Source/JavaScriptCore/ChangeLog

   1 2016-09-22  Filip Pizlo  <fpizlo@apple.com>
   2
   3         Need a store-load fence between setting cell state and visiting the object in SlotVisitor
   4         https://bugs.webkit.org/show_bug.cgi?id=162354
   5
   6         Reviewed by Mark Lam.
   7
   8         This was meant to be a small change, but then it became bigger as I found small
   9         opportunities for improving this code. This adds a store-load fence and is performance-
  10         neutral. That's probably partly due to other optimizations that I did to visitChildren().
  11
  12         Initially, I found that adding an mfence as a store-load fence was terribly expensive. So,
  13         I thought that I needed to buffer up a bunch of objects, set their states, do one mfence,
  14         and then visit all of them. This seemed like a win, so I went with it. Unfortunately, this
  15         made no sense for two reasons:
  16
  17         - I shouldn't use mfence. I should use ortop (lock orl $0, (%rsp)) instead. Ortop is
  18           basically free, and it's what WTF now uses for storeLoadFence().
  19
  20         - My data saying that buffering up objects was not a slow-down was wrong. That was actually
  21           almost as expensive as the mfence.
  22
  23         But in order to implement that, I made some other improvements that I think we should stick
  24         with:
  25
  26         - SlotVisitor::visitChildren() now uses a switch on type. This replaces what used to be
  27           some nasty ClassInfo look-ups.
  28
  29         - We no longer save the object's old CellState. We would do that so that we would know what
  30           state the object had been before we blackened it. But I believe that the more logical
  31           solution is to have two kinds of black - one for black-for-the-first-time objects and one
  32           for repeat offenders. This is a lot easier to reason about, since you can now just figure
  33           this out by looking at the cell directly.
  34
  35         The latter change meant rewiring a bunch of barriers. It didn't make them any more
  36         expensive.
  37
  38         * ftl/FTLLowerDFGToB3.cpp:
  39         (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
  40         * heap/CellState.h:
  41         (JSC::blacken):
  42         * heap/Heap.cpp:
  43         (JSC::Heap::addToRememberedSet):
  44         * heap/Heap.h:
  45         * heap/HeapInlines.h:
  46         (JSC::Heap::writeBarrier):
  47         (JSC::Heap::reportExtraMemoryVisited):
  48         (JSC::Heap::reportExternalMemoryVisited):
  49         * heap/MarkStack.cpp:
  50         * heap/MarkStack.h:
  51         * heap/SlotVisitor.cpp:
  52         (JSC::SlotVisitor::visitChildren):
  53         * heap/SlotVisitor.h:
  54         * heap/SlotVisitorInlines.h:
  55         (JSC::SlotVisitor::reportExtraMemoryVisited):
  56         (JSC::SlotVisitor::reportExternalMemoryVisited):
  57         * jit/AssemblyHelpers.h:
  58         (JSC::AssemblyHelpers::jumpIfIsRememberedOrInEden):
  59         * llint/LLIntData.cpp:
  60         (JSC::LLInt::Data::performAssertions):
  61         * llint/LowLevelInterpreter.asm:
  62         * llint/LowLevelInterpreter32_64.asm:
  63         * llint/LowLevelInterpreter64.asm:
  64         * runtime/JSObject.h:
  65         (JSC::isJSFinalObject):
  66
  67 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
  68
  69         ARM EABI buildfix after r206289
  70         https://bugs.webkit.org/show_bug.cgi?id=162486
  71
  72         Unreviewed buildfix.
  73
  74         * jit/CCallHelpers.h:
  75         (JSC::CCallHelpers::setupArgumentsWithExecState):
  76
  77 2016-09-23  Antoine Quint  <graouts@apple.com>
  78
  79         Add a new runtime flag for work on modern media controls (off by default)
  80         https://bugs.webkit.org/show_bug.cgi?id=162420
  81         <rdar://problem/27989489>
  82
  83         Reviewed by Eric Carlson.
  84
  85         * runtime/CommonIdentifiers.h:
  86
  87 2016-09-23  Carlos Garcia Campos  <cgarcia@igalia.com>
  88
  89         REGRESSION(r194387): Crash on github.com in IntlDateTimeFormat::resolvedOptions in C locale
  90         https://bugs.webkit.org/show_bug.cgi?id=162139
  91
  92         Reviewed by Michael Catanzaro.
  93
  94         The crash happens in unix ports because the resolved locale is empty when system locale is "C". IntlObject
  95         considers any language tag with a size < 2 to be an invalid language, so "C" is not a valid language to resolve
  96         the locale. We should ensure that WTF::platformUserPreferredLanguages() never returns invalid languages, but
  97         that's not enough, because languages can be overriden from the public API, so we need to handle those cases and
  98         throw exceptions instead of crashing.
  99
 100         * runtime/IntlCollator.cpp:
 101         (JSC::IntlCollator::initializeCollator): Throw a exception when we fail to resolve the locale.
 102         * runtime/IntlDateTimeFormat.cpp:
 103         (JSC::IntlDateTimeFormat::initializeDateTimeFormat): Ditto.
 104         * runtime/IntlNumberFormat.cpp:
 105         (JSC::IntlNumberFormat::initializeNumberFormat): Ditto.
 106
 107 2016-09-22  Benjamin Poulain  <bpoulain@apple.com>
 108
 109         [JSC] Use an inline cache to generate op_negate
 110         https://bugs.webkit.org/show_bug.cgi?id=162371
 111
 112         Reviewed by Saam Barati.
 113
 114         Use an inline cache to reduce the amount of code
 115         required to implement op_negate.
 116
 117         For pure integer negate, the generated asm shrinks
 118         from 147 bytes to 125 bytes (14%).
 119         For double negate, the generated asm shrinks
 120         to 130 bytes (11%).
 121         The average size on Sunspider is 100bytes, this is due
 122         to the op_negates that are never executed and do not
 123         generate much.
 124
 125         * bytecode/ArithProfile.h:
 126         (JSC::ArithProfile::ArithProfile):
 127         (JSC::ArithProfile::observeLHS):
 128         (JSC::ArithProfile::observeLHSAndRHS):
 129         * bytecode/BytecodeList.json:
 130         * bytecode/CodeBlock.cpp:
 131         (JSC::CodeBlock::addJITNegIC):
 132         * bytecode/CodeBlock.h:
 133         * bytecompiler/BytecodeGenerator.cpp:
 134         (JSC::BytecodeGenerator::emitUnaryOp):
 135         * bytecompiler/BytecodeGenerator.h:
 136         * bytecompiler/NodesCodegen.cpp:
 137         (JSC::UnaryOpNode::emitBytecode):
 138         * dfg/DFGSpeculativeJIT.cpp:
 139         (JSC::DFG::SpeculativeJIT::compileMathIC):
 140         * dfg/DFGSpeculativeJIT.h:
 141         * ftl/FTLLowerDFGToB3.cpp:
 142         (JSC::FTL::DFG::LowerDFGToB3::compileMathIC):
 143         * jit/CCallHelpers.h:
 144         (JSC::CCallHelpers::setupArgumentsWithExecState):
 145         * jit/JIT.h:
 146         * jit/JITArithmetic.cpp:
 147         (JSC::JIT::emit_op_negate):
 148         (JSC::JIT::emitSlow_op_negate):
 149         (JSC::JIT::emitMathICFast):
 150         (JSC::JIT::emitMathICSlow):
 151         * jit/JITInlines.h:
 152         (JSC::JIT::callOperation):
 153         * jit/JITMathIC.h:
 154         (JSC::JITMathIC::generateInline):
 155         (JSC::canGenerateWithBinaryProfile):
 156         (JSC::canGenerateWithUnaryProfile):
 157         * jit/JITMathICForwards.h:
 158         * jit/JITNegGenerator.cpp:
 159         (JSC::JITNegGenerator::generateInline):
 160         (JSC::JITNegGenerator::generateFastPath):
 161         * jit/JITNegGenerator.h:
 162         (JSC::JITNegGenerator::JITNegGenerator):
 163         (JSC::JITNegGenerator::arithProfile):
 164         (JSC::JITNegGenerator::didEmitFastPath): Deleted.
 165         (JSC::JITNegGenerator::endJumpList): Deleted.
 166         (JSC::JITNegGenerator::slowPathJumpList): Deleted.
 167         * jit/JITOperations.cpp:
 168         * jit/JITOperations.h:
 169         * llint/LowLevelInterpreter.asm:
 170         * llint/LowLevelInterpreter32_64.asm:
 171         * llint/LowLevelInterpreter64.asm:
 172         * runtime/CommonSlowPaths.cpp:
 173         (JSC::updateArithProfileForUnaryArithOp):
 174         (JSC::SLOW_PATH_DECL):
 175
 176 2016-09-22  Mark Lam  <mark.lam@apple.com>
 177
 178         Removed unused hasErrorInfo().
 179         https://bugs.webkit.org/show_bug.cgi?id=162473
 180
 181         Reviewed by Saam Barati.
 182
 183         * JavaScriptCore.order:
 184         * runtime/Error.cpp:
 185         (JSC::hasErrorInfo): Deleted.
 186         * runtime/Error.h:
 187
 188 2016-09-22  Mark Lam  <mark.lam@apple.com>
 189
 190         Array.prototype.join should do overflow checks on string joins.
 191         https://bugs.webkit.org/show_bug.cgi?id=162459
 192
 193         Reviewed by Saam Barati.
 194
 195         Change the 2 JSRopeString::create() functions that do joins to be private, and
 196         force all clients of it to go through the jsString() utility functions that do
 197         overflow checks before creating the ropes.
 198
 199         * dfg/DFGOperations.cpp:
 200         * runtime/ArrayPrototype.cpp:
 201         (JSC::slowJoin):
 202         * runtime/JSString.h:
 203         * runtime/Operations.h:
 204         (JSC::jsString):
 205
 206 2016-09-22  Filip Pizlo  <fpizlo@apple.com>
 207
 208         Fences on x86 should be a lot cheaper
 209         https://bugs.webkit.org/show_bug.cgi?id=162417
 210
 211         Reviewed by Mark Lam and Geoffrey Garen.
 212
 213         It turns out that:
 214
 215             lock; orl $0, (%rsp)
 216
 217         does everything that we wanted from:
 218
 219             mfence
 220
 221         And it's a lot faster. When I tried mfence for making object visiting concurrent-GC-TSO-
 222         friendly, it was a 9% regression on Octane/splay. But when I tried ortop, it was neutral.
 223         So, we should use ortop from now on.
 224
 225         This part of the change is for the JITs. MacroAssembler::memoryFence() appears to always
 226         mean something like an acqrel fence, so it's safe to make this use ortop. Since B3's Fence
 227         compiles to Air MemoryFence, which is just MacroAssembler::memoryFence(), this also changes
 228         B3 codegen.
 229
 230         * assembler/MacroAssemblerX86Common.h:
 231         (JSC::MacroAssemblerX86Common::memoryFence):
 232         * assembler/X86Assembler.h:
 233         (JSC::X86Assembler::lock):
 234         * b3/testb3.cpp:
 235         (JSC::B3::testX86MFence):
 236         (JSC::B3::testX86CompilerFence):
 237
 238 2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
 239
 240         test262: Function length should be number of parameters before parameters with default values
 241         https://bugs.webkit.org/show_bug.cgi?id=162377
 242
 243         Reviewed by Saam Barati.
 244
 245         https://tc39.github.io/ecma262/#sec-function-definitions-static-semantics-expectedargumentcount
 246
 247         > NOTE: The ExpectedArgumentCount of a FormalParameterList is the number of
 248         > FormalParameters to the left of either the rest parameter or the first
 249         > FormalParameter with an Initializer. A FormalParameter without an
 250         > initializer is allowed after the first parameter with an initializer
 251         > but such parameters are considered to be optional with undefined as
 252         > their default value.
 253
 254         Alongside the parameterCount value, maintain a separate count,
 255         functionLength, which will be the count before seeing a rest parameter
 256         or parameter with a default value. This will be the function's length.
 257
 258         * bytecode/UnlinkedCodeBlock.h:
 259         * bytecode/UnlinkedFunctionExecutable.cpp:
 260         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
 261         * bytecode/UnlinkedFunctionExecutable.h:
 262         * parser/ASTBuilder.h:
 263         (JSC::ASTBuilder::createFunctionMetadata):
 264         * parser/Nodes.cpp:
 265         (JSC::FunctionMetadataNode::FunctionMetadataNode):
 266         * parser/Nodes.h:
 267         * parser/Parser.cpp:
 268         (JSC::Parser<LexerType>::isArrowFunctionParameters):
 269         (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
 270         (JSC::Parser<LexerType>::parseFormalParameters):
 271         (JSC::Parser<LexerType>::parseFunctionBody):
 272         (JSC::Parser<LexerType>::parseFunctionParameters):
 273         (JSC::Parser<LexerType>::parseFunctionInfo):
 274         * parser/Parser.h:
 275         * parser/ParserFunctionInfo.h:
 276         * parser/SourceProviderCacheItem.h:
 277         (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
 278         * parser/SyntaxChecker.h:
 279         (JSC::SyntaxChecker::createFunctionMetadata):
 280         * runtime/Executable.h:
 281         * runtime/JSFunction.cpp:
 282         (JSC::JSFunction::createBuiltinFunction):
 283         (JSC::JSFunction::reifyLength):
 284
 285 2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
 286
 287         Remove a bunch of unnecessary includes
 288         https://bugs.webkit.org/show_bug.cgi?id=162376
 289
 290         Reviewed by Mark Lam.
 291
 292 2016-09-21  Keith Miller  <keith_miller@apple.com>
 293
 294         Fix build for future versions of Clang.
 295         https://bugs.webkit.org/show_bug.cgi?id=162346
 296
 297         Reviewed by Filip Pizlo.
 298
 299         This fixes issues with the WebCore build where inline
 300         template-class function definitions are marked as exported. This
 301         genereates a weak external symobl that our build does not like.
 302
 303
 304         * runtime/VM.h:
 305         (JSC::VM::setGlobalConstRedeclarationShouldThrow):
 306
 307 2016-09-21  Joseph Pecoraro  <pecoraro@apple.com>
 308
 309         Inline function only used in one place
 310         https://bugs.webkit.org/show_bug.cgi?id=162363
 311
 312         Reviewed by Saam Barati.
 313
 314         * bytecompiler/NodesCodegen.cpp:
 315         (JSC::ForInNode::emitBytecode):
 316         (JSC::ForInNode::emitMultiLoopBytecode):
 317         * parser/Nodes.h:
 318         No need for the extra function, it adds no clarification.
 319
 320 2016-09-21  Commit Queue  <commit-queue@webkit.org>
 321
 322         Unreviewed, rolling out r206222 and r206227.
 323         https://bugs.webkit.org/show_bug.cgi?id=162361
 324
 325         "broke the windows build" (Requested by keith_mi_ on #webkit).
 326
 327         Reverted changesets:
 328
 329         "Fix build for future versions of Clang."
 330         https://bugs.webkit.org/show_bug.cgi?id=162346
 331         http://trac.webkit.org/changeset/206222
 332
 333         "Attempt to fix windows build after r206222."
 334         http://trac.webkit.org/changeset/206227
 335
 336 2016-09-21  Filip Pizlo  <fpizlo@apple.com>
 337
 338         Add a Fence opcode to B3
 339         https://bugs.webkit.org/show_bug.cgi?id=162343
 340
 341         Reviewed by Geoffrey Garen.
 342
 343         This adds the most basic fence support to B3. Currently, this is optimal on x86 and correct
 344         on ARM. It also happens to be sufficient and optimal for what we'll do in the concurrent GC.
 345
 346         The idea of Fence is that it can represent any standalone fence instruction by having two
 347         additional params: a read range and a write range. If the write range is empty, this is
 348         taken to be a store-store fence, which turns into zero code on x86 and a cheaper fence on
 349         ARM.
 350
 351         It turns out that this is powerful enough to express store-load and store-store fences. For
 352         load-store and load-load fences, you wouldn't have wanted to use any code on x86 and you
 353         wouldn't have wanted a standalone barrier on ARM. For those cases, you'd want either a
 354         fenced load (load acquire) or a dependency. See bug 162349 and bug 162350, respectively.
 355
 356         This isn't yet optimized for store-store fences on ARM because we don't have the
 357         MacroAssembler support. Also, the support for "dmb ish" is not really what we want (it seems
 358         to use a heavier fence). I don't think that this is urgent because of how the concurrent GC
 359         will use this facility. I've left that to bug 162342.
 360
 361         * CMakeLists.txt:
 362         * JavaScriptCore.xcodeproj/project.pbxproj:
 363         * assembler/MacroAssemblerCodeRef.cpp:
 364         (JSC::MacroAssemblerCodeRef::tryToDisassemble):
 365         (JSC::MacroAssemblerCodeRef::disassembly):
 366         * assembler/MacroAssemblerCodeRef.h:
 367         (JSC::MacroAssemblerCodeRef::size): Deleted.
 368         (JSC::MacroAssemblerCodeRef::tryToDisassemble): Deleted.
 369         * b3/B3Compilation.h:
 370         (JSC::B3::Compilation::codeRef):
 371         (JSC::B3::Compilation::disassembly):
 372         (JSC::B3::Compilation::code): Deleted.
 373         * b3/B3Effects.h:
 374         * b3/B3FenceValue.cpp: Added.
 375         (JSC::B3::FenceValue::~FenceValue):
 376         (JSC::B3::FenceValue::cloneImpl):
 377         (JSC::B3::FenceValue::FenceValue):
 378         * b3/B3FenceValue.h: Added.
 379         * b3/B3LowerToAir.cpp:
 380         (JSC::B3::Air::LowerToAir::lower):
 381         * b3/B3Opcode.cpp:
 382         (WTF::printInternal):
 383         * b3/B3Opcode.h:
 384         * b3/B3Validate.cpp:
 385         * b3/B3Value.cpp:
 386         (JSC::B3::Value::effects):
 387         * b3/air/AirOpcode.opcodes:
 388         * b3/testb3.cpp:
 389         (JSC::B3::checkUsesInstruction):
 390         (JSC::B3::checkDoesNotUseInstruction):
 391         (JSC::B3::testX86MFence):
 392         (JSC::B3::testX86CompilerFence):
 393         (JSC::B3::run):
 394
 395 2016-09-21  Keith Miller  <keith_miller@apple.com>
 396
 397         Fix build for future versions of Clang.
 398         https://bugs.webkit.org/show_bug.cgi?id=162346
 399
 400         Reviewed by Filip Pizlo.
 401
 402         This fixes issues with the WebCore build where inline
 403         template-class function definitions are marked as exported. This
 404         genereates a weak external symobl that our build does not like.
 405
 406
 407         * runtime/VM.h:
 408         (JSC::VM::setGlobalConstRedeclarationShouldThrow):
 409
 410 2016-09-21  Chris Dumez  <cdumez@apple.com>
 411
 412         Object.getOwnPropertyDescriptor() does not work correctly cross origin
 413         https://bugs.webkit.org/show_bug.cgi?id=162311
 414
 415         Reviewed by Gavin Barraclough.
 416
 417         Add a CustomGetterSetter field to PropertySlot that gets populated
 418         by getOwnPropertySlot() and use it in getOwnPropertyDescriptor()
 419         to properly populate the descriptor. We used to rely on reifying
 420         the properties and then call getDirect() in order to get the
 421         CustomGetterSetter. However, this hack was insufficient to support
 422         the cross-origin case because we need to control more precisely
 423         the visibility of the getter and the setter. For example, Location's
 424         href property has both a getter and a setter in the same origin
 425         case but only has a setter in the cross-origin case.
 426
 427         In the future, we can extend the use of PropertySlot's
 428         customGetterSetter field to the same origin case and get rid of the
 429         reification + getDirect() hack in getOwnPropertyDescriptor().
 430
 431         * runtime/JSObject.cpp:
 432         (JSC::JSObject::getOwnPropertyDescriptor):
 433         * runtime/PropertySlot.cpp:
 434         (JSC::PropertySlot::customAccessorGetter):
 435         * runtime/PropertySlot.h:
 436
 437 2016-09-21  Michael Saboff  <msaboff@apple.com>
 438
 439         FTL needs to reserve callee stack space in bytes
 440         https://bugs.webkit.org/show_bug.cgi?id=162324
 441
 442         Reviewed by Geoffrey Garen.
 443
 444         Changed two instances where we call B3::Procedure::requestCallArgAreaSize() with the
 445         number of JSValue sized objects of stack space instead of bytes.  The correct units
 446         to use is bytes.
 447
 448         Renamed both the Air and B3 related callArgAreaSize() to callArgAreaSizeInBytes().
 449
 450         No new tests as this doesn't surface as an issue when arguments are passed on the stack.
 451
 452         * b3/B3Procedure.cpp:
 453         (JSC::B3::Procedure::callArgAreaSizeInBytes):
 454         (JSC::B3::Procedure::requestCallArgAreaSizeInBytes):
 455         (JSC::B3::Procedure::callArgAreaSize): Deleted.
 456         (JSC::B3::Procedure::requestCallArgAreaSize): Deleted.
 457         * b3/B3Procedure.h:
 458         * b3/air/AirAllocateStack.cpp:
 459         (JSC::B3::Air::allocateStack):
 460         * b3/air/AirCCallingConvention.cpp:
 461         (JSC::B3::Air::computeCCallingConvention):
 462         * b3/air/AirCode.h:
 463         (JSC::B3::Air::Code::callArgAreaSizeInBytes):
 464         (JSC::B3::Air::Code::requestCallArgAreaSizeInBytes):
 465         (JSC::B3::Air::Code::callArgAreaSize): Deleted.
 466         (JSC::B3::Air::Code::requestCallArgAreaSize): Deleted.
 467         * ftl/FTLLowerDFGToB3.cpp:
 468         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
 469         (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
 470         (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
 471
 472 2016-09-21  Csaba Osztrogonác  <ossy@webkit.org>
 473
 474         [ARM] Unreviewed buildfix after r206136.
 475
 476         * assembler/MacroAssembler.h:
 477         * assembler/MacroAssemblerARM.h:
 478         (JSC::MacroAssemblerARM::branchPtr): Added.
 479
 480 2016-09-20  Alex Christensen  <achristensen@webkit.org>
 481
 482         Require WTFMove for String::adopt
 483         https://bugs.webkit.org/show_bug.cgi?id=162313
 484
 485         Reviewed by Yusuke Suzuki.
 486
 487         * runtime/JSStringBuilder.h:
 488         (JSC::JSStringBuilder::build):
 489
 490 2016-09-20  Joseph Pecoraro  <pecoraro@apple.com>
 491
 492         REGRESSION(r205692): Minified builds have broken inspector
 493         https://bugs.webkit.org/show_bug.cgi?id=162327
 494         <rdar://problem/28370137>
 495
 496         Reviewed by Matt Baker.
 497
 498         * Scripts/cssmin.py:
 499         (cssminify):
 500         Converge on the newer cssmin that we mistakenly dropped in r205692.
 501         This knows how to handle more cases.
 502
 503 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
 504
 505         DFG::StoreBarrierInsertionPhase should assume that any epoch increment may make objects older
 506         https://bugs.webkit.org/show_bug.cgi?id=162319
 507
 508         Reviewed by Saam Barati.
 509
 510         The store barrier phase needs to be aware of the fact that an object that is not in the
 511         OldBlack state may be concurrently brought into that state. That means that:
 512
 513         - We cannot reason about the relative ages of objects. An object is either new, in which
 514           case we can store to it without barriers, or it's not in which case it needs a barrier.
 515
 516         - After we insert a barrier on an object, the object is no longer new, because now the GC
 517           knows about it and the GC may do things to it, like make it OldBlack.
 518
 519         This is a perf-neutral change. These optimizations were never particularly profitable.
 520
 521         * dfg/DFGStoreBarrierInsertionPhase.cpp:
 522
 523 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
 524
 525         Rename MarkedSpace::version/MarkedBlock::version to MarkedSpace::markingVersion/MarkedBlock::markingVersion
 526         https://bugs.webkit.org/show_bug.cgi?id=162310
 527
 528         Reviewed by Geoffrey Garen.
 529
 530         In bug 162309, which is part of my concurrent GC work, I'll need to introduce a second
 531         version-based flip. This one will be for newlyAllocated bits. This will allow me to
 532         cheaply preserve per-object live state during marking. MarkedBlock::aboutToMarkSlow() will
 533         do this instead of clearMarks():
 534
 535             - Walk the mark bits, simultaneously counting the number of set bits and clearing
 536               them.
 537             - If the count is zero, then we're done.
 538             - If the count is equal to the max number of cells in the block, then set the
 539               allocated bit for the block.
 540             - If the count is something else, create a newlyAllocated vector.
 541
 542         The hope is that the last mode is going to be rare, since most blocks are not fragmented
 543         at end of GC. Usually, we will fill them in with objects by allocating! But if we do
 544         create newlyAllocated bits then we need to have some way of blowing them away later.
 545
 546         This is where a second version comes in. We can have a version for newlyAllocated bits,
 547         which we increment at the end of marking, at around the same time that we clear all
 548         allocated bits.
 549
 550         This means that the MarkedBlock will have two different version-based flips, so terms like
 551         "flip" and "version" aren't enough.
 552
 553         This patch gets rid of the term "flip" entirely. It's a term of art in GCs that refers to
 554         the state change at the beginning or end of GC. It refers to the logical state change, not
 555         the physical one. It doesn't actually make sense to speak of a block being flipped
 556         independently of other blocks. It's true that our implementation of the flip makes some
 557         state updates happen lazily, but the block updating itself in some way (like clearing mark
 558         bits) isn't the flip - the flip already happened when the version was incremented.
 559
 560         We no longer refer to a version without qualifying what kind of version it is. The type is
 561         HeapVersion. All of the version members were renamed to markingVersion, to reflect the
 562         fact that this version is just used for doing things to marking state. Instead of asking
 563         if the block needsFlip(), we ask if areMarksStale().
 564
 565         This will let us introduce a second version for newlyAllocated, and will let us speak of
 566         the two versions unambiguously.
 567
 568         * heap/CellContainer.h:
 569         * heap/CellContainerInlines.h:
 570         (JSC::CellContainer::isMarked):
 571         (JSC::CellContainer::isMarkedOrNewlyAllocated):
 572         (JSC::CellContainer::aboutToMark):
 573         (JSC::CellContainer::areMarksStale):
 574         (JSC::CellContainer::needsFlip): Deleted.
 575         * heap/ConservativeRoots.cpp:
 576         (JSC::ConservativeRoots::genericAddPointer):
 577         (JSC::ConservativeRoots::genericAddSpan):
 578         * heap/HeapInlines.h:
 579         (JSC::Heap::isMarked):
 580         (JSC::Heap::isMarkedConcurrently):
 581         (JSC::Heap::testAndSetMarked):
 582         * heap/HeapUtil.h:
 583         (JSC::HeapUtil::findGCObjectPointersForMarking):
 584         * heap/MarkedAllocator.cpp:
 585         (JSC::MarkedAllocator::isPagedOut):
 586         * heap/MarkedBlock.cpp:
 587         (JSC::MarkedBlock::MarkedBlock):
 588         (JSC::MarkedBlock::Handle::specializedSweep):
 589         (JSC::MarkedBlock::Handle::sweepHelperSelectSweepMode):
 590         (JSC::MarkedBlock::Handle::sweepHelperSelectMarksMode):
 591         (JSC::MarkedBlock::aboutToMarkSlow):
 592         (JSC::MarkedBlock::clearMarks):
 593         (JSC::MarkedBlock::assertMarksNotStale):
 594         (JSC::MarkedBlock::areMarksStale):
 595         (JSC::MarkedBlock::Handle::areMarksStale):
 596         (JSC::MarkedBlock::isMarked):
 597         (JSC::MarkedBlock::Handle::isMarkedOrNewlyAllocated):
 598         (JSC::MarkedBlock::isMarkedOrNewlyAllocated):
 599         (JSC::MarkedBlock::markCount):
 600         (JSC::MarkedBlock::Handle::isLive):
 601         (JSC::MarkedBlock::Handle::isLiveCell):
 602         (JSC::MarkedBlock::Handle::sweepHelperSelectFlipMode): Deleted.
 603         (JSC::MarkedBlock::assertFlipped): Deleted.
 604         (JSC::MarkedBlock::needsFlip): Deleted.
 605         (JSC::MarkedBlock::Handle::needsFlip): Deleted.
 606         * heap/MarkedBlock.h:
 607         (JSC::MarkedBlock::areMarksStale):
 608         (JSC::MarkedBlock::aboutToMark):
 609         (JSC::MarkedBlock::assertMarksNotStale):
 610         (JSC::MarkedBlock::Handle::assertMarksNotStale):
 611         (JSC::MarkedBlock::isMarked):
 612         (JSC::MarkedBlock::isMarkedConcurrently):
 613         (JSC::MarkedBlock::testAndSetMarked):
 614         (JSC::MarkedBlock::Handle::isMarkedOrNewlyAllocated):
 615         (JSC::MarkedBlock::isMarkedOrNewlyAllocated):
 616         (JSC::MarkedBlock::needsFlip): Deleted.
 617         (JSC::MarkedBlock::assertFlipped): Deleted.
 618         (JSC::MarkedBlock::Handle::assertFlipped): Deleted.
 619         * heap/MarkedBlockInlines.h:
 620         (JSC::MarkedBlock::Handle::isLive):
 621         (JSC::MarkedBlock::Handle::isLiveCell):
 622         (JSC::MarkedBlock::resetMarkingVersion):
 623         (JSC::MarkedBlock::resetVersion): Deleted.
 624         * heap/MarkedSpace.cpp:
 625         (JSC::MarkedSpace::beginMarking):
 626         * heap/MarkedSpace.h:
 627         (JSC::MarkedSpace::markingVersion):
 628         (JSC::MarkedSpace::version): Deleted.
 629         * heap/SlotVisitor.cpp:
 630         (JSC::SlotVisitor::SlotVisitor):
 631         (JSC::SlotVisitor::didStartMarking):
 632         (JSC::SlotVisitor::appendJSCellOrAuxiliary):
 633         (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
 634         (JSC::SlotVisitor::markAuxiliary):
 635         * heap/SlotVisitor.h:
 636         (JSC::SlotVisitor::markingVersion):
 637         (JSC::SlotVisitor::version): Deleted.
 638         * heap/WeakBlock.cpp:
 639         (JSC::WeakBlock::specializedVisit):
 640         (JSC::WeakBlock::reap):
 641
 642 2016-09-20  Ryan Haddad  <ryanhaddad@apple.com>
 643
 644         Rebaseline builtins generator tests after r206155.
 645
 646         Unreviewed test gardening.
 647
 648         * Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result:
 649
 650 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
 651
 652         Unreviewed, fix cloop build.
 653
 654         * runtime/VM.h:
 655
 656 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
 657
 658         Make MarkedBlock state tracking support overlapped allocation and marking state
 659         https://bugs.webkit.org/show_bug.cgi?id=161581
 660
 661         Reviewed by Geoffrey Garen.
 662
 663         Concurrent GCs must allow for mutation and allocation during collection. We already know
 664         how to mutate during collection. We have a write barrier for that. Allocation during
 665         collection is more involved: the collector modifies the the mark bits, as well as other
 666         kinds of MarkedBlock state, in-place during a collection. The allocator uses that same
 667         MarkedBlock state to decide which regions of memory are free. This works if the allocator
 668         never runs while the collector is running, but if we want to allow them to run at the same
 669         time, then we need to have two versions of the state: one version built up by the
 670         collector and another consumed by the allocator. We clear the collector state at the
 671         beginning of collection, and splat the collector state onto the allocator state after
 672         collection.
 673
 674         This could be super expensive, but we can make it cheap with some cleverness. The biggest
 675         observation is just that most of the state is a handful of bits per block: is the block
 676         free-listed? is it completely full? completely empty? in the incremental sweeper's
 677         snapshot? is it retired? is it in eden? There is also state inside blocks, like the mark
 678         bits, but I have a solid plan there and I'll save it for another patch. Once we view the
 679         state of blocks as bits, we can put that state into bitvectors, so that if the collector
 680         needs to transform the state of some blocks, it can do it with a single operation over
 681         bitvectors. I like to think of this as 32-way parallelizing block operations, since
 682         doing one operation on a 32-bit word in one of those bitvectors instantly affects 32
 683         blocks.
 684
 685         This change converts all previous collections of MarkedBlocks, along with the MarkedBlock
 686         state, into 8 bitvectors (live, empty, allocated, canAllocateButNotEmpty, eden, unswept,
 687         markingNotEmpty, and markingRetired). The bitvectors separate allocator state (empty,
 688         allocated, canAllocateButNotEmpty) from marking state (markingNotEmpty, markingRetired).
 689
 690         As a nice side-effect of switching to bitvectors, we get size class rebalancing for free.
 691         It used to be that if a MarkedAllocator had an empty block, we would only allow that
 692         memory to be reused by a different MarkedAllocator if we did an incremental sweep or a
 693         full eager sweep. Now we hunt down all destructorless empty blocks before allocating new
 694         MarkedBlocks. It would be relatively easy to also hunt down destructor empty blocks, but
 695         the theory is that those might be expensive to sweep, so it might still be better to leave
 696         those to the incremental sweeper.
 697
 698         This change is perf-neutral all around. I did some tests with two different kinds of
 699         allocation strategies - something that is somewhat easier to do now that you can look for
 700         blocks that are candidates for allocation by just scanning some bitvectors. I tried two
 701         variants:
 702
 703         - Allocate out of non-empty blocks first, leaving empty blocks for last in case a
 704           different allocator needed them. This is sort of a best-fit strategy. I tried this
 705           first, and it can be expressed as:
 706
 707           m_allocationCursor = m_canAllocateButNotEmpty.findBit(m_allocationCursor, true)
 708
 709         - Allocate out of lower-indexed blocks first, treating empty and canAllocateButNotEmpty
 710           blocks equally. This is sort of a first-fit strategy. This is what I ended up settling
 711           on, and it can be expressed as:
 712
 713           m_allocationCursor = (m_canAllocateButNotEmpty | m_empty).findBit(m_allocationCursor, true)
 714
 715         The best-fit strategy meant 1% regressions in LongSpider and Octane overall, and a 11%
 716         regression on Octane/earley. First-fit means perf-neutrality. Most great allocators skew
 717         towards first-fit because it's empirically better, so this result is not surprising.
 718
 719         Overall, the performance of this patch on my machine is as follows, where "neutral" means
 720         less than 1% and not statistically significant.
 721
 722         run-jsc-benchmarks:
 723             SunSpider: neutral
 724             LongSpider: 0.6% slower
 725             V8Spider: neutral
 726             Octane: neutral
 727             Kraken: neutral
 728             Microbenchmarks: 0.37% slower
 729             AsmBench: neutral
 730             CompressionBench: maybe 1% faster
 731
 732         For browser benchmarks, I report the ratio of means (bigger / smaller) along with a T-test
 733         from Mathematica reported as % chance of not [sic] the null hypothesis. Note that we
 734         normally consider anything less than 95% confidence to be inconclusive.
 735
 736         Browser benchmarks:
 737             PLT3: 0.3% faster with 67% confidence
 738             membuster:
 739                 Snap2FinishedLoadingPost: 0.68% more memory with 50% confidence
 740                 Snap3EndPost: 2.4% more memory with 61% confidence
 741             JetStream: 0.2% slower with 32% confidence
 742             Speedometer: 0.7% faster with 82% confidence
 743
 744         Additionally, Octane/splay's heap capacity goes down to ~180KB from ~200KB, so about a 10%
 745         progression. This is due to the allocator rebalancing feature.
 746
 747         Finally, this breaks --useImmortalObjects. It was already broken as far as I can tell. I
 748         filed a bug to reimplement it (bug 162296). Unless someone urgently needs this internal
 749         tool, it's probably best to reimplement it after I'm done refactoring MarkedSpace.
 750
 751         * JavaScriptCore.xcodeproj/project.pbxproj:
 752         * debugger/Debugger.cpp:
 753         * heap/CellContainer.h:
 754         * heap/CellContainerInlines.h:
 755         (JSC::CellContainer::vm):
 756         (JSC::CellContainer::heap):
 757         (JSC::CellContainer::isMarkedOrNewlyAllocated):
 758         (JSC::CellContainer::aboutToMark):
 759         (JSC::CellContainer::isMarked): Deleted.
 760         (JSC::CellContainer::flipIfNecessary): Deleted.
 761         * heap/ConservativeRoots.cpp:
 762         * heap/Heap.cpp:
 763         (JSC::Heap::beginMarking):
 764         (JSC::Heap::endMarking):
 765         (JSC::Heap::collectAllGarbage):
 766         (JSC::Heap::collectImpl):
 767         (JSC::Heap::snapshotMarkedSpace):
 768         (JSC::Heap::prepareForAllocation):
 769         (JSC::Heap::zombifyDeadObjects):
 770         (JSC::MarkedBlockSnapshotFunctor::MarkedBlockSnapshotFunctor): Deleted.
 771         (JSC::MarkedBlockSnapshotFunctor::operator()): Deleted.
 772         (JSC::Heap::resetAllocators): Deleted.
 773         * heap/Heap.h:
 774         * heap/HeapInlines.h:
 775         (JSC::Heap::isMarked):
 776         (JSC::Heap::isMarkedConcurrently):
 777         (JSC::Heap::testAndSetMarked):
 778         * heap/HeapStatistics.cpp:
 779         * heap/HeapUtil.h:
 780         (JSC::HeapUtil::findGCObjectPointersForMarking):
 781         (JSC::HeapUtil::isPointerGCObjectJSCell):
 782         * heap/HeapVerifier.cpp:
 783         * heap/IncrementalSweeper.cpp:
 784         (JSC::IncrementalSweeper::IncrementalSweeper):
 785         (JSC::IncrementalSweeper::doSweep):
 786         (JSC::IncrementalSweeper::sweepNextBlock):
 787         (JSC::IncrementalSweeper::startSweeping):
 788         (JSC::IncrementalSweeper::willFinishSweeping):
 789         * heap/IncrementalSweeper.h:
 790         * heap/LargeAllocation.h:
 791         (JSC::LargeAllocation::isMarked):
 792         (JSC::LargeAllocation::isMarkedConcurrently):
 793         (JSC::LargeAllocation::isMarkedOrNewlyAllocated):
 794         (JSC::LargeAllocation::aboutToMark):
 795         (JSC::LargeAllocation::isMarkedDuringWeakVisiting): Deleted.
 796         (JSC::LargeAllocation::flipIfNecessary): Deleted.
 797         (JSC::LargeAllocation::flipIfNecessaryDuringMarking): Deleted.
 798         * heap/MarkedAllocator.cpp:
 799         (JSC::MarkedAllocator::MarkedAllocator):
 800         (JSC::MarkedAllocator::isPagedOut):
 801         (JSC::MarkedAllocator::findEmptyBlock):
 802         (JSC::MarkedAllocator::tryAllocateWithoutCollectingImpl):
 803         (JSC::MarkedAllocator::allocateIn):
 804         (JSC::MarkedAllocator::tryAllocateIn):
 805         (JSC::MarkedAllocator::allocateSlowCaseImpl):
 806         (JSC::MarkedAllocator::tryAllocateBlock):
 807         (JSC::MarkedAllocator::addBlock):
 808         (JSC::MarkedAllocator::removeBlock):
 809         (JSC::MarkedAllocator::stopAllocating):
 810         (JSC::MarkedAllocator::prepareForAllocation):
 811         (JSC::MarkedAllocator::lastChanceToFinalize):
 812         (JSC::MarkedAllocator::resumeAllocating):
 813         (JSC::MarkedAllocator::beginMarkingForFullCollection):
 814         (JSC::MarkedAllocator::endMarking):
 815         (JSC::MarkedAllocator::snapshotForEdenCollection):
 816         (JSC::MarkedAllocator::snapshotForFullCollection):
 817         (JSC::MarkedAllocator::findBlockToSweep):
 818         (JSC::MarkedAllocator::sweep):
 819         (JSC::MarkedAllocator::shrink):
 820         (JSC::MarkedAllocator::assertSnapshotEmpty):
 821         (JSC::MarkedAllocator::dump):
 822         (JSC::MarkedAllocator::dumpBits):
 823         (JSC::MarkedAllocator::retire): Deleted.
 824         (JSC::MarkedAllocator::filterNextBlock): Deleted.
 825         (JSC::MarkedAllocator::setNextBlockToSweep): Deleted.
 826         (JSC::MarkedAllocator::reset): Deleted.
 827         * heap/MarkedAllocator.h:
 828         (JSC::MarkedAllocator::forEachBitVector):
 829         (JSC::MarkedAllocator::forEachBitVectorWithName):
 830         (JSC::MarkedAllocator::nextAllocator):
 831         (JSC::MarkedAllocator::setNextAllocator):
 832         (JSC::MarkedAllocator::forEachBlock):
 833         (JSC::MarkedAllocator::resumeAllocating): Deleted.
 834         * heap/MarkedBlock.cpp:
 835         (JSC::MarkedBlock::tryCreate):
 836         (JSC::MarkedBlock::Handle::Handle):
 837         (JSC::MarkedBlock::Handle::~Handle):
 838         (JSC::MarkedBlock::MarkedBlock):
 839         (JSC::MarkedBlock::Handle::specializedSweep):
 840         (JSC::MarkedBlock::Handle::sweep):
 841         (JSC::MarkedBlock::Handle::sweepHelperSelectScribbleMode):
 842         (JSC::MarkedBlock::Handle::sweepHelperSelectEmptyMode):
 843         (JSC::MarkedBlock::Handle::sweepHelperSelectHasNewlyAllocated):
 844         (JSC::MarkedBlock::Handle::sweepHelperSelectSweepMode):
 845         (JSC::MarkedBlock::Handle::sweepHelperSelectFlipMode):
 846         (JSC::MarkedBlock::Handle::unsweepWithNoNewlyAllocated):
 847         (JSC::MarkedBlock::Handle::setIsFreeListed):
 848         (JSC::MarkedBlock::Handle::stopAllocating):
 849         (JSC::MarkedBlock::Handle::lastChanceToFinalize):
 850         (JSC::MarkedBlock::Handle::resumeAllocating):
 851         (JSC::MarkedBlock::aboutToMarkSlow):
 852         (JSC::MarkedBlock::clearMarks):
 853         (JSC::MarkedBlock::isMarked):
 854         (JSC::MarkedBlock::Handle::isMarkedOrNewlyAllocated):
 855         (JSC::MarkedBlock::isMarkedOrNewlyAllocated):
 856         (JSC::MarkedBlock::Handle::didConsumeFreeList):
 857         (JSC::MarkedBlock::markCount):
 858         (JSC::MarkedBlock::Handle::isEmpty):
 859         (JSC::MarkedBlock::noteMarkedSlow):
 860         (JSC::MarkedBlock::Handle::removeFromAllocator):
 861         (JSC::MarkedBlock::Handle::didAddToAllocator):
 862         (JSC::MarkedBlock::Handle::didRemoveFromAllocator):
 863         (JSC::MarkedBlock::Handle::isLive):
 864         (JSC::MarkedBlock::Handle::isLiveCell):
 865         (JSC::MarkedBlock::Handle::sweepHelperSelectStateAndSweepMode): Deleted.
 866         (JSC::MarkedBlock::flipIfNecessary): Deleted.
 867         (JSC::MarkedBlock::Handle::flipIfNecessary): Deleted.
 868         (JSC::MarkedBlock::flipIfNecessarySlow): Deleted.
 869         (JSC::MarkedBlock::flipIfNecessaryDuringMarkingSlow): Deleted.
 870         (JSC::MarkedBlock::Handle::willRemoveBlock): Deleted.
 871         (WTF::printInternal): Deleted.
 872         * heap/MarkedBlock.h:
 873         (JSC::MarkedBlock::Handle::isFreeListed):
 874         (JSC::MarkedBlock::Handle::index):
 875         (JSC::MarkedBlock::aboutToMark):
 876         (JSC::MarkedBlock::isMarked):
 877         (JSC::MarkedBlock::isMarkedConcurrently):
 878         (JSC::MarkedBlock::Handle::isMarkedOrNewlyAllocated):
 879         (JSC::MarkedBlock::isMarkedOrNewlyAllocated):
 880         (JSC::MarkedBlock::Handle::isOnBlocksToSweep): Deleted.
 881         (JSC::MarkedBlock::Handle::setIsOnBlocksToSweep): Deleted.
 882         (JSC::MarkedBlock::Handle::state): Deleted.
 883         (JSC::MarkedBlock::flipIfNecessary): Deleted.
 884         (JSC::MarkedBlock::flipIfNecessaryDuringMarking): Deleted.
 885         (JSC::MarkedBlock::Handle::flipIfNecessary): Deleted.
 886         (JSC::MarkedBlock::Handle::flipIfNecessaryDuringMarking): Deleted.
 887         (JSC::MarkedBlock::Handle::flipForEdenCollection): Deleted.
 888         (JSC::MarkedBlock::isMarkedDuringWeakVisiting): Deleted.
 889         (JSC::MarkedBlock::Handle::isLive): Deleted.
 890         (JSC::MarkedBlock::Handle::isLiveCell): Deleted.
 891         (JSC::MarkedBlock::Handle::forEachLiveCell): Deleted.
 892         (JSC::MarkedBlock::Handle::forEachDeadCell): Deleted.
 893         (JSC::MarkedBlock::Handle::needsSweeping): Deleted.
 894         (JSC::MarkedBlock::Handle::isAllocated): Deleted.
 895         (JSC::MarkedBlock::Handle::isMarked): Deleted.
 896         * heap/MarkedBlockInlines.h: Added.
 897         (JSC::MarkedBlock::Handle::isLive):
 898         (JSC::MarkedBlock::Handle::isLiveCell):
 899         (JSC::MarkedBlock::Handle::forEachLiveCell):
 900         (JSC::MarkedBlock::Handle::forEachDeadCell):
 901         (JSC::MarkedBlock::resetVersion):
 902         * heap/MarkedSpace.cpp:
 903         (JSC::MarkedSpace::MarkedSpace):
 904         (JSC::MarkedSpace::allocate):
 905         (JSC::MarkedSpace::tryAllocate):
 906         (JSC::MarkedSpace::sweep):
 907         (JSC::MarkedSpace::prepareForAllocation):
 908         (JSC::MarkedSpace::shrink):
 909         (JSC::MarkedSpace::clearNewlyAllocated):
 910         (JSC::MarkedSpace::beginMarking):
 911         (JSC::MarkedSpace::endMarking):
 912         (JSC::MarkedSpace::didAllocateInBlock):
 913         (JSC::MarkedSpace::findEmptyBlock):
 914         (JSC::MarkedSpace::snapshot):
 915         (JSC::MarkedSpace::assertSnapshotEmpty):
 916         (JSC::MarkedSpace::dumpBits):
 917         (JSC::MarkedSpace::zombifySweep): Deleted.
 918         (JSC::MarkedSpace::resetAllocators): Deleted.
 919         (JSC::VerifyMarked::operator()): Deleted.
 920         (JSC::MarkedSpace::flip): Deleted.
 921         * heap/MarkedSpace.h:
 922         (JSC::MarkedSpace::nextVersion):
 923         (JSC::MarkedSpace::firstAllocator):
 924         (JSC::MarkedSpace::allocatorForEmptyAllocation):
 925         (JSC::MarkedSpace::forEachAllocator):
 926         (JSC::MarkedSpace::blocksWithNewObjects): Deleted.
 927         (JSC::MarkedSpace::setIsMarking): Deleted.
 928         (JSC::MarkedSpace::forEachLiveCell): Deleted.
 929         (JSC::MarkedSpace::forEachDeadCell): Deleted.
 930         * heap/MarkedSpaceInlines.h: Added.
 931         (JSC::MarkedSpace::forEachLiveCell):
 932         (JSC::MarkedSpace::forEachDeadCell):
 933         * heap/SlotVisitor.cpp:
 934         (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
 935         (JSC::SlotVisitor::markAuxiliary):
 936         (JSC::SlotVisitor::visitChildren):
 937         * heap/Weak.h:
 938         (WTF::HashTraits<JSC::Weak<T>>::emptyValue):
 939         (WTF::HashTraits<JSC::Weak<T>>::peek):
 940         * heap/WeakBlock.cpp:
 941         (JSC::WeakBlock::specializedVisit):
 942         (JSC::WeakBlock::reap):
 943         * heap/WeakInlines.h:
 944         (WTF::HashTraits<JSC::Weak<T>>::emptyValue): Deleted.
 945         (WTF::HashTraits<JSC::Weak<T>>::peek): Deleted.
 946         * jit/JITThunks.h:
 947         * runtime/JSGlobalObject.cpp:
 948         * runtime/PrototypeMap.h:
 949         * runtime/SamplingProfiler.cpp:
 950         * runtime/WeakGCMap.h:
 951         * tools/JSDollarVMPrototype.cpp:
 952
 953 2016-09-20  Jonathan Bedard  <jbedard@apple.com>
 954
 955         Undefined behavior: Left shift negative number
 956         https://bugs.webkit.org/show_bug.cgi?id=161866
 957
 958         Reviewed by Keith Miller.
 959
 960         Left shifting a negative number is undefined behavior in C/C++, although most implementations do define it. Explicitly clarifying the intended behavior due to shifting negative number in some cases.
 961
 962         * dfg/DFGAbstractHeap.h:
 963         (JSC::DFG::AbstractHeap::encode): Explicitly cast signed integer for left shift.
 964
 965 2016-09-20  Saam Barati  <sbarati@apple.com>
 966
 967         Unreviewed fix for 32-bit DFG x86 implementation of HasOwnProperty.
 968
 969         Fixup phase is always setting ObjectUse on child1() of HasOwnProperty.
 970         However, on x86 32-bit, I omitted a call to speculateObject() on child1().
 971
 972         * dfg/DFGSpeculativeJIT32_64.cpp:
 973         (JSC::DFG::SpeculativeJIT::compile):
 974
 975 2016-09-20  Yusuke Suzuki  <utatane.tea@gmail.com>
 976
 977         [JSC] Add `typeof value === "symbol"` handling to bytecode compiler
 978         https://bugs.webkit.org/show_bug.cgi?id=162253
 979
 980         Reviewed by Sam Weinig.
 981
 982         Add `typeof value === "symbol"` handling to the bytecode compiler.
 983         The effect is tiny, but it keeps consistency since the bytecode compiler
 984         already has the similar optimization for "string" case.
 985
 986         * bytecode/SpeculatedType.cpp:
 987         (JSC::speculationFromJSType):
 988         * bytecompiler/BytecodeGenerator.cpp:
 989         (JSC::BytecodeGenerator::emitEqualityOp):
 990
 991 2016-09-19  Saam Barati  <sbarati@apple.com>
 992
 993         Make HasOwnProperty faster
 994         https://bugs.webkit.org/show_bug.cgi?id=161708
 995
 996         Reviewed by Geoffrey Garen.
 997
 998         This patch adds a cache for HasOwnProperty. The cache holds tuples
 999         of {StructureID, UniquedStringImpl*, boolean} where the boolean indicates
1000         the result of performing hasOwnProperty on an object with StructureID and
1001         UniquedStringImpl*. If the cache contains an item, we can be guaranteed
1002         that it contains the same result as performing hasOwnProperty on an
1003         object O with a given structure and key. To guarantee this, we only add
1004         items into the cache when the Structure of the given item is cacheable.
1005
1006         The caching strategy is simple: when adding new items into the cache,
1007         we will evict any item that was in the location that the new item
1008         is hashed into. We also clear the cache on every GC. This strategy
1009         proves to be successful on speedometer, which sees a cache hit rate
1010         over 90%. This caching strategy is now inlined into the DFG/FTL JITs
1011         by now recognizing hasOwnProperty as an intrinsic with the corresponding
1012         HasOwnProperty node. The goal of the node is to emit inlined code for
1013         the cache lookup to prevent the overhead of the call for the common
1014         case where we get a cache hit.
1015
1016         I'm seeing around a 1% to 1.5% percent improvement on Speedometer on
1017         my machine. Hopefully the perf bots agree with my machine.
1018
1019         This patch also speeds up the microbenchmark I added by 2.5x.
1020
1021         * JavaScriptCore.xcodeproj/project.pbxproj:
1022         * dfg/DFGAbstractInterpreterInlines.h:
1023         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1024         * dfg/DFGByteCodeParser.cpp:
1025         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
1026         * dfg/DFGClobberize.h:
1027         (JSC::DFG::clobberize):
1028         * dfg/DFGDoesGC.cpp:
1029         (JSC::DFG::doesGC):
1030         * dfg/DFGFixupPhase.cpp:
1031         (JSC::DFG::FixupPhase::fixupNode):
1032         * dfg/DFGNodeType.h:
1033         * dfg/DFGOperations.cpp:
1034         * dfg/DFGOperations.h:
1035         * dfg/DFGPredictionPropagationPhase.cpp:
1036         * dfg/DFGSafeToExecute.h:
1037         (JSC::DFG::safeToExecute):
1038         * dfg/DFGSpeculativeJIT.h:
1039         (JSC::DFG::SpeculativeJIT::callOperation):
1040         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
1041         * dfg/DFGSpeculativeJIT32_64.cpp:
1042         (JSC::DFG::SpeculativeJIT::compile):
1043         * dfg/DFGSpeculativeJIT64.cpp:
1044         (JSC::DFG::SpeculativeJIT::compile):
1045         * dfg/DFGValidate.cpp:
1046         * ftl/FTLAbstractHeapRepository.h:
1047         * ftl/FTLCapabilities.cpp:
1048         (JSC::FTL::canCompile):
1049         * ftl/FTLLowerDFGToB3.cpp:
1050         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1051         (JSC::FTL::DFG::LowerDFGToB3::compileHasOwnProperty):
1052         * heap/Heap.cpp:
1053         (JSC::Heap::collectImpl):
1054         * jit/JITOperations.h:
1055         * runtime/HasOwnPropertyCache.h: Added.
1056         (JSC::HasOwnPropertyCache::Entry::offsetOfStructureID):
1057         (JSC::HasOwnPropertyCache::Entry::offsetOfImpl):
1058         (JSC::HasOwnPropertyCache::Entry::offsetOfResult):
1059         (JSC::HasOwnPropertyCache::operator delete):
1060         (JSC::HasOwnPropertyCache::create):
1061         (JSC::HasOwnPropertyCache::hash):
1062         (JSC::HasOwnPropertyCache::get):
1063         (JSC::HasOwnPropertyCache::tryAdd):
1064         (JSC::HasOwnPropertyCache::clear):
1065         (JSC::VM::ensureHasOwnPropertyCache):
1066         * runtime/Intrinsic.h:
1067         * runtime/JSObject.h:
1068         * runtime/JSObjectInlines.h:
1069         (JSC::JSObject::hasOwnProperty):
1070         * runtime/ObjectPrototype.cpp:
1071         (JSC::ObjectPrototype::finishCreation):
1072         (JSC::objectProtoFuncHasOwnProperty):
1073         * runtime/Symbol.h:
1074         * runtime/VM.cpp:
1075         * runtime/VM.h:
1076         (JSC::VM::hasOwnPropertyCache):
1077
1078 2016-09-19  Benjamin Poulain  <bpoulain@apple.com>
1079
1080         [JSC] Make the rounding-related nodes support any type
1081         https://bugs.webkit.org/show_bug.cgi?id=161895
1082
1083         Reviewed by Geoffrey Garen.
1084
1085         This patch changes ArithRound, ArithFloor, ArithCeil and ArithTrunc
1086         to support polymorphic input without exiting on entry.
1087
1088         * dfg/DFGAbstractInterpreterInlines.h:
1089         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1090         * dfg/DFGByteCodeParser.cpp:
1091         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
1092         The 4 functions ignore any input past the first argument. It is okay
1093         to use the nodes with the first argument and let the Phantoms keep
1094         the remaining arguments live.
1095
1096         * dfg/DFGClobberize.h:
1097         (JSC::DFG::clobberize):
1098         * dfg/DFGFixupPhase.cpp:
1099         (JSC::DFG::FixupPhase::fixupNode):
1100         Our fixup had the issue we have seen on previous nodes: unaryArithShouldSpeculateInt32()
1101         prevents us from picking a good type if we do not see any double.
1102
1103         * dfg/DFGNodeType.h:
1104         * dfg/DFGOperations.cpp:
1105         * dfg/DFGOperations.h:
1106         * dfg/DFGPredictionPropagationPhase.cpp:
1107         Prediction propagation of those nodes are fully determined
1108         from their flags and results's prediction. They are moved
1109         to the invariant processing.
1110
1111         * dfg/DFGSpeculativeJIT.cpp:
1112         (JSC::DFG::SpeculativeJIT::compileArithRounding):
1113         * ftl/FTLLowerDFGToB3.cpp:
1114         (JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
1115         (JSC::FTL::DFG::LowerDFGToB3::compileArithFloor):
1116         (JSC::FTL::DFG::LowerDFGToB3::compileArithCeil):
1117         (JSC::FTL::DFG::LowerDFGToB3::compileArithTrunc):
1118
1119 2016-09-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1120
1121         Unreviewed, build fix for Win64
1122         https://bugs.webkit.org/show_bug.cgi?id=162132
1123
1124         In Windows 64bit, t3 register in LLInt is not r[a-d]x.
1125         It means that this cannot be used for byte operation.
1126
1127         * llint/LowLevelInterpreter64.asm:
1128
1129 2016-09-19  Daniel Bates  <dabates@apple.com>
1130
1131         Remove ENABLE(TEXT_AUTOSIZING) automatic text size adjustment code
1132         https://bugs.webkit.org/show_bug.cgi?id=162167
1133
1134         Reviewed by Simon Fraser.
1135
1136         * Configurations/FeatureDefines.xcconfig:
1137
1138 2016-09-19  Keith Miller  <keith_miller@apple.com>
1139
1140         Update WASM towards 0xc
1141         https://bugs.webkit.org/show_bug.cgi?id=162067
1142
1143         Reviewed by Geoffrey Garen.
1144
1145         This patch updates some of the core parts of the WASM frontend to the 0xc standard.
1146         First, it changes the section names from strings to bytecodes. It also adds support
1147         for inline block signatures. This is a change from the old version that used to have
1148         each branch indicate the arity. Finally, this patch updates all the tests and deletes
1149         a duplicate test.
1150
1151         * CMakeLists.txt:
1152         * JavaScriptCore.xcodeproj/project.pbxproj:
1153         * testWASM.cpp:
1154         (runWASMTests):
1155         * wasm/WASMB3IRGenerator.cpp:
1156         * wasm/WASMFormat.h:
1157         * wasm/WASMFunctionParser.h:
1158         (JSC::WASM::FunctionParser<Context>::FunctionParser):
1159         (JSC::WASM::FunctionParser<Context>::parseBlock):
1160         (JSC::WASM::FunctionParser<Context>::parseExpression):
1161         * wasm/WASMModuleParser.cpp:
1162         (JSC::WASM::ModuleParser::parse):
1163         * wasm/WASMSections.cpp: Removed.
1164         (JSC::WASM::Sections::lookup): Deleted.
1165         * wasm/WASMSections.h:
1166         (JSC::WASM::Sections::validateOrder):
1167
1168 2016-09-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1169
1170         [JSC] Use is_cell_with_type for @isRegExpObject, @isMap, and @isSet
1171         https://bugs.webkit.org/show_bug.cgi?id=162142
1172
1173         Reviewed by Michael Saboff.
1174
1175         Use is_cell_with_type for @isRegExpObject, @isMap and @isSet.
1176         Previously, they were implemented as functions and only @isRegExpObject was handled in the DFG and FTL.
1177         The recently added op_is_cell_with_type bytecode and DFG IsCellWithType node allows us to simplify the above checks in all JIT tiers.
1178         Changed these checks to bytecode intrinsics using op_is_cell_with_type.
1179
1180         * builtins/BuiltinNames.h:
1181         * bytecode/BytecodeIntrinsicRegistry.h:
1182         * bytecode/SpeculatedType.cpp:
1183         (JSC::speculationFromJSType):
1184         * bytecompiler/BytecodeGenerator.h:
1185         (JSC::BytecodeGenerator::emitIsRegExpObject):
1186         (JSC::BytecodeGenerator::emitIsMap):
1187         (JSC::BytecodeGenerator::emitIsSet):
1188         (JSC::BytecodeGenerator::emitIsProxyObject): Deleted.
1189         * bytecompiler/NodesCodegen.cpp:
1190         (JSC::BytecodeIntrinsicNode::emit_intrinsic_isRegExpObject):
1191         (JSC::BytecodeIntrinsicNode::emit_intrinsic_isMap):
1192         (JSC::BytecodeIntrinsicNode::emit_intrinsic_isSet):
1193         * dfg/DFGByteCodeParser.cpp:
1194         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
1195         * runtime/ECMAScriptSpecInternalFunctions.cpp:
1196         (JSC::esSpecIsRegExpObject): Deleted.
1197         * runtime/ECMAScriptSpecInternalFunctions.h:
1198         * runtime/Intrinsic.h:
1199         * runtime/JSGlobalObject.cpp:
1200         (JSC::JSGlobalObject::init):
1201         * runtime/MapPrototype.cpp:
1202         (JSC::privateFuncIsMap): Deleted.
1203         * runtime/MapPrototype.h:
1204         * runtime/SetPrototype.cpp:
1205         (JSC::privateFuncIsSet): Deleted.
1206         * runtime/SetPrototype.h:
1207
1208 2016-09-19  Brian Burg  <bburg@apple.com>
1209
1210         Web Replay: teach the replay inputs generator to encode and decode OptionSet<T>
1211         https://bugs.webkit.org/show_bug.cgi?id=162107
1212
1213         Reviewed by Anders Carlsson.
1214
1215         Add a new type flag OPTION_SET. This means that the type is a typechecked enum class
1216         declaration, but it's stored in an OptionSet object and can contain multiple
1217         distinct enumeration values like an untyped enum declaration.
1218
1219         Do some cleanup since the generator now supports three different enumerable types:
1220         'enum', 'enum class', and 'OptionSet<T>' where T is an enum class.
1221
1222         Also clean up some sloppy variable names. Using an 'enum_' prefix is really confusing now.
1223
1224         * replay/scripts/CodeGeneratorReplayInputs.py:
1225         (Type.is_enum_declaration):
1226         (Type.is_enum_class_declaration):
1227         (Type.is_option_set):
1228         (Type):
1229         (Type.is_enumerable):
1230         When we want all enumerable types, this property includes all three variants.
1231
1232         (Type.declaration_kind): Forward-declare OptionSet's type parameter as an enum class.
1233         (VectorType.is_enum_declaration): Renamed from is_enum().
1234         (VectorType.is_enum_class_declaration): Renamed from is_enum_class().
1235         (VectorType.is_option_set): Added.
1236         (InputsModel.enumerable_types): Added.
1237         (InputsModel.parse_type_with_framework):
1238         (Generator.generate_header):
1239         (Generator.generate_implementation):
1240         (Generator.generate_includes):
1241         (Generator.generate_type_forward_declarations):
1242         (Generator.generate_enumerable_type_trait_declaration):
1243         (Generator.generate_enum_trait_declaration): Renamed.
1244         (Generator.generate_enum_trait_implementation): Renamed.
1245
1246         * replay/scripts/CodeGeneratorReplayInputsTemplates.py:
1247         Add new templates for OptionSet types. Clean up parameter names and simplify the
1248         enumerable type declaration template, which is the same for all enumerable type variants.
1249
1250         * replay/scripts/tests/expected/fail-on-c-style-enum-no-storage.json-error:
1251         * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.cpp:
1252         (JSC::EncodingTraits<Test::PlatformEvent::OtherType>::encodeValue):
1253         (JSC::EncodingTraits<Test::PlatformEvent::OtherType>::decodeValue):
1254         * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.h:
1255         * replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.h:
1256         Rebaseline test results.
1257
1258         * replay/scripts/tests/generate-enum-encoding-helpers.json:
1259         Add a new type for OptionSet<PlatformEvent::Modifier> to capture generated encode/decode methods.
1260
1261 2016-09-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1262
1263         [JSC][LLInt] Introduce is_cell_with_type
1264         https://bugs.webkit.org/show_bug.cgi?id=162132
1265
1266         Reviewed by Sam Weinig.
1267
1268         In this patch, we introduce is_cell_with_type bytecode. This bytecode can unify the following predicates,
1269         op_is_string, op_is_jsarray, op_is_proxy_object, and op_is_derived_array!
1270         And we now drop DFG node IsString since we can use IsCellWithType instead.
1271         This automatically offers optimization to previous IsString node: dropping cell check by using CellUse edge filter.
1272
1273         Later, we are planning to use this is_cell_with_type to optimize @isRegExpObject, @isSet, and @isMap[1].
1274
1275         The performance results are neutral.
1276
1277         [1]: https://bugs.webkit.org/show_bug.cgi?id=162142
1278
1279         * bytecode/BytecodeList.json:
1280         * bytecode/BytecodeUseDef.h:
1281         (JSC::computeUsesForBytecodeOffset):
1282         (JSC::computeDefsForBytecodeOffset):
1283         * bytecode/CodeBlock.cpp:
1284         (JSC::CodeBlock::dumpBytecode):
1285         * bytecode/SpeculatedType.cpp:
1286         (JSC::speculationFromJSType):
1287         * bytecode/SpeculatedType.h:
1288         * bytecompiler/BytecodeGenerator.cpp:
1289         (JSC::BytecodeGenerator::emitEqualityOp):
1290         (JSC::BytecodeGenerator::emitIsCellWithType):
1291         * bytecompiler/BytecodeGenerator.h:
1292         (JSC::BytecodeGenerator::emitIsJSArray):
1293         (JSC::BytecodeGenerator::emitIsProxyObject):
1294         (JSC::BytecodeGenerator::emitIsDerivedArray):
1295         * dfg/DFGAbstractInterpreterInlines.h:
1296         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1297         * dfg/DFGByteCodeParser.cpp:
1298         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
1299         (JSC::DFG::ByteCodeParser::parseBlock):
1300         * dfg/DFGCapabilities.cpp:
1301         (JSC::DFG::capabilityLevel):
1302         * dfg/DFGClobberize.h:
1303         (JSC::DFG::clobberize):
1304         * dfg/DFGDoesGC.cpp:
1305         (JSC::DFG::doesGC):
1306         * dfg/DFGFixupPhase.cpp:
1307         (JSC::DFG::FixupPhase::fixupNode):
1308         (JSC::DFG::FixupPhase::fixupIsCellWithType):
1309         * dfg/DFGNode.h:
1310         (JSC::DFG::Node::speculatedTypeForQuery):
1311         * dfg/DFGNodeType.h:
1312         * dfg/DFGPredictionPropagationPhase.cpp:
1313         * dfg/DFGSafeToExecute.h:
1314         (JSC::DFG::safeToExecute):
1315         * dfg/DFGSpeculativeJIT32_64.cpp:
1316         (JSC::DFG::SpeculativeJIT::compile):
1317         * dfg/DFGSpeculativeJIT64.cpp:
1318         (JSC::DFG::SpeculativeJIT::compile):
1319         * ftl/FTLCapabilities.cpp:
1320         (JSC::FTL::canCompile):
1321         * ftl/FTLLowerDFGToB3.cpp:
1322         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1323         (JSC::FTL::DFG::LowerDFGToB3::compileIsString): Deleted.
1324         * jit/JIT.cpp:
1325         (JSC::JIT::privateCompileMainPass):
1326         * jit/JIT.h:
1327         * jit/JITOpcodes.cpp:
1328         (JSC::JIT::emit_op_is_cell_with_type):
1329         (JSC::JIT::emitIsCellWithType): Deleted.
1330         (JSC::JIT::emit_op_is_string): Deleted.
1331         (JSC::JIT::emit_op_is_jsarray): Deleted.
1332         (JSC::JIT::emit_op_is_proxy_object): Deleted.
1333         (JSC::JIT::emit_op_is_derived_array): Deleted.
1334         * jit/JITOpcodes32_64.cpp:
1335         (JSC::JIT::emit_op_is_cell_with_type):
1336         (JSC::JIT::emitIsCellWithType): Deleted.
1337         (JSC::JIT::emit_op_is_string): Deleted.
1338         (JSC::JIT::emit_op_is_jsarray): Deleted.
1339         (JSC::JIT::emit_op_is_proxy_object): Deleted.
1340         (JSC::JIT::emit_op_is_derived_array): Deleted.
1341         * llint/LLIntData.cpp:
1342         (JSC::LLInt::Data::performAssertions):
1343         * llint/LowLevelInterpreter32_64.asm:
1344         * llint/LowLevelInterpreter64.asm:
1345
1346 2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1347
1348         [JSC] Assert length of LLInt opcodes using isCellWithType is 3
1349         https://bugs.webkit.org/show_bug.cgi?id=162134
1350
1351         Reviewed by Saam Barati.
1352
1353         * llint/LLIntData.cpp:
1354         (JSC::LLInt::Data::performAssertions):
1355
1356 2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1357
1358         [JSC] Do not need to use defineProperty to define methods for object literals
1359         https://bugs.webkit.org/show_bug.cgi?id=162111
1360
1361         Reviewed by Saam Barati.
1362
1363         When we receive the following code,
1364
1365             var object = { method() { } };
1366
1367         currently, we use defineProperty to define "method" function for "object".
1368         This patch replaces it with the ordinary put_by_id_direct / put_by_val_direct
1369         because the following 2 conditions are met.
1370
1371         1. While methods in classes have special attributes ({configurable: true, writable: true, enumerable: false}),
1372            the attributes of methods in object literals is just the same to the other normal properties ({configurable: true, writable: true, enumerable: true}).
1373            This means that we can use the usual put_by_id_direct / put_by_val_direct to define method properties for object literals.
1374
1375         2. Furthermore, all the own properties that can reside in objects created by object literals have {configurable: true}.
1376            So there is no need to check conflict by defineProperty. Always overwriting is OK.
1377
1378                 let name = 'method';
1379                 var object = { get [name]() { }, method() { } };
1380                 // Latter method wins.
1381
1382             On the other hand, in class syntax, conflict check is necessary since "prototype" own property is defined as {configurable: false}.
1383
1384                 class Hello { static prototype() { } }  // Should throw error by defineProperty's check.
1385
1386             This means that conflict check done in defneProperty is not necessary for object literals' properties.
1387
1388         * bytecompiler/NodesCodegen.cpp:
1389         (JSC::PropertyListNode::emitPutConstantProperty):
1390
1391 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1392
1393         [DFG] Introduce IsCellWithType node and unify IsJSArray, IsRegExpObject and newly added IsProxyObject
1394         https://bugs.webkit.org/show_bug.cgi?id=162000
1395
1396         Reviewed by Filip Pizlo.
1397
1398         Sampling profiler tells that ES6SampleBench/Basic frequently calls Array.isArray(). This function is introduced in
1399         ES5 and it is well-used to distinguish Array from the other objects. Moreover, this function is used in Array.prototype.xxx
1400         methods as @isArray. So it's worth optimizing.
1401
1402         The difference between Array.isArray and @isJSArray is that Array.isArray need to consider about ProxyObject while
1403         @isJSArray builtin intrinsic does not. So in this patch, we leverage the existing @isJSArray to implement Array.isArray.
1404         Array.isArray is written in builtin JS code using @isJSArray and newly added @isProxyObject(). That allow us to inline
1405         Array.isArray() code and the inlined code uses existing DFG nodes well.
1406
1407         Another problem is RuntimeArray and ArrayPrototype. They inherit JSArray and their JSType is ObjectType. But Array.isArray need
1408         to return true for those types. While optimizing type checking in generic way by type display is nice, RuntimeArray and
1409         ArrayPrototype are a bit tricky and it is super rare that these functions are passed to Array.isArray(). So instead of introducing
1410         type display in this patch, we just introduce a new JSType, DerivedArrayType and use it in the above 2 use classes. Since
1411         Array.isArray is specially handled in the spec (while we don't have any Date.isDate() like functions, only Array.isArray
1412         is specified in the spec because we frequently want to distinguish Arrays from other Objects), optimizing Array.isArray specially
1413         by introducing special DerivedArrayType is reasonable.
1414
1415         In LLInt level, we add a new opcode, op_is_proxy_object and op_is_derived_array. This works similar to op_is_jsarray.
1416         And we also perform LLInt code cleanup by introducing a macro isCellWithType.
1417
1418         In baseline, we perform some clean up for op_is_proxy_object etc. Now duplicate code is reduced.
1419
1420         In DFG, we unify IsJSArray, IsRegExpObject, IsProxyObject, and IsDerivedArray into one IsCellWithType node. And we clean up
1421         some AI code related to IsJSArray and IsRegExpObject since SpeculatedType now recognizes ProxyObject. IsJSArray and IsRegExpObject
1422         does not do anything special for proxy objects.
1423
1424         The above change simplify things to create a new IsXXX DFG handling and paves the way for optimizing @isMap & @isSet in DFG.
1425         Furthermore, introducing @isProxyObject() is nice for the first step to optimize ProxyObject handling.
1426
1427         Here is microbenchmark result. We can see stable performance improvement (Even if we use Proxies!).
1428
1429                                                     baseline                  patched
1430
1431             is-array-for-array                   2.5156+-0.0288     ^      2.0668+-0.0285        ^ definitely 1.2171x faster
1432             is-array-for-mixed-case              4.7787+-0.0755     ^      4.4722+-0.0789        ^ definitely 1.0686x faster
1433             is-array-for-non-array-object        2.3596+-0.0368     ^      1.8178+-0.0262        ^ definitely 1.2980x faster
1434             is-array-for-proxy                   4.0469+-0.0437     ^      3.3845+-0.0404        ^ definitely 1.1957x faster
1435
1436         And ES6SampleBench/Basic reports 5.2% perf improvement. And now sampling result in ES6SampleBench/Basic does not pose Array.isArray.
1437
1438             Benchmark             First Iteration        Worst 2%               Steady State
1439             baseline:Basic        28.59 ms +- 1.03 ms    15.08 ms +- 0.28 ms    1656.96 ms +- 18.02 ms
1440             patched:Basic         27.82 ms +- 0.44 ms    14.59 ms +- 0.16 ms    1574.65 ms +- 8.44 ms
1441
1442         * builtins/ArrayConstructor.js:
1443         (isArray):
1444         (from): Deleted.
1445         * builtins/BuiltinNames.h:
1446         * bytecode/BytecodeIntrinsicRegistry.h:
1447         * bytecode/BytecodeList.json:
1448         * bytecode/BytecodeUseDef.h:
1449         (JSC::computeUsesForBytecodeOffset):
1450         (JSC::computeDefsForBytecodeOffset):
1451         * bytecode/CodeBlock.cpp:
1452         (JSC::CodeBlock::dumpBytecode):
1453         * bytecode/SpeculatedType.cpp:
1454         (JSC::dumpSpeculation):
1455         (JSC::speculationFromClassInfo):
1456         (JSC::speculationFromStructure):
1457         * bytecode/SpeculatedType.h:
1458         (JSC::isProxyObjectSpeculation):
1459         (JSC::isDerivedArraySpeculation):
1460         * bytecompiler/BytecodeGenerator.h:
1461         (JSC::BytecodeGenerator::emitIsProxyObject):
1462         (JSC::BytecodeGenerator::emitIsDerivedArray):
1463         (JSC::BytecodeGenerator::emitIsJSArray): Deleted.
1464         * bytecompiler/NodesCodegen.cpp:
1465         (JSC::BytecodeIntrinsicNode::emit_intrinsic_isProxyObject):
1466         (JSC::BytecodeIntrinsicNode::emit_intrinsic_isDerivedArray):
1467         * dfg/DFGAbstractInterpreterInlines.h:
1468         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1469         * dfg/DFGByteCodeParser.cpp:
1470         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
1471         (JSC::DFG::ByteCodeParser::parseBlock):
1472         * dfg/DFGCapabilities.cpp:
1473         (JSC::DFG::capabilityLevel):
1474         * dfg/DFGClobberize.h:
1475         (JSC::DFG::clobberize):
1476         * dfg/DFGDoesGC.cpp:
1477         (JSC::DFG::doesGC):
1478         * dfg/DFGFixupPhase.cpp:
1479         (JSC::DFG::FixupPhase::fixupNode):
1480         (JSC::DFG::FixupPhase::fixupIsCellWithType):
1481         * dfg/DFGGraph.cpp:
1482         (JSC::DFG::Graph::dump):
1483         * dfg/DFGNode.h:
1484         (JSC::DFG::Node::hasQueriedType):
1485         (JSC::DFG::Node::queriedType):
1486         (JSC::DFG::Node::hasSpeculatedTypeForQuery):
1487         (JSC::DFG::Node::speculatedTypeForQuery):
1488         (JSC::DFG::Node::shouldSpeculateProxyObject):
1489         (JSC::DFG::Node::shouldSpeculateDerivedArray):
1490         (JSC::DFG::Node::loadVarargsData): Deleted.
1491         (JSC::DFG::Node::shouldSpeculateArray): Deleted.
1492         * dfg/DFGNodeType.h:
1493         * dfg/DFGPredictionPropagationPhase.cpp:
1494         * dfg/DFGSafeToExecute.h:
1495         (JSC::DFG::SafeToExecuteEdge::operator()):
1496         (JSC::DFG::safeToExecute):
1497         * dfg/DFGSpeculativeJIT.cpp:
1498         (JSC::DFG::SpeculativeJIT::compileIsCellWithType):
1499         (JSC::DFG::SpeculativeJIT::speculateProxyObject):
1500         (JSC::DFG::SpeculativeJIT::speculateDerivedArray):
1501         (JSC::DFG::SpeculativeJIT::speculate):
1502         (JSC::DFG::SpeculativeJIT::compileIsJSArray): Deleted.
1503         (JSC::DFG::SpeculativeJIT::compileIsRegExpObject): Deleted.
1504         * dfg/DFGSpeculativeJIT.h:
1505         * dfg/DFGSpeculativeJIT32_64.cpp:
1506         (JSC::DFG::SpeculativeJIT::compile):
1507         * dfg/DFGSpeculativeJIT64.cpp:
1508         (JSC::DFG::SpeculativeJIT::compile):
1509         * dfg/DFGUseKind.cpp:
1510         (WTF::printInternal):
1511         * dfg/DFGUseKind.h:
1512         (JSC::DFG::typeFilterFor):
1513         (JSC::DFG::isCell):
1514         * ftl/FTLCapabilities.cpp:
1515         (JSC::FTL::canCompile):
1516         * ftl/FTLLowerDFGToB3.cpp:
1517         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
1518         (JSC::FTL::DFG::LowerDFGToB3::compileIsCellWithType):
1519         (JSC::FTL::DFG::LowerDFGToB3::speculate):
1520         (JSC::FTL::DFG::LowerDFGToB3::isCellWithType):
1521         (JSC::FTL::DFG::LowerDFGToB3::speculateProxyObject):
1522         (JSC::FTL::DFG::LowerDFGToB3::speculateDerivedArray):
1523         (JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray): Deleted.
1524         (JSC::FTL::DFG::LowerDFGToB3::compileIsRegExpObject): Deleted.
1525         (JSC::FTL::DFG::LowerDFGToB3::isArray): Deleted.
1526         (JSC::FTL::DFG::LowerDFGToB3::isRegExpObject): Deleted.
1527         * jit/JIT.cpp:
1528         (JSC::JIT::privateCompileMainPass):
1529         * jit/JIT.h:
1530         * jit/JITOpcodes.cpp:
1531         (JSC::JIT::emitIsCellWithType):
1532         (JSC::JIT::emit_op_is_string):
1533         (JSC::JIT::emit_op_is_jsarray):
1534         (JSC::JIT::emit_op_is_proxy_object):
1535         (JSC::JIT::emit_op_is_derived_array):
1536         * jit/JITOpcodes32_64.cpp:
1537         (JSC::JIT::emitIsCellWithType):
1538         (JSC::JIT::emit_op_is_string):
1539         (JSC::JIT::emit_op_is_jsarray):
1540         (JSC::JIT::emit_op_is_proxy_object):
1541         (JSC::JIT::emit_op_is_derived_array):
1542         * jsc.cpp:
1543         (WTF::RuntimeArray::createStructure):
1544         * llint/LLIntData.cpp:
1545         (JSC::LLInt::Data::performAssertions):
1546         * llint/LowLevelInterpreter.asm:
1547         * llint/LowLevelInterpreter32_64.asm:
1548         * llint/LowLevelInterpreter64.asm:
1549         * runtime/ArrayConstructor.cpp:
1550         (JSC::ArrayConstructor::finishCreation):
1551         (JSC::isArraySlowInline):
1552         (JSC::isArraySlow):
1553         (JSC::arrayConstructorPrivateFuncIsArraySlow):
1554         (JSC::arrayConstructorIsArray): Deleted.
1555         * runtime/ArrayConstructor.h:
1556         (JSC::isArray):
1557         * runtime/ArrayPrototype.h:
1558         (JSC::ArrayPrototype::createStructure):
1559         * runtime/JSArray.h:
1560         (JSC::JSArray::finishCreation):
1561         * runtime/JSGlobalObject.cpp:
1562         (JSC::JSGlobalObject::init):
1563         * runtime/JSType.h:
1564
1565 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1566
1567         [DFG] Introduce ArrayUse
1568         https://bugs.webkit.org/show_bug.cgi?id=162063
1569
1570         Reviewed by Keith Miller.
1571
1572         ArrayUse is particularly useful: for IsJSArray.
1573         We can drop IsJSArray in fixup phase by setting ArrayUse edge filter.
1574
1575         Since @isJSArray user is limited (Array.prototype.concat), the effect of this patch is small.
1576         But later, I'll update {@isArray, Array.isArray} to use @isJSArray[1]. In that patch, we are planning
1577         to implement more aggressive optimization like, setting CellUse edge filter to avoid cell check in
1578         SpeculativeJIT::compileIsJSArray.
1579
1580         In the benchmark using Array.prototype.concat, we can see perf improvement since we can drop IsJSArray in fixup phase.
1581
1582                                                      baseline                  patched
1583
1584             lazy-array-species-watchpoints       25.0911+-0.0516     ^     24.7687+-0.0767        ^ definitely 1.0130x faster
1585
1586         [1]: https://bugs.webkit.org/show_bug.cgi?id=162000
1587
1588         * dfg/DFGFixupPhase.cpp:
1589         (JSC::DFG::FixupPhase::fixupNode):
1590         * dfg/DFGSafeToExecute.h:
1591         (JSC::DFG::SafeToExecuteEdge::operator()):
1592         * dfg/DFGSpeculativeJIT.cpp:
1593         (JSC::DFG::SpeculativeJIT::speculateArray):
1594         (JSC::DFG::SpeculativeJIT::speculate):
1595         * dfg/DFGSpeculativeJIT.h:
1596         * dfg/DFGUseKind.cpp:
1597         (WTF::printInternal):
1598         * dfg/DFGUseKind.h:
1599         (JSC::DFG::typeFilterFor):
1600         (JSC::DFG::isCell):
1601         * ftl/FTLCapabilities.cpp:
1602         (JSC::FTL::canCompile):
1603         * ftl/FTLLowerDFGToB3.cpp:
1604         (JSC::FTL::DFG::LowerDFGToB3::speculate):
1605         (JSC::FTL::DFG::LowerDFGToB3::speculateArray):
1606         (JSC::FTL::DFG::LowerDFGToB3::speculateObject): Deleted.
1607
1608 2016-09-16  Joseph Pecoraro  <pecoraro@apple.com>
1609
1610         test262: Various Constructors length properties should be configurable
1611         https://bugs.webkit.org/show_bug.cgi?id=161998
1612
1613         Reviewed by Saam Barati.
1614
1615         https://tc39.github.io/ecma262/#sec-ecmascript-standard-built-in-objects
1616         Unless otherwise specified, the length property of a built-in Function
1617         object has the attributes:
1618         { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
1619
1620         * runtime/ErrorConstructor.cpp:
1621         (JSC::ErrorConstructor::finishCreation):
1622         * runtime/JSPromiseConstructor.cpp:
1623         (JSC::JSPromiseConstructor::finishCreation):
1624         * runtime/MapConstructor.cpp:
1625         (JSC::MapConstructor::finishCreation):
1626         * runtime/NativeErrorConstructor.cpp:
1627         (JSC::NativeErrorConstructor::finishCreation):
1628         * runtime/ProxyConstructor.cpp:
1629         (JSC::ProxyConstructor::finishCreation):
1630         * runtime/SetConstructor.cpp:
1631         (JSC::SetConstructor::finishCreation):
1632         * runtime/WeakMapConstructor.cpp:
1633         (JSC::WeakMapConstructor::finishCreation):
1634         * runtime/WeakSetConstructor.cpp:
1635         (JSC::WeakSetConstructor::finishCreation):
1636
1637 2016-09-16  Youenn Fablet  <youenn@apple.com>
1638
1639         Custom promise-returning functions should not throw if callee has not the expected type
1640         https://bugs.webkit.org/show_bug.cgi?id=162011
1641
1642         Reviewed by Sam Weinig.
1643
1644         * JavaScriptCore.xcodeproj/project.pbxproj: Making JSPromiseConstructor.h private
1645
1646 2016-09-15  Filip Pizlo  <fpizlo@apple.com>
1647
1648         REGRESSION (r205462): Lot of leaks
1649         https://bugs.webkit.org/show_bug.cgi?id=161946
1650
1651         Reviewed by Saam Barati.
1652
1653         We were forgetting to delete LargeAllocations on VM exit!
1654
1655         * heap/MarkedSpace.cpp:
1656         (JSC::MarkedSpace::~MarkedSpace):
1657
1658 2016-09-15  Keith Miller  <keith_miller@apple.com>
1659
1660
1661         Pragma out undefined-var-template warnings in JSC for JSObjects that are templatized
1662         https://bugs.webkit.org/show_bug.cgi?id=161985
1663
1664         Reviewed by Alex Christensen.
1665
1666         I started a true fix for this in
1667         https://bugs.webkit.org/show_bug.cgi?id=161979, however the fix
1668         for this issue is not sustainable. Since the scope of this issue
1669         is just limited to the static const ClassInfo member it is
1670         simpler to just pragma out this warning. This works because
1671         COMDAT will, AFAIK, pick the actual specialization.  If, in the
1672         future, we want to expose these classes to WebCore we will need to
1673         do what we do for JSGenericTypedArrayViews and create a custom
1674         info() function with a switch.
1675
1676         This patch also fixes a bunch of weak external symbols due to one of:
1677         1) out of line template member definitions functions not being marked inline.
1678         2) inline member functions definitions being marked as exported.
1679         3) missing header file includes for forward function declarations.
1680
1681         * API/JSCallbackObject.h:
1682         * b3/B3ValueInlines.h:
1683         (JSC::B3::Value::as):
1684         * runtime/HashMapImpl.cpp:
1685         (JSC::getHashMapBucketKeyClassInfo):
1686         (JSC::getHashMapBucketKeyValueClassInfo):
1687         (JSC::getHashMapImplKeyClassInfo):
1688         (JSC::getHashMapImplKeyValueClassInfo):
1689         * runtime/HashMapImpl.h:
1690         (JSC::HashMapBucket::info):
1691         (JSC::HashMapImpl::info):
1692         * runtime/JSCJSValue.h:
1693         (JSC::toUInt32): Deleted.
1694         * runtime/JSGenericTypedArrayView.h:
1695         (JSC::JSGenericTypedArrayView::setIndexQuicklyToDouble):
1696         * runtime/JSGenericTypedArrayViewConstructor.h:
1697         * runtime/JSGenericTypedArrayViewPrototype.h:
1698         * runtime/MathCommon.h:
1699         (JSC::toUInt32):
1700         * runtime/TypedArrayAdaptors.h:
1701         * runtime/VM.h:
1702         (JSC::VM::watchdog):
1703         (JSC::VM::heapProfiler):
1704         (JSC::VM::samplingProfiler):
1705
1706 2016-09-14  Filip Pizlo  <fpizlo@apple.com>
1707
1708         There is no good reason for WeakBlock to care about newly allocated objects
1709         https://bugs.webkit.org/show_bug.cgi?id=162006
1710
1711         Reviewed by Geoffrey Garen.
1712
1713         WeakBlock scans itself in two modes:
1714
1715         visit: if a Weak in the block belongs to an unmarked object, ask the Weak to consider whether
1716             it should do things.
1717
1718         reap: if a Weak in a block belongs to an unmarked object, delete the Weak.
1719
1720         Except that "unmarked" has a peculiar meaning: WeakBlock defines it as
1721         !markedOrNewlyAllocated. So, a newly allocated object will never be consulted about anything.
1722         That sounds scary until you realize that newlyAllocated must have been cleared before we even
1723         got here.
1724
1725         So, we were paying the price of checking newlyAllocated for no reason. This switches the code
1726         to using isMarked(). I don't know why the code previously checked newlyAllocated, but I do
1727         trust my reasoning.
1728
1729         * heap/LargeAllocation.h:
1730         (JSC::LargeAllocation::isMarkedDuringWeakVisiting):
1731         (JSC::LargeAllocation::isMarkedOrNewlyAllocatedDuringWeakVisiting): Deleted.
1732         * heap/MarkedBlock.h:
1733         (JSC::MarkedBlock::isMarkedDuringWeakVisiting):
1734         (JSC::MarkedBlock::isMarkedOrNewlyAllocatedDuringWeakVisiting): Deleted.
1735         * heap/WeakBlock.cpp:
1736         (JSC::WeakBlock::specializedVisit):
1737         (JSC::WeakBlock::reap):
1738
1739 2016-09-15  Commit Queue  <commit-queue@webkit.org>
1740
1741         Unreviewed, rolling out r205931.
1742         https://bugs.webkit.org/show_bug.cgi?id=162021
1743
1744         Tests for this change fail on 32-bit JSC bots (Requested by
1745         ryanhaddad on #webkit).
1746
1747         Reverted changeset:
1748
1749         "[JSC] Make the rounding-related nodes support any type"
1750         https://bugs.webkit.org/show_bug.cgi?id=161895
1751         http://trac.webkit.org/changeset/205931
1752
1753 2016-09-15  Joseph Pecoraro  <pecoraro@apple.com>
1754
1755         test262: Should be a SyntaxError for duplicate parameter names in function with default parameters
1756         https://bugs.webkit.org/show_bug.cgi?id=162013
1757
1758         Reviewed by Saam Barati.
1759
1760         https://tc39.github.io/ecma262/#sec-function-definitions-static-semantics-early-errors
1761         It is a Syntax Error if IsSimpleParameterList of FormalParameterList is
1762         false and BoundNames of FormalParameterList contains any duplicate elements.
1763
1764         Non-simple parameter lists include rest parameters, destructuring,
1765         and default parameters.
1766
1767         * parser/Parser.cpp:
1768         (JSC::Parser<LexerType>::parseFormalParameters):
1769         Previously, we were not failing if there were default parameters
1770         early in the parameter list that were not yet identified as duplicates
1771         and simple parameters later were duplicates. Now, we fail if there
1772         are default parameters anywhere in the parameter list with a duplicate.
1773
1774 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
1775
1776         ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
1777         https://bugs.webkit.org/show_bug.cgi?id=162003
1778
1779         Reviewed by Saam Barati.
1780
1781         * bytecompiler/NodesCodegen.cpp:
1782         (JSC::ArrayNode::isSimpleArray):
1783         Don't treat an Array that has a spread expression inside it as simple.
1784         This avoids a fast path for f.apply(x, simpleArray) that was not handling
1785         spread expressions within arrays, and instead taking a path that can
1786         handle the spreading.
1787
1788 2016-09-14  Commit Queue  <commit-queue@webkit.org>
1789
1790         Unreviewed, rolling out r205933 and r205936.
1791         https://bugs.webkit.org/show_bug.cgi?id=162002
1792
1793         broke the build (Requested by keith_miller on #webkit).
1794
1795         Reverted changesets:
1796
1797         "Pragma out undefined-var-template warnings in JSC for
1798         JSObjects that are templatized"
1799         https://bugs.webkit.org/show_bug.cgi?id=161985
1800         http://trac.webkit.org/changeset/205933
1801
1802         "Unreviewed, fix the Windows build."
1803         http://trac.webkit.org/changeset/205936
1804
1805 2016-09-14  Chris Dumez  <cdumez@apple.com>
1806
1807         REGRESSION (r205670): ASSERTION FAILED: methodTable(vm)->toThis(this, exec, NotStrictMode) == this
1808         https://bugs.webkit.org/show_bug.cgi?id=161982
1809
1810         Reviewed by Saam Barati.
1811
1812         Update JSProxy::setPrototype() to return false unconditionally instead
1813         of forwarding the call to its target. We used to forward to the target
1814         and then the JSDOMWindow's [[SetPrototypeOf]] would return false.
1815         However, the JSC tests use a different GlobalObject and forwarding
1816         the setPrototypeOf() call to the GlobalObject lead to hitting an
1817         assertion. This patch aligns the behavior of the GlobalObject used by
1818         the JSC tests with JSDOMWindow.
1819
1820         * runtime/JSProxy.cpp:
1821         (JSC::JSProxy::setPrototype):
1822
1823 2016-09-14  Michael Saboff  <msaboff@apple.com>
1824
1825         YARR doesn't check for invalid flags for literal regular expressions
1826         https://bugs.webkit.org/show_bug.cgi?id=161995
1827
1828         Reviewed by Mark Lam.
1829
1830         Added a new error and a check that the flags are valid when we create a
1831         literal regular expression.
1832
1833         * runtime/RegExp.cpp:
1834         (JSC::RegExp::finishCreation):
1835         * yarr/YarrPattern.cpp:
1836         (JSC::Yarr::YarrPattern::errorMessage):
1837         (JSC::Yarr::YarrPattern::compile):
1838         * yarr/YarrPattern.h:
1839
1840 2016-09-14  Keith Miller  <keith_miller@apple.com>
1841
1842         Unreviewed, fix the Windows build.
1843
1844         * runtime/HashMapImpl.cpp:
1845
1846 2016-09-14  Keith Miller  <keith_miller@apple.com>
1847
1848         Pragma out undefined-var-template warnings in JSC for JSObjects that are templatized
1849         https://bugs.webkit.org/show_bug.cgi?id=161985
1850
1851         Reviewed by Geoffrey Garen.
1852
1853         I started a true fix for this in
1854         https://bugs.webkit.org/show_bug.cgi?id=161979, however the fix
1855         for this issue is not sustainable. Since the scope of this issue
1856         is just limited to the static const ClassInfo member it is
1857         simpler to just pragma out this warning. This works because
1858         COMDAT will, AFAIK, pick the actual specialization.  If, in the
1859         future, we want to expose these classes to WebCore we will need to
1860         do what we do for JSGenericTypedArrayViews and create a custom
1861         info() function with a switch.
1862
1863         This patch also fixes a bunch of weak external symbols due to one of:
1864         1) out of line template member definitions functions not being marked inline.
1865         2) inline member functions definitions being marked as exported.
1866         3) missing header file includes for forward function declarations.
1867
1868         * API/JSCallbackObject.h:
1869         * b3/B3ValueInlines.h:
1870         (JSC::B3::Value::as):
1871         * runtime/HashMapImpl.h:
1872         * runtime/JSCJSValue.h:
1873         (JSC::toUInt32): Deleted.
1874         * runtime/JSGenericTypedArrayView.h:
1875         (JSC::JSGenericTypedArrayView::setIndexQuicklyToDouble):
1876         * runtime/JSGenericTypedArrayViewConstructor.h:
1877         * runtime/JSGenericTypedArrayViewPrototype.h:
1878         * runtime/MathCommon.h:
1879         (JSC::toUInt32):
1880         * runtime/TypedArrayAdaptors.h:
1881         * runtime/VM.h:
1882         (JSC::VM::watchdog):
1883         (JSC::VM::heapProfiler):
1884         (JSC::VM::samplingProfiler):
1885
1886 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
1887
1888         test262: TypedArray constructors length should be 3 and configurable
1889         https://bugs.webkit.org/show_bug.cgi?id=161955
1890
1891         Reviewed by Mark Lam.
1892
1893         https://tc39.github.io/ecma262/#sec-ecmascript-standard-built-in-objects
1894         Unless otherwise specified, the length property of a built-in Function
1895         object has the attributes:
1896         { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
1897
1898         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
1899         (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation):
1900
1901 2016-09-14  Benjamin Poulain  <bpoulain@apple.com>
1902
1903         [JSC] Make the rounding-related nodes support any type
1904         https://bugs.webkit.org/show_bug.cgi?id=161895
1905
1906         Reviewed by Geoffrey Garen.
1907
1908         This patch changes ArithRound, ArithFloor, ArithCeil and ArithTrunc
1909         to support polymorphic input without exiting on entry.
1910
1911         * dfg/DFGAbstractInterpreterInlines.h:
1912         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1913         * dfg/DFGByteCodeParser.cpp:
1914         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
1915         The 4 functions ignore any input past the first argument. It is okay
1916         to use the nodes with the first argument and let the Phantoms keep
1917         the remaining arguments live.
1918
1919         * dfg/DFGClobberize.h:
1920         (JSC::DFG::clobberize):
1921         * dfg/DFGFixupPhase.cpp:
1922         (JSC::DFG::FixupPhase::fixupNode):
1923         Our fixup had the issue we have seen on previous nodes: unaryArithShouldSpeculateInt32()
1924         prevents us from picking a good type if we do not see any double.
1925
1926         * dfg/DFGNodeType.h:
1927         * dfg/DFGOperations.cpp:
1928         * dfg/DFGOperations.h:
1929         * dfg/DFGPredictionPropagationPhase.cpp:
1930         Prediction propagation of those nodes are fully determined
1931         from their flags and results's prediction. They are moved
1932         to the invariant processing.
1933
1934         * dfg/DFGSpeculativeJIT.cpp:
1935         (JSC::DFG::SpeculativeJIT::compileArithRounding):
1936         * ftl/FTLLowerDFGToB3.cpp:
1937         (JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
1938         (JSC::FTL::DFG::LowerDFGToB3::compileArithFloor):
1939         (JSC::FTL::DFG::LowerDFGToB3::compileArithCeil):
1940         (JSC::FTL::DFG::LowerDFGToB3::compileArithTrunc):
1941
1942 2016-09-14  Filip Pizlo  <fpizlo@apple.com>
1943
1944         Remove Heap::setMarked()
1945
1946         Rubber stamped by Keith Miller.
1947
1948         Nobody uses this function.
1949
1950         * heap/Heap.h:
1951         * heap/HeapInlines.h:
1952         (JSC::Heap::setMarked): Deleted.
1953         * heap/LargeAllocation.h:
1954         (JSC::LargeAllocation::testAndSetMarked):
1955         (JSC::LargeAllocation::setMarked): Deleted.
1956         * heap/MarkedBlock.h:
1957
1958 2016-09-14  Mark Lam  <mark.lam@apple.com>
1959
1960         Use Options::validateExceptionChecks() instead of VM::m_verifyExceptionEvents.
1961         https://bugs.webkit.org/show_bug.cgi?id=161975
1962
1963         Reviewed by Keith Miller.
1964
1965         This makes it less burdensome (no longer needs a rebuild to enable checks) to do
1966         incremental work towards enabling checks all the time.
1967
1968         * runtime/Options.h:
1969         * runtime/VM.cpp:
1970         (JSC::VM::verifyExceptionCheckNeedIsSatisfied):
1971         * runtime/VM.h:
1972
1973 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
1974
1975         TaggedTemplateString function calls should emit tail position calls
1976         https://bugs.webkit.org/show_bug.cgi?id=161948
1977
1978         Reviewed by Yusuke Suzuki.
1979
1980         * bytecompiler/NodesCodegen.cpp:
1981         (JSC::TaggedTemplateNode::emitBytecode):
1982         The tagged template string function call can be a tail call:
1983         https://tc39.github.io/ecma262/#sec-tagged-templates-runtime-semantics-evaluation
1984
1985 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
1986
1987         test262: Array.prototype.slice should always set length
1988         https://bugs.webkit.org/show_bug.cgi?id=161953
1989
1990         Reviewed by Mark Lam.
1991
1992         * runtime/ArrayPrototype.cpp:
1993         (JSC::arrayProtoFuncSplice):
1994
1995 2016-09-13  Michael Saboff  <msaboff@apple.com>
1996
1997         Promises aren't resolved properly when making a ObjC API callback
1998         https://bugs.webkit.org/show_bug.cgi?id=161929
1999
2000         Reviewed by Geoffrey Garen.
2001
2002         When we go to call out to an Objective C function registered via the API,
2003         we first drop all JSC locks to make the call.  As part of dropping the locks,
2004         we drain the microtask queue that is used among other things for handling deferred
2005         promise resolution.  The DropAllLocks scope class that drops the locks while in
2006         scope, resets the current thread's AtomicStringTable to the default table.  This
2007         is wrong for two reasons, first it happens before we drain the microtask queue and
2008         second it isn't needed as JSLock::willReleaseLock() restores the current thread's
2009         AtomicStringTable to the table before the lock was acquired.
2010
2011         In fact, the manipulation of the current thread's AtomicStringTable is already
2012         properly handled as a stack in JSLock::didAcquireLock() and willReleaseLock().
2013         Therefore the manipulation of the AtomicStringTable in DropAllLocks constructor
2014         and destructor should be removed.
2015
2016         * API/tests/testapi.mm:
2017         (testObjectiveCAPIMain): Added a new test.
2018         * runtime/JSLock.cpp:
2019         (JSC::JSLock::DropAllLocks::DropAllLocks):
2020         (JSC::JSLock::DropAllLocks::~DropAllLocks):
2021
2022 2016-09-13  Filip Pizlo  <fpizlo@apple.com>
2023
2024         Remove Heap::isLive()
2025         https://bugs.webkit.org/show_bug.cgi?id=161933
2026
2027         Reviewed by Mark Lam.
2028
2029         Before I put any more effort into maintaining this weird function, I decided to check how it
2030         was used. It turns out it's not.
2031
2032         * heap/Heap.h:
2033         * heap/HeapInlines.h:
2034         (JSC::Heap::isLive): Deleted.
2035
2036 2016-09-13  Mark Lam  <mark.lam@apple.com>
2037
2038         DFG NewArrayBuffer node should watch for "have a bad time" state change.
2039         https://bugs.webkit.org/show_bug.cgi?id=161927
2040         <rdar://problem/27995222>
2041
2042         Reviewed by Geoffrey Garen.
2043
2044         * dfg/DFGFixupPhase.cpp:
2045         (JSC::DFG::FixupPhase::fixupNode):
2046
2047 2016-09-13  JF Bastien  <jfbastien@apple.com>
2048
2049         Support jsc shell builtin `read`
2050         https://bugs.webkit.org/show_bug.cgi?id=161662
2051
2052         Reviewed by Keith Miller.
2053
2054         The jsc shell currently supports a `readFile` method which returns
2055         a string. SpiderMonkey's js shell and V8's d8 shell both support
2056         similar file-to-string functions, as well as a
2057         binary-file-to-Uint8Array function. jsc should support a similar
2058         binary file method to simplify testing, including testing of
2059         WebAssembly blobs.
2060
2061         Emscripten's shell.js (which is also used for some WebAssembly
2062         things) has a polyfill [1] for a builtin called `read`. jsc should
2063         therefore have a builtin with the same name if we want things to
2064         "Just Work".
2065
2066           [1]: https://github.com/kripken/emscripten/blob/5f0918409a1407dd168f57cfa34b109cd1770a8a/src/shell.js#L138
2067
2068         * jsc.cpp:
2069         (GlobalObject::finishCreation): add `read`, make `readFile` take up to 2 arguments.
2070         (functionReadFile): support binary files, as per SpiderMonkey.
2071         * runtime/Error.h:
2072         (JSC::throwVMError): convenience function, I'll add more uses in a follow-up
2073         * runtime/JSTypedArrays.cpp:
2074         (JSC::createUint8TypedArray): JS private export of JSUint8Array::create.
2075         * runtime/JSTypedArrays.h: expose private export.
2076
2077 2016-09-12  Skachkov Oleksandr  <gskachkov@gmail.com>
2078
2079         ES6: Classes: Should be allowed to create a static method with name "arguments"
2080         https://bugs.webkit.org/show_bug.cgi?id=152985
2081
2082         Reviewed by Keith Miller.
2083
2084         Current patch covered 16.2 Forbidden Extensions - first topic
2085         (https://tc39.github.io/ecma262/#sec-forbidden-extensions) ECMAScript Functions
2086         should not have own properties named "caller" or "arguments".
2087         Also added possibility to declare static methods and getters with
2088         name 'arguments' and 'caller' for classes. i.e.:
2089         class A { static arguments() { return 'value'; } }
2090         A.arguments() === 'value';
2091         To implement this patch 'caller' and 'arguments' were put to the FunctionPrototype
2092         object. Also was changed approach to init throwTypeErrorArgumentsCalleeAndCallerGetterSetter
2093         property from Lazy to common because it necessary to use execState during init of the accessors
2094         properties.
2095
2096         * runtime/Executable.h:
2097         * runtime/FunctionPrototype.cpp:
2098         (JSC::FunctionPrototype::initRestrictedProperties):
2099         (JSC::FunctionPrototype::addFunctionProperties): Deleted.
2100         * runtime/FunctionPrototype.h:
2101         * runtime/JSFunction.cpp:
2102         (JSC::JSFunction::getOwnPropertySlot):
2103         (JSC::JSFunction::getOwnNonIndexPropertyNames):
2104         (JSC::JSFunction::put):
2105         (JSC::JSFunction::deleteProperty):
2106         (JSC::JSFunction::defineOwnProperty):
2107         * runtime/JSGlobalObject.cpp:
2108         (JSC::JSGlobalObject::init):
2109         (JSC::JSGlobalObject::visitChildren):
2110         * runtime/JSGlobalObject.h:
2111         (JSC::JSGlobalObject::throwTypeErrorArgumentsCalleeAndCallerGetterSetter):
2112
2113 2016-09-12  Filip Pizlo  <fpizlo@apple.com>
2114
2115         MarkedBlock should be able to use flipIfNecessary() as the "I'm not empty" trigger
2116         https://bugs.webkit.org/show_bug.cgi?id=161869
2117
2118         Reviewed by Saam Barati.
2119
2120         In bug 161581, I'm going to use flipIfNecessary() during marking to trigger the "I'm not
2121         empty" hook, which will set a bit in the markingNotEmpty bitvector.
2122
2123         For this to work, we need to ensure that nobody else uses flipIfNecessary() during marking.
2124         If anyone else does it but they aren't marking new objects, then this prevents
2125         flipIfNecessary() from triggering when the first object is marked, which means we won't
2126         always detect when a block became non-empty.
2127
2128         I addressed this by adding a isMarking flag, and asserting in flipIfNecessary() that the flag
2129         isn't set. flipIfNecessaryDuringMarking() is used only on the marking path, so that code
2130         knows that it can trigger something like noteMarked(). The only places that were using
2131         flipIfNecessary() should have been using needsFlip() anyway.
2132
2133         * heap/CellContainer.h:
2134         * heap/CellContainerInlines.h:
2135         (JSC::CellContainer::needsFlip):
2136         * heap/Heap.cpp:
2137         (JSC::Heap::markRoots):
2138         (JSC::Heap::beginMarking):
2139         (JSC::Heap::endMarking):
2140         (JSC::Heap::clearLivenessData): Deleted.
2141         (JSC::Heap::converge): Deleted.
2142         (JSC::Heap::resetVisitors): Deleted.
2143         * heap/Heap.h:
2144         * heap/HeapInlines.h:
2145         (JSC::Heap::testAndSetMarked):
2146         * heap/LargeAllocation.h:
2147         (JSC::LargeAllocation::flipIfNecessaryDuringMarking):
2148         (JSC::LargeAllocation::flipIfNecessaryConcurrently): Deleted.
2149         * heap/MarkedBlock.cpp:
2150         (JSC::MarkedBlock::flipIfNecessarySlow):
2151         (JSC::MarkedBlock::flipIfNecessaryDuringMarkingSlow):
2152         (JSC::MarkedBlock::flipIfNecessaryConcurrentlySlow): Deleted.
2153         * heap/MarkedBlock.h:
2154         (JSC::MarkedBlock::flipIfNecessaryDuringMarking):
2155         (JSC::MarkedBlock::Handle::flipIfNecessaryDuringMarking):
2156         (JSC::MarkedBlock::flipIfNecessaryConcurrently): Deleted.
2157         (JSC::MarkedBlock::Handle::flipIfNecessaryConcurrently): Deleted.
2158         * heap/MarkedSpace.h:
2159         (JSC::MarkedSpace::isMarking):
2160         (JSC::MarkedSpace::setIsMarking):
2161         (JSC::MarkedSpace::largeAllocationsForThisCollectionSize): Deleted.
2162         * heap/SlotVisitor.cpp:
2163         (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
2164         * heap/WeakBlock.cpp:
2165         (JSC::WeakBlock::visit):
2166
2167 2016-09-12  Saam Barati  <sbarati@apple.com>
2168
2169         HashMapImpl should take into account m_deleteCount in its load factor and it should be able to rehash the table to be smaller
2170         https://bugs.webkit.org/show_bug.cgi?id=161640
2171
2172         Reviewed by Geoffrey Garen.
2173
2174         HashMapImpl now takes into account m_deleteCount in its load factor.
2175         It now knows how to rehash to either decrease its capacity, stay at
2176         the same capacity, or increase its capacity. The reason we can sometimes
2177         stay at the same capacity is that we can reduce the load factor enough
2178         by rehashing that growing isn't warranted. The reason for this is that
2179         anytime we rehash, we remove all deleted sentinels from the buffer.
2180         Therefore, staying at the same same capacity, when there are deleted entries,
2181         can still reduce the load factor because it removes all deleted sentinels.
2182
2183         * runtime/HashMapImpl.h:
2184         (JSC::HashMapBuffer::create):
2185         (JSC::HashMapBuffer::reset):
2186         (JSC::HashMapImpl::HashMapImpl):
2187         (JSC::HashMapImpl::add):
2188         (JSC::HashMapImpl::remove):
2189         (JSC::HashMapImpl::size):
2190         (JSC::HashMapImpl::clear):
2191         (JSC::HashMapImpl::approximateSize):
2192         (JSC::HashMapImpl::shouldRehashAfterAdd):
2193         (JSC::HashMapImpl::shouldShrink):
2194         (JSC::HashMapImpl::rehash):
2195         (JSC::HashMapImpl::checkConsistency):
2196         (JSC::HashMapImpl::makeAndSetNewBuffer):
2197         (JSC::HashMapImpl::assertBufferIsEmpty):
2198
2199 2016-09-12  Benjamin Poulain  <bpoulain@apple.com>
2200
2201         [JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
2202         https://bugs.webkit.org/show_bug.cgi?id=161671
2203
2204         Reviewed by Geoffrey Garen.
2205
2206         UndecidedShape is a type with storage. When we allocate an uninitialized JSArray,
2207         it gets a butterfly with its length.
2208         When we were querying that length, we were generating a generic GetById with inline cache.
2209
2210         This patch adds the missing bits to treat Undecided like the other types with storage.
2211
2212         * dfg/DFGArrayMode.cpp:
2213         (JSC::DFG::canBecomeGetArrayLength):
2214         (JSC::DFG::ArrayMode::refine):
2215         * dfg/DFGArrayMode.h:
2216         (JSC::DFG::ArrayMode::usesButterfly):
2217         (JSC::DFG::ArrayMode::lengthNeedsStorage):
2218         * dfg/DFGClobberize.h:
2219         (JSC::DFG::clobberize):
2220         * dfg/DFGFixupPhase.cpp:
2221         (JSC::DFG::FixupPhase::checkArray):
2222         * dfg/DFGSpeculativeJIT.cpp:
2223         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
2224         * ftl/FTLCapabilities.cpp:
2225         (JSC::FTL::canCompile):
2226         * ftl/FTLLowerDFGToB3.cpp:
2227         (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
2228
2229 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2230
2231         [DFG][FTL] Add ArithTan
2232         https://bugs.webkit.org/show_bug.cgi?id=161857
2233
2234         Reviewed by Filip Pizlo.
2235
2236         While ArithSin and ArithCos are supported, ArithTan is not supported yet.
2237         And we also find that Math.tan is included in MotionMark's Multiply benchmark.
2238
2239         This patch adds ArithTan support in DFG and FTL. And it also cleans up the
2240         existing ArithSin, ArithCos, and ArithLog compilations by unifying them.
2241         The microbenchmark shows the 9% perf improvement.
2242
2243             tan    322.4819+-0.3766     ^    295.8700+-0.3094        ^ definitely 1.0899x faster
2244
2245         * dfg/DFGAbstractInterpreterInlines.h:
2246         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2247         * dfg/DFGByteCodeParser.cpp:
2248         (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
2249         * dfg/DFGClobberize.h:
2250         (JSC::DFG::clobberize):
2251         * dfg/DFGDoesGC.cpp:
2252         (JSC::DFG::doesGC):
2253         * dfg/DFGFixupPhase.cpp:
2254         (JSC::DFG::FixupPhase::fixupNode):
2255         * dfg/DFGNodeType.h:
2256         * dfg/DFGOperations.cpp:
2257         * dfg/DFGOperations.h:
2258         * dfg/DFGPredictionPropagationPhase.cpp:
2259         * dfg/DFGSafeToExecute.h:
2260         (JSC::DFG::safeToExecute):
2261         * dfg/DFGSpeculativeJIT.cpp:
2262         (JSC::DFG::SpeculativeJIT::compileArithDoubleUnaryOp):
2263         (JSC::DFG::SpeculativeJIT::compileArithCos):
2264         (JSC::DFG::SpeculativeJIT::compileArithTan):
2265         (JSC::DFG::SpeculativeJIT::compileArithSin):
2266         (JSC::DFG::SpeculativeJIT::compileArithLog):
2267         * dfg/DFGSpeculativeJIT.h:
2268         * dfg/DFGSpeculativeJIT32_64.cpp:
2269         (JSC::DFG::SpeculativeJIT::compile):
2270         * dfg/DFGSpeculativeJIT64.cpp:
2271         (JSC::DFG::SpeculativeJIT::compile):
2272         * ftl/FTLCapabilities.cpp:
2273         (JSC::FTL::canCompile):
2274         * ftl/FTLLowerDFGToB3.cpp:
2275         (JSC::FTL::DFG::LowerDFGToB3::compileNode):
2276         (JSC::FTL::DFG::LowerDFGToB3::compileArithTan):
2277         * ftl/FTLOutput.cpp:
2278         (JSC::FTL::Output::doubleTan):
2279         * ftl/FTLOutput.h:
2280         * runtime/Intrinsic.h:
2281         * runtime/MathObject.cpp:
2282         (JSC::MathObject::finishCreation):
2283
2284 2016-09-12  Saam Barati  <sbarati@apple.com>
2285
2286         MapHash should do constant folding when it has a constant argument and its legal to hash that value
2287         https://bugs.webkit.org/show_bug.cgi?id=161639
2288
2289         Reviewed by Filip Pizlo.
2290
2291         We now constant fold the MapHash node. We're careful to not resolve
2292         ropes from the compiler thread, and to only hash strings if they're
2293         not too large. The microbenchmark I added runs about 12% faster with
2294         this patch.
2295
2296         * dfg/DFGAbstractInterpreterInlines.h:
2297         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2298         * runtime/HashMapImpl.h:
2299         (JSC::wangsInt64Hash):
2300         (JSC::jsMapHash):
2301         (JSC::concurrentJSMapHash):
2302
2303 2016-09-11  Filip Pizlo  <fpizlo@apple.com>
2304
2305         DFG::forAllKilledOperands() could use a faster bitvector scan in the same-inline-stack fast path
2306         https://bugs.webkit.org/show_bug.cgi?id=161849
2307
2308         Reviewed by Saam Barati.
2309
2310         This is a fairly obvious change. This turns a loop that would query each bit individually
2311         into a loop that will process a word at a time. I would expect a very tiny progression in
2312         DFG compile times.
2313
2314         This also gave me an opportunity to test and fix the new FastBitVector functionality.
2315
2316         * dfg/DFGForAllKills.h:
2317         (JSC::DFG::forAllKilledOperands):
2318
2319 2016-09-11  Filip Pizlo  <fpizlo@apple.com>
2320
2321         FastBitVector should have efficient and easy-to-use vector-vector operations
2322         https://bugs.webkit.org/show_bug.cgi?id=161847
2323
2324         Reviewed by Saam Barati.
2325
2326         Adapt existing users of FastBitVector to the new API.
2327
2328         * bytecode/BytecodeLivenessAnalysis.cpp:
2329         (JSC::BytecodeLivenessAnalysis::computeKills):
2330         (JSC::BytecodeLivenessAnalysis::dumpResults):
2331         * bytecode/BytecodeLivenessAnalysisInlines.h:
2332         (JSC::operandThatIsNotAlwaysLiveIsLive):
2333         (JSC::BytecodeLivenessPropagation<DerivedAnalysis>::stepOverInstruction):
2334         (JSC::BytecodeLivenessPropagation<DerivedAnalysis>::runLivenessFixpoint):
2335         * bytecode/CodeBlock.cpp:
2336         (JSC::CodeBlock::validate):
2337         * dfg/DFGByteCodeParser.cpp:
2338         (JSC::DFG::ByteCodeParser::flushForTerminal):
2339         * dfg/DFGForAllKills.h:
2340         (JSC::DFG::forAllKilledOperands):
2341         * dfg/DFGGraph.h:
2342         (JSC::DFG::Graph::forAllLocalsLiveInBytecode):
2343         * dfg/DFGLiveCatchVariablePreservationPhase.cpp:
2344         (JSC::DFG::LiveCatchVariablePreservationPhase::willCatchException):
2345         (JSC::DFG::LiveCatchVariablePreservationPhase::handleBlock):
2346         * dfg/DFGNaturalLoops.cpp:
2347         (JSC::DFG::NaturalLoops::NaturalLoops):
2348         * dfg/DFGPlan.cpp:
2349         (JSC::DFG::Plan::cleanMustHandleValuesIfNecessary):
2350
2351 2016-09-10  Chris Dumez  <cdumez@apple.com>
2352
2353         parseHTMLInteger() should take a StringView in parameter
2354         https://bugs.webkit.org/show_bug.cgi?id=161669
2355
2356         Reviewed by Ryosuke Niwa.
2357
2358         * runtime/DateConversion.cpp:
2359         (JSC::formatDateTime):
2360         Explicitly construct a String from the const WCHAR* on Windows because
2361         it is ambiguous otherwise now that there is a StringBuilder::append()
2362         overload taking an AtomicString in.
2363
2364 2016-09-08  Keith Miller  <keith_miller@apple.com>
2365
2366         WASM should support if-then-else
2367         https://bugs.webkit.org/show_bug.cgi?id=161778
2368
2369         Reviewed by Michael Saboff.
2370
2371         This patch makes some major changes to the way that the WASM
2372         function parser works. First, the control stack has been moved
2373         from the parser's context to the parser itself. This simplifies
2374         the way that the parser works and allows us to make the decoder
2375         iterative rather than recursive. Since the control stack has been
2376         moved to the parser, any context operation that refers to some
2377         block now receives that block by reference.
2378
2379         For any if block, regardless of whether or not it is an
2380         if-then-else or not, we will allocate both the entire control flow
2381         diamond. This is not a major issue in the if-then case since B3
2382         will immediately cleanup these blocks. In order to support if-then
2383         and if-then-else we needed to be able to distinguish what the type
2384         of the top block on the control stack is. This will be necessary
2385         when validating the else opcode in the future. In the B3 IR
2386         generator we decide to the type of the block strictly by the
2387         shape.
2388
2389         Currently, if blocks don't handle passed and returned stack values
2390         correctly. I plan to fix this when I add support for the block
2391         signatures. See: https://github.com/WebAssembly/design/pull/765
2392
2393         * testWASM.cpp:
2394         (runWASMTests):
2395         * wasm/WASMB3IRGenerator.cpp:
2396         (dumpProcedure):
2397         (JSC::WASM::parseAndCompile):
2398         * wasm/WASMB3IRGenerator.h:
2399         * wasm/WASMFunctionParser.h:
2400         (JSC::WASM::FunctionParser<Context>::parseBlock):
2401         (JSC::WASM::FunctionParser<Context>::parseExpression):
2402         (JSC::WASM::FunctionParser<Context>::parseUnreachableExpression):
2403         * wasm/WASMOps.h:
2404
2405 2016-09-09  Filip Pizlo  <fpizlo@apple.com>
2406
2407         jsc.cpp should call initializeMainThread() to make sure that GC thread assertions work
2408         https://bugs.webkit.org/show_bug.cgi?id=161801
2409
2410         Reviewed by Keith Miller.
2411
2412         The GC has debug assertions that certain things don't happen on GC threads. Those assertions
2413         are no-ops unless initializeGCThreads() is called, and I think the most canonical way to do
2414         that is to call initializeMainThread().
2415
2416         * jsc.cpp:
2417         (jscmain):
2418
2419 2016-09-09  Saam Barati  <sbarati@apple.com>
2420
2421         Make hasOwnProperty ALWAYS_INLINE
2422         https://bugs.webkit.org/show_bug.cgi?id=161775
2423
2424         Reviewed by Ryosuke Niwa.
2425
2426         Speedometer spends around 2.5% of its time in hasOwnProperty.
2427         Let's reduce the overhead of calling that function by marking
2428         it as inline. Also, it's likely that the function will call into
2429         JSObject::getOwnPropertySlot. I added a check to see if that's
2430         the function we're calling, if it is, we do a direct call instead
2431         of an indirect call.
2432
2433         * runtime/JSObject.cpp:
2434         (JSC::JSObject::hasOwnProperty): Deleted.
2435         * runtime/JSObjectInlines.h:
2436         (JSC::JSObject::hasOwnProperty):
2437
2438 2016-09-09  Filip Pizlo  <fpizlo@apple.com>
2439
2440         HashMapImpl needs to m_buffer.clear() in its constructor
2441         https://bugs.webkit.org/show_bug.cgi?id=161796
2442
2443         Reviewed by Keith Miller.
2444
2445         This is the second time that I'm fixing a bug because AuxiliaryBarrier does not initialize
2446         itself. That seemed like a good idea because maybe sometimes the user knows better how to
2447         initialize it. But, it's not worth it if it's a constant source of bugs.
2448
2449         So, I'm fixing it for good by making AuxiliaryBarrier::AuxiliaryBarrier() initialize its
2450         m_value.
2451
2452         * runtime/AuxiliaryBarrier.h:
2453         (JSC::AuxiliaryBarrier::AuxiliaryBarrier):
2454         * runtime/DirectArguments.cpp:
2455         (JSC::DirectArguments::DirectArguments):
2456
2457 2016-09-09  Youenn Fablet  <youenn@apple.com>
2458
2459         ASSERTION FAILED: promise.inherits(JSPromise::info())
2460         https://bugs.webkit.org/show_bug.cgi?id=161632
2461         <rdar://problem/28184743>
2462
2463         Reviewed by Mark Lam.
2464
2465         * runtime/JSPromiseDeferred.cpp:
2466         (JSC::JSPromiseDeferred::create): Returning null if promise object is not created.
2467
2468 2016-09-08  Filip Pizlo  <fpizlo@apple.com>
2469
2470         Heap::isMarked() shouldn't pay the price of concurrent lazy flipping
2471         https://bugs.webkit.org/show_bug.cgi?id=161760
2472
2473         Reviewed by Mark Lam.
2474
2475         To fix a race condition in marking, I made Heap::isMarked() and Heap::isLive() atomic by
2476         using flipIfNecessaryConcurrently() instead of flipIfNecessary().
2477
2478         This introduces three unnecessary overheads:
2479
2480         - isLive() is not called by marking, so that change was not necessary.
2481
2482         - isMarked() gets calls many times outside of marking, so it shouldn't always do the
2483           concurrent thing. This adds isMarkedConcurrently() for use in marking, and reverts
2484           isMarked().
2485
2486         - isMarked() and isMarkedConcurrently() don't actually have to do the lazy flip. They can
2487           return false if the flip is necessary.
2488
2489         I added a bunch of debug assertions to make sure that isLive() and isMarked() are not called
2490         during marking.
2491
2492         If we needed to, we could remove most of the calls to isMarkedConcurrently(). As a kind of
2493         optimization, CodeBlock does an initial fixpoint iteration during marking, and so all of the
2494         code called from CodeBlock's fixpoint iterator needs to use isMarkedConcurrently(). But we
2495         could probably arrange for CodeBlock only do fixpoint iterating during the weak reference
2496         thing.
2497
2498         * bytecode/CodeBlock.cpp:
2499         (JSC::CodeBlock::visitWeakly):
2500         (JSC::CodeBlock::shouldJettisonDueToOldAge):
2501         (JSC::shouldMarkTransition):
2502         (JSC::CodeBlock::propagateTransitions):
2503         (JSC::CodeBlock::determineLiveness):
2504         * bytecode/PolymorphicAccess.cpp:
2505         (JSC::AccessCase::propagateTransitions):
2506         * heap/Heap.h:
2507         * heap/HeapInlines.h:
2508         (JSC::Heap::isLive):
2509         (JSC::Heap::isMarked):
2510         (JSC::Heap::isMarkedConcurrently):
2511         * heap/MarkedBlock.cpp:
2512         (JSC::MarkedBlock::flipIfNecessarySlow):
2513         (JSC::MarkedBlock::flipIfNecessaryConcurrentlySlow):
2514         (JSC::MarkedBlock::needsFlip):
2515         * heap/MarkedBlock.h:
2516         (JSC::MarkedBlock::needsFlip):
2517         (JSC::MarkedBlock::flipIfNecessary):
2518         (JSC::MarkedBlock::flipIfNecessaryConcurrently):
2519         * heap/SlotVisitor.cpp:
2520         (JSC::SlotVisitor::appendToMarkStack):
2521         (JSC::SlotVisitor::markAuxiliary):
2522         (JSC::SlotVisitor::visitChildren):
2523         * runtime/Structure.cpp:
2524         (JSC::Structure::isCheapDuringGC):
2525         (JSC::Structure::markIfCheap):
2526
2527 2016-09-08  Saam Barati  <sbarati@apple.com>
2528
2529         We should inline operationConvertJSValueToBoolean into JIT code
2530         https://bugs.webkit.org/show_bug.cgi?id=161729
2531
2532         Reviewed by Filip Pizlo.
2533
2534         This patch introduces an AssemblyHelpers emitter function
2535         that replaces operationConvertJSValueToBoolean. This operation
2536         was showing up when I was doing performance analysis for the
2537         speedometer benchmark. I saw that it was spending about 1% of
2538         its time in this function. Hopefully this patch can help us speedup
2539         up speedometer by a little bit.
2540
2541         * dfg/DFGSpeculativeJIT32_64.cpp:
2542         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
2543         (JSC::DFG::SpeculativeJIT::emitBranch):
2544         * dfg/DFGSpeculativeJIT64.cpp:
2545         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
2546         (JSC::DFG::SpeculativeJIT::emitBranch):
2547         * jit/AssemblyHelpers.cpp:
2548         (JSC::AssemblyHelpers::emitConvertValueToBoolean):
2549         * jit/AssemblyHelpers.h:
2550         (JSC::AssemblyHelpers::emitAllocateDestructibleObject): Deleted.
2551         * jit/JIT.cpp:
2552         (JSC::JIT::privateCompileSlowCases):
2553         * jit/JIT.h:
2554         * jit/JITOpcodes.cpp:
2555         (JSC::JIT::emit_op_jfalse):
2556         (JSC::JIT::emit_op_jtrue):
2557         (JSC::JIT::emitSlow_op_jfalse): Deleted.
2558         (JSC::JIT::emitSlow_op_jtrue): Deleted.
2559         * jit/JITOpcodes32_64.cpp:
2560         (JSC::JIT::emit_op_jfalse):
2561         (JSC::JIT::emit_op_jtrue):
2562         (JSC::JIT::emitSlow_op_jfalse): Deleted.
2563         (JSC::JIT::emitSlow_op_jtrue): Deleted.
2564         * jit/JITOperations.cpp:
2565         * jit/JITOperations.h:
2566
2567 2016-09-08  Chris Dumez  <cdumez@apple.com>
2568
2569         Align proto getter / setter behavior with other browsers
2570         https://bugs.webkit.org/show_bug.cgi?id=161455
2571
2572         Reviewed by Saam Barati.
2573
2574         Drop allowsAccessFrom from the methodTable and delegate cross-origin
2575         checking to the DOM bindings for [[SetPrototypeOf]] / [[GetPrototypeOf]].
2576         This is more consistent with other operations (e.g. [[GetOwnProperty]]).
2577
2578         * jsc.cpp:
2579         * runtime/JSGlobalObject.cpp:
2580         * runtime/JSGlobalObject.h:
2581         * runtime/JSGlobalObjectFunctions.cpp:
2582         (JSC::globalFuncProtoGetter):
2583         (JSC::globalFuncProtoSetter):
2584         (JSC::globalFuncBuiltinLog): Deleted.
2585         * runtime/JSGlobalObjectFunctions.h:
2586         * runtime/JSObject.cpp:
2587         (JSC::JSObject::setPrototypeWithCycleCheck):
2588         Remove check added in r197648. This check was added to match
2589         the latest EcmaScript spec:
2590         - https://tc39.github.io/ecma262/#sec-ordinarysetprototypeof (step 8)
2591         This check allowed for [[Prototype]] chain cycles if the prototype
2592         chain includes objects that do not use the ordinary object definitions
2593         for [[GetPrototypeOf]] and [[SetPrototypeOf]].
2594         The issue is that the rest of our code base does not properly handle
2595         such cycles and we can end up in infinite loops. This became obvious
2596         because this patch updates Window / Location so that they no longer
2597         use the default [[GetPrototypeOf]] / [[SetPrototypeOf]]. If I do not
2598         remove this check, I get an infinite loop in
2599         Structure::anyObjectInChainMayInterceptIndexedAccesses(), which is
2600         called from JSObject::setPrototypeDirect(), when running the following
2601         layout test:
2602         - html/browsers/history/the-location-interface/allow_prototype_cycle_through_location.sub.html
2603         I filed https://bugs.webkit.org/show_bug.cgi?id=161534 to track this
2604         issue.
2605
2606         * runtime/JSObject.h:
2607         (JSC::JSObject::getArrayLength): Deleted.
2608         * runtime/JSProxy.cpp:
2609         (JSC::JSProxy::setPrototype):
2610         (JSC::JSProxy::getPrototype):
2611         * runtime/JSProxy.h:
2612         * runtime/ObjectConstructor.cpp:
2613         (JSC::objectConstructorGetPrototypeOf):
2614         (JSC::objectConstructorSetPrototypeOf):
2615         (JSC::objectConstructorGetOwnPropertyDescriptor): Deleted.
2616         (JSC::objectConstructorGetOwnPropertyDescriptors): Deleted.
2617         * runtime/ObjectConstructor.h:
2618         * runtime/ReflectObject.cpp:
2619         (JSC::reflectObjectGetPrototypeOf):
2620         (JSC::reflectObjectSetPrototypeOf):
2621
2622 2016-09-08  Filip Pizlo  <fpizlo@apple.com>
2623
2624         Remove CopiedSpace and use MarkedSpace instead
2625         https://bugs.webkit.org/show_bug.cgi?id=159658
2626
2627         Reviewed by Keith Miller.
2628
2629         This removes the final client of CopiedSpace, the overrides array of DirectArguments. That
2630         is a simple change.
2631
2632         Then this stubs out some remaining internal debugging code that referenced CopiedSpace in
2633         JSDollarVM and HeapVerifier. I filed FIXMEs to restore that debugging functionality.
2634
2635         The rest of this patch is deleting CopiedSpace.
2636
2637         * API/JSObjectRef.cpp:
2638         * CMakeLists.txt:
2639         * JavaScriptCore.xcodeproj/project.pbxproj:
2640         * dfg/DFGOperations.cpp:
2641         * heap/ConservativeRoots.cpp:
2642         (JSC::ConservativeRoots::genericAddPointer):
2643         * heap/CopiedAllocator.h: Removed.
2644         * heap/CopiedBlock.cpp: Removed.
2645         * heap/CopiedBlock.h: Removed.
2646         * heap/CopiedBlockInlines.h: Removed.
2647         * heap/CopiedSpace.cpp: Removed.
2648         * heap/CopiedSpace.h: Removed.
2649         * heap/CopiedSpaceInlines.h: Removed.
2650         * heap/CopyBarrier.h: Removed.
2651         * heap/CopyToken.h: Removed.
2652         * heap/CopyVisitor.cpp: Removed.
2653         * heap/CopyVisitor.h: Removed.
2654         * heap/CopyVisitorInlines.h: Removed.
2655         * heap/CopyWorkList.h: Removed.
2656         * heap/Heap.cpp:
2657         (JSC::Heap::Heap):
2658         (JSC::Heap::isPagedOut):
2659         (JSC::Heap::updateObjectCounts):
2660         (JSC::Heap::size):
2661         (JSC::Heap::capacity):
2662         (JSC::Heap::collectImpl):
2663         (JSC::Heap::stopAllocation):
2664         (JSC::Heap::updateAllocationLimits):
2665         (JSC::Heap::copyBackingStores): Deleted.
2666         (JSC::Heap::threadBytesCopied): Deleted.
2667         * heap/Heap.h:
2668         (JSC::Heap::objectSpace):
2669         (JSC::Heap::allocatorForAuxiliaryData):
2670         (JSC::Heap::storageSpace): Deleted.
2671         (JSC::Heap::storageAllocator): Deleted.
2672         * heap/HeapCellInlines.h:
2673         * heap/HeapInlines.h:
2674         (JSC::Heap::tryAllocateStorage): Deleted.
2675         (JSC::Heap::tryReallocateStorage): Deleted.
2676         * heap/HeapVerifier.cpp:
2677         (JSC::HeapVerifier::verifyButterflyIsInStorageSpace):
2678         (JSC::HeapVerifier::reportObject):
2679         (JSC::getButterflyDetails): Deleted.
2680         * heap/SlotVisitor.cpp:
2681         (JSC::SlotVisitor::copyLater): Deleted.
2682         * heap/SlotVisitor.h:
2683         * jit/AssemblyHelpers.h:
2684         * jit/JITOpcodes.cpp:
2685         * jsc.cpp:
2686         * runtime/ArrayConstructor.cpp:
2687         * runtime/ArrayPrototype.cpp:
2688         * runtime/Butterfly.h:
2689         * runtime/ButterflyInlines.h:
2690         (JSC::Butterfly::createUninitializedDuringCollection): Deleted.
2691         * runtime/ClassInfo.h:
2692         * runtime/DirectArguments.cpp:
2693         (JSC::DirectArguments::visitChildren):
2694         (JSC::DirectArguments::overrideThings):
2695         (JSC::DirectArguments::copyBackingStore): Deleted.
2696         * runtime/DirectArguments.h:
2697         * runtime/JSArray.cpp:
2698         * runtime/JSCell.cpp:
2699         (JSC::JSCell::copyBackingStore): Deleted.
2700         * runtime/JSCell.h:
2701         * runtime/JSLexicalEnvironment.h:
2702         * runtime/JSObject.cpp:
2703         * runtime/JSTypedArrays.cpp:
2704         * runtime/LiteralParser.cpp:
2705         * runtime/ObjectConstructor.cpp:
2706         * runtime/RegExpObject.cpp:
2707         * runtime/StringPrototype.cpp:
2708         * runtime/WeakMapData.cpp:
2709         * tools/JSDollarVMPrototype.cpp:
2710         (JSC::JSDollarVMPrototype::isInStorageSpace):
2711
2712 2016-09-08  Filip Pizlo  <fpizlo@apple.com>
2713
2714         Heap version should be 32-bit
2715         https://bugs.webkit.org/show_bug.cgi?id=161751
2716
2717         Reviewed by Mark Lam.
2718
2719         32-bit devices are probably getting hurt by the 64-bit version number. The reason why I made
2720         it 64-bit initially is so that I wouldn't have to worry about wrap-around. But wrap-around is
2721         easy to handle.
2722
2723         * heap/CellContainer.h:
2724         * heap/CellContainerInlines.h:
2725         (JSC::CellContainer::flipIfNecessary):
2726         * heap/ConservativeRoots.cpp:
2727         (JSC::ConservativeRoots::genericAddPointer):
2728         (JSC::ConservativeRoots::genericAddSpan):
2729         * heap/ConservativeRoots.h:
2730         * heap/Heap.h:
2731         * heap/HeapInlines.h:
2732         (JSC::Heap::testAndSetMarked):
2733         * heap/HeapUtil.h:
2734         (JSC::HeapUtil::findGCObjectPointersForMarking):
2735         * heap/MarkedBlock.cpp:
2736         (JSC::MarkedBlock::MarkedBlock):
2737         * heap/MarkedBlock.h:
2738         (JSC::MarkedBlock::flipIfNecessary):
2739         (JSC::MarkedBlock::flipIfNecessaryConcurrently):
2740         (JSC::MarkedBlock::Handle::flipIfNecessary):
2741         (JSC::MarkedBlock::Handle::flipIfNecessaryConcurrently):
2742         * heap/MarkedSpace.cpp:
2743         (JSC::MarkedSpace::flip):
2744         * heap/MarkedSpace.h:
2745         (JSC::MarkedSpace::version):
2746         * heap/SlotVisitor.cpp:
2747         (JSC::SlotVisitor::SlotVisitor):
2748         * heap/SlotVisitor.h:
2749
2750 2016-09-08  Mark Lam  <mark.lam@apple.com>
2751
2752         Add support for a ternary sub32 emitter for ARM64 and 32-bit ARM.
2753         https://bugs.webkit.org/show_bug.cgi?id=161724
2754
2755         Reviewed by Filip Pizlo.
2756
2757         ARM architectures support ternary sub instructions.  We should make use of them
2758         in emitAllocateWithNonNullAllocator().
2759
2760         * assembler/MacroAssemblerARM.h:
2761         (JSC::MacroAssemblerARM::sub32):
2762         * assembler/MacroAssemblerARM64.h:
2763         (JSC::MacroAssemblerARM64::sub32):
2764         * assembler/MacroAssemblerARMv7.h:
2765         (JSC::MacroAssemblerARMv7::sub32):
2766         * assembler/MacroAssemblerSH4.h:
2767         (JSC::MacroAssemblerSH4::sub32):
2768         * assembler/MacroAssemblerX86Common.h:
2769         (JSC::MacroAssemblerX86Common::sub32):
2770         * b3/air/AirOpcode.opcodes:
2771         * b3/testb3.cpp:
2772         (JSC::B3::testTernarySubInstructionSelection):
2773         (JSC::B3::run):
2774         * jit/AssemblyHelpers.h:
2775         (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
2776
2777 2016-09-08  Filip Pizlo  <fpizlo@apple.com>
2778
2779         Move JSMap/JSSet over to Auxiliary MarkedSpace
2780         https://bugs.webkit.org/show_bug.cgi?id=161744
2781
2782         Reviewed by Saam Barati.
2783
2784         This moves the buffer out of CopiedSpace and into Auxiliary MarkedSpace.
2785
2786         Also removes MapData.h/MapDataInlines.h since they are not used anywhere, but they still
2787         speak of CopiedSpace.
2788
2789         This is a purely mechanical change.
2790
2791         * JavaScriptCore.xcodeproj/project.pbxproj:
2792         * heap/CopyToken.h:
2793         * runtime/HashMapImpl.cpp:
2794         (JSC::HashMapImpl<HashMapBucket>::visitChildren):
2795         (JSC::HashMapImpl<HashMapBucket>::copyBackingStore): Deleted.
2796         * runtime/HashMapImpl.h:
2797         (JSC::HashMapBuffer::create):
2798         * runtime/JSMapIterator.cpp:
2799         * runtime/JSMapIterator.h:
2800         * runtime/JSSetIterator.cpp:
2801         * runtime/JSSetIterator.h:
2802         * runtime/MapBase.cpp:
2803         * runtime/MapData.h: Removed.
2804         * runtime/MapDataInlines.h: Removed.
2805         * runtime/MapPrototype.cpp:
2806         * runtime/SetConstructor.cpp:
2807         * runtime/SetPrototype.cpp:
2808         * runtime/VM.cpp:
2809
2810 2016-09-06  Filip Pizlo  <fpizlo@apple.com>
2811
2812         Typed arrays should use MarkedSpace instead of CopiedSpace
2813         https://bugs.webkit.org/show_bug.cgi?id=161100
2814
2815         Reviewed by Geoffrey Garen.
2816
2817         This moves typed array backing stores out of CopiedSpace and into Auxiliary MarkedSpace.
2818
2819         This is a purely mechanical change since Auxiliary MarkedSpace already knows how to do
2820         everything that typed arrays want.
2821
2822         * dfg/DFGOperations.cpp:
2823         (JSC::DFG::newTypedArrayWithSize):
2824         * dfg/DFGOperations.h:
2825         (JSC::DFG::operationNewTypedArrayWithSizeForType):
2826         * dfg/DFGSpeculativeJIT.cpp:
2827         (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
2828         * dfg/DFGSpeculativeJIT.h:
2829         (JSC::DFG::SpeculativeJIT::callOperation):
2830         (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage): Deleted.
2831         * ftl/FTLLowerDFGToB3.cpp:
2832         (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
2833         (JSC::FTL::DFG::LowerDFGToB3::initializeArrayElements):
2834         (JSC::FTL::DFG::LowerDFGToB3::splatWords):
2835         (JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorageAndGetEnd): Deleted.
2836         (JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorage): Deleted.
2837         * heap/CopyToken.h:
2838         * heap/SlotVisitor.cpp:
2839         (JSC::SlotVisitor::markAuxiliary):
2840         * jit/JITOperations.h:
2841         * runtime/JSArrayBufferView.cpp:
2842         (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
2843         (JSC::JSArrayBufferView::JSArrayBufferView):
2844         * runtime/JSArrayBufferView.h:
2845         * runtime/JSGenericTypedArrayView.h:
2846         * runtime/JSGenericTypedArrayViewInlines.h:
2847         (JSC::JSGenericTypedArrayView<Adaptor>::createWithFastVector):
2848         (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
2849         (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
2850         (JSC::JSGenericTypedArrayView<Adaptor>::copyBackingStore): Deleted.
2851
2852 2016-09-08  Per Arne Vollan  <pvollan@apple.com>
2853
2854         [Win64] Compile fixes.
2855         https://bugs.webkit.org/show_bug.cgi?id=161682
2856
2857         Reviewed by Brent Fulgham.
2858
2859         * dfg/DFGSpeculativeJIT64.cpp:
2860         (JSC::DFG::SpeculativeJIT::emitCall):
2861         * jit/JITCall.cpp:
2862         (JSC::JIT::compileOpCall):
2863         * runtime/ArrayConventions.cpp:
2864         (JSC::clearArrayMemset):
2865
2866 2016-09-08  Per Arne Vollan  <pvollan@apple.com>
2867
2868         [Win] Exception fuzz tests fail
2869         https://bugs.webkit.org/show_bug.cgi?id=140928
2870
2871         Reviewed by Mark Lam.
2872
2873         Flush stdout when throwing the exception to make sure the output comes before output in the exception handler.
2874         The tests depend on the output to stdout being written in the correct order.
2875
2876         * runtime/ExceptionFuzz.cpp:
2877         (JSC::doExceptionFuzzing):
2878
2879 2016-09-07  Simon Fraser  <simon.fraser@apple.com>
2880
2881         Enable the <meter> element on iOS
2882         https://bugs.webkit.org/show_bug.cgi?id=161714
2883         rdar://problem/8978410
2884
2885         Reviewed by Tim Horton.
2886
2887         Define ENABLE_METER_ELEMENT unconditionally now.
2888
2889         * Configurations/FeatureDefines.xcconfig:
2890
2891 2016-09-07  Joseph Pecoraro  <pecoraro@apple.com>
2892
2893         Modernize Debugger to use nullptr
2894         https://bugs.webkit.org/show_bug.cgi?id=161718
2895
2896         Reviewed by Mark Lam.
2897
2898         * debugger/Debugger.cpp:
2899         (JSC::Debugger::Debugger):
2900         (JSC::Debugger::~Debugger):
2901         (JSC::Debugger::detach):
2902         (JSC::Debugger::stepOutOfFunction):
2903         (JSC::Debugger::updateCallFrameAndPauseIfNeeded):
2904         * debugger/Debugger.h:
2905
2906 2016-09-07  Joseph Pecoraro  <pecoraro@apple.com>
2907
2908         Web Inspector: Remove always false case in Debugger
2909         https://bugs.webkit.org/show_bug.cgi?id=161717
2910
2911         Reviewed by Brian Burg.
2912
2913         * debugger/Debugger.cpp:
2914         (JSC::Debugger::didExecuteProgram):
2915         We would have earlier returned a few statements ago if this case was true.
2916         And we would have crashed in the previous statement if this case was true.
2917
2918 2016-09-07  Yusuke Suzuki  <utatane.tea@gmail.com>
2919
2920         Unreviewed, build fix after r205569
2921
2922         Tweak CMakeLists.txt
2923
2924         * CMakeLists.txt:
2925
2926 2016-09-07  Mark Lam  <mark.lam@apple.com>
2927
2928         Add CatchScope and force all exception checks to be via ThrowScope or CatchScope.
2929         https://bugs.webkit.org/show_bug.cgi?id=161498
2930
2931         Reviewed by Geoffrey Garen.
2932
2933         This patch refactors the ThrowScope class, and introduces a base ExceptionScope
2934         that ThrowScope extends.  A CatchScope which extends the ExceptionScope is also
2935         introduced.
2936
2937         ENABLE(THROW_SCOPE_VERIFICATION) is now renamed to ENABLE(EXCEPTION_SCOPE_VERIFICATION)
2938         which is a more suitable name now.
2939
2940         Note: exception scope verification is still disabled by default.  There are still
2941         many places that need to be fixed up or re-expressed in a way that is friendly
2942         to the verification.  I'll address those in subsequent patches.
2943
2944         After this patch, the code will statically enforce that:
2945         1. all calls to throwException() go through a ThrowScope.
2946         2. all calls to clearException() go through a CatchScope.
2947         3. all exception checks go through an ExceptionScope in the form of a ThrowScope
2948            or CatchScope.
2949
2950         A Summary of how to use ExceptionScopes
2951         =======================================
2952         1. If a function can throw a JS exception, it should declare a ThrowScope at the
2953            top of the function (as early as possible).
2954
2955         2. If a function can clear JS exceptions, it should declare a CatchScope at the
2956            top of the function (as early as possible).
2957
2958         Declaring a ThrowScope in a function means that the function may throw an exception
2959         that its caller will have to handle.  Declaring a CatchScope in a function means
2960         that the function intends to clear pending exceptions before returning to its
2961         caller.
2962
2963         For more details, see the notes below.
2964
2965         Everything you may want to know about ExceptionScopes
2966         =====================================================
2967         ExceptionScope verification works to simulate exception throws and detect cases
2968         where exception checks are missing.  The notes below will cover:
2969
2970             1. The VM::m_needExceptionCheck bit
2971             2. ThrowScopes and CatchScopes
2972             3. Verification of needed exception checks
2973             3. Checking Exceptions
2974             4. Simulating throws
2975             5. Using ThrowScope::release()
2976             6. Checking exceptions with ThrowScope::exception() / CatchScope::exception()
2977             7. Checking exceptions by checking callee results
2978             8. Debugging verification errors
2979
2980         1. The VM::m_needExceptionCheck bit
2981
2982            The VM has a m_needExceptionCheck bit that indicates when an exception may be
2983            thrown.  You can think of the m_needExceptionCheck bit being set as a simulated
2984            throw.
2985
2986         2. ThrowScopes and CatchScopes
2987
2988            Only ThrowScopes may throwException.  Only CatchScopes may catchException.
2989
2990            Every throw site must declare a ThrowScope instance using DECLARE_THROW_SCOPE
2991            at the top of its function (as early as possible) e.g.
2992
2993                 void foo(...)
2994                 {
2995                     auto scope = DECLARE_THROW_SCOPE(vm);
2996                     ...
2997                     throwException(exec, scope, ...);
2998                 }
2999
3000            Note: by convention, every throw helper function must take a ThrowScope argument
3001            instead of instantiating its own ThrowScope.  This allows the throw to be
3002            attributed to the client code rather than the throw helper itself.
3003
3004            Every catch site (i.e. a site that calls clearException()) must declare a
3005            CatchScope instance using DECLARE_CATCH_SCOPE at the top of its function.
3006
3007            If a function can both throw or clear exceptions, then the ThrowScope should
3008            be declared first so that it can simulate a throw to the function's caller.
3009
3010            Note: ThrowScope and CatchScope both extend ExceptionScope so that ThrowScopes
3011            can be aware if there's an enclosing CatchScope between it and the point where
3012            C++ code returns to JS code.  This is needed to determine if the ThrowScope
3013            should simulate a re-throw or not.  See (4) below for more details on returning
3014            to JS code.
3015
3016         3. Verification of needed exception checks
3017
3018            a. On construction, each ThrowScope and CatchScope will verify that
3019               VM::m_needExceptionCheck is not set.
3020
3021               This ensures that the caller of the current function has checked for exceptions
3022               where needed before doing more work which lead to calling the current function.
3023
3024            b. On destruction, each ThrowScope and CatchScope will verify that
3025               VM::m_needExceptionCheck is not set. This verification will be skipped if
3026               the ThrowScope has been released (see (5) below).
3027
3028               This ensures that the function that owns this exception scope is not missing
3029               any exception checks before returning.
3030
3031            c. When throwing an exception, the ThrowScope will verify that VM::m_needExceptionCheck
3032               is not already set, unless it's been ask to rethrow the same Exception object.
3033
3034         4. Simulating throws
3035
3036            Throws are simulated by setting the m_needExceptionCheck bit.
3037
3038            The bit will only be set in the ThrowScope destructor except when the ThrowScope
3039            detects the caller is a LLInt or JIT function.  LLInt or JIT functions will always
3040            check for exceptions after a host C++ function returns to it.  However, they will
3041            not clear the m_needExceptionCheck bit.
3042
3043            Hence, if the ThrowScope destructor detects the caller is a LLInt or JIT function,
3044            it will just skip the setting of the bit.
3045
3046            Note: it is not needed nor correct to set the m_needExceptionCheck bit in the
3047            throwException methods.  This is because, in practice, we always return
3048            immediately after throwing an exception.  It doesn't make sense to set the bit in
3049            the throw just to have to clear it immediately after before we do verification in
3050            the ThrowScope destructor.
3051
3052         5. Using ThrowScope::release()
3053
3054            Calling release() means that the scope is released from its obligation to
3055            verify the VM::m_needExceptionCheck bit on destruction.
3056
3057            release() should only be used at the bottom of a function if:
3058
3059            a. This function is going to let its caller check and handle the exception, e.g.
3060
3061                 void foo(...)
3062                 {
3063                     auto scope = DECLARE_THROW_SCOPE(vm);
3064                     auto result = goo(); // may throw.
3065
3066                     ... // Code that will are not affected by a pending exceptions.
3067
3068                     scope.release(); // tell the ThrowScope that the caller will handle the exception.
3069                     return result;
3070                 }
3071
3072            b. This function is going to do a tail call that may throw.
3073
3074                 void foo(...)
3075                 {
3076                     auto scope = DECLARE_THROW_SCOPE(vm);
3077                     ...
3078                     scope.release(); // tell the ThrowScope that the caller will handle the exception.
3079                     return goo(); // may throw.
3080                 }
3081
3082               release() should not be used in code paths that branch. For example:
3083
3084                 void foo(...)
3085                 {
3086                     auto scope = DECLARE_THROW_SCOPE(vm);
3087
3088                     auto result = goo1(); // may throw.
3089                     scope.release(); // WRONG !!! Don't do this.
3090                     if (result)
3091                         return;
3092
3093                     result = goo2(); // may throw.
3094                     ...
3095                     return result;
3096                 }
3097
3098             The above will result in a verification error in goo2()'s ThrowScope.  The
3099             proper way to fix this verification is to do either (6) or (7) below.
3100
3101          6. Checking exceptions with ThrowScope::exception() / CatchScope::exception()
3102
3103             ThrowScope/CatchScope::exception() returns the thrown Exception object if
3104             there is one pending.  Else, it returns nullptr.
3105
3106             It also clears the m_needExceptionCheck bit thereby indicating that we've
3107             satisfied the needed exception check.  For example,
3108
3109                 void foo(...)
3110                 {
3111                     auto scope = DECLARE_THROW_SCOPE(vm);
3112
3113                     auto result = goo1(); // may throw.
3114                     if (scope.exception())
3115                         return;
3116
3117                     result = goo2(); // may throw.
3118                     ...
3119                     return result;
3120                 }
3121
3122             But sometimes, for optimization reasons, we may choose to test the result of
3123             the callee function instead doing a load of the VM exception value.  See (7)
3124             below.
3125
3126          7. Checking exceptions by checking callee results
3127
3128             This approach should only be applied when it makes a difference to performance.
3129             If we need to do this, we should add an ASSERT() that invokes the scope's
3130             exception() method to verify the result.  Since exception scope verification
3131             is only done on DEBUG builds, this ASSERT will satisfy the verification
3132             requirements without impacting performance.  For example,
3133
3134                 void foo(...)
3135                 {
3136                     auto scope = DECLARE_THROW_SCOPE(vm);
3137
3138                     bool failed = goo1(); // may throw.
3139                     ASSERT(!!scope.exception() == failed)
3140                     if (failed)
3141                         return;
3142
3143                     result = goo2(); // may throw.
3144                     ...
3145                     return result;
3146                 }
3147
3148          8. Debugging verification errors
3149
3150             a. When verification fails, you will see a message followed by an assertion
3151                failure.  For example:
3152
3153             ERROR: Unchecked JS exception:
3154                 This scope can throw a JS exception: setUpCall @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1245
3155                     (ExceptionScope::m_recursionDepth was ...)
3156                 But the exception was unchecked as of this scope: varargsSetup @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1398
3157                     (ExceptionScope::m_recursionDepth was ...)
3158                 [ backtrace here ]
3159
3160                The message tells you that failure was detected at in varargsSetup() at
3161                LLIntSlowPaths.cpp line 1398, and that the missing exception check should
3162                have happened somewhere between the call to setUpCall() at LLIntSlowPaths.cpp
3163                line 1245 and it.
3164
3165                If that is insufficient information, you can ...
3166
3167             b. Dump simulated throws
3168
3169                Re-run the test case with JSC_dumpSimulatedThrows=true.  You will also see
3170                back traces at each simulated throw.
3171
3172             c. Narrowing down the source of a simulated throw
3173
3174                Another technique for narrowing down the source of simulated throws is by
3175                further dividing a function to smaller regions by separating each region
3176                with additional local throw scopes.  For example,
3177
3178                 ... // Region 1
3179                 { auto scope = DECLARE_THROW_SCOPE(vm); }
3180                 ... // Region 2
3181                 { auto scope = DECLARE_THROW_SCOPE(vm); }
3182                 ... // Region 3
3183
3184         * API/APIUtils.h:
3185         (handleExceptionIfNeeded):
3186         * CMakeLists.txt:
3187         * JavaScriptCore.xcodeproj/project.pbxproj:
3188         * bindings/ScriptFunctionCall.cpp:
3189         (Deprecated::ScriptFunctionCall::call):
3190         * bindings/ScriptValue.cpp:
3191         (Deprecated::ScriptValue::toString):
3192         * debugger/Debugger.cpp:
3193         (JSC::Debugger::pauseIfNeeded):
3194         * debugger/DebuggerCallFrame.cpp:
3195         (JSC::DebuggerCallFrame::evaluateWithScopeExtension):
3196         * dfg/DFGOSRExitCompiler.cpp:
3197         * dfg/DFGOperations.cpp:
3198         (JSC::DFG::operationPutByValInternal):
3199         * inspector/InjectedScriptManager.cpp:
3200         (Inspector::InjectedScriptManager::createInjectedScript):
3201         * inspector/JSGlobalObjectInspectorController.cpp:
3202         (Inspector::JSGlobalObjectInspectorController::reportAPIException):
3203         * inspector/JSInjectedScriptHost.cpp:
3204         (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
3205         (Inspector::JSInjectedScriptHost::getInternalProperties):
3206         (Inspector::JSInjectedScriptHost::weakMapEntries):
3207         (Inspector::JSInjectedScriptHost::weakSetEntries):
3208         (Inspector::JSInjectedScriptHost::iteratorEntries):
3209         * inspector/JSJavaScriptCallFrame.cpp:
3210         (Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
3211         * inspector/ScriptCallStackFactory.cpp:
3212         (Inspector::extractSourceInformationFromException):
3213         * interpreter/CachedCall.h:
3214         (JSC::CachedCall::CachedCall):
3215         * interpreter/CallFrame.h:
3216         (JSC::ExecState::clearException): Deleted.
3217         (JSC::ExecState::exception): Deleted.
3218         (JSC::ExecState::hadException): Deleted.
3219         (JSC::ExecState::lastException): Deleted.
3220         (JSC::ExecState::clearLastException): Deleted.
3221         * interpreter/Interpreter.cpp:
3222         (JSC::eval):
3223         (JSC::sizeOfVarargs):
3224         (JSC::notifyDebuggerOfUnwinding):
3225         (JSC::Interpreter::unwind):
3226         (JSC::Interpreter::execute):
3227         (JSC::Interpreter::executeCall):
3228         (JSC::Interpreter::executeConstruct):
3229         (JSC::Interpreter::prepareForRepeatCall):
3230         (JSC::Interpreter::debug):
3231         * interpreter/Interpreter.h:
3232         (JSC::SuspendExceptionScope::SuspendExceptionScope):
3233         * interpreter/ShadowChicken.cpp:
3234         (JSC::ShadowChicken::functionsOnStack):
3235         * jit/JITCode.cpp:
3236         (JSC::JITCode::execute):
3237         * jit/JITExceptions.cpp:
3238         (JSC::genericUnwind):
3239         * jit/JITOperations.cpp:
3240         (JSC::getByVal):
3241         * jsc.cpp:
3242         (WTF::ImpureGetter::getOwnPropertySlot):
3243         (GlobalObject::moduleLoaderResolve):
3244         (GlobalObject::moduleLoaderFetch):
3245         (functionCreateElement):
3246         (functionRun):
3247         (functionRunString):
3248         (functionLoad):
3249         (functionLoadString):
3250         (functionReadFile):
3251         (functionCheckSyntax):
3252         (functionSetRandomSeed):
3253         (functionLoadModule):
3254         (functionCreateBuiltin):
3255         (functionCheckModuleSyntax):
3256         (functionGenerateHeapSnapshot):
3257         (functionSamplingProfilerStackTraces):
3258         (dumpException):
3259         (checkUncaughtException):
3260         (runWithScripts):
3261         (runInteractive):
3262         * llint/LLIntExceptions.cpp:
3263         (JSC::LLInt::returnToThrow):
3264         (JSC::LLInt::callToThrow):
3265         * llint/LLIntSlowPaths.cpp:
3266         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3267         * profiler/ProfilerBytecodeSequence.cpp:
3268         (JSC::Profiler::BytecodeSequence::addSequenceProperties):
3269         * profiler/ProfilerCompilation.cpp:
3270         (JSC::Profiler::Compilation::toJS):
3271         * profiler/ProfilerDatabase.cpp:
3272         (JSC::Profiler::Database::toJS):
3273         * profiler/ProfilerOSRExitSite.cpp:
3274         (JSC::Profiler::OSRExitSite::toJS):
3275         * profiler/ProfilerOriginStack.cpp:
3276         (JSC::Profiler::OriginStack::toJS):
3277         * runtime/ArrayPrototype.cpp:
3278         (JSC::speciesConstructArray):
3279         (JSC::shift):
3280         (JSC::unshift):
3281         (JSC::arrayProtoFuncToString):
3282         (JSC::arrayProtoFuncToLocaleString):
3283         (JSC::slowJoin):
3284         (JSC::fastJoin):
3285         (JSC::arrayProtoFuncJoin):
3286         (JSC::arrayProtoFuncPop):
3287         (JSC::arrayProtoFuncPush):
3288         (JSC::arrayProtoFuncReverse):
3289         (JSC::arrayProtoFuncShift):
3290         (JSC::arrayProtoFuncSlice):
3291         (JSC::arrayProtoFuncSplice):
3292         (JSC::arrayProtoFuncUnShift):
3293         (JSC::arrayProtoFuncIndexOf):
3294         (JSC::arrayProtoFuncLastIndexOf):
3295         (JSC::moveElements):
3296         (JSC::concatAppendOne):
3297         (JSC::arrayProtoPrivateFuncConcatMemcpy):
3298         * runtime/BooleanConstructor.cpp:
3299         (JSC::constructWithBooleanConstructor):
3300         * runtime/CallData.cpp:
3301         (JSC::call):
3302         * runtime/CatchScope.cpp: Added.
3303         (JSC::CatchScope::CatchScope):
3304         (JSC::CatchScope::~CatchScope):
3305         * runtime/CatchScope.h: Added.
3306         (JSC::CatchScope::clearException):
3307         (JSC::CatchScope::CatchScope):
3308         * runtime/CommonSlowPaths.cpp:
3309         (JSC::SLOW_PATH_DECL):
3310         * runtime/CommonSlowPaths.h:
3311         (JSC::CommonSlowPaths::opIn):
3312         * runtime/CommonSlowPathsExceptions.cpp:
3313         (JSC::CommonSlowPaths::interpreterThrowInCaller):
3314         * runtime/Completion.cpp:
3315         (JSC::evaluate):
3316         (JSC::rejectPromise):
3317         (JSC::loadAndEvaluateModule):
3318         (JSC::loadModule):
3319         * runtime/ConsoleObject.cpp:
3320         (JSC::consoleProtoFuncAssert):
3321         (JSC::consoleProtoFuncProfile):
3322         (JSC::consoleProtoFuncProfileEnd):
3323         (JSC::consoleProtoFuncTakeHeapSnapshot):
3324         (JSC::consoleProtoFuncTime):
3325         (JSC::consoleProtoFuncTimeEnd):
3326         * runtime/DateConstructor.cpp:
3327         (JSC::constructDate):
3328         (JSC::dateParse):
3329         * runtime/DatePrototype.cpp:
3330         (JSC::dateProtoFuncToPrimitiveSymbol):
3331         (JSC::dateProtoFuncToJSON):
3332         * runtime/ErrorConstructor.cpp:
3333         (JSC::Interpreter::constructWithErrorConstructor):
3334         * runtime/ErrorInstance.cpp:
3335         (JSC::ErrorInstance::sanitizedToString):
3336         * runtime/ErrorPrototype.cpp:
3337         (JSC::errorProtoFuncToString):
3338         * runtime/ExceptionEventLocation.cpp: Added.
3339         (WTF::printInternal):
3340         * runtime/ExceptionEventLocation.h: Copied from Source/JavaScriptCore/runtime/ThrowScopeLocation.h.
3341         (JSC::ExceptionEventLocation::ExceptionEventLocation):
3342         (JSC::ThrowScopeLocation::ThrowScopeLocation): Deleted.
3343         * runtime/ExceptionHelpers.h:
3344         * runtime/ExceptionScope.cpp: Added.
3345         (JSC::ExceptionScope::ExceptionScope):
3346         (JSC::ExceptionScope::~ExceptionScope):
3347         * runtime/ExceptionScope.h: Added.
3348         (JSC::ExceptionScope::vm):
3349         (JSC::ExceptionScope::recursionDepth):
3350         (JSC::ExceptionScope::exception):
3351         (JSC::ExceptionScope::ExceptionScope):
3352         * runtime/FunctionConstructor.cpp:
3353         (JSC::constructFunctionSkippingEvalEnabledCheck):
3354         * runtime/FunctionPrototype.cpp:
3355         (JSC::functionProtoFuncBind):
3356         * runtime/GenericArgumentsInlines.h:
3357         (JSC::GenericArguments<Type>::copyToArguments):
3358         * runtime/GetterSetter.cpp:
3359         (JSC::callGetter):
3360         * runtime/InspectorInstrumentationObject.cpp:
3361         (JSC::inspectorInstrumentationObjectLog):
3362         * runtime/InternalFunction.cpp:
3363         (JSC::InternalFunction::createSubclassStructure):
3364         * runtime/IntlCollator.cpp:
3365         (JSC::IntlCollator::initializeCollator):
3366         (JSC::IntlCollator::createCollator):
3367         (JSC::IntlCollator::resolvedOptions):
3368         * runtime/IntlCollatorConstructor.cpp:
3369         (JSC::constructIntlCollator):
3370         (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
3371         * runtime/IntlCollatorPrototype.cpp:
3372         (JSC::IntlCollatorFuncCompare):
3373         (JSC::IntlCollatorPrototypeGetterCompare):
3374         * runtime/IntlDateTimeFormat.cpp:
3375         (JSC::toDateTimeOptionsAnyDate):
3376         (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
3377         (JSC::IntlDateTimeFormat::resolvedOptions):
3378         (JSC::IntlDateTimeFormat::format):
3379         * runtime/IntlDateTimeFormatConstructor.cpp:
3380         (JSC::constructIntlDateTimeFormat):
3381         (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
3382         * runtime/IntlDateTimeFormatPrototype.cpp:
3383         (JSC::IntlDateTimeFormatFuncFormatDateTime):
3384         (JSC::IntlDateTimeFormatPrototypeGetterFormat):
3385         * runtime/IntlNumberFormat.cpp:
3386         (JSC::IntlNumberFormat::initializeNumberFormat):
3387         (JSC::IntlNumberFormat::createNumberFormat):
3388         (JSC::IntlNumberFormat::resolvedOptions):
3389         * runtime/IntlNumberFormatConstructor.cpp:
3390         (JSC::constructIntlNumberFormat):
3391         (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
3392         * runtime/IntlNumberFormatPrototype.cpp:
3393         (JSC::IntlNumberFormatFuncFormatNumber):
3394         (JSC::IntlNumberFormatPrototypeGetterFormat):
3395         * runtime/IntlObject.cpp:
3396         (JSC::intlBooleanOption):
3397         (JSC::intlStringOption):
3398         (JSC::intlNumberOption):
3399         (JSC::canonicalizeLocaleList):
3400         (JSC::supportedLocales):
3401         * runtime/IntlObjectInlines.h:
3402         (JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):
3403         * runtime/IteratorOperations.cpp:
3404         (JSC::iteratorNext):
3405         (JSC::iteratorStep):
3406         (JSC::iteratorClose):
3407         (JSC::iteratorForIterable):
3408         * runtime/IteratorOperations.h:
3409         (JSC::forEachInIterable):
3410         * runtime/JSArray.cpp:
3411         (JSC::JSArray::pop):
3412         (JSC::JSArray::push):
3413         (JSC::JSArray::copyToArguments):
3414         * runtime/JSArrayBufferConstructor.cpp:
3415         (JSC::constructArrayBuffer):
3416         * runtime/JSArrayBufferPrototype.cpp:
3417         (JSC::arrayBufferProtoFuncSlice):
3418         * runtime/JSArrayInlines.h:
3419         (JSC::getLength):
3420         (JSC::toLength):
3421         * runtime/JSBoundFunction.cpp:
3422         (JSC::getBoundFunctionStructure):
3423         (JSC::JSBoundFunction::create):
3424         * runtime/JSCJSValue.cpp:
3425         (JSC::JSValue::putToPrimitive):
3426         (JSC::JSValue::putToPrimitiveByIndex):
3427         (JSC::JSValue::toStringSlowCase):
3428         * runtime/JSCJSValueInlines.h:
3429         (JSC::toPreferredPrimitiveType):
3430         (JSC::JSValue::getPropertySlot):
3431         (JSC::JSValue::equalSlowCaseInline):
3432         * runtime/JSDataViewPrototype.cpp:
3433         (JSC::getData):
3434         (JSC::setData):
3435         * runtime/JSFunction.cpp:
3436         (JSC::JSFunction::setFunctionName):
3437         * runtime/JSGenericTypedArrayView.h:
3438         (JSC::JSGenericTypedArrayView::setIndex):
3439         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
3440         (JSC::constructGenericTypedArrayViewFromIterator):
3441         (JSC::constructGenericTypedArrayViewWithArguments):
3442         (JSC::constructGenericTypedArrayView):
3443         * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
3444         (JSC::speciesConstruct):
3445         (JSC::genericTypedArrayViewProtoFuncCopyWithin):
3446         (JSC::genericTypedArrayViewProtoFuncIncludes):
3447         (JSC::genericTypedArrayViewProtoFuncIndexOf):
3448         (JSC::genericTypedArrayViewProtoFuncJoin):
3449         (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
3450         (JSC::genericTypedArrayViewProtoFuncSlice):
3451         (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
3452         * runtime/JSGlobalObject.h:
3453         (JSC::constructEmptyArray):
3454         (JSC::constructArray):
3455         (JSC::constructArrayNegativeIndexed):
3456         * runtime/JSGlobalObjectFunctions.cpp:
3457         (JSC::globalFuncEval):
3458         * runtime/JSJob.cpp:
3459         (JSC::JSJobMicrotask::run):
3460         * runtime/JSModuleEnvironment.cpp:
3461         (JSC::JSModuleEnvironment::getOwnPropertySlot):
3462         * runtime/JSModuleLoader.cpp:
3463         (JSC::JSModuleLoader::fetch):
3464         * runtime/JSModuleNamespaceObject.cpp:
3465         (JSC::JSModuleNamespaceObject::finishCreation):
3466         (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
3467         * runtime/JSModuleRecord.cpp:
3468         (JSC::JSModuleRecord::instantiateDeclarations):
3469         * runtime/JSONObject.cpp:
3470         (JSC::Stringifier::Stringifier):
3471         (JSC::Stringifier::stringify):
3472         (JSC::Stringifier::toJSON):
3473         (JSC::Stringifier::appendStringifiedValue):
3474         (JSC::Stringifier::Holder::appendNextProperty):
3475         (JSC::Walker::walk):
3476         (JSC::JSONProtoFuncParse):
3477         * runtime/JSObject.cpp:
3478         (JSC::ordinarySetSlow):
3479         (JSC::JSObject::setPrototypeWithCycleCheck):
3480         (JSC::callToPrimitiveFunction):
3481         (JSC::JSObject::ordinaryToPrimitive):
3482         (JSC::JSObject::defaultHasInstance):
3483         (JSC::JSObject::getPropertyNames):
3484         (JSC::JSObject::toNumber):
3485         (JSC::JSObject::toString):
3486         (JSC::JSObject::defineOwnNonIndexProperty):
3487         (JSC::JSObject::getGenericPropertyNames):
3488         (JSC::JSObject::getMethod):
3489         * runtime/JSObjectInlines.h:
3490         (JSC::createListFromArrayLike):
3491         (JSC::JSObject::getPropertySlot):
3492         (JSC::JSObject::getNonIndexPropertySlot):
3493         * runtime/JSPromiseConstructor.cpp:
3494         (JSC::constructPromise):
3495         * runtime/JSPropertyNameEnumerator.h:
3496         (JSC::propertyNameEnumerator):
3497         * runtime/JSPropertyNameIterator.cpp:
3498         (JSC::JSPropertyNameIterator::create):
3499         * runtime/JSScope.cpp:
3500         (JSC::isUnscopable):
3501         (JSC::JSScope::resolve):
3502         * runtime/JSString.cpp:
3503         (JSC::JSString::equalSlowCase):
3504         * runtime/JSStringJoiner.cpp:
3505         (JSC::JSStringJoiner::join):
3506         * runtime/LiteralParser.cpp:
3507         (JSC::LiteralParser<CharType>::parse):
3508         * runtime/MapConstructor.cpp:
3509         (JSC::constructMap):
3510         * runtime/MathObject.cpp:
3511         (JSC::mathProtoFuncClz32):
3512         (JSC::mathProtoFuncHypot):
3513         (JSC::mathProtoFuncIMul):
3514         * runtime/ModuleLoaderPrototype.cpp:
3515         (JSC::moduleLoaderPrototypeParseModule):
3516         (JSC::moduleLoaderPrototypeRequestedModules):
3517         (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
3518         * runtime/NativeErrorConstructor.cpp:
3519         (JSC::Interpreter::constructWithNativeErrorConstructor):
3520         * runtime/NumberConstructor.cpp:
3521         (JSC::constructWithNumberConstructor):
3522         * runtime/ObjectConstructor.cpp:
3523         (JSC::constructObject):
3524         (JSC::objectConstructorGetPrototypeOf):
3525         (JSC::objectConstructorSetPrototypeOf):
3526         (JSC::objectConstructorGetOwnPropertyDescriptor):
3527         (JSC::objectConstructorGetOwnPropertyDescriptors):
3528         (JSC::objectConstructorGetOwnPropertyNames):
3529         (JSC::objectConstructorGetOwnPropertySymbols):
3530         (JSC::objectConstructorKeys):
3531         (JSC::ownEnumerablePropertyKeys):
3532         (JSC::toPropertyDescriptor):
3533         (JSC::objectConstructorDefineProperty):
3534         (JSC::defineProperties):
3535         (JSC::objectConstructorSeal):
3536         (JSC::objectConstructorFreeze):
3537         (JSC::objectConstructorIsSealed):
3538         (JSC::objectConstructorIsFrozen):
3539         (JSC::objectConstructorIsExtensible):
3540         (JSC::ownPropertyKeys):
3541         * runtime/ObjectConstructor.h:
3542         (JSC::constructObjectFromPropertyDescriptor):
3543         * runtime/ObjectPrototype.cpp:
3544         (JSC::objectProtoFuncHasOwnProperty):
3545         (JSC::objectProtoFuncIsPrototypeOf):
3546         (JSC::objectProtoFuncDefineGetter):
3547         (JSC::objectProtoFuncDefineSetter):
3548         (JSC::objectProtoFuncLookupGetter):
3549         (JSC::objectProtoFuncLookupSetter):
3550         (JSC::objectProtoFuncPropertyIsEnumerable):
3551         (JSC::objectProtoFuncToLocaleString):
3552         (JSC::objectProtoFuncToString):
3553         * runtime/Operations.cpp:
3554         (JSC::jsAddSlowCase):
3555         * runtime/Options.h:
3556         * runtime/PropertyDescriptor.cpp:
3557         (JSC::PropertyDescriptor::slowGetterSetter):
3558         * runtime/ProxyConstructor.cpp:
3559         (JSC::makeRevocableProxy):
3560         * runtime/ProxyObject.cpp:
3561         (JSC::ProxyObject::toStringName):
3562         (JSC::performProxyGet):
3563         (JSC::ProxyObject::performGet):
3564         (JSC::ProxyObject::performInternalMethodGetOwnProperty):
3565         (JSC::ProxyObject::performHasProperty):
3566         (JSC::ProxyObject::performPut):
3567         (JSC::ProxyObject::putByIndexCommon):
3568         (JSC::performProxyCall):
3569         (JSC::performProxyConstruct):
3570         (JSC::ProxyObject::performDelete):
3571         (JSC::ProxyObject::performPreventExtensions):
3572         (JSC::ProxyObject::performIsExtensible):
3573         (JSC::ProxyObject::performDefineOwnProperty):
3574         (JSC::ProxyObject::performGetOwnPropertyNames):
3575         (JSC::ProxyObject::performSetPrototype):
3576         (JSC::ProxyObject::performGetPrototype):
3577         * runtime/ReflectObject.cpp:
3578         (JSC::reflectObjectConstruct):
3579         (JSC::reflectObjectDefineProperty):
3580         (JSC::reflectObjectGet):
3581         (JSC::reflectObjectGetOwnPropertyDescriptor):
3582         (JSC::reflectObjectIsExtensible):
3583         (JSC::reflectObjectPreventExtensions):
3584         (JSC::reflectObjectSet):
3585         (JSC::reflectObjectSetPrototypeOf):
3586         * runtime/RegExpConstructor.cpp:
3587         (JSC::toFlags):
3588         (JSC::regExpCreate):
3589         (JSC::constructRegExp):
3590         * runtime/RegExpConstructor.h:
3591         (JSC::isRegExp):
3592         * runtime/RegExpObject.cpp:
3593         (JSC::collectMatches):
3594         (JSC::RegExpObject::matchGlobal):
3595         * runtime/RegExpPrototype.cpp:
3596         (JSC::regExpProtoFuncCompile):
3597         (JSC::flagsString):
3598         (JSC::regExpProtoFuncToString):
3599         (JSC::regExpProtoGetterFlags):
3600         (JSC::regExpProtoFuncSearchFast):
3601         (JSC::regExpProtoFuncSplitFast):
3602         * runtime/SetConstructor.cpp:
3603         (JSC::constructSet):
3604         * runtime/StringConstructor.cpp:
3605         (JSC::stringFromCodePoint):
3606         (JSC::constructWithStringConstructor):
3607         * runtime/StringObject.cpp:
3608         (JSC::StringObject::defineOwnProperty):
3609         * runtime/StringPrototype.cpp:
3610         (JSC::replaceUsingRegExpSearch):
3611         (JSC::operationStringProtoFuncReplaceRegExpEmptyStr):
3612         (JSC::replaceUsingStringSearch):
3613         (JSC::replace):
3614         (JSC::stringProtoFuncReplaceUsingRegExp):
3615         (JSC::stringProtoFuncReplaceUsingStringSearch):
3616         (JSC::stringProtoFuncCodePointAt):
3617         (JSC::stringProtoFuncSlice):
3618         (JSC::stringProtoFuncSplitFast):
3619         (JSC::stringProtoFuncSubstr):
3620         (JSC::stringProtoFuncSubstring):
3621         (JSC::stringProtoFuncLocaleCompare):
3622         (JSC::toLocaleCase):
3623         (JSC::stringProtoFuncBig):
3624         (JSC::stringProtoFuncSmall):
3625         (JSC::stringProtoFuncBlink):
3626         (JSC::stringProtoFuncBold):
3627         (JSC::stringProtoFuncFixed):
3628         (JSC::stringProtoFuncItalics):
3629         (JSC::stringProtoFuncStrike):
3630         (JSC::stringProtoFuncSub):
3631         (JSC::stringProtoFuncSup):
3632         (JSC::stringProtoFuncFontcolor):
3633         (JSC::stringProtoFuncFontsize):
3634         (JSC::stringProtoFuncAnchor):
3635         (JSC::stringProtoFuncLink):
3636         (JSC::trimString):
3637         (JSC::stringProtoFuncStartsWith):
3638         (JSC::stringProtoFuncEndsWith):
3639         (JSC::stringIncludesImpl):
3640         (JSC::stringProtoFuncIncludes):
3641         (JSC::builtinStringIncludesInternal):
3642         (JSC::stringProtoFuncNormalize):
3643         * runtime/SymbolConstructor.cpp:
3644         (JSC::symbolConstructorFor):
3645         * runtime/TemplateRegistry.cpp:
3646         (JSC::TemplateRegistry::getTemplateObject):
3647         * runtime/ThrowScope.cpp:
3648         (JSC::ThrowScope::ThrowScope):
3649         (JSC::ThrowScope::~ThrowScope):
3650         (JSC::ThrowScope::throwException):
3651         (JSC::ThrowScope::simulateThrow):
3652         (JSC::ThrowScope::printIfNeedCheck): Deleted.
3653         (JSC::ThrowScope::verifyExceptionCheckNeedIsSatisfied): Deleted.
3654         * runtime/ThrowScope.h:
3655         (JSC::ThrowScope::release):
3656         (JSC::ThrowScope::ThrowScope):
3657         (JSC::ThrowScope::throwException):
3658         (JSC::ThrowScope::vm): Deleted.
3659         (JSC::ThrowScope::exception): Deleted.
3660         * runtime/ThrowScopeLocation.h: Removed.
3661         * runtime/VM.cpp:
3662         (JSC::VM::verifyExceptionCheckNeedIsSatisfied):
3663         * runtime/VM.h:
3664         (JSC::VM::exception):
3665         (JSC::VM::clearException):
3666         (JSC::VM::setException): Deleted.
3667         * runtime/WeakMapConstructor.cpp:
3668         (JSC::constructWeakMap):
3669         * runtime/WeakSetConstructor.cpp:
3670         (JSC::constructWeakSet):
3671         * tools/JSDollarVMPrototype.cpp:
3672         (JSC::functionPrint):
3673
3674 2016-09-07  Andy VanWagoner  <thetalecrafter@gmail.com>
3675
3676         [INTL] some valid language tags cause errors in Intl constructors
3677         https://bugs.webkit.org/show_bug.cgi?id=161672
3678
3679         Reviewed by Mark Lam.
3680
3681         Fix private use tag parsing to match spec, allowing single character parts.
3682         https://www.rfc-editor.org/rfc/bcp/bcp47.txt
3683
3684         ```
3685         privateuse    = "x" 1*("-" (1*8alphanum))
3686         ```
3687
3688         * runtime/IntlObject.cpp:
3689         (JSC::privateUseLangTag): Allow singleton parts in private use tag.
3690
3691 2016-09-07  Benjamin Poulain  <bpoulain@apple.com>
3692
3693         [JSC] Remove a couple of useless forward declaration
3694         https://bugs.webkit.org/show_bug.cgi?id=161676
3695
3696         Reviewed by Mark Lam.
3697
3698         JITMathICForwards.h should take care of declarating the Math ICs.
3699
3700         * bytecode/CodeBlock.h:
3701         * jit/JITOperations.h:
3702
3703 2016-09-07  Filip Pizlo  <fpizlo@apple.com>
3704
3705         Make emitAllocateWithNonNullAllocator's sub32() disallow-scratch-friendly
3706         https://bugs.webkit.org/show_bug.cgi?id=161706
3707
3708         Reviewed by Geoffrey Garen.
3709
3710         You can't sub32(Addr, Reg) on not-x86 without using a scratch register. So, on those CPUs, we
3711         have to do something different.
3712
3713         * jit/AssemblyHelpers.h:
3714         (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
3715
3716 2016-09-07  Michael Catanzaro  <mcatanzaro@igalia.com>
3717
3718         Unreviewed CMake build fix after r205552
3719
3720         * CMakeLists.txt:
3721
3722 2016-09-03  Keith Miller  <keith_miller@apple.com>
3723
3724         Add support for WASM Loops and Branches
3725         https://bugs.webkit.org/show_bug.cgi?id=161569
3726
3727         Reviewed by Benjamin Poulain.
3728
3729         This patch adds support for loops and branches to WASM. In order
3730         to support loops, we needed to change the way the B3IRGenerator
3731         tracked control information. Now, the control data holds three
3732         pieces of information: The continuation block, the loop branch
3733         target, and variables exiting the block. Whenever we branch to
3734         some control point we first check if it is a loop by checking that
3735         the loop branch target is non-null. If the branch is not targeting
3736         a loop, we map the stack values to the associated B3 variables for
3737         that stack slot.
3738
3739         Another interesting thing of note is that we now only allocate the
3740         continuation basic block lazily. This is beneficial when the
3741         continuation would just fall through to another block anyway. For
3742         example, in code like: (block ... (block (add 1 2) end) end) the
3743         continuation for the inner block just falls through to the outer
3744         block's continuation so we don't need an extra block.
3745
3746         * B3CallingConventions.cpp:
3747         (JSC::B3::jscCallingConvention): Deleted.
3748         * B3CallingConventions.h:
3749         (JSC::B3::CallingConvention::CallingConvention): Deleted.
3750         (JSC::B3::CallingConvention::iterate): Deleted.
3751         (JSC::B3::nextJSCOffset): Deleted.
3752         * JavaScriptCore.xcodeproj/project.pbxproj:
3753         * b3/B3Type.h:
3754         * testWASM.cpp:
3755         (runWASMTests):
3756         * wasm/WASMB3IRGenerator.cpp:
3757         (JSC::WASM::B3IRGenerator::LazyBlock::LazyBlock):
3758         (JSC::WASM::B3IRGenerator::LazyBlock::operator bool):
3759         (JSC::WASM::B3IRGenerator::LazyBlock::get):
3760         (JSC::WASM::B3IRGenerator::LazyBlock::dump):
3761         (JSC::WASM::B3IRGenerator::ControlData::ControlData):
3762         (JSC::WASM::B3IRGenerator::ControlData::dump):
3763         (JSC::WASM::B3IRGenerator::ControlData::targetBlockForBranch):
3764         (JSC::WASM::B3IRGenerator::ControlData::isLoop):
3765         (JSC::WASM::B3IRGenerator::addLocal):
3766         (JSC::WASM::B3IRGenerator::addArguments):
3767         (JSC::WASM::B3IRGenerator::setLocal):
3768         (JSC::WASM::B3IRGenerator::addBlock):
3769         (JSC::WASM::B3IRGenerator::addLoop):
3770         (JSC::WASM::B3IRGenerator::endBlock):
3771         (JSC::WASM::B3IRGenerator::addReturn):
3772         (JSC::WASM::B3IRGenerator::addBranch):
3773         (JSC::WASM::B3IRGenerator::initializeIncommingTypes):
3774         (JSC::WASM::B3IRGenerator::unifyValuesWithBlock):
3775         (JSC::WASM::B3IRGenerator::controlDataForLevel):
3776         (JSC::WASM::B3IRGenerator::dumpGraphAndControlStack):
3777         (JSC::WASM::parseAndCompile):
3778         (JSC::WASM::B3IRGenerator::unifyValuesWithLevel): Deleted.
3779         (JSC::WASM::B3IRGenerator::stackForControlLevel): Deleted.
3780         (JSC::WASM::B3IRGenerator::blockForControlLevel): Deleted.
3781         * wasm/WASMCallingConvention.cpp: Renamed from Source/JavaScriptCore/B3CallingConventions.cpp.
3782         (JSC::WASM::jscCallingConvention):
3783         * wasm/WASMCallingConvention.h: Renamed from Source/JavaScriptCore/B3CallingConventions.h.
3784         (JSC::WASM::CallingConvention::CallingConvention):
3785         (JSC::WASM::CallingConvention::iterate):
3786         (JSC::WASM::nextJSCOffset):
3787         * wasm/WASMFormat.h:
3788         (JSC::WASM::toB3Type):
3789         (JSC::WASM::isValueType):
3790         * wasm/WASMFunctionParser.h:
3791         (JSC::WASM::FunctionParser<Context>::parse):
3792         (JSC::WASM::FunctionParser<Context>::parseExpression):
3793         * wasm/WASMModuleParser.cpp:
3794         (JSC::WASM::ModuleParser::parseFunctionTypes):
3795         * wasm/WASMOps.h:
3796
3797 2016-09-07  Youenn Fablet  <youenn@apple.com>
3798
3799         [Streams API] Separate compile flag for ReadableStream and WritableStream
3800         https://bugs.webkit.org/show_bug.cgi?id=161044
3801
3802         Reviewed by Alex Christensen.
3803
3804         Moving from STREAMS_API to READABLE_STREAM_API and WRITABLE_STREAM_API compilation flags.
3805         Updated builtin test to cover the case of @conditional taking ENABLE(XX) || ENABLE(YY) flag.
3806
3807         * Configurations/FeatureDefines.xcconfig:
3808         * Scripts/tests/builtins/WebCore-GuardedInternalBuiltin-Separate.js:
3809         * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
3810         * Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result:
3811
3812 2016-09-07  Csaba Osztrogonác  <ossy@webkit.org>
3813
3814         Fix the ENABLE(WEBASSEMBLY) build on Linux
3815         https://bugs.webkit.org/show_bug.cgi?id=161685
3816
3817         Unreviewed buildfix.
3818
3819         * wasm/JSWASMModule.cpp:
3820
3821 2016-09-06  Saam Barati  <sbarati@apple.com>
3822
3823         ProxyObject's structure should not have ObjectPrototype as its prototype and it should not have special behavior for intercepting "__proto__"
3824         https://bugs.webkit.org/show_bug.cgi?id=161558
3825
3826         Reviewed by Benjamin Poulain.
3827
3828         ProxyObject had ObjectPrototype as its direct prototype.
3829         This could lead to infinite loops when doing a getDirectPrototype()
3830         loop.
3831
3832         Fixing this bug revealed another bug, which I made when implementing Proxy.
3833         We should not special case "__proto__" in get and set for Proxy Object's
3834         hooks. "__proto__" should just go through the normal set and get path.
3835
3836         * runtime/JSGlobalObject.cpp:
3837         (JSC::JSGlobalObject::init):
3838         * runtime/ProxyObject.cpp:
3839         (JSC::performProxyGet):
3840         (JSC::ProxyObject::put):
3841
3842 2016-09-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3843
3844         Make JSC::PrivateName copyable
3845         https://bugs.webkit.org/show_bug.cgi?id=161666
3846
3847         Reviewed by Ryosuke Niwa.
3848
3849         Define the custom copy constructor to make PrivateName copyable while using Ref<SymbolImpl>.
3850         And since the custom copy constructor deletes the default move constructor, we explcitly define
3851         it by `= default;`.
3852
3853         * runtime/PrivateName.h:
3854         (JSC::PrivateName::PrivateName):
3855
3856 2016-09-06  Daniel Bates  <dabates@apple.com>
3857
3858         [iOS] Build fails in JSCLLIntOffsetsExtractor - Ad Hoc code signing is not allowed with SDK 'Simulator - iOS 10.0'
3859         https://bugs.webkit.org/show_bug.cgi?id=161296
3860
3861         Reviewed by Dan Bernstein.
3862
3863         Allow ad-hoc code signing when building JavaScriptCore command line tools for simulator
3864         with the iOS 10 beta SDK.
3865
3866         * Configurations/Base.xcconfig:
3867
3868 2016-09-06  Saam Barati  <sbarati@apple.com>
3869
3870         Unreviewed build fix for 32-bit platforms after r205520.
3871
3872         * dfg/DFGSpeculativeJIT.h:
3873         (JSC::DFG::SpeculativeJIT::callOperation): Deleted.
3874
3875 2016-09-06  Saam Barati  <sbarati@apple.com>
3876
3877         Member call on NULL pointer in JavaScriptCore/dfg/DFGAbstractInterpretterInlines.h
3878         https://bugs.webkit.org/show_bug.cgi?id=160870
3879