Source/JavaScriptCore/ChangeLog

   1 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
   2
   3         Fix indentation of JSGlobalObject.h and JSGlobalObjectFunctions.h
   4
   5         Rubber stamped by Mark Hahnenberg.
   6
   7         * runtime/JSGlobalObject.h:
   8         * runtime/JSGlobalObjectFunctions.h:
   9
  10 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
  11
  12         Fix indention of Operations.h
  13
  14         Rubber stamped by Mark Hahnenberg.
  15
  16         * runtime/Operations.h:
  17
  18 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
  19
  20         Remove DFG::SpeculativeJIT::isKnownNumeric(), since it's not called from anywhere.
  21
  22         Rubber stamped by Andy Estes.
  23
  24         * dfg/DFGSpeculativeJIT.cpp:
  25         (DFG):
  26         * dfg/DFGSpeculativeJIT.h:
  27         (SpeculativeJIT):
  28
  29 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
  30
  31         Remove DFG::SpeculativeJIT::isStrictInt32(), since it's not called from anywhere.
  32
  33         Rubber stampted by Andy Estes.
  34
  35         * dfg/DFGSpeculativeJIT.cpp:
  36         (DFG):
  37         * dfg/DFGSpeculativeJIT.h:
  38         (SpeculativeJIT):
  39
  40 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
  41
  42         Remove dead code for ValueToNumber from the DFG.
  43
  44         Rubber stamped by Andy Estes.
  45
  46         We killed ValueToNumber at some point, but forgot to kill all of the backend support
  47         for it.
  48
  49         * dfg/DFGByteCodeParser.cpp:
  50         (JSC::DFG::ByteCodeParser::handleMinMax):
  51         * dfg/DFGOperations.cpp:
  52         * dfg/DFGOperations.h:
  53         * dfg/DFGSpeculativeJIT.h:
  54         (SpeculativeJIT):
  55         * dfg/DFGSpeculativeJIT32_64.cpp:
  56         * dfg/DFGSpeculativeJIT64.cpp:
  57
  58 2013-02-17  Csaba Osztrogonác  <ossy@webkit.org>
  59
  60         Unreviewed buildfix for JSVALUE32_64 builds after r143147.
  61
  62         * jit/JIT.h:
  63
  64 2013-02-17  Filip Pizlo  <fpizlo@apple.com>
  65
  66         Move all Structure out-of-line inline methods to StructureInlines.h
  67         https://bugs.webkit.org/show_bug.cgi?id=110024
  68
  69         Rubber stamped by Mark Hahnenberg and Sam Weinig.
  70
  71         This was supposed to be easy.
  72
  73         But, initially, there was a Structure inline method in CodeBlock.h, and moving that
  74         into StructureInlines.h meant that Operations.h included CodeBlock.h. This would
  75         cause WebCore build failures, because CodeBlock.h transitively included the JSC
  76         parser (via many, many paths), and the JSC parser defines tokens using enumeration
  77         elements that CSSGrammar.cpp (generated by bison) would #define. For example,
  78         bison would give CSSGrammar.cpp a #define FUNCTION 123, and would do so before
  79         including anything interesting. The JSC parser would have an enum that included
  80         FUNCTION as an element. Hence the JSC parser included into CSSGrammar.cpp would have
  81         a token element called FUNCTION declared in an enumeration, but FUNCTION was
  82         #define'd to 123, leading to a parser error.
  83
  84         Wow.
  85
  86         So I removed all transitive include paths from CodeBlock.h to the JSC Parser. I
  87         believe I was able to do so without out-of-lining anything interesting or performance
  88         critical. This is probably a purely good thing to have done: it will be nice to be
  89         able to make changes to the parser without having to compile the universe.
  90
  91         Of course, doing this caused a bunch of other things to not compile, since a bunch of
  92         headers relied on things being implicitly included for them when they transitively
  93         included the parser. I fixed a lot of that.
  94
  95         Finally, I ended up removing the method that depended on CodeBlock.h from
  96         StructureInlines.h, and putting it in Structure.cpp. That might seem like all of this
  97         was a waste of time, except that I suspect it was a worthwhile forcing function for
  98         cleaning up a bunch of cruft.
  99
 100         * API/JSCallbackFunction.cpp:
 101         * CMakeLists.txt:
 102         * GNUmakefile.list.am:
 103         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
 104         * JavaScriptCore.xcodeproj/project.pbxproj:
 105         * Target.pri:
 106         * bytecode/CodeBlock.h:
 107         (JSC):
 108         * bytecode/EvalCodeCache.h:
 109         * bytecode/SamplingTool.h:
 110         * bytecode/UnlinkedCodeBlock.cpp:
 111         (JSC::UnlinkedFunctionExecutable::parameterCount):
 112         (JSC):
 113         * bytecode/UnlinkedCodeBlock.h:
 114         (UnlinkedFunctionExecutable):
 115         * bytecompiler/BytecodeGenerator.h:
 116         * bytecompiler/Label.h:
 117         (JSC):
 118         * dfg/DFGByteCodeParser.cpp:
 119         * dfg/DFGByteCodeParser.h:
 120         * dfg/DFGFPRInfo.h:
 121         * dfg/DFGRegisterBank.h:
 122         * heap/HandleStack.cpp:
 123         * jit/JITWriteBarrier.h:
 124         * parser/Nodes.h:
 125         (JSC):
 126         * parser/Parser.h:
 127         * parser/ParserError.h: Added.
 128         (JSC):
 129         (JSC::ParserError::ParserError):
 130         (ParserError):
 131         (JSC::ParserError::toErrorObject):
 132         * parser/ParserModes.h:
 133         * parser/SourceProvider.cpp: Added.
 134         (JSC):
 135         (JSC::SourceProvider::SourceProvider):
 136         (JSC::SourceProvider::~SourceProvider):
 137         * parser/SourceProvider.h:
 138         (JSC):
 139         (SourceProvider):
 140         * runtime/ArrayPrototype.cpp:
 141         * runtime/DatePrototype.cpp:
 142         * runtime/Executable.h:
 143         * runtime/JSGlobalObject.cpp:
 144         * runtime/JSGlobalObject.h:
 145         (JSC):
 146         * runtime/Operations.h:
 147         * runtime/Structure.cpp:
 148         (JSC::Structure::prototypeForLookup):
 149         (JSC):
 150         * runtime/Structure.h:
 151         (JSC):
 152         * runtime/StructureInlines.h: Added.
 153         (JSC):
 154         (JSC::Structure::create):
 155         (JSC::Structure::createStructure):
 156         (JSC::Structure::get):
 157         (JSC::Structure::masqueradesAsUndefined):
 158         (JSC::SlotVisitor::internalAppend):
 159         (JSC::Structure::transitivelyTransitionedFrom):
 160         (JSC::Structure::setEnumerationCache):
 161         (JSC::Structure::enumerationCache):
 162         (JSC::Structure::prototypeForLookup):
 163         (JSC::Structure::prototypeChain):
 164         (JSC::Structure::isValid):
 165         * runtime/StructureRareData.cpp:
 166
 167 2013-02-17  Roger Fong  <roger_fong@apple.com>
 168
 169         Unreviewed. Windows build fix.
 170
 171         * runtime/CodeCache.h:
 172         (CodeCacheMap):
 173
 174 2013-02-16  Geoffrey Garen  <ggaren@apple.com>
 175
 176         Code cache should be explicit about what it caches
 177         https://bugs.webkit.org/show_bug.cgi?id=110039
 178
 179         Reviewed by Oliver Hunt.
 180
 181         This patch makes the code cache more explicit in two ways:
 182
 183         (1) The cache caches top-level scripts. Any sub-functions executed as a
 184         part of a script are cached with it and evicted with it.
 185
 186         This simplifies things by eliminating out-of-band sub-function tracking,
 187         and fixes pathological cases where functions for live scripts would be
 188         evicted in favor of functions for dead scripts, and/or high probability
 189         functions executed early in script lifetime would be evicted in favor of
 190         low probability functions executed late in script lifetime, due to LRU.
 191
 192         Statistical data from general browsing and PLT confirms that caching
 193         functions independently of scripts is not profitable.
 194
 195         (2) The cache tracks script size, not script count.
 196
 197         This reduces the worst-case cache size by a factor of infinity.
 198
 199         Script size is a reasonable first-order estimate of in-memory footprint
 200         for a cached script because there are no syntactic constructs that have
 201         super-linear memory footprint.
 202
 203         * bytecode/UnlinkedCodeBlock.cpp:
 204         (JSC::generateFunctionCodeBlock): Moved this function out of the cache
 205         because it does not consult the cache, and is not managed by it.
 206
 207         (JSC::UnlinkedFunctionExecutable::visitChildren): Visit our code blocks
 208         because they are strong references now, rather than weak, a la (1).
 209
 210         (JSC::UnlinkedFunctionExecutable::codeBlockFor): Updated for interface changes.
 211
 212         * bytecode/UnlinkedCodeBlock.h:
 213         (UnlinkedFunctionExecutable):
 214         (UnlinkedFunctionCodeBlock): Strong now, not weak, a la (1).
 215
 216         * runtime/CodeCache.cpp:
 217         (JSC::CodeCache::CodeCache):
 218         * runtime/CodeCache.h:
 219         (JSC::SourceCodeKey::length):
 220         (SourceCodeKey):
 221         (CodeCacheMap):
 222         (JSC::CodeCacheMap::CodeCacheMap):
 223         (JSC::CodeCacheMap::find):
 224         (JSC::CodeCacheMap::set):
 225         (JSC::CodeCacheMap::clear):
 226         (CodeCache):
 227         (JSC::CodeCache::clear): Removed individual function tracking, due to (1).
 228         Added explicit character counting, for (2).
 229
 230         You might think 16000000 characters is a lot. It is. But this patch
 231         didn't establish that limit -- it just took the existing limit and
 232         made it more visible. I intend to reduce the size of the cache in a
 233         future patch.
 234
 235 2013-02-16  Filip Pizlo  <fpizlo@apple.com>
 236
 237         Remove support for bytecode comments, since it doesn't build, and hasn't been used in a while.
 238         https://bugs.webkit.org/show_bug.cgi?id=110035
 239
 240         Rubber stamped by Andreas Kling.
 241
 242         There are other ways of achieving the same effect, like adding print statements to the bytecode generator.
 243         The fact that this feature doesn't build and nobody noticed implies that it's probably not a popular
 244         feature. As well, the amount of wiring that was required for it was quite big considering its relatively
 245         modest utility.
 246
 247         * GNUmakefile.list.am:
 248         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
 249         * JavaScriptCore.xcodeproj/project.pbxproj:
 250         * bytecode/CodeBlock.cpp:
 251         (JSC):
 252         (JSC::CodeBlock::dumpBytecode):
 253         (JSC::CodeBlock::CodeBlock):
 254         * bytecode/CodeBlock.h:
 255         (CodeBlock):
 256         * bytecode/Comment.h: Removed.
 257         * bytecompiler/BytecodeGenerator.cpp:
 258         (JSC::BytecodeGenerator::BytecodeGenerator):
 259         (JSC::BytecodeGenerator::emitOpcode):
 260         (JSC):
 261         * bytecompiler/BytecodeGenerator.h:
 262         (BytecodeGenerator):
 263         (JSC::BytecodeGenerator::symbolTable):
 264
 265 2013-02-16  Brent Fulgham  <bfulgham@webkit.org>
 266
 267         [Windows] Unreviewed Visual Studio 2010 build fix after r143117
 268
 269         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Reference new path to property sheets.
 270         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
 271         Build correction after new operator == added.
 272
 273 2013-02-16  Filip Pizlo  <fpizlo@apple.com>
 274
 275         Fix indentation of Structure.h
 276
 277         Rubber stamped by Mark Hahnenberg.
 278
 279         * runtime/Structure.h:
 280
 281 2013-02-16  Christophe Dumez  <ch.dumez@sisa.samsung.com>
 282
 283         Unreviewed build fix.
 284
 285         Export symbol for new CString operator== operator to fix Windows build.
 286
 287         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
 288
 289 2013-02-15  Filip Pizlo  <fpizlo@apple.com>
 290
 291         Structure should be more methodical about the relationship between m_offset and m_propertyTable
 292         https://bugs.webkit.org/show_bug.cgi?id=109978
 293
 294         Reviewed by Mark Hahnenberg.
 295
 296         Allegedly, the previous relationship was that either m_propertyTable or m_offset
 297         would be set, and if m_propertyTable was not set you could rebuild it.  In reality,
 298         we would sometimes "reset" both: some transitions wouldn't set m_offset, and other
 299         transitions would clear the previous structure's m_propertyTable.  So, in a
 300         structure transition chain of A->B->C you could have:
 301
 302         A transitions to B: B doesn't copy m_offset but does copy m_propertyTable, because
 303             that seemed like a good idea at the time (this was a common idiom in the code).
 304         B transitions to C: C steals B's m_propertyTable, leaving B with neither a
 305             m_propertyTable nor a m_offset.
 306
 307         Then we would ask for the size of the property storage of B and get the answer
 308         "none".  That's not good.
 309
 310         Now, there is a new relationship, which, hopefully, should fix things: m_offset is
 311         always set and always refers to the maximum offset ever used by the property table.
 312         From this, you can infer both the inline and out-of-line property size, and
 313         capacity.  This is accomplished by having PropertyTable::add() take a
 314         PropertyOffset reference, which must be Structure::m_offset.  It will update this
 315         offset.  As well, all transitions now copy m_offset.  And we frequently assert
 316         (using RELEASE_ASSERT) that the m_offset matches what m_propertyTable would tell
 317         you.  Hence if you ever modify the m_propertyTable, you'll also update the offset.
 318         If you ever copy the property table, you'll also copy the offset.  Life should be
 319         good, I think.
 320
 321         * runtime/PropertyMapHashTable.h:
 322         (JSC::PropertyTable::add):
 323         * runtime/Structure.cpp:
 324         (JSC::Structure::materializePropertyMap):
 325         (JSC::Structure::addPropertyTransition):
 326         (JSC::Structure::removePropertyTransition):
 327         (JSC::Structure::changePrototypeTransition):
 328         (JSC::Structure::despecifyFunctionTransition):
 329         (JSC::Structure::attributeChangeTransition):
 330         (JSC::Structure::toDictionaryTransition):
 331         (JSC::Structure::sealTransition):
 332         (JSC::Structure::freezeTransition):
 333         (JSC::Structure::preventExtensionsTransition):
 334         (JSC::Structure::nonPropertyTransition):
 335         (JSC::Structure::flattenDictionaryStructure):
 336         (JSC::Structure::checkConsistency):
 337         (JSC::Structure::putSpecificValue):
 338         (JSC::Structure::createPropertyMap):
 339         (JSC::PropertyTable::checkConsistency):
 340         * runtime/Structure.h:
 341         (JSC):
 342         (JSC::Structure::putWillGrowOutOfLineStorage):
 343         (JSC::Structure::outOfLineCapacity):
 344         (JSC::Structure::outOfLineSize):
 345         (JSC::Structure::isEmpty):
 346         (JSC::Structure::materializePropertyMapIfNecessary):
 347         (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
 348         (Structure):
 349         (JSC::Structure::checkOffsetConsistency):
 350
 351 2013-02-15  Martin Robinson  <mrobinson@igalia.com>
 352
 353         [GTK] Spread the gyp build files throughout the tree
 354         https://bugs.webkit.org/show_bug.cgi?id=109960
 355
 356         Reviewed by Dirk Pranke.
 357
 358         * JavaScriptCore.gyp/JavaScriptCoreGTK.gyp: Renamed from Source/WebKit/gtk/gyp/JavaScriptCore.gyp.
 359         * JavaScriptCore.gyp/generate-derived-sources.sh: Renamed from Source/WebKit/gtk/gyp/generate-derived-sources.sh.
 360
 361 2013-02-15  Filip Pizlo  <fpizlo@apple.com>
 362
 363         DFG SpeculativeJIT64 should be more precise about when it's dealing with a cell (even though it probably doesn't matter)
 364         https://bugs.webkit.org/show_bug.cgi?id=109625
 365
 366         Reviewed by Mark Hahnenberg.
 367
 368         * dfg/DFGSpeculativeJIT64.cpp:
 369         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
 370         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 371         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 372         (JSC::DFG::SpeculativeJIT::compile):
 373
 374 2013-02-15  Geoffrey Garen  <ggaren@apple.com>
 375
 376         Merged the global function cache into the source code cache
 377         https://bugs.webkit.org/show_bug.cgi?id=108660
 378
 379         Reviewed by Sam Weinig.
 380
 381         Responding to review comments by Darin Adler.
 382
 383         * runtime/CodeCache.h:
 384         (JSC::SourceCodeKey::SourceCodeKey): Don't initialize m_name and m_flags
 385         in the hash table deleted value because they're meaningless.
 386
 387 2013-02-14  Filip Pizlo  <fpizlo@apple.com>
 388
 389         DFG AbstractState should filter operands to NewArray more precisely
 390         https://bugs.webkit.org/show_bug.cgi?id=109900
 391
 392         Reviewed by Mark Hahnenberg.
 393
 394         NewArray for primitive indexing types speculates that the inputs are the appropriate
 395         primitives. Now, the CFA filters the abstract state accordingly, as well.
 396
 397         * dfg/DFGAbstractState.cpp:
 398         (JSC::DFG::AbstractState::execute):
 399
 400 2013-02-15  Andreas Kling  <akling@apple.com>
 401
 402         Yarr: Use OwnPtr to make pattern/disjunction/character-class ownership clearer.
 403         <http://webkit.org/b/109218>
 404
 405         Reviewed by Benjamin Poulain.
 406
 407         - Let classes that manage lifetime of other objects hold on to them with OwnPtr instead of raw pointers.
 408         - Placed some strategic Vector::shrinkToFit(), ::reserveInitialCapacity() and ::swap().
 409
 410         668 kB progression on Membuster3.
 411
 412         * yarr/YarrInterpreter.cpp:
 413         (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
 414         (JSC::Yarr::ByteCompiler::emitDisjunction):
 415         (ByteCompiler):
 416         * yarr/YarrInterpreter.h:
 417         (JSC::Yarr::BytecodePattern::BytecodePattern):
 418         (BytecodePattern):
 419         * yarr/YarrJIT.cpp:
 420         (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
 421         (JSC::Yarr::YarrGenerator::opCompileParentheticalAssertion):
 422         (JSC::Yarr::YarrGenerator::opCompileBody):
 423         * yarr/YarrPattern.cpp:
 424         (JSC::Yarr::CharacterClassConstructor::charClass):
 425         (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
 426         (JSC::Yarr::YarrPatternConstructor::reset):
 427         (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
 428         (JSC::Yarr::YarrPatternConstructor::atomCharacterClassEnd):
 429         (JSC::Yarr::YarrPatternConstructor::copyDisjunction):
 430         (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):
 431         (JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
 432         (JSC::Yarr::YarrPatternConstructor::optimizeBOL):
 433         (JSC::Yarr::YarrPatternConstructor::containsCapturingTerms):
 434         (JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):
 435         * yarr/YarrPattern.h:
 436         (JSC::Yarr::PatternDisjunction::addNewAlternative):
 437         (PatternDisjunction):
 438         (YarrPattern):
 439         (JSC::Yarr::YarrPattern::reset):
 440         (JSC::Yarr::YarrPattern::newlineCharacterClass):
 441         (JSC::Yarr::YarrPattern::digitsCharacterClass):
 442         (JSC::Yarr::YarrPattern::spacesCharacterClass):
 443         (JSC::Yarr::YarrPattern::wordcharCharacterClass):
 444         (JSC::Yarr::YarrPattern::nondigitsCharacterClass):
 445         (JSC::Yarr::YarrPattern::nonspacesCharacterClass):
 446         (JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
 447
 448 2013-02-14  Geoffrey Garen  <ggaren@apple.com>
 449
 450         Merged the global function cache into the source code cache
 451         https://bugs.webkit.org/show_bug.cgi?id=108660
 452
 453         Reviewed by Sam Weinig.
 454
 455         This has a few benefits:
 456
 457             (*) Saves a few kB by removing a second cache data structure.
 458
 459             (*) Reduces the worst case memory usage of the cache by 1.75X. (Heavy
 460             use of 'new Function' and other techniques could cause us to fill
 461             both root caches, and they didn't trade off against each other.)
 462
 463             (*) Paves the way for future improvements based on a non-trivial
 464             cache key (for example, shrinkable pointer to the key string, and
 465             more precise cache size accounting).
 466
 467         Also cleaned up the cache implementation and simplified it a bit.
 468
 469         * heap/Handle.h:
 470         (HandleBase):
 471         * heap/Strong.h:
 472         (Strong): Build!
 473
 474         * runtime/CodeCache.cpp:
 475         (JSC):
 476         (JSC::CodeCache::getCodeBlock):
 477         (JSC::CodeCache::generateFunctionCodeBlock):
 478         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
 479         (JSC::CodeCache::usedFunctionCode): Updated for three interface changes:
 480
 481             (*) SourceCodeKey is a class, not a pair.
 482
 483             (*) Table values are abstract pointers, since they can be executables
 484             or code blocks. (In a future patch, I'd like to change this so we
 485             always store only code blocks. But that's too much for one patch.)
 486
 487             (*) The cache function is named "set" because it always overwrites
 488             unconditionally.
 489
 490         * runtime/CodeCache.h:
 491         (CacheMap):
 492         (JSC::CacheMap::find):
 493         (JSC::CacheMap::set):
 494         (JSC::CacheMap::clear): Added support for specifying hash traits, so we
 495         can use a SourceCodeKey.
 496
 497         Removed side table and random number generator to save space and reduce
 498         complexity. Hash tables are already random, so we don't need another source
 499         of randomness.
 500
 501         (SourceCodeKey):
 502         (JSC::SourceCodeKey::SourceCodeKey):
 503         (JSC::SourceCodeKey::isHashTableDeletedValue):
 504         (JSC::SourceCodeKey::hash):
 505         (JSC::SourceCodeKey::isNull):
 506         (JSC::SourceCodeKey::operator==):
 507         (JSC::SourceCodeKeyHash::hash):
 508         (JSC::SourceCodeKeyHash::equal):
 509         (SourceCodeKeyHash):
 510         (SourceCodeKeyHashTraits):
 511         (JSC::SourceCodeKeyHashTraits::isEmptyValue): A SourceCodeKey is just a
 512         fancy triplet: source code string; function name (or null, for non-functions);
 513         and flags. Flags and function name distinguish between functions and programs
 514         with identical code, so they can live in the same cache.
 515
 516         I chose to use the source code string as the primary hashing reference
 517         because it's likely to be unique. We can use profiling to choose another
 518         technique in future, if collisions between functions and programs prove
 519         to be hot. I suspect they won't.
 520
 521         (JSC::CodeCache::clear):
 522         (CodeCache): Removed the second cache.
 523
 524         * heap/Handle.h:
 525         (HandleBase):
 526         * heap/Strong.h:
 527         (Strong):
 528         * runtime/CodeCache.cpp:
 529         (JSC):
 530         (JSC::CodeCache::getCodeBlock):
 531         (JSC::CodeCache::generateFunctionCodeBlock):
 532         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
 533         (JSC::CodeCache::usedFunctionCode):
 534         * runtime/CodeCache.h:
 535         (JSC):
 536         (CacheMap):
 537         (JSC::CacheMap::find):
 538         (JSC::CacheMap::set):
 539         (JSC::CacheMap::clear):
 540         (SourceCodeKey):
 541         (JSC::SourceCodeKey::SourceCodeKey):
 542         (JSC::SourceCodeKey::isHashTableDeletedValue):
 543         (JSC::SourceCodeKey::hash):
 544         (JSC::SourceCodeKey::isNull):
 545         (JSC::SourceCodeKey::operator==):
 546         (JSC::SourceCodeKeyHash::hash):
 547         (JSC::SourceCodeKeyHash::equal):
 548         (SourceCodeKeyHash):
 549         (SourceCodeKeyHashTraits):
 550         (JSC::SourceCodeKeyHashTraits::isEmptyValue):
 551         (JSC::CodeCache::clear):
 552         (CodeCache):
 553
 554 2013-02-14  Tony Chang  <tony@chromium.org>
 555
 556         Unreviewed, set svn:eol-style native for .sln, .vcproj, and .vsprops files.
 557         https://bugs.webkit.org/show_bug.cgi?id=96934
 558
 559         * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
 560         * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
 561         * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops: Added property svn:eol-style.
 562         * JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops: Added property svn:eol-style.
 563         * JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops: Added property svn:eol-style.
 564         * JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops: Added property svn:eol-style.
 565         * JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops: Added property svn:eol-style.
 566         * JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops: Added property svn:eol-style.
 567         * JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops: Added property svn:eol-style.
 568         * JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops: Added property svn:eol-style.
 569
 570 2013-02-14  Tony Chang  <tony@chromium.org>
 571
 572         Unreviewed, set svn:eol-style CRLF for .sln files.
 573
 574         * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
 575         * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
 576
 577 2013-02-14  David Kilzer  <ddkilzer@apple.com>
 578
 579         [Mac] Clean up WARNING_CFLAGS
 580         <http://webkit.org/b/109747>
 581         <rdar://problem/13208373>
 582
 583         Reviewed by Mark Rowe.
 584
 585         * Configurations/Base.xcconfig: Use
 586         GCC_WARN_64_TO_32_BIT_CONVERSION to enable and disable
 587         -Wshorten-64-to-32 rather than WARNING_CFLAGS.
 588
 589         * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
 590         * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
 591
 592 2013-02-13  Anders Carlsson  <andersca@apple.com>
 593
 594         Better build fix.
 595
 596         * API/tests/testapi.c:
 597         (assertEqualsAsNumber):
 598         (main):
 599
 600 2013-02-13  Roger Fong  <roger_fong@apple.com>
 601
 602         Unreviewed. Build fix.
 603
 604         * API/tests/testapi.c:
 605         (assertEqualsAsNumber):
 606         (main):
 607
 608 2013-02-13  Oliver Hunt  <oliver@apple.com>
 609
 610         Yet another build fix
 611
 612         * bytecode/CodeBlock.cpp:
 613         (JSC::CodeBlock::CodeBlock):
 614
 615 2013-02-13  Zan Dobersek  <zdobersek@igalia.com>
 616
 617         The 'global isinf/isnan' compiler quirk required when using clang with libstdc++
 618         https://bugs.webkit.org/show_bug.cgi?id=109325
 619
 620         Reviewed by Anders Carlsson.
 621
 622         Prefix calls to the isinf and isnan methods with std::, declaring we want to use the
 623         two methods as they're provided by the C++ standard library being used.
 624
 625         * API/JSValueRef.cpp:
 626         (JSValueMakeNumber):
 627         * JSCTypedArrayStubs.h:
 628         (JSC):
 629         * bytecompiler/BytecodeGenerator.cpp:
 630         (JSC::BytecodeGenerator::emitLoad):
 631         * dfg/DFGByteCodeParser.cpp:
 632         (JSC::DFG::ByteCodeParser::constantNaN):
 633         * offlineasm/cloop.rb:
 634         * runtime/DateConstructor.cpp:
 635         (JSC::dateUTC): Also include an opportunistic style fix.
 636         * runtime/DateInstance.cpp:
 637         (JSC::DateInstance::calculateGregorianDateTime):
 638         (JSC::DateInstance::calculateGregorianDateTimeUTC):
 639         * runtime/DatePrototype.cpp:
 640         (JSC::dateProtoFuncGetMilliSeconds):
 641         (JSC::dateProtoFuncGetUTCMilliseconds):
 642         (JSC::setNewValueFromTimeArgs):
 643         (JSC::setNewValueFromDateArgs):
 644         (JSC::dateProtoFuncSetYear):
 645         * runtime/JSCJSValue.cpp:
 646         (JSC::JSValue::toInteger):
 647         * runtime/JSDateMath.cpp:
 648         (JSC::getUTCOffset):
 649         (JSC::parseDateFromNullTerminatedCharacters):
 650         (JSC::parseDate):
 651         * runtime/JSGlobalObjectFunctions.cpp:
 652         (JSC::globalFuncIsNaN):
 653         * runtime/MathObject.cpp:
 654         (JSC::mathProtoFuncMax):
 655         (JSC::mathProtoFuncMin):
 656         (JSC::mathProtoFuncPow):
 657         * runtime/PropertyDescriptor.cpp:
 658         (JSC::sameValue):
 659
 660 2013-02-13  Filip Pizlo  <fpizlo@apple.com>
 661
 662         Change another use of (SpecCell & ~SpecString) to SpecObject.
 663
 664         Reviewed by Mark Hahnenberg.
 665
 666         * dfg/DFGAbstractState.cpp:
 667         (JSC::DFG::AbstractState::execute):
 668
 669 2013-02-13  Filip Pizlo  <fpizlo@apple.com>
 670
 671         ForwardInt32ToDouble is not in DFG::MinifiedNode's list of relevant node types
 672         https://bugs.webkit.org/show_bug.cgi?id=109726
 673
 674         Reviewed by Mark Hahnenberg.
 675
 676         If you add it to the list of relevant node types, you also need to make sure
 677         it's listed as either hasChild or one of the other kinds. Otherwise you get
 678         an assertion. This is causing test failures in run-javascriptcore-tests.
 679
 680         * dfg/DFGMinifiedNode.h:
 681         (JSC::DFG::MinifiedNode::hasChild):
 682
 683 2013-02-13  Oliver Hunt  <oliver@apple.com>
 684
 685         Build fix.
 686
 687         Rearranged the code somewhat to reduce the number of
 688         DFG related ifdefs.
 689
 690         * bytecode/CodeBlock.cpp:
 691         (JSC::CodeBlock::CodeBlock):
 692
 693 2013-02-13  Filip Pizlo  <fpizlo@apple.com>
 694
 695         ForwardInt32ToDouble is not in DFG::MinifiedNode's list of relevant node types
 696         https://bugs.webkit.org/show_bug.cgi?id=109726
 697
 698         Reviewed by Gavin Barraclough.
 699
 700         This is asymptomatic because ForwardInt32ToDouble is only used in SetLocals, in
 701         which case the value is already stored to the stack.  Still, we should fix this.
 702
 703         * dfg/DFGMinifiedNode.h:
 704         (JSC::DFG::belongsInMinifiedGraph):
 705
 706 2013-02-12  Filip Pizlo  <fpizlo@apple.com>
 707
 708         DFG LogicalNot/Branch peephole removal and inversion ignores the possibility of things exiting
 709         https://bugs.webkit.org/show_bug.cgi?id=109489
 710
 711         Reviewed by Mark Hahnenberg.
 712
 713         If things can exit between the LogicalNot and the Branch then don't peephole.
 714
 715         * dfg/DFGFixupPhase.cpp:
 716         (JSC::DFG::FixupPhase::fixupNode):
 717
 718 2013-02-13  Oliver Hunt  <oliver@apple.com>
 719
 720         Remove unnecessary indirection to non-local variable access operations
 721         https://bugs.webkit.org/show_bug.cgi?id=109724
 722
 723         Reviewed by Filip Pizlo.
 724
 725         Linked bytecode now stores a direct pointer to the resolve operation
 726         vectors, so the interpreter no longer needs a bunch of indirection to
 727         to perform non-local lookup.
 728
 729         * bytecode/CodeBlock.cpp:
 730         (JSC::CodeBlock::CodeBlock):
 731         * bytecode/CodeBlock.h:
 732         (CodeBlock):
 733         * bytecode/Instruction.h:
 734         * dfg/DFGByteCodeParser.cpp:
 735         (ByteCodeParser):
 736         (InlineStackEntry):
 737         (JSC::DFG::ByteCodeParser::parseResolveOperations):
 738         (JSC::DFG::ByteCodeParser::parseBlock):
 739         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
 740         * dfg/DFGCapabilities.h:
 741         (JSC::DFG::canInlineOpcode):
 742         * dfg/DFGGraph.h:
 743         (ResolveGlobalData):
 744         (ResolveOperationData):
 745         (PutToBaseOperationData):
 746         * dfg/DFGSpeculativeJIT.h:
 747         * dfg/DFGSpeculativeJIT32_64.cpp:
 748         (JSC::DFG::SpeculativeJIT::compile):
 749         * dfg/DFGSpeculativeJIT64.cpp:
 750         (JSC::DFG::SpeculativeJIT::compile):
 751         * jit/JITOpcodes.cpp:
 752         (JSC::JIT::emit_op_put_to_base):
 753         (JSC::JIT::emit_op_resolve):
 754         (JSC::JIT::emitSlow_op_resolve):
 755         (JSC::JIT::emit_op_resolve_base):
 756         (JSC::JIT::emitSlow_op_resolve_base):
 757         (JSC::JIT::emit_op_resolve_with_base):
 758         (JSC::JIT::emitSlow_op_resolve_with_base):
 759         (JSC::JIT::emit_op_resolve_with_this):
 760         (JSC::JIT::emitSlow_op_resolve_with_this):
 761         (JSC::JIT::emitSlow_op_put_to_base):
 762         * jit/JITOpcodes32_64.cpp:
 763         (JSC::JIT::emit_op_put_to_base):
 764         * llint/LLIntSlowPaths.cpp:
 765         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 766         * llint/LowLevelInterpreter.asm:
 767
 768 2013-02-13  Zoltan Herczeg  <zherczeg@webkit.org>
 769
 770         replaceWithJump should not decrease the offset by 1 on ARM traditional.
 771         https://bugs.webkit.org/show_bug.cgi?id=109689
 772
 773         Reviewed by Oliver Hunt.
 774
 775         * assembler/ARMAssembler.h:
 776         (JSC::ARMAssembler::replaceWithJump):
 777
 778 2013-02-12  Joseph Pecoraro  <pecoraro@apple.com>
 779
 780         [iOS] Enable PAGE_VISIBILITY_API
 781         https://bugs.webkit.org/show_bug.cgi?id=109399
 782
 783         Reviewed by David Kilzer.
 784
 785         * Configurations/FeatureDefines.xcconfig:
 786
 787 2013-02-12  Filip Pizlo  <fpizlo@apple.com>
 788
 789         Renamed SpecObjectMask to SpecObject.
 790
 791         Rubber stamped by Mark Hahnenberg.
 792
 793         "SpecObjectMask" is a weird name considering that a bunch of the other speculated
 794         types are also masks, but don't have "Mask" in the name.
 795
 796         * bytecode/SpeculatedType.h:
 797         (JSC):
 798         (JSC::isObjectSpeculation):
 799         (JSC::isObjectOrOtherSpeculation):
 800         * dfg/DFGAbstractState.cpp:
 801         (JSC::DFG::AbstractState::execute):
 802         * dfg/DFGPredictionPropagationPhase.cpp:
 803         (JSC::DFG::PredictionPropagationPhase::propagate):
 804         * dfg/DFGSpeculativeJIT.cpp:
 805         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
 806         * dfg/DFGSpeculativeJIT32_64.cpp:
 807         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
 808         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 809         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 810         * dfg/DFGSpeculativeJIT64.cpp:
 811         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
 812         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 813         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 814
 815 2013-02-12  Filip Pizlo  <fpizlo@apple.com>
 816
 817         DFG CFA doesn't filter precisely enough for CompareStrictEq
 818         https://bugs.webkit.org/show_bug.cgi?id=109618
 819
 820         Reviewed by Mark Hahnenberg.
 821
 822         The backend speculates object for this case, but the CFA was filtering on
 823         (SpecCell & ~SpecString) | SpecOther.
 824
 825         * dfg/DFGAbstractState.cpp:
 826         (JSC::DFG::AbstractState::execute):
 827
 828 2013-02-12  Martin Robinson  <mrobinson@igalia.com>
 829
 830         Fix the gyp build of JavaScriptCore.
 831
 832         * JavaScriptCore.gypi: Added some missing DFG files to the source list.
 833
 834 2013-02-12  Sheriff Bot  <webkit.review.bot@gmail.com>
 835
 836         Unreviewed, rolling out r142387.
 837         http://trac.webkit.org/changeset/142387
 838         https://bugs.webkit.org/show_bug.cgi?id=109601
 839
 840         caused all layout and jscore tests on windows to fail
 841         (Requested by kling on #webkit).
 842
 843         * bytecode/UnlinkedCodeBlock.cpp:
 844         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
 845         * bytecode/UnlinkedCodeBlock.h:
 846         (UnlinkedCodeBlock):
 847
 848 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
 849
 850         DFG CompareEq optimization should be retuned
 851         https://bugs.webkit.org/show_bug.cgi?id=109545
 852
 853         Reviewed by Mark Hahnenberg.
 854
 855         - Made the object-to-object equality case work again by hoisting the if statement
 856           for it. Previously, object-to-object equality would be compiled as
 857           object-to-object-or-other.
 858
 859         - Added AbstractState guards for most of the type checks that the object equality
 860           code uses.
 861
 862         Looks like a hint of a speed-up on all of the things.
 863
 864         * dfg/DFGAbstractState.cpp:
 865         (JSC::DFG::AbstractState::execute):
 866         * dfg/DFGSpeculativeJIT.cpp:
 867         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
 868         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
 869         (JSC::DFG::SpeculativeJIT::compare):
 870         * dfg/DFGSpeculativeJIT32_64.cpp:
 871         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
 872         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 873         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 874         * dfg/DFGSpeculativeJIT64.cpp:
 875         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
 876         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 877         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 878
 879 2013-02-12  Gabor Rapcsanyi  <rgabor@webkit.org>
 880
 881         JSC asserting with long parameter list functions in debug mode on ARM traditional
 882         https://bugs.webkit.org/show_bug.cgi?id=109565
 883
 884         Reviewed by Zoltan Herczeg.
 885
 886         Increase the value of sequenceGetByIdSlowCaseInstructionSpace to 80.
 887
 888         * jit/JIT.h:
 889
 890 2013-02-11  Oliver Hunt  <oliver@apple.com>
 891
 892         Make JSC API more NULL tolerant
 893         https://bugs.webkit.org/show_bug.cgi?id=109515
 894
 895         Reviewed by Mark Hahnenberg.
 896
 897         We do so much marshalling for the C API these days anyway that a single null
 898         check isn't a performance issue.  Yet the existing "null is unsafe" behaviour
 899         leads to crashes in embedding applications whenever there's an untested code
 900         path, so it seems having defined behaviour is superior.
 901
 902         * API/APICast.h:
 903         (toJS):
 904         (toJSForGC):
 905         * API/JSObjectRef.cpp:
 906         (JSObjectIsFunction):
 907         (JSObjectCallAsFunction):
 908         (JSObjectIsConstructor):
 909         (JSObjectCallAsConstructor):
 910         * API/tests/testapi.c:
 911         (main):
 912
 913 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
 914
 915         Unreviewed, adding a FIXME to remind ourselves of a bug.
 916         https://bugs.webkit.org/show_bug.cgi?id=109487
 917
 918         * dfg/DFGSpeculativeJIT.cpp:
 919         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
 920
 921 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
 922
 923         Strange bug in DFG OSR in JSC
 924         https://bugs.webkit.org/show_bug.cgi?id=109491
 925
 926         Reviewed by Mark Hahnenberg.
 927
 928         Int32ToDouble was being injected after a side-effecting operation and before a SetLocal. Anytime we
 929         inject something just before a SetLocal we should be aware that the previous operation may have been
 930         a side-effect associated with the current code origin. Hence, we should use a forward exit.
 931         Int32ToDouble does not do forward exits by default.
 932
 933         This patch adds a forward-exiting form of Int32ToDouble, for use in SetLocal Int32ToDouble injections.
 934         Changed the CSE and other things to treat these nodes identically, but for the exit strategy to be
 935         distinct (Int32ToDouble -> backward, ForwardInt32ToDouble -> forward). The use of the NodeType for
 936         signaling exit direction is not "great" but it's what we use in other places already (like
 937         ForwardCheckStructure).
 938
 939         * dfg/DFGAbstractState.cpp:
 940         (JSC::DFG::AbstractState::execute):
 941         * dfg/DFGCSEPhase.cpp:
 942         (JSC::DFG::CSEPhase::int32ToDoubleCSE):
 943         (CSEPhase):
 944         (JSC::DFG::CSEPhase::performNodeCSE):
 945         * dfg/DFGCommon.h:
 946         * dfg/DFGFixupPhase.cpp:
 947         (JSC::DFG::FixupPhase::fixupNode):
 948         (JSC::DFG::FixupPhase::fixDoubleEdge):
 949         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
 950         * dfg/DFGNode.h:
 951         (JSC::DFG::Node::willHaveCodeGenOrOSR):
 952         * dfg/DFGNodeType.h:
 953         (DFG):
 954         * dfg/DFGPredictionPropagationPhase.cpp:
 955         (JSC::DFG::PredictionPropagationPhase::propagate):
 956         * dfg/DFGSpeculativeJIT.cpp:
 957         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
 958         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
 959         * dfg/DFGSpeculativeJIT.h:
 960         * dfg/DFGSpeculativeJIT32_64.cpp:
 961         (JSC::DFG::SpeculativeJIT::compile):
 962         * dfg/DFGSpeculativeJIT64.cpp:
 963         (JSC::DFG::SpeculativeJIT::compile):
 964         * dfg/DFGVariableEventStream.cpp:
 965         (JSC::DFG::VariableEventStream::reconstruct):
 966
 967 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
 968
 969         NonStringCell and Object are practically the same thing for the purpose of speculation
 970         https://bugs.webkit.org/show_bug.cgi?id=109492
 971
 972         Reviewed by Mark Hahnenberg.
 973
 974         Removed isNonStringCellSpeculation, and made all callers use isObjectSpeculation.
 975
 976         Changed isNonStringCellOrOtherSpeculation to be isObjectOrOtherSpeculation.
 977
 978         I believe this is correct because even weird object types like JSNotAnObject end up
 979         being "objects" from the standpoint of our typesystem. Anyway, the assumption that
 980         "is cell but not a string" equates to "object" is an assumption that is already made
 981         in other places in the system so there's little value in being paranoid about it.
 982
 983         * bytecode/SpeculatedType.h:
 984         (JSC::isObjectSpeculation):
 985         (JSC::isObjectOrOtherSpeculation):
 986         * dfg/DFGAbstractState.cpp:
 987         (JSC::DFG::AbstractState::execute):
 988         * dfg/DFGNode.h:
 989         (Node):
 990         (JSC::DFG::Node::shouldSpeculateObjectOrOther):
 991         * dfg/DFGSpeculativeJIT.cpp:
 992         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
 993         (JSC::DFG::SpeculativeJIT::compare):
 994         (JSC::DFG::SpeculativeJIT::compileStrictEq):
 995         * dfg/DFGSpeculativeJIT.h:
 996         (SpeculativeJIT):
 997         * dfg/DFGSpeculativeJIT32_64.cpp:
 998         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
 999         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
1000         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
1001         (JSC::DFG::SpeculativeJIT::emitBranch):
1002         (JSC::DFG::SpeculativeJIT::compile):
1003         * dfg/DFGSpeculativeJIT64.cpp:
1004         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
1005         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
1006         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
1007         (JSC::DFG::SpeculativeJIT::emitBranch):
1008         (JSC::DFG::SpeculativeJIT::compile):
1009
1010 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
1011
1012         DFG CompareEq(a, null) and CompareStrictEq(a, const) are unsound with respect to constant folding
1013         https://bugs.webkit.org/show_bug.cgi?id=109387
1014
1015         Reviewed by Oliver Hunt and Mark Hahnenberg.
1016
1017         Lock in the decision to use a non-speculative constant comparison as early as possible
1018         and don't let the CFA change it by folding constants. This might be a performance
1019         penalty on some really weird code (FWIW, I haven't seen this on benchmarks), but on
1020         the other hand it completely side-steps the unsoundness that the bug speaks of.
1021
1022         Rolling back in after adding 32-bit path.
1023
1024         * dfg/DFGAbstractState.cpp:
1025         (JSC::DFG::AbstractState::execute):
1026         * dfg/DFGByteCodeParser.cpp:
1027         (JSC::DFG::ByteCodeParser::isConstantForCompareStrictEq):
1028         (ByteCodeParser):
1029         (JSC::DFG::ByteCodeParser::parseBlock):
1030         * dfg/DFGCSEPhase.cpp:
1031         (JSC::DFG::CSEPhase::performNodeCSE):
1032         * dfg/DFGNodeType.h:
1033         (DFG):
1034         * dfg/DFGPredictionPropagationPhase.cpp:
1035         (JSC::DFG::PredictionPropagationPhase::propagate):
1036         * dfg/DFGSpeculativeJIT.cpp:
1037         (JSC::DFG::SpeculativeJIT::compileStrictEq):
1038         * dfg/DFGSpeculativeJIT32_64.cpp:
1039         (JSC::DFG::SpeculativeJIT::compile):
1040         * dfg/DFGSpeculativeJIT64.cpp:
1041         (JSC::DFG::SpeculativeJIT::compile):
1042
1043 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
1044
1045         DFG TypeOf implementation should have its backend code aligned to what the CFA does
1046         https://bugs.webkit.org/show_bug.cgi?id=109385
1047
1048         Reviewed by Sam Weinig.
1049
1050         The problem was that if we ended up trying to constant fold, but didn't succeed
1051         because of prediction mismatches, then we would also fail to do filtration.
1052
1053         Rearranged the control flow in the CFA to fix that.
1054
1055         As far as I know, this is asymptomatic - it's sort of OK for the CFA to prove less
1056         things, which is what the bug was.
1057
1058         * dfg/DFGAbstractState.cpp:
1059         (JSC::DFG::AbstractState::execute):
1060
1061 2013-02-11  Sheriff Bot  <webkit.review.bot@gmail.com>
1062
1063         Unreviewed, rolling out r142491.
1064         http://trac.webkit.org/changeset/142491
1065         https://bugs.webkit.org/show_bug.cgi?id=109470
1066
1067         broke the 32 bit build (Requested by jessieberlin on #webkit).
1068
1069         * dfg/DFGAbstractState.cpp:
1070         (JSC::DFG::AbstractState::execute):
1071         * dfg/DFGByteCodeParser.cpp:
1072         (JSC::DFG::ByteCodeParser::parseBlock):
1073         * dfg/DFGCSEPhase.cpp:
1074         (JSC::DFG::CSEPhase::performNodeCSE):
1075         * dfg/DFGNodeType.h:
1076         (DFG):
1077         * dfg/DFGPredictionPropagationPhase.cpp:
1078         (JSC::DFG::PredictionPropagationPhase::propagate):
1079         * dfg/DFGSpeculativeJIT.cpp:
1080         (JSC::DFG::SpeculativeJIT::compileStrictEq):
1081         * dfg/DFGSpeculativeJIT64.cpp:
1082         (JSC::DFG::SpeculativeJIT::compile):
1083
1084 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
1085
1086         DFG CompareEq(a, null) and CompareStrictEq(a, const) are unsound with respect to constant folding
1087         https://bugs.webkit.org/show_bug.cgi?id=109387
1088
1089         Reviewed by Oliver Hunt.
1090
1091         Lock in the decision to use a non-speculative constant comparison as early as possible
1092         and don't let the CFA change it by folding constants. This might be a performance
1093         penalty on some really weird code (FWIW, I haven't seen this on benchmarks), but on
1094         the other hand it completely side-steps the unsoundness that the bug speaks of.
1095
1096         * dfg/DFGAbstractState.cpp:
1097         (JSC::DFG::AbstractState::execute):
1098         * dfg/DFGByteCodeParser.cpp:
1099         (JSC::DFG::ByteCodeParser::isConstantForCompareStrictEq):
1100         (ByteCodeParser):
1101         (JSC::DFG::ByteCodeParser::parseBlock):
1102         * dfg/DFGCSEPhase.cpp:
1103         (JSC::DFG::CSEPhase::performNodeCSE):
1104         * dfg/DFGNodeType.h:
1105         (DFG):
1106         * dfg/DFGPredictionPropagationPhase.cpp:
1107         (JSC::DFG::PredictionPropagationPhase::propagate):
1108         * dfg/DFGSpeculativeJIT.cpp:
1109         (JSC::DFG::SpeculativeJIT::compileStrictEq):
1110         * dfg/DFGSpeculativeJIT64.cpp:
1111         (JSC::DFG::SpeculativeJIT::compile):
1112
1113 2013-02-11  Csaba Osztrogonác  <ossy@webkit.org>
1114
1115         Unreviewed fix after r13954 for !ENABLE(JIT) builds.
1116
1117         * llint/LowLevelInterpreter.cpp:
1118
1119 2013-02-11  Gabor Rapcsanyi  <rgabor@webkit.org>
1120
1121         JSC build failing with verbose debug mode
1122         https://bugs.webkit.org/show_bug.cgi?id=109441
1123
1124         Reviewed by Darin Adler.
1125
1126         Fixing some verbose messages which caused build errors.
1127
1128         * dfg/DFGAbstractState.cpp:
1129         (JSC::DFG::AbstractState::mergeToSuccessors):
1130         * dfg/DFGCFAPhase.cpp:
1131         (JSC::DFG::CFAPhase::performBlockCFA):
1132         * dfg/DFGCSEPhase.cpp:
1133         (JSC::DFG::CSEPhase::setReplacement):
1134         (JSC::DFG::CSEPhase::eliminate):
1135         * dfg/DFGPredictionInjectionPhase.cpp:
1136         (JSC::DFG::PredictionInjectionPhase::run):
1137
1138 2013-02-10  Martin Robinson  <mrobinson@igalia.com>
1139
1140         Fix the GTK+ gyp build
1141
1142         * JavaScriptCore.gypi: Update the source list to accurately
1143         reflect what's in the repository and remove the offsets extractor
1144         from the list of JavaScriptCore files. It's only used to build
1145         the extractor binary.
1146
1147 2013-02-09  Andreas Kling  <akling@apple.com>
1148
1149         Shrink-wrap UnlinkedCodeBlock members.
1150         <http://webkit.org/b/109368>
1151
1152         Reviewed by Oliver Hunt.
1153
1154         Rearrange the members of UnlinkedCodeBlock to avoid unnecessary padding on 64-bit.
1155         Knocks ~600 KB off of the Membuster3 peak.
1156
1157         * bytecode/UnlinkedCodeBlock.cpp:
1158         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
1159         * bytecode/UnlinkedCodeBlock.h:
1160         (UnlinkedCodeBlock):
1161
1162 2013-02-08  Filip Pizlo  <fpizlo@apple.com>
1163
1164         DFG should allow phases to break Phi's and then have one phase to rebuild them
1165         https://bugs.webkit.org/show_bug.cgi?id=108414
1166
1167         Reviewed by Mark Hahnenberg.
1168
1169         Introduces two new DFG forms: LoadStore and ThreadedCPS. These are described in
1170         detail in DFGCommon.h.
1171
1172         Consequently, DFG phases no longer have to worry about preserving data flow
1173         links between basic blocks. It is generally always safe to request that the
1174         graph be dethreaded (Graph::dethread), which brings it into LoadStore form, where
1175         the data flow is implicit. In this form, only liveness-at-head needs to be
1176         preserved.
1177
1178         All of the machinery for "threading" the graph to introduce data flow between
1179         blocks is now moved out of the bytecode parser and into the CPSRethreadingPhase.
1180         All phases that previously did this maintenance themselves now just rely on
1181         being able to dethread the graph. The one exception is the structure check
1182         hoising phase, which operates over a threaded graph and preserves it, for the
1183         sake of performance.
1184
1185         Also moved two other things into their own phases: unification (previously found
1186         in the parser) and prediction injection (previously found in various places).
1187
1188         * CMakeLists.txt:
1189         * GNUmakefile.list.am:
1190         * JavaScriptCore.xcodeproj/project.pbxproj:
1191         * Target.pri:
1192         * bytecode/Operands.h:
1193         (Operands):
1194         (JSC::Operands::sizeFor):
1195         (JSC::Operands::atFor):
1196         * dfg/DFGAbstractState.cpp:
1197         (JSC::DFG::AbstractState::execute):
1198         (JSC::DFG::AbstractState::mergeStateAtTail):
1199         * dfg/DFGAllocator.h:
1200         (JSC::DFG::::allocateSlow):
1201         * dfg/DFGArgumentsSimplificationPhase.cpp:
1202         (JSC::DFG::ArgumentsSimplificationPhase::run):
1203         * dfg/DFGBasicBlockInlines.h:
1204         (DFG):
1205         * dfg/DFGByteCodeParser.cpp:
1206         (JSC::DFG::ByteCodeParser::getLocal):
1207         (JSC::DFG::ByteCodeParser::getArgument):
1208         (JSC::DFG::ByteCodeParser::flushDirect):
1209         (JSC::DFG::ByteCodeParser::parseBlock):
1210         (DFG):
1211         (JSC::DFG::ByteCodeParser::parse):
1212         * dfg/DFGCFGSimplificationPhase.cpp:
1213         (JSC::DFG::CFGSimplificationPhase::run):
1214         (JSC::DFG::CFGSimplificationPhase::killUnreachable):
1215         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
1216         (CFGSimplificationPhase):
1217         (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
1218         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
1219         * dfg/DFGCPSRethreadingPhase.cpp: Added.
1220         (DFG):
1221         (CPSRethreadingPhase):
1222         (JSC::DFG::CPSRethreadingPhase::CPSRethreadingPhase):
1223         (JSC::DFG::CPSRethreadingPhase::run):
1224         (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
1225         (JSC::DFG::CPSRethreadingPhase::clearVariablesAtHeadAndTail):
1226         (JSC::DFG::CPSRethreadingPhase::addPhiSilently):
1227         (JSC::DFG::CPSRethreadingPhase::addPhi):
1228         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
1229         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocal):
1230         (JSC::DFG::CPSRethreadingPhase::canonicalizeSetLocal):
1231         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
1232         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocal):
1233         (JSC::DFG::CPSRethreadingPhase::canonicalizeSetArgument):
1234         (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
1235         (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlocks):
1236         (JSC::DFG::CPSRethreadingPhase::propagatePhis):
1237         (JSC::DFG::CPSRethreadingPhase::PhiStackEntry::PhiStackEntry):
1238         (PhiStackEntry):
1239         (JSC::DFG::CPSRethreadingPhase::phiStackFor):
1240         (JSC::DFG::performCPSRethreading):
1241         * dfg/DFGCPSRethreadingPhase.h: Added.
1242         (DFG):
1243         * dfg/DFGCSEPhase.cpp:
1244         (CSEPhase):
1245         (JSC::DFG::CSEPhase::performNodeCSE):
1246         * dfg/DFGCommon.cpp:
1247         (WTF):
1248         (WTF::printInternal):
1249         * dfg/DFGCommon.h:
1250         (JSC::DFG::logCompilationChanges):
1251         (DFG):
1252         (WTF):
1253         * dfg/DFGConstantFoldingPhase.cpp:
1254         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1255         * dfg/DFGDriver.cpp:
1256         (JSC::DFG::compile):
1257         * dfg/DFGGraph.cpp:
1258         (JSC::DFG::Graph::Graph):
1259         (JSC::DFG::Graph::dump):
1260         (JSC::DFG::Graph::dethread):
1261         (JSC::DFG::Graph::collectGarbage):
1262         * dfg/DFGGraph.h:
1263         (JSC::DFG::Graph::performSubstitution):
1264         (Graph):
1265         (JSC::DFG::Graph::performSubstitutionForEdge):
1266         (JSC::DFG::Graph::convertToConstant):
1267         * dfg/DFGNode.h:
1268         (JSC::DFG::Node::convertToPhantomLocal):
1269         (Node):
1270         (JSC::DFG::Node::convertToGetLocal):
1271         (JSC::DFG::Node::hasVariableAccessData):
1272         * dfg/DFGNodeType.h:
1273         (DFG):
1274         * dfg/DFGPhase.cpp:
1275         (JSC::DFG::Phase::beginPhase):
1276         * dfg/DFGPhase.h:
1277         (JSC::DFG::runAndLog):
1278         * dfg/DFGPredictionInjectionPhase.cpp: Added.
1279         (DFG):
1280         (PredictionInjectionPhase):
1281         (JSC::DFG::PredictionInjectionPhase::PredictionInjectionPhase):
1282         (JSC::DFG::PredictionInjectionPhase::run):
1283         (JSC::DFG::performPredictionInjection):
1284         * dfg/DFGPredictionInjectionPhase.h: Added.
1285         (DFG):
1286         * dfg/DFGPredictionPropagationPhase.cpp:
1287         (JSC::DFG::PredictionPropagationPhase::run):
1288         (JSC::DFG::PredictionPropagationPhase::propagate):
1289         * dfg/DFGSpeculativeJIT32_64.cpp:
1290         (JSC::DFG::SpeculativeJIT::compile):
1291         * dfg/DFGSpeculativeJIT64.cpp:
1292         (JSC::DFG::SpeculativeJIT::compile):
1293         * dfg/DFGStructureCheckHoistingPhase.cpp:
1294         (JSC::DFG::StructureCheckHoistingPhase::run):
1295         * dfg/DFGUnificationPhase.cpp: Added.
1296         (DFG):
1297         (UnificationPhase):
1298         (JSC::DFG::UnificationPhase::UnificationPhase):
1299         (JSC::DFG::UnificationPhase::run):
1300         (JSC::DFG::performUnification):
1301         * dfg/DFGUnificationPhase.h: Added.
1302         (DFG):
1303         * dfg/DFGValidate.cpp:
1304         (JSC::DFG::Validate::validate):
1305         (JSC::DFG::Validate::dumpGraphIfAppropriate):
1306         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
1307         (JSC::DFG::VirtualRegisterAllocationPhase::run):
1308         * llint/LLIntSlowPaths.cpp:
1309         (JSC::LLInt::setUpCall):
1310         * runtime/JSCJSValue.cpp:
1311         (JSC::JSValue::dump):
1312         * runtime/JSString.h:
1313         (JSString):
1314         * runtime/Options.h:
1315         (JSC):
1316
1317 2013-02-08  Jer Noble  <jer.noble@apple.com>
1318
1319         Bring WebKit up to speed with latest Encrypted Media spec.
1320         https://bugs.webkit.org/show_bug.cgi?id=97037
1321
1322         Reviewed by Eric Carlson.
1323
1324         Define the ENABLE_ENCRYPTED_MEDIA_V2 setting.
1325
1326         * Configurations/FeatureDefines.xcconfig:
1327
1328 2013-02-08  Gavin Barraclough  <barraclough@apple.com>
1329
1330         Objective-C API for JavaScriptCore
1331         https://bugs.webkit.org/show_bug.cgi?id=105889
1332
1333         Reviewed by Joseph Pecoraro
1334
1335         Following up on review comments, mostly typos.
1336
1337         * API/JSBlockAdaptor.h:
1338         * API/JSBlockAdaptor.mm:
1339         (-[JSBlockAdaptor blockFromValue:inContext:withException:]):
1340         * API/JSContext.h:
1341         * API/JSExport.h:
1342         * API/JSValue.h:
1343         * API/JSValue.mm:
1344         * API/JSWrapperMap.mm:
1345         (selectorToPropertyName):
1346         (-[JSWrapperMap classInfoForClass:]):
1347         (-[JSWrapperMap wrapperForObject:]):
1348
1349 2013-02-08  Martin Robinson  <mrobinson@igalia.com>
1350
1351         [GTK] Add an experimental gyp build
1352         https://bugs.webkit.org/show_bug.cgi?id=109003
1353
1354         Reviewed by Gustavo Noronha Silva.
1355
1356         * JavaScriptCore.gypi: Update the list of source files to include those
1357         necessary for the GTK+ build.
1358
1359 2013-02-08  Andreas Kling  <akling@apple.com>
1360
1361         JSC: Lower minimum PropertyTable size.
1362         <http://webkit.org/b/109247>
1363
1364         Reviewed by Darin Adler.
1365
1366         Lower the minimum table size for PropertyTable from 16 to 8.
1367         3.32 MB progression on Membuster3 (a ~13% reduction in memory used by PropertyTables.)
1368
1369         * runtime/PropertyMapHashTable.h:
1370         (PropertyTable):
1371         (JSC::PropertyTable::sizeForCapacity):
1372
1373 2013-02-07  Roger Fong  <roger_fong@apple.com>
1374
1375         Unreviewed. More VS2010 WebKit solution touchups.
1376         Make JavaScriptCoreExports.def.in be treated as a custom build file so that changes to it cause the exports to be rebuilt.
1377
1378         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
1379         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters:
1380         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
1381
1382 2013-02-07  Mark Hahnenberg  <mhahnenberg@apple.com>
1383
1384         Objective-C API: testapi.mm should use ARC
1385         https://bugs.webkit.org/show_bug.cgi?id=107838
1386
1387         Reviewed by Mark Rowe.
1388
1389         Removing the changes to the Xcode project file and moving the equivalent flags into
1390         the ToolExecutable xcconfig file.
1391
1392         * Configurations/ToolExecutable.xcconfig:
1393         * JavaScriptCore.xcodeproj/project.pbxproj:
1394
1395 2013-02-07  Brent Fulgham  <bfulgham@webkit.org>
1396
1397         [Windows] Unreviewed Visual Studio 2010 build fixes after r142179.
1398
1399         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Correct changed symbols
1400         * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Removed autogenerated file.
1401
1402 2013-02-05  Filip Pizlo  <fpizlo@apple.com>
1403
1404         DFG::ByteCodeParser should do surgical constant folding to reduce load on the optimization fixpoint
1405         https://bugs.webkit.org/show_bug.cgi?id=109000
1406
1407         Reviewed by Oliver Hunt.
1408
1409         Previously our source parser's ASTBuilder did some surgical constant folding, but it
1410         didn't cover some cases.  It was particularly incapable of doing constant folding for
1411         cases where we do some minimal loop peeling in the bytecode generator - since it
1412         didn't "see" those constants prior to the peeling.  Example:
1413
1414         for (var i = 0; i < 4; ++i)
1415             things;
1416
1417         This will get peeled just a bit by the bytecode generator, so that the "i < 4" is
1418         duplicated both at the top of the loop and the bottom.  This means that we have a
1419         constant comparison: "0 < 4", which the bytecode generator emits without any further
1420         thought.
1421
1422         The DFG optimization fixpoint of course folds this and simplifies the CFG
1423         accordingly, but this incurs a compile-time cost.  The purpose of this change is to
1424         do some surgical constant folding in the DFG's bytecode parser, so that such
1425         constructs reduce load on the CFG simplifier and the optimization fixpoint.  The goal
1426         is not to cover all cases, since the DFG CFA and CFG simplifier have a powerful
1427         sparse conditional constant propagation that we can always fall back on. Instead the
1428         goal is to cover enough cases that for common small functions we don't have to
1429         perform such transformations, thereby reducing compile times.
1430
1431         This also refactors m_inlineStackEntry->m_inlineCallFrame to be a handy method call
1432         and also adds the notion of a TriState-based JSValue::pureToBoolean(). Both of these
1433         things are used by the folder.
1434
1435         As well, care has been taken to make sure that the bytecode parser only does folding
1436         that is statically provable, and that doesn't arise out of speculation. This means
1437         we cannot fold on data flow that crosses inlining boundaries. On the other hand, the
1438         folding that the bytecode parser uses doesn't require phantoming anything. Such is
1439         the trade-off: for anything that we do need phantoming, we defer it to the
1440         optimization fixpoint.
1441
1442         Slight SunSpider speed-up.
1443
1444         * dfg/DFGByteCodeParser.cpp:
1445         (JSC::DFG::ByteCodeParser::get):
1446         (JSC::DFG::ByteCodeParser::getLocal):
1447         (JSC::DFG::ByteCodeParser::setLocal):
1448         (JSC::DFG::ByteCodeParser::flushDirect):
1449         (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables):
1450         (JSC::DFG::ByteCodeParser::toInt32):
1451         (ByteCodeParser):
1452         (JSC::DFG::ByteCodeParser::inlineCallFrame):
1453         (JSC::DFG::ByteCodeParser::currentCodeOrigin):
1454         (JSC::DFG::ByteCodeParser::canFold):
1455         (JSC::DFG::ByteCodeParser::handleInlining):
1456         (JSC::DFG::ByteCodeParser::getScope):
1457         (JSC::DFG::ByteCodeParser::parseResolveOperations):
1458         (JSC::DFG::ByteCodeParser::parseBlock):
1459         (JSC::DFG::ByteCodeParser::parseCodeBlock):
1460         * dfg/DFGNode.h:
1461         (JSC::DFG::Node::isStronglyProvedConstantIn):
1462         (Node):
1463         * runtime/JSCJSValue.h:
1464         * runtime/JSCJSValueInlines.h:
1465         (JSC::JSValue::pureToBoolean):
1466         (JSC):
1467
1468 2013-02-07  Zoltan Herczeg  <zherczeg@webkit.org>
1469
1470         Invalid code is generated for storing constants with baseindex addressing modes on ARM traditional.
1471         https://bugs.webkit.org/show_bug.cgi?id=109050
1472
1473         Reviewed by Oliver Hunt.
1474
1475         The S! scratch register is reused, but it should contain the constant value.
1476
1477         * assembler/ARMAssembler.cpp:
1478         (JSC::ARMAssembler::baseIndexTransfer32):
1479         (JSC::ARMAssembler::baseIndexTransfer16):
1480
1481 2013-02-07  Andras Becsi  <andras.becsi@digia.com>
1482
1483         [Qt] Use GNU ar's thin archive format for intermediate static libs
1484         https://bugs.webkit.org/show_bug.cgi?id=109052
1485
1486         Reviewed by Jocelyn Turcotte.
1487
1488         Adjust project files that used activeBuildConfig()
1489         to use targetSubDir().
1490
1491         * JavaScriptCore.pri:
1492         * LLIntOffsetsExtractor.pro:
1493         * Target.pri:
1494
1495 2013-02-06  Roger Fong  <roger_fong@apple.com>
1496
1497         Unreviewed. Touchups to VS2010 WebKit solution.
1498         Fix an export generator script, modify some property sheets, add resouce file.
1499
1500         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props:
1501         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
1502         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props:
1503         * JavaScriptCore.vcxproj/resource.h: Added.
1504
1505 2013-02-06  Ilya Tikhonovsky  <loislo@chromium.org>
1506
1507         Web Inspector: Native Memory Instrumentation: assign class name to the heap graph node automatically
1508         https://bugs.webkit.org/show_bug.cgi?id=107262
1509
1510         Reviewed by Yury Semikhatsky.
1511
1512         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
1513
1514 2013-02-06  Mike West  <mkwst@chromium.org>
1515
1516         Add an ENABLE_NOSNIFF feature flag.
1517         https://bugs.webkit.org/show_bug.cgi?id=109029
1518
1519         Reviewed by Jochen Eisinger.
1520
1521         This new flag will control the behavior of 'X-Content-Type-Options: nosniff'
1522         when processing script and other resource types.
1523
1524         * Configurations/FeatureDefines.xcconfig:
1525
1526 2013-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
1527
1528         put_to_base should emit a Phantom for "value" across the ForceOSRExit
1529         https://bugs.webkit.org/show_bug.cgi?id=108998
1530
1531         Reviewed by Oliver Hunt.
1532
1533         Otherwise, the OSR exit compiler could clobber it, which would lead to badness.
1534
1535         * bytecode/CodeBlock.cpp:
1536         (JSC::CodeBlock::tallyFrequentExitSites): Build fixes for when DFG debug logging is enabled.
1537         * dfg/DFGByteCodeParser.cpp:
1538         (JSC::DFG::ByteCodeParser::parseBlock): Added extra Phantoms for the "value" field where needed.
1539         * dfg/DFGSpeculativeJIT.cpp:
1540         (JSC::DFG::SpeculativeJIT::compile): Ditto.
1541
1542 2013-02-05  Michael Saboff  <msaboff@apple.com>
1543
1544         Crash at JSC::call when loading www.gap.com with JSVALUE32_64 Enabled
1545         https://bugs.webkit.org/show_bug.cgi?id=108991
1546
1547         Reviewed by Oliver Hunt.
1548
1549         Changed the restoration from calleeGPR to nonArgGPR0 because the restoration of the return location
1550         may step on calleeGPR is it happen to be nonArgGPR2.
1551
1552         * dfg/DFGRepatch.cpp:
1553         (JSC::DFG::dfgLinkClosureCall):
1554
1555 2013-02-05  Roger Fong  <roger_fong@apple.com>
1556
1557         Add a JavaScriptCore Export Generator project.
1558         https://bugs.webkit.org/show_bug.cgi?id=108971.
1559
1560         Reviewed by Brent Fulgham.
1561
1562         * JavaScriptCore.vcxproj/JavaScriptCore.sln:
1563         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1564         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1565         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
1566         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator: Added.
1567         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj: Added.
1568         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters: Added.
1569         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.user: Added.
1570         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorBuildCmd.cmd: Added.
1571         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props: Added.
1572         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props: Added.
1573         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd: Added.
1574         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPreBuild.cmd: Added.
1575         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props: Added.
1576         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Added.
1577
1578 2013-02-04  Filip Pizlo  <fpizlo@apple.com>
1579
1580         DFG should have a precise view of jump targets
1581         https://bugs.webkit.org/show_bug.cgi?id=108868
1582
1583         Reviewed by Oliver Hunt.
1584
1585         Previously, the DFG relied entirely on the CodeBlock's jump targets list for
1586         determining when to break basic blocks. This worked great, except sometimes it
1587         would be too conservative since the CodeBlock just says where the bytecode
1588         generator inserted labels.
1589
1590         This change keeps the old jump target list in CodeBlock since it is still
1591         valuable to the baseline JIT, but switches the DFG to use its own jump target
1592         calculator. This ought to reduce pressure on the DFG simplifier, which would
1593         previously do a lot of work to try to merge redundantly created basic blocks.
1594         It appears to be a 1% progression on SunSpider.
1595
1596         * CMakeLists.txt:
1597         * GNUmakefile.list.am:
1598         * JavaScriptCore.xcodeproj/project.pbxproj:
1599         * Target.pri:
1600         * bytecode/PreciseJumpTargets.cpp: Added.
1601         (JSC):
1602         (JSC::addSimpleSwitchTargets):
1603         (JSC::computePreciseJumpTargets):
1604         * bytecode/PreciseJumpTargets.h: Added.
1605         (JSC):
1606         * dfg/DFGByteCodeParser.cpp:
1607         (JSC::DFG::ByteCodeParser::parseCodeBlock):
1608
1609 2013-02-01  Roger Fong  <roger_fong@apple.com>
1610
1611         Make ConfigurationBuildDir include directories precede WebKitLibraries in JSC.
1612         https://bugs.webkit.org/show_bug.cgi?id=108693.
1613
1614         Rubberstamped by Timothy Horton.
1615
1616         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
1617
1618 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
1619
1620         Structure::m_outOfLineCapacity is unnecessary
1621         https://bugs.webkit.org/show_bug.cgi?id=108206
1622
1623         Reviewed by Darin Adler.
1624
1625         Simplifying the utility functions that we use since we don't need a
1626         bunch of fancy templates for this one specific call site.
1627
1628         * runtime/Structure.h:
1629         (JSC::Structure::outOfLineCapacity):
1630
1631 2013-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
1632
1633         Objective-C API: testapi.mm should use ARC
1634         https://bugs.webkit.org/show_bug.cgi?id=107838
1635
1636         Reviewed by Oliver Hunt.
1637
1638         In ToT testapi.mm uses the Obj-C garbage collector, which hides a lot of our object lifetime bugs.
1639         We should enable ARC, since that is what most of our clients will be using. We use Xcode project
1640         settings to make sure we don't try to compile ARC on 32-bit.
1641
1642         * API/tests/testapi.mm:
1643         (+[TestObject testObject]):
1644         (testObjectiveCAPI):
1645         * JavaScriptCore.xcodeproj/project.pbxproj:
1646
1647 2013-02-05  Brent Fulgham  <bfulgham@webkit.org>
1648
1649         [Windows] Unreviewed VS2010 Build Correction after r141651
1650
1651         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add missing
1652         StructureRareData.h and StructureRareData.cpp files.
1653         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
1654
1655 2013-02-05  Michael Saboff  <msaboff@apple.com>
1656
1657         r141788 won't build due to not having all changes needed by Node* change
1658         https://bugs.webkit.org/show_bug.cgi?id=108944
1659
1660         Reviewed by David Kilzer.
1661
1662         Fixed three instances of integerResult(..., m_compileIndex) to be integerResult(..., node).
1663
1664         * dfg/DFGSpeculativeJIT.cpp:
1665         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
1666         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
1667
1668 2013-02-04  Sheriff Bot  <webkit.review.bot@gmail.com>
1669
1670         Unreviewed, rolling out r141809.
1671         http://trac.webkit.org/changeset/141809
1672         https://bugs.webkit.org/show_bug.cgi?id=108860
1673
1674         ARC isn't supported on 32-bit. (Requested by mhahnenberg on
1675         #webkit).
1676
1677         * API/tests/testapi.mm:
1678         (+[TestObject testObject]):
1679         (testObjectiveCAPI):
1680         * JavaScriptCore.xcodeproj/project.pbxproj:
1681
1682 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
1683
1684         Objective-C API: testapi.mm should use ARC
1685         https://bugs.webkit.org/show_bug.cgi?id=107838
1686
1687         Reviewed by Oliver Hunt.
1688
1689         In ToT testapi.mm uses the Obj-C garbage collector, which hides a lot of our object lifetime bugs.
1690         We should enable ARC, since that is what most of our clients will be using.
1691
1692         * API/tests/testapi.mm:
1693         (-[TestObject init]):
1694         (-[TestObject dealloc]):
1695         (+[TestObject testObject]):
1696         (testObjectiveCAPI):
1697         * JavaScriptCore.xcodeproj/project.pbxproj:
1698
1699 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
1700
1701         Objective-C API: ObjCCallbackFunction should retain the target of its NSInvocation
1702         https://bugs.webkit.org/show_bug.cgi?id=108843
1703
1704         Reviewed by Darin Adler.
1705
1706         Currently, ObjCCallbackFunction doesn't retain the target of its NSInvocation. It needs to do
1707         this to prevent crashes when trying to invoke a callback later on.
1708
1709         * API/ObjCCallbackFunction.mm:
1710         (ObjCCallbackFunction::ObjCCallbackFunction):
1711         (ObjCCallbackFunction::~ObjCCallbackFunction):
1712
1713 2013-02-04  Martin Robinson  <mrobinson@igalia.com>
1714
1715         Fix GTK+ 'make dist' in preparation for the 1.11.5 release.
1716
1717         * GNUmakefile.list.am: Update the source lists.
1718
1719 2013-02-04  Michael Saboff  <msaboff@apple.com>
1720
1721         For ARMv7s use integer divide instruction for divide and modulo when possible
1722         https://bugs.webkit.org/show_bug.cgi?id=108840
1723
1724         Reviewed in person by Filip Pizlo.
1725
1726         Added ARMv7s integer divide path for ArithDiv and ArithMod where operands and results are integer.
1727         This is patterned after the similar code for X86.  Also added modulo power of 2 optimization
1728         that uses logical and.  Added sdiv and udiv to the ARMv7 disassembler.  Put all the changes
1729         behind #if CPU(APPLE_ARMV7S).
1730
1731         * assembler/ARMv7Assembler.h:
1732         (ARMv7Assembler):
1733         (JSC::ARMv7Assembler::sdiv):
1734         (JSC::ARMv7Assembler::udiv):
1735         * dfg/DFGCommon.h:
1736         (JSC::DFG::isARMv7s):
1737         * dfg/DFGFixupPhase.cpp:
1738         (JSC::DFG::FixupPhase::fixupNode):
1739         * dfg/DFGSpeculativeJIT.cpp:
1740         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
1741         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
1742         * dfg/DFGSpeculativeJIT.h:
1743         (SpeculativeJIT):
1744         * dfg/DFGSpeculativeJIT32_64.cpp:
1745         (JSC::DFG::SpeculativeJIT::compile):
1746
1747 2013-02-04  David Kilzer  <ddkilzer@apple.com>
1748
1749         Check PrivateHeaders/JSBasePrivate.h for inappropriate macros
1750         <http://webkit.org/b/108749>
1751
1752         Reviewed by Joseph Pecoraro.
1753
1754         * JavaScriptCore.xcodeproj/project.pbxproj: Add
1755         PrivateHeaders/JSBasePrivate.h to list of headers to check in
1756         "Check for Inappropriate Macros in External Headers" build phase
1757         script.
1758
1759 2013-02-04  David Kilzer  <ddkilzer@apple.com>
1760
1761         Remove duplicate entries from JavaScriptCore Xcode project
1762
1763             $ uniq Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj | diff -u - Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj | patch -p0 -R
1764             patching file Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
1765
1766         * JavaScriptCore.xcodeproj/project.pbxproj: Remove duplicates.
1767
1768 2013-02-04  David Kilzer  <ddkilzer@apple.com>
1769
1770         Sort JavaScriptCore Xcode project file
1771
1772         * JavaScriptCore.xcodeproj/project.pbxproj:
1773
1774 2013-02-03  David Kilzer  <ddkilzer@apple.com>
1775
1776         Upstream ENABLE_PDFKIT_PLUGIN settting
1777         <http://webkit.org/b/108792>
1778
1779         Reviewed by Tim Horton.
1780
1781         * Configurations/FeatureDefines.xcconfig: Disable PDFKIT_PLUGIN
1782         on iOS since PDFKit is a Mac-only framework.
1783
1784 2013-02-02  Andreas Kling  <akling@apple.com>
1785
1786         Vector should consult allocator about ideal size when choosing capacity.
1787         <http://webkit.org/b/108410>
1788         <rdar://problem/13124002>
1789
1790         Reviewed by Benjamin Poulain.
1791
1792         Remove assertion about Vector capacity that won't hold anymore since capacity()
1793         may not be what you passed to reserveCapacity().
1794         Also export WTF::fastMallocGoodSize() for Windows builds.
1795
1796         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
1797         * bytecode/CodeBlock.cpp:
1798         (JSC::CodeBlock::CodeBlock):
1799
1800 2013-02-02  Patrick Gansterer  <paroga@webkit.org>
1801
1802         [CMake] Adopt the WinCE port to new CMake
1803         https://bugs.webkit.org/show_bug.cgi?id=108754
1804
1805         Reviewed by Laszlo Gombos.
1806
1807         * os-win32/WinMain.cpp: Removed.
1808         * shell/PlatformWinCE.cmake: Removed.
1809
1810 2013-02-02  Mark Rowe  <mrowe@apple.com>
1811
1812         <http://webkit.org/b/108745> WTF shouldn't use a script build phase to detect the presence of headers when the compiler can do it for us
1813
1814         Reviewed by Sam Weinig.
1815
1816         * DerivedSources.make: Remove an obsolete Makefile rule. This should have been removed when the use
1817         of the generated file moved to WTF.
1818
1819 2013-02-02  David Kilzer  <ddkilzer@apple.com>
1820
1821         Upstream iOS FeatureDefines
1822         <http://webkit.org/b/108753>
1823
1824         Reviewed by Anders Carlsson.
1825
1826         * Configurations/FeatureDefines.xcconfig:
1827         - ENABLE_DEVICE_ORIENTATION: Add iOS configurations.
1828         - ENABLE_PLUGIN_PROXY_FOR_VIDEO: Ditto.
1829         - FEATURE_DEFINES: Add ENABLE_PLUGIN_PROXY_FOR_VIDEO.  Add
1830           PLATFORM_NAME variant to reduce future merge conflicts.
1831
1832 2013-02-01  Mark Hahnenberg  <mhahnenberg@apple.com>
1833
1834         Structure::m_enumerationCache should be moved to StructureRareData
1835         https://bugs.webkit.org/show_bug.cgi?id=108723
1836
1837         Reviewed by Oliver Hunt.
1838
1839         m_enumerationCache is only used by objects whose properties are iterated over, so not every Structure needs this
1840         field and it can therefore be moved safely to StructureRareData to help with memory savings.
1841
1842         * runtime/JSPropertyNameIterator.h:
1843         (JSPropertyNameIterator):
1844         (JSC::Register::propertyNameIterator):
1845         (JSC::StructureRareData::enumerationCache): Add to JSPropertyNameIterator.h so that it can see the correct type.
1846         (JSC::StructureRareData::setEnumerationCache): Ditto.
1847         * runtime/Structure.cpp:
1848         (JSC::Structure::addPropertyWithoutTransition): Use the enumerationCache() getter rather than accessing the field.
1849         (JSC::Structure::removePropertyWithoutTransition): Ditto.
1850         (JSC::Structure::visitChildren): We no longer have to worry about marking the m_enumerationCache field.
1851         * runtime/Structure.h:
1852         (JSC::Structure::setEnumerationCache): Move the old accessors back since we don't have to have any knowledge of
1853         the JSPropertyNameIterator type.
1854         (JSC::Structure::enumerationCache): Ditto.
1855         * runtime/StructureRareData.cpp:
1856         (JSC::StructureRareData::visitChildren): Mark the new m_enumerationCache field.
1857         * runtime/StructureRareData.h: Add new functions/fields.
1858         (StructureRareData):
1859
1860 2013-02-01  Roger Fong  <roger_fong@apple.com>
1861
1862         Unreviewed. JavaScriptCore VS2010 project cleanup.
1863
1864         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1865         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1866         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
1867         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
1868
1869 2013-02-01  Sheriff Bot  <webkit.review.bot@gmail.com>
1870
1871         Unreviewed, rolling out r141662.
1872         http://trac.webkit.org/changeset/141662
1873         https://bugs.webkit.org/show_bug.cgi?id=108738
1874
1875         it's an incorrect change since processPhiStack will
1876         dereference dangling BasicBlock pointers (Requested by pizlo
1877         on #webkit).
1878
1879         * dfg/DFGByteCodeParser.cpp:
1880         (JSC::DFG::ByteCodeParser::parse):
1881
1882 2013-02-01  Filip Pizlo  <fpizlo@apple.com>
1883
1884         Eliminate dead blocks sooner in the DFG::ByteCodeParser to make clear that you don't need to hold onto them during Phi construction
1885         https://bugs.webkit.org/show_bug.cgi?id=108717
1886
1887         Reviewed by Mark Hahnenberg.
1888
1889         I think this makes the code clearer. It doesn't change behavior.
1890
1891         * dfg/DFGByteCodeParser.cpp:
1892         (JSC::DFG::ByteCodeParser::parse):
1893
1894 2013-02-01  Mark Hahnenberg  <mhahnenberg@apple.com>
1895
1896         Structure should have a StructureRareData field to save space
1897         https://bugs.webkit.org/show_bug.cgi?id=108659
1898
1899         Reviewed by Oliver Hunt.
1900
1901         Many of the fields in Structure are used in a subset of all total Structures; however, all Structures must
1902         pay the memory cost of those fields, regardless of whether they use them or not. Since we can have potentially
1903         many Structures on a single page (e.g. bing.com creates ~1500 Structures), it would be profitable to
1904         refactor Structure so that not every Structure has to pay the memory costs for these infrequently used fields.
1905
1906         To accomplish this, we can create a new StructureRareData class to house these seldom used fields which we
1907         can allocate on demand whenever a Structure requires it. This StructureRareData can itself be a JSCell, and
1908         can do all the marking of the fields for the Structure. The StructureRareData field will be part of a union
1909         with m_previous to minimize overhead. We'll add a new field to JSTypeInfo to indicate that the Structure has
1910         a StructureRareData field. During transitions, a Structure will clone its previous Structure's StructureRareData
1911         if it has one. There could be some potential for optimizing this process, but the initial implementation will
1912         be dumb since we'd be paying these overhead costs for each Structure anyways.
1913
1914         Initially we'll only put two fields in the StructureRareData to avoid a memory regression. Over time we'll
1915         continue to move fields from Structure to StructureRareData. Optimistically, this could potentially reduce our
1916         Structure memory footprint by up to around 75%. It could also clear the way for removing destructors from
1917         Structures (and into StructureRareData).
1918
1919         * CMakeLists.txt:
1920         * GNUmakefile.list.am:
1921         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1922         * JavaScriptCore.xcodeproj/project.pbxproj:
1923         * Target.pri:
1924         * dfg/DFGRepatch.cpp: Includes for linking purposes.
1925         * jit/JITStubs.cpp:
1926         * jsc.cpp:
1927         * llint/LLIntSlowPaths.cpp:
1928         * runtime/JSCellInlines.h: Added ifdef guards.
1929         * runtime/JSGlobalData.cpp: New Structure for StructureRareData class.
1930         (JSC::JSGlobalData::JSGlobalData):
1931         * runtime/JSGlobalData.h:
1932         (JSGlobalData):
1933         * runtime/JSGlobalObject.h:
1934         * runtime/JSTypeInfo.h: New flag to indicate whether or not a Structure has a StructureRareData field.
1935         (JSC::TypeInfo::flags):
1936         (JSC::TypeInfo::structureHasRareData):
1937         * runtime/ObjectPrototype.cpp:
1938         * runtime/Structure.cpp: We use a combined WriteBarrier<JSCell> field m_previousOrRareData to avoid compiler issues.
1939         (JSC::Structure::dumpStatistics):
1940         (JSC::Structure::Structure):
1941         (JSC::Structure::materializePropertyMap):
1942         (JSC::Structure::addPropertyTransition):
1943         (JSC::Structure::nonPropertyTransition):
1944         (JSC::Structure::pin):
1945         (JSC::Structure::allocateRareData): Handles allocating a brand new StructureRareData field.
1946         (JSC::Structure::cloneRareDataFrom): Handles cloning a StructureRareData field from another. Used during Structure
1947         transitions.
1948         (JSC::Structure::visitChildren): We no longer have to worry about marking m_objectToStringValue.
1949         * runtime/Structure.h:
1950         (JSC::Structure::previousID): Checks the structureHasRareData flag to see where it should get the previous Structure.
1951         (JSC::Structure::objectToStringValue): Reads the value from the StructureRareData. If it doesn't exist, returns 0.
1952         (JSC::Structure::setObjectToStringValue): Ensures that we have a StructureRareData field, then forwards the function
1953         call to it.
1954         (JSC::Structure::materializePropertyMapIfNecessary):
1955         (JSC::Structure::setPreviousID): Checks for StructureRareData and forwards if necessary.
1956         (Structure):
1957         (JSC::Structure::clearPreviousID): Ditto.
1958         (JSC::Structure::create):
1959         * runtime/StructureRareData.cpp: Added. All of the basic functionality of a JSCell with the fields that we've moved
1960         from Structure and the functions required to access/modify those fields as Structure would have done.
1961         (JSC):
1962         (JSC::StructureRareData::createStructure):
1963         (JSC::StructureRareData::create):
1964         (JSC::StructureRareData::clone):
1965         (JSC::StructureRareData::StructureRareData):
1966         (JSC::StructureRareData::visitChildren):
1967         * runtime/StructureRareData.h: Added.
1968         (JSC):
1969         (StructureRareData):
1970         * runtime/StructureRareDataInlines.h: Added.
1971         (JSC):
1972         (JSC::StructureRareData::previousID):
1973         (JSC::StructureRareData::setPreviousID):
1974         (JSC::StructureRareData::clearPreviousID):
1975         (JSC::Structure::previous): Handles the ugly casting to get the value of the right type of m_previousOrRareData.
1976         (JSC::Structure::rareData): Ditto.
1977         (JSC::StructureRareData::objectToStringValue):
1978         (JSC::StructureRareData::setObjectToStringValue):
1979
1980         * CMakeLists.txt:
1981         * GNUmakefile.list.am:
1982         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1983         * JavaScriptCore.xcodeproj/project.pbxproj:
1984         * Target.pri:
1985         * dfg/DFGRepatch.cpp:
1986         * jit/JITStubs.cpp:
1987         * jsc.cpp:
1988         * llint/LLIntSlowPaths.cpp:
1989         * runtime/JSCellInlines.h:
1990         * runtime/JSGlobalData.cpp:
1991         (JSC::JSGlobalData::JSGlobalData):
1992         * runtime/JSGlobalData.h:
1993         (JSGlobalData):
1994         * runtime/JSGlobalObject.h:
1995         * runtime/JSTypeInfo.h:
1996         (JSC):
1997         (JSC::TypeInfo::flags):
1998         (JSC::TypeInfo::structureHasRareData):
1999         * runtime/ObjectPrototype.cpp:
2000         * runtime/Structure.cpp:
2001         (JSC::Structure::dumpStatistics):
2002         (JSC::Structure::Structure):
2003         (JSC::Structure::materializePropertyMap):
2004         (JSC::Structure::addPropertyTransition):
2005         (JSC::Structure::nonPropertyTransition):
2006         (JSC::Structure::pin):
2007         (JSC::Structure::allocateRareData):
2008         (JSC):
2009         (JSC::Structure::cloneRareDataFrom):
2010         (JSC::Structure::visitChildren):
2011         * runtime/Structure.h:
2012         (JSC::Structure::previousID):
2013         (JSC::Structure::objectToStringValue):
2014         (JSC::Structure::setObjectToStringValue):
2015         (JSC::Structure::materializePropertyMapIfNecessary):
2016         (JSC::Structure::setPreviousID):
2017         (Structure):
2018         (JSC::Structure::clearPreviousID):
2019         (JSC::Structure::previous):
2020         (JSC::Structure::rareData):
2021         (JSC::Structure::create):
2022         * runtime/StructureRareData.cpp: Added.
2023         (JSC):
2024         (JSC::StructureRareData::createStructure):
2025         (JSC::StructureRareData::create):
2026         (JSC::StructureRareData::clone):
2027         (JSC::StructureRareData::StructureRareData):
2028         (JSC::StructureRareData::visitChildren):
2029         * runtime/StructureRareData.h: Added.
2030         (JSC):
2031         (StructureRareData):
2032         * runtime/StructureRareDataInlines.h: Added.
2033         (JSC):
2034         (JSC::StructureRareData::previousID):
2035         (JSC::StructureRareData::setPreviousID):
2036         (JSC::StructureRareData::clearPreviousID):
2037         (JSC::StructureRareData::objectToStringValue):
2038         (JSC::StructureRareData::setObjectToStringValue):
2039
2040 2013-02-01  Balazs Kilvady  <kilvadyb@homejinni.com>
2041
2042         offlineasm BaseIndex handling is broken on ARM due to MIPS changes
2043         https://bugs.webkit.org/show_bug.cgi?id=108261
2044
2045         Reviewed by Filip Pizlo.
2046
2047         offlineasm BaseIndex handling fix on MIPS.
2048
2049         * offlineasm/mips.rb:
2050         * offlineasm/risc.rb:
2051
2052 2013-02-01  Geoffrey Garen  <ggaren@apple.com>
2053
2054         Removed an unused function: JSGlobalObject::createFunctionExecutableFromGlobalCode
2055         https://bugs.webkit.org/show_bug.cgi?id=108657
2056
2057         Reviewed by Anders Carlsson.
2058
2059         * runtime/JSGlobalObject.cpp:
2060         (JSC):
2061         * runtime/JSGlobalObject.h:
2062         (JSGlobalObject):
2063
2064 2013-02-01  Geoffrey Garen  <ggaren@apple.com>
2065
2066         Added TriState to WTF and started using it in one place
2067         https://bugs.webkit.org/show_bug.cgi?id=108628
2068
2069         Reviewed by Beth Dakin.
2070
2071         * runtime/PrototypeMap.h:
2072         (JSC::PrototypeMap::isPrototype): Use TriState instead of boolean. In
2073         response to review feedback, this is an attempt to clarify that our
2074         'true' condition is actually just a 'maybe'.
2075
2076         * runtime/PrototypeMap.h:
2077         (PrototypeMap):
2078         (JSC::PrototypeMap::isPrototype):
2079
2080 2013-02-01  Alexis Menard  <alexis@webkit.org>
2081
2082         Enable unprefixed CSS transitions by default.
2083         https://bugs.webkit.org/show_bug.cgi?id=108216
2084
2085         Reviewed by Dean Jackson.
2086
2087         Rename the flag CSS_TRANSFORMS_ANIMATIONS_TRANSITIONS_UNPREFIXED
2088         to CSS_TRANSFORMS_ANIMATIONS_UNPREFIXED which will be used later to
2089         guard the unprefixing work for CSS Transforms and animations.
2090
2091         * Configurations/FeatureDefines.xcconfig:
2092
2093 2013-01-31  Filip Pizlo  <fpizlo@apple.com>
2094
2095         DFG::CFGSimplificationPhase::keepOperandAlive() conflates liveness and availability
2096         https://bugs.webkit.org/show_bug.cgi?id=108580
2097
2098         Reviewed by Oliver Hunt.
2099
2100         This is a harmless bug in that it only results in us keeping a bit too many things
2101         for OSR.  But it's worth fixing so that the code is consistent.
2102
2103         keepOperandAlive() is called when block A has a branch to blocks B and C, but the
2104         A->B edge is proven to never be taken and we want to optimize the code to have A
2105         unconditionally jump to C.  In that case, for the purposes of OSR, we need to
2106         preserve the knowledge that the state that B expected to be live incoming from A
2107         ought still to be live up to the point of where the A->B,C branch used to be.  The
2108         way we keep things alive is by using the variablesAtTail of A (i.e., we use the
2109         knowledge of in what manner A made state available to B and C).  The way we choose
2110         which state should be kept alive ought to be chosen by the variablesAtHead of B
2111         (i.e. the things B says it needs from its predecessors, including A), except that
2112         keepOperandAlive() was previously just using variablesAtTail of A for this
2113         purpose.
2114
2115         The fix is to have keepOperandAlive() use both liveness and availability in its
2116         logic. It should use liveness (i.e. B->variablesAtHead) to decide what to keep
2117         alive, and it should use availability (i.e. A->variablesAtTail) to decide how to
2118         keep it alive.
2119
2120         This might be a microscopic win on some programs, but it's mainly intended to be
2121         a code clean-up so that I don't end up scratching my head in confusion the next
2122         time I look at this code.
2123
2124         * dfg/DFGCFGSimplificationPhase.cpp:
2125         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
2126         (JSC::DFG::CFGSimplificationPhase::jettisonBlock):
2127         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
2128
2129 2013-01-31  Geoffrey Garen  <ggaren@apple.com>
2130
2131         REGRESSION (r141192): Crash beneath cti_op_get_by_id_generic @ discussions.apple.com
2132         https://bugs.webkit.org/show_bug.cgi?id=108576
2133
2134         Reviewed by Filip Pizlo.
2135
2136         This was a long-standing bug. The DFG would destructively reuse a register
2137         in op_convert_this, but:
2138
2139             * The bug only presented during speculation failure for type Other
2140
2141             * The bug presented by removing the low bits of a pointer, which
2142             used to be harmless, since all objects were so aligned anyway.
2143
2144         * dfg/DFGSpeculativeJIT64.cpp:
2145         (JSC::DFG::SpeculativeJIT::compile): Don't reuse our this register as
2146         our scratch register. The whole point of our scratch register is to
2147         avoid destructively modifying our this register. I'm pretty sure this
2148         was a copy-paste error.
2149
2150 2013-01-31  Roger Fong  <roger_fong@apple.com>
2151
2152         Unreviewed. Windows build fix.
2153
2154         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
2155
2156 2013-01-31  Jessie Berlin  <jberlin@apple.com>
2157
2158         Rolling out r141407 because it is causing crashes under
2159         WTF::TCMalloc_Central_FreeList::FetchFromSpans() in Release builds.
2160
2161         * bytecode/CodeBlock.cpp:
2162         (JSC::CodeBlock::CodeBlock):
2163
2164 2013-01-31  Mark Hahnenberg  <mhahnenberg@apple.com>
2165
2166         Objective-C API: JSContext exception property causes reference cycle
2167         https://bugs.webkit.org/show_bug.cgi?id=107778
2168
2169         Reviewed by Darin Adler.
2170
2171         JSContext has a (retain) JSValue * exception property which, when non-null, creates a
2172         reference cycle (since the JSValue * holds a strong reference back to the JSContext *).
2173
2174         * API/JSContext.mm: Instead of JSValue *, we now use a plain JSValueRef, which eliminates the reference cycle.
2175         (-[JSContext initWithVirtualMachine:]):
2176         (-[JSContext setException:]):
2177         (-[JSContext exception]):
2178
2179 2013-01-31  Roger Fong  <roger_fong@apple.com>
2180
2181         Unreviewed build fix. Win7 port.
2182
2183         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
2184
2185 2013-01-31  Joseph Pecoraro  <pecoraro@apple.com>
2186
2187         Disable ENABLE_FULLSCREEN_API on iOS
2188         https://bugs.webkit.org/show_bug.cgi?id=108250
2189
2190         Reviewed by Benjamin Poulain.
2191
2192         * Configurations/FeatureDefines.xcconfig:
2193
2194 2013-01-31  Mark Hahnenberg  <mhahnenberg@apple.com>
2195
2196         Objective-C API: Fix insertion of values greater than the max index allowed by the spec
2197         https://bugs.webkit.org/show_bug.cgi?id=108264
2198
2199         Reviewed by Oliver Hunt.
2200
2201         Fixed a bug, added a test to the API tests, cleaned up some code.
2202
2203         * API/JSValue.h: Changed some of the documentation on setValue:atIndex: to indicate that
2204         setting values at indices greater than UINT_MAX - 1 wont' affect the length of JS arrays.
2205         * API/JSValue.mm:
2206         (-[JSValue valueAtIndex:]): We weren't returning when we should have been.
2207         (-[JSValue setValue:atIndex:]): Added a comment about why we do the early check for being larger than UINT_MAX.
2208         (objectToValueWithoutCopy): Removed two redundant cases that were already checked previously.
2209         * API/tests/testapi.mm:
2210
2211 2013-01-30  Andreas Kling  <akling@apple.com>
2212
2213         Vector should consult allocator about ideal size when choosing capacity.
2214         <http://webkit.org/b/108410>
2215         <rdar://problem/13124002>
2216
2217         Reviewed by Benjamin Poulain.
2218
2219         Remove assertion about Vector capacity that won't hold anymore since capacity()
2220         may not be what you passed to reserveCapacity().
2221
2222         * bytecode/CodeBlock.cpp:
2223         (JSC::CodeBlock::CodeBlock):
2224
2225 2013-01-30  Filip Pizlo  <fpizlo@apple.com>
2226
2227         DFG bytecode parser should have more assertions about the status of local accesses
2228         https://bugs.webkit.org/show_bug.cgi?id=108417
2229
2230         Reviewed by Mark Hahnenberg.
2231
2232         Assert some things that we already know to be true, just to reassure ourselves that they are true.
2233         This is meant as a prerequisite for https://bugs.webkit.org/show_bug.cgi?id=108414, which will
2234         make these rules even stricter.
2235
2236         * dfg/DFGByteCodeParser.cpp:
2237         (JSC::DFG::ByteCodeParser::getLocal):
2238         (JSC::DFG::ByteCodeParser::getArgument):
2239
2240 2013-01-30  Mark Hahnenberg  <mhahnenberg@apple.com>
2241
2242         Objective-C API: JSContext's dealloc causes ASSERT due to ordering of releases
2243         https://bugs.webkit.org/show_bug.cgi?id=107978
2244
2245         Reviewed by Filip Pizlo.
2246
2247         We need to add the Identifier table save/restore in JSContextGroupRelease so that we
2248         have the correct table if we end up destroying the JSGlobalData/Heap.
2249
2250         * API/JSContextRef.cpp:
2251         (JSContextGroupRelease):
2252
2253 2013-01-30  Mark Hahnenberg  <mhahnenberg@apple.com>
2254
2255         Objective-C API: exceptionHandler needs to be released in JSContext dealloc
2256         https://bugs.webkit.org/show_bug.cgi?id=108378
2257
2258         Reviewed by Filip Pizlo.
2259
2260         JSContext has a (copy) exceptionHandler property that it doesn't release in dealloc.
2261         That sounds like the potential for a leak. It should be released.
2262
2263         * API/JSContext.mm:
2264         (-[JSContext dealloc]):
2265
2266 2013-01-30  Filip Pizlo  <fpizlo@apple.com>
2267
2268         REGRESSION(140504): pure CSE no longer matches things, 10% regression on Kraken
2269         https://bugs.webkit.org/show_bug.cgi?id=108366
2270
2271         Reviewed by Geoffrey Garen and Mark Hahnenberg.
2272
2273         This was a longstanding bug that was revealed by http://trac.webkit.org/changeset/140504.
2274         Pure CSE requires that the Node::flags() that may affect the behavior of a node match,
2275         when comparing a possibly redundant node to its possible replacement. It was doing this
2276         by comparing Node::arithNodeFlags(), which as the name might appear to suggest, returns
2277         just those flag bits that correspond to actual node behavior and not auxiliary things.
2278         Unfortunately, Node::arithNodeFlags() wasn't actually masking off the irrelevant bits.
2279         This worked prior to r140504 because CSE itself didn't mutate the flags, so there was a
2280         very high probability that matching nodes would also have completely identical flag bits
2281         (even the ones that aren't relevant to arithmetic behavior, like NodeDoesNotExit). But
2282         r140504 moved one of CSE's side-tables (m_relevantToOSR) into a flag bit for quicker
2283         access. These bits would be mutated as the CSE ran over a basic block, in such a way that
2284         there was a very high probability that the possible replacement would already have the
2285         bit set, while the redundant node did not have the bit set. Since Node::arithNodeFlags()
2286         returned all of the bits, this would cause CSEPhase::pureCSE() to reject the match
2287         almost every time.
2288
2289         The solution is to make Node::arithNodeFlags() do as its name suggests: only return those
2290         flags that are relevant to arithmetic behavior. This patch introduces a new mask that
2291         represents those bits, and includes NodeBehaviorMask and NodeBackPropMask, which are both
2292         used for queries on Node::arithNodeFlags(), and both affect arithmetic code gen. None of
2293         the other flags are relevant to Node::arithNodeFlags() since they either correspond to
2294         information already conveyed by the opcode (like NodeResultMask, NodeMustGenerate,
2295         NodeHasVarArgs, NodeClobbersWorld, NodeMightClobber) or information that doesn't affect
2296         the result that the node will produce or any of the queries performed on the result of
2297         Node::arithNodeFlags (NodeDoesNotExit and of course NodeRelevantToOSR).
2298
2299         This is a 10% speed-up on Kraken, undoing the regression from r140504.
2300
2301         * dfg/DFGNode.h:
2302         (JSC::DFG::Node::arithNodeFlags):
2303         * dfg/DFGNodeFlags.h:
2304         (DFG):
2305
2306 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
2307
2308         Structure::m_outOfLineCapacity is unnecessary
2309         https://bugs.webkit.org/show_bug.cgi?id=108206
2310
2311         Reviewed by Geoffrey Garen.
2312
2313         We can calculate our out of line capacity by using the outOfLineSize and our knowledge about our resize policy.
2314         According to GDB, this knocks Structures down from 136 bytes to 128 bytes (I'm guessing the extra bytes are from
2315         better alignment of object fields), which puts Structures in a smaller size class. Woohoo! Looks neutral on our
2316         benchmarks.
2317
2318         * runtime/Structure.cpp:
2319         (JSC::Structure::Structure):
2320         (JSC):
2321         (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
2322         (JSC::Structure::addPropertyTransition):
2323         (JSC::Structure::addPropertyWithoutTransition):
2324         * runtime/Structure.h:
2325         (Structure):
2326         (JSC::Structure::outOfLineCapacity):
2327         (JSC::Structure::totalStorageCapacity):
2328
2329 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
2330
2331         Be a little more conservative about emitting table-based switches
2332         https://bugs.webkit.org/show_bug.cgi?id=108292
2333
2334         Reviewed by Filip Pizlo.
2335
2336         Profiling shows we're using op_switch in cases where it's a regression.
2337
2338         * bytecompiler/NodesCodegen.cpp:
2339         (JSC):
2340         (JSC::length):
2341         (JSC::CaseBlockNode::tryTableSwitch):
2342         (JSC::CaseBlockNode::emitBytecodeForBlock):
2343         * parser/Nodes.h:
2344         (CaseBlockNode):
2345
2346 2013-01-29  Sheriff Bot  <webkit.review.bot@gmail.com>
2347
2348         Unreviewed, rolling out r140983.
2349         http://trac.webkit.org/changeset/140983
2350         https://bugs.webkit.org/show_bug.cgi?id=108277
2351
2352         Unfortunately, this API has one last client (Requested by
2353         abarth on #webkit).
2354
2355         * Configurations/FeatureDefines.xcconfig:
2356
2357 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
2358
2359         Objective-C API: JSObjCClassInfo creates reference cycle with JSContext
2360         https://bugs.webkit.org/show_bug.cgi?id=107839
2361
2362         Reviewed by Geoffrey Garen.
2363
2364         Fixing several ASSERTs that were incorrect along with some of the reallocation of m_prototype and
2365         m_constructor that they were based on.
2366
2367         * API/JSWrapperMap.mm:
2368         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): We now only allocate those
2369         fields that are null (i.e. have been collected or have never been allocated to begin with).
2370         (-[JSObjCClassInfo reallocateConstructorAndOrPrototype]): Renamed to better indicate that we're
2371         reallocating one or both of the prototype/constructor combo.
2372         (-[JSObjCClassInfo wrapperForObject:]): Call new reallocate function.
2373         (-[JSObjCClassInfo constructor]): Ditto.
2374
2375 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
2376
2377         Make precise size classes more precise
2378         https://bugs.webkit.org/show_bug.cgi?id=108270
2379
2380         Reviewed by Mark Hahnenberg.
2381
2382         Size inference makes this profitable.
2383
2384         I chose 8 byte increments because JSString is 24 bytes. Otherwise, 16
2385         byte increments might be better.
2386
2387         * heap/Heap.h:
2388         (Heap): Removed firstAllocatorWithoutDestructors because it's unused now.
2389
2390         * heap/MarkedBlock.h:
2391         (MarkedBlock): Updated constants.
2392
2393         * heap/MarkedSpace.h:
2394         (MarkedSpace):
2395         (JSC): Also reduced the maximum precise size class because my testing
2396         has shown that the smaller size classes are much more common. This
2397         offsets some of the size class explosion caused by reducing the precise
2398         increment.
2399
2400         * llint/LLIntData.cpp:
2401         (JSC::LLInt::Data::performAssertions): No need for this ASSERT anymore
2402         because we don't rely on firstAllocatorWithoutDestructors anymore, since
2403         we pick size classes dynamically now.
2404
2405 2013-01-29  Oliver Hunt  <oliver@apple.com>
2406
2407         Add some hardening to methodTable()
2408         https://bugs.webkit.org/show_bug.cgi?id=108253
2409
2410         Reviewed by Mark Hahnenberg.
2411
2412         When accessing methodTable() we now always make sure that our
2413         structure _could_ be valid.  Added a separate method to get a
2414         classes methodTable during destruction as it's not possible to
2415         validate the structure at that point.  This separation might
2416         also make it possible to improve the performance of methodTable
2417         access more generally in future.
2418
2419         * heap/MarkedBlock.cpp:
2420         (JSC::MarkedBlock::callDestructor):
2421         * runtime/JSCell.h:
2422         (JSCell):
2423         * runtime/JSCellInlines.h:
2424         (JSC::JSCell::methodTableForDestruction):
2425         (JSC):
2426         (JSC::JSCell::methodTable):
2427
2428 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
2429
2430         offlineasm BaseIndex handling is broken on ARM due to MIPS changes
2431         https://bugs.webkit.org/show_bug.cgi?id=108261
2432
2433         Reviewed by Oliver Hunt.
2434
2435         Backends shouldn't override each other's methods. That's not cool.
2436
2437         * offlineasm/mips.rb:
2438
2439 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
2440
2441         cloop.rb shouldn't use a method called 'dump' for code generation
2442         https://bugs.webkit.org/show_bug.cgi?id=108251
2443
2444         Reviewed by Mark Hahnenberg.
2445
2446         Revert http://trac.webkit.org/changeset/141178 and rename 'dump' to 'clDump'.
2447
2448         Also made trivial build fixes for !ENABLE(JIT).
2449
2450         * offlineasm/cloop.rb:
2451         * runtime/Executable.h:
2452         (ExecutableBase):
2453         (JSC::ExecutableBase::intrinsicFor):
2454         * runtime/JSGlobalData.h:
2455
2456 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
2457
2458         Removed GGC because it has been disabled for a long time
2459         https://bugs.webkit.org/show_bug.cgi?id=108245
2460
2461         Reviewed by Filip Pizlo.
2462
2463         * GNUmakefile.list.am:
2464         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2465         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2466         * JavaScriptCore.xcodeproj/project.pbxproj:
2467         * dfg/DFGRepatch.cpp:
2468         (JSC::DFG::emitPutReplaceStub):
2469         (JSC::DFG::emitPutTransitionStub):
2470         * dfg/DFGSpeculativeJIT.cpp:
2471         (JSC::DFG::SpeculativeJIT::writeBarrier):
2472         * dfg/DFGSpeculativeJIT.h:
2473         (SpeculativeJIT):
2474         * dfg/DFGSpeculativeJIT32_64.cpp:
2475         (JSC::DFG::SpeculativeJIT::compile):
2476         * dfg/DFGSpeculativeJIT64.cpp:
2477         (JSC::DFG::SpeculativeJIT::compile):
2478         * heap/CardSet.h: Removed.
2479         * heap/Heap.cpp:
2480         (JSC::Heap::markRoots):
2481         (JSC::Heap::collect):
2482         * heap/Heap.h:
2483         (Heap):
2484         (JSC::Heap::shouldCollect):
2485         (JSC::Heap::isWriteBarrierEnabled):
2486         (JSC):
2487         (JSC::Heap::writeBarrier):
2488         * heap/MarkedBlock.h:
2489         (MarkedBlock):
2490         (JSC):
2491         * heap/MarkedSpace.cpp:
2492         (JSC):
2493         * jit/JITPropertyAccess.cpp:
2494         (JSC::JIT::emitWriteBarrier):
2495
2496 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
2497
2498         Remove redundant AST dump method from cloop.rb, since they are already defined in ast.rb
2499         https://bugs.webkit.org/show_bug.cgi?id=108247
2500
2501         Reviewed by Oliver Hunt.
2502
2503         Makes offlineasm dumping easier to read and less likely to cause assertion failures.
2504         Also fixes the strange situation where cloop.rb and ast.rb both defined dump methods,
2505         but cloop.rb was winning.
2506
2507         * offlineasm/cloop.rb:
2508
2509 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
2510
2511         Objective-C API: JSObjCClassInfo creates reference cycle with JSContext
2512         https://bugs.webkit.org/show_bug.cgi?id=107839
2513
2514         Reviewed by Oliver Hunt.
2515
2516         JSContext has a JSWrapperMap, which has an NSMutableDictionary m_classMap, which has values that
2517         are JSObjCClassInfo objects, which have strong references to two JSValue *'s, m_prototype and
2518         m_constructor, which in turn have strong references to the JSContext, creating a reference cycle.
2519         We should make m_prototype and m_constructor Weak<JSObject>. This gets rid of the strong reference
2520         to the JSContext and also prevents clients from accidentally creating reference cycles by assigning
2521         to the prototype of the constructor. If Weak<JSObject> fields are ever garbage collected, we will
2522         reallocate them.
2523
2524         * API/JSContext.mm:
2525         (-[JSContext wrapperMap]):
2526         * API/JSContextInternal.h:
2527         * API/JSWrapperMap.mm:
2528         (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]):
2529         (-[JSObjCClassInfo dealloc]):
2530         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]):
2531         (-[JSObjCClassInfo allocateConstructorAndPrototype]):
2532         (-[JSObjCClassInfo wrapperForObject:]):
2533         (-[JSObjCClassInfo constructor]):
2534
2535 2013-01-29  Oliver Hunt  <oliver@apple.com>
2536
2537         REGRESSION (r140594): RELEASE_ASSERT_NOT_REACHED in JSC::Interpreter::execute
2538         https://bugs.webkit.org/show_bug.cgi?id=108097
2539
2540         Reviewed by Geoffrey Garen.
2541
2542         LiteralParser was accepting a bogus 'var a.b = c' statement
2543
2544         * runtime/LiteralParser.cpp:
2545         (JSC::::tryJSONPParse):
2546
2547 2013-01-29  Oliver Hunt  <oliver@apple.com>
2548
2549         Force debug builds to do bounds checks on contiguous property storage
2550         https://bugs.webkit.org/show_bug.cgi?id=108212
2551
2552         Reviewed by Mark Hahnenberg.
2553
2554         Add a ContiguousData type that we use to represent contiguous property
2555         storage.  In release builds it is simply a pointer to the correct type,
2556         but in debug builds it also carries the data length and performs bounds
2557         checks.  This means we don't have to add as many manual bounds assertions
2558         when performing operations over contiguous data.
2559
2560         * dfg/DFGOperations.cpp:
2561         * runtime/ArrayStorage.h:
2562         (ArrayStorage):
2563         (JSC::ArrayStorage::vector):
2564         * runtime/Butterfly.h:
2565         (JSC::ContiguousData::ContiguousData):
2566         (ContiguousData):
2567         (JSC::ContiguousData::operator[]):
2568         (JSC::ContiguousData::data):
2569         (JSC::ContiguousData::length):
2570         (JSC):
2571         (JSC::Butterfly::contiguousInt32):
2572         (Butterfly):
2573         (JSC::Butterfly::contiguousDouble):
2574         (JSC::Butterfly::contiguous):
2575         * runtime/JSArray.cpp:
2576         (JSC::JSArray::sortNumericVector):
2577         (ContiguousTypeAccessor):
2578         (JSC::ContiguousTypeAccessor::getAsValue):
2579         (JSC::ContiguousTypeAccessor::setWithValue):
2580         (JSC::ContiguousTypeAccessor::replaceDataReference):
2581         (JSC):
2582         (JSC::JSArray::sortCompactedVector):
2583         (JSC::JSArray::sort):
2584         (JSC::JSArray::fillArgList):
2585         (JSC::JSArray::copyToArguments):
2586         * runtime/JSArray.h:
2587         (JSArray):
2588         * runtime/JSObject.cpp:
2589         (JSC::JSObject::copyButterfly):
2590         (JSC::JSObject::visitButterfly):
2591         (JSC::JSObject::createInitialInt32):
2592         (JSC::JSObject::createInitialDouble):
2593         (JSC::JSObject::createInitialContiguous):
2594         (JSC::JSObject::convertUndecidedToInt32):
2595         (JSC::JSObject::convertUndecidedToDouble):
2596         (JSC::JSObject::convertUndecidedToContiguous):
2597         (JSC::JSObject::convertInt32ToDouble):
2598         (JSC::JSObject::convertInt32ToContiguous):
2599         (JSC::JSObject::genericConvertDoubleToContiguous):
2600         (JSC::JSObject::convertDoubleToContiguous):
2601         (JSC::JSObject::rageConvertDoubleToContiguous):
2602         (JSC::JSObject::ensureInt32Slow):
2603         (JSC::JSObject::ensureDoubleSlow):
2604         (JSC::JSObject::ensureContiguousSlow):
2605         (JSC::JSObject::rageEnsureContiguousSlow):
2606         (JSC::JSObject::ensureLengthSlow):
2607         * runtime/JSObject.h:
2608         (JSC::JSObject::ensureInt32):
2609         (JSC::JSObject::ensureDouble):
2610         (JSC::JSObject::ensureContiguous):
2611         (JSC::JSObject::rageEnsureContiguous):
2612         (JSObject):
2613         (JSC::JSObject::indexingData):
2614         (JSC::JSObject::currentIndexingData):
2615
2616 2013-01-29  Brent Fulgham  <bfulgham@webkit.org>
2617
2618         [Windows, WinCairo] Unreviewed build fix after r141050
2619
2620         * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Update symbols
2621         to match JavaScriptCore.vcproj version.
2622
2623 2013-01-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
2624
2625         [Qt] Implement GCActivityCallback
2626         https://bugs.webkit.org/show_bug.cgi?id=103998
2627
2628         Reviewed by Simon Hausmann.
2629
2630         Implements the activity triggered garbage collector.
2631
2632         * runtime/GCActivityCallback.cpp:
2633         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
2634         (JSC::DefaultGCActivityCallback::scheduleTimer):
2635         (JSC::DefaultGCActivityCallback::cancelTimer):
2636         * runtime/GCActivityCallback.h:
2637         (GCActivityCallback):
2638         (DefaultGCActivityCallback):
2639
2640 2013-01-29  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
2641
2642         Compilation warning in JSC
2643         https://bugs.webkit.org/show_bug.cgi?id=108178
2644
2645         Reviewed by Kentaro Hara.
2646
2647         Fixed 'comparison between signed and unsigned integer' warning in JSC::Structure constructor.
2648
2649         * runtime/Structure.cpp:
2650         (JSC::Structure::Structure):
2651
2652 2013-01-29  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
2653
2654         [Qt] Fix the JSC build on Mac
2655
2656         Unreviewed, build fix.
2657
2658         * heap/HeapTimer.h:
2659         Qt on Mac has USE(CF) true, and should use the CF HeapTimer in that case.
2660
2661 2013-01-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
2662
2663         [Qt] Implement IncrementalSweeper and HeapTimer
2664         https://bugs.webkit.org/show_bug.cgi?id=103996
2665
2666         Reviewed by Simon Hausmann.
2667
2668         Implements the incremental sweeping garbage collection for the Qt platform.
2669
2670         * heap/HeapTimer.cpp:
2671         (JSC::HeapTimer::HeapTimer):
2672         (JSC::HeapTimer::~HeapTimer):
2673         (JSC::HeapTimer::timerEvent):
2674         (JSC::HeapTimer::synchronize):
2675         (JSC::HeapTimer::invalidate):
2676         (JSC::HeapTimer::didStartVMShutdown):
2677         * heap/HeapTimer.h:
2678         (HeapTimer):
2679         * heap/IncrementalSweeper.cpp:
2680         (JSC::IncrementalSweeper::IncrementalSweeper):
2681         (JSC::IncrementalSweeper::scheduleTimer):
2682         * heap/IncrementalSweeper.h:
2683         (IncrementalSweeper):
2684
2685 2013-01-28  Filip Pizlo  <fpizlo@apple.com>
2686
2687         DFG should not use a graph that is a vector, Nodes shouldn't move after allocation, and we should always refer to nodes by Node*
2688         https://bugs.webkit.org/show_bug.cgi?id=106868
2689
2690         Reviewed by Oliver Hunt.
2691
2692         This adds a pool allocator for Nodes, and uses that instead of a Vector. Changes all
2693         uses of Node& and NodeIndex to be simply Node*. Nodes no longer have an index except
2694         for debugging (Node::index(), which is not guaranteed to be O(1)).
2695
2696         1% speed-up on SunSpider, presumably because this improves compile times.
2697
2698         * CMakeLists.txt:
2699         * GNUmakefile.list.am:
2700         * JavaScriptCore.xcodeproj/project.pbxproj:
2701         * Target.pri:
2702         * bytecode/DataFormat.h:
2703         (JSC::dataFormatToString):
2704         * dfg/DFGAbstractState.cpp:
2705         (JSC::DFG::AbstractState::initialize):
2706         (JSC::DFG::AbstractState::booleanResult):
2707         (JSC::DFG::AbstractState::execute):
2708         (JSC::DFG::AbstractState::mergeStateAtTail):
2709         (JSC::DFG::AbstractState::mergeToSuccessors):
2710         (JSC::DFG::AbstractState::mergeVariableBetweenBlocks):
2711         (JSC::DFG::AbstractState::dump):
2712         * dfg/DFGAbstractState.h:
2713         (DFG):
2714         (JSC::DFG::AbstractState::forNode):
2715         (AbstractState):
2716         (JSC::DFG::AbstractState::speculateInt32Unary):
2717         (JSC::DFG::AbstractState::speculateNumberUnary):
2718         (JSC::DFG::AbstractState::speculateBooleanUnary):
2719         (JSC::DFG::AbstractState::speculateInt32Binary):
2720         (JSC::DFG::AbstractState::speculateNumberBinary):
2721         (JSC::DFG::AbstractState::trySetConstant):
2722         * dfg/DFGAbstractValue.h:
2723         (AbstractValue):
2724         * dfg/DFGAdjacencyList.h:
2725         (JSC::DFG::AdjacencyList::AdjacencyList):
2726         (JSC::DFG::AdjacencyList::initialize):
2727         * dfg/DFGAllocator.h: Added.
2728         (DFG):
2729         (Allocator):
2730         (JSC::DFG::Allocator::Region::size):
2731         (JSC::DFG::Allocator::Region::headerSize):
2732         (JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
2733         (JSC::DFG::Allocator::Region::data):
2734         (JSC::DFG::Allocator::Region::isInThisRegion):
2735         (JSC::DFG::Allocator::Region::regionFor):
2736         (Region):
2737         (JSC::DFG::::Allocator):
2738         (JSC::DFG::::~Allocator):
2739         (JSC::DFG::::allocate):
2740         (JSC::DFG::::free):
2741         (JSC::DFG::::freeAll):
2742         (JSC::DFG::::reset):
2743         (JSC::DFG::::indexOf):
2744         (JSC::DFG::::allocatorOf):
2745         (JSC::DFG::::bumpAllocate):
2746         (JSC::DFG::::freeListAllocate):
2747         (JSC::DFG::::allocateSlow):
2748         (JSC::DFG::::freeRegionsStartingAt):
2749         (JSC::DFG::::startBumpingIn):
2750         * dfg/DFGArgumentsSimplificationPhase.cpp:
2751         (JSC::DFG::ArgumentsSimplificationPhase::run):
2752         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
2753         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
2754         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
2755         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
2756         (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
2757         * dfg/DFGArrayMode.cpp:
2758         (JSC::DFG::ArrayMode::originalArrayStructure):
2759         (JSC::DFG::ArrayMode::alreadyChecked):
2760         * dfg/DFGArrayMode.h:
2761         (ArrayMode):
2762         * dfg/DFGArrayifySlowPathGenerator.h:
2763         (JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
2764         * dfg/DFGBasicBlock.h:
2765         (JSC::DFG::BasicBlock::node):
2766         (JSC::DFG::BasicBlock::isInPhis):
2767         (JSC::DFG::BasicBlock::isInBlock):
2768         (BasicBlock):
2769         * dfg/DFGBasicBlockInlines.h:
2770         (DFG):
2771         * dfg/DFGByteCodeParser.cpp:
2772         (ByteCodeParser):
2773         (JSC::DFG::ByteCodeParser::getDirect):
2774         (JSC::DFG::ByteCodeParser::get):
2775         (JSC::DFG::ByteCodeParser::setDirect):
2776         (JSC::DFG::ByteCodeParser::set):
2777         (JSC::DFG::ByteCodeParser::setPair):
2778         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
2779         (JSC::DFG::ByteCodeParser::getLocal):
2780         (JSC::DFG::ByteCodeParser::setLocal):
2781         (JSC::DFG::ByteCodeParser::getArgument):
2782         (JSC::DFG::ByteCodeParser::setArgument):
2783         (JSC::DFG::ByteCodeParser::flushDirect):
2784         (JSC::DFG::ByteCodeParser::getToInt32):
2785         (JSC::DFG::ByteCodeParser::toInt32):
2786         (JSC::DFG::ByteCodeParser::getJSConstantForValue):
2787         (JSC::DFG::ByteCodeParser::getJSConstant):
2788         (JSC::DFG::ByteCodeParser::getCallee):
2789         (JSC::DFG::ByteCodeParser::getThis):
2790         (JSC::DFG::ByteCodeParser::setThis):
2791         (JSC::DFG::ByteCodeParser::isJSConstant):
2792         (JSC::DFG::ByteCodeParser::isInt32Constant):
2793         (JSC::DFG::ByteCodeParser::valueOfJSConstant):
2794         (JSC::DFG::ByteCodeParser::valueOfInt32Constant):
2795         (JSC::DFG::ByteCodeParser::constantUndefined):
2796         (JSC::DFG::ByteCodeParser::constantNull):
2797         (JSC::DFG::ByteCodeParser::one):
2798         (JSC::DFG::ByteCodeParser::constantNaN):
2799         (JSC::DFG::ByteCodeParser::cellConstant):
2800         (JSC::DFG::ByteCodeParser::addToGraph):
2801         (JSC::DFG::ByteCodeParser::insertPhiNode):
2802         (JSC::DFG::ByteCodeParser::addVarArgChild):
2803         (JSC::DFG::ByteCodeParser::addCall):
2804         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
2805         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
2806         (JSC::DFG::ByteCodeParser::getPrediction):
2807         (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
2808         (JSC::DFG::ByteCodeParser::makeSafe):
2809         (JSC::DFG::ByteCodeParser::makeDivSafe):
2810         (JSC::DFG::ByteCodeParser::ConstantRecord::ConstantRecord):
2811         (ConstantRecord):
2812         (JSC::DFG::ByteCodeParser::PhiStackEntry::PhiStackEntry):
2813         (PhiStackEntry):
2814         (JSC::DFG::ByteCodeParser::handleCall):
2815         (JSC::DFG::ByteCodeParser::emitFunctionChecks):
2816         (JSC::DFG::ByteCodeParser::handleInlining):
2817         (JSC::DFG::ByteCodeParser::setIntrinsicResult):
2818         (JSC::DFG::ByteCodeParser::handleMinMax):
2819         (JSC::DFG::ByteCodeParser::handleIntrinsic):
2820         (JSC::DFG::ByteCodeParser::handleGetByOffset):
2821         (JSC::DFG::ByteCodeParser::handleGetById):
2822         (JSC::DFG::ByteCodeParser::getScope):
2823         (JSC::DFG::ByteCodeParser::parseResolveOperations):
2824         (JSC::DFG::ByteCodeParser::parseBlock):
2825         (JSC::DFG::ByteCodeParser::processPhiStack):
2826         (JSC::DFG::ByteCodeParser::linkBlock):
2827         (JSC::DFG::ByteCodeParser::parseCodeBlock):
2828         (JSC::DFG::ByteCodeParser::parse):
2829         * dfg/DFGCFAPhase.cpp:
2830         (JSC::DFG::CFAPhase::performBlockCFA):
2831         * dfg/DFGCFGSimplificationPhase.cpp:
2832         (JSC::DFG::CFGSimplificationPhase::run):
2833         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
2834         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
2835         (JSC::DFG::CFGSimplificationPhase::fixPhis):
2836         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
2837         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
2838         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::dump):
2839         (OperandSubstitution):
2840         (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
2841         (JSC::DFG::CFGSimplificationPhase::recordNewTarget):
2842         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
2843         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
2844         * dfg/DFGCSEPhase.cpp:
2845         (JSC::DFG::CSEPhase::canonicalize):
2846         (JSC::DFG::CSEPhase::endIndexForPureCSE):
2847         (JSC::DFG::CSEPhase::pureCSE):
2848         (JSC::DFG::CSEPhase::constantCSE):
2849         (JSC::DFG::CSEPhase::weakConstantCSE):
2850         (JSC::DFG::CSEPhase::getCalleeLoadElimination):
2851         (JSC::DFG::CSEPhase::getArrayLengthElimination):
2852         (JSC::DFG::CSEPhase::globalVarLoadElimination):
2853         (JSC::DFG::CSEPhase::scopedVarLoadElimination):
2854         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
2855         (JSC::DFG::CSEPhase::globalVarStoreElimination):
2856         (JSC::DFG::CSEPhase::scopedVarStoreElimination):
2857         (JSC::DFG::CSEPhase::getByValLoadElimination):
2858         (JSC::DFG::CSEPhase::checkFunctionElimination):
2859         (JSC::DFG::CSEPhase::checkExecutableElimination):
2860         (JSC::DFG::CSEPhase::checkStructureElimination):
2861         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
2862         (JSC::DFG::CSEPhase::putStructureStoreElimination):
2863         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
2864         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
2865         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
2866         (JSC::DFG::CSEPhase::checkArrayElimination):
2867         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
2868         (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
2869         (JSC::DFG::CSEPhase::getLocalLoadElimination):
2870         (JSC::DFG::CSEPhase::setLocalStoreElimination):
2871         (JSC::DFG::CSEPhase::performSubstitution):
2872         (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
2873         (JSC::DFG::CSEPhase::setReplacement):
2874         (JSC::DFG::CSEPhase::eliminate):
2875         (JSC::DFG::CSEPhase::performNodeCSE):
2876         (JSC::DFG::CSEPhase::performBlockCSE):
2877         (CSEPhase):
2878         * dfg/DFGCommon.cpp: Added.
2879         (DFG):
2880         (JSC::DFG::NodePointerTraits::dump):
2881         * dfg/DFGCommon.h:
2882         (DFG):
2883         (JSC::DFG::NodePointerTraits::defaultValue):
2884         (NodePointerTraits):
2885         (JSC::DFG::verboseCompilationEnabled):
2886         (JSC::DFG::shouldDumpGraphAtEachPhase):
2887         (JSC::DFG::validationEnabled):
2888         * dfg/DFGConstantFoldingPhase.cpp:
2889         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2890         (JSC::DFG::ConstantFoldingPhase::isCapturedAtOrAfter):
2891         (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
2892         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
2893         * dfg/DFGDisassembler.cpp:
2894         (JSC::DFG::Disassembler::Disassembler):
2895         (JSC::DFG::Disassembler::createDumpList):
2896         (JSC::DFG::Disassembler::dumpDisassembly):
2897         * dfg/DFGDisassembler.h:
2898         (JSC::DFG::Disassembler::setForNode):
2899         (Disassembler):
2900         * dfg/DFGDriver.cpp:
2901         (JSC::DFG::compile):
2902         * dfg/DFGEdge.cpp: Added.
2903         (DFG):
2904         (JSC::DFG::Edge::dump):
2905         * dfg/DFGEdge.h:
2906         (JSC::DFG::Edge::Edge):
2907         (JSC::DFG::Edge::node):
2908         (JSC::DFG::Edge::operator*):
2909         (JSC::DFG::Edge::operator->):
2910         (Edge):
2911         (JSC::DFG::Edge::setNode):
2912         (JSC::DFG::Edge::useKind):
2913         (JSC::DFG::Edge::setUseKind):
2914         (JSC::DFG::Edge::isSet):
2915         (JSC::DFG::Edge::shift):
2916         (JSC::DFG::Edge::makeWord):
2917         (JSC::DFG::operator==):
2918         (JSC::DFG::operator!=):
2919         * dfg/DFGFixupPhase.cpp:
2920         (JSC::DFG::FixupPhase::fixupBlock):
2921         (JSC::DFG::FixupPhase::fixupNode):
2922         (JSC::DFG::FixupPhase::checkArray):
2923         (JSC::DFG::FixupPhase::blessArrayOperation):
2924         (JSC::DFG::FixupPhase::fixIntEdge):
2925         (JSC::DFG::FixupPhase::fixDoubleEdge):
2926         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
2927         (FixupPhase):
2928         * dfg/DFGGenerationInfo.h:
2929         (JSC::DFG::GenerationInfo::GenerationInfo):
2930         (JSC::DFG::GenerationInfo::initConstant):
2931         (JSC::DFG::GenerationInfo::initInteger):
2932         (JSC::DFG::GenerationInfo::initJSValue):
2933         (JSC::DFG::GenerationInfo::initCell):
2934         (JSC::DFG::GenerationInfo::initBoolean):
2935         (JSC::DFG::GenerationInfo::initDouble):
2936         (JSC::DFG::GenerationInfo::initStorage):
2937         (GenerationInfo):
2938         (JSC::DFG::GenerationInfo::node):
2939         (JSC::DFG::GenerationInfo::noticeOSRBirth):
2940         (JSC::DFG::GenerationInfo::use):
2941         (JSC::DFG::GenerationInfo::appendFill):
2942         (JSC::DFG::GenerationInfo::appendSpill):
2943         * dfg/DFGGraph.cpp:
2944         (JSC::DFG::Graph::Graph):
2945         (JSC::DFG::Graph::~Graph):
2946         (DFG):
2947         (JSC::DFG::Graph::dumpCodeOrigin):
2948         (JSC::DFG::Graph::amountOfNodeWhiteSpace):
2949         (JSC::DFG::Graph::printNodeWhiteSpace):
2950         (JSC::DFG::Graph::dump):
2951         (JSC::DFG::Graph::dumpBlockHeader):
2952         (JSC::DFG::Graph::refChildren):
2953         (JSC::DFG::Graph::derefChildren):
2954         (JSC::DFG::Graph::predictArgumentTypes):
2955         (JSC::DFG::Graph::collectGarbage):
2956         (JSC::DFG::Graph::determineReachability):
2957         (JSC::DFG::Graph::resetExitStates):
2958         * dfg/DFGGraph.h:
2959         (Graph):
2960         (JSC::DFG::Graph::ref):
2961         (JSC::DFG::Graph::deref):
2962         (JSC::DFG::Graph::changeChild):
2963         (JSC::DFG::Graph::compareAndSwap):
2964         (JSC::DFG::Graph::clearAndDerefChild):
2965         (JSC::DFG::Graph::clearAndDerefChild1):
2966         (JSC::DFG::Graph::clearAndDerefChild2):
2967         (JSC::DFG::Graph::clearAndDerefChild3):
2968         (JSC::DFG::Graph::convertToConstant):
2969         (JSC::DFG::Graph::getJSConstantSpeculation):
2970         (JSC::DFG::Graph::addSpeculationMode):
2971         (JSC::DFG::Graph::valueAddSpeculationMode):
2972         (JSC::DFG::Graph::arithAddSpeculationMode):
2973         (JSC::DFG::Graph::addShouldSpeculateInteger):
2974         (JSC::DFG::Graph::mulShouldSpeculateInteger):
2975         (JSC::DFG::Graph::negateShouldSpeculateInteger):
2976         (JSC::DFG::Graph::isConstant):
2977         (JSC::DFG::Graph::isJSConstant):
2978         (JSC::DFG::Graph::isInt32Constant):
2979         (JSC::DFG::Graph::isDoubleConstant):
2980         (JSC::DFG::Graph::isNumberConstant):
2981         (JSC::DFG::Graph::isBooleanConstant):
2982         (JSC::DFG::Graph::isCellConstant):
2983         (JSC::DFG::Graph::isFunctionConstant):
2984         (JSC::DFG::Graph::isInternalFunctionConstant):
2985         (JSC::DFG::Graph::valueOfJSConstant):
2986         (JSC::DFG::Graph::valueOfInt32Constant):
2987         (JSC::DFG::Graph::valueOfNumberConstant):
2988         (JSC::DFG::Graph::valueOfBooleanConstant):
2989         (JSC::DFG::Graph::valueOfFunctionConstant):
2990         (JSC::DFG::Graph::valueProfileFor):
2991         (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
2992         (JSC::DFG::Graph::numSuccessors):
2993         (JSC::DFG::Graph::successor):
2994         (JSC::DFG::Graph::successorForCondition):
2995         (JSC::DFG::Graph::isPredictedNumerical):
2996         (JSC::DFG::Graph::byValIsPure):
2997         (JSC::DFG::Graph::clobbersWorld):
2998         (JSC::DFG::Graph::varArgNumChildren):
2999         (JSC::DFG::Graph::numChildren):
3000         (JSC::DFG::Graph::varArgChild):
3001         (JSC::DFG::Graph::child):
3002         (JSC::DFG::Graph::voteNode):
3003         (JSC::DFG::Graph::voteChildren):
3004         (JSC::DFG::Graph::substitute):
3005         (JSC::DFG::Graph::substituteGetLocal):
3006         (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
3007         (JSC::DFG::Graph::mulImmediateShouldSpeculateInteger):
3008         * dfg/DFGInsertionSet.h:
3009         (JSC::DFG::Insertion::Insertion):
3010         (JSC::DFG::Insertion::element):
3011         (Insertion):
3012         (JSC::DFG::InsertionSet::insert):
3013         (InsertionSet):
3014         * dfg/DFGJITCompiler.cpp:
3015         * dfg/DFGJITCompiler.h:
3016         (JSC::DFG::JITCompiler::setForNode):
3017         (JSC::DFG::JITCompiler::addressOfDoubleConstant):
3018         (JSC::DFG::JITCompiler::noticeOSREntry):
3019         * dfg/DFGLongLivedState.cpp: Added.
3020         (DFG):
3021         (JSC::DFG::LongLivedState::LongLivedState):
3022         (JSC::DFG::LongLivedState::~LongLivedState):
3023         (JSC::DFG::LongLivedState::shrinkToFit):
3024         * dfg/DFGLongLivedState.h: Added.
3025         (DFG):
3026         (LongLivedState):
3027         * dfg/DFGMinifiedID.h:
3028         (JSC::DFG::MinifiedID::MinifiedID):
3029         (JSC::DFG::MinifiedID::node):
3030         * dfg/DFGMinifiedNode.cpp:
3031         (JSC::DFG::MinifiedNode::fromNode):
3032         * dfg/DFGMinifiedNode.h:
3033         (MinifiedNode):
3034         * dfg/DFGNode.cpp: Added.
3035         (DFG):
3036         (JSC::DFG::Node::index):
3037         (WTF):
3038         (WTF::printInternal):
3039         * dfg/DFGNode.h:
3040         (DFG):
3041         (JSC::DFG::Node::Node):
3042         (Node):
3043         (JSC::DFG::Node::convertToGetByOffset):
3044         (JSC::DFG::Node::convertToPutByOffset):
3045         (JSC::DFG::Node::ref):
3046         (JSC::DFG::Node::shouldSpeculateInteger):
3047         (JSC::DFG::Node::shouldSpeculateIntegerForArithmetic):
3048         (JSC::DFG::Node::shouldSpeculateIntegerExpectingDefined):
3049         (JSC::DFG::Node::shouldSpeculateDoubleForArithmetic):
3050         (JSC::DFG::Node::shouldSpeculateNumber):
3051         (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
3052         (JSC::DFG::Node::shouldSpeculateFinalObject):
3053         (JSC::DFG::Node::shouldSpeculateArray):
3054         (JSC::DFG::Node::dumpChildren):
3055         (WTF):
3056         * dfg/DFGNodeAllocator.h: Added.
3057         (DFG):
3058         (operator new ):
3059         * dfg/DFGOSRExit.cpp:
3060         (JSC::DFG::OSRExit::OSRExit):
3061         * dfg/DFGOSRExit.h:
3062         (OSRExit):
3063         (SpeculationFailureDebugInfo):
3064         * dfg/DFGOSRExitCompiler.cpp:
3065         * dfg/DFGOSRExitCompiler32_64.cpp:
3066         (JSC::DFG::OSRExitCompiler::compileExit):
3067         * dfg/DFGOSRExitCompiler64.cpp:
3068         (JSC::DFG::OSRExitCompiler::compileExit):
3069         * dfg/DFGOperations.cpp:
3070         * dfg/DFGPhase.cpp:
3071         (DFG):
3072         (JSC::DFG::Phase::beginPhase):
3073         (JSC::DFG::Phase::endPhase):
3074         * dfg/DFGPhase.h:
3075         (Phase):
3076         (JSC::DFG::runAndLog):
3077         * dfg/DFGPredictionPropagationPhase.cpp:
3078         (JSC::DFG::PredictionPropagationPhase::setPrediction):
3079         (JSC::DFG::PredictionPropagationPhase::mergePrediction):
3080         (JSC::DFG::PredictionPropagationPhase::isNotNegZero):
3081         (JSC::DFG::PredictionPropagationPhase::isNotZero):
3082         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoForConstant):
3083         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoNonRecursive):
3084         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwo):
3085         (JSC::DFG::PredictionPropagationPhase::propagate):
3086         (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags):
3087         (JSC::DFG::PredictionPropagationPhase::propagateForward):
3088         (JSC::DFG::PredictionPropagationPhase::propagateBackward):
3089         (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
3090         (PredictionPropagationPhase):
3091         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
3092         * dfg/DFGScoreBoard.h:
3093         (JSC::DFG::ScoreBoard::ScoreBoard):
3094         (JSC::DFG::ScoreBoard::use):
3095         (JSC::DFG::ScoreBoard::useIfHasResult):
3096         (ScoreBoard):
3097         * dfg/DFGSilentRegisterSavePlan.h:
3098         (JSC::DFG::SilentRegisterSavePlan::SilentRegisterSavePlan):
3099         (JSC::DFG::SilentRegisterSavePlan::node):
3100         (SilentRegisterSavePlan):
3101         * dfg/DFGSlowPathGenerator.h:
3102         (JSC::DFG::SlowPathGenerator::SlowPathGenerator):
3103         (JSC::DFG::SlowPathGenerator::generate):
3104         (SlowPathGenerator):
3105         * dfg/DFGSpeculativeJIT.cpp:
3106         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
3107         (JSC::DFG::SpeculativeJIT::speculationCheck):
3108         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
3109         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
3110         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
3111         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
3112         (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
3113         (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
3114         (JSC::DFG::SpeculativeJIT::silentSpill):
3115         (JSC::DFG::SpeculativeJIT::silentFill):
3116         (JSC::DFG::SpeculativeJIT::checkArray):
3117         (JSC::DFG::SpeculativeJIT::arrayify):
3118         (JSC::DFG::SpeculativeJIT::fillStorage):
3119         (JSC::DFG::SpeculativeJIT::useChildren):
3120         (JSC::DFG::SpeculativeJIT::isStrictInt32):
3121         (JSC::DFG::SpeculativeJIT::isKnownInteger):
3122         (JSC::DFG::SpeculativeJIT::isKnownNumeric):
3123         (JSC::DFG::SpeculativeJIT::isKnownCell):
3124         (JSC::DFG::SpeculativeJIT::isKnownNotCell):
3125         (JSC::DFG::SpeculativeJIT::isKnownNotInteger):
3126         (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
3127         (JSC::DFG::SpeculativeJIT::writeBarrier):
3128         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
3129         (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
3130         (JSC::DFG::GPRTemporary::GPRTemporary):
3131         (JSC::DFG::FPRTemporary::FPRTemporary):
3132         (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
3133         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
3134         (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
3135         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
3136         (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
3137         (JSC::DFG::SpeculativeJIT::compileMovHint):
3138         (JSC::DFG::SpeculativeJIT::compile):
3139         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
3140         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
3141         (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
3142         (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
3143         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
3144         (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
3145         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
3146         (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
3147         (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
3148         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
3149         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
3150         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
3151         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
3152         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
3153         (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
3154         (JSC::DFG::SpeculativeJIT::compileInstanceOf):
3155         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
3156         (JSC::DFG::SpeculativeJIT::compileAdd):
3157         (JSC::DFG::SpeculativeJIT::compileArithSub):
3158         (JSC::DFG::SpeculativeJIT::compileArithNegate):
3159         (JSC::DFG::SpeculativeJIT::compileArithMul):
3160         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
3161         (JSC::DFG::SpeculativeJIT::compileArithMod):
3162         (JSC::DFG::SpeculativeJIT::compare):
3163         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
3164         (JSC::DFG::SpeculativeJIT::compileStrictEq):
3165         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
3166         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
3167         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
3168         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
3169         (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
3170         (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
3171         (JSC::DFG::SpeculativeJIT::compileRegExpExec):
3172         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
3173         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
3174         * dfg/DFGSpeculativeJIT.h:
3175         (SpeculativeJIT):
3176         (JSC::DFG::SpeculativeJIT::canReuse):
3177         (JSC::DFG::SpeculativeJIT::isFilled):
3178         (JSC::DFG::SpeculativeJIT::isFilledDouble):
3179         (JSC::DFG::SpeculativeJIT::use):
3180         (JSC::DFG::SpeculativeJIT::isConstant):
3181         (JSC::DFG::SpeculativeJIT::isJSConstant):
3182         (JSC::DFG::SpeculativeJIT::isInt32Constant):
3183         (JSC::DFG::SpeculativeJIT::isDoubleConstant):
3184         (JSC::DFG::SpeculativeJIT::isNumberConstant):
3185         (JSC::DFG::SpeculativeJIT::isBooleanConstant):
3186         (JSC::DFG::SpeculativeJIT::isFunctionConstant):
3187         (JSC::DFG::SpeculativeJIT::valueOfInt32Constant):
3188         (JSC::DFG::SpeculativeJIT::valueOfNumberConstant):
3189         (JSC::DFG::SpeculativeJIT::valueOfNumberConstantAsInt32):
3190         (JSC::DFG::SpeculativeJIT::addressOfDoubleConstant):
3191         (JSC::DFG::SpeculativeJIT::valueOfJSConstant):
3192         (JSC::DFG::SpeculativeJIT::valueOfBooleanConstant):
3193         (JSC::DFG::SpeculativeJIT::valueOfFunctionConstant):
3194         (JSC::DFG::SpeculativeJIT::isNullConstant):
3195         (JSC::DFG::SpeculativeJIT::valueOfJSConstantAsImm64):
3196         (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
3197         (JSC::DFG::SpeculativeJIT::integerResult):
3198         (JSC::DFG::SpeculativeJIT::noResult):
3199         (JSC::DFG::SpeculativeJIT::cellResult):
3200         (JSC::DFG::SpeculativeJIT::booleanResult):
3201         (JSC::DFG::SpeculativeJIT::jsValueResult):
3202         (JSC::DFG::SpeculativeJIT::storageResult):
3203         (JSC::DFG::SpeculativeJIT::doubleResult):
3204         (JSC::DFG::SpeculativeJIT::initConstantInfo):
3205         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
3206         (JSC::DFG::SpeculativeJIT::isInteger):
3207         (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
3208         (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
3209         (JSC::DFG::SpeculativeJIT::setNodeForOperand):
3210         (JSC::DFG::IntegerOperand::IntegerOperand):
3211         (JSC::DFG::IntegerOperand::node):
3212         (JSC::DFG::IntegerOperand::gpr):
3213         (JSC::DFG::IntegerOperand::use):
3214         (IntegerOperand):
3215         (JSC::DFG::DoubleOperand::DoubleOperand):
3216         (JSC::DFG::DoubleOperand::node):
3217         (JSC::DFG::DoubleOperand::fpr):
3218         (JSC::DFG::DoubleOperand::use):
3219         (DoubleOperand):
3220         (JSC::DFG::JSValueOperand::JSValueOperand):
3221         (JSC::DFG::JSValueOperand::node):
3222         (JSC::DFG::JSValueOperand::gpr):
3223         (JSC::DFG::JSValueOperand::fill):
3224         (JSC::DFG::JSValueOperand::use):
3225         (JSValueOperand):
3226         (JSC::DFG::StorageOperand::StorageOperand):
3227         (JSC::DFG::StorageOperand::node):
3228         (JSC::DFG::StorageOperand::gpr):
3229         (JSC::DFG::StorageOperand::use):
3230         (StorageOperand):
3231         (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
3232         (JSC::DFG::SpeculateIntegerOperand::node):
3233         (JSC::DFG::SpeculateIntegerOperand::gpr):
3234         (JSC::DFG::SpeculateIntegerOperand::use):
3235         (SpeculateIntegerOperand):
3236         (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
3237         (JSC::DFG::SpeculateStrictInt32Operand::node):
3238         (JSC::DFG::SpeculateStrictInt32Operand::gpr):
3239         (JSC::DFG::SpeculateStrictInt32Operand::use):
3240         (SpeculateStrictInt32Operand):
3241         (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
3242         (JSC::DFG::SpeculateDoubleOperand::node):
3243         (JSC::DFG::SpeculateDoubleOperand::fpr):
3244         (JSC::DFG::SpeculateDoubleOperand::use):
3245         (SpeculateDoubleOperand):
3246         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
3247         (JSC::DFG::SpeculateCellOperand::node):
3248         (JSC::DFG::SpeculateCellOperand::gpr):
3249         (JSC::DFG::SpeculateCellOperand::use):
3250         (SpeculateCellOperand):
3251         (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
3252         (JSC::DFG::SpeculateBooleanOperand::node):
3253         (JSC::DFG::SpeculateBooleanOperand::gpr):
3254         (JSC::DFG::SpeculateBooleanOperand::use):
3255         (SpeculateBooleanOperand):
3256         * dfg/DFGSpeculativeJIT32_64.cpp:
3257         (JSC::DFG::SpeculativeJIT::fillInteger):
3258         (JSC::DFG::SpeculativeJIT::fillDouble):
3259         (JSC::DFG::SpeculativeJIT::fillJSValue):
3260         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
3261         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
3262         (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
3263         (JSC::DFG::SpeculativeJIT::cachedPutById):
3264         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
3265         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
3266         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
3267         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
3268         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
3269         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
3270         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
3271         (JSC::DFG::SpeculativeJIT::emitCall):
3272         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
3273         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
3274         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
3275         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
3276         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
3277         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
3278         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
3279         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
3280         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
3281         (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
3282         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
3283         (JSC::DFG::SpeculativeJIT::compileValueAdd):
3284         (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
3285         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
3286         (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
3287         (JSC::DFG::SpeculativeJIT::emitBranch):
3288         (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
3289         (JSC::DFG::SpeculativeJIT::compile):
3290         * dfg/DFGSpeculativeJIT64.cpp:
3291         (JSC::DFG::SpeculativeJIT::fillInteger):
3292         (JSC::DFG::SpeculativeJIT::fillDouble):
3293         (JSC::DFG::SpeculativeJIT::fillJSValue):
3294         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
3295         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
3296         (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
3297         (JSC::DFG::SpeculativeJIT::cachedPutById):
3298         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
3299         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
3300         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
3301         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
3302         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
3303         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
3304         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
3305         (JSC::DFG::SpeculativeJIT::emitCall):
3306         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
3307         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
3308         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
3309         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
3310         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
3311         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
3312         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
3313         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
3314         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
3315         (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
3316         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
3317         (JSC::DFG::SpeculativeJIT::compileValueAdd):
3318         (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
3319         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
3320         (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
3321         (JSC::DFG::SpeculativeJIT::emitBranch):
3322         (JSC::DFG::SpeculativeJIT::compile):
3323         * dfg/DFGStructureAbstractValue.h:
3324         (StructureAbstractValue):
3325         * dfg/DFGStructureCheckHoistingPhase.cpp:
3326         (JSC::DFG::StructureCheckHoistingPhase::run):
3327         * dfg/DFGValidate.cpp:
3328         (DFG):
3329         (Validate):
3330         (JSC::DFG::Validate::validate):
3331         (JSC::DFG::Validate::reportValidationContext):
3332         * dfg/DFGValidate.h:
3333         * dfg/DFGValueSource.cpp:
3334         (JSC::DFG::ValueSource::dump):
3335         * dfg/DFGValueSource.h:
3336         (JSC::DFG::ValueSource::ValueSource):
3337         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
3338         (JSC::DFG::VirtualRegisterAllocationPhase::run):
3339         * runtime/FunctionExecutableDump.cpp: Added.
3340         (JSC):
3341         (JSC::FunctionExecutableDump::dump):
3342         * runtime/FunctionExecutableDump.h: Added.
3343         (JSC):
3344         (FunctionExecutableDump):
3345         (JSC::FunctionExecutableDump::FunctionExecutableDump):
3346         * runtime/JSGlobalData.cpp:
3347         (JSC::JSGlobalData::JSGlobalData):
3348         * runtime/JSGlobalData.h:
3349         (JSC):
3350         (DFG):
3351         (JSGlobalData):
3352         * runtime/Options.h:
3353         (JSC):
3354
3355 2013-01-28  Laszlo Gombos  <l.gombos@samsung.com>
3356
3357         Collapse testing for a list of PLATFORM() into OS() and USE() tests
3358         https://bugs.webkit.org/show_bug.cgi?id=108018
3359
3360         Reviewed by Eric Seidel.
3361
3362         No functional change as "OS(DARWIN) && USE(CF)" equals to the
3363         following platforms: MAC, WX, QT and CHROMIUM. CHROMIUM
3364         is not using JavaScriptCore.
3365
3366         * runtime/DatePrototype.cpp:
3367         (JSC):
3368
3369 2013-01-28  Geoffrey Garen  <ggaren@apple.com>
3370
3371         Static size inference for JavaScript objects
3372         https://bugs.webkit.org/show_bug.cgi?id=108093
3373
3374         Reviewed by Phil Pizlo.
3375
3376         * API/JSObjectRef.cpp:
3377         * JavaScriptCore.order:
3378         * JavaScriptCore.xcodeproj/project.pbxproj: Pay the tax man.
3379
3380         * bytecode/CodeBlock.cpp:
3381         (JSC::CodeBlock::dumpBytecode): op_new_object and op_create_this now
3382         have an extra inferredInlineCapacity argument. This is the statically
3383         inferred inline capacity, just from analyzing source text. op_new_object
3384         also gets a pointer to an allocation profile. (For op_create_this, the
3385         profile is in the construtor function.)
3386
3387         (JSC::CodeBlock::CodeBlock): Link op_new_object.
3388
3389         (JSC::CodeBlock::stronglyVisitStrongReferences): Mark our profiles.
3390
3391         * bytecode/CodeBlock.h:
3392         (CodeBlock): Removed some dead code. Added object allocation profiles.
3393
3394         * bytecode/Instruction.h:
3395         (JSC): New union type, since an instruction operand may point to an
3396         object allocation profile now.
3397
3398         * bytecode/ObjectAllocationProfile.h: Added.
3399         (JSC):
3400         (ObjectAllocationProfile):
3401         (JSC::ObjectAllocationProfile::offsetOfAllocator):
3402         (JSC::ObjectAllocationProfile::offsetOfStructure):
3403         (JSC::ObjectAllocationProfile::ObjectAllocationProfile):
3404         (JSC::ObjectAllocationProfile::isNull):
3405         (JSC::ObjectAllocationProfile::initialize):
3406         (JSC::ObjectAllocationProfile::structure):
3407         (JSC::ObjectAllocationProfile::inlineCapacity):
3408         (JSC::ObjectAllocationProfile::clear):
3409         (JSC::ObjectAllocationProfile::visitAggregate):
3410         (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount): New class
3411         for tracking a prediction about object allocation: structure, inline
3412         capacity, allocator to use.
3413
3414         * bytecode/Opcode.h:
3415         (JSC):
3416         (JSC::padOpcodeName): Updated instruction sizes.
3417
3418         * bytecode/UnlinkedCodeBlock.cpp:
3419         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
3420         * bytecode/UnlinkedCodeBlock.h:
3421         (JSC):
3422         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile):
3423         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles):
3424         (UnlinkedCodeBlock): Unlinked support for allocation profiles.
3425
3426         * bytecompiler/BytecodeGenerator.cpp:
3427         (JSC::BytecodeGenerator::generate): Kill all remaining analyses at the
3428         end of codegen, since this is our last opportunity.
3429
3430         (JSC::BytecodeGenerator::BytecodeGenerator): Added a static property
3431         analyzer to bytecode generation. It tracks initializing assignments and
3432         makes a guess about how many will happen.
3433
3434         (JSC::BytecodeGenerator::newObjectAllocationProfile):
3435         (JSC):
3436         (JSC::BytecodeGenerator::emitProfiledOpcode):
3437         (JSC::BytecodeGenerator::emitMove):
3438         (JSC::BytecodeGenerator::emitResolve):
3439         (JSC::BytecodeGenerator::emitResolveBase):
3440         (JSC::BytecodeGenerator::emitResolveBaseForPut):
3441         (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
3442         (JSC::BytecodeGenerator::emitResolveWithThis):
3443         (JSC::BytecodeGenerator::emitGetById):
3444         (JSC::BytecodeGenerator::emitPutById):
3445         (JSC::BytecodeGenerator::emitDirectPutById):
3446         (JSC::BytecodeGenerator::emitPutGetterSetter):
3447         (JSC::BytecodeGenerator::emitGetArgumentByVal):
3448         (JSC::BytecodeGenerator::emitGetByVal): Added hooks to the static property
3449         analyzer, so it can observe allocations and stores.
3450
3451         (JSC::BytecodeGenerator::emitCreateThis): Factored this into a helper
3452         function because it was a significant amount of logic, and I wanted to
3453         add to it.
3454
3455         (JSC::BytecodeGenerator::emitNewObject):
3456         (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
3457         (JSC::BytecodeGenerator::emitCall):
3458         (JSC::BytecodeGenerator::emitCallVarargs):
3459         (JSC::BytecodeGenerator::emitConstruct): Added a hook to profiled opcodes
3460         to track their stores, in case a store kills a profiled allocation. Since
3461         profiled opcodes are basically the only interesting stores we do, this
3462         is a convenient place to notice any store that might kill an allocation.
3463
3464         * bytecompiler/BytecodeGenerator.h:
3465         (BytecodeGenerator): As above.
3466
3467         * bytecompiler/StaticPropertyAnalysis.h: Added.
3468         (JSC):
3469         (StaticPropertyAnalysis):
3470         (JSC::StaticPropertyAnalysis::create):
3471         (JSC::StaticPropertyAnalysis::addPropertyIndex):
3472         (JSC::StaticPropertyAnalysis::record):
3473         (JSC::StaticPropertyAnalysis::propertyIndexCount):
3474         (JSC::StaticPropertyAnalysis::StaticPropertyAnalysis): Simple helper
3475         class for tracking allocations and stores.
3476
3477         * bytecompiler/StaticPropertyAnalyzer.h: Added.
3478         (StaticPropertyAnalyzer):
3479         (JSC::StaticPropertyAnalyzer::StaticPropertyAnalyzer):
3480         (JSC::StaticPropertyAnalyzer::createThis):
3481         (JSC::StaticPropertyAnalyzer::newObject):
3482         (JSC::StaticPropertyAnalyzer::putById):
3483         (JSC::StaticPropertyAnalyzer::mov):
3484         (JSC::StaticPropertyAnalyzer::kill): Helper class for observing allocations
3485         and stores and making an inline capacity guess. The heuristics here are
3486         intentionally minimal because we don't want this one class to try to
3487         re-create something like a DFG or a runtime analysis. If we discover that
3488         we need those kinds of analyses, we should just replace this class with
3489         something else.
3490
3491         This class tracks multiple registers that alias the same object -- that
3492         happens a lot, when moving locals into temporary registers -- but it
3493         doesn't track control flow or multiple objects that alias the same register.
3494
3495         * dfg/DFGAbstractState.cpp:
3496         (JSC::DFG::AbstractState::execute): Updated for rename.
3497
3498         * dfg/DFGByteCodeParser.cpp:
3499         (JSC::DFG::ByteCodeParser::parseBlock): Updated for inline capacity and
3500         allocation profile.
3501
3502         * dfg/DFGNode.h:
3503         (JSC::DFG::Node::hasInlineCapacity):
3504         (Node):
3505         (JSC::DFG::Node::inlineCapacity):
3506         (JSC::DFG::Node::hasFunction): Give the graph a good way to represent
3507         inline capacity for an allocation.
3508
3509         * dfg/DFGNodeType.h:
3510         (DFG): Updated for rename.
3511
3512         * dfg/DFGOperations.cpp: Updated for interface change.
3513
3514         * dfg/DFGOperations.h: We pass the inline capacity to the slow case as
3515         an argument. This is the simplest way, since it's stored as a bytecode operand.
3516
3517         * dfg/DFGPredictionPropagationPhase.cpp:
3518         (JSC::DFG::PredictionPropagationPhase::propagate): Updated for rename.
3519
3520         * dfg/DFGRepatch.cpp:
3521         (JSC::DFG::tryCacheGetByID): Fixed a horrible off-by-one-half bug that only
3522         appears when doing an inline cached load for property number 64 on a 32-bit
3523         system. In JSVALUE32_64 land, "offsetRelativeToPatchedStorage" is the
3524         offset of the 64bit JSValue -- but we'll actually issue two loads, one for
3525         the payload at that offset, and one for the tag at that offset + 4. We need
3526         to ensure that both loads have a compact representation, or we'll corrupt
3527         the instruction stream.
3528
3529         * dfg/DFGSpeculativeJIT.cpp:
3530         (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
3531         * dfg/DFGSpeculativeJIT.h:
3532         (JSC::DFG::SpeculativeJIT::callOperation):
3533         (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
3534         (SpeculativeJIT):
3535         (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
3536         * dfg/DFGSpeculativeJIT32_64.cpp:
3537         (JSC::DFG::SpeculativeJIT::compile):
3538         * dfg/DFGSpeculativeJIT64.cpp:
3539         (JSC::DFG::SpeculativeJIT::compile): Lots of refactoring to support
3540         passing an allocator to our allocation function, and/or passing a Structure
3541         as a register instead of an immediate.
3542
3543         * heap/MarkedAllocator.h:
3544         (DFG):
3545         (MarkedAllocator):
3546         (JSC::MarkedAllocator::offsetOfFreeListHead): Added an accessor to simplify
3547         JIT code generation of allocation from an arbitrary allocator.
3548
3549         * jit/JIT.h:
3550         (JSC):
3551         * jit/JITInlines.h:
3552         (JSC):
3553         (JSC::JIT::emitAllocateJSObject):
3554         * jit/JITOpcodes.cpp:
3555         (JSC::JIT::emit_op_new_object):
3556         (JSC::JIT::emitSlow_op_new_object):
3557         (JSC::JIT::emit_op_create_this):
3558         (JSC::JIT::emitSlow_op_create_this):
3559         * jit/JITOpcodes32_64.cpp:
3560         (JSC::JIT::emit_op_new_object):
3561         (JSC::JIT::emitSlow_op_new_object):
3562         (JSC::JIT::emit_op_create_this):
3563         (JSC::JIT::emitSlow_op_create_this): Same refactoring as done for the DFG.
3564
3565         * jit/JITStubs.cpp:
3566         (JSC::tryCacheGetByID): Fixed the same bug mentioned above.
3567
3568         (JSC::DEFINE_STUB_FUNCTION): Updated for interface changes.
3569
3570         * llint/LLIntData.cpp:
3571         (JSC::LLInt::Data::performAssertions): Updated for interface changes.
3572
3573         * llint/LLIntSlowPaths.cpp:
3574         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3575         * llint/LowLevelInterpreter.asm:
3576         * llint/LowLevelInterpreter32_64.asm:
3577         * llint/LowLevelInterpreter64.asm: Same refactoring as for the JITs.
3578
3579         * profiler/ProfilerBytecode.cpp:
3580         * profiler/ProfilerBytecodes.cpp:
3581         * profiler/ProfilerCompilation.cpp:
3582         * profiler/ProfilerCompiledBytecode.cpp:
3583         * profiler/ProfilerDatabase.cpp:
3584         * profiler/ProfilerOSRExit.cpp:
3585         * profiler/ProfilerOrigin.cpp:
3586         * profiler/ProfilerProfiledBytecodes.cpp: Include ObjectConstructor.h
3587         because that's where createEmptyObject() lives now.
3588
3589         * runtime/Executable.h:
3590         (JSC::JSFunction::JSFunction): Updated for rename.
3591
3592         * runtime/JSCellInlines.h:
3593         (JSC::allocateCell): Updated to match the allocator selection code in
3594         the JIT, so it's clearer that both are correct.
3595
3596         * runtime/JSFunction.cpp:
3597         (JSC::JSFunction::JSFunction):
3598         (JSC::JSFunction::createAllocationProfile):
3599         (JSC::JSFunction::visitChildren):
3600         (JSC::JSFunction::getOwnPropertySlot):
3601         (JSC::JSFunction::put):
3602         (JSC::JSFunction::defineOwnProperty):
3603         (JSC::JSFunction::getConstructData):
3604         * runtime/JSFunction.h:
3605         (JSC::JSFunction::offsetOfScopeChain):
3606         (JSC::JSFunction::offsetOfExecutable):
3607         (JSC::JSFunction::offsetOfAllocationProfile):
3608         (JSC::JSFunction::allocationProfile):
3609         (JSFunction):
3610         (JSC::JSFunction::tryGetAllocationProfile):
3611         (JSC::JSFunction::addAllocationProfileWatchpoint): Changed inheritorID
3612         data member to be an ObjectAllocationProfile, which includes a pointer
3613         to the desired allocator. This simplifies JIT code, since we don't have
3614         to compute the allocator on the fly. I verified by code inspection that
3615         JSFunction is still only 64 bytes.
3616
3617         * runtime/JSGlobalObject.cpp:
3618         (JSC::JSGlobalObject::reset):
3619         (JSC::JSGlobalObject::visitChildren):
3620         * runtime/JSGlobalObject.h:
3621         (JSGlobalObject):
3622         (JSC::JSGlobalObject::dateStructure): No direct pointer to the empty
3623         object structure anymore, because now clients need to specify how much
3624         inline capacity they want.
3625
3626         * runtime/JSONObject.cpp:
3627         * runtime/JSObject.h:
3628         (JSC):
3629         (JSFinalObject):
3630         (JSC::JSFinalObject::defaultInlineCapacity):
3631         (JSC::JSFinalObject::maxInlineCapacity):
3632         (JSC::JSFinalObject::createStructure): A little refactoring to try to
3633         clarify where some of these constants derive from.
3634
3635         (JSC::maxOffsetRelativeToPatchedStorage): Used for bug fix, above.
3636
3637         * runtime/JSProxy.cpp:
3638         (JSC::JSProxy::setTarget): Ugly, but effective.
3639
3640         * runtime/LiteralParser.cpp:
3641         * runtime/ObjectConstructor.cpp:
3642         (JSC::constructObject):
3643         (JSC::constructWithObjectConstructor):
3644         (JSC::callObjectConstructor):
3645         (JSC::objectConstructorCreate): Updated for interface changes.
3646
3647         * runtime/ObjectConstructor.h:
3648         (JSC::constructEmptyObject): Clarified your options for how to allocate
3649         an empty object, to emphasize what things can actually vary.
3650
3651         * runtime/PropertyOffset.h: These constants have moved because they're
3652         really higher level concepts to do with the layout of objects and the
3653         collector. PropertyOffset is just an abstract number line, independent
3654         of those things.
3655
3656         * runtime/PrototypeMap.cpp:
3657         (JSC::PrototypeMap::emptyObjectStructureForPrototype):
3658         (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
3659         * runtime/PrototypeMap.h:
3660         (PrototypeMap): The map key is now a pair of prototype and inline capacity,
3661         since Structure encodes inline capacity.
3662
3663         * runtime/Structure.cpp:
3664         (JSC::Structure::Structure):
3665         (JSC::Structure::materializePropertyMap):
3666         (JSC::Structure::addPropertyTransition):
3667         (JSC::Structure::nonPropertyTransition):
3668         (JSC::Structure::copyPropertyTableForPinning):
3669         * runtime/Structure.h:
3670         (Structure):
3671         (JSC::Structure::totalStorageSize):
3672         (JSC::Structure::transitionCount):
3673         (JSC::Structure::create): Fixed a nasty refactoring bug that only shows
3674         up after enabling variable-sized inline capacities: we were passing our
3675         type info where our inline capacity was expected. The compiler didn't
3676         notice because both have type int :(.
3677
3678 2013-01-28  Oliver Hunt  <oliver@apple.com>
3679
3680         Add more assertions to the property storage use in arrays
3681         https://bugs.webkit.org/show_bug.cgi?id=107728
3682
3683         Reviewed by Filip Pizlo.
3684
3685         Add a bunch of assertions to array and object butterfly
3686         usage.  This should make debugging somewhat easier.
3687
3688         I also converted a couple of assertions to release asserts
3689         as they were so low cost it seemed a sensible thing to do.
3690
3691         * runtime/JSArray.cpp:
3692         (JSC::JSArray::sortVector):
3693         (JSC::JSArray::compactForSorting):
3694         * runtime/JSObject.h:
3695         (JSC::JSObject::getHolyIndexQuickly):
3696
3697 2013-01-28  Adam Barth  <abarth@webkit.org>
3698
3699         Remove webkitNotifications.createHTMLNotification
3700         https://bugs.webkit.org/show_bug.cgi?id=107598
3701
3702         Reviewed by Benjamin Poulain.
3703
3704         * Configurations/FeatureDefines.xcconfig:
3705
3706 2013-01-28  Michael Saboff  <msaboff@apple.com>
3707
3708         Cleanup ARM version of debugName() in DFGFPRInfo.h
3709         https://bugs.webkit.org/show_bug.cgi?id=108090
3710
3711         Reviewed by David Kilzer.
3712
3713         Fixed debugName() so it will compile by adding static_cast<int> and missing commas.
3714
3715         * dfg/DFGFPRInfo.h:
3716         (JSC::DFG::FPRInfo::debugName):
3717
3718 2013-01-27  Andreas Kling  <akling@apple.com>
3719
3720         JSC: FunctionParameters are memory hungry.
3721         <http://webkit.org/b/108033>
3722         <rdar://problem/13094803>
3723
3724         Reviewed by Sam Weinig.
3725
3726         Instead of inheriting from Vector<Identifier>, make FunctionParameters a simple fixed-size array
3727         with a custom-allocating create() function. Removes one step of indirection and cuts memory usage
3728         roughly in half.
3729
3730         2.73 MB progression on Membuster3.
3731
3732         * bytecode/UnlinkedCodeBlock.cpp:
3733         (JSC::UnlinkedFunctionExecutable::paramString):
3734         * bytecompiler/BytecodeGenerator.cpp:
3735         (JSC::BytecodeGenerator::BytecodeGenerator):
3736         * parser/Nodes.cpp:
3737         (JSC::FunctionParameters::create):
3738         (JSC::FunctionParameters::FunctionParameters):
3739         (JSC::FunctionParameters::~FunctionParameters):
3740         * parser/Nodes.h:
3741         (FunctionParameters):
3742         (JSC::FunctionParameters::size):
3743         (JSC::FunctionParameters::at):
3744         (JSC::FunctionParameters::identifiers):
3745
3746 2013-01-27  Andreas Kling  <akling@apple.com>
3747
3748         JSC: SourceProviderCache is memory hungry.
3749         <http://webkit.org/b/108029>
3750         <rdar://problem/13094806>
3751
3752         Reviewed by Sam Weinig.
3753
3754         Use fixed-size arrays for SourceProviderCacheItem's lists of captured variables.
3755         Since the lists never change after the object is created, there's no need to keep them in Vectors
3756         and we can instead create the whole cache item in a single allocation.
3757
3758         13.37 MB progression on Membuster3.
3759
3760         * parser/Parser.cpp:
3761         (JSC::::parseFunctionInfo):
3762         * parser/Parser.h:
3763         (JSC::Scope::copyCapturedVariablesToVector):
3764         (JSC::Scope::fillParametersForSourceProviderCache):
3765         (JSC::Scope::restoreFromSourceProviderCache):
3766         * parser/SourceProviderCacheItem.h:
3767         (SourceProviderCacheItemCreationParameters):
3768         (SourceProviderCacheItem):
3769         (JSC::SourceProviderCacheItem::approximateByteSize):
3770         (JSC::SourceProviderCacheItem::usedVariables):
3771         (JSC::SourceProviderCacheItem::writtenVariables):
3772         (JSC::SourceProviderCacheItem::~SourceProviderCacheItem):
3773         (JSC::SourceProviderCacheItem::create):
3774         (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
3775
3776 2013-01-27  Zoltan Arvai  <zarvai@inf.u-szeged.hu>
3777
3778         Fixing atomicIncrement implementation for Windows by dropping support before XP SP2.
3779         https://bugs.webkit.org/show_bug.cgi?id=106740
3780
3781         Reviewed by Benjamin Poulain.
3782
3783         * config.h:
3784
3785 2013-01-25  Filip Pizlo  <fpizlo@apple.com>
3786
3787         DFG variable event stream shouldn't use NodeIndex
3788         https://bugs.webkit.org/show_bug.cgi?id=107996
3789
3790         Reviewed by Oliver Hunt.
3791
3792         Introduce the notion of a DFG::MinifiedID, which is just a unique ID of a DFG Node.
3793         Internally it currently uses a NodeIndex, but we could change this without having
3794         to recode all of the users of MinifiedID. This effectively decouples the OSR exit
3795         compiler's way of identifying nodes from the speculative JIT's way of identifying
3796         nodes, and should make it easier to make changes to the speculative JIT's internals
3797         in the future.
3798
3799         Also changed variable event stream logging to exclude information about births and
3800         deaths of constants, since the OSR exit compiler never cares about which register
3801         holds a constant; if a value is constant then the OSR exit compiler can reify it.
3802
3803         Also changed the variable event stream's value recovery computation to use a
3804         HashMap keyed by MinifiedID rather than a Vector indexed by NodeIndex.
3805
3806         This appears to be performance-neutral. It's primarily meant as a small step
3807         towards https://bugs.webkit.org/show_bug.cgi?id=106868.
3808
3809         * GNUmakefile.list.am:
3810         * JavaScriptCore.xcodeproj/project.pbxproj:
3811         * dfg/DFGGenerationInfo.h:
3812         (JSC::DFG::GenerationInfo::GenerationInfo):
3813         (JSC::DFG::GenerationInfo::initConstant):
3814         (JSC::DFG::GenerationInfo::initInteger):
3815         (JSC::DFG::GenerationInfo::initJSValue):
3816         (JSC::DFG::GenerationInfo::initCell):
3817         (JSC::DFG::GenerationInfo::initBoolean):
3818         (JSC::DFG::GenerationInfo::initDouble):
3819         (JSC::DFG::GenerationInfo::initStorage):
3820         (JSC::DFG::GenerationInfo::noticeOSRBirth):
3821         (JSC::DFG::GenerationInfo::use):
3822         (JSC::DFG::GenerationInfo::appendFill):
3823         (JSC::DFG::GenerationInfo::appendSpill):
3824         (GenerationInfo):
3825         * dfg/DFGJITCompiler.cpp:
3826         (JSC::DFG::JITCompiler::link):
3827         * dfg/DFGMinifiedGraph.h:
3828         (JSC::DFG::MinifiedGraph::at):
3829         (MinifiedGraph):
3830         * dfg/DFGMinifiedID.h: Added.
3831         (DFG):
3832         (MinifiedID):
3833         (JSC::DFG::MinifiedID::MinifiedID):
3834         (JSC::DFG::MinifiedID::operator!):
3835         (JSC::DFG::MinifiedID::nodeIndex):
3836         (JSC::DFG::MinifiedID::operator==):
3837         (JSC::DFG::MinifiedID::operator!=):
3838         (JSC::DFG::MinifiedID::operator<):
3839         (JSC::DFG::MinifiedID::operator>):
3840         (JSC::DFG::MinifiedID::operator<=):
3841         (JSC::DFG::MinifiedID::operator>=):
3842         (JSC::DFG::MinifiedID::hash):
3843         (JSC::DFG::MinifiedID::dump):
3844         (JSC::DFG::MinifiedID::isHashTableDeletedValue):
3845         (JSC::DFG::MinifiedID::invalidID):
3846         (JSC::DFG::MinifiedID::otherInvalidID):
3847         (JSC::DFG::MinifiedID::fromBits):
3848         (JSC::DFG::MinifiedIDHash::hash):
3849         (JSC::DFG::MinifiedIDHash::equal):
3850         (MinifiedIDHash):
3851         (WTF):
3852         * dfg/DFGMinifiedNode.cpp:
3853         (JSC::DFG::MinifiedNode::fromNode):
3854         * dfg/DFGMinifiedNode.h:
3855         (JSC::DFG::MinifiedNode::id):
3856         (JSC::DFG::MinifiedNode::child1):
3857         (JSC::DFG::MinifiedNode::getID):
3858         (JSC::DFG::MinifiedNode::compareByNodeIndex):
3859         (MinifiedNode):
3860         * dfg/DFGSpeculativeJIT.cpp:
3861         (JSC::DFG::SpeculativeJIT::compileMovHint):
3862         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
3863         * dfg/DFGSpeculativeJIT.h:
3864         (JSC::DFG::SpeculativeJIT::setNodeIndexForOperand):
3865         * dfg/DFGValueSource.cpp:
3866         (JSC::DFG::ValueSource::dump):
3867         * dfg/DFGValueSource.h:
3868         (JSC::DFG::ValueSource::ValueSource):
3869         (JSC::DFG::ValueSource::isSet):
3870         (JSC::DFG::ValueSource::kind):
3871         (JSC::DFG::ValueSource::id):
3872         (ValueSource):
3873         (JSC::DFG::ValueSource::idFromKind):
3874         (JSC::DFG::ValueSource::kindFromID):
3875         * dfg/DFGVariableEvent.cpp:
3876         (JSC::DFG::VariableEvent::dump):
3877         (JSC::DFG::VariableEvent::dumpFillInfo):
3878         (JSC::DFG::VariableEvent::dumpSpillInfo):
3879         * dfg/DFGVariableEvent.h:
3880         (JSC::DFG::VariableEvent::fillGPR):
3881         (JSC::DFG::VariableEvent::fillPair):
3882         (JSC::DFG::VariableEvent::fillFPR):
3883         (JSC::DFG::VariableEvent::spill):
3884         (JSC::DFG::VariableEvent::death):
3885         (JSC::DFG::VariableEvent::movHint):
3886         (JSC::DFG::VariableEvent::id):
3887         (VariableEvent):
3888         * dfg/DFGVariableEventStream.cpp:
3889         (DFG):
3890         (JSC::DFG::VariableEventStream::tryToSetConstantRecovery):
3891         (JSC::DFG::VariableEventStream::reconstruct):
3892         * dfg/DFGVariableEventStream.h:
3893         (VariableEventStream):
3894
3895 2013-01-25  Roger Fong  <roger_fong@apple.com>
3896
3897         Unreviewed. Rename LLInt projects folder and make appropriate changes to solutions.
3898
3899         * JavaScriptCore.vcxproj/JavaScriptCore.sln:
3900         * JavaScriptCore.vcxproj/LLInt: Copied from JavaScriptCore.vcxproj/LLInt.vcproj.
3901         * JavaScriptCore.vcxproj/LLInt.vcproj: Removed.
3902         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly: Removed.
3903         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.make: Removed.
3904         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj: Removed.
3905         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj.user: Removed.
3906         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Removed.
3907         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets: Removed.
3908         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Removed.
3909         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj: Removed.
3910         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj.user: Removed.
3911         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Removed.
3912         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor: Removed.
3913         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj: Removed.
3914         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj.user: Removed.
3915         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props: Removed.
3916         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Removed.
3917         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props: Removed.
3918
3919 2013-01-24  Roger Fong  <roger_fong@apple.com>
3920
3921         VS2010 JavascriptCore: Clean up property sheets, add a JSC solution, add testRegExp and testAPI projects.
3922         https://bugs.webkit.org/show_bug.cgi?id=106987
3923
3924         Reviewed by Brent Fulgham.
3925
3926         * JavaScriptCore.vcxproj/JavaScriptCore.sln: Added.
3927         * JavaScriptCore.vcxproj/JavaScriptCoreCF.props:
3928         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
3929         * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
3930         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
3931         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
3932         * JavaScriptCore.vcxproj/jsc/jscDebug.props:
3933         * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
3934         * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
3935         * JavaScriptCore.vcxproj/testRegExp: Added.
3936         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj: Added.
3937         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters: Added.
3938         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.user: Added.
3939         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props: Added.
3940         * JavaScriptCore.vcxproj/testRegExp/testRegExpDebug.props: Added.
3941         * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd: Added.
3942         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreBuild.cmd: Added.
3943         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd: Added.
3944         * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props: Added.
3945         * JavaScriptCore.vcxproj/testapi: Added.
3946         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Added.
3947         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters: Added.
3948         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.user: Added.
3949         * JavaScriptCore.vcxproj/testapi/testapiCommon.props: Added.
3950         * JavaScriptCore.vcxproj/testapi/testapiDebug.props: Added.
3951         * JavaScriptCore.vcxproj/testapi/testapiPostBuild.cmd: Added.
3952         * JavaScriptCore.vcxproj/testapi/testapiPreBuild.cmd: Added.
3953         * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd: Added.
3954         * JavaScriptCore.vcxproj/testapi/testapiRelease.props: Added.
3955
3956 2013-01-24  Roger Fong  <roger_fong@apple.com>
3957
3958         Unreviewed. Windows build fix.
3959
3960         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3961
3962 2013-01-24&nb