp/properties-001.js:
 349             - Check in new test cases results.
 350
 351 2012-02-29  Mark Rowe  <mrowe@apple.com>
 352
 353         Stop installing JSCLLIntOffsetsExtractor.
 354
 355         Replace the separate TestRegExp and TestAPI xcconfig files with a single ToolExecutable xcconfig file
 356         that derives the product name from the target name. We can then use that xcconfig file for JSCLLIntOffsetsExtractor.
 357         This has the results of setting SKIP_INSTALL = YES for JSCLLIntOffsetsExtractor.
 358
 359         While I was doing this fiddling I noticed that the JSCLLIntOffsetsExtractor target had a custom value
 360         for USER_HEADER_SEARCH_PATHS to allow it to find LLIntDesiredOffsets.h. A better way of doing that is
 361         to add LLIntDesiredOffsets.h to the Xcode project so that it'll be included in the header map. That
 362         allows us to remove the override of USER_HEADER_SEARCH_PATHS entirely. So I did that too!
 363
 364         Reviewed by Filip Pizlo.
 365
 366         * Configurations/TestRegExp.xcconfig: Removed.
 367         * Configurations/ToolExecutable.xcconfig: Renamed from Source/JavaScriptCore/Configurations/TestAPI.xcconfig.
 368         * JavaScriptCore.xcodeproj/project.pbxproj:
 369
 370 2012-02-28  Filip Pizlo  <fpizlo@apple.com>
 371
 372         RefCounted::deprecatedTurnOffVerifier() should not be deprecated
 373         https://bugs.webkit.org/show_bug.cgi?id=79864
 374
 375         Reviewed by Oliver Hunt.
 376
 377         Removed the word "deprecated" from the name of this method, since this method
 378         should not be deprecated. It works just fine as it is, and there is simply no
 379         alternative to calling this method for many interesting JSC classes.
 380
 381         * parser/SourceProvider.h:
 382         (JSC::SourceProvider::SourceProvider):
 383         * runtime/SymbolTable.h:
 384         (JSC::SharedSymbolTable::SharedSymbolTable):
 385         * wtf/MetaAllocator.cpp:
 386         (WTF::MetaAllocatorHandle::MetaAllocatorHandle):
 387         (WTF::MetaAllocator::allocate):
 388         * wtf/RefCounted.h:
 389         (RefCountedBase):
 390         (WTF::RefCountedBase::turnOffVerifier):
 391
 392 2012-02-29  Gavin Barraclough  <barraclough@apple.com>
 393
 394         'source' property of RegExp instance cannot be ""
 395         https://bugs.webkit.org/show_bug.cgi?id=79938
 396
 397         Reviewed by Oliver Hunt.
 398
 399         15.10.6.4 specifies that RegExp.prototype.toString must return '/' + source + '/',
 400         and also states that the result must be a valid RegularExpressionLiteral. '//' is
 401         not a valid RegularExpressionLiteral (since it is a single line comment), and hence
 402         source cannot ever validly be "". If the source is empty, return a different Pattern
 403         that would match the same thing.
 404
 405         * runtime/RegExpObject.cpp:
 406         (JSC::regExpObjectSource):
 407             - Do not return "" if the source is empty, this would lead to invalid behaviour in toString.
 408         * runtime/RegExpPrototype.cpp:
 409         (JSC::regExpProtoFuncToString):
 410             - No need to special case the empty string - this should be being done by 'source'.
 411
 412 2012-02-29  Gavin Barraclough  <barraclough@apple.com>
 413
 414         Writable attribute not set correctly when redefining an accessor to a data descriptor
 415         https://bugs.webkit.org/show_bug.cgi?id=79931
 416
 417         Reviewed by Oliver Hunt.
 418
 419         * runtime/JSObject.cpp:
 420         (JSC::JSObject::defineOwnProperty):
 421             - use attributesOverridingCurrent instead of attributesWithOverride.
 422         * runtime/PropertyDescriptor.cpp:
 423         * runtime/PropertyDescriptor.h:
 424             - remove attributesWithOverride - attributesOverridingCurrent does the same thing.
 425
 426 2012-02-29  Kevin Ollivier  <kevino@theolliviers.com>
 427
 428         Add JSCore symbol exports needed by wx port
 429         https://bugs.webkit.org/show_bug.cgi?id=77280
 430
 431         Reviewed by Hajime Morita.
 432
 433         * wtf/ArrayBufferView.h:
 434         * wtf/ExportMacros.h:
 435
 436 2012-02-28  Raphael Kubo da Costa  <kubo@profusion.mobi>
 437
 438         [CMake] Always build wtf as a static library.
 439         https://bugs.webkit.org/show_bug.cgi?id=79857
 440
 441         Reviewed by Eric Seidel.
 442
 443         To help the efforts in bug 75673 to move WTF out of
 444         JavaScriptCore, act more like the other ports and remove the
 445         possibility of building WTF as a shared library.
 446
 447         It does not make much sense to, for example, ship WTF as a
 448         separate .so with webkit-efl packages, and it should be small
 449         enough not to cause problems during linking.
 450
 451         * wtf/CMakeLists.txt:
 452
 453 2012-02-28  Dmitry Lomov  <dslomov@google.com>
 454
 455         [JSC] Implement ArrayBuffer transfer
 456         https://bugs.webkit.org/show_bug.cgi?id=73493.
 457         Implement ArrayBuffer transfer, per Khronos spec:  http://www.khronos.org/registry/typedarray/specs/latest/#9.
 458         This brings parity with V8 implementation of transferable typed arrays.
 459
 460         Reviewed by Oliver Hunt.
 461
 462         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Extra export.
 463         * wtf/ArrayBuffer.h:
 464         (ArrayBuffer): Added extra export.
 465
 466 2012-02-28  Kevin Ollivier  <kevino@theolliviers.com>
 467
 468         [wx] Unreviewed. Build fix after recent LLInt additions.
 469
 470         * wscript:
 471
 472 2012-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
 473
 474         Refactor SpeculativeJIT::emitAllocateJSFinalObject
 475         https://bugs.webkit.org/show_bug.cgi?id=79801
 476
 477         Reviewed by Filip Pizlo.
 478
 479         * dfg/DFGSpeculativeJIT.h:
 480         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Split emitAllocateJSFinalObject out to form this
 481         function, which is more generic in that it can allocate a variety of classes.
 482         (SpeculativeJIT):
 483         (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): Changed to use the new helper function.
 484
 485 2012-02-28  Gavin Barraclough  <barraclough@apple.com>
 486
 487         [[Get]]/[[Put]] for primitives should not wrap on strict accessor call
 488         https://bugs.webkit.org/show_bug.cgi?id=79588
 489
 490         Reviewed by Oliver Hunt.
 491
 492         In the case of [[Get]], this is a pretty trivial bug - just don't wrap
 493         primitives at the point you call a getter.
 494
 495         For setters, this is a little more involved, since we have already wrapped
 496         the value up in a synthesized object. Stop doing so. There is also a further
 497         subtely, that in strict mode all attempts to create a new data property on
 498         the object should throw.
 499
 500         * runtime/JSCell.cpp:
 501         (JSC::JSCell::put):
 502             - [[Put]] to a string primitive should use JSValue::putToPrimitive.
 503         * runtime/JSObject.cpp:
 504         (JSC::JSObject::put):
 505             - Remove static function called in one place.
 506         * runtime/JSObject.h:
 507         (JSC::JSValue::put):
 508             - [[Put]] to a non-cell JSValue should use JSValue::putToPrimitive.
 509         * runtime/JSValue.cpp:
 510         (JSC::JSValue::synthesizePrototype):
 511             - Add support for synthesizing the prototype of strings.
 512         (JSC::JSValue::putToPrimitive):
 513             - Added, implements [[Put]] for primitive bases, per 8.7.2.
 514         * runtime/JSValue.h:
 515         (JSValue):
 516             - Add declaration for JSValue::putToPrimitive.
 517         * runtime/PropertySlot.cpp:
 518         (JSC::PropertySlot::functionGetter):
 519             - Don't call ToObject on primitive this values.
 520
 521 2012-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
 522
 523         Re-enable parallel GC on Mac
 524         https://bugs.webkit.org/show_bug.cgi?id=79837
 525
 526         Rubber stamped by Filip Pizlo.
 527
 528         * runtime/Options.cpp:
 529         (JSC::Options::initializeOptions): We accidentally disabled parallel GC with this line,
 530         so we removed it and things should go back to normal.
 531
 532 2012-02-28  Filip Pizlo  <fpizlo@apple.com>
 533
 534         Some run-javascriptcore-tests broken for 32-bit debug
 535         https://bugs.webkit.org/show_bug.cgi?id=79844
 536
 537         Rubber stamped by Oliver Hunt.
 538
 539         These assertions are just plain wrong for 32-bit. We could either have a massive
 540         assertion that depends on value representation, that has to be changed every
 541         time we change the JITs, resulting in a bug tail of debug-mode crashes, or we
 542         could get rid of the assertions. I pick the latter.
 543
 544         * dfg/DFGOperations.cpp:
 545         * jit/JITStubs.cpp:
 546         (JSC::DEFINE_STUB_FUNCTION):
 547
 548 2012-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
 549
 550         Get rid of padding cruft in CopiedBlock
 551         https://bugs.webkit.org/show_bug.cgi?id=79686
 552
 553         Reviewed by Filip Pizlo.
 554
 555         * heap/CopiedBlock.h:
 556         (CopiedBlock): Removed the extra padding that was used for alignment purposes until
 557         the calculation of the payload offset into CopiedBlocks was redone recently.
 558
 559 2012-02-28  Anders Carlsson  <andersca@apple.com>
 560
 561         Fix build with newer versions of clang.
 562
 563         Clang now warns since we're not passing a CFString literal to CFStringCreateWithFormatAndArguments,
 564         but it's OK to ignore this warning since clang is also checking that the caller (vprintf_stderr_common)
 565         takes a string literal.
 566
 567         * wtf/Assertions.cpp:
 568
 569 2012-02-28  Mario Sanchez Prada  <msanchez@igalia.com>
 570
 571         [GTK] Add GMainLoop and GMainContext to be handled by GRefPtr
 572         https://bugs.webkit.org/show_bug.cgi?id=79496
 573
 574         Reviewed by Martin Robinson.
 575
 576         Handle GMainLoop and GMainContext in GRefPtr, by calling
 577         g_main_loop_(un)ref and g_main_context_(un)ref in the
 578         implementation of the refGPtr and derefGPtr template functions.
 579
 580         * wtf/gobject/GRefPtr.cpp:
 581         (WTF::refGPtr):
 582         (WTF):
 583         (WTF::derefGPtr):
 584         * wtf/gobject/GRefPtr.h:
 585         (WTF):
 586         * wtf/gobject/GTypedefs.h:
 587
 588 2012-02-28  Yong Li  <yoli@rim.com>
 589
 590         JSString::resolveRope() should report extra memory cost to the heap.
 591         https://bugs.webkit.org/show_bug.cgi?id=79555
 592
 593         Reviewed by Michael Saboff.
 594
 595         At the time a JSString is constructed with fibers, it doesn't report
 596         extra memory cost, which is reasonable because it hasn't allocate
 597         new memory. However when the rope is resolved, it should report meory
 598         cost for the new buffer.
 599
 600         * runtime/JSString.cpp:
 601         (JSC::JSString::resolveRope):
 602
 603 2012-02-27  Oliver Hunt  <oliver@apple.com>
 604
 605         sputnik/Unicode/Unicode_500/S7.2_A1.6_T1.html crashes in the interpreter
 606         https://bugs.webkit.org/show_bug.cgi?id=79728
 607
 608         Reviewed by Gavin Barraclough.
 609
 610         When initialising a chained get instruction we may end up in a state where
 611         the instruction stream says we have a scopechain, but it has not yet been set
 612         (eg. if allocating the StructureChain itself is what leads to the GC).  We could
 613         re-order the allocation, but it occurs in a couple of places, so it seems less
 614         fragile simply to null check the scopechain slot before we actually visit the slot.
 615
 616         * bytecode/CodeBlock.cpp:
 617         (JSC::CodeBlock::visitStructures):
 618
 619 2012-02-27  Filip Pizlo  <fpizlo@apple.com>
 620
 621         Old JIT's style of JSVALUE64 strict equality is subtly wrong
 622         https://bugs.webkit.org/show_bug.cgi?id=79700
 623
 624         Reviewed by Oliver Hunt.
 625
 626         * assembler/MacroAssemblerX86_64.h:
 627         (JSC::MacroAssemblerX86_64::comparePtr):
 628         (MacroAssemblerX86_64):
 629         * dfg/DFGOperations.cpp:
 630         * dfg/DFGSpeculativeJIT.cpp:
 631         (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
 632         * dfg/DFGSpeculativeJIT64.cpp:
 633         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
 634         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
 635         * jit/JITOpcodes.cpp:
 636         (JSC::JIT::compileOpStrictEq):
 637         (JSC::JIT::emitSlow_op_stricteq):
 638         (JSC::JIT::emitSlow_op_nstricteq):
 639         * jit/JITStubs.cpp:
 640         (JSC::DEFINE_STUB_FUNCTION):
 641
 642 2012-02-27  Gavin Barraclough  <barraclough@apple.com>
 643
 644         Implement support for op_negate and op_bitnot in the DFG JIT
 645         https://bugs.webkit.org/show_bug.cgi?id=79617
 646
 647         Reviewed by Filip Pizlo.
 648
 649         Add an ArithNegate op to the DFG JIT, to implement op_negate.
 650
 651         This patch also adds support for op_negate to the JSVALUE64 baseline JIT
 652         (JSVALUE32_64 already had this), so that we can profile the slowpath usage.
 653
 654         This is a 2.5%-3% Sunspider progression and a 1% win on Kraken.
 655
 656         * assembler/ARMv7Assembler.h:
 657         (JSC::ARMv7Assembler::sub_S):
 658             - Added sub_S from immediate.
 659         (ARMv7Assembler):
 660         (JSC::ARMv7Assembler::vneg):
 661             - Added double negate.
 662         * assembler/MacroAssemblerARMv7.h:
 663         (JSC::MacroAssemblerARMv7::negateDouble):
 664             - Added double negate.
 665         (MacroAssemblerARMv7):
 666         (JSC::MacroAssemblerARMv7::branchNeg32):
 667             - Added.
 668         * assembler/MacroAssemblerX86.h:
 669         (MacroAssemblerX86):
 670             - moved loadDouble, absDouble to common.
 671         * assembler/MacroAssemblerX86Common.h:
 672         (MacroAssemblerX86Common):
 673         (JSC::MacroAssemblerX86Common::absDouble):
 674             - implementation can be shared.
 675         (JSC::MacroAssemblerX86Common::negateDouble):
 676             - Added.
 677         (JSC::MacroAssemblerX86Common::loadDouble):
 678             - allow absDouble to have a common implementation.
 679         * assembler/MacroAssemblerX86_64.h:
 680         (MacroAssemblerX86_64):
 681             - moved loadDouble, absDouble to common.
 682         * dfg/DFGAbstractState.cpp:
 683         (JSC::DFG::AbstractState::execute):
 684             - support ArithNegate.
 685         * dfg/DFGArithNodeFlagsInferencePhase.cpp:
 686         (JSC::DFG::ArithNodeFlagsInferencePhase::propagate):
 687             - support ArithNegate.
 688         * dfg/DFGByteCodeParser.cpp:
 689         (JSC::DFG::ByteCodeParser::makeSafe):
 690             - support ArithNegate.
 691         (JSC::DFG::ByteCodeParser::parseBlock):
 692             - support op_negate.
 693         * dfg/DFGCSEPhase.cpp:
 694         (JSC::DFG::CSEPhase::performNodeCSE):
 695             - support ArithNegate.
 696         * dfg/DFGCapabilities.h:
 697         (JSC::DFG::canCompileOpcode):
 698             - support op_negate.
 699         * dfg/DFGGraph.h:
 700         (JSC::DFG::Graph::negateShouldSpeculateInteger):
 701             - support ArithNegate.
 702         * dfg/DFGNode.h:
 703         (JSC::DFG::Node::hasArithNodeFlags):
 704             - support ArithNegate.
 705         * dfg/DFGPredictionPropagationPhase.cpp:
 706         (JSC::DFG::PredictionPropagationPhase::propagate):
 707             - support ArithNegate.
 708         * dfg/DFGSpeculativeJIT.cpp:
 709         (JSC::DFG::SpeculativeJIT::compileArithNegate):
 710             - support ArithNegate.
 711         * dfg/DFGSpeculativeJIT.h:
 712         (SpeculativeJIT):
 713             - support ArithNegate.
 714         * dfg/DFGSpeculativeJIT32_64.cpp:
 715         (JSC::DFG::SpeculativeJIT::compile):
 716             - support ArithNegate.
 717         * dfg/DFGSpeculativeJIT64.cpp:
 718         (JSC::DFG::SpeculativeJIT::compile):
 719             - support ArithNegate.
 720         * jit/JIT.cpp:
 721         (JSC::JIT::privateCompileMainPass):
 722         (JSC::JIT::privateCompileSlowCases):
 723             - Add support for op_negate in JSVALUE64.
 724         * jit/JITArithmetic.cpp:
 725         (JSC::JIT::emit_op_negate):
 726         (JSC::JIT::emitSlow_op_negate):
 727             - Add support for op_negate in JSVALUE64.
 728
 729 2012-02-27  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
 730
 731         Unreviewed. Build fix for linux-bot (qt) after r109021.
 732
 733         * runtime/Error.cpp:
 734
 735 2012-02-27  Oliver Hunt  <oliver@apple.com>
 736
 737         REGRESSION (r108112): AWS Management Console at amazon.com fails to initialize
 738         https://bugs.webkit.org/show_bug.cgi?id=79693
 739
 740         Reviewed by Filip Pizlo.
 741
 742         Alas we can't provide the stack trace as an array, as despite everyone wanting
 743         an array, everyone arbitrarily creates the array by calling split on the stack
 744         trace.  To create the array we would have provided them in the first place.
 745
 746         This changes the exception's stack property to a \n separated string.  To get the
 747         old array just do <exception>.stack.split("\n").
 748
 749         * runtime/Error.cpp:
 750         (JSC::addErrorInfo):
 751
 752 2012-02-27  Gavin Barraclough  <barraclough@apple.com>
 753
 754         RegExp lastIndex should behave as a regular property
 755         https://bugs.webkit.org/show_bug.cgi?id=79446
 756
 757         Reviewed by Sam Weinig.
 758
 759         lastIndex should be a regular data descriptor, with the attributes configurable:false,
 760         enumerable:false, writable:true. As such, it should be possible to reconfigure writable
 761         as false. If the lastIndex property is reconfigured to be read-only, we should respect
 762         this correctly.
 763
 764         * runtime/CommonIdentifiers.h:
 765             - Removed some unused identifiers, added lastIndex.
 766         * runtime/RegExpObject.cpp:
 767         (JSC::RegExpObject::getOwnPropertySlot):
 768             - lastIndex is no longer a static value, provided specific handling.
 769         (JSC::RegExpObject::getOwnPropertyDescriptor):
 770             - lastIndex is no longer a static value, provided specific handling.
 771         (JSC::RegExpObject::deleteProperty):
 772             - lastIndex is no longer a static value, provided specific handling.
 773         (JSC::RegExpObject::getOwnPropertyNames):
 774             - lastIndex is no longer a static value, provided specific handling.
 775         (JSC::RegExpObject::getPropertyNames):
 776             - lastIndex is no longer a static value, provided specific handling.
 777         (JSC::reject):
 778             - helper function for defineOwnProperty.
 779         (JSC::RegExpObject::defineOwnProperty):
 780             - lastIndex is no longer a static value, provided specific handling.
 781         (JSC::RegExpObject::put):
 782             - lastIndex is no longer a static value, provided specific handling.
 783         (JSC::RegExpObject::match):
 784             - Pass setLastIndex an ExecState, so it can throw if read-only.
 785         * runtime/RegExpObject.h:
 786         (JSC::RegExpObject::setLastIndex):
 787             - Pass setLastIndex an ExecState, so it can throw if read-only.
 788         (RegExpObjectData):
 789             - Added lastIndexIsWritable.
 790         * runtime/RegExpPrototype.cpp:
 791         (JSC::regExpProtoFuncCompile):
 792             - Pass setLastIndex an ExecState, so it can throw if read-only.
 793
 794 2012-02-27  Gavin Barraclough  <barraclough@apple.com>
 795
 796         Implement support for op_negate and op_bitnot in the DFG JIT
 797         https://bugs.webkit.org/show_bug.cgi?id=79617
 798
 799         Reviewed by Sam Weinig.
 800
 801         Remove op_bitnop - this is redundant, ~x === x^-1.
 802         This is a fractional (<1%) progression.
 803
 804         Remove not32(X) from the MacroAssemblers - make this an optimization to add32(-1, X).
 805         Remove CanReuse from the result type - this was unused.
 806         Remove op_bitnot.
 807
 808         * assembler/MacroAssemblerARM.h:
 809         (MacroAssemblerARM):
 810         (JSC::MacroAssemblerARM::xor32):
 811         * assembler/MacroAssemblerARMv7.h:
 812         (MacroAssemblerARMv7):
 813         (JSC::MacroAssemblerARMv7::xor32):
 814         * assembler/MacroAssemblerMIPS.h:
 815         (MacroAssemblerMIPS):
 816         (JSC::MacroAssemblerMIPS::xor32):
 817         * assembler/MacroAssemblerSH4.h:
 818         (MacroAssemblerSH4):
 819         (JSC::MacroAssemblerSH4::xor32):
 820         * assembler/MacroAssemblerX86Common.h:
 821         (MacroAssemblerX86Common):
 822         (JSC::MacroAssemblerX86Common::xor32):
 823         * bytecode/CodeBlock.cpp:
 824         (JSC::CodeBlock::dump):
 825         * bytecode/Opcode.h:
 826         (JSC):
 827         (JSC::padOpcodeName):
 828         * bytecompiler/NodesCodegen.cpp:
 829         (JSC):
 830         (JSC::BitwiseNotNode::emitBytecode):
 831         * interpreter/Interpreter.cpp:
 832         (JSC::Interpreter::privateExecute):
 833         * jit/JIT.cpp:
 834         (JSC::JIT::privateCompileMainPass):
 835         (JSC::JIT::privateCompileSlowCases):
 836         * jit/JIT.h:
 837         (JIT):
 838         * jit/JITArithmetic32_64.cpp:
 839         (JSC):
 840         * jit/JITOpcodes.cpp:
 841         (JSC):
 842         * jit/JITStubs.cpp:
 843         (JSC):
 844         * jit/JITStubs.h:
 845         * llint/LLIntSlowPaths.cpp:
 846         (LLInt):
 847         * llint/LLIntSlowPaths.h:
 848         (LLInt):
 849         * llint/LowLevelInterpreter32_64.asm:
 850         * parser/NodeConstructors.h:
 851         (JSC::NegateNode::NegateNode):
 852         (JSC::BitwiseNotNode::BitwiseNotNode):
 853         (JSC::MultNode::MultNode):
 854         (JSC::DivNode::DivNode):
 855         (JSC::ModNode::ModNode):
 856         (JSC::SubNode::SubNode):
 857         (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
 858         * parser/Nodes.h:
 859         (BitwiseNotNode):
 860         (JSC::BitwiseNotNode::expr):
 861         (JSC):
 862         * parser/ResultType.h:
 863         (ResultType):
 864         (JSC::ResultType::numberTypeIsInt32):
 865         (JSC::ResultType::stringOrNumberType):
 866         (JSC::ResultType::forAdd):
 867         (JSC::ResultType::forBitOp):
 868
 869 2012-02-27  Michael Saboff  <msaboff@apple.com>
 870
 871         Error check regexp min quantifier
 872         https://bugs.webkit.org/show_bug.cgi?id=70648
 873
 874         Reviewed by Gavin Barraclough.
 875
 876         Added checking for min or only quantifier being UINT_MAX.
 877         When encountered this becomes a SyntaxError during parsing.
 878
 879         * yarr/YarrParser.h:
 880         (JSC::Yarr::Parser::parseQuantifier):
 881         (JSC::Yarr::Parser::parse):
 882         (Parser):
 883
 884 2012-02-27  Carlos Garcia Campos  <cgarcia@igalia.com>
 885
 886         Unreviewed. Fix make distcheck.
 887
 888         * GNUmakefile.list.am: Add missing files.
 889
 890 2012-02-26  Hajime Morrita  <morrita@chromium.org>
 891
 892         Move ChromeClient::showContextMenu() to ContextMenuClient
 893         https://bugs.webkit.org/show_bug.cgi?id=79427
 894
 895         Reviewed by Adam Barth.
 896
 897         Added ACCESSIBILITY_CONTEXT_MENUS.
 898
 899         * wtf/Platform.h:
 900
 901 2012-02-26  Filip Pizlo  <fpizlo@apple.com>
 902
 903         LayoutTests/fast/xpath/xpath-functional-test.html is crashing in the DFG
 904         https://bugs.webkit.org/show_bug.cgi?id=79616
 905
 906         Reviewed by Oliver Hunt.
 907
 908         Guard against the fact that in JSVALUE64, JSValue().isCell() == true.
 909
 910         * dfg/DFGAbstractValue.h:
 911         (JSC::DFG::AbstractValue::validate):
 912
 913 2012-02-26  Filip Pizlo  <fpizlo@apple.com>
 914
 915         DFG should support activations and nested functions
 916         https://bugs.webkit.org/show_bug.cgi?id=79554
 917
 918         Reviewed by Sam Weinig.
 919
 920         Fix 32-bit. The 32-bit function+activation code had some really weird
 921         register reuse bugs.
 922
 923         * dfg/DFGSpeculativeJIT32_64.cpp:
 924         (JSC::DFG::SpeculativeJIT::compile):
 925
 926 2012-02-26  Filip Pizlo  <fpizlo@apple.com>
 927
 928         Getting the instruction stream for a code block should not require two loads
 929         https://bugs.webkit.org/show_bug.cgi?id=79608
 930
 931         Reviewed by Sam Weinig.
 932
 933         Introduced the RefCountedArray class, which contains a single inline pointer
 934         to a ref-counted non-resizeable vector backing store. This satisfies the
 935         requirements of CodeBlock, which desires the ability to share instruction
 936         streams with other CodeBlocks. It also reduces the number of loads required
 937         for getting the instruction stream by one.
 938
 939         This patch also gets rid of the bytecode discarding logic, since we don't
 940         use it anymore and it's unlikely to ever work right with DFG or LLInt. And
 941         I didn't feel like porting dead code to use RefCountedArray.
 942
 943         * GNUmakefile.list.am:
 944         * JavaScriptCore.xcodeproj/project.pbxproj:
 945         * bytecode/CodeBlock.cpp:
 946         (JSC::instructionOffsetForNth):
 947         (JSC::CodeBlock::dump):
 948         (JSC::CodeBlock::CodeBlock):
 949         (JSC::CodeBlock::finalizeUnconditionally):
 950         (JSC::CodeBlock::handlerForBytecodeOffset):
 951         (JSC::CodeBlock::lineNumberForBytecodeOffset):
 952         (JSC::CodeBlock::expressionRangeForBytecodeOffset):
 953         (JSC::CodeBlock::shrinkToFit):
 954         * bytecode/CodeBlock.h:
 955         (CodeBlock):
 956         (JSC::CodeBlock::numberOfInstructions):
 957         (JSC::CodeBlock::instructions):
 958         (JSC::CodeBlock::instructionCount):
 959         (JSC::CodeBlock::valueProfileForBytecodeOffset):
 960         (JSC):
 961         * bytecompiler/BytecodeGenerator.cpp:
 962         (JSC::Label::setLocation):
 963         (JSC):
 964         (JSC::BytecodeGenerator::generate):
 965         (JSC::BytecodeGenerator::newLabel):
 966         * bytecompiler/BytecodeGenerator.h:
 967         (JSC):
 968         (BytecodeGenerator):
 969         (JSC::BytecodeGenerator::instructions):
 970         * bytecompiler/Label.h:
 971         (JSC::Label::Label):
 972         (Label):
 973         * dfg/DFGByteCodeCache.h:
 974         (JSC::DFG::ByteCodeCache::~ByteCodeCache):
 975         (JSC::DFG::ByteCodeCache::get):
 976         * jit/JITExceptions.cpp:
 977         (JSC::genericThrow):
 978         * llint/LowLevelInterpreter32_64.asm:
 979         * runtime/Executable.cpp:
 980         (JSC::EvalExecutable::compileInternal):
 981         (JSC::ProgramExecutable::compileInternal):
 982         (JSC::FunctionExecutable::codeBlockWithBytecodeFor):
 983         (JSC::FunctionExecutable::produceCodeBlockFor):
 984         * wtf/RefCountedArray.h: Added.
 985         (WTF):
 986         (RefCountedArray):
 987         (WTF::RefCountedArray::RefCountedArray):
 988         (WTF::RefCountedArray::operator=):
 989         (WTF::RefCountedArray::~RefCountedArray):
 990         (WTF::RefCountedArray::size):
 991         (WTF::RefCountedArray::data):
 992         (WTF::RefCountedArray::begin):
 993         (WTF::RefCountedArray::end):
 994         (WTF::RefCountedArray::at):
 995         (WTF::RefCountedArray::operator[]):
 996         (Header):
 997         (WTF::RefCountedArray::Header::size):
 998         (WTF::RefCountedArray::Header::payload):
 999         (WTF::RefCountedArray::Header::fromPayload):
1000         * wtf/Platform.h:
1001
1002 2012-02-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1003
1004         StringLiteral and NumericLiteral are allowed as ObjectLiteral getter / setter name
1005         https://bugs.webkit.org/show_bug.cgi?id=79571
1006
1007         Reviewed by Gavin Barraclough.
1008
1009         * parser/ASTBuilder.h:
1010         (JSC::ASTBuilder::createGetterOrSetterProperty):
1011         * parser/Parser.cpp:
1012         (JSC::::parseProperty):
1013         * parser/SyntaxChecker.h:
1014         (JSC::SyntaxChecker::createGetterOrSetterProperty):
1015
1016 2012-02-26  Mark Hahnenberg  <mhahnenberg@apple.com>
1017
1018         Implement fast path for op_new_array in the baseline JIT
1019         https://bugs.webkit.org/show_bug.cgi?id=78612
1020
1021         Reviewed by Filip Pizlo.
1022
1023         heap/CopiedAllocator.h:
1024         (CopiedAllocator): Friended the JIT to allow access to m_currentOffset.
1025         * heap/CopiedSpace.h:
1026         (CopiedSpace): Friended the JIT to allow access to isOversize.
1027         (JSC::CopiedSpace::allocator):
1028         * heap/Heap.h:
1029         (JSC::Heap::storageAllocator): Added a getter for the CopiedAllocator class so the JIT
1030         can use it for simple allocation i.e. when we can just bump the offset without having to
1031         do anything else.
1032         * jit/JIT.cpp:
1033         (JSC::JIT::privateCompileSlowCases): Added new slow case for op_new_array for when
1034         we have to bail out because the fast allocation path fails for whatever reason.
1035         * jit/JIT.h:
1036         (JIT):
1037         * jit/JITInlineMethods.h:
1038         (JSC::JIT::emitAllocateBasicStorage): Added utility function that allows objects to
1039         allocate generic backing stores. This function is used by emitAllocateJSArray.
1040         (JSC):
1041         (JSC::JIT::emitAllocateJSArray): Added utility function that allows the client to
1042         more easily allocate JSArrays. This function is used by emit_op_new_array and I expect
1043         it will also be used for emit_op_new_array_buffer.
1044         * jit/JITOpcodes.cpp:
1045         (JSC::JIT::emit_op_new_array): Changed to do inline allocation of JSArrays. Still does
1046         a stub call for oversize arrays.
1047         (JSC):
1048         (JSC::JIT::emitSlow_op_new_array): New slow path that just bails out to a stub call if we
1049         fail in any way on the fast path.
1050         * runtime/JSArray.cpp:
1051         (JSC):
1052         * runtime/JSArray.h: Added lots of offset functions for all the fields that we need to
1053         initialize in the JIT.
1054         (ArrayStorage):
1055         (JSC::ArrayStorage::lengthOffset):
1056         (JSC::ArrayStorage::numValuesInVectorOffset):
1057         (JSC::ArrayStorage::allocBaseOffset):
1058         (JSC::ArrayStorage::vectorOffset):
1059         (JSArray):
1060         (JSC::JSArray::sparseValueMapOffset):
1061         (JSC::JSArray::subclassDataOffset):
1062         (JSC::JSArray::indexBiasOffset):
1063         (JSC):
1064         (JSC::JSArray::storageSize): Moved this function from being a static function in the cpp file
1065         to being a static function in the JSArray class. This move allows the JIT to call it to
1066         see what size it should allocate.
1067
1068 2012-02-26  Patrick Gansterer  <paroga@webkit.org>
1069
1070         Unreviewed. Build fix for ENABLE(CLASSIC_INTERPRETER) after r108681.
1071
1072         * interpreter/Interpreter.cpp:
1073         (JSC::getLineNumberForCallFrame):
1074         (JSC::Interpreter::getStackTrace):
1075
1076 2012-02-26  Patrick Gansterer  <paroga@webkit.org>
1077
1078         Unreviewed. Build fix for !ENABLE(JIT) after r108681.
1079
1080         * interpreter/Interpreter.cpp:
1081         (JSC::getLineNumberForCallFrame):
1082
1083 2012-02-25  Filip Pizlo  <fpizlo@apple.com>
1084
1085         LLInt assembly file should be split into 32-bit and 64-bit parts
1086         https://bugs.webkit.org/show_bug.cgi?id=79584
1087
1088         Reviewed by Sam Weinig.
1089
1090         Moved LowLevelInterpreter.asm to LowLevelInterpreter32_64.asm. Gave offlineasm
1091         the ability to include files, and correctly track dependencies: it restricts
1092         the include mechanism to using the same directory as the source file, and uses
1093         the SHA1 hash of all .asm files in that directory as an input hash.
1094
1095         * llint/LLIntOfflineAsmConfig.h:
1096         * llint/LowLevelInterpreter.asm:
1097         * llint/LowLevelInterpreter32_64.asm: Added.
1098             - This is just the entire contents of what was previously LowLevelInterpreter.asm
1099         * llint/LowLevelInterpreter64.asm: Added.
1100         * offlineasm/asm.rb:
1101         * offlineasm/ast.rb:
1102         * offlineasm/generate_offset_extractor.rb:
1103         * offlineasm/parser.rb:
1104         * offlineasm/self_hash.rb:
1105
1106 2012-02-25  Filip Pizlo  <fpizlo@apple.com>
1107
1108         Offlineasm should support X86_64
1109         https://bugs.webkit.org/show_bug.cgi?id=79581
1110
1111         Reviewed by Oliver Hunt.
1112
1113         * llint/LLIntOfflineAsmConfig.h:
1114         * offlineasm/backends.rb:
1115         * offlineasm/instructions.rb:
1116         * offlineasm/settings.rb:
1117         * offlineasm/x86.rb:
1118
1119 2012-02-25  Filip Pizlo  <fpizlo@apple.com>
1120
1121         DFG should support activations and nested functions
1122         https://bugs.webkit.org/show_bug.cgi?id=79554
1123
1124         Reviewed by Oliver Hunt.
1125
1126         Wrote the simplest possible implementation of activations. Big speed-up on
1127         code that uses activations, no speed-up on major benchmarks (SunSpider, V8,
1128         Kraken) because they do not appear to have sufficient coverage over code
1129         that uses activations.
1130
1131         * bytecode/PredictedType.cpp:
1132         (JSC::predictionToString):
1133         (JSC::predictionFromValue):
1134         * bytecode/PredictedType.h:
1135         (JSC):
1136         (JSC::isEmptyPrediction):
1137         * dfg/DFGAbstractState.cpp:
1138         (JSC::DFG::AbstractState::execute):
1139         * dfg/DFGByteCodeParser.cpp:
1140         (JSC::DFG::ByteCodeParser::ByteCodeParser):
1141         (ByteCodeParser):
1142         (JSC::DFG::ByteCodeParser::parseBlock):
1143         (JSC::DFG::ByteCodeParser::buildOperandMapsIfNecessary):
1144         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
1145         (JSC::DFG::ByteCodeParser::parse):
1146         * dfg/DFGCapabilities.h:
1147         (JSC::DFG::canCompileOpcode):
1148         (JSC::DFG::canInlineOpcode):
1149         * dfg/DFGGraph.h:
1150         (JSC::DFG::Graph::needsActivation):
1151         * dfg/DFGNode.h:
1152         (DFG):
1153         (JSC::DFG::Node::storageAccessDataIndex):
1154         (Node):
1155         (JSC::DFG::Node::hasFunctionDeclIndex):
1156         (JSC::DFG::Node::functionDeclIndex):
1157         (JSC::DFG::Node::hasFunctionExprIndex):
1158         (JSC::DFG::Node::functionExprIndex):
1159         * dfg/DFGOperations.cpp:
1160         * dfg/DFGOperations.h:
1161         * dfg/DFGPredictionPropagationPhase.cpp:
1162         (JSC::DFG::PredictionPropagationPhase::propagate):
1163         * dfg/DFGSpeculativeJIT.cpp:
1164         (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
1165         (DFG):
1166         (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
1167         * dfg/DFGSpeculativeJIT.h:
1168         (JSC::DFG::SpeculativeJIT::callOperation):
1169         * dfg/DFGSpeculativeJIT32_64.cpp:
1170         (JSC::DFG::SpeculativeJIT::compile):
1171         * dfg/DFGSpeculativeJIT64.cpp:
1172         (JSC::DFG::SpeculativeJIT::compile):
1173
1174 2012-02-25  Benjamin Poulain  <benjamin@webkit.org>
1175
1176         Add an empty skeleton of KURL for WTFURL
1177         https://bugs.webkit.org/show_bug.cgi?id=78990
1178
1179         Reviewed by Adam Barth.
1180
1181         * JavaScriptCore.xcodeproj/project.pbxproj: Export the relevant classes from WTFURL
1182         so that can use them in WebCore.
1183
1184 2012-02-25  Filip Pizlo  <fpizlo@apple.com>
1185
1186         Unreviewed, fix build for DFG disabled and LLInt enabled.
1187
1188         * jit/JIT.cpp:
1189         (JSC::JIT::privateCompile):
1190         * llint/LLIntSlowPaths.cpp:
1191         (LLInt):
1192         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1193
1194 2012-02-25  Mark Hahnenberg  <mhahnenberg@apple.com>
1195
1196         Fix the CopiedBlock offset alignment in a cross platform fashion
1197         https://bugs.webkit.org/show_bug.cgi?id=79556
1198
1199         Reviewed by Filip Pizlo.
1200
1201         Replaced m_payload with a payload() method that calculates the offset
1202         of the payload with the proper alignment. This change allows us to
1203         avoid alignment-related issues in a cross-platform manner.
1204
1205         * heap/CopiedAllocator.h:
1206         (JSC::CopiedAllocator::currentUtilization):
1207         * heap/CopiedBlock.h:
1208         (JSC::CopiedBlock::CopiedBlock):
1209         (JSC::CopiedBlock::payload):
1210         (CopiedBlock):
1211         * heap/CopiedSpace.cpp:
1212         (JSC::CopiedSpace::doneFillingBlock):
1213         * heap/CopiedSpaceInlineMethods.h:
1214         (JSC::CopiedSpace::borrowBlock):
1215         (JSC::CopiedSpace::allocateFromBlock):
1216
1217 2012-02-24  Michael Saboff  <msaboff@apple.com>
1218
1219         Unreviewed, Windows build fix.  Changed signature in export to match
1220         change made in r108858.
1221
1222         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1223
1224 2012-02-24  Filip Pizlo  <fpizlo@apple.com>
1225
1226         DFG support for op_new_regexp should be enabled
1227         https://bugs.webkit.org/show_bug.cgi?id=79538
1228
1229         Reviewed by Oliver Hunt.
1230
1231         No performance change.
1232
1233         * dfg/DFGCapabilities.h:
1234         (JSC::DFG::canCompileOpcode):
1235         * dfg/DFGCommon.h:
1236
1237 2012-02-24  Michael Saboff  <msaboff@apple.com>
1238
1239         ASSERT(position < 0) in JSC::Yarr::Interpreter::InputStream::readChecked
1240         https://bugs.webkit.org/show_bug.cgi?id=73728
1241
1242         Reviewed by Gavin Barraclough.
1243
1244         Fixed the mixing of signed and unsigned character indeces in YARR
1245         interpreter.
1246
1247         * runtime/RegExp.cpp:
1248         (JSC::RegExp::match): Added code to check for match longer than 2^31 and
1249         return no match after resetting the offsets.
1250         * yarr/YarrInterpreter.cpp: Changed to use unsigned for all character index
1251         handling except when matching back references.
1252         (JSC::Yarr::Interpreter::InputStream::readChecked):
1253         (JSC::Yarr::Interpreter::InputStream::checkInput):
1254         (JSC::Yarr::Interpreter::InputStream::uncheckInput):
1255         (JSC::Yarr::Interpreter::InputStream::atStart):
1256         (JSC::Yarr::Interpreter::InputStream::atEnd):
1257         (JSC::Yarr::Interpreter::InputStream::isAvailableInput):
1258         (JSC::Yarr::Interpreter::checkCharacter):
1259         (JSC::Yarr::Interpreter::checkCasedCharacter):
1260         (JSC::Yarr::Interpreter::checkCharacterClass):
1261         (JSC::Yarr::Interpreter::tryConsumeBackReference):
1262         (JSC::Yarr::Interpreter::matchAssertionBOL):
1263         (JSC::Yarr::Interpreter::matchAssertionWordBoundary):
1264         (JSC::Yarr::Interpreter::backtrackPatternCharacter):
1265         (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
1266         (JSC::Yarr::Interpreter::matchCharacterClass):
1267         (JSC::Yarr::Interpreter::backtrackCharacterClass):
1268         (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
1269         (JSC::Yarr::Interpreter::matchDisjunction):
1270         (JSC::Yarr::Interpreter::interpret):
1271         (JSC::Yarr::ByteCompiler::assertionBOL):
1272         (JSC::Yarr::ByteCompiler::assertionEOL):
1273         (JSC::Yarr::ByteCompiler::assertionWordBoundary):
1274         (JSC::Yarr::ByteCompiler::atomPatternCharacter):
1275         (JSC::Yarr::ByteCompiler::atomCharacterClass):
1276         (JSC::Yarr::ByteCompiler::atomBackReference):
1277         (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
1278         (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
1279         (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
1280         (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
1281         (JSC::Yarr::ByteCompiler::emitDisjunction):
1282         * yarr/YarrInterpreter.h:
1283
1284 2012-02-24  Filip Pizlo  <fpizlo@apple.com>
1285
1286         Unreviewed, build fix for builds where the DFG is disabled but the LLInt is
1287         enabled.
1288
1289         * llint/LLIntOfflineAsmConfig.h:
1290         * llint/LowLevelInterpreter.asm:
1291
1292 2012-02-24  Filip Pizlo  <fpizlo@apple.com>
1293
1294         DFG should be able to handle variables getting captured
1295         https://bugs.webkit.org/show_bug.cgi?id=79469
1296
1297         Reviewed by Oliver Hunt.
1298
1299         Made captured variables work by placing a Flush on the SetLocal and
1300         forcing the emission of the GetLocal even if copy propagation tells us
1301         who has the value.
1302
1303         Changed the CFA and various prediction codes to understand that we can't
1304         really prove anything about captured variables. Well, we could in the
1305         future by just looking at what side effects are happening, but in this
1306         first cut we just assume that we can't reason about captured variables.
1307
1308         Also added a mode where the DFG pretends that all variables and arguments
1309         got captured. Used this mode to harden the code.
1310
1311         This is performance neutral. Capturing all variables is a slow down, but
1312         not too big of one. This seems to predict that when we add activation
1313         support, the amount of speed benefit we'll get from increased coverage
1314         will far outweigh the pessimism that we'll have to endure for captured
1315         variables.
1316
1317         * bytecode/CodeType.h:
1318         (JSC::codeTypeToString):
1319         * dfg/DFGAbstractState.cpp:
1320         (JSC::DFG::AbstractState::initialize):
1321         (JSC::DFG::AbstractState::endBasicBlock):
1322         (JSC::DFG::AbstractState::execute):
1323         (JSC::DFG::AbstractState::merge):
1324         * dfg/DFGAbstractState.h:
1325         (AbstractState):
1326         * dfg/DFGByteCodeParser.cpp:
1327         (JSC::DFG::ByteCodeParser::getLocal):
1328         (JSC::DFG::ByteCodeParser::setLocal):
1329         (JSC::DFG::ByteCodeParser::getArgument):
1330         (JSC::DFG::ByteCodeParser::setArgument):
1331         (JSC::DFG::ByteCodeParser::flushArgument):
1332         (JSC::DFG::ByteCodeParser::handleInlining):
1333         (JSC::DFG::ByteCodeParser::processPhiStack):
1334         (JSC::DFG::ByteCodeParser::parseCodeBlock):
1335         (JSC::DFG::ByteCodeParser::parse):
1336         * dfg/DFGCapabilities.h:
1337         (JSC::DFG::mightInlineFunctionForCall):
1338         (JSC::DFG::mightInlineFunctionForConstruct):
1339         * dfg/DFGCommon.h:
1340         * dfg/DFGGraph.h:
1341         (JSC::DFG::Graph::needsActivation):
1342         (Graph):
1343         (JSC::DFG::Graph::argumentIsCaptured):
1344         (JSC::DFG::Graph::localIsCaptured):
1345         (JSC::DFG::Graph::isCaptured):
1346         * dfg/DFGNode.h:
1347         (JSC::DFG::Node::shouldGenerate):
1348         * dfg/DFGPredictionPropagationPhase.cpp:
1349         (JSC::DFG::PredictionPropagationPhase::propagate):
1350         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
1351         * dfg/DFGSpeculativeJIT.cpp:
1352         (DFG):
1353         (JSC::DFG::ValueSource::dump):
1354         (JSC::DFG::SpeculativeJIT::compile):
1355         * dfg/DFGSpeculativeJIT.h:
1356         (ValueSource):
1357         * dfg/DFGSpeculativeJIT32_64.cpp:
1358         (JSC::DFG::SpeculativeJIT::compile):
1359         * dfg/DFGSpeculativeJIT64.cpp:
1360         (JSC::DFG::SpeculativeJIT::compile):
1361         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
1362         (JSC::DFG::VirtualRegisterAllocationPhase::run):
1363
1364 2012-02-24  Gavin Barraclough  <barraclough@apple.com>
1365
1366         Should not allow malformed \x escapes
1367         https://bugs.webkit.org/show_bug.cgi?id=79462
1368
1369         Reviewed by Oliver Hunt.
1370
1371         * parser/Lexer.cpp:
1372         (JSC::::parseString):
1373         (JSC::::parseStringSlowCase):
1374             - Prohibit malformed '\x' escapes
1375         * tests/mozilla/ecma/Array/15.4.5.1-1.js:
1376         * tests/mozilla/ecma/LexicalConventions/7.7.4.js:
1377         * tests/mozilla/ecma_2/RegExp/hex-001.js:
1378         * tests/mozilla/js1_2/regexp/hexadecimal.js:
1379             - Remove erroneous test cases (correct behaviour is tested by LayoutTests/sputnik).
1380
1381 2012-02-24  Daniel Bates  <dbates@webkit.org>
1382
1383         Fix change log entry for changeset r108819; add bug URL
1384         https://bugs.webkit.org/show_bug.cgi?id=79504
1385
1386         Changeset r108819 is associated with bug #79504.
1387
1388         * ChangeLog
1389
1390 2012-02-24  Daniel Bates  <dbates@webkit.org>
1391
1392         Substitute ENABLE(CLASSIC_INTERPRETER) for ENABLE(INTERPRETER) in Interpreter.cpp
1393         https://bugs.webkit.org/show_bug.cgi?id=79504
1394
1395         Reviewed by Oliver Hunt.
1396
1397         There are a few places in Interpreter.cpp that need to be updated to use
1398         ENABLE(CLASSIC_INTERPRETER) following the renaming of ENABLE_INTERPRETER to
1399         ENABLE_CLASSIC_INTERPRETER in changeset <http://trac.webkit.org/changeset/108020>
1400         (https://bugs.webkit.org/show_bug.cgi?id=78791).
1401
1402         * interpreter/Interpreter.cpp:
1403         (JSC::getLineNumberForCallFrame):
1404         (JSC::getCallerInfo):
1405         (JSC::getSourceURLFromCallFrame):
1406
1407 2012-02-24  Adam Roben  <aroben@apple.com>
1408
1409         Undo the BUILDING_WTF part of r108808
1410
1411         This broke the build, which is obviously worse than the linker warning it was trying to
1412         solve.
1413
1414         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
1415
1416 2012-02-24  Adam Roben  <aroben@apple.com>
1417
1418         Fix linker warnings on Windows
1419
1420         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed symbols that are already
1421         exported via JS_EXPORTDATA.
1422
1423         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Define BUILDING_WTF. We
1424         aren't actually building WTF, but we are statically linking it, so we need to define this
1425         symbol so that we export WTF's exports.
1426
1427 2012-02-24  Philippe Normand  <pnormand@igalia.com>
1428
1429         Fix GTK WebAudio build for WebKitGTK 1.7.90.
1430
1431         Patch by Priit Laes <plaes@plaes.org> on 2012-02-24
1432         Rubber-stamped by Philippe Normand.
1433
1434         * GNUmakefile.list.am: Add Complex.h to the list of files so it
1435         gets disted in the tarballs.
1436
1437 2012-02-24  Zoltan Herczeg  <zherczeg@webkit.org>
1438
1439         [Qt] Buildfix for "Zero out CopiedBlocks on initialization".
1440         https://bugs.webkit.org/show_bug.cgi?id=79199
1441
1442         Ruber stamped by Csaba Osztrogonác.
1443
1444         Temporary fix since the new member wastes a little space on
1445         64 bit systems. Although it is harmless, it is only needed
1446         for 32 bit systems.
1447
1448         * heap/CopiedBlock.h:
1449         (CopiedBlock):
1450
1451 2012-02-24  Han Hojong  <hojong.han@samsung.com>
1452
1453         Remove useless jump instructions for short circuit
1454         https://bugs.webkit.org/show_bug.cgi?id=75602
1455
1456         Reviewed by Michael Saboff.
1457
1458         Jump instruction is inserted to make short circuit,
1459         however it does nothing but moving to the next instruction.
1460         Therefore useless jump instructions are removed,
1461         and jump list is moved into the case not for a short circuit,
1462         so that only necessary instructions are added to JIT code
1463         unless it has a 16 bit pattern character and an 8 bit string.
1464
1465         * yarr/YarrJIT.cpp:
1466         (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
1467         (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
1468
1469 2012-02-24  Sheriff Bot  <webkit.review.bot@gmail.com>
1470
1471         Unreviewed, rolling out r108731.
1472         http://trac.webkit.org/changeset/108731
1473         https://bugs.webkit.org/show_bug.cgi?id=79464
1474
1475         Broke Chromium Win tests (Requested by bashi on #webkit).
1476
1477         * wtf/Platform.h:
1478
1479 2012-02-24  Andrew Lo  <anlo@rim.com>
1480
1481         [BlackBerry] Enable requestAnimationFrame
1482         https://bugs.webkit.org/show_bug.cgi?id=79408
1483
1484         Use timer implementation of requestAnimationFrame on BlackBerry.
1485
1486         Reviewed by Rob Buis.
1487
1488         * wtf/Platform.h:
1489
1490 2012-02-24  Mathias Bynens  <mathias@qiwi.be>
1491
1492         `\u200c` and `\u200d` should be allowed in IdentifierPart, as per ES5
1493         https://bugs.webkit.org/show_bug.cgi?id=78908
1494
1495         Add additional checks for zero-width non-joiner (0x200C) and
1496         zero-width joiner (0x200D) characters.
1497
1498         Reviewed by Michael Saboff.
1499
1500         * parser/Lexer.cpp:
1501         (JSC::isNonASCIIIdentPart)
1502         * runtime/LiteralParser.cpp:
1503         (JSC::::Lexer::lexIdentifier)
1504
1505 2012-02-23  Kenichi Ishibashi  <bashi@chromium.org>
1506
1507         Adding WebSocket per-frame DEFLATE extension
1508         https://bugs.webkit.org/show_bug.cgi?id=77522
1509
1510         Added USE(ZLIB) flag.
1511
1512         Reviewed by Kent Tamura.
1513
1514         * wtf/Platform.h:
1515
1516 2012-02-23  Mark Hahnenberg  <mhahnenberg@apple.com>
1517
1518         Zero out CopiedBlocks on initialization
1519         https://bugs.webkit.org/show_bug.cgi?id=79199
1520
1521         Reviewed by Filip Pizlo.
1522
1523         Made CopyBlocks zero their payloads during construction. This allows
1524         JSArray to avoid having to manually clear its backing store upon allocation
1525         and also alleviates any future pain with regard to the garbage collector trying
1526         to mark what it thinks are values in what is actually uninitialized memory.
1527
1528         * heap/CopiedBlock.h:
1529         (JSC::CopiedBlock::CopiedBlock):
1530         * runtime/JSArray.cpp:
1531         (JSC::JSArray::finishCreation):
1532         (JSC::JSArray::tryFinishCreationUninitialized):
1533         (JSC::JSArray::increaseVectorLength):
1534         (JSC::JSArray::unshiftCountSlowCase):
1535
1536 2012-02-23  Oliver Hunt  <oliver@apple.com>
1537
1538         Make Interpreter::getStackTrace be able to generate the line number for the top callframe if none is provided
1539         https://bugs.webkit.org/show_bug.cgi?id=79407
1540
1541         Reviewed by Gavin Barraclough.
1542
1543         Outside of exception handling, we don't know what our source line number is.  This
1544         change allows us to pass -1 is as the initial line number, and get the correct line
1545         number in the resultant stack trace.  We can't completely elide the initial line
1546         number (yet) due to some idiosyncrasies of the exception handling machinery.
1547
1548         * interpreter/Interpreter.cpp:
1549         (JSC::getLineNumberForCallFrame):
1550         (JSC):
1551         (JSC::Interpreter::getStackTrace):
1552
1553 2012-02-22  Filip Pizlo  <fpizlo@apple.com>
1554
1555         DFG OSR exit value profiling should have graceful handling of local variables and arguments
1556         https://bugs.webkit.org/show_bug.cgi?id=79310
1557
1558         Reviewed by Gavin Barraclough.
1559
1560         Previously, if we OSR exited because a prediction in a local was wrong, we'd
1561         only realize what the true type of the local was if the regular value profiling
1562         kicked in and told us. Unless the local was block-locally copy propagated, in
1563         which case we'd know from an OSR exit profile.
1564
1565         This patch adds OSR exit profiling to all locals and arguments. Now, if we OSR
1566         exit because of a mispredicted local or argument type, we'll know what the type of
1567         the local or argument should be immediately upon exiting.
1568
1569         The way that local variable OSR exit profiling works is that we now have a lazily
1570         added set of OSR-exit-only value profiles for exit sites that are BadType and that
1571         cited a GetLocal as their value source. The value profiles are only added if the
1572         OSR exit is taken, and are keyed by CodeBlock, bytecode index of the GetLocal, and
1573         operand. The look-up is performed by querying the
1574         CompressedLazyOperandValueProfileHolder in the CodeBlock, using a key that contains
1575         the bytecode index and the operand. Because the value profiles are added at random
1576         times, they are not sorted; instead they are just stored in an arbitrarily-ordered
1577         SegmentedVector. Look-ups are made fast by "decompressing": the DFG::ByteCodeParser
1578         creates a LazyOperandValueProfileParser, which turns the
1579         CompressedLazyOperandValueProfileHolder's contents into a HashMap for the duration
1580         of DFG parsing.
1581
1582         Previously, OSR exits had a pointer to the ValueProfile that had the specFailBucket
1583         into which values observed during OSR exit would be placed. Now it uses a lazy
1584         thunk for a ValueProfile. I call this the MethodOfGettingAValueProfile. It may
1585         either contain a ValueProfile inside it (which works for previous uses of OSR exit
1586         profiling) or it may just have knowledge of how to go about creating the
1587         LazyOperandValueProfile in the case that the OSR exit is actually taken. This
1588         ensures that we never have to create NumOperands*NumBytecodeIndices*NumCodeBlocks
1589         value profiling buckets unless we actually did OSR exit on every single operand,
1590         in every single instruction, in each code block (that's probably unlikely).
1591
1592         This appears to be neutral on the major benchmarks, but is a double-digit speed-up
1593         on code deliberately written to have data flow that spans basic blocks and where
1594         the code exhibits post-optimization polymorphism in a local variable.
1595
1596         * CMakeLists.txt:
1597         * GNUmakefile.list.am:
1598         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1599         * JavaScriptCore.xcodeproj/project.pbxproj:
1600         * Target.pri:
1601         * bytecode/CodeBlock.cpp:
1602         (JSC::CodeBlock::stronglyVisitStrongReferences):
1603         * bytecode/CodeBlock.h:
1604         (CodeBlock):
1605         (JSC::CodeBlock::lazyOperandValueProfiles):
1606         * bytecode/LazyOperandValueProfile.cpp: Added.
1607         (JSC):
1608         (JSC::CompressedLazyOperandValueProfileHolder::CompressedLazyOperandValueProfileHolder):
1609         (JSC::CompressedLazyOperandValueProfileHolder::~CompressedLazyOperandValueProfileHolder):
1610         (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
1611         (JSC::CompressedLazyOperandValueProfileHolder::add):
1612         (JSC::LazyOperandValueProfileParser::LazyOperandValueProfileParser):
1613         (JSC::LazyOperandValueProfileParser::~LazyOperandValueProfileParser):
1614         (JSC::LazyOperandValueProfileParser::getIfPresent):
1615         (JSC::LazyOperandValueProfileParser::prediction):
1616         * bytecode/LazyOperandValueProfile.h: Added.
1617         (JSC):
1618         (LazyOperandValueProfileKey):
1619         (JSC::LazyOperandValueProfileKey::LazyOperandValueProfileKey):
1620         (JSC::LazyOperandValueProfileKey::operator!):
1621         (JSC::LazyOperandValueProfileKey::operator==):
1622         (JSC::LazyOperandValueProfileKey::hash):
1623         (JSC::LazyOperandValueProfileKey::bytecodeOffset):
1624         (JSC::LazyOperandValueProfileKey::operand):
1625         (JSC::LazyOperandValueProfileKey::isHashTableDeletedValue):
1626         (JSC::LazyOperandValueProfileKeyHash::hash):
1627         (JSC::LazyOperandValueProfileKeyHash::equal):
1628         (LazyOperandValueProfileKeyHash):
1629         (WTF):
1630         (JSC::LazyOperandValueProfile::LazyOperandValueProfile):
1631         (LazyOperandValueProfile):
1632         (JSC::LazyOperandValueProfile::key):
1633         (CompressedLazyOperandValueProfileHolder):
1634         (LazyOperandValueProfileParser):
1635         * bytecode/MethodOfGettingAValueProfile.cpp: Added.
1636         (JSC):
1637         (JSC::MethodOfGettingAValueProfile::fromLazyOperand):
1638         (JSC::MethodOfGettingAValueProfile::getSpecFailBucket):
1639         * bytecode/MethodOfGettingAValueProfile.h: Added.
1640         (JSC):
1641         (MethodOfGettingAValueProfile):
1642         (JSC::MethodOfGettingAValueProfile::MethodOfGettingAValueProfile):
1643         (JSC::MethodOfGettingAValueProfile::operator!):
1644         * bytecode/ValueProfile.cpp: Removed.
1645         * bytecode/ValueProfile.h:
1646         (JSC):
1647         (ValueProfileBase):
1648         (JSC::ValueProfileBase::ValueProfileBase):
1649         (JSC::ValueProfileBase::dump):
1650         (JSC::ValueProfileBase::computeUpdatedPrediction):
1651         (JSC::MinimalValueProfile::MinimalValueProfile):
1652         (ValueProfileWithLogNumberOfBuckets):
1653         (JSC::ValueProfileWithLogNumberOfBuckets::ValueProfileWithLogNumberOfBuckets):
1654         (JSC::ValueProfile::ValueProfile):
1655         (JSC::getValueProfileBytecodeOffset):
1656         (JSC::getRareCaseProfileBytecodeOffset):
1657         * dfg/DFGByteCodeParser.cpp:
1658         (ByteCodeParser):
1659         (JSC::DFG::ByteCodeParser::injectLazyOperandPrediction):
1660         (JSC::DFG::ByteCodeParser::getLocal):
1661         (JSC::DFG::ByteCodeParser::getArgument):
1662         (InlineStackEntry):
1663         (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions):
1664         (DFG):
1665         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
1666         (JSC::DFG::ByteCodeParser::parse):
1667         * dfg/DFGDriver.cpp:
1668         (JSC::DFG::compile):
1669         * dfg/DFGGraph.h:
1670         (JSC::DFG::Graph::valueProfileFor):
1671         (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
1672         (Graph):
1673         * dfg/DFGNode.h:
1674         (Node):
1675         * dfg/DFGOSRExit.cpp:
1676         (JSC::DFG::OSRExit::OSRExit):
1677         * dfg/DFGOSRExit.h:
1678         (OSRExit):
1679         * dfg/DFGOSRExitCompiler32_64.cpp:
1680         (JSC::DFG::OSRExitCompiler::compileExit):
1681         * dfg/DFGOSRExitCompiler64.cpp:
1682         (JSC::DFG::OSRExitCompiler::compileExit):
1683         * dfg/DFGPhase.cpp:
1684         (JSC::DFG::Phase::beginPhase):
1685         (JSC::DFG::Phase::endPhase):
1686         * dfg/DFGSpeculativeJIT.cpp:
1687         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
1688         * dfg/DFGSpeculativeJIT.h:
1689         (JSC::DFG::SpeculativeJIT::speculationCheck):
1690         * dfg/DFGVariableAccessData.h:
1691         (JSC::DFG::VariableAccessData::nonUnifiedPrediction):
1692         (VariableAccessData):
1693
1694 2012-02-23  Filip Pizlo  <fpizlo@apple.com>
1695
1696         Build fix.
1697
1698         * llint/LLIntOffsetsExtractor.cpp:
1699
1700 2012-02-23  Kevin Ollivier  <kevino@theolliviers.com>
1701
1702         [wx] Build fix, disable LLINT for now and fix ENABLE defines for it.
1703
1704         * llint/LLIntOffsetsExtractor.cpp:
1705         * wtf/Platform.h:
1706
1707 2012-02-23  Kevin Ollivier  <kevino@theolliviers.com>
1708
1709         [wx] Build fix for non-Mac wx builds.
1710
1711         * runtime/DatePrototype.cpp:
1712
1713 2012-02-22  Filip Pizlo  <fpizlo@apple.com>
1714
1715         DFG's logic for emitting a Flush is too convoluted and contains an inaccurate comment
1716         https://bugs.webkit.org/show_bug.cgi?id=79334
1717
1718         Reviewed by Oliver Hunt.
1719
1720         * dfg/DFGByteCodeParser.cpp:
1721         (JSC::DFG::ByteCodeParser::getLocal):
1722         (JSC::DFG::ByteCodeParser::getArgument):
1723         (JSC::DFG::ByteCodeParser::flush):
1724
1725 2012-02-23  Gavin Barraclough  <barraclough@apple.com>
1726
1727         Object.isSealed / Object.isFrozen don't work for native objects
1728         https://bugs.webkit.org/show_bug.cgi?id=79331
1729
1730         Reviewed by Sam Weinig.
1731
1732         Need to inspect all properties, including static ones.
1733         This exposes a couple of bugs in Array & Arguments:
1734             - getOwnPropertyDescriptor doesn't correctly report the writable attribute of array length.
1735             - Arguments object's defineOwnProperty does not handle callee/caller/length correctly.
1736
1737         * runtime/Arguments.cpp:
1738         (JSC::Arguments::defineOwnProperty):
1739             - Add handling for callee/caller/length.
1740         * runtime/JSArray.cpp:
1741         (JSC::JSArray::getOwnPropertyDescriptor):
1742             - report length's writability correctly.
1743         * runtime/ObjectConstructor.cpp:
1744         (JSC::objectConstructorSeal):
1745         (JSC::objectConstructorFreeze):
1746         (JSC::objectConstructorIsSealed):
1747         (JSC::objectConstructorIsFrozen):
1748             - Add spec-based implementation for non-final objects.
1749
1750 2012-02-23  Gavin Barraclough  <barraclough@apple.com>
1751
1752         pop of array hole should get from the prototype chain
1753         https://bugs.webkit.org/show_bug.cgi?id=79338
1754
1755         Reviewed by Sam Weinig.
1756
1757         * runtime/JSArray.cpp:
1758         (JSC::JSArray::pop):
1759             - If the fast fast vector case fails, more closely follow the spec.
1760
1761 2012-02-23  Yong Li  <yoli@rim.com>
1762
1763         JSString::outOfMemory() should ASSERT(isRope()) rather than !isRope()
1764         https://bugs.webkit.org/show_bug.cgi?id=79268
1765
1766         Reviewed by Michael Saboff.
1767
1768         resolveRope() is the only caller of outOfMemory(), and it calls outOfMemory()
1769         after it fails to allocate a buffer for m_value. So outOfMemory() should assert
1770         isRope() rather than !isRope().
1771
1772         * runtime/JSString.cpp:
1773         (JSC::JSString::outOfMemory):
1774
1775 2012-02-23  Patrick Gansterer  <paroga@webkit.org>
1776
1777         [CMake] Add WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS macro
1778         https://bugs.webkit.org/show_bug.cgi?id=79371
1779
1780         Reviewed by Daniel Bates.
1781
1782         * CMakeLists.txt:
1783         * shell/CMakeLists.txt:
1784         * wtf/CMakeLists.txt:
1785
1786 2012-02-23  Aron Rosenberg  <arosenberg@logitech.com>
1787
1788         Fix the PRI macros used in WTF::String formatters to be compatible with Qt and Visual Studio 2005 and newer.
1789         https://bugs.webkit.org/show_bug.cgi?id=76210
1790
1791         Add compile time check for Visual Studio 2005 or newer.
1792
1793         Reviewed by Simon Hausmann.
1794
1795         * os-win32/inttypes.h:
1796
1797 2012-02-22  Gavin Barraclough  <barraclough@apple.com>
1798
1799         Implement [[DefineOwnProperty]] for the arguments object
1800         https://bugs.webkit.org/show_bug.cgi?id=79309
1801
1802         Reviewed by Sam Weinig.
1803
1804         * runtime/Arguments.cpp:
1805         (JSC::Arguments::deletePropertyByIndex):
1806         (JSC::Arguments::deleteProperty):
1807             - Deleting an argument should also delete the copy on the object, if any.
1808         (JSC::Arguments::defineOwnProperty):
1809             - Defining a property may override the live mapping.
1810         * runtime/Arguments.h:
1811         (Arguments):
1812
1813 2012-02-22  Gavin Barraclough  <barraclough@apple.com>
1814
1815         Fix Object.freeze for non-final objects.
1816         https://bugs.webkit.org/show_bug.cgi?id=79286
1817
1818         Reviewed by Oliver Hunt.
1819
1820         For vanilla objects we implement this with a single transition, for objects
1821         with special properties we should just follow the spec defined algorithm.
1822
1823         * runtime/JSArray.cpp:
1824         (JSC::SparseArrayValueMap::put):
1825             - this does need to handle inextensible objects.
1826         * runtime/ObjectConstructor.cpp:
1827         (JSC::objectConstructorSeal):
1828         (JSC::objectConstructorFreeze):
1829             - Implement spec defined algorithm for non-final objects.
1830         * runtime/Structure.cpp:
1831         (JSC::Structure::Structure):
1832         (JSC::Structure::freezeTransition):
1833             - freeze should set m_hasReadOnlyOrGetterSetterPropertiesExcludingProto.
1834         * runtime/Structure.h:
1835         (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
1836         (JSC::Structure::setHasGetterSetterProperties):
1837         (JSC::Structure::setContainsReadOnlyProperties):
1838         (Structure):
1839             - renamed m_hasReadOnlyOrGetterSetterPropertiesExcludingProto.
1840
1841 2012-02-22  Mark Hahnenberg  <mhahnenberg@apple.com>
1842
1843         Allocations from CopiedBlocks should always be 8-byte aligned
1844         https://bugs.webkit.org/show_bug.cgi?id=79271
1845
1846         Reviewed by Geoffrey Garen.
1847
1848         * heap/CopiedAllocator.h:
1849         (JSC::CopiedAllocator::allocate):
1850         * heap/CopiedBlock.h: Changed to add padding so that the start of the payload is always
1851         guaranteed to be 8 byte aligned on both 64- and 32-bit platforms.
1852         (CopiedBlock):
1853         * heap/CopiedSpace.cpp: Changed all assertions of isPointerAligned to is8ByteAligned.
1854         (JSC::CopiedSpace::tryAllocateOversize):
1855         (JSC::CopiedSpace::getFreshBlock):
1856         * heap/CopiedSpaceInlineMethods.h:
1857         (JSC::CopiedSpace::allocateFromBlock):
1858         * runtime/JSArray.h:
1859         (ArrayStorage): Added padding for ArrayStorage to make sure that it is always 8 byte
1860         aligned on both 64- and 32-bit platforms.
1861         * wtf/StdLibExtras.h:
1862         (WTF::is8ByteAligned): Added new utility function that functions similarly to the
1863         way isPointerAligned does, but it just always checks for 8 byte alignment.
1864         (WTF):
1865
1866 2012-02-22  Sheriff Bot  <webkit.review.bot@gmail.com>
1867
1868         Unreviewed, rolling out r108456.
1869         http://trac.webkit.org/changeset/108456
1870         https://bugs.webkit.org/show_bug.cgi?id=79223
1871
1872         Broke fast/regex/pcre-test-4.html and cannot find anyone on
1873         IRC (Requested by zherczeg on #webkit).
1874
1875         * yarr/YarrJIT.cpp:
1876         (JSC::Yarr::YarrGenerator::backtrackPatternCharacterGreedy):
1877
1878 2012-02-22  Sheriff Bot  <webkit.review.bot@gmail.com>
1879
1880         Unreviewed, rolling out r108468.
1881         http://trac.webkit.org/changeset/108468
1882         https://bugs.webkit.org/show_bug.cgi?id=79219
1883
1884         Broke Chromium Win release build (Requested by bashi on
1885         #webkit).
1886
1887         * wtf/Platform.h:
1888
1889 2012-02-22  Kenichi Ishibashi  <bashi@chromium.org>
1890
1891         Adding WebSocket per-frame DEFLATE extension
1892         https://bugs.webkit.org/show_bug.cgi?id=77522
1893
1894         Added USE(ZLIB) flag.
1895
1896         Reviewed by Kent Tamura.
1897
1898         * wtf/Platform.h:
1899
1900 2012-02-22  Hojong Han  <hojong.han@samsung.com>
1901
1902         Short circuit fixed for a 16 bt pattern character and an 8 bit string.
1903         https://bugs.webkit.org/show_bug.cgi?id=75602
1904
1905         Reviewed by Gavin Barraclough.
1906
1907         * yarr/YarrJIT.cpp:
1908         (JSC::Yarr::YarrGenerator::backtrackPatternCharacterGreedy):
1909
1910 2012-02-21  Filip Pizlo  <fpizlo@apple.com>
1911
1912         Build fix for systems with case sensitive disks.
1913
1914         * llint/LLIntOfflineAsmConfig.h:
1915
1916 2012-02-21  Filip Pizlo  <fpizlo@apple.com>
1917
1918         JSC should be a triple-tier VM
1919         https://bugs.webkit.org/show_bug.cgi?id=75812
1920         <rdar://problem/10079694>
1921
1922         Reviewed by Gavin Barraclough.
1923
1924         Implemented an interpreter that uses the JIT's calling convention. This
1925         interpreter is called LLInt, or the Low Level Interpreter. JSC will now
1926         will start by executing code in LLInt and will only tier up to the old
1927         JIT after the code is proven hot.
1928
1929         LLInt is written in a modified form of our macro assembly. This new macro
1930         assembly is compiled by an offline assembler (see offlineasm), which
1931         implements many modern conveniences such as a Turing-complete CPS-based
1932         macro language and direct access to relevant C++ type information
1933         (basically offsets of fields and sizes of structs/classes).
1934
1935         Code executing in LLInt appears to the rest of the JSC world "as if" it
1936         were executing in the old JIT. Hence, things like exception handling and
1937         cross-execution-engine calls just work and require pretty much no
1938         additional overhead.
1939
1940         This interpreter is 2-2.5x faster than our old interpreter on SunSpider,
1941         V8, and Kraken. With triple-tiering turned on, we're neutral on SunSpider,
1942         V8, and Kraken, but appear to get a double-digit improvement on real-world
1943         websites due to a huge reduction in the amount of JIT'ing.
1944
1945         * CMakeLists.txt:
1946         * GNUmakefile.am:
1947         * GNUmakefile.list.am:
1948         * JavaScriptCore.pri:
1949         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1950         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
1951         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
1952         * JavaScriptCore.xcodeproj/project.pbxproj:
1953         * Target.pri:
1954         * assembler/LinkBuffer.h:
1955         * assembler/MacroAssemblerCodeRef.h:
1956         (MacroAssemblerCodePtr):
1957         (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
1958         * bytecode/BytecodeConventions.h: Added.
1959         * bytecode/CallLinkStatus.cpp:
1960         (JSC::CallLinkStatus::computeFromLLInt):
1961         (JSC):
1962         (JSC::CallLinkStatus::computeFor):
1963         * bytecode/CallLinkStatus.h:
1964         (JSC::CallLinkStatus::isSet):
1965         (JSC::CallLinkStatus::operator!):
1966         (CallLinkStatus):
1967         * bytecode/CodeBlock.cpp:
1968         (JSC::CodeBlock::dump):
1969         (JSC::CodeBlock::CodeBlock):
1970         (JSC::CodeBlock::~CodeBlock):
1971         (JSC::CodeBlock::finalizeUnconditionally):
1972         (JSC::CodeBlock::stronglyVisitStrongReferences):
1973         (JSC):
1974         (JSC::CodeBlock::unlinkCalls):
1975         (JSC::CodeBlock::unlinkIncomingCalls):
1976         (JSC::CodeBlock::bytecodeOffset):
1977         (JSC::ProgramCodeBlock::jettison):
1978         (JSC::EvalCodeBlock::jettison):
1979         (JSC::FunctionCodeBlock::jettison):
1980         (JSC::ProgramCodeBlock::jitCompileImpl):
1981         (JSC::EvalCodeBlock::jitCompileImpl):
1982         (JSC::FunctionCodeBlock::jitCompileImpl):
1983         * bytecode/CodeBlock.h:
1984         (JSC):
1985         (CodeBlock):
1986         (JSC::CodeBlock::baselineVersion):
1987         (JSC::CodeBlock::linkIncomingCall):
1988         (JSC::CodeBlock::bytecodeOffset):
1989         (JSC::CodeBlock::jitCompile):
1990         (JSC::CodeBlock::hasOptimizedReplacement):
1991         (JSC::CodeBlock::addPropertyAccessInstruction):
1992         (JSC::CodeBlock::addGlobalResolveInstruction):
1993         (JSC::CodeBlock::addLLIntCallLinkInfo):
1994         (JSC::CodeBlock::addGlobalResolveInfo):
1995         (JSC::CodeBlock::numberOfMethodCallLinkInfos):
1996         (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
1997         (JSC::CodeBlock::likelyToTakeSlowCase):
1998         (JSC::CodeBlock::couldTakeSlowCase):
1999         (JSC::CodeBlock::likelyToTakeSpecialFastCase):
2000         (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
2001         (JSC::CodeBlock::likelyToTakeAnySlowCase):
2002         (JSC::CodeBlock::addFrequentExitSite):
2003         (JSC::CodeBlock::dontJITAnytimeSoon):
2004         (JSC::CodeBlock::jitAfterWarmUp):
2005         (JSC::CodeBlock::jitSoon):
2006         (JSC::CodeBlock::llintExecuteCounter):
2007         (ProgramCodeBlock):
2008         (EvalCodeBlock):
2009         (FunctionCodeBlock):
2010         * bytecode/GetByIdStatus.cpp:
2011         (JSC::GetByIdStatus::computeFromLLInt):
2012         (JSC):
2013         (JSC::GetByIdStatus::computeFor):
2014         * bytecode/GetByIdStatus.h:
2015         (JSC::GetByIdStatus::GetByIdStatus):
2016         (JSC::GetByIdStatus::wasSeenInJIT):
2017         (GetByIdStatus):
2018         * bytecode/Instruction.h:
2019         (JSC):
2020         (JSC::Instruction::Instruction):
2021         (Instruction):
2022         * bytecode/LLIntCallLinkInfo.h: Added.
2023         (JSC):
2024         (JSC::LLIntCallLinkInfo::LLIntCallLinkInfo):
2025         (LLIntCallLinkInfo):
2026         (JSC::LLIntCallLinkInfo::~LLIntCallLinkInfo):
2027         (JSC::LLIntCallLinkInfo::isLinked):
2028         (JSC::LLIntCallLinkInfo::unlink):
2029         * bytecode/MethodCallLinkStatus.cpp:
2030         (JSC::MethodCallLinkStatus::computeFor):
2031         * bytecode/Opcode.cpp:
2032         (JSC):
2033         * bytecode/Opcode.h:
2034         (JSC):
2035         (JSC::padOpcodeName):
2036         * bytecode/PutByIdStatus.cpp:
2037         (JSC::PutByIdStatus::computeFromLLInt):
2038         (JSC):
2039         (JSC::PutByIdStatus::computeFor):
2040         * bytecode/PutByIdStatus.h:
2041         (PutByIdStatus):
2042         * bytecompiler/BytecodeGenerator.cpp:
2043         (JSC::BytecodeGenerator::emitResolve):
2044         (JSC::BytecodeGenerator::emitResolveWithBase):
2045         (JSC::BytecodeGenerator::emitGetById):
2046         (JSC::BytecodeGenerator::emitPutById):
2047         (JSC::BytecodeGenerator::emitDirectPutById):
2048         (JSC::BytecodeGenerator::emitCall):
2049         (JSC::BytecodeGenerator::emitConstruct):
2050         (JSC::BytecodeGenerator::emitCatch):
2051         * dfg/DFGByteCodeParser.cpp:
2052         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
2053         (JSC::DFG::ByteCodeParser::handleInlining):
2054         (JSC::DFG::ByteCodeParser::parseBlock):
2055         * dfg/DFGCapabilities.h:
2056         (JSC::DFG::canCompileOpcode):
2057         * dfg/DFGOSRExitCompiler.cpp:
2058         * dfg/DFGOperations.cpp:
2059         * heap/Heap.h:
2060         (JSC):
2061         (JSC::Heap::firstAllocatorWithoutDestructors):
2062         (Heap):
2063         * heap/MarkStack.cpp:
2064         (JSC::visitChildren):
2065         * heap/MarkedAllocator.h:
2066         (JSC):
2067         (MarkedAllocator):
2068         * heap/MarkedSpace.h:
2069         (JSC):
2070         (MarkedSpace):
2071         (JSC::MarkedSpace::firstAllocator):
2072         * interpreter/CallFrame.cpp:
2073         (JSC):
2074         (JSC::CallFrame::bytecodeOffsetForNonDFGCode):
2075         (JSC::CallFrame::setBytecodeOffsetForNonDFGCode):
2076         (JSC::CallFrame::currentVPC):
2077         (JSC::CallFrame::setCurrentVPC):
2078         (JSC::CallFrame::trueCallerFrame):
2079         * interpreter/CallFrame.h:
2080         (JSC::ExecState::hasReturnPC):
2081         (JSC::ExecState::clearReturnPC):
2082         (ExecState):
2083         (JSC::ExecState::bytecodeOffsetForNonDFGCode):
2084         (JSC::ExecState::currentVPC):
2085         (JSC::ExecState::setCurrentVPC):
2086         * interpreter/Interpreter.cpp:
2087         (JSC::Interpreter::Interpreter):
2088         (JSC::Interpreter::~Interpreter):
2089         (JSC):
2090         (JSC::Interpreter::initialize):
2091         (JSC::Interpreter::isOpcode):
2092         (JSC::Interpreter::unwindCallFrame):
2093         (JSC::getCallerInfo):
2094         (JSC::Interpreter::privateExecute):
2095         (JSC::Interpreter::retrieveLastCaller):
2096         * interpreter/Interpreter.h:
2097         (JSC):
2098         (Interpreter):
2099         (JSC::Interpreter::getOpcode):
2100         (JSC::Interpreter::getOpcodeID):
2101         (JSC::Interpreter::classicEnabled):
2102         * interpreter/RegisterFile.h:
2103         (JSC):
2104         (RegisterFile):
2105         * jit/ExecutableAllocator.h:
2106         (JSC):
2107         * jit/HostCallReturnValue.cpp: Added.
2108         (JSC):
2109         (JSC::getHostCallReturnValueWithExecState):
2110         * jit/HostCallReturnValue.h: Added.
2111         (JSC):
2112         (JSC::initializeHostCallReturnValue):
2113         * jit/JIT.cpp:
2114         (JSC::JIT::privateCompileMainPass):
2115         (JSC::JIT::privateCompileSlowCases):
2116         (JSC::JIT::privateCompile):
2117         * jit/JITCode.h:
2118         (JSC::JITCode::isOptimizingJIT):
2119         (JITCode):
2120         (JSC::JITCode::isBaselineCode):
2121         (JSC::JITCode::JITCode):
2122         * jit/JITDriver.h:
2123         (JSC::jitCompileIfAppropriate):
2124         (JSC::jitCompileFunctionIfAppropriate):
2125         * jit/JITExceptions.cpp:
2126         (JSC::jitThrow):
2127         * jit/JITInlineMethods.h:
2128         (JSC::JIT::updateTopCallFrame):
2129         * jit/JITStubs.cpp:
2130         (JSC::DEFINE_STUB_FUNCTION):
2131         (JSC):
2132         * jit/JITStubs.h:
2133         (JSC):
2134         * jit/JSInterfaceJIT.h:
2135         * llint: Added.
2136         * llint/LLIntCommon.h: Added.
2137         * llint/LLIntData.cpp: Added.
2138         (LLInt):
2139         (JSC::LLInt::Data::Data):
2140         (JSC::LLInt::Data::performAssertions):
2141         (JSC::LLInt::Data::~Data):
2142         * llint/LLIntData.h: Added.
2143         (JSC):
2144         (LLInt):
2145         (Data):
2146         (JSC::LLInt::Data::exceptionInstructions):
2147         (JSC::LLInt::Data::opcodeMap):
2148         (JSC::LLInt::Data::performAssertions):
2149         * llint/LLIntEntrypoints.cpp: Added.
2150         (LLInt):
2151         (JSC::LLInt::getFunctionEntrypoint):
2152         (JSC::LLInt::getEvalEntrypoint):
2153         (JSC::LLInt::getProgramEntrypoint):
2154         * llint/LLIntEntrypoints.h: Added.
2155         (JSC):
2156         (LLInt):
2157         (JSC::LLInt::getEntrypoint):
2158         * llint/LLIntExceptions.cpp: Added.
2159         (LLInt):
2160         (JSC::LLInt::interpreterThrowInCaller):
2161         (JSC::LLInt::returnToThrowForThrownException):
2162         (JSC::LLInt::returnToThrow):
2163         (JSC::LLInt::callToThrow):
2164         * llint/LLIntExceptions.h: Added.
2165         (JSC):
2166         (LLInt):
2167         * llint/LLIntOfflineAsmConfig.h: Added.
2168         * llint/LLIntOffsetsExtractor.cpp: Added.
2169         (JSC):
2170         (LLIntOffsetsExtractor):
2171         (JSC::LLIntOffsetsExtractor::dummy):
2172         (main):
2173         * llint/LLIntSlowPaths.cpp: Added.
2174         (LLInt):
2175         (JSC::LLInt::llint_trace_operand):
2176         (JSC::LLInt::llint_trace_value):
2177         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2178         (JSC::LLInt::traceFunctionPrologue):
2179         (JSC::LLInt::shouldJIT):
2180         (JSC::LLInt::entryOSR):
2181         (JSC::LLInt::resolveGlobal):
2182         (JSC::LLInt::getByVal):
2183         (JSC::LLInt::handleHostCall):
2184         (JSC::LLInt::setUpCall):
2185         (JSC::LLInt::genericCall):
2186         * llint/LLIntSlowPaths.h: Added.
2187         (JSC):
2188         (LLInt):
2189         * llint/LLIntThunks.cpp: Added.
2190         (LLInt):
2191         (JSC::LLInt::generateThunkWithJumpTo):
2192         (JSC::LLInt::functionForCallEntryThunkGenerator):
2193         (JSC::LLInt::functionForConstructEntryThunkGenerator):
2194         (JSC::LLInt::functionForCallArityCheckThunkGenerator):
2195         (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
2196         (JSC::LLInt::evalEntryThunkGenerator):
2197         (JSC::LLInt::programEntryThunkGenerator):
2198         * llint/LLIntThunks.h: Added.
2199         (JSC):
2200         (LLInt):
2201         * llint/LowLevelInterpreter.asm: Added.
2202         * llint/LowLevelInterpreter.cpp: Added.
2203         * llint/LowLevelInterpreter.h: Added.
2204         * offlineasm: Added.
2205         * offlineasm/armv7.rb: Added.
2206         * offlineasm/asm.rb: Added.
2207         * offlineasm/ast.rb: Added.
2208         * offlineasm/backends.rb: Added.
2209         * offlineasm/generate_offset_extractor.rb: Added.
2210         * offlineasm/instructions.rb: Added.
2211         * offlineasm/offset_extractor_constants.rb: Added.
2212         * offlineasm/offsets.rb: Added.
2213         * offlineasm/opt.rb: Added.
2214         * offlineasm/parser.rb: Added.
2215         * offlineasm/registers.rb: Added.
2216         * offlineasm/self_hash.rb: Added.
2217         * offlineasm/settings.rb: Added.
2218         * offlineasm/transform.rb: Added.
2219         * offlineasm/x86.rb: Added.
2220         * runtime/CodeSpecializationKind.h: Added.
2221         (JSC):
2222         * runtime/CommonSlowPaths.h:
2223         (JSC::CommonSlowPaths::arityCheckFor):
2224         (CommonSlowPaths):
2225         * runtime/Executable.cpp:
2226         (JSC::jettisonCodeBlock):
2227         (JSC):
2228         (JSC::EvalExecutable::jitCompile):
2229         (JSC::samplingDescription):
2230         (JSC::EvalExecutable::compileInternal):
2231         (JSC::ProgramExecutable::jitCompile):
2232         (JSC::ProgramExecutable::compileInternal):
2233         (JSC::FunctionExecutable::baselineCodeBlockFor):
2234         (JSC::FunctionExecutable::jitCompileForCall):
2235         (JSC::FunctionExecutable::jitCompileForConstruct):
2236         (JSC::FunctionExecutable::compileForCallInternal):
2237         (JSC::FunctionExecutable::compileForConstructInternal):
2238         * runtime/Executable.h:
2239         (JSC):
2240         (EvalExecutable):
2241         (ProgramExecutable):
2242         (FunctionExecutable):
2243         (JSC::FunctionExecutable::jitCompileFor):
2244         * runtime/ExecutionHarness.h: Added.
2245         (JSC):
2246         (JSC::prepareForExecution):
2247         (JSC::prepareFunctionForExecution):
2248         * runtime/JSArray.h:
2249         (JSC):
2250         (JSArray):
2251         * runtime/JSCell.h:
2252         (JSC):
2253         (JSCell):
2254         * runtime/JSFunction.h:
2255         (JSC):
2256         (JSFunction):
2257         * runtime/JSGlobalData.cpp:
2258         (JSC::JSGlobalData::JSGlobalData):
2259         * runtime/JSGlobalData.h:
2260         (JSC):
2261         (JSGlobalData):
2262         * runtime/JSGlobalObject.h:
2263         (JSC):
2264         (JSGlobalObject):
2265         * runtime/JSObject.h:
2266         (JSC):
2267         (JSObject):
2268         (JSFinalObject):
2269         * runtime/JSPropertyNameIterator.h:
2270         (JSC):
2271         (JSPropertyNameIterator):
2272         * runtime/JSString.h:
2273         (JSC):
2274         (JSString):
2275         * runtime/JSTypeInfo.h:
2276         (JSC):
2277         (TypeInfo):
2278         * runtime/JSValue.cpp:
2279         (JSC::JSValue::description):
2280         * runtime/JSValue.h:
2281         (LLInt):
2282         (JSValue):
2283         * runtime/JSVariableObject.h:
2284         (JSC):
2285         (JSVariableObject):
2286         * runtime/Options.cpp:
2287         (Options):
2288         (JSC::Options::initializeOptions):
2289         * runtime/Options.h:
2290         (Options):
2291         * runtime/ScopeChain.h:
2292         (JSC):
2293         (ScopeChainNode):
2294         * runtime/Structure.cpp:
2295         (JSC::Structure::addPropertyTransition):
2296         * runtime/Structure.h:
2297         (JSC):
2298         (Structure):
2299         * runtime/StructureChain.h:
2300         (JSC):
2301         (StructureChain):
2302         * wtf/InlineASM.h:
2303         * wtf/Platform.h:
2304         * wtf/SentinelLinkedList.h:
2305         (SentinelLinkedList):
2306         (WTF::SentinelLinkedList::isEmpty):
2307         * wtf/text/StringImpl.h:
2308         (JSC):
2309         (StringImpl):
2310
2311 2012-02-21  Oliver Hunt  <oliver@apple.com>
2312
2313         Unbreak double-typed arrays on ARMv7
2314         https://bugs.webkit.org/show_bug.cgi?id=79177
2315
2316         Reviewed by Gavin Barraclough.
2317
2318         The existing code had completely broken address arithmetic.
2319
2320         * JSCTypedArrayStubs.h:
2321         (JSC):
2322         * assembler/MacroAssemblerARMv7.h:
2323         (JSC::MacroAssemblerARMv7::storeDouble):
2324         (JSC::MacroAssemblerARMv7::storeFloat):
2325
2326 2012-02-21  Gavin Barraclough  <barraclough@apple.com>
2327
2328         Should be able to reconfigure a non-configurable property as read-only
2329         https://bugs.webkit.org/show_bug.cgi?id=79170
2330
2331         Reviewed by Sam Weinig.
2332
2333         See ES5.1 8.12.9 10.a.i - the spec prohibits making a read-only property writable,
2334         but does not inhibit making a writable property read-only.
2335
2336         * runtime/JSGlobalData.cpp:
2337         (JSC::JSGlobalData::JSGlobalData):
2338         * runtime/JSGlobalData.h:
2339         (JSC::JSGlobalData::setInDefineOwnProperty):
2340         (JSGlobalData):
2341         (JSC::JSGlobalData::isInDefineOwnProperty):
2342             - Added flag, tracking whether we are in JSObject::defineOwnProperty.
2343         * runtime/JSObject.cpp:
2344         (JSC::JSObject::deleteProperty):
2345         (DefineOwnPropertyScope):
2346             - Always allow properties to be deleted by DefineOwnProperty - assume it knows what it is doing!
2347         (JSC::DefineOwnPropertyScope::DefineOwnPropertyScope):
2348         (JSC::DefineOwnPropertyScope::~DefineOwnPropertyScope):
2349             - Added RAII helper.
2350         (JSC::JSObject::defineOwnProperty):
2351             - Track on the globalData when we are in this method.
2352
2353 2012-02-21  Oliver Hunt  <oliver@apple.com>
2354
2355         Make TypedArrays be available in commandline jsc
2356         https://bugs.webkit.org/show_bug.cgi?id=79163
2357
2358         Reviewed by Gavin Barraclough.
2359
2360         Adds a compile time option to have jsc support a basic implementation
2361         of the TypedArrays available in WebCore.  This lets us test the typed
2362         array logic in the JIT witout having to build webcore.
2363
2364         * JSCTypedArrayStubs.h: Added.
2365         (JSC):
2366         * JavaScriptCore.xcodeproj/project.pbxproj:
2367         * jsc.cpp:
2368         (GlobalObject::finishCreation):
2369         (GlobalObject):
2370         (GlobalObject::addConstructableFunction):
2371         * runtime/JSGlobalData.h:
2372         (JSGlobalData):
2373
2374 2012-02-21  Tom Sepez  <tsepez@chromium.org>
2375
2376         equalIgnoringNullity() only comparing half the bytes for equality
2377         https://bugs.webkit.org/show_bug.cgi?id=79135
2378
2379         Reviewed by Adam Barth.
2380
2381         * wtf/text/StringImpl.h:
2382         (WTF::equalIgnoringNullity):
2383
2384 2012-02-21  Roland Takacs  <takacs.roland@stud.u-szeged.hu>
2385
2386         Unnecessary preprocessor macros in MainThread.h/cpp
2387         https://bugs.webkit.org/show_bug.cgi?id=79083
2388
2389         Removed invalid/wrong PLATFORM(WINDOWS) preprocessor macro.
2390
2391         * wtf/MainThread.cpp:
2392         (WTF):
2393         * wtf/MainThread.h:
2394         (WTF):
2395
2396 2012-02-21  Sam Weinig  <sam@webkit.org>
2397
2398         Attempt to fix the Snow Leopard build.
2399
2400         * Configurations/Base.xcconfig:
2401
2402 2012-02-21  Sam Weinig  <sam@webkit.org>
2403
2404         Use libc++ when building with Clang on Mac
2405         https://bugs.webkit.org/show_bug.cgi?id=78981
2406
2407         Reviewed by Dan Bernstein.
2408
2409         * Configurations/Base.xcconfig:
2410
2411 2012-02-21  Adam Roben  <aroben@apple.com>
2412
2413         Roll out r108309, r108323, and r108326
2414
2415         They broke the 32-bit Lion build.
2416
2417         Original bugs is <http://webkit.org/b/75812> <rdar://problem/10079694>.
2418
2419         * CMakeLists.txt:
2420         * GNUmakefile.am:
2421         * GNUmakefile.list.am:
2422         * JavaScriptCore.pri:
2423         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2424         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
2425         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
2426         * JavaScriptCore.xcodeproj/project.pbxproj:
2427         * Target.pri:
2428         * assembler/LinkBuffer.h:
2429         * assembler/MacroAssemblerCodeRef.h:
2430         * bytecode/BytecodeConventions.h: Removed.
2431         * bytecode/CallLinkStatus.cpp:
2432         * bytecode/CallLinkStatus.h:
2433         * bytecode/CodeBlock.cpp:
2434         * bytecode/CodeBlock.h:
2435         * bytecode/GetByIdStatus.cpp:
2436         * bytecode/GetByIdStatus.h:
2437         * bytecode/Instruction.h:
2438         * bytecode/LLIntCallLinkInfo.h: Removed.
2439         * bytecode/MethodCallLinkStatus.cpp:
2440         * bytecode/Opcode.cpp:
2441         * bytecode/Opcode.h:
2442         * bytecode/PutByIdStatus.cpp:
2443         * bytecode/PutByIdStatus.h:
2444         * bytecompiler/BytecodeGenerator.cpp:
2445         * dfg/DFGByteCodeParser.cpp:
2446         * dfg/DFGCapabilities.h:
2447         * dfg/DFGOSRExitCompiler.cpp:
2448         * dfg/DFGOperations.cpp:
2449         * heap/Heap.h:
2450         * heap/MarkStack.cpp:
2451         * heap/MarkedAllocator.h:
2452         * heap/MarkedSpace.h:
2453         * interpreter/CallFrame.cpp:
2454         * interpreter/CallFrame.h:
2455         * interpreter/Interpreter.cpp:
2456         * interpreter/Interpreter.h:
2457         * interpreter/RegisterFile.h:
2458         * jit/ExecutableAllocator.h:
2459         * jit/HostCallReturnValue.cpp: Removed.
2460         * jit/HostCallReturnValue.h: Removed.
2461         * jit/JIT.cpp:
2462         * jit/JITCode.h:
2463         * jit/JITDriver.h:
2464         * jit/JITExceptions.cpp:
2465         * jit/JITInlineMethods.h:
2466         * jit/JITStubs.cpp:
2467         * jit/JITStubs.h:
2468         * jit/JSInterfaceJIT.h:
2469         * llint/LLIntCommon.h: Removed.
2470         * llint/LLIntData.cpp: Removed.
2471         * llint/LLIntData.h: Removed.
2472         * llint/LLIntEntrypoints.cpp: Removed.
2473         * llint/LLIntEntrypoints.h: Removed.
2474         * llint/LLIntExceptions.cpp: Removed.
2475         * llint/LLIntExceptions.h: Removed.
2476         * llint/LLIntOfflineAsmConfig.h: Removed.
2477         * llint/LLIntOffsetsExtractor.cpp: Removed.
2478         * llint/LLIntSlowPaths.cpp: Removed.
2479         * llint/LLIntSlowPaths.h: Removed.
2480         * llint/LLIntThunks.cpp: Removed.
2481         * llint/LLIntThunks.h: Removed.
2482         * llint/LowLevelInterpreter.asm: Removed.
2483         * llint/LowLevelInterpreter.cpp: Removed.
2484         * llint/LowLevelInterpreter.h: Removed.
2485         * offlineasm/armv7.rb: Removed.
2486         * offlineasm/asm.rb: Removed.
2487         * offlineasm/ast.rb: Removed.
2488         * offlineasm/backends.rb: Removed.
2489         * offlineasm/generate_offset_extractor.rb: Removed.
2490         * offlineasm/instructions.rb: Removed.
2491         * offlineasm/offset_extractor_constants.rb: Removed.
2492         * offlineasm/offsets.rb: Removed.
2493         * offlineasm/opt.rb: Removed.
2494         * offlineasm/parser.rb: Removed.
2495         * offlineasm/registers.rb: Removed.
2496         * offlineasm/self_hash.rb: Removed.
2497         * offlineasm/settings.rb: Removed.
2498         * offlineasm/transform.rb: Removed.
2499         * offlineasm/x86.rb: Removed.
2500         * runtime/CodeSpecializationKind.h: Removed.
2501         * runtime/CommonSlowPaths.h:
2502         * runtime/Executable.cpp:
2503         * runtime/Executable.h:
2504         * runtime/ExecutionHarness.h: Removed.
2505         * runtime/JSArray.h:
2506         * runtime/JSCell.h:
2507         * runtime/JSFunction.h:
2508         * runtime/JSGlobalData.cpp:
2509         * runtime/JSGlobalData.h:
2510         * runtime/JSGlobalObject.h:
2511         * runtime/JSObject.h:
2512         * runtime/JSPropertyNameIterator.h:
2513         * runtime/JSString.h:
2514         * runtime/JSTypeInfo.h:
2515         * runtime/JSValue.cpp:
2516         * runtime/JSValue.h:
2517         * runtime/JSVariableObject.h:
2518         * runtime/Options.cpp:
2519         * runtime/Options.h:
2520         * runtime/ScopeChain.h:
2521         * runtime/Structure.cpp:
2522         * runtime/Structure.h:
2523         * runtime/StructureChain.h:
2524         * wtf/InlineASM.h:
2525         * wtf/Platform.h:
2526         * wtf/SentinelLinkedList.h:
2527         * wtf/text/StringImpl.h:
2528
2529 2012-02-21  Gustavo Noronha Silva  <kov@debian.org> and Bob Tracy  <rct@frus.com>
2530
2531         Does not build on IA64, SPARC and Alpha
2532         https://bugs.webkit.org/show_bug.cgi?id=79047
2533
2534         Rubber-stamped by Kent Tamura.
2535
2536         * wtf/dtoa/utils.h: these architectures also have correct double
2537         operations, so add them to the appropriate side of the check.
2538
2539 2012-02-21  Filip Pizlo  <fpizlo@apple.com>
2540
2541         Fix massive crashes in all tests introduced by previous build fix, and fix non-DFG build.
2542         https://bugs.webkit.org/show_bug.cgi?id=75812
2543
2544         Reviewed by Csaba Osztrogonác.
2545
2546         * dfg/DFGOperations.cpp:
2547         (JSC):
2548         * jit/HostCallReturnValue.h:
2549         (JSC::initializeHostCallReturnValue):
2550
2551 2012-02-21  Filip Pizlo  <fpizlo@apple.com>
2552
2553         Attempted build fix for ELF platforms.
2554
2555         * dfg/DFGOperations.cpp:
2556         (JSC):
2557         (JSC::getHostCallReturnValueWithExecState):
2558         * jit/HostCallReturnValue.cpp:
2559         (JSC):
2560         * jit/HostCallReturnValue.h:
2561         (JSC::initializeHostCallReturnValue):
2562
2563 2012-02-20  Filip Pizlo  <fpizlo@apple.com>
2564
2565         JSC should be a triple-tier VM
2566         https://bugs.webkit.org/show_bug.cgi?id=75812
2567         <rdar://problem/10079694>
2568
2569         Reviewed by Gavin Barraclough.
2570
2571         Implemented an interpreter that uses the JIT's calling convention. This
2572         interpreter is called LLInt, or the Low Level Interpreter. JSC will now
2573         will start by executing code in LLInt and will only tier up to the old
2574         JIT after the code is proven hot.
2575
2576         LLInt is written in a modified form of our macro assembly. This new macro
2577         assembly is compiled by an offline assembler (see offlineasm), which
2578         implements many modern conveniences such as a Turing-complete CPS-based
2579         macro language and direct access to relevant C++ type information
2580         (basically offsets of fields and sizes of structs/classes).
2581
2582         Code executing in LLInt appears to the rest of the JSC world "as if" it
2583         were executing in the old JIT. Hence, things like exception handling and
2584         cross-execution-engine calls just work and require pretty much no
2585         additional overhead.
2586
2587         This interpreter is 2-2.5x faster than our old interpreter on SunSpider,
2588         V8, and Kraken. With triple-tiering turned on, we're neutral on SunSpider,
2589         V8, and Kraken, but appear to get a double-digit improvement on real-world
2590         websites due to a huge reduction in the amount of JIT'ing.
2591
2592         * CMakeLists.txt:
2593         * GNUmakefile.am:
2594         * GNUmakefile.list.am:
2595         * JavaScriptCore.pri:
2596         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2597         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
2598         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
2599         * JavaScriptCore.xcodeproj/project.pbxproj:
2600         * Target.pri:
2601         * assembler/LinkBuffer.h:
2602         * assembler/MacroAssemblerCodeRef.h:
2603         (MacroAssemblerCodePtr):
2604         (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
2605         * bytecode/BytecodeConventions.h: Added.
2606         * bytecode/CallLinkStatus.cpp:
2607         (JSC::CallLinkStatus::computeFromLLInt):
2608         (JSC):
2609         (JSC::CallLinkStatus::computeFor):
2610         * bytecode/CallLinkStatus.h:
2611         (JSC::CallLinkStatus::isSet):
2612         (JSC::CallLinkStatus::operator!):
2613         (CallLinkStatus):
2614         * bytecode/CodeBlock.cpp:
2615         (JSC::CodeBlock::dump):
2616         (JSC::CodeBlock::CodeBlock):
2617         (JSC::CodeBlock::~CodeBlock):
2618         (JSC::CodeBlock::finalizeUnconditionally):
2619         (JSC::CodeBlock::stronglyVisitStrongReferences):
2620         (JSC):
2621         (JSC::CodeBlock::unlinkCalls):
2622         (JSC::CodeBlock::unlinkIncomingCalls):
2623         (JSC::CodeBlock::bytecodeOffset):
2624         (JSC::ProgramCodeBlock::jettison):
2625         (JSC::EvalCodeBlock::jettison):
2626         (JSC::FunctionCodeBlock::jettison):
2627         (JSC::ProgramCodeBlock::jitCompileImpl):
2628         (JSC::EvalCodeBlock::jitCompileImpl):
2629         (JSC::FunctionCodeBlock::jitCompileImpl):
2630         * bytecode/CodeBlock.h:
2631         (JSC):
2632         (CodeBlock):
2633         (JSC::CodeBlock::baselineVersion):
2634         (JSC::CodeBlock::linkIncomingCall):
2635         (JSC::CodeBlock::bytecodeOffset):
2636         (JSC::CodeBlock::jitCompile):
2637         (JSC::CodeBlock::hasOptimizedReplacement):
2638         (JSC::CodeBlock::addPropertyAccessInstruction):
2639         (JSC::CodeBlock::addGlobalResolveInstruction):
2640         (JSC::CodeBlock::addLLIntCallLinkInfo):
2641         (JSC::CodeBlock::addGlobalResolveInfo):
2642         (JSC::CodeBlock::numberOfMethodCallLinkInfos):
2643         (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
2644         (JSC::CodeBlock::likelyToTakeSlowCase):
2645         (JSC::CodeBlock::couldTakeSlowCase):
2646         (JSC::CodeBlock::likelyToTakeSpecialFastCase):
2647         (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
2648         (JSC::CodeBlock::likelyToTakeAnySlowCase):
2649         (JSC::CodeBlock::addFrequentExitSite):
2650         (JSC::CodeBlock::dontJITAnytimeSoon):
2651         (JSC::CodeBlock::jitAfterWarmUp):
2652         (JSC::CodeBlock::jitSoon):
2653         (JSC::CodeBlock::llintExecuteCounter):
2654         (ProgramCodeBlock):
2655         (EvalCodeBlock):
2656         (FunctionCodeBlock):
2657         * bytecode/GetByIdStatus.cpp:
2658         (JSC::GetByIdStatus::computeFromLLInt):
2659         (JSC):
2660         (JSC::GetByIdStatus::computeFor):
2661         * bytecode/GetByIdStatus.h:
2662         (JSC::GetByIdStatus::GetByIdStatus):
2663         (JSC::GetByIdStatus::wasSeenInJIT):
2664         (GetByIdStatus):
2665         * bytecode/Instruction.h:
2666         (JSC):
2667         (JSC::Instruction::Instruction):
2668         (Instruction):
2669         * bytecode/LLIntCallLinkInfo.h: Added.
2670         (JSC):
2671         (JSC::LLIntCallLinkInfo::LLIntCallLinkInfo):
2672         (LLIntCallLinkInfo):
2673         (JSC::LLIntCallLinkInfo::~LLIntCallLinkInfo):
2674         (JSC::LLIntCallLinkInfo::isLinked):
2675         (JSC::LLIntCallLinkInfo::unlink):
2676         * bytecode/MethodCallLinkStatus.cpp:
2677         (JSC::MethodCallLinkStatus::computeFor):
2678         * bytecode/Opcode.cpp:
2679         (JSC):
2680         * bytecode/Opcode.h:
2681         (JSC):
2682         (JSC::padOpcodeName):
2683         * bytecode/PutByIdStatus.cpp:
2684         (JSC::PutByIdStatus::computeFromLLInt):
2685         (JSC):
2686         (JSC::PutByIdStatus::computeFor):
2687         * bytecode/PutByIdStatus.h:
2688         (PutByIdStatus):
2689         * bytecompiler/BytecodeGenerator.cpp:
2690         (JSC::BytecodeGenerator::emitResolve):
2691         (JSC::BytecodeGenerator::emitResolveWithBase):
2692         (JSC::BytecodeGenerator::emitGetById):
2693         (JSC::BytecodeGenerator::emitPutById):
2694         (JSC::BytecodeGenerator::emitDirectPutById):
2695         (JSC::BytecodeGenerator::emitCall):
2696         (JSC::BytecodeGenerator::emitConstruct):
2697         (JSC::BytecodeGenerator::emitCatch):
2698         * dfg/DFGByteCodeParser.cpp:
2699         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
2700         (JSC::DFG::ByteCodeParser::handleInlining):
2701         (JSC::DFG::ByteCodeParser::parseBlock):
2702         * dfg/DFGCapabilities.h:
2703         (JSC::DFG::canCompileOpcode):
2704         * dfg/DFGOSRExitCompiler.cpp:
2705         * dfg/DFGOperations.cpp:
2706         * heap/Heap.h:
2707         (JSC):
2708         (JSC::Heap::firstAllocatorWithoutDestructors):
2709         (Heap):
2710         * heap/MarkStack.cpp:
2711         (JSC::visitChildren):
2712         * heap/MarkedAllocator.h:
2713         (JSC):
2714         (MarkedAllocator):
2715         * heap/MarkedSpace.h:
2716         (JSC):
2717         (MarkedSpace):
2718         (JSC::MarkedSpace::firstAllocator):
2719         * interpreter/CallFrame.cpp:
2720         (JSC):
2721         (JSC::CallFrame::bytecodeOffsetForNonDFGCode):
2722         (JSC::CallFrame::setBytecodeOffsetForNonDFGCode):
2723         (JSC::CallFrame::currentVPC):
2724         (JSC::CallFrame::setCurrentVPC):
2725         (JSC::CallFrame::trueCallerFrame):
2726         * interpreter/CallFrame.h:
2727         (JSC::ExecState::hasReturnPC):
2728         (JSC::ExecState::clearReturnPC):
2729         (ExecState):
2730         (JSC::ExecState::bytecodeOffsetForNonDFGCode):
2731         (JSC::ExecState::currentVPC):
2732         (JSC::ExecState::setCurrentVPC):
2733         * interpreter/Interpreter.cpp:
2734         (JSC::Interpreter::Interpreter):
2735         (JSC::Interpreter::~Interpreter):
2736         (JSC):
2737         (JSC::Interpreter::initialize):
2738         (JSC::Interpreter::isOpcode):
2739         (JSC::Interpreter::unwindCallFrame):
2740         (JSC::getCallerInfo):
2741         (JSC::Interpreter::privateExecute):
2742         (JSC::Interpreter::retrieveLastCaller):
2743         * interpreter/Interpreter.h:
2744         (JSC):
2745         (Interpreter):
2746         (JSC::Interpreter::getOpcode):
2747         (JSC::Interpreter::getOpcodeID):
2748         (JSC::Interpreter::classicEnabled):
2749         * interpreter/RegisterFile.h:
2750         (JSC):
2751         (RegisterFile):
2752         * jit/ExecutableAllocator.h:
2753         (JSC):
2754         * jit/HostCallReturnValue.cpp: Added.
2755         (JSC):
2756         (JSC::getHostCallReturnValueWithExecState):
2757         * jit/HostCallReturnValue.h: Added.
2758         (JSC):
2759         (JSC::initializeHostCallReturnValue):
2760         * jit/JIT.cpp:
2761         (JSC::JIT::privateCompileMainPass):
2762         (JSC::JIT::privateCompileSlowCases):
2763         (JSC::JIT::privateCompile):
2764         * jit/JITCode.h:
2765         (JSC::JITCode::isOptimizingJIT):
2766         (JITCode):
2767         (JSC::JITCode::isBaselineCode):
2768         (JSC::JITCode::JITCode):
2769         * jit/JITDriver.h:
2770         (JSC::jitCompileIfAppropriate):
2771         (JSC::jitCompileFunctionIfAppropriate):
2772         * jit/JITExceptions.cpp:
2773         (JSC::jitThrow):
2774         * jit/JITInlineMethods.h:
2775         (JSC::JIT::updateTopCallFrame):
2776         * jit/JITStubs.cpp:
2777         (JSC::DEFINE_STUB_FUNCTION):
2778         (JSC):
2779         * jit/JITStubs.h:
2780         (JSC):
2781         * jit/JSInterfaceJIT.h:
2782         * llint: Added.
2783         * llint/LLIntCommon.h: Added.
2784         * llint/LLIntData.cpp: Added.
2785         (LLInt):
2786         (JSC::LLInt::Data::Data):
2787         (JSC::LLInt::Data::performAssertions):
2788         (JSC::LLInt::Data::~Data):
2789         * llint/LLIntData.h: Added.
2790         (JSC):
2791         (LLInt):
2792         (Data):
2793         (JSC::LLInt::Data::exceptionInstructions):
2794         (JSC::LLInt::Data::opcodeMap):
2795         (JSC::LLInt::Data::performAssertions):
2796         * llint/LLIntEntrypoints.cpp: Added.
2797         (LLInt):
2798         (JSC::LLInt::getFunctionEntrypoint):
2799         (JSC::LLInt::getEvalEntrypoint):
2800         (JSC::LLInt::getProgramEntrypoint):
2801         * llint/LLIntEntrypoints.h: Added.
2802         (JSC):
2803         (LLInt):
2804         (JSC::LLInt::getEntrypoint):
2805         * llint/LLIntExceptions.cpp: Added.
2806         (LLInt):
2807         (JSC::LLInt::interpreterThrowInCaller):
2808         (JSC::LLInt::returnToThrowForThrownException):
2809         (JSC::LLInt::returnToThrow):
2810         (JSC::LLInt::callToThrow):
2811         * llint/LLIntExceptions.h: Added.
2812         (JSC):
2813         (LLInt):
2814         * llint/LLIntOfflineAsmConfig.h: Added.
2815         * llint/LLIntOffsetsExtractor.cpp: Added.
2816         (JSC):
2817         (LLIntOffsetsExtractor):
2818         (JSC::LLIntOffsetsExtractor::dummy):
2819         (main):
2820         * llint/LLIntSlowPaths.cpp: Added.
2821         (LLInt):
2822         (JSC::LLInt::llint_trace_operand):
2823         (JSC::LLInt::llint_trace_value):
2824         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2825         (JSC::LLInt::traceFunctionPrologue):
2826         (JSC::LLInt::shouldJIT):
2827         (JSC::LLInt::entryOSR):
2828         (JSC::LLInt::resolveGlobal):
2829         (JSC::LLInt::getByVal):
2830         (JSC::LLInt::handleHostCall):
2831         (JSC::LLInt::setUpCall):
2832         (JSC::LLInt::genericCall):
2833         * llint/LLIntSlowPaths.h: Added.
2834         (JSC):
2835         (LLInt):
2836         * llint/LLIntThunks.cpp: Added.
2837         (LLInt):
2838         (JSC::LLInt::generateThunkWithJumpTo):
2839         (JSC::LLInt::functionForCallEntryThunkGenerator):
2840         (JSC::LLInt::functionForConstructEntryThunkGenerator):
2841         (JSC::LLInt::functionForCallArityCheckThunkGenerator):
2842         (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
2843         (JSC::LLInt::evalEntryThunkGenerator):
2844         (JSC::LLInt::programEntryThunkGenerator):
2845         * llint/LLIntThunks.h: Added.
2846         (JSC):
2847         (LLInt):
2848         * llint/LowLevelInterpreter.asm: Added.
2849         * llint/LowLevelInterpreter.cpp: Added.
2850         * llint/LowLevelInterpreter.h: Added.
2851         * offlineasm: Added.
2852         * offlineasm/armv7.rb: Added.
2853         * offlineasm/asm.rb: Added.
2854         * offlineasm/ast.rb: Added.
2855         * offlineasm/backends.rb: Added.
2856         * offlineasm/generate_offset_extractor.rb: Added.
2857         * offlineasm/instructions.rb: Added.
2858         * offlineasm/offset_extractor_constants.rb: Added.
2859         * offlineasm/offsets.rb: Added.
2860         * offlineasm/opt.rb: Added.
2861         * offlineasm/parser.rb: Added.
2862         * offlineasm/registers.rb: Added.
2863         * offlineasm/self_hash.rb: Added.
2864         * offlineasm/settings.rb: Added.
2865         * offlineasm/transform.rb: Added.
2866         * offlineasm/x86.rb: Added.
2867         * runtime/CodeSpecializationKind.h: Added.
2868         (JSC):
2869         * runtime/CommonSlowPaths.h:
2870         (JSC::CommonSlowPaths::arityCheckFor):
2871         (CommonSlowPaths):
2872         * runtime/Executable.cpp:
2873         (JSC::jettisonCodeBlock):
2874         (JSC):
2875         (JSC::EvalExecutable::jitCompile):
2876         (JSC::samplingDescription):
2877         (JSC::EvalExecutable::compileInternal):
2878         (JSC::ProgramExecutable::jitCompile):
2879         (JSC::ProgramExecutable::compileInternal):
2880         (JSC::FunctionExecutable::baselineCodeBlockFor):
2881         (JSC::FunctionExecutable::jitCompileForCall):
2882         (JSC::FunctionExecutable::jitCompileForConstruct):
2883         (JSC::FunctionExecutable::compileForCallInternal):
2884         (JSC::FunctionExecutable::compileForConstructInternal):
2885         * runtime/Executable.h:
2886         (JSC):
2887         (EvalExecutable):
2888         (ProgramExecutable):
2889         (FunctionExecutable):
2890         (JSC::FunctionExecutable::jitCompileFor):
2891         * runtime/ExecutionHarness.h: Added.
2892         (JSC):
2893         (JSC::prepareForExecution):
2894         (JSC::prepareFunctionForExecution):
2895         * runtime/JSArray.h:
2896         (JSC):
2897         (JSArray):
2898         * runtime/JSCell.h:
2899         (JSC):
2900         (JSCell):
2901         * runtime/JSFunction.h:
2902         (JSC):
2903         (JSFunction):
2904         * runtime/JSGlobalData.cpp:
2905         (JSC::JSGlobalData::JSGlobalData):
2906         * runtime/JSGlobalData.h:
2907         (JSC):
2908         (JSGlobalData):
2909         * runtime/JSGlobalObject.h:
2910         (JSC):
2911         (JSGlobalObject):
2912         * runtime/JSObject.h:
2913         (JSC):
2914         (JSObject):
2915         (JSFinalObject):
2916         * runtime/JSPropertyNameIterator.h:
2917         (JSC):
2918         (JSPropertyNameIterator):
2919         * runtime/JSString.h:
2920         (JSC):
2921         (JSString):
2922         * runtime/JSTypeInfo.h:
2923         (JSC):
2924         (TypeInfo):
2925         * runtime/JSValue.cpp:
2926         (JSC::JSValue::description):
2927         * runtime/JSValue.h:
2928         (LLInt):
2929         (JSValue):
2930         * runtime/JSVariableObject.h:
2931         (JSC):
2932         (JSVariableObject):
2933         * runtime/Options.cpp:
2934         (Options):
2935         (JSC::Options::initializeOptions):
2936         * runtime/Options.h:
2937         (Options):
2938         * runtime/ScopeChain.h:
2939         (JSC):
2940         (ScopeChainNode):
2941         * runtime/Structure.cpp:
2942         (JSC::Structure::addPropertyTransition):
2943         * runtime/Structure.h:
2944         (JSC):
2945         (Structure):
2946         * runtime/StructureChain.h:
2947         (JSC):
2948         (StructureChain):
2949         * wtf/InlineASM.h:
2950         * wtf/Platform.h:
2951         * wtf/SentinelLinkedList.h:
2952         (SentinelLinkedList):
2953         (WTF::SentinelLinkedList::isEmpty):
2954         * wtf/text/StringImpl.h:
2955         (JSC):
2956         (StringImpl):
2957
2958 2012-02-20  Filip Pizlo  <fpizlo@apple.com>
2959
2960         Unreviewed, rolling out http://trac.webkit.org/changeset/108291
2961         It completely broke the 32-bit JIT.
2962
2963         * heap/CopiedAllocator.h:
2964         * heap/CopiedSpace.h:
2965         (CopiedSpace):
2966         * heap/Heap.h:
2967         (JSC::Heap::allocatorForObjectWithDestructor):
2968         * jit/JIT.cpp:
2969         (JSC::JIT::privateCompileSlowCases):
2970         * jit/JIT.h:
2971         (JIT):
2972         * jit/JITInlineMethods.h:
2973         (JSC):
2974         * jit/JITOpcodes.cpp:
2975         (JSC::JIT::emit_op_new_array):
2976         * runtime/JSArray.cpp:
2977         (JSC::storageSize):
2978         (JSC):
2979         * runtime/JSArray.h:
2980         (ArrayStorage):
2981         (JSArray):
2982
2983 2012-02-20  Gavin Barraclough  <barraclough@apple.com>
2984
2985         [[Put]] should throw if prototype chain contains a readonly property.
2986         https://bugs.webkit.org/show_bug.cgi?id=79069
2987
2988         Reviewed by Oliver Hunt.
2989
2990         Currently we only check the base of the put, not the prototype chain.
2991         Fold this check in with the test for accessors.
2992
2993         * runtime/JSObject.cpp:
2994         (JSC::JSObject::put):
2995             - Updated to test all objects in the propotype chain for readonly properties.
2996         (JSC::JSObject::putDirectAccessor):
2997         (JSC::putDescriptor):
2998             - Record the presence of readonly properties on the structure.
2999         * runtime/Structure.cpp:
3000         (JSC::Structure::Structure):
3001             - hasGetterSetterPropertiesExcludingProto expanded to hasReadOnlyOrGetterSetterPropertiesExcludingProto.
3002         * runtime/Structure.h:
3003         (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
3004         (JSC::Structure::setHasGetterSetterProperties):
3005             - hasGetterSetterPropertiesExcludingProto expanded to hasReadOnlyOrGetterSetterPropertiesExcludingProto.
3006         (JSC::Structure::setContainsReadOnlyProperties):
3007             - Added.
3008
3009 2012-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
3010
3011         Implement fast path for op_new_array in the baseline JIT
3012         https://bugs.webkit.org/show_bug.cgi?id=78612
3013
3014         Reviewed by Filip Pizlo.
3015
3016         * heap/CopiedAllocator.h:
3017         (CopiedAllocator): Friended the JIT to allow access to m_currentOffset.
3018         * heap/CopiedSpace.h:
3019         (CopiedSpace): Friended the JIT to allow access to
3020         (JSC::CopiedSpace::allocator):
3021         * heap/Heap.h:
3022         (JSC::Heap::storageAllocator): Added a getter for the CopiedAllocator class so the JIT
3023         can use it for simple allocation i.e. when we can just bump the offset without having to
3024         do anything else.
3025         * jit/JIT.cpp:
3026         (JSC::JIT::privateCompileSlowCases): Added new slow case for op_new_array for when
3027         we have to bail out because the fast allocation path fails for whatever reason.
3028         * jit/JIT.h:
3029         (JIT):
3030         * jit/JITInlineMethods.h:
3031         (JSC::JIT::emitAllocateBasicStorage): Added utility function that allows objects to
3032         allocate generic backing stores. This function is used by emitAllocateJSArray.
3033         (JSC):
3034         (JSC::JIT::emitAllocateJSArray): Added utility function that allows the client to
3035         more easily allocate JSArrays. This function is used by emit_op_new_array and I expect
3036         it will also be used for emit_op_new_array_buffer.
3037         * jit/JITOpcodes.cpp:
3038         (JSC::JIT::emit_op_new_array): Changed to do inline allocation of JSArrays. Still does
3039         a stub call for oversize arrays.
3040         (JSC):
3041         (JSC::JIT::emitSlow_op_new_array): Just bails out to a stub call if we fail in any way on
3042         the fast path.
3043         * runtime/JSArray.cpp:
3044         (JSC):
3045         * runtime/JSArray.h: Added lots of offset functions for all the fields that we need to
3046         initialize in the JIT.
3047         (ArrayStorage):
3048         (JSC::ArrayStorage::lengthOffset):
3049         (JSC::ArrayStorage::numValuesInVectorOffset):
3050         (JSC::ArrayStorage::allocBaseOffset):
3051         (JSC::ArrayStorage::vectorOffset):
3052         (JSArray):
3053         (JSC::JSArray::sparseValueMapOffset):
3054         (JSC::JSArray::subclassDataOffset):
3055         (JSC::JSArray::indexBiasOffset):
3056         (JSC):
3057         (JSC::JSArray::storageSize): Moved this function from being a static function in the cpp file
3058         to being a static function in the JSArray class. This move allows the JIT to call it to
3059         see what size it should allocate.
3060
3061 2012-02-20  Gavin Barraclough  <barraclough@apple.com>
3062
3063         DefineOwnProperty fails with numeric properties & Object.prototype
3064         https://bugs.webkit.org/show_bug.cgi?id=79059
3065
3066         Reviewed by Oliver Hunt.
3067
3068         ObjectPrototype caches whether it contains any numeric properties (m_hasNoPropertiesWithUInt32Names),
3069         calls to defineOwnProperty need to update this cache.
3070
3071         * runtime/ObjectPrototype.cpp:
3072         (JSC::ObjectPrototype::put):
3073         (JSC::ObjectPrototype::defineOwnProperty):
3074         (JSC):
3075         (JSC::ObjectPrototype::getOwnPropertySlotByIndex):
3076         * runtime/ObjectPrototype.h:
3077         (ObjectPrototype):
3078
3079 2012-02-20  Pino Toscano  <pino@debian.org>
3080
3081         Does not build on GNU Hurd
3082         https://bugs.webkit.org/show_bug.cgi?id=79045
3083
3084         Reviewed by Gustavo Noronha Silva.
3085
3086         * wtf/Platform.h: define WTF_OS_HURD.
3087         * wtf/ThreadIdentifierDataPthreads.cpp: adds a band-aid fix
3088         for the lack of PTHREAD_KEYS_MAX definition, with a value which
3089         should not cause issues.
3090
3091 2012-02-20  Gavin Barraclough  <barraclough@apple.com>
3092
3093         Unreviewed windows build fix.
3094
3095         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3096
3097 2012-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
3098
3099         Undoing accidental changes
3100
3101         * heap/Heap.cpp:
3102         (JSC::Heap::collectAllGarbage):
3103
3104 2012-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
3105
3106         Factor out allocation in CopySpace into a separate CopyAllocator
3107         https://bugs.webkit.org/show_bug.cgi?id=78610
3108
3109         Reviewed by Oliver Hunt.
3110
3111         Added a new CopyAllocator class, which allows us to do allocations without
3112         having to load the current offset and store the current offset in the current
3113         block. This change will allow us to easily do inline assembly in the JIT for
3114         array allocations.
3115
3116         * GNUmakefile.list.am:
3117         * JavaScriptCore.gypi:
3118         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3119         * JavaScriptCore.xcodeproj/project.pbxproj:
3120         * heap/CopiedAllocator.h: Added.
3121         (JSC):
3122         (CopiedAllocator):
3123         (JSC::CopiedAllocator::currentBlock):
3124         (JSC::CopiedAllocator::CopiedAllocator):
3125         (JSC::CopiedAllocator::allocate):
3126         (JSC::CopiedAllocator::fitsInCurrentBlock):
3127         (JSC::CopiedAllocator::wasLastAllocation):
3128         (JSC::CopiedAllocator::startedCopying):
3129         (JSC::CopiedAllocator::resetCurrentBlock):
3130         (JSC::CopiedAllocator::currentUtilization):
3131         (JSC::CopiedAllocator::resetLastAllocation):
3132         * heap/CopiedBlock.h:
3133         (CopiedBlock):
3134         * heap/CopiedSpace.cpp: Moved some stuff from CopiedSpaceInlineMethods to here because we
3135         weren't really getting any benefits from having such big functions in a header file.
3136         (JSC::CopiedSpace::CopiedSpace):
3137         (JSC):
3138         (JSC::CopiedSpace::init):
3139         (JSC::CopiedSpace::tryAllocateSlowCase):
3140         (JSC::CopiedSpace::tryAllocateOversize):
3141         (JSC::CopiedSpace::tryReallocate):
3142         (JSC::CopiedSpace::tryReallocateOversize):
3143         (JSC::CopiedSpace::doneFillingBlock):
3144         (JSC::CopiedSpace::doneCopying):
3145         (JSC::CopiedSpace::getFreshBlock):
3146         * heap/CopiedSpace.h:
3147         (CopiedSpace):
3148         * heap/CopiedSpaceInlineMethods.h:
3149         (JSC):
3150         (JSC::CopiedSpace::startedCopying):
3151         (JSC::CopiedSpace::addNewBlock):
3152         (JSC::CopiedSpace::allocateNewBlock):
3153         (JSC::CopiedSpace::fitsInBlock):
3154         (JSC::CopiedSpace::tryAllocate):
3155         (JSC::CopiedSpace::allocateFromBlock):
3156         * heap/Heap.cpp:
3157         (JSC::Heap::collectAllGarbage):
3158         * heap/HeapBlock.h:
3159         (HeapBlock):
3160
3161 2012-02-20  Patrick Gansterer  <paroga@webkit.org>
3162
3163         Fix Visual Studio 2010 build.
3164
3165         * bytecompiler/NodesCodegen.cpp:
3166         (JSC::PropertyListNode::emitBytecode):
3167
3168 2012-02-16  Gavin Barraclough  <barraclough@apple.com>
3169
3170         Move special __proto__ property to Object.prototype
3171         https://bugs.webkit.org/show_bug.cgi?id=78409
3172
3173         Reviewed by Oliver Hunt.
3174
3175         Re-implement this as a regular accessor property.  This has three key benefits:
3176         1) It makes it possible for objects to be given properties named __proto__.
3177         2) Object.prototype.__proto__ can be deleted, preventing object prototypes from being changed.
3178         3) This largely removes the magic used the implement __proto__, it can just be made a regular accessor property.
3179
3180         * parser/Parser.cpp:
3181         (JSC::::parseFunctionInfo):
3182             - No need to prohibit functions named __proto__.
3183         * runtime/JSGlobalObject.cpp:
3184         (JSC::JSGlobalObject::reset):
3185             - Add __proto__ accessor to Object.prototype.
3186         * runtime/JSGlobalObjectFunctions.cpp:
3187         (JSC::globalFuncProtoGetter):
3188         (JSC::globalFuncProtoSetter):
3189             - Definition of the __proto__ accessor functions.
3190         * runtime/JSGlobalObjectFunctions.h:
3191             - Declaration of the __proto__ accessor functions.
3192         * runtime/JSObject.cpp:
3193         (JSC::JSObject::put):
3194             - Remove the special handling for __proto__, there is still a check to allow for a fast guard for accessors excluding __proto__.
3195         (JSC::JSObject::putDirectAccessor):
3196             - Track on the structure whether an object contains accessors other than one for __proto__.
3197         (JSC::JSObject::defineOwnProperty):
3198             - No need to prohibit definition of own properties named __proto__.
3199         * runtime/JSObject.h:
3200         (JSC::JSObject::inlineGetOwnPropertySlot):
3201             - Remove the special handling for __proto__.
3202         (JSC::JSValue::get):
3203             - Remove the special handling for __proto__.
3204         * runtime/JSString.cpp:
3205         (JSC::JSString::getOwnPropertySlot):
3206             - Remove the special handling for __proto__.
3207         * runtime/JSValue.h:
3208         (JSValue):
3209             - Made synthesizePrototype public (this may be needed by the __proto__ getter).
3210         * runtime/ObjectConstructor.cpp:
3211         (JSC::objectConstructorGetPrototypeOf):
3212             - Perform the security check & call prototype() directly.
3213         * runtime/Structure.cpp:
3214         (JSC::Structure::Structure):
3215             - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
3216         * runtime/Structure.h:
3217         (JSC::Structure::hasGetterSetterPropertiesExcludingProto):
3218         (JSC::Structure::setHasGetterSetterProperties):
3219         (Structure):
3220             - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
3221
3222 2012-02-20  Michael Saboff  <msaboff@apple.com>
3223
3224         Update toLower and toUpper tests for Unicode 6.1 changes
3225         https://bugs.webkit.org/show_bug.cgi?id=78923
3226
3227         Reviewed by Oliver Hunt.
3228
3229         * tests/mozilla/ecma/String/15.5.4.11-2.js: Updated the test
3230         to handle a third set of results for updated Unicode 6.1
3231         changes.
3232         (getTestCases):
3233         (TestCaseMultiExpected):
3234         (writeTestCaseResultMultiExpected):
3235         (getTestCaseResultMultiExpected):
3236         (test):
3237         (GetUnicodeValues):
3238         (DecimalToHexString):
3239
3240 2012-02-20  Andy Wingo  <wingo@igalia.com>
3241
3242         Remove unused features from CodeFeatures
3243         https://bugs.webkit.org/show_bug.cgi?id=78804
3244
3245         Reviewed by Gavin Barraclough.
3246
3247         * parser/Nodes.h:
3248         * parser/ASTBuilder.h:
3249         (JSC::ClosureFeature):
3250         (JSC::ASTBuilder::createFunctionBody):
3251         (JSC::ASTBuilder::usesClosures):
3252         Remove "ClosureFeature".  Since we track captured variables more
3253         precisely, this bit doesn't do us any good.
3254
3255         (JSC::AssignFeature):
3256         (JSC::ASTBuilder::makeAssignNode):
3257         (JSC::ASTBuilder::makePrefixNode):
3258         (JSC::ASTBuilder::makePostfixNode):
3259         (JSC::ASTBuilder::usesAssignment):
3260         Similarly, remove AssignFeature.  It is unused.
3261
3262 2012-02-19  Carlos Garcia Campos  <cgarcia@igalia.com>
3263
3264         Unreviewed. Fix make distcheck issues.
3265
3266         * GNUmakefile.list.am: Add missing files.
3267
3268 2012-02-18  Sam Weinig  <sam@webkit.org>
3269
3270         Fix style issues in DFG Phase classes
3271         https://bugs.webkit.org/show_bug.cgi?id=78983
3272
3273         Reviewed by Ryosuke Niwa.
3274
3275         * dfg/DFGArithNodeFlagsInferencePhase.cpp:
3276         * dfg/DFGCFAPhase.cpp:
3277         * dfg/DFGCSEPhase.cpp:
3278         * dfg/DFGPredictionPropagationPhase.cpp:
3279         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
3280         Add a space before the colon in class declarations.
3281
3282 2012-02-18  Filip Pizlo  <fpizlo@apple.com>
3283
3284         Attempt to fix Windows build.
3285
3286         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3287
3288 2012-02-18  Sam Weinig  <sam@webkit.org>
3289
3290         Fix the libc++ build.
3291
3292         Reviewed by Anders Carlsson.
3293
3294         * heap/Weak.h:
3295         Libc++'s nullptr emulation does not allow default construction
3296         of the nullptr_t type. Work around this with the arguably clearer
3297         just returning nullptr.
3298
3299 2012-02-18  Filip Pizlo  <fpizlo@apple.com>
3300
3301         DFGPropagator.cpp has too many things
3302         https://bugs.webkit.org/show_bug.cgi?id=78956
3303
3304         Reviewed by Oliver Hunt.
3305
3306         Added the notion of a DFG::Phase. Removed DFG::Propagator, and took its
3307         various things and put them into separate files. These new phases follow
3308         the naming convention "DFG<name>Phase" where <name> is a noun. They are
3309         called via functions of the form "perform<name>".
3310
3311         * CMakeLists.txt:
3312         * GNUmakefile.list.am:
3313         * JavaScriptCore.xcodeproj/project.pbxproj:
3314         * Target.pri:
3315         * dfg/DFGArithNodeFlagsInferencePhase.cpp: Added.
3316         (DFG):
3317         (JSC::DFG::performArithNodeFlagsInference):
3318         * dfg/DFGArithNodeFlagsInferencePhase.h: Added.
3319         (DFG):
3320         * dfg/DFGCFAPhase.cpp: Added.
3321         (DFG):
3322         (JSC::DFG::performCFA):
3323         * dfg/DFGCFAPhase.h: Added.
3324         (DFG):
3325         * dfg/DFGCSEPhase.cpp: Added.
3326         (DFG):
3327         (JSC::DFG::performCSE):
3328         * dfg/DFGCSEPhase.h: Added.
3329         (DFG):
3330         * dfg/DFGDriver.cpp:
3331         (JSC::DFG::compile):
3332         * dfg/DFGPhase.cpp: Added.
3333         (DFG):
3334         (JSC::DFG::Phase::beginPhase):
3335         (JSC::DFG::Phase::endPhase):
3336         * dfg/DFGPhase.h: Added.
3337         (DFG):
3338         (Phase):
3339         (JSC::DFG::Phase::Phase):
3340         (JSC::DFG::Phase::~Phase):
3341         (JSC::DFG::Phase::globalData):
3342         (JSC::DFG::Phase::codeBlock):
3343         (JSC::DFG::Phase::profiledBlock):
3344         (JSC::DFG::Phase::beginPhase):
3345         (JSC::DFG::Phase::endPhase):
3346         (JSC::DFG::runPhase):
3347         * dfg/DFGPredictionPropagationPhase.cpp: Added.
3348         (DFG):
3349         (JSC::DFG::performPredictionPropagation):
3350         * dfg/DFGPredictionPropagationPhase.h: Added.
3351         (DFG):
3352         * dfg/DFGPropagator.cpp: Removed.
3353         * dfg/DFGPropagator.h: Removed.
3354         * dfg/DFGVirtualRegisterAllocationPhase.cpp: Added.
3355         (DFG):
3356         (JSC::DFG::performVirtualRegisterAllocation):
3357         * dfg/DFGVirtualRegisterAllocationPhase.h: Added.
3358         (DFG):
3359
3360 2012-02-17  Filip Pizlo  <fpizlo@apple.com>
3361
3362         DFG::Graph should have references to JSGlobalData, the CodeBlock being compiled, and
3363         the CodeBlock that was used for profiling
3364         https://bugs.webkit.org/show_bug.cgi?id=78954
3365
3366         Reviewed by Gavin Barraclough.
3367
3368         * bytecode/CodeBlock.h:
3369         (JSC::baselineCodeBlockForOriginAndBaselineCodeBlock):
3370         (JSC):
3371         * dfg/DFGAbstractState.cpp:
3372         (JSC::DFG::AbstractState::AbstractState):
3373         (JSC::DFG::AbstractState::execute):
3374         * dfg/DFGAbstractState.h:
3375         * dfg/DFGAssemblyHelpers.h:
3376         (AssemblyHelpers):
3377         * dfg/DFGByteCodeParser.cpp:
3378         (JSC::DFG::ByteCodeParser::ByteCodeParser):
3379         (JSC::DFG::ByteCodeParser::handleCall):
3380         (JSC::DFG::parse):
3381         * dfg/DFGByteCodeParser.h:
3382         (DFG):
3383         * dfg/DFGDriver.cpp:
3384         (JSC::DFG::compile):
3385         * dfg/DFGGraph.cpp:
3386         (JSC::DFG::Graph::dump):
3387         (JSC::DFG::Graph::predictArgumentTypes):
3388         * dfg/DFGGraph.h:
3389         (JSC::DFG::Graph::Graph):
3390         (Graph):
3391         (JSC::DFG::Graph::getJSConstantPrediction):
3392         (JSC::DFG::Graph::addShouldSpeculateInteger):
3393         (JSC::DFG::Graph::isInt32Constant):
3394         (JSC::DFG::Graph::isDoubleConstant):
3395         (JSC::DFG::Graph::isNumberConstant):
3396         (JSC::DFG::Graph::isBooleanConstant):
3397         (JSC::DFG::Graph::isFunctionConstant):
3398         (JSC::DFG::Graph::valueOfJSConstant):
3399         (JSC::DFG::Graph::valueOfInt32Constant):
3400         (JSC::DFG::Graph::valueOfNumberConstant):
3401         (JSC::DFG::Graph::valueOfBooleanConstant):
3402         (JSC::DFG::Graph::valueOfFunctionConstant):
3403         (JSC::DFG::Graph::baselineCodeBlockFor):
3404         (JSC::DFG::Graph::valueProfileFor):
3405         (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
3406         * dfg/DFGJITCompiler.h:
3407         (JSC::DFG::JITCompiler::JITCompiler):
3408         (JITCompiler):
3409         * dfg/DFGOSRExit.cpp:
3410         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
3411         * dfg/DFGPropagator.cpp:
3412         (JSC::DFG::Propagator::Propagator):
3413         (JSC::DFG::Propagator::isNotNegZero):
3414         (JSC::DFG::Propagator::isNotZero):
3415         (JSC::DFG::Propagator::propagateNodePredictions):
3416         (JSC::DFG::Propagator::doRoundOfDoubleVoting):
3417         (JSC::DFG::Propagator::globalCFA):
3418         (JSC::DFG::propagate):
3419         * dfg/DFGPropagator.h:
3420         (DFG):
3421         * dfg/DFGSpeculativeJIT.cpp:
3422         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
3423         (JSC::DFG::SpeculativeJIT::compileAdd):
3424         (JSC::DFG::SpeculativeJIT::compileArithSub):
3425         * dfg/DFGSpeculativeJIT.h:
3426         (JSC::DFG::SpeculativeJIT::isConstant):
3427         (JSC::DFG::SpeculativeJIT::isJSConstant):
3428         (JSC::DFG::SpeculativeJIT::isInt32Constant):
3429         (JSC::DFG::SpeculativeJIT::isDoubleConstant):
3430         (JSC::DFG::SpeculativeJIT::isNumberConstant):
3431         (JSC::DFG::SpeculativeJIT::isBooleanConstant):
3432         (JSC::DFG::SpeculativeJIT::isFunctionConstant):
3433         (JSC::DFG::SpeculativeJIT::valueOfInt32Constant):