Source/JavaScriptCore/ChangeLog

   1 2014-08-12  Alex Christensen  <achristensen@webkit.org>
   2
   3         Generate header detection headers for CMake on Windows.
   4         https://bugs.webkit.org/show_bug.cgi?id=135807
   5
   6         Reviewed by Brent Fulgham.
   7
   8         * CMakeLists.txt:
   9         Include the derived sources directory to find WTF/WTFHeaderDetection.h.
  10
  11 2014-08-11  Andy Estes  <aestes@apple.com>
  12
  13         [iOS] Get rid of iOS.xcconfig
  14         https://bugs.webkit.org/show_bug.cgi?id=135809
  15
  16         Reviewed by Joseph Pecoraro.
  17
  18         All iOS.xcconfig did was include AspenFamily.xcconfig, so there's no need for the indirection.
  19
  20         * Configurations/Base.xcconfig:
  21         * Configurations/iOS.xcconfig: Removed.
  22         * JavaScriptCore.xcodeproj/project.pbxproj:
  23
  24 2014-08-11  Michael Saboff  <msaboff@apple.com>
  25
  26         Eliminate {push,pop}CalleeSaves in favor of individual pushes & pops
  27         https://bugs.webkit.org/show_bug.cgi?id=127155
  28
  29         Reviewed by Geoffrey Garen.
  30
  31         Eliminated the offline assembler instructions {push,pop}CalleeSaves as well as the
  32         ARM64 specific {push,pop}LRAndFP and replaced them with individual push and pop
  33         instructions. Where the registers referenced by the added push and pop instructions
  34         are not part of the offline assembler register aliases, used a newly added "emit"
  35         offline assembler instruction which takes a string literal and outputs that
  36         string as a native instruction.
  37
  38         * llint/LowLevelInterpreter.asm:
  39         * offlineasm/arm.rb:
  40         * offlineasm/arm64.rb:
  41         * offlineasm/ast.rb:
  42         * offlineasm/cloop.rb:
  43         * offlineasm/instructions.rb:
  44         * offlineasm/mips.rb:
  45         * offlineasm/parser.rb:
  46         * offlineasm/sh4.rb:
  47         * offlineasm/transform.rb:
  48         * offlineasm/x86.rb:
  49
  50 2014-08-11  Mark Lam  <mark.lam@apple.com>
  51
  52         Re-landing r172401 with fixed test.
  53         <https://webkit.org/b/135782>
  54
  55         Not reviewed.
  56
  57         * bytecompiler/BytecodeGenerator.cpp:
  58         (JSC::BytecodeGenerator::emitGetByVal):
  59         (JSC::BytecodeGenerator::pushIndexedForInScope):
  60         (JSC::BytecodeGenerator::pushStructureForInScope):
  61         * bytecompiler/BytecodeGenerator.h:
  62         (JSC::ForInContext::ForInContext):
  63         (JSC::ForInContext::base):
  64         (JSC::StructureForInContext::StructureForInContext):
  65         (JSC::IndexedForInContext::IndexedForInContext):
  66         * bytecompiler/NodesCodegen.cpp:
  67         (JSC::ForInNode::emitMultiLoopBytecode):
  68         * tests/stress/for-in-tests.js:
  69
  70 2014-08-11  Commit Queue  <commit-queue@webkit.org>
  71
  72         Unreviewed, rolling out r172401.
  73         https://bugs.webkit.org/show_bug.cgi?id=135812
  74
  75         Failing stress/for-in-tests.js
  76         http://build.webkit.org/builders/Apple%20Mavericks%20Release%20WK1%20%28Tests%29/builds/7945/steps
  77         /jscore-test/logs/stdio (Requested by mlam on #webkit).
  78
  79         Reverted changeset:
  80
  81         "for-in optimization should also make sure the base matches
  82         the object being iterated"
  83         https://bugs.webkit.org/show_bug.cgi?id=135782
  84         http://trac.webkit.org/changeset/172401
  85
  86 2014-08-11  Brian J. Burg  <burg@cs.washington.edu>
  87
  88         Web Inspector: use type builders to construct high fidelity type information payloads
  89         https://bugs.webkit.org/show_bug.cgi?id=135803
  90
  91         Reviewed by Timothy Hatcher.
  92
  93         Due to some typos in the protocol file, the code had worked with raw objects
  94         rather than with type builders. Convert to using builders.
  95
  96         * inspector/agents/InspectorRuntimeAgent.cpp:
  97         (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
  98         * inspector/agents/InspectorRuntimeAgent.h:
  99         * inspector/protocol/Runtime.json: Fix 'item' for 'items'; true for 'true'.
 100         * runtime/HighFidelityTypeProfiler.cpp:
 101         (JSC::HighFidelityTypeProfiler::getTypesForVariableAtOffsetForInspector):
 102         * runtime/HighFidelityTypeProfiler.h:
 103         * runtime/TypeSet.cpp:
 104         (JSC::TypeSet::allStructureRepresentations):
 105         (JSC::StructureShape::stringRepresentation):
 106         (JSC::StructureShape::inspectorRepresentation):
 107         * runtime/TypeSet.h:
 108
 109 2014-08-11  Mark Hahnenberg  <mhahnenberg@apple.com>
 110
 111         for-in optimization should also make sure the base matches the object being iterated
 112         https://bugs.webkit.org/show_bug.cgi?id=135782
 113
 114         Reviewed by Geoffrey Garen.
 115
 116         If we access a different base object with the same index, we shouldn't try to randomly
 117         load from that object's backing store.
 118
 119         * bytecompiler/BytecodeGenerator.cpp:
 120         (JSC::BytecodeGenerator::emitGetByVal):
 121         (JSC::BytecodeGenerator::pushIndexedForInScope):
 122         (JSC::BytecodeGenerator::pushStructureForInScope):
 123         * bytecompiler/BytecodeGenerator.h:
 124         (JSC::ForInContext::ForInContext):
 125         (JSC::ForInContext::base):
 126         (JSC::StructureForInContext::StructureForInContext):
 127         (JSC::IndexedForInContext::IndexedForInContext):
 128         * bytecompiler/NodesCodegen.cpp:
 129         (JSC::ForInNode::emitMultiLoopBytecode):
 130         * tests/stress/for-in-tests.js:
 131
 132 2014-08-11  Brent Fulgham  <bfulgham@apple.com>
 133
 134         [Win] Unreviewed gardening.
 135
 136         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Display files in
 137         proper folder categories..
 138
 139 2014-08-11  Mark Hahnenberg  <mhahnenberg@apple.com>
 140
 141         JIT should use full 64-bit stores for jsBoolean and jsNull
 142         https://bugs.webkit.org/show_bug.cgi?id=135784
 143
 144         Reviewed by Michael Saboff.
 145
 146         This guarantees that we set the high bits of the register with the correct tag.
 147
 148         * dfg/DFGSpeculativeJIT64.cpp:
 149         (JSC::DFG::SpeculativeJIT::compile):
 150         * jit/JITOpcodes.cpp:
 151         (JSC::JIT::emit_op_has_structure_property):
 152         (JSC::JIT::emit_op_next_enumerator_pname):
 153
 154 2014-08-11  Brent Fulgham  <bfulgham@apple.com>
 155
 156         [Win] Adjust build script for Windows production build.
 157         https://bugs.webkit.org/show_bug.cgi?id=135806
 158         <rdar://problem/17978299>
 159
 160         Reviewed by Timothy Hatcher.
 161
 162         * JavaScriptCore.vcxproj/copy-files.cmd: Copy file for later use
 163         in WebInspectorUI build.
 164
 165 2014-08-10  Oliver Hunt  <oliver@apple.com>
 166
 167         Destructuring assignment in a var declaration list incorrectly consumes subsequent variable initialisers
 168         https://bugs.webkit.org/show_bug.cgi?id=135773
 169
 170         Reviewed by Michael Saboff.
 171
 172         We should be using parseAssignment expression in order to get the correct
 173         precedence.
 174
 175         * parser/Parser.cpp:
 176         (JSC::Parser<LexerType>::parseVarDeclarationList):
 177
 178 2014-08-10  Diego Pino Garcia  <dpino@igalia.com>
 179
 180         JSC Lexer is allowing octals 08 and 09 in strict mode functions
 181         https://bugs.webkit.org/show_bug.cgi?id=135704
 182
 183         Reviewed by Oliver Hunt.
 184
 185         Return syntax error ("Decimal integer literals with a leading zero are
 186         forbidden in strict mode") if a number starts with 0 and is followed
 187         by a digit.
 188
 189         * parser/Lexer.cpp:
 190         (JSC::Lexer<T>::lex):
 191
 192 2014-08-08  Mark Lam  <mark.lam@apple.com>
 193
 194         REGRESSION: Inspector crashes when debugger is paused and injected scripts access window.screen().
 195         <https://webkit.org/b/135656>
 196
 197         Not reviewed.
 198
 199         Rolling out r170680 which was merged to ToT in r172129.
 200
 201         * debugger/Debugger.h:
 202         * debugger/DebuggerCallFrame.cpp:
 203         (JSC::DebuggerCallFrame::scope):
 204         (JSC::DebuggerCallFrame::evaluate):
 205         (JSC::DebuggerCallFrame::invalidate):
 206         * debugger/DebuggerCallFrame.h:
 207         * debugger/DebuggerScope.cpp:
 208         (JSC::DebuggerScope::DebuggerScope):
 209         (JSC::DebuggerScope::finishCreation):
 210         (JSC::DebuggerScope::visitChildren):
 211         (JSC::DebuggerScope::className):
 212         (JSC::DebuggerScope::getOwnPropertySlot):
 213         (JSC::DebuggerScope::put):
 214         (JSC::DebuggerScope::deleteProperty):
 215         (JSC::DebuggerScope::getOwnPropertyNames):
 216         (JSC::DebuggerScope::defineOwnProperty):
 217         (JSC::DebuggerScope::next): Deleted.
 218         (JSC::DebuggerScope::invalidateChain): Deleted.
 219         (JSC::DebuggerScope::isWithScope): Deleted.
 220         (JSC::DebuggerScope::isGlobalScope): Deleted.
 221         (JSC::DebuggerScope::isFunctionScope): Deleted.
 222         * debugger/DebuggerScope.h:
 223         (JSC::DebuggerScope::create):
 224         (JSC::DebuggerScope::Iterator::Iterator): Deleted.
 225         (JSC::DebuggerScope::Iterator::get): Deleted.
 226         (JSC::DebuggerScope::Iterator::operator++): Deleted.
 227         (JSC::DebuggerScope::Iterator::operator==): Deleted.
 228         (JSC::DebuggerScope::Iterator::operator!=): Deleted.
 229         (JSC::DebuggerScope::isValid): Deleted.
 230         (JSC::DebuggerScope::jsScope): Deleted.
 231         (JSC::DebuggerScope::begin): Deleted.
 232         (JSC::DebuggerScope::end): Deleted.
 233         * inspector/JSJavaScriptCallFrame.cpp:
 234         (Inspector::JSJavaScriptCallFrame::scopeType):
 235         (Inspector::JSJavaScriptCallFrame::scopeChain):
 236         * inspector/JavaScriptCallFrame.h:
 237         (Inspector::JavaScriptCallFrame::scopeChain):
 238         * inspector/ScriptDebugServer.cpp:
 239         * runtime/JSGlobalObject.cpp:
 240         (JSC::JSGlobalObject::reset):
 241         (JSC::JSGlobalObject::visitChildren):
 242         * runtime/JSGlobalObject.h:
 243         (JSC::JSGlobalObject::debuggerScopeStructure): Deleted.
 244         * runtime/JSObject.h:
 245         (JSC::JSObject::isWithScope): Deleted.
 246         * runtime/JSScope.h:
 247         * runtime/VM.cpp:
 248         (JSC::VM::VM):
 249         * runtime/VM.h:
 250
 251 2014-08-07  Saam Barati  <sbarati@apple.com>
 252
 253         Create a more generic way for VMEntryScope to notify those interested that it will be destroyed
 254         https://bugs.webkit.org/show_bug.cgi?id=135358
 255
 256         Reviewed by Geoffrey Garen.
 257
 258         When VMEntryScope is destroyed, and it has a flag set indicating that the
 259         Debugger needs to recompile all functions, it calls Debugger::recompileAllJSFunctions.
 260         This flag is only used by Debugger to have VMEntryScope notify it when the
 261         Debugger is safe to recompile all functions. This patch will substitute this
 262         Debugger-specific recompilation flag with a list of callbacks that are notified
 263         when the outermost VMEntryScope dies. This creates a general purpose interface
 264         for being notified when the VM stops executing code via the event of the outermost
 265         VMEntryScope dying.
 266
 267         * debugger/Debugger.cpp:
 268         (JSC::Debugger::recompileAllJSFunctions):
 269         * runtime/VMEntryScope.cpp:
 270         (JSC::VMEntryScope::VMEntryScope):
 271         (JSC::VMEntryScope::setEntryScopeDidPopListener):
 272         (JSC::VMEntryScope::~VMEntryScope):
 273         * runtime/VMEntryScope.h:
 274         (JSC::VMEntryScope::setRecompilationNeeded): Deleted.
 275
 276 2014-08-07  Benjamin Poulain  <bpoulain@apple.com>
 277
 278         Get rid of SCRIPTED_SPEECH
 279         https://bugs.webkit.org/show_bug.cgi?id=135729
 280
 281         Reviewed by Brent Fulgham.
 282
 283         * Configurations/FeatureDefines.xcconfig:
 284
 285 2014-08-07  Mark Hahnenberg  <mhahnenberg@apple.com>
 286
 287         SpeculateInt32Operand is sometimes used in a 64-bit context, which has undefined behavior
 288         https://bugs.webkit.org/show_bug.cgi?id=135722
 289
 290         Reviewed by Filip Pizlo.
 291
 292         We should be using SpeculateStrictInt32Operand instead.
 293
 294         * dfg/DFGSpeculativeJIT64.cpp:
 295         (JSC::DFG::SpeculativeJIT::compile):
 296
 297 2014-08-07  Benjamin Poulain  <bpoulain@apple.com>
 298
 299         Get rid of INPUT_SPEECH
 300         https://bugs.webkit.org/show_bug.cgi?id=135672
 301
 302         Reviewed by Andreas Kling.
 303
 304         * Configurations/FeatureDefines.xcconfig:
 305
 306 2014-08-07  Mark Hahnenberg  <mhahnenberg@apple.com>
 307
 308         for-in is failing fast/dom/dataset-xhtml.xhtml and dataset.html tests
 309         https://bugs.webkit.org/show_bug.cgi?id=135681
 310
 311         Reviewed by Filip Pizlo.
 312
 313         * runtime/Structure.cpp:
 314         (JSC::Structure::canCacheGenericPropertyNameEnumerator): We were checking the entire
 315         prototype chain for overridesGetPropertyNames, but we were neglecting to check the
 316         base object's Structure. D'oh!
 317
 318 2014-08-06  Mark Lam  <mark.lam@apple.com>
 319
 320         Gardening: fix for build failure on EFL bots.
 321
 322         Not reviewed.
 323
 324         * runtime/EnumerationMode.h:
 325         (JSC::shouldIncludeJSObjectPropertyNames):
 326         (JSC::modeThatSkipsJSObject):
 327         * runtime/JSCell.cpp:
 328         (JSC::JSCell::getEnumerableLength):
 329         * runtime/JSCell.h:
 330
 331 2014-08-06  Dean Jackson  <dino@apple.com>
 332
 333         ENABLE_CSS_TRANSFORMS_ANIMATIONS_UNPREFIXED is not used anywhere. Remove it.
 334         https://bugs.webkit.org/show_bug.cgi?id=135675
 335
 336         Reviewed by Sam Weinig.
 337
 338         * Configurations/FeatureDefines.xcconfig:
 339
 340 2014-08-06  Wenson Hsieh  <wenson_hsieh@apple.com>
 341
 342         Implement parsing for CSS scroll snap points
 343         https://bugs.webkit.org/show_bug.cgi?id=134301
 344
 345         Reviewed by Dean Jackson.
 346
 347         * Configurations/FeatureDefines.xcconfig: Added ENABLE_CSS_SCROLL_SNAP
 348
 349 2014-08-06  Mark Lam  <mark.lam@apple.com>
 350
 351         Gardening: fix for build failure on GTK bots.
 352
 353         Not reviewed.
 354
 355         * runtime/FunctionHasExecutedCache.cpp:
 356         - #include <limits.h> for UINT_MAX's definition.
 357
 358 2014-08-06  Mark Lam  <mark.lam@apple.com>
 359
 360         Gardening: fix for build failure on EFL bots.
 361
 362         Not reviewed.
 363
 364         * jit/JITInlines.h:
 365         (JSC::JIT::emitLoadForArrayMode):
 366
 367 2014-08-06  Mark Lam  <mark.lam@apple.com>
 368
 369         Gardening: adding missing build file changes from the FTLOPT merge at r172176.
 370
 371         Not reviewed.
 372
 373         * CMakeLists.txt:
 374         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 375         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
 376
 377 2014-08-06  Ryuan Choi  <ryuan.choi@samsung.com>
 378
 379         Unreviewed build fix attempt since r172184
 380
 381         * CMakeLists.txt: Removed TypeLocation.cpp
 382
 383 2014-08-06  Mark Lam  <mark.lam@apple.com>
 384
 385         Gardening: adding missing build file changes from r171510.
 386         <https://webkit.org/b/134860>
 387
 388         Not reviewed.
 389
 390         * CMakeLists.txt:
 391         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 392         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
 393
 394 2014-08-06  Mark Lam  <mark.lam@apple.com>
 395
 396         Gardening: adding missing build file changes from r170490.
 397         <https://webkit.org/b/133395>
 398
 399         Not reviewed.
 400
 401         * CMakeLists.txt:
 402         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
 403
 404 2014-08-06  Filip Pizlo  <fpizlo@apple.com>
 405
 406         Silence a debug assertion.
 407
 408         Reviewed by Mark Hahnenberg.
 409
 410         * runtime/JSPropertyNameEnumerator.h:
 411         (JSC::JSPropertyNameEnumerator::cachedStructure):
 412
 413 2014-08-06  Filip Pizlo  <fpizlo@apple.com>
 414
 415         Fix 32-bit build.
 416
 417         * jit/JITOpcodes32_64.cpp:
 418         (JSC::JIT::privateCompileHasIndexedProperty):
 419
 420 2014-08-06  Filip Pizlo  <fpizlo@apple.com>
 421
 422         Merge r171389, r171495, r171508, r171510, r171605, r171606, r171611, r171614, r171763 from ftlopt.
 423
 424     2014-07-28  Mark Hahnenberg  <mhahnenberg@apple.com>
 425
 426             Support for-in in the FTL
 427             https://bugs.webkit.org/show_bug.cgi?id=134140
 428
 429             Reviewed by Filip Pizlo.
 430
 431             * dfg/DFGSSALoweringPhase.cpp:
 432             (JSC::DFG::SSALoweringPhase::handleNode):
 433             * ftl/FTLAbstractHeapRepository.cpp:
 434             * ftl/FTLAbstractHeapRepository.h:
 435             * ftl/FTLCapabilities.cpp:
 436             (JSC::FTL::canCompile):
 437             * ftl/FTLIntrinsicRepository.h:
 438             * ftl/FTLLowerDFGToLLVM.cpp:
 439             (JSC::FTL::LowerDFGToLLVM::compileNode):
 440             (JSC::FTL::LowerDFGToLLVM::compileHasIndexedProperty):
 441             (JSC::FTL::LowerDFGToLLVM::compileHasGenericProperty):
 442             (JSC::FTL::LowerDFGToLLVM::compileHasStructureProperty):
 443             (JSC::FTL::LowerDFGToLLVM::compileGetDirectPname):
 444             (JSC::FTL::LowerDFGToLLVM::compileGetEnumerableLength):
 445             (JSC::FTL::LowerDFGToLLVM::compileGetStructurePropertyEnumerator):
 446             (JSC::FTL::LowerDFGToLLVM::compileGetGenericPropertyEnumerator):
 447             (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorPname):
 448             (JSC::FTL::LowerDFGToLLVM::compileToIndexString):
 449
 450     2014-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
 451
 452             Remove JSPropertyNameIterator
 453             https://bugs.webkit.org/show_bug.cgi?id=135066
 454
 455             Reviewed by Geoffrey Garen.
 456
 457             It has been replaced by JSPropertyNameEnumerator.
 458
 459             * JavaScriptCore.order:
 460             * bytecode/BytecodeBasicBlock.cpp:
 461             (JSC::isBranch):
 462             * bytecode/BytecodeList.json:
 463             * bytecode/BytecodeUseDef.h:
 464             (JSC::computeUsesForBytecodeOffset):
 465             (JSC::computeDefsForBytecodeOffset):
 466             * bytecode/CodeBlock.cpp:
 467             (JSC::CodeBlock::dumpBytecode):
 468             * bytecode/PreciseJumpTargets.cpp:
 469             (JSC::getJumpTargetsForBytecodeOffset):
 470             * bytecompiler/BytecodeGenerator.cpp:
 471             (JSC::BytecodeGenerator::emitGetPropertyNames): Deleted.
 472             (JSC::BytecodeGenerator::emitNextPropertyName): Deleted.
 473             * bytecompiler/BytecodeGenerator.h:
 474             * interpreter/Interpreter.cpp:
 475             * interpreter/Register.h:
 476             * jit/JIT.cpp:
 477             (JSC::JIT::privateCompileMainPass):
 478             (JSC::JIT::privateCompileSlowCases):
 479             * jit/JIT.h:
 480             * jit/JITOpcodes.cpp:
 481             (JSC::JIT::emit_op_get_pnames): Deleted.
 482             (JSC::JIT::emit_op_next_pname): Deleted.
 483             * jit/JITOpcodes32_64.cpp:
 484             (JSC::JIT::emit_op_get_pnames): Deleted.
 485             (JSC::JIT::emit_op_next_pname): Deleted.
 486             * jit/JITOperations.cpp:
 487             * jit/JITPropertyAccess.cpp:
 488             (JSC::JIT::emit_op_get_by_pname): Deleted.
 489             (JSC::JIT::emitSlow_op_get_by_pname): Deleted.
 490             * jit/JITPropertyAccess32_64.cpp:
 491             (JSC::JIT::emit_op_get_by_pname): Deleted.
 492             (JSC::JIT::emitSlow_op_get_by_pname): Deleted.
 493             * llint/LLIntOffsetsExtractor.cpp:
 494             * llint/LLIntSlowPaths.cpp:
 495             (JSC::LLInt::LLINT_SLOW_PATH_DECL): Deleted.
 496             * llint/LLIntSlowPaths.h:
 497             * llint/LowLevelInterpreter.asm:
 498             * llint/LowLevelInterpreter32_64.asm:
 499             * llint/LowLevelInterpreter64.asm:
 500             * runtime/CommonSlowPaths.cpp:
 501             * runtime/JSPropertyNameIterator.cpp:
 502             (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Deleted.
 503             (JSC::JSPropertyNameIterator::create): Deleted.
 504             (JSC::JSPropertyNameIterator::destroy): Deleted.
 505             (JSC::JSPropertyNameIterator::get): Deleted.
 506             (JSC::JSPropertyNameIterator::visitChildren): Deleted.
 507             * runtime/JSPropertyNameIterator.h:
 508             (JSC::JSPropertyNameIterator::createStructure): Deleted.
 509             (JSC::JSPropertyNameIterator::size): Deleted.
 510             (JSC::JSPropertyNameIterator::setCachedStructure): Deleted.
 511             (JSC::JSPropertyNameIterator::cachedStructure): Deleted.
 512             (JSC::JSPropertyNameIterator::setCachedPrototypeChain): Deleted.
 513             (JSC::JSPropertyNameIterator::cachedPrototypeChain): Deleted.
 514             (JSC::JSPropertyNameIterator::finishCreation): Deleted.
 515             (JSC::Register::propertyNameIterator): Deleted.
 516             (JSC::StructureRareData::enumerationCache): Deleted.
 517             (JSC::StructureRareData::setEnumerationCache): Deleted.
 518             * runtime/Structure.cpp:
 519             (JSC::Structure::addPropertyWithoutTransition):
 520             (JSC::Structure::removePropertyWithoutTransition):
 521             * runtime/Structure.h:
 522             * runtime/StructureInlines.h:
 523             (JSC::Structure::setEnumerationCache): Deleted.
 524             (JSC::Structure::enumerationCache): Deleted.
 525             * runtime/StructureRareData.cpp:
 526             (JSC::StructureRareData::visitChildren):
 527             * runtime/StructureRareData.h:
 528             * runtime/VM.cpp:
 529             (JSC::VM::VM):
 530
 531     2014-07-25  Saam Barati  <sbarati@apple.com>
 532
 533             Fix 32-bit build breakage for type profiling
 534             https://bugs.webkit.org/process_bug.cgi
 535
 536             Reviewed by Mark Hahnenberg.
 537
 538             32-bit builds currently break because global variable IDs for high
 539             fidelity type profiling are int64_t. Change this to intptr_t so that
 540             it's 32 bits on 32-bit platforms and 64 bits on 64-bit platforms.
 541
 542             * bytecode/CodeBlock.cpp:
 543             (JSC::CodeBlock::CodeBlock):
 544             (JSC::CodeBlock::scopeDependentProfile):
 545             * bytecode/TypeLocation.h:
 546             * runtime/SymbolTable.cpp:
 547             (JSC::SymbolTable::uniqueIDForVariable):
 548             (JSC::SymbolTable::uniqueIDForRegister):
 549             * runtime/SymbolTable.h:
 550             * runtime/TypeLocationCache.cpp:
 551             (JSC::TypeLocationCache::getTypeLocation):
 552             * runtime/TypeLocationCache.h:
 553             * runtime/VM.h:
 554             (JSC::VM::getNextUniqueVariableID):
 555
 556     2014-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
 557
 558             Reindent PropertyNameArray.h
 559             https://bugs.webkit.org/show_bug.cgi?id=135067
 560
 561             Reviewed by Geoffrey Garen.
 562
 563             * runtime/PropertyNameArray.h:
 564             (JSC::RefCountedIdentifierSet::contains):
 565             (JSC::RefCountedIdentifierSet::size):
 566             (JSC::RefCountedIdentifierSet::add):
 567             (JSC::PropertyNameArrayData::create):
 568             (JSC::PropertyNameArrayData::propertyNameVector):
 569             (JSC::PropertyNameArrayData::PropertyNameArrayData):
 570             (JSC::PropertyNameArray::PropertyNameArray):
 571             (JSC::PropertyNameArray::vm):
 572             (JSC::PropertyNameArray::add):
 573             (JSC::PropertyNameArray::addKnownUnique):
 574             (JSC::PropertyNameArray::operator[]):
 575             (JSC::PropertyNameArray::setData):
 576             (JSC::PropertyNameArray::data):
 577             (JSC::PropertyNameArray::releaseData):
 578             (JSC::PropertyNameArray::identifierSet):
 579             (JSC::PropertyNameArray::canAddKnownUniqueForStructure):
 580             (JSC::PropertyNameArray::size):
 581             (JSC::PropertyNameArray::begin):
 582             (JSC::PropertyNameArray::end):
 583             (JSC::PropertyNameArray::numCacheableSlots):
 584             (JSC::PropertyNameArray::setNumCacheableSlotsForObject):
 585             (JSC::PropertyNameArray::setBaseObject):
 586             (JSC::PropertyNameArray::setPreviouslyEnumeratedLength):
 587
 588     2014-07-23  Mark Hahnenberg  <mhahnenberg@apple.com>
 589
 590             Refactor our current implementation of for-in
 591             https://bugs.webkit.org/show_bug.cgi?id=134142
 592
 593             Reviewed by Filip Pizlo.
 594
 595             This patch splits for-in loops into three distinct parts:
 596
 597             - Iterating over the indexed properties in the base object.
 598             - Iterating over the Structure properties in the base object.
 599             - Iterating over any other enumerable properties for that object and any objects in the prototype chain.
 600
 601             It does this by emitting these explicit loops in bytecode, using a new set of bytecodes to
 602             support the various operations required for each loop.
 603
 604             * API/JSCallbackObjectFunctions.h:
 605             (JSC::JSCallbackObject<Parent>::getOwnNonIndexPropertyNames):
 606             * JavaScriptCore.xcodeproj/project.pbxproj:
 607             * bytecode/BytecodeList.json:
 608             * bytecode/BytecodeUseDef.h:
 609             (JSC::computeUsesForBytecodeOffset):
 610             (JSC::computeDefsForBytecodeOffset):
 611             * bytecode/CallLinkStatus.h:
 612             (JSC::CallLinkStatus::CallLinkStatus):
 613             * bytecode/CodeBlock.cpp:
 614             (JSC::CodeBlock::dumpBytecode):
 615             (JSC::CodeBlock::CodeBlock):
 616             * bytecompiler/BytecodeGenerator.cpp:
 617             (JSC::BytecodeGenerator::emitGetByVal):
 618             (JSC::BytecodeGenerator::emitComplexPopScopes):
 619             (JSC::BytecodeGenerator::emitGetEnumerableLength):
 620             (JSC::BytecodeGenerator::emitHasGenericProperty):
 621             (JSC::BytecodeGenerator::emitHasIndexedProperty):
 622             (JSC::BytecodeGenerator::emitHasStructureProperty):
 623             (JSC::BytecodeGenerator::emitGetStructurePropertyEnumerator):
 624             (JSC::BytecodeGenerator::emitGetGenericPropertyEnumerator):
 625             (JSC::BytecodeGenerator::emitNextEnumeratorPropertyName):
 626             (JSC::BytecodeGenerator::emitToIndexString):
 627             (JSC::BytecodeGenerator::pushIndexedForInScope):
 628             (JSC::BytecodeGenerator::popIndexedForInScope):
 629             (JSC::BytecodeGenerator::pushStructureForInScope):
 630             (JSC::BytecodeGenerator::popStructureForInScope):
 631             (JSC::BytecodeGenerator::invalidateForInContextForLocal):
 632             * bytecompiler/BytecodeGenerator.h:
 633             (JSC::ForInContext::ForInContext):
 634             (JSC::ForInContext::~ForInContext):
 635             (JSC::ForInContext::isValid):
 636             (JSC::ForInContext::invalidate):
 637             (JSC::ForInContext::local):
 638             (JSC::StructureForInContext::StructureForInContext):
 639             (JSC::StructureForInContext::type):
 640             (JSC::StructureForInContext::index):
 641             (JSC::StructureForInContext::property):
 642             (JSC::StructureForInContext::enumerator):
 643             (JSC::IndexedForInContext::IndexedForInContext):
 644             (JSC::IndexedForInContext::type):
 645             (JSC::IndexedForInContext::index):
 646             (JSC::BytecodeGenerator::pushOptimisedForIn): Deleted.
 647             (JSC::BytecodeGenerator::popOptimisedForIn): Deleted.
 648             * bytecompiler/NodesCodegen.cpp:
 649             (JSC::ReadModifyResolveNode::emitBytecode):
 650             (JSC::AssignResolveNode::emitBytecode):
 651             (JSC::ForInNode::tryGetBoundLocal):
 652             (JSC::ForInNode::emitLoopHeader):
 653             (JSC::ForInNode::emitMultiLoopBytecode):
 654             (JSC::ForInNode::emitBytecode):
 655             * debugger/DebuggerScope.h:
 656             * dfg/DFGAbstractHeap.h:
 657             * dfg/DFGAbstractInterpreterInlines.h:
 658             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
 659             * dfg/DFGByteCodeParser.cpp:
 660             (JSC::DFG::ByteCodeParser::parseBlock):
 661             * dfg/DFGCapabilities.cpp:
 662             (JSC::DFG::capabilityLevel):
 663             * dfg/DFGClobberize.h:
 664             (JSC::DFG::clobberize):
 665             * dfg/DFGDoesGC.cpp:
 666             (JSC::DFG::doesGC):
 667             * dfg/DFGFixupPhase.cpp:
 668             (JSC::DFG::FixupPhase::fixupNode):
 669             * dfg/DFGHeapLocation.cpp:
 670             (WTF::printInternal):
 671             * dfg/DFGHeapLocation.h:
 672             * dfg/DFGNode.h:
 673             (JSC::DFG::Node::hasHeapPrediction):
 674             (JSC::DFG::Node::hasArrayMode):
 675             * dfg/DFGNodeType.h:
 676             * dfg/DFGPredictionPropagationPhase.cpp:
 677             (JSC::DFG::PredictionPropagationPhase::propagate):
 678             * dfg/DFGSafeToExecute.h:
 679             (JSC::DFG::safeToExecute):
 680             * dfg/DFGSpeculativeJIT.h:
 681             (JSC::DFG::SpeculativeJIT::callOperation):
 682             * dfg/DFGSpeculativeJIT32_64.cpp:
 683             (JSC::DFG::SpeculativeJIT::compile):
 684             * dfg/DFGSpeculativeJIT64.cpp:
 685             (JSC::DFG::SpeculativeJIT::compile):
 686             * jit/JIT.cpp:
 687             (JSC::JIT::privateCompileMainPass):
 688             (JSC::JIT::privateCompileSlowCases):
 689             * jit/JIT.h:
 690             (JSC::JIT::compileHasIndexedProperty):
 691             (JSC::JIT::emitInt32Load):
 692             * jit/JITInlines.h:
 693             (JSC::JIT::emitDoubleGetByVal):
 694             (JSC::JIT::emitLoadForArrayMode):
 695             (JSC::JIT::emitContiguousGetByVal):
 696             (JSC::JIT::emitArrayStorageGetByVal):
 697             * jit/JITOpcodes.cpp:
 698             (JSC::JIT::emit_op_get_enumerable_length):
 699             (JSC::JIT::emit_op_has_structure_property):
 700             (JSC::JIT::emitSlow_op_has_structure_property):
 701             (JSC::JIT::emit_op_has_generic_property):
 702             (JSC::JIT::privateCompileHasIndexedProperty):
 703             (JSC::JIT::emit_op_has_indexed_property):
 704             (JSC::JIT::emitSlow_op_has_indexed_property):
 705             (JSC::JIT::emit_op_get_direct_pname):
 706             (JSC::JIT::emitSlow_op_get_direct_pname):
 707             (JSC::JIT::emit_op_get_structure_property_enumerator):
 708             (JSC::JIT::emit_op_get_generic_property_enumerator):
 709             (JSC::JIT::emit_op_next_enumerator_pname):
 710             (JSC::JIT::emit_op_to_index_string):
 711             * jit/JITOpcodes32_64.cpp:
 712             (JSC::JIT::emit_op_get_enumerable_length):
 713             (JSC::JIT::emit_op_has_structure_property):
 714             (JSC::JIT::emitSlow_op_has_structure_property):
 715             (JSC::JIT::emit_op_has_generic_property):
 716             (JSC::JIT::privateCompileHasIndexedProperty):
 717             (JSC::JIT::emit_op_has_indexed_property):
 718             (JSC::JIT::emitSlow_op_has_indexed_property):
 719             (JSC::JIT::emit_op_get_direct_pname):
 720             (JSC::JIT::emitSlow_op_get_direct_pname):
 721             (JSC::JIT::emit_op_get_structure_property_enumerator):
 722             (JSC::JIT::emit_op_get_generic_property_enumerator):
 723             (JSC::JIT::emit_op_next_enumerator_pname):
 724             (JSC::JIT::emit_op_to_index_string):
 725             * jit/JITOperations.cpp:
 726             * jit/JITOperations.h:
 727             * jit/JITPropertyAccess.cpp:
 728             (JSC::JIT::emitDoubleLoad):
 729             (JSC::JIT::emitContiguousLoad):
 730             (JSC::JIT::emitArrayStorageLoad):
 731             (JSC::JIT::emitDoubleGetByVal): Deleted.
 732             (JSC::JIT::emitContiguousGetByVal): Deleted.
 733             (JSC::JIT::emitArrayStorageGetByVal): Deleted.
 734             * jit/JITPropertyAccess32_64.cpp:
 735             (JSC::JIT::emitContiguousLoad):
 736             (JSC::JIT::emitDoubleLoad):
 737             (JSC::JIT::emitArrayStorageLoad):
 738             (JSC::JIT::emitContiguousGetByVal): Deleted.
 739             (JSC::JIT::emitDoubleGetByVal): Deleted.
 740             (JSC::JIT::emitArrayStorageGetByVal): Deleted.
 741             * llint/LowLevelInterpreter.asm:
 742             * parser/Nodes.h:
 743             * runtime/Arguments.cpp:
 744             (JSC::Arguments::getOwnPropertyNames):
 745             * runtime/ClassInfo.h:
 746             * runtime/CommonSlowPaths.cpp:
 747             (JSC::SLOW_PATH_DECL):
 748             * runtime/CommonSlowPaths.h:
 749             * runtime/EnumerationMode.h: Added.
 750             (JSC::shouldIncludeDontEnumProperties):
 751             (JSC::shouldExcludeDontEnumProperties):
 752             (JSC::shouldIncludeJSObjectPropertyNames):
 753             (JSC::modeThatSkipsJSObject):
 754             * runtime/JSActivation.cpp:
 755             (JSC::JSActivation::getOwnNonIndexPropertyNames):
 756             * runtime/JSArray.cpp:
 757             (JSC::JSArray::getOwnNonIndexPropertyNames):
 758             * runtime/JSArrayBuffer.cpp:
 759             (JSC::JSArrayBuffer::getOwnNonIndexPropertyNames):
 760             * runtime/JSArrayBufferView.cpp:
 761             (JSC::JSArrayBufferView::getOwnNonIndexPropertyNames):
 762             * runtime/JSCell.cpp:
 763             (JSC::JSCell::getEnumerableLength):
 764             (JSC::JSCell::getStructurePropertyNames):
 765             (JSC::JSCell::getGenericPropertyNames):
 766             * runtime/JSCell.h:
 767             * runtime/JSFunction.cpp:
 768             (JSC::JSFunction::getOwnNonIndexPropertyNames):
 769             * runtime/JSGenericTypedArrayViewInlines.h:
 770             (JSC::JSGenericTypedArrayView<Adaptor>::getOwnNonIndexPropertyNames):
 771             * runtime/JSObject.cpp:
 772             (JSC::getClassPropertyNames):
 773             (JSC::JSObject::hasOwnProperty):
 774             (JSC::JSObject::getOwnPropertyNames):
 775             (JSC::JSObject::getOwnNonIndexPropertyNames):
 776             (JSC::JSObject::getEnumerableLength):
 777             (JSC::JSObject::getStructurePropertyNames):
 778             (JSC::JSObject::getGenericPropertyNames):
 779             * runtime/JSObject.h:
 780             * runtime/JSPropertyNameEnumerator.cpp: Added.
 781             (JSC::JSPropertyNameEnumerator::create):
 782             (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
 783             (JSC::JSPropertyNameEnumerator::finishCreation):
 784             (JSC::JSPropertyNameEnumerator::destroy):
 785             (JSC::JSPropertyNameEnumerator::visitChildren):
 786             * runtime/JSPropertyNameEnumerator.h: Added.
 787             (JSC::JSPropertyNameEnumerator::createStructure):
 788             (JSC::JSPropertyNameEnumerator::propertyNameAtIndex):
 789             (JSC::JSPropertyNameEnumerator::identifierSet):
 790             (JSC::JSPropertyNameEnumerator::cachedPrototypeChain):
 791             (JSC::JSPropertyNameEnumerator::setCachedPrototypeChain):
 792             (JSC::JSPropertyNameEnumerator::cachedStructure):
 793             (JSC::JSPropertyNameEnumerator::cachedStructureID):
 794             (JSC::JSPropertyNameEnumerator::cachedInlineCapacity):
 795             (JSC::JSPropertyNameEnumerator::cachedStructureIDOffset):
 796             (JSC::JSPropertyNameEnumerator::cachedInlineCapacityOffset):
 797             (JSC::JSPropertyNameEnumerator::cachedPropertyNamesLengthOffset):
 798             (JSC::JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset):
 799             (JSC::structurePropertyNameEnumerator):
 800             (JSC::genericPropertyNameEnumerator):
 801             * runtime/JSProxy.cpp:
 802             (JSC::JSProxy::getEnumerableLength):
 803             (JSC::JSProxy::getStructurePropertyNames):
 804             (JSC::JSProxy::getGenericPropertyNames):
 805             * runtime/JSProxy.h:
 806             * runtime/JSSymbolTableObject.cpp:
 807             (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
 808             * runtime/PropertyNameArray.cpp:
 809             (JSC::PropertyNameArray::add):
 810             (JSC::PropertyNameArray::setPreviouslyEnumeratedProperties):
 811             * runtime/PropertyNameArray.h:
 812             (JSC::RefCountedIdentifierSet::contains):
 813             (JSC::RefCountedIdentifierSet::size):
 814             (JSC::RefCountedIdentifierSet::add):
 815             (JSC::PropertyNameArray::PropertyNameArray):
 816             (JSC::PropertyNameArray::add):
 817             (JSC::PropertyNameArray::addKnownUnique):
 818             (JSC::PropertyNameArray::identifierSet):
 819             (JSC::PropertyNameArray::canAddKnownUniqueForStructure):
 820             (JSC::PropertyNameArray::setPreviouslyEnumeratedLength):
 821             * runtime/RegExpObject.cpp:
 822             (JSC::RegExpObject::getOwnNonIndexPropertyNames):
 823             (JSC::RegExpObject::getPropertyNames):
 824             (JSC::RegExpObject::getGenericPropertyNames):
 825             * runtime/RegExpObject.h:
 826             * runtime/StringObject.cpp:
 827             (JSC::StringObject::getOwnPropertyNames):
 828             * runtime/Structure.cpp:
 829             (JSC::Structure::getPropertyNamesFromStructure):
 830             (JSC::Structure::setCachedStructurePropertyNameEnumerator):
 831             (JSC::Structure::cachedStructurePropertyNameEnumerator):
 832             (JSC::Structure::setCachedGenericPropertyNameEnumerator):
 833             (JSC::Structure::cachedGenericPropertyNameEnumerator):
 834             (JSC::Structure::canCacheStructurePropertyNameEnumerator):
 835             (JSC::Structure::canCacheGenericPropertyNameEnumerator):
 836             (JSC::Structure::canAccessPropertiesQuickly):
 837             * runtime/Structure.h:
 838             * runtime/StructureRareData.cpp:
 839             (JSC::StructureRareData::visitChildren):
 840             (JSC::StructureRareData::cachedStructurePropertyNameEnumerator):
 841             (JSC::StructureRareData::setCachedStructurePropertyNameEnumerator):
 842             (JSC::StructureRareData::cachedGenericPropertyNameEnumerator):
 843             (JSC::StructureRareData::setCachedGenericPropertyNameEnumerator):
 844             * runtime/StructureRareData.h:
 845             * runtime/VM.cpp:
 846             (JSC::VM::VM):
 847             * runtime/VM.h:
 848
 849     2014-07-23  Saam Barati  <sbarati@apple.com>
 850
 851             Make improvements to Type Profiling
 852             https://bugs.webkit.org/show_bug.cgi?id=134860
 853
 854             Reviewed by Filip Pizlo.
 855
 856             I improved the API between the inspector and JSC. We no longer send one huge
 857             string to the inspector. We now send structured data that represents the type
 858             information that JSC has collected. I've also created a beginning implementation
 859             of a type lattice that allows us to resolve a display name for a type that
 860             consists of a single word.
 861
 862             I created a data structure that knows which functions have executed. This
 863             solves the bug where types inside an un-executed function will resolve
 864             to the type of the enclosing expression of that function. This data
 865             structure may also be useful later if the inspector chooses to create a UI
 866             around showing which functions have executed.
 867
 868             Better type information is gathered for objects. StructureShape now
 869             represents an object's prototype chain.  StructureShape also collects
 870             the constructor name for an object.
 871
 872             Expression ranges are now zero indexed.
 873
 874             Removed some extraneous methods.
 875
 876             * JavaScriptCore.xcodeproj/project.pbxproj:
 877             * bytecode/CodeBlock.cpp:
 878             (JSC::CodeBlock::CodeBlock):
 879             (JSC::CodeBlock::scopeDependentProfile):
 880             * bytecode/CodeBlock.h:
 881             * bytecode/TypeLocation.h:
 882             (JSC::TypeLocation::TypeLocation):
 883             * bytecode/UnlinkedCodeBlock.cpp:
 884             (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
 885             * bytecode/UnlinkedCodeBlock.h:
 886             (JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingStartOffset):
 887             (JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingEndOffset):
 888             * bytecompiler/BytecodeGenerator.cpp:
 889             (JSC::BytecodeGenerator::BytecodeGenerator):
 890             (JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo):
 891             * bytecompiler/BytecodeGenerator.h:
 892             (JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo): Deleted.
 893             * heap/Heap.cpp:
 894             (JSC::Heap::collect):
 895             * inspector/agents/InspectorRuntimeAgent.cpp:
 896             (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
 897             (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableAtOffset): Deleted.
 898             * inspector/agents/InspectorRuntimeAgent.h:
 899             * inspector/protocol/Runtime.json:
 900             * runtime/Executable.cpp:
 901             (JSC::ScriptExecutable::ScriptExecutable):
 902             (JSC::ProgramExecutable::ProgramExecutable):
 903             (JSC::FunctionExecutable::FunctionExecutable):
 904             (JSC::ProgramExecutable::initializeGlobalProperties):
 905             * runtime/Executable.h:
 906             (JSC::ScriptExecutable::highFidelityTypeProfilingStartOffset):
 907             (JSC::ScriptExecutable::highFidelityTypeProfilingEndOffset):
 908             * runtime/FunctionHasExecutedCache.cpp: Added.
 909             (JSC::FunctionHasExecutedCache::hasExecutedAtOffset):
 910             (JSC::FunctionHasExecutedCache::insertUnexecutedRange):
 911             (JSC::FunctionHasExecutedCache::removeUnexecutedRange):
 912             * runtime/FunctionHasExecutedCache.h: Added.
 913             (JSC::FunctionHasExecutedCache::FunctionRange::FunctionRange):
 914             (JSC::FunctionHasExecutedCache::FunctionRange::operator==):
 915             (JSC::FunctionHasExecutedCache::FunctionRange::hash):
 916             * runtime/HighFidelityLog.cpp:
 917             (JSC::HighFidelityLog::processHighFidelityLog):
 918             (JSC::HighFidelityLog::actuallyProcessLogThreadFunction): Deleted.
 919             * runtime/HighFidelityLog.h:
 920             (JSC::HighFidelityLog::recordTypeInformationForLocation):
 921             * runtime/HighFidelityTypeProfiler.cpp:
 922             (JSC::HighFidelityTypeProfiler::logTypesForTypeLocation):
 923             (JSC::HighFidelityTypeProfiler::insertNewLocation):
 924             (JSC::HighFidelityTypeProfiler::getTypesForVariableAtOffsetForInspector):
 925             (JSC::descriptorMatchesTypeLocation):
 926             (JSC::HighFidelityTypeProfiler::findLocation):
 927             (JSC::HighFidelityTypeProfiler::getTypesForVariableInAtOffset): Deleted.
 928             (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableAtOffset): Deleted.
 929             (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableAtOffset): Deleted.
 930             * runtime/HighFidelityTypeProfiler.h:
 931             (JSC::QueryKey::QueryKey):
 932             (JSC::QueryKey::isHashTableDeletedValue):
 933             (JSC::QueryKey::operator==):
 934             (JSC::QueryKey::hash):
 935             (JSC::QueryKeyHash::hash):
 936             (JSC::QueryKeyHash::equal):
 937             (JSC::HighFidelityTypeProfiler::functionHasExecutedCache):
 938             (JSC::HighFidelityTypeProfiler::typeLocationCache):
 939             * runtime/Structure.cpp:
 940             (JSC::Structure::toStructureShape):
 941             * runtime/Structure.h:
 942             * runtime/TypeLocationCache.cpp: Added.
 943             (JSC::TypeLocationCache::getTypeLocation):
 944             * runtime/TypeLocationCache.h: Added.
 945             (JSC::TypeLocationCache::LocationKey::LocationKey):
 946             (JSC::TypeLocationCache::LocationKey::operator==):
 947             (JSC::TypeLocationCache::LocationKey::hash):
 948             * runtime/TypeSet.cpp:
 949             (JSC::TypeSet::getRuntimeTypeForValue):
 950             (JSC::TypeSet::addTypeForValue):
 951             (JSC::TypeSet::seenTypes):
 952             (JSC::TypeSet::doesTypeConformTo):
 953             (JSC::TypeSet::displayName):
 954             (JSC::TypeSet::allPrimitiveTypeNames):
 955             (JSC::TypeSet::allStructureRepresentations):
 956             (JSC::TypeSet::leastCommonAncestor):
 957             (JSC::StructureShape::StructureShape):
 958             (JSC::StructureShape::addProperty):
 959             (JSC::StructureShape::propertyHash):
 960             (JSC::StructureShape::leastCommonAncestor):
 961             (JSC::StructureShape::stringRepresentation):
 962             (JSC::StructureShape::inspectorRepresentation):
 963             (JSC::StructureShape::leastUpperBound): Deleted.
 964             * runtime/TypeSet.h:
 965             (JSC::StructureShape::setConstructorName):
 966             (JSC::StructureShape::constructorName):
 967             (JSC::StructureShape::setProto):
 968             * runtime/VM.cpp:
 969             (JSC::VM::dumpHighFidelityProfilingTypes):
 970             (JSC::VM::getTypesForVariableAtOffset): Deleted.
 971             (JSC::VM::updateHighFidelityTypeProfileState): Deleted.
 972             * runtime/VM.h:
 973             (JSC::VM::isProfilingTypesWithHighFidelity):
 974             (JSC::VM::highFidelityTypeProfiler):
 975
 976     2014-07-23  Filip Pizlo  <fpizlo@apple.com>
 977
 978             Fix debug build.
 979
 980             * bytecode/CallLinkStatus.h:
 981             (JSC::CallLinkStatus::CallLinkStatus):
 982
 983     2014-07-20  Filip Pizlo  <fpizlo@apple.com>
 984
 985             [ftlopt] Phantoms in SSA form should be aggressively hoisted
 986             https://bugs.webkit.org/show_bug.cgi?id=135111
 987
 988             Reviewed by Oliver Hunt.
 989
 990             In CPS form, Phantom means three things: (1) that the children should be kept alive so long
 991             as they are relevant to OSR (due to a MovHint), (2) that the children are live-in-bytecode
 992             at the point of the Phantom, and (3) that some checks should be performed. In SSA, the
 993             second meaning is not used but the other two stay.
 994
 995             The fact that a Phantom that is used to keep a node alive could be anywhere in the graph,
 996             even in a totally different basic block, complicates some SSA transformations. It's not
 997             possible to just jettison some successor, since tha successor could have a Phantom that we
 998             care about.
 999
1000             This change rationalizes how Phantoms work so that:
1001
1002             1) Phantoms keep children alive so long as those children are relevant to OSR. This is true
1003                in both CPS and SSA. This was true before and it's true now.
1004
1005             2) Phantoms are used for live-in-bytecode only in CPS. This was true before and it's true
1006                now, except that now we also don't bother preserving the live-in-bytecode information
1007                that Phantoms convey, when we are in SSA.
1008
1009             3) Phantoms may incidentally have checks, but in cases where we only want checks, we now
1010                use Check instead of Phantom. Notably, DCE phase has dead nodes decay to Check, not
1011                Phantom.
1012
1013             The biggest part of this change is that in SSA, we canonicalize Phantoms:
1014
1015             - All Phantoms are replaced with Check nodes that include only those edges that have
1016               checks.
1017
1018             - Nodes that were the children of any Phantoms have a Phantom right after them.
1019
1020             For example, the following code:
1021
1022                 5: ArithAdd(@1, @2)
1023                 6: ArithSub(@5, @3)
1024                 7: Phantom(Int32:@5)
1025
1026             would be turned into the following:
1027
1028                 5: ArithAdd(@1, @2)
1029                 8: Phantom(@5) // @5 was the child of a Phantom, so we create a new Phantom right after
1030                                // @5. This is the only Phantom we will have for @5.
1031                 6: ArithSub(@5, @3)
1032                 7: Check(Int32:@5) // We replace the Phantom with a Check; in this case since Int32: is
1033                                    // a checking edge, we leave it.
1034
1035             This is a slight speed-up across the board, presumably because we now do a better job of
1036             reducing the size of the graph during compilation. It could also be a fluke, though. The
1037             main purpose of this is to unlock some other work (like CFG simplification in SSA). It will
1038             become a requirement to run phantom canonicalization prior to some SSA phases. None of the
1039             current phases need it, but future phases probably will.
1040
1041             * CMakeLists.txt:
1042             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1043             * JavaScriptCore.xcodeproj/project.pbxproj:
1044             * dfg/DFGAbstractInterpreterInlines.h:
1045             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1046             * dfg/DFGConstantFoldingPhase.cpp:
1047             (JSC::DFG::ConstantFoldingPhase::foldConstants):
1048             * dfg/DFGDCEPhase.cpp:
1049             (JSC::DFG::DCEPhase::run):
1050             (JSC::DFG::DCEPhase::findTypeCheckRoot):
1051             (JSC::DFG::DCEPhase::countEdge):
1052             (JSC::DFG::DCEPhase::fixupBlock):
1053             (JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):
1054             * dfg/DFGEdge.cpp:
1055             (JSC::DFG::Edge::dump):
1056             * dfg/DFGEdge.h:
1057             (JSC::DFG::Edge::isProved):
1058             (JSC::DFG::Edge::needsCheck): Deleted.
1059             * dfg/DFGNodeFlags.h:
1060             * dfg/DFGPhantomCanonicalizationPhase.cpp: Added.
1061             (JSC::DFG::PhantomCanonicalizationPhase::PhantomCanonicalizationPhase):
1062             (JSC::DFG::PhantomCanonicalizationPhase::run):
1063             (JSC::DFG::performPhantomCanonicalization):
1064             * dfg/DFGPhantomCanonicalizationPhase.h: Added.
1065             * dfg/DFGPhantomRemovalPhase.cpp:
1066             (JSC::DFG::PhantomRemovalPhase::run):
1067             * dfg/DFGPhantomRemovalPhase.h:
1068             * dfg/DFGPlan.cpp:
1069             (JSC::DFG::Plan::compileInThreadImpl):
1070             * ftl/FTLLowerDFGToLLVM.cpp:
1071             (JSC::FTL::LowerDFGToLLVM::lowJSValue):
1072             (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
1073
1074     2014-07-22  Filip Pizlo  <fpizlo@apple.com>
1075
1076             [ftlopt] Get rid of structure checks as a way of checking if a function is in fact a function
1077             https://bugs.webkit.org/show_bug.cgi?id=135146
1078
1079             Reviewed by Oliver Hunt.
1080
1081             This greatly simplifies our closure call optimizations by taking advantage of the type
1082             bits available in the cell header.
1083
1084             * bytecode/CallLinkInfo.cpp:
1085             (JSC::CallLinkInfo::visitWeak):
1086             * bytecode/CallLinkStatus.cpp:
1087             (JSC::CallLinkStatus::CallLinkStatus):
1088             (JSC::CallLinkStatus::computeFor):
1089             (JSC::CallLinkStatus::dump):
1090             * bytecode/CallLinkStatus.h:
1091             (JSC::CallLinkStatus::CallLinkStatus):
1092             (JSC::CallLinkStatus::executable):
1093             (JSC::CallLinkStatus::structure): Deleted.
1094             * dfg/DFGByteCodeParser.cpp:
1095             (JSC::DFG::ByteCodeParser::emitFunctionChecks):
1096             * dfg/DFGFixupPhase.cpp:
1097             (JSC::DFG::FixupPhase::fixupNode):
1098             (JSC::DFG::FixupPhase::observeUseKindOnNode):
1099             * dfg/DFGSafeToExecute.h:
1100             (JSC::DFG::SafeToExecuteEdge::operator()):
1101             * dfg/DFGSpeculativeJIT.cpp:
1102             (JSC::DFG::SpeculativeJIT::checkArray):
1103             (JSC::DFG::SpeculativeJIT::speculateCellTypeWithoutTypeFiltering):
1104             (JSC::DFG::SpeculativeJIT::speculateCellType):
1105             (JSC::DFG::SpeculativeJIT::speculateFunction):
1106             (JSC::DFG::SpeculativeJIT::speculateFinalObject):
1107             (JSC::DFG::SpeculativeJIT::speculate):
1108             * dfg/DFGSpeculativeJIT.h:
1109             * dfg/DFGSpeculativeJIT32_64.cpp:
1110             (JSC::DFG::SpeculativeJIT::compile):
1111             * dfg/DFGSpeculativeJIT64.cpp:
1112             (JSC::DFG::SpeculativeJIT::compile):
1113             * dfg/DFGUseKind.cpp:
1114             (WTF::printInternal):
1115             * dfg/DFGUseKind.h:
1116             (JSC::DFG::typeFilterFor):
1117             (JSC::DFG::isCell):
1118             * ftl/FTLCapabilities.cpp:
1119             (JSC::FTL::canCompile):
1120             * ftl/FTLLowerDFGToLLVM.cpp:
1121             (JSC::FTL::LowerDFGToLLVM::compileCheckExecutable):
1122             (JSC::FTL::LowerDFGToLLVM::speculate):
1123             (JSC::FTL::LowerDFGToLLVM::isFunction):
1124             (JSC::FTL::LowerDFGToLLVM::isNotFunction):
1125             (JSC::FTL::LowerDFGToLLVM::speculateFunction):
1126             * jit/ClosureCallStubRoutine.cpp:
1127             (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
1128             (JSC::ClosureCallStubRoutine::markRequiredObjectsInternal):
1129             * jit/ClosureCallStubRoutine.h:
1130             (JSC::ClosureCallStubRoutine::structure): Deleted.
1131             * jit/JIT.h:
1132             (JSC::JIT::compileClosureCall): Deleted.
1133             * jit/JITCall.cpp:
1134             (JSC::JIT::privateCompileClosureCall): Deleted.
1135             * jit/JITCall32_64.cpp:
1136             (JSC::JIT::privateCompileClosureCall): Deleted.
1137             * jit/JITOperations.cpp:
1138             * jit/Repatch.cpp:
1139             (JSC::linkClosureCall):
1140             * jit/Repatch.h:
1141
1142 2014-08-06  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
1143
1144         [ARM] Incorrect handling of Unicode characters
1145         https://bugs.webkit.org/show_bug.cgi?id=135380
1146
1147         Reviewed by Darin Adler.
1148
1149         Removed erroneous fast case from stringFromUTF(), since it assumed that
1150         char is always implemented as signed.
1151
1152         * jsc.cpp:
1153         (stringFromUTF):
1154
1155 2014-08-06  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
1156
1157         [JSC] Build fix for FTL on EFL after ftlopt merge
1158         https://bugs.webkit.org/show_bug.cgi?id=135565
1159
1160         Reviewed by Mark Lam.
1161
1162         Adding an enable guard for native inlining, since it now requires the bitcode
1163         emitted from Clang, and we don't have a good way of creating it from other compilers.
1164
1165         * dfg/DFGByteCodeParser.cpp:
1166         (JSC::DFG::ByteCodeParser::handleCall):
1167         * ftl/FTLLowerDFGToLLVM.cpp:
1168         (JSC::FTL::LowerDFGToLLVM::compileNode):
1169         * ftl/FTLState.cpp:
1170         (JSC::FTL::State::State):
1171         * ftl/FTLState.h:
1172
1173 2014-08-05  Csaba Osztrogonác  <ossy@webkit.org>
1174
1175         URTBF after r172129. (ftlopt branch merge)
1176
1177         Remove the duplicated friend declaration to fix this build failure:
1178         "error: ‘JSC::Structure’ is already a friend of ‘JSC::StructureRareData’ [-Werror]"
1179
1180         * runtime/StructureRareData.h:
1181
1182 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1183
1184         Attempt to fix CMake-based builds, part 3.
1185
1186         * CMakeLists.txt:
1187
1188 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1189
1190         Attempt to fix CMake-based builds, part 2.
1191
1192         * CMakeLists.txt:
1193
1194 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1195
1196         Attempt to fix Windows build, part 2.
1197
1198         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1199
1200 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1201
1202         Attempt to fix CMake-based builds.
1203
1204         * CMakeLists.txt:
1205
1206 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1207
1208         Attempt to fix Windows build.
1209
1210         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1211
1212 2014-08-05  Filip Pizlo  <fpizlo@apple.com>
1213
1214         Fix cloop build.
1215
1216         * bytecode/CodeBlock.cpp:
1217         (JSC::CodeBlock::jettison):
1218
1219 2014-07-29  Filip Pizlo  <fpizlo@apple.com>
1220
1221         Merge r170564, r170571, r170604, r170628, r170672, r170680, r170724, r170728, r170729, r170819, r170821, r170836, r170855, r170860, r170890, r170907, r170929, r171052, r171106, r171152, r171153, r171214 from ftlopt.
1222
1223         This part of the merge delivers roughly a 2% across-the-board performance
1224         improvement, mostly due to immutable property inference and DFG-side GCSE. It also
1225         almost completely resolves accessor performance issues; in the common case the DFG
1226         will compile a getter/setter access into code that is just as efficient as a normal
1227         property access.
1228
1229         Another major highlight of this part of the merge is the work to add a type profiler
1230         to the inspector. This work is still on-going but this greatly increases coverage.
1231
1232         Note that this merge fixes a minor bug in the GetterSetter refactoring from
1233         http://trac.webkit.org/changeset/170729 (https://bugs.webkit.org/show_bug.cgi?id=134518).
1234         It also adds a new tests to tests/stress to cover that bug. That bug was previously only
1235         covered by layout tests.
1236
1237     2014-07-17  Filip Pizlo  <fpizlo@apple.com>
1238
1239             [ftlopt] DFG Flush(SetLocal) store elimination is overzealous for captured variables in the presence of nodes that have no effects but may throw (merge trunk r171190)
1240             https://bugs.webkit.org/show_bug.cgi?id=135019
1241
1242             Reviewed by Oliver Hunt.
1243
1244             Behaviorally, this is just a merge of trunk r171190, except that the relevant functionality
1245             has moved to StrengthReductionPhase and is written in a different style. Same algorithm,
1246             different code.
1247
1248             * dfg/DFGNodeType.h:
1249             * dfg/DFGStrengthReductionPhase.cpp:
1250             (JSC::DFG::StrengthReductionPhase::handleNode):
1251             * tests/stress/capture-escape-and-throw.js: Added.
1252             (foo.f):
1253             (foo):
1254             * tests/stress/new-array-with-size-throw-exception-and-tear-off-arguments.js: Added.
1255             (foo):
1256             (bar):
1257
1258     2014-07-15  Filip Pizlo  <fpizlo@apple.com>
1259
1260             [ftlopt] Constant fold GetGetter and GetSetter if the GetterSetter is a constant
1261             https://bugs.webkit.org/show_bug.cgi?id=134962
1262
1263             Reviewed by Oliver Hunt.
1264
1265             This removes yet another steady-state-throughput implication of using getters and setters:
1266             if your accessor call is monomorphic then you'll just get a structure check, nothing more.
1267             No more loads to get to the GetterSetter object or the accessor function object.
1268
1269             * dfg/DFGAbstractInterpreterInlines.h:
1270             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1271             * runtime/GetterSetter.h:
1272             (JSC::GetterSetter::getterConcurrently):
1273             (JSC::GetterSetter::setGetter):
1274             (JSC::GetterSetter::setterConcurrently):
1275             (JSC::GetterSetter::setSetter):
1276
1277     2014-07-15  Filip Pizlo  <fpizlo@apple.com>
1278
1279             [ftlopt] Identity replacement in CSE shouldn't create a Phantom over the Identity's children
1280             https://bugs.webkit.org/show_bug.cgi?id=134893
1281
1282             Reviewed by Oliver Hunt.
1283
1284             Replace Identity with Check instead of Phantom. Phantom means that the child of the
1285             Identity should be unconditionally live. The liveness semantics of Identity are such that
1286             if the parents of Identity are live then the child is live. Removing the Identity entirely
1287             preserves such liveness semantics. So, the only thing that should be left behind is the
1288             type check on the child, which is what Check means: do the check but don't keep the child
1289             alive if the check isn't needed.
1290
1291             * dfg/DFGCSEPhase.cpp:
1292             * dfg/DFGNode.h:
1293             (JSC::DFG::Node::convertToCheck):
1294
1295     2014-07-13  Filip Pizlo  <fpizlo@apple.com>
1296
1297             [ftlopt] DFG should be able to do GCSE in SSA and this should be unified with the CSE in CPS, and both of these things should use abstract heaps for reasoning about effects
1298             https://bugs.webkit.org/show_bug.cgi?id=134677
1299
1300             Reviewed by Sam Weinig.
1301
1302             This removes the old local CSE phase, which was based on manually written backward-search
1303             rules for all of the different kinds of things we cared about, and adds a new local/global
1304             CSE (local for CPS and global for SSA) that leaves the node semantics almost entirely up to
1305             clobberize(). Thus, the CSE phase itself just worries about the algorithms and data
1306             structures used for storing sets of available values. This results in a large reduction in
1307             code size in CSEPhase.cpp while greatly increasing the phase's power (since it now does
1308             global CSE) and reducing compile time (since local CSE is now rewritten to use smarter data
1309             structures). Even though LLVM was already running GVN, the extra GCSE at DFG IR level means
1310             that this is a significant (~0.7%) throughput improvement.
1311
1312             This work is based on the concept of "def" to clobberize(). If clobberize() calls def(), it
1313             means that the node being analyzed makes available some value in some DFG node, and that
1314             future attempts to compute that value can simply use that node. In other words, it
1315             establishes an available value mapping of the form value=>node. There are two kinds of
1316             values that can be passed to def():
1317
1318             PureValue. This captures everything needed to determine whether two pure nodes - nodes that
1319                 neither read nor write, and produce a value that is a CSE candidate - are identical. It
1320                 carries the NodeType, an AdjacencyList, and one word of meta-data. The meta-data is
1321                 usually used for things like the arithmetic mode or constant pointer. Passing a
1322                 PureValue to def() means that the node produces a value that is valid anywhere that the
1323                 node dominates.
1324
1325             HeapLocation. This describes a location in the heap that could be written to or read from.
1326                 Both stores and loads can def() a HeapLocation. HeapLocation carries around an abstract
1327                 heap that both serves as part of the "name" of the heap location (together with the
1328                 other fields of HeapLocation) and also tells us what write()'s to watch for. If someone
1329                 write()'s to an abstract heap that overlaps the heap associated with the HeapLocation,
1330                 then it means that the values for that location are no longer available.
1331
1332             This approach is sufficiently clever that the CSEPhase itself can focus on the mechanism of
1333             tracking the PureValue=>node and HeapLocation=>node maps, without having to worry about
1334             interpreting the semantics of different DFG node types - that is now almost entirely in
1335             clobberize(). The only things we special-case inside CSEPhase are the Identity node, which
1336             CSE is traditionally responsible for eliminating even though it has nothing to do with CSE,
1337             and the LocalCSE rule for turning PutByVal into PutByValAlias.
1338
1339             This is a slight Octane, SunSpider, and Kraken speed-up - all somewhere arond 0.7% . It's
1340             not a bigger win because LLVM was already giving us most of what we needed in its GVN.
1341             Also, the SunSpider speed-up isn't from GCSE as much as it's a clean-up of local CSE - that
1342             is no longer O(n^2). Basically this is purely good: it reduces the amount of LLVM IR we
1343             generate, it removes the old CSE's heap modeling (which was a constant source of bugs), and
1344             it improves both the quality of the code we generate and the speed with which we generate
1345             it. Also, any future optimizations that depend on GCSE will now be easier to implement.
1346
1347             During the development of this patch I also rationalized some other stuff, like Graph's
1348             ordered traversals - we now have preorder and postorder rather than just "depth first".
1349
1350             * CMakeLists.txt:
1351             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1352             * JavaScriptCore.xcodeproj/project.pbxproj:
1353             * dfg/DFGAbstractHeap.h:
1354             * dfg/DFGAdjacencyList.h:
1355             (JSC::DFG::AdjacencyList::hash):
1356             (JSC::DFG::AdjacencyList::operator==):
1357             * dfg/DFGBasicBlock.h:
1358             * dfg/DFGCSEPhase.cpp:
1359             (JSC::DFG::performLocalCSE):
1360             (JSC::DFG::performGlobalCSE):
1361             (JSC::DFG::CSEPhase::CSEPhase): Deleted.
1362             (JSC::DFG::CSEPhase::run): Deleted.
1363             (JSC::DFG::CSEPhase::endIndexForPureCSE): Deleted.
1364             (JSC::DFG::CSEPhase::pureCSE): Deleted.
1365             (JSC::DFG::CSEPhase::constantCSE): Deleted.
1366             (JSC::DFG::CSEPhase::constantStoragePointerCSE): Deleted.
1367             (JSC::DFG::CSEPhase::getCalleeLoadElimination): Deleted.
1368             (JSC::DFG::CSEPhase::getArrayLengthElimination): Deleted.
1369             (JSC::DFG::CSEPhase::globalVarLoadElimination): Deleted.
1370             (JSC::DFG::CSEPhase::scopedVarLoadElimination): Deleted.
1371             (JSC::DFG::CSEPhase::varInjectionWatchpointElimination): Deleted.
1372             (JSC::DFG::CSEPhase::getByValLoadElimination): Deleted.
1373             (JSC::DFG::CSEPhase::checkFunctionElimination): Deleted.
1374             (JSC::DFG::CSEPhase::checkExecutableElimination): Deleted.
1375             (JSC::DFG::CSEPhase::checkStructureElimination): Deleted.
1376             (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): Deleted.
1377             (JSC::DFG::CSEPhase::getByOffsetLoadElimination): Deleted.
1378             (JSC::DFG::CSEPhase::getGetterSetterByOffsetLoadElimination): Deleted.
1379             (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): Deleted.
1380             (JSC::DFG::CSEPhase::checkArrayElimination): Deleted.
1381             (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): Deleted.
1382             (JSC::DFG::CSEPhase::getInternalFieldLoadElimination): Deleted.
1383             (JSC::DFG::CSEPhase::getMyScopeLoadElimination): Deleted.
1384             (JSC::DFG::CSEPhase::getLocalLoadElimination): Deleted.
1385             (JSC::DFG::CSEPhase::invalidationPointElimination): Deleted.
1386             (JSC::DFG::CSEPhase::setReplacement): Deleted.
1387             (JSC::DFG::CSEPhase::eliminate): Deleted.
1388             (JSC::DFG::CSEPhase::performNodeCSE): Deleted.
1389             (JSC::DFG::CSEPhase::performBlockCSE): Deleted.
1390             (JSC::DFG::performCSE): Deleted.
1391             * dfg/DFGCSEPhase.h:
1392             * dfg/DFGClobberSet.cpp:
1393             (JSC::DFG::addReads):
1394             (JSC::DFG::addWrites):
1395             (JSC::DFG::addReadsAndWrites):
1396             (JSC::DFG::readsOverlap):
1397             (JSC::DFG::writesOverlap):
1398             * dfg/DFGClobberize.cpp:
1399             (JSC::DFG::doesWrites):
1400             (JSC::DFG::accessesOverlap):
1401             (JSC::DFG::writesOverlap):
1402             * dfg/DFGClobberize.h:
1403             (JSC::DFG::clobberize):
1404             (JSC::DFG::NoOpClobberize::operator()):
1405             (JSC::DFG::CheckClobberize::operator()):
1406             (JSC::DFG::ReadMethodClobberize::ReadMethodClobberize):
1407             (JSC::DFG::ReadMethodClobberize::operator()):
1408             (JSC::DFG::WriteMethodClobberize::WriteMethodClobberize):
1409             (JSC::DFG::WriteMethodClobberize::operator()):
1410             (JSC::DFG::DefMethodClobberize::DefMethodClobberize):
1411             (JSC::DFG::DefMethodClobberize::operator()):
1412             * dfg/DFGDCEPhase.cpp:
1413             (JSC::DFG::DCEPhase::run):
1414             (JSC::DFG::DCEPhase::fixupBlock):
1415             * dfg/DFGGraph.cpp:
1416             (JSC::DFG::Graph::getBlocksInPreOrder):
1417             (JSC::DFG::Graph::getBlocksInPostOrder):
1418             (JSC::DFG::Graph::addForDepthFirstSort): Deleted.
1419             (JSC::DFG::Graph::getBlocksInDepthFirstOrder): Deleted.
1420             * dfg/DFGGraph.h:
1421             * dfg/DFGHeapLocation.cpp: Added.
1422             (JSC::DFG::HeapLocation::dump):
1423             (WTF::printInternal):
1424             * dfg/DFGHeapLocation.h: Added.
1425             (JSC::DFG::HeapLocation::HeapLocation):
1426             (JSC::DFG::HeapLocation::operator!):
1427             (JSC::DFG::HeapLocation::kind):
1428             (JSC::DFG::HeapLocation::heap):
1429             (JSC::DFG::HeapLocation::base):
1430             (JSC::DFG::HeapLocation::index):
1431             (JSC::DFG::HeapLocation::hash):
1432             (JSC::DFG::HeapLocation::operator==):
1433             (JSC::DFG::HeapLocation::isHashTableDeletedValue):
1434             (JSC::DFG::HeapLocationHash::hash):
1435             (JSC::DFG::HeapLocationHash::equal):
1436             * dfg/DFGLICMPhase.cpp:
1437             (JSC::DFG::LICMPhase::run):
1438             * dfg/DFGNode.h:
1439             (JSC::DFG::Node::replaceWith):
1440             (JSC::DFG::Node::convertToPhantomUnchecked): Deleted.
1441             * dfg/DFGPlan.cpp:
1442             (JSC::DFG::Plan::compileInThreadImpl):
1443             * dfg/DFGPureValue.cpp: Added.
1444             (JSC::DFG::PureValue::dump):
1445             * dfg/DFGPureValue.h: Added.
1446             (JSC::DFG::PureValue::PureValue):
1447             (JSC::DFG::PureValue::operator!):
1448             (JSC::DFG::PureValue::op):
1449             (JSC::DFG::PureValue::children):
1450             (JSC::DFG::PureValue::info):
1451             (JSC::DFG::PureValue::hash):
1452             (JSC::DFG::PureValue::operator==):
1453             (JSC::DFG::PureValue::isHashTableDeletedValue):
1454             (JSC::DFG::PureValueHash::hash):
1455             (JSC::DFG::PureValueHash::equal):
1456             * dfg/DFGSSAConversionPhase.cpp:
1457             (JSC::DFG::SSAConversionPhase::run):
1458             * ftl/FTLLowerDFGToLLVM.cpp:
1459             (JSC::FTL::LowerDFGToLLVM::lower):
1460
1461     2014-07-13  Filip Pizlo  <fpizlo@apple.com>
1462
1463             Unreviewed, revert unintended change in r171051.
1464
1465             * dfg/DFGCSEPhase.cpp:
1466
1467     2014-07-08  Filip Pizlo  <fpizlo@apple.com>
1468
1469             [ftlopt] Move Flush(SetLocal) store elimination to StrengthReductionPhase
1470             https://bugs.webkit.org/show_bug.cgi?id=134739
1471
1472             Reviewed by Mark Hahnenberg.
1473
1474             I'm going to streamline CSE around clobberize() as part of
1475             https://bugs.webkit.org/show_bug.cgi?id=134677, and so Flush(SetLocal) store
1476             elimination wouldn't belong in CSE anymore. It doesn't quite belong anywhere, which
1477             means that it belongs in StrengthReductionPhase, since that's intended to be our
1478             dumping ground.
1479
1480             To do this I had to add some missing smarts to clobberize(). Previously clobberize()
1481             could play a bit loose with reads of Variables because it wasn't used for store
1482             elimination. The main client of read() was LICM, but it would only use it to
1483             determine hoistability and anything that did a write() was not hoistable - so, we had
1484             benign (but still wrong) missing read() calls in places that did write()s. This fixes
1485             a bunch of those cases.
1486
1487             * dfg/DFGCSEPhase.cpp:
1488             (JSC::DFG::CSEPhase::performNodeCSE):
1489             (JSC::DFG::CSEPhase::setLocalStoreElimination): Deleted.
1490             * dfg/DFGClobberize.cpp:
1491             (JSC::DFG::accessesOverlap):
1492             * dfg/DFGClobberize.h:
1493             (JSC::DFG::clobberize): Make clobberize() smart enough for detecting when this store elimination would be sound.
1494             * dfg/DFGStrengthReductionPhase.cpp:
1495             (JSC::DFG::StrengthReductionPhase::handleNode): Implement the store elimination in terms of clobberize().
1496
1497     2014-07-08  Filip Pizlo  <fpizlo@apple.com>
1498
1499             [ftlopt] Phantom simplification should be in its own phase
1500             https://bugs.webkit.org/show_bug.cgi?id=134742
1501
1502             Reviewed by Geoffrey Garen.
1503
1504             This moves Phantom simplification out of CSE, which greatly simplifies CSE and gives it
1505             more focus. Also this finally adds a phase that removes empty Phantoms. We sort of had
1506             this in CPSRethreading, but that phase runs too infrequently and doesn't run at all for
1507             SSA.
1508
1509             * CMakeLists.txt:
1510             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1511             * JavaScriptCore.xcodeproj/project.pbxproj:
1512             * dfg/DFGAdjacencyList.h:
1513             * dfg/DFGCSEPhase.cpp:
1514             (JSC::DFG::CSEPhase::run):
1515             (JSC::DFG::CSEPhase::setReplacement):
1516             (JSC::DFG::CSEPhase::eliminate):
1517             (JSC::DFG::CSEPhase::performNodeCSE):
1518             (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren): Deleted.
1519             * dfg/DFGPhantomRemovalPhase.cpp: Added.
1520             (JSC::DFG::PhantomRemovalPhase::PhantomRemovalPhase):
1521             (JSC::DFG::PhantomRemovalPhase::run):
1522             (JSC::DFG::performCleanUp):
1523             * dfg/DFGPhantomRemovalPhase.h: Added.
1524             * dfg/DFGPlan.cpp:
1525             (JSC::DFG::Plan::compileInThreadImpl):
1526
1527     2014-07-08  Filip Pizlo  <fpizlo@apple.com>
1528
1529             [ftlopt] Get rid of Node::misc by moving the fields out of the union so that you can use replacement and owner simultaneously
1530             https://bugs.webkit.org/show_bug.cgi?id=134730
1531
1532             Reviewed by Mark Lam.
1533
1534             This will allow for a better GCSE implementation.
1535
1536             * dfg/DFGCPSRethreadingPhase.cpp:
1537             (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
1538             * dfg/DFGCSEPhase.cpp:
1539             (JSC::DFG::CSEPhase::setReplacement):
1540             * dfg/DFGEdgeDominates.h:
1541             (JSC::DFG::EdgeDominates::operator()):
1542             * dfg/DFGGraph.cpp:
1543             (JSC::DFG::Graph::clearReplacements):
1544             (JSC::DFG::Graph::initializeNodeOwners):
1545             * dfg/DFGGraph.h:
1546             (JSC::DFG::Graph::performSubstitutionForEdge):
1547             * dfg/DFGLICMPhase.cpp:
1548             (JSC::DFG::LICMPhase::attemptHoist):
1549             * dfg/DFGNode.h:
1550             (JSC::DFG::Node::Node):
1551             * dfg/DFGSSAConversionPhase.cpp:
1552             (JSC::DFG::SSAConversionPhase::run):
1553
1554     2014-07-04  Filip Pizlo  <fpizlo@apple.com>
1555
1556             [ftlopt] Infer immutable object properties
1557             https://bugs.webkit.org/show_bug.cgi?id=134567
1558
1559             Reviewed by Mark Hahnenberg.
1560
1561             This introduces a new way of inferring immutable object properties. A property is said to
1562             be immutable if after its creation (i.e. the transition that creates it), we never
1563             overwrite it (i.e. replace it) or delete it. Immutability is a property of an "own
1564             property" - so if we say that "f" is immutable at "o" then we are implying that "o" has "f"
1565             directly and not on a prototype. More specifically, the immutability inference will prove
1566             that a property on some structure is immutable. This means that, for example, we may have a
1567             structure S1 with property "f" where we claim that "f" at S1 is immutable, but S1 has a
1568             transition to S2 that adds a new property "g" and we may claim that "f" at S2 is actually
1569             mutable. This is mainly for convenience; it allows us to decouple immutability logic from
1570             transition logic. Immutability can be used to constant-fold accesses to objects at
1571             DFG-time. The DFG needs to prove the following to constant-fold the access:
1572
1573             - The base of the access must be a constant object pointer. We prove that a property at a
1574               structure is immutable, but that says nothing of its value; each actual instance of that
1575               property may have a different value. So, a constant object pointer is needed to get an
1576               actual constant instance of the immutable value.
1577
1578             - A check (or watchpoint) must have been emitted proving that the object has a structure
1579               that allows loading the property in question.
1580
1581             - The replacement watchpoint set of the property in the structure that we've proven the
1582               object to have is still valid and we add a watchpoint to it lazily. The replacement
1583               watchpoint set is the key new mechanism that this change adds. It's possible that we have
1584               proven that the object has one of many structures, in which case each of those structures
1585               needs a valid replacement watchpoint set.
1586
1587             The replacement watchpoint set is created the first time that any access to the property is
1588             cached. A put replace cache will create, and immediately invalidate, the watchpoint set. A
1589             get cache will create the watchpoint set and make it start watching. Any non-cached put
1590             access will invalidate the watchpoint set if one had been created; the underlying algorithm
1591             ensures that checking for the existence of a replacement watchpoint set is very fast in the
1592             common case. This algorithm ensures that no cached access needs to ever do any work to
1593             invalidate, or check the validity of, any replacement watchpoint sets. It also has some
1594             other nice properties:
1595
1596             - It's very robust in its definition of immutability. The strictest that it will ever be is
1597               that for any instance of the object, the property must be written to only once,
1598               specifically at the time that the property is created. But it's looser than this in
1599               practice. For example, the property may be written to any number of times before we add
1600               the final property that the object will have before anyone reads the property; this works
1601               since for optimization purposes we only care if we detect immutability on the structure
1602               that the object will have when it is most frequently read from, not any previous
1603               structure that the object had. Also, we may write to the property any number of times
1604               before anyone caches accesses to it.
1605
1606             - It is mostly orthogonal to structure transitions. No new structures need to be created to
1607               track the immutability of a property. Hence, there is no risk from this feature causing
1608               more polymorphism. This is different from the previous "specificValue" constant
1609               inference, which did cause additional structures to be created and sometimes those
1610               structures led to fake polymorphism. This feature does leverage existing transitions to
1611               do some of the watchpointing: property deletions don't fire the replacement watchpoint
1612               set because that would cause a new structure and so the mandatory structure check would
1613               fail. Also, this feature is guaranteed to never kick in for uncacheable dictionaries
1614               because those wouldn't allow for cacheable accesses - and it takes a cacheable access for
1615               this feature to be enabled.
1616
1617             - No memory overhead is incurred except when accesses to the property are cached.
1618               Dictionary properties will typically have no meta-data for immutability. The number of
1619               replacement watchpoint sets we allocate is proportional to the number of inline caches in
1620               the program, which is typically must smaller than the number of structures or even the
1621               number of objects.
1622
1623             This inference is far more powerful than the previous "specificValue" inference, so this
1624             change also removes all of that code. It's interesting that the amount of code that is
1625             changed to remove that feature is almost as big as the amount of code added to support the
1626             new inference - and that's if you include the new tests in the tally. Without new tests,
1627             it appears that the new feature actually touches less code!
1628
1629             There is one corner case where the previous "specificValue" inference was more powerful.
1630             You can imagine someone creating objects with functions as self properties on those
1631             objects, such that each object instance had the same function pointers - essentially,
1632             someone might be trying to create a vtable but failing at the whole "one vtable for many
1633             instances" concept. The "specificValue" inference would do very well for such programs,
1634             because a structure check would be sufficient to prove a constant value for all of the
1635             function properties. This new inference will fail because it doesn't track the constant
1636             values of constant properties; instead it detects the immutability of otherwise variable
1637             properties (in the sense that each instance of the property may have a different value).
1638             So, the new inference requires having a particular object instance to actually get the
1639             constant value. I think it's OK to lose this antifeature. It took a lot of code to support
1640             and was a constant source of grief in our transition logic, and there doesn't appear to be
1641             any real evidence that programs benefited from that particular kind of inference since
1642             usually it's the singleton prototype instance that has all of the functions.
1643
1644             This change is a speed-up on everything. date-format-xparb and both SunSpider/raytrace and
1645             V8/raytrace seem to be the biggest winners among the macrobenchmarks; they see >5%
1646             speed-ups. Many of our microbenchmarks see very large performance improvements, even 80% in
1647             one case.
1648
1649             * bytecode/ComplexGetStatus.cpp:
1650             (JSC::ComplexGetStatus::computeFor):
1651             * bytecode/GetByIdStatus.cpp:
1652             (JSC::GetByIdStatus::computeFromLLInt):
1653             (JSC::GetByIdStatus::computeForStubInfo):
1654             (JSC::GetByIdStatus::computeFor):
1655             * bytecode/GetByIdVariant.cpp:
1656             (JSC::GetByIdVariant::GetByIdVariant):
1657             (JSC::GetByIdVariant::operator=):
1658             (JSC::GetByIdVariant::attemptToMerge):
1659             (JSC::GetByIdVariant::dumpInContext):
1660             * bytecode/GetByIdVariant.h:
1661             (JSC::GetByIdVariant::alternateBase):
1662             (JSC::GetByIdVariant::specificValue): Deleted.
1663             * bytecode/PutByIdStatus.cpp:
1664             (JSC::PutByIdStatus::computeForStubInfo):
1665             (JSC::PutByIdStatus::computeFor):
1666             * bytecode/PutByIdVariant.cpp:
1667             (JSC::PutByIdVariant::operator=):
1668             (JSC::PutByIdVariant::setter):
1669             (JSC::PutByIdVariant::dumpInContext):
1670             * bytecode/PutByIdVariant.h:
1671             (JSC::PutByIdVariant::specificValue): Deleted.
1672             * bytecode/Watchpoint.cpp:
1673             (JSC::WatchpointSet::fireAllSlow):
1674             (JSC::WatchpointSet::fireAll): Deleted.
1675             * bytecode/Watchpoint.h:
1676             (JSC::WatchpointSet::fireAll):
1677             * dfg/DFGAbstractInterpreterInlines.h:
1678             (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1679             * dfg/DFGByteCodeParser.cpp:
1680             (JSC::DFG::ByteCodeParser::handleGetByOffset):
1681             (JSC::DFG::ByteCodeParser::handleGetById):
1682             (JSC::DFG::ByteCodeParser::handlePutById):
1683             (JSC::DFG::ByteCodeParser::parseBlock):
1684             * dfg/DFGConstantFoldingPhase.cpp:
1685             (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
1686             * dfg/DFGFixupPhase.cpp:
1687             (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
1688             (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
1689             * dfg/DFGGraph.cpp:
1690             (JSC::DFG::Graph::tryGetConstantProperty):
1691             (JSC::DFG::Graph::visitChildren):
1692             * dfg/DFGGraph.h:
1693             * dfg/DFGWatchableStructureWatchingPhase.cpp:
1694             (JSC::DFG::WatchableStructureWatchingPhase::run):
1695             * ftl/FTLLowerDFGToLLVM.cpp:
1696             (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
1697             * jit/JITOperations.cpp:
1698             * jit/Repatch.cpp:
1699             (JSC::repatchByIdSelfAccess):
1700             (JSC::generateByIdStub):
1701             (JSC::tryCacheGetByID):
1702             (JSC::tryCachePutByID):
1703             (JSC::tryBuildPutByIdList):
1704             * llint/LLIntSlowPaths.cpp:
1705             (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1706             (JSC::LLInt::putToScopeCommon):
1707             * runtime/CommonSlowPaths.h:
1708             (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
1709             * runtime/IntendedStructureChain.cpp:
1710             (JSC::IntendedStructureChain::mayInterceptStoreTo):
1711             * runtime/JSCJSValue.cpp:
1712             (JSC::JSValue::putToPrimitive):
1713             * runtime/JSGlobalObject.cpp:
1714             (JSC::JSGlobalObject::reset):
1715             * runtime/JSObject.cpp:
1716             (JSC::JSObject::put):
1717             (JSC::JSObject::putDirectNonIndexAccessor):
1718             (JSC::JSObject::deleteProperty):
1719             (JSC::JSObject::defaultValue):
1720             (JSC::getCallableObjectSlow): Deleted.
1721             (JSC::JSObject::getPropertySpecificValue): Deleted.
1722             * runtime/JSObject.h:
1723             (JSC::JSObject::getDirect):
1724             (JSC::JSObject::getDirectOffset):
1725             (JSC::JSObject::inlineGetOwnPropertySlot):
1726             (JSC::JSObject::putDirectInternal):
1727             (JSC::JSObject::putOwnDataProperty):
1728             (JSC::JSObject::putDirect):
1729             (JSC::JSObject::putDirectWithoutTransition):
1730             (JSC::getCallableObject): Deleted.
1731             * runtime/JSScope.cpp:
1732             (JSC::abstractAccess):
1733             * runtime/PropertyMapHashTable.h:
1734             (JSC::PropertyMapEntry::PropertyMapEntry):
1735             (JSC::PropertyTable::copy):
1736             * runtime/PropertyTable.cpp:
1737             (JSC::PropertyTable::clone):
1738             (JSC::PropertyTable::PropertyTable):
1739             (JSC::PropertyTable::visitChildren): Deleted.
1740             * runtime/Structure.cpp:
1741             (JSC::Structure::Structure):
1742             (JSC::Structure::materializePropertyMap):
1743             (JSC::Structure::addPropertyTransitionToExistingStructureImpl):
1744             (JSC::Structure::addPropertyTransitionToExistingStructure):
1745             (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently):
1746             (JSC::Structure::addPropertyTransition):
1747             (JSC::Structure::changePrototypeTransition):
1748             (JSC::Structure::attributeChangeTransition):
1749             (JSC::Structure::toDictionaryTransition):
1750             (JSC::Structure::preventExtensionsTransition):
1751             (JSC::Structure::takePropertyTableOrCloneIfPinned):
1752             (JSC::Structure::nonPropertyTransition):
1753             (JSC::Structure::addPropertyWithoutTransition):
1754             (JSC::Structure::allocateRareData):
1755             (JSC::Structure::ensurePropertyReplacementWatchpointSet):
1756             (JSC::Structure::startWatchingPropertyForReplacements):
1757             (JSC::Structure::didCachePropertyReplacement):
1758             (JSC::Structure::startWatchingInternalProperties):
1759             (JSC::Structure::copyPropertyTable):
1760             (JSC::Structure::copyPropertyTableForPinning):
1761             (JSC::Structure::getConcurrently):
1762             (JSC::Structure::get):
1763             (JSC::Structure::add):
1764             (JSC::Structure::visitChildren):
1765             (JSC::Structure::prototypeChainMayInterceptStoreTo):
1766             (JSC::Structure::dump):
1767             (JSC::Structure::despecifyDictionaryFunction): Deleted.
1768             (JSC::Structure::despecifyFunctionTransition): Deleted.
1769             (JSC::Structure::despecifyFunction): Deleted.
1770             (JSC::Structure::despecifyAllFunctions): Deleted.
1771             (JSC::Structure::putSpecificValue): Deleted.
1772             * runtime/Structure.h:
1773             (JSC::Structure::startWatchingPropertyForReplacements):
1774             (JSC::Structure::startWatchingInternalPropertiesIfNecessary):
1775             (JSC::Structure::startWatchingInternalPropertiesIfNecessaryForEntireChain):
1776             (JSC::Structure::transitionDidInvolveSpecificValue): Deleted.
1777             (JSC::Structure::disableSpecificFunctionTracking): Deleted.
1778             * runtime/StructureInlines.h:
1779             (JSC::Structure::getConcurrently):
1780             (JSC::Structure::didReplaceProperty):
1781             (JSC::Structure::propertyReplacementWatchpointSet):
1782             * runtime/StructureRareData.cpp:
1783             (JSC::StructureRareData::destroy):
1784             * runtime/StructureRareData.h:
1785             * tests/stress/infer-constant-global-property.js: Added.
1786             (foo.Math.sin):
1787             (foo):
1788             * tests/stress/infer-constant-property.js: Added.
1789             (foo):
1790             * tests/stress/jit-cache-poly-replace-then-cache-get-and-fold-then-invalidate.js: Added.
1791             (foo):
1792             (bar):
1793             * tests/stress/jit-cache-replace-then-cache-get-and-fold-then-invalidate.js: Added.
1794             (foo):
1795             (bar):
1796             * tests/stress/jit-put-to-scope-global-cache-watchpoint-invalidate.js: Added.
1797             (foo):
1798             (bar):
1799             * tests/stress/llint-cache-replace-then-cache-get-and-fold-then-invalidate.js: Added.
1800             (foo):
1801             (bar):
1802             * tests/stress/llint-put-to-scope-global-cache-watchpoint-invalidate.js: Added.
1803             (foo):
1804             (bar):
1805             * tests/stress/repeat-put-to-scope-global-with-same-value-watchpoint-invalidate.js: Added.
1806             (foo):
1807             (bar):
1808
1809     2014-07-03  Saam Barati  <sbarati@apple.com>
1810
1811             Add more coverage for the profile_types_with_high_fidelity op code.
1812             https://bugs.webkit.org/show_bug.cgi?id=134616
1813
1814             Reviewed by Filip Pizlo.
1815
1816             More operations are now being recorded by the profile_types_with_high_fidelity
1817             opcode. Specifically: function parameters, function return values,
1818             function 'this' value, get_by_id, get_by_value, resolve nodes, function return
1819             values at the call site. Added more flags to the profile_types_with_high_fidelity
1820             opcode so more focused tasks can take place when the instruction is
1821             being linked in CodeBlock. Re-worked the type profiler to search
1822             through character offset ranges when asked for the type of an expression
1823             at a given offset. Removed redundant calls to Structure::toStructureShape
1824             in HighFidelityLog and TypeSet by caching calls based on StructureID.
1825
1826             * bytecode/BytecodeList.json:
1827             * bytecode/BytecodeUseDef.h:
1828             (JSC::computeUsesForBytecodeOffset):
1829             (JSC::computeDefsForBytecodeOffset):
1830             * bytecode/CodeBlock.cpp:
1831             (JSC::CodeBlock::CodeBlock):
1832             (JSC::CodeBlock::finalizeUnconditionally):
1833             (JSC::CodeBlock::scopeDependentProfile):
1834             * bytecode/CodeBlock.h:
1835             (JSC::CodeBlock::returnStatementTypeSet):
1836             * bytecode/TypeLocation.h:
1837             * bytecode/UnlinkedCodeBlock.cpp:
1838             (JSC::UnlinkedCodeBlock::highFidelityTypeProfileExpressionInfoForBytecodeOffset):
1839             (JSC::UnlinkedCodeBlock::addHighFidelityTypeProfileExpressionInfo):
1840             * bytecode/UnlinkedCodeBlock.h:
1841             * bytecompiler/BytecodeGenerator.cpp:
1842             (JSC::BytecodeGenerator::emitMove):
1843             (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity):
1844             (JSC::BytecodeGenerator::emitGetFromScopeWithProfile):
1845             (JSC::BytecodeGenerator::emitPutToScope):
1846             (JSC::BytecodeGenerator::emitPutToScopeWithProfile):
1847             (JSC::BytecodeGenerator::emitPutById):
1848             (JSC::BytecodeGenerator::emitPutByVal):
1849             * bytecompiler/BytecodeGenerator.h:
1850             (JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo):
1851             * bytecompiler/NodesCodegen.cpp:
1852             (JSC::ResolveNode::emitBytecode):
1853             (JSC::BracketAccessorNode::emitBytecode):
1854             (JSC::DotAccessorNode::emitBytecode):
1855             (JSC::FunctionCallValueNode::emitBytecode):
1856             (JSC::FunctionCallResolveNode::emitBytecode):
1857             (JSC::FunctionCallBracketNode::emitBytecode):
1858             (JSC::FunctionCallDotNode::emitBytecode):
1859             (JSC::CallFunctionCallDotNode::emitBytecode):
1860             (JSC::ApplyFunctionCallDotNode::emitBytecode):
1861             (JSC::PostfixNode::emitResolve):
1862             (JSC::PostfixNode::emitBracket):
1863             (JSC::PostfixNode::emitDot):
1864             (JSC::PrefixNode::emitResolve):
1865             (JSC::PrefixNode::emitBracket):
1866             (JSC::PrefixNode::emitDot):
1867             (JSC::ReadModifyResolveNode::emitBytecode):
1868             (JSC::AssignResolveNode::emitBytecode):
1869             (JSC::AssignDotNode::emitBytecode):
1870             (JSC::ReadModifyDotNode::emitBytecode):
1871             (JSC::AssignBracketNode::emitBytecode):
1872             (JSC::ReadModifyBracketNode::emitBytecode):
1873             (JSC::ReturnNode::emitBytecode):
1874             (JSC::FunctionBodyNode::emitBytecode):
1875             * inspector/agents/InspectorRuntimeAgent.cpp:
1876             (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableAtOffset):
1877             (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange): Deleted.
1878             * inspector/agents/InspectorRuntimeAgent.h:
1879             * inspector/protocol/Runtime.json:
1880             * llint/LLIntSlowPaths.cpp:
1881             (JSC::LLInt::getFromScopeCommon):
1882             (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1883             * llint/LLIntSlowPaths.h:
1884             * llint/LowLevelInterpreter.asm:
1885             * runtime/HighFidelityLog.cpp:
1886             (JSC::HighFidelityLog::processHighFidelityLog):
1887             (JSC::HighFidelityLog::actuallyProcessLogThreadFunction):
1888             (JSC::HighFidelityLog::recordTypeInformationForLocation): Deleted.
1889             * runtime/HighFidelityLog.h:
1890             (JSC::HighFidelityLog::recordTypeInformationForLocation):
1891             * runtime/HighFidelityTypeProfiler.cpp:
1892             (JSC::HighFidelityTypeProfiler::getTypesForVariableInAtOffset):
1893             (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableAtOffset):
1894             (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableAtOffset):
1895             (JSC::HighFidelityTypeProfiler::insertNewLocation):
1896             (JSC::HighFidelityTypeProfiler::findLocation):
1897             (JSC::HighFidelityTypeProfiler::getTypesForVariableInRange): Deleted.
1898             (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableInRange): Deleted.
1899             (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableInRange): Deleted.
1900             (JSC::HighFidelityTypeProfiler::getLocationBasedHash): Deleted.
1901             * runtime/HighFidelityTypeProfiler.h:
1902             (JSC::LocationKey::LocationKey): Deleted.
1903             (JSC::LocationKey::hash): Deleted.
1904             (JSC::LocationKey::operator==): Deleted.
1905             * runtime/Structure.cpp:
1906             (JSC::Structure::toStructureShape):
1907             * runtime/Structure.h:
1908             * runtime/TypeSet.cpp:
1909             (JSC::TypeSet::TypeSet):
1910             (JSC::TypeSet::addTypeForValue):
1911             (JSC::TypeSet::seenTypes):
1912             (JSC::TypeSet::removeDuplicatesInStructureHistory): Deleted.
1913             * runtime/TypeSet.h:
1914             (JSC::StructureShape::setConstructorName):
1915             * runtime/VM.cpp:
1916             (JSC::VM::getTypesForVariableAtOffset):
1917             (JSC::VM::dumpHighFidelityProfilingTypes):
1918             (JSC::VM::getTypesForVariableInRange): Deleted.
1919             * runtime/VM.h:
1920
1921     2014-07-04  Filip Pizlo  <fpizlo@apple.com>
1922
1923             [ftlopt][REGRESSION] debug tests fail because PutByIdDirect is now implemented in terms of In
1924             https://bugs.webkit.org/show_bug.cgi?id=134642
1925
1926             Rubber stamped by Andreas Kling.
1927
1928             * ftl/FTLLowerDFGToLLVM.cpp:
1929             (JSC::FTL::LowerDFGToLLVM::compileNode):
1930
1931     2014-07-01  Filip Pizlo  <fpizlo@apple.com>
1932
1933             [ftlopt] Allocate a new GetterSetter if we change the value of any of its entries other than when they were previously null, so that if we constant-infer an accessor slot then we immediately get the function constant for free
1934             https://bugs.webkit.org/show_bug.cgi?id=134518
1935
1936             Reviewed by Mark Hahnenberg.
1937
1938             This has no real effect right now, particularly since almost all uses of
1939             setSetter/setGetter were already allocating a branch new GetterSetter. But once we start
1940             doing more aggressive constant property inference, this change will allow us to remove
1941             all runtime checks from getter/setter calls.
1942
1943             * runtime/GetterSetter.cpp:
1944             (JSC::GetterSetter::withGetter):
1945             (JSC::GetterSetter::withSetter):
1946             * runtime/GetterSetter.h:
1947             (JSC::GetterSetter::setGetter):
1948             (JSC::GetterSetter::setSetter):
1949             * runtime/JSObject.cpp:
1950             (JSC::JSObject::defineOwnNonIndexProperty):
1951
1952     2014-07-02  Filip Pizlo  <fpizlo@apple.com>
1953
1954             [ftlopt] Rename notifyTransitionFromThisStructure to didTransitionFromThisStructure
1955
1956             Rubber stamped by Mark Hahnenberg.
1957
1958             * runtime/Structure.cpp:
1959             (JSC::Structure::Structure):
1960             (JSC::Structure::nonPropertyTransition):
1961             (JSC::Structure::didTransitionFromThisStructure):
1962             (JSC::Structure::notifyTransitionFromThisStructure): Deleted.
1963             * runtime/Structure.h:
1964
1965     2014-07-02  Filip Pizlo  <fpizlo@apple.com>
1966
1967             [ftlopt] Remove the functionality for cloning StructureRareData since we never do that anymore.
1968
1969             Rubber stamped by Mark Hahnenberg.
1970
1971             * runtime/Structure.cpp:
1972             (JSC::Structure::Structure):
1973             (JSC::Structure::cloneRareDataFrom): Deleted.
1974             * runtime/Structure.h:
1975             * runtime/StructureRareData.cpp:
1976             (JSC::StructureRareData::clone): Deleted.
1977             (JSC::StructureRareData::StructureRareData): Deleted.
1978             * runtime/StructureRareData.h:
1979             (JSC::StructureRareData::needsCloning): Deleted.
1980
1981     2014-07-01  Mark Lam  <mark.lam@apple.com>
1982
1983             [ftlopt] DebuggerCallFrame::scope() should return a DebuggerScope.
1984             <https://webkit.org/b/134420>
1985
1986             Reviewed by Geoffrey Garen.
1987
1988             Previously, DebuggerCallFrame::scope() returns a JSActivation (and relevant
1989             peers) which the WebInspector will use to introspect CallFrame variables.
1990             Instead, we should be returning a DebuggerScope as an abstraction layer that
1991             provides the introspection functionality that the WebInspector needs.  This
1992             is the first step towards not forcing every frame to have a JSActivation
1993             object just because the debugger is enabled.
1994
1995             1. Instantiate the debuggerScopeStructure as a member of the JSGlobalObject
1996                instead of the VM.  This allows JSObject::globalObject() to be able to
1997                return the global object for the DebuggerScope.
1998
1999             2. On the DebuggerScope's life-cycle management:
2000
2001                The DebuggerCallFrame is designed to be "valid" only during a debugging session
2002                (while the debugger is broken) through the use of a DebuggerCallFrameScope in
2003                Debugger::pauseIfNeeded().  Once the debugger resumes from the break, the
2004                DebuggerCallFrameScope destructs, and the DebuggerCallFrame will be invalidated.
2005                We can't guarantee (from this code alone) that the Inspector code isn't still
2006                holding a ref to the DebuggerCallFrame (though they shouldn't), but by contract,
2007                the frame will be invalidated, and any attempt to query it will return null values.
2008                This is pre-existing behavior.
2009
2010                Now, we're adding the DebuggerScope into the picture.  While a single debugger
2011                pause session is in progress, the Inspector may request the scope from the
2012                DebuggerCallFrame.  While the DebuggerCallFrame is still valid, we want
2013                DebuggerCallFrame::scope() to always return the same DebuggerScope object.
2014                This is why we hold on to the DebuggerScope with a strong ref.
2015
2016                If we use a weak ref instead, the following cooky behavior can manifest:
2017                1. The Inspector calls Debugger::scope() to get the top scope.
2018                2. The Inspector iterates down the scope chain and is now only holding a
2019                   reference to a parent scope.  It is no longer referencing the top scope.
2020                3. A GC occurs, and the DebuggerCallFrame's weak m_scope ref to the top scope
2021                   gets cleared.
2022                4. The Inspector calls DebuggerCallFrame::scope() to get the top scope again but gets
2023                   a different DebuggerScope instance.
2024                5. The Inspector iterates down the scope chain but never sees the parent scope
2025                   instance that retained a ref to in step 2 above.  This is because when iterating
2026                   this new DebuggerScope instance (which has no knowledge of the previous parent
2027                   DebuggerScope instance), a new DebuggerScope instance will get created for the
2028                   same parent scope.
2029
2030                Since the DebuggerScope is a JSObject, it's liveness is determined by its reachability.
2031                However, it's "validity" is determined by the life-cycle of its owner DebuggerCallFrame.
2032                When the owner DebuggerCallFrame gets invalidated, its debugger scope chain (if
2033                instantiated) will also get invalidated.  This is why we need the
2034                DebuggerScope::invalidateChain() method.  The Inspector should not be using the
2035                DebuggerScope instance after its owner DebuggerCallFrame is invalidated.  If it does,
2036                those methods will do nothing or returned a failed status.
2037
2038             * debugger/Debugger.h:
2039             * debugger/DebuggerCallFrame.cpp:
2040             (JSC::DebuggerCallFrame::scope):
2041             (JSC::DebuggerCallFrame::evaluate):
2042             (JSC::DebuggerCallFrame::invalidate):
2043             (JSC::DebuggerCallFrame::vm):
2044             (JSC::DebuggerCallFrame::lexicalGlobalObject):
2045             * debugger/DebuggerCallFrame.h:
2046             * debugger/DebuggerScope.cpp:
2047             (JSC::DebuggerScope::DebuggerScope):
2048             (JSC::DebuggerScope::finishCreation):
2049             (JSC::DebuggerScope::visitChildren):
2050             (JSC::DebuggerScope::className):
2051             (JSC::DebuggerScope::getOwnPropertySlot):
2052             (JSC::DebuggerScope::put):
2053             (JSC::DebuggerScope::deleteProperty):
2054             (JSC::DebuggerScope::getOwnPropertyNames):
2055             (JSC::DebuggerScope::defineOwnProperty):
2056             (JSC::DebuggerScope::next):
2057             (JSC::DebuggerScope::invalidateChain):
2058             (JSC::DebuggerScope::isWithScope):
2059             (JSC::DebuggerScope::isGlobalScope):
2060             (JSC::DebuggerScope::isFunctionScope):
2061             * debugger/DebuggerScope.h:
2062             (JSC::DebuggerScope::create):
2063             (JSC::DebuggerScope::Iterator::Iterator):
2064             (JSC::DebuggerScope::Iterator::get):
2065             (JSC::DebuggerScope::Iterator::operator++):
2066             (JSC::DebuggerScope::Iterator::operator==):
2067             (JSC::DebuggerScope::Iterator::operator!=):
2068             (JSC::DebuggerScope::isValid):
2069             (JSC::DebuggerScope::jsScope):
2070             (JSC::DebuggerScope::begin):
2071             (JSC::DebuggerScope::end):
2072             * inspector/JSJavaScriptCallFrame.cpp:
2073             (Inspector::JSJavaScriptCallFrame::scopeType):
2074             (Inspector::JSJavaScriptCallFrame::scopeChain):
2075             * inspector/JavaScriptCallFrame.h:
2076             (Inspector::JavaScriptCallFrame::scopeChain):
2077             * inspector/ScriptDebugServer.cpp:
2078             * runtime/JSGlobalObject.cpp:
2079             (JSC::JSGlobalObject::reset):
2080             (JSC::JSGlobalObject::visitChildren):
2081             * runtime/JSGlobalObject.h:
2082             (JSC::JSGlobalObject::debuggerScopeStructure):
2083             * runtime/JSObject.h:
2084             (JSC::JSObject::isWithScope):
2085             * runtime/JSScope.h:
2086             * runtime/VM.cpp:
2087             (JSC::VM::VM):
2088             * runtime/VM.h:
2089
2090     2014-07-01  Filip Pizlo  <fpizlo@apple.com>
2091
2092             [ftlopt] DFG bytecode parser should turn PutById with nothing but a Setter stub as stuff+handleCall, and handleCall should be allowed to inline if it wants to
2093             https://bugs.webkit.org/show_bug.cgi?id=130756
2094
2095             Reviewed by Oliver Hunt.
2096
2097             The enables exposing the call to setters in the DFG, and then inlining it. Previously we
2098             already supproted inlined-cached calls to setters from within put_by_id inline caches,
2099             and the DFG could certainly emit such IC's. Now, if an IC had a setter call, then the DFG
2100             will either emit the GetGetterSetterByOffset/GetSetter/Call combo, or it will do one
2101             better and inline the call.
2102
2103             A lot of the core functionality was already available from the previous work to inline
2104             getters. So, there are some refactorings in this patch that move preexisting
2105             functionality around. For example, the work to figure out how the DFG should go about
2106             getting to what we call the "loaded value" - i.e. the GetterSetter object reference in
2107             the case of accessors - is now shared in ComplexGetStatus, and both GetByIdStatus and
2108             PutByIdStatus use it. This means that we can keep the safety checks common.  This patch
2109             also does additional refactorings in DFG::ByteCodeParser so that we can continue to reuse
2110             handleCall() for all of the various kinds of calls we can now emit.
2111
2112             83% speed-up on getter-richards, 2% speed-up on box2d.
2113
2114             * CMakeLists.txt:
2115             * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2116             * JavaScriptCore.xcodeproj/project.pbxproj:
2117             * bytecode/ComplexGetStatus.cpp: Added.
2118             (JSC::ComplexGetStatus::computeFor):
2119             * bytecode/ComplexGetStatus.h: Added.
2120             (JSC::ComplexGetStatus::ComplexGetStatus):
2121             (JSC::ComplexGetStatus::skip):
2122             (JSC::ComplexGetStatus::takesSlowPath):
2123             (JSC::ComplexGetStatus::kind):
2124             (JSC::ComplexGetStatus::attributes):
2125             (JSC::ComplexGetStatus::specificValue):
2126             (JSC::ComplexGetStatus::offset):
2127             (JSC::ComplexGetStatus::chain):
2128             * bytecode/GetByIdStatus.cpp:
2129             (JSC::GetByIdStatus::computeForStubInfo):
2130             * bytecode/GetByIdVariant.cpp:
2131             (JSC::GetByIdVariant::GetByIdVariant):
2132             * bytecode/PolymorphicPutByIdList.h:
2133             (JSC::PutByIdAccess::PutByIdAccess):
2134             (JSC::PutByIdAccess::setter):
2135             (JSC::PutByIdAccess::structure):
2136             (JSC::PutByIdAccess::chainCount):
2137             * bytecode/PutByIdStatus.cpp:
2138             (JSC::PutByIdStatus::computeFromLLInt):
2139             (JSC::PutByIdStatus::computeFor):
2140             (JSC::PutByIdStatus::computeForStubInfo):
2141             (JSC::PutByIdStatus::makesCalls):
2142             * bytecode/PutByIdStatus.h:
2143             (JSC::PutByIdStatus::makesCalls): Deleted.
2144             * bytecode/PutByIdVariant.cpp:
2145             (JSC::PutByIdVariant::PutByIdVariant):
2146             (JSC::PutByIdVariant::operator=):
2147             (JSC::PutByIdVariant::replace):
2148             (JSC::PutByIdVariant::transition):
2149             (JSC::PutByIdVariant::setter):
2150             (JSC::PutByIdVariant::writesStructures):
2151             (JSC::PutByIdVariant::reallocatesStorage):
2152             (JSC::PutByIdVariant::makesCalls):
2153             (JSC::PutByIdVariant::dumpInContext):
2154             * bytecode/PutByIdVariant.h:
2155             (JSC::PutByIdVariant::PutByIdVariant):
2156             (JSC::PutByIdVariant::structure):
2157             (JSC::PutByIdVariant::oldStructure):
2158             (JSC::PutByIdVariant::alternateBase):
2159             (JSC::PutByIdVariant::specificValue):
2160             (JSC::PutByIdVariant::callLinkStatus):
2161             (JSC::PutByIdVariant::replace): Deleted.
2162             (JSC::PutByIdVariant::transition): Deleted.
2163             * dfg/DFGByteCodeParser.cpp:
2164             (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
2165             (JSC::DFG::ByteCodeParser::addCall):
2166             (JSC::DFG::ByteCodeParser::handleCall):
2167             (JSC::DFG::ByteCodeParser::handleInlining):
2168             (JSC::DFG::ByteCodeParser::handleGetById):
2169             (JSC::DFG::ByteCodeParser::handlePutById):
2170             (JSC::DFG::ByteCodeParser::parseBlock):
2171             * jit/Repatch.cpp:
2172             (JSC::tryCachePutByID):
2173             (JSC::tryBuildPutByIdList):
2174             * runtime/IntendedStructureChain.cpp:
2175             (JSC::IntendedStructureChain::takesSlowPathInDFGForImpureProperty):
2176             * runtime/IntendedStructureChain.h:
2177             * tests/stress/exit-from-setter.js: Added.
2178             * tests/stress/poly-chain-setter.js: Added.
2179             (Cons):
2180             (foo):
2181             (test):
2182             * tests/stress/poly-chain-then-setter.js: Added.
2183             (Cons1):
2184             (Cons2):
2185             (foo):
2186             (test):
2187             * tests/stress/poly-setter-combo.js: Added.
2188             (Cons1):
2189             (Cons2):
2190             (foo):
2191             (test):
2192             (.test):
2193             * tests/stress/poly-setter-then-self.js: Added.
2194             (foo):
2195             (test):
2196             (.test):
2197             * tests/stress/weird-setter-counter.js: Added.
2198             (foo):
2199             (test):
2200             * tests/stress/weird-setter-counter-syntactic.js: Added.
2201             (foo):
2202             (test):
2203
2204     2014-07-01  Matthew Mirman  <mmirman@apple.com>
2205
2206             Added an implementation of the "in" check to FTL.
2207             https://bugs.webkit.org/show_bug.cgi?id=134508
2208
2209             Reviewed by Filip Pizlo.
2210
2211             * ftl/FTLCapabilities.cpp: enabled compilation for "in"
2212             (JSC::FTL::canCompile): ditto
2213             * ftl/FTLCompile.cpp:
2214             (JSC::FTL::generateCheckInICFastPath): added.
2215             (JSC::FTL::fixFunctionBasedOnStackMaps): added case for CheckIn descriptors.
2216             * ftl/FTLInlineCacheDescriptor.h:
2217             (JSC::FTL::CheckInGenerator::CheckInGenerator): added.
2218             (JSC::FTL::CheckInDescriptor::CheckInDescriptor): added.
2219             * ftl/FTLInlineCacheSize.cpp:
2220             (JSC::FTL::sizeOfCheckIn): added. Currently larger than necessary.
2221             * ftl/FTLInlineCacheSize.h: ditto
2222             * ftl/FTLIntrinsicRepository.h: Added function type for operationInGeneric
2223             * ftl/FTLLowerDFGToLLVM.cpp:
2224             (JSC::FTL::LowerDFGToLLVM::compileNode): added case for In.
2225             (JSC::FTL::LowerDFGToLLVM::compileIn): added.
2226             * ftl/FTLSlowPathCall.cpp: Added a callOperation for operationIn
2227             (JSC::FTL::callOperation): ditto
2228             * ftl/FTLSlowPathCall.h: ditto
2229             * ftl/FTLState.h: Added a vector to hold CheckIn descriptors.
2230             * jit/JITOperations.h: made operationIns internal.
2231             * tests/stress/ftl-checkin.js: Added.
2232             * tests/stress/ftl-checkin-variable.js: Added.
2233
2234     2014-06-30  Mark Hahnenberg  <mhahnenberg@apple.com>
2235
2236             CodeBlock::stronglyVisitWeakReferences should mark DFG::CommonData::weakStructureReferences
2237             https://bugs.webkit.org/show_bug.cgi?id=134455
2238
2239             Reviewed by Geoffrey Garen.
2240
2241             Otherwise we get hanging pointers which can cause us to die later.
2242
2243             * bytecode/CodeBlock.cpp:
2244             (JSC::CodeBlock::stronglyVisitWeakReferences):
2245
2246     2014-06-27  Filip Pizlo  <fpizlo@apple.com>
2247
2248             [ftlopt] Reduce the GC's influence on optimization decisions
2249             https://bugs.webkit.org/show_bug.cgi?id=134427
2250
2251             Reviewed by Oliver Hunt.
2252
2253             This is a slight speed-up on some platforms, that arises from a bunch of fixes that I made
2254             while trying to make the GC keep more structures alive
2255             (https://bugs.webkit.org/show_bug.cgi?id=128072).
2256
2257             The fixes are, roughly:
2258
2259             - If the GC clears an inline cache, then this no longer causes the IC to be forever
2260               polymorphic.
2261
2262             - If we exit in inlined code into a function that tries to OSR enter, then we jettison
2263               sooner.
2264
2265             - Some variables being uninitialized led to rage-recompilations.
2266
2267             This is a pretty strong step in the direction of keeping more Structures alive and not
2268             blowing away code just because a Structure died. But, it seems like there is still a slight
2269             speed-up to be had from blowing away code that references dead Structures.
2270
2271             * bytecode/CodeBlock.cpp:
2272             (JSC::CodeBlock::dumpAssumingJITType):
2273             (JSC::shouldMarkTransition):
2274             (JSC::CodeBlock::propagateTransitions):
2275             (JSC::CodeBlock::determineLiveness):
2276             * bytecode/GetByIdStatus.cpp:
2277             (JSC::GetByIdStatus::computeForStubInfo):
2278             * bytecode/PutByIdStatus.cpp:
2279             (JSC::PutByIdStatus::computeForStubInfo):
2280             * dfg/DFGCapabilities.cpp:
2281             (JSC::DFG::isSupportedForInlining):
2282             (JSC::DFG::mightInlineFunctionForCall):
2283             (JSC::DFG::mightInlineFunctionForClosureCall):
2284             (JSC::DFG::mightInlineFunctionForConstruct):
2285             * dfg/DFGCapabilities.h:
2286             * dfg/DFGCommonData.h:
2287             * dfg/DFGDesiredWeakReferences.cpp:
2288             (JSC::DFG::DesiredWeakReferences::reallyAdd):
2289             * dfg/DFGOSREntry.cpp:
2290             (JSC::DFG::prepareOSREntry):
2291             * dfg/DFGOSRExitCompilerCommon.cpp:
2292             (JSC::DFG::handleExitCounts):
2293             * dfg/DFGOperations.cpp:
2294             * dfg/DFGOperations.h:
2295             * ftl/FTLForOSREntryJITCode.cpp:
2296             (JSC::FTL::ForOSREntryJITCode::ForOSREntryJITCode): These variables being uninitialized is benign in terms of correctness but can sometimes cause rage-recompilations. For some reason it took this patch to reveal this.
2297             * ftl/FTLOSREntry.cpp:
2298             (JSC::FTL::prepareOSREntry):
2299             * runtime/Executable.cpp:
2300             (JSC::ExecutableBase::destroy):
2301             (JSC::NativeExecutable::destroy):
2302             (JSC::ScriptExecutable::ScriptExecutable):
2303             (JSC::ScriptExecutable::destroy):
2304             (JSC::ScriptExecutable::installCode):
2305             (JSC::EvalExecutable::EvalExecutable):
2306             (JSC::ProgramExecutable::ProgramExecutable):
2307             * runtime/Executable.h:
2308             (JSC::ScriptExecutable::setDidTryToEnterInLoop):
2309             (JSC::ScriptExecutable::didTryToEnterInLoop):
2310             (JSC::ScriptExecutable::addressOfDidTryToEnterInLoop):
2311             (JSC::ScriptExecutable::ScriptExecutable): Deleted.
2312             * runtime/StructureInlines.h:
2313             (JSC::Structure::storedPrototypeObject):
2314             (JSC::Structure::storedPrototypeStructure):
2315
2316     2014-06-25  Filip Pizlo  <fpizlo@apple.com>
2317
2318             [ftlopt] If a CodeBlock is jettisoned due to a watchpoint then it should be possible to figure out something about that watchpoint
2319             https://bugs.webkit.org/show_bug.cgi?id=134333
2320
2321             Reviewed by Geoffrey Garen.
2322
2323             This is engineered to provide loads of information to the profiler without incurring any
2324             costs when the profiler is disabled. It's the oldest trick in the book: the thing that
2325             fires the watchpoint doesn't actually create anything to describe the reason why it was
2326             fired; instead it creates a stack-allocated FireDetail subclass instance. Only if the
2327             FireDetail::dump() virtual method is called does anything happen.
2328
2329             Currently we use this to produce very fine-grained data for Structure watchpoints and
2330             some cases of variable watchpoints. For all other situations, the given reason is just a
2331             string constant, by using StringFireDetail. If we find a situation where that string
2332             constant is insufficient to diagnose an issue then we can change it to provide more
2333             fine-grained information.
2334
2335             * JavaScriptCore.xcodeproj/project.pbxproj:
2336             * bytecode/CodeBlock.cpp:
2337             (JSC::CodeBlock::CodeBlock):
2338             (JSC::CodeBlock::jettison):
2339             * bytecode/CodeBlock.h:
2340             * bytecode/CodeBlockJettisoningWatchpoint.cpp:
2341             (JSC::CodeBlockJettisoningWatchpoint::fireInternal):
2342             * bytecode/CodeBlockJettisoningWatchpoint.h:
2343             * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp: Removed.
2344             * bytecode/ProfiledCodeBlockJettisoningWatchpoint.h: Removed.
2345             * bytecode/StructureStubClearingWatchpoint.cpp:
2346             (JSC::StructureStubClearingWatchpoint::fireInternal):
2347             * bytecode/StructureStubClearingWatchpoint.h:
2348             * bytecode/VariableWatchpointSet.h:
2349             (JSC::VariableWatchpointSet::invalidate):
2350             (JSC::VariableWatchpointSet::finalizeUnconditionally):
2351             * bytecode/VariableWatchpointSetInlines.h:
2352             (JSC::VariableWatchpointSet::notifyWrite):
2353             * bytecode/Watchpoint.cpp:
2354             (JSC::StringFireDetail::dump):
2355             (JSC::WatchpointSet::fireAll):
2356             (JSC::WatchpointSet::fireAllSlow):
2357             (JSC::WatchpointSet::fireAllWatchpoints):
2358             (JSC::InlineWatchpointSet::fireAll):
2359             * bytecode/Watchpoint.h:
2360             (JSC::FireDetail::FireDetail):
2361             (JSC::FireDetail::~FireDetail):
2362             (JSC::StringFireDetail::StringFireDetail):
2363             (JSC::Watchpoint::fire):
2364             (JSC::WatchpointSet::fireAll):
2365             (JSC::WatchpointSet::touch):
2366             (JSC::WatchpointSet::invalidate):
2367             (JSC::InlineWatchpointSet::fireAll):
2368             (JSC::InlineWatchpointSet::touch):
2369             * dfg/DFGCommonData.h:
2370             * dfg/DFGOperations.cpp:
2371             * interpreter/Interpreter.cpp:
2372             (JSC::Interpreter::execute):
2373             * jsc.cpp:
2374             (WTF::Masquerader::create):
2375             * profiler/ProfilerCompilation.cpp:
2376             (JSC::Profiler::Compilation::setJettisonReason):
2377             (JSC::Profiler::Compilation::toJS):
2378             * profiler/ProfilerCompilation.h:
2379             (JSC::Profiler::Compilation::setJettisonReason): Deleted.
2380             * runtime/ArrayBuffer.cpp:
2381             (JSC::ArrayBuffer::transfer):
2382             * runtime/ArrayBufferNeuteringWatchpoint.cpp:
2383             (JSC::ArrayBufferNeuteringWatchpoint::fireAll):
2384             * runtime/ArrayBufferNeuteringWatchpoint.h:
2385             * runtime/CommonIdentifiers.h:
2386             * runtime/CommonSlowPaths.cpp:
2387             (JSC::SLOW_PATH_DECL):
2388             * runtime/Identifier.cpp:
2389             (JSC::Identifier::dump):
2390             * runtime/Identifier.h:
2391             * runtime/JSFunction.cpp:
2392             (JSC::JSFunction::put):
2393             (JSC::JSFunction::defineOwnProperty):
2394             * runtime/JSGlobalObject.cpp:
2395             (JSC::JSGlobalObject::addFunction):
2396             (JSC::JSGlobalObject::haveABadTime):
2397             * runtime/JSSymbolTableObject.cpp:
2398             (JSC::VariableWriteFireDetail::dump):
2399             * runtime/JSSymbolTableObject.h:
2400             (JSC::VariableWriteFireDetail::VariableWriteFireDetail):
2401             (JSC::symbolTablePut):
2402             (JSC::symbolTablePutWithAttributes):
2403             * runtime/PropertyName.h:
2404             (JSC::PropertyName::dump):
2405             * runtime/Structure.cpp:
2406             (JSC::Structure::notifyTransitionFromThisStructure):
2407             * runtime/Structure.h:
2408             (JSC::Structure::notifyTransitionFromThisStructure): Deleted.
2409             * runtime/SymbolTable.cpp:
2410             (JSC::SymbolTableEntry::notifyWriteSlow):
2411             (JSC::SymbolTable::WatchpointCleanup::finalizeUnconditionally):
2412             * runtime/SymbolTable.h:
2413             (JSC::SymbolTableEntry::notifyWrite):
2414             * runtime/VM.cpp:
2415             (JSC::VM::addImpureProperty):
2416
2417 2014-08-05  Commit Queue  <commit-queue@webkit.org>
2418
2419         Unreviewed, rolling out r172099.
2420         https://bugs.webkit.org/show_bug.cgi?id=135635
2421
2422         Needs a do-over. (Requested by kling on #webkit).
2423
2424         Reverted changeset:
2425
2426         "The JIT should cache property lookup misses."
2427         https://bugs.webkit.org/show_bug.cgi?id=135578
2428         http://trac.webkit.org/changeset/172099
2429
2430 2014-08-05  Przemyslaw Kuczynski  <p.kuczynski@samsung.com>
2431
2432         Fix resource leak of unclosed file descriptor.
2433         https://bugs.webkit.org/show_bug.cgi?id=135417
2434
2435         Reviewed by Darin Adler.
2436
2437         When open returns zero, fd handle leaks. Checking (fd > 0) needs to be replaced
2438         with (fd != -1).
2439
2440         * assembler/MacroAssemblerARM.cpp:
2441         (JSC::isVFPPresent):
2442
2443 2014-08-05  Andreas Kling  <akling@apple.com>
2444
2445         The JIT should cache property lookup misses.
2446         <https://webkit.org/b/135578>
2447
2448         Add support for inline caching of object properties that don't exist.
2449         Previously we'd fall back to the C++ slow-path whenever a property was missing.
2450
2451         It's implemented as a simple GetById-style stub that returns jsUndefined() as
2452         long as the Structure chain check passes.
2453
2454         10x speedup on the included microbenchmark.
2455
2456         Reviewed by Geoffrey Garen.
2457
2458         * jit/Repatch.cpp:
2459         (JSC::toString):
2460         (JSC::kindFor):
2461         (JSC::generateByIdStub):
2462         (JSC::tryCacheGetByID):
2463         (JSC::patchJumpToGetByIdStub):
2464         * runtime/PropertySlot.h:
2465         (JSC::PropertySlot::isUnset):
2466
2467 2014-08-05  Commit Queue  <commit-queue@webkit.org>
2468
2469         Unreviewed, rolling out r172009.
2470         https://bugs.webkit.org/show_bug.cgi?id=135627
2471
2472         "Commit landed on trunk instead of ftlopt branch." (Requested
2473         by saamyjoon on #webkit).
2474
2475         Reverted changeset:
2476
2477         "Create a more generic way for VMEntryScope to notify those
2478         interested that it will be destroyed"
2479         https://bugs.webkit.org/show_bug.cgi?id=135358
2480         http://trac.webkit.org/changeset/172009
2481
2482 2014-08-05  Alex Christensen  <achristensen@webkit.org>
2483
2484         More work on CMake.
2485         https://bugs.webkit.org/show_bug.cgi?id=135620
2486
2487         Reviewed by Laszlo Gombos.
2488
2489         * CMakeLists.txt:
2490         Added missing source files.
2491         * PlatformEfl.cmake:
2492         * PlatformGTK.cmake:
2493         Include glib directories and libraries to find glib.h in EventLoop.cpp.
2494         * PlatformMac.cmake:
2495         Moved STATICALLY_LINKED_WITH_WTF definition away from the common CMakeLists
2496         because it should not be defined on Windows.
2497         Added remote inspector source files.
2498
2499 2014-08-05  Peyton Randolph  <prandolph@apple.com>
2500
2501         Rename MAC_LONG_PRESS feature flag to LONG_MOUSE_PRESS.
2502         https://bugs.webkit.org/show_bug.cgi?id=135276
2503
2504         Reviewed by Beth Dakin.
2505
2506         * Configurations/FeatureDefines.xcconfig:
2507
2508 2014-08-04  Benjamin Poulain  <benjamin@webkit.org>
2509
2510         Add a flag for the CSS Selectors level 4 implementation
2511         https://bugs.webkit.org/show_bug.cgi?id=135535
2512
2513         Reviewed by Andreas Kling.
2514
2515         * Configurations/FeatureDefines.xcconfig:
2516
2517 2014-08-04  Alex Christensen  <achristensen@webkit.org>
2518
2519         Progress towards CMake on Mac.
2520         https://bugs.webkit.org/show_bug.cgi?id=135528
2521
2522         Reviewed by Gyuyoung Kim.
2523
2524         * CMakeLists.txt:
2525         Include necessary directories and copy all necessary forwarding headers.
2526         Only compile UDis86Disassembler.cpp if we're using UDIS86.
2527         * PlatformMac.cmake: Added.
2528         * tools/CodeProfiling.cpp:
2529         Compile fix.  Include sys/time.h on darwin, too.
2530
2531 2014-08-04  Saam Barati  <sbarati@apple.com>
2532
2533         Create a more generic way for VMEntryScope to notify those interested that it will be destroyed
2534         https://bugs.webkit.org/show_bug.cgi?id=135358
2535
2536         Reviewed by Geoffrey Garen.
2537
2538         When VMEntryScope is destroyed, and it has a flag set indicating that the
2539         Debugger needs to recompile all functions, it calls Debugger::recompileAllJSFunctions.
2540         This flag is only used by Debugger to have VMEntryScope notify it when the
2541         Debugger is safe to recompile all functions. This patch will substitute this
2542         Debugger-specific recompilation flag with a list of callbacks that are notified
2543         when the outermost VMEntryScope dies. This creates a general purpose interface
2544         for being notified when the VM stops executing code via the event of the outermost
2545         VMEntryScope dying.
2546
2547         * debugger/Debugger.cpp:
2548         (JSC::Debugger::recompileAllJSFunctions):
2549         * runtime/VMEntryScope.cpp:
2550         (JSC::VMEntryScope::VMEntryScope):
2551         (JSC::VMEntryScope::addEntryScopeDidPopListener):
2552         (JSC::VMEntryScope::~VMEntryScope):
2553         * runtime/VMEntryScope.h:
2554         (JSC::VMEntryScope::setRecompilationNeeded): Deleted.
2555
2556 2014-08-01  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2557
2558         REGRESSION(r171942): [CMAKE] [GTK] build broken (clean build).
2559         https://bugs.webkit.org/show_bug.cgi?id=135522
2560
2561         Reviewed by Martin Robinson.
2562
2563         * CMakeLists.txt: Output the inspector headers inside inspector
2564         subdirectory.
2565
2566 2014-08-01  Mark Lam  <mark.lam@apple.com>
2567
2568         Add some structure related assertions.
2569         <https://webkit.org/b/135523>
2570
2571         Reviewed by Geoffrey Garen.
2572
2573         Adding 2 assertions:
2574         1. assert that we don't index pass the end of the StructureIDTable.
2575            This should never happen, but this assertion will help catch bugs
2576            where a bad structureID gets passed in.
2577         2. assert that cells in MarkedBlock::callDestructor() that are not
2578            zapped should have a non-null StructureID.  This will help us catch
2579            bugs where the other cell header flag bits get set after the cell is
2580            zapped, thereby making the cell look like an unzapped cell but has a
2581            null structureID.
2582
2583         * heap/MarkedBlock.cpp:
2584         (JSC::MarkedBlock::callDestructor):
2585         * runtime/StructureIDTable.h:
2586         (JSC::StructureIDTable::get):
2587
2588 2014-08-01  Csaba Osztrogonác  <ossy@webkit.org>
2589
2590         URTBF after r171946 to fix non-Apple builds.
2591
2592         * bytecode/InlineCallFrameSet.cpp:
2593
2594 2014-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
2595
2596         CodeBlock fails to visit the Executables of its InlineCallFrames
2597         https://bugs.webkit.org/show_bug.cgi?id=135471
2598
2599         Reviewed by Geoffrey Garen.
2600
2601         CodeBlock needs to visit its InlineCallFrames' owner Executables. If it doesn't, they
2602         can be prematurely collected and cause crashes.
2603
2604         * bytecode/CodeBlock.cpp:
2605         (JSC::CodeBlock::stronglyVisitStrongReferences):
2606         * bytecode/CodeOrigin.h:
2607         (JSC::InlineCallFrame::visitAggregate):
2608         * bytecode/InlineCallFrameSet.cpp:
2609         (JSC::InlineCallFrameSet::visitAggregate):
2610         * bytecode/InlineCallFrameSet.h:
2611
2612 2014-08-01  Alex Christensen  <achristensen@webkit.org>
2613
2614         Progress towards cmake on Windows.
2615         https://bugs.webkit.org/show_bug.cgi?id=135484
2616
2617         Reviewed by Martin Robinson.
2618
2619         * CMakeLists.txt:
2620         Generate code directly to inspector directory to avoid using the cp command
2621         which is not available on Windows.
2622         * PlatformWin.cmake: Added.
2623
2624 2014-07-31  Andreas Kling  <akling@apple.com>
2625
2626         Remove the JSC::OverridesVisitChildren flag.
2627         <https://webkit.org/b/135489>
2628
2629         Except for 3 special classes, the visitChildren() call is always
2630         dispatched through the method table (see SlotVisitor.cpp.)
2631
2632         The OverridesVisitChildren flag doesn't actually do anything.
2633         It could be used to implement a non-virtual direct call to
2634         JSCell::visitChildren, bypassing the method table for some objects,
2635         but such a micro-optimization seems like a weak trade for all this
2636         code complexity. Instead, just remove the flag.
2637
2638         This change frees up an inline flag bit in JSCell.
2639
2640         Reviewed by Geoffrey Garen.
2641
2642         * API/JSAPIWrapperObject.h:
2643         * API/JSAPIWrapperObject.mm:
2644         (JSC::JSAPIWrapperObject::visitChildren):
2645         * API/JSCallbackObject.h:
2646         (JSC::JSCallbackObject::visitChildren):
2647         * bytecode/UnlinkedCodeBlock.cpp:
2648         (JSC::UnlinkedFunctionExecutable::visitChildren):
2649         (JSC::UnlinkedCodeBlock::visitChildren):
2650         (JSC::UnlinkedProgramCodeBlock::visitChildren):
2651         * bytecode/UnlinkedCodeBlock.h:
2652         * debugger/DebuggerScope.cpp:
2653         (JSC::DebuggerScope::visitChildren):
2654         * debugger/DebuggerScope.h:
2655         * jsc.cpp:
2656         * runtime/Arguments.cpp:
2657         (JSC::Arguments::visitChildren):
2658         * runtime/Arguments.h:
2659         * runtime/Executable.cpp:
2660         (JSC::EvalExecutable::visitChildren):
2661         (JSC::ProgramExecutable::visitChildren):
2662         (JSC::FunctionExecutable::visitChildren):
2663         * runtime/Executable.h:
2664         * runtime/GetterSetter.cpp:
2665         (JSC::GetterSetter::visitChildren):
2666         * runtime/GetterSetter.h:
2667         (JSC::GetterSetter::createStructure):
2668         * runtime/JSAPIValueWrapper.h:
2669         (JSC::JSAPIValueWrapper::createStructure):
2670         * runtime/JSActivation.cpp:
2671         (JSC::JSActivation::visitChildren):
2672         * runtime/JSActivation.h:
2673         * runtime/JSArrayIterator.cpp:
2674         (JSC::JSArrayIterator::visitChildren):
2675         * runtime/JSArrayIterator.h:
2676         * runtime/JSBoundFunction.cpp:
2677         (JSC::JSBoundFunction::visitChildren):
2678         * runtime/JSBoundFunction.h:
2679         * runtime/JSCellInlines.h:
2680         (JSC::JSCell::setStructure):
2681         * runtime/JSFunction.cpp:
2682         (JSC::JSFunction::visitChildren):
2683         * runtime/JSFunction.h:
2684         * runtime/JSGlobalObject.cpp:
2685         (JSC::JSGlobalObject::visitChildren):
2686         * runtime/JSGlobalObject.h:
2687         * runtime/JSMap.h:
2688         * runtime/JSMapIterator.cpp:
2689         (JSC::JSMapIterator::visitChildren):
2690         * runtime/JSMapIterator.h:
2691         * runtime/JSNameScope.cpp:
2692         (JSC::JSNameScope::visitChildren):
2693         * runtime/JSNameScope.h:
2694         * runtime/JSPromise.cpp:
2695         (JSC::JSPromise::visitChildren):
2696         * runtime/JSPromise.h:
2697         * runtime/JSPromiseDeferred.cpp:
2698         (JSC::JSPromiseDeferred::visitChildren):
2699         * runtime/JSPromiseDeferred.h:
2700         * runtime/JSPromiseReaction.cpp:
2701         (JSC::JSPromiseReaction::visitChildren):
2702         * runtime/JSPromiseReaction.h:
2703         * runtime/JSPropertyNameIterator.cpp:
2704         (JSC::JSPropertyNameIterator::visitChildren):
2705         * runtime/JSPropertyNameIterator.h:
2706         * runtime/JSProxy.cpp:
2707         (JSC::JSProxy::visitChildren):
2708         * runtime/JSProxy.h:
2709         * runtime/JSScope.cpp:
2710         (JSC::JSScope::visitChildren):
2711         * runtime/JSScope.h:
2712         * runtime/JSSegmentedVariableObject.cpp:
2713         (JSC::JSSegmentedVariableObject::visitChildren):
2714         * runtime/JSSegmentedVariableObject.h:
2715         * runtime/JSSet.h:
2716         * runtime/JSSetIterator.cpp:
2717         (JSC::JSSetIterator::visitChildren):
2718         * runtime/JSSetIterator.h:
2719         * runtime/JSSymbolTableObject.cpp:
2720         (JSC::JSSymbolTableObject::visitChildren):
2721         * runtime/JSSymbolTableObject.h:
2722         * runtime/JSTypeInfo.h:
2723         (JSC::TypeInfo::overridesVisitChildren): Deleted.
2724         * runtime/JSWeakMap.h:
2725         * runtime/JSWithScope.cpp:
2726         (JSC::JSWithScope::visitChildren):
2727         * runtime/JSWithScope.h:
2728         * runtime/JSWrapperObject.cpp:
2729         (JSC::JSWrapperObject::visitChildren):
2730         * runtime/JSWrapperObject.h:
2731         * runtime/MapData.h:
2732         * runtime/NativeErrorConstructor.cpp:
2733         (JSC::NativeErrorConstructor::visitChildren):
2734         * runtime/NativeErrorConstructor.h:
2735         * runtime/PropertyMapHashTable.h:
2736         * runtime/PropertyTable.cpp:
2737         (JSC::PropertyTable::visitChildren):
2738         * runtime/RegExpConstructor.cpp:
2739         (JSC::RegExpConstructor::visitChildren):
2740         * runtime/RegExpConstructor.h:
2741         * runtime/RegExpMatchesArray.cpp:
2742         (JSC::RegExpMatchesArray::visitChildren):
2743         * runtime/RegExpMatchesArray.h:
2744         * runtime/RegExpObject.cpp:
2745         (JSC::RegExpObject::visitChildren):
2746         * runtime/RegExpObject.h:
2747         * runtime/SparseArrayValueMap.h:
2748         * runtime/Structure.cpp:
2749         (JSC::Structure::Structure):
2750         (JSC::Structure::visitChildren):
2751         * runtime/StructureChain.cpp:
2752         (JSC::StructureChain::visitChildren):
2753         * runtime/StructureChain.h:
2754         * runtime/StructureRareData.cpp:
2755         (JSC::StructureRareData::visitChildren):
2756         * runtime/StructureRareData.h:
2757         * runtime/WeakMapData.h:
2758
2759 2014-07-31  Mark Lam  <mark.lam@apple.com>
2760
2761         JSCell::classInfo() belongs in JSCellInlines.h.
2762         <https://webkit.org/b/135475>
2763
2764         Reviewed by Mark Hahnenberg.
2765
2766         * runtime/JSCellInlines.h:
2767         (JSC::JSCell::classInfo):
2768         * runtime/JSDestructibleObject.h:
2769         (JSC::JSCell::classInfo): Deleted.
2770
2771 2014-07-31  Tanay C  <tanay.c@samsung.com>
2772
2773         Build warning in webkit/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
2774         https://bugs.webkit.org/show_bug.cgi?id=135414
2775
2776         Reviewed by Csaba Osztrogonác.
2777
2778         * llint/LLIntSlowPaths.cpp:
2779         (JSC::LLInt::putToScopeCommon):removed unused parameter from function definition
2780
2781 2014-07-30  Filip Pizlo  <fpizlo@apple.com>
2782
2783         NewFunctionExpression and NewFunctionNoCheck should setHaveStructures(true)
2784         https://bugs.webkit.org/show_bug.cgi?id=135430
2785
2786         Reviewed by Mark Hahnenberg.
2787
2788         We already handled this correctly after the ftlopt merge, but it's useful to have the test.
2789
2790         * tests/stress/new-function-expression-has-structures.js: Added.
2791         (foo.f):
2792         (foo.f.prototype.f):
2793         (foo):
2794
2795 2014-07-30  Andreas Kling  <akling@apple.com>
2796
2797         Speculative Windows build fix.
2798
2799         Try to dllimport the dllexported global object HashTable.
2800
2801         * jsc.cpp:
2802         * testRegExp.cpp:
2803
2804 2014-07-30  Andreas Kling  <akling@apple.com>
2805
2806         PropertyName's internal string is always atomic.
2807         <https://webkit.org/b/135451>
2808
2809         Now that we've merged the JSC::Identifier and WTF::AtomicString tables,
2810         we know that any string that's an Identifier is guaranteed to be atomic.
2811
2812         A PropertyName can be either an Identifier or a PrivateName, and the
2813         private names are also guaranteed to be atomic internally.
2814
2815         Make PropertyName vend AtomicStringImpl* instead of StringImpl*.
2816
2817         Reviewed by Benjamin Poulain.
2818
2819         * runtime/PropertyName.h:
2820         (JSC::PropertyName::PropertyName):
2821         (JSC::PropertyName::uid):
2822         (JSC::PropertyName::publicName):
2823
2824 2014-07-30  Andy Estes  <aestes@apple.com>
2825
2826         USE(CONTENT_FILTERING) should be ENABLE(CONTENT_FILTERING)
2827         https://bugs.webkit.org/show_bug.cgi?id=135439
2828
2829         Reviewed by Tim Horton.
2830
2831         We now support two different platform content filters, and will soon support a mock content filter (as part of
2832         webkit.org/b/128858). This makes content filtering a feature of WebKit, not just an adoption of a third-party
2833         library. ENABLE() is the correct macro to use for such a feature.
2834
2835         * Configurations/FeatureDefines.xcconfig:
2836
2837 2014-07-30  Andreas Kling  <akling@apple.com>
2838
2839         Static hash tables no longer need to be coupled with a VM.
2840         <https://webkit.org/b/135421>
2841
2842         Now that the static hash tables are using char** instead of StringImpl**,
2843         it's no longer necessary to make them per-VM.
2844
2845         This patch removes the hook in ClassInfo for providing your own static
2846         hash table getter. Everyone now uses ClassInfo::staticPropHashTable.
2847         Most of this patch is tweaking ClassInfo construction sites to pass one
2848         less null pointer.
2849
2850         Also simplified Lookup.h to stop requiring ExecState/VM to access the
2851         static hash tables.
2852
2853         Reviewed by Geoffrey Garen.
2854
2855         * API/JSAPIWrapperObject.mm:
2856         * API/JSCallbackConstructor.cpp:
2857         * API/JSCallbackFunction.cpp:
2858         * API/JSCallbackObject.cpp:
2859         * API/ObjCCallbackFunction.mm:
2860         * bytecode/UnlinkedCodeBlock.cpp:
2861         * create_hash_table:
2862         * debugger/DebuggerScope.cpp:
2863         * inspector/JSInjectedScriptHost.cpp:
2864         * inspector/JSInjectedScriptHostPrototype.cpp:
2865         * inspector/JSJavaScriptCallFrame.cpp:
2866         * inspector/JSJavaScriptCallFramePrototype.cpp:
2867         * interpreter/CallFrame.h:
2868         (JSC::ExecState::arrayConstructorTable): Deleted.
2869         (JSC::ExecState::arrayPrototypeTable): Deleted.
2870         (JSC::ExecState::booleanPrototypeTable): Deleted.
2871         (JSC::ExecState::dataViewTable): Deleted.
2872         (JSC::ExecState::dateTable): Deleted.
2873         (JSC::ExecState::dateConstructorTable): Deleted.
2874         (JSC::ExecState::errorPrototypeTable): Deleted.
2875         (JSC::ExecState::globalObjectTable): Deleted.
2876         (JSC::ExecState::jsonTable): Deleted.
2877         (JSC::ExecState::numberConstructorTable): Deleted.
2878         (JSC::ExecState::numberPrototypeTable): Deleted.
2879         (JSC::ExecState::objectConstructorTable): Deleted.
2880         (JSC::ExecState::privateNamePrototypeTable): Deleted.
2881         (JSC::ExecState::regExpTable): Deleted.
2882         (JSC::ExecState::regExpConstructorTable): Deleted.
2883         (JSC::ExecState::regExpPrototypeTable): Deleted.
2884         (JSC::ExecState::stringConstructorTable): Deleted.
2885         (JSC::ExecState::promisePrototypeTable): Deleted.
2886         (JSC::ExecState::promiseConstructorTable): Deleted.
2887         * jsc.cpp:
2888         * parser/Lexer.h:
2889         (JSC::Keywords::isKeyword):
2890         (JSC::Keywords::getKeyword):
2891         * runtime/Arguments.cpp:
2892         * runtime/ArgumentsIteratorConstructor.cpp:
2893         * runtime/ArgumentsIteratorPrototype.cpp:
2894         * runtime/ArrayBufferNeuteringWatchpoint.cpp:
2895         * runtime/ArrayConstructor.cpp:
2896         (JSC::ArrayConstructor::getOwnPropertySlot):
2897         * runtime/ArrayIteratorConstructor.cpp:
2898         * runtime/ArrayIteratorPrototype.cpp:
2899         * runtime/ArrayPrototype.cpp:
2900         (JSC::ArrayPrototype::getOwnPropertySlot):
2901         * runtime/BooleanConstructor.cpp:
2902         * runtime/BooleanObject.cpp:
2903         * runtime/BooleanPrototype.cpp:
2904         (JSC::BooleanPrototype::getOwnPropertySlot):
2905         * runtime/ClassInfo.h:
2906         (JSC::ClassInfo::hasStaticProperties):
2907         (JSC::ClassInfo::propHashTable): Deleted.
2908         * runtime/ConsolePrototype.cpp:
2909         * runtime/CustomGetterSetter.cpp:
2910         * runtime/DateConstructor.cpp:
2911         (JSC::DateConstructor::getOwnPropertySlot):
2912         * runtime/DateInstance.cpp:
2913         * runtime/DatePrototype.cpp:
2914         (JSC::DatePrototype::getOwnPropertySlot):
2915         * runtime/Error.cpp:
2916         * runtime/ErrorConstructor.cpp:
2917         * runtime/ErrorInstance.cpp:
2918         * runtime/ErrorPrototype.cpp:
2919         (JSC::ErrorPrototype::getOwnPropertySlot):
2920         * runtime/ExceptionHelpers.cpp:
2921         * runtime/Executable.cpp:
2922         * runtime/FunctionConstructor.cpp:
2923         * runtime/FunctionPrototype.cpp:
2924         * runtime/GetterSetter.cpp:
2925         * runtime/InternalFunction.cpp:
2926         * runtime/JSAPIValueWrapper.cpp:
2927         * runtime/JSActivation.cpp:
2928         * runtime/JSArgumentsIterator.cpp:
2929         * runtime/JSArray.cpp:
2930         * runtime/JSArrayBuffer.cpp:
2931         * runtime/JSArrayBufferConstructor.cpp:
2932         * runtime/JSArrayBufferPrototype.cpp:
2933         * runtime/JSArrayBufferView.cpp:
2934         * runtime/JSArrayIterator.cpp:
2935         * runtime/JSBoundFunction.cpp:
2936         * runtime/JSConsole.cpp:
2937         * runtime/JSDataView.cpp:
2938         * runtime/JSDataViewPrototype.cpp:
2939         (JSC::JSDataViewPrototype::getOwnPropertySlot):
2940         * runtime/JSFunction.cpp:
2941         * runtime/JSGlobalObject.cpp:
2942         (JSC::JSGlobalObject::getOwnPropertySlot):
2943         * runtime/JSMap.cpp:
2944         * runtime/JSMapIterator.cpp:
2945         * runtime/JSNameScope.cpp:
2946         * runtime/JSNotAnObject.cpp:
2947         * runtime/JSONObject.cpp:
2948         (JSC::JSONObject::getOwnPropertySlot):
2949         * runtime/JSObject.cpp:
2950         (JSC::getClassPropertyNames):
2951         (JSC::JSObject::put):
2952         (JSC::JSObject::deleteProperty):
2953         (JSC::JSObject::findPropertyHashEntry):
2954         (JSC::JSObject::reifyStaticFunctionsForDelete):
2955         * runtime/JSObject.h:
2956         * runtime/JSPromise.cpp:
2957         * runtime/JSPromiseConstructor.cpp:
2958         (JSC::JSPromiseConstructor::getOwnPropertySlot):
2959         * runtime/JSPromiseDeferred.cpp:
2960         * runtime/JSPromisePrototype.cpp:
2961         (JSC::JSPromisePrototype::getOwnPropertySlot):
2962         * runtime/JSPromiseReaction.cpp:
2963         * runtime/JSPropertyNameIterator.cpp:
2964         * runtime/JSProxy.cpp:
2965         * runtime/JSSet.cpp:
2966         * runtime/JSSetIterator.cpp:
2967         * runtime/JSString.cpp:
2968         * runtime/JSTypedArrayConstructors.cpp:
2969         * runtime/JSTypedArrayPrototypes.cpp:
2970         * runtime/JSTypedArrays.cpp:
2971         * runtime/JSVariableObject.cpp:
2972         * runtime/JSWeakMap.cpp:
2973         * runtime/JSWithScope.cpp:
2974         * runtime/Lookup.cpp:
2975         (JSC::HashTable::createTable):
2976         * runtime/Lookup.h:
2977         (JSC::HashTable::initializeIfNeeded):
2978         (JSC::HashTable::entry):
2979         (JSC::HashTable::begin):
2980         (JSC::HashTable::end):
2981         (JSC::getStaticPropertySlot):
2982         (JSC::getStaticFunctionSlot):
2983         (JSC::getStaticValueSlot):
2984         (JSC::lookupPut):
2985         * runtime/MapConstructor.cpp:
2986         * runtime/MapData.cpp:
2987         * runtime/MapIteratorConstructor.cpp:
2988         * runtime/MapIteratorPrototype.cpp:
2989         * runtime/MapPrototype.cpp:
2990         * runtime/MathObject.cpp:
2991         * runtime/NameConstructor.cpp:
2992         * runtime/NameInstance.cpp:
2993         * runtime/NamePrototype.cpp:
2994         (JSC::NamePrototype::getOwnPropertySlot):
2995         * runtime/NativeErrorConstructor.cpp:
2996         * runtime/NumberConstructor.cpp:
2997         (JSC::NumberConstructor::getOwnPropertySlot):
2998         * runtime/NumberObject.cpp:
2999         * runtime/NumberPrototype.cpp:
3000         (JSC::NumberPrototype::getOwnPropertySlot):
3001         * runtime/ObjectConstructor.cpp:
3002         (JSC::ObjectConstructor::getOwnPropertySlot):
3003         * runtime/ObjectPrototype.cpp:
3004         * runtime/PropertyTable.cpp:
3005         * runtime/RegExp.cpp:
3006         * runtime/RegExpConstructor.cpp:
3007         (JSC::RegExpConstructor::getOwnPropertySlot):
3008         * runtime/RegExpMatchesArray.cpp:
3009         * runtime/RegExpObject.cpp:
3010         (JSC::RegExpObject::getOwnPropertySlot):
3011         * runtime/RegExpPrototype.cpp:
3012         (JSC::RegExpPrototype::getOwnPropertySlot):
3013         * runtime/SetConstructor.cpp:
3014         * runtime/SetIteratorConstructor.cpp:
3015         * runtime/SetIteratorPrototype.cpp:
3016         * runtime/SetPrototype.cpp:
3017         * runtime/SparseArrayValueMap.cpp:
3018         * runtime/StrictEvalActivation.cpp:
3019         * runtime/StringConstructor.cpp:
3020         (JSC::StringConstructor::getOwnPropertySlot):
3021         * runtime/StringObject.cpp:
3022         * runtime/StringPrototype.cpp:
3023         * runtime/Structure.cpp:
3024         (JSC::Structure::Structure):
3025         (JSC::Structure::freezeTransition):
3026         (JSC::ClassInfo::hasStaticSetterOrReadonlyProperties):
3027         * runtime/StructureChain.cpp:
3028         * runtime/StructureRareData.cpp:
3029         * runtime/SymbolTable.cpp:
3030         * runtime/VM.cpp:
3031         (JSC::VM::VM):
3032         (JSC::VM::~VM):
3033         * runtime/VM.h:
3034         * runtime/WeakMapConstructor.cpp:
3035         * runtime/WeakMapData.cpp:
3036         * runtime/WeakMapPrototype.cpp:
3037         * testRegExp.cpp:
3038
3039 2014-07-29  Brent Fulgham  <bfulgham@apple.com>
3040
3041         [Win] Modify version numbering scheme to support 5-tuple versions
3042         https://bugs.webkit.org/show_bug.cgi?id=135400
3043         <rdar://problem/17849033>
3044
3045         Reviewed by David Kilzer.
3046
3047         * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd: Use the
3048         new version-stamp.pl script to version JavaScriptCore.dll.
3049
3050 2014-07-29  Daniel Bates  <dabates@apple.com>
3051
3052         Use WTF::move() instead of std::move() to help ensure move semantics
3053         https://bugs.webkit.org/show_bug.cgi?id=135351
3054
3055         Reviewed by Alexey Proskuryakov.
3056
3057         * bytecode/GetByIdStatus.cpp:
3058         (JSC::GetByIdStatus::computeForStubInfo):
3059         * bytecode/GetByIdVariant.cpp:
3060         (JSC::GetByIdVariant::GetByIdVariant):
3061
3062 2014-07-28  Tamas Gergely  <tgergely.u-szeged@partner.samsung.com>
3063
3064         BuildFix: JavaScriptCore/bytecode/StructureSet.h:262:77: warning.
3065         https://bugs.webkit.org/show_bug.cgi?id=135287
3066
3067         Reviewed by Darin Adler.
3068
3069         The set() method tries to use a part of the old value (the reservedFlag bit) which
3070         was not defined when the constructor is called. Initialize m_pointer to 0 explicitely.
3071
3072         * bytecode/StructureSet.h:
3073         (JSC::StructureSet::StructureSet):
3074
3075 2014-07-28  Benjamin Poulain  <bpoulain@apple.com>
3076
3077         [JSC] JIT::assertStackPointerOffset() crashes on ARM64
3078         https://bugs.webkit.org/show_bug.cgi?id=135316
3079
3080         Reviewed by Geoffrey Garen.
3081
3082         JIT::assertStackPointerOffset() does a compare between an arbitrary register
3083         and the stack pointer. This was not supported by the ARM64 assembler.
3084
3085         There are no variation that can take a stack pointer for Xd. There is one version of subs
3086         that can take a stack pointer, but only for the Xn: the shift+extend one.
3087         To solve the problem, I changed cmp to swap the registers if necessary, and I fixed
3088         the implementation of sub.
3089
3090         * assembler/ARM64Assembler.h:
3091         (JSC::ARM64Assembler::sub):
3092         In the generic sub(reg, reg), I added assertions to catch the condition that cannot be generated
3093         with either version of sub.
3094
3095         In sub(with shift), I remove the weird special case for SP. First, it was quite misleading because
3096         the Rd case only works if "setflag == false". The other confusing part is going to addSubtractShiftedRegister()
3097         gives you a reduce shift range, which could create subtle bug that only appear when SP is used.
3098
3099         Since I removed the weird case, I need to differentiate between the sub() that support SP, and the one that does
3100         not elsewhere. That is why that branch has moved to the generic sub(reg, reg). Since at that point we know
3101         the shift value must be zero, it is safe to call either variant.
3102
3103         * assembler/MacroAssemblerARM64.h:
3104         (JSC::MacroAssemblerARM64::branch64):
3105         With the changes described above, we can now use SP for the left register. What do we do if the rightmost
3106         register is SP?
3107
3108         For the case of JIT::assertStackPointerOffset(), the comparison is Equal so the order really does not matter,
3109         we just switch the registers before generating the instruction.
3110
3111         For the generic case, just move the value of SP to a GPR before doing the CMP.
3112
3113 2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
3114
3115         Unreviewed build fix after r171682.
3116
3117         * replay/EncodedValue.h: Don't mark the inlined Vector<char> specialization
3118         as an exported symbol.
3119
3120 2014-07-28  Mark Hahnenberg  <mhahnenberg@apple.com>
3121
3122         REGRESSION: JSObjectSetPrototype() does not work on result of JSGetGlobalObject()
3123         https://bugs.webkit.org/show_bug.cgi?id=135322
3124
3125         Reviewed by Oliver Hunt.
3126
3127         The prototype chain of the JSProxy object should match that of the JSGlobalObject.
3128
3129         This is a separate but related issue with JSObjectSetPrototype which doesn't correctly
3130         account for JSProxies. I also audited the rest of the C API to check that we correctly
3131         handle JSProxies in all other situations where we expect a JSCallbackObject of some sort
3132         and found some SPI calls (JSObject*PrivateProperty) that didn't behave correctly when
3133         passed a JSProxy.
3134
3135         I also added some new tests for these cases.
3136
3137         * API/JSObjectRef.cpp:
3138         (JSObjectSetPrototype):
3139         (JSObjectGetPrivateProperty):
3140         (JSObjectSetPrivateProperty):
3141         (JSObjectDeletePrivateProperty):
3142         * API/JSWeakObjectMapRefPrivate.cpp:
3143         * API/tests/CustomGlobalObjectClassTest.c:
3144         (globalObjectSetPrototypeTest):
3145         (globalObjectPrivatePropertyTest):
3146         * API/tests/CustomGlobalObjectClassTest.h:
3147         * API/tests/testapi.c:
3148         (main):
3149
3150 2014-07-28  Filip Pizlo  <fpizlo@apple.com>
3151
3152         Make sure that we don't use non-speculative BooleanToNumber for a speculative Branch
3153         https://bugs.webkit.org/show_bug.cgi?id=135350
3154         <rdar://problem/17509889>
3155
3156         Reviewed by Mark Hahnenberg and Oliver Hunt.
3157
3158         If we have an exiting node that uses a conversion node, then that exiting node
3159         needs to have a Phantom after it for the the original node. But we can't do that
3160         for Branch because https://bugs.webkit.org/show_bug.cgi?id=126778.
3161
3162         * dfg/DFGFixupPhase.cpp:
3163         (JSC::DFG::FixupPhase::fixupNode):
3164         (JSC::DFG::FixupPhase::clearPhantomsAtEnd):
3165         * tests/stress/branch-check-int32-on-boolean-to-number-untyped.js: Added.
3166         (foo):
3167         (test):
3168         * tests/stress/branch-check-number-on-boolean-to-number-untyped.js: Added.
3169         (foo):
3170         (test):
3171
3172 2014-07-28  Joseph Pecoraro  <pecoraro@apple.com>
3173
3174         JSContext Inspector: crash when using step-into
3175         https://bugs.webkit.org/show_bug.cgi?id=135345
3176
3177         Reviewed by Timothy Hatcher.
3178
3179         * inspector/agents/InspectorDebuggerAgent.cpp:
3180         (Inspector::InspectorDebuggerAgent::stepInto):
3181         Null check m_listener since it may not be set.
3182
3183 2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
3184
3185         Web Replay: auto-decoding of parameterized vector's elements is incorrect
3186         https://bugs.webkit.org/show_bug.cgi?id=135343
3187
3188         Reviewed by Timothy Hatcher.
3189
3190         Fix an incorrect type argument in EncodingTraits<Vector<T>>::encodeValue
3191         that was using the element's decoded type as the type parameter to
3192         EncodedValue::append<T>. It should instead be the raw type T. This
3193         causes problems when encoding Vector<RefPtr<T>>, as it later tries to
3194         use encoding traits for RefPtr<T> rather than for T.
3195
3196         Fix incorrect generated encoding traits argument for vectors of
3197         RefCounted objects. Updated test to cover this scenario.
3198
3199