Generate header detection headers for CMake on Windows.
[WebKit-https.git] / Source / JavaScriptCore / ChangeLog
1 2014-08-12  Alex Christensen  <achristensen@webkit.org>
2
3         Generate header detection headers for CMake on Windows.
4         https://bugs.webkit.org/show_bug.cgi?id=135807
5
6         Reviewed by Brent Fulgham.
7
8         * CMakeLists.txt:
9         Include the derived sources directory to find WTF/WTFHeaderDetection.h.
10
11 2014-08-11  Andy Estes  <aestes@apple.com>
12
13         [iOS] Get rid of iOS.xcconfig
14         https://bugs.webkit.org/show_bug.cgi?id=135809
15
16         Reviewed by Joseph Pecoraro.
17
18         All iOS.xcconfig did was include AspenFamily.xcconfig, so there's no need for the indirection.
19
20         * Configurations/Base.xcconfig:
21         * Configurations/iOS.xcconfig: Removed.
22         * JavaScriptCore.xcodeproj/project.pbxproj:
23
24 2014-08-11  Michael Saboff  <msaboff@apple.com>
25
26         Eliminate {push,pop}CalleeSaves in favor of individual pushes & pops
27         https://bugs.webkit.org/show_bug.cgi?id=127155
28
29         Reviewed by Geoffrey Garen.
30
31         Eliminated the offline assembler instructions {push,pop}CalleeSaves as well as the
32         ARM64 specific {push,pop}LRAndFP and replaced them with individual push and pop
33         instructions. Where the registers referenced by the added push and pop instructions
34         are not part of the offline assembler register aliases, used a newly added "emit"
35         offline assembler instruction which takes a string literal and outputs that
36         string as a native instruction.
37
38         * llint/LowLevelInterpreter.asm:
39         * offlineasm/arm.rb:
40         * offlineasm/arm64.rb:
41         * offlineasm/ast.rb:
42         * offlineasm/cloop.rb:
43         * offlineasm/instructions.rb:
44         * offlineasm/mips.rb:
45         * offlineasm/parser.rb:
46         * offlineasm/sh4.rb:
47         * offlineasm/transform.rb:
48         * offlineasm/x86.rb:
49
50 2014-08-11  Mark Lam  <mark.lam@apple.com>
51
52         Re-landing r172401 with fixed test.
53         <https://webkit.org/b/135782>
54
55         Not reviewed.
56
57         * bytecompiler/BytecodeGenerator.cpp:
58         (JSC::BytecodeGenerator::emitGetByVal):
59         (JSC::BytecodeGenerator::pushIndexedForInScope):
60         (JSC::BytecodeGenerator::pushStructureForInScope):
61         * bytecompiler/BytecodeGenerator.h:
62         (JSC::ForInContext::ForInContext):
63         (JSC::ForInContext::base):
64         (JSC::StructureForInContext::StructureForInContext):
65         (JSC::IndexedForInContext::IndexedForInContext):
66         * bytecompiler/NodesCodegen.cpp:
67         (JSC::ForInNode::emitMultiLoopBytecode):
68         * tests/stress/for-in-tests.js:
69
70 2014-08-11  Commit Queue  <commit-queue@webkit.org>
71
72         Unreviewed, rolling out r172401.
73         https://bugs.webkit.org/show_bug.cgi?id=135812
74
75         Failing stress/for-in-tests.js
76         http://build.webkit.org/builders/Apple%20Mavericks%20Release%20WK1%20%28Tests%29/builds/7945/steps
77         /jscore-test/logs/stdio (Requested by mlam on #webkit).
78
79         Reverted changeset:
80
81         "for-in optimization should also make sure the base matches
82         the object being iterated"
83         https://bugs.webkit.org/show_bug.cgi?id=135782
84         http://trac.webkit.org/changeset/172401
85
86 2014-08-11  Brian J. Burg  <burg@cs.washington.edu>
87
88         Web Inspector: use type builders to construct high fidelity type information payloads
89         https://bugs.webkit.org/show_bug.cgi?id=135803
90
91         Reviewed by Timothy Hatcher.
92
93         Due to some typos in the protocol file, the code had worked with raw objects
94         rather than with type builders. Convert to using builders.
95
96         * inspector/agents/InspectorRuntimeAgent.cpp:
97         (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
98         * inspector/agents/InspectorRuntimeAgent.h:
99         * inspector/protocol/Runtime.json: Fix 'item' for 'items'; true for 'true'.
100         * runtime/HighFidelityTypeProfiler.cpp:
101         (JSC::HighFidelityTypeProfiler::getTypesForVariableAtOffsetForInspector):
102         * runtime/HighFidelityTypeProfiler.h:
103         * runtime/TypeSet.cpp:
104         (JSC::TypeSet::allStructureRepresentations):
105         (JSC::StructureShape::stringRepresentation):
106         (JSC::StructureShape::inspectorRepresentation):
107         * runtime/TypeSet.h:
108
109 2014-08-11  Mark Hahnenberg  <mhahnenberg@apple.com>
110
111         for-in optimization should also make sure the base matches the object being iterated
112         https://bugs.webkit.org/show_bug.cgi?id=135782
113
114         Reviewed by Geoffrey Garen.
115
116         If we access a different base object with the same index, we shouldn't try to randomly 
117         load from that object's backing store.
118
119         * bytecompiler/BytecodeGenerator.cpp:
120         (JSC::BytecodeGenerator::emitGetByVal):
121         (JSC::BytecodeGenerator::pushIndexedForInScope):
122         (JSC::BytecodeGenerator::pushStructureForInScope):
123         * bytecompiler/BytecodeGenerator.h:
124         (JSC::ForInContext::ForInContext):
125         (JSC::ForInContext::base):
126         (JSC::StructureForInContext::StructureForInContext):
127         (JSC::IndexedForInContext::IndexedForInContext):
128         * bytecompiler/NodesCodegen.cpp:
129         (JSC::ForInNode::emitMultiLoopBytecode):
130         * tests/stress/for-in-tests.js:
131
132 2014-08-11  Brent Fulgham  <bfulgham@apple.com>
133
134         [Win] Unreviewed gardening.
135
136         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Display files in
137         proper folder categories..
138
139 2014-08-11  Mark Hahnenberg  <mhahnenberg@apple.com>
140
141         JIT should use full 64-bit stores for jsBoolean and jsNull
142         https://bugs.webkit.org/show_bug.cgi?id=135784
143
144         Reviewed by Michael Saboff.
145
146         This guarantees that we set the high bits of the register with the correct tag.
147
148         * dfg/DFGSpeculativeJIT64.cpp:
149         (JSC::DFG::SpeculativeJIT::compile):
150         * jit/JITOpcodes.cpp:
151         (JSC::JIT::emit_op_has_structure_property):
152         (JSC::JIT::emit_op_next_enumerator_pname):
153
154 2014-08-11  Brent Fulgham  <bfulgham@apple.com>
155
156         [Win] Adjust build script for Windows production build.
157         https://bugs.webkit.org/show_bug.cgi?id=135806
158         <rdar://problem/17978299>
159
160         Reviewed by Timothy Hatcher.
161
162         * JavaScriptCore.vcxproj/copy-files.cmd: Copy file for later use
163         in WebInspectorUI build.
164
165 2014-08-10  Oliver Hunt  <oliver@apple.com>
166
167         Destructuring assignment in a var declaration list incorrectly consumes subsequent variable initialisers
168         https://bugs.webkit.org/show_bug.cgi?id=135773
169
170         Reviewed by Michael Saboff.
171
172         We should be using parseAssignment expression in order to get the correct
173         precedence.
174
175         * parser/Parser.cpp:
176         (JSC::Parser<LexerType>::parseVarDeclarationList):
177
178 2014-08-10  Diego Pino Garcia  <dpino@igalia.com>
179
180         JSC Lexer is allowing octals 08 and 09 in strict mode functions
181         https://bugs.webkit.org/show_bug.cgi?id=135704
182
183         Reviewed by Oliver Hunt.
184
185         Return syntax error ("Decimal integer literals with a leading zero are
186         forbidden in strict mode") if a number starts with 0 and is followed 
187         by a digit.
188
189         * parser/Lexer.cpp:
190         (JSC::Lexer<T>::lex):
191
192 2014-08-08  Mark Lam  <mark.lam@apple.com>
193
194         REGRESSION: Inspector crashes when debugger is paused and injected scripts access window.screen().
195         <https://webkit.org/b/135656>
196
197         Not reviewed.
198
199         Rolling out r170680 which was merged to ToT in r172129.
200
201         * debugger/Debugger.h:
202         * debugger/DebuggerCallFrame.cpp:
203         (JSC::DebuggerCallFrame::scope):
204         (JSC::DebuggerCallFrame::evaluate):
205         (JSC::DebuggerCallFrame::invalidate):
206         * debugger/DebuggerCallFrame.h:
207         * debugger/DebuggerScope.cpp:
208         (JSC::DebuggerScope::DebuggerScope):
209         (JSC::DebuggerScope::finishCreation):
210         (JSC::DebuggerScope::visitChildren):
211         (JSC::DebuggerScope::className):
212         (JSC::DebuggerScope::getOwnPropertySlot):
213         (JSC::DebuggerScope::put):
214         (JSC::DebuggerScope::deleteProperty):
215         (JSC::DebuggerScope::getOwnPropertyNames):
216         (JSC::DebuggerScope::defineOwnProperty):
217         (JSC::DebuggerScope::next): Deleted.
218         (JSC::DebuggerScope::invalidateChain): Deleted.
219         (JSC::DebuggerScope::isWithScope): Deleted.
220         (JSC::DebuggerScope::isGlobalScope): Deleted.
221         (JSC::DebuggerScope::isFunctionScope): Deleted.
222         * debugger/DebuggerScope.h:
223         (JSC::DebuggerScope::create):
224         (JSC::DebuggerScope::Iterator::Iterator): Deleted.
225         (JSC::DebuggerScope::Iterator::get): Deleted.
226         (JSC::DebuggerScope::Iterator::operator++): Deleted.
227         (JSC::DebuggerScope::Iterator::operator==): Deleted.
228         (JSC::DebuggerScope::Iterator::operator!=): Deleted.
229         (JSC::DebuggerScope::isValid): Deleted.
230         (JSC::DebuggerScope::jsScope): Deleted.
231         (JSC::DebuggerScope::begin): Deleted.
232         (JSC::DebuggerScope::end): Deleted.
233         * inspector/JSJavaScriptCallFrame.cpp:
234         (Inspector::JSJavaScriptCallFrame::scopeType):
235         (Inspector::JSJavaScriptCallFrame::scopeChain):
236         * inspector/JavaScriptCallFrame.h:
237         (Inspector::JavaScriptCallFrame::scopeChain):
238         * inspector/ScriptDebugServer.cpp:
239         * runtime/JSGlobalObject.cpp:
240         (JSC::JSGlobalObject::reset):
241         (JSC::JSGlobalObject::visitChildren):
242         * runtime/JSGlobalObject.h:
243         (JSC::JSGlobalObject::debuggerScopeStructure): Deleted.
244         * runtime/JSObject.h:
245         (JSC::JSObject::isWithScope): Deleted.
246         * runtime/JSScope.h:
247         * runtime/VM.cpp:
248         (JSC::VM::VM):
249         * runtime/VM.h:
250
251 2014-08-07  Saam Barati  <sbarati@apple.com>
252
253         Create a more generic way for VMEntryScope to notify those interested that it will be destroyed
254         https://bugs.webkit.org/show_bug.cgi?id=135358
255
256         Reviewed by Geoffrey Garen.
257
258         When VMEntryScope is destroyed, and it has a flag set indicating that the
259         Debugger needs to recompile all functions, it calls Debugger::recompileAllJSFunctions. 
260         This flag is only used by Debugger to have VMEntryScope notify it when the
261         Debugger is safe to recompile all functions. This patch will substitute this
262         Debugger-specific recompilation flag with a list of callbacks that are notified 
263         when the outermost VMEntryScope dies. This creates a general purpose interface 
264         for being notified when the VM stops executing code via the event of the outermost 
265         VMEntryScope dying.
266
267         * debugger/Debugger.cpp:
268         (JSC::Debugger::recompileAllJSFunctions):
269         * runtime/VMEntryScope.cpp:
270         (JSC::VMEntryScope::VMEntryScope):
271         (JSC::VMEntryScope::setEntryScopeDidPopListener):
272         (JSC::VMEntryScope::~VMEntryScope):
273         * runtime/VMEntryScope.h:
274         (JSC::VMEntryScope::setRecompilationNeeded): Deleted.
275
276 2014-08-07  Benjamin Poulain  <bpoulain@apple.com>
277
278         Get rid of SCRIPTED_SPEECH
279         https://bugs.webkit.org/show_bug.cgi?id=135729
280
281         Reviewed by Brent Fulgham.
282
283         * Configurations/FeatureDefines.xcconfig:
284
285 2014-08-07  Mark Hahnenberg  <mhahnenberg@apple.com>
286
287         SpeculateInt32Operand is sometimes used in a 64-bit context, which has undefined behavior
288         https://bugs.webkit.org/show_bug.cgi?id=135722
289
290         Reviewed by Filip Pizlo.
291
292         We should be using SpeculateStrictInt32Operand instead.
293
294         * dfg/DFGSpeculativeJIT64.cpp:
295         (JSC::DFG::SpeculativeJIT::compile):
296
297 2014-08-07  Benjamin Poulain  <bpoulain@apple.com>
298
299         Get rid of INPUT_SPEECH
300         https://bugs.webkit.org/show_bug.cgi?id=135672
301
302         Reviewed by Andreas Kling.
303
304         * Configurations/FeatureDefines.xcconfig:
305
306 2014-08-07  Mark Hahnenberg  <mhahnenberg@apple.com>
307
308         for-in is failing fast/dom/dataset-xhtml.xhtml and dataset.html tests
309         https://bugs.webkit.org/show_bug.cgi?id=135681
310
311         Reviewed by Filip Pizlo.
312
313         * runtime/Structure.cpp:
314         (JSC::Structure::canCacheGenericPropertyNameEnumerator): We were checking the entire 
315         prototype chain for overridesGetPropertyNames, but we were neglecting to check the 
316         base object's Structure. D'oh!
317
318 2014-08-06  Mark Lam  <mark.lam@apple.com>
319
320         Gardening: fix for build failure on EFL bots.
321
322         Not reviewed.
323
324         * runtime/EnumerationMode.h:
325         (JSC::shouldIncludeJSObjectPropertyNames):
326         (JSC::modeThatSkipsJSObject):
327         * runtime/JSCell.cpp:
328         (JSC::JSCell::getEnumerableLength):
329         * runtime/JSCell.h:
330
331 2014-08-06  Dean Jackson  <dino@apple.com>
332
333         ENABLE_CSS_TRANSFORMS_ANIMATIONS_UNPREFIXED is not used anywhere. Remove it.
334         https://bugs.webkit.org/show_bug.cgi?id=135675
335
336         Reviewed by Sam Weinig.
337
338         * Configurations/FeatureDefines.xcconfig:
339
340 2014-08-06  Wenson Hsieh  <wenson_hsieh@apple.com>
341
342         Implement parsing for CSS scroll snap points
343         https://bugs.webkit.org/show_bug.cgi?id=134301
344
345         Reviewed by Dean Jackson.
346
347         * Configurations/FeatureDefines.xcconfig: Added ENABLE_CSS_SCROLL_SNAP
348
349 2014-08-06  Mark Lam  <mark.lam@apple.com>
350
351         Gardening: fix for build failure on GTK bots.
352
353         Not reviewed.
354
355         * runtime/FunctionHasExecutedCache.cpp:
356         - #include <limits.h> for UINT_MAX's definition.
357
358 2014-08-06  Mark Lam  <mark.lam@apple.com>
359
360         Gardening: fix for build failure on EFL bots.
361
362         Not reviewed.
363
364         * jit/JITInlines.h:
365         (JSC::JIT::emitLoadForArrayMode):
366
367 2014-08-06  Mark Lam  <mark.lam@apple.com>
368
369         Gardening: adding missing build file changes from the FTLOPT merge at r172176.
370
371         Not reviewed.
372
373         * CMakeLists.txt:
374         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
375         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
376
377 2014-08-06  Ryuan Choi  <ryuan.choi@samsung.com>
378
379         Unreviewed build fix attempt since r172184
380
381         * CMakeLists.txt: Removed TypeLocation.cpp
382
383 2014-08-06  Mark Lam  <mark.lam@apple.com>
384
385         Gardening: adding missing build file changes from r171510.
386         <https://webkit.org/b/134860>
387
388         Not reviewed.
389
390         * CMakeLists.txt:
391         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
392         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
393
394 2014-08-06  Mark Lam  <mark.lam@apple.com>
395
396         Gardening: adding missing build file changes from r170490.
397         <https://webkit.org/b/133395>
398
399         Not reviewed.
400
401         * CMakeLists.txt:
402         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
403
404 2014-08-06  Filip Pizlo  <fpizlo@apple.com>
405
406         Silence a debug assertion.
407
408         Reviewed by Mark Hahnenberg.
409
410         * runtime/JSPropertyNameEnumerator.h:
411         (JSC::JSPropertyNameEnumerator::cachedStructure):
412
413 2014-08-06  Filip Pizlo  <fpizlo@apple.com>
414
415         Fix 32-bit build.
416
417         * jit/JITOpcodes32_64.cpp:
418         (JSC::JIT::privateCompileHasIndexedProperty):
419
420 2014-08-06  Filip Pizlo  <fpizlo@apple.com>
421
422         Merge r171389, r171495, r171508, r171510, r171605, r171606, r171611, r171614, r171763 from ftlopt.
423
424     2014-07-28  Mark Hahnenberg  <mhahnenberg@apple.com>
425     
426             Support for-in in the FTL
427             https://bugs.webkit.org/show_bug.cgi?id=134140
428     
429             Reviewed by Filip Pizlo.
430     
431             * dfg/DFGSSALoweringPhase.cpp:
432             (JSC::DFG::SSALoweringPhase::handleNode):
433             * ftl/FTLAbstractHeapRepository.cpp:
434             * ftl/FTLAbstractHeapRepository.h:
435             * ftl/FTLCapabilities.cpp:
436             (JSC::FTL::canCompile):
437             * ftl/FTLIntrinsicRepository.h:
438             * ftl/FTLLowerDFGToLLVM.cpp:
439             (JSC::FTL::LowerDFGToLLVM::compileNode):
440             (JSC::FTL::LowerDFGToLLVM::compileHasIndexedProperty):
441             (JSC::FTL::LowerDFGToLLVM::compileHasGenericProperty):
442             (JSC::FTL::LowerDFGToLLVM::compileHasStructureProperty):
443             (JSC::FTL::LowerDFGToLLVM::compileGetDirectPname):
444             (JSC::FTL::LowerDFGToLLVM::compileGetEnumerableLength):
445             (JSC::FTL::LowerDFGToLLVM::compileGetStructurePropertyEnumerator):
446             (JSC::FTL::LowerDFGToLLVM::compileGetGenericPropertyEnumerator):
447             (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorPname):
448             (JSC::FTL::LowerDFGToLLVM::compileToIndexString):
449     
450     2014-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
451     
452             Remove JSPropertyNameIterator
453             https://bugs.webkit.org/show_bug.cgi?id=135066
454     
455             Reviewed by Geoffrey Garen.
456     
457             It has been replaced by JSPropertyNameEnumerator.
458     
459             * JavaScriptCore.order:
460             * bytecode/BytecodeBasicBlock.cpp:
461             (JSC::isBranch):
462             * bytecode/BytecodeList.json:
463             * bytecode/BytecodeUseDef.h:
464             (JSC::computeUsesForBytecodeOffset):
465             (JSC::computeDefsForBytecodeOffset):
466             * bytecode/CodeBlock.cpp:
467             (JSC::CodeBlock::dumpBytecode):
468             * bytecode/PreciseJumpTargets.cpp:
469             (JSC::getJumpTargetsForBytecodeOffset):
470             * bytecompiler/BytecodeGenerator.cpp:
471             (JSC::BytecodeGenerator::emitGetPropertyNames): Deleted.
472             (JSC::BytecodeGenerator::emitNextPropertyName): Deleted.
473             * bytecompiler/BytecodeGenerator.h:
474             * interpreter/Interpreter.cpp:
475             * interpreter/Register.h:
476             * jit/JIT.cpp:
477             (JSC::JIT::privateCompileMainPass):
478             (JSC::JIT::privateCompileSlowCases):
479             * jit/JIT.h:
480             * jit/JITOpcodes.cpp:
481             (JSC::JIT::emit_op_get_pnames): Deleted.
482             (JSC::JIT::emit_op_next_pname): Deleted.
483             * jit/JITOpcodes32_64.cpp:
484             (JSC::JIT::emit_op_get_pnames): Deleted.
485             (JSC::JIT::emit_op_next_pname): Deleted.
486             * jit/JITOperations.cpp:
487             * jit/JITPropertyAccess.cpp:
488             (JSC::JIT::emit_op_get_by_pname): Deleted.
489             (JSC::JIT::emitSlow_op_get_by_pname): Deleted.
490             * jit/JITPropertyAccess32_64.cpp:
491             (JSC::JIT::emit_op_get_by_pname): Deleted.
492             (JSC::JIT::emitSlow_op_get_by_pname): Deleted.
493             * llint/LLIntOffsetsExtractor.cpp:
494             * llint/LLIntSlowPaths.cpp:
495             (JSC::LLInt::LLINT_SLOW_PATH_DECL): Deleted.
496             * llint/LLIntSlowPaths.h:
497             * llint/LowLevelInterpreter.asm:
498             * llint/LowLevelInterpreter32_64.asm:
499             * llint/LowLevelInterpreter64.asm:
500             * runtime/CommonSlowPaths.cpp:
501             * runtime/JSPropertyNameIterator.cpp:
502             (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Deleted.
503             (JSC::JSPropertyNameIterator::create): Deleted.
504             (JSC::JSPropertyNameIterator::destroy): Deleted.
505             (JSC::JSPropertyNameIterator::get): Deleted.
506             (JSC::JSPropertyNameIterator::visitChildren): Deleted.
507             * runtime/JSPropertyNameIterator.h:
508             (JSC::JSPropertyNameIterator::createStructure): Deleted.
509             (JSC::JSPropertyNameIterator::size): Deleted.
510             (JSC::JSPropertyNameIterator::setCachedStructure): Deleted.
511             (JSC::JSPropertyNameIterator::cachedStructure): Deleted.
512             (JSC::JSPropertyNameIterator::setCachedPrototypeChain): Deleted.
513             (JSC::JSPropertyNameIterator::cachedPrototypeChain): Deleted.
514             (JSC::JSPropertyNameIterator::finishCreation): Deleted.
515             (JSC::Register::propertyNameIterator): Deleted.
516             (JSC::StructureRareData::enumerationCache): Deleted.
517             (JSC::StructureRareData::setEnumerationCache): Deleted.
518             * runtime/Structure.cpp:
519             (JSC::Structure::addPropertyWithoutTransition):
520             (JSC::Structure::removePropertyWithoutTransition):
521             * runtime/Structure.h:
522             * runtime/StructureInlines.h:
523             (JSC::Structure::setEnumerationCache): Deleted.
524             (JSC::Structure::enumerationCache): Deleted.
525             * runtime/StructureRareData.cpp:
526             (JSC::StructureRareData::visitChildren):
527             * runtime/StructureRareData.h:
528             * runtime/VM.cpp:
529             (JSC::VM::VM):
530     
531     2014-07-25  Saam Barati  <sbarati@apple.com>
532     
533             Fix 32-bit build breakage for type profiling
534             https://bugs.webkit.org/process_bug.cgi
535     
536             Reviewed by Mark Hahnenberg.
537     
538             32-bit builds currently break because global variable IDs for high
539             fidelity type profiling are int64_t. Change this to intptr_t so that
540             it's 32 bits on 32-bit platforms and 64 bits on 64-bit platforms.
541     
542             * bytecode/CodeBlock.cpp:
543             (JSC::CodeBlock::CodeBlock):
544             (JSC::CodeBlock::scopeDependentProfile):
545             * bytecode/TypeLocation.h:
546             * runtime/SymbolTable.cpp:
547             (JSC::SymbolTable::uniqueIDForVariable):
548             (JSC::SymbolTable::uniqueIDForRegister):
549             * runtime/SymbolTable.h:
550             * runtime/TypeLocationCache.cpp:
551             (JSC::TypeLocationCache::getTypeLocation):
552             * runtime/TypeLocationCache.h:
553             * runtime/VM.h:
554             (JSC::VM::getNextUniqueVariableID):
555     
556     2014-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
557     
558             Reindent PropertyNameArray.h
559             https://bugs.webkit.org/show_bug.cgi?id=135067
560     
561             Reviewed by Geoffrey Garen.
562     
563             * runtime/PropertyNameArray.h:
564             (JSC::RefCountedIdentifierSet::contains):
565             (JSC::RefCountedIdentifierSet::size):
566             (JSC::RefCountedIdentifierSet::add):
567             (JSC::PropertyNameArrayData::create):
568             (JSC::PropertyNameArrayData::propertyNameVector):
569             (JSC::PropertyNameArrayData::PropertyNameArrayData):
570             (JSC::PropertyNameArray::PropertyNameArray):
571             (JSC::PropertyNameArray::vm):
572             (JSC::PropertyNameArray::add):
573             (JSC::PropertyNameArray::addKnownUnique):
574             (JSC::PropertyNameArray::operator[]):
575             (JSC::PropertyNameArray::setData):
576             (JSC::PropertyNameArray::data):
577             (JSC::PropertyNameArray::releaseData):
578             (JSC::PropertyNameArray::identifierSet):
579             (JSC::PropertyNameArray::canAddKnownUniqueForStructure):
580             (JSC::PropertyNameArray::size):
581             (JSC::PropertyNameArray::begin):
582             (JSC::PropertyNameArray::end):
583             (JSC::PropertyNameArray::numCacheableSlots):
584             (JSC::PropertyNameArray::setNumCacheableSlotsForObject):
585             (JSC::PropertyNameArray::setBaseObject):
586             (JSC::PropertyNameArray::setPreviouslyEnumeratedLength):
587     
588     2014-07-23  Mark Hahnenberg  <mhahnenberg@apple.com>
589     
590             Refactor our current implementation of for-in
591             https://bugs.webkit.org/show_bug.cgi?id=134142
592     
593             Reviewed by Filip Pizlo.
594     
595             This patch splits for-in loops into three distinct parts:
596     
597             - Iterating over the indexed properties in the base object.
598             - Iterating over the Structure properties in the base object.
599             - Iterating over any other enumerable properties for that object and any objects in the prototype chain.
600      
601             It does this by emitting these explicit loops in bytecode, using a new set of bytecodes to 
602             support the various operations required for each loop.
603     
604             * API/JSCallbackObjectFunctions.h:
605             (JSC::JSCallbackObject<Parent>::getOwnNonIndexPropertyNames):
606             * JavaScriptCore.xcodeproj/project.pbxproj:
607             * bytecode/BytecodeList.json:
608             * bytecode/BytecodeUseDef.h:
609             (JSC::computeUsesForBytecodeOffset):
610             (JSC::computeDefsForBytecodeOffset):
611             * bytecode/CallLinkStatus.h:
612             (JSC::CallLinkStatus::CallLinkStatus):
613             * bytecode/CodeBlock.cpp:
614             (JSC::CodeBlock::dumpBytecode):
615             (JSC::CodeBlock::CodeBlock):
616             * bytecompiler/BytecodeGenerator.cpp:
617             (JSC::BytecodeGenerator::emitGetByVal):
618             (JSC::BytecodeGenerator::emitComplexPopScopes):
619             (JSC::BytecodeGenerator::emitGetEnumerableLength):
620             (JSC::BytecodeGenerator::emitHasGenericProperty):
621             (JSC::BytecodeGenerator::emitHasIndexedProperty):
622             (JSC::BytecodeGenerator::emitHasStructureProperty):
623             (JSC::BytecodeGenerator::emitGetStructurePropertyEnumerator):
624             (JSC::BytecodeGenerator::emitGetGenericPropertyEnumerator):
625             (JSC::BytecodeGenerator::emitNextEnumeratorPropertyName):
626             (JSC::BytecodeGenerator::emitToIndexString):
627             (JSC::BytecodeGenerator::pushIndexedForInScope):
628             (JSC::BytecodeGenerator::popIndexedForInScope):
629             (JSC::BytecodeGenerator::pushStructureForInScope):
630             (JSC::BytecodeGenerator::popStructureForInScope):
631             (JSC::BytecodeGenerator::invalidateForInContextForLocal):
632             * bytecompiler/BytecodeGenerator.h:
633             (JSC::ForInContext::ForInContext):
634             (JSC::ForInContext::~ForInContext):
635             (JSC::ForInContext::isValid):
636             (JSC::ForInContext::invalidate):
637             (JSC::ForInContext::local):
638             (JSC::StructureForInContext::StructureForInContext):
639             (JSC::StructureForInContext::type):
640             (JSC::StructureForInContext::index):
641             (JSC::StructureForInContext::property):
642             (JSC::StructureForInContext::enumerator):
643             (JSC::IndexedForInContext::IndexedForInContext):
644             (JSC::IndexedForInContext::type):
645             (JSC::IndexedForInContext::index):
646             (JSC::BytecodeGenerator::pushOptimisedForIn): Deleted.
647             (JSC::BytecodeGenerator::popOptimisedForIn): Deleted.
648             * bytecompiler/NodesCodegen.cpp:
649             (JSC::ReadModifyResolveNode::emitBytecode):
650             (JSC::AssignResolveNode::emitBytecode):
651             (JSC::ForInNode::tryGetBoundLocal):
652             (JSC::ForInNode::emitLoopHeader):
653             (JSC::ForInNode::emitMultiLoopBytecode):
654             (JSC::ForInNode::emitBytecode):
655             * debugger/DebuggerScope.h:
656             * dfg/DFGAbstractHeap.h:
657             * dfg/DFGAbstractInterpreterInlines.h:
658             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
659             * dfg/DFGByteCodeParser.cpp:
660             (JSC::DFG::ByteCodeParser::parseBlock):
661             * dfg/DFGCapabilities.cpp:
662             (JSC::DFG::capabilityLevel):
663             * dfg/DFGClobberize.h:
664             (JSC::DFG::clobberize):
665             * dfg/DFGDoesGC.cpp:
666             (JSC::DFG::doesGC):
667             * dfg/DFGFixupPhase.cpp:
668             (JSC::DFG::FixupPhase::fixupNode):
669             * dfg/DFGHeapLocation.cpp:
670             (WTF::printInternal):
671             * dfg/DFGHeapLocation.h:
672             * dfg/DFGNode.h:
673             (JSC::DFG::Node::hasHeapPrediction):
674             (JSC::DFG::Node::hasArrayMode):
675             * dfg/DFGNodeType.h:
676             * dfg/DFGPredictionPropagationPhase.cpp:
677             (JSC::DFG::PredictionPropagationPhase::propagate):
678             * dfg/DFGSafeToExecute.h:
679             (JSC::DFG::safeToExecute):
680             * dfg/DFGSpeculativeJIT.h:
681             (JSC::DFG::SpeculativeJIT::callOperation):
682             * dfg/DFGSpeculativeJIT32_64.cpp:
683             (JSC::DFG::SpeculativeJIT::compile):
684             * dfg/DFGSpeculativeJIT64.cpp:
685             (JSC::DFG::SpeculativeJIT::compile):
686             * jit/JIT.cpp:
687             (JSC::JIT::privateCompileMainPass):
688             (JSC::JIT::privateCompileSlowCases):
689             * jit/JIT.h:
690             (JSC::JIT::compileHasIndexedProperty):
691             (JSC::JIT::emitInt32Load):
692             * jit/JITInlines.h:
693             (JSC::JIT::emitDoubleGetByVal):
694             (JSC::JIT::emitLoadForArrayMode):
695             (JSC::JIT::emitContiguousGetByVal):
696             (JSC::JIT::emitArrayStorageGetByVal):
697             * jit/JITOpcodes.cpp:
698             (JSC::JIT::emit_op_get_enumerable_length):
699             (JSC::JIT::emit_op_has_structure_property):
700             (JSC::JIT::emitSlow_op_has_structure_property):
701             (JSC::JIT::emit_op_has_generic_property):
702             (JSC::JIT::privateCompileHasIndexedProperty):
703             (JSC::JIT::emit_op_has_indexed_property):
704             (JSC::JIT::emitSlow_op_has_indexed_property):
705             (JSC::JIT::emit_op_get_direct_pname):
706             (JSC::JIT::emitSlow_op_get_direct_pname):
707             (JSC::JIT::emit_op_get_structure_property_enumerator):
708             (JSC::JIT::emit_op_get_generic_property_enumerator):
709             (JSC::JIT::emit_op_next_enumerator_pname):
710             (JSC::JIT::emit_op_to_index_string):
711             * jit/JITOpcodes32_64.cpp:
712             (JSC::JIT::emit_op_get_enumerable_length):
713             (JSC::JIT::emit_op_has_structure_property):
714             (JSC::JIT::emitSlow_op_has_structure_property):
715             (JSC::JIT::emit_op_has_generic_property):
716             (JSC::JIT::privateCompileHasIndexedProperty):
717             (JSC::JIT::emit_op_has_indexed_property):
718             (JSC::JIT::emitSlow_op_has_indexed_property):
719             (JSC::JIT::emit_op_get_direct_pname):
720             (JSC::JIT::emitSlow_op_get_direct_pname):
721             (JSC::JIT::emit_op_get_structure_property_enumerator):
722             (JSC::JIT::emit_op_get_generic_property_enumerator):
723             (JSC::JIT::emit_op_next_enumerator_pname):
724             (JSC::JIT::emit_op_to_index_string):
725             * jit/JITOperations.cpp:
726             * jit/JITOperations.h:
727             * jit/JITPropertyAccess.cpp:
728             (JSC::JIT::emitDoubleLoad):
729             (JSC::JIT::emitContiguousLoad):
730             (JSC::JIT::emitArrayStorageLoad):
731             (JSC::JIT::emitDoubleGetByVal): Deleted.
732             (JSC::JIT::emitContiguousGetByVal): Deleted.
733             (JSC::JIT::emitArrayStorageGetByVal): Deleted.
734             * jit/JITPropertyAccess32_64.cpp:
735             (JSC::JIT::emitContiguousLoad):
736             (JSC::JIT::emitDoubleLoad):
737             (JSC::JIT::emitArrayStorageLoad):
738             (JSC::JIT::emitContiguousGetByVal): Deleted.
739             (JSC::JIT::emitDoubleGetByVal): Deleted.
740             (JSC::JIT::emitArrayStorageGetByVal): Deleted.
741             * llint/LowLevelInterpreter.asm:
742             * parser/Nodes.h:
743             * runtime/Arguments.cpp:
744             (JSC::Arguments::getOwnPropertyNames):
745             * runtime/ClassInfo.h:
746             * runtime/CommonSlowPaths.cpp:
747             (JSC::SLOW_PATH_DECL):
748             * runtime/CommonSlowPaths.h:
749             * runtime/EnumerationMode.h: Added.
750             (JSC::shouldIncludeDontEnumProperties):
751             (JSC::shouldExcludeDontEnumProperties):
752             (JSC::shouldIncludeJSObjectPropertyNames):
753             (JSC::modeThatSkipsJSObject):
754             * runtime/JSActivation.cpp:
755             (JSC::JSActivation::getOwnNonIndexPropertyNames):
756             * runtime/JSArray.cpp:
757             (JSC::JSArray::getOwnNonIndexPropertyNames):
758             * runtime/JSArrayBuffer.cpp:
759             (JSC::JSArrayBuffer::getOwnNonIndexPropertyNames):
760             * runtime/JSArrayBufferView.cpp:
761             (JSC::JSArrayBufferView::getOwnNonIndexPropertyNames):
762             * runtime/JSCell.cpp:
763             (JSC::JSCell::getEnumerableLength):
764             (JSC::JSCell::getStructurePropertyNames):
765             (JSC::JSCell::getGenericPropertyNames):
766             * runtime/JSCell.h:
767             * runtime/JSFunction.cpp:
768             (JSC::JSFunction::getOwnNonIndexPropertyNames):
769             * runtime/JSGenericTypedArrayViewInlines.h:
770             (JSC::JSGenericTypedArrayView<Adaptor>::getOwnNonIndexPropertyNames):
771             * runtime/JSObject.cpp:
772             (JSC::getClassPropertyNames):
773             (JSC::JSObject::hasOwnProperty):
774             (JSC::JSObject::getOwnPropertyNames):
775             (JSC::JSObject::getOwnNonIndexPropertyNames):
776             (JSC::JSObject::getEnumerableLength):
777             (JSC::JSObject::getStructurePropertyNames):
778             (JSC::JSObject::getGenericPropertyNames):
779             * runtime/JSObject.h:
780             * runtime/JSPropertyNameEnumerator.cpp: Added.
781             (JSC::JSPropertyNameEnumerator::create):
782             (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
783             (JSC::JSPropertyNameEnumerator::finishCreation):
784             (JSC::JSPropertyNameEnumerator::destroy):
785             (JSC::JSPropertyNameEnumerator::visitChildren):
786             * runtime/JSPropertyNameEnumerator.h: Added.
787             (JSC::JSPropertyNameEnumerator::createStructure):
788             (JSC::JSPropertyNameEnumerator::propertyNameAtIndex):
789             (JSC::JSPropertyNameEnumerator::identifierSet):
790             (JSC::JSPropertyNameEnumerator::cachedPrototypeChain):
791             (JSC::JSPropertyNameEnumerator::setCachedPrototypeChain):
792             (JSC::JSPropertyNameEnumerator::cachedStructure):
793             (JSC::JSPropertyNameEnumerator::cachedStructureID):
794             (JSC::JSPropertyNameEnumerator::cachedInlineCapacity):
795             (JSC::JSPropertyNameEnumerator::cachedStructureIDOffset):
796             (JSC::JSPropertyNameEnumerator::cachedInlineCapacityOffset):
797             (JSC::JSPropertyNameEnumerator::cachedPropertyNamesLengthOffset):
798             (JSC::JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset):
799             (JSC::structurePropertyNameEnumerator):
800             (JSC::genericPropertyNameEnumerator):
801             * runtime/JSProxy.cpp:
802             (JSC::JSProxy::getEnumerableLength):
803             (JSC::JSProxy::getStructurePropertyNames):
804             (JSC::JSProxy::getGenericPropertyNames):
805             * runtime/JSProxy.h:
806             * runtime/JSSymbolTableObject.cpp:
807             (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
808             * runtime/PropertyNameArray.cpp:
809             (JSC::PropertyNameArray::add):
810             (JSC::PropertyNameArray::setPreviouslyEnumeratedProperties):
811             * runtime/PropertyNameArray.h:
812             (JSC::RefCountedIdentifierSet::contains):
813             (JSC::RefCountedIdentifierSet::size):
814             (JSC::RefCountedIdentifierSet::add):
815             (JSC::PropertyNameArray::PropertyNameArray):
816             (JSC::PropertyNameArray::add):
817             (JSC::PropertyNameArray::addKnownUnique):
818             (JSC::PropertyNameArray::identifierSet):
819             (JSC::PropertyNameArray::canAddKnownUniqueForStructure):
820             (JSC::PropertyNameArray::setPreviouslyEnumeratedLength):
821             * runtime/RegExpObject.cpp:
822             (JSC::RegExpObject::getOwnNonIndexPropertyNames):
823             (JSC::RegExpObject::getPropertyNames):
824             (JSC::RegExpObject::getGenericPropertyNames):
825             * runtime/RegExpObject.h:
826             * runtime/StringObject.cpp:
827             (JSC::StringObject::getOwnPropertyNames):
828             * runtime/Structure.cpp:
829             (JSC::Structure::getPropertyNamesFromStructure):
830             (JSC::Structure::setCachedStructurePropertyNameEnumerator):
831             (JSC::Structure::cachedStructurePropertyNameEnumerator):
832             (JSC::Structure::setCachedGenericPropertyNameEnumerator):
833             (JSC::Structure::cachedGenericPropertyNameEnumerator):
834             (JSC::Structure::canCacheStructurePropertyNameEnumerator):
835             (JSC::Structure::canCacheGenericPropertyNameEnumerator):
836             (JSC::Structure::canAccessPropertiesQuickly):
837             * runtime/Structure.h:
838             * runtime/StructureRareData.cpp:
839             (JSC::StructureRareData::visitChildren):
840             (JSC::StructureRareData::cachedStructurePropertyNameEnumerator):
841             (JSC::StructureRareData::setCachedStructurePropertyNameEnumerator):
842             (JSC::StructureRareData::cachedGenericPropertyNameEnumerator):
843             (JSC::StructureRareData::setCachedGenericPropertyNameEnumerator):
844             * runtime/StructureRareData.h:
845             * runtime/VM.cpp:
846             (JSC::VM::VM):
847             * runtime/VM.h:
848     
849     2014-07-23  Saam Barati  <sbarati@apple.com>
850     
851             Make improvements to Type Profiling
852             https://bugs.webkit.org/show_bug.cgi?id=134860
853     
854             Reviewed by Filip Pizlo.
855     
856             I improved the API between the inspector and JSC. We no longer send one huge
857             string to the inspector. We now send structured data that represents the type
858             information that JSC has collected. I've also created a beginning implementation 
859             of a type lattice that allows us to resolve a display name for a type that
860             consists of a single word.
861     
862             I created a data structure that knows which functions have executed. This
863             solves the bug where types inside an un-executed function will resolve
864             to the type of the enclosing expression of that function. This data
865             structure may also be useful later if the inspector chooses to create a UI
866             around showing which functions have executed.
867     
868             Better type information is gathered for objects. StructureShape now
869             represents an object's prototype chain.  StructureShape also collects
870             the constructor name for an object.
871     
872             Expression ranges are now zero indexed.
873     
874             Removed some extraneous methods.
875     
876             * JavaScriptCore.xcodeproj/project.pbxproj:
877             * bytecode/CodeBlock.cpp:
878             (JSC::CodeBlock::CodeBlock):
879             (JSC::CodeBlock::scopeDependentProfile):
880             * bytecode/CodeBlock.h:
881             * bytecode/TypeLocation.h:
882             (JSC::TypeLocation::TypeLocation):
883             * bytecode/UnlinkedCodeBlock.cpp:
884             (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
885             * bytecode/UnlinkedCodeBlock.h:
886             (JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingStartOffset):
887             (JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingEndOffset):
888             * bytecompiler/BytecodeGenerator.cpp:
889             (JSC::BytecodeGenerator::BytecodeGenerator):
890             (JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo):
891             * bytecompiler/BytecodeGenerator.h:
892             (JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo): Deleted.
893             * heap/Heap.cpp:
894             (JSC::Heap::collect):
895             * inspector/agents/InspectorRuntimeAgent.cpp:
896             (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
897             (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableAtOffset): Deleted.
898             * inspector/agents/InspectorRuntimeAgent.h:
899             * inspector/protocol/Runtime.json:
900             * runtime/Executable.cpp:
901             (JSC::ScriptExecutable::ScriptExecutable):
902             (JSC::ProgramExecutable::ProgramExecutable):
903             (JSC::FunctionExecutable::FunctionExecutable):
904             (JSC::ProgramExecutable::initializeGlobalProperties):
905             * runtime/Executable.h:
906             (JSC::ScriptExecutable::highFidelityTypeProfilingStartOffset):
907             (JSC::ScriptExecutable::highFidelityTypeProfilingEndOffset):
908             * runtime/FunctionHasExecutedCache.cpp: Added.
909             (JSC::FunctionHasExecutedCache::hasExecutedAtOffset):
910             (JSC::FunctionHasExecutedCache::insertUnexecutedRange):
911             (JSC::FunctionHasExecutedCache::removeUnexecutedRange):
912             * runtime/FunctionHasExecutedCache.h: Added.
913             (JSC::FunctionHasExecutedCache::FunctionRange::FunctionRange):
914             (JSC::FunctionHasExecutedCache::FunctionRange::operator==):
915             (JSC::FunctionHasExecutedCache::FunctionRange::hash):
916             * runtime/HighFidelityLog.cpp:
917             (JSC::HighFidelityLog::processHighFidelityLog):
918             (JSC::HighFidelityLog::actuallyProcessLogThreadFunction): Deleted.
919             * runtime/HighFidelityLog.h:
920             (JSC::HighFidelityLog::recordTypeInformationForLocation):
921             * runtime/HighFidelityTypeProfiler.cpp:
922             (JSC::HighFidelityTypeProfiler::logTypesForTypeLocation):
923             (JSC::HighFidelityTypeProfiler::insertNewLocation):
924             (JSC::HighFidelityTypeProfiler::getTypesForVariableAtOffsetForInspector):
925             (JSC::descriptorMatchesTypeLocation):
926             (JSC::HighFidelityTypeProfiler::findLocation):
927             (JSC::HighFidelityTypeProfiler::getTypesForVariableInAtOffset): Deleted.
928             (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableAtOffset): Deleted.
929             (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableAtOffset): Deleted.
930             * runtime/HighFidelityTypeProfiler.h:
931             (JSC::QueryKey::QueryKey):
932             (JSC::QueryKey::isHashTableDeletedValue):
933             (JSC::QueryKey::operator==):
934             (JSC::QueryKey::hash):
935             (JSC::QueryKeyHash::hash):
936             (JSC::QueryKeyHash::equal):
937             (JSC::HighFidelityTypeProfiler::functionHasExecutedCache):
938             (JSC::HighFidelityTypeProfiler::typeLocationCache):
939             * runtime/Structure.cpp:
940             (JSC::Structure::toStructureShape):
941             * runtime/Structure.h:
942             * runtime/TypeLocationCache.cpp: Added.
943             (JSC::TypeLocationCache::getTypeLocation):
944             * runtime/TypeLocationCache.h: Added.
945             (JSC::TypeLocationCache::LocationKey::LocationKey):
946             (JSC::TypeLocationCache::LocationKey::operator==):
947             (JSC::TypeLocationCache::LocationKey::hash):
948             * runtime/TypeSet.cpp:
949             (JSC::TypeSet::getRuntimeTypeForValue):
950             (JSC::TypeSet::addTypeForValue):
951             (JSC::TypeSet::seenTypes):
952             (JSC::TypeSet::doesTypeConformTo):
953             (JSC::TypeSet::displayName):
954             (JSC::TypeSet::allPrimitiveTypeNames):
955             (JSC::TypeSet::allStructureRepresentations):
956             (JSC::TypeSet::leastCommonAncestor):
957             (JSC::StructureShape::StructureShape):
958             (JSC::StructureShape::addProperty):
959             (JSC::StructureShape::propertyHash):
960             (JSC::StructureShape::leastCommonAncestor):
961             (JSC::StructureShape::stringRepresentation):
962             (JSC::StructureShape::inspectorRepresentation):
963             (JSC::StructureShape::leastUpperBound): Deleted.
964             * runtime/TypeSet.h:
965             (JSC::StructureShape::setConstructorName):
966             (JSC::StructureShape::constructorName):
967             (JSC::StructureShape::setProto):
968             * runtime/VM.cpp:
969             (JSC::VM::dumpHighFidelityProfilingTypes):
970             (JSC::VM::getTypesForVariableAtOffset): Deleted.
971             (JSC::VM::updateHighFidelityTypeProfileState): Deleted.
972             * runtime/VM.h:
973             (JSC::VM::isProfilingTypesWithHighFidelity):
974             (JSC::VM::highFidelityTypeProfiler):
975     
976     2014-07-23  Filip Pizlo  <fpizlo@apple.com>
977     
978             Fix debug build.
979     
980             * bytecode/CallLinkStatus.h:
981             (JSC::CallLinkStatus::CallLinkStatus):
982     
983     2014-07-20  Filip Pizlo  <fpizlo@apple.com>
984     
985             [ftlopt] Phantoms in SSA form should be aggressively hoisted
986             https://bugs.webkit.org/show_bug.cgi?id=135111
987     
988             Reviewed by Oliver Hunt.
989             
990             In CPS form, Phantom means three things: (1) that the children should be kept alive so long
991             as they are relevant to OSR (due to a MovHint), (2) that the children are live-in-bytecode
992             at the point of the Phantom, and (3) that some checks should be performed. In SSA, the
993             second meaning is not used but the other two stay.
994             
995             The fact that a Phantom that is used to keep a node alive could be anywhere in the graph,
996             even in a totally different basic block, complicates some SSA transformations. It's not
997             possible to just jettison some successor, since tha successor could have a Phantom that we
998             care about.
999             
1000             This change rationalizes how Phantoms work so that:
1001             
1002             1) Phantoms keep children alive so long as those children are relevant to OSR. This is true
1003                in both CPS and SSA. This was true before and it's true now.
1004             
1005             2) Phantoms are used for live-in-bytecode only in CPS. This was true before and it's true
1006                now, except that now we also don't bother preserving the live-in-bytecode information
1007                that Phantoms convey, when we are in SSA.
1008             
1009             3) Phantoms may incidentally have checks, but in cases where we only want checks, we now
1010                use Check instead of Phantom. Notably, DCE phase has dead nodes decay to Check, not
1011                Phantom.
1012             
1013             The biggest part of this change is that in SSA, we canonicalize Phantoms:
1014             
1015             - All Phantoms are replaced with Check nodes that include only those edges that have
1016               checks.
1017             
1018             - Nodes that were the children of any Phantoms have a Phantom right after them.
1019             
1020             For example, the following code:
1021             
1022                 5: ArithAdd(@1, @2)
1023                 6: ArithSub(@5, @3)
1024                 7: Phantom(Int32:@5)
1025             
1026             would be turned into the following:
1027             
1028                 5: ArithAdd(@1, @2)
1029                 8: Phantom(@5) // @5 was the child of a Phantom, so we create a new Phantom right after
1030                                // @5. This is the only Phantom we will have for @5.
1031                 6: ArithSub(@5, @3)
1032                 7: Check(Int32:@5) // We replace the Phantom with a Check; in this case since Int32: is
1033                                    // a checking edge, we leave it.
1034             
1035             This is a slight speed-up across the board, presumably because we now do a better job of
1036             reducing the size of the graph during compilation. It could also be a fluke, though. The
1037             main purpose of this is to unlock some other work (like CFG simplification in SSA). It will
1038             become a requirement to run phantom canonicalization prior to some SSA phases. None of the
1039             current phases need it, but future phases probably will.
1040     
1041             * CMakeLists.txt:
1042             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1043             * JavaScriptCore.xcodeproj/project.pbxproj:
1044             * dfg/DFGAbstractInterpreterInlines.h:
1045             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1046             * dfg/DFGConstantFoldingPhase.cpp:
1047             (JSC::DFG::ConstantFoldingPhase::foldConstants):
1048             * dfg/DFGDCEPhase.cpp:
1049             (JSC::DFG::DCEPhase::run):
1050             (JSC::DFG::DCEPhase::findTypeCheckRoot):
1051             (JSC::DFG::DCEPhase::countEdge):
1052             (JSC::DFG::DCEPhase::fixupBlock):
1053             (JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):
1054             * dfg/DFGEdge.cpp:
1055             (JSC::DFG::Edge::dump):
1056             * dfg/DFGEdge.h:
1057             (JSC::DFG::Edge::isProved):
1058             (JSC::DFG::Edge::needsCheck): Deleted.
1059             * dfg/DFGNodeFlags.h:
1060             * dfg/DFGPhantomCanonicalizationPhase.cpp: Added.
1061             (JSC::DFG::PhantomCanonicalizationPhase::PhantomCanonicalizationPhase):
1062             (JSC::DFG::PhantomCanonicalizationPhase::run):
1063             (JSC::DFG::performPhantomCanonicalization):
1064             * dfg/DFGPhantomCanonicalizationPhase.h: Added.
1065             * dfg/DFGPhantomRemovalPhase.cpp:
1066             (JSC::DFG::PhantomRemovalPhase::run):
1067             * dfg/DFGPhantomRemovalPhase.h:
1068             * dfg/DFGPlan.cpp:
1069             (JSC::DFG::Plan::compileInThreadImpl):
1070             * ftl/FTLLowerDFGToLLVM.cpp:
1071             (JSC::FTL::LowerDFGToLLVM::lowJSValue):
1072             (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
1073     
1074     2014-07-22  Filip Pizlo  <fpizlo@apple.com>
1075     
1076             [ftlopt] Get rid of structure checks as a way of checking if a function is in fact a function
1077             https://bugs.webkit.org/show_bug.cgi?id=135146
1078     
1079             Reviewed by Oliver Hunt.
1080             
1081             This greatly simplifies our closure call optimizations by taking advantage of the type
1082             bits available in the cell header.
1083     
1084             * bytecode/CallLinkInfo.cpp:
1085             (JSC::CallLinkInfo::visitWeak):
1086             * bytecode/CallLinkStatus.cpp:
1087             (JSC::CallLinkStatus::CallLinkStatus):
1088             (JSC::CallLinkStatus::computeFor):
1089             (JSC::CallLinkStatus::dump):
1090             * bytecode/CallLinkStatus.h:
1091             (JSC::CallLinkStatus::CallLinkStatus):
1092             (JSC::CallLinkStatus::executable):
1093             (JSC::CallLinkStatus::structure): Deleted.
1094             * dfg/DFGByteCodeParser.cpp:
1095             (JSC::DFG::ByteCodeParser::emitFunctionChecks):
1096             * dfg/DFGFixupPhase.cpp:
1097             (JSC::DFG::FixupPhase::fixupNode):
1098             (JSC::DFG::FixupPhase::observeUseKindOnNode):
1099             * dfg/DFGSafeToExecute.h:
1100             (JSC::DFG::SafeToExecuteEdge::operator()):
1101             * dfg/DFGSpeculativeJIT.cpp:
1102             (JSC::DFG::SpeculativeJIT::checkArray):
1103             (JSC::DFG::SpeculativeJIT::speculateCellTypeWithoutTypeFiltering):
1104             (JSC::DFG::SpeculativeJIT::speculateCellType):
1105             (JSC::DFG::SpeculativeJIT::speculateFunction):
1106             (JSC::DFG::SpeculativeJIT::speculateFinalObject):
1107             (JSC::DFG::SpeculativeJIT::speculate):
1108             * dfg/DFGSpeculativeJIT.h:
1109             * dfg/DFGSpeculativeJIT32_64.cpp:
1110             (JSC::DFG::SpeculativeJIT::compile):
1111             * dfg/DFGSpeculativeJIT64.cpp:
1112             (JSC::DFG::SpeculativeJIT::compile):
1113             * dfg/DFGUseKind.cpp:
1114             (WTF::printInternal):
1115             * dfg/DFGUseKind.h:
1116             (JSC::DFG::typeFilterFor):
1117             (JSC::DFG::isCell):
1118             * ftl/FTLCapabilities.cpp:
1119             (JSC::FTL::canCompile):
1120             * ftl/FTLLowerDFGToLLVM.cpp:
1121             (JSC::FTL::LowerDFGToLLVM::compileCheckExecutable):
1122             (JSC::FTL::LowerDFGToLLVM::speculate):
1123             (JSC::FTL::LowerDFGToLLVM::isFunction):
1124             (JSC::FTL::LowerDFGToLLVM::isNotFunction):
1125             (JSC::FTL::LowerDFGToLLVM::speculateFunction):
1126             * jit/ClosureCallStubRoutine.cpp:
1127             (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
1128             (JSC::ClosureCallStubRoutine::markRequiredObjectsInternal):
1129             * jit/ClosureCallStubRoutine.h:
1130             (JSC::ClosureCallStubRoutine::structure): Deleted.
1131             * jit/JIT.h:
1132             (JSC::JIT::compileClosureCall): Deleted.
1133             * jit/JITCall.cpp:
1134             (JSC::JIT::privateCompileClosureCall): Deleted.
1135             * jit/JITCall32_64.cpp:
1136             (JSC::JIT::privateCompileClosureCall): Deleted.
1137             * jit/JITOperations.cpp:
1138             * jit/Repatch.cpp:
1139             (JSC::linkClosureCall):
1140             * jit/Repatch.h:
1141     
1142 2014-08-06  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
1143
1144         [ARM] Incorrect handling of Unicode characters
1145         https://bugs.webkit.org/show_bug.cgi?id=135380
1146
1147         Reviewed by Darin Adler.
1148
1149         Removed erroneous fast case from stringFromUTF(), since it assumed that 
1150         char is always implemented as signed.
1151
1152         * jsc.cpp:
1153         (stringFromUTF):
1154
1155 2014-08-06  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
1156
1157         [JSC] Build fix for FTL on EFL after ftlopt merge
1158         https://bugs.webkit.org/show_bug.cgi?id=135565
1159
1160         Reviewed by Mark Lam.
1161
1162         Adding an enable guard for native inlining, since it now requires the bitcode
1163         emitted from Clang, and we don't have a good way of creating it from other compilers.
1164
1165         * dfg/DFGByteCodeParser.cpp:
1166         (JSC::DFG::ByteCodeParser::handleCall):
1167         * ftl/FTLLowerDFGToLLVM.cpp:
1168         (JSC::FTL::LowerDFGToLLVM::compileNode):
1169         * ftl/FTLState.cpp:
1170         (JSC::FTL::State::State):
1171         * ftl/FTLState.h:
1172
1173 2014-08-05  Csaba Osztrogonác  <ossy@webkit.org>
1174
1175         URTBF after r172129. (ftlopt branch merge)
1176
1177         Remove the duplicated friend declaration to fix this build failure:
1178         "error: ‘JSC::Structure’ is already a friend of ‘JSC::StructureRareData’ [-Werror]"
1179
1180         * runtime/StructureRareData.h:
1181
1182 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1183
1184         Attempt to fix CMake-based builds, part 3.
1185
1186         * CMakeLists.txt:
1187
1188 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1189
1190         Attempt to fix CMake-based builds, part 2.
1191
1192         * CMakeLists.txt:
1193
1194 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1195
1196         Attempt to fix Windows build, part 2.
1197
1198         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1199
1200 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1201
1202         Attempt to fix CMake-based builds.
1203
1204         * CMakeLists.txt:
1205
1206 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1207
1208         Attempt to fix Windows build.
1209
1210         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1211
1212 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1213
1214         Fix cloop build.
1215
1216         * bytecode/CodeBlock.cpp:
1217         (JSC::CodeBlock::jettison):
1218
1219 2014-07-29  Filip Pizlo  <fpizlo@apple.com>
1220
1221         Merge r170564, r170571, r170604, r170628, r170672, r170680, r170724, r170728, r170729, r170819, r170821, r170836, r170855, r170860, r170890, r170907, r170929, r171052, r171106, r171152, r171153, r171214 from ftlopt.
1222
1223         This part of the merge delivers roughly a 2% across-the-board performance
1224         improvement, mostly due to immutable property inference and DFG-side GCSE. It also
1225         almost completely resolves accessor performance issues; in the common case the DFG
1226         will compile a getter/setter access into code that is just as efficient as a normal
1227         property access.
1228         
1229         Another major highlight of this part of the merge is the work to add a type profiler
1230         to the inspector. This work is still on-going but this greatly increases coverage.
1231
1232         Note that this merge fixes a minor bug in the GetterSetter refactoring from
1233         http://trac.webkit.org/changeset/170729 (https://bugs.webkit.org/show_bug.cgi?id=134518).
1234         It also adds a new tests to tests/stress to cover that bug. That bug was previously only
1235         covered by layout tests.
1236
1237     2014-07-17  Filip Pizlo  <fpizlo@apple.com>
1238     
1239             [ftlopt] DFG Flush(SetLocal) store elimination is overzealous for captured variables in the presence of nodes that have no effects but may throw (merge trunk r171190)
1240             https://bugs.webkit.org/show_bug.cgi?id=135019
1241     
1242             Reviewed by Oliver Hunt.
1243             
1244             Behaviorally, this is just a merge of trunk r171190, except that the relevant functionality
1245             has moved to StrengthReductionPhase and is written in a different style. Same algorithm,
1246             different code.
1247     
1248             * dfg/DFGNodeType.h:
1249             * dfg/DFGStrengthReductionPhase.cpp:
1250             (JSC::DFG::StrengthReductionPhase::handleNode):
1251             * tests/stress/capture-escape-and-throw.js: Added.
1252             (foo.f):
1253             (foo):
1254             * tests/stress/new-array-with-size-throw-exception-and-tear-off-arguments.js: Added.
1255             (foo):
1256             (bar):
1257     
1258     2014-07-15  Filip Pizlo  <fpizlo@apple.com>
1259     
1260             [ftlopt] Constant fold GetGetter and GetSetter if the GetterSetter is a constant
1261             https://bugs.webkit.org/show_bug.cgi?id=134962
1262     
1263             Reviewed by Oliver Hunt.
1264             
1265             This removes yet another steady-state-throughput implication of using getters and setters:
1266             if your accessor call is monomorphic then you'll just get a structure check, nothing more.
1267             No more loads to get to the GetterSetter object or the accessor function object.
1268     
1269             * dfg/DFGAbstractInterpreterInlines.h:
1270             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1271             * runtime/GetterSetter.h:
1272             (JSC::GetterSetter::getterConcurrently):
1273             (JSC::GetterSetter::setGetter):
1274             (JSC::GetterSetter::setterConcurrently):
1275             (JSC::GetterSetter::setSetter):
1276     
1277     2014-07-15  Filip Pizlo  <fpizlo@apple.com>
1278     
1279             [ftlopt] Identity replacement in CSE shouldn't create a Phantom over the Identity's children
1280             https://bugs.webkit.org/show_bug.cgi?id=134893
1281     
1282             Reviewed by Oliver Hunt.
1283             
1284             Replace Identity with Check instead of Phantom. Phantom means that the child of the
1285             Identity should be unconditionally live. The liveness semantics of Identity are such that
1286             if the parents of Identity are live then the child is live. Removing the Identity entirely
1287             preserves such liveness semantics. So, the only thing that should be left behind is the
1288             type check on the child, which is what Check means: do the check but don't keep the child
1289             alive if the check isn't needed.
1290     
1291             * dfg/DFGCSEPhase.cpp:
1292             * dfg/DFGNode.h:
1293             (JSC::DFG::Node::convertToCheck):
1294     
1295     2014-07-13  Filip Pizlo  <fpizlo@apple.com>
1296     
1297             [ftlopt] DFG should be able to do GCSE in SSA and this should be unified with the CSE in CPS, and both of these things should use abstract heaps for reasoning about effects
1298             https://bugs.webkit.org/show_bug.cgi?id=134677
1299     
1300             Reviewed by Sam Weinig.
1301             
1302             This removes the old local CSE phase, which was based on manually written backward-search 
1303             rules for all of the different kinds of things we cared about, and adds a new local/global
1304             CSE (local for CPS and global for SSA) that leaves the node semantics almost entirely up to
1305             clobberize(). Thus, the CSE phase itself just worries about the algorithms and data
1306             structures used for storing sets of available values. This results in a large reduction in
1307             code size in CSEPhase.cpp while greatly increasing the phase's power (since it now does
1308             global CSE) and reducing compile time (since local CSE is now rewritten to use smarter data
1309             structures). Even though LLVM was already running GVN, the extra GCSE at DFG IR level means
1310             that this is a significant (~0.7%) throughput improvement.
1311             
1312             This work is based on the concept of "def" to clobberize(). If clobberize() calls def(), it
1313             means that the node being analyzed makes available some value in some DFG node, and that
1314             future attempts to compute that value can simply use that node. In other words, it
1315             establishes an available value mapping of the form value=>node. There are two kinds of
1316             values that can be passed to def():
1317             
1318             PureValue. This captures everything needed to determine whether two pure nodes - nodes that
1319                 neither read nor write, and produce a value that is a CSE candidate - are identical. It
1320                 carries the NodeType, an AdjacencyList, and one word of meta-data. The meta-data is
1321                 usually used for things like the arithmetic mode or constant pointer. Passing a
1322                 PureValue to def() means that the node produces a value that is valid anywhere that the
1323                 node dominates.
1324             
1325             HeapLocation. This describes a location in the heap that could be written to or read from.
1326                 Both stores and loads can def() a HeapLocation. HeapLocation carries around an abstract
1327                 heap that both serves as part of the "name" of the heap location (together with the
1328                 other fields of HeapLocation) and also tells us what write()'s to watch for. If someone
1329                 write()'s to an abstract heap that overlaps the heap associated with the HeapLocation,
1330                 then it means that the values for that location are no longer available.
1331             
1332             This approach is sufficiently clever that the CSEPhase itself can focus on the mechanism of
1333             tracking the PureValue=>node and HeapLocation=>node maps, without having to worry about
1334             interpreting the semantics of different DFG node types - that is now almost entirely in
1335             clobberize(). The only things we special-case inside CSEPhase are the Identity node, which
1336             CSE is traditionally responsible for eliminating even though it has nothing to do with CSE,
1337             and the LocalCSE rule for turning PutByVal into PutByValAlias.
1338             
1339             This is a slight Octane, SunSpider, and Kraken speed-up - all somewhere arond 0.7% . It's
1340             not a bigger win because LLVM was already giving us most of what we needed in its GVN.
1341             Also, the SunSpider speed-up isn't from GCSE as much as it's a clean-up of local CSE - that
1342             is no longer O(n^2). Basically this is purely good: it reduces the amount of LLVM IR we
1343             generate, it removes the old CSE's heap modeling (which was a constant source of bugs), and
1344             it improves both the quality of the code we generate and the speed with which we generate
1345             it. Also, any future optimizations that depend on GCSE will now be easier to implement.
1346             
1347             During the development of this patch I also rationalized some other stuff, like Graph's
1348             ordered traversals - we now have preorder and postorder rather than just "depth first".
1349     
1350             * CMakeLists.txt:
1351             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1352             * JavaScriptCore.xcodeproj/project.pbxproj:
1353             * dfg/DFGAbstractHeap.h:
1354             * dfg/DFGAdjacencyList.h:
1355             (JSC::DFG::AdjacencyList::hash):
1356             (JSC::DFG::AdjacencyList::operator==):
1357             * dfg/DFGBasicBlock.h:
1358             * dfg/DFGCSEPhase.cpp:
1359             (JSC::DFG::performLocalCSE):
1360             (JSC::DFG::performGlobalCSE):
1361             (JSC::DFG::CSEPhase::CSEPhase): Deleted.
1362             (JSC::DFG::CSEPhase::run): Deleted.
1363             (JSC::DFG::CSEPhase::endIndexForPureCSE): Deleted.
1364             (JSC::DFG::CSEPhase::pureCSE): Deleted.
1365             (JSC::DFG::CSEPhase::constantCSE): Deleted.
1366             (JSC::DFG::CSEPhase::constantStoragePointerCSE): Deleted.
1367             (JSC::DFG::CSEPhase::getCalleeLoadElimination): Deleted.
1368             (JSC::DFG::CSEPhase::getArrayLengthElimination): Deleted.
1369             (JSC::DFG::CSEPhase::globalVarLoadElimination): Deleted.
1370             (JSC::DFG::CSEPhase::scopedVarLoadElimination): Deleted.
1371             (JSC::DFG::CSEPhase::varInjectionWatchpointElimination): Deleted.
1372             (JSC::DFG::CSEPhase::getByValLoadElimination): Deleted.
1373             (JSC::DFG::CSEPhase::checkFunctionElimination): Deleted.
1374             (JSC::DFG::CSEPhase::checkExecutableElimination): Deleted.
1375             (JSC::DFG::CSEPhase::checkStructureElimination): Deleted.
1376             (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): Deleted.
1377             (JSC::DFG::CSEPhase::getByOffsetLoadElimination): Deleted.
1378             (JSC::DFG::CSEPhase::getGetterSetterByOffsetLoadElimination): Deleted.
1379             (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): Deleted.
1380             (JSC::DFG::CSEPhase::checkArrayElimination): Deleted.
1381             (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): Deleted.
1382             (JSC::DFG::CSEPhase::getInternalFieldLoadElimination): Deleted.
1383             (JSC::DFG::CSEPhase::getMyScopeLoadElimination): Deleted.
1384             (JSC::DFG::CSEPhase::getLocalLoadElimination): Deleted.
1385             (JSC::DFG::CSEPhase::invalidationPointElimination): Deleted.
1386             (JSC::DFG::CSEPhase::setReplacement): Deleted.
1387             (JSC::DFG::CSEPhase::eliminate): Deleted.
1388             (JSC::DFG::CSEPhase::performNodeCSE): Deleted.
1389             (JSC::DFG::CSEPhase::performBlockCSE): Deleted.
1390             (JSC::DFG::performCSE): Deleted.
1391             * dfg/DFGCSEPhase.h:
1392             * dfg/DFGClobberSet.cpp:
1393             (JSC::DFG::addReads):
1394             (JSC::DFG::addWrites):
1395             (JSC::DFG::addReadsAndWrites):
1396             (JSC::DFG::readsOverlap):
1397             (JSC::DFG::writesOverlap):
1398             * dfg/DFGClobberize.cpp:
1399             (JSC::DFG::doesWrites):
1400             (JSC::DFG::accessesOverlap):
1401             (JSC::DFG::writesOverlap):
1402             * dfg/DFGClobberize.h:
1403             (JSC::DFG::clobberize):
1404             (JSC::DFG::NoOpClobberize::operator()):
1405             (JSC::DFG::CheckClobberize::operator()):
1406             (JSC::DFG::ReadMethodClobberize::ReadMethodClobberize):
1407             (JSC::DFG::ReadMethodClobberize::operator()):
1408             (JSC::DFG::WriteMethodClobberize::WriteMethodClobberize):
1409             (JSC::DFG::WriteMethodClobberize::operator()):
1410             (JSC::DFG::DefMethodClobberize::DefMethodClobberize):
1411             (JSC::DFG::DefMethodClobberize::operator()):
1412             * dfg/DFGDCEPhase.cpp:
1413             (JSC::DFG::DCEPhase::run):
1414             (JSC::DFG::DCEPhase::fixupBlock):
1415             * dfg/DFGGraph.cpp:
1416             (JSC::DFG::Graph::getBlocksInPreOrder):
1417             (JSC::DFG::Graph::getBlocksInPostOrder):
1418             (JSC::DFG::Graph::addForDepthFirstSort): Deleted.
1419             (JSC::DFG::Graph::getBlocksInDepthFirstOrder): Deleted.
1420             * dfg/DFGGraph.h:
1421             * dfg/DFGHeapLocation.cpp: Added.
1422             (JSC::DFG::HeapLocation::dump):
1423             (WTF::printInternal):
1424             * dfg/DFGHeapLocation.h: Added.
1425             (JSC::DFG::HeapLocation::HeapLocation):
1426             (JSC::DFG::HeapLocation::operator!):
1427             (JSC::DFG::HeapLocation::kind):
1428             (JSC::DFG::HeapLocation::heap):
1429             (JSC::DFG::HeapLocation::base):
1430             (JSC::DFG::HeapLocation::index):
1431             (JSC::DFG::HeapLocation::hash):
1432             (JSC::DFG::HeapLocation::operator==):
1433             (JSC::DFG::HeapLocation::isHashTableDeletedValue):
1434             (JSC::DFG::HeapLocationHash::hash):
1435             (JSC::DFG::HeapLocationHash::equal):
1436             * dfg/DFGLICMPhase.cpp:
1437             (JSC::DFG::LICMPhase::run):
1438             * dfg/DFGNode.h:
1439             (JSC::DFG::Node::replaceWith):
1440             (JSC::DFG::Node::convertToPhantomUnchecked): Deleted.
1441             * dfg/DFGPlan.cpp:
1442             (JSC::DFG::Plan::compileInThreadImpl):
1443             * dfg/DFGPureValue.cpp: Added.
1444             (JSC::DFG::PureValue::dump):
1445             * dfg/DFGPureValue.h: Added.
1446             (JSC::DFG::PureValue::PureValue):
1447             (JSC::DFG::PureValue::operator!):
1448             (JSC::DFG::PureValue::op):
1449             (JSC::DFG::PureValue::children):
1450             (JSC::DFG::PureValue::info):
1451             (JSC::DFG::PureValue::hash):
1452             (JSC::DFG::PureValue::operator==):
1453             (JSC::DFG::PureValue::isHashTableDeletedValue):
1454             (JSC::DFG::PureValueHash::hash):
1455             (JSC::DFG::PureValueHash::equal):
1456             * dfg/DFGSSAConversionPhase.cpp:
1457             (JSC::DFG::SSAConversionPhase::run):
1458             * ftl/FTLLowerDFGToLLVM.cpp:
1459             (JSC::FTL::LowerDFGToLLVM::lower):
1460     
1461     2014-07-13  Filip Pizlo  <fpizlo@apple.com>
1462     
1463             Unreviewed, revert unintended change in r171051.
1464     
1465             * dfg/DFGCSEPhase.cpp:
1466     
1467     2014-07-08  Filip Pizlo  <fpizlo@apple.com>
1468     
1469             [ftlopt] Move Flush(SetLocal) store elimination to StrengthReductionPhase
1470             https://bugs.webkit.org/show_bug.cgi?id=134739
1471     
1472             Reviewed by Mark Hahnenberg.
1473             
1474             I'm going to streamline CSE around clobberize() as part of
1475             https://bugs.webkit.org/show_bug.cgi?id=134677, and so Flush(SetLocal) store
1476             elimination wouldn't belong in CSE anymore. It doesn't quite belong anywhere, which
1477             means that it belongs in StrengthReductionPhase, since that's intended to be our
1478             dumping ground.
1479             
1480             To do this I had to add some missing smarts to clobberize(). Previously clobberize()
1481             could play a bit loose with reads of Variables because it wasn't used for store
1482             elimination. The main client of read() was LICM, but it would only use it to
1483             determine hoistability and anything that did a write() was not hoistable - so, we had
1484             benign (but still wrong) missing read() calls in places that did write()s. This fixes
1485             a bunch of those cases.
1486     
1487             * dfg/DFGCSEPhase.cpp:
1488             (JSC::DFG::CSEPhase::performNodeCSE):
1489             (JSC::DFG::CSEPhase::setLocalStoreElimination): Deleted.
1490             * dfg/DFGClobberize.cpp:
1491             (JSC::DFG::accessesOverlap):
1492             * dfg/DFGClobberize.h:
1493             (JSC::DFG::clobberize): Make clobberize() smart enough for detecting when this store elimination would be sound.
1494             * dfg/DFGStrengthReductionPhase.cpp:
1495             (JSC::DFG::StrengthReductionPhase::handleNode): Implement the store elimination in terms of clobberize().
1496     
1497     2014-07-08  Filip Pizlo  <fpizlo@apple.com>
1498     
1499             [ftlopt] Phantom simplification should be in its own phase
1500             https://bugs.webkit.org/show_bug.cgi?id=134742
1501     
1502             Reviewed by Geoffrey Garen.
1503             
1504             This moves Phantom simplification out of CSE, which greatly simplifies CSE and gives it
1505             more focus. Also this finally adds a phase that removes empty Phantoms. We sort of had
1506             this in CPSRethreading, but that phase runs too infrequently and doesn't run at all for
1507             SSA.
1508     
1509             * CMakeLists.txt:
1510             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1511             * JavaScriptCore.xcodeproj/project.pbxproj:
1512             * dfg/DFGAdjacencyList.h:
1513             * dfg/DFGCSEPhase.cpp:
1514             (JSC::DFG::CSEPhase::run):
1515             (JSC::DFG::CSEPhase::setReplacement):
1516             (JSC::DFG::CSEPhase::eliminate):
1517             (JSC::DFG::CSEPhase::performNodeCSE):
1518             (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren): Deleted.
1519             * dfg/DFGPhantomRemovalPhase.cpp: Added.
1520             (JSC::DFG::PhantomRemovalPhase::PhantomRemovalPhase):
1521             (JSC::DFG::PhantomRemovalPhase::run):
1522             (JSC::DFG::performCleanUp):
1523             * dfg/DFGPhantomRemovalPhase.h: Added.
1524             * dfg/DFGPlan.cpp:
1525             (JSC::DFG::Plan::compileInThreadImpl):
1526     
1527     2014-07-08  Filip Pizlo  <fpizlo@apple.com>
1528     
1529             [ftlopt] Get rid of Node::misc by moving the fields out of the union so that you can use replacement and owner simultaneously
1530             https://bugs.webkit.org/show_bug.cgi?id=134730
1531     
1532             Reviewed by Mark Lam.
1533             
1534             This will allow for a better GCSE implementation.
1535     
1536             * dfg/DFGCPSRethreadingPhase.cpp:
1537             (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
1538             * dfg/DFGCSEPhase.cpp:
1539             (JSC::DFG::CSEPhase::setReplacement):
1540             * dfg/DFGEdgeDominates.h:
1541             (JSC::DFG::EdgeDominates::operator()):
1542             * dfg/DFGGraph.cpp:
1543             (JSC::DFG::Graph::clearReplacements):
1544             (JSC::DFG::Graph::initializeNodeOwners):
1545             * dfg/DFGGraph.h:
1546             (JSC::DFG::Graph::performSubstitutionForEdge):
1547             * dfg/DFGLICMPhase.cpp:
1548             (JSC::DFG::LICMPhase::attemptHoist):
1549             * dfg/DFGNode.h:
1550             (JSC::DFG::Node::Node):
1551             * dfg/DFGSSAConversionPhase.cpp:
1552             (JSC::DFG::SSAConversionPhase::run):
1553     
1554     2014-07-04  Filip Pizlo  <fpizlo@apple.com>
1555     
1556             [ftlopt] Infer immutable object properties
1557             https://bugs.webkit.org/show_bug.cgi?id=134567
1558     
1559             Reviewed by Mark Hahnenberg.
1560             
1561             This introduces a new way of inferring immutable object properties. A property is said to
1562             be immutable if after its creation (i.e. the transition that creates it), we never
1563             overwrite it (i.e. replace it) or delete it. Immutability is a property of an "own
1564             property" - so if we say that "f" is immutable at "o" then we are implying that "o" has "f"
1565             directly and not on a prototype. More specifically, the immutability inference will prove
1566             that a property on some structure is immutable. This means that, for example, we may have a
1567             structure S1 with property "f" where we claim that "f" at S1 is immutable, but S1 has a
1568             transition to S2 that adds a new property "g" and we may claim that "f" at S2 is actually
1569             mutable. This is mainly for convenience; it allows us to decouple immutability logic from
1570             transition logic. Immutability can be used to constant-fold accesses to objects at
1571             DFG-time. The DFG needs to prove the following to constant-fold the access:
1572             
1573             - The base of the access must be a constant object pointer. We prove that a property at a
1574               structure is immutable, but that says nothing of its value; each actual instance of that
1575               property may have a different value. So, a constant object pointer is needed to get an
1576               actual constant instance of the immutable value.
1577             
1578             - A check (or watchpoint) must have been emitted proving that the object has a structure
1579               that allows loading the property in question.
1580             
1581             - The replacement watchpoint set of the property in the structure that we've proven the
1582               object to have is still valid and we add a watchpoint to it lazily. The replacement
1583               watchpoint set is the key new mechanism that this change adds. It's possible that we have
1584               proven that the object has one of many structures, in which case each of those structures
1585               needs a valid replacement watchpoint set.
1586             
1587             The replacement watchpoint set is created the first time that any access to the property is
1588             cached. A put replace cache will create, and immediately invalidate, the watchpoint set. A
1589             get cache will create the watchpoint set and make it start watching. Any non-cached put
1590             access will invalidate the watchpoint set if one had been created; the underlying algorithm
1591             ensures that checking for the existence of a replacement watchpoint set is very fast in the
1592             common case. This algorithm ensures that no cached access needs to ever do any work to
1593             invalidate, or check the validity of, any replacement watchpoint sets. It also has some
1594             other nice properties:
1595             
1596             - It's very robust in its definition of immutability. The strictest that it will ever be is
1597               that for any instance of the object, the property must be written to only once,
1598               specifically at the time that the property is created. But it's looser than this in
1599               practice. For example, the property may be written to any number of times before we add
1600               the final property that the object will have before anyone reads the property; this works
1601               since for optimization purposes we only care if we detect immutability on the structure
1602               that the object will have when it is most frequently read from, not any previous
1603               structure that the object had. Also, we may write to the property any number of times
1604               before anyone caches accesses to it.
1605             
1606             - It is mostly orthogonal to structure transitions. No new structures need to be created to
1607               track the immutability of a property. Hence, there is no risk from this feature causing
1608               more polymorphism. This is different from the previous "specificValue" constant
1609               inference, which did cause additional structures to be created and sometimes those
1610               structures led to fake polymorphism. This feature does leverage existing transitions to
1611               do some of the watchpointing: property deletions don't fire the replacement watchpoint
1612               set because that would cause a new structure and so the mandatory structure check would
1613               fail. Also, this feature is guaranteed to never kick in for uncacheable dictionaries
1614               because those wouldn't allow for cacheable accesses - and it takes a cacheable access for
1615               this feature to be enabled.
1616             
1617             - No memory overhead is incurred except when accesses to the property are cached.
1618               Dictionary properties will typically have no meta-data for immutability. The number of
1619               replacement watchpoint sets we allocate is proportional to the number of inline caches in
1620               the program, which is typically must smaller than the number of structures or even the
1621               number of objects.
1622             
1623             This inference is far more powerful than the previous "specificValue" inference, so this
1624             change also removes all of that code. It's interesting that the amount of code that is
1625             changed to remove that feature is almost as big as the amount of code added to support the
1626             new inference - and that's if you include the new tests in the tally. Without new tests,
1627             it appears that the new feature actually touches less code!
1628             
1629             There is one corner case where the previous "specificValue" inference was more powerful.
1630             You can imagine someone creating objects with functions as self properties on those
1631             objects, such that each object instance had the same function pointers - essentially,
1632             someone might be trying to create a vtable but failing at the whole "one vtable for many
1633             instances" concept. The "specificValue" inference would do very well for such programs,
1634             because a structure check would be sufficient to prove a constant value for all of the
1635             function properties. This new inference will fail because it doesn't track the constant
1636             values of constant properties; instead it detects the immutability of otherwise variable
1637             properties (in the sense that each instance of the property may have a different value).
1638             So, the new inference requires having a particular object instance to actually get the
1639             constant value. I think it's OK to lose this antifeature. It took a lot of code to support
1640             and was a constant source of grief in our transition logic, and there doesn't appear to be
1641             any real evidence that programs benefited from that particular kind of inference since
1642             usually it's the singleton prototype instance that has all of the functions.
1643             
1644             This change is a speed-up on everything. date-format-xparb and both SunSpider/raytrace and
1645             V8/raytrace seem to be the biggest winners among the macrobenchmarks; they see >5%
1646             speed-ups. Many of our microbenchmarks see very large performance improvements, even 80% in
1647             one case.
1648     
1649             * bytecode/ComplexGetStatus.cpp:
1650             (JSC::ComplexGetStatus::computeFor):
1651             * bytecode/GetByIdStatus.cpp:
1652             (JSC::GetByIdStatus::computeFromLLInt):
1653             (JSC::GetByIdStatus::computeForStubInfo):
1654             (JSC::GetByIdStatus::computeFor):
1655             * bytecode/GetByIdVariant.cpp:
1656             (JSC::GetByIdVariant::GetByIdVariant):
1657             (JSC::GetByIdVariant::operator=):
1658             (JSC::GetByIdVariant::attemptToMerge):
1659             (JSC::GetByIdVariant::dumpInContext):
1660             * bytecode/GetByIdVariant.h:
1661             (JSC::GetByIdVariant::alternateBase):
1662             (JSC::GetByIdVariant::specificValue): Deleted.
1663             * bytecode/PutByIdStatus.cpp:
1664             (JSC::PutByIdStatus::computeForStubInfo):
1665             (JSC::PutByIdStatus::computeFor):
1666             * bytecode/PutByIdVariant.cpp:
1667             (JSC::PutByIdVariant::operator=):
1668             (JSC::PutByIdVariant::setter):
1669             (JSC::PutByIdVariant::dumpInContext):
1670             * bytecode/PutByIdVariant.h:
1671             (JSC::PutByIdVariant::specificValue): Deleted.
1672             * bytecode/Watchpoint.cpp:
1673             (JSC::WatchpointSet::fireAllSlow):
1674             (JSC::WatchpointSet::fireAll): Deleted.
1675             * bytecode/Watchpoint.h:
1676             (JSC::WatchpointSet::fireAll):
1677             * dfg/DFGAbstractInterpreterInlines.h:
1678             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1679             * dfg/DFGByteCodeParser.cpp:
1680             (JSC::DFG::ByteCodeParser::handleGetByOffset):
1681             (JSC::DFG::ByteCodeParser::handleGetById):
1682             (JSC::DFG::ByteCodeParser::handlePutById):
1683             (JSC::DFG::ByteCodeParser::parseBlock):
1684             * dfg/DFGConstantFoldingPhase.cpp:
1685             (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
1686             * dfg/DFGFixupPhase.cpp:
1687             (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
1688             (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
1689             * dfg/DFGGraph.cpp:
1690             (JSC::DFG::Graph::tryGetConstantProperty):
1691             (JSC::DFG::Graph::visitChildren):
1692             * dfg/DFGGraph.h:
1693             * dfg/DFGWatchableStructureWatchingPhase.cpp:
1694             (JSC::DFG::WatchableStructureWatchingPhase::run):
1695             * ftl/FTLLowerDFGToLLVM.cpp:
1696             (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
1697             * jit/JITOperations.cpp:
1698             * jit/Repatch.cpp:
1699             (JSC::repatchByIdSelfAccess):
1700             (JSC::generateByIdStub):
1701             (JSC::tryCacheGetByID):
1702             (JSC::tryCachePutByID):
1703             (JSC::tryBuildPutByIdList):
1704             * llint/LLIntSlowPaths.cpp:
1705             (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1706             (JSC::LLInt::putToScopeCommon):
1707             * runtime/CommonSlowPaths.h:
1708             (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
1709             * runtime/IntendedStructureChain.cpp:
1710             (JSC::IntendedStructureChain::mayInterceptStoreTo):
1711             * runtime/JSCJSValue.cpp:
1712             (JSC::JSValue::putToPrimitive):
1713             * runtime/JSGlobalObject.cpp:
1714             (JSC::JSGlobalObject::reset):
1715             * runtime/JSObject.cpp:
1716             (JSC::JSObject::put):
1717             (JSC::JSObject::putDirectNonIndexAccessor):
1718             (JSC::JSObject::deleteProperty):
1719             (JSC::JSObject::defaultValue):
1720             (JSC::getCallableObjectSlow): Deleted.
1721             (JSC::JSObject::getPropertySpecificValue): Deleted.
1722             * runtime/JSObject.h:
1723             (JSC::JSObject::getDirect):
1724             (JSC::JSObject::getDirectOffset):
1725             (JSC::JSObject::inlineGetOwnPropertySlot):
1726             (JSC::JSObject::putDirectInternal):
1727             (JSC::JSObject::putOwnDataProperty):
1728             (JSC::JSObject::putDirect):
1729             (JSC::JSObject::putDirectWithoutTransition):
1730             (JSC::getCallableObject): Deleted.
1731             * runtime/JSScope.cpp:
1732             (JSC::abstractAccess):
1733             * runtime/PropertyMapHashTable.h:
1734             (JSC::PropertyMapEntry::PropertyMapEntry):
1735             (JSC::PropertyTable::copy):
1736             * runtime/PropertyTable.cpp:
1737             (JSC::PropertyTable::clone):
1738             (JSC::PropertyTable::PropertyTable):
1739             (JSC::PropertyTable::visitChildren): Deleted.
1740             * runtime/Structure.cpp:
1741             (JSC::Structure::Structure):
1742             (JSC::Structure::materializePropertyMap):
1743             (JSC::Structure::addPropertyTransitionToExistingStructureImpl):
1744             (JSC::Structure::addPropertyTransitionToExistingStructure):
1745             (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently):
1746             (JSC::Structure::addPropertyTransition):
1747             (JSC::Structure::changePrototypeTransition):
1748             (JSC::Structure::attributeChangeTransition):
1749             (JSC::Structure::toDictionaryTransition):
1750             (JSC::Structure::preventExtensionsTransition):
1751             (JSC::Structure::takePropertyTableOrCloneIfPinned):
1752             (JSC::Structure::nonPropertyTransition):
1753             (JSC::Structure::addPropertyWithoutTransition):
1754             (JSC::Structure::allocateRareData):
1755             (JSC::Structure::ensurePropertyReplacementWatchpointSet):
1756             (JSC::Structure::startWatchingPropertyForReplacements):
1757             (JSC::Structure::didCachePropertyReplacement):
1758             (JSC::Structure::startWatchingInternalProperties):
1759             (JSC::Structure::copyPropertyTable):
1760             (JSC::Structure::copyPropertyTableForPinning):
1761             (JSC::Structure::getConcurrently):
1762             (JSC::Structure::get):
1763             (JSC::Structure::add):
1764             (JSC::Structure::visitChildren):
1765             (JSC::Structure::prototypeChainMayInterceptStoreTo):
1766             (JSC::Structure::dump):
1767             (JSC::Structure::despecifyDictionaryFunction): Deleted.
1768             (JSC::Structure::despecifyFunctionTransition): Deleted.
1769             (JSC::Structure::despecifyFunction): Deleted.
1770             (JSC::Structure::despecifyAllFunctions): Deleted.
1771             (JSC::Structure::putSpecificValue): Deleted.
1772             * runtime/Structure.h:
1773             (JSC::Structure::startWatchingPropertyForReplacements):
1774             (JSC::Structure::startWatchingInternalPropertiesIfNecessary):
1775             (JSC::Structure::startWatchingInternalPropertiesIfNecessaryForEntireChain):
1776             (JSC::Structure::transitionDidInvolveSpecificValue): Deleted.
1777             (JSC::Structure::disableSpecificFunctionTracking): Deleted.
1778             * runtime/StructureInlines.h:
1779             (JSC::Structure::getConcurrently):
1780             (JSC::Structure::didReplaceProperty):
1781             (JSC::Structure::propertyReplacementWatchpointSet):
1782             * runtime/StructureRareData.cpp:
1783             (JSC::StructureRareData::destroy):
1784             * runtime/StructureRareData.h:
1785             * tests/stress/infer-constant-global-property.js: Added.
1786             (foo.Math.sin):
1787             (foo):
1788             * tests/stress/infer-constant-property.js: Added.
1789             (foo):
1790             * tests/stress/jit-cache-poly-replace-then-cache-get-and-fold-then-invalidate.js: Added.
1791             (foo):
1792             (bar):
1793             * tests/stress/jit-cache-replace-then-cache-get-and-fold-then-invalidate.js: Added.
1794             (foo):
1795             (bar):
1796             * tests/stress/jit-put-to-scope-global-cache-watchpoint-invalidate.js: Added.
1797             (foo):
1798             (bar):
1799             * tests/stress/llint-cache-replace-then-cache-get-and-fold-then-invalidate.js: Added.
1800             (foo):
1801             (bar):
1802             * tests/stress/llint-put-to-scope-global-cache-watchpoint-invalidate.js: Added.
1803             (foo):
1804             (bar):
1805             * tests/stress/repeat-put-to-scope-global-with-same-value-watchpoint-invalidate.js: Added.
1806             (foo):
1807             (bar):
1808     
1809     2014-07-03  Saam Barati  <sbarati@apple.com>
1810     
1811             Add more coverage for the profile_types_with_high_fidelity op code.
1812             https://bugs.webkit.org/show_bug.cgi?id=134616
1813     
1814             Reviewed by Filip Pizlo.
1815     
1816             More operations are now being recorded by the profile_types_with_high_fidelity 
1817             opcode. Specifically: function parameters, function return values,
1818             function 'this' value, get_by_id, get_by_value, resolve nodes, function return 
1819             values at the call site. Added more flags to the profile_types_with_high_fidelity
1820             opcode so more focused tasks can take place when the instruction is
1821             being linked in CodeBlock. Re-worked the type profiler to search 
1822             through character offset ranges when asked for the type of an expression
1823             at a given offset. Removed redundant calls to Structure::toStructureShape
1824             in HighFidelityLog and TypeSet by caching calls based on StructureID.
1825     
1826             * bytecode/BytecodeList.json:
1827             * bytecode/BytecodeUseDef.h:
1828             (JSC::computeUsesForBytecodeOffset):
1829             (JSC::computeDefsForBytecodeOffset):
1830             * bytecode/CodeBlock.cpp:
1831             (JSC::CodeBlock::CodeBlock):
1832             (JSC::CodeBlock::finalizeUnconditionally):
1833             (JSC::CodeBlock::scopeDependentProfile):
1834             * bytecode/CodeBlock.h:
1835             (JSC::CodeBlock::returnStatementTypeSet):
1836             * bytecode/TypeLocation.h:
1837             * bytecode/UnlinkedCodeBlock.cpp:
1838             (JSC::UnlinkedCodeBlock::highFidelityTypeProfileExpressionInfoForBytecodeOffset):
1839             (JSC::UnlinkedCodeBlock::addHighFidelityTypeProfileExpressionInfo):
1840             * bytecode/UnlinkedCodeBlock.h:
1841             * bytecompiler/BytecodeGenerator.cpp:
1842             (JSC::BytecodeGenerator::emitMove):
1843             (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity):
1844             (JSC::BytecodeGenerator::emitGetFromScopeWithProfile):
1845             (JSC::BytecodeGenerator::emitPutToScope):
1846             (JSC::BytecodeGenerator::emitPutToScopeWithProfile):
1847             (JSC::BytecodeGenerator::emitPutById):
1848             (JSC::BytecodeGenerator::emitPutByVal):
1849             * bytecompiler/BytecodeGenerator.h:
1850             (JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo):
1851             * bytecompiler/NodesCodegen.cpp:
1852             (JSC::ResolveNode::emitBytecode):
1853             (JSC::BracketAccessorNode::emitBytecode):
1854             (JSC::DotAccessorNode::emitBytecode):
1855             (JSC::FunctionCallValueNode::emitBytecode):
1856             (JSC::FunctionCallResolveNode::emitBytecode):
1857             (JSC::FunctionCallBracketNode::emitBytecode):
1858             (JSC::FunctionCallDotNode::emitBytecode):
1859             (JSC::CallFunctionCallDotNode::emitBytecode):
1860             (JSC::ApplyFunctionCallDotNode::emitBytecode):
1861             (JSC::PostfixNode::emitResolve):
1862             (JSC::PostfixNode::emitBracket):
1863             (JSC::PostfixNode::emitDot):
1864             (JSC::PrefixNode::emitResolve):
1865             (JSC::PrefixNode::emitBracket):
1866             (JSC::PrefixNode::emitDot):
1867             (JSC::ReadModifyResolveNode::emitBytecode):
1868             (JSC::AssignResolveNode::emitBytecode):
1869             (JSC::AssignDotNode::emitBytecode):
1870             (JSC::ReadModifyDotNode::emitBytecode):
1871             (JSC::AssignBracketNode::emitBytecode):
1872             (JSC::ReadModifyBracketNode::emitBytecode):
1873             (JSC::ReturnNode::emitBytecode):
1874             (JSC::FunctionBodyNode::emitBytecode):
1875             * inspector/agents/InspectorRuntimeAgent.cpp:
1876             (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableAtOffset):
1877             (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange): Deleted.
1878             * inspector/agents/InspectorRuntimeAgent.h:
1879             * inspector/protocol/Runtime.json:
1880             * llint/LLIntSlowPaths.cpp:
1881             (JSC::LLInt::getFromScopeCommon):
1882             (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1883             * llint/LLIntSlowPaths.h:
1884             * llint/LowLevelInterpreter.asm:
1885             * runtime/HighFidelityLog.cpp:
1886             (JSC::HighFidelityLog::processHighFidelityLog):
1887             (JSC::HighFidelityLog::actuallyProcessLogThreadFunction):
1888             (JSC::HighFidelityLog::recordTypeInformationForLocation): Deleted.
1889             * runtime/HighFidelityLog.h:
1890             (JSC::HighFidelityLog::recordTypeInformationForLocation):
1891             * runtime/HighFidelityTypeProfiler.cpp:
1892             (JSC::HighFidelityTypeProfiler::getTypesForVariableInAtOffset):
1893             (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableAtOffset):
1894             (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableAtOffset):
1895             (JSC::HighFidelityTypeProfiler::insertNewLocation):
1896             (JSC::HighFidelityTypeProfiler::findLocation):
1897             (JSC::HighFidelityTypeProfiler::getTypesForVariableInRange): Deleted.
1898             (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableInRange): Deleted.
1899             (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableInRange): Deleted.
1900             (JSC::HighFidelityTypeProfiler::getLocationBasedHash): Deleted.
1901             * runtime/HighFidelityTypeProfiler.h:
1902             (JSC::LocationKey::LocationKey): Deleted.
1903             (JSC::LocationKey::hash): Deleted.
1904             (JSC::LocationKey::operator==): Deleted.
1905             * runtime/Structure.cpp:
1906             (JSC::Structure::toStructureShape):
1907             * runtime/Structure.h:
1908             * runtime/TypeSet.cpp:
1909             (JSC::TypeSet::TypeSet):
1910             (JSC::TypeSet::addTypeForValue):
1911             (JSC::TypeSet::seenTypes):
1912             (JSC::TypeSet::removeDuplicatesInStructureHistory): Deleted.
1913             * runtime/TypeSet.h:
1914             (JSC::StructureShape::setConstructorName):
1915             * runtime/VM.cpp:
1916             (JSC::VM::getTypesForVariableAtOffset):
1917             (JSC::VM::dumpHighFidelityProfilingTypes):
1918             (JSC::VM::getTypesForVariableInRange): Deleted.
1919             * runtime/VM.h:
1920     
1921     2014-07-04  Filip Pizlo  <fpizlo@apple.com>
1922     
1923             [ftlopt][REGRESSION] debug tests fail because PutByIdDirect is now implemented in terms of In
1924             https://bugs.webkit.org/show_bug.cgi?id=134642
1925     
1926             Rubber stamped by Andreas Kling.
1927     
1928             * ftl/FTLLowerDFGToLLVM.cpp:
1929             (JSC::FTL::LowerDFGToLLVM::compileNode):
1930     
1931     2014-07-01  Filip Pizlo  <fpizlo@apple.com>
1932     
1933             [ftlopt] Allocate a new GetterSetter if we change the value of any of its entries other than when they were previously null, so that if we constant-infer an accessor slot then we immediately get the function constant for free
1934             https://bugs.webkit.org/show_bug.cgi?id=134518
1935     
1936             Reviewed by Mark Hahnenberg.
1937             
1938             This has no real effect right now, particularly since almost all uses of
1939             setSetter/setGetter were already allocating a branch new GetterSetter. But once we start
1940             doing more aggressive constant property inference, this change will allow us to remove
1941             all runtime checks from getter/setter calls.
1942     
1943             * runtime/GetterSetter.cpp:
1944             (JSC::GetterSetter::withGetter):
1945             (JSC::GetterSetter::withSetter):
1946             * runtime/GetterSetter.h:
1947             (JSC::GetterSetter::setGetter):
1948             (JSC::GetterSetter::setSetter):
1949             * runtime/JSObject.cpp:
1950             (JSC::JSObject::defineOwnNonIndexProperty):
1951     
1952     2014-07-02  Filip Pizlo  <fpizlo@apple.com>
1953     
1954             [ftlopt] Rename notifyTransitionFromThisStructure to didTransitionFromThisStructure
1955     
1956             Rubber stamped by Mark Hahnenberg.
1957     
1958             * runtime/Structure.cpp:
1959             (JSC::Structure::Structure):
1960             (JSC::Structure::nonPropertyTransition):
1961             (JSC::Structure::didTransitionFromThisStructure):
1962             (JSC::Structure::notifyTransitionFromThisStructure): Deleted.
1963             * runtime/Structure.h:
1964     
1965     2014-07-02  Filip Pizlo  <fpizlo@apple.com>
1966     
1967             [ftlopt] Remove the functionality for cloning StructureRareData since we never do that anymore.
1968     
1969             Rubber stamped by Mark Hahnenberg.
1970     
1971             * runtime/Structure.cpp:
1972             (JSC::Structure::Structure):
1973             (JSC::Structure::cloneRareDataFrom): Deleted.
1974             * runtime/Structure.h:
1975             * runtime/StructureRareData.cpp:
1976             (JSC::StructureRareData::clone): Deleted.
1977             (JSC::StructureRareData::StructureRareData): Deleted.
1978             * runtime/StructureRareData.h:
1979             (JSC::StructureRareData::needsCloning): Deleted.
1980     
1981     2014-07-01  Mark Lam  <mark.lam@apple.com>
1982     
1983             [ftlopt] DebuggerCallFrame::scope() should return a DebuggerScope.
1984             <https://webkit.org/b/134420>
1985     
1986             Reviewed by Geoffrey Garen.
1987     
1988             Previously, DebuggerCallFrame::scope() returns a JSActivation (and relevant
1989             peers) which the WebInspector will use to introspect CallFrame variables.
1990             Instead, we should be returning a DebuggerScope as an abstraction layer that
1991             provides the introspection functionality that the WebInspector needs.  This
1992             is the first step towards not forcing every frame to have a JSActivation
1993             object just because the debugger is enabled.
1994     
1995             1. Instantiate the debuggerScopeStructure as a member of the JSGlobalObject
1996                instead of the VM.  This allows JSObject::globalObject() to be able to
1997                return the global object for the DebuggerScope.
1998     
1999             2. On the DebuggerScope's life-cycle management:
2000     
2001                The DebuggerCallFrame is designed to be "valid" only during a debugging session
2002                (while the debugger is broken) through the use of a DebuggerCallFrameScope in
2003                Debugger::pauseIfNeeded().  Once the debugger resumes from the break, the
2004                DebuggerCallFrameScope destructs, and the DebuggerCallFrame will be invalidated.
2005                We can't guarantee (from this code alone) that the Inspector code isn't still
2006                holding a ref to the DebuggerCallFrame (though they shouldn't), but by contract,
2007                the frame will be invalidated, and any attempt to query it will return null values.
2008                This is pre-existing behavior.
2009     
2010                Now, we're adding the DebuggerScope into the picture.  While a single debugger
2011                pause session is in progress, the Inspector may request the scope from the
2012                DebuggerCallFrame.  While the DebuggerCallFrame is still valid, we want
2013                DebuggerCallFrame::scope() to always return the same DebuggerScope object.
2014                This is why we hold on to the DebuggerScope with a strong ref.
2015     
2016                If we use a weak ref instead, the following cooky behavior can manifest:
2017                1. The Inspector calls Debugger::scope() to get the top scope.
2018                2. The Inspector iterates down the scope chain and is now only holding a
2019                   reference to a parent scope.  It is no longer referencing the top scope.
2020                3. A GC occurs, and the DebuggerCallFrame's weak m_scope ref to the top scope
2021                   gets cleared.
2022                4. The Inspector calls DebuggerCallFrame::scope() to get the top scope again but gets
2023                   a different DebuggerScope instance.
2024                5. The Inspector iterates down the scope chain but never sees the parent scope
2025                   instance that retained a ref to in step 2 above.  This is because when iterating
2026                   this new DebuggerScope instance (which has no knowledge of the previous parent
2027                   DebuggerScope instance), a new DebuggerScope instance will get created for the
2028                   same parent scope. 
2029     
2030                Since the DebuggerScope is a JSObject, it's liveness is determined by its reachability.
2031                However, it's "validity" is determined by the life-cycle of its owner DebuggerCallFrame.
2032                When the owner DebuggerCallFrame gets invalidated, its debugger scope chain (if
2033                instantiated) will also get invalidated.  This is why we need the
2034                DebuggerScope::invalidateChain() method.  The Inspector should not be using the
2035                DebuggerScope instance after its owner DebuggerCallFrame is invalidated.  If it does,
2036                those methods will do nothing or returned a failed status.
2037     
2038             * debugger/Debugger.h:
2039             * debugger/DebuggerCallFrame.cpp:
2040             (JSC::DebuggerCallFrame::scope):
2041             (JSC::DebuggerCallFrame::evaluate):
2042             (JSC::DebuggerCallFrame::invalidate):
2043             (JSC::DebuggerCallFrame::vm):
2044             (JSC::DebuggerCallFrame::lexicalGlobalObject):
2045             * debugger/DebuggerCallFrame.h:
2046             * debugger/DebuggerScope.cpp:
2047             (JSC::DebuggerScope::DebuggerScope):
2048             (JSC::DebuggerScope::finishCreation):
2049             (JSC::DebuggerScope::visitChildren):
2050             (JSC::DebuggerScope::className):
2051             (JSC::DebuggerScope::getOwnPropertySlot):
2052             (JSC::DebuggerScope::put):
2053             (JSC::DebuggerScope::deleteProperty):
2054             (JSC::DebuggerScope::getOwnPropertyNames):
2055             (JSC::DebuggerScope::defineOwnProperty):
2056             (JSC::DebuggerScope::next):
2057             (JSC::DebuggerScope::invalidateChain):
2058             (JSC::DebuggerScope::isWithScope):
2059             (JSC::DebuggerScope::isGlobalScope):
2060             (JSC::DebuggerScope::isFunctionScope):
2061             * debugger/DebuggerScope.h:
2062             (JSC::DebuggerScope::create):
2063             (JSC::DebuggerScope::Iterator::Iterator):
2064             (JSC::DebuggerScope::Iterator::get):
2065             (JSC::DebuggerScope::Iterator::operator++):
2066             (JSC::DebuggerScope::Iterator::operator==):
2067             (JSC::DebuggerScope::Iterator::operator!=):
2068             (JSC::DebuggerScope::isValid):
2069             (JSC::DebuggerScope::jsScope):
2070             (JSC::DebuggerScope::begin):
2071             (JSC::DebuggerScope::end):
2072             * inspector/JSJavaScriptCallFrame.cpp:
2073             (Inspector::JSJavaScriptCallFrame::scopeType):
2074             (Inspector::JSJavaScriptCallFrame::scopeChain):
2075             * inspector/JavaScriptCallFrame.h:
2076             (Inspector::JavaScriptCallFrame::scopeChain):
2077             * inspector/ScriptDebugServer.cpp:
2078             * runtime/JSGlobalObject.cpp:
2079             (JSC::JSGlobalObject::reset):
2080             (JSC::JSGlobalObject::visitChildren):
2081             * runtime/JSGlobalObject.h:
2082             (JSC::JSGlobalObject::debuggerScopeStructure):
2083             * runtime/JSObject.h:
2084             (JSC::JSObject::isWithScope):
2085             * runtime/JSScope.h:
2086             * runtime/VM.cpp:
2087             (JSC::VM::VM):
2088             * runtime/VM.h:
2089     
2090     2014-07-01  Filip Pizlo  <fpizlo@apple.com>
2091     
2092             [ftlopt] DFG bytecode parser should turn PutById with nothing but a Setter stub as stuff+handleCall, and handleCall should be allowed to inline if it wants to
2093             https://bugs.webkit.org/show_bug.cgi?id=130756
2094     
2095             Reviewed by Oliver Hunt.
2096             
2097             The enables exposing the call to setters in the DFG, and then inlining it. Previously we
2098             already supproted inlined-cached calls to setters from within put_by_id inline caches,
2099             and the DFG could certainly emit such IC's. Now, if an IC had a setter call, then the DFG
2100             will either emit the GetGetterSetterByOffset/GetSetter/Call combo, or it will do one
2101             better and inline the call.
2102             
2103             A lot of the core functionality was already available from the previous work to inline
2104             getters. So, there are some refactorings in this patch that move preexisting
2105             functionality around. For example, the work to figure out how the DFG should go about
2106             getting to what we call the "loaded value" - i.e. the GetterSetter object reference in
2107             the case of accessors - is now shared in ComplexGetStatus, and both GetByIdStatus and
2108             PutByIdStatus use it. This means that we can keep the safety checks common.  This patch
2109             also does additional refactorings in DFG::ByteCodeParser so that we can continue to reuse
2110             handleCall() for all of the various kinds of calls we can now emit.
2111             
2112             83% speed-up on getter-richards, 2% speed-up on box2d.
2113     
2114             * CMakeLists.txt:
2115             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2116             * JavaScriptCore.xcodeproj/project.pbxproj:
2117             * bytecode/ComplexGetStatus.cpp: Added.
2118             (JSC::ComplexGetStatus::computeFor):
2119             * bytecode/ComplexGetStatus.h: Added.
2120             (JSC::ComplexGetStatus::ComplexGetStatus):
2121             (JSC::ComplexGetStatus::skip):
2122             (JSC::ComplexGetStatus::takesSlowPath):
2123             (JSC::ComplexGetStatus::kind):
2124             (JSC::ComplexGetStatus::attributes):
2125             (JSC::ComplexGetStatus::specificValue):
2126             (JSC::ComplexGetStatus::offset):
2127             (JSC::ComplexGetStatus::chain):
2128             * bytecode/GetByIdStatus.cpp:
2129             (JSC::GetByIdStatus::computeForStubInfo):
2130             * bytecode/GetByIdVariant.cpp:
2131             (JSC::GetByIdVariant::GetByIdVariant):
2132             * bytecode/PolymorphicPutByIdList.h:
2133             (JSC::PutByIdAccess::PutByIdAccess):
2134             (JSC::PutByIdAccess::setter):
2135             (JSC::PutByIdAccess::structure):
2136             (JSC::PutByIdAccess::chainCount):
2137             * bytecode/PutByIdStatus.cpp:
2138             (JSC::PutByIdStatus::computeFromLLInt):
2139             (JSC::PutByIdStatus::computeFor):
2140             (JSC::PutByIdStatus::computeForStubInfo):
2141             (JSC::PutByIdStatus::makesCalls):
2142             * bytecode/PutByIdStatus.h:
2143             (JSC::PutByIdStatus::makesCalls): Deleted.
2144             * bytecode/PutByIdVariant.cpp:
2145             (JSC::PutByIdVariant::PutByIdVariant):
2146             (JSC::PutByIdVariant::operator=):
2147             (JSC::PutByIdVariant::replace):
2148             (JSC::PutByIdVariant::transition):
2149             (JSC::PutByIdVariant::setter):
2150             (JSC::PutByIdVariant::writesStructures):
2151             (JSC::PutByIdVariant::reallocatesStorage):
2152             (JSC::PutByIdVariant::makesCalls):
2153             (JSC::PutByIdVariant::dumpInContext):
2154             * bytecode/PutByIdVariant.h:
2155             (JSC::PutByIdVariant::PutByIdVariant):
2156             (JSC::PutByIdVariant::structure):
2157             (JSC::PutByIdVariant::oldStructure):
2158             (JSC::PutByIdVariant::alternateBase):
2159             (JSC::PutByIdVariant::specificValue):
2160             (JSC::PutByIdVariant::callLinkStatus):
2161             (JSC::PutByIdVariant::replace): Deleted.
2162             (JSC::PutByIdVariant::transition): Deleted.
2163             * dfg/DFGByteCodeParser.cpp:
2164             (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
2165             (JSC::DFG::ByteCodeParser::addCall):
2166             (JSC::DFG::ByteCodeParser::handleCall):
2167             (JSC::DFG::ByteCodeParser::handleInlining):
2168             (JSC::DFG::ByteCodeParser::handleGetById):
2169             (JSC::DFG::ByteCodeParser::handlePutById):
2170             (JSC::DFG::ByteCodeParser::parseBlock):
2171             * jit/Repatch.cpp:
2172             (JSC::tryCachePutByID):
2173             (JSC::tryBuildPutByIdList):
2174             * runtime/IntendedStructureChain.cpp:
2175             (JSC::IntendedStructureChain::takesSlowPathInDFGForImpureProperty):
2176             * runtime/IntendedStructureChain.h:
2177             * tests/stress/exit-from-setter.js: Added.
2178             * tests/stress/poly-chain-setter.js: Added.
2179             (Cons):
2180             (foo):
2181             (test):
2182             * tests/stress/poly-chain-then-setter.js: Added.
2183             (Cons1):
2184             (Cons2):
2185             (foo):
2186             (test):
2187             * tests/stress/poly-setter-combo.js: Added.
2188             (Cons1):
2189             (Cons2):
2190             (foo):
2191             (test):
2192             (.test):
2193             * tests/stress/poly-setter-then-self.js: Added.
2194             (foo):
2195             (test):
2196             (.test):
2197             * tests/stress/weird-setter-counter.js: Added.
2198             (foo):
2199             (test):
2200             * tests/stress/weird-setter-counter-syntactic.js: Added.
2201             (foo):
2202             (test):
2203     
2204     2014-07-01  Matthew Mirman  <mmirman@apple.com>
2205     
2206             Added an implementation of the "in" check to FTL.
2207             https://bugs.webkit.org/show_bug.cgi?id=134508
2208     
2209             Reviewed by Filip Pizlo.
2210     
2211             * ftl/FTLCapabilities.cpp: enabled compilation for "in"
2212             (JSC::FTL::canCompile): ditto
2213             * ftl/FTLCompile.cpp:
2214             (JSC::FTL::generateCheckInICFastPath): added.
2215             (JSC::FTL::fixFunctionBasedOnStackMaps): added case for CheckIn descriptors.
2216             * ftl/FTLInlineCacheDescriptor.h:
2217             (JSC::FTL::CheckInGenerator::CheckInGenerator): added.
2218             (JSC::FTL::CheckInDescriptor::CheckInDescriptor): added.
2219             * ftl/FTLInlineCacheSize.cpp: 
2220             (JSC::FTL::sizeOfCheckIn): added. Currently larger than necessary.
2221             * ftl/FTLInlineCacheSize.h: ditto
2222             * ftl/FTLIntrinsicRepository.h: Added function type for operationInGeneric
2223             * ftl/FTLLowerDFGToLLVM.cpp: 
2224             (JSC::FTL::LowerDFGToLLVM::compileNode): added case for In.
2225             (JSC::FTL::LowerDFGToLLVM::compileIn): added.
2226             * ftl/FTLSlowPathCall.cpp: Added a callOperation for operationIn
2227             (JSC::FTL::callOperation): ditto
2228             * ftl/FTLSlowPathCall.h: ditto
2229             * ftl/FTLState.h: Added a vector to hold CheckIn descriptors.
2230             * jit/JITOperations.h: made operationIns internal.
2231             * tests/stress/ftl-checkin.js: Added.
2232             * tests/stress/ftl-checkin-variable.js: Added.
2233     
2234     2014-06-30  Mark Hahnenberg  <mhahnenberg@apple.com>
2235     
2236             CodeBlock::stronglyVisitWeakReferences should mark DFG::CommonData::weakStructureReferences
2237             https://bugs.webkit.org/show_bug.cgi?id=134455
2238     
2239             Reviewed by Geoffrey Garen.
2240     
2241             Otherwise we get hanging pointers which can cause us to die later.
2242     
2243             * bytecode/CodeBlock.cpp:
2244             (JSC::CodeBlock::stronglyVisitWeakReferences):
2245     
2246     2014-06-27  Filip Pizlo  <fpizlo@apple.com>
2247     
2248             [ftlopt] Reduce the GC's influence on optimization decisions
2249             https://bugs.webkit.org/show_bug.cgi?id=134427
2250     
2251             Reviewed by Oliver Hunt.
2252             
2253             This is a slight speed-up on some platforms, that arises from a bunch of fixes that I made
2254             while trying to make the GC keep more structures alive
2255             (https://bugs.webkit.org/show_bug.cgi?id=128072).
2256             
2257             The fixes are, roughly:
2258             
2259             - If the GC clears an inline cache, then this no longer causes the IC to be forever
2260               polymorphic.
2261             
2262             - If we exit in inlined code into a function that tries to OSR enter, then we jettison
2263               sooner.
2264             
2265             - Some variables being uninitialized led to rage-recompilations.
2266             
2267             This is a pretty strong step in the direction of keeping more Structures alive and not
2268             blowing away code just because a Structure died. But, it seems like there is still a slight
2269             speed-up to be had from blowing away code that references dead Structures.
2270     
2271             * bytecode/CodeBlock.cpp:
2272             (JSC::CodeBlock::dumpAssumingJITType):
2273             (JSC::shouldMarkTransition):
2274             (JSC::CodeBlock::propagateTransitions):
2275             (JSC::CodeBlock::determineLiveness):
2276             * bytecode/GetByIdStatus.cpp:
2277             (JSC::GetByIdStatus::computeForStubInfo):
2278             * bytecode/PutByIdStatus.cpp:
2279             (JSC::PutByIdStatus::computeForStubInfo):
2280             * dfg/DFGCapabilities.cpp:
2281             (JSC::DFG::isSupportedForInlining):
2282             (JSC::DFG::mightInlineFunctionForCall):
2283             (JSC::DFG::mightInlineFunctionForClosureCall):
2284             (JSC::DFG::mightInlineFunctionForConstruct):
2285             * dfg/DFGCapabilities.h:
2286             * dfg/DFGCommonData.h:
2287             * dfg/DFGDesiredWeakReferences.cpp:
2288             (JSC::DFG::DesiredWeakReferences::reallyAdd):
2289             * dfg/DFGOSREntry.cpp:
2290             (JSC::DFG::prepareOSREntry):
2291             * dfg/DFGOSRExitCompilerCommon.cpp:
2292             (JSC::DFG::handleExitCounts):
2293             * dfg/DFGOperations.cpp:
2294             * dfg/DFGOperations.h:
2295             * ftl/FTLForOSREntryJITCode.cpp:
2296             (JSC::FTL::ForOSREntryJITCode::ForOSREntryJITCode): These variables being uninitialized is benign in terms of correctness but can sometimes cause rage-recompilations. For some reason it took this patch to reveal this.
2297             * ftl/FTLOSREntry.cpp:
2298             (JSC::FTL::prepareOSREntry):
2299             * runtime/Executable.cpp:
2300             (JSC::ExecutableBase::destroy):
2301             (JSC::NativeExecutable::destroy):
2302             (JSC::ScriptExecutable::ScriptExecutable):
2303             (JSC::ScriptExecutable::destroy):
2304             (JSC::ScriptExecutable::installCode):
2305             (JSC::EvalExecutable::EvalExecutable):
2306             (JSC::ProgramExecutable::ProgramExecutable):
2307             * runtime/Executable.h:
2308             (JSC::ScriptExecutable::setDidTryToEnterInLoop):
2309             (JSC::ScriptExecutable::didTryToEnterInLoop):
2310             (JSC::ScriptExecutable::addressOfDidTryToEnterInLoop):
2311             (JSC::ScriptExecutable::ScriptExecutable): Deleted.
2312             * runtime/StructureInlines.h:
2313             (JSC::Structure::storedPrototypeObject):
2314             (JSC::Structure::storedPrototypeStructure):
2315     
2316     2014-06-25  Filip Pizlo  <fpizlo@apple.com>
2317     
2318             [ftlopt] If a CodeBlock is jettisoned due to a watchpoint then it should be possible to figure out something about that watchpoint
2319             https://bugs.webkit.org/show_bug.cgi?id=134333
2320     
2321             Reviewed by Geoffrey Garen.
2322             
2323             This is engineered to provide loads of information to the profiler without incurring any
2324             costs when the profiler is disabled. It's the oldest trick in the book: the thing that
2325             fires the watchpoint doesn't actually create anything to describe the reason why it was
2326             fired; instead it creates a stack-allocated FireDetail subclass instance. Only if the
2327             FireDetail::dump() virtual method is called does anything happen.
2328             
2329             Currently we use this to produce very fine-grained data for Structure watchpoints and
2330             some cases of variable watchpoints. For all other situations, the given reason is just a
2331             string constant, by using StringFireDetail. If we find a situation where that string
2332             constant is insufficient to diagnose an issue then we can change it to provide more
2333             fine-grained information.
2334     
2335             * JavaScriptCore.xcodeproj/project.pbxproj:
2336             * bytecode/CodeBlock.cpp:
2337             (JSC::CodeBlock::CodeBlock):
2338             (JSC::CodeBlock::jettison):
2339             * bytecode/CodeBlock.h:
2340             * bytecode/CodeBlockJettisoningWatchpoint.cpp:
2341             (JSC::CodeBlockJettisoningWatchpoint::fireInternal):
2342             * bytecode/CodeBlockJettisoningWatchpoint.h:
2343             * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp: Removed.
2344             * bytecode/ProfiledCodeBlockJettisoningWatchpoint.h: Removed.
2345             * bytecode/StructureStubClearingWatchpoint.cpp:
2346             (JSC::StructureStubClearingWatchpoint::fireInternal):
2347             * bytecode/StructureStubClearingWatchpoint.h:
2348             * bytecode/VariableWatchpointSet.h:
2349             (JSC::VariableWatchpointSet::invalidate):
2350             (JSC::VariableWatchpointSet::finalizeUnconditionally):
2351             * bytecode/VariableWatchpointSetInlines.h:
2352             (JSC::VariableWatchpointSet::notifyWrite):
2353             * bytecode/Watchpoint.cpp:
2354             (JSC::StringFireDetail::dump):
2355             (JSC::WatchpointSet::fireAll):
2356             (JSC::WatchpointSet::fireAllSlow):
2357             (JSC::WatchpointSet::fireAllWatchpoints):
2358             (JSC::InlineWatchpointSet::fireAll):
2359             * bytecode/Watchpoint.h:
2360             (JSC::FireDetail::FireDetail):
2361             (JSC::FireDetail::~FireDetail):
2362             (JSC::StringFireDetail::StringFireDetail):
2363             (JSC::Watchpoint::fire):
2364             (JSC::WatchpointSet::fireAll):
2365             (JSC::WatchpointSet::touch):
2366             (JSC::WatchpointSet::invalidate):
2367             (JSC::InlineWatchpointSet::fireAll):
2368             (JSC::InlineWatchpointSet::touch):
2369             * dfg/DFGCommonData.h:
2370             * dfg/DFGOperations.cpp:
2371             * interpreter/Interpreter.cpp:
2372             (JSC::Interpreter::execute):
2373             * jsc.cpp:
2374             (WTF::Masquerader::create):
2375             * profiler/ProfilerCompilation.cpp:
2376             (JSC::Profiler::Compilation::setJettisonReason):
2377             (JSC::Profiler::Compilation::toJS):
2378             * profiler/ProfilerCompilation.h:
2379             (JSC::Profiler::Compilation::setJettisonReason): Deleted.
2380             * runtime/ArrayBuffer.cpp:
2381             (JSC::ArrayBuffer::transfer):
2382             * runtime/ArrayBufferNeuteringWatchpoint.cpp:
2383             (JSC::ArrayBufferNeuteringWatchpoint::fireAll):
2384             * runtime/ArrayBufferNeuteringWatchpoint.h:
2385             * runtime/CommonIdentifiers.h:
2386             * runtime/CommonSlowPaths.cpp:
2387             (JSC::SLOW_PATH_DECL):
2388             * runtime/Identifier.cpp:
2389             (JSC::Identifier::dump):
2390             * runtime/Identifier.h:
2391             * runtime/JSFunction.cpp:
2392             (JSC::JSFunction::put):
2393             (JSC::JSFunction::defineOwnProperty):
2394             * runtime/JSGlobalObject.cpp:
2395             (JSC::JSGlobalObject::addFunction):
2396             (JSC::JSGlobalObject::haveABadTime):
2397             * runtime/JSSymbolTableObject.cpp:
2398             (JSC::VariableWriteFireDetail::dump):
2399             * runtime/JSSymbolTableObject.h:
2400             (JSC::VariableWriteFireDetail::VariableWriteFireDetail):
2401             (JSC::symbolTablePut):
2402             (JSC::symbolTablePutWithAttributes):
2403             * runtime/PropertyName.h:
2404             (JSC::PropertyName::dump):
2405             * runtime/Structure.cpp:
2406             (JSC::Structure::notifyTransitionFromThisStructure):
2407             * runtime/Structure.h:
2408             (JSC::Structure::notifyTransitionFromThisStructure): Deleted.
2409             * runtime/SymbolTable.cpp:
2410             (JSC::SymbolTableEntry::notifyWriteSlow):
2411             (JSC::SymbolTable::WatchpointCleanup::finalizeUnconditionally):
2412             * runtime/SymbolTable.h:
2413             (JSC::SymbolTableEntry::notifyWrite):
2414             * runtime/VM.cpp:
2415             (JSC::VM::addImpureProperty):
2416     
2417 2014-08-05  Commit Queue  <commit-queue@webkit.org>
2418
2419         Unreviewed, rolling out r172099.
2420         https://bugs.webkit.org/show_bug.cgi?id=135635
2421
2422         Needs a do-over. (Requested by kling on #webkit).
2423
2424         Reverted changeset:
2425
2426         "The JIT should cache property lookup misses."
2427         https://bugs.webkit.org/show_bug.cgi?id=135578
2428         http://trac.webkit.org/changeset/172099
2429
2430 2014-08-05  Przemyslaw Kuczynski  <p.kuczynski@samsung.com>
2431
2432         Fix resource leak of unclosed file descriptor.
2433         https://bugs.webkit.org/show_bug.cgi?id=135417
2434
2435         Reviewed by Darin Adler.
2436
2437         When open returns zero, fd handle leaks. Checking (fd > 0) needs to be replaced
2438         with (fd != -1).
2439
2440         * assembler/MacroAssemblerARM.cpp:
2441         (JSC::isVFPPresent):
2442
2443 2014-08-05  Andreas Kling  <akling@apple.com>
2444
2445         The JIT should cache property lookup misses.
2446         <https://webkit.org/b/135578>
2447
2448         Add support for inline caching of object properties that don't exist.
2449         Previously we'd fall back to the C++ slow-path whenever a property was missing.
2450
2451         It's implemented as a simple GetById-style stub that returns jsUndefined() as
2452         long as the Structure chain check passes.
2453
2454         10x speedup on the included microbenchmark.
2455
2456         Reviewed by Geoffrey Garen.
2457
2458         * jit/Repatch.cpp:
2459         (JSC::toString):
2460         (JSC::kindFor):
2461         (JSC::generateByIdStub):
2462         (JSC::tryCacheGetByID):
2463         (JSC::patchJumpToGetByIdStub):
2464         * runtime/PropertySlot.h:
2465         (JSC::PropertySlot::isUnset):
2466
2467 2014-08-05  Commit Queue  <commit-queue@webkit.org>
2468
2469         Unreviewed, rolling out r172009.
2470         https://bugs.webkit.org/show_bug.cgi?id=135627
2471
2472         "Commit landed on trunk instead of ftlopt branch." (Requested
2473         by saamyjoon on #webkit).
2474
2475         Reverted changeset:
2476
2477         "Create a more generic way for VMEntryScope to notify those
2478         interested that it will be destroyed"
2479         https://bugs.webkit.org/show_bug.cgi?id=135358
2480         http://trac.webkit.org/changeset/172009
2481
2482 2014-08-05  Alex Christensen  <achristensen@webkit.org>
2483
2484         More work on CMake.
2485         https://bugs.webkit.org/show_bug.cgi?id=135620
2486
2487         Reviewed by Laszlo Gombos.
2488
2489         * CMakeLists.txt:
2490         Added missing source files.
2491         * PlatformEfl.cmake:
2492         * PlatformGTK.cmake:
2493         Include glib directories and libraries to find glib.h in EventLoop.cpp.
2494         * PlatformMac.cmake:
2495         Moved STATICALLY_LINKED_WITH_WTF definition away from the common CMakeLists
2496         because it should not be defined on Windows.
2497         Added remote inspector source files.
2498
2499 2014-08-05  Peyton Randolph  <prandolph@apple.com>
2500
2501         Rename MAC_LONG_PRESS feature flag to LONG_MOUSE_PRESS.
2502         https://bugs.webkit.org/show_bug.cgi?id=135276
2503
2504         Reviewed by Beth Dakin.
2505
2506         * Configurations/FeatureDefines.xcconfig:
2507
2508 2014-08-04  Benjamin Poulain  <benjamin@webkit.org>
2509
2510         Add a flag for the CSS Selectors level 4 implementation
2511         https://bugs.webkit.org/show_bug.cgi?id=135535
2512
2513         Reviewed by Andreas Kling.
2514
2515         * Configurations/FeatureDefines.xcconfig:
2516
2517 2014-08-04  Alex Christensen  <achristensen@webkit.org>
2518
2519         Progress towards CMake on Mac.
2520         https://bugs.webkit.org/show_bug.cgi?id=135528
2521
2522         Reviewed by Gyuyoung Kim.
2523
2524         * CMakeLists.txt:
2525         Include necessary directories and copy all necessary forwarding headers.
2526         Only compile UDis86Disassembler.cpp if we're using UDIS86.
2527         * PlatformMac.cmake: Added.
2528         * tools/CodeProfiling.cpp:
2529         Compile fix.  Include sys/time.h on darwin, too.
2530
2531 2014-08-04  Saam Barati  <sbarati@apple.com>
2532
2533         Create a more generic way for VMEntryScope to notify those interested that it will be destroyed
2534         https://bugs.webkit.org/show_bug.cgi?id=135358
2535
2536         Reviewed by Geoffrey Garen.
2537
2538         When VMEntryScope is destroyed, and it has a flag set indicating that the
2539         Debugger needs to recompile all functions, it calls Debugger::recompileAllJSFunctions. 
2540         This flag is only used by Debugger to have VMEntryScope notify it when the
2541         Debugger is safe to recompile all functions. This patch will substitute this
2542         Debugger-specific recompilation flag with a list of callbacks that are notified 
2543         when the outermost VMEntryScope dies. This creates a general purpose interface 
2544         for being notified when the VM stops executing code via the event of the outermost 
2545         VMEntryScope dying.
2546
2547         * debugger/Debugger.cpp:
2548         (JSC::Debugger::recompileAllJSFunctions):
2549         * runtime/VMEntryScope.cpp:
2550         (JSC::VMEntryScope::VMEntryScope):
2551         (JSC::VMEntryScope::addEntryScopeDidPopListener):
2552         (JSC::VMEntryScope::~VMEntryScope):
2553         * runtime/VMEntryScope.h:
2554         (JSC::VMEntryScope::setRecompilationNeeded): Deleted.
2555
2556 2014-08-01  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2557
2558         REGRESSION(r171942): [CMAKE] [GTK] build broken (clean build).
2559         https://bugs.webkit.org/show_bug.cgi?id=135522
2560
2561         Reviewed by Martin Robinson.
2562
2563         * CMakeLists.txt: Output the inspector headers inside inspector
2564         subdirectory.
2565
2566 2014-08-01  Mark Lam  <mark.lam@apple.com>
2567
2568         Add some structure related assertions.
2569         <https://webkit.org/b/135523>
2570
2571         Reviewed by Geoffrey Garen.
2572
2573         Adding 2 assertions:
2574         1. assert that we don't index pass the end of the StructureIDTable.
2575            This should never happen, but this assertion will help catch bugs
2576            where a bad structureID gets passed in.
2577         2. assert that cells in MarkedBlock::callDestructor() that are not
2578            zapped should have a non-null StructureID.  This will help us catch
2579            bugs where the other cell header flag bits get set after the cell is
2580            zapped, thereby making the cell look like an unzapped cell but has a
2581            null structureID.
2582
2583         * heap/MarkedBlock.cpp:
2584         (JSC::MarkedBlock::callDestructor):
2585         * runtime/StructureIDTable.h:
2586         (JSC::StructureIDTable::get):
2587
2588 2014-08-01  Csaba Osztrogonác  <ossy@webkit.org>
2589
2590         URTBF after r171946 to fix non-Apple builds.
2591
2592         * bytecode/InlineCallFrameSet.cpp:
2593
2594 2014-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
2595
2596         CodeBlock fails to visit the Executables of its InlineCallFrames
2597         https://bugs.webkit.org/show_bug.cgi?id=135471
2598
2599         Reviewed by Geoffrey Garen.
2600
2601         CodeBlock needs to visit its InlineCallFrames' owner Executables. If it doesn't, they 
2602         can be prematurely collected and cause crashes.
2603
2604         * bytecode/CodeBlock.cpp:
2605         (JSC::CodeBlock::stronglyVisitStrongReferences):
2606         * bytecode/CodeOrigin.h:
2607         (JSC::InlineCallFrame::visitAggregate):
2608         * bytecode/InlineCallFrameSet.cpp:
2609         (JSC::InlineCallFrameSet::visitAggregate):
2610         * bytecode/InlineCallFrameSet.h:
2611
2612 2014-08-01  Alex Christensen  <achristensen@webkit.org>
2613
2614         Progress towards cmake on Windows.
2615         https://bugs.webkit.org/show_bug.cgi?id=135484
2616
2617         Reviewed by Martin Robinson.
2618
2619         * CMakeLists.txt:
2620         Generate code directly to inspector directory to avoid using the cp command
2621         which is not available on Windows.
2622         * PlatformWin.cmake: Added.
2623
2624 2014-07-31  Andreas Kling  <akling@apple.com>
2625
2626         Remove the JSC::OverridesVisitChildren flag.
2627         <https://webkit.org/b/135489>
2628
2629         Except for 3 special classes, the visitChildren() call is always
2630         dispatched through the method table (see SlotVisitor.cpp.)
2631
2632         The OverridesVisitChildren flag doesn't actually do anything.
2633         It could be used to implement a non-virtual direct call to
2634         JSCell::visitChildren, bypassing the method table for some objects,
2635         but such a micro-optimization seems like a weak trade for all this
2636         code complexity. Instead, just remove the flag.
2637
2638         This change frees up an inline flag bit in JSCell.
2639
2640         Reviewed by Geoffrey Garen.
2641
2642         * API/JSAPIWrapperObject.h:
2643         * API/JSAPIWrapperObject.mm:
2644         (JSC::JSAPIWrapperObject::visitChildren):
2645         * API/JSCallbackObject.h:
2646         (JSC::JSCallbackObject::visitChildren):
2647         * bytecode/UnlinkedCodeBlock.cpp:
2648         (JSC::UnlinkedFunctionExecutable::visitChildren):
2649         (JSC::UnlinkedCodeBlock::visitChildren):
2650         (JSC::UnlinkedProgramCodeBlock::visitChildren):
2651         * bytecode/UnlinkedCodeBlock.h:
2652         * debugger/DebuggerScope.cpp:
2653         (JSC::DebuggerScope::visitChildren):
2654         * debugger/DebuggerScope.h:
2655         * jsc.cpp:
2656         * runtime/Arguments.cpp:
2657         (JSC::Arguments::visitChildren):
2658         * runtime/Arguments.h:
2659         * runtime/Executable.cpp:
2660         (JSC::EvalExecutable::visitChildren):
2661         (JSC::ProgramExecutable::visitChildren):
2662         (JSC::FunctionExecutable::visitChildren):
2663         * runtime/Executable.h:
2664         * runtime/GetterSetter.cpp:
2665         (JSC::GetterSetter::visitChildren):
2666         * runtime/GetterSetter.h:
2667         (JSC::GetterSetter::createStructure):
2668         * runtime/JSAPIValueWrapper.h:
2669         (JSC::JSAPIValueWrapper::createStructure):
2670         * runtime/JSActivation.cpp:
2671         (JSC::JSActivation::visitChildren):
2672         * runtime/JSActivation.h:
2673         * runtime/JSArrayIterator.cpp:
2674         (JSC::JSArrayIterator::visitChildren):
2675         * runtime/JSArrayIterator.h:
2676         * runtime/JSBoundFunction.cpp:
2677         (JSC::JSBoundFunction::visitChildren):
2678         * runtime/JSBoundFunction.h:
2679         * runtime/JSCellInlines.h:
2680         (JSC::JSCell::setStructure):
2681         * runtime/JSFunction.cpp:
2682         (JSC::JSFunction::visitChildren):
2683         * runtime/JSFunction.h:
2684         * runtime/JSGlobalObject.cpp:
2685         (JSC::JSGlobalObject::visitChildren):
2686         * runtime/JSGlobalObject.h:
2687         * runtime/JSMap.h:
2688         * runtime/JSMapIterator.cpp:
2689         (JSC::JSMapIterator::visitChildren):
2690         * runtime/JSMapIterator.h:
2691         * runtime/JSNameScope.cpp:
2692         (JSC::JSNameScope::visitChildren):
2693         * runtime/JSNameScope.h:
2694         * runtime/JSPromise.cpp:
2695         (JSC::JSPromise::visitChildren):
2696         * runtime/JSPromise.h:
2697         * runtime/JSPromiseDeferred.cpp:
2698         (JSC::JSPromiseDeferred::visitChildren):
2699         * runtime/JSPromiseDeferred.h:
2700         * runtime/JSPromiseReaction.cpp:
2701         (JSC::JSPromiseReaction::visitChildren):
2702         * runtime/JSPromiseReaction.h:
2703         * runtime/JSPropertyNameIterator.cpp:
2704         (JSC::JSPropertyNameIterator::visitChildren):
2705         * runtime/JSPropertyNameIterator.h:
2706         * runtime/JSProxy.cpp:
2707         (JSC::JSProxy::visitChildren):
2708         * runtime/JSProxy.h:
2709         * runtime/JSScope.cpp:
2710         (JSC::JSScope::visitChildren):
2711         * runtime/JSScope.h:
2712         * runtime/JSSegmentedVariableObject.cpp:
2713         (JSC::JSSegmentedVariableObject::visitChildren):
2714         * runtime/JSSegmentedVariableObject.h:
2715         * runtime/JSSet.h:
2716         * runtime/JSSetIterator.cpp:
2717         (JSC::JSSetIterator::visitChildren):
2718         * runtime/JSSetIterator.h:
2719         * runtime/JSSymbolTableObject.cpp:
2720         (JSC::JSSymbolTableObject::visitChildren):
2721         * runtime/JSSymbolTableObject.h:
2722         * runtime/JSTypeInfo.h:
2723         (JSC::TypeInfo::overridesVisitChildren): Deleted.
2724         * runtime/JSWeakMap.h:
2725         * runtime/JSWithScope.cpp:
2726         (JSC::JSWithScope::visitChildren):
2727         * runtime/JSWithScope.h:
2728         * runtime/JSWrapperObject.cpp:
2729         (JSC::JSWrapperObject::visitChildren):
2730         * runtime/JSWrapperObject.h:
2731         * runtime/MapData.h:
2732         * runtime/NativeErrorConstructor.cpp:
2733         (JSC::NativeErrorConstructor::visitChildren):
2734         * runtime/NativeErrorConstructor.h:
2735         * runtime/PropertyMapHashTable.h:
2736         * runtime/PropertyTable.cpp:
2737         (JSC::PropertyTable::visitChildren):
2738         * runtime/RegExpConstructor.cpp:
2739         (JSC::RegExpConstructor::visitChildren):
2740         * runtime/RegExpConstructor.h:
2741         * runtime/RegExpMatchesArray.cpp:
2742         (JSC::RegExpMatchesArray::visitChildren):
2743         * runtime/RegExpMatchesArray.h:
2744         * runtime/RegExpObject.cpp:
2745         (JSC::RegExpObject::visitChildren):
2746         * runtime/RegExpObject.h:
2747         * runtime/SparseArrayValueMap.h:
2748         * runtime/Structure.cpp:
2749         (JSC::Structure::Structure):
2750         (JSC::Structure::visitChildren):
2751         * runtime/StructureChain.cpp:
2752         (JSC::StructureChain::visitChildren):
2753         * runtime/StructureChain.h:
2754         * runtime/StructureRareData.cpp:
2755         (JSC::StructureRareData::visitChildren):
2756         * runtime/StructureRareData.h:
2757         * runtime/WeakMapData.h:
2758
2759 2014-07-31  Mark Lam  <mark.lam@apple.com>
2760
2761         JSCell::classInfo() belongs in JSCellInlines.h.
2762         <https://webkit.org/b/135475>
2763
2764         Reviewed by Mark Hahnenberg.
2765
2766         * runtime/JSCellInlines.h:
2767         (JSC::JSCell::classInfo):
2768         * runtime/JSDestructibleObject.h:
2769         (JSC::JSCell::classInfo): Deleted.
2770
2771 2014-07-31  Tanay C  <tanay.c@samsung.com>
2772
2773         Build warning in webkit/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
2774         https://bugs.webkit.org/show_bug.cgi?id=135414
2775
2776         Reviewed by Csaba Osztrogonác.
2777
2778         * llint/LLIntSlowPaths.cpp:
2779         (JSC::LLInt::putToScopeCommon):removed unused parameter from function definition
2780
2781 2014-07-30  Filip Pizlo  <fpizlo@apple.com>
2782
2783         NewFunctionExpression and NewFunctionNoCheck should setHaveStructures(true)
2784         https://bugs.webkit.org/show_bug.cgi?id=135430
2785
2786         Reviewed by Mark Hahnenberg.
2787
2788         We already handled this correctly after the ftlopt merge, but it's useful to have the test.
2789
2790         * tests/stress/new-function-expression-has-structures.js: Added.
2791         (foo.f):
2792         (foo.f.prototype.f):
2793         (foo):
2794
2795 2014-07-30  Andreas Kling  <akling@apple.com>
2796
2797         Speculative Windows build fix.
2798
2799         Try to dllimport the dllexported global object HashTable.
2800
2801         * jsc.cpp:
2802         * testRegExp.cpp:
2803
2804 2014-07-30  Andreas Kling  <akling@apple.com>
2805
2806         PropertyName's internal string is always atomic.
2807         <https://webkit.org/b/135451>
2808
2809         Now that we've merged the JSC::Identifier and WTF::AtomicString tables,
2810         we know that any string that's an Identifier is guaranteed to be atomic.
2811
2812         A PropertyName can be either an Identifier or a PrivateName, and the
2813         private names are also guaranteed to be atomic internally.
2814
2815         Make PropertyName vend AtomicStringImpl* instead of StringImpl*.
2816
2817         Reviewed by Benjamin Poulain.
2818
2819         * runtime/PropertyName.h:
2820         (JSC::PropertyName::PropertyName):
2821         (JSC::PropertyName::uid):
2822         (JSC::PropertyName::publicName):
2823
2824 2014-07-30  Andy Estes  <aestes@apple.com>
2825
2826         USE(CONTENT_FILTERING) should be ENABLE(CONTENT_FILTERING)
2827         https://bugs.webkit.org/show_bug.cgi?id=135439
2828
2829         Reviewed by Tim Horton.
2830
2831         We now support two different platform content filters, and will soon support a mock content filter (as part of
2832         webkit.org/b/128858). This makes content filtering a feature of WebKit, not just an adoption of a third-party
2833         library. ENABLE() is the correct macro to use for such a feature.
2834
2835         * Configurations/FeatureDefines.xcconfig:
2836
2837 2014-07-30  Andreas Kling  <akling@apple.com>
2838
2839         Static hash tables no longer need to be coupled with a VM.
2840         <https://webkit.org/b/135421>
2841
2842         Now that the static hash tables are using char** instead of StringImpl**,
2843         it's no longer necessary to make them per-VM.
2844
2845         This patch removes the hook in ClassInfo for providing your own static
2846         hash table getter. Everyone now uses ClassInfo::staticPropHashTable.
2847         Most of this patch is tweaking ClassInfo construction sites to pass one
2848         less null pointer.
2849
2850         Also simplified Lookup.h to stop requiring ExecState/VM to access the
2851         static hash tables.
2852
2853         Reviewed by Geoffrey Garen.
2854
2855         * API/JSAPIWrapperObject.mm:
2856         * API/JSCallbackConstructor.cpp:
2857         * API/JSCallbackFunction.cpp:
2858         * API/JSCallbackObject.cpp:
2859         * API/ObjCCallbackFunction.mm:
2860         * bytecode/UnlinkedCodeBlock.cpp:
2861         * create_hash_table:
2862         * debugger/DebuggerScope.cpp:
2863         * inspector/JSInjectedScriptHost.cpp:
2864         * inspector/JSInjectedScriptHostPrototype.cpp:
2865         * inspector/JSJavaScriptCallFrame.cpp:
2866         * inspector/JSJavaScriptCallFramePrototype.cpp:
2867         * interpreter/CallFrame.h:
2868         (JSC::ExecState::arrayConstructorTable): Deleted.
2869         (JSC::ExecState::arrayPrototypeTable): Deleted.
2870         (JSC::ExecState::booleanPrototypeTable): Deleted.
2871         (JSC::ExecState::dataViewTable): Deleted.
2872         (JSC::ExecState::dateTable): Deleted.
2873         (JSC::ExecState::dateConstructorTable): Deleted.
2874         (JSC::ExecState::errorPrototypeTable): Deleted.
2875         (JSC::ExecState::globalObjectTable): Deleted.
2876         (JSC::ExecState::jsonTable): Deleted.
2877         (JSC::ExecState::numberConstructorTable): Deleted.
2878         (JSC::ExecState::numberPrototypeTable): Deleted.
2879         (JSC::ExecState::objectConstructorTable): Deleted.
2880         (JSC::ExecState::privateNamePrototypeTable): Deleted.
2881         (JSC::ExecState::regExpTable): Deleted.
2882         (JSC::ExecState::regExpConstructorTable): Deleted.
2883         (JSC::ExecState::regExpPrototypeTable): Deleted.
2884         (JSC::ExecState::stringConstructorTable): Deleted.
2885         (JSC::ExecState::promisePrototypeTable): Deleted.
2886         (JSC::ExecState::promiseConstructorTable): Deleted.
2887         * jsc.cpp:
2888         * parser/Lexer.h:
2889         (JSC::Keywords::isKeyword):
2890         (JSC::Keywords::getKeyword):
2891         * runtime/Arguments.cpp:
2892         * runtime/ArgumentsIteratorConstructor.cpp:
2893         * runtime/ArgumentsIteratorPrototype.cpp:
2894         * runtime/ArrayBufferNeuteringWatchpoint.cpp:
2895         * runtime/ArrayConstructor.cpp:
2896         (JSC::ArrayConstructor::getOwnPropertySlot):
2897         * runtime/ArrayIteratorConstructor.cpp:
2898         * runtime/ArrayIteratorPrototype.cpp:
2899         * runtime/ArrayPrototype.cpp:
2900         (JSC::ArrayPrototype::getOwnPropertySlot):
2901         * runtime/BooleanConstructor.cpp:
2902         * runtime/BooleanObject.cpp:
2903         * runtime/BooleanPrototype.cpp:
2904         (JSC::BooleanPrototype::getOwnPropertySlot):
2905         * runtime/ClassInfo.h:
2906         (JSC::ClassInfo::hasStaticProperties):
2907         (JSC::ClassInfo::propHashTable): Deleted.
2908         * runtime/ConsolePrototype.cpp:
2909         * runtime/CustomGetterSetter.cpp:
2910         * runtime/DateConstructor.cpp:
2911         (JSC::DateConstructor::getOwnPropertySlot):
2912         * runtime/DateInstance.cpp:
2913         * runtime/DatePrototype.cpp:
2914         (JSC::DatePrototype::getOwnPropertySlot):
2915         * runtime/Error.cpp:
2916         * runtime/ErrorConstructor.cpp:
2917         * runtime/ErrorInstance.cpp:
2918         * runtime/ErrorPrototype.cpp:
2919         (JSC::ErrorPrototype::getOwnPropertySlot):
2920         * runtime/ExceptionHelpers.cpp:
2921         * runtime/Executable.cpp:
2922         * runtime/FunctionConstructor.cpp:
2923         * runtime/FunctionPrototype.cpp:
2924         * runtime/GetterSetter.cpp:
2925         * runtime/InternalFunction.cpp:
2926         * runtime/JSAPIValueWrapper.cpp:
2927         * runtime/JSActivation.cpp:
2928         * runtime/JSArgumentsIterator.cpp:
2929         * runtime/JSArray.cpp:
2930         * runtime/JSArrayBuffer.cpp:
2931         * runtime/JSArrayBufferConstructor.cpp:
2932         * runtime/JSArrayBufferPrototype.cpp:
2933         * runtime/JSArrayBufferView.cpp:
2934         * runtime/JSArrayIterator.cpp:
2935         * runtime/JSBoundFunction.cpp:
2936         * runtime/JSConsole.cpp:
2937         * runtime/JSDataView.cpp:
2938         * runtime/JSDataViewPrototype.cpp:
2939         (JSC::JSDataViewPrototype::getOwnPropertySlot):
2940         * runtime/JSFunction.cpp:
2941         * runtime/JSGlobalObject.cpp:
2942         (JSC::JSGlobalObject::getOwnPropertySlot):
2943         * runtime/JSMap.cpp:
2944         * runtime/JSMapIterator.cpp:
2945         * runtime/JSNameScope.cpp:
2946         * runtime/JSNotAnObject.cpp:
2947         * runtime/JSONObject.cpp:
2948         (JSC::JSONObject::getOwnPropertySlot):
2949         * runtime/JSObject.cpp:
2950         (JSC::getClassPropertyNames):
2951         (JSC::JSObject::put):
2952         (JSC::JSObject::deleteProperty):
2953         (JSC::JSObject::findPropertyHashEntry):
2954         (JSC::JSObject::reifyStaticFunctionsForDelete):
2955         * runtime/JSObject.h:
2956         * runtime/JSPromise.cpp:
2957         * runtime/JSPromiseConstructor.cpp:
2958         (JSC::JSPromiseConstructor::getOwnPropertySlot):
2959         * runtime/JSPromiseDeferred.cpp:
2960         * runtime/JSPromisePrototype.cpp:
2961         (JSC::JSPromisePrototype::getOwnPropertySlot):
2962         * runtime/JSPromiseReaction.cpp:
2963         * runtime/JSPropertyNameIterator.cpp:
2964         * runtime/JSProxy.cpp:
2965         * runtime/JSSet.cpp:
2966         * runtime/JSSetIterator.cpp:
2967         * runtime/JSString.cpp:
2968         * runtime/JSTypedArrayConstructors.cpp:
2969         * runtime/JSTypedArrayPrototypes.cpp:
2970         * runtime/JSTypedArrays.cpp:
2971         * runtime/JSVariableObject.cpp:
2972         * runtime/JSWeakMap.cpp:
2973         * runtime/JSWithScope.cpp:
2974         * runtime/Lookup.cpp:
2975         (JSC::HashTable::createTable):
2976         * runtime/Lookup.h:
2977         (JSC::HashTable::initializeIfNeeded):
2978         (JSC::HashTable::entry):
2979         (JSC::HashTable::begin):
2980         (JSC::HashTable::end):
2981         (JSC::getStaticPropertySlot):
2982         (JSC::getStaticFunctionSlot):
2983         (JSC::getStaticValueSlot):
2984         (JSC::lookupPut):
2985         * runtime/MapConstructor.cpp:
2986         * runtime/MapData.cpp:
2987         * runtime/MapIteratorConstructor.cpp:
2988         * runtime/MapIteratorPrototype.cpp:
2989         * runtime/MapPrototype.cpp:
2990         * runtime/MathObject.cpp:
2991         * runtime/NameConstructor.cpp:
2992         * runtime/NameInstance.cpp:
2993         * runtime/NamePrototype.cpp:
2994         (JSC::NamePrototype::getOwnPropertySlot):
2995         * runtime/NativeErrorConstructor.cpp:
2996         * runtime/NumberConstructor.cpp:
2997         (JSC::NumberConstructor::getOwnPropertySlot):
2998         * runtime/NumberObject.cpp:
2999         * runtime/NumberPrototype.cpp:
3000         (JSC::NumberPrototype::getOwnPropertySlot):
3001         * runtime/ObjectConstructor.cpp:
3002         (JSC::ObjectConstructor::getOwnPropertySlot):
3003         * runtime/ObjectPrototype.cpp:
3004         * runtime/PropertyTable.cpp:
3005         * runtime/RegExp.cpp:
3006         * runtime/RegExpConstructor.cpp:
3007         (JSC::RegExpConstructor::getOwnPropertySlot):
3008         * runtime/RegExpMatchesArray.cpp:
3009         * runtime/RegExpObject.cpp:
3010         (JSC::RegExpObject::getOwnPropertySlot):
3011         * runtime/RegExpPrototype.cpp:
3012         (JSC::RegExpPrototype::getOwnPropertySlot):
3013         * runtime/SetConstructor.cpp:
3014         * runtime/SetIteratorConstructor.cpp:
3015         * runtime/SetIteratorPrototype.cpp:
3016         * runtime/SetPrototype.cpp:
3017         * runtime/SparseArrayValueMap.cpp:
3018         * runtime/StrictEvalActivation.cpp:
3019         * runtime/StringConstructor.cpp:
3020         (JSC::StringConstructor::getOwnPropertySlot):
3021         * runtime/StringObject.cpp:
3022         * runtime/StringPrototype.cpp:
3023         * runtime/Structure.cpp:
3024         (JSC::Structure::Structure):
3025         (JSC::Structure::freezeTransition):
3026         (JSC::ClassInfo::hasStaticSetterOrReadonlyProperties):
3027         * runtime/StructureChain.cpp:
3028         * runtime/StructureRareData.cpp:
3029         * runtime/SymbolTable.cpp:
3030         * runtime/VM.cpp:
3031         (JSC::VM::VM):
3032         (JSC::VM::~VM):
3033         * runtime/VM.h:
3034         * runtime/WeakMapConstructor.cpp:
3035         * runtime/WeakMapData.cpp:
3036         * runtime/WeakMapPrototype.cpp:
3037         * testRegExp.cpp:
3038
3039 2014-07-29  Brent Fulgham  <bfulgham@apple.com>
3040
3041         [Win] Modify version numbering scheme to support 5-tuple versions
3042         https://bugs.webkit.org/show_bug.cgi?id=135400
3043         <rdar://problem/17849033>
3044
3045         Reviewed by David Kilzer.
3046
3047         * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd: Use the
3048         new version-stamp.pl script to version JavaScriptCore.dll.
3049
3050 2014-07-29  Daniel Bates  <dabates@apple.com>
3051
3052         Use WTF::move() instead of std::move() to help ensure move semantics
3053         https://bugs.webkit.org/show_bug.cgi?id=135351
3054
3055         Reviewed by Alexey Proskuryakov.
3056
3057         * bytecode/GetByIdStatus.cpp:
3058         (JSC::GetByIdStatus::computeForStubInfo):
3059         * bytecode/GetByIdVariant.cpp:
3060         (JSC::GetByIdVariant::GetByIdVariant):
3061
3062 2014-07-28  Tamas Gergely  <tgergely.u-szeged@partner.samsung.com>
3063
3064         BuildFix: JavaScriptCore/bytecode/StructureSet.h:262:77: warning.
3065         https://bugs.webkit.org/show_bug.cgi?id=135287
3066
3067         Reviewed by Darin Adler.
3068
3069         The set() method tries to use a part of the old value (the reservedFlag bit) which
3070         was not defined when the constructor is called. Initialize m_pointer to 0 explicitely.
3071
3072         * bytecode/StructureSet.h:
3073         (JSC::StructureSet::StructureSet):
3074
3075 2014-07-28  Benjamin Poulain  <bpoulain@apple.com>
3076
3077         [JSC] JIT::assertStackPointerOffset() crashes on ARM64
3078         https://bugs.webkit.org/show_bug.cgi?id=135316
3079
3080         Reviewed by Geoffrey Garen.
3081
3082         JIT::assertStackPointerOffset() does a compare between an arbitrary register
3083         and the stack pointer. This was not supported by the ARM64 assembler.
3084
3085         There are no variation that can take a stack pointer for Xd. There is one version of subs
3086         that can take a stack pointer, but only for the Xn: the shift+extend one.
3087         To solve the problem, I changed cmp to swap the registers if necessary, and I fixed
3088         the implementation of sub.
3089
3090         * assembler/ARM64Assembler.h:
3091         (JSC::ARM64Assembler::sub):
3092         In the generic sub(reg, reg), I added assertions to catch the condition that cannot be generated
3093         with either version of sub.
3094
3095         In sub(with shift), I remove the weird special case for SP. First, it was quite misleading because
3096         the Rd case only works if "setflag == false". The other confusing part is going to addSubtractShiftedRegister()
3097         gives you a reduce shift range, which could create subtle bug that only appear when SP is used.
3098
3099         Since I removed the weird case, I need to differentiate between the sub() that support SP, and the one that does
3100         not elsewhere. That is why that branch has moved to the generic sub(reg, reg). Since at that point we know
3101         the shift value must be zero, it is safe to call either variant.
3102
3103         * assembler/MacroAssemblerARM64.h:
3104         (JSC::MacroAssemblerARM64::branch64):
3105         With the changes described above, we can now use SP for the left register. What do we do if the rightmost
3106         register is SP?
3107
3108         For the case of JIT::assertStackPointerOffset(), the comparison is Equal so the order really does not matter,
3109         we just switch the registers before generating the instruction.
3110
3111         For the generic case, just move the value of SP to a GPR before doing the CMP.
3112
3113 2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
3114
3115         Unreviewed build fix after r171682.
3116
3117         * replay/EncodedValue.h: Don't mark the inlined Vector<char> specialization
3118         as an exported symbol.
3119
3120 2014-07-28  Mark Hahnenberg  <mhahnenberg@apple.com>
3121
3122         REGRESSION: JSObjectSetPrototype() does not work on result of JSGetGlobalObject()
3123         https://bugs.webkit.org/show_bug.cgi?id=135322
3124
3125         Reviewed by Oliver Hunt.
3126
3127         The prototype chain of the JSProxy object should match that of the JSGlobalObject. 
3128
3129         This is a separate but related issue with JSObjectSetPrototype which doesn't correctly 
3130         account for JSProxies. I also audited the rest of the C API to check that we correctly 
3131         handle JSProxies in all other situations where we expect a JSCallbackObject of some sort
3132         and found some SPI calls (JSObject*PrivateProperty) that didn't behave correctly when 
3133         passed a JSProxy.
3134
3135         I also added some new tests for these cases.
3136
3137         * API/JSObjectRef.cpp:
3138         (JSObjectSetPrototype):
3139         (JSObjectGetPrivateProperty):
3140         (JSObjectSetPrivateProperty):
3141         (JSObjectDeletePrivateProperty):
3142         * API/JSWeakObjectMapRefPrivate.cpp:
3143         * API/tests/CustomGlobalObjectClassTest.c:
3144         (globalObjectSetPrototypeTest):
3145         (globalObjectPrivatePropertyTest):
3146         * API/tests/CustomGlobalObjectClassTest.h:
3147         * API/tests/testapi.c:
3148         (main):
3149
3150 2014-07-28  Filip Pizlo  <fpizlo@apple.com>
3151
3152         Make sure that we don't use non-speculative BooleanToNumber for a speculative Branch
3153         https://bugs.webkit.org/show_bug.cgi?id=135350
3154         <rdar://problem/17509889>
3155
3156         Reviewed by Mark Hahnenberg and Oliver Hunt.
3157         
3158         If we have an exiting node that uses a conversion node, then that exiting node
3159         needs to have a Phantom after it for the the original node. But we can't do that
3160         for Branch because https://bugs.webkit.org/show_bug.cgi?id=126778.
3161
3162         * dfg/DFGFixupPhase.cpp:
3163         (JSC::DFG::FixupPhase::fixupNode):
3164         (JSC::DFG::FixupPhase::clearPhantomsAtEnd):
3165         * tests/stress/branch-check-int32-on-boolean-to-number-untyped.js: Added.
3166         (foo):
3167         (test):
3168         * tests/stress/branch-check-number-on-boolean-to-number-untyped.js: Added.
3169         (foo):
3170         (test):
3171
3172 2014-07-28  Joseph Pecoraro  <pecoraro@apple.com>
3173
3174         JSContext Inspector: crash when using step-into
3175         https://bugs.webkit.org/show_bug.cgi?id=135345
3176
3177         Reviewed by Timothy Hatcher.
3178
3179         * inspector/agents/InspectorDebuggerAgent.cpp:
3180         (Inspector::InspectorDebuggerAgent::stepInto):
3181         Null check m_listener since it may not be set.
3182
3183 2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
3184
3185         Web Replay: auto-decoding of parameterized vector's elements is incorrect
3186         https://bugs.webkit.org/show_bug.cgi?id=135343
3187
3188         Reviewed by Timothy Hatcher.
3189
3190         Fix an incorrect type argument in EncodingTraits<Vector<T>>::encodeValue
3191         that was using the element's decoded type as the type parameter to
3192         EncodedValue::append<T>. It should instead be the raw type T. This
3193         causes problems when encoding Vector<RefPtr<T>>, as it later tries to
3194         use encoding traits for RefPtr<T> rather than for T.
3195
3196         Fix incorrect generated encoding traits argument for vectors of
3197         RefCounted objects. Updated test to cover this scenario.
3198
3199