Source/JavaScriptCore/ChangeLog

   1 2016-12-09  JF Bastien  <jfbastien@apple.com>
   2
   3         WebAssembly JS API: implement start function
   4         https://bugs.webkit.org/show_bug.cgi?id=165150
   5
   6         Reviewed by Saam Barati.
   7
   8         * wasm/WasmFormat.h: pass the start function around
   9         * wasm/WasmModuleParser.cpp:
  10         (JSC::Wasm::ModuleParser::parseTable): mark unreachable code
  11         (JSC::Wasm::ModuleParser::parseGlobal): mark unreachable code
  12         (JSC::Wasm::ModuleParser::parseStart): mark unreachable code
  13         (JSC::Wasm::ModuleParser::parseElement): mark unreachable code
  14         (JSC::Wasm::ModuleParser::parseData): mark unreachable code
  15         * wasm/js/WebAssemblyFunction.cpp:
  16         (JSC::callWebAssemblyFunction): NFC: call the new function below
  17         (JSC::WebAssemblyFunction::call): separate this out so that the start function can use it
  18         * wasm/js/WebAssemblyFunction.h:
  19         * wasm/js/WebAssemblyModuleRecord.cpp:
  20         (JSC::WebAssemblyModuleRecord::visitChildren): visit the start function
  21         (JSC::WebAssemblyModuleRecord::link): handle start function
  22         (JSC::WebAssemblyModuleRecord::evaluate): call the start function, if present
  23         * wasm/js/WebAssemblyModuleRecord.h:
  24
  25 2016-12-09  Filip Pizlo  <fpizlo@apple.com>
  26
  27         GC might be forced to look at a nuked object due to ordering of AllocatePropertyStorage, MaterializeNewObject, and PutStructure
  28         https://bugs.webkit.org/show_bug.cgi?id=165672
  29
  30         Reviewed by Geoffrey Garen.
  31
  32         We need to make sure that the shady stuff in a property put happens after the
  33         PutByOffset, since the PutByOffset is the place where we materialize. More generally, we
  34         should strive to not have any fenceposts between Nodes where a GC would be illegal.
  35
  36         This gets us most of the way there by separating NukeStructureAndSetButterfly from
  37         [Re]AllocatePropertyStorage. A transitioning put will now look something like:
  38
  39             GetButterfly
  40             ReallocatePropertyStorage
  41             PutByOffset
  42             NukeStructureAndSetButterfly
  43             PutStructure
  44
  45         Previously the structure would get nuked by ReallocatePropertyStorage, so if we placed
  46         an object materialization just after it (before the PutByOffset) then any GC that
  47         completed at that safepoint would encounter an unresolved visit race due to seeing a
  48         nuked structure. We cannot have nuked structures at safepoints, and this change makes
  49         sure that we don't - at least until someone tries to sink to the PutStructure. We will
  50         eventually have to create a combined SetStructureAndButterfly node, but we don't need it
  51         yet.
  52
  53         This also fixes a goof where the DFG's AllocatePropertyStorage was nulling the structure
  54         instead of nuking it. This could easily have caused many crashes in GC.
  55
  56         * dfg/DFGAbstractInterpreterInlines.h:
  57         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
  58         * dfg/DFGByteCodeParser.cpp:
  59         (JSC::DFG::ByteCodeParser::handlePutById):
  60         * dfg/DFGClobberize.h:
  61         (JSC::DFG::clobberize):
  62         * dfg/DFGClobbersExitState.cpp:
  63         (JSC::DFG::clobbersExitState):
  64         * dfg/DFGConstantFoldingPhase.cpp:
  65         (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
  66         * dfg/DFGDoesGC.cpp:
  67         (JSC::DFG::doesGC):
  68         * dfg/DFGFixupPhase.cpp:
  69         (JSC::DFG::FixupPhase::fixupNode):
  70         * dfg/DFGMayExit.cpp:
  71         * dfg/DFGNodeType.h:
  72         * dfg/DFGOperations.cpp:
  73         * dfg/DFGOperations.h:
  74         * dfg/DFGPredictionPropagationPhase.cpp:
  75         * dfg/DFGSafeToExecute.h:
  76         (JSC::DFG::safeToExecute):
  77         * dfg/DFGSpeculativeJIT.cpp:
  78         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
  79         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
  80         (JSC::DFG::SpeculativeJIT::compileNukeStructureAndSetButterfly):
  81         * dfg/DFGSpeculativeJIT.h:
  82         * dfg/DFGSpeculativeJIT32_64.cpp:
  83         (JSC::DFG::SpeculativeJIT::compile):
  84         * dfg/DFGSpeculativeJIT64.cpp:
  85         (JSC::DFG::SpeculativeJIT::compile):
  86         * dfg/DFGStoreBarrierInsertionPhase.cpp:
  87         * dfg/DFGTypeCheckHoistingPhase.cpp:
  88         (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
  89         * ftl/FTLCapabilities.cpp:
  90         (JSC::FTL::canCompile):
  91         * ftl/FTLLowerDFGToB3.cpp:
  92         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
  93         (JSC::FTL::DFG::LowerDFGToB3::compileNukeStructureAndSetButterfly):
  94         (JSC::FTL::DFG::LowerDFGToB3::storageForTransition):
  95         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
  96         (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
  97         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
  98         * runtime/Options.cpp:
  99         (JSC::recomputeDependentOptions):
 100         * runtime/Options.h: Fix a bug - make it possible to turn on concurrent GC optionally again.
 101
 102 2016-12-09  Chris Dumez  <cdumez@apple.com>
 103
 104         Inline JSCell::toObject()
 105         https://bugs.webkit.org/show_bug.cgi?id=165679
 106
 107         Reviewed by Geoffrey Garen.
 108
 109         Inline JSCell::toObject() as it shows on Speedometer profiles.
 110
 111         * runtime/JSCell.cpp:
 112         (JSC::JSCell::toObjectSlow):
 113         (JSC::JSCell::toObject): Deleted.
 114         * runtime/JSCell.h:
 115         * runtime/JSCellInlines.h:
 116         (JSC::JSCell::toObject):
 117
 118 2016-12-09  Geoffrey Garen  <ggaren@apple.com>
 119
 120         Deploy OrdinalNumber in JSC::SourceCode
 121         https://bugs.webkit.org/show_bug.cgi?id=165687
 122
 123         Reviewed by Michael Saboff.
 124
 125         We have a lot of confusion between 1-based and 0-based counting in line
 126         and column numbers. Let's use OrdinalNumber to clear up the confusion.
 127
 128         * bytecode/UnlinkedFunctionExecutable.cpp:
 129         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
 130         (JSC::UnlinkedFunctionExecutable::link):
 131         * bytecompiler/BytecodeGenerator.h:
 132         (JSC::BytecodeGenerator::emitExpressionInfo):
 133         * inspector/JSInjectedScriptHost.cpp:
 134         (Inspector::JSInjectedScriptHost::functionDetails):
 135         * parser/Lexer.cpp:
 136         (JSC::Lexer<T>::setCode):
 137         * parser/Parser.cpp:
 138         (JSC::Parser<LexerType>::Parser):
 139         * parser/Parser.h:
 140         (JSC::Parser<LexerType>::parse):
 141         * parser/SourceCode.h:
 142         (JSC::SourceCode::SourceCode):
 143         (JSC::SourceCode::firstLine):
 144         (JSC::SourceCode::startColumn):
 145         * runtime/CodeCache.cpp:
 146         (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
 147         * runtime/ScriptExecutable.h:
 148         (JSC::ScriptExecutable::firstLine):
 149         (JSC::ScriptExecutable::startColumn):
 150         * tools/CodeProfile.h:
 151         (JSC::CodeProfile::CodeProfile):
 152
 153 2016-12-09  Saam Barati  <sbarati@apple.com>
 154
 155         WebAssembly JS API: implement importing and defining Memory
 156         https://bugs.webkit.org/show_bug.cgi?id=164134
 157
 158         Reviewed by Keith Miller.
 159
 160         This patch implements the WebAssembly.Memory object. It refactors
 161         the code to now associate a Memory with the instance instead of
 162         the Module.
 163
 164         * CMakeLists.txt:
 165         * JavaScriptCore.xcodeproj/project.pbxproj:
 166         * jsc.cpp:
 167         (functionTestWasmModuleFunctions):
 168         * runtime/VM.h:
 169         * shell/CMakeLists.txt:
 170         * testWasm.cpp: Removed.
 171         This has bitrotted. I'm removing it.
 172
 173         * wasm/WasmB3IRGenerator.cpp:
 174         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
 175         (JSC::Wasm::sizeOfLoadOp):
 176         (JSC::Wasm::createJSToWasmWrapper):
 177         (JSC::Wasm::parseAndCompile):
 178         * wasm/WasmB3IRGenerator.h:
 179         * wasm/WasmFormat.cpp:
 180         (JSC::Wasm::ModuleInformation::~ModuleInformation): Deleted.
 181         * wasm/WasmFormat.h:
 182         * wasm/WasmMemory.cpp:
 183         (JSC::Wasm::Memory::Memory):
 184         * wasm/WasmMemory.h:
 185         (JSC::Wasm::Memory::size):
 186         (JSC::Wasm::Memory::initial):
 187         (JSC::Wasm::Memory::maximum):
 188         (JSC::Wasm::Memory::pinnedRegisters): Deleted.
 189         * wasm/WasmMemoryInformation.cpp: Added.
 190         (JSC::Wasm::MemoryInformation::MemoryInformation):
 191         * wasm/WasmMemoryInformation.h: Added.
 192         (JSC::Wasm::MemoryInformation::MemoryInformation):
 193         (JSC::Wasm::MemoryInformation::pinnedRegisters):
 194         (JSC::Wasm::MemoryInformation::initial):
 195         (JSC::Wasm::MemoryInformation::maximum):
 196         (JSC::Wasm::MemoryInformation::isImport):
 197         (JSC::Wasm::MemoryInformation::operator bool):
 198         * wasm/WasmModuleParser.cpp:
 199         (JSC::Wasm::ModuleParser::parseImport):
 200         (JSC::Wasm::ModuleParser::parseMemoryHelper):
 201         (JSC::Wasm::ModuleParser::parseMemory):
 202         (JSC::Wasm::ModuleParser::parseExport):
 203         * wasm/WasmModuleParser.h:
 204         * wasm/WasmPageCount.h: Added. Implement a new way of describing Wasm
 205         pages and then asking for how many bytes a quantity of pages is. This
 206         class also makes it clear when we're talking about bytes or pages.
 207
 208         (JSC::Wasm::PageCount::PageCount):
 209         (JSC::Wasm::PageCount::bytes):
 210         (JSC::Wasm::PageCount::isValid):
 211         (JSC::Wasm::PageCount::max):
 212         (JSC::Wasm::PageCount::operator bool):
 213         (JSC::Wasm::PageCount::operator<):
 214         (JSC::Wasm::PageCount::operator>):
 215         (JSC::Wasm::PageCount::operator>=):
 216         * wasm/WasmPlan.cpp:
 217         (JSC::Wasm::Plan::run):
 218         * wasm/WasmPlan.h:
 219         (JSC::Wasm::Plan::memory): Deleted.
 220         * wasm/WasmValidate.cpp:
 221         (JSC::Wasm::Validate::hasMemory):
 222         (JSC::Wasm::Validate::Validate):
 223         (JSC::Wasm::validateFunction):
 224         * wasm/WasmValidate.h:
 225         * wasm/generateWasmValidateInlinesHeader.py:
 226         * wasm/js/JSWebAssemblyInstance.cpp:
 227         (JSC::JSWebAssemblyInstance::visitChildren):
 228         * wasm/js/JSWebAssemblyInstance.h:
 229         (JSC::JSWebAssemblyInstance::memory):
 230         (JSC::JSWebAssemblyInstance::setMemory):
 231         (JSC::JSWebAssemblyInstance::offsetOfImportFunctions):
 232         (JSC::JSWebAssemblyInstance::allocationSize):
 233         * wasm/js/JSWebAssemblyMemory.cpp:
 234         (JSC::JSWebAssemblyMemory::create):
 235         (JSC::JSWebAssemblyMemory::JSWebAssemblyMemory):
 236         (JSC::JSWebAssemblyMemory::buffer):
 237         (JSC::JSWebAssemblyMemory::visitChildren):
 238         * wasm/js/JSWebAssemblyMemory.h:
 239         (JSC::JSWebAssemblyMemory::memory):
 240         * wasm/js/WebAssemblyFunction.cpp:
 241         (JSC::callWebAssemblyFunction):
 242         * wasm/js/WebAssemblyInstanceConstructor.cpp:
 243         Handle importing and creating of memory according
 244         to the spec. This also does the needed validation
 245         of making sure the memory defined in the module
 246         is compatible with the imported memory.
 247
 248         (JSC::constructJSWebAssemblyInstance):
 249         * wasm/js/WebAssemblyMemoryConstructor.cpp:
 250         (JSC::constructJSWebAssemblyMemory):
 251         (JSC::callJSWebAssemblyMemory):
 252         * wasm/js/WebAssemblyMemoryPrototype.cpp:
 253         (JSC::webAssemblyMemoryProtoFuncBuffer):
 254         (JSC::WebAssemblyMemoryPrototype::create):
 255         (JSC::WebAssemblyMemoryPrototype::finishCreation):
 256         * wasm/js/WebAssemblyMemoryPrototype.h:
 257         * wasm/js/WebAssemblyModuleRecord.cpp:
 258         (JSC::WebAssemblyModuleRecord::finishCreation):
 259         (JSC::WebAssemblyModuleRecord::link):
 260
 261 2016-12-09  Joseph Pecoraro  <pecoraro@apple.com>
 262
 263         Web Inspector: Some resources fetched via Fetch API do not have data
 264         https://bugs.webkit.org/show_bug.cgi?id=165230
 265         <rdar://problem/29449220>
 266
 267         Reviewed by Alex Christensen.
 268
 269         * inspector/protocol/Page.json:
 270         Add new Fetch Page.ResourceType.
 271
 272 2016-12-09  Geoffrey Garen  <ggaren@apple.com>
 273
 274         TextPosition and OrdinalNumber should be more like idiomatic numbers
 275         https://bugs.webkit.org/show_bug.cgi?id=165678
 276
 277         Reviewed by Filip Pizlo.
 278
 279         Adopt default constructor.
 280
 281         * API/JSBase.cpp:
 282         (JSEvaluateScript):
 283         (JSCheckScriptSyntax):
 284         * API/JSObjectRef.cpp:
 285         (JSObjectMakeFunction):
 286         * API/JSScriptRef.cpp:
 287         (OpaqueJSScript::OpaqueJSScript):
 288         * jsc.cpp:
 289         (functionCheckModuleSyntax):
 290         * parser/SourceCode.h:
 291         (JSC::makeSource):
 292         * parser/SourceProvider.h:
 293         (JSC::StringSourceProvider::create):
 294         (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
 295         * runtime/FunctionConstructor.cpp:
 296         (JSC::constructFunction):
 297         * runtime/ModuleLoaderPrototype.cpp:
 298         (JSC::moduleLoaderPrototypeParseModule):
 299
 300 2016-12-09  Filip Pizlo  <fpizlo@apple.com>
 301
 302         Unreviewed, disable concurrent GC for real.
 303
 304         * runtime/Options.cpp:
 305         (JSC::recomputeDependentOptions):
 306
 307 2016-12-09  Filip Pizlo  <fpizlo@apple.com>
 308
 309         Unreviewed, disable concurrent GC while crashes get investigated.
 310
 311         * runtime/Options.cpp:
 312         (JSC::recomputeDependentOptions):
 313
 314 2016-12-09  Filip Pizlo  <fpizlo@apple.com>
 315
 316         JSSegmentedVariableObject should keep its state private
 317
 318         Rubber stamped by Michael Saboff.
 319
 320         Its state fields were protected for no reason. They really should be private because
 321         you have to know to obey a particular concurrency protocol when accessing them.
 322
 323         * runtime/JSSegmentedVariableObject.h:
 324
 325 2016-12-09  Csaba Osztrogonác  <ossy@webkit.org>
 326
 327         Unreviewed ARM buildfix after 209570.
 328
 329         * assembler/MacroAssemblerARM.h:
 330         (JSC::MacroAssemblerARM::or32): Added.
 331
 332 2016-12-08  JF Bastien  <jfbastien@apple.com>
 333
 334         WebAssembly: JSC::link* shouldn't need a CodeBlock
 335         https://bugs.webkit.org/show_bug.cgi?id=165591
 336
 337         Reviewed by Keith Miller.
 338
 339         Allow linking without a CodeBlock, which WebAssembly's wasm -> JS stubs does. This needs to work for polymorphic and virtual calls. This patch adds corresponding tests for this.
 340
 341         * assembler/LinkBuffer.cpp:
 342         (JSC::shouldDumpDisassemblyFor): don't look at the tier option if there isn't a CodeBlock, only look at the global one. This is a WebAssembly function, so the tier information is irrelevant.
 343         * jit/Repatch.cpp:
 344         (JSC::isWebAssemblyToJSCallee): this is used in the link* functions below
 345         (JSC::linkFor):
 346         (JSC::linkVirtualFor):
 347         (JSC::linkPolymorphicCall):
 348         * runtime/Options.h: add an option to change the maximum number of polymorphic calls in stubs from wasm to JS, which will come in handy when we try to tune performance or try merging some of the WebAssembly stubs
 349         * wasm/WasmBinding.cpp:
 350         (JSC::Wasm::importStubGenerator): remove the breakpoint since the code now works
 351         * wasm/js/WebAssemblyToJSCallee.h:
 352
 353 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
 354
 355         MultiPutByOffset should get a barrier if it transitions
 356         https://bugs.webkit.org/show_bug.cgi?id=165646
 357
 358         Reviewed by Keith Miller.
 359
 360         Previously, if we knew that we were storing a non-cell but we needed to transition, we
 361         would fail to add the barrier but the FTL's lowering expected the barrier to be there.
 362
 363         Strictly, we need to "consider" the barrier on MultiPutByOffset if the value is
 364         possibly a cell or if the MultiPutByOffset may transition. Then "considering" the
 365         barrier implies checking if the base is possibly old.
 366
 367         But because the barrier is so cheap anyway, this patch implements something safer: we
 368         just consider the barrier on MultiPutByOffset unconditionally, which opts it out of any
 369         barrier optimizations other than those based on the predicted state of the base. Those
 370         optimizations are already sound - for example they use doesGC() to detect safepoints
 371         and that function correctly predicts when MultiPutByOffset could GC.
 372
 373         Because the barrier optimizations are only a very small speed-up, I think it's great to
 374         fix bugs by weakening the optimizer without cleverness.
 375
 376         * dfg/DFGFixupPhase.cpp:
 377         * dfg/DFGStoreBarrierInsertionPhase.cpp:
 378         * heap/MarkedBlock.cpp:
 379         (JSC::MarkedBlock::assertValidCell):
 380
 381 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
 382
 383         Enable concurrent GC on ARM64
 384         https://bugs.webkit.org/show_bug.cgi?id=165643
 385
 386         Reviewed by Saam Barati.
 387
 388         It looks stable enough to enable.
 389
 390         * assembler/CPU.h:
 391         (JSC::useGCFences): Deleted.
 392         * bytecode/PolymorphicAccess.cpp:
 393         (JSC::AccessCase::generateImpl):
 394         * dfg/DFGSpeculativeJIT.cpp:
 395         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
 396         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
 397         * ftl/FTLLowerDFGToB3.cpp:
 398         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
 399         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
 400         (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
 401         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
 402         * jit/AssemblyHelpers.h:
 403         (JSC::AssemblyHelpers::mutatorFence):
 404         (JSC::AssemblyHelpers::storeButterfly):
 405         (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly):
 406         (JSC::AssemblyHelpers::emitInitializeInlineStorage):
 407         (JSC::AssemblyHelpers::emitInitializeOutOfLineStorage):
 408         * runtime/Options.cpp:
 409         (JSC::recomputeDependentOptions):
 410
 411 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
 412
 413         Disable collectContinuously if not useConcurrentGC
 414
 415         Rubber stamped by Geoffrey Garen.
 416
 417         * runtime/Options.cpp:
 418         (JSC::recomputeDependentOptions):
 419
 420 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
 421
 422         Unreviewed, fix cloop build.
 423
 424         * runtime/JSObject.h:
 425
 426 2016-12-06  Filip Pizlo  <fpizlo@apple.com>
 427
 428         Concurrent GC should be stable enough to land enabled on X86_64
 429         https://bugs.webkit.org/show_bug.cgi?id=164990
 430
 431         Reviewed by Geoffrey Garen.
 432
 433         This fixes a ton of performance and correctness bugs revealed by getting the concurrent GC to
 434         be stable enough to land enabled.
 435
 436         I had to redo the JSObject::visitChildren concurrency protocol again. This time I think it's
 437         even more correct than ever!
 438
 439         This is an enormous win on JetStream/splay-latency and Octane/SplayLatency. It looks to be
 440         mostly neutral on everything else, though Speedometer is showing statistically weak signs of a
 441         slight regression.
 442
 443         * API/JSAPIWrapperObject.mm: Added locking.
 444         (JSC::JSAPIWrapperObject::visitChildren):
 445         * API/JSCallbackObject.h: Added locking.
 446         (JSC::JSCallbackObjectData::visitChildren):
 447         (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
 448         (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
 449         (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
 450         * CMakeLists.txt:
 451         * JavaScriptCore.xcodeproj/project.pbxproj:
 452         * bytecode/CodeBlock.cpp:
 453         (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): This had a TOCTOU race on shouldJettisonDueToOldAge.
 454         (JSC::EvalCodeCache::visitAggregate): Moved to EvalCodeCache.cpp.
 455         * bytecode/DirectEvalCodeCache.cpp: Added. Outlined some functions and made them use locks.
 456         (JSC::DirectEvalCodeCache::setSlow):
 457         (JSC::DirectEvalCodeCache::clear):
 458         (JSC::DirectEvalCodeCache::visitAggregate):
 459         * bytecode/DirectEvalCodeCache.h:
 460         (JSC::DirectEvalCodeCache::set):
 461         (JSC::DirectEvalCodeCache::clear): Deleted.
 462         * bytecode/UnlinkedCodeBlock.cpp: Added locking.
 463         (JSC::UnlinkedCodeBlock::visitChildren):
 464         (JSC::UnlinkedCodeBlock::setInstructions):
 465         (JSC::UnlinkedCodeBlock::shrinkToFit):
 466         * bytecode/UnlinkedCodeBlock.h: Added locking.
 467         (JSC::UnlinkedCodeBlock::addRegExp):
 468         (JSC::UnlinkedCodeBlock::addConstant):
 469         (JSC::UnlinkedCodeBlock::addFunctionDecl):
 470         (JSC::UnlinkedCodeBlock::addFunctionExpr):
 471         (JSC::UnlinkedCodeBlock::createRareDataIfNecessary):
 472         (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
 473         * debugger/Debugger.cpp: Use the right delete API.
 474         (JSC::Debugger::recompileAllJSFunctions):
 475         * dfg/DFGAbstractInterpreterInlines.h:
 476         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Fix a pre-existing bug in ToFunction constant folding.
 477         * dfg/DFGClobberize.h: Add support for nuking.
 478         (JSC::DFG::clobberize):
 479         * dfg/DFGClobbersExitState.cpp: Add support for nuking.
 480         (JSC::DFG::clobbersExitState):
 481         * dfg/DFGFixupPhase.cpp: Add support for nuking.
 482         (JSC::DFG::FixupPhase::fixupNode):
 483         (JSC::DFG::FixupPhase::indexForChecks):
 484         (JSC::DFG::FixupPhase::originForCheck):
 485         (JSC::DFG::FixupPhase::speculateForBarrier):
 486         (JSC::DFG::FixupPhase::insertCheck):
 487         (JSC::DFG::FixupPhase::fixupChecksInBlock):
 488         * dfg/DFGSpeculativeJIT.cpp: Add support for nuking.
 489         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
 490         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
 491         * ftl/FTLLowerDFGToB3.cpp: Add support for nuking.
 492         (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
 493         (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
 494         (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
 495         (JSC::FTL::DFG::LowerDFGToB3::nukeStructureAndSetButterfly):
 496         (JSC::FTL::DFG::LowerDFGToB3::setButterfly): Deleted.
 497         * heap/CodeBlockSet.cpp: We need to be more careful about the CodeBlockSet workflow during GC, since we will allocate CodeBlocks in eden while collecting.
 498         (JSC::CodeBlockSet::clearMarksForFullCollection):
 499         (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
 500         * heap/Heap.cpp: Added code to measure max pauses. Added a better collectContinuously mode.
 501         (JSC::Heap::lastChanceToFinalize): Stop the collectContinuously thread.
 502         (JSC::Heap::harvestWeakReferences): Inline SlotVisitor::harvestWeakReferences.
 503         (JSC::Heap::finalizeUnconditionalFinalizers): Inline SlotVisitor::finalizeUnconditionalReferences.
 504         (JSC::Heap::markToFixpoint): We need to do some MarkedSpace stuff before every conservative scan, rather than just at the start of marking, so we now call prepareForConservativeScan() before each conservative scan. Also call a less-parallel version of drainInParallel when the mutator is running.
 505         (JSC::Heap::collectInThread): Inline Heap::prepareForAllocation().
 506         (JSC::Heap::stopIfNecessarySlow): We need to be more careful about ensuring that we run finalization before and after stopping. Also, we should sanitize stack when stopping the world.
 507         (JSC::Heap::acquireAccessSlow): Add some optional debug prints.
 508         (JSC::Heap::handleNeedFinalize): Assert that we are running this when the world is not stopped.
 509         (JSC::Heap::finalize): Remove the old collectContinuously code.
 510         (JSC::Heap::requestCollection): We don't need to sanitize stack here anymore.
 511         (JSC::Heap::notifyIsSafeToCollect): Start the collectContinuously thread. It will request collection 1 KHz.
 512         (JSC::Heap::prepareForAllocation): Deleted.
 513         (JSC::Heap::preventCollection): Prevent any new concurrent GCs from being initiated.
 514         (JSC::Heap::allowCollection):
 515         (JSC::Heap::forEachSlotVisitor): Allows us to safely iterate slot visitors.
 516         * heap/Heap.h:
 517         * heap/HeapInlines.h:
 518         (JSC::Heap::writeBarrier): If the 'to' cell is not NewWhite then it could be AnthraciteOrBlack. During a full collection, objects may be AnthraciteOrBlack from a previous GC. Turns out, we don't benefit from this optimization so we can just kill it.
 519         * heap/HeapSnapshotBuilder.cpp:
 520         (JSC::HeapSnapshotBuilder::buildSnapshot): This needs to use PreventCollectionScope to ensure snapshot soundness.
 521         * heap/ListableHandler.h:
 522         (JSC::ListableHandler::isOnList): Useful helper.
 523         * heap/LockDuringMarking.h:
 524         (JSC::lockDuringMarking): It's a locker that only locks while we're marking.
 525         * heap/MarkedAllocator.cpp:
 526         (JSC::MarkedAllocator::addBlock): Hold the bitvector lock while resizing.
 527         * heap/MarkedBlock.cpp: Hold the bitvector lock while accessing the bitvectors while the mutator is running.
 528         * heap/MarkedSpace.cpp:
 529         (JSC::MarkedSpace::prepareForConservativeScan): We used to do this in prepareForMarking, but we need to do it before each conservative scan not just before marking.
 530         (JSC::MarkedSpace::prepareForMarking): Remove the logic moved to prepareForConservativeScan.
 531         * heap/MarkedSpace.h:
 532         * heap/PreventCollectionScope.h: Added.
 533         * heap/SlotVisitor.cpp: Refactored drainFromShared so that we can write a similar function called drainInParallelPassively.
 534         (JSC::SlotVisitor::updateMutatorIsStopped): Update whether we can use "fast" scanning.
 535         (JSC::SlotVisitor::mutatorIsStoppedIsUpToDate):
 536         (JSC::SlotVisitor::didReachTermination):
 537         (JSC::SlotVisitor::hasWork):
 538         (JSC::SlotVisitor::drain): This now uses the rightToRun lock to allow the main GC thread to safepoint the workers.
 539         (JSC::SlotVisitor::drainFromShared):
 540         (JSC::SlotVisitor::drainInParallelPassively): This runs marking with one fewer threads than normal. It's useful for when we have resumed the mutator, since then the mutator has a better chance of getting on a core.
 541         (JSC::SlotVisitor::addWeakReferenceHarvester):
 542         (JSC::SlotVisitor::addUnconditionalFinalizer):
 543         (JSC::SlotVisitor::harvestWeakReferences): Deleted.
 544         (JSC::SlotVisitor::finalizeUnconditionalFinalizers): Deleted.
 545         * heap/SlotVisitor.h:
 546         * heap/SlotVisitorInlines.h: Outline stuff.
 547         (JSC::SlotVisitor::addWeakReferenceHarvester): Deleted.
 548         (JSC::SlotVisitor::addUnconditionalFinalizer): Deleted.
 549         * runtime/InferredType.cpp: This needed thread safety.
 550         (JSC::InferredType::visitChildren): This needs to keep its structure finalizer alive until it runs.
 551         (JSC::InferredType::set):
 552         (JSC::InferredType::InferredStructureFinalizer::finalizeUnconditionally):
 553         * runtime/InferredType.h:
 554         * runtime/InferredValue.cpp: This needed thread safety.
 555         (JSC::InferredValue::visitChildren):
 556         (JSC::InferredValue::ValueCleanup::finalizeUnconditionally):
 557         * runtime/JSArray.cpp:
 558         (JSC::JSArray::unshiftCountSlowCase): Update to use new butterfly API.
 559         (JSC::JSArray::unshiftCountWithArrayStorage): Update to use new butterfly API.
 560         * runtime/JSArrayBufferView.cpp:
 561         (JSC::JSArrayBufferView::visitChildren): Thread safety.
 562         * runtime/JSCell.h:
 563         (JSC::JSCell::setStructureIDDirectly): This is used for nuking the structure.
 564         (JSC::JSCell::InternalLocker::InternalLocker): Deleted. The cell is now the lock.
 565         (JSC::JSCell::InternalLocker::~InternalLocker): Deleted. The cell is now the lock.
 566         * runtime/JSCellInlines.h:
 567         (JSC::JSCell::structure): Clean this up.
 568         (JSC::JSCell::lock): The cell is now the lock.
 569         (JSC::JSCell::tryLock):
 570         (JSC::JSCell::unlock):
 571         (JSC::JSCell::isLocked):
 572         (JSC::JSCell::lockInternalLock): Deleted.
 573         (JSC::JSCell::unlockInternalLock): Deleted.
 574         * runtime/JSFunction.cpp:
 575         (JSC::JSFunction::visitChildren): Thread safety.
 576         * runtime/JSGenericTypedArrayViewInlines.h:
 577         (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren): Thread safety.
 578         (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory): Thread safety.
 579         * runtime/JSObject.cpp:
 580         (JSC::JSObject::markAuxiliaryAndVisitOutOfLineProperties): Factor out this "easy" step of butterfly visiting.
 581         (JSC::JSObject::visitButterfly): Make this achieve 100% precision about structure-butterfly relationships. This relies on the mutator "nuking" the structure prior to "locked" structure-butterfly transitions.
 582         (JSC::JSObject::visitChildren): Use the new, nicer API.
 583         (JSC::JSFinalObject::visitChildren): Use the new, nicer API.
 584         (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists): Use the new butterfly API.
 585         (JSC::JSObject::createInitialUndecided): Use the new butterfly API.
 586         (JSC::JSObject::createInitialInt32): Use the new butterfly API.
 587         (JSC::JSObject::createInitialDouble): Use the new butterfly API.
 588         (JSC::JSObject::createInitialContiguous): Use the new butterfly API.
 589         (JSC::JSObject::createArrayStorage): Use the new butterfly API.
 590         (JSC::JSObject::convertUndecidedToContiguous): Use the new butterfly API.
 591         (JSC::JSObject::convertUndecidedToArrayStorage): Use the new butterfly API.
 592         (JSC::JSObject::convertInt32ToArrayStorage): Use the new butterfly API.
 593         (JSC::JSObject::convertDoubleToContiguous): Use the new butterfly API.
 594         (JSC::JSObject::convertDoubleToArrayStorage): Use the new butterfly API.
 595         (JSC::JSObject::convertContiguousToArrayStorage): Use the new butterfly API.
 596         (JSC::JSObject::increaseVectorLength): Use the new butterfly API.
 597         (JSC::JSObject::shiftButterflyAfterFlattening): Use the new butterfly API.
 598         * runtime/JSObject.h:
 599         (JSC::JSObject::setButterfly): This now does all of the fences. Only use this when you are not also transitioning the structure or the structure's lastOffset.
 600         (JSC::JSObject::nukeStructureAndSetButterfly): Use this when doing locked structure-butterfly transitions.
 601         * runtime/JSObjectInlines.h:
 602         (JSC::JSObject::putDirectWithoutTransition): Use the newly factored out API.
 603         (JSC::JSObject::prepareToPutDirectWithoutTransition): Factor this out!
 604         (JSC::JSObject::putDirectInternal): Use the newly factored out API.
 605         * runtime/JSPropertyNameEnumerator.cpp:
 606         (JSC::JSPropertyNameEnumerator::finishCreation): Locks!
 607         (JSC::JSPropertyNameEnumerator::visitChildren): Locks!
 608         * runtime/JSSegmentedVariableObject.cpp:
 609         (JSC::JSSegmentedVariableObject::visitChildren): Locks!
 610         * runtime/JSString.cpp:
 611         (JSC::JSString::visitChildren): Thread safety.
 612         * runtime/ModuleProgramExecutable.cpp:
 613         (JSC::ModuleProgramExecutable::visitChildren): Thread safety.
 614         * runtime/Options.cpp: For now we disable concurrent GC on not-X86_64.
 615         (JSC::recomputeDependentOptions):
 616         * runtime/Options.h: Change the default max GC parallelism to 8. I don't know why it was still 7.
 617         * runtime/SamplingProfiler.cpp:
 618         (JSC::SamplingProfiler::stackTracesAsJSON): This needs to defer GC before grabbing its lock.
 619         * runtime/SparseArrayValueMap.cpp: This needed thread safety.
 620         (JSC::SparseArrayValueMap::add):
 621         (JSC::SparseArrayValueMap::remove):
 622         (JSC::SparseArrayValueMap::visitChildren):
 623         * runtime/SparseArrayValueMap.h:
 624         * runtime/Structure.cpp: This had a race between addNewPropertyTransition and visitChildren.
 625         (JSC::Structure::Structure):
 626         (JSC::Structure::materializePropertyTable):
 627         (JSC::Structure::addNewPropertyTransition):
 628         (JSC::Structure::flattenDictionaryStructure):
 629         (JSC::Structure::add): Help out with nuking support - the m_offset needs to play along.
 630         (JSC::Structure::visitChildren):
 631         * runtime/Structure.h: Make some useful things public - like the notion of a lastOffset.
 632         * runtime/StructureChain.cpp:
 633         (JSC::StructureChain::visitChildren): Thread safety!
 634         * runtime/StructureChain.h: Thread safety!
 635         * runtime/StructureIDTable.cpp:
 636         (JSC::StructureIDTable::allocateID): Ensure that we don't get nuked IDs.
 637         * runtime/StructureIDTable.h: Add the notion of a nuked ID! It's a bit that the runtime never sees except during specific shady actions like locked structure-butterfly transitions. "Nuking" tells the GC to steer clear and rescan once we fire the barrier.
 638         (JSC::nukedStructureIDBit):
 639         (JSC::nuke):
 640         (JSC::isNuked):
 641         (JSC::decontaminate):
 642         * runtime/StructureInlines.h:
 643         (JSC::Structure::hasIndexingHeader): Better API.
 644         (JSC::Structure::add):
 645         * runtime/VM.cpp: Better GC interaction.
 646         (JSC::VM::ensureWatchdog):
 647         (JSC::VM::deleteAllLinkedCode):
 648         (JSC::VM::deleteAllCode):
 649         * runtime/VM.h:
 650         (JSC::VM::getStructure): Why wasn't this always an API!
 651         * runtime/WebAssemblyExecutable.cpp:
 652         (JSC::WebAssemblyExecutable::visitChildren): Thread safety.
 653
 654 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
 655
 656         Enable SharedArrayBuffer, remove the flag
 657         https://bugs.webkit.org/show_bug.cgi?id=165614
 658
 659         Rubber stamped by Geoffrey Garen.
 660
 661         * runtime/JSGlobalObject.cpp:
 662         (JSC::JSGlobalObject::init):
 663         * runtime/RuntimeFlags.h:
 664
 665 2016-12-08  JF Bastien  <jfbastien@apple.com>
 666
 667         WebAssembly JS API: wire up Instance imports
 668         https://bugs.webkit.org/show_bug.cgi?id=165118
 669
 670         Reviewed by Saam Barati.
 671
 672         Change a bunch of the WebAssembly object model, and pipe the
 673         necessary changes to be able to call JS imports from
 674         WebAssembly. This will make it easier to call_indirect, and
 675         unblock many other missing features.
 676
 677         As a follow-up I need to teach JSC::linkFor to live without a
 678         CodeBlock: wasm doesn't have one and the IC patching is sad. We'll
 679         switch on the callee (or its type?) and then use that as the owner
 680         (because the callee is alive if the instance is alive, ditto
 681         module, and module owns the CallLinkInfo).
 682
 683         * CMakeLists.txt:
 684         * JavaScriptCore.xcodeproj/project.pbxproj:
 685         * interpreter/CallFrame.h:
 686         (JSC::ExecState::callee): give access to the callee as a JSCell
 687         * jit/RegisterSet.cpp: dead code from previous WebAssembly implementation
 688         * jsc.cpp:
 689         (callWasmFunction):
 690         (functionTestWasmModuleFunctions):
 691         * runtime/JSCellInlines.h:
 692         (JSC::ExecState::vm): check callee instead of jsCallee: wasm only has a JSCell and not a JSObject
 693         * runtime/VM.cpp:
 694         (JSC::VM::VM): store the "top" WebAssembly.Instance on entry to WebAssembly (and restore the previous one on exit)
 695         * runtime/VM.h:
 696         * testWasm.cpp:
 697         (runWasmTests):
 698         * wasm/JSWebAssembly.h:
 699         * wasm/WasmB3IRGenerator.cpp:
 700         (JSC::Wasm::B3IRGenerator::B3IRGenerator): pass unlinked calls around to shorten their lifetime: they're ony needed until the Plan is done
 701         (JSC::Wasm::B3IRGenerator::addCall):
 702         (JSC::Wasm::createJSToWasmWrapper):
 703         (JSC::Wasm::parseAndCompile): also pass in the function index space, so that imports can be signature-checked along with internal functions
 704         * wasm/WasmB3IRGenerator.h:
 705         * wasm/WasmBinding.cpp: Added.
 706         (JSC::Wasm::importStubGenerator): stubs from wasm to JS
 707         * wasm/WasmBinding.h: Copied from Source/JavaScriptCore/wasm/WasmValidate.h.
 708         * wasm/WasmCallingConvention.h:
 709         (JSC::Wasm::CallingConvention::setupFrameInPrologue):
 710         * wasm/WasmFormat.h: fix the object model
 711         (JSC::Wasm::CallableFunction::CallableFunction):
 712         * wasm/WasmFunctionParser.h: simplify some of the failure condition checks
 713         (JSC::Wasm::FunctionParser<Context>::FunctionParser): need function index space, not just internal functions
 714         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 715         * wasm/WasmModuleParser.cpp: early-create some of the structures which will be needed later
 716         (JSC::Wasm::ModuleParser::parseImport):
 717         (JSC::Wasm::ModuleParser::parseFunction):
 718         (JSC::Wasm::ModuleParser::parseMemory):
 719         (JSC::Wasm::ModuleParser::parseExport):
 720         (JSC::Wasm::ModuleParser::parseCode):
 721         * wasm/WasmModuleParser.h:
 722         (JSC::Wasm::ModuleParser::functionIndexSpace):
 723         (JSC::Wasm::ModuleParser::functionLocations):
 724         * wasm/WasmParser.h:
 725         (JSC::Wasm::Parser::consumeUTF8String):
 726         * wasm/WasmPlan.cpp: pass around the wasm objects at the right time, reducing their lifetime and making it easier to pass them around when needed
 727         (JSC::Wasm::Plan::run):
 728         (JSC::Wasm::Plan::initializeCallees):
 729         * wasm/WasmPlan.h:
 730         (JSC::Wasm::Plan::exports):
 731         (JSC::Wasm::Plan::internalFunctionCount):
 732         (JSC::Wasm::Plan::jsToWasmEntryPointForFunction):
 733         (JSC::Wasm::Plan::takeModuleInformation):
 734         (JSC::Wasm::Plan::takeCallLinkInfos):
 735         (JSC::Wasm::Plan::takeWasmToJSStubs):
 736         (JSC::Wasm::Plan::takeFunctionIndexSpace):
 737         * wasm/WasmValidate.cpp: check function index space instead of only internal functions
 738         (JSC::Wasm::Validate::addCall):
 739         (JSC::Wasm::validateFunction):
 740         * wasm/WasmValidate.h:
 741         * wasm/js/JSWebAssemblyCallee.cpp:
 742         (JSC::JSWebAssemblyCallee::finishCreation):
 743         * wasm/js/JSWebAssemblyCallee.h:
 744         (JSC::JSWebAssemblyCallee::create):
 745         (JSC::JSWebAssemblyCallee::jsToWasmEntryPoint):
 746         * wasm/js/JSWebAssemblyInstance.cpp:
 747         (JSC::JSWebAssemblyInstance::create):
 748         (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
 749         (JSC::JSWebAssemblyInstance::visitChildren):
 750         * wasm/js/JSWebAssemblyInstance.h: hold the import functions off the end of the Instance
 751         (JSC::JSWebAssemblyInstance::importFunction):
 752         (JSC::JSWebAssemblyInstance::importFunctions):
 753         (JSC::JSWebAssemblyInstance::setImportFunction):
 754         (JSC::JSWebAssemblyInstance::offsetOfImportFunctions):
 755         (JSC::JSWebAssemblyInstance::offsetOfImportFunction):
 756         (JSC::JSWebAssemblyInstance::allocationSize):
 757         * wasm/js/JSWebAssemblyModule.cpp:
 758         (JSC::JSWebAssemblyModule::create):
 759         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
 760         (JSC::JSWebAssemblyModule::visitChildren):
 761         * wasm/js/JSWebAssemblyModule.h: hold the link call info, the import function stubs, and the function index space
 762         (JSC::JSWebAssemblyModule::signatureForFunctionIndexSpace):
 763         (JSC::JSWebAssemblyModule::importCount):
 764         (JSC::JSWebAssemblyModule::calleeFromFunctionIndexSpace):
 765         * wasm/js/WebAssemblyFunction.cpp:
 766         (JSC::callWebAssemblyFunction): set top Instance on VM
 767         * wasm/js/WebAssemblyFunction.h:
 768         (JSC::WebAssemblyFunction::instance):
 769         * wasm/js/WebAssemblyInstanceConstructor.cpp:
 770         (JSC::constructJSWebAssemblyInstance): handle function imports
 771         * wasm/js/WebAssemblyModuleConstructor.cpp:
 772         (JSC::constructJSWebAssemblyModule): generate the stubs for import functions
 773         * wasm/js/WebAssemblyModuleRecord.cpp:
 774         (JSC::WebAssemblyModuleRecord::link):
 775         * wasm/js/WebAssemblyToJSCallee.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp.
 776         (JSC::WebAssemblyToJSCallee::create): dummy JSCell singleton which lives on the VM, and is put as the callee in the import stub's frame to identified it when unwinding
 777         (JSC::WebAssemblyToJSCallee::createStructure):
 778         (JSC::WebAssemblyToJSCallee::WebAssemblyToJSCallee):
 779         (JSC::WebAssemblyToJSCallee::finishCreation):
 780         (JSC::WebAssemblyToJSCallee::destroy):
 781         * wasm/js/WebAssemblyToJSCallee.h: Copied from Source/JavaScriptCore/wasm/WasmB3IRGenerator.h.
 782
 783 2016-12-08  Mark Lam  <mark.lam@apple.com>
 784
 785         Enable JSC restricted options by default in the jsc shell.
 786         https://bugs.webkit.org/show_bug.cgi?id=165615
 787
 788         Reviewed by Keith Miller.
 789
 790         The jsc shell is only used for debugging and development testing.  We should
 791         allow it to use restricted options like JSC_useDollarVM even for release builds.
 792
 793         * jsc.cpp:
 794         (jscmain):
 795         * runtime/Options.cpp:
 796         (JSC::Options::enableRestrictedOptions):
 797         (JSC::Options::isAvailable):
 798         (JSC::allowRestrictedOptions): Deleted.
 799         * runtime/Options.h:
 800
 801 2016-12-08  Chris Dumez  <cdumez@apple.com>
 802
 803         Unreviewed, rolling out r209489.
 804
 805         Likely caused large regressions on JetStream, Sunspider and
 806         Speedometer
 807
 808         Reverted changeset:
 809
 810         "Add system trace points for JavaScript VM entry/exit"
 811         https://bugs.webkit.org/show_bug.cgi?id=165550
 812         http://trac.webkit.org/changeset/209489
 813
 814 2016-12-08  Keith Miller  <keith_miller@apple.com>
 815
 816         Move LEB tests to API tests
 817         https://bugs.webkit.org/show_bug.cgi?id=165586
 818
 819         Reviewed by Saam Barati.
 820
 821         Delete old stuff.
 822
 823         * testWasm.cpp:
 824         (printUsageStatement):
 825         (CommandLine::parseArguments):
 826         (main):
 827         (runLEBTests): Deleted.
 828
 829 2016-12-07  JF Bastien  <jfbastien@apple.com>
 830
 831         Cleanup WebAssembly's RETURN_IF_EXCEPTION
 832         https://bugs.webkit.org/show_bug.cgi?id=165595
 833
 834         Reviewed by Filip Pizlo.
 835
 836         * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
 837         (JSC::constructJSWebAssemblyCompileError):
 838         * wasm/js/WebAssemblyFunction.cpp:
 839         (JSC::callWebAssemblyFunction):
 840         * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
 841         (JSC::constructJSWebAssemblyRuntimeError):
 842
 843 2016-12-07  Geoffrey Garen  <ggaren@apple.com>
 844
 845         Renamed SourceCode members to match their accessor names
 846         https://bugs.webkit.org/show_bug.cgi?id=165573
 847
 848         Reviewed by Keith Miller.
 849
 850         startChar => startOffset
 851         endChar => endOffset
 852
 853         * parser/UnlinkedSourceCode.h:
 854         (JSC::UnlinkedSourceCode::UnlinkedSourceCode):
 855         (JSC::UnlinkedSourceCode::view):
 856         (JSC::UnlinkedSourceCode::startOffset):
 857         (JSC::UnlinkedSourceCode::endOffset):
 858         (JSC::UnlinkedSourceCode::length):
 859
 860 2016-12-07  Keith Miller  <keith_miller@apple.com>
 861
 862         Add more missing trivial wasm ops.
 863         https://bugs.webkit.org/show_bug.cgi?id=165564
 864
 865         Reviewed by Geoffrey Garen.
 866
 867         This patch adds the nop, drop, and tee_local opcodes.
 868         It also fixes an issue where we were not generating
 869         the proper enums for the grow_memory and current_memory
 870         opcodes.
 871
 872         * wasm/WasmFunctionParser.h:
 873         (JSC::Wasm::FunctionParser<Context>::parseExpression):
 874         * wasm/generateWasmOpsHeader.py:
 875
 876 2016-12-07  Geoffrey Garen  <ggaren@apple.com>
 877
 878         Renamed source => parentSource
 879         https://bugs.webkit.org/show_bug.cgi?id=165570
 880
 881         Reviewed by Keith Miller.
 882
 883         For less confuse.
 884
 885         * bytecode/UnlinkedFunctionExecutable.cpp:
 886         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
 887
 888 2016-12-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 889
 890         [JSC] Drop translate phase in module loader
 891         https://bugs.webkit.org/show_bug.cgi?id=164861
 892
 893         Reviewed by Saam Barati.
 894
 895         Originally, this "translate" phase was introduced to the module loader.
 896         However, recent rework discussion[1] starts dropping this phase.
 897         And this "translate" phase is meaningless in the browser side module loader
 898         since this phase originally mimics the node.js's translation hook (like,
 899         transpiling CoffeeScript source to JavaScript).
 900
 901         This "translate" phase is not necessary for the exposed HTML5
 902         <script type="module"> tag right now. Once the module loader pipeline is
 903         redefined and specified, we need to update the current loader anyway.
 904         So dropping "translate" phase right now is OK.
 905
 906         This a bit simplifies the current module loader pipeline.
 907
 908         [1]: https://github.com/whatwg/loader/issues/147
 909
 910         * builtins/ModuleLoaderPrototype.js:
 911         (newRegistryEntry):
 912         (fulfillFetch):
 913         (requestFetch):
 914         (requestInstantiate):
 915         (provide):
 916         (fulfillTranslate): Deleted.
 917         (requestTranslate): Deleted.
 918         * bytecode/BytecodeIntrinsicRegistry.cpp:
 919         (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
 920         * jsc.cpp:
 921         * runtime/JSGlobalObject.cpp:
 922         * runtime/JSGlobalObject.h:
 923         * runtime/JSModuleLoader.cpp:
 924         (JSC::JSModuleLoader::translate): Deleted.
 925         * runtime/JSModuleLoader.h:
 926         * runtime/ModuleLoaderPrototype.cpp:
 927         (JSC::moduleLoaderPrototypeInstantiate):
 928         (JSC::moduleLoaderPrototypeTranslate): Deleted.
 929
 930 2016-12-07  Joseph Pecoraro  <pecoraro@apple.com>
 931
 932         Web Inspector: Add ability to distinguish if a Script was parsed as a module
 933         https://bugs.webkit.org/show_bug.cgi?id=164900
 934         <rdar://problem/29323817>
 935
 936         Reviewed by Timothy Hatcher.
 937
 938         * inspector/agents/InspectorDebuggerAgent.cpp:
 939         (Inspector::InspectorDebuggerAgent::didParseSource):
 940         * inspector/protocol/Debugger.json:
 941         Add an optional event parameter to distinguish if a script was a module or not.
 942
 943 2016-12-07  Simon Fraser  <simon.fraser@apple.com>
 944
 945         Add system trace points for JavaScript VM entry/exit
 946         https://bugs.webkit.org/show_bug.cgi?id=165550
 947
 948         Reviewed by Tim Horton.
 949
 950         Add trace points for entry/exit into/out of the JS VM.
 951
 952         * runtime/VMEntryScope.cpp:
 953         (JSC::VMEntryScope::VMEntryScope):
 954         (JSC::VMEntryScope::~VMEntryScope):
 955
 956 2016-12-06  Keith Miller  <keith_miller@apple.com>
 957
 958         Add support for truncation operators
 959         https://bugs.webkit.org/show_bug.cgi?id=165519
 960
 961         Reviewed by Geoffrey Garen.
 962
 963         This patch adds initial support for truncation operators. The current patch
 964         does range based out of bounds checking, in the future we should use system
 965         register flags on ARM and other tricks on X86 improve the performance of
 966         these opcodes.
 967
 968         * assembler/MacroAssemblerARM64.h:
 969         (JSC::MacroAssemblerARM64::branchTruncateDoubleToInt32):
 970         (JSC::MacroAssemblerARM64::truncateDoubleToInt64):
 971         (JSC::MacroAssemblerARM64::truncateDoubleToUint64):
 972         (JSC::MacroAssemblerARM64::truncateFloatToInt32):
 973         (JSC::MacroAssemblerARM64::truncateFloatToUint32):
 974         (JSC::MacroAssemblerARM64::truncateFloatToInt64):
 975         (JSC::MacroAssemblerARM64::truncateFloatToUint64):
 976         * assembler/MacroAssemblerX86Common.h:
 977         (JSC::MacroAssemblerX86Common::truncateFloatToInt32):
 978         (JSC::MacroAssemblerX86Common::truncateDoubleToUint32): Deleted.
 979         * assembler/MacroAssemblerX86_64.h:
 980         (JSC::MacroAssemblerX86_64::truncateDoubleToUint32):
 981         (JSC::MacroAssemblerX86_64::truncateDoubleToInt64):
 982         (JSC::MacroAssemblerX86_64::truncateDoubleToUint64):
 983         (JSC::MacroAssemblerX86_64::truncateFloatToUint32):
 984         (JSC::MacroAssemblerX86_64::truncateFloatToInt64):
 985         (JSC::MacroAssemblerX86_64::truncateFloatToUint64):
 986         * assembler/X86Assembler.h:
 987         (JSC::X86Assembler::cvttss2si_rr):
 988         (JSC::X86Assembler::cvttss2siq_rr):
 989         * wasm/WasmB3IRGenerator.cpp:
 990         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF64>):
 991         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF32>):
 992         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF64>):
 993         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF32>):
 994         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF64>):
 995         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF64>):
 996         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF32>):
 997         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF32>):
 998         * wasm/WasmFunctionParser.h:
 999         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1000
1001 2016-12-07  Joseph Pecoraro  <pecoraro@apple.com>
1002
1003         Web Inspector: Remove unused and mostly untested Page domain commands and events
1004         https://bugs.webkit.org/show_bug.cgi?id=165507
1005
1006         Reviewed by Brian Burg.
1007
1008         Remove unused and unsupported commands and events.
1009
1010           - Page.setDocumentContent
1011           - Page.getScriptExecutionStatus
1012           - Page.setScriptExecutionDisabled
1013           - Page.handleJavaScriptDialog
1014           - Page.javascriptDialogOpening
1015           - Page.javascriptDialogClosed
1016           - Page.scriptsEnabled
1017
1018         * inspector/protocol/Page.json:
1019
1020 2016-12-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1021
1022         [JSC] Merge PromiseReactions
1023         https://bugs.webkit.org/show_bug.cgi?id=165526
1024
1025         Reviewed by Sam Weinig.
1026
1027         Our promise implementation has two arrays per Promise; promiseFulfillReactions and promiseRejectReactions.
1028         And everytime we call `promise.then`, we create two promise reactions for fullfill and reject.
1029         However, these two reactions and the arrays for reactions can be merged into one array and one reaction.
1030         It reduces the unnecessary object allocations.
1031
1032         No behavior change.
1033
1034         * builtins/BuiltinNames.h:
1035         * builtins/PromiseOperations.js:
1036         (globalPrivate.newPromiseReaction):
1037         (globalPrivate.triggerPromiseReactions):
1038         (globalPrivate.rejectPromise):
1039         (globalPrivate.fulfillPromise):
1040         (globalPrivate.promiseReactionJob):
1041         (globalPrivate.initializePromise):
1042         * builtins/PromisePrototype.js:
1043         (then):
1044         * runtime/JSPromise.cpp:
1045         (JSC::JSPromise::finishCreation):
1046
1047 2016-12-06  Mark Lam  <mark.lam@apple.com>
1048
1049         GetByID IC is wrongly unwrapping the global proxy this value for getter/setters.
1050         https://bugs.webkit.org/show_bug.cgi?id=165401
1051
1052         Reviewed by Saam Barati.
1053
1054         When the this value for a property access is the JS global and that property
1055         access is via a GetterSetter, the underlying getter / setter functions would
1056         expect the this value they receive to be the JSProxy instance instead of the
1057         JSGlobalObject.  This is consistent with how the LLINT and runtime code behaves.
1058         The IC code should behave the same way.
1059
1060         Also added some ASSERTs to document invariants in the code, and help detect
1061         bugs sooner if the code gets changed in a way that breaks those invariants in
1062         the future.
1063
1064         * bytecode/PolymorphicAccess.cpp:
1065         (JSC::AccessCase::generateImpl):
1066
1067 2016-12-06  Joseph Pecoraro  <pecoraro@apple.com>
1068
1069         DumpRenderTree ASSERT in JSC::ExecutableBase::isHostFunction seen on bots
1070         https://bugs.webkit.org/show_bug.cgi?id=165497
1071         <rdar://problem/29538973>
1072
1073         Reviewed by Saam Barati.
1074
1075         * inspector/agents/InspectorScriptProfilerAgent.cpp:
1076         (Inspector::InspectorScriptProfilerAgent::trackingComplete):
1077         Defer collection when extracting and processing the samples to avoid
1078         any objects held by the samples from getting collected while processing.
1079         This is because while processing we call into functions that can
1080         allocate and we must prevent those functions from syncing with the
1081         GC thread which may collect other sample data yet to be processed.
1082
1083 2016-12-06  Alexey Proskuryakov  <ap@apple.com>
1084
1085         Correct SDKROOT values in xcconfig files
1086         https://bugs.webkit.org/show_bug.cgi?id=165487
1087         rdar://problem/29539209
1088
1089         Reviewed by Dan Bernstein.
1090
1091         Fix suggested by Dan Bernstein.
1092
1093         * Configurations/DebugRelease.xcconfig:
1094
1095 2016-12-06  Saam Barati  <sbarati@apple.com>
1096
1097         Remove old Wasm object model
1098         https://bugs.webkit.org/show_bug.cgi?id=165481
1099
1100         Reviewed by Keith Miller and Mark Lam.
1101
1102         It's confusing to see code that consults both the old
1103         Wasm object model alongside the new one. The old object
1104         model is not a thing, and it's not being used. Let's
1105         remove it now to prevent further confusion.
1106
1107         * CMakeLists.txt:
1108         * JavaScriptCore.xcodeproj/project.pbxproj:
1109         * bytecode/CodeBlock.cpp:
1110         (JSC::CodeBlock::finalizeLLIntInlineCaches):
1111         (JSC::CodeBlock::replacement):
1112         (JSC::CodeBlock::computeCapabilityLevel):
1113         (JSC::CodeBlock::updateAllPredictions):
1114         * bytecode/CodeBlock.h:
1115         * bytecode/WebAssemblyCodeBlock.cpp: Removed.
1116         * bytecode/WebAssemblyCodeBlock.h: Removed.
1117         * dfg/DFGCapabilities.cpp:
1118         (JSC::DFG::isSupportedForInlining):
1119         * interpreter/Interpreter.cpp:
1120         (JSC::GetStackTraceFunctor::operator()):
1121         (JSC::UnwindFunctor::operator()):
1122         (JSC::isWebAssemblyExecutable): Deleted.
1123         * jit/JITOperations.cpp:
1124         * jit/Repatch.cpp:
1125         (JSC::linkPolymorphicCall):
1126         * llint/LLIntSlowPaths.cpp:
1127         (JSC::LLInt::setUpCall):
1128         * runtime/ExecutableBase.cpp:
1129         (JSC::ExecutableBase::clearCode):
1130         * runtime/ExecutableBase.h:
1131         (JSC::ExecutableBase::isWebAssemblyExecutable): Deleted.
1132         * runtime/JSFunction.cpp:
1133         * runtime/JSFunction.h:
1134         * runtime/JSFunctionInlines.h:
1135         (JSC::JSFunction::isBuiltinFunction):
1136         * runtime/VM.cpp:
1137         (JSC::VM::VM):
1138         * runtime/VM.h:
1139         * runtime/WebAssemblyExecutable.cpp: Removed.
1140         * runtime/WebAssemblyExecutable.h: Removed.
1141
1142 2016-12-06  JF Bastien  <jfbastien@apple.com>
1143
1144         PureNaN: fix typo
1145         https://bugs.webkit.org/show_bug.cgi?id=165493
1146
1147         Reviewed by Mark Lam.
1148
1149         * runtime/PureNaN.h:
1150
1151 2016-12-06  Mark Lam  <mark.lam@apple.com>
1152
1153         Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
1154         https://bugs.webkit.org/show_bug.cgi?id=165227
1155         <rdar://problem/29442665>
1156
1157         Reviewed by Saam Barati.
1158
1159         * runtime/JSObject.cpp:
1160         (JSC::JSObject::setPrototypeWithCycleCheck):
1161         - This is where we check for immutable prototype exotic objects and refuse to set
1162           the prototype if needed.
1163           See https://tc39.github.io/ecma262/#sec-immutable-prototype-exotic-objects.
1164
1165         * runtime/JSTypeInfo.h:
1166         (JSC::TypeInfo::isImmutablePrototypeExoticObject):
1167         * runtime/Structure.h:
1168         - Add flag for declaring immutable prototype exotic objects.
1169
1170         * runtime/ObjectPrototype.h:
1171         - Declare that Object.prototype is an immutable prototype exotic object.
1172           See https://tc39.github.io/ecma262/#sec-properties-of-the-object-prototype-object.
1173
1174         * runtime/ObjectConstructor.cpp:
1175         (JSC::objectConstructorSetPrototypeOf):
1176         - Use better error messages.
1177
1178 2016-12-04  Darin Adler  <darin@apple.com>
1179
1180         Use ASCIICType more, and improve it a little bit
1181         https://bugs.webkit.org/show_bug.cgi?id=165360
1182
1183         Reviewed by Sam Weinig.
1184
1185         * inspector/InspectorValues.cpp:
1186         (Inspector::readHexDigits): Use isASCIIHexDigit.
1187         (Inspector::hextoInt): Deleted.
1188         (decodeString): Use toASCIIHexValue.
1189
1190         * runtime/JSGlobalObjectFunctions.cpp:
1191         (JSC::parseDigit): Use isASCIIDigit, isASCIIUpper, and isASCIILower.
1192
1193         * runtime/StringPrototype.cpp:
1194         (JSC::substituteBackreferencesSlow): Use isASCIIDigit.
1195
1196 2016-12-06  Csaba Osztrogonác  <ossy@webkit.org>
1197
1198         Add storeFence support for ARMv7
1199         https://bugs.webkit.org/show_bug.cgi?id=164733
1200
1201         Reviewed by Saam Barati.
1202
1203         * assembler/ARMAssembler.h:
1204         (JSC::ARMAssembler::dmbISHST): Added.
1205         * assembler/ARMv7Assembler.h: Typo fixed, DMB has only T1 encoding.
1206         (JSC::ARMv7Assembler::dmbSY):
1207         (JSC::ARMv7Assembler::dmbISHST): Added.
1208         * assembler/MacroAssemblerARM.h:
1209         (JSC::MacroAssemblerARM::storeFence):
1210         * assembler/MacroAssemblerARMv7.h:
1211         (JSC::MacroAssemblerARMv7::storeFence):
1212
1213 2016-12-05  Matt Baker  <mattbaker@apple.com>
1214
1215         Web Inspector: remove ASSERT from InspectorDebuggerAgent::derefAsyncCallData
1216         https://bugs.webkit.org/show_bug.cgi?id=165413
1217         <rdar://problem/29517587>
1218
1219         Reviewed by Brian Burg.
1220
1221         DOMTimer::removeById can call into InspectorInstrumentation with an
1222         invalid identifier, so don't assert that async call data exists.
1223
1224         * inspector/agents/InspectorDebuggerAgent.cpp:
1225         (Inspector::InspectorDebuggerAgent::derefAsyncCallData):
1226
1227 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
1228
1229         Fixed a bug in my last patch.
1230
1231         Unreviewed.
1232
1233         * bytecode/UnlinkedFunctionExecutable.h: Restore the conversion to
1234         one-based counting.
1235
1236 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
1237
1238         Moved start and end column linking into helper functions
1239         https://bugs.webkit.org/show_bug.cgi?id=165422
1240
1241         Reviewed by Sam Weinig.
1242
1243         * bytecode/UnlinkedFunctionExecutable.cpp:
1244         (JSC::UnlinkedFunctionExecutable::link):
1245         * bytecode/UnlinkedFunctionExecutable.h:
1246
1247 2016-12-05  Mark Lam  <mark.lam@apple.com>
1248
1249         Fix JSC files so that we can build a release build with NDEBUG #undef'ed.
1250         https://bugs.webkit.org/show_bug.cgi?id=165409
1251
1252         Reviewed by Keith Miller.
1253
1254         This allows us to run a release build with DEBUG ASSERTs enabled.
1255
1256         * bytecode/BytecodeLivenessAnalysis.cpp:
1257         * bytecode/UnlinkedEvalCodeBlock.cpp:
1258         * bytecode/UnlinkedFunctionCodeBlock.cpp:
1259         * bytecode/UnlinkedModuleProgramCodeBlock.cpp:
1260         * bytecode/UnlinkedProgramCodeBlock.cpp:
1261         * runtime/EvalExecutable.cpp:
1262
1263 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
1264
1265         Renamed source => parentSource
1266         https://bugs.webkit.org/show_bug.cgi?id=165419
1267
1268         Reviewed by Saam Barati.
1269
1270         This should help clarify that a FunctionExecutable holds the source
1271         code to its *parent* scope, and not its own SourceCode.
1272
1273         * builtins/BuiltinExecutables.cpp:
1274         (JSC::BuiltinExecutables::createExecutable):
1275         * bytecode/UnlinkedFunctionExecutable.cpp:
1276         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
1277         (JSC::UnlinkedFunctionExecutable::link):
1278         * bytecode/UnlinkedFunctionExecutable.h:
1279
1280 2016-12-05  Geoffrey Garen  <ggaren@apple.com>
1281
1282         ScriptExecutable should not contain a copy of firstLine and startColumn
1283         https://bugs.webkit.org/show_bug.cgi?id=165415
1284
1285         Reviewed by Keith Miller.
1286
1287         We already have this data in SourceCode.
1288
1289         It's super confusing to have two copies of this data, where one is
1290         allowed to mutate. In reality, your line and column number never change.
1291
1292         * bytecode/UnlinkedFunctionExecutable.cpp:
1293         (JSC::UnlinkedFunctionExecutable::link):
1294         * runtime/CodeCache.cpp:
1295         (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
1296         * runtime/CodeCache.h:
1297         (JSC::generateUnlinkedCodeBlock):
1298         * runtime/FunctionExecutable.cpp:
1299         (JSC::FunctionExecutable::FunctionExecutable):
1300         * runtime/FunctionExecutable.h:
1301         * runtime/ScriptExecutable.cpp:
1302         (JSC::ScriptExecutable::ScriptExecutable):
1303         (JSC::ScriptExecutable::newCodeBlockFor):
1304         * runtime/ScriptExecutable.h:
1305         (JSC::ScriptExecutable::firstLine):
1306         (JSC::ScriptExecutable::startColumn):
1307         (JSC::ScriptExecutable::recordParse):
1308
1309 2016-12-05  Caitlin Potter  <caitp@igalia.com>
1310
1311         [JSC] report unexpected token when "async" is followed by identifier
1312         https://bugs.webkit.org/show_bug.cgi?id=165091
1313
1314         Reviewed by Mark Lam.
1315
1316         Report a SyntaxError, in order to report correct error in contexts
1317         an async ArrowFunction cannot occur. Also corrects errors in comment
1318         describing JSTokenType bitfield, which was added in r209293.
1319
1320         * parser/Parser.cpp:
1321         (JSC::Parser<LexerType>::parseMemberExpression):
1322         * parser/ParserTokens.h:
1323
1324 2016-12-05  Keith Miller  <keith_miller@apple.com>
1325
1326         Add Wasm i64 to i32 conversion.
1327         https://bugs.webkit.org/show_bug.cgi?id=165378
1328
1329         Reviewed by Filip Pizlo.
1330
1331         It turns out the wrap operation is just B3's Trunc.
1332
1333         * wasm/wasm.json:
1334
1335 2016-12-05  Joseph Pecoraro  <pecoraro@apple.com>
1336
1337         REGRESSION(r208985): SafariForWebKitDevelopment Symbol Not Found looking for method with WTF::Optional
1338         https://bugs.webkit.org/show_bug.cgi?id=165351
1339
1340         Reviewed by Yusuke Suzuki.
1341
1342         Some versions of Safari expect:
1343
1344             Inspector::BackendDispatcher::reportProtocolError(WTF::Optional<long>, Inspector::BackendDispatcher::CommonErrorCode, WTF::String const&)
1345
1346         Which we had updated to use std::optional. Expose a version with the original
1347         Symbol for these Safaris. This stub will just call through to the new version.
1348
1349         * inspector/InspectorBackendDispatcher.cpp:
1350         (Inspector::BackendDispatcher::reportProtocolError):
1351         * inspector/InspectorBackendDispatcher.h:
1352
1353 2016-12-05  Konstantin Tokarev  <annulen@yandex.ru>
1354
1355         Add __STDC_FORMAT_MACROS before inttypes.h is included
1356         https://bugs.webkit.org/show_bug.cgi?id=165374
1357
1358         We need formatting macros like PRIu64 to be available in all places where
1359         inttypes.h header is used. All these usages get inttypes.h definitions
1360         via wtf/Assertions.h header, except SQLiteFileSystem.cpp where formatting
1361         macros are not used anymore since r185129.
1362
1363         This patch fixes multiple build errors with MinGW and reduces number of
1364         independent __STDC_FORMAT_MACROS uses in the code base.
1365
1366         Reviewed by Darin Adler.
1367
1368         * disassembler/ARM64/A64DOpcode.cpp: Removed __STDC_FORMAT_MACROS
1369         because it is obtained via Assertions.h now
1370         * disassembler/ARM64Disassembler.cpp: Ditto.
1371
1372 2016-12-04  Keith Miller  <keith_miller@apple.com>
1373
1374         Add support for Wasm ctz and popcnt
1375         https://bugs.webkit.org/show_bug.cgi?id=165369
1376
1377         Reviewed by Saam Barati.
1378
1379         * assembler/MacroAssemblerARM64.h:
1380         (JSC::MacroAssemblerARM64::countTrailingZeros32):
1381         (JSC::MacroAssemblerARM64::countTrailingZeros64):
1382         * assembler/MacroAssemblerX86Common.cpp:
1383         * assembler/MacroAssemblerX86Common.h:
1384         (JSC::MacroAssemblerX86Common::countTrailingZeros32):
1385         (JSC::MacroAssemblerX86Common::supportsBMI1):
1386         (JSC::MacroAssemblerX86Common::ctzAfterBsf):
1387         * assembler/MacroAssemblerX86_64.h:
1388         (JSC::MacroAssemblerX86_64::countTrailingZeros64):
1389         * assembler/X86Assembler.h:
1390         (JSC::X86Assembler::tzcnt_rr):
1391         (JSC::X86Assembler::tzcntq_rr):
1392         (JSC::X86Assembler::bsf_rr):
1393         (JSC::X86Assembler::bsfq_rr):
1394         * wasm/WasmB3IRGenerator.cpp:
1395         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Ctz>):
1396         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Ctz>):
1397         (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Popcnt>):
1398         (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Popcnt>):
1399         * wasm/WasmFunctionParser.h:
1400         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1401
1402 2016-12-04  Saam Barati  <sbarati@apple.com>
1403
1404         We should have a Wasm callee
1405         https://bugs.webkit.org/show_bug.cgi?id=165163
1406
1407         Reviewed by Keith Miller.
1408
1409         This patch adds JSWebAssemblyCallee and stores it into the
1410         callee slot in the call frame as part of the prologue of a
1411         wasm function. This is the first step in implementing
1412         unwinding from/through wasm frames. We will use the callee
1413         to identify that a machine frame belongs to wasm code.
1414
1415         * CMakeLists.txt:
1416         * JavaScriptCore.xcodeproj/project.pbxproj:
1417         * jsc.cpp:
1418         (callWasmFunction):
1419         (functionTestWasmModuleFunctions):
1420         * llint/LowLevelInterpreter64.asm:
1421         * runtime/JSGlobalObject.cpp:
1422         * runtime/VM.cpp:
1423         (JSC::VM::VM):
1424         * runtime/VM.h:
1425         * wasm/JSWebAssembly.h:
1426         * wasm/WasmB3IRGenerator.cpp:
1427         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1428         (JSC::Wasm::parseAndCompile):
1429         * wasm/WasmCallingConvention.h:
1430         (JSC::Wasm::CallingConvention::setupFrameInPrologue):
1431         * wasm/WasmFormat.h:
1432         * wasm/WasmPlan.cpp:
1433         (JSC::Wasm::Plan::initializeCallees):
1434         * wasm/WasmPlan.h:
1435         (JSC::Wasm::Plan::compiledFunction):
1436         (JSC::Wasm::Plan::getCompiledFunctions): Deleted.
1437         * wasm/js/JSWebAssemblyCallee.cpp: Added.
1438         (JSC::JSWebAssemblyCallee::JSWebAssemblyCallee):
1439         (JSC::JSWebAssemblyCallee::finishCreation):
1440         (JSC::JSWebAssemblyCallee::destroy):
1441         * wasm/js/JSWebAssemblyCallee.h: Added.
1442         (JSC::JSWebAssemblyCallee::create):
1443         (JSC::JSWebAssemblyCallee::createStructure):
1444         (JSC::JSWebAssemblyCallee::jsEntryPoint):
1445         * wasm/js/JSWebAssemblyModule.cpp:
1446         (JSC::JSWebAssemblyModule::create):
1447         (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
1448         (JSC::JSWebAssemblyModule::visitChildren):
1449         * wasm/js/JSWebAssemblyModule.h:
1450         (JSC::JSWebAssemblyModule::moduleInformation):
1451         (JSC::JSWebAssemblyModule::callee):
1452         (JSC::JSWebAssemblyModule::callees):
1453         (JSC::JSWebAssemblyModule::offsetOfCallees):
1454         (JSC::JSWebAssemblyModule::allocationSize):
1455         (JSC::JSWebAssemblyModule::compiledFunctions): Deleted.
1456         * wasm/js/WebAssemblyFunction.cpp:
1457         (JSC::callWebAssemblyFunction):
1458         (JSC::WebAssemblyFunction::create):
1459         (JSC::WebAssemblyFunction::visitChildren):
1460         (JSC::WebAssemblyFunction::finishCreation):
1461         * wasm/js/WebAssemblyFunction.h:
1462         (JSC::WebAssemblyFunction::webAssemblyCallee):
1463         (JSC::WebAssemblyFunction::instance):
1464         (JSC::WebAssemblyFunction::signature):
1465         (JSC::CallableWebAssemblyFunction::CallableWebAssemblyFunction): Deleted.
1466         (JSC::WebAssemblyFunction::webAssemblyFunctionCell): Deleted.
1467         * wasm/js/WebAssemblyFunctionCell.cpp:
1468         (JSC::WebAssemblyFunctionCell::create): Deleted.
1469         (JSC::WebAssemblyFunctionCell::WebAssemblyFunctionCell): Deleted.
1470         (JSC::WebAssemblyFunctionCell::destroy): Deleted.
1471         (JSC::WebAssemblyFunctionCell::createStructure): Deleted.
1472         * wasm/js/WebAssemblyFunctionCell.h:
1473         (JSC::WebAssemblyFunctionCell::function): Deleted.
1474         * wasm/js/WebAssemblyModuleConstructor.cpp:
1475         (JSC::constructJSWebAssemblyModule):
1476         * wasm/js/WebAssemblyModuleRecord.cpp:
1477         (JSC::WebAssemblyModuleRecord::link):
1478
1479 2016-12-04  Matt Baker  <mattbaker@apple.com>
1480
1481         Web Inspector: Assertion Failures breakpoint should respect global Breakpoints enabled setting
1482         https://bugs.webkit.org/show_bug.cgi?id=165277
1483         <rdar://problem/29467098>
1484
1485         Reviewed by Mark Lam.
1486
1487         * inspector/agents/InspectorDebuggerAgent.cpp:
1488         (Inspector::InspectorDebuggerAgent::handleConsoleAssert):
1489         Check that breakpoints are active before pausing.
1490
1491 2016-12-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1492
1493         Refactor SymbolImpl layout
1494         https://bugs.webkit.org/show_bug.cgi?id=165247
1495
1496         Reviewed by Darin Adler.
1497
1498         Use SymbolImpl::{create, createNullSymbol} instead.
1499
1500         * runtime/PrivateName.h:
1501         (JSC::PrivateName::PrivateName):
1502
1503 2016-12-03  JF Bastien  <jfbastien@apple.com>
1504
1505         WebAssembly: update binary format to 0xD version
1506         https://bugs.webkit.org/show_bug.cgi?id=165345
1507
1508         Reviewed by Keith Miller.
1509
1510         As described in the following PR: https://github.com/WebAssembly/design/pull/836
1511         Originally committed in r209175, reverted in r209242, and fixed in r209284.
1512
1513         * wasm/WasmB3IRGenerator.cpp:
1514         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1515         (JSC::Wasm::B3IRGenerator::zeroForType):
1516         (JSC::Wasm::B3IRGenerator::addConstant):
1517         (JSC::Wasm::createJSWrapper):
1518         * wasm/WasmCallingConvention.h:
1519         (JSC::Wasm::CallingConvention::marshallArgument):
1520         * wasm/WasmFormat.cpp:
1521         (JSC::Wasm::toString): Deleted.
1522         * wasm/WasmFormat.h:
1523         (JSC::Wasm::isValueType):
1524         (JSC::Wasm::toB3Type): Deleted.
1525         * wasm/WasmFunctionParser.h:
1526         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1527         * wasm/WasmModuleParser.cpp:
1528         (JSC::Wasm::ModuleParser::parse):
1529         (JSC::Wasm::ModuleParser::parseType):
1530         * wasm/WasmModuleParser.h:
1531         * wasm/WasmParser.h:
1532         (JSC::Wasm::Parser::parseResultType):
1533         * wasm/generateWasm.py:
1534         (Wasm.__init__):
1535         * wasm/generateWasmOpsHeader.py:
1536         (cppMacro):
1537         (typeMacroizer):
1538         (opcodeMacroizer):
1539         * wasm/js/WebAssemblyFunction.cpp:
1540         (JSC::callWebAssemblyFunction):
1541         * wasm/wasm.json:
1542
1543 2016-12-02  Keith Miller  <keith_miller@apple.com>
1544
1545         Add Wasm copysign
1546         https://bugs.webkit.org/show_bug.cgi?id=165355
1547
1548         Reviewed by Filip Pizlo.
1549
1550         This patch also makes two other important changes:
1551
1552         1) allows for i64 constants in the B3 generator language.
1553         2) Fixes a bug with F64ConvertUI64 where the operation returned a Float instead
1554            of a Double in B3.
1555
1556         * wasm/WasmB3IRGenerator.cpp:
1557         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
1558         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
1559         (CodeGenerator.generateOpcode):
1560         (generateConstCode):
1561         (generateI32ConstCode): Deleted.
1562         * wasm/wasm.json:
1563
1564 2016-12-03  Commit Queue  <commit-queue@webkit.org>
1565
1566         Unreviewed, rolling out r209298.
1567         https://bugs.webkit.org/show_bug.cgi?id=165359
1568
1569         broke the build (Requested by smfr on #webkit).
1570
1571         Reverted changeset:
1572
1573         "Add Wasm copysign"
1574         https://bugs.webkit.org/show_bug.cgi?id=165355
1575         http://trac.webkit.org/changeset/209298
1576
1577 2016-12-02  Keith Miller  <keith_miller@apple.com>
1578
1579         Add Wasm copysign
1580         https://bugs.webkit.org/show_bug.cgi?id=165355
1581
1582         Reviewed by Filip Pizlo.
1583
1584         This patch also makes two other important changes:
1585
1586         1) allows for i64 constants in the B3 generator language.
1587         2) Fixes a bug with F64ConvertUI64 where the operation returned a Float instead
1588            of a Double in B3.
1589
1590         * wasm/WasmB3IRGenerator.cpp:
1591         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
1592         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
1593         (CodeGenerator.generateOpcode):
1594         (generateConstCode):
1595         (generateI32ConstCode): Deleted.
1596         * wasm/wasm.json:
1597
1598 2016-12-02  Keith Miller  <keith_miller@apple.com>
1599
1600         Unreviewed, fix git having a breakdown over trying to reland a rollout.
1601
1602 2016-12-02  Keith Miller  <keith_miller@apple.com>
1603
1604         Add Wasm floating point nearest and trunc
1605         https://bugs.webkit.org/show_bug.cgi?id=165339
1606
1607         Reviewed by Saam Barati.
1608
1609         This patch also allows any wasm primitive type to be passed as a
1610         string.
1611
1612         * assembler/MacroAssemblerARM64.h:
1613         (JSC::MacroAssemblerARM64::nearestIntDouble):
1614         (JSC::MacroAssemblerARM64::nearestIntFloat):
1615         (JSC::MacroAssemblerARM64::truncDouble):
1616         (JSC::MacroAssemblerARM64::truncFloat):
1617         * assembler/MacroAssemblerX86Common.h:
1618         (JSC::MacroAssemblerX86Common::nearestIntDouble):
1619         (JSC::MacroAssemblerX86Common::nearestIntFloat):
1620         * jsc.cpp:
1621         (box):
1622         * wasm/WasmB3IRGenerator.cpp:
1623         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
1624         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
1625         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Nearest>):
1626         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Nearest>):
1627         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Trunc>):
1628         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Trunc>):
1629         * wasm/WasmFunctionParser.h:
1630         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1631
1632 2016-12-02  Caitlin Potter  <caitp@igalia.com>
1633
1634 [JSC] add additional bit to JSTokenType bitfield
1635         https://bugs.webkit.org/show_bug.cgi?id=165091
1636
1637         Reviewed by Geoffrey Garen.
1638
1639         Avoid overflow which causes keyword tokens to be treated as unary
1640         tokens now that "async" is tokenized as a keyword, by granting an
1641         additional 64 bits to be occupied by token IDs.
1642
1643         * parser/ParserTokens.h:
1644
1645 2016-12-02  Andy Estes  <aestes@apple.com>
1646
1647         [Cocoa] Adopt the PRODUCT_BUNDLE_IDENTIFIER build setting
1648         https://bugs.webkit.org/show_bug.cgi?id=164492
1649
1650         Reviewed by Dan Bernstein.
1651
1652         * Configurations/JavaScriptCore.xcconfig: Set PRODUCT_BUNDLE_IDENTIFIER to
1653         com.apple.$(PRODUCT_NAME:rfc1034identifier).
1654         * Info.plist: Changed CFBundleIdentifier's value from com.apple.${PRODUCT_NAME} to
1655         ${PRODUCT_BUNDLE_IDENTIFIER}.
1656
1657 2016-12-02  JF Bastien  <jfbastien@apple.com>
1658
1659         WebAssembly: mark WasmOps.h as private
1660         https://bugs.webkit.org/show_bug.cgi?id=165335
1661
1662         Reviewed by Mark Lam.
1663
1664         * JavaScriptCore.xcodeproj/project.pbxproj: WasmOps.h will be used by non-JSC and should therefore be private
1665
1666 2016-12-02  Commit Queue  <commit-queue@webkit.org>
1667
1668         Unreviewed, rolling out r209275 and r209276.
1669         https://bugs.webkit.org/show_bug.cgi?id=165348
1670
1671         "broke the arm build" (Requested by keith_miller on #webkit).
1672
1673         Reverted changesets:
1674
1675         "Add Wasm floating point nearest and trunc"
1676         https://bugs.webkit.org/show_bug.cgi?id=165339
1677         http://trac.webkit.org/changeset/209275
1678
1679         "Unreviewed, forgot to change instruction after renaming."
1680         http://trac.webkit.org/changeset/209276
1681
1682 2016-12-02  Keith Miller  <keith_miller@apple.com>
1683
1684         Unreviewed, forgot to change instruction after renaming.
1685
1686         * assembler/MacroAssemblerARM64.h:
1687         (JSC::MacroAssemblerARM64::nearestIntDouble):
1688         (JSC::MacroAssemblerARM64::nearestIntFloat):
1689
1690 2016-12-02  Keith Miller  <keith_miller@apple.com>
1691
1692         Add Wasm floating point nearest and trunc
1693         https://bugs.webkit.org/show_bug.cgi?id=165339
1694
1695         Reviewed by Filip Pizlo.
1696
1697         This patch also allows any wasm primitive type to be passed as a
1698         string.
1699
1700         * assembler/MacroAssemblerARM64.h:
1701         (JSC::MacroAssemblerARM64::nearestIntDouble):
1702         (JSC::MacroAssemblerARM64::nearestIntFloat):
1703         (JSC::MacroAssemblerARM64::truncDouble):
1704         (JSC::MacroAssemblerARM64::truncFloat):
1705         * assembler/MacroAssemblerX86Common.h:
1706         (JSC::MacroAssemblerX86Common::nearestIntDouble):
1707         (JSC::MacroAssemblerX86Common::nearestIntFloat):
1708         * jsc.cpp:
1709         (box):
1710         * wasm/WasmB3IRGenerator.cpp:
1711         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
1712         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
1713         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Nearest>):
1714         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Nearest>):
1715         (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Trunc>):
1716         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Trunc>):
1717         * wasm/WasmFunctionParser.h:
1718         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1719
1720 2016-12-02  JF Bastien  <jfbastien@apple.com>
1721
1722         WebAssembly: revert patch causing odd breakage
1723         https://bugs.webkit.org/show_bug.cgi?id=165308
1724
1725         Unreviewed.
1726
1727         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
1728         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
1729
1730         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
1731
1732         * wasm/WasmB3IRGenerator.cpp:
1733         (JSC::Wasm::B3IRGenerator::B3IRGenerator):
1734         (JSC::Wasm::B3IRGenerator::zeroForType):
1735         (JSC::Wasm::B3IRGenerator::addConstant):
1736         (JSC::Wasm::createJSWrapper):
1737         * wasm/WasmCallingConvention.h:
1738         (JSC::Wasm::CallingConvention::marshallArgument):
1739         * wasm/WasmFormat.cpp:
1740         (JSC::Wasm::toString):
1741         * wasm/WasmFormat.h:
1742         (JSC::Wasm::toB3Type):
1743         * wasm/WasmFunctionParser.h:
1744         (JSC::Wasm::FunctionParser<Context>::parseExpression):
1745         * wasm/WasmModuleParser.cpp:
1746         (JSC::Wasm::ModuleParser::parse):
1747         (JSC::Wasm::ModuleParser::parseType):
1748         * wasm/WasmModuleParser.h:
1749         * wasm/WasmParser.h:
1750         (JSC::Wasm::Parser::parseResultType):
1751         * wasm/generateWasm.py:
1752         (Wasm.__init__):
1753         * wasm/generateWasmOpsHeader.py:
1754         (cppMacro):
1755         (opcodeMacroizer):
1756         (typeMacroizer): Deleted.
1757         * wasm/js/WebAssemblyFunction.cpp:
1758         (JSC::callWebAssemblyFunction):
1759         * wasm/wasm.json:
1760
1761 2016-12-01  Brian Burg  <bburg@apple.com>
1762
1763         Remote Inspector: fix weird typo in generated ObjC protocol type initializer implementations
1764         https://bugs.webkit.org/show_bug.cgi?id=165295
1765         <rdar://problem/29427778>
1766
1767         Reviewed by Joseph Pecoraro.
1768
1769         Remove a stray semicolon appended after custom initializer signatures.
1770         This is a syntax error when building with less lenient compiler warnings.
1771
1772         * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
1773         (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_required_members):
1774         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
1775         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
1776         * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
1777         * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
1778         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
1779         * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
1780         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
1781
1782 2016-12-01  Saam Barati  <sbarati@apple.com>
1783
1784         Rename CallFrame::callee() to CallFrame::jsCallee()
1785         https://bugs.webkit.org/show_bug.cgi?id=165293
1786
1787         Reviewed by Keith Miller.
1788
1789         Wasm will soon have its own Callee that doesn't derive
1790         from JSObject, but derives from JSCell. I want to introduce
1791         a new function like:
1792         ```
1793         CalleeBase* CallFrame::callee()
1794         ```
1795
1796         once we have a Wasm callee. It only makes sense to name that
1797         function callee() and rename the current one turn to:
1798         ```
1799         JSObject* CallFrame::jsCallee()
1800         ```
1801
1802         * API/APICallbackFunction.h:
1803         (JSC::APICallbackFunction::call):
1804         (JSC::APICallbackFunction::construct):
1805         * API/JSCallbackObjectFunctions.h:
1806         (JSC::JSCallbackObject<Parent>::construct):
1807         (JSC::JSCallbackObject<Parent>::call):
1808         * debugger/DebuggerCallFrame.cpp:
1809         (JSC::DebuggerCallFrame::scope):
1810         (JSC::DebuggerCallFrame::type):
1811         * interpreter/CallFrame.cpp:
1812         (JSC::CallFrame::friendlyFunctionName):
1813         * interpreter/CallFrame.h:
1814         (JSC::ExecState::jsCallee):
1815         (JSC::ExecState::callee): Deleted.
1816         * interpreter/Interpreter.cpp:
1817         (JSC::Interpreter::dumpRegisters):
1818         (JSC::notifyDebuggerOfUnwinding):
1819         * interpreter/ShadowChicken.cpp:
1820         (JSC::ShadowChicken::update):
1821         * interpreter/StackVisitor.cpp:
1822         (JSC::StackVisitor::readNonInlinedFrame):
1823         * llint/LLIntSlowPaths.cpp:
1824         (JSC::LLInt::traceFunctionPrologue):
1825         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1826         * runtime/ArrayConstructor.cpp:
1827         (JSC::constructArrayWithSizeQuirk):
1828         * runtime/AsyncFunctionConstructor.cpp:
1829         (JSC::callAsyncFunctionConstructor):
1830         (JSC::constructAsyncFunctionConstructor):
1831         * runtime/BooleanConstructor.cpp:
1832         (JSC::constructWithBooleanConstructor):
1833         * runtime/ClonedArguments.cpp:
1834         (JSC::ClonedArguments::createWithInlineFrame):
1835         * runtime/CommonSlowPaths.h:
1836         (JSC::CommonSlowPaths::arityCheckFor):
1837         * runtime/DateConstructor.cpp:
1838         (JSC::constructWithDateConstructor):
1839         * runtime/DirectArguments.cpp:
1840         (JSC::DirectArguments::createByCopying):
1841         * runtime/Error.h:
1842         (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
1843         (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
1844         * runtime/ErrorConstructor.cpp:
1845         (JSC::Interpreter::constructWithErrorConstructor):
1846         (JSC::Interpreter::callErrorConstructor):
1847         * runtime/FunctionConstructor.cpp:
1848         (JSC::constructWithFunctionConstructor):
1849         (JSC::callFunctionConstructor):
1850         * runtime/GeneratorFunctionConstructor.cpp:
1851         (JSC::callGeneratorFunctionConstructor):
1852         (JSC::constructGeneratorFunctionConstructor):
1853         * runtime/InternalFunction.cpp:
1854         (JSC::InternalFunction::createSubclassStructure):
1855         * runtime/IntlCollator.cpp:
1856         (JSC::IntlCollator::initializeCollator):
1857         * runtime/IntlCollatorConstructor.cpp:
1858         (JSC::constructIntlCollator):
1859         (JSC::callIntlCollator):
1860         (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
1861         * runtime/IntlDateTimeFormat.cpp:
1862         (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
1863         * runtime/IntlDateTimeFormatConstructor.cpp:
1864         (JSC::constructIntlDateTimeFormat):
1865         (JSC::callIntlDateTimeFormat):
1866         (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
1867         * runtime/IntlNumberFormat.cpp:
1868         (JSC::IntlNumberFormat::initializeNumberFormat):
1869         * runtime/IntlNumberFormatConstructor.cpp:
1870         (JSC::constructIntlNumberFormat):
1871         (JSC::callIntlNumberFormat):
1872         (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
1873         * runtime/IntlObject.cpp:
1874         (JSC::canonicalizeLocaleList):
1875         (JSC::defaultLocale):
1876         (JSC::lookupSupportedLocales):
1877         (JSC::intlObjectFuncGetCanonicalLocales):
1878         * runtime/JSArrayBufferConstructor.cpp:
1879         (JSC::constructArrayBuffer):
1880         * runtime/JSArrayBufferPrototype.cpp:
1881         (JSC::arrayBufferProtoFuncSlice):
1882         * runtime/JSBoundFunction.cpp:
1883         (JSC::boundThisNoArgsFunctionCall):
1884         (JSC::boundFunctionCall):
1885         (JSC::boundThisNoArgsFunctionConstruct):
1886         (JSC::boundFunctionConstruct):
1887         * runtime/JSCellInlines.h:
1888         (JSC::ExecState::vm):
1889         * runtime/JSCustomGetterSetterFunction.cpp:
1890         (JSC::JSCustomGetterSetterFunction::customGetterSetterFunctionCall):
1891         * runtime/JSFunction.cpp:
1892         (JSC::callHostFunctionAsConstructor):
1893         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
1894         (JSC::constructGenericTypedArrayView):
1895         * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
1896         (JSC::genericTypedArrayViewProtoFuncSlice):
1897         (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
1898         * runtime/JSGlobalObjectFunctions.cpp:
1899         (JSC::globalFuncEval):
1900         * runtime/JSInternalPromiseConstructor.cpp:
1901         (JSC::constructPromise):
1902         * runtime/JSMapIterator.cpp:
1903         (JSC::JSMapIterator::createPair):
1904         (JSC::JSMapIterator::clone):
1905         * runtime/JSNativeStdFunction.cpp:
1906         (JSC::runStdFunction):
1907         * runtime/JSPromiseConstructor.cpp:
1908         (JSC::constructPromise):
1909         * runtime/JSPropertyNameIterator.cpp:
1910         (JSC::JSPropertyNameIterator::clone):
1911         * runtime/JSScope.h:
1912         (JSC::ExecState::lexicalGlobalObject):
1913         * runtime/JSSetIterator.cpp:
1914         (JSC::JSSetIterator::createPair):
1915         (JSC::JSSetIterator::clone):
1916         * runtime/JSStringIterator.cpp:
1917         (JSC::JSStringIterator::clone):
1918         * runtime/MapConstructor.cpp:
1919         (JSC::constructMap):
1920         * runtime/MapPrototype.cpp:
1921         (JSC::mapProtoFuncValues):
1922         (JSC::mapProtoFuncEntries):
1923         (JSC::mapProtoFuncKeys):
1924         (JSC::privateFuncMapIterator):
1925         * runtime/NativeErrorConstructor.cpp:
1926         (JSC::Interpreter::constructWithNativeErrorConstructor):
1927         (JSC::Interpreter::callNativeErrorConstructor):
1928         * runtime/ObjectConstructor.cpp:
1929         (JSC::constructObject):
1930         * runtime/ProxyObject.cpp:
1931         (JSC::performProxyCall):
1932         (JSC::performProxyConstruct):
1933         * runtime/ProxyRevoke.cpp:
1934         (JSC::performProxyRevoke):
1935         * runtime/RegExpConstructor.cpp:
1936         (JSC::constructWithRegExpConstructor):
1937         (JSC::callRegExpConstructor):
1938         * runtime/ScopedArguments.cpp:
1939         (JSC::ScopedArguments::createByCopying):
1940         * runtime/SetConstructor.cpp:
1941         (JSC::constructSet):
1942         * runtime/SetPrototype.cpp:
1943         (JSC::setProtoFuncValues):
1944         (JSC::setProtoFuncEntries):
1945         (JSC::privateFuncSetIterator):
1946         * runtime/StringConstructor.cpp:
1947         (JSC::constructWithStringConstructor):
1948         * runtime/StringPrototype.cpp:
1949         (JSC::stringProtoFuncIterator):
1950         * runtime/WeakMapConstructor.cpp:
1951         (JSC::constructWeakMap):
1952         * runtime/WeakSetConstructor.cpp:
1953         (JSC::constructWeakSet):
1954         * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
1955         (JSC::constructJSWebAssemblyCompileError):
1956         * wasm/js/WebAssemblyFunction.cpp:
1957         (JSC::callWebAssemblyFunction):
1958         * wasm/js/WebAssemblyModuleConstructor.cpp:
1959         (JSC::constructJSWebAssemblyModule):
1960         * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
1961         (JSC::constructJSWebAssemblyRuntimeError):
1962
1963 2016-12-01  Brian Burg  <bburg@apple.com>
1964
1965         Web Inspector: generated code should use a framework-style import for *ProtocolArrayConversions.h
1966         https://bugs.webkit.org/show_bug.cgi?id=165281
1967         <rdar://problem/29427778>
1968
1969         Reviewed by Joseph Pecoraro.
1970
1971         * inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py:
1972         (ObjCProtocolTypeConversionsHeaderGenerator.generate_output):
1973         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
1974         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
1975         * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
1976         * inspector/scripts/tests/expected/enum-values.json-result:
1977         * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
1978         * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
1979         * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
1980         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
1981         * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
1982         * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
1983         * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
1984         * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
1985         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
1986
1987 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
1988
1989         SourceCodeKey should use unlinked source code
1990         https://bugs.webkit.org/show_bug.cgi?id=165286
1991
1992         Reviewed by Saam Barati.
1993
1994         This patch splits out UnlinkedSourceCode from SourceCode, and deploys
1995         UnlinkedSourceCode in SourceCodeKey.
1996
1997         It's misleading to store SourceCode in SourceCodeKey because SourceCode
1998         has an absolute location whereas unlinked cached code has no location.
1999
2000         I plan to deploy UnlinkedSourceCode in more places, to indicate code
2001         that has no absolute location.
2002
2003         * JavaScriptCore.xcodeproj/project.pbxproj:
2004         * parser/SourceCode.cpp:
2005         (JSC::UnlinkedSourceCode::toUTF8):
2006         (JSC::SourceCode::toUTF8): Deleted.
2007         * parser/SourceCode.h:
2008         (JSC::SourceCode::SourceCode):
2009         (JSC::SourceCode::startColumn):
2010         (JSC::SourceCode::isHashTableDeletedValue): Deleted.
2011         (JSC::SourceCode::hash): Deleted.
2012         (JSC::SourceCode::view): Deleted.
2013         (JSC::SourceCode::providerID): Deleted.
2014         (JSC::SourceCode::isNull): Deleted.
2015         (JSC::SourceCode::provider): Deleted.
2016         (JSC::SourceCode::startOffset): Deleted.
2017         (JSC::SourceCode::endOffset): Deleted.
2018         (JSC::SourceCode::length): Deleted. Move a bunch of stuff in to a new
2019         base class, UnlinkedSourceCode.
2020
2021         * parser/SourceCodeKey.h:
2022         (JSC::SourceCodeKey::SourceCodeKey): Use UnlinkedSourceCode since code
2023         in the cache has no location.
2024
2025         * parser/UnlinkedSourceCode.h: Copied from Source/JavaScriptCore/parser/SourceCode.h.
2026         (JSC::UnlinkedSourceCode::UnlinkedSourceCode):
2027         (JSC::UnlinkedSourceCode::provider):
2028         (JSC::SourceCode::SourceCode): Deleted.
2029         (JSC::SourceCode::isHashTableDeletedValue): Deleted.
2030         (JSC::SourceCode::hash): Deleted.
2031         (JSC::SourceCode::view): Deleted.
2032         (JSC::SourceCode::providerID): Deleted.
2033         (JSC::SourceCode::isNull): Deleted.
2034         (JSC::SourceCode::provider): Deleted.
2035         (JSC::SourceCode::firstLine): Deleted.
2036         (JSC::SourceCode::startColumn): Deleted.
2037         (JSC::SourceCode::startOffset): Deleted.
2038         (JSC::SourceCode::endOffset): Deleted.
2039         (JSC::SourceCode::length): Deleted.
2040         (JSC::makeSource): Deleted.
2041         (JSC::SourceCode::subExpression): Deleted.
2042
2043         * runtime/CodeCache.h: Use UnlinkedSourceCode in the cache.
2044
2045 2016-12-01  Keith Miller  <keith_miller@apple.com>
2046
2047         Add wasm int to floating point opcodes
2048         https://bugs.webkit.org/show_bug.cgi?id=165252
2049
2050         Reviewed by Geoffrey Garen.
2051
2052         This patch adds support for the Wasm integral type => floating point
2053         type conversion opcodes. Most of these were already supported by B3
2054         however there was no support for uint64 to float/double. Unfortunately,
2055         AFAIK x86_64 does not have a single instruction that performs this
2056         conversion. Since there is a signed conversion instruction on x86 we
2057         use that for all uint64s that don't have the top bit set. If they do have
2058         the top bit set we need to divide by 2 (rounding up) then convert the number
2059         with the signed conversion then double the result.
2060
2061         * assembler/MacroAssemblerX86_64.h:
2062         (JSC::MacroAssemblerX86_64::convertUInt64ToDouble):
2063         (JSC::MacroAssemblerX86_64::convertUInt64ToFloat):
2064         * jsc.cpp:
2065         (valueWithTypeOfWasmValue):
2066         (box):
2067         (functionTestWasmModuleFunctions):
2068         * wasm/WasmB3IRGenerator.cpp:
2069         (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
2070         (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
2071         * wasm/WasmFunctionParser.h:
2072         (JSC::Wasm::FunctionParser<Context>::parseExpression):
2073         * wasm/wasm.json:
2074
2075 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
2076
2077         Renamed EvalCodeCache => DirectEvalCodeCache
2078         https://bugs.webkit.org/show_bug.cgi?id=165271
2079
2080         Reviewed by Saam Barati.
2081
2082         We only use this cache for DirectEval, not IndirectEval.
2083
2084         * JavaScriptCore.xcodeproj/project.pbxproj:
2085         * bytecode/CodeBlock.cpp:
2086         (JSC::DirectEvalCodeCache::visitAggregate):
2087         (JSC::CodeBlock::stronglyVisitStrongReferences):
2088         (JSC::EvalCodeCache::visitAggregate): Deleted.
2089         * bytecode/CodeBlock.h:
2090         (JSC::CodeBlock::directEvalCodeCache):
2091         (JSC::CodeBlock::evalCodeCache): Deleted.
2092         * bytecode/DirectEvalCodeCache.h: Copied from Source/JavaScriptCore/bytecode/EvalCodeCache.h.
2093         (JSC::EvalCodeCache::CacheKey::CacheKey): Deleted.
2094         (JSC::EvalCodeCache::CacheKey::hash): Deleted.
2095         (JSC::EvalCodeCache::CacheKey::isEmptyValue): Deleted.
2096         (JSC::EvalCodeCache::CacheKey::operator==): Deleted.
2097         (JSC::EvalCodeCache::CacheKey::isHashTableDeletedValue): Deleted.
2098         (JSC::EvalCodeCache::CacheKey::Hash::hash): Deleted.
2099         (JSC::EvalCodeCache::CacheKey::Hash::equal): Deleted.
2100         (JSC::EvalCodeCache::tryGet): Deleted.
2101         (JSC::EvalCodeCache::set): Deleted.
2102         (JSC::EvalCodeCache::isEmpty): Deleted.
2103         (JSC::EvalCodeCache::clear): Deleted.
2104         * bytecode/EvalCodeCache.h: Removed.
2105         * interpreter/Interpreter.cpp:
2106         (JSC::eval):
2107         * runtime/DirectEvalExecutable.cpp:
2108         (JSC::DirectEvalExecutable::create):
2109
2110 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
2111
2112         Removed some unnecessary indirection in code generation
2113         https://bugs.webkit.org/show_bug.cgi?id=165264
2114
2115         Reviewed by Keith Miller.
2116
2117         There's no need to route through JSGlobalObject when producing code --
2118         it just made the code harder to read.
2119
2120         This patch moves functions from JSGlobalObject to their singleton
2121         call sites.
2122
2123         * runtime/CodeCache.cpp:
2124         (JSC::CodeCache::getUnlinkedEvalCodeBlock):
2125         (JSC::CodeCache::getUnlinkedGlobalEvalCodeBlock): Deleted.
2126         * runtime/CodeCache.h:
2127         * runtime/DirectEvalExecutable.cpp:
2128         (JSC::DirectEvalExecutable::create):
2129         * runtime/IndirectEvalExecutable.cpp:
2130         (JSC::IndirectEvalExecutable::create):
2131         * runtime/JSGlobalObject.cpp:
2132         (JSC::JSGlobalObject::createProgramCodeBlock): Deleted.
2133         (JSC::JSGlobalObject::createLocalEvalCodeBlock): Deleted.
2134         (JSC::JSGlobalObject::createGlobalEvalCodeBlock): Deleted.
2135         (JSC::JSGlobalObject::createModuleProgramCodeBlock): Deleted.
2136         * runtime/JSGlobalObject.h:
2137         * runtime/ModuleProgramExecutable.cpp:
2138         (JSC::ModuleProgramExecutable::create):
2139         * runtime/ProgramExecutable.cpp:
2140         (JSC::ProgramExecutable::initializeGlobalProperties):
2141         * runtime/ProgramExecutable.h:
2142
2143 2016-11-30  Darin Adler  <darin@apple.com>
2144
2145         Roll out StringBuilder changes from the previous patch.
2146         They were a slowdown on a Kraken JSON test.
2147
2148         * runtime/JSONObject.cpp:
2149         Roll out changes from below.
2150
2151 2016-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2152
2153         [JSC] Specifying same module entry point multiple times cause TypeError
2154         https://bugs.webkit.org/show_bug.cgi?id=164858
2155
2156         Reviewed by Saam Barati.
2157
2158         Allow importing the same module multiple times. Previously, when specifying the same
2159         module in the <script type="module" src="here">, it throws TypeError.
2160
2161         * builtins/ModuleLoaderPrototype.js:
2162         (requestFetch):
2163         (requestTranslate):
2164         (requestInstantiate):
2165         (requestSatisfy):
2166
2167 2016-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2168
2169         WebAssembly JS API: export a module namespace object instead of a module environment
2170         https://bugs.webkit.org/show_bug.cgi?id=165121
2171
2172         Reviewed by Saam Barati.
2173
2174         This patch setup AbstractModuleRecord further for WebAssemblyModuleRecord.
2175         For exported entries in a wasm instance, we set up exported entries for
2176         AbstractModuleRecord. This allows us to export WASM exported functions in
2177         the module handling code.
2178
2179         Since the exported entries in the abstract module record are correctly
2180         instantiated, the module namespace object for WASM module also starts
2181         working correctly. So we start exposing the module namespace object
2182         as `instance.exports` instead of the module environment object.
2183
2184         And we move SourceCode, lexicalVariables, and declaredVariables fields to
2185         JSModuleRecord since they are related to JS source code (in the spec words,
2186         they are related to the source text module record).
2187
2188         * runtime/AbstractModuleRecord.cpp:
2189         (JSC::AbstractModuleRecord::AbstractModuleRecord):
2190         * runtime/AbstractModuleRecord.h:
2191         (JSC::AbstractModuleRecord::sourceCode): Deleted.
2192         (JSC::AbstractModuleRecord::declaredVariables): Deleted.
2193         (JSC::AbstractModuleRecord::lexicalVariables): Deleted.
2194         * runtime/JSModuleRecord.cpp:
2195         (JSC::JSModuleRecord::JSModuleRecord):
2196         * runtime/JSModuleRecord.h:
2197         (JSC::JSModuleRecord::sourceCode):
2198         (JSC::JSModuleRecord::declaredVariables):
2199         (JSC::JSModuleRecord::lexicalVariables):
2200         * wasm/WasmFormat.cpp:
2201         * wasm/js/JSWebAssemblyInstance.cpp:
2202         (JSC::JSWebAssemblyInstance::finishCreation):
2203         * wasm/js/WebAssemblyFunction.cpp:
2204         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2205         (JSC::constructJSWebAssemblyInstance):
2206         * wasm/js/WebAssemblyModuleRecord.cpp:
2207         (JSC::WebAssemblyModuleRecord::create):
2208         (JSC::WebAssemblyModuleRecord::WebAssemblyModuleRecord):
2209         (JSC::WebAssemblyModuleRecord::finishCreation):
2210         WebAssemblyModuleRecord::link should perform linking things.
2211         So allocating exported entries should be done here.
2212         (JSC::WebAssemblyModuleRecord::link):
2213         * wasm/js/WebAssemblyModuleRecord.h:
2214
2215 2016-11-30  Mark Lam  <mark.lam@apple.com>
2216
2217         TypeInfo::OutOfLineTypeFlags should be 16 bits in size.
2218         https://bugs.webkit.org/show_bug.cgi?id=165224
2219
2220         Reviewed by Saam Barati.
2221
2222         There's no reason for OutOfLineTypeFlags to be constraint to 8 bits since the
2223         space is available to us.  Making OutOfLineTypeFlags 16 bits brings TypeInfo up
2224         to 32 bits in size from the current 24 bits.
2225
2226         * runtime/JSTypeInfo.h:
2227         (JSC::TypeInfo::TypeInfo):
2228
2229 2016-11-30  Joseph Pecoraro  <pecoraro@apple.com>
2230
2231         REGRESSION: inspector/sampling-profiler/* LayoutTests are flaky timeouts
2232         https://bugs.webkit.org/show_bug.cgi?id=164388
2233         <rdar://problem/29101555>
2234
2235         Reviewed by Saam Barati.
2236
2237         There was a possibility of a deadlock between the main thread and the GC thread
2238         with the SamplingProfiler lock when Inspector is processing samples to send to
2239         the frontend. The Inspector (main thread) was holding the SamplingProfiler lock
2240         while processing samples, which runs JavaScript that could trigger a GC, and
2241         GC then tries to acquire the SamplingProfiler lock to process unprocessed samples.
2242
2243         A simple solution here is to tighten the bounds of when Inspector holds the
2244         SamplingProfiler lock. It only needs the lock when extracting samples from
2245         the SamplingProfiler. It doesn't need to hold the lock for processing those
2246         samples, which is what can run script and cause a GC.
2247
2248         * inspector/agents/InspectorScriptProfilerAgent.cpp:
2249         (Inspector::InspectorScriptProfilerAgent::trackingComplete):
2250         Tighten bounds of this lock to only where it is needed.
2251
2252 2016-11-30  Mark Lam  <mark.lam@apple.com>
2253
2254         Proxy is not allowed in the global prototype chain.
2255         https://bugs.webkit.org/show_bug.cgi?id=165205
2256
2257         Reviewed by Geoffrey Garen.
2258
2259         * runtime/ProgramExecutable.cpp:
2260         (JSC::ProgramExecutable::initializeGlobalProperties):
2261         - We'll now throw a TypeError if we detect a Proxy in the global prototype chain.
2262
2263 2016-11-30  Commit Queue  <commit-queue@webkit.org>
2264
2265         Unreviewed, rolling out r209112.
2266         https://bugs.webkit.org/show_bug.cgi?id=165208
2267
2268         "It regressed Octane/Raytrace and JetStream" (Requested by
2269         saamyjoon on #webkit).
2270
2271         Reverted changeset:
2272
2273         "We should support CreateThis in the FTL"
2274         https://bugs.webkit.org/show_bug.cgi?id=164904
2275         http://trac.webkit.org/changeset/209112
2276
2277 2016-11-30  Darin Adler  <darin@apple.com>
2278
2279         Streamline and speed up tokenizer and segmented string classes
2280         https://bugs.webkit.org/show_bug.cgi?id=165003
2281
2282         Reviewed by Sam Weinig.
2283
2284         * runtime/JSONObject.cpp:
2285         (JSC::Stringifier::appendStringifiedValue): Use viewWithUnderlyingString when calling
2286         StringBuilder::appendQuotedJSONString, since it now takes a StringView and there is
2287         no benefit in creating a String for that function if one doesn't already exist.
2288
2289 2016-11-29  JF Bastien  <jfbastien@apple.com>
2290
2291         WebAssembly JS API: improve Instance
2292         https://bugs.webkit.org/show_bug.cgi?id=164757
2293
2294         Reviewed by Keith Miller.
2295
2296         An Instance's `exports` property wasn't populated with exports.
2297
2298         According to the spec [0], `exports` should present itself as a WebAssembly
2299         Module Record. In order to do this we need to split JSModuleRecord into
2300         AbstractModuleRecord (without the `link` and `evaluate` functions), and
2301         JSModuleRecord (which implements link and evaluate). We can then have a separate
2302         WebAssemblyModuleRecord which shares most of the implementation.
2303
2304         `exports` then maps function names to WebAssemblyFunction and
2305         WebAssemblyFunctionCell, which call into the B3-generated WebAssembly code.
2306
2307         A follow-up patch will do imports.
2308
2309         A few things of note:
2310
2311          - Use Identifier instead of String. They get uniqued, we need them for the JSModuleNamespaceObject. This is safe because JSWebAssemblyModule creation is on the main thread.
2312          - JSWebAssemblyInstance needs to refer to the JSWebAssemblyModule used to create it, because the module owns the code, identifiers, etc. The world would be very sad if it got GC'd.
2313          - Instance.exports shouldn't use putWithoutTransition because it affects all Structures, whereas here each instance needs its own exports.
2314          - Expose the compiled functions, and pipe them to the InstanceConstructor. Start moving things around to split JSModuleRecord out into JS and WebAssembly parts.
2315
2316           [0]: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-constructor
2317
2318         * CMakeLists.txt:
2319         * JavaScriptCore.xcodeproj/project.pbxproj:
2320         * runtime/AbstractModuleRecord.cpp: Copied from Source/JavaScriptCore/runtime/JSModuleRecord.cpp, which I split in two
2321         (JSC::AbstractModuleRecord::AbstractModuleRecord):
2322         (JSC::AbstractModuleRecord::destroy):
2323         (JSC::AbstractModuleRecord::finishCreation):
2324         (JSC::AbstractModuleRecord::visitChildren):
2325         (JSC::AbstractModuleRecord::appendRequestedModule):
2326         (JSC::AbstractModuleRecord::addStarExportEntry):
2327         (JSC::AbstractModuleRecord::addImportEntry):
2328         (JSC::AbstractModuleRecord::addExportEntry):
2329         (JSC::identifierToJSValue):
2330         (JSC::AbstractModuleRecord::hostResolveImportedModule):
2331         (JSC::AbstractModuleRecord::ResolveQuery::ResolveQuery):
2332         (JSC::AbstractModuleRecord::ResolveQuery::isEmptyValue):
2333         (JSC::AbstractModuleRecord::ResolveQuery::isDeletedValue):
2334         (JSC::AbstractModuleRecord::ResolveQuery::Hash::hash):
2335         (JSC::AbstractModuleRecord::ResolveQuery::Hash::equal):
2336         (JSC::AbstractModuleRecord::cacheResolution):
2337         (JSC::getExportedNames):
2338         (JSC::AbstractModuleRecord::getModuleNamespace):
2339         (JSC::printableName):
2340         (JSC::AbstractModuleRecord::dump):
2341         * runtime/AbstractModuleRecord.h: Copied from Source/JavaScriptCore/runtime/JSModuleRecord.h.
2342         (JSC::AbstractModuleRecord::ImportEntry::isNamespace):
2343         (JSC::AbstractModuleRecord::sourceCode):
2344         (JSC::AbstractModuleRecord::moduleKey):
2345         (JSC::AbstractModuleRecord::requestedModules):
2346         (JSC::AbstractModuleRecord::exportEntries):
2347         (JSC::AbstractModuleRecord::importEntries):
2348         (JSC::AbstractModuleRecord::starExportEntries):
2349         (JSC::AbstractModuleRecord::declaredVariables):
2350         (JSC::AbstractModuleRecord::lexicalVariables):
2351         (JSC::AbstractModuleRecord::moduleEnvironment):
2352         * runtime/JSGlobalObject.cpp:
2353         (JSC::JSGlobalObject::init):
2354         (JSC::JSGlobalObject::visitChildren):
2355         * runtime/JSGlobalObject.h:
2356         (JSC::JSGlobalObject::webAssemblyModuleRecordStructure):
2357         (JSC::JSGlobalObject::webAssemblyFunctionStructure):
2358         * runtime/JSModuleEnvironment.cpp:
2359         (JSC::JSModuleEnvironment::create):
2360         (JSC::JSModuleEnvironment::finishCreation):
2361         (JSC::JSModuleEnvironment::getOwnPropertySlot):
2362         (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
2363         (JSC::JSModuleEnvironment::put):
2364         (JSC::JSModuleEnvironment::deleteProperty):
2365         * runtime/JSModuleEnvironment.h:
2366         (JSC::JSModuleEnvironment::create):
2367         (JSC::JSModuleEnvironment::offsetOfModuleRecord):
2368         (JSC::JSModuleEnvironment::allocationSize):
2369         (JSC::JSModuleEnvironment::moduleRecord):
2370         (JSC::JSModuleEnvironment::moduleRecordSlot):
2371         * runtime/JSModuleNamespaceObject.cpp:
2372         (JSC::JSModuleNamespaceObject::finishCreation):
2373         (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
2374         * runtime/JSModuleNamespaceObject.h:
2375         (JSC::JSModuleNamespaceObject::create):
2376         (JSC::JSModuleNamespaceObject::moduleRecord):
2377         * runtime/JSModuleRecord.cpp:
2378         (JSC::JSModuleRecord::createStructure):
2379         (JSC::JSModuleRecord::create):
2380         (JSC::JSModuleRecord::JSModuleRecord):
2381         (JSC::JSModuleRecord::destroy):
2382         (JSC::JSModuleRecord::finishCreation):
2383         (JSC::JSModuleRecord::visitChildren):
2384         (JSC::JSModuleRecord::instantiateDeclarations):
2385         * runtime/JSModuleRecord.h:
2386         * runtime/JSScope.cpp:
2387         (JSC::abstractAccess):
2388         (JSC::JSScope::collectClosureVariablesUnderTDZ):
2389         * runtime/VM.cpp:
2390         (JSC::VM::VM):
2391         * runtime/VM.h:
2392         * wasm/JSWebAssembly.h:
2393         * wasm/WasmFormat.h: use Identifier instead of String
2394         * wasm/WasmModuleParser.cpp:
2395         (JSC::Wasm::ModuleParser::parse):
2396         (JSC::Wasm::ModuleParser::parseType):
2397         (JSC::Wasm::ModuleParser::parseImport): fix off-by-one
2398         (JSC::Wasm::ModuleParser::parseFunction):
2399         (JSC::Wasm::ModuleParser::parseExport):
2400         * wasm/WasmModuleParser.h:
2401         (JSC::Wasm::ModuleParser::ModuleParser):
2402         * wasm/WasmPlan.cpp:
2403         (JSC::Wasm::Plan::run):
2404         * wasm/js/JSWebAssemblyInstance.cpp:
2405         (JSC::JSWebAssemblyInstance::create):
2406         (JSC::JSWebAssemblyInstance::finishCreation):
2407         (JSC::JSWebAssemblyInstance::visitChildren):
2408         * wasm/js/JSWebAssemblyInstance.h:
2409         (JSC::JSWebAssemblyInstance::module):
2410         * wasm/js/JSWebAssemblyModule.cpp:
2411         (JSC::JSWebAssemblyModule::create):
2412         (JSC::JSWebAssemblyModule::finishCreation):
2413         (JSC::JSWebAssemblyModule::visitChildren):
2414         * wasm/js/JSWebAssemblyModule.h:
2415         (JSC::JSWebAssemblyModule::moduleInformation):
2416         (JSC::JSWebAssemblyModule::compiledFunctions):
2417         (JSC::JSWebAssemblyModule::exportSymbolTable):
2418         * wasm/js/WebAssemblyFunction.cpp: Added.
2419         (JSC::callWebAssemblyFunction):
2420         (JSC::WebAssemblyFunction::create):
2421         (JSC::WebAssemblyFunction::createStructure):
2422         (JSC::WebAssemblyFunction::WebAssemblyFunction):
2423         (JSC::WebAssemblyFunction::visitChildren):
2424         (JSC::WebAssemblyFunction::finishCreation):
2425         * wasm/js/WebAssemblyFunction.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h.
2426         (JSC::CallableWebAssemblyFunction::CallableWebAssemblyFunction):
2427         (JSC::WebAssemblyFunction::webAssemblyFunctionCell):
2428         * wasm/js/WebAssemblyFunctionCell.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h.
2429         (JSC::WebAssemblyFunctionCell::create):
2430         (JSC::WebAssemblyFunctionCell::WebAssemblyFunctionCell):
2431         (JSC::WebAssemblyFunctionCell::destroy):
2432         (JSC::WebAssemblyFunctionCell::createStructure):
2433         * wasm/js/WebAssemblyFunctionCell.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h.
2434         (JSC::WebAssemblyFunctionCell::function):
2435         * wasm/js/WebAssemblyInstanceConstructor.cpp:
2436         (JSC::constructJSWebAssemblyInstance):
2437         * wasm/js/WebAssemblyModuleConstructor.cpp:
2438         (JSC::constructJSWebAssemblyModule):
2439         * wasm/js/WebAssemblyModuleRecord.cpp: Added.
2440         (JSC::WebAssemblyModuleRecord::createStructure):
2441         (JSC::WebAssemblyModuleRecord::create):
2442         (JSC::WebAssemblyModuleRecord::WebAssemblyModuleRecord):
2443         (JSC::WebAssemblyModuleRecord::destroy):
2444         (JSC::WebAssemblyModuleRecord::finishCreation):
2445         (JSC::WebAssemblyModuleRecord::visitChildren):
2446         (JSC::WebAssemblyModuleRecord::link):
2447         (JSC::WebAssemblyModuleRecord::evaluate):
2448         * wasm/js/WebAssemblyModuleRecord.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h.
2449
2450 2016-11-29  Saam Barati  <sbarati@apple.com>
2451
2452         We should be able optimize the pattern where we spread a function's rest parameter to another call
2453         https://bugs.webkit.org/show_bug.cgi?id=163865
2454
2455         Reviewed by Filip Pizlo.
2456
2457         This patch optimizes the following patterns to prevent both the allocation
2458         of the rest parameter, and the execution of the iterator protocol:
2459
2460         ```
2461         function foo(...args) {
2462             let arr = [...args];
2463         }
2464
2465         and
2466
2467         function foo(...args) {
2468             bar(...args);
2469         }
2470         ```
2471
2472         To do this, I've extended the arguments elimination phase to reason
2473         about Spread and NewArrayWithSpread. I've added two new nodes, PhantomSpread
2474         and PhantomNewArrayWithSpread. PhantomSpread is only allowed over rest
2475         parameters that don't escape. If the rest parameter *does* escape, we can't
2476         convert the spread into a phantom because it would not be sound w.r.t JS
2477         semantics because we would be reading from the call frame even though
2478         the rest array may have changed.
2479
2480         Note that NewArrayWithSpread also understands what to do when one of its
2481         arguments is PhantomSpread(@PhantomCreateRest) even if it itself is escaped.
2482
2483         PhantomNewArrayWithSpread is only allowed over a series of
2484         PhantomSpread(@PhantomCreateRest) nodes. Like with PhantomSpread, PhantomNewArrayWithSpread
2485         is only allowed if none of its arguments that are being spread are escaped
2486         and if it itself is not escaped.
2487
2488         Because there is a dependency between a node being a candidate and
2489         the escaped state of the node's children, I've extended the notion
2490         of escaping a node inside the arguments elimination phase. Now, when
2491         any node is escaped, we must consider all other candidates that are may
2492         now no longer be valid.
2493
2494         For example:
2495
2496         ```
2497         function foo(...args) {
2498             escape(args);
2499             bar(...args);
2500         }
2501         ```
2502
2503         In the above program, we don't know if the function call to escape()
2504         modifies args, therefore, the spread can not become phantom because
2505         the execution of the spread may not be as simple as reading the
2506         arguments from the call frame.
2507
2508         Unfortunately, the arguments elimination phase does not consider control
2509         flow when doing its escape analysis. It would be good to integrate this
2510         phase with the object allocation sinking phase. To see why, consider
2511         an example where we don't eliminate the spread and allocation of the rest
2512         parameter even though we could:
2513
2514         ```
2515         function foo(rareCondition, ...args) {
2516             bar(...args);
2517             if (rareCondition)
2518                 baz(args);
2519         }
2520         ```
2521
2522         There are only a few users of the PhantomSpread and PhantomNewArrayWithSpread
2523         nodes. PhantomSpread is only used by PhantomNewArrayWithSpread and NewArrayWithSpread.
2524         PhantomNewArrayWithSpread is only used by ForwardVarargs and the various
2525         *Call*ForwardVarargs nodes. The users of these phantoms know how to produce
2526         what the phantom node would have produced. For example, NewArrayWithSpread
2527         knows how to produce the values that would have been produced by PhantomSpread(@PhantomCreateRest)
2528         by directly reading from the call frame.
2529
2530         This patch is a 6% speedup on my MBP on ES6SampleBench.
2531
2532         * b3/B3LowerToAir.cpp:
2533         (JSC::B3::Air::LowerToAir::tryAppendLea):
2534         * b3/B3ValueRep.h:
2535         * builtins/BuiltinExecutables.cpp:
2536         (JSC::BuiltinExecutables::createDefaultConstructor):
2537         * dfg/DFGAbstractInterpreterInlines.h:
2538         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2539         * dfg/DFGArgumentsEliminationPhase.cpp:
2540         * dfg/DFGClobberize.h:
2541         (JSC::DFG::clobberize):
2542         * dfg/DFGDoesGC.cpp:
2543         (JSC::DFG::doesGC):
2544         * dfg/DFGFixupPhase.cpp:
2545         (JSC::DFG::FixupPhase::fixupNode):
2546         * dfg/DFGForAllKills.h:
2547         (JSC::DFG::forAllKillsInBlock):
2548         * dfg/DFGNode.h:
2549         (JSC::DFG::Node::hasConstant):
2550         (JSC::DFG::Node::constant):
2551         (JSC::DFG::Node::bitVector):
2552         (JSC::DFG::Node::isPhantomAllocation):
2553         * dfg/DFGNodeType.h:
2554         * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
2555         (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
2556         (JSC::DFG::LocalOSRAvailabilityCalculator::LocalOSRAvailabilityCalculator):
2557         (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
2558         * dfg/DFGOSRAvailabilityAnalysisPhase.h:
2559         * dfg/DFGObjectAllocationSinkingPhase.cpp:
2560         * dfg/DFGPreciseLocalClobberize.h:
2561         (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
2562         * dfg/DFGPredictionPropagationPhase.cpp:
2563         * dfg/DFGPromotedHeapLocation.cpp:
2564         (WTF::printInternal):
2565         * dfg/DFGPromotedHeapLocation.h:
2566         * dfg/DFGSafeToExecute.h:
2567         (JSC::DFG::safeToExecute):
2568         * dfg/DFGSpeculativeJIT32_64.cpp:
2569         (JSC::DFG::SpeculativeJIT::compile):
2570         * dfg/DFGSpeculativeJIT64.cpp:
2571         (JSC::DFG::SpeculativeJIT::compile):
2572         * dfg/DFGValidate.cpp:
2573         * ftl/FTLCapabilities.cpp:
2574         (JSC::FTL::canCompile):
2575         * ftl/FTLLowerDFGToB3.cpp:
2576         (JSC::FTL::DFG::LowerDFGToB3::LowerDFGToB3):
2577         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
2578         (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
2579         (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
2580         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
2581         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
2582         (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
2583         (JSC::FTL::DFG::LowerDFGToB3::getSpreadLengthFromInlineCallFrame):
2584         (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargsWithSpread):
2585         * ftl/FTLOperations.cpp:
2586         (JSC::FTL::operationPopulateObjectInOSR):
2587         (JSC::FTL::operationMaterializeObjectInOSR):
2588         * jit/SetupVarargsFrame.cpp:
2589         (JSC::emitSetupVarargsFrameFastCase):
2590         * jsc.cpp:
2591         (GlobalObject::finishCreation):
2592         (functionMaxArguments):
2593         * runtime/JSFixedArray.h:
2594         (JSC::JSFixedArray::createFromArray):
2595
2596 2016-11-29  Commit Queue  <commit-queue@webkit.org>
2597
2598         Unreviewed, rolling out r209058 and r209074.
2599         https://bugs.webkit.org/show_bug.cgi?id=165188
2600
2601         These changes caused API test StringBuilderTest.Equal to crash
2602         and/or fail. (Requested by ryanhaddad on #webkit).
2603
2604         Reverted changesets:
2605
2606         "Streamline and speed up tokenizer and segmented string
2607         classes"
2608         https://bugs.webkit.org/show_bug.cgi?id=165003
2609         http://trac.webkit.org/changeset/209058
2610
2611         "REGRESSION (r209058): API test StringBuilderTest.Equal
2612         crashing"
2613         https://bugs.webkit.org/show_bug.cgi?id=165142
2614         http://trac.webkit.org/changeset/209074
2615
2616 2016-11-29  Caitlin Potter  <caitp@igalia.com>
2617
2618         [JSC] always wrap AwaitExpression operand in a new Promise
2619         https://bugs.webkit.org/show_bug.cgi?id=165181
2620
2621         Reviewed by Yusuke Suzuki.
2622
2623         Ensure operand of AwaitExpression is wrapped in a new Promise by
2624         explicitly creating a new Promise Capability and invoking its
2625         resolve callback. This avoids the specified short-circuit for
2626         Promise.resolve().
2627
2628         * builtins/AsyncFunctionPrototype.js:
2629         (globalPrivate.asyncFunctionResume):
2630
2631 2016-11-29  Saam Barati  <sbarati@apple.com>
2632
2633         We should support CreateThis in the FTL
2634         https://bugs.webkit.org/show_bug.cgi?id=164904
2635
2636         Reviewed by Geoffrey Garen.
2637
2638         * ftl/FTLAbstractHeapRepository.h:
2639         * ftl/FTLCapabilities.cpp:
2640         (JSC::FTL::canCompile):
2641         * ftl/FTLLowerDFGToB3.cpp:
2642         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
2643         (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
2644         (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
2645         (JSC::FTL::DFG::LowerDFGToB3::compileCreateThis):
2646         (JSC::FTL::DFG::LowerDFGToB3::storeStructure):
2647         (JSC::FTL::DFG::LowerDFGToB3::allocateCell):
2648         (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
2649         (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
2650         (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
2651         * runtime/Structure.h:
2652
2653 2016-11-29  Mark Lam  <mark.lam@apple.com>
2654
2655         Fix exception scope verification failures in runtime/RegExp* files.
2656         https://bugs.webkit.org/show_bug.cgi?id=165054
2657
2658         Reviewed by Saam Barati.
2659
2660         Also replaced returning JSValue() with returning { }.
2661
2662         * runtime/RegExpConstructor.cpp:
2663         (JSC::toFlags):
2664         (JSC::regExpCreate):
2665         (JSC::constructRegExp):
2666         * runtime/RegExpObject.cpp:
2667         (JSC::RegExpObject::defineOwnProperty):
2668         (JSC::collectMatches):
2669         (JSC::RegExpObject::matchGlobal):
2670         * runtime/RegExpObjectInlines.h:
2671         (JSC::getRegExpObjectLastIndexAsUnsigned):
2672         (JSC::RegExpObject::execInline):
2673         (JSC::RegExpObject::matchInline):
2674         * runtime/RegExpPrototype.cpp:
2675         (JSC::regExpProtoFuncCompile):
2676         (JSC::flagsString):
2677         (JSC::regExpProtoFuncToString):
2678         (JSC::regExpProtoFuncSplitFast):
2679
2680 2016-11-29  Andy Estes  <aestes@apple.com>
2681
2682         [Cocoa] Enable two clang warnings recommended by Xcode
2683         https://bugs.webkit.org/show_bug.cgi?id=164498
2684
2685         Reviewed by Mark Lam.
2686
2687         * Configurations/Base.xcconfig: Enabled CLANG_WARN_INFINITE_RECURSION and CLANG_WARN_SUSPICIOUS_MOVE.
2688
2689 2016-11-29  Keith Miller  <keith_miller@apple.com>
2690
2691         Add simple way to implement Wasm ops that require more than one B3 opcode
2692         https://bugs.webkit.org/show_bug.cgi?id=165129
2693
2694         Reviewed by Geoffrey Garen.
2695
2696         This patch adds a simple way to show the B3IRGenerator opcode script how
2697         to generate code for Wasm opcodes that do not have a one to one mapping.
2698         The syntax is pretty simple right now. There are only three things one
2699         can use as of this patch (although more things might be added in the future)
2700         1) Wasm opcode arguments: These are referred to as @<argument_number>. For example,
2701            I32.sub would map to Sub(@0, @1).
2702         2) 32-bit int constants: These are reffered to as i32(<value>). For example, i32.inc
2703            would map to Add(@0, i32(1))
2704         3) B3 opcodes: These are referred to as the B3 opcode name followed by the B3Value's constructor
2705            arguments. A value may take the result of another value as an argument. For example, you can do
2706            Div(Mul(@0, Add(@0, i32(1))), i32(2)) if there was a b3 opcode that computed the sum from 1 to n.
2707
2708         These scripts are used to implement Wasm's eqz and floating point max/min opcodes. This patch
2709         also adds missing support for the Wasm Neg opcodes.
2710
2711         * jsc.cpp:
2712         (box):
2713         (functionTestWasmModuleFunctions):
2714         * wasm/WasmB3IRGenerator.cpp:
2715         (JSC::Wasm::toB3Op): Deleted.
2716         * wasm/WasmFunctionParser.h:
2717         (JSC::Wasm::FunctionParser<Context>::parseBody):
2718         * wasm/WasmModuleParser.cpp:
2719         (JSC::Wasm::ModuleParser::parseType):
2720         * wasm/WasmParser.h:
2721         (JSC::Wasm::Parser::parseUInt8):
2722         (JSC::Wasm::Parser::parseValueType):
2723         * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
2724         (Source):
2725         (Source.__init__):
2726         (read):
2727         (lex):
2728         (CodeGenerator):
2729         (CodeGenerator.__init__):
2730         (CodeGenerator.advance):
2731         (CodeGenerator.token):
2732         (CodeGenerator.parseError):
2733         (CodeGenerator.consume):
2734         (CodeGenerator.generateParameters):
2735         (CodeGenerator.generateOpcode):
2736         (CodeGenerator.generate):
2737         (temp):
2738         (generateB3OpCode):
2739         (generateI32ConstCode):
2740         (generateB3Code):
2741         (generateSimpleCode):
2742         * wasm/wasm.json:
2743
2744 2016-11-29  Mark Lam  <mark.lam@apple.com>
2745
2746         Fix exception scope verification failures in ProxyConstructor.cpp and ProxyObject.cpp.
2747         https://bugs.webkit.org/show_bug.cgi?id=165053
2748
2749         Reviewed by Saam Barati.
2750
2751         Also replaced returning JSValue() with returning { }.
2752
2753         * runtime/ProxyConstructor.cpp:
2754         (JSC::constructProxyObject):
2755         * runtime/ProxyObject.cpp:
2756         (JSC::ProxyObject::structureForTarget):
2757         (JSC::performProxyGet):
2758         (JSC::ProxyObject::performInternalMethodGetOwnProperty):
2759         (JSC::ProxyObject::performHasProperty):
2760         (JSC::ProxyObject::getOwnPropertySlotCommon):
2761         (JSC::ProxyObject::performPut):
2762         (JSC::ProxyObject::putByIndexCommon):
2763         (JSC::performProxyCall):
2764         (JSC::performProxyConstruct):
2765         (JSC::ProxyObject::performDelete):
2766         (JSC::ProxyObject::performPreventExtensions):
2767         (JSC::ProxyObject::performIsExtensible):
2768         (JSC::ProxyObject::performDefineOwnProperty):
2769         (JSC::ProxyObject::performGetOwnPropertyNames):
2770         (JSC::ProxyObject::performSetPrototype):
2771         (JSC::ProxyObject::performGetPrototype):
2772
2773 2016-11-28  Matt Baker  <mattbaker@apple.com>
2774
2775         Web Inspector: Debugger should have an option for showing asynchronous call stacks
2776         https://bugs.webkit.org/show_bug.cgi?id=163230
2777         <rdar://problem/28698683>
2778
2779         Reviewed by Joseph Pecoraro.
2780
2781         * inspector/ScriptCallFrame.cpp:
2782         (Inspector::ScriptCallFrame::isNative):
2783         Encapsulate check for native code source URL.
2784
2785         * inspector/ScriptCallFrame.h:
2786         * inspector/ScriptCallStack.cpp:
2787         (Inspector::ScriptCallStack::firstNonNativeCallFrame):
2788         (Inspector::ScriptCallStack::buildInspectorArray):
2789         * inspector/ScriptCallStack.h:
2790         Replace use of Console::StackTrace with Array<Console::CallFrame>.
2791
2792         * inspector/agents/InspectorDebuggerAgent.cpp:
2793         (Inspector::InspectorDebuggerAgent::disable):
2794         (Inspector::InspectorDebuggerAgent::setAsyncStackTraceDepth):
2795         Set number of async frames to store (including boundary frames).
2796         A value of zero disables recording of async call stacks.
2797
2798         (Inspector::InspectorDebuggerAgent::buildAsyncStackTrace):
2799         Helper function for building a linked list StackTraces.
2800         (Inspector::InspectorDebuggerAgent::didScheduleAsyncCall):
2801         Store a call stack for the script that scheduled the async call.
2802         If the call repeats (e.g. setInterval), the starting reference count is
2803         set to 1. This ensures that dereffing after dispatch won't clear the stack.
2804         If another async call is currently being dispatched, increment the
2805         AsyncCallData reference count for that call.
2806
2807         (Inspector::InspectorDebuggerAgent::didCancelAsyncCall):
2808         Decrement the reference count for the canceled call.
2809
2810         (Inspector::InspectorDebuggerAgent::willDispatchAsyncCall):
2811         Set the identifier for the async callback currently being dispatched,
2812         so that if the debugger pauses during dispatch a stack trace can be
2813         associated with the pause location. If an async call is already being
2814         dispatched, which could be the case when a script schedules an async
2815         call in a nested runloop, do nothing.
2816
2817         (Inspector::InspectorDebuggerAgent::didDispatchAsyncCall):
2818         Decrement the reference count for the canceled call.
2819         (Inspector::InspectorDebuggerAgent::didPause):
2820         If a stored stack trace exists for this location, convert to a protocol
2821         object and send to the frontend.
2822
2823         (Inspector::InspectorDebuggerAgent::didClearGlobalObject):
2824         (Inspector::InspectorDebuggerAgent::clearAsyncStackTraceData):
2825         (Inspector::InspectorDebuggerAgent::refAsyncCallData):
2826         Increment AsyncCallData reference count.
2827         (Inspector::InspectorDebuggerAgent::derefAsyncCallData):
2828         Decrement AsyncCallData reference count. If zero, deref its parent
2829         (if it exists) and remove the AsyncCallData entry.
2830
2831         * inspector/agents/InspectorDebuggerAgent.h:
2832
2833         * inspector/protocol/Console.json:
2834         * inspector/protocol/Network.json:
2835         Replace use of Console.StackTrace with array of Console.CallFrame.
2836
2837         * inspector/protocol/Debugger.json:
2838         New protocol command and event data.
2839
2840 2016-11-28  Darin Adler  <darin@apple.com>
2841
2842         Streamline and speed up tokenizer and segmented string classes
2843         https://bugs.webkit.org/show_bug.cgi?id=165003
2844
2845         Reviewed by Sam Weinig.
2846
2847         * runtime/JSONObject.cpp:
2848         (JSC::Stringifier::appendStringifiedValue): Use viewWithUnderlyingString when calling
2849         StringBuilder::appendQuotedJSONString, since it now takes a StringView and there is
2850         no benefit in creating a String for that function if one doesn't already exist.
2851
2852 2016-11-21  Mark Lam  <mark.lam@apple.com>
2853
2854         Fix exception scope verification failures in runtime/Intl* files.
2855         https://bugs.webkit.org/show_bug.cgi?id=165014
2856
2857         Reviewed by Saam Barati.
2858
2859         * runtime/IntlCollatorConstructor.cpp:
2860         (JSC::constructIntlCollator):
2861         (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
2862         * runtime/IntlCollatorPrototype.cpp:
2863         (JSC::IntlCollatorPrototypeFuncResolvedOptions):
2864         * runtime/IntlDateTimeFormatConstructor.cpp:
2865         (JSC::constructIntlDateTimeFormat):
2866         (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
2867         * runtime/IntlDateTimeFormatPrototype.cpp:
2868         (JSC::IntlDateTimeFormatFuncFormatDateTime):
2869         (JSC::IntlDateTimeFormatPrototypeGetterFormat):
2870         (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
2871         * runtime/IntlNumberFormatConstructor.cpp:
2872         (JSC::constructIntlNumberFormat):
2873         (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
2874         * runtime/IntlNumberFormatPrototype.cpp:
2875         (JSC::IntlNumberFormatFuncFormatNumber):
2876         (JSC::IntlNumberFormatPrototypeGetterFormat):
2877         (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
2878         * runtime/IntlObject.cpp:
2879         (JSC::lookupSupportedLocales):
2880         * runtime/IntlObjectInlines.h:
2881         (JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):
2882
2883 2016-11-28  Mark Lam  <mark.lam@apple.com>
2884
2885         Fix exception scope verification failures in IteratorOperations.h.
2886         https://bugs.webkit.org/show_bug.cgi?id=165015
2887
2888         Reviewed by Saam Barati.
2889
2890         * runtime/IteratorOperations.h:
2891         (JSC::forEachInIterable):
2892
2893 2016-11-28  Mark Lam  <mark.lam@apple.com>
2894
2895         Fix exception scope verification failures in JSArray* files.
2896         https://bugs.webkit.org/show_bug.cgi?id=165016
2897
2898         Reviewed by Saam Barati.
2899
2900         * runtime/JSArray.cpp:
2901         (JSC::JSArray::defineOwnProperty):
2902         (JSC::JSArray::put):
2903         (JSC::JSArray::setLength):
2904         (JSC::JSArray::pop):
2905         (JSC::JSArray::push):
2906         (JSC::JSArray::unshiftCountWithAnyIndexingType):
2907         * runtime/JSArrayBuffer.cpp:
2908         (JSC::JSArrayBuffer::put):
2909         (JSC::JSArrayBuffer::defineOwnProperty):
2910         * runtime/JSArrayInlines.h:
2911         (JSC::getLength):
2912         (JSC::toLength):
2913
2914 2016-11-28  Mark Lam  <mark.lam@apple.com>
2915
2916         Fix exception scope verification failures in JSDataView.cpp.
2917         https://bugs.webkit.org/show_bug.cgi?id=165020
2918
2919         Reviewed by Saam Barati.
2920
2921         * runtime/JSDataView.cpp:
2922         (JSC::JSDataView::put):
2923
2924 2016-11-28  Mark Lam  <mark.lam@apple.com>
2925
2926         Fix exception scope verification failures in JSFunction.cpp.
2927         https://bugs.webkit.org/show_bug.cgi?id=165021
2928
2929         Reviewed by Saam Barati.
2930
2931         * runtime/JSFunction.cpp:
2932         (JSC::JSFunction::put):
2933         (JSC::JSFunction::defineOwnProperty):
2934
2935 2016-11-28  Mark Lam  <mark.lam@apple.com>
2936
2937         Fix exception scope verification failures in runtime/JSGenericTypedArrayView* files.
2938         https://bugs.webkit.org/show_bug.cgi?id=165022
2939
2940         Reviewed by Saam Barati.
2941
2942         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
2943         (JSC::constructGenericTypedArrayViewFromIterator):
2944         (JSC::constructGenericTypedArrayViewWithArguments):
2945         (JSC::constructGenericTypedArrayView):
2946         * runtime/JSGenericTypedArrayViewInlines.h:
2947         (JSC::JSGenericTypedArrayView<Adaptor>::set):
2948         (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
2949         * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
2950         (JSC::speciesConstruct):
2951         (JSC::genericTypedArrayViewProtoFuncSet):
2952         (JSC::genericTypedArrayViewProtoFuncJoin):
2953         (JSC::genericTypedArrayViewProtoFuncSlice):
2954         (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
2955
2956 2016-11-28  Mark Lam  <mark.lam@apple.com>
2957
2958         Fix exception scope verification failures in runtime/Operations.cpp/h.
2959         https://bugs.webkit.org/show_bug.cgi?id=165046
2960
2961         Reviewed by Saam Barati.
2962
2963         Also switched to using returning { } instead of JSValue().
2964
2965         * runtime/Operations.cpp:
2966         (JSC::jsAddSlowCase):
2967         (JSC::jsIsObjectTypeOrNull):
2968         * runtime/Operations.h:
2969         (JSC::jsStringFromRegisterArray):
2970         (JSC::jsStringFromArguments):
2971         (JSC::jsLess):
2972         (JSC::jsLessEq):
2973
2974 2016-11-28  Mark Lam  <mark.lam@apple.com>
2975
2976         Fix exception scope verification failures in JSScope.cpp.
2977         https://bugs.webkit.org/show_bug.cgi?id=165047
2978
2979         Reviewed by Saam Barati.
2980
2981         * runtime/JSScope.cpp:
2982         (JSC::JSScope::resolve):
2983
2984 2016-11-28  Mark Lam  <mark.lam@apple.com>
2985
2986         Fix exception scope verification failures in JSTypedArrayViewPrototype.cpp.
2987         https://bugs.webkit.org/show_bug.cgi?id=165049
2988
2989         Reviewed by Saam Barati.
2990
2991         * runtime/JSTypedArrayViewPrototype.cpp:
2992         (JSC::typedArrayViewPrivateFuncSort):
2993         (JSC::typedArrayViewProtoFuncSet):
2994         (JSC::typedArrayViewProtoFuncCopyWithin):
2995         (JSC::typedArrayViewProtoFuncIncludes):
2996         (JSC::typedArrayViewProtoFuncLastIndexOf):
2997         (JSC::typedArrayViewProtoFuncIndexOf):
2998         (JSC::typedArrayViewProtoFuncJoin):
2999         (JSC::typedArrayViewProtoGetterFuncBuffer):
3000         (JSC::typedArrayViewProtoGetterFuncLength):
3001         (JSC::typedArrayViewProtoGetterFuncByteLength):
3002         (JSC::typedArrayViewProtoGetterFuncByteOffset):
3003         (JSC::typedArrayViewProtoFuncReverse):
3004         (JSC::typedArrayViewPrivateFuncSubarrayCreate):
3005         (JSC::typedArrayViewProtoFuncSlice):
3006
3007 2016-11-28  Mark Lam  <mark.lam@apple.com>
3008
3009         Fix exception scope verification failures in runtime/Map* files.
3010         https://bugs.webkit.org/show_bug.cgi?id=165050
3011
3012         Reviewed by Saam Barati.
3013
3014         * runtime/MapConstructor.cpp:
3015         (JSC::constructMap):
3016         * runtime/MapIteratorPrototype.cpp:
3017         (JSC::MapIteratorPrototypeFuncNext):
3018         * runtime/MapPrototype.cpp:
3019         (JSC::privateFuncMapIteratorNext):
3020
3021 2016-11-28  Mark Lam  <mark.lam@apple.com>
3022
3023         Fix exception scope verification failures in more miscellaneous files.
3024         https://bugs.webkit.org/show_bug.cgi?id=165102
3025
3026         Reviewed by Saam Barati.
3027
3028         * wasm/js/WebAssemblyInstanceConstructor.cpp:
3029         (JSC::constructJSWebAssemblyInstance):
3030
3031 2016-11-28  Mark Lam  <mark.lam@apple.com>
3032
3033         Fix exception scope verification failures in runtime/Weak* files.
3034         https://bugs.webkit.org/show_bug.cgi?id=165096
3035
3036         Reviewed by Geoffrey Garen.
3037
3038         * runtime/WeakMapConstructor.cpp:
3039         (JSC::constructWeakMap):
3040         * runtime/WeakMapPrototype.cpp:
3041         (JSC::protoFuncWeakMapSet):
3042         * runtime/WeakSetConstructor.cpp:
3043         (JSC::constructWeakSet):
3044         * runtime/WeakSetPrototype.cpp:
3045         (JSC::protoFuncWeakSetAdd):
3046
3047 2016-11-28  Mark Lam  <mark.lam@apple.com>
3048
3049         Fix exception scope verification failures in runtime/String* files.
3050         https://bugs.webkit.org/show_bug.cgi?id=165067
3051
3052         Reviewed by Saam Barati.
3053
3054         * runtime/StringConstructor.cpp:
3055         (JSC::stringFromCodePoint):
3056         (JSC::constructWithStringConstructor):
3057         * runtime/StringObject.cpp:
3058         (JSC::StringObject::put):
3059         (JSC::StringObject::putByIndex):
3060         (JSC::StringObject::defineOwnProperty):
3061         * runtime/StringPrototype.cpp:
3062         (JSC::jsSpliceSubstrings):
3063         (JSC::jsSpliceSubstringsWithSeparators):
3064         (JSC::replaceUsingRegExpSearch):
3065         (JSC::replaceUsingStringSearch):
3066         (JSC::repeatCharacter):
3067         (JSC::replace):
3068         (JSC::stringProtoFuncReplaceUsingStringSearch):
3069         (JSC::stringProtoFuncCharAt):
3070         (JSC::stringProtoFuncCodePointAt):
3071         (JSC::stringProtoFuncConcat):
3072         (JSC::stringProtoFuncIndexOf):
3073         (JSC::stringProtoFuncLastIndexOf):
3074         (JSC::splitStringByOneCharacterImpl):
3075         (JSC::stringProtoFuncSplitFast):
3076         (JSC::stringProtoFuncSubstring):
3077         (JSC::stringProtoFuncToLowerCase):
3078         (JSC::stringProtoFuncToUpperCase):
3079         (JSC::toLocaleCase):
3080         (JSC::trimString):
3081         (JSC::stringProtoFuncIncludes):
3082         (JSC::builtinStringIncludesInternal):
3083         (JSC::stringProtoFuncIterator):
3084         (JSC::normalize):
3085         (JSC::stringProtoFuncNormalize):
3086
3087 2016-11-28  Mark Lam  <mark.lam@apple.com>
3088
3089         Fix exception scope verification failures in ObjectConstructor.cpp and ObjectPrototype.cpp.
3090         https://bugs.webkit.org/show_bug.cgi?id=165051
3091
3092         Reviewed by Saam Barati.
3093
3094         Also,
3095         1. Replaced returning JSValue() with returning { }.
3096         2. Replaced uses of exec->propertyNames() with vm.propertyNames.
3097
3098         * runtime/ObjectConstructor.cpp:
3099         (JSC::constructObject):
3100         (JSC::objectConstructorGetPrototypeOf):
3101         (JSC::objectConstructorGetOwnPropertyDescriptor):
3102         (JSC::objectConstructorGetOwnPropertyDescriptors):
3103         (JSC::objectConstructorGetOwnPropertyNames):
3104         (JSC::objectConstructorGetOwnPropertySymbols):
3105         (JSC::objectConstructorKeys):
3106         (JSC::ownEnumerablePropertyKeys):
3107         (JSC::toPropertyDescriptor):
3108         (JSC::defineProperties):
3109         (JSC::objectConstructorDefineProperties):
3110         (JSC::objectConstructorCreate):
3111         (JSC::setIntegrityLevel):
3112         (JSC::objectConstructorSeal):
3113         (JSC::objectConstructorPreventExtensions):
3114         (JSC::objectConstructorIsSealed):
3115         (JSC::objectConstructorIsFrozen):
3116         (JSC::ownPropertyKeys):
3117         * runtime/ObjectPrototype.cpp:
3118         (JSC::objectProtoFuncValueOf):
3119         (JSC::objectProtoFuncHasOwnProperty):
3120         (JSC::objectProtoFuncIsPrototypeOf):
3121         (JSC::objectProtoFuncDefineGetter):
3122         (JSC::objectProtoFuncDefineSetter):
3123         (JSC::objectProtoFuncLookupGetter):
3124         (JSC::objectProtoFuncLookupSetter):
3125         (JSC::objectProtoFuncToLocaleString):
3126         (JSC::objectProtoFuncToString):
3127
3128 2016-11-26  Mark Lam  <mark.lam@apple.com>
3129
3130         Fix exception scope verification failures in miscellaneous files.
3131         https://bugs.webkit.org/show_bug.cgi?id=165055
3132
3133         Reviewed by Saam Barati.
3134
3135         * runtime/MathObject.cpp:
3136         (JSC::mathProtoFuncIMul):
3137         * runtime/ModuleLoaderPrototype.cpp:
3138         (JSC::moduleLoaderPrototypeParseModule):
3139         (JSC::moduleLoaderPrototypeRequestedModules):
3140         * runtime/NativeErrorConstructor.cpp:
3141         (JSC::Interpreter::constructWithNativeErrorConstructor):
3142         * runtime/NumberConstructor.cpp:
3143         (JSC::constructWithNumberConstructor):
3144         * runtime/SetConstructor.cpp:
3145         (JSC::constructSet):
3146         * runtime/SetIteratorPrototype.cpp:
3147         (JSC::SetIteratorPrototypeFuncNext):
3148         * runtime/SparseArrayValueMap.cpp:
3149         (JSC::SparseArrayValueMap::putEntry):
3150         (JSC::SparseArrayEntry::put):
3151         * runtime/TemplateRegistry.cpp:
3152         (JSC::TemplateRegistry::getTemplateObject):
3153
3154 2016-11-28  Mark Lam  <mark.lam@apple.com>
3155
3156         Fix exception scope verification failures in ReflectObject.cpp.
3157         https://bugs.webkit.org/show_bug.cgi?id=165066
3158
3159         Reviewed by Saam Barati.
3160
3161         * runtime/ReflectObject.cpp:
3162         (JSC::reflectObjectConstruct):
3163         (JSC::reflectObjectDefineProperty):
3164         (JSC::reflectObjectEnumerate):
3165         (JSC::reflectObjectGet):
3166         (JSC::reflectObjectGetOwnPropertyDescriptor):
3167         (JSC::reflectObjectGetPrototypeOf):
3168         (JSC::reflectObjectOwnKeys):
3169         (JSC::reflectObjectSet):
3170
3171 2016-11-24  Mark Lam  <mark.lam@apple.com>
3172
3173         Fix exception scope verification failures in ArrayConstructor.cpp and ArrayPrototype.cpp.
3174         https://bugs.webkit.org/show_bug.cgi?id=164972
3175
3176         Reviewed by Geoffrey Garen.
3177
3178         * runtime/ArrayConstructor.cpp:
3179         (JSC::constructArrayWithSizeQuirk):
3180         * runtime/ArrayPrototype.cpp:
3181         (JSC::getProperty):
3182         (JSC::putLength):
3183         (JSC::speciesWatchpointsValid):
3184         (JSC::speciesConstructArray):
3185         (JSC::shift):
3186         (JSC::unshift):
3187         (JSC::arrayProtoFuncToString):
3188         (JSC::arrayProtoFuncToLocaleString):
3189         (JSC::slowJoin):
3190         (JSC::fastJoin):
3191         (JSC::arrayProtoFuncJoin):
3192         (JSC::arrayProtoFuncPop):
3193         (JSC::arrayProtoFuncPush):
3194         (JSC::arrayProtoFuncReverse):
3195         (JSC::arrayProtoFuncShift):
3196         (JSC::arrayProtoFuncSlice):
3197         (JSC::arrayProtoFuncSplice):
3198         (JSC::arrayProtoFuncUnShift):
3199         (JSC::arrayProtoFuncIndexOf):
3200         (JSC::arrayProtoFuncLastIndexOf):
3201         (JSC::concatAppendOne):
3202         (JSC::arrayProtoPrivateFuncConcatMemcpy):
3203         (JSC::ArrayPrototype::attemptToInitializeSpeciesWatchpoint):
3204
3205 2016-11-28  Mark Lam  <mark.lam@apple.com>
3206
3207         Fix exception scope verification failures in LLIntSlowPaths.cpp.
3208         https://bugs.webkit.org/show_bug.cgi?id=164969
3209
3210         Reviewed by Geoffrey Garen.
3211
3212         * llint/LLIntSlowPaths.cpp:
3213         (JSC::LLInt::getByVal):
3214         (JSC::LLInt::setUpCall):
3215         (JSC::LLInt::varargsSetup):
3216         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3217
3218 2016-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3219
3220         [WTF] Import std::optional reference implementation as WTF::Optional
3221         https://bugs.webkit.org/show_bug.cgi?id=164199
3222
3223         Reviewed by Saam Barati and Sam Weinig.
3224
3225         Previous WTF::Optional::operator= is not compatible to std::optional::operator=.
3226         std::optional::emplace has the same semantics to the previous one.
3227         So we change the code to use it.
3228
3229         * Scripts/builtins/builtins_templates.py:
3230         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
3231         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
3232         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
3233         * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
3234         * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
3235         * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
3236         * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
3237         * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
3238         * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
3239         * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
3240         * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
3241         * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
3242         * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
3243         * assembler/MacroAssemblerARM64.h:
3244         (JSC::MacroAssemblerARM64::commuteCompareToZeroIntoTest):
3245         * assembler/MacroAssemblerX86Common.h:
3246         (JSC::MacroAssemblerX86Common::commuteCompareToZeroIntoTest):
3247         * b3/B3CheckSpecial.cpp:
3248         (JSC::B3::CheckSpecial::forEachArg):
3249         (JSC::B3::CheckSpecial::shouldTryAliasingDef):
3250         * b3/B3CheckSpecial.h:
3251         * b3/B3LowerToAir.cpp:
3252         (JSC::B3::Air::LowerToAir::scaleForShl):
3253         (JSC::B3::Air::LowerToAir::effectiveAddr):
3254         (JSC::B3::Air::LowerToAir::tryAppendLea):
3255         * b3/B3Opcode.cpp:
3256         (JSC::B3::invertedCompare):
3257         * b3/B3Opcode.h:
3258         * b3/B3PatchpointSpecial.cpp:
3259         (JSC::B3::PatchpointSpecial::forEachArg):
3260         * b3/B3StackmapSpecial.cpp:
3261         (JSC::B3::StackmapSpecial::forEachArgImpl):
3262         * b3/B3StackmapSpecial.h:
3263         * b3/B3Value.cpp:
3264         (JSC::B3::Value::invertedCompare):
3265         * b3/air/AirArg.h:
3266         (JSC::B3::Air::Arg::isValidScale):
3267         (JSC::B3::Air::Arg::isValidAddrForm):
3268         (JSC::B3::Air::Arg::isValidIndexForm):
3269         (JSC::B3::Air::Arg::isValidForm):
3270         * b3/air/AirCustom.h:
3271         (JSC::B3::Air::PatchCustom::shouldTryAliasingDef):
3272         * b3/air/AirFixObviousSpills.cpp:
3273         * b3/air/AirInst.h:
3274         * b3/air/AirInstInlines.h:
3275         (JSC::B3::Air::Inst::shouldTryAliasingDef):
3276         * b3/air/AirIteratedRegisterCoalescing.cpp:
3277         * b3/air/AirSpecial.cpp:
3278         (JSC::B3::Air::Special::shouldTryAliasingDef):
3279         * b3/air/AirSpecial.h:
3280         * bytecode/BytecodeGeneratorification.cpp:
3281         (JSC::BytecodeGeneratorification::storageForGeneratorLocal):
3282         * bytecode/CodeBlock.cpp:
3283         (JSC::CodeBlock::findPC):
3284         (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex):
3285         * bytecode/CodeBlock.h:
3286         * bytecode/UnlinkedFunctionExecutable.cpp:
3287         (JSC::UnlinkedFunctionExecutable::link):
3288         * bytecode/UnlinkedFunctionExecutable.h:
3289         * bytecompiler/BytecodeGenerator.h:
3290         * bytecompiler/NodesCodegen.cpp:
3291         (JSC::PropertyListNode::emitPutConstantProperty):
3292         (JSC::ObjectPatternNode::bindValue):
3293         * debugger/Debugger.cpp:
3294         (JSC::Debugger::resolveBreakpoint):
3295         * debugger/DebuggerCallFrame.cpp:
3296         (JSC::DebuggerCallFrame::currentPosition):
3297         * debugger/DebuggerParseData.cpp:
3298         (JSC::DebuggerPausePositions::breakpointLocationForLineColumn):
3299         * debugger/DebuggerParseData.h:
3300         * debugger/ScriptProfilingScope.h:
3301         * dfg/DFGAbstractInterpreterInlines.h:
3302         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3303         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeDoubleUnaryOpEffects):
3304         * dfg/DFGJITCode.cpp:
3305         (JSC::DFG::JITCode::findPC):
3306         * dfg/DFGJITCode.h:
3307         * dfg/DFGOperations.cpp:
3308         (JSC::DFG::operationPutByValInternal):
3309         * dfg/DFGSlowPathGenerator.h:
3310         (JSC::DFG::SlowPathGenerator::generate):
3311         * dfg/DFGSpeculativeJIT.cpp:
3312         (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
3313         (JSC::DFG::SpeculativeJIT::emitUntypedBitOp):
3314         (JSC::DFG::SpeculativeJIT::emitUntypedRightShiftBitOp):
3315         (JSC::DFG::SpeculativeJIT::compileMathIC):
3316         (JSC::DFG::SpeculativeJIT::compileArithDiv):
3317         (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
3318         * dfg/DFGSpeculativeJIT.h:
3319         * dfg/DFGSpeculativeJIT32_64.cpp:
3320         (JSC::DFG::SpeculativeJIT::compile):
3321         * dfg/DFGSpeculativeJIT64.cpp:
3322         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
3323         (JSC::DFG::SpeculativeJIT::emitBranch):
3324         (JSC::DFG::SpeculativeJIT::compile):
3325         * dfg/DFGStrengthReductionPhase.cpp:
3326         (JSC::DFG::StrengthReductionPhase::handleNode):
3327         * ftl/FTLJITCode.cpp:
3328         (JSC::FTL::JITCode::findPC):
3329         * ftl/FTLJITCode.h:
3330         * heap/Heap.cpp:
3331         (JSC::Heap::collectAsync):
3332         (JSC::Heap::collectSync):
3333         (JSC::Heap::collectInThread):
3334         (JSC::Heap::requestCollection):
3335         (JSC::Heap::willStartCollection):
3336         (JSC::Heap::didFinishCollection):
3337         (JSC::Heap::shouldDoFullCollection):
3338         * heap/Heap.h:
3339         (JSC::Heap::collectionScope):
3340         * heap/HeapSnapshot.cpp:
3341         (JSC::HeapSnapshot::nodeForCell):
3342         (JSC::HeapSnapshot::nodeForObjectIdentifier):
3343         * heap/HeapSnapshot.h:
3344         * inspector/InspectorBackendDispatcher.cpp:
3345         (Inspector::BackendDispatcher::dispatch):
3346         (Inspector::BackendDispatcher::sendPendingErrors):
3347         (Inspector::BackendDispatcher::reportProtocolError):
3348         * inspector/InspectorBackendDispatcher.h:
3349         * inspector/agents/InspectorHeapAgent.cpp:
3350         (Inspector::InspectorHeapAgent::nodeForHeapObjectIdentifier):
3351         (Inspector::InspectorHeapAgent::getPreview):
3352         (Inspector::InspectorHeapAgent::getRemoteObject):
3353         * inspector/agents/InspectorHeapAgent.h:
3354         * inspector/remote/RemoteConnectionToTarget.h:
3355         * inspector/remote/RemoteConnectionToTarget.mm:
3356         (Inspector::RemoteConnectionToTarget::targetIdentifier):
3357         (Inspector::RemoteConnectionToTarget::setup):
3358         * inspector/remote/RemoteInspector.h:
3359         * inspector/remote/RemoteInspector.mm:
3360         (Inspector::RemoteInspector::updateClientCapabilities):
3361         * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
3362         (_generate_declarations_for_enum_conversion_methods):
3363         (_generate_declarations_for_enum_conversion_methods.return_type_with_export_macro):
3364         * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
3365         (CppProtocolTypesImplementationGenerator._generate_enum_conversion_methods_for_domain.generate_conversion_method_body):
3366         * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
3367         * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
3368         * inspector/scripts/tests/expected/enum-values.json-result:
3369         * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
3370         * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
3371         * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
3372         * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
3373         * jit/JITCode.h:
3374         (JSC::JITCode::findPC):
3375         * jit/JITDivGenerator.cpp:
3376         (JSC::JITDivGenerator::generateFastPath):
3377         * jit/JITOperations.cpp:
3378         * jit/PCToCodeOriginMap.cpp:
3379         (JSC::PCToCodeOriginMap::findPC):
3380         * jit/PCToCodeOriginMap.h:
3381         * jsc.cpp:
3382         (WTF::RuntimeArray::getOwnPropertySlot):
3383         * llint/LLIntSlowPaths.cpp: