DFG should inline code blocks that use scoped variable access
[WebKit-https.git] / Source / JavaScriptCore / ChangeLog
1 2012-12-03  Filip Pizlo  <fpizlo@apple.com>
2
3         DFG should inline code blocks that use scoped variable access
4         https://bugs.webkit.org/show_bug.cgi?id=103974
5
6         Reviewed by Oliver Hunt.
7
8         This mostly just turns on something we could have done all along, but also adds a few key
9         necessities to make this right:
10         
11         1) Constant folding of SkipScope, since if we inline with a known JSFunction* then the
12            scope is constant.
13         
14         2) Interference analysis for GetLocal<->PutScopedVar and SetLocal<->GetScopedVar.
15         
16         This is not meant to be a speed-up on major benchmarks since we don't yet inline most
17         closure calls for entirely unrelated reasons. But on toy programs it can be >2x faster.
18
19         * dfg/DFGAbstractState.cpp:
20         (JSC::DFG::AbstractState::execute):
21         * dfg/DFGByteCodeParser.cpp:
22         (JSC::DFG::ByteCodeParser::getScope):
23         (JSC::DFG::ByteCodeParser::parseResolveOperations):
24         * dfg/DFGCSEPhase.cpp:
25         (JSC::DFG::CSEPhase::scopedVarLoadElimination):
26         (JSC::DFG::CSEPhase::scopedVarStoreElimination):
27         (JSC::DFG::CSEPhase::getLocalLoadElimination):
28         (JSC::DFG::CSEPhase::setLocalStoreElimination):
29         * dfg/DFGCapabilities.h:
30         (JSC::DFG::canInlineResolveOperations):
31
32 2012-12-03  Filip Pizlo  <fpizlo@apple.com>
33
34         Replace JSValue::description() with JSValue::dump(PrintStream&)
35         https://bugs.webkit.org/show_bug.cgi?id=103866
36
37         Reviewed by Darin Adler.
38
39         JSValue now has a dump() method. Anywhere that you would have wanted to use
40         description(), you can either do toCString(value).data(), or if the callee
41         is a print()/dataLog() method then you just pass the value directly.
42
43         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
44         * bytecode/CodeBlock.cpp:
45         (JSC::valueToSourceString):
46         (JSC::CodeBlock::finalizeUnconditionally):
47         * bytecode/ValueProfile.h:
48         (JSC::ValueProfileBase::dump):
49         * bytecode/ValueRecovery.h:
50         (JSC::ValueRecovery::dump):
51         * dfg/DFGAbstractValue.h:
52         (JSC::DFG::AbstractValue::dump):
53         * dfg/DFGGraph.cpp:
54         (JSC::DFG::Graph::dump):
55         * interpreter/Interpreter.cpp:
56         (JSC::Interpreter::dumpRegisters):
57         * jsc.cpp:
58         (functionDescribe):
59         * llint/LLIntSlowPaths.cpp:
60         (JSC::LLInt::llint_trace_value):
61         * runtime/JSValue.cpp:
62         (JSC::JSValue::dump):
63         * runtime/JSValue.h:
64
65 2012-12-04  Filip Pizlo  <fpizlo@apple.com>
66
67         jsc command line tool's support for typed arrays should be robust against array buffer allocation errors
68         https://bugs.webkit.org/show_bug.cgi?id=104020
69         <rdar://problem/12802478>
70
71         Reviewed by Mark Hahnenberg.
72
73         Check for null buffers, since that's what typed array allocators are supposed to do. WebCore does it,
74         and that is indeed the contract of ArrayBuffer and TypedArrayBase.
75
76         * JSCTypedArrayStubs.h:
77         (JSC):
78
79 2012-12-03  Peter Rybin  <prybin@chromium.org>
80
81         Web Inspector: make ASSERTION FAILED: foundPropertiesCount == object->size() more useful
82         https://bugs.webkit.org/show_bug.cgi?id=103254
83
84         Reviewed by Pavel Feldman.
85
86         Missing symbol WTFReportFatalError is added to the linker list.
87
88         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
89
90 2012-12-03  Alexis Menard  <alexis@webkit.org>
91
92         [Mac] Enable CSS3 background-position offset by default.
93         https://bugs.webkit.org/show_bug.cgi?id=103905
94
95         Reviewed by Simon Fraser.
96
97         Turn the flag on by default.
98
99         * Configurations/FeatureDefines.xcconfig:
100
101 2012-12-02  Filip Pizlo  <fpizlo@apple.com>
102
103         DFG should trigger rage conversion from double to contiguous if it sees a GetByVal on Double being used in an integer context
104         https://bugs.webkit.org/show_bug.cgi?id=103858
105
106         Reviewed by Gavin Barraclough.
107
108         A rage conversion from double to contiguous is one where you try to convert each
109         double to an int32.
110
111         This is probably not the last we'll hear of rage conversion from double to contiguous.
112         It may be better to do this right during parsing, which will result in fewer cases of
113         Arrayification. But even so, this looks like a straight win already - 1% speed-up on
114         Kraken, no major regression anywhere else.
115
116         * dfg/DFGAbstractState.cpp:
117         (JSC::DFG::AbstractState::execute):
118         * dfg/DFGArrayMode.cpp:
119         (JSC::DFG::ArrayMode::refine):
120         (JSC::DFG::arrayConversionToString):
121         (JSC::DFG::ArrayMode::dump):
122         (WTF):
123         (WTF::printInternal):
124         * dfg/DFGArrayMode.h:
125         (JSC::DFG::ArrayMode::withConversion):
126         (ArrayMode):
127         (JSC::DFG::ArrayMode::doesConversion):
128         (WTF):
129         * dfg/DFGFixupPhase.cpp:
130         (JSC::DFG::FixupPhase::fixupBlock):
131         (JSC::DFG::FixupPhase::fixupNode):
132         (JSC::DFG::FixupPhase::checkArray):
133         (FixupPhase):
134         * dfg/DFGGraph.cpp:
135         (JSC::DFG::Graph::dump):
136         * dfg/DFGNodeFlags.h:
137         (DFG):
138         * dfg/DFGOperations.cpp:
139         * dfg/DFGOperations.h:
140         * dfg/DFGPredictionPropagationPhase.cpp:
141         (JSC::DFG::PredictionPropagationPhase::propagate):
142         * dfg/DFGSpeculativeJIT.cpp:
143         (JSC::DFG::SpeculativeJIT::arrayify):
144         * dfg/DFGStructureCheckHoistingPhase.cpp:
145         (JSC::DFG::StructureCheckHoistingPhase::run):
146         * runtime/JSObject.cpp:
147         (JSC):
148         (JSC::JSObject::genericConvertDoubleToContiguous):
149         (JSC::JSObject::convertDoubleToContiguous):
150         (JSC::JSObject::rageConvertDoubleToContiguous):
151         (JSC::JSObject::ensureContiguousSlow):
152         (JSC::JSObject::rageEnsureContiguousSlow):
153         * runtime/JSObject.h:
154         (JSObject):
155         (JSC::JSObject::rageEnsureContiguous):
156
157 2012-12-02  Filip Pizlo  <fpizlo@apple.com>
158
159         DFG CSE should not keep alive things that aren't relevant to OSR
160         https://bugs.webkit.org/show_bug.cgi?id=103849
161
162         Reviewed by Oliver Hunt.
163
164         Most Phantom nodes are inserted by CSE, and by default have the same children as the
165         node that CSE had eliminated. This change makes CSE inspect all Phantom nodes (both
166         those it creates and those that were created by other phases) to see if they have
167         children that are redundant - i.e. children that are not interesting to OSR, which
168         is the only reason why Phantoms exist in the first place. Being relevant to OSR is
169         defined as one of: (1) you're a Phi, (2) you're a SetLocal, (3) somewhere between
170         your definition and the Phantom there was a SetLocal that referred to you.
171         
172         This is a slight speed-up in a few places.
173
174         * dfg/DFGCSEPhase.cpp:
175         (JSC::DFG::CSEPhase::CSEPhase):
176         (JSC::DFG::CSEPhase::run):
177         (JSC::DFG::CSEPhase::performSubstitution):
178         (CSEPhase):
179         (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
180         (JSC::DFG::CSEPhase::setReplacement):
181         (JSC::DFG::CSEPhase::eliminate):
182         (JSC::DFG::CSEPhase::performNodeCSE):
183         (JSC::DFG::CSEPhase::performBlockCSE):
184
185 2012-12-02  Filip Pizlo  <fpizlo@apple.com>
186
187         It should be possible to build and run with DFG_ENABLE(PROPAGATION_VERBOSE)
188         https://bugs.webkit.org/show_bug.cgi?id=103848
189
190         Reviewed by Sam Weinig.
191
192         Fix random dataLog() and print() statements.
193
194         * dfg/DFGArgumentsSimplificationPhase.cpp:
195         (JSC::DFG::ArgumentsSimplificationPhase::run):
196         * dfg/DFGByteCodeParser.cpp:
197         (JSC::DFG::ByteCodeParser::parseCodeBlock):
198         * dfg/DFGGraph.cpp:
199         (JSC::DFG::Graph::dumpBlockHeader):
200         * dfg/DFGPredictionPropagationPhase.cpp:
201         (JSC::DFG::PredictionPropagationPhase::propagate):
202         * dfg/DFGStructureCheckHoistingPhase.cpp:
203         (JSC::DFG::StructureCheckHoistingPhase::run):
204
205 2012-12-01  Filip Pizlo  <fpizlo@apple.com>
206
207         CodeBlock should be able to dump bytecode to something other than WTF::dataFile()
208         https://bugs.webkit.org/show_bug.cgi?id=103832
209
210         Reviewed by Oliver Hunt.
211
212         Add a PrintStream& argument to all of the CodeBlock bytecode dumping methods.
213
214         * bytecode/CodeBlock.cpp:
215         (JSC::CodeBlock::dumpBytecodeCommentAndNewLine):
216         (JSC::CodeBlock::printUnaryOp):
217         (JSC::CodeBlock::printBinaryOp):
218         (JSC::CodeBlock::printConditionalJump):
219         (JSC::CodeBlock::printGetByIdOp):
220         (JSC::dumpStructure):
221         (JSC::dumpChain):
222         (JSC::CodeBlock::printGetByIdCacheStatus):
223         (JSC::CodeBlock::printCallOp):
224         (JSC::CodeBlock::printPutByIdOp):
225         (JSC::CodeBlock::printStructure):
226         (JSC::CodeBlock::printStructures):
227         (JSC::CodeBlock::dumpBytecode):
228         * bytecode/CodeBlock.h:
229         (CodeBlock):
230         * jit/JITDisassembler.cpp:
231         (JSC::JITDisassembler::dumpForInstructions):
232
233 2012-11-30  Pierre Rossi  <pierre.rossi@gmail.com>
234
235         [Qt] Unreviewed speculative Mac build fix after r136232
236
237         Update the include path so that LLIntAssembly.h is picked up.
238         The bot didn't break until later when a clean build was triggered.
239
240         * JavaScriptCore.pri:
241
242 2012-11-30  Oliver Hunt  <oliver@apple.com>
243
244         Optimise more cases of op_typeof
245         https://bugs.webkit.org/show_bug.cgi?id=103783
246
247         Reviewed by Mark Hahnenberg.
248
249         Increase our coverage of typeof based typechecks by
250         making sure that the codegenerators always uses
251         consistent operand ordering when feeding typeof operations
252         into equality operations.
253
254         * bytecompiler/NodesCodegen.cpp:
255         (JSC::BinaryOpNode::emitBytecode):
256         (JSC::EqualNode::emitBytecode):
257         (JSC::StrictEqualNode::emitBytecode):
258
259 2012-11-30  Filip Pizlo  <fpizlo@apple.com>
260
261         Rationalize and clean up DFG handling of scoped accesses
262         https://bugs.webkit.org/show_bug.cgi?id=103715
263
264         Reviewed by Oliver Hunt.
265
266         Previously, we had a GetScope node that specified the depth to which you wanted
267         to travel to get a JSScope, and the backend implementation of the node would
268         perform all of the necessary footwork, including potentially skipping the top
269         scope if necessary, and doing however many loads were needed. But there were
270         strange things. First, if you had accesses at different scope depths, then the
271         loads to get to the common depth could not be CSE'd - CSE would match only
272         GetScope's that had identical depth. Second, GetScope would be emitted even if
273         we already had the scope, for example in put_to_base. And finally, even though
274         the ResolveOperations could tell us whether or not we had to skip the top scope,
275         the backend would recompute this information itself, often pessimistically.
276         
277         This eliminates GetScope and replaces it with the following:
278         
279         GetMyScope: just get the JSScope from the call frame header. This will forever
280         mean getting the JSScope associated with the machine call frame; it will not
281         mean getting the scope of an inlined function. Or at least that's the intent.
282         
283         SkipTopScope: check if there is an activation, and if so, skip a scope. This
284         takes a scope as a child and returns a scope.
285         
286         SkipScope: skip one scope level.
287         
288         The bytecode parser now emits the right combination of the above, and
289         potentially emits multiple SkipScope's, based on the ResolveOperations.
290         
291         This change also includes some fixups to debug logging. We now always print
292         the ExecutableBase* in addition to the CodeBlock* in the CodeBlock's dump,
293         and we are now more verbose when dumping CodeOrigins and InlineCallFrames.
294         
295         This is performance-neutral. It's just meant to be a clean-up.
296
297         * bytecode/CodeBlock.cpp:
298         (JSC::CodeBlock::dumpAssumingJITType):
299         * bytecode/CodeOrigin.cpp:
300         (JSC::CodeOrigin::inlineStack):
301         (JSC::CodeOrigin::dump):
302         (JSC):
303         (JSC::InlineCallFrame::dump):
304         * bytecode/CodeOrigin.h:
305         (CodeOrigin):
306         (InlineCallFrame):
307         * dfg/DFGAbstractState.cpp:
308         (JSC::DFG::AbstractState::execute):
309         * dfg/DFGByteCodeParser.cpp:
310         (ByteCodeParser):
311         (JSC::DFG::ByteCodeParser::getScope):
312         (DFG):
313         (JSC::DFG::ByteCodeParser::parseResolveOperations):
314         (JSC::DFG::ByteCodeParser::parseBlock):
315         * dfg/DFGCSEPhase.cpp:
316         (JSC::DFG::CSEPhase::scopedVarLoadElimination):
317         (JSC::DFG::CSEPhase::scopedVarStoreElimination):
318         (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
319         (JSC::DFG::CSEPhase::setLocalStoreElimination):
320         (JSC::DFG::CSEPhase::performNodeCSE):
321         * dfg/DFGDisassembler.cpp:
322         (JSC::DFG::Disassembler::dump):
323         * dfg/DFGGraph.cpp:
324         (JSC::DFG::Graph::dumpCodeOrigin):
325         (JSC::DFG::Graph::dumpBlockHeader):
326         * dfg/DFGNode.h:
327         (Node):
328         * dfg/DFGNodeType.h:
329         (DFG):
330         * dfg/DFGPredictionPropagationPhase.cpp:
331         (JSC::DFG::PredictionPropagationPhase::propagate):
332         * dfg/DFGSpeculativeJIT32_64.cpp:
333         (JSC::DFG::SpeculativeJIT::compile):
334         * dfg/DFGSpeculativeJIT64.cpp:
335         (JSC::DFG::SpeculativeJIT::compile):
336         * jit/JITDisassembler.cpp:
337         (JSC::JITDisassembler::dump):
338
339 2012-11-30  Oliver Hunt  <oliver@apple.com>
340
341         Add direct string->function code cache
342         https://bugs.webkit.org/show_bug.cgi?id=103764
343
344         Reviewed by Michael Saboff.
345
346         A fairly logically simple patch.  We now track the start of the
347         unique portion of a functions body, and use that as our key for
348         unlinked function code.  This allows us to cache identical code
349         in different contexts, leading to a small but consistent improvement
350         on the benchmarks we track.
351
352         * bytecode/UnlinkedCodeBlock.cpp:
353         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
354         * bytecode/UnlinkedCodeBlock.h:
355         (JSC::UnlinkedFunctionExecutable::functionStartOffset):
356         (UnlinkedFunctionExecutable):
357         * parser/ASTBuilder.h:
358         (ASTBuilder):
359         (JSC::ASTBuilder::setFunctionStart):
360         * parser/Nodes.cpp:
361         * parser/Nodes.h:
362         (JSC::FunctionBodyNode::setFunctionStart):
363         (JSC::FunctionBodyNode::functionStart):
364         (FunctionBodyNode):
365         * parser/Parser.cpp:
366         (JSC::::parseFunctionInfo):
367         * parser/Parser.h:
368         (JSC::Parser::findCachedFunctionInfo):
369         * parser/SyntaxChecker.h:
370         (JSC::SyntaxChecker::setFunctionStart):
371         * runtime/CodeCache.cpp:
372         (JSC::CodeCache::generateFunctionCodeBlock):
373         (JSC::CodeCache::getFunctionCodeBlock):
374         (JSC::CodeCache::usedFunctionCode):
375         * runtime/CodeCache.h:
376
377 2012-11-30  Allan Sandfeld Jensen  <allan.jensen@digia.com>
378
379         Crash in conversion of empty OpaqueJSString to Identifier 
380         https://bugs.webkit.org/show_bug.cgi?id=101867
381
382         Reviewed by Michael Saboff.
383
384         The constructor call used for both null and empty OpaqueJSStrings results
385         in an assertion voilation and crash. This patch instead uses the Identifier
386         constructors which are specifically for null and empty Identifier.
387
388         * API/OpaqueJSString.cpp:
389         (OpaqueJSString::identifier):
390
391 2012-11-30  Tor Arne Vestbø  <tor.arne.vestbo@digia.com>
392
393         [Qt] Place the LLIntOffsetsExtractor binaries in debug/release subdirs on Mac
394
395         Otherwise we'll end up using the same LLIntAssembly.h for both build
396         configs of JavaScriptCore -- one of them which will be for the wrong
397         config.
398
399         Reviewed by Simon Hausmann.
400
401         * LLIntOffsetsExtractor.pro:
402
403 2012-11-30  Julien BRIANCEAU   <jbrianceau@nds.com>
404
405         [sh4] Fix compilation warnings in JavaScriptCore JIT for sh4 arch
406         https://bugs.webkit.org/show_bug.cgi?id=103378
407
408         Reviewed by Filip Pizlo.
409
410         * assembler/MacroAssemblerSH4.h:
411         (JSC::MacroAssemblerSH4::branchTest32):
412         (JSC::MacroAssemblerSH4::branchAdd32):
413         (JSC::MacroAssemblerSH4::branchMul32):
414         (JSC::MacroAssemblerSH4::branchSub32):
415         (JSC::MacroAssemblerSH4::branchOr32):
416
417 2012-11-29  Rafael Weinstein  <rafaelw@chromium.org>
418
419         [HTMLTemplateElement] Add feature flag
420         https://bugs.webkit.org/show_bug.cgi?id=103694
421
422         Reviewed by Adam Barth.
423
424         This flag will guard the implementation of the HTMLTemplateElement.
425         http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/templates/index.html
426
427         * Configurations/FeatureDefines.xcconfig:
428
429 2012-11-29  Filip Pizlo  <fpizlo@apple.com>
430
431         It should be easy to find code blocks in debug dumps
432         https://bugs.webkit.org/show_bug.cgi?id=103623
433
434         Reviewed by Goeffrey Garen.
435
436         This gives CodeBlock a relatively strong, but also relatively compact, hash. We compute
437         it lazily so that it only impacts run-time when debug support is enabled. We stringify
438         it smartly so that it's short and easy to type. We base it on the source code so that
439         the optimization level is irrelevant. And, we use SHA1 since it's already in our code
440         base. Now, when a piece of code wants to print some debugging to say that it's operating
441         on some code block, it can use this CodeBlockHash instead of memory addresses.
442
443         This also takes CodeBlock debugging into the new world of print() and dataLog(). In
444         particular, CodeBlock::dump() corresponds to the thing you want printed if you do:
445
446         dataLog("I heart ", *myCodeBlock);
447
448         Probably, you want to just print some identifying information at this point rather than
449         the full bytecode dump. So, the existing CodeBlock::dump() has been renamed to
450         CodeBlock::dumpBytecode(), and CodeBlock::dump() now prints the CodeBlockHash plus just
451         a few little tidbits.
452         
453         Here's an example of CodeBlock::dump() output:
454         
455         EkILzr:[0x103883a00, BaselineFunctionCall]
456         
457         EkILzr is the CodeBlockHash. 0x103883a00 is the CodeBlock's address in memory. The other
458         part is self-explanatory.
459
460         Finally, this new notion of CodeBlockHash is available for other purposes like bisecting
461         breakage. As such CodeBlockHash has all of the comparison operator overloads. When
462         bisecting in DFGDriver.cpp, you can now say things like:
463         
464         if (codeBlock->hash() < CodeBlockHash("CAAAAA"))
465             return false;
466         
467         And yes, CAAAAA is near the median hash, and the largest one is smaller than E99999. Such
468         is life when you use base 62 to encode a 32-bit number.
469
470         * CMakeLists.txt:
471         * GNUmakefile.list.am:
472         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
473         * JavaScriptCore.xcodeproj/project.pbxproj:
474         * Target.pri:
475         * bytecode/CallLinkInfo.h:
476         (CallLinkInfo):
477         (JSC::CallLinkInfo::specializationKind):
478         * bytecode/CodeBlock.cpp:
479         (JSC::CodeBlock::hash):
480         (JSC):
481         (JSC::CodeBlock::dumpAssumingJITType):
482         (JSC::CodeBlock::dump):
483         (JSC::CodeBlock::dumpBytecode):
484         (JSC::CodeBlock::CodeBlock):
485         (JSC::CodeBlock::finalizeUnconditionally):
486         (JSC::CodeBlock::resetStubInternal):
487         (JSC::CodeBlock::reoptimize):
488         (JSC::ProgramCodeBlock::jettison):
489         (JSC::EvalCodeBlock::jettison):
490         (JSC::FunctionCodeBlock::jettison):
491         (JSC::CodeBlock::shouldOptimizeNow):
492         (JSC::CodeBlock::tallyFrequentExitSites):
493         (JSC::CodeBlock::dumpValueProfiles):
494         * bytecode/CodeBlock.h:
495         (JSC::CodeBlock::specializationKind):
496         (CodeBlock):
497         (JSC::CodeBlock::getJITType):
498         * bytecode/CodeBlockHash.cpp: Added.
499         (JSC):
500         (JSC::CodeBlockHash::CodeBlockHash):
501         (JSC::CodeBlockHash::dump):
502         * bytecode/CodeBlockHash.h: Added.
503         (JSC):
504         (CodeBlockHash):
505         (JSC::CodeBlockHash::CodeBlockHash):
506         (JSC::CodeBlockHash::hash):
507         (JSC::CodeBlockHash::operator==):
508         (JSC::CodeBlockHash::operator!=):
509         (JSC::CodeBlockHash::operator<):
510         (JSC::CodeBlockHash::operator>):
511         (JSC::CodeBlockHash::operator<=):
512         (JSC::CodeBlockHash::operator>=):
513         * bytecode/CodeBlockWithJITType.h: Added.
514         (JSC):
515         (CodeBlockWithJITType):
516         (JSC::CodeBlockWithJITType::CodeBlockWithJITType):
517         (JSC::CodeBlockWithJITType::dump):
518         * bytecode/CodeOrigin.cpp: Added.
519         (JSC):
520         (JSC::CodeOrigin::inlineDepthForCallFrame):
521         (JSC::CodeOrigin::inlineDepth):
522         (JSC::CodeOrigin::inlineStack):
523         (JSC::InlineCallFrame::hash):
524         * bytecode/CodeOrigin.h:
525         (InlineCallFrame):
526         (JSC::InlineCallFrame::specializationKind):
527         (JSC):
528         * bytecode/CodeType.cpp: Added.
529         (WTF):
530         (WTF::printInternal):
531         * bytecode/CodeType.h:
532         (WTF):
533         * bytecode/ExecutionCounter.cpp:
534         (JSC::ExecutionCounter::dump):
535         * bytecode/ExecutionCounter.h:
536         (ExecutionCounter):
537         * dfg/DFGByteCodeParser.cpp:
538         (JSC::DFG::ByteCodeParser::parseCodeBlock):
539         * dfg/DFGDisassembler.cpp:
540         (JSC::DFG::Disassembler::dump):
541         * dfg/DFGGraph.cpp:
542         (JSC::DFG::Graph::dumpCodeOrigin):
543         * dfg/DFGOSRExitCompiler.cpp:
544         * dfg/DFGOperations.cpp:
545         * dfg/DFGRepatch.cpp:
546         (JSC::DFG::generateProtoChainAccessStub):
547         (JSC::DFG::tryCacheGetByID):
548         (JSC::DFG::tryBuildGetByIDList):
549         (JSC::DFG::emitPutReplaceStub):
550         (JSC::DFG::emitPutTransitionStub):
551         (JSC::DFG::dfgLinkClosureCall):
552         * interpreter/Interpreter.cpp:
553         (JSC::Interpreter::dumpCallFrame):
554         * jit/JITCode.cpp: Added.
555         (WTF):
556         (WTF::printInternal):
557         * jit/JITCode.h:
558         (JSC::JITCode::jitType):
559         (WTF):
560         * jit/JITDisassembler.cpp:
561         (JSC::JITDisassembler::dump):
562         (JSC::JITDisassembler::dumpForInstructions):
563         * jit/JITPropertyAccess.cpp:
564         (JSC::JIT::privateCompilePutByIdTransition):
565         (JSC::JIT::privateCompilePatchGetArrayLength):
566         (JSC::JIT::privateCompileGetByIdProto):
567         (JSC::JIT::privateCompileGetByIdSelfList):
568         (JSC::JIT::privateCompileGetByIdProtoList):
569         (JSC::JIT::privateCompileGetByIdChainList):
570         (JSC::JIT::privateCompileGetByIdChain):
571         (JSC::JIT::privateCompileGetByVal):
572         (JSC::JIT::privateCompilePutByVal):
573         * jit/JITPropertyAccess32_64.cpp:
574         (JSC::JIT::privateCompilePutByIdTransition):
575         (JSC::JIT::privateCompilePatchGetArrayLength):
576         (JSC::JIT::privateCompileGetByIdProto):
577         (JSC::JIT::privateCompileGetByIdSelfList):
578         (JSC::JIT::privateCompileGetByIdProtoList):
579         (JSC::JIT::privateCompileGetByIdChainList):
580         (JSC::JIT::privateCompileGetByIdChain):
581         * jit/JITStubs.cpp:
582         (JSC::DEFINE_STUB_FUNCTION):
583         * runtime/CodeSpecializationKind.cpp: Added.
584         (WTF):
585         (WTF::printInternal):
586         * runtime/CodeSpecializationKind.h:
587         (JSC::specializationFromIsCall):
588         (JSC):
589         (JSC::specializationFromIsConstruct):
590         (WTF):
591         * runtime/Executable.cpp:
592         (JSC::ExecutableBase::hashFor):
593         (JSC):
594         (JSC::NativeExecutable::hashFor):
595         (JSC::ScriptExecutable::hashFor):
596         * runtime/Executable.h:
597         (ExecutableBase):
598         (NativeExecutable):
599         (ScriptExecutable):
600         (JSC::ScriptExecutable::source):
601
602 2012-11-29  Michael Saboff  <msaboff@apple.com>
603
604         Speculative Windows build fix after r136086.
605
606         Unreviewed build fix.
607
608         Suspect that ?setDumpsGeneratedCode@BytecodeGenerator@JSC@@SAX_N@Z needs to be removed from Windows
609         export list since the symbol was removed in r136086.
610
611         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
612
613 2012-11-28  Filip Pizlo  <fpizlo@apple.com>
614
615         SpeculatedType dumping should not use the static char buffer[thingy] idiom
616         https://bugs.webkit.org/show_bug.cgi?id=103584
617
618         Reviewed by Michael Saboff.
619
620         Changed SpeculatedType to be "dumpable" by saying things like:
621         
622         dataLog("thingy = ", SpeculationDump(thingy))
623         
624         Removed the old stringification functions, and changed all code that referred to them
625         to use the new dataLog()/print() style.
626
627         * CMakeLists.txt:
628         * GNUmakefile.list.am:
629         * JavaScriptCore.xcodeproj/project.pbxproj:
630         * Target.pri:
631         * bytecode/SpeculatedType.cpp:
632         (JSC::dumpSpeculation):
633         (JSC::speculationToAbbreviatedString):
634         (JSC::dumpSpeculationAbbreviated):
635         * bytecode/SpeculatedType.h:
636         * bytecode/ValueProfile.h:
637         (JSC::ValueProfileBase::dump):
638         * bytecode/VirtualRegister.h:
639         (WTF::printInternal):
640         * dfg/DFGAbstractValue.h:
641         (JSC::DFG::AbstractValue::dump):
642         * dfg/DFGByteCodeParser.cpp:
643         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
644         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
645         * dfg/DFGGraph.cpp:
646         (JSC::DFG::Graph::dump):
647         (JSC::DFG::Graph::predictArgumentTypes):
648         * dfg/DFGGraph.h:
649         (Graph):
650         * dfg/DFGStructureAbstractValue.h:
651         * dfg/DFGVariableAccessDataDump.cpp: Added.
652         (JSC::DFG::VariableAccessDataDump::VariableAccessDataDump):
653         (JSC::DFG::VariableAccessDataDump::dump):
654         * dfg/DFGVariableAccessDataDump.h: Added.
655         (VariableAccessDataDump):
656
657 2012-11-28  Michael Saboff  <msaboff@apple.com>
658
659         Change Bytecompiler s_dumpsGeneratedCode to an Options value
660         https://bugs.webkit.org/show_bug.cgi?id=103588
661
662         Reviewed by Filip Pizlo.
663
664         Moved the control of dumping bytecodes to Options::dumpGeneratedBytecodes.
665
666         * bytecode/CodeBlock.cpp:
667         (JSC::CodeBlock::CodeBlock):
668         * bytecompiler/BytecodeGenerator.cpp:
669         * bytecompiler/BytecodeGenerator.h:
670         * jsc.cpp:
671         (runWithScripts):
672         * runtime/Options.h:
673
674 2012-11-28  Mark Hahnenberg  <mhahnenberg@apple.com>
675
676         Copying phase should use work lists
677         https://bugs.webkit.org/show_bug.cgi?id=101390
678
679         Reviewed by Filip Pizlo.
680
681         * JavaScriptCore.xcodeproj/project.pbxproj:
682         * heap/BlockAllocator.cpp:
683         (JSC::BlockAllocator::BlockAllocator):
684         * heap/BlockAllocator.h: New RegionSet for CopyWorkListSegments.
685         (BlockAllocator):
686         (JSC::CopyWorkListSegment):
687         * heap/CopiedBlock.h: Added a per-block CopyWorkList to keep track of the JSCells that need to be revisited during the copying
688         phase to copy their backing stores.
689         (CopiedBlock):
690         (JSC::CopiedBlock::CopiedBlock): 
691         (JSC::CopiedBlock::didSurviveGC):
692         (JSC::CopiedBlock::didEvacuateBytes): There is now a one-to-one relationship between GCThreads and the CopiedBlocks they're 
693         responsible for evacuating, we no longer need any of that fancy compare and swap stuff. 
694         (JSC::CopiedBlock::pin):
695         (JSC::CopiedBlock::hasWorkList): 
696         (JSC::CopiedBlock::workList):
697         * heap/CopiedBlockInlines.h: Added.
698         (JSC::CopiedBlock::reportLiveBytes): Since we now have to grab a SpinLock to perform operations on the CopyWorkList during marking,
699         we don't need to do any of that fancy compare and swap stuff we were doing for tracking live bytes.
700         * heap/CopiedSpace.h:
701         (CopiedSpace):
702         * heap/CopiedSpaceInlines.h:
703         (JSC::CopiedSpace::pin):
704         * heap/CopyVisitor.cpp:
705         (JSC::CopyVisitor::copyFromShared): We now iterate over a range of CopiedBlocks rather than MarkedBlocks and revisit the cells in those
706         blocks' CopyWorkLists.
707         * heap/CopyVisitor.h:
708         (CopyVisitor):
709         * heap/CopyVisitorInlines.h:
710         (JSC::CopyVisitor::visitCell): The function responsible for calling the correct copyBackingStore() function for each JSCell from 
711         a CopiedBlock's CopyWorkList.
712         (JSC::CopyVisitor::didCopy): We no longer need to check if the block is empty here because we know exactly when we're done 
713         evacuating a CopiedBlock, which is when we've gone through all of the CopiedBlock's CopyWorkList.
714         * heap/CopyWorkList.h: Added.
715         (CopyWorkListSegment): Individual chunk of a CopyWorkList that is allocated from the BlockAllocator.
716         (JSC::CopyWorkListSegment::create):
717         (JSC::CopyWorkListSegment::size):
718         (JSC::CopyWorkListSegment::isFull):
719         (JSC::CopyWorkListSegment::get):
720         (JSC::CopyWorkListSegment::append):
721         (JSC::CopyWorkListSegment::CopyWorkListSegment):
722         (JSC::CopyWorkListSegment::data):
723         (JSC::CopyWorkListSegment::endOfBlock):
724         (CopyWorkListIterator): Responsible for giving CopyVisitors a contiguous notion of access across the separate CopyWorkListSegments
725         that make up each CopyWorkList.
726         (JSC::CopyWorkListIterator::get):
727         (JSC::CopyWorkListIterator::operator*):
728         (JSC::CopyWorkListIterator::operator->):
729         (JSC::CopyWorkListIterator::operator++):
730         (JSC::CopyWorkListIterator::operator==):
731         (JSC::CopyWorkListIterator::operator!=):
732         (JSC::CopyWorkListIterator::CopyWorkListIterator):
733         (CopyWorkList): Data structure that keeps track of the JSCells that need copying in a particular CopiedBlock.
734         (JSC::CopyWorkList::CopyWorkList):
735         (JSC::CopyWorkList::~CopyWorkList):
736         (JSC::CopyWorkList::append):
737         (JSC::CopyWorkList::begin):
738         (JSC::CopyWorkList::end):
739         * heap/GCThreadSharedData.cpp:
740         (JSC::GCThreadSharedData::GCThreadSharedData): We no longer use the m_blockSnapshot from the Heap during the copying phase.
741         (JSC::GCThreadSharedData::didStartCopying): We now copy the set of all blocks in the CopiedSpace to a separate vector for 
742         iterating over during the copying phase since the set stored in the CopiedSpace will change as blocks are evacuated and 
743         recycled throughout the copying phase.
744         * heap/GCThreadSharedData.h:
745         (GCThreadSharedData): 
746         * heap/Heap.h:
747         (Heap):
748         * heap/SlotVisitor.h: We now need to know the object who is being marked that has a backing store so that we can store it 
749         in a CopyWorkList to revisit later during the copying phase.
750         * heap/SlotVisitorInlines.h:
751         (JSC::SlotVisitor::copyLater):
752         * runtime/JSObject.cpp:
753         (JSC::JSObject::visitButterfly):
754
755 2012-11-28  Filip Pizlo  <fpizlo@apple.com>
756
757         Disassembly methods should be able to disassemble to any PrintStream& rather than always using WTF::dataFile()
758         https://bugs.webkit.org/show_bug.cgi?id=103492
759
760         Reviewed by Mark Hahnenberg.
761
762         Switched disassembly code to use PrintStream&, and to use print() rather than printf().
763
764         * dfg/DFGDisassembler.cpp:
765         (JSC::DFG::Disassembler::dump):
766         (DFG):
767         (JSC::DFG::Disassembler::dumpDisassembly):
768         * dfg/DFGDisassembler.h:
769         (Disassembler):
770         * dfg/DFGGraph.cpp:
771         (JSC::DFG::printWhiteSpace):
772         (JSC::DFG::Graph::dumpCodeOrigin):
773         (JSC::DFG::Graph::printNodeWhiteSpace):
774         (JSC::DFG::Graph::dump):
775         (DFG):
776         (JSC::DFG::Graph::dumpBlockHeader):
777         * dfg/DFGGraph.h:
778         (Graph):
779         * jit/JITDisassembler.cpp:
780         (JSC::JITDisassembler::dump):
781         (JSC::JITDisassembler::dumpForInstructions):
782         (JSC::JITDisassembler::dumpDisassembly):
783         * jit/JITDisassembler.h:
784         (JITDisassembler):
785
786 2012-11-28  Filip Pizlo  <fpizlo@apple.com>
787
788         It should be possible to say dataLog("count = ", count, "\n") instead of dataLogF("count = %d\n", count)
789         https://bugs.webkit.org/show_bug.cgi?id=103009
790
791         Reviewed by Michael Saboff.
792
793         Instead of converting all of JSC to use the new dataLog()/print() methods, I just changed
794         one place: dumping of abstract values. This is mainly just to ensure that the code I
795         added to WTF is actually doing things.
796
797         * bytecode/CodeBlock.cpp:
798         (JSC::CodeBlock::dump):
799         * dfg/DFGAbstractValue.h:
800         (JSC::DFG::AbstractValue::dump):
801         (WTF):
802         (WTF::printInternal):
803         * dfg/DFGStructureAbstractValue.h:
804         (JSC::DFG::StructureAbstractValue::dump):
805         (WTF):
806         (WTF::printInternal):
807
808 2012-11-28  Oliver Hunt  <oliver@apple.com>
809
810         Make source cache include more information about the function extent.
811         https://bugs.webkit.org/show_bug.cgi?id=103552
812
813         Reviewed by Gavin Barraclough.
814
815         Add a bit more information to the source cache.
816
817         * parser/Parser.cpp:
818         (JSC::::parseFunctionInfo):
819            Store the function start offset
820         * parser/SourceProviderCacheItem.h:
821         (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
822         (SourceProviderCacheItem):
823            Add additional field for the start of the real function string, and re-arrange
824            fields to avoid growing the struct.
825
826 2012-11-27  Filip Pizlo  <fpizlo@apple.com>
827
828         Convert some remaining uses of FILE* to PrintStream&.
829
830         Rubber stamped by Mark Hahnenberg.
831
832         * bytecode/ValueProfile.h:
833         (JSC::ValueProfileBase::dump):
834         * bytecode/ValueRecovery.h:
835         (JSC::ValueRecovery::dump):
836         * dfg/DFGByteCodeParser.cpp:
837         (JSC::DFG::ByteCodeParser::parseCodeBlock):
838         * dfg/DFGNode.h:
839         (JSC::DFG::Node::dumpChildren):
840
841 2012-11-27  Filip Pizlo  <fpizlo@apple.com>
842
843         Fix indentation in JSValue.h
844
845         Rubber stamped by Mark Hahnenberg.
846
847         * runtime/JSValue.h:
848
849 2012-11-26  Filip Pizlo  <fpizlo@apple.com>
850
851         DFG SetLocal should use forwardSpeculationCheck instead of its own half-baked version of same
852         https://bugs.webkit.org/show_bug.cgi?id=103353
853
854         Reviewed by Oliver Hunt and Gavin Barraclough.
855
856         Made it possible to use forward speculations for most of the operand classes. Changed the conditional
857         direction parameter from being 'bool isForward' to an enum (SpeculationDirection). Changed SetLocal
858         to use forward speculations and got rid of its half-baked version of same.
859         
860         Also added the ability to force the DFG's disassembler to dump all nodes, even ones that are dead.
861
862         * dfg/DFGByteCodeParser.cpp:
863         (JSC::DFG::ByteCodeParser::parseBlock):
864         * dfg/DFGDisassembler.cpp:
865         (JSC::DFG::Disassembler::dump):
866         * dfg/DFGDriver.cpp:
867         (JSC::DFG::compile):
868         * dfg/DFGSpeculativeJIT.cpp:
869         (JSC::DFG::SpeculativeJIT::speculationCheck):
870         (DFG):
871         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
872         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
873         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
874         (JSC::DFG::SpeculativeJIT::fillStorage):
875         * dfg/DFGSpeculativeJIT.h:
876         (SpeculativeJIT):
877         (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
878         (JSC::DFG::SpeculateIntegerOperand::gpr):
879         (SpeculateIntegerOperand):
880         (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
881         (JSC::DFG::SpeculateDoubleOperand::fpr):
882         (SpeculateDoubleOperand):
883         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
884         (JSC::DFG::SpeculateCellOperand::gpr):
885         (SpeculateCellOperand):
886         (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
887         (JSC::DFG::SpeculateBooleanOperand::gpr):
888         (SpeculateBooleanOperand):
889         * dfg/DFGSpeculativeJIT32_64.cpp:
890         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
891         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
892         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
893         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
894         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
895         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
896         (JSC::DFG::SpeculativeJIT::compile):
897         * dfg/DFGSpeculativeJIT64.cpp:
898         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
899         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
900         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
901         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
902         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
903         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
904         (JSC::DFG::SpeculativeJIT::compile):
905         * runtime/Options.h:
906         (JSC):
907
908 2012-11-26  Daniel Bates  <dbates@webkit.org>
909
910         Substitute "allSeparators8Bit" for "allSeperators8Bit" in JSC::jsSpliceSubstringsWithSeparators()
911         <https://bugs.webkit.org/show_bug.cgi?id=103303>
912
913         Reviewed by Simon Fraser.
914
915         Fix misspelled word, "Seperators" [sic], in a local variable name in JSC::jsSpliceSubstringsWithSeparators().
916
917         * runtime/StringPrototype.cpp:
918         (JSC::jsSpliceSubstringsWithSeparators):
919
920 2012-11-26  Daniel Bates  <dbates@webkit.org>
921
922         JavaScript fails to handle String.replace() with large replacement string
923         https://bugs.webkit.org/show_bug.cgi?id=102956
924         <rdar://problem/12738012>
925
926         Reviewed by Oliver Hunt.
927
928         Fix an issue where we didn't check for overflow when computing the length
929         of the result of String.replace() with a large replacement string.
930
931         * runtime/StringPrototype.cpp:
932         (JSC::jsSpliceSubstringsWithSeparators):
933
934 2012-11-26  Zeno Albisser  <zeno@webkit.org>
935
936         [Qt] Fix the LLInt build on Mac
937         https://bugs.webkit.org/show_bug.cgi?id=97587
938
939         Reviewed by Simon Hausmann.
940
941         * DerivedSources.pri:
942         * JavaScriptCore.pro:
943
944 2012-11-26  Oliver Hunt  <oliver@apple.com>
945
946         32-bit build fix.  Move the method decalration outside of the X86_64 only section.
947
948         * assembler/MacroAssembler.h:
949         (MacroAssembler):
950         (JSC::MacroAssembler::shouldConsiderBlinding):
951
952 2012-11-26  Oliver Hunt  <oliver@apple.com>
953
954         Don't blind all the things.
955         https://bugs.webkit.org/show_bug.cgi?id=102572
956
957         Reviewed by Gavin Barraclough.
958
959         No longer blind all the constants in the instruction stream.  We use a
960         simple non-deterministic filter to avoid blinding everything.  Also modified
961         the basic integer blinding logic to avoid blinding small negative values.
962
963         * assembler/MacroAssembler.h:
964         (MacroAssembler):
965         (JSC::MacroAssembler::shouldConsiderBlinding):
966         (JSC::MacroAssembler::shouldBlind):
967
968 2012-11-26  Mark Hahnenberg  <mhahnenberg@apple.com>
969
970         JSObject::copyButterfly doesn't handle undecided indexing types correctly
971         https://bugs.webkit.org/show_bug.cgi?id=102573
972
973         Reviewed by Filip Pizlo.
974
975         We don't do any copying into the newly allocated vector and we don't zero-initialize CopiedBlocks 
976         during the copying phase, so we end up with uninitialized memory in arrays which have undecided indexing 
977         types. We should just do the actual memcpy from the old block to the new one. 
978
979         * runtime/JSObject.cpp:
980         (JSC::JSObject::copyButterfly): Just do the same thing that we do for other contiguous indexing types.
981
982 2012-11-26  Julien BRIANCEAU   <jbrianceau@nds.com>
983
984         [sh4] JavaScriptCore JIT build is broken since r135330
985         Add missing implementation for sh4 arch.
986         https://bugs.webkit.org/show_bug.cgi?id=103145
987
988         Reviewed by Oliver Hunt.
989
990         * assembler/MacroAssemblerSH4.h:
991         (JSC::MacroAssemblerSH4::canJumpReplacePatchableBranchPtrWithPatch):
992         (MacroAssemblerSH4):
993         (JSC::MacroAssemblerSH4::startOfBranchPtrWithPatchOnRegister):
994         (JSC::MacroAssemblerSH4::revertJumpReplacementToBranchPtrWithPatch):
995         (JSC::MacroAssemblerSH4::startOfPatchableBranchPtrWithPatchOnAddress):
996         (JSC::MacroAssemblerSH4::revertJumpReplacementToPatchableBranchPtrWithPatch):
997         * assembler/SH4Assembler.h:
998         (JSC::SH4Assembler::revertJump):
999         (SH4Assembler):
1000         (JSC::SH4Assembler::printInstr):
1001
1002 2012-11-26  Yuqiang Xian  <yuqiang.xian@intel.com>
1003
1004         Use load64 instead of loadPtr to load a JSValue on JSVALUE64 platforms
1005         https://bugs.webkit.org/show_bug.cgi?id=100909
1006
1007         Reviewed by Brent Fulgham.
1008
1009         This is a (trivial) fix after r132701.
1010
1011         * dfg/DFGOSRExitCompiler64.cpp:
1012         (JSC::DFG::OSRExitCompiler::compileExit):
1013
1014 2012-11-26  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
1015
1016         [Qt][ARM] REGRESSION(r130826): It made 33 JSC test and 466 layout tests crash
1017         https://bugs.webkit.org/show_bug.cgi?id=98857
1018
1019         Reviewed by Zoltan Herczeg.
1020
1021         Implement a new version of patchableBranch32 to fix crashing JSC
1022         tests.
1023
1024         * assembler/MacroAssembler.h:
1025         (MacroAssembler):
1026         * assembler/MacroAssemblerARM.h:
1027         (JSC::MacroAssemblerARM::patchableBranch32):
1028         (MacroAssemblerARM):
1029
1030 2012-11-21  Filip Pizlo  <fpizlo@apple.com>
1031
1032         Any function that can log things should be able to easily log them to a memory buffer as well
1033         https://bugs.webkit.org/show_bug.cgi?id=103000
1034
1035         Reviewed by Sam Weinig.
1036
1037         Change all users of WTF::dataFile() to expect a PrintStream& rather than a FILE*.
1038
1039         * bytecode/Operands.h:
1040         (JSC::OperandValueTraits::dump):
1041         (JSC::dumpOperands):
1042         (JSC):
1043         * dfg/DFGAbstractState.cpp:
1044         (JSC::DFG::AbstractState::dump):
1045         * dfg/DFGAbstractState.h:
1046         (AbstractState):
1047         * dfg/DFGAbstractValue.h:
1048         (JSC::DFG::AbstractValue::dump):
1049         * dfg/DFGCommon.h:
1050         (JSC::DFG::NodeIndexTraits::dump):
1051         * dfg/DFGStructureAbstractValue.h:
1052         (JSC::DFG::StructureAbstractValue::dump):
1053         * dfg/DFGVariableEvent.cpp:
1054         (JSC::DFG::VariableEvent::dump):
1055         (JSC::DFG::VariableEvent::dumpFillInfo):
1056         (JSC::DFG::VariableEvent::dumpSpillInfo):
1057         * dfg/DFGVariableEvent.h:
1058         (VariableEvent):
1059         * disassembler/Disassembler.h:
1060         (JSC):
1061         (JSC::tryToDisassemble):
1062         * disassembler/UDis86Disassembler.cpp:
1063         (JSC::tryToDisassemble):
1064
1065 2012-11-23  Alexis Menard  <alexis@webkit.org>
1066
1067         [CSS3 Backgrounds and Borders] Implement new CSS3 background-position parsing.
1068         https://bugs.webkit.org/show_bug.cgi?id=102104
1069
1070         Reviewed by Julien Chaffraix.
1071
1072         Protect the new feature behind a feature flag.
1073
1074         * Configurations/FeatureDefines.xcconfig:
1075
1076 2012-11-23  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
1077
1078         Fix the ARM traditional build after r135330
1079         https://bugs.webkit.org/show_bug.cgi?id=102871
1080
1081         Reviewed by Zoltan Herczeg.
1082
1083         Added missing functionality to traditional ARM architecture.
1084
1085         * assembler/ARMAssembler.h:
1086         (JSC::ARMAssembler::revertJump):
1087         (ARMAssembler):
1088         * assembler/MacroAssemblerARM.h:
1089         (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatchOnAddress):
1090         (JSC::MacroAssemblerARM::startOfBranchPtrWithPatchOnRegister):
1091         (MacroAssemblerARM):
1092         (JSC::MacroAssemblerARM::revertJumpReplacementToBranchPtrWithPatch):
1093
1094 2012-11-16  Yury Semikhatsky  <yurys@chromium.org>
1095
1096         Memory instrumentation: extract MemoryObjectInfo declaration into a separate file
1097         https://bugs.webkit.org/show_bug.cgi?id=102510
1098
1099         Reviewed by Pavel Feldman.
1100
1101         Added new symbols for the methods that have moved into .../wtf/MemoryInstrumentation.cpp
1102
1103         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1104
1105 2012-11-23  Julien BRIANCEAU   <jbrianceau@nds.com>
1106
1107         [sh4] JavaScriptCore JIT build is broken since r130839
1108         Add missing implementation for sh4 arch.
1109         https://bugs.webkit.org/show_bug.cgi?id=101479
1110
1111         Reviewed by Filip Pizlo.
1112
1113         * assembler/MacroAssemblerSH4.h:
1114         (JSC::MacroAssemblerSH4::load8Signed):
1115         (MacroAssemblerSH4):
1116         (JSC::MacroAssemblerSH4::load16Signed):
1117         (JSC::MacroAssemblerSH4::store8):
1118         (JSC::MacroAssemblerSH4::store16):
1119         (JSC::MacroAssemblerSH4::moveDoubleToInts):
1120         (JSC::MacroAssemblerSH4::moveIntsToDouble):
1121         (JSC::MacroAssemblerSH4::loadFloat):
1122         (JSC::MacroAssemblerSH4::loadDouble):
1123         (JSC::MacroAssemblerSH4::storeFloat):
1124         (JSC::MacroAssemblerSH4::storeDouble):
1125         (JSC::MacroAssemblerSH4::addDouble):
1126         (JSC::MacroAssemblerSH4::convertFloatToDouble):
1127         (JSC::MacroAssemblerSH4::convertDoubleToFloat):
1128         (JSC::MacroAssemblerSH4::urshift32):
1129         * assembler/SH4Assembler.h:
1130         (JSC::SH4Assembler::sublRegReg):
1131         (JSC::SH4Assembler::subvlRegReg):
1132         (JSC::SH4Assembler::floatfpulfrn):
1133         (JSC::SH4Assembler::fldsfpul):
1134         (JSC::SH4Assembler::fstsfpul):
1135         (JSC::SH4Assembler::dcnvsd):
1136         (SH4Assembler):
1137         (JSC::SH4Assembler::movbRegMem):
1138         (JSC::SH4Assembler::sizeOfConstantPool):
1139         (JSC::SH4Assembler::linkJump):
1140         (JSC::SH4Assembler::printInstr):
1141         (JSC::SH4Assembler::printBlockInstr):
1142
1143 2012-11-22  Balazs Kilvady  <kilvadyb@homejinni.com>
1144
1145         Fix the MIPS build after r135330
1146         https://bugs.webkit.org/show_bug.cgi?id=102872
1147
1148         Reviewed by Gavin Barraclough.
1149
1150         Revert/replace functions added to MIPS port.
1151
1152         * assembler/MIPSAssembler.h:
1153         (JSC::MIPSAssembler::revertJumpToMove):
1154         (MIPSAssembler):
1155         (JSC::MIPSAssembler::replaceWithJump):
1156         * assembler/MacroAssemblerMIPS.h:
1157         (MacroAssemblerMIPS):
1158         (JSC::MacroAssemblerMIPS::startOfBranchPtrWithPatchOnRegister):
1159         (JSC::MacroAssemblerMIPS::revertJumpReplacementToBranchPtrWithPatch):
1160         (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatchOnAddress):
1161
1162 2012-11-21  Filip Pizlo  <fpizlo@apple.com>
1163
1164         Rename dataLog() and dataLogV() to dataLogF() and dataLogFV()
1165         https://bugs.webkit.org/show_bug.cgi?id=103001
1166
1167         Rubber stamped by Dan Bernstein.
1168
1169         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1170         * assembler/LinkBuffer.cpp:
1171         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
1172         (JSC::LinkBuffer::dumpLinkStatistics):
1173         (JSC::LinkBuffer::dumpCode):
1174         * assembler/LinkBuffer.h:
1175         (JSC):
1176         * assembler/SH4Assembler.h:
1177         (JSC::SH4Assembler::vprintfStdoutInstr):
1178         * bytecode/CodeBlock.cpp:
1179         (JSC::CodeBlock::dumpBytecodeCommentAndNewLine):
1180         (JSC::CodeBlock::printUnaryOp):
1181         (JSC::CodeBlock::printBinaryOp):
1182         (JSC::CodeBlock::printConditionalJump):
1183         (JSC::CodeBlock::printGetByIdOp):
1184         (JSC::dumpStructure):
1185         (JSC::dumpChain):
1186         (JSC::CodeBlock::printGetByIdCacheStatus):
1187         (JSC::CodeBlock::printCallOp):
1188         (JSC::CodeBlock::printPutByIdOp):
1189         (JSC::CodeBlock::printStructure):
1190         (JSC::CodeBlock::printStructures):
1191         (JSC::CodeBlock::dump):
1192         (JSC::CodeBlock::dumpStatistics):
1193         (JSC::CodeBlock::finalizeUnconditionally):
1194         (JSC::CodeBlock::resetStubInternal):
1195         (JSC::CodeBlock::reoptimize):
1196         (JSC::ProgramCodeBlock::jettison):
1197         (JSC::EvalCodeBlock::jettison):
1198         (JSC::FunctionCodeBlock::jettison):
1199         (JSC::CodeBlock::shouldOptimizeNow):
1200         (JSC::CodeBlock::tallyFrequentExitSites):
1201         (JSC::CodeBlock::dumpValueProfiles):
1202         * bytecode/Opcode.cpp:
1203         (JSC::OpcodeStats::~OpcodeStats):
1204         * bytecode/SamplingTool.cpp:
1205         (JSC::SamplingFlags::stop):
1206         (JSC::SamplingRegion::dumpInternal):
1207         (JSC::SamplingTool::dump):
1208         * dfg/DFGAbstractState.cpp:
1209         (JSC::DFG::AbstractState::initialize):
1210         (JSC::DFG::AbstractState::endBasicBlock):
1211         (JSC::DFG::AbstractState::mergeStateAtTail):
1212         (JSC::DFG::AbstractState::mergeToSuccessors):
1213         * dfg/DFGAbstractValue.h:
1214         (JSC::DFG::AbstractValue::dump):
1215         * dfg/DFGArgumentsSimplificationPhase.cpp:
1216         (JSC::DFG::ArgumentsSimplificationPhase::run):
1217         * dfg/DFGByteCodeParser.cpp:
1218         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
1219         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
1220         (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
1221         (JSC::DFG::ByteCodeParser::makeSafe):
1222         (JSC::DFG::ByteCodeParser::makeDivSafe):
1223         (JSC::DFG::ByteCodeParser::handleCall):
1224         (JSC::DFG::ByteCodeParser::handleInlining):
1225         (JSC::DFG::ByteCodeParser::parseBlock):
1226         (JSC::DFG::ByteCodeParser::processPhiStack):
1227         (JSC::DFG::ByteCodeParser::linkBlock):
1228         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
1229         (JSC::DFG::ByteCodeParser::parseCodeBlock):
1230         (JSC::DFG::ByteCodeParser::parse):
1231         * dfg/DFGCFAPhase.cpp:
1232         (JSC::DFG::CFAPhase::performBlockCFA):
1233         (JSC::DFG::CFAPhase::performForwardCFA):
1234         * dfg/DFGCFGSimplificationPhase.cpp:
1235         (JSC::DFG::CFGSimplificationPhase::run):
1236         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
1237         (JSC::DFG::CFGSimplificationPhase::fixPhis):
1238         (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
1239         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
1240         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
1241         * dfg/DFGCSEPhase.cpp:
1242         (JSC::DFG::CSEPhase::endIndexForPureCSE):
1243         (JSC::DFG::CSEPhase::setReplacement):
1244         (JSC::DFG::CSEPhase::eliminate):
1245         (JSC::DFG::CSEPhase::performNodeCSE):
1246         * dfg/DFGCapabilities.cpp:
1247         (JSC::DFG::debugFail):
1248         * dfg/DFGConstantFoldingPhase.cpp:
1249         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1250         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
1251         * dfg/DFGDisassembler.cpp:
1252         (JSC::DFG::Disassembler::dump):
1253         * dfg/DFGDriver.cpp:
1254         (JSC::DFG::compile):
1255         * dfg/DFGFixupPhase.cpp:
1256         (JSC::DFG::FixupPhase::fixupNode):
1257         (JSC::DFG::FixupPhase::fixDoubleEdge):
1258         * dfg/DFGGraph.cpp:
1259         (JSC::DFG::printWhiteSpace):
1260         (JSC::DFG::Graph::dumpCodeOrigin):
1261         (JSC::DFG::Graph::dump):
1262         (JSC::DFG::Graph::dumpBlockHeader):
1263         (JSC::DFG::Graph::predictArgumentTypes):
1264         * dfg/DFGJITCompiler.cpp:
1265         (JSC::DFG::JITCompiler::link):
1266         * dfg/DFGOSREntry.cpp:
1267         (JSC::DFG::prepareOSREntry):
1268         * dfg/DFGOSRExitCompiler.cpp:
1269         * dfg/DFGOSRExitCompiler32_64.cpp:
1270         (JSC::DFG::OSRExitCompiler::compileExit):
1271         * dfg/DFGOSRExitCompiler64.cpp:
1272         (JSC::DFG::OSRExitCompiler::compileExit):
1273         * dfg/DFGOperations.cpp:
1274         * dfg/DFGPhase.cpp:
1275         (JSC::DFG::Phase::beginPhase):
1276         * dfg/DFGPhase.h:
1277         (JSC::DFG::runAndLog):
1278         * dfg/DFGPredictionPropagationPhase.cpp:
1279         (JSC::DFG::PredictionPropagationPhase::propagate):
1280         (JSC::DFG::PredictionPropagationPhase::propagateForward):
1281         (JSC::DFG::PredictionPropagationPhase::propagateBackward):
1282         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
1283         * dfg/DFGRegisterBank.h:
1284         (JSC::DFG::RegisterBank::dump):
1285         * dfg/DFGScoreBoard.h:
1286         (JSC::DFG::ScoreBoard::use):
1287         (JSC::DFG::ScoreBoard::dump):
1288         * dfg/DFGSlowPathGenerator.h:
1289         (JSC::DFG::SlowPathGenerator::generate):
1290         * dfg/DFGSpeculativeJIT.cpp:
1291         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
1292         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
1293         (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
1294         (JSC::DFG::SpeculativeJIT::dump):
1295         (JSC::DFG::SpeculativeJIT::checkConsistency):
1296         (JSC::DFG::SpeculativeJIT::compile):
1297         (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
1298         * dfg/DFGSpeculativeJIT32_64.cpp:
1299         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
1300         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
1301         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
1302         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
1303         * dfg/DFGSpeculativeJIT64.cpp:
1304         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
1305         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
1306         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
1307         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
1308         * dfg/DFGStructureCheckHoistingPhase.cpp:
1309         (JSC::DFG::StructureCheckHoistingPhase::run):
1310         * dfg/DFGValidate.cpp:
1311         (Validate):
1312         (JSC::DFG::Validate::reportValidationContext):
1313         (JSC::DFG::Validate::dumpData):
1314         (JSC::DFG::Validate::dumpGraphIfAppropriate):
1315         * dfg/DFGVariableEventStream.cpp:
1316         (JSC::DFG::VariableEventStream::logEvent):
1317         (JSC::DFG::VariableEventStream::reconstruct):
1318         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
1319         (JSC::DFG::VirtualRegisterAllocationPhase::run):
1320         * heap/Heap.cpp:
1321         * heap/HeapStatistics.cpp:
1322         (JSC::HeapStatistics::logStatistics):
1323         (JSC::HeapStatistics::showObjectStatistics):
1324         * heap/MarkStack.h:
1325         * heap/MarkedBlock.h:
1326         * heap/SlotVisitor.cpp:
1327         (JSC::SlotVisitor::validate):
1328         * interpreter/CallFrame.cpp:
1329         (JSC::CallFrame::dumpCaller):
1330         * interpreter/Interpreter.cpp:
1331         (JSC::Interpreter::dumpRegisters):
1332         * jit/JIT.cpp:
1333         (JSC::JIT::privateCompileMainPass):
1334         (JSC::JIT::privateCompileSlowCases):
1335         (JSC::JIT::privateCompile):
1336         * jit/JITDisassembler.cpp:
1337         (JSC::JITDisassembler::dump):
1338         (JSC::JITDisassembler::dumpForInstructions):
1339         * jit/JITStubRoutine.h:
1340         (JSC):
1341         * jit/JITStubs.cpp:
1342         (JSC::DEFINE_STUB_FUNCTION):
1343         * jit/JumpReplacementWatchpoint.cpp:
1344         (JSC::JumpReplacementWatchpoint::fireInternal):
1345         * llint/LLIntExceptions.cpp:
1346         (JSC::LLInt::interpreterThrowInCaller):
1347         (JSC::LLInt::returnToThrow):
1348         (JSC::LLInt::callToThrow):
1349         * llint/LLIntSlowPaths.cpp:
1350         (JSC::LLInt::llint_trace_operand):
1351         (JSC::LLInt::llint_trace_value):
1352         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1353         (JSC::LLInt::traceFunctionPrologue):
1354         (JSC::LLInt::jitCompileAndSetHeuristics):
1355         (JSC::LLInt::entryOSR):
1356         (JSC::LLInt::handleHostCall):
1357         (JSC::LLInt::setUpCall):
1358         * profiler/Profile.cpp:
1359         (JSC::Profile::debugPrintData):
1360         (JSC::Profile::debugPrintDataSampleStyle):
1361         * profiler/ProfileNode.cpp:
1362         (JSC::ProfileNode::debugPrintData):
1363         (JSC::ProfileNode::debugPrintDataSampleStyle):
1364         * runtime/JSGlobalData.cpp:
1365         (JSC::JSGlobalData::dumpRegExpTrace):
1366         * runtime/RegExp.cpp:
1367         (JSC::RegExp::matchCompareWithInterpreter):
1368         * runtime/SamplingCounter.cpp:
1369         (JSC::AbstractSamplingCounter::dump):
1370         * runtime/Structure.cpp:
1371         (JSC::Structure::dumpStatistics):
1372         (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
1373         * tools/CodeProfile.cpp:
1374         (JSC::CodeProfile::report):
1375         * tools/ProfileTreeNode.h:
1376         (JSC::ProfileTreeNode::dumpInternal):
1377         * yarr/YarrInterpreter.cpp:
1378         (JSC::Yarr::ByteCompiler::dumpDisjunction):
1379
1380 2012-11-21  Filip Pizlo  <fpizlo@apple.com>
1381
1382         It should be possible to say disassemble(stuff) instead of having to say if (!tryToDisassemble(stuff)) dataLog("I failed")
1383         https://bugs.webkit.org/show_bug.cgi?id=103010
1384
1385         Reviewed by Anders Carlsson.
1386
1387         You can still say tryToDisassemble(), which will tell you if it failed; you can then
1388         decide what to do instead. But it's better to say disassemble(), which will just print
1389         the instruction ranges if tryToDisassemble() failed. This is particularly appropriate
1390         since that's what all previous users of tryToDisassemble() would have done in some
1391         form or another.
1392
1393         * CMakeLists.txt:
1394         * GNUmakefile.list.am:
1395         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1396         * JavaScriptCore.xcodeproj/project.pbxproj:
1397         * Target.pri:
1398         * assembler/LinkBuffer.cpp:
1399         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
1400         * dfg/DFGDisassembler.cpp:
1401         (JSC::DFG::Disassembler::dumpDisassembly):
1402         * disassembler/Disassembler.cpp: Added.
1403         (JSC):
1404         (JSC::disassemble):
1405         * disassembler/Disassembler.h:
1406         (JSC):
1407         * jit/JITDisassembler.cpp:
1408         (JSC::JITDisassembler::dumpDisassembly):
1409
1410 2012-11-21  Filip Pizlo  <fpizlo@apple.com>
1411
1412         dumpOperands() claims that it needs a non-const Operands& when that is completely false
1413         https://bugs.webkit.org/show_bug.cgi?id=103005
1414
1415         Reviewed by Eric Carlson.
1416
1417         * bytecode/Operands.h:
1418         (JSC::dumpOperands):
1419         (JSC):
1420
1421 2012-11-20  Filip Pizlo  <fpizlo@apple.com>
1422
1423         Baseline JIT's disassembly should be just as pretty as the DFG's
1424         https://bugs.webkit.org/show_bug.cgi?id=102873
1425
1426         Reviewed by Sam Weinig.
1427
1428         Integrated the CodeBlock's bytecode dumper with the JIT's disassembler. Also fixed
1429         some type goof-ups (instructions are not in a Vector<Instruction> so using a Vector
1430         iterator makes no sense) and stream-lined some things (you don't actually need a
1431         full-fledged ExecState* to dump bytecode).
1432
1433         * CMakeLists.txt:
1434         * GNUmakefile.list.am:
1435         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1436         * JavaScriptCore.xcodeproj/project.pbxproj:
1437         * Target.pri:
1438         * bytecode/CodeBlock.cpp:
1439         (JSC::CodeBlock::printUnaryOp):
1440         (JSC::CodeBlock::printBinaryOp):
1441         (JSC::CodeBlock::printConditionalJump):
1442         (JSC::CodeBlock::printGetByIdOp):
1443         (JSC::CodeBlock::printCallOp):
1444         (JSC::CodeBlock::printPutByIdOp):
1445         (JSC::CodeBlock::dump):
1446         (JSC):
1447         (JSC::CodeBlock::CodeBlock):
1448         * bytecode/CodeBlock.h:
1449         (CodeBlock):
1450         * interpreter/Interpreter.cpp:
1451         (JSC::Interpreter::dumpCallFrame):
1452         * jit/JIT.cpp:
1453         (JSC::JIT::privateCompileMainPass):
1454         (JSC::JIT::privateCompileSlowCases):
1455         (JSC::JIT::privateCompile):
1456         * jit/JIT.h:
1457         (JIT):
1458         * jit/JITDisassembler.cpp: Added.
1459         (JSC):
1460         (JSC::JITDisassembler::JITDisassembler):
1461         (JSC::JITDisassembler::~JITDisassembler):
1462         (JSC::JITDisassembler::dump):
1463         (JSC::JITDisassembler::dumpForInstructions):
1464         (JSC::JITDisassembler::dumpDisassembly):
1465         * jit/JITDisassembler.h: Added.
1466         (JSC):
1467         (JITDisassembler):
1468         (JSC::JITDisassembler::setStartOfCode):
1469         (JSC::JITDisassembler::setForBytecodeMainPath):
1470         (JSC::JITDisassembler::setForBytecodeSlowPath):
1471         (JSC::JITDisassembler::setEndOfSlowPath):
1472         (JSC::JITDisassembler::setEndOfCode):
1473
1474 2012-11-21  Daniel Bates  <dbates@webkit.org>
1475
1476         JavaScript fails to concatenate large strings
1477         <https://bugs.webkit.org/show_bug.cgi?id=102963>
1478
1479         Reviewed by Michael Saboff.
1480
1481         Fixes an issue where we inadvertently didn't check the length of
1482         a JavaScript string for overflow.
1483
1484         * runtime/Operations.h:
1485         (JSC::jsString):
1486         (JSC::jsStringFromArguments):
1487
1488 2012-11-20  Filip Pizlo  <fpizlo@apple.com>
1489
1490         DFG should be able to cache closure calls (part 2/2)
1491         https://bugs.webkit.org/show_bug.cgi?id=102662
1492
1493         Reviewed by Gavin Barraclough.
1494
1495         Added caching of calls where the JSFunction* varies, but the Structure* and ExecutableBase*
1496         stay the same. This is accomplished by replacing the branch that compares against a constant
1497         JSFunction* with a jump to a closure call stub. The closure call stub contains a fast path,
1498         and jumps slow directly to the virtual call thunk.
1499
1500         Looks like a 1% win on V8v7.
1501
1502         * CMakeLists.txt:
1503         * GNUmakefile.list.am:
1504         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1505         * JavaScriptCore.xcodeproj/project.pbxproj:
1506         * Target.pri:
1507         * bytecode/CallLinkInfo.cpp:
1508         (JSC::CallLinkInfo::unlink):
1509         * bytecode/CallLinkInfo.h:
1510         (CallLinkInfo):
1511         (JSC::CallLinkInfo::isLinked):
1512         (JSC::getCallLinkInfoBytecodeIndex):
1513         * bytecode/CodeBlock.cpp:
1514         (JSC::CodeBlock::finalizeUnconditionally):
1515         (JSC):
1516         (JSC::CodeBlock::findClosureCallForReturnPC):
1517         (JSC::CodeBlock::bytecodeOffset):
1518         (JSC::CodeBlock::codeOriginForReturn):
1519         * bytecode/CodeBlock.h:
1520         (JSC::CodeBlock::getCallLinkInfo):
1521         (CodeBlock):
1522         (JSC::CodeBlock::isIncomingCallAlreadyLinked):
1523         * dfg/DFGJITCompiler.cpp:
1524         (JSC::DFG::JITCompiler::link):
1525         * dfg/DFGJITCompiler.h:
1526         (JSC::DFG::JITCompiler::addJSCall):
1527         (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
1528         (JSCallRecord):
1529         * dfg/DFGOperations.cpp:
1530         * dfg/DFGOperations.h:
1531         * dfg/DFGRepatch.cpp:
1532         (JSC::DFG::linkSlowFor):
1533         (DFG):
1534         (JSC::DFG::dfgLinkFor):
1535         (JSC::DFG::dfgLinkSlowFor):
1536         (JSC::DFG::dfgLinkClosureCall):
1537         * dfg/DFGRepatch.h:
1538         (DFG):
1539         * dfg/DFGSpeculativeJIT32_64.cpp:
1540         (JSC::DFG::SpeculativeJIT::emitCall):
1541         * dfg/DFGSpeculativeJIT64.cpp:
1542         (JSC::DFG::SpeculativeJIT::emitCall):
1543         * dfg/DFGThunks.cpp:
1544         (DFG):
1545         (JSC::DFG::linkClosureCallThunkGenerator):
1546         * dfg/DFGThunks.h:
1547         (DFG):
1548         * heap/Heap.h:
1549         (Heap):
1550         (JSC::Heap::jitStubRoutines):
1551         * heap/JITStubRoutineSet.h:
1552         (JSC::JITStubRoutineSet::size):
1553         (JSC::JITStubRoutineSet::at):
1554         (JITStubRoutineSet):
1555         * jit/ClosureCallStubRoutine.cpp: Added.
1556         (JSC):
1557         (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
1558         (JSC::ClosureCallStubRoutine::~ClosureCallStubRoutine):
1559         (JSC::ClosureCallStubRoutine::markRequiredObjectsInternal):
1560         * jit/ClosureCallStubRoutine.h: Added.
1561         (JSC):
1562         (ClosureCallStubRoutine):
1563         (JSC::ClosureCallStubRoutine::structure):
1564         (JSC::ClosureCallStubRoutine::executable):
1565         (JSC::ClosureCallStubRoutine::codeOrigin):
1566         * jit/GCAwareJITStubRoutine.cpp:
1567         (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
1568         * jit/GCAwareJITStubRoutine.h:
1569         (GCAwareJITStubRoutine):
1570         (JSC::GCAwareJITStubRoutine::isClosureCall):
1571         * jit/JIT.cpp:
1572         (JSC::JIT::privateCompile):
1573
1574 2012-11-20  Filip Pizlo  <fpizlo@apple.com>
1575
1576         DFG should be able to cache closure calls (part 1/2)
1577         https://bugs.webkit.org/show_bug.cgi?id=102662
1578
1579         Reviewed by Gavin Barraclough.
1580
1581         Add ability to revert a jump replacement back to
1582         branchPtrWithPatch(Condition, RegisterID, TrustedImmPtr). This is meant to be
1583         a mandatory piece of functionality for all assemblers. I also renamed some of
1584         the functions for reverting jump replacements back to
1585         patchableBranchPtrWithPatch(Condition, Address, TrustedImmPtr), so as to avoid
1586         confusion.
1587
1588         * assembler/ARMv7Assembler.h:
1589         (JSC::ARMv7Assembler::BadReg):
1590         (ARMv7Assembler):
1591         (JSC::ARMv7Assembler::revertJumpTo_movT3):
1592         * assembler/LinkBuffer.h:
1593         (JSC):
1594         * assembler/MacroAssemblerARMv7.h:
1595         (JSC::MacroAssemblerARMv7::startOfBranchPtrWithPatchOnRegister):
1596         (MacroAssemblerARMv7):
1597         (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
1598         (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatchOnAddress):
1599         * assembler/MacroAssemblerX86.h:
1600         (JSC::MacroAssemblerX86::startOfBranchPtrWithPatchOnRegister):
1601         (MacroAssemblerX86):
1602         (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatchOnAddress):
1603         (JSC::MacroAssemblerX86::revertJumpReplacementToBranchPtrWithPatch):
1604         * assembler/MacroAssemblerX86_64.h:
1605         (JSC::MacroAssemblerX86_64::startOfBranchPtrWithPatchOnRegister):
1606         (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatchOnAddress):
1607         (MacroAssemblerX86_64):
1608         (JSC::MacroAssemblerX86_64::revertJumpReplacementToBranchPtrWithPatch):
1609         * assembler/RepatchBuffer.h:
1610         (JSC::RepatchBuffer::startOfBranchPtrWithPatchOnRegister):
1611         (RepatchBuffer):
1612         (JSC::RepatchBuffer::startOfPatchableBranchPtrWithPatchOnAddress):
1613         (JSC::RepatchBuffer::revertJumpReplacementToBranchPtrWithPatch):
1614         * assembler/X86Assembler.h:
1615         (JSC::X86Assembler::revertJumpTo_cmpl_ir_force32):
1616         (X86Assembler):
1617         * dfg/DFGRepatch.cpp:
1618         (JSC::DFG::replaceWithJump):
1619         (JSC::DFG::dfgResetGetByID):
1620         (JSC::DFG::dfgResetPutByID):
1621
1622 2012-11-20  Yong Li  <yoli@rim.com>
1623
1624         [ARMv7] Neither linkCall() nor linkPointer() should flush code.
1625         https://bugs.webkit.org/show_bug.cgi?id=99213
1626
1627         Reviewed by George Staikos.
1628
1629         LinkBuffer doesn't need to flush code during linking. It will
1630         eventually flush the whole executable. Fixing this gives >%5
1631         sunspider boost (on QNX).
1632
1633         Also make replaceWithLoad() and replaceWithAddressComputation() flush
1634         only when necessary.
1635
1636         * assembler/ARMv7Assembler.h:
1637         (JSC::ARMv7Assembler::linkCall):
1638         (JSC::ARMv7Assembler::linkPointer):
1639         (JSC::ARMv7Assembler::relinkCall):
1640         (JSC::ARMv7Assembler::repatchInt32):
1641         (JSC::ARMv7Assembler::repatchPointer):
1642         (JSC::ARMv7Assembler::replaceWithLoad): Flush only after it did write.
1643         (JSC::ARMv7Assembler::replaceWithAddressComputation): Flush only after it did write.
1644         (JSC::ARMv7Assembler::setInt32):
1645         (JSC::ARMv7Assembler::setPointer):
1646
1647 2012-11-19  Filip Pizlo  <fpizlo@apple.com>
1648
1649         Remove support for ARMv7 errata from the jump code
1650         https://bugs.webkit.org/show_bug.cgi?id=102759
1651
1652         Reviewed by Oliver Hunt.
1653
1654         The jump replacement code was wrong to begin with since it wasn't doing
1655         a cache flush on the inserted padding. And, to my knowledge, we don't need
1656         this anymore, so this patch removes all errata code from the ARMv7 port.
1657
1658         * assembler/ARMv7Assembler.h:
1659         (JSC::ARMv7Assembler::computeJumpType):
1660         (JSC::ARMv7Assembler::replaceWithJump):
1661         (JSC::ARMv7Assembler::maxJumpReplacementSize):
1662         (JSC::ARMv7Assembler::canBeJumpT3):
1663         (JSC::ARMv7Assembler::canBeJumpT4):
1664
1665 2012-11-19  Patrick Gansterer  <paroga@webkit.org>
1666
1667         [CMake] Create JavaScriptCore ForwardingHeaders
1668         https://bugs.webkit.org/show_bug.cgi?id=92665
1669
1670         Reviewed by Brent Fulgham.
1671
1672         When using CMake to build the Windows port, we need
1673         to generate the forwarding headers with it too.
1674
1675         * CMakeLists.txt:
1676
1677 2012-11-19  Kihong Kwon  <kihong.kwon@samsung.com>
1678
1679         Add PROXIMITY_EVENTS feature
1680         https://bugs.webkit.org/show_bug.cgi?id=102658
1681
1682         Reviewed by Kentaro Hara.
1683
1684         Add PROXIMITY_EVENTS feature to xcode project for JavaScriptCore.
1685
1686         * Configurations/FeatureDefines.xcconfig:
1687
1688 2012-11-18  Dan Bernstein  <mitz@apple.com>
1689
1690         Try to fix the DFG build after r135099.
1691
1692         * dfg/DFGCommon.h:
1693         (JSC::DFG::shouldShowDisassembly):
1694
1695 2012-11-18  Filip Pizlo  <fpizlo@apple.com>
1696
1697         Unreviewed, build fix for !ENABLE(DFG_JIT).
1698
1699         * dfg/DFGCommon.h:
1700         (JSC::DFG::shouldShowDisassembly):
1701         (DFG):
1702
1703 2012-11-18  Filip Pizlo  <fpizlo@apple.com>
1704
1705         JSC should have more logging in structure-related code
1706         https://bugs.webkit.org/show_bug.cgi?id=102630
1707
1708         Reviewed by Simon Fraser.
1709
1710         - JSValue::description() now tells you if something is a structure, and if so,
1711           what kind of structure it is.
1712         
1713         - Jettisoning logic now tells you why things are being jettisoned.
1714         
1715         - It's now possible to turn off GC-triggered jettisoning entirely.
1716
1717         * bytecode/CodeBlock.cpp:
1718         (JSC::CodeBlock::finalizeUnconditionally):
1719         (JSC::CodeBlock::reoptimize):
1720         (JSC::ProgramCodeBlock::jettison):
1721         (JSC::EvalCodeBlock::jettison):
1722         (JSC::FunctionCodeBlock::jettison):
1723         * bytecode/CodeBlock.h:
1724         (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
1725         * runtime/JSValue.cpp:
1726         (JSC::JSValue::description):
1727         * runtime/Options.h:
1728         (JSC):
1729
1730 2012-11-18  Filip Pizlo  <fpizlo@apple.com>
1731
1732         DFG constant folding phase should say 'changed = true' whenever it changes the graph
1733         https://bugs.webkit.org/show_bug.cgi?id=102550
1734
1735         Rubber stamped by Mark Hahnenberg.
1736
1737         * dfg/DFGConstantFoldingPhase.cpp:
1738         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1739
1740 2012-11-17  Elliott Sprehn  <esprehn@chromium.org>
1741
1742         Expose JSObject removeDirect and PrivateName to WebCore
1743         https://bugs.webkit.org/show_bug.cgi?id=102546
1744
1745         Reviewed by Geoffrey Garen.
1746
1747         Export removeDirect for use in WebCore so JSDependentRetained works.
1748
1749         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1750
1751 2012-11-16  Filip Pizlo  <fpizlo@apple.com>
1752
1753         Given a PutById or GetById with a proven structure, the DFG should be able to emit a PutByOffset or GetByOffset instead
1754         https://bugs.webkit.org/show_bug.cgi?id=102327
1755
1756         Reviewed by Mark Hahnenberg.
1757
1758         If the profiler tells us that a GetById or PutById may be polymorphic but our
1759         control flow analysis proves that it isn't, we should trust the control flow
1760         analysis over the profiler. This arises in cases where GetById or PutById were
1761         inlined: the inlined function may have been called from other places that led
1762         to polymorphism, but in the current inlined context, there is no polymorphism.
1763
1764         * bytecode/CodeBlock.cpp:
1765         (JSC::CodeBlock::dump):
1766         * bytecode/GetByIdStatus.cpp:
1767         (JSC::GetByIdStatus::computeFor):
1768         (JSC):
1769         * bytecode/GetByIdStatus.h:
1770         (JSC::GetByIdStatus::GetByIdStatus):
1771         (GetByIdStatus):
1772         * bytecode/PutByIdStatus.cpp:
1773         (JSC::PutByIdStatus::computeFor):
1774         (JSC):
1775         * bytecode/PutByIdStatus.h:
1776         (JSC):
1777         (JSC::PutByIdStatus::PutByIdStatus):
1778         (PutByIdStatus):
1779         * dfg/DFGAbstractState.cpp:
1780         (JSC::DFG::AbstractState::execute):
1781         * dfg/DFGAbstractValue.h:
1782         (JSC::DFG::AbstractValue::bestProvenStructure):
1783         (AbstractValue):
1784         * dfg/DFGConstantFoldingPhase.cpp:
1785         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1786         (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
1787         (ConstantFoldingPhase):
1788         * dfg/DFGNode.h:
1789         (JSC::DFG::Node::convertToGetByOffset):
1790         (Node):
1791         (JSC::DFG::Node::convertToPutByOffset):
1792         (JSC::DFG::Node::hasStorageResult):
1793         * runtime/JSGlobalObject.h:
1794         (JSC::Structure::prototypeChain):
1795         (JSC):
1796         (JSC::Structure::isValid):
1797         * runtime/Operations.h:
1798         (JSC::isPrototypeChainNormalized):
1799         (JSC):
1800         * runtime/Structure.h:
1801         (Structure):
1802         (JSC::Structure::transitionDidInvolveSpecificValue):
1803
1804 2012-11-16  Tony Chang  <tony@chromium.org>
1805
1806         Remove ENABLE_CSS_HIERARCHIES since it's no longer in use
1807         https://bugs.webkit.org/show_bug.cgi?id=102554
1808
1809         Reviewed by Andreas Kling.
1810
1811         As mentioned in https://bugs.webkit.org/show_bug.cgi?id=79939#c41 ,
1812         we're going to revist this feature once additional vendor support is
1813         achieved.
1814
1815         * Configurations/FeatureDefines.xcconfig:
1816
1817 2012-11-16  Patrick Gansterer  <paroga@webkit.org>
1818
1819         Build fix for WinCE after r133688.
1820
1821         Use numeric_limits<uint32_t>::max() instead of UINT32_MAX.
1822
1823         * runtime/CodeCache.h:
1824         (JSC::CacheMap::CacheMap):
1825
1826 2012-11-15  Filip Pizlo  <fpizlo@apple.com>
1827
1828         ClassInfo.h should have correct indentation.
1829
1830         Rubber stamped by Mark Hahnenberg.
1831
1832         ClassInfo.h had some true creativity in its use of whitespace. Some things within
1833         the namespace were indented four spaces and others where not. One #define had its
1834         contents indented four spaces, while another didn't. I applied the following rule:
1835         
1836         - Non-macro things in the namespace should not be indented (that's our current
1837           accepted practice).
1838         
1839         - Macros should never be indented but if they are multi-line then their subsequent
1840           bodies should be indented four spaces. I believe that is consistent with what we
1841           do elsewhere.
1842
1843         * runtime/ClassInfo.h:
1844         (JSC):
1845         (MethodTable):
1846         (ClassInfo):
1847         (JSC::ClassInfo::propHashTable):
1848         (JSC::ClassInfo::isSubClassOf):
1849         (JSC::ClassInfo::hasStaticProperties):
1850
1851 2012-11-15  Filip Pizlo  <fpizlo@apple.com>
1852
1853         DFG should copy propagate trivially no-op ConvertThis
1854         https://bugs.webkit.org/show_bug.cgi?id=102445
1855
1856         Reviewed by Oliver Hunt.
1857
1858         Copy propagation is always a good thing, since it reveals must-alias relationships
1859         to the CFA and CSE. This accomplishes copy propagation for ConvertThis by first
1860         converting it to an Identity node (which is done by the constant folder since it
1861         has access to CFA results) and then performing substitution of references to
1862         Identity with references to Identity's child in the CSE.
1863         
1864         I'm not aiming for a big speed-up here; I just think that this will be useful for
1865         the work on https://bugs.webkit.org/show_bug.cgi?id=102327.
1866
1867         * dfg/DFGAbstractState.cpp:
1868         (JSC::DFG::AbstractState::execute):
1869         * dfg/DFGCSEPhase.cpp:
1870         (JSC::DFG::CSEPhase::performNodeCSE):
1871         * dfg/DFGConstantFoldingPhase.cpp:
1872         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1873         * dfg/DFGNodeType.h:
1874         (DFG):
1875         * dfg/DFGPredictionPropagationPhase.cpp:
1876         (JSC::DFG::PredictionPropagationPhase::propagate):
1877         * dfg/DFGSpeculativeJIT32_64.cpp:
1878         (JSC::DFG::SpeculativeJIT::compile):
1879         * dfg/DFGSpeculativeJIT64.cpp:
1880         (JSC::DFG::SpeculativeJIT::compile):
1881
1882 2012-11-15  Filip Pizlo  <fpizlo@apple.com>
1883
1884         CallData.h should have correct indentation.
1885
1886         Rubber stamped by Mark Hahneberg.
1887
1888         * runtime/CallData.h:
1889         (JSC):
1890
1891 2012-11-15  Filip Pizlo  <fpizlo@apple.com>
1892
1893         Remove methodCallDummy since it is not used anymore.
1894
1895         Rubber stamped by Mark Hahnenberg.
1896
1897         * runtime/JSGlobalObject.cpp:
1898         (JSC::JSGlobalObject::reset):
1899         (JSC):
1900         (JSC::JSGlobalObject::visitChildren):
1901         * runtime/JSGlobalObject.h:
1902         (JSGlobalObject):
1903
1904 2012-11-14  Filip Pizlo  <fpizlo@apple.com>
1905
1906         Structure should be able to easily tell if the prototype chain might intercept a store
1907         https://bugs.webkit.org/show_bug.cgi?id=102326
1908
1909         Reviewed by Geoffrey Garen.
1910
1911         This improves our ability to reason about the correctness of the more optimized
1912         prototype chain walk in JSObject::put(), while also making it straight forward to
1913         check if the prototype chain will do strange things to a property store by just
1914         looking at the structure.
1915
1916         * runtime/JSObject.cpp:
1917         (JSC::JSObject::put):
1918         * runtime/Structure.cpp:
1919         (JSC::Structure::prototypeChainMayInterceptStoreTo):
1920         (JSC):
1921         * runtime/Structure.h:
1922         (Structure):
1923
1924 2012-11-15  Thiago Marcos P. Santos  <thiago.santos@intel.com>
1925
1926         [CMake] Do not regenerate LLIntAssembly.h on every incremental build
1927         https://bugs.webkit.org/show_bug.cgi?id=102248
1928
1929         Reviewed by Kenneth Rohde Christiansen.
1930
1931         Update LLIntAssembly.h's mtime after running asm.rb to make the build
1932         system dependency tracking consistent.
1933
1934         * CMakeLists.txt:
1935
1936 2012-11-15  Thiago Marcos P. Santos  <thiago.santos@intel.com>
1937
1938         Fix compiler warnings about signed/unsigned comparison on i386
1939         https://bugs.webkit.org/show_bug.cgi?id=102249
1940
1941         Reviewed by Kenneth Rohde Christiansen.
1942
1943         Add casting to unsigned to shut up gcc warnings. Build was broken on
1944         JSVALUE32_64 ports compiling with -Werror.
1945
1946         * llint/LLIntData.cpp:
1947         (JSC::LLInt::Data::performAssertions):
1948
1949 2012-11-14  Brent Fulgham  <bfulgham@webkit.org>
1950
1951         [Windows, WinCairo] Unreviewed build fix.
1952
1953         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1954         Missed one of the exports that was part of the WebKit2.def.
1955
1956 2012-11-14  Brent Fulgham  <bfulgham@webkit.org>
1957
1958         [Windows, WinCairo] Correct build failure.
1959         https://bugs.webkit.org/show_bug.cgi?id=102302
1960
1961         WebCore symbols were mistakenly added to the JavaScriptCore
1962         library definition file.
1963
1964         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Remove
1965         WebCore symbols that were incorrectly added to the export file.
1966
1967 2012-11-14  Mark Lam  <mark.lam@apple.com>
1968
1969         Change JSEventListener::m_jsFunction to be a weak ref.
1970         https://bugs.webkit.org/show_bug.cgi?id=101989.
1971
1972         Reviewed by Geoffrey Garen.
1973
1974         Added infrastructure for scanning weak ref slots.
1975
1976         * heap/SlotVisitor.cpp: Added #include "SlotVisitorInlines.h".
1977         * heap/SlotVisitor.h:
1978         (SlotVisitor): Added SlotVisitor::appendUnbarrieredWeak().
1979         * heap/SlotVisitorInlines.h: Added #include "Weak.h".
1980         (JSC::SlotVisitor::appendUnbarrieredWeak): Added.
1981         * heap/Weak.h:
1982         (JSC::operator==): Added operator==() for Weak.
1983         * runtime/JSCell.h: Removed #include "SlotVisitorInlines.h".
1984         * runtime/JSObject.h: Added #include "SlotVisitorInlines.h".
1985
1986 2012-11-14  Filip Pizlo  <fpizlo@apple.com>
1987
1988         Read-only properties created with putDirect() should tell the structure that there are read-only properties
1989         https://bugs.webkit.org/show_bug.cgi?id=102292
1990
1991         Reviewed by Gavin Barraclough.
1992
1993         This mostly affects things like function.length.
1994
1995         * runtime/JSObject.h:
1996         (JSC::JSObject::putDirectInternal):
1997
1998 2012-11-13  Filip Pizlo  <fpizlo@apple.com>
1999
2000         Don't access Node& after adding nodes to the graph.
2001         https://bugs.webkit.org/show_bug.cgi?id=102005
2002
2003         Reviewed by Oliver Hunt.
2004
2005         * dfg/DFGFixupPhase.cpp:
2006         (JSC::DFG::FixupPhase::fixupNode):
2007
2008 2012-11-14  Valery Ignatyev  <valery.ignatyev@ispras.ru>
2009
2010         Replace (typeof(x) != <"object", "undefined", ...>) with
2011         !(typeof(x) == <"object",..>). Later is_object, is_<...>  bytecode operation
2012         will be used.
2013
2014         https://bugs.webkit.org/show_bug.cgi?id=98893
2015
2016         Reviewed by Filip Pizlo.
2017
2018         This eliminates expensive  typeof implementation and
2019         allows to use DFG optimizations, which doesn't support 'typeof'.
2020
2021         * bytecompiler/NodesCodegen.cpp:
2022         (JSC::BinaryOpNode::emitBytecode):
2023
2024 2012-11-14  Peter Gal  <galpeter@inf.u-szeged.hu>
2025
2026         [Qt][ARM]REGRESSION(r133985): It broke the build
2027         https://bugs.webkit.org/show_bug.cgi?id=101740
2028
2029         Reviewed by Csaba Osztrogonác.
2030
2031         Changed the emitGenericContiguousPutByVal to accept the additional IndexingType argument.
2032         This information was passed as a template parameter.        
2033
2034         * jit/JIT.h:
2035         (JSC::JIT::emitInt32PutByVal):
2036         (JSC::JIT::emitDoublePutByVal):
2037         (JSC::JIT::emitContiguousPutByVal):
2038         (JIT):
2039         * jit/JITPropertyAccess.cpp:
2040         (JSC::JIT::emitGenericContiguousPutByVal):
2041         * jit/JITPropertyAccess32_64.cpp:
2042         (JSC::JIT::emitGenericContiguousPutByVal):
2043
2044 2012-11-14  Peter Gal  <galpeter@inf.u-szeged.hu>
2045
2046         Fix the MIPS build after r134332
2047         https://bugs.webkit.org/show_bug.cgi?id=102227
2048
2049         Reviewed by Csaba Osztrogonác.
2050
2051         Added missing methods for the MacroAssemblerMIPS, based on the MacroAssemblerARMv7.
2052
2053         * assembler/MacroAssemblerMIPS.h:
2054         (JSC::MacroAssemblerMIPS::canJumpReplacePatchableBranchPtrWithPatch):
2055         (MacroAssemblerMIPS):
2056         (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatch):
2057         (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranchPtrWithPatch):
2058
2059 2012-11-14  Peter Gal  <galpeter@inf.u-szeged.hu>
2060
2061         Fix the [-Wreturn-type] warning in JavaScriptCore/assembler/MacroAssemblerARM.h
2062         https://bugs.webkit.org/show_bug.cgi?id=102206
2063
2064         Reviewed by Csaba Osztrogonác.
2065
2066         Add a return value for the function to suppress the warning.
2067
2068         * assembler/MacroAssemblerARM.h:
2069         (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatch):
2070
2071 2012-11-14  Sheriff Bot  <webkit.review.bot@gmail.com>
2072
2073         Unreviewed, rolling out r134599.
2074         http://trac.webkit.org/changeset/134599
2075         https://bugs.webkit.org/show_bug.cgi?id=102225
2076
2077         It broke the 32 bit EFL build (Requested by Ossy on #webkit).
2078
2079         * jit/JITPropertyAccess.cpp:
2080         * jit/JITPropertyAccess32_64.cpp:
2081         (JSC):
2082         (JSC::JIT::emitGenericContiguousPutByVal):
2083
2084 2012-11-14  Balazs Kilvady  <kilvadyb@homejinni.com>
2085
2086         [Qt][ARM]REGRESSION(r133985): It broke the build
2087         https://bugs.webkit.org/show_bug.cgi?id=101740
2088
2089         Reviewed by Csaba Osztrogonác.
2090
2091         Template function body moved to fix VALUE_PROFILER disabled case.
2092
2093         * jit/JITPropertyAccess.cpp:
2094         (JSC):
2095         (JSC::JIT::emitGenericContiguousPutByVal):
2096         * jit/JITPropertyAccess32_64.cpp:
2097
2098 2012-11-13  Filip Pizlo  <fpizlo@apple.com>
2099
2100         DFG CreateThis should be able to statically account for the structure of the object it creates, if profiling indicates that this structure is always the same
2101         https://bugs.webkit.org/show_bug.cgi?id=102017
2102
2103         Reviewed by Geoffrey Garen.
2104
2105         This adds a watchpoint in JSFunction on the cached inheritor ID. It also changes
2106         NewObject to take a structure as an operand (previously it implicitly used the owning
2107         global object's empty object structure). Any GetCallee where the callee is predictable
2108         is turned into a CheckFunction + WeakJSConstant, and any CreateThis on a WeakJSConstant
2109         where the inheritor ID watchpoint is still valid is turned into an InheritorIDWatchpoint
2110         followed by a NewObject. NewObject already accounts for the structure it uses for object
2111         creation in the CFA.
2112
2113         * dfg/DFGAbstractState.cpp:
2114         (JSC::DFG::AbstractState::execute):
2115         * dfg/DFGByteCodeParser.cpp:
2116         (JSC::DFG::ByteCodeParser::parseBlock):
2117         * dfg/DFGCSEPhase.cpp:
2118         (JSC::DFG::CSEPhase::checkFunctionElimination):
2119         * dfg/DFGGraph.cpp:
2120         (JSC::DFG::Graph::dump):
2121         * dfg/DFGNode.h:
2122         (JSC::DFG::Node::hasFunction):
2123         (JSC::DFG::Node::function):
2124         (JSC::DFG::Node::hasStructure):
2125         * dfg/DFGNodeType.h:
2126         (DFG):
2127         * dfg/DFGOperations.cpp:
2128         * dfg/DFGOperations.h:
2129         * dfg/DFGPredictionPropagationPhase.cpp:
2130         (JSC::DFG::PredictionPropagationPhase::propagate):
2131         * dfg/DFGSpeculativeJIT.h:
2132         (JSC::DFG::SpeculativeJIT::callOperation):
2133         * dfg/DFGSpeculativeJIT32_64.cpp:
2134         (JSC::DFG::SpeculativeJIT::compile):
2135         * dfg/DFGSpeculativeJIT64.cpp:
2136         (JSC::DFG::SpeculativeJIT::compile):
2137         * runtime/Executable.h:
2138         (JSC::JSFunction::JSFunction):
2139         * runtime/JSBoundFunction.cpp:
2140         (JSC):
2141         * runtime/JSFunction.cpp:
2142         (JSC::JSFunction::JSFunction):
2143         (JSC::JSFunction::put):
2144         (JSC::JSFunction::defineOwnProperty):
2145         * runtime/JSFunction.h:
2146         (JSC::JSFunction::tryGetKnownInheritorID):
2147         (JSFunction):
2148         (JSC::JSFunction::addInheritorIDWatchpoint):
2149
2150 2012-11-13  Filip Pizlo  <fpizlo@apple.com>
2151
2152         JSFunction and its descendants should be destructible
2153         https://bugs.webkit.org/show_bug.cgi?id=102062
2154
2155         Reviewed by Mark Hahnenberg.
2156
2157         This will make it easy to place an InlineWatchpointSet inside JSFunction. In the
2158         future, we could make JSFunction non-destructible again by making a version of
2159         WatchpointSet that is entirely GC'd, but this seems like overkill for now.
2160         
2161         This is performance-neutral.
2162
2163         * runtime/JSBoundFunction.cpp:
2164         (JSC::JSBoundFunction::destroy):
2165         (JSC):
2166         * runtime/JSBoundFunction.h:
2167         (JSBoundFunction):
2168         * runtime/JSFunction.cpp:
2169         (JSC):
2170         (JSC::JSFunction::destroy):
2171         * runtime/JSFunction.h:
2172         (JSFunction):
2173
2174 2012-11-13  Cosmin Truta  <ctruta@rim.com>
2175
2176         Uninitialized fields in class JSLock
2177         https://bugs.webkit.org/show_bug.cgi?id=101695
2178
2179         Reviewed by Mark Hahnenberg.
2180
2181         Initialize JSLock::m_ownerThread and JSLock::m_lockDropDepth.
2182
2183         * runtime/JSLock.cpp:
2184         (JSC::JSLock::JSLock):
2185
2186 2012-11-13  Peter Gal  <galpeter@inf.u-szeged.hu>
2187
2188         Fix the ARM traditional build after r134332
2189         https://bugs.webkit.org/show_bug.cgi?id=102044
2190
2191         Reviewed by Zoltan Herczeg.
2192
2193         Added missing methods for the MacroAssemblerARM, based on the MacroAssemblerARMv7.
2194
2195         * assembler/MacroAssemblerARM.h:
2196         (JSC::MacroAssemblerARM::canJumpReplacePatchableBranchPtrWithPatch):
2197         (MacroAssemblerARM):
2198         (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatch):
2199         (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranchPtrWithPatch):
2200
2201 2012-11-12  Filip Pizlo  <fpizlo@apple.com>
2202
2203         op_get_callee should have value profiling
2204         https://bugs.webkit.org/show_bug.cgi?id=102047
2205
2206         Reviewed by Sam Weinig.
2207
2208         This will allow us to detect if the callee is always the same, which is probably
2209         the common case for a lot of constructors.
2210
2211         * bytecode/CodeBlock.cpp:
2212         (JSC::CodeBlock::CodeBlock):
2213         * bytecode/Opcode.h:
2214         (JSC):
2215         (JSC::padOpcodeName):
2216         * bytecompiler/BytecodeGenerator.cpp:
2217         (JSC::BytecodeGenerator::BytecodeGenerator):
2218         * jit/JITOpcodes.cpp:
2219         (JSC::JIT::emit_op_get_callee):
2220         * jit/JITOpcodes32_64.cpp:
2221         (JSC::JIT::emit_op_get_callee):
2222         * llint/LowLevelInterpreter32_64.asm:
2223         * llint/LowLevelInterpreter64.asm:
2224
2225 2012-11-12  Filip Pizlo  <fpizlo@apple.com>
2226
2227         The act of getting the callee during 'this' construction should be explicit in bytecode
2228         https://bugs.webkit.org/show_bug.cgi?id=102016
2229
2230         Reviewed by Michael Saboff.
2231
2232         This is mostly a rollout of http://trac.webkit.org/changeset/116673, but also includes
2233         changes to have create_this use the result of get_callee.
2234         
2235         No performance or behavioral impact. This is just meant to allow us to profile
2236         get_callee in the future.
2237
2238         * bytecode/CodeBlock.cpp:
2239         (JSC::CodeBlock::dump):
2240         * bytecode/Opcode.h:
2241         (JSC):
2242         (JSC::padOpcodeName):
2243         * bytecompiler/BytecodeGenerator.cpp:
2244         (JSC::BytecodeGenerator::BytecodeGenerator):
2245         * dfg/DFGByteCodeParser.cpp:
2246         (JSC::DFG::ByteCodeParser::parseBlock):
2247         * dfg/DFGCapabilities.h:
2248         (JSC::DFG::canCompileOpcode):
2249         * jit/JIT.cpp:
2250         (JSC::JIT::privateCompileMainPass):
2251         * jit/JIT.h:
2252         (JIT):
2253         * jit/JITOpcodes.cpp:
2254         (JSC::JIT::emit_op_get_callee):
2255         (JSC):
2256         (JSC::JIT::emit_op_create_this):
2257         * jit/JITOpcodes32_64.cpp:
2258         (JSC::JIT::emit_op_get_callee):
2259         (JSC):
2260         (JSC::JIT::emit_op_create_this):
2261         * llint/LLIntSlowPaths.cpp:
2262         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2263         * llint/LowLevelInterpreter32_64.asm:
2264         * llint/LowLevelInterpreter64.asm:
2265
2266 2012-11-12  Filip Pizlo  <fpizlo@apple.com>
2267
2268         Unreviewed, fix ARMv7 build.
2269
2270         * assembler/MacroAssemblerARMv7.h:
2271         (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatch):
2272         (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
2273
2274 2012-11-12  Filip Pizlo  <fpizlo@apple.com>
2275
2276         Patching of jumps to stubs should use jump replacement rather than branch destination overwrite
2277         https://bugs.webkit.org/show_bug.cgi?id=101909
2278
2279         Reviewed by Geoffrey Garen.
2280
2281         This saves a few instructions in inline cases, on those architectures where it is
2282         easy to figure out where to put the jump replacement. Sub-1% speed-up across the
2283         board.
2284
2285         * assembler/MacroAssemblerARMv7.h:
2286         (MacroAssemblerARMv7):
2287         (JSC::MacroAssemblerARMv7::canJumpReplacePatchableBranchPtrWithPatch):
2288         (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatch):
2289         (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
2290         * assembler/MacroAssemblerX86.h:
2291         (JSC::MacroAssemblerX86::canJumpReplacePatchableBranchPtrWithPatch):
2292         (MacroAssemblerX86):
2293         (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatch):
2294         (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranchPtrWithPatch):
2295         * assembler/MacroAssemblerX86_64.h:
2296         (JSC::MacroAssemblerX86_64::canJumpReplacePatchableBranchPtrWithPatch):
2297         (MacroAssemblerX86_64):
2298         (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatch):
2299         (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranchPtrWithPatch):
2300         * assembler/RepatchBuffer.h:
2301         (JSC::RepatchBuffer::startOfPatchableBranchPtrWithPatch):
2302         (RepatchBuffer):
2303         (JSC::RepatchBuffer::replaceWithJump):
2304         (JSC::RepatchBuffer::revertJumpReplacementToPatchableBranchPtrWithPatch):
2305         * assembler/X86Assembler.h:
2306         (X86Assembler):
2307         (JSC::X86Assembler::revertJumpTo_movq_i64r):
2308         (JSC::X86Assembler::revertJumpTo_cmpl_im_force32):
2309         (X86InstructionFormatter):
2310         * bytecode/StructureStubInfo.h:
2311         * dfg/DFGRepatch.cpp:
2312         (JSC::DFG::replaceWithJump):
2313         (DFG):
2314         (JSC::DFG::tryCacheGetByID):
2315         (JSC::DFG::tryBuildGetByIDList):
2316         (JSC::DFG::tryBuildGetByIDProtoList):
2317         (JSC::DFG::tryCachePutByID):
2318         (JSC::DFG::dfgResetGetByID):
2319         (JSC::DFG::dfgResetPutByID):
2320
2321 2012-11-11  Filip Pizlo  <fpizlo@apple.com>
2322
2323         DFG ArithMul overflow check elimination is too aggressive
2324         https://bugs.webkit.org/show_bug.cgi?id=101871
2325
2326         Reviewed by Oliver Hunt.
2327
2328         The code was ignoring the fact that ((a * b) | 0) == (((a | 0) * (b | 0)) | 0)
2329         only holds if a * b < 2^53. So, I changed it to only enable the optimization
2330         when a < 2^22 and b is an int32 (and vice versa), using a super trivial peephole
2331         analysis to prove the inequality. I considered writing an epic forward flow
2332         formulation that tracks the ranges of integer values but then I thought better
2333         of it.
2334         
2335         This also rewires the ArithMul integer speculation logic. Previously, we would
2336         assume that an ArithMul was only UsedAsNumber if it escaped, and separately we
2337         would decide whether to speculate integer based on a proof of the <2^22
2338         inequality. Now, we treat the double rounding behavior of ArithMul as if the
2339         result was UsedAsNumber even if it did not escape. Then we try to prove that
2340         double rounding cannot happen by attemping to prove that a < 2^22. This then
2341         feeds back into the decision of whether or not to speculate integer (if we fail
2342         to prove a < 2^22 then we're UsedAsNumber, and if we're also MayOverflow then
2343         that forces double speculation).
2344         
2345         No performance impact. It just fixes a bug.
2346
2347         * dfg/DFGGraph.h:
2348         (JSC::DFG::Graph::mulShouldSpeculateInteger):
2349         * dfg/DFGPredictionPropagationPhase.cpp:
2350         (PredictionPropagationPhase):
2351         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoForConstant):
2352         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoNonRecursive):
2353         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwo):
2354         (JSC::DFG::PredictionPropagationPhase::propagate):
2355
2356 2012-11-11  Filip Pizlo  <fpizlo@apple.com>
2357
2358         DFG should not emit function checks if we've already proved that the operand is that exact function
2359         https://bugs.webkit.org/show_bug.cgi?id=101885
2360
2361         Reviewed by Oliver Hunt.
2362
2363         * dfg/DFGAbstractState.cpp:
2364         (JSC::DFG::AbstractState::execute):
2365         * dfg/DFGAbstractValue.h:
2366         (JSC::DFG::AbstractValue::filterByValue):
2367         (AbstractValue):
2368         * dfg/DFGConstantFoldingPhase.cpp:
2369         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2370
2371 2012-11-12  Kentaro Hara  <haraken@chromium.org>
2372
2373         [V8][JSC] ScriptProfileNode::callUID needs not to be [Custom]
2374         https://bugs.webkit.org/show_bug.cgi?id=101892
2375
2376         Reviewed by Adam Barth.
2377
2378         Added callUID(), which enables us to kill custom bindings for ScriptProfileNode::callUID.
2379
2380         * profiler/ProfileNode.h:
2381         (JSC::ProfileNode::callUID):
2382
2383 2012-11-12  Carlos Garcia Campos  <cgarcia@igalia.com>
2384
2385         Unreviewed. Fix make distcheck.
2386
2387         * GNUmakefile.list.am: Add missing header.
2388
2389 2012-11-11  Michael Pruett  <michael@68k.org>
2390
2391         Fix assertion failure in JSObject::tryGetIndexQuickly()
2392         https://bugs.webkit.org/show_bug.cgi?id=101869
2393
2394         Reviewed by Filip Pizlo.
2395
2396         Currently JSObject::tryGetIndexQuickly() triggers an assertion
2397         failure when the object has an undecided indexing type. This
2398         case should be treated the same as a blank indexing type.
2399
2400         * runtime/JSObject.h:
2401         (JSC::JSObject::tryGetIndexQuickly):
2402
2403 2012-11-11  Filip Pizlo  <fpizlo@apple.com>
2404
2405         DFG register allocation should be greedy rather than round-robin
2406         https://bugs.webkit.org/show_bug.cgi?id=101870
2407
2408         Reviewed by Geoffrey Garen.
2409
2410         This simplifies the code, reduces some code duplication, and shows some slight
2411         performance improvements in a few places, likely due to the fact that lower-numered
2412         registers also typically have smaller encodings.
2413
2414         * dfg/DFGRegisterBank.h:
2415         (JSC::DFG::RegisterBank::RegisterBank):
2416         (JSC::DFG::RegisterBank::tryAllocate):
2417         (JSC::DFG::RegisterBank::allocate):
2418         (JSC::DFG::RegisterBank::allocateInternal):
2419         (RegisterBank):
2420
2421 2012-11-11  Kenichi Ishibashi  <bashi@chromium.org>
2422
2423         WTFString::utf8() should have a mode of conversion to use replacement character
2424         https://bugs.webkit.org/show_bug.cgi?id=101678
2425
2426         Reviewed by Alexey Proskuryakov.
2427
2428         Follow the change on String::utf8()
2429
2430         * runtime/JSGlobalObjectFunctions.cpp:
2431         (JSC::encode): Pass String::StrictConversion instead of true to String::utf8().
2432
2433 2012-11-10  Filip Pizlo  <fpizlo@apple.com>
2434
2435         DFG should optimize out the NaN check on loads from double arrays if the array prototype chain is having a great time
2436         https://bugs.webkit.org/show_bug.cgi?id=101718
2437
2438         Reviewed by Geoffrey Garen.
2439
2440         If we're reading from a JSArray in double mode, where the array's structure is
2441         primordial (all aspects of the structure are unchanged except for indexing type),
2442         and the result of the load is used in arithmetic that is known to not distinguish
2443         between NaN and undefined, then we should not emit a NaN check. Looks like a 5%
2444         win on navier-stokes.
2445         
2446         Also fixed an OpInfo initialization goof for String ops that was revealed by this
2447         change.
2448
2449         * dfg/DFGAbstractState.cpp:
2450         (JSC::DFG::AbstractState::execute):
2451         * dfg/DFGArrayMode.cpp:
2452         (JSC::DFG::arraySpeculationToString):
2453         * dfg/DFGArrayMode.h:
2454         (JSC::DFG::ArrayMode::isSaneChain):
2455         (ArrayMode):
2456         (JSC::DFG::ArrayMode::isInBounds):
2457         * dfg/DFGByteCodeParser.cpp:
2458         (JSC::DFG::ByteCodeParser::handleIntrinsic):
2459         * dfg/DFGFixupPhase.cpp:
2460         (JSC::DFG::FixupPhase::fixupNode):
2461         * dfg/DFGNodeFlags.cpp:
2462         (JSC::DFG::nodeFlagsAsString):
2463         * dfg/DFGNodeFlags.h:
2464         (DFG):
2465         * dfg/DFGPredictionPropagationPhase.cpp:
2466         (JSC::DFG::PredictionPropagationPhase::propagate):
2467         * dfg/DFGSpeculativeJIT32_64.cpp:
2468         (JSC::DFG::SpeculativeJIT::compile):
2469         * dfg/DFGSpeculativeJIT64.cpp:
2470         (JSC::DFG::SpeculativeJIT::compile):
2471         * runtime/JSGlobalObject.cpp:
2472         (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
2473         (JSC):
2474         * runtime/JSGlobalObject.h:
2475         (JSGlobalObject):
2476
2477 2012-11-10  Filip Pizlo  <fpizlo@apple.com>
2478
2479         DFG constant folding and CFG simplification should be smart enough to know that if a logical op's operand is proven to have a non-masquerading structure then it always evaluates to true
2480         https://bugs.webkit.org/show_bug.cgi?id=101511
2481
2482         Reviewed by Geoffrey Garen.
2483         
2484         This is the second attempt at this patch, which fixes the !"" case.
2485
2486         To make life easier, this moves BranchDirection into BasicBlock so that after
2487         running the CFA, we always know, for each block, what direction the CFA
2488         proved. CFG simplification now both uses and preserves cfaBranchDirection in
2489         its transformations.
2490         
2491         Also made both LogicalNot and Branch check whether the operand is a known cell
2492         with a known structure, and if so, made them do the appropriate folding.
2493         
2494         5% speed-up on V8/raytrace because it makes raytrace's own null checks
2495         evaporate (i.e. idioms like 'if (!x) throw "unhappiness"') thanks to the fact
2496         that we were already doing structure check hoisting.
2497
2498         * JavaScriptCore.xcodeproj/project.pbxproj:
2499         * dfg/DFGAbstractState.cpp:
2500         (JSC::DFG::AbstractState::endBasicBlock):
2501         (JSC::DFG::AbstractState::execute):
2502         (JSC::DFG::AbstractState::mergeToSuccessors):
2503         * dfg/DFGAbstractState.h:
2504         (AbstractState):
2505         * dfg/DFGBasicBlock.h:
2506         (JSC::DFG::BasicBlock::BasicBlock):
2507         (BasicBlock):
2508         * dfg/DFGBranchDirection.h: Added.
2509         (DFG):
2510         (JSC::DFG::branchDirectionToString):
2511         (JSC::DFG::isKnownDirection):
2512         (JSC::DFG::branchCondition):
2513         * dfg/DFGCFGSimplificationPhase.cpp:
2514         (JSC::DFG::CFGSimplificationPhase::run):
2515         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
2516
2517 2012-11-10  Sheriff Bot  <webkit.review.bot@gmail.com>
2518
2519         Unreviewed, rolling out r133971.
2520         http://trac.webkit.org/changeset/133971
2521         https://bugs.webkit.org/show_bug.cgi?id=101839
2522
2523         Causes WebProcess to hang at 100% on www.apple.com (Requested
2524         by kling on #webkit).
2525
2526         * JavaScriptCore.xcodeproj/project.pbxproj:
2527         * dfg/DFGAbstractState.cpp:
2528         (JSC::DFG::AbstractState::endBasicBlock):
2529         (JSC::DFG::AbstractState::execute):
2530         (JSC::DFG::AbstractState::mergeToSuccessors):
2531         * dfg/DFGAbstractState.h:
2532         (JSC::DFG::AbstractState::branchDirectionToString):
2533         (AbstractState):
2534         * dfg/DFGBasicBlock.h:
2535         (JSC::DFG::BasicBlock::BasicBlock):
2536         (BasicBlock):
2537         * dfg/DFGBranchDirection.h: Removed.
2538         * dfg/DFGCFGSimplificationPhase.cpp:
2539         (JSC::DFG::CFGSimplificationPhase::run):
2540         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
2541
2542 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
2543
2544         If the DFG ArrayMode says that an access is on an OriginalArray, then the checks should always enforce this
2545         https://bugs.webkit.org/show_bug.cgi?id=101720
2546
2547         Reviewed by Mark Hahnenberg.
2548
2549         Previously, "original" arrays was just a hint that we could find the structure
2550         of the array if we needed to even if the array profile didn't have it due to
2551         polymorphism. Now, "original" arrays are a property that is actually checked:
2552         if an array access has ArrayMode::arrayClass() == Array::OriginalArray, then we
2553         can be sure that the code performing the access is dealing with not just a
2554         JSArray, but a JSArray that has no named properties, no indexed accessors, and
2555         the ArrayPrototype as its prototype. This will be useful for optimizations that
2556         are being done as part of https://bugs.webkit.org/show_bug.cgi?id=101720.
2557
2558         * dfg/DFGAbstractState.cpp:
2559         (JSC::DFG::AbstractState::execute):
2560         * dfg/DFGArrayMode.cpp:
2561         (JSC::DFG::ArrayMode::originalArrayStructure):
2562         (DFG):
2563         (JSC::DFG::ArrayMode::alreadyChecked):
2564         * dfg/DFGArrayMode.h:
2565         (JSC):
2566         (DFG):
2567         (JSC::DFG::ArrayMode::withProfile):
2568         (ArrayMode):
2569         (JSC::DFG::ArrayMode::benefitsFromOriginalArray):
2570         * dfg/DFGConstantFoldingPhase.cpp:
2571         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2572         * dfg/DFGFixupPhase.cpp:
2573         (JSC::DFG::FixupPhase::checkArray):
2574         * dfg/DFGSpeculativeJIT.cpp:
2575         (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
2576         (JSC::DFG::SpeculativeJIT::checkArray):
2577         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
2578         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
2579         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
2580         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
2581         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
2582         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
2583
2584 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
2585
2586         Fix indentation of BooleanPrototype.h
2587
2588         Rubber stamped by Mark Hahnenberg.
2589
2590         * runtime/BooleanPrototype.h:
2591
2592 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
2593
2594         Fix indentation of BooleanObject.h
2595
2596         Rubber stamped by Mark Hahnenberg.
2597
2598         * runtime/BooleanObject.h:
2599
2600 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
2601
2602         Fix indentation of BooleanConstructor.h
2603
2604         Rubber stamped by Mark Hahnenberg.
2605
2606         * runtime/BooleanConstructor.h:
2607
2608 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
2609
2610         Fix indentation of BatchedTransitionOptimizer.h
2611
2612         Rubber stamped by Mark Hahnenberg.
2613
2614         * runtime/BatchedTransitionOptimizer.h:
2615
2616 2012-11-09  Oliver Hunt  <oliver@apple.com>
2617
2618         So Thingy probably isn't the best name for a class, so
2619         renamed to CacheMap.
2620
2621         RS=Geoff
2622
2623         * runtime/CodeCache.h:
2624         (JSC::CacheMap::CacheMap):
2625
2626 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
2627
2628         ArrayPrototype should start out with a blank indexing type
2629         https://bugs.webkit.org/show_bug.cgi?id=101719
2630
2631         Reviewed by Mark Hahnenberg.
2632
2633         This allows us to track if the array prototype ever ends up with indexed
2634         properties.
2635
2636         * runtime/ArrayPrototype.cpp:
2637         (JSC::ArrayPrototype::create):
2638         (JSC::ArrayPrototype::ArrayPrototype):
2639         * runtime/ArrayPrototype.h:
2640         (ArrayPrototype):
2641         (JSC::ArrayPrototype::createStructure):
2642
2643 2012-11-08  Mark Hahnenberg  <mhahnenberg@apple.com>
2644
2645         MarkStackArray should use the BlockAllocator instead of the MarkStackSegmentAllocator
2646         https://bugs.webkit.org/show_bug.cgi?id=101642
2647
2648         Reviewed by Filip Pizlo.
2649
2650         MarkStackSegmentAllocator is like a miniature version of the BlockAllocator. Now that the BlockAllocator has support 
2651         for a variety of block sizes, we should get rid of the MarkStackSegmentAllocator in favor of the BlockAllocator.
2652
2653         * heap/BlockAllocator.h: Add new specializations of regionSetFor for the new MarkStackSegments.
2654         (JSC):
2655         (JSC::MarkStackSegment):
2656         * heap/GCThreadSharedData.cpp:
2657         (JSC::GCThreadSharedData::GCThreadSharedData):
2658         (JSC::GCThreadSharedData::reset):
2659         * heap/GCThreadSharedData.h:
2660         (GCThreadSharedData):
2661         * heap/MarkStack.cpp: 
2662         (JSC::MarkStackArray::MarkStackArray): We now have a doubly linked list of MarkStackSegments, so we need to refactor 
2663         all the places that used the old custom tail/previous logic.
2664         (JSC::MarkStackArray::~MarkStackArray):
2665         (JSC::MarkStackArray::expand):
2666         (JSC::MarkStackArray::refill):
2667         (JSC::MarkStackArray::donateSomeCellsTo): Refactor to use the new linked list.
2668         (JSC::MarkStackArray::stealSomeCellsFrom): Ditto.
2669         * heap/MarkStack.h:
2670         (JSC):
2671         (MarkStackSegment):
2672         (JSC::MarkStackSegment::MarkStackSegment):
2673         (JSC::MarkStackSegment::sizeFromCapacity):
2674         (MarkStackArray):
2675         * heap/MarkStackInlines.h:
2676         (JSC::MarkStackSegment::create):
2677         (JSC):
2678         (JSC::MarkStackArray::postIncTop):
2679         (JSC::MarkStackArray::preDecTop):
2680         (JSC::MarkStackArray::setTopForFullSegment):
2681         (JSC::MarkStackArray::setTopForEmptySegment):
2682         (JSC::MarkStackArray::top):
2683         (JSC::MarkStackArray::validatePrevious):
2684         (JSC::MarkStackArray::append):
2685         (JSC::MarkStackArray::removeLast):
2686         (JSC::MarkStackArray::isEmpty):
2687         (JSC::MarkStackArray::size):
2688         * heap/SlotVisitor.cpp:
2689         (JSC::SlotVisitor::SlotVisitor):
2690
2691 2012-11-09  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
2692
2693         [Qt] r133953 broke the ARM_TRADITIONAL build
2694         https://bugs.webkit.org/show_bug.cgi?id=101706
2695
2696         Reviewed by Csaba Osztrogonác.
2697
2698         Fix for both hardfp and softfp.
2699
2700         * dfg/DFGCCallHelpers.h:
2701         (CCallHelpers):
2702         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
2703
2704 2012-11-09  Sheriff Bot  <webkit.review.bot@gmail.com>
2705
2706         Unreviewed, rolling out r134051.
2707         http://trac.webkit.org/changeset/134051
2708         https://bugs.webkit.org/show_bug.cgi?id=101757
2709
2710         It didn't fix the build (Requested by Ossy on #webkit).
2711
2712         * dfg/DFGCCallHelpers.h:
2713         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
2714
2715 2012-11-09  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
2716
2717         [Qt] r133953 broke the ARM_TRADITIONAL build
2718         https://bugs.webkit.org/show_bug.cgi?id=101706
2719
2720         Reviewed by Csaba Osztrogonác.
2721
2722         Fix the ARM_TRADITIONAL build after r133953
2723
2724         * dfg/DFGCCallHelpers.h:
2725         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
2726         (CCallHelpers):
2727
2728 2012-11-09  Csaba Osztrogonác  <ossy@webkit.org>
2729
2730         [Qt] Fix the LLINT build from ARMv7 platform
2731         https://bugs.webkit.org/show_bug.cgi?id=101712
2732
2733         Reviewed by Simon Hausmann.
2734
2735         Enable generating of LLIntAssembly.h on ARM platforms.
2736
2737         * DerivedSources.pri:
2738         * JavaScriptCore.pro:
2739
2740 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
2741
2742         ArrayPrototype.h should have correct indentation
2743
2744         Rubber stamped by Sam Weinig.
2745
2746         * runtime/ArrayPrototype.h:
2747
2748 2012-11-08  Mark Lam  <mark.lam@apple.com>
2749
2750         Renamed ...InlineMethods.h files to ...Inlines.h.
2751         https://bugs.webkit.org/show_bug.cgi?id=101145.
2752
2753         Reviewed by Geoffrey Garen.
2754
2755         This is only a refactoring effort to rename the files. There are no
2756         functionality changes.
2757
2758         * API/JSObjectRef.cpp:
2759         * GNUmakefile.list.am:
2760         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2761         * JavaScriptCore.xcodeproj/project.pbxproj:
2762         * bytecode/CodeBlock.cpp:
2763         * dfg/DFGOperations.cpp:
2764         * heap/ConservativeRoots.cpp:
2765         * heap/CopiedBlock.h:
2766         * heap/CopiedSpace.cpp:
2767         * heap/CopiedSpaceInlineMethods.h: Removed.
2768         * heap/CopiedSpaceInlines.h: Copied from Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h.
2769         * heap/CopyVisitor.cpp:
2770         * heap/CopyVisitorInlineMethods.h: Removed.
2771         * heap/CopyVisitorInlines.h: Copied from Source/JavaScriptCore/heap/CopyVisitorInlineMethods.h.
2772         * heap/GCThread.cpp:
2773         * heap/GCThreadSharedData.cpp:
2774         * heap/HandleStack.cpp:
2775         * heap/Heap.cpp:
2776         * heap/HeapRootVisitor.h:
2777         * heap/MarkStack.cpp:
2778         * heap/MarkStackInlineMethods.h: Removed.
2779         * heap/MarkStackInlines.h: Copied from Source/JavaScriptCore/heap/MarkStackInlineMethods.h.
2780         * heap/SlotVisitor.cpp:
2781         * heap/SlotVisitor.h:
2782         * heap/SlotVisitorInlineMethods.h: Removed.
2783         * heap/SlotVisitorInlines.h: Copied from Source/JavaScriptCore/heap/SlotVisitorInlineMethods.h.
2784         * jit/HostCallReturnValue.cpp:
2785         * jit/JIT.cpp:
2786         * jit/JITArithmetic.cpp:
2787         * jit/JITArithmetic32_64.cpp:
2788         * jit/JITCall.cpp:
2789         * jit/JITCall32_64.cpp:
2790         * jit/JITInlineMethods.h: Removed.
2791         * jit/JITInlines.h: Copied from Source/JavaScriptCore/jit/JITInlineMethods.h.
2792         * jit/JITOpcodes.cpp:
2793         * jit/JITOpcodes32_64.cpp:
2794         * jit/JITPropertyAccess.cpp:
2795         * jit/JITPropertyAccess32_64.cpp:
2796         * jsc.cpp:
2797         * runtime/ArrayConstructor.cpp:
2798         * runtime/ArrayPrototype.cpp:
2799         * runtime/ButterflyInlineMethods.h: Removed.
2800         * runtime/ButterflyInlines.h: Copied from Source/JavaScriptCore/runtime/ButterflyInlineMethods.h.
2801         * runtime/IndexingHeaderInlineMethods.h: Removed.
2802         * runtime/IndexingHeaderInlines.h: Copied from Source/JavaScriptCore/runtime/IndexingHeaderInlineMethods.h.
2803         * runtime/JSActivation.h:
2804         * runtime/JSArray.cpp:
2805         * runtime/JSArray.h:
2806         * runtime/JSCell.h:
2807         * runtime/JSObject.cpp:
2808         * runtime/JSValueInlineMethods.h: Removed.
2809         * runtime/JSValueInlines.h: Copied from Source/JavaScriptCore/runtime/JSValueInlineMethods.h.
2810         * runtime/LiteralParser.cpp:
2811         * runtime/ObjectConstructor.cpp:
2812         * runtime/Operations.h:
2813         * runtime/RegExpMatchesArray.cpp:
2814         * runtime/RegExpObject.cpp:
2815         * runtime/StringPrototype.cpp:
2816
2817 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
2818
2819         ArrayConstructor.h should have correct indentation
2820
2821         Rubber stamped by Sam Weinig.
2822
2823         * runtime/ArrayConstructor.h:
2824
2825 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
2826
2827         DFG should know that int == null is always false
2828         https://bugs.webkit.org/show_bug.cgi?id=101665
2829
2830         Reviewed by Oliver Hunt.
2831
2832         * dfg/DFGAbstractState.cpp:
2833         (JSC::DFG::AbstractState::execute):
2834
2835 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
2836
2837         Arguments.h should have correct indentation
2838
2839         Rubber stamped by Sam Weinig.
2840
2841         * runtime/Arguments.h:
2842
2843 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
2844
2845         It should be possible to JIT compile get_by_vals and put_by_vals even if the DFG is disabled.
2846
2847         Reviewed by Oliver Hunt.
2848
2849         * jit/JITInlineMethods.h:
2850         (JSC::JIT::chooseArrayMode):
2851
2852 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
2853
2854         op_call should have LLInt call link info even if the DFG is disabled
2855         https://bugs.webkit.org/show_bug.cgi?id=101672
2856
2857         Reviewed by Oliver Hunt.
2858
2859         Get rid of the evil uses of fall-through.
2860
2861         * bytecode/CodeBlock.cpp:
2862         (JSC::CodeBlock::CodeBlock):
2863
2864 2012-11-08  Oliver Hunt  <oliver@apple.com>
2865
2866         Improve effectiveness of function-level caching
2867         https://bugs.webkit.org/show_bug.cgi?id=101667
2868
2869         Reviewed by Filip Pizlo.
2870
2871         Added a random-eviction based cache for unlinked functions, and switch
2872         UnlinkedFunctionExecutable's code references to Weak<>, thereby letting
2873         us remove the explicit UnlinkedFunctionExecutable::clearCode() calls that
2874         were being triggered by GC.
2875
2876         Refactored the random eviction part of the CodeCache into a separate data
2877         structure so that I didn't have to duplicate the code again, and then used
2878         that for the new function cache.
2879
2880         * bytecode/UnlinkedCodeBlock.cpp:
2881         (JSC::UnlinkedFunctionExecutable::visitChildren):
2882         (JSC::UnlinkedFunctionExecutable::codeBlockFor):
2883         * bytecode/UnlinkedCodeBlock.h:
2884         (JSC::UnlinkedFunctionExecutable::clearCodeForRecompilation):
2885         (UnlinkedFunctionExecutable):
2886         * debugger/Debugger.cpp:
2887         * runtime/CodeCache.cpp:
2888         (JSC::CodeCache::getCodeBlock):
2889         (JSC::CodeCache::generateFunctionCodeBlock):
2890         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
2891         (JSC::CodeCache::usedFunctionCode):
2892         (JSC):
2893         * runtime/Executable.cpp:
2894         (JSC::FunctionExecutable::clearUnlinkedCodeForRecompilationIfNotCompiling):
2895         (JSC::FunctionExecutable::clearCode):
2896         * runtime/Executable.h:
2897         (FunctionExecutable):
2898
2899 2012-11-07  Filip Pizlo  <fpizlo@apple.com>
2900
2901         DFG constant folding and CFG simplification should be smart enough to know that if a logical op's operand is proven to have a non-masquerading structure then it always evaluates to true
2902         https://bugs.webkit.org/show_bug.cgi?id=101511
2903
2904         Reviewed by Oliver Hunt.
2905
2906         To make life easier, this moves BranchDirection into BasicBlock so that after
2907         running the CFA, we always know, for each block, what direction the CFA
2908         proved. CFG simplification now both uses and preserves cfaBranchDirection in
2909         its transformations.
2910         
2911         Also made both LogicalNot and Branch check whether the operand is a known cell
2912         with a known structure, and if so, made them do the appropriate folding.
2913         
2914         5% speed-up on V8/raytrace because it makes raytrace's own null checks
2915         evaporate (i.e. idioms like 'if (!x) throw "unhappiness"') thanks to the fact
2916         that we were already doing structure check hoisting.
2917
2918         * JavaScriptCore.xcodeproj/project.pbxproj:
2919         * dfg/DFGAbstractState.cpp:
2920         (JSC::DFG::AbstractState::endBasicBlock):
2921         (JSC::DFG::AbstractState::execute):
2922         (JSC::DFG::AbstractState::mergeToSuccessors):
2923         * dfg/DFGAbstractState.h:
2924         (AbstractState):
2925         * dfg/DFGBasicBlock.h:
2926         (JSC::DFG::BasicBlock::BasicBlock):
2927         (BasicBlock):
2928         * dfg/DFGBranchDirection.h: Added.
2929         (DFG):
2930         (JSC::DFG::branchDirectionToString):
2931         (JSC::DFG::isKnownDirection):
2932         (JSC::DFG::branchCondition):
2933         * dfg/DFGCFGSimplificationPhase.cpp:
2934         (JSC::DFG::CFGSimplificationPhase::run):
2935         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
2936
2937 2012-11-08  Christophe Dumez  <christophe.dumez@intel.com>
2938
2939         [JSC] HTML extensions to String.prototype should escape " as &quot; in argument values
2940         https://bugs.webkit.org/show_bug.cgi?id=90667
2941
2942         Reviewed by Benjamin Poulain.
2943
2944         Escape quotation mark as &quot; in argument values to:
2945         - String.prototype.anchor(name)
2946         - String.prototype.fontcolor(color)
2947         - String.prototype.fontsize(size)
2948         - String.prototype.link(href)
2949
2950         This behavior matches Chromium/V8 and Firefox/Spidermonkey
2951         implementations and is requited by:
2952         http://mathias.html5.org/specs/javascript/#escapeattributevalue
2953
2954         This also fixes a potential security risk (XSS vector).
2955
2956         * runtime/StringPrototype.cpp:
2957         (JSC::stringProtoFuncFontcolor):
2958         (JSC::stringProtoFuncFontsize):
2959         (JSC::stringProtoFuncAnchor):
2960         (JSC::stringProtoFuncLink):
2961
2962 2012-11-08  Anders Carlsson  <andersca@apple.com>
2963
2964         HeapStatistics::s_pauseTimeStarts and s_pauseTimeEnds should be Vectors
2965         https://bugs.webkit.org/show_bug.cgi?id=101651
2966
2967         Reviewed by Andreas Kling.
2968
2969         HeapStatistics uses Deques when Vectors would work just as good.
2970
2971         * heap/HeapStatistics.cpp:
2972         * heap/HeapStatistics.h:
2973         (HeapStatistics):
2974
2975 2012-11-07  Filip Pizlo  <fpizlo@apple.com>
2976
2977         DFG should not assume that something is a double just because it might be undefined
2978         https://bugs.webkit.org/show_bug.cgi?id=101438
2979
2980         Reviewed by Oliver Hunt.
2981
2982         This changes all non-bitop arithmetic to (a) statically expect that variables are
2983         defined prior to use in arithmetic and (b) not fall off into double paths just
2984         because a value may not be a number. This is accomplished with two new notions of
2985         speculation:
2986         
2987         shouldSpeculateIntegerExpectingDefined: Should we speculate that the value is an
2988         integer if we ignore undefined (i.e. SpecOther) predictions?
2989         
2990         shouldSpeculateIntegerForArithmetic: Should we speculate that the value is an
2991         integer if we ignore non-numeric predictions?
2992         
2993         This is a ~2x speed-up on programs that seem to our prediction propagator to have
2994         paths in which otherwise numeric variables are undefined.
2995
2996         * bytecode/SpeculatedType.h:
2997         (JSC::isInt32SpeculationForArithmetic):
2998         (JSC):
2999         (JSC::isInt32SpeculationExpectingDefined):
3000         (JSC::isDoubleSpeculationForArithmetic):
3001         (JSC::isNumberSpeculationExpectingDefined):
3002         * dfg/DFGAbstractState.cpp:
3003         (JSC::DFG::AbstractState::execute):
3004         * dfg/DFGFixupPhase.cpp:
3005         (JSC::DFG::FixupPhase::fixupNode):
3006         * dfg/DFGGraph.h:
3007         (JSC::DFG::Graph::addShouldSpeculateInteger):
3008         (JSC::DFG::Graph::mulShouldSpeculateInteger):
3009         (JSC::DFG::Graph::negateShouldSpeculateInteger):
3010         (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
3011         (JSC::DFG::Graph::mulImmediateShouldSpeculateInteger):
3012         * dfg/DFGNode.h:
3013         (JSC::DFG::Node::shouldSpeculateIntegerForArithmetic):
3014         (Node):
3015         (JSC::DFG::Node::shouldSpeculateIntegerExpectingDefined):
3016         (JSC::DFG::Node::shouldSpeculateDoubleForArithmetic):
3017         (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
3018         * dfg/DFGPredictionPropagationPhase.cpp:
3019         (JSC::DFG::PredictionPropagationPhase::propagate):
3020         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
3021         * dfg/DFGSpeculativeJIT.cpp:
3022         (JSC::DFG::SpeculativeJIT::compileAdd):
3023         (JSC::DFG::SpeculativeJIT::compileArithMod):
3024         * dfg/DFGSpeculativeJIT32_64.cpp:
3025         (JSC::DFG::SpeculativeJIT::compile):
3026         * dfg/DFGSpeculativeJIT64.cpp:
3027         (JSC::DFG::SpeculativeJIT::compile):
3028         * jit/JITArithmetic.cpp:
3029         (JSC::JIT::emit_op_div):
3030
3031 2012-11-06  Filip Pizlo  <fpizlo@apple.com>
3032
3033         JSC should infer when indexed storage contains only integers or doubles
3034         https://bugs.webkit.org/show_bug.cgi?id=98606
3035
3036         Reviewed by Oliver Hunt.
3037
3038         This adds two new indexing types: int32 and double. It also adds array allocation profiling,
3039         which allows array allocations to converge to allocating arrays using those types to which
3040         those arrays would have been converted.
3041         
3042         20% speed-up on navier-stokes. 40% speed-up on various Kraken DSP tests. Some slow-downs too,
3043         but a performance win overall on all benchmarks we track.
3044
3045         * API/JSObjectRef.cpp:
3046         (JSObjectMakeArray):
3047         * CMakeLists.txt:
3048         * GNUmakefile.list.am:
3049         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3050         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3051         * JavaScriptCore.xcodeproj/project.pbxproj:
3052         * Target.pri:
3053         * assembler/AbstractMacroAssembler.h:
3054         (JumpList):
3055         (JSC::AbstractMacroAssembler::JumpList::JumpList):
3056         * assembler/MacroAssemblerX86Common.h:
3057         (JSC::MacroAssemblerX86Common::branchDouble):
3058         * assembler/X86Assembler.h:
3059         (JSC::X86Assembler::jnp):
3060         (X86Assembler):
3061         (JSC::X86Assembler::X86InstructionFormatter::emitRex):
3062         * bytecode/ArrayAllocationProfile.cpp: Added.
3063         (JSC):
3064         (JSC::ArrayAllocationProfile::updateIndexingType):
3065         * bytecode/ArrayAllocationProfile.h: Added.
3066         (JSC):
3067         (ArrayAllocationProfile):
3068         (JSC::ArrayAllocationProfile::ArrayAllocationProfile):
3069         (JSC::ArrayAllocationProfile::selectIndexingType):
3070         (JSC::ArrayAllocationProfile::updateLastAllocation):
3071         (JSC::ArrayAllocationProfile::selectIndexingTypeFor):
3072         (JSC::ArrayAllocationProfile::updateLastAllocationFor):
3073         * bytecode/ArrayProfile.cpp:
3074         (JSC::ArrayProfile::updatedObservedArrayModes):
3075         (JSC):
3076         * bytecode/ArrayProfile.h:
3077         (JSC):
3078         (JSC::arrayModesInclude):
3079         (JSC::shouldUseSlowPutArrayStorage):
3080         (JSC::shouldUseFastArrayStorage):
3081         (JSC::shouldUseContiguous):
3082         (JSC::shouldUseDouble):
3083         (JSC::shouldUseInt32):
3084         (ArrayProfile):
3085         * bytecode/ByValInfo.h:
3086         (JSC::isOptimizableIndexingType):
3087         (JSC::jitArrayModeForIndexingType):
3088         * bytecode/CodeBlock.cpp:
3089         (JSC::CodeBlock::dump):
3090         (JSC::CodeBlock::CodeBlock):
3091         (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
3092         (JSC):
3093         (JSC::CodeBlock::updateAllValueProfilePredictions):
3094         (JSC::CodeBlock::updateAllArrayPredictions):
3095         (JSC::CodeBlock::updateAllPredictions):
3096         (JSC::CodeBlock::shouldOptimizeNow):
3097         * bytecode/CodeBlock.h:
3098         (CodeBlock):
3099         (JSC::CodeBlock::numberOfArrayAllocationProfiles):
3100         (JSC::CodeBlock::addArrayAllocationProfile):
3101         (JSC::CodeBlock::updateAllValueProfilePredictions):
3102         (JSC::CodeBlock::updateAllArrayPredictions):
3103         * bytecode/DFGExitProfile.h:
3104         (JSC::DFG::exitKindToString):
3105         * bytecode/Instruction.h:
3106         (JSC):
3107         (JSC::Instruction::Instruction):
3108         * bytecode/Opcode.h:
3109         (JSC):
3110         (JSC::padOpcodeName):
3111         * bytecode/SpeculatedType.h:
3112         (JSC):
3113         (JSC::isRealNumberSpeculation):
3114         * bytecode/UnlinkedCodeBlock.cpp:
3115         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
3116         * bytecode/UnlinkedCodeBlock.h:
3117         (JSC):
3118         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile):
3119         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles):
3120         (UnlinkedCodeBlock):
3121         * bytecompiler/BytecodeGenerator.cpp:
3122         (JSC::BytecodeGenerator::newArrayAllocationProfile):
3123         (JSC):
3124         (JSC::BytecodeGenerator::emitNewArray):
3125         (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
3126         * bytecompiler/BytecodeGenerator.h:
3127         (BytecodeGenerator):
3128         * dfg/DFGAbstractState.cpp:
3129         (JSC::DFG::AbstractState::execute):
3130         * dfg/DFGArrayMode.cpp:
3131         (JSC::DFG::ArrayMode::fromObserved):
3132         (JSC::DFG::ArrayMode::refine):
3133         (DFG):
3134         (JSC::DFG::ArrayMode::alreadyChecked):
3135         (JSC::DFG::arrayTypeToString):
3136         * dfg/DFGArrayMode.h:
3137         (JSC::DFG::ArrayMode::withType):
3138         (ArrayMode):
3139         (JSC::DFG::ArrayMode::withTypeAndConversion):
3140         (JSC::DFG::ArrayMode::usesButterfly):
3141         (JSC::DFG::ArrayMode::isSpecific):
3142         (JSC::DFG::ArrayMode::supportsLength):
3143         (JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
3144         * dfg/DFGByteCodeParser.cpp:
3145         (JSC::DFG::ByteCodeParser::getArrayMode):
3146         (ByteCodeParser):
3147         (JSC::DFG::ByteCodeParser::handleIntrinsic):
3148         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
3149         (JSC::DFG::ByteCodeParser::parseBlock):
3150         * dfg/DFGCCallHelpers.h:
3151         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
3152         (CCallHelpers):
3153         * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
3154         (JSC::DFG::CallArrayAllocatorSlowPathGenerator::generateInternal):
3155         (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::generateInternal):
3156         * dfg/DFGFixupPhase.cpp:
3157         (JSC::DFG::FixupPhase::fixupNode):
3158         (JSC::DFG::FixupPhase::checkArray):
3159         * dfg/DFGGraph.cpp:
3160         (JSC::DFG::Graph::dump):
3161         * dfg/DFGGraph.h:
3162         (JSC::DFG::Graph::byValIsPure):
3163         * dfg/DFGNode.h:
3164         (NewArrayBufferData):
3165         (JSC::DFG::Node::hasIndexingType):
3166         (Node):
3167         (JSC::DFG::Node::indexingType):
3168         (JSC::DFG::Node::setIndexingType):
3169         * dfg/DFGOperations.cpp:
3170         * dfg/DFGOperations.h:
3171         * dfg/DFGPredictionPropagationPhase.cpp:
3172         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
3173         * dfg/DFGSpeculativeJIT.cpp:
3174         (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
3175         (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
3176         (DFG):
3177         (JSC::DFG::SpeculativeJIT::checkArray):
3178         (JSC::DFG::SpeculativeJIT::arrayify):
3179         (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
3180         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
3181         * dfg/DFGSpeculativeJIT.h:
3182         (JSC::DFG::SpeculativeJIT::callOperation):
3183         (SpeculativeJIT):
3184         (SpeculateIntegerOperand):
3185         (JSC::DFG::SpeculateIntegerOperand::use):
3186         (SpeculateDoubleOperand):
3187         (JSC::DFG::SpeculateDoubleOperand::use):
3188         * dfg/DFGSpeculativeJIT32_64.cpp:
3189         (DFG):
3190         (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
3191         (JSC::DFG::SpeculativeJIT::compile):
3192         * dfg/DFGSpeculativeJIT64.cpp:
3193         (JSC::DFG::SpeculativeJIT::compile):
3194         * jit/JIT.h:
3195         (JSC::JIT::emitInt32GetByVal):
3196         (JIT):
3197         (JSC::JIT::emitInt32PutByVal):
3198         (JSC::JIT::emitDoublePutByVal):
3199         (JSC::JIT::emitContiguousPutByVal):
3200         * jit/JITExceptions.cpp:
3201         (JSC::genericThrow):
3202         * jit/JITInlineMethods.h:
3203         (JSC::arrayProfileSaw):
3204         (JSC::JIT::chooseArrayMode):
3205         * jit/JITOpcodes.cpp:
3206         (JSC::JIT::emit_op_new_array):
3207         (JSC::JIT::emit_op_new_array_with_size):
3208         (JSC::JIT::emit_op_new_array_buffer):
3209         * jit/JITPropertyAccess.cpp:
3210         (JSC::JIT::emit_op_get_by_val):
3211         (JSC::JIT::emitDoubleGetByVal):
3212         (JSC):
3213         (JSC::JIT::emitContiguousGetByVal):
3214         (JSC::JIT::emit_op_put_by_val):
3215         (JSC::JIT::emitGenericContiguousPutByVal):
3216         (JSC::JIT::emitSlow_op_put_by_val):
3217         (JSC::JIT::privateCompileGetByVal):
3218         (JSC::JIT::privateCompilePutByVal):
3219         * jit/JITPropertyAccess32_64.cpp:
3220         (JSC::JIT::emit_op_get_by_val):
3221         (JSC::JIT::emitContiguousGetByVal):
3222         (JSC::JIT::emitDoubleGetByVal):
3223         (JSC):
3224         (JSC::JIT::emit_op_put_by_val):
3225         (JSC::JIT::emitGenericContiguousPutByVal):
3226         (JSC::JIT::emitSlow_op_put_by_val):
3227         * jit/JITStubs.cpp:
3228         (JSC::DEFINE_STUB_FUNCTION):
3229         * jit/JITStubs.h:
3230         (JSC):
3231         * jsc.cpp:
3232         (GlobalObject::finishCreation):
3233         * llint/LLIntSlowPaths.cpp:
3234         (JSC::LLInt::jitCompileAndSetHeuristics):
3235         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3236         * llint/LowLevelInterpreter.asm:
3237         * llint/LowLevelInterpreter32_64.asm:
3238         * llint/LowLevelInterpreter64.asm:
3239         * offlineasm/x86.rb:
3240         * runtime/ArrayConstructor.cpp:
3241         (JSC::constructArrayWithSizeQuirk):
3242         * runtime/ArrayConstructor.h:
3243         (JSC):
3244         * runtime/ArrayPrototype.cpp:
3245         (JSC::arrayProtoFuncConcat):
3246         (JSC::arrayProtoFuncSlice):
3247         (JSC::arrayProtoFuncSplice):
3248         (JSC::arrayProtoFuncFilter):
3249         (JSC::arrayProtoFuncMap):
3250         * runtime/Butterfly.h:
3251         (JSC::Butterfly::contiguousInt32):
3252         (JSC::Butterfly::contiguousDouble):
3253         (JSC::Butterfly::fromContiguous):
3254         * runtime/ButterflyInlineMethods.h:
3255         (JSC::Butterfly::createUninitializedDuringCollection):
3256         * runtime/FunctionPrototype.cpp:
3257         (JSC::functionProtoFuncBind):
3258         * runtime/IndexingHeaderInlineMethods.h:
3259         (JSC::IndexingHeader::indexingPayloadSizeInBytes):
3260         * runtime/IndexingType.cpp:
3261         (JSC::leastUpperBoundOfIndexingTypes):
3262         (JSC):
3263         (JSC::leastUpperBoundOfIndexingTypeAndType):
3264         (JSC::leastUpperBoundOfIndexingTypeAndValue):
3265         (JSC::indexingTypeToString):
3266         * runtime/IndexingType.h:
3267         (JSC):
3268         (JSC::hasUndecided):
3269         (JSC::hasInt32):
3270         (JSC::hasDouble):
3271         * runtime/JSArray.cpp:
3272         (JSC::JSArray::setLength):
3273         (JSC::JSArray::pop):
3274         (JSC::JSArray::push):
3275         (JSC::JSArray::shiftCountWithAnyIndexingType):
3276         (JSC::JSArray::unshiftCountWithAnyIndexingType):
3277         (JSC::compareNumbersForQSortWithInt32):
3278         (JSC):
3279         (JSC::compareNumbersForQSortWithDouble):
3280         (JSC::JSArray::sortNumericVector):
3281         (JSC::JSArray::sortNumeric):
3282         (JSC::JSArray::sortCompactedVector):
3283         (JSC::JSArray::sort):
3284         (JSC::JSArray::sortVector):
3285         (JSC::JSArray::fillArgList):
3286         (JSC::JSArray::copyToArguments):
3287         (JSC::JSArray::compactForSorting):
3288         * runtime/JSArray.h:
3289         (JSArray):
3290         (JSC::createContiguousArrayButterfly):
3291         (JSC::JSArray::create):
3292         (JSC::JSArray::tryCreateUninitialized):
3293         * runtime/JSGlobalObject.cpp:
3294         (JSC::JSGlobalObject::reset):
3295         (JSC):
3296         (JSC::JSGlobalObject::haveABadTime):
3297         (JSC::JSGlobalObject::visitChildren):
3298         * runtime/JSGlobalObject.h:
3299         (JSGlobalObject):
3300         (JSC::JSGlobalObject::originalArrayStructureForIndexingType):
3301         (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation):
3302         (JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation):
3303         (JSC::JSGlobalObject::isOriginalArrayStructure):
3304         (JSC::constructEmptyArray):
3305         (JSC::constructArray):
3306         * runtime/JSObject.cpp:
3307         (JSC::JSObject::copyButterfly):
3308         (JSC::JSObject::getOwnPropertySlotByIndex):
3309         (JSC::JSObject::putByIndex):
3310         (JSC::JSObject::enterDictionaryIndexingMode):
3311         (JSC::JSObject::createInitialIndexedStorage):
3312         (JSC):
3313         (JSC::JSObject::createInitialUndecided):
3314         (JSC::JSObject::createInitialInt32):
3315         (JSC::JSObject::createInitialDouble):
3316         (JSC::JSObject::createInitialContiguous):
3317         (JSC::JSObject::convertUndecidedToInt32):
3318         (JSC::JSObject::convertUndecidedToDouble):
3319         (JSC::JSObject::convertUndecidedToContiguous):
3320         (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
3321         (JSC::JSObject::convertUndecidedToArrayStorage):
3322         (JSC::JSObject::convertInt32ToDouble):
3323         (JSC::JSObject::convertInt32ToContiguous):
3324         (JSC::JSObject::convertInt32ToArrayStorage):
3325         (JSC::JSObject::convertDoubleToContiguous):
3326         (JSC::JSObject::convertDoubleToArrayStorage):
3327         (JSC::JSObject::convertContiguousToArrayStorage):
3328         (JSC::JSObject::convertUndecidedForValue):
3329         (JSC::JSObject::convertInt32ForValue):
3330         (JSC::JSObject::setIndexQuicklyToUndecided):
3331         (JSC::JSObject::convertInt32ToDoubleOrContiguousWhilePerformingSetIndex):
3332         (JSC::JSObject::convertDoubleToContiguousWhilePerformingSetIndex):
3333         (JSC::JSObject::ensureInt32Slow):
3334         (JSC::JSObject::ensureDoubleSlow):
3335         (JSC::JSObject::ensureContiguousSlow):
3336         (JSC::JSObject::ensureArrayStorageSlow):
3337         (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
3338         (JSC::JSObject::switchToSlowPutArrayStorage):
3339         (JSC::JSObject::deletePropertyByIndex):
3340         (JSC::JSObject::getOwnPropertyNames):
3341         (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
3342         (JSC::JSObject::putByIndexBeyondVectorLength):
3343         (JSC::JSObject::putDirectIndexBeyondVectorLength):
3344         (JSC::JSObject::getNewVectorLength):
3345         (JSC::JSObject::countElements):
3346         (JSC::JSObject::ensureLengthSlow):
3347         (JSC::JSObject::getOwnPropertyDescriptor):
3348         * runtime/JSObject.h:
3349         (JSC::JSObject::getArrayLength):
3350         (JSC::JSObject::getVectorLength):
3351         (JSC::JSObject::canGetIndexQuickly):
3352         (JSC::JSObject::getIndexQuickly):
3353         (JSC::JSObject::tryGetIndexQuickly):
3354         (JSC::JSObject::canSetIndexQuickly):
3355         (JSC::JSObject::canSetIndexQuicklyForPutDirect):
3356         (JSC::JSObject::setIndexQuickly):
3357         (JSC::JSObject::initializeIndex):
3358         (JSC::JSObject::hasSparseMap):
3359         (JSC::JSObject::inSparseIndexingMode):
3360         (JSObject):
3361         (JSC::JSObject::ensureInt32):
3362         (JSC::JSObject::ensureDouble):
3363         (JSC::JSObject::ensureLength):
3364         (JSC::JSObject::indexingData):
3365         (JSC::JSObject::currentIndexingData):
3366         (JSC::JSObject::getHolyIndexQuickly):
3367         (JSC::JSObject::relevantLength):
3368         (JSC::JSObject::currentRelevantLength):
3369         * runtime/JSValue.cpp:
3370         (JSC::JSValue::description):
3371         * runtime/LiteralParser.cpp:
3372         (JSC::::parse):
3373         * runtime/ObjectConstructor.cpp:
3374         (JSC::objectConstructorGetOwnPropertyNames):
3375         (JSC::objectConstructorKeys):
3376         * runtime/StringPrototype.cpp:
3377         (JSC::stringProtoFuncMatch):
3378         (JSC::stringProtoFuncSplit):
3379         * runtime/Structure.cpp:
3380         (JSC::Structure::nonPropertyTransition):
3381         * runtime/StructureTransitionTable.h:
3382         (JSC::newIndexingType):
3383
3384 2012-11-08  Balazs Kilvady  <kilvadyb@homejinni.com>
3385
3386         ASSERT problem on MIPS
3387         https://bugs.webkit.org/show_bug.cgi?id=100589
3388
3389         Reviewed by Oliver Hunt.
3390
3391         ASSERT fix for MIPS arch.
3392
3393         * jit/JITOpcodes.cpp:
3394         (JSC::JIT::emit_resolve_operations):
3395
3396 2012-11-08  Michael Saboff  <msaboff@apple.com>
3397
3398         OpaqueJSClassContextData() should use StringImpl::isolatedCopy() to make string copies
3399         https://bugs.webkit.org/show_bug.cgi?id=101507
3400
3401         Reviewed by Andreas Kling.
3402
3403         Changed to use isolatedCopy() for key Strings.
3404
3405         * API/JSClassRef.cpp:
3406         (OpaqueJSClassContextData::OpaqueJSClassContextData):
3407
3408 2012-11-07  Mark Hahnenberg  <mhahnenberg@apple.com>
3409
3410         WeakBlocks should be HeapBlocks
3411         https://bugs.webkit.org/show_bug.cgi?id=101411
3412
3413         Reviewed by Oliver Hunt.
3414
3415         Currently WeakBlocks use fastMalloc memory. They are very similar to the other HeapBlocks, however, 
3416         so we should change them to being allocated with the BlockAllocator.
3417
3418         * heap/BlockAllocator.cpp:
3419         (JSC::BlockAllocator::BlockAllocator):
3420         * heap/BlockAllocator.h: Added a new RegionSet for WeakBlocks.
3421         (JSC):
3422         (BlockAllocator):
3423         (JSC::WeakBlock):
3424         * heap/Heap.h: Friended WeakSet to allow access to the BlockAllocator.
3425         (Heap):
3426         * heap/WeakBlock.cpp:
3427         (JSC::WeakBlock::create): Refactored to use HeapBlocks rather than fastMalloc.
3428         (JSC::WeakBlock::WeakBlock):
3429         * heap/WeakBlock.h: Changed the WeakBlock size to 4 KB so that it divides evenly into the Region size.
3430         (JSC):
3431         (WeakBlock):
3432         * heap/WeakSet.cpp:
3433         (JSC::WeakSet::~WeakSet):
3434         (JSC::WeakSet::addAllocator):
3435
3436 2012-11-07  Filip Pizlo  <fpizlo@apple.com>
3437
3438         Indentation of ArgList.h is wrong
3439         https://bugs.webkit.org/show_bug.cgi?id=101441
3440
3441         Reviewed by Andreas Kling.
3442
3443         Just unindented by 4 spaces.
3444
3445         * runtime/ArgList.h:
3446
3447 2012-11-07  Gabor Ballabas  <gaborb@inf.u-szeged.hu>