Source/JavaScriptCore/ChangeLog

   1 2013-02-12  Joseph Pecoraro  <pecoraro@apple.com>
   2
   3         [iOS] Enable PAGE_VISIBILITY_API
   4         https://bugs.webkit.org/show_bug.cgi?id=109399
   5
   6         Reviewed by David Kilzer.
   7
   8         * Configurations/FeatureDefines.xcconfig:
   9
  10 2013-02-12  Filip Pizlo  <fpizlo@apple.com>
  11
  12         Renamed SpecObjectMask to SpecObject.
  13
  14         Rubber stamped by Mark Hahnenberg.
  15
  16         "SpecObjectMask" is a weird name considering that a bunch of the other speculated
  17         types are also masks, but don't have "Mask" in the name.
  18
  19         * bytecode/SpeculatedType.h:
  20         (JSC):
  21         (JSC::isObjectSpeculation):
  22         (JSC::isObjectOrOtherSpeculation):
  23         * dfg/DFGAbstractState.cpp:
  24         (JSC::DFG::AbstractState::execute):
  25         * dfg/DFGPredictionPropagationPhase.cpp:
  26         (JSC::DFG::PredictionPropagationPhase::propagate):
  27         * dfg/DFGSpeculativeJIT.cpp:
  28         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
  29         * dfg/DFGSpeculativeJIT32_64.cpp:
  30         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
  31         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
  32         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
  33         * dfg/DFGSpeculativeJIT64.cpp:
  34         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
  35         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
  36         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
  37
  38 2013-02-12  Filip Pizlo  <fpizlo@apple.com>
  39
  40         DFG CFA doesn't filter precisely enough for CompareStrictEq
  41         https://bugs.webkit.org/show_bug.cgi?id=109618
  42
  43         Reviewed by Mark Hahnenberg.
  44
  45         The backend speculates object for this case, but the CFA was filtering on
  46         (SpecCell & ~SpecString) | SpecOther.
  47
  48         * dfg/DFGAbstractState.cpp:
  49         (JSC::DFG::AbstractState::execute):
  50
  51 2013-02-12  Martin Robinson  <mrobinson@igalia.com>
  52
  53         Fix the gyp build of JavaScriptCore.
  54
  55         * JavaScriptCore.gypi: Added some missing DFG files to the source list.
  56
  57 2013-02-12  Sheriff Bot  <webkit.review.bot@gmail.com>
  58
  59         Unreviewed, rolling out r142387.
  60         http://trac.webkit.org/changeset/142387
  61         https://bugs.webkit.org/show_bug.cgi?id=109601
  62
  63         caused all layout and jscore tests on windows to fail
  64         (Requested by kling on #webkit).
  65
  66         * bytecode/UnlinkedCodeBlock.cpp:
  67         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
  68         * bytecode/UnlinkedCodeBlock.h:
  69         (UnlinkedCodeBlock):
  70
  71 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
  72
  73         DFG CompareEq optimization should be retuned
  74         https://bugs.webkit.org/show_bug.cgi?id=109545
  75
  76         Reviewed by Mark Hahnenberg.
  77
  78         - Made the object-to-object equality case work again by hoisting the if statement
  79           for it. Previously, object-to-object equality would be compiled as
  80           object-to-object-or-other.
  81
  82         - Added AbstractState guards for most of the type checks that the object equality
  83           code uses.
  84
  85         Looks like a hint of a speed-up on all of the things.
  86
  87         * dfg/DFGAbstractState.cpp:
  88         (JSC::DFG::AbstractState::execute):
  89         * dfg/DFGSpeculativeJIT.cpp:
  90         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
  91         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
  92         (JSC::DFG::SpeculativeJIT::compare):
  93         * dfg/DFGSpeculativeJIT32_64.cpp:
  94         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
  95         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
  96         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
  97         * dfg/DFGSpeculativeJIT64.cpp:
  98         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
  99         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 100         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 101
 102 2013-02-12  Gabor Rapcsanyi  <rgabor@webkit.org>
 103
 104         JSC asserting with long parameter list functions in debug mode on ARM traditional
 105         https://bugs.webkit.org/show_bug.cgi?id=109565
 106
 107         Reviewed by Zoltan Herczeg.
 108
 109         Increase the value of sequenceGetByIdSlowCaseInstructionSpace to 80.
 110
 111         * jit/JIT.h:
 112
 113 2013-02-11  Oliver Hunt  <oliver@apple.com>
 114
 115         Make JSC API more NULL tolerant
 116         https://bugs.webkit.org/show_bug.cgi?id=109515
 117
 118         Reviewed by Mark Hahnenberg.
 119
 120         We do so much marshalling for the C API these days anyway that a single null
 121         check isn't a performance issue.  Yet the existing "null is unsafe" behaviour
 122         leads to crashes in embedding applications whenever there's an untested code
 123         path, so it seems having defined behaviour is superior.
 124
 125         * API/APICast.h:
 126         (toJS):
 127         (toJSForGC):
 128         * API/JSObjectRef.cpp:
 129         (JSObjectIsFunction):
 130         (JSObjectCallAsFunction):
 131         (JSObjectIsConstructor):
 132         (JSObjectCallAsConstructor):
 133         * API/tests/testapi.c:
 134         (main):
 135
 136 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
 137
 138         Unreviewed, adding a FIXME to remind ourselves of a bug.
 139         https://bugs.webkit.org/show_bug.cgi?id=109487
 140
 141         * dfg/DFGSpeculativeJIT.cpp:
 142         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
 143
 144 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
 145
 146         Strange bug in DFG OSR in JSC
 147         https://bugs.webkit.org/show_bug.cgi?id=109491
 148
 149         Reviewed by Mark Hahnenberg.
 150
 151         Int32ToDouble was being injected after a side-effecting operation and before a SetLocal. Anytime we
 152         inject something just before a SetLocal we should be aware that the previous operation may have been
 153         a side-effect associated with the current code origin. Hence, we should use a forward exit.
 154         Int32ToDouble does not do forward exits by default.
 155
 156         This patch adds a forward-exiting form of Int32ToDouble, for use in SetLocal Int32ToDouble injections.
 157         Changed the CSE and other things to treat these nodes identically, but for the exit strategy to be
 158         distinct (Int32ToDouble -> backward, ForwardInt32ToDouble -> forward). The use of the NodeType for
 159         signaling exit direction is not "great" but it's what we use in other places already (like
 160         ForwardCheckStructure).
 161
 162         * dfg/DFGAbstractState.cpp:
 163         (JSC::DFG::AbstractState::execute):
 164         * dfg/DFGCSEPhase.cpp:
 165         (JSC::DFG::CSEPhase::int32ToDoubleCSE):
 166         (CSEPhase):
 167         (JSC::DFG::CSEPhase::performNodeCSE):
 168         * dfg/DFGCommon.h:
 169         * dfg/DFGFixupPhase.cpp:
 170         (JSC::DFG::FixupPhase::fixupNode):
 171         (JSC::DFG::FixupPhase::fixDoubleEdge):
 172         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
 173         * dfg/DFGNode.h:
 174         (JSC::DFG::Node::willHaveCodeGenOrOSR):
 175         * dfg/DFGNodeType.h:
 176         (DFG):
 177         * dfg/DFGPredictionPropagationPhase.cpp:
 178         (JSC::DFG::PredictionPropagationPhase::propagate):
 179         * dfg/DFGSpeculativeJIT.cpp:
 180         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
 181         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
 182         * dfg/DFGSpeculativeJIT.h:
 183         * dfg/DFGSpeculativeJIT32_64.cpp:
 184         (JSC::DFG::SpeculativeJIT::compile):
 185         * dfg/DFGSpeculativeJIT64.cpp:
 186         (JSC::DFG::SpeculativeJIT::compile):
 187         * dfg/DFGVariableEventStream.cpp:
 188         (JSC::DFG::VariableEventStream::reconstruct):
 189
 190 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
 191
 192         NonStringCell and Object are practically the same thing for the purpose of speculation
 193         https://bugs.webkit.org/show_bug.cgi?id=109492
 194
 195         Reviewed by Mark Hahnenberg.
 196
 197         Removed isNonStringCellSpeculation, and made all callers use isObjectSpeculation.
 198
 199         Changed isNonStringCellOrOtherSpeculation to be isObjectOrOtherSpeculation.
 200
 201         I believe this is correct because even weird object types like JSNotAnObject end up
 202         being "objects" from the standpoint of our typesystem. Anyway, the assumption that
 203         "is cell but not a string" equates to "object" is an assumption that is already made
 204         in other places in the system so there's little value in being paranoid about it.
 205
 206         * bytecode/SpeculatedType.h:
 207         (JSC::isObjectSpeculation):
 208         (JSC::isObjectOrOtherSpeculation):
 209         * dfg/DFGAbstractState.cpp:
 210         (JSC::DFG::AbstractState::execute):
 211         * dfg/DFGNode.h:
 212         (Node):
 213         (JSC::DFG::Node::shouldSpeculateObjectOrOther):
 214         * dfg/DFGSpeculativeJIT.cpp:
 215         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
 216         (JSC::DFG::SpeculativeJIT::compare):
 217         (JSC::DFG::SpeculativeJIT::compileStrictEq):
 218         * dfg/DFGSpeculativeJIT.h:
 219         (SpeculativeJIT):
 220         * dfg/DFGSpeculativeJIT32_64.cpp:
 221         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
 222         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
 223         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
 224         (JSC::DFG::SpeculativeJIT::emitBranch):
 225         (JSC::DFG::SpeculativeJIT::compile):
 226         * dfg/DFGSpeculativeJIT64.cpp:
 227         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
 228         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
 229         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
 230         (JSC::DFG::SpeculativeJIT::emitBranch):
 231         (JSC::DFG::SpeculativeJIT::compile):
 232
 233 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
 234
 235         DFG CompareEq(a, null) and CompareStrictEq(a, const) are unsound with respect to constant folding
 236         https://bugs.webkit.org/show_bug.cgi?id=109387
 237
 238         Reviewed by Oliver Hunt and Mark Hahnenberg.
 239
 240         Lock in the decision to use a non-speculative constant comparison as early as possible
 241         and don't let the CFA change it by folding constants. This might be a performance
 242         penalty on some really weird code (FWIW, I haven't seen this on benchmarks), but on
 243         the other hand it completely side-steps the unsoundness that the bug speaks of.
 244
 245         Rolling back in after adding 32-bit path.
 246
 247         * dfg/DFGAbstractState.cpp:
 248         (JSC::DFG::AbstractState::execute):
 249         * dfg/DFGByteCodeParser.cpp:
 250         (JSC::DFG::ByteCodeParser::isConstantForCompareStrictEq):
 251         (ByteCodeParser):
 252         (JSC::DFG::ByteCodeParser::parseBlock):
 253         * dfg/DFGCSEPhase.cpp:
 254         (JSC::DFG::CSEPhase::performNodeCSE):
 255         * dfg/DFGNodeType.h:
 256         (DFG):
 257         * dfg/DFGPredictionPropagationPhase.cpp:
 258         (JSC::DFG::PredictionPropagationPhase::propagate):
 259         * dfg/DFGSpeculativeJIT.cpp:
 260         (JSC::DFG::SpeculativeJIT::compileStrictEq):
 261         * dfg/DFGSpeculativeJIT32_64.cpp:
 262         (JSC::DFG::SpeculativeJIT::compile):
 263         * dfg/DFGSpeculativeJIT64.cpp:
 264         (JSC::DFG::SpeculativeJIT::compile):
 265
 266 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
 267
 268         DFG TypeOf implementation should have its backend code aligned to what the CFA does
 269         https://bugs.webkit.org/show_bug.cgi?id=109385
 270
 271         Reviewed by Sam Weinig.
 272
 273         The problem was that if we ended up trying to constant fold, but didn't succeed
 274         because of prediction mismatches, then we would also fail to do filtration.
 275
 276         Rearranged the control flow in the CFA to fix that.
 277
 278         As far as I know, this is asymptomatic - it's sort of OK for the CFA to prove less
 279         things, which is what the bug was.
 280
 281         * dfg/DFGAbstractState.cpp:
 282         (JSC::DFG::AbstractState::execute):
 283
 284 2013-02-11  Sheriff Bot  <webkit.review.bot@gmail.com>
 285
 286         Unreviewed, rolling out r142491.
 287         http://trac.webkit.org/changeset/142491
 288         https://bugs.webkit.org/show_bug.cgi?id=109470
 289
 290         broke the 32 bit build (Requested by jessieberlin on #webkit).
 291
 292         * dfg/DFGAbstractState.cpp:
 293         (JSC::DFG::AbstractState::execute):
 294         * dfg/DFGByteCodeParser.cpp:
 295         (JSC::DFG::ByteCodeParser::parseBlock):
 296         * dfg/DFGCSEPhase.cpp:
 297         (JSC::DFG::CSEPhase::performNodeCSE):
 298         * dfg/DFGNodeType.h:
 299         (DFG):
 300         * dfg/DFGPredictionPropagationPhase.cpp:
 301         (JSC::DFG::PredictionPropagationPhase::propagate):
 302         * dfg/DFGSpeculativeJIT.cpp:
 303         (JSC::DFG::SpeculativeJIT::compileStrictEq):
 304         * dfg/DFGSpeculativeJIT64.cpp:
 305         (JSC::DFG::SpeculativeJIT::compile):
 306
 307 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
 308
 309         DFG CompareEq(a, null) and CompareStrictEq(a, const) are unsound with respect to constant folding
 310         https://bugs.webkit.org/show_bug.cgi?id=109387
 311
 312         Reviewed by Oliver Hunt.
 313
 314         Lock in the decision to use a non-speculative constant comparison as early as possible
 315         and don't let the CFA change it by folding constants. This might be a performance
 316         penalty on some really weird code (FWIW, I haven't seen this on benchmarks), but on
 317         the other hand it completely side-steps the unsoundness that the bug speaks of.
 318
 319         * dfg/DFGAbstractState.cpp:
 320         (JSC::DFG::AbstractState::execute):
 321         * dfg/DFGByteCodeParser.cpp:
 322         (JSC::DFG::ByteCodeParser::isConstantForCompareStrictEq):
 323         (ByteCodeParser):
 324         (JSC::DFG::ByteCodeParser::parseBlock):
 325         * dfg/DFGCSEPhase.cpp:
 326         (JSC::DFG::CSEPhase::performNodeCSE):
 327         * dfg/DFGNodeType.h:
 328         (DFG):
 329         * dfg/DFGPredictionPropagationPhase.cpp:
 330         (JSC::DFG::PredictionPropagationPhase::propagate):
 331         * dfg/DFGSpeculativeJIT.cpp:
 332         (JSC::DFG::SpeculativeJIT::compileStrictEq):
 333         * dfg/DFGSpeculativeJIT64.cpp:
 334         (JSC::DFG::SpeculativeJIT::compile):
 335
 336 2013-02-11  Csaba Osztrogonác  <ossy@webkit.org>
 337
 338         Unreviewed fix after r13954 for !ENABLE(JIT) builds.
 339
 340         * llint/LowLevelInterpreter.cpp:
 341
 342 2013-02-11  Gabor Rapcsanyi  <rgabor@webkit.org>
 343
 344         JSC build failing with verbose debug mode
 345         https://bugs.webkit.org/show_bug.cgi?id=109441
 346
 347         Reviewed by Darin Adler.
 348
 349         Fixing some verbose messages which caused build errors.
 350
 351         * dfg/DFGAbstractState.cpp:
 352         (JSC::DFG::AbstractState::mergeToSuccessors):
 353         * dfg/DFGCFAPhase.cpp:
 354         (JSC::DFG::CFAPhase::performBlockCFA):
 355         * dfg/DFGCSEPhase.cpp:
 356         (JSC::DFG::CSEPhase::setReplacement):
 357         (JSC::DFG::CSEPhase::eliminate):
 358         * dfg/DFGPredictionInjectionPhase.cpp:
 359         (JSC::DFG::PredictionInjectionPhase::run):
 360
 361 2013-02-10  Martin Robinson  <mrobinson@igalia.com>
 362
 363         Fix the GTK+ gyp build
 364
 365         * JavaScriptCore.gypi: Update the source list to accurately
 366         reflect what's in the repository and remove the offsets extractor
 367         from the list of JavaScriptCore files. It's only used to build
 368         the extractor binary.
 369
 370 2013-02-09  Andreas Kling  <akling@apple.com>
 371
 372         Shrink-wrap UnlinkedCodeBlock members.
 373         <http://webkit.org/b/109368>
 374
 375         Reviewed by Oliver Hunt.
 376
 377         Rearrange the members of UnlinkedCodeBlock to avoid unnecessary padding on 64-bit.
 378         Knocks ~600 KB off of the Membuster3 peak.
 379
 380         * bytecode/UnlinkedCodeBlock.cpp:
 381         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
 382         * bytecode/UnlinkedCodeBlock.h:
 383         (UnlinkedCodeBlock):
 384
 385 2013-02-08  Filip Pizlo  <fpizlo@apple.com>
 386
 387         DFG should allow phases to break Phi's and then have one phase to rebuild them
 388         https://bugs.webkit.org/show_bug.cgi?id=108414
 389
 390         Reviewed by Mark Hahnenberg.
 391
 392         Introduces two new DFG forms: LoadStore and ThreadedCPS. These are described in
 393         detail in DFGCommon.h.
 394
 395         Consequently, DFG phases no longer have to worry about preserving data flow
 396         links between basic blocks. It is generally always safe to request that the
 397         graph be dethreaded (Graph::dethread), which brings it into LoadStore form, where
 398         the data flow is implicit. In this form, only liveness-at-head needs to be
 399         preserved.
 400
 401         All of the machinery for "threading" the graph to introduce data flow between
 402         blocks is now moved out of the bytecode parser and into the CPSRethreadingPhase.
 403         All phases that previously did this maintenance themselves now just rely on
 404         being able to dethread the graph. The one exception is the structure check
 405         hoising phase, which operates over a threaded graph and preserves it, for the
 406         sake of performance.
 407
 408         Also moved two other things into their own phases: unification (previously found
 409         in the parser) and prediction injection (previously found in various places).
 410
 411         * CMakeLists.txt:
 412         * GNUmakefile.list.am:
 413         * JavaScriptCore.xcodeproj/project.pbxproj:
 414         * Target.pri:
 415         * bytecode/Operands.h:
 416         (Operands):
 417         (JSC::Operands::sizeFor):
 418         (JSC::Operands::atFor):
 419         * dfg/DFGAbstractState.cpp:
 420         (JSC::DFG::AbstractState::execute):
 421         (JSC::DFG::AbstractState::mergeStateAtTail):
 422         * dfg/DFGAllocator.h:
 423         (JSC::DFG::::allocateSlow):
 424         * dfg/DFGArgumentsSimplificationPhase.cpp:
 425         (JSC::DFG::ArgumentsSimplificationPhase::run):
 426         * dfg/DFGBasicBlockInlines.h:
 427         (DFG):
 428         * dfg/DFGByteCodeParser.cpp:
 429         (JSC::DFG::ByteCodeParser::getLocal):
 430         (JSC::DFG::ByteCodeParser::getArgument):
 431         (JSC::DFG::ByteCodeParser::flushDirect):
 432         (JSC::DFG::ByteCodeParser::parseBlock):
 433         (DFG):
 434         (JSC::DFG::ByteCodeParser::parse):
 435         * dfg/DFGCFGSimplificationPhase.cpp:
 436         (JSC::DFG::CFGSimplificationPhase::run):
 437         (JSC::DFG::CFGSimplificationPhase::killUnreachable):
 438         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
 439         (CFGSimplificationPhase):
 440         (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
 441         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
 442         * dfg/DFGCPSRethreadingPhase.cpp: Added.
 443         (DFG):
 444         (CPSRethreadingPhase):
 445         (JSC::DFG::CPSRethreadingPhase::CPSRethreadingPhase):
 446         (JSC::DFG::CPSRethreadingPhase::run):
 447         (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
 448         (JSC::DFG::CPSRethreadingPhase::clearVariablesAtHeadAndTail):
 449         (JSC::DFG::CPSRethreadingPhase::addPhiSilently):
 450         (JSC::DFG::CPSRethreadingPhase::addPhi):
 451         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
 452         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocal):
 453         (JSC::DFG::CPSRethreadingPhase::canonicalizeSetLocal):
 454         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
 455         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocal):
 456         (JSC::DFG::CPSRethreadingPhase::canonicalizeSetArgument):
 457         (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
 458         (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlocks):
 459         (JSC::DFG::CPSRethreadingPhase::propagatePhis):
 460         (JSC::DFG::CPSRethreadingPhase::PhiStackEntry::PhiStackEntry):
 461         (PhiStackEntry):
 462         (JSC::DFG::CPSRethreadingPhase::phiStackFor):
 463         (JSC::DFG::performCPSRethreading):
 464         * dfg/DFGCPSRethreadingPhase.h: Added.
 465         (DFG):
 466         * dfg/DFGCSEPhase.cpp:
 467         (CSEPhase):
 468         (JSC::DFG::CSEPhase::performNodeCSE):
 469         * dfg/DFGCommon.cpp:
 470         (WTF):
 471         (WTF::printInternal):
 472         * dfg/DFGCommon.h:
 473         (JSC::DFG::logCompilationChanges):
 474         (DFG):
 475         (WTF):
 476         * dfg/DFGConstantFoldingPhase.cpp:
 477         (JSC::DFG::ConstantFoldingPhase::foldConstants):
 478         * dfg/DFGDriver.cpp:
 479         (JSC::DFG::compile):
 480         * dfg/DFGGraph.cpp:
 481         (JSC::DFG::Graph::Graph):
 482         (JSC::DFG::Graph::dump):
 483         (JSC::DFG::Graph::dethread):
 484         (JSC::DFG::Graph::collectGarbage):
 485         * dfg/DFGGraph.h:
 486         (JSC::DFG::Graph::performSubstitution):
 487         (Graph):
 488         (JSC::DFG::Graph::performSubstitutionForEdge):
 489         (JSC::DFG::Graph::convertToConstant):
 490         * dfg/DFGNode.h:
 491         (JSC::DFG::Node::convertToPhantomLocal):
 492         (Node):
 493         (JSC::DFG::Node::convertToGetLocal):
 494         (JSC::DFG::Node::hasVariableAccessData):
 495         * dfg/DFGNodeType.h:
 496         (DFG):
 497         * dfg/DFGPhase.cpp:
 498         (JSC::DFG::Phase::beginPhase):
 499         * dfg/DFGPhase.h:
 500         (JSC::DFG::runAndLog):
 501         * dfg/DFGPredictionInjectionPhase.cpp: Added.
 502         (DFG):
 503         (PredictionInjectionPhase):
 504         (JSC::DFG::PredictionInjectionPhase::PredictionInjectionPhase):
 505         (JSC::DFG::PredictionInjectionPhase::run):
 506         (JSC::DFG::performPredictionInjection):
 507         * dfg/DFGPredictionInjectionPhase.h: Added.
 508         (DFG):
 509         * dfg/DFGPredictionPropagationPhase.cpp:
 510         (JSC::DFG::PredictionPropagationPhase::run):
 511         (JSC::DFG::PredictionPropagationPhase::propagate):
 512         * dfg/DFGSpeculativeJIT32_64.cpp:
 513         (JSC::DFG::SpeculativeJIT::compile):
 514         * dfg/DFGSpeculativeJIT64.cpp:
 515         (JSC::DFG::SpeculativeJIT::compile):
 516         * dfg/DFGStructureCheckHoistingPhase.cpp:
 517         (JSC::DFG::StructureCheckHoistingPhase::run):
 518         * dfg/DFGUnificationPhase.cpp: Added.
 519         (DFG):
 520         (UnificationPhase):
 521         (JSC::DFG::UnificationPhase::UnificationPhase):
 522         (JSC::DFG::UnificationPhase::run):
 523         (JSC::DFG::performUnification):
 524         * dfg/DFGUnificationPhase.h: Added.
 525         (DFG):
 526         * dfg/DFGValidate.cpp:
 527         (JSC::DFG::Validate::validate):
 528         (JSC::DFG::Validate::dumpGraphIfAppropriate):
 529         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
 530         (JSC::DFG::VirtualRegisterAllocationPhase::run):
 531         * llint/LLIntSlowPaths.cpp:
 532         (JSC::LLInt::setUpCall):
 533         * runtime/JSCJSValue.cpp:
 534         (JSC::JSValue::dump):
 535         * runtime/JSString.h:
 536         (JSString):
 537         * runtime/Options.h:
 538         (JSC):
 539
 540 2013-02-08  Jer Noble  <jer.noble@apple.com>
 541
 542         Bring WebKit up to speed with latest Encrypted Media spec.
 543         https://bugs.webkit.org/show_bug.cgi?id=97037
 544
 545         Reviewed by Eric Carlson.
 546
 547         Define the ENABLE_ENCRYPTED_MEDIA_V2 setting.
 548
 549         * Configurations/FeatureDefines.xcconfig:
 550
 551 2013-02-08  Gavin Barraclough  <barraclough@apple.com>
 552
 553         Objective-C API for JavaScriptCore
 554         https://bugs.webkit.org/show_bug.cgi?id=105889
 555
 556         Reviewed by Joseph Pecoraro
 557
 558         Following up on review comments, mostly typos.
 559
 560         * API/JSBlockAdaptor.h:
 561         * API/JSBlockAdaptor.mm:
 562         (-[JSBlockAdaptor blockFromValue:inContext:withException:]):
 563         * API/JSContext.h:
 564         * API/JSExport.h:
 565         * API/JSValue.h:
 566         * API/JSValue.mm:
 567         * API/JSWrapperMap.mm:
 568         (selectorToPropertyName):
 569         (-[JSWrapperMap classInfoForClass:]):
 570         (-[JSWrapperMap wrapperForObject:]):
 571
 572 2013-02-08  Martin Robinson  <mrobinson@igalia.com>
 573
 574         [GTK] Add an experimental gyp build
 575         https://bugs.webkit.org/show_bug.cgi?id=109003
 576
 577         Reviewed by Gustavo Noronha Silva.
 578
 579         * JavaScriptCore.gypi: Update the list of source files to include those
 580         necessary for the GTK+ build.
 581
 582 2013-02-08  Andreas Kling  <akling@apple.com>
 583
 584         JSC: Lower minimum PropertyTable size.
 585         <http://webkit.org/b/109247>
 586
 587         Reviewed by Darin Adler.
 588
 589         Lower the minimum table size for PropertyTable from 16 to 8.
 590         3.32 MB progression on Membuster3 (a ~13% reduction in memory used by PropertyTables.)
 591
 592         * runtime/PropertyMapHashTable.h:
 593         (PropertyTable):
 594         (JSC::PropertyTable::sizeForCapacity):
 595
 596 2013-02-07  Roger Fong  <roger_fong@apple.com>
 597
 598         Unreviewed. More VS2010 WebKit solution touchups.
 599         Make JavaScriptCoreExports.def.in be treated as a custom build file so that changes to it cause the exports to be rebuilt.
 600
 601         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
 602         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters:
 603         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
 604
 605 2013-02-07  Mark Hahnenberg  <mhahnenberg@apple.com>
 606
 607         Objective-C API: testapi.mm should use ARC
 608         https://bugs.webkit.org/show_bug.cgi?id=107838
 609
 610         Reviewed by Mark Rowe.
 611
 612         Removing the changes to the Xcode project file and moving the equivalent flags into
 613         the ToolExecutable xcconfig file.
 614
 615         * Configurations/ToolExecutable.xcconfig:
 616         * JavaScriptCore.xcodeproj/project.pbxproj:
 617
 618 2013-02-07  Brent Fulgham  <bfulgham@webkit.org>
 619
 620         [Windows] Unreviewed Visual Studio 2010 build fixes after r142179.
 621
 622         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Correct changed symbols
 623         * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Removed autogenerated file.
 624
 625 2013-02-05  Filip Pizlo  <fpizlo@apple.com>
 626
 627         DFG::ByteCodeParser should do surgical constant folding to reduce load on the optimization fixpoint
 628         https://bugs.webkit.org/show_bug.cgi?id=109000
 629
 630         Reviewed by Oliver Hunt.
 631
 632         Previously our source parser's ASTBuilder did some surgical constant folding, but it
 633         didn't cover some cases.  It was particularly incapable of doing constant folding for
 634         cases where we do some minimal loop peeling in the bytecode generator - since it
 635         didn't "see" those constants prior to the peeling.  Example:
 636
 637         for (var i = 0; i < 4; ++i)
 638             things;
 639
 640         This will get peeled just a bit by the bytecode generator, so that the "i < 4" is
 641         duplicated both at the top of the loop and the bottom.  This means that we have a
 642         constant comparison: "0 < 4", which the bytecode generator emits without any further
 643         thought.
 644
 645         The DFG optimization fixpoint of course folds this and simplifies the CFG
 646         accordingly, but this incurs a compile-time cost.  The purpose of this change is to
 647         do some surgical constant folding in the DFG's bytecode parser, so that such
 648         constructs reduce load on the CFG simplifier and the optimization fixpoint.  The goal
 649         is not to cover all cases, since the DFG CFA and CFG simplifier have a powerful
 650         sparse conditional constant propagation that we can always fall back on. Instead the
 651         goal is to cover enough cases that for common small functions we don't have to
 652         perform such transformations, thereby reducing compile times.
 653
 654         This also refactors m_inlineStackEntry->m_inlineCallFrame to be a handy method call
 655         and also adds the notion of a TriState-based JSValue::pureToBoolean(). Both of these
 656         things are used by the folder.
 657
 658         As well, care has been taken to make sure that the bytecode parser only does folding
 659         that is statically provable, and that doesn't arise out of speculation. This means
 660         we cannot fold on data flow that crosses inlining boundaries. On the other hand, the
 661         folding that the bytecode parser uses doesn't require phantoming anything. Such is
 662         the trade-off: for anything that we do need phantoming, we defer it to the
 663         optimization fixpoint.
 664
 665         Slight SunSpider speed-up.
 666
 667         * dfg/DFGByteCodeParser.cpp:
 668         (JSC::DFG::ByteCodeParser::get):
 669         (JSC::DFG::ByteCodeParser::getLocal):
 670         (JSC::DFG::ByteCodeParser::setLocal):
 671         (JSC::DFG::ByteCodeParser::flushDirect):
 672         (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables):
 673         (JSC::DFG::ByteCodeParser::toInt32):
 674         (ByteCodeParser):
 675         (JSC::DFG::ByteCodeParser::inlineCallFrame):
 676         (JSC::DFG::ByteCodeParser::currentCodeOrigin):
 677         (JSC::DFG::ByteCodeParser::canFold):
 678         (JSC::DFG::ByteCodeParser::handleInlining):
 679         (JSC::DFG::ByteCodeParser::getScope):
 680         (JSC::DFG::ByteCodeParser::parseResolveOperations):
 681         (JSC::DFG::ByteCodeParser::parseBlock):
 682         (JSC::DFG::ByteCodeParser::parseCodeBlock):
 683         * dfg/DFGNode.h:
 684         (JSC::DFG::Node::isStronglyProvedConstantIn):
 685         (Node):
 686         * runtime/JSCJSValue.h:
 687         * runtime/JSCJSValueInlines.h:
 688         (JSC::JSValue::pureToBoolean):
 689         (JSC):
 690
 691 2013-02-07  Zoltan Herczeg  <zherczeg@webkit.org>
 692
 693         Invalid code is generated for storing constants with baseindex addressing modes on ARM traditional.
 694         https://bugs.webkit.org/show_bug.cgi?id=109050
 695
 696         Reviewed by Oliver Hunt.
 697
 698         The S! scratch register is reused, but it should contain the constant value.
 699
 700         * assembler/ARMAssembler.cpp:
 701         (JSC::ARMAssembler::baseIndexTransfer32):
 702         (JSC::ARMAssembler::baseIndexTransfer16):
 703
 704 2013-02-07  Andras Becsi  <andras.becsi@digia.com>
 705
 706         [Qt] Use GNU ar's thin archive format for intermediate static libs
 707         https://bugs.webkit.org/show_bug.cgi?id=109052
 708
 709         Reviewed by Jocelyn Turcotte.
 710
 711         Adjust project files that used activeBuildConfig()
 712         to use targetSubDir().
 713
 714         * JavaScriptCore.pri:
 715         * LLIntOffsetsExtractor.pro:
 716         * Target.pri:
 717
 718 2013-02-06  Roger Fong  <roger_fong@apple.com>
 719
 720         Unreviewed. Touchups to VS2010 WebKit solution.
 721         Fix an export generator script, modify some property sheets, add resouce file.
 722
 723         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props:
 724         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
 725         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props:
 726         * JavaScriptCore.vcxproj/resource.h: Added.
 727
 728 2013-02-06  Ilya Tikhonovsky  <loislo@chromium.org>
 729
 730         Web Inspector: Native Memory Instrumentation: assign class name to the heap graph node automatically
 731         https://bugs.webkit.org/show_bug.cgi?id=107262
 732
 733         Reviewed by Yury Semikhatsky.
 734
 735         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
 736
 737 2013-02-06  Mike West  <mkwst@chromium.org>
 738
 739         Add an ENABLE_NOSNIFF feature flag.
 740         https://bugs.webkit.org/show_bug.cgi?id=109029
 741
 742         Reviewed by Jochen Eisinger.
 743
 744         This new flag will control the behavior of 'X-Content-Type-Options: nosniff'
 745         when processing script and other resource types.
 746
 747         * Configurations/FeatureDefines.xcconfig:
 748
 749 2013-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
 750
 751         put_to_base should emit a Phantom for "value" across the ForceOSRExit
 752         https://bugs.webkit.org/show_bug.cgi?id=108998
 753
 754         Reviewed by Oliver Hunt.
 755
 756         Otherwise, the OSR exit compiler could clobber it, which would lead to badness.
 757
 758         * bytecode/CodeBlock.cpp:
 759         (JSC::CodeBlock::tallyFrequentExitSites): Build fixes for when DFG debug logging is enabled.
 760         * dfg/DFGByteCodeParser.cpp:
 761         (JSC::DFG::ByteCodeParser::parseBlock): Added extra Phantoms for the "value" field where needed.
 762         * dfg/DFGSpeculativeJIT.cpp:
 763         (JSC::DFG::SpeculativeJIT::compile): Ditto.
 764
 765 2013-02-05  Michael Saboff  <msaboff@apple.com>
 766
 767         Crash at JSC::call when loading www.gap.com with JSVALUE32_64 Enabled
 768         https://bugs.webkit.org/show_bug.cgi?id=108991
 769
 770         Reviewed by Oliver Hunt.
 771
 772         Changed the restoration from calleeGPR to nonArgGPR0 because the restoration of the return location
 773         may step on calleeGPR is it happen to be nonArgGPR2.
 774
 775         * dfg/DFGRepatch.cpp:
 776         (JSC::DFG::dfgLinkClosureCall):
 777
 778 2013-02-05  Roger Fong  <roger_fong@apple.com>
 779
 780         Add a JavaScriptCore Export Generator project.
 781         https://bugs.webkit.org/show_bug.cgi?id=108971.
 782
 783         Reviewed by Brent Fulgham.
 784
 785         * JavaScriptCore.vcxproj/JavaScriptCore.sln:
 786         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 787         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
 788         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
 789         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator: Added.
 790         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj: Added.
 791         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters: Added.
 792         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.user: Added.
 793         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorBuildCmd.cmd: Added.
 794         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props: Added.
 795         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props: Added.
 796         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd: Added.
 797         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPreBuild.cmd: Added.
 798         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props: Added.
 799         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Added.
 800
 801 2013-02-04  Filip Pizlo  <fpizlo@apple.com>
 802
 803         DFG should have a precise view of jump targets
 804         https://bugs.webkit.org/show_bug.cgi?id=108868
 805
 806         Reviewed by Oliver Hunt.
 807
 808         Previously, the DFG relied entirely on the CodeBlock's jump targets list for
 809         determining when to break basic blocks. This worked great, except sometimes it
 810         would be too conservative since the CodeBlock just says where the bytecode
 811         generator inserted labels.
 812
 813         This change keeps the old jump target list in CodeBlock since it is still
 814         valuable to the baseline JIT, but switches the DFG to use its own jump target
 815         calculator. This ought to reduce pressure on the DFG simplifier, which would
 816         previously do a lot of work to try to merge redundantly created basic blocks.
 817         It appears to be a 1% progression on SunSpider.
 818
 819         * CMakeLists.txt:
 820         * GNUmakefile.list.am:
 821         * JavaScriptCore.xcodeproj/project.pbxproj:
 822         * Target.pri:
 823         * bytecode/PreciseJumpTargets.cpp: Added.
 824         (JSC):
 825         (JSC::addSimpleSwitchTargets):
 826         (JSC::computePreciseJumpTargets):
 827         * bytecode/PreciseJumpTargets.h: Added.
 828         (JSC):
 829         * dfg/DFGByteCodeParser.cpp:
 830         (JSC::DFG::ByteCodeParser::parseCodeBlock):
 831
 832 2013-02-01  Roger Fong  <roger_fong@apple.com>
 833
 834         Make ConfigurationBuildDir include directories precede WebKitLibraries in JSC.
 835         https://bugs.webkit.org/show_bug.cgi?id=108693.
 836
 837         Rubberstamped by Timothy Horton.
 838
 839         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
 840
 841 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
 842
 843         Structure::m_outOfLineCapacity is unnecessary
 844         https://bugs.webkit.org/show_bug.cgi?id=108206
 845
 846         Reviewed by Darin Adler.
 847
 848         Simplifying the utility functions that we use since we don't need a
 849         bunch of fancy templates for this one specific call site.
 850
 851         * runtime/Structure.h:
 852         (JSC::Structure::outOfLineCapacity):
 853
 854 2013-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
 855
 856         Objective-C API: testapi.mm should use ARC
 857         https://bugs.webkit.org/show_bug.cgi?id=107838
 858
 859         Reviewed by Oliver Hunt.
 860
 861         In ToT testapi.mm uses the Obj-C garbage collector, which hides a lot of our object lifetime bugs.
 862         We should enable ARC, since that is what most of our clients will be using. We use Xcode project
 863         settings to make sure we don't try to compile ARC on 32-bit.
 864
 865         * API/tests/testapi.mm:
 866         (+[TestObject testObject]):
 867         (testObjectiveCAPI):
 868         * JavaScriptCore.xcodeproj/project.pbxproj:
 869
 870 2013-02-05  Brent Fulgham  <bfulgham@webkit.org>
 871
 872         [Windows] Unreviewed VS2010 Build Correction after r141651
 873
 874         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add missing
 875         StructureRareData.h and StructureRareData.cpp files.
 876         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
 877
 878 2013-02-05  Michael Saboff  <msaboff@apple.com>
 879
 880         r141788 won't build due to not having all changes needed by Node* change
 881         https://bugs.webkit.org/show_bug.cgi?id=108944
 882
 883         Reviewed by David Kilzer.
 884
 885         Fixed three instances of integerResult(..., m_compileIndex) to be integerResult(..., node).
 886
 887         * dfg/DFGSpeculativeJIT.cpp:
 888         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
 889         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
 890
 891 2013-02-04  Sheriff Bot  <webkit.review.bot@gmail.com>
 892
 893         Unreviewed, rolling out r141809.
 894         http://trac.webkit.org/changeset/141809
 895         https://bugs.webkit.org/show_bug.cgi?id=108860
 896
 897         ARC isn't supported on 32-bit. (Requested by mhahnenberg on
 898         #webkit).
 899
 900         * API/tests/testapi.mm:
 901         (+[TestObject testObject]):
 902         (testObjectiveCAPI):
 903         * JavaScriptCore.xcodeproj/project.pbxproj:
 904
 905 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
 906
 907         Objective-C API: testapi.mm should use ARC
 908         https://bugs.webkit.org/show_bug.cgi?id=107838
 909
 910         Reviewed by Oliver Hunt.
 911
 912         In ToT testapi.mm uses the Obj-C garbage collector, which hides a lot of our object lifetime bugs.
 913         We should enable ARC, since that is what most of our clients will be using.
 914
 915         * API/tests/testapi.mm:
 916         (-[TestObject init]):
 917         (-[TestObject dealloc]):
 918         (+[TestObject testObject]):
 919         (testObjectiveCAPI):
 920         * JavaScriptCore.xcodeproj/project.pbxproj:
 921
 922 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
 923
 924         Objective-C API: ObjCCallbackFunction should retain the target of its NSInvocation
 925         https://bugs.webkit.org/show_bug.cgi?id=108843
 926
 927         Reviewed by Darin Adler.
 928
 929         Currently, ObjCCallbackFunction doesn't retain the target of its NSInvocation. It needs to do
 930         this to prevent crashes when trying to invoke a callback later on.
 931
 932         * API/ObjCCallbackFunction.mm:
 933         (ObjCCallbackFunction::ObjCCallbackFunction):
 934         (ObjCCallbackFunction::~ObjCCallbackFunction):
 935
 936 2013-02-04  Martin Robinson  <mrobinson@igalia.com>
 937
 938         Fix GTK+ 'make dist' in preparation for the 1.11.5 release.
 939
 940         * GNUmakefile.list.am: Update the source lists.
 941
 942 2013-02-04  Michael Saboff  <msaboff@apple.com>
 943
 944         For ARMv7s use integer divide instruction for divide and modulo when possible
 945         https://bugs.webkit.org/show_bug.cgi?id=108840
 946
 947         Reviewed in person by Filip Pizlo.
 948
 949         Added ARMv7s integer divide path for ArithDiv and ArithMod where operands and results are integer.
 950         This is patterned after the similar code for X86.  Also added modulo power of 2 optimization
 951         that uses logical and.  Added sdiv and udiv to the ARMv7 disassembler.  Put all the changes
 952         behind #if CPU(APPLE_ARMV7S).
 953
 954         * assembler/ARMv7Assembler.h:
 955         (ARMv7Assembler):
 956         (JSC::ARMv7Assembler::sdiv):
 957         (JSC::ARMv7Assembler::udiv):
 958         * dfg/DFGCommon.h:
 959         (JSC::DFG::isARMv7s):
 960         * dfg/DFGFixupPhase.cpp:
 961         (JSC::DFG::FixupPhase::fixupNode):
 962         * dfg/DFGSpeculativeJIT.cpp:
 963         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
 964         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
 965         * dfg/DFGSpeculativeJIT.h:
 966         (SpeculativeJIT):
 967         * dfg/DFGSpeculativeJIT32_64.cpp:
 968         (JSC::DFG::SpeculativeJIT::compile):
 969
 970 2013-02-04  David Kilzer  <ddkilzer@apple.com>
 971
 972         Check PrivateHeaders/JSBasePrivate.h for inappropriate macros
 973         <http://webkit.org/b/108749>
 974
 975         Reviewed by Joseph Pecoraro.
 976
 977         * JavaScriptCore.xcodeproj/project.pbxproj: Add
 978         PrivateHeaders/JSBasePrivate.h to list of headers to check in
 979         "Check for Inappropriate Macros in External Headers" build phase
 980         script.
 981
 982 2013-02-04  David Kilzer  <ddkilzer@apple.com>
 983
 984         Remove duplicate entries from JavaScriptCore Xcode project
 985
 986             $ uniq Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj | diff -u - Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj | patch -p0 -R
 987             patching file Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
 988
 989         * JavaScriptCore.xcodeproj/project.pbxproj: Remove duplicates.
 990
 991 2013-02-04  David Kilzer  <ddkilzer@apple.com>
 992
 993         Sort JavaScriptCore Xcode project file
 994
 995         * JavaScriptCore.xcodeproj/project.pbxproj:
 996
 997 2013-02-03  David Kilzer  <ddkilzer@apple.com>
 998
 999         Upstream ENABLE_PDFKIT_PLUGIN settting
1000         <http://webkit.org/b/108792>
1001
1002         Reviewed by Tim Horton.
1003
1004         * Configurations/FeatureDefines.xcconfig: Disable PDFKIT_PLUGIN
1005         on iOS since PDFKit is a Mac-only framework.
1006
1007 2013-02-02  Andreas Kling  <akling@apple.com>
1008
1009         Vector should consult allocator about ideal size when choosing capacity.
1010         <http://webkit.org/b/108410>
1011         <rdar://problem/13124002>
1012
1013         Reviewed by Benjamin Poulain.
1014
1015         Remove assertion about Vector capacity that won't hold anymore since capacity()
1016         may not be what you passed to reserveCapacity().
1017         Also export WTF::fastMallocGoodSize() for Windows builds.
1018
1019         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
1020         * bytecode/CodeBlock.cpp:
1021         (JSC::CodeBlock::CodeBlock):
1022
1023 2013-02-02  Patrick Gansterer  <paroga@webkit.org>
1024
1025         [CMake] Adopt the WinCE port to new CMake
1026         https://bugs.webkit.org/show_bug.cgi?id=108754
1027
1028         Reviewed by Laszlo Gombos.
1029
1030         * os-win32/WinMain.cpp: Removed.
1031         * shell/PlatformWinCE.cmake: Removed.
1032
1033 2013-02-02  Mark Rowe  <mrowe@apple.com>
1034
1035         <http://webkit.org/b/108745> WTF shouldn't use a script build phase to detect the presence of headers when the compiler can do it for us
1036
1037         Reviewed by Sam Weinig.
1038
1039         * DerivedSources.make: Remove an obsolete Makefile rule. This should have been removed when the use
1040         of the generated file moved to WTF.
1041
1042 2013-02-02  David Kilzer  <ddkilzer@apple.com>
1043
1044         Upstream iOS FeatureDefines
1045         <http://webkit.org/b/108753>
1046
1047         Reviewed by Anders Carlsson.
1048
1049         * Configurations/FeatureDefines.xcconfig:
1050         - ENABLE_DEVICE_ORIENTATION: Add iOS configurations.
1051         - ENABLE_PLUGIN_PROXY_FOR_VIDEO: Ditto.
1052         - FEATURE_DEFINES: Add ENABLE_PLUGIN_PROXY_FOR_VIDEO.  Add
1053           PLATFORM_NAME variant to reduce future merge conflicts.
1054
1055 2013-02-01  Mark Hahnenberg  <mhahnenberg@apple.com>
1056
1057         Structure::m_enumerationCache should be moved to StructureRareData
1058         https://bugs.webkit.org/show_bug.cgi?id=108723
1059
1060         Reviewed by Oliver Hunt.
1061
1062         m_enumerationCache is only used by objects whose properties are iterated over, so not every Structure needs this
1063         field and it can therefore be moved safely to StructureRareData to help with memory savings.
1064
1065         * runtime/JSPropertyNameIterator.h:
1066         (JSPropertyNameIterator):
1067         (JSC::Register::propertyNameIterator):
1068         (JSC::StructureRareData::enumerationCache): Add to JSPropertyNameIterator.h so that it can see the correct type.
1069         (JSC::StructureRareData::setEnumerationCache): Ditto.
1070         * runtime/Structure.cpp:
1071         (JSC::Structure::addPropertyWithoutTransition): Use the enumerationCache() getter rather than accessing the field.
1072         (JSC::Structure::removePropertyWithoutTransition): Ditto.
1073         (JSC::Structure::visitChildren): We no longer have to worry about marking the m_enumerationCache field.
1074         * runtime/Structure.h:
1075         (JSC::Structure::setEnumerationCache): Move the old accessors back since we don't have to have any knowledge of
1076         the JSPropertyNameIterator type.
1077         (JSC::Structure::enumerationCache): Ditto.
1078         * runtime/StructureRareData.cpp:
1079         (JSC::StructureRareData::visitChildren): Mark the new m_enumerationCache field.
1080         * runtime/StructureRareData.h: Add new functions/fields.
1081         (StructureRareData):
1082
1083 2013-02-01  Roger Fong  <roger_fong@apple.com>
1084
1085         Unreviewed. JavaScriptCore VS2010 project cleanup.
1086
1087         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1088         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1089         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
1090         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
1091
1092 2013-02-01  Sheriff Bot  <webkit.review.bot@gmail.com>
1093
1094         Unreviewed, rolling out r141662.
1095         http://trac.webkit.org/changeset/141662
1096         https://bugs.webkit.org/show_bug.cgi?id=108738
1097
1098         it's an incorrect change since processPhiStack will
1099         dereference dangling BasicBlock pointers (Requested by pizlo
1100         on #webkit).
1101
1102         * dfg/DFGByteCodeParser.cpp:
1103         (JSC::DFG::ByteCodeParser::parse):
1104
1105 2013-02-01  Filip Pizlo  <fpizlo@apple.com>
1106
1107         Eliminate dead blocks sooner in the DFG::ByteCodeParser to make clear that you don't need to hold onto them during Phi construction
1108         https://bugs.webkit.org/show_bug.cgi?id=108717
1109
1110         Reviewed by Mark Hahnenberg.
1111
1112         I think this makes the code clearer. It doesn't change behavior.
1113
1114         * dfg/DFGByteCodeParser.cpp:
1115         (JSC::DFG::ByteCodeParser::parse):
1116
1117 2013-02-01  Mark Hahnenberg  <mhahnenberg@apple.com>
1118
1119         Structure should have a StructureRareData field to save space
1120         https://bugs.webkit.org/show_bug.cgi?id=108659
1121
1122         Reviewed by Oliver Hunt.
1123
1124         Many of the fields in Structure are used in a subset of all total Structures; however, all Structures must
1125         pay the memory cost of those fields, regardless of whether they use them or not. Since we can have potentially
1126         many Structures on a single page (e.g. bing.com creates ~1500 Structures), it would be profitable to
1127         refactor Structure so that not every Structure has to pay the memory costs for these infrequently used fields.
1128
1129         To accomplish this, we can create a new StructureRareData class to house these seldom used fields which we
1130         can allocate on demand whenever a Structure requires it. This StructureRareData can itself be a JSCell, and
1131         can do all the marking of the fields for the Structure. The StructureRareData field will be part of a union
1132         with m_previous to minimize overhead. We'll add a new field to JSTypeInfo to indicate that the Structure has
1133         a StructureRareData field. During transitions, a Structure will clone its previous Structure's StructureRareData
1134         if it has one. There could be some potential for optimizing this process, but the initial implementation will
1135         be dumb since we'd be paying these overhead costs for each Structure anyways.
1136
1137         Initially we'll only put two fields in the StructureRareData to avoid a memory regression. Over time we'll
1138         continue to move fields from Structure to StructureRareData. Optimistically, this could potentially reduce our
1139         Structure memory footprint by up to around 75%. It could also clear the way for removing destructors from
1140         Structures (and into StructureRareData).
1141
1142         * CMakeLists.txt:
1143         * GNUmakefile.list.am:
1144         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1145         * JavaScriptCore.xcodeproj/project.pbxproj:
1146         * Target.pri:
1147         * dfg/DFGRepatch.cpp: Includes for linking purposes.
1148         * jit/JITStubs.cpp:
1149         * jsc.cpp:
1150         * llint/LLIntSlowPaths.cpp:
1151         * runtime/JSCellInlines.h: Added ifdef guards.
1152         * runtime/JSGlobalData.cpp: New Structure for StructureRareData class.
1153         (JSC::JSGlobalData::JSGlobalData):
1154         * runtime/JSGlobalData.h:
1155         (JSGlobalData):
1156         * runtime/JSGlobalObject.h:
1157         * runtime/JSTypeInfo.h: New flag to indicate whether or not a Structure has a StructureRareData field.
1158         (JSC::TypeInfo::flags):
1159         (JSC::TypeInfo::structureHasRareData):
1160         * runtime/ObjectPrototype.cpp:
1161         * runtime/Structure.cpp: We use a combined WriteBarrier<JSCell> field m_previousOrRareData to avoid compiler issues.
1162         (JSC::Structure::dumpStatistics):
1163         (JSC::Structure::Structure):
1164         (JSC::Structure::materializePropertyMap):
1165         (JSC::Structure::addPropertyTransition):
1166         (JSC::Structure::nonPropertyTransition):
1167         (JSC::Structure::pin):
1168         (JSC::Structure::allocateRareData): Handles allocating a brand new StructureRareData field.
1169         (JSC::Structure::cloneRareDataFrom): Handles cloning a StructureRareData field from another. Used during Structure
1170         transitions.
1171         (JSC::Structure::visitChildren): We no longer have to worry about marking m_objectToStringValue.
1172         * runtime/Structure.h:
1173         (JSC::Structure::previousID): Checks the structureHasRareData flag to see where it should get the previous Structure.
1174         (JSC::Structure::objectToStringValue): Reads the value from the StructureRareData. If it doesn't exist, returns 0.
1175         (JSC::Structure::setObjectToStringValue): Ensures that we have a StructureRareData field, then forwards the function
1176         call to it.
1177         (JSC::Structure::materializePropertyMapIfNecessary):
1178         (JSC::Structure::setPreviousID): Checks for StructureRareData and forwards if necessary.
1179         (Structure):
1180         (JSC::Structure::clearPreviousID): Ditto.
1181         (JSC::Structure::create):
1182         * runtime/StructureRareData.cpp: Added. All of the basic functionality of a JSCell with the fields that we've moved
1183         from Structure and the functions required to access/modify those fields as Structure would have done.
1184         (JSC):
1185         (JSC::StructureRareData::createStructure):
1186         (JSC::StructureRareData::create):
1187         (JSC::StructureRareData::clone):
1188         (JSC::StructureRareData::StructureRareData):
1189         (JSC::StructureRareData::visitChildren):
1190         * runtime/StructureRareData.h: Added.
1191         (JSC):
1192         (StructureRareData):
1193         * runtime/StructureRareDataInlines.h: Added.
1194         (JSC):
1195         (JSC::StructureRareData::previousID):
1196         (JSC::StructureRareData::setPreviousID):
1197         (JSC::StructureRareData::clearPreviousID):
1198         (JSC::Structure::previous): Handles the ugly casting to get the value of the right type of m_previousOrRareData.
1199         (JSC::Structure::rareData): Ditto.
1200         (JSC::StructureRareData::objectToStringValue):
1201         (JSC::StructureRareData::setObjectToStringValue):
1202
1203         * CMakeLists.txt:
1204         * GNUmakefile.list.am:
1205         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1206         * JavaScriptCore.xcodeproj/project.pbxproj:
1207         * Target.pri:
1208         * dfg/DFGRepatch.cpp:
1209         * jit/JITStubs.cpp:
1210         * jsc.cpp:
1211         * llint/LLIntSlowPaths.cpp:
1212         * runtime/JSCellInlines.h:
1213         * runtime/JSGlobalData.cpp:
1214         (JSC::JSGlobalData::JSGlobalData):
1215         * runtime/JSGlobalData.h:
1216         (JSGlobalData):
1217         * runtime/JSGlobalObject.h:
1218         * runtime/JSTypeInfo.h:
1219         (JSC):
1220         (JSC::TypeInfo::flags):
1221         (JSC::TypeInfo::structureHasRareData):
1222         * runtime/ObjectPrototype.cpp:
1223         * runtime/Structure.cpp:
1224         (JSC::Structure::dumpStatistics):
1225         (JSC::Structure::Structure):
1226         (JSC::Structure::materializePropertyMap):
1227         (JSC::Structure::addPropertyTransition):
1228         (JSC::Structure::nonPropertyTransition):
1229         (JSC::Structure::pin):
1230         (JSC::Structure::allocateRareData):
1231         (JSC):
1232         (JSC::Structure::cloneRareDataFrom):
1233         (JSC::Structure::visitChildren):
1234         * runtime/Structure.h:
1235         (JSC::Structure::previousID):
1236         (JSC::Structure::objectToStringValue):
1237         (JSC::Structure::setObjectToStringValue):
1238         (JSC::Structure::materializePropertyMapIfNecessary):
1239         (JSC::Structure::setPreviousID):
1240         (Structure):
1241         (JSC::Structure::clearPreviousID):
1242         (JSC::Structure::previous):
1243         (JSC::Structure::rareData):
1244         (JSC::Structure::create):
1245         * runtime/StructureRareData.cpp: Added.
1246         (JSC):
1247         (JSC::StructureRareData::createStructure):
1248         (JSC::StructureRareData::create):
1249         (JSC::StructureRareData::clone):
1250         (JSC::StructureRareData::StructureRareData):
1251         (JSC::StructureRareData::visitChildren):
1252         * runtime/StructureRareData.h: Added.
1253         (JSC):
1254         (StructureRareData):
1255         * runtime/StructureRareDataInlines.h: Added.
1256         (JSC):
1257         (JSC::StructureRareData::previousID):
1258         (JSC::StructureRareData::setPreviousID):
1259         (JSC::StructureRareData::clearPreviousID):
1260         (JSC::StructureRareData::objectToStringValue):
1261         (JSC::StructureRareData::setObjectToStringValue):
1262
1263 2013-02-01  Balazs Kilvady  <kilvadyb@homejinni.com>
1264
1265         offlineasm BaseIndex handling is broken on ARM due to MIPS changes
1266         https://bugs.webkit.org/show_bug.cgi?id=108261
1267
1268         Reviewed by Filip Pizlo.
1269
1270         offlineasm BaseIndex handling fix on MIPS.
1271
1272         * offlineasm/mips.rb:
1273         * offlineasm/risc.rb:
1274
1275 2013-02-01  Geoffrey Garen  <ggaren@apple.com>
1276
1277         Removed an unused function: JSGlobalObject::createFunctionExecutableFromGlobalCode
1278         https://bugs.webkit.org/show_bug.cgi?id=108657
1279
1280         Reviewed by Anders Carlsson.
1281
1282         * runtime/JSGlobalObject.cpp:
1283         (JSC):
1284         * runtime/JSGlobalObject.h:
1285         (JSGlobalObject):
1286
1287 2013-02-01  Geoffrey Garen  <ggaren@apple.com>
1288
1289         Added TriState to WTF and started using it in one place
1290         https://bugs.webkit.org/show_bug.cgi?id=108628
1291
1292         Reviewed by Beth Dakin.
1293
1294         * runtime/PrototypeMap.h:
1295         (JSC::PrototypeMap::isPrototype): Use TriState instead of boolean. In
1296         response to review feedback, this is an attempt to clarify that our
1297         'true' condition is actually just a 'maybe'.
1298
1299         * runtime/PrototypeMap.h:
1300         (PrototypeMap):
1301         (JSC::PrototypeMap::isPrototype):
1302
1303 2013-02-01  Alexis Menard  <alexis@webkit.org>
1304
1305         Enable unprefixed CSS transitions by default.
1306         https://bugs.webkit.org/show_bug.cgi?id=108216
1307
1308         Reviewed by Dean Jackson.
1309
1310         Rename the flag CSS_TRANSFORMS_ANIMATIONS_TRANSITIONS_UNPREFIXED
1311         to CSS_TRANSFORMS_ANIMATIONS_UNPREFIXED which will be used later to
1312         guard the unprefixing work for CSS Transforms and animations.
1313
1314         * Configurations/FeatureDefines.xcconfig:
1315
1316 2013-01-31  Filip Pizlo  <fpizlo@apple.com>
1317
1318         DFG::CFGSimplificationPhase::keepOperandAlive() conflates liveness and availability
1319         https://bugs.webkit.org/show_bug.cgi?id=108580
1320
1321         Reviewed by Oliver Hunt.
1322
1323         This is a harmless bug in that it only results in us keeping a bit too many things
1324         for OSR.  But it's worth fixing so that the code is consistent.
1325
1326         keepOperandAlive() is called when block A has a branch to blocks B and C, but the
1327         A->B edge is proven to never be taken and we want to optimize the code to have A
1328         unconditionally jump to C.  In that case, for the purposes of OSR, we need to
1329         preserve the knowledge that the state that B expected to be live incoming from A
1330         ought still to be live up to the point of where the A->B,C branch used to be.  The
1331         way we keep things alive is by using the variablesAtTail of A (i.e., we use the
1332         knowledge of in what manner A made state available to B and C).  The way we choose
1333         which state should be kept alive ought to be chosen by the variablesAtHead of B
1334         (i.e. the things B says it needs from its predecessors, including A), except that
1335         keepOperandAlive() was previously just using variablesAtTail of A for this
1336         purpose.
1337
1338         The fix is to have keepOperandAlive() use both liveness and availability in its
1339         logic. It should use liveness (i.e. B->variablesAtHead) to decide what to keep
1340         alive, and it should use availability (i.e. A->variablesAtTail) to decide how to
1341         keep it alive.
1342
1343         This might be a microscopic win on some programs, but it's mainly intended to be
1344         a code clean-up so that I don't end up scratching my head in confusion the next
1345         time I look at this code.
1346
1347         * dfg/DFGCFGSimplificationPhase.cpp:
1348         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
1349         (JSC::DFG::CFGSimplificationPhase::jettisonBlock):
1350         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
1351
1352 2013-01-31  Geoffrey Garen  <ggaren@apple.com>
1353
1354         REGRESSION (r141192): Crash beneath cti_op_get_by_id_generic @ discussions.apple.com
1355         https://bugs.webkit.org/show_bug.cgi?id=108576
1356
1357         Reviewed by Filip Pizlo.
1358
1359         This was a long-standing bug. The DFG would destructively reuse a register
1360         in op_convert_this, but:
1361
1362             * The bug only presented during speculation failure for type Other
1363
1364             * The bug presented by removing the low bits of a pointer, which
1365             used to be harmless, since all objects were so aligned anyway.
1366
1367         * dfg/DFGSpeculativeJIT64.cpp:
1368         (JSC::DFG::SpeculativeJIT::compile): Don't reuse our this register as
1369         our scratch register. The whole point of our scratch register is to
1370         avoid destructively modifying our this register. I'm pretty sure this
1371         was a copy-paste error.
1372
1373 2013-01-31  Roger Fong  <roger_fong@apple.com>
1374
1375         Unreviewed. Windows build fix.
1376
1377         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
1378
1379 2013-01-31  Jessie Berlin  <jberlin@apple.com>
1380
1381         Rolling out r141407 because it is causing crashes under
1382         WTF::TCMalloc_Central_FreeList::FetchFromSpans() in Release builds.
1383
1384         * bytecode/CodeBlock.cpp:
1385         (JSC::CodeBlock::CodeBlock):
1386
1387 2013-01-31  Mark Hahnenberg  <mhahnenberg@apple.com>
1388
1389         Objective-C API: JSContext exception property causes reference cycle
1390         https://bugs.webkit.org/show_bug.cgi?id=107778
1391
1392         Reviewed by Darin Adler.
1393
1394         JSContext has a (retain) JSValue * exception property which, when non-null, creates a
1395         reference cycle (since the JSValue * holds a strong reference back to the JSContext *).
1396
1397         * API/JSContext.mm: Instead of JSValue *, we now use a plain JSValueRef, which eliminates the reference cycle.
1398         (-[JSContext initWithVirtualMachine:]):
1399         (-[JSContext setException:]):
1400         (-[JSContext exception]):
1401
1402 2013-01-31  Roger Fong  <roger_fong@apple.com>
1403
1404         Unreviewed build fix. Win7 port.
1405
1406         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
1407
1408 2013-01-31  Joseph Pecoraro  <pecoraro@apple.com>
1409
1410         Disable ENABLE_FULLSCREEN_API on iOS
1411         https://bugs.webkit.org/show_bug.cgi?id=108250
1412
1413         Reviewed by Benjamin Poulain.
1414
1415         * Configurations/FeatureDefines.xcconfig:
1416
1417 2013-01-31  Mark Hahnenberg  <mhahnenberg@apple.com>
1418
1419         Objective-C API: Fix insertion of values greater than the max index allowed by the spec
1420         https://bugs.webkit.org/show_bug.cgi?id=108264
1421
1422         Reviewed by Oliver Hunt.
1423
1424         Fixed a bug, added a test to the API tests, cleaned up some code.
1425
1426         * API/JSValue.h: Changed some of the documentation on setValue:atIndex: to indicate that
1427         setting values at indices greater than UINT_MAX - 1 wont' affect the length of JS arrays.
1428         * API/JSValue.mm:
1429         (-[JSValue valueAtIndex:]): We weren't returning when we should have been.
1430         (-[JSValue setValue:atIndex:]): Added a comment about why we do the early check for being larger than UINT_MAX.
1431         (objectToValueWithoutCopy): Removed two redundant cases that were already checked previously.
1432         * API/tests/testapi.mm:
1433
1434 2013-01-30  Andreas Kling  <akling@apple.com>
1435
1436         Vector should consult allocator about ideal size when choosing capacity.
1437         <http://webkit.org/b/108410>
1438         <rdar://problem/13124002>
1439
1440         Reviewed by Benjamin Poulain.
1441
1442         Remove assertion about Vector capacity that won't hold anymore since capacity()
1443         may not be what you passed to reserveCapacity().
1444
1445         * bytecode/CodeBlock.cpp:
1446         (JSC::CodeBlock::CodeBlock):
1447
1448 2013-01-30  Filip Pizlo  <fpizlo@apple.com>
1449
1450         DFG bytecode parser should have more assertions about the status of local accesses
1451         https://bugs.webkit.org/show_bug.cgi?id=108417
1452
1453         Reviewed by Mark Hahnenberg.
1454
1455         Assert some things that we already know to be true, just to reassure ourselves that they are true.
1456         This is meant as a prerequisite for https://bugs.webkit.org/show_bug.cgi?id=108414, which will
1457         make these rules even stricter.
1458
1459         * dfg/DFGByteCodeParser.cpp:
1460         (JSC::DFG::ByteCodeParser::getLocal):
1461         (JSC::DFG::ByteCodeParser::getArgument):
1462
1463 2013-01-30  Mark Hahnenberg  <mhahnenberg@apple.com>
1464
1465         Objective-C API: JSContext's dealloc causes ASSERT due to ordering of releases
1466         https://bugs.webkit.org/show_bug.cgi?id=107978
1467
1468         Reviewed by Filip Pizlo.
1469
1470         We need to add the Identifier table save/restore in JSContextGroupRelease so that we
1471         have the correct table if we end up destroying the JSGlobalData/Heap.
1472
1473         * API/JSContextRef.cpp:
1474         (JSContextGroupRelease):
1475
1476 2013-01-30  Mark Hahnenberg  <mhahnenberg@apple.com>
1477
1478         Objective-C API: exceptionHandler needs to be released in JSContext dealloc
1479         https://bugs.webkit.org/show_bug.cgi?id=108378
1480
1481         Reviewed by Filip Pizlo.
1482
1483         JSContext has a (copy) exceptionHandler property that it doesn't release in dealloc.
1484         That sounds like the potential for a leak. It should be released.
1485
1486         * API/JSContext.mm:
1487         (-[JSContext dealloc]):
1488
1489 2013-01-30  Filip Pizlo  <fpizlo@apple.com>
1490
1491         REGRESSION(140504): pure CSE no longer matches things, 10% regression on Kraken
1492         https://bugs.webkit.org/show_bug.cgi?id=108366
1493
1494         Reviewed by Geoffrey Garen and Mark Hahnenberg.
1495
1496         This was a longstanding bug that was revealed by http://trac.webkit.org/changeset/140504.
1497         Pure CSE requires that the Node::flags() that may affect the behavior of a node match,
1498         when comparing a possibly redundant node to its possible replacement. It was doing this
1499         by comparing Node::arithNodeFlags(), which as the name might appear to suggest, returns
1500         just those flag bits that correspond to actual node behavior and not auxiliary things.
1501         Unfortunately, Node::arithNodeFlags() wasn't actually masking off the irrelevant bits.
1502         This worked prior to r140504 because CSE itself didn't mutate the flags, so there was a
1503         very high probability that matching nodes would also have completely identical flag bits
1504         (even the ones that aren't relevant to arithmetic behavior, like NodeDoesNotExit). But
1505         r140504 moved one of CSE's side-tables (m_relevantToOSR) into a flag bit for quicker
1506         access. These bits would be mutated as the CSE ran over a basic block, in such a way that
1507         there was a very high probability that the possible replacement would already have the
1508         bit set, while the redundant node did not have the bit set. Since Node::arithNodeFlags()
1509         returned all of the bits, this would cause CSEPhase::pureCSE() to reject the match
1510         almost every time.
1511
1512         The solution is to make Node::arithNodeFlags() do as its name suggests: only return those
1513         flags that are relevant to arithmetic behavior. This patch introduces a new mask that
1514         represents those bits, and includes NodeBehaviorMask and NodeBackPropMask, which are both
1515         used for queries on Node::arithNodeFlags(), and both affect arithmetic code gen. None of
1516         the other flags are relevant to Node::arithNodeFlags() since they either correspond to
1517         information already conveyed by the opcode (like NodeResultMask, NodeMustGenerate,
1518         NodeHasVarArgs, NodeClobbersWorld, NodeMightClobber) or information that doesn't affect
1519         the result that the node will produce or any of the queries performed on the result of
1520         Node::arithNodeFlags (NodeDoesNotExit and of course NodeRelevantToOSR).
1521
1522         This is a 10% speed-up on Kraken, undoing the regression from r140504.
1523
1524         * dfg/DFGNode.h:
1525         (JSC::DFG::Node::arithNodeFlags):
1526         * dfg/DFGNodeFlags.h:
1527         (DFG):
1528
1529 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
1530
1531         Structure::m_outOfLineCapacity is unnecessary
1532         https://bugs.webkit.org/show_bug.cgi?id=108206
1533
1534         Reviewed by Geoffrey Garen.
1535
1536         We can calculate our out of line capacity by using the outOfLineSize and our knowledge about our resize policy.
1537         According to GDB, this knocks Structures down from 136 bytes to 128 bytes (I'm guessing the extra bytes are from
1538         better alignment of object fields), which puts Structures in a smaller size class. Woohoo! Looks neutral on our
1539         benchmarks.
1540
1541         * runtime/Structure.cpp:
1542         (JSC::Structure::Structure):
1543         (JSC):
1544         (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
1545         (JSC::Structure::addPropertyTransition):
1546         (JSC::Structure::addPropertyWithoutTransition):
1547         * runtime/Structure.h:
1548         (Structure):
1549         (JSC::Structure::outOfLineCapacity):
1550         (JSC::Structure::totalStorageCapacity):
1551
1552 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
1553
1554         Be a little more conservative about emitting table-based switches
1555         https://bugs.webkit.org/show_bug.cgi?id=108292
1556
1557         Reviewed by Filip Pizlo.
1558
1559         Profiling shows we're using op_switch in cases where it's a regression.
1560
1561         * bytecompiler/NodesCodegen.cpp:
1562         (JSC):
1563         (JSC::length):
1564         (JSC::CaseBlockNode::tryTableSwitch):
1565         (JSC::CaseBlockNode::emitBytecodeForBlock):
1566         * parser/Nodes.h:
1567         (CaseBlockNode):
1568
1569 2013-01-29  Sheriff Bot  <webkit.review.bot@gmail.com>
1570
1571         Unreviewed, rolling out r140983.
1572         http://trac.webkit.org/changeset/140983
1573         https://bugs.webkit.org/show_bug.cgi?id=108277
1574
1575         Unfortunately, this API has one last client (Requested by
1576         abarth on #webkit).
1577
1578         * Configurations/FeatureDefines.xcconfig:
1579
1580 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
1581
1582         Objective-C API: JSObjCClassInfo creates reference cycle with JSContext
1583         https://bugs.webkit.org/show_bug.cgi?id=107839
1584
1585         Reviewed by Geoffrey Garen.
1586
1587         Fixing several ASSERTs that were incorrect along with some of the reallocation of m_prototype and
1588         m_constructor that they were based on.
1589
1590         * API/JSWrapperMap.mm:
1591         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): We now only allocate those
1592         fields that are null (i.e. have been collected or have never been allocated to begin with).
1593         (-[JSObjCClassInfo reallocateConstructorAndOrPrototype]): Renamed to better indicate that we're
1594         reallocating one or both of the prototype/constructor combo.
1595         (-[JSObjCClassInfo wrapperForObject:]): Call new reallocate function.
1596         (-[JSObjCClassInfo constructor]): Ditto.
1597
1598 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
1599
1600         Make precise size classes more precise
1601         https://bugs.webkit.org/show_bug.cgi?id=108270
1602
1603         Reviewed by Mark Hahnenberg.
1604
1605         Size inference makes this profitable.
1606
1607         I chose 8 byte increments because JSString is 24 bytes. Otherwise, 16
1608         byte increments might be better.
1609
1610         * heap/Heap.h:
1611         (Heap): Removed firstAllocatorWithoutDestructors because it's unused now.
1612
1613         * heap/MarkedBlock.h:
1614         (MarkedBlock): Updated constants.
1615
1616         * heap/MarkedSpace.h:
1617         (MarkedSpace):
1618         (JSC): Also reduced the maximum precise size class because my testing
1619         has shown that the smaller size classes are much more common. This
1620         offsets some of the size class explosion caused by reducing the precise
1621         increment.
1622
1623         * llint/LLIntData.cpp:
1624         (JSC::LLInt::Data::performAssertions): No need for this ASSERT anymore
1625         because we don't rely on firstAllocatorWithoutDestructors anymore, since
1626         we pick size classes dynamically now.
1627
1628 2013-01-29  Oliver Hunt  <oliver@apple.com>
1629
1630         Add some hardening to methodTable()
1631         https://bugs.webkit.org/show_bug.cgi?id=108253
1632
1633         Reviewed by Mark Hahnenberg.
1634
1635         When accessing methodTable() we now always make sure that our
1636         structure _could_ be valid.  Added a separate method to get a
1637         classes methodTable during destruction as it's not possible to
1638         validate the structure at that point.  This separation might
1639         also make it possible to improve the performance of methodTable
1640         access more generally in future.
1641
1642         * heap/MarkedBlock.cpp:
1643         (JSC::MarkedBlock::callDestructor):
1644         * runtime/JSCell.h:
1645         (JSCell):
1646         * runtime/JSCellInlines.h:
1647         (JSC::JSCell::methodTableForDestruction):
1648         (JSC):
1649         (JSC::JSCell::methodTable):
1650
1651 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
1652
1653         offlineasm BaseIndex handling is broken on ARM due to MIPS changes
1654         https://bugs.webkit.org/show_bug.cgi?id=108261
1655
1656         Reviewed by Oliver Hunt.
1657
1658         Backends shouldn't override each other's methods. That's not cool.
1659
1660         * offlineasm/mips.rb:
1661
1662 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
1663
1664         cloop.rb shouldn't use a method called 'dump' for code generation
1665         https://bugs.webkit.org/show_bug.cgi?id=108251
1666
1667         Reviewed by Mark Hahnenberg.
1668
1669         Revert http://trac.webkit.org/changeset/141178 and rename 'dump' to 'clDump'.
1670
1671         Also made trivial build fixes for !ENABLE(JIT).
1672
1673         * offlineasm/cloop.rb:
1674         * runtime/Executable.h:
1675         (ExecutableBase):
1676         (JSC::ExecutableBase::intrinsicFor):
1677         * runtime/JSGlobalData.h:
1678
1679 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
1680
1681         Removed GGC because it has been disabled for a long time
1682         https://bugs.webkit.org/show_bug.cgi?id=108245
1683
1684         Reviewed by Filip Pizlo.
1685
1686         * GNUmakefile.list.am:
1687         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1688         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1689         * JavaScriptCore.xcodeproj/project.pbxproj:
1690         * dfg/DFGRepatch.cpp:
1691         (JSC::DFG::emitPutReplaceStub):
1692         (JSC::DFG::emitPutTransitionStub):
1693         * dfg/DFGSpeculativeJIT.cpp:
1694         (JSC::DFG::SpeculativeJIT::writeBarrier):
1695         * dfg/DFGSpeculativeJIT.h:
1696         (SpeculativeJIT):
1697         * dfg/DFGSpeculativeJIT32_64.cpp:
1698         (JSC::DFG::SpeculativeJIT::compile):
1699         * dfg/DFGSpeculativeJIT64.cpp:
1700         (JSC::DFG::SpeculativeJIT::compile):
1701         * heap/CardSet.h: Removed.
1702         * heap/Heap.cpp:
1703         (JSC::Heap::markRoots):
1704         (JSC::Heap::collect):
1705         * heap/Heap.h:
1706         (Heap):
1707         (JSC::Heap::shouldCollect):
1708         (JSC::Heap::isWriteBarrierEnabled):
1709         (JSC):
1710         (JSC::Heap::writeBarrier):
1711         * heap/MarkedBlock.h:
1712         (MarkedBlock):
1713         (JSC):
1714         * heap/MarkedSpace.cpp:
1715         (JSC):
1716         * jit/JITPropertyAccess.cpp:
1717         (JSC::JIT::emitWriteBarrier):
1718
1719 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
1720
1721         Remove redundant AST dump method from cloop.rb, since they are already defined in ast.rb
1722         https://bugs.webkit.org/show_bug.cgi?id=108247
1723
1724         Reviewed by Oliver Hunt.
1725
1726         Makes offlineasm dumping easier to read and less likely to cause assertion failures.
1727         Also fixes the strange situation where cloop.rb and ast.rb both defined dump methods,
1728         but cloop.rb was winning.
1729
1730         * offlineasm/cloop.rb:
1731
1732 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
1733
1734         Objective-C API: JSObjCClassInfo creates reference cycle with JSContext
1735         https://bugs.webkit.org/show_bug.cgi?id=107839
1736
1737         Reviewed by Oliver Hunt.
1738
1739         JSContext has a JSWrapperMap, which has an NSMutableDictionary m_classMap, which has values that
1740         are JSObjCClassInfo objects, which have strong references to two JSValue *'s, m_prototype and
1741         m_constructor, which in turn have strong references to the JSContext, creating a reference cycle.
1742         We should make m_prototype and m_constructor Weak<JSObject>. This gets rid of the strong reference
1743         to the JSContext and also prevents clients from accidentally creating reference cycles by assigning
1744         to the prototype of the constructor. If Weak<JSObject> fields are ever garbage collected, we will
1745         reallocate them.
1746
1747         * API/JSContext.mm:
1748         (-[JSContext wrapperMap]):
1749         * API/JSContextInternal.h:
1750         * API/JSWrapperMap.mm:
1751         (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]):
1752         (-[JSObjCClassInfo dealloc]):
1753         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]):
1754         (-[JSObjCClassInfo allocateConstructorAndPrototype]):
1755         (-[JSObjCClassInfo wrapperForObject:]):
1756         (-[JSObjCClassInfo constructor]):
1757
1758 2013-01-29  Oliver Hunt  <oliver@apple.com>
1759
1760         REGRESSION (r140594): RELEASE_ASSERT_NOT_REACHED in JSC::Interpreter::execute
1761         https://bugs.webkit.org/show_bug.cgi?id=108097
1762
1763         Reviewed by Geoffrey Garen.
1764
1765         LiteralParser was accepting a bogus 'var a.b = c' statement
1766
1767         * runtime/LiteralParser.cpp:
1768         (JSC::::tryJSONPParse):
1769
1770 2013-01-29  Oliver Hunt  <oliver@apple.com>
1771
1772         Force debug builds to do bounds checks on contiguous property storage
1773         https://bugs.webkit.org/show_bug.cgi?id=108212
1774
1775         Reviewed by Mark Hahnenberg.
1776
1777         Add a ContiguousData type that we use to represent contiguous property
1778         storage.  In release builds it is simply a pointer to the correct type,
1779         but in debug builds it also carries the data length and performs bounds
1780         checks.  This means we don't have to add as many manual bounds assertions
1781         when performing operations over contiguous data.
1782
1783         * dfg/DFGOperations.cpp:
1784         * runtime/ArrayStorage.h:
1785         (ArrayStorage):
1786         (JSC::ArrayStorage::vector):
1787         * runtime/Butterfly.h:
1788         (JSC::ContiguousData::ContiguousData):
1789         (ContiguousData):
1790         (JSC::ContiguousData::operator[]):
1791         (JSC::ContiguousData::data):
1792         (JSC::ContiguousData::length):
1793         (JSC):
1794         (JSC::Butterfly::contiguousInt32):
1795         (Butterfly):
1796         (JSC::Butterfly::contiguousDouble):
1797         (JSC::Butterfly::contiguous):
1798         * runtime/JSArray.cpp:
1799         (JSC::JSArray::sortNumericVector):
1800         (ContiguousTypeAccessor):
1801         (JSC::ContiguousTypeAccessor::getAsValue):
1802         (JSC::ContiguousTypeAccessor::setWithValue):
1803         (JSC::ContiguousTypeAccessor::replaceDataReference):
1804         (JSC):
1805         (JSC::JSArray::sortCompactedVector):
1806         (JSC::JSArray::sort):
1807         (JSC::JSArray::fillArgList):
1808         (JSC::JSArray::copyToArguments):
1809         * runtime/JSArray.h:
1810         (JSArray):
1811         * runtime/JSObject.cpp:
1812         (JSC::JSObject::copyButterfly):
1813         (JSC::JSObject::visitButterfly):
1814         (JSC::JSObject::createInitialInt32):
1815         (JSC::JSObject::createInitialDouble):
1816         (JSC::JSObject::createInitialContiguous):
1817         (JSC::JSObject::convertUndecidedToInt32):
1818         (JSC::JSObject::convertUndecidedToDouble):
1819         (JSC::JSObject::convertUndecidedToContiguous):
1820         (JSC::JSObject::convertInt32ToDouble):
1821         (JSC::JSObject::convertInt32ToContiguous):
1822         (JSC::JSObject::genericConvertDoubleToContiguous):
1823         (JSC::JSObject::convertDoubleToContiguous):
1824         (JSC::JSObject::rageConvertDoubleToContiguous):
1825         (JSC::JSObject::ensureInt32Slow):
1826         (JSC::JSObject::ensureDoubleSlow):
1827         (JSC::JSObject::ensureContiguousSlow):
1828         (JSC::JSObject::rageEnsureContiguousSlow):
1829         (JSC::JSObject::ensureLengthSlow):
1830         * runtime/JSObject.h:
1831         (JSC::JSObject::ensureInt32):
1832         (JSC::JSObject::ensureDouble):
1833         (JSC::JSObject::ensureContiguous):
1834         (JSC::JSObject::rageEnsureContiguous):
1835         (JSObject):
1836         (JSC::JSObject::indexingData):
1837         (JSC::JSObject::currentIndexingData):
1838
1839 2013-01-29  Brent Fulgham  <bfulgham@webkit.org>
1840
1841         [Windows, WinCairo] Unreviewed build fix after r141050
1842
1843         * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Update symbols
1844         to match JavaScriptCore.vcproj version.
1845
1846 2013-01-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
1847
1848         [Qt] Implement GCActivityCallback
1849         https://bugs.webkit.org/show_bug.cgi?id=103998
1850
1851         Reviewed by Simon Hausmann.
1852
1853         Implements the activity triggered garbage collector.
1854
1855         * runtime/GCActivityCallback.cpp:
1856         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
1857         (JSC::DefaultGCActivityCallback::scheduleTimer):
1858         (JSC::DefaultGCActivityCallback::cancelTimer):
1859         * runtime/GCActivityCallback.h:
1860         (GCActivityCallback):
1861         (DefaultGCActivityCallback):
1862
1863 2013-01-29  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
1864
1865         Compilation warning in JSC
1866         https://bugs.webkit.org/show_bug.cgi?id=108178
1867
1868         Reviewed by Kentaro Hara.
1869
1870         Fixed 'comparison between signed and unsigned integer' warning in JSC::Structure constructor.
1871
1872         * runtime/Structure.cpp:
1873         (JSC::Structure::Structure):
1874
1875 2013-01-29  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
1876
1877         [Qt] Fix the JSC build on Mac
1878
1879         Unreviewed, build fix.
1880
1881         * heap/HeapTimer.h:
1882         Qt on Mac has USE(CF) true, and should use the CF HeapTimer in that case.
1883
1884 2013-01-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
1885
1886         [Qt] Implement IncrementalSweeper and HeapTimer
1887         https://bugs.webkit.org/show_bug.cgi?id=103996
1888
1889         Reviewed by Simon Hausmann.
1890
1891         Implements the incremental sweeping garbage collection for the Qt platform.
1892
1893         * heap/HeapTimer.cpp:
1894         (JSC::HeapTimer::HeapTimer):
1895         (JSC::HeapTimer::~HeapTimer):
1896         (JSC::HeapTimer::timerEvent):
1897         (JSC::HeapTimer::synchronize):
1898         (JSC::HeapTimer::invalidate):
1899         (JSC::HeapTimer::didStartVMShutdown):
1900         * heap/HeapTimer.h:
1901         (HeapTimer):
1902         * heap/IncrementalSweeper.cpp:
1903         (JSC::IncrementalSweeper::IncrementalSweeper):
1904         (JSC::IncrementalSweeper::scheduleTimer):
1905         * heap/IncrementalSweeper.h:
1906         (IncrementalSweeper):
1907
1908 2013-01-28  Filip Pizlo  <fpizlo@apple.com>
1909
1910         DFG should not use a graph that is a vector, Nodes shouldn't move after allocation, and we should always refer to nodes by Node*
1911         https://bugs.webkit.org/show_bug.cgi?id=106868
1912
1913         Reviewed by Oliver Hunt.
1914
1915         This adds a pool allocator for Nodes, and uses that instead of a Vector. Changes all
1916         uses of Node& and NodeIndex to be simply Node*. Nodes no longer have an index except
1917         for debugging (Node::index(), which is not guaranteed to be O(1)).
1918
1919         1% speed-up on SunSpider, presumably because this improves compile times.
1920
1921         * CMakeLists.txt:
1922         * GNUmakefile.list.am:
1923         * JavaScriptCore.xcodeproj/project.pbxproj:
1924         * Target.pri:
1925         * bytecode/DataFormat.h:
1926         (JSC::dataFormatToString):
1927         * dfg/DFGAbstractState.cpp:
1928         (JSC::DFG::AbstractState::initialize):
1929         (JSC::DFG::AbstractState::booleanResult):
1930         (JSC::DFG::AbstractState::execute):
1931         (JSC::DFG::AbstractState::mergeStateAtTail):
1932         (JSC::DFG::AbstractState::mergeToSuccessors):
1933         (JSC::DFG::AbstractState::mergeVariableBetweenBlocks):
1934         (JSC::DFG::AbstractState::dump):
1935         * dfg/DFGAbstractState.h:
1936         (DFG):
1937         (JSC::DFG::AbstractState::forNode):
1938         (AbstractState):
1939         (JSC::DFG::AbstractState::speculateInt32Unary):
1940         (JSC::DFG::AbstractState::speculateNumberUnary):
1941         (JSC::DFG::AbstractState::speculateBooleanUnary):
1942         (JSC::DFG::AbstractState::speculateInt32Binary):
1943         (JSC::DFG::AbstractState::speculateNumberBinary):
1944         (JSC::DFG::AbstractState::trySetConstant):
1945         * dfg/DFGAbstractValue.h:
1946         (AbstractValue):
1947         * dfg/DFGAdjacencyList.h:
1948         (JSC::DFG::AdjacencyList::AdjacencyList):
1949         (JSC::DFG::AdjacencyList::initialize):
1950         * dfg/DFGAllocator.h: Added.
1951         (DFG):
1952         (Allocator):
1953         (JSC::DFG::Allocator::Region::size):
1954         (JSC::DFG::Allocator::Region::headerSize):
1955         (JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
1956         (JSC::DFG::Allocator::Region::data):
1957         (JSC::DFG::Allocator::Region::isInThisRegion):
1958         (JSC::DFG::Allocator::Region::regionFor):
1959         (Region):
1960         (JSC::DFG::::Allocator):
1961         (JSC::DFG::::~Allocator):
1962         (JSC::DFG::::allocate):
1963         (JSC::DFG::::free):
1964         (JSC::DFG::::freeAll):
1965         (JSC::DFG::::reset):
1966         (JSC::DFG::::indexOf):
1967         (JSC::DFG::::allocatorOf):
1968         (JSC::DFG::::bumpAllocate):
1969         (JSC::DFG::::freeListAllocate):
1970         (JSC::DFG::::allocateSlow):
1971         (JSC::DFG::::freeRegionsStartingAt):
1972         (JSC::DFG::::startBumpingIn):
1973         * dfg/DFGArgumentsSimplificationPhase.cpp:
1974         (JSC::DFG::ArgumentsSimplificationPhase::run):
1975         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
1976         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
1977         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
1978         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
1979         (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
1980         * dfg/DFGArrayMode.cpp:
1981         (JSC::DFG::ArrayMode::originalArrayStructure):
1982         (JSC::DFG::ArrayMode::alreadyChecked):
1983         * dfg/DFGArrayMode.h:
1984         (ArrayMode):
1985         * dfg/DFGArrayifySlowPathGenerator.h:
1986         (JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
1987         * dfg/DFGBasicBlock.h:
1988         (JSC::DFG::BasicBlock::node):
1989         (JSC::DFG::BasicBlock::isInPhis):
1990         (JSC::DFG::BasicBlock::isInBlock):
1991         (BasicBlock):
1992         * dfg/DFGBasicBlockInlines.h:
1993         (DFG):
1994         * dfg/DFGByteCodeParser.cpp:
1995         (ByteCodeParser):
1996         (JSC::DFG::ByteCodeParser::getDirect):
1997         (JSC::DFG::ByteCodeParser::get):
1998         (JSC::DFG::ByteCodeParser::setDirect):
1999         (JSC::DFG::ByteCodeParser::set):
2000         (JSC::DFG::ByteCodeParser::setPair):
2001         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
2002         (JSC::DFG::ByteCodeParser::getLocal):
2003         (JSC::DFG::ByteCodeParser::setLocal):
2004         (JSC::DFG::ByteCodeParser::getArgument):
2005         (JSC::DFG::ByteCodeParser::setArgument):
2006         (JSC::DFG::ByteCodeParser::flushDirect):
2007         (JSC::DFG::ByteCodeParser::getToInt32):
2008         (JSC::DFG::ByteCodeParser::toInt32):
2009         (JSC::DFG::ByteCodeParser::getJSConstantForValue):
2010         (JSC::DFG::ByteCodeParser::getJSConstant):
2011         (JSC::DFG::ByteCodeParser::getCallee):
2012         (JSC::DFG::ByteCodeParser::getThis):
2013         (JSC::DFG::ByteCodeParser::setThis):
2014         (JSC::DFG::ByteCodeParser::isJSConstant):
2015         (JSC::DFG::ByteCodeParser::isInt32Constant):
2016         (JSC::DFG::ByteCodeParser::valueOfJSConstant):
2017         (JSC::DFG::ByteCodeParser::valueOfInt32Constant):
2018         (JSC::DFG::ByteCodeParser::constantUndefined):
2019         (JSC::DFG::ByteCodeParser::constantNull):
2020         (JSC::DFG::ByteCodeParser::one):
2021         (JSC::DFG::ByteCodeParser::constantNaN):
2022         (JSC::DFG::ByteCodeParser::cellConstant):
2023         (JSC::DFG::ByteCodeParser::addToGraph):
2024         (JSC::DFG::ByteCodeParser::insertPhiNode):
2025         (JSC::DFG::ByteCodeParser::addVarArgChild):
2026         (JSC::DFG::ByteCodeParser::addCall):
2027         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
2028         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
2029         (JSC::DFG::ByteCodeParser::getPrediction):
2030         (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
2031         (JSC::DFG::ByteCodeParser::makeSafe):
2032         (JSC::DFG::ByteCodeParser::makeDivSafe):
2033         (JSC::DFG::ByteCodeParser::ConstantRecord::ConstantRecord):
2034         (ConstantRecord):
2035         (JSC::DFG::ByteCodeParser::PhiStackEntry::PhiStackEntry):
2036         (PhiStackEntry):
2037         (JSC::DFG::ByteCodeParser::handleCall):
2038         (JSC::DFG::ByteCodeParser::emitFunctionChecks):
2039         (JSC::DFG::ByteCodeParser::handleInlining):
2040         (JSC::DFG::ByteCodeParser::setIntrinsicResult):
2041         (JSC::DFG::ByteCodeParser::handleMinMax):
2042         (JSC::DFG::ByteCodeParser::handleIntrinsic):
2043         (JSC::DFG::ByteCodeParser::handleGetByOffset):
2044         (JSC::DFG::ByteCodeParser::handleGetById):
2045         (JSC::DFG::ByteCodeParser::getScope):
2046         (JSC::DFG::ByteCodeParser::parseResolveOperations):
2047         (JSC::DFG::ByteCodeParser::parseBlock):
2048         (JSC::DFG::ByteCodeParser::processPhiStack):
2049         (JSC::DFG::ByteCodeParser::linkBlock):
2050         (JSC::DFG::ByteCodeParser::parseCodeBlock):
2051         (JSC::DFG::ByteCodeParser::parse):
2052         * dfg/DFGCFAPhase.cpp:
2053         (JSC::DFG::CFAPhase::performBlockCFA):
2054         * dfg/DFGCFGSimplificationPhase.cpp:
2055         (JSC::DFG::CFGSimplificationPhase::run):
2056         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
2057         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
2058         (JSC::DFG::CFGSimplificationPhase::fixPhis):
2059         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
2060         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
2061         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::dump):
2062         (OperandSubstitution):
2063         (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
2064         (JSC::DFG::CFGSimplificationPhase::recordNewTarget):
2065         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
2066         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
2067         * dfg/DFGCSEPhase.cpp:
2068         (JSC::DFG::CSEPhase::canonicalize):
2069         (JSC::DFG::CSEPhase::endIndexForPureCSE):
2070         (JSC::DFG::CSEPhase::pureCSE):
2071         (JSC::DFG::CSEPhase::constantCSE):
2072         (JSC::DFG::CSEPhase::weakConstantCSE):
2073         (JSC::DFG::CSEPhase::getCalleeLoadElimination):
2074         (JSC::DFG::CSEPhase::getArrayLengthElimination):
2075         (JSC::DFG::CSEPhase::globalVarLoadElimination):
2076         (JSC::DFG::CSEPhase::scopedVarLoadElimination):
2077         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
2078         (JSC::DFG::CSEPhase::globalVarStoreElimination):
2079         (JSC::DFG::CSEPhase::scopedVarStoreElimination):
2080         (JSC::DFG::CSEPhase::getByValLoadElimination):
2081         (JSC::DFG::CSEPhase::checkFunctionElimination):
2082         (JSC::DFG::CSEPhase::checkExecutableElimination):
2083         (JSC::DFG::CSEPhase::checkStructureElimination):
2084         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
2085         (JSC::DFG::CSEPhase::putStructureStoreElimination):
2086         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
2087         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
2088         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
2089         (JSC::DFG::CSEPhase::checkArrayElimination):
2090         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
2091         (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
2092         (JSC::DFG::CSEPhase::getLocalLoadElimination):
2093         (JSC::DFG::CSEPhase::setLocalStoreElimination):
2094         (JSC::DFG::CSEPhase::performSubstitution):
2095         (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
2096         (JSC::DFG::CSEPhase::setReplacement):
2097         (JSC::DFG::CSEPhase::eliminate):
2098         (JSC::DFG::CSEPhase::performNodeCSE):
2099         (JSC::DFG::CSEPhase::performBlockCSE):
2100         (CSEPhase):
2101         * dfg/DFGCommon.cpp: Added.
2102         (DFG):
2103         (JSC::DFG::NodePointerTraits::dump):
2104         * dfg/DFGCommon.h:
2105         (DFG):
2106         (JSC::DFG::NodePointerTraits::defaultValue):
2107         (NodePointerTraits):
2108         (JSC::DFG::verboseCompilationEnabled):
2109         (JSC::DFG::shouldDumpGraphAtEachPhase):
2110         (JSC::DFG::validationEnabled):
2111         * dfg/DFGConstantFoldingPhase.cpp:
2112         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2113         (JSC::DFG::ConstantFoldingPhase::isCapturedAtOrAfter):
2114         (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
2115         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
2116         * dfg/DFGDisassembler.cpp:
2117         (JSC::DFG::Disassembler::Disassembler):
2118         (JSC::DFG::Disassembler::createDumpList):
2119         (JSC::DFG::Disassembler::dumpDisassembly):
2120         * dfg/DFGDisassembler.h:
2121         (JSC::DFG::Disassembler::setForNode):
2122         (Disassembler):
2123         * dfg/DFGDriver.cpp:
2124         (JSC::DFG::compile):
2125         * dfg/DFGEdge.cpp: Added.
2126         (DFG):
2127         (JSC::DFG::Edge::dump):
2128         * dfg/DFGEdge.h:
2129         (JSC::DFG::Edge::Edge):
2130         (JSC::DFG::Edge::node):
2131         (JSC::DFG::Edge::operator*):
2132         (JSC::DFG::Edge::operator->):
2133         (Edge):
2134         (JSC::DFG::Edge::setNode):
2135         (JSC::DFG::Edge::useKind):
2136         (JSC::DFG::Edge::setUseKind):
2137         (JSC::DFG::Edge::isSet):
2138         (JSC::DFG::Edge::shift):
2139         (JSC::DFG::Edge::makeWord):
2140         (JSC::DFG::operator==):
2141         (JSC::DFG::operator!=):
2142         * dfg/DFGFixupPhase.cpp:
2143         (JSC::DFG::FixupPhase::fixupBlock):
2144         (JSC::DFG::FixupPhase::fixupNode):
2145         (JSC::DFG::FixupPhase::checkArray):
2146         (JSC::DFG::FixupPhase::blessArrayOperation):
2147         (JSC::DFG::FixupPhase::fixIntEdge):
2148         (JSC::DFG::FixupPhase::fixDoubleEdge):
2149         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
2150         (FixupPhase):
2151         * dfg/DFGGenerationInfo.h:
2152         (JSC::DFG::GenerationInfo::GenerationInfo):
2153         (JSC::DFG::GenerationInfo::initConstant):
2154         (JSC::DFG::GenerationInfo::initInteger):
2155         (JSC::DFG::GenerationInfo::initJSValue):
2156         (JSC::DFG::GenerationInfo::initCell):
2157         (JSC::DFG::GenerationInfo::initBoolean):
2158         (JSC::DFG::GenerationInfo::initDouble):
2159         (JSC::DFG::GenerationInfo::initStorage):
2160         (GenerationInfo):
2161         (JSC::DFG::GenerationInfo::node):
2162         (JSC::DFG::GenerationInfo::noticeOSRBirth):
2163         (JSC::DFG::GenerationInfo::use):
2164         (JSC::DFG::GenerationInfo::appendFill):
2165         (JSC::DFG::GenerationInfo::appendSpill):
2166         * dfg/DFGGraph.cpp:
2167         (JSC::DFG::Graph::Graph):
2168         (JSC::DFG::Graph::~Graph):
2169         (DFG):
2170         (JSC::DFG::Graph::dumpCodeOrigin):
2171         (JSC::DFG::Graph::amountOfNodeWhiteSpace):
2172         (JSC::DFG::Graph::printNodeWhiteSpace):
2173         (JSC::DFG::Graph::dump):
2174         (JSC::DFG::Graph::dumpBlockHeader):
2175         (JSC::DFG::Graph::refChildren):
2176         (JSC::DFG::Graph::derefChildren):
2177         (JSC::DFG::Graph::predictArgumentTypes):
2178         (JSC::DFG::Graph::collectGarbage):
2179         (JSC::DFG::Graph::determineReachability):
2180         (JSC::DFG::Graph::resetExitStates):
2181         * dfg/DFGGraph.h:
2182         (Graph):
2183         (JSC::DFG::Graph::ref):
2184         (JSC::DFG::Graph::deref):
2185         (JSC::DFG::Graph::changeChild):
2186         (JSC::DFG::Graph::compareAndSwap):
2187         (JSC::DFG::Graph::clearAndDerefChild):
2188         (JSC::DFG::Graph::clearAndDerefChild1):
2189         (JSC::DFG::Graph::clearAndDerefChild2):
2190         (JSC::DFG::Graph::clearAndDerefChild3):
2191         (JSC::DFG::Graph::convertToConstant):
2192         (JSC::DFG::Graph::getJSConstantSpeculation):
2193         (JSC::DFG::Graph::addSpeculationMode):
2194         (JSC::DFG::Graph::valueAddSpeculationMode):
2195         (JSC::DFG::Graph::arithAddSpeculationMode):
2196         (JSC::DFG::Graph::addShouldSpeculateInteger):
2197         (JSC::DFG::Graph::mulShouldSpeculateInteger):
2198         (JSC::DFG::Graph::negateShouldSpeculateInteger):
2199         (JSC::DFG::Graph::isConstant):
2200         (JSC::DFG::Graph::isJSConstant):
2201         (JSC::DFG::Graph::isInt32Constant):
2202         (JSC::DFG::Graph::isDoubleConstant):
2203         (JSC::DFG::Graph::isNumberConstant):
2204         (JSC::DFG::Graph::isBooleanConstant):
2205         (JSC::DFG::Graph::isCellConstant):
2206         (JSC::DFG::Graph::isFunctionConstant):
2207         (JSC::DFG::Graph::isInternalFunctionConstant):
2208         (JSC::DFG::Graph::valueOfJSConstant):
2209         (JSC::DFG::Graph::valueOfInt32Constant):
2210         (JSC::DFG::Graph::valueOfNumberConstant):
2211         (JSC::DFG::Graph::valueOfBooleanConstant):
2212         (JSC::DFG::Graph::valueOfFunctionConstant):
2213         (JSC::DFG::Graph::valueProfileFor):
2214         (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
2215         (JSC::DFG::Graph::numSuccessors):
2216         (JSC::DFG::Graph::successor):
2217         (JSC::DFG::Graph::successorForCondition):
2218         (JSC::DFG::Graph::isPredictedNumerical):
2219         (JSC::DFG::Graph::byValIsPure):
2220         (JSC::DFG::Graph::clobbersWorld):
2221         (JSC::DFG::Graph::varArgNumChildren):
2222         (JSC::DFG::Graph::numChildren):
2223         (JSC::DFG::Graph::varArgChild):
2224         (JSC::DFG::Graph::child):
2225         (JSC::DFG::Graph::voteNode):
2226         (JSC::DFG::Graph::voteChildren):
2227         (JSC::DFG::Graph::substitute):
2228         (JSC::DFG::Graph::substituteGetLocal):
2229         (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
2230         (JSC::DFG::Graph::mulImmediateShouldSpeculateInteger):
2231         * dfg/DFGInsertionSet.h:
2232         (JSC::DFG::Insertion::Insertion):
2233         (JSC::DFG::Insertion::element):
2234         (Insertion):
2235         (JSC::DFG::InsertionSet::insert):
2236         (InsertionSet):
2237         * dfg/DFGJITCompiler.cpp:
2238         * dfg/DFGJITCompiler.h:
2239         (JSC::DFG::JITCompiler::setForNode):
2240         (JSC::DFG::JITCompiler::addressOfDoubleConstant):
2241         (JSC::DFG::JITCompiler::noticeOSREntry):
2242         * dfg/DFGLongLivedState.cpp: Added.
2243         (DFG):
2244         (JSC::DFG::LongLivedState::LongLivedState):
2245         (JSC::DFG::LongLivedState::~LongLivedState):
2246         (JSC::DFG::LongLivedState::shrinkToFit):
2247         * dfg/DFGLongLivedState.h: Added.
2248         (DFG):
2249         (LongLivedState):
2250         * dfg/DFGMinifiedID.h:
2251         (JSC::DFG::MinifiedID::MinifiedID):
2252         (JSC::DFG::MinifiedID::node):
2253         * dfg/DFGMinifiedNode.cpp:
2254         (JSC::DFG::MinifiedNode::fromNode):
2255         * dfg/DFGMinifiedNode.h:
2256         (MinifiedNode):
2257         * dfg/DFGNode.cpp: Added.
2258         (DFG):
2259         (JSC::DFG::Node::index):
2260         (WTF):
2261         (WTF::printInternal):
2262         * dfg/DFGNode.h:
2263         (DFG):
2264         (JSC::DFG::Node::Node):
2265         (Node):
2266         (JSC::DFG::Node::convertToGetByOffset):
2267         (JSC::DFG::Node::convertToPutByOffset):
2268         (JSC::DFG::Node::ref):
2269         (JSC::DFG::Node::shouldSpeculateInteger):
2270         (JSC::DFG::Node::shouldSpeculateIntegerForArithmetic):
2271         (JSC::DFG::Node::shouldSpeculateIntegerExpectingDefined):
2272         (JSC::DFG::Node::shouldSpeculateDoubleForArithmetic):
2273         (JSC::DFG::Node::shouldSpeculateNumber):
2274         (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
2275         (JSC::DFG::Node::shouldSpeculateFinalObject):
2276         (JSC::DFG::Node::shouldSpeculateArray):
2277         (JSC::DFG::Node::dumpChildren):
2278         (WTF):
2279         * dfg/DFGNodeAllocator.h: Added.
2280         (DFG):
2281         (operator new ):
2282         * dfg/DFGOSRExit.cpp:
2283         (JSC::DFG::OSRExit::OSRExit):
2284         * dfg/DFGOSRExit.h:
2285         (OSRExit):
2286         (SpeculationFailureDebugInfo):
2287         * dfg/DFGOSRExitCompiler.cpp:
2288         * dfg/DFGOSRExitCompiler32_64.cpp:
2289         (JSC::DFG::OSRExitCompiler::compileExit):
2290         * dfg/DFGOSRExitCompiler64.cpp:
2291         (JSC::DFG::OSRExitCompiler::compileExit):
2292         * dfg/DFGOperations.cpp:
2293         * dfg/DFGPhase.cpp:
2294         (DFG):
2295         (JSC::DFG::Phase::beginPhase):
2296         (JSC::DFG::Phase::endPhase):
2297         * dfg/DFGPhase.h:
2298         (Phase):
2299         (JSC::DFG::runAndLog):
2300         * dfg/DFGPredictionPropagationPhase.cpp:
2301         (JSC::DFG::PredictionPropagationPhase::setPrediction):
2302         (JSC::DFG::PredictionPropagationPhase::mergePrediction):
2303         (JSC::DFG::PredictionPropagationPhase::isNotNegZero):
2304         (JSC::DFG::PredictionPropagationPhase::isNotZero):
2305         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoForConstant):
2306         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoNonRecursive):
2307         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwo):
2308         (JSC::DFG::PredictionPropagationPhase::propagate):
2309         (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags):
2310         (JSC::DFG::PredictionPropagationPhase::propagateForward):
2311         (JSC::DFG::PredictionPropagationPhase::propagateBackward):
2312         (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
2313         (PredictionPropagationPhase):
2314         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
2315         * dfg/DFGScoreBoard.h:
2316         (JSC::DFG::ScoreBoard::ScoreBoard):
2317         (JSC::DFG::ScoreBoard::use):
2318         (JSC::DFG::ScoreBoard::useIfHasResult):
2319         (ScoreBoard):
2320         * dfg/DFGSilentRegisterSavePlan.h:
2321         (JSC::DFG::SilentRegisterSavePlan::SilentRegisterSavePlan):
2322         (JSC::DFG::SilentRegisterSavePlan::node):
2323         (SilentRegisterSavePlan):
2324         * dfg/DFGSlowPathGenerator.h:
2325         (JSC::DFG::SlowPathGenerator::SlowPathGenerator):
2326         (JSC::DFG::SlowPathGenerator::generate):
2327         (SlowPathGenerator):
2328         * dfg/DFGSpeculativeJIT.cpp:
2329         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
2330         (JSC::DFG::SpeculativeJIT::speculationCheck):
2331         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
2332         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
2333         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
2334         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
2335         (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
2336         (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
2337         (JSC::DFG::SpeculativeJIT::silentSpill):
2338         (JSC::DFG::SpeculativeJIT::silentFill):
2339         (JSC::DFG::SpeculativeJIT::checkArray):
2340         (JSC::DFG::SpeculativeJIT::arrayify):
2341         (JSC::DFG::SpeculativeJIT::fillStorage):
2342         (JSC::DFG::SpeculativeJIT::useChildren):
2343         (JSC::DFG::SpeculativeJIT::isStrictInt32):
2344         (JSC::DFG::SpeculativeJIT::isKnownInteger):
2345         (JSC::DFG::SpeculativeJIT::isKnownNumeric):
2346         (JSC::DFG::SpeculativeJIT::isKnownCell):
2347         (JSC::DFG::SpeculativeJIT::isKnownNotCell):
2348         (JSC::DFG::SpeculativeJIT::isKnownNotInteger):
2349         (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
2350         (JSC::DFG::SpeculativeJIT::writeBarrier):
2351         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
2352         (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
2353         (JSC::DFG::GPRTemporary::GPRTemporary):
2354         (JSC::DFG::FPRTemporary::FPRTemporary):
2355         (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
2356         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
2357         (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
2358         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
2359         (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
2360         (JSC::DFG::SpeculativeJIT::compileMovHint):
2361         (JSC::DFG::SpeculativeJIT::compile):
2362         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
2363         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
2364         (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
2365         (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
2366         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
2367         (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
2368         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
2369         (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
2370         (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
2371         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
2372         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
2373         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
2374         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
2375         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
2376         (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
2377         (JSC::DFG::SpeculativeJIT::compileInstanceOf):
2378         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
2379         (JSC::DFG::SpeculativeJIT::compileAdd):
2380         (JSC::DFG::SpeculativeJIT::compileArithSub):
2381         (JSC::DFG::SpeculativeJIT::compileArithNegate):
2382         (JSC::DFG::SpeculativeJIT::compileArithMul):
2383         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
2384         (JSC::DFG::SpeculativeJIT::compileArithMod):
2385         (JSC::DFG::SpeculativeJIT::compare):
2386         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
2387         (JSC::DFG::SpeculativeJIT::compileStrictEq):
2388         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
2389         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
2390         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
2391         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
2392         (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
2393         (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
2394         (JSC::DFG::SpeculativeJIT::compileRegExpExec):
2395         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
2396         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
2397         * dfg/DFGSpeculativeJIT.h:
2398         (SpeculativeJIT):
2399         (JSC::DFG::SpeculativeJIT::canReuse):
2400         (JSC::DFG::SpeculativeJIT::isFilled):
2401         (JSC::DFG::SpeculativeJIT::isFilledDouble):
2402         (JSC::DFG::SpeculativeJIT::use):
2403         (JSC::DFG::SpeculativeJIT::isConstant):
2404         (JSC::DFG::SpeculativeJIT::isJSConstant):
2405         (JSC::DFG::SpeculativeJIT::isInt32Constant):
2406         (JSC::DFG::SpeculativeJIT::isDoubleConstant):
2407         (JSC::DFG::SpeculativeJIT::isNumberConstant):
2408         (JSC::DFG::SpeculativeJIT::isBooleanConstant):
2409         (JSC::DFG::SpeculativeJIT::isFunctionConstant):
2410         (JSC::DFG::SpeculativeJIT::valueOfInt32Constant):
2411         (JSC::DFG::SpeculativeJIT::valueOfNumberConstant):
2412         (JSC::DFG::SpeculativeJIT::valueOfNumberConstantAsInt32):
2413         (JSC::DFG::SpeculativeJIT::addressOfDoubleConstant):
2414         (JSC::DFG::SpeculativeJIT::valueOfJSConstant):
2415         (JSC::DFG::SpeculativeJIT::valueOfBooleanConstant):
2416         (JSC::DFG::SpeculativeJIT::valueOfFunctionConstant):
2417         (JSC::DFG::SpeculativeJIT::isNullConstant):
2418         (JSC::DFG::SpeculativeJIT::valueOfJSConstantAsImm64):
2419         (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
2420         (JSC::DFG::SpeculativeJIT::integerResult):
2421         (JSC::DFG::SpeculativeJIT::noResult):
2422         (JSC::DFG::SpeculativeJIT::cellResult):
2423         (JSC::DFG::SpeculativeJIT::booleanResult):
2424         (JSC::DFG::SpeculativeJIT::jsValueResult):
2425         (JSC::DFG::SpeculativeJIT::storageResult):
2426         (JSC::DFG::SpeculativeJIT::doubleResult):
2427         (JSC::DFG::SpeculativeJIT::initConstantInfo):
2428         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
2429         (JSC::DFG::SpeculativeJIT::isInteger):
2430         (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
2431         (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
2432         (JSC::DFG::SpeculativeJIT::setNodeForOperand):
2433         (JSC::DFG::IntegerOperand::IntegerOperand):
2434         (JSC::DFG::IntegerOperand::node):
2435         (JSC::DFG::IntegerOperand::gpr):
2436         (JSC::DFG::IntegerOperand::use):
2437         (IntegerOperand):
2438         (JSC::DFG::DoubleOperand::DoubleOperand):
2439         (JSC::DFG::DoubleOperand::node):
2440         (JSC::DFG::DoubleOperand::fpr):
2441         (JSC::DFG::DoubleOperand::use):
2442         (DoubleOperand):
2443         (JSC::DFG::JSValueOperand::JSValueOperand):
2444         (JSC::DFG::JSValueOperand::node):
2445         (JSC::DFG::JSValueOperand::gpr):
2446         (JSC::DFG::JSValueOperand::fill):
2447         (JSC::DFG::JSValueOperand::use):
2448         (JSValueOperand):
2449         (JSC::DFG::StorageOperand::StorageOperand):
2450         (JSC::DFG::StorageOperand::node):
2451         (JSC::DFG::StorageOperand::gpr):
2452         (JSC::DFG::StorageOperand::use):
2453         (StorageOperand):
2454         (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
2455         (JSC::DFG::SpeculateIntegerOperand::node):
2456         (JSC::DFG::SpeculateIntegerOperand::gpr):
2457         (JSC::DFG::SpeculateIntegerOperand::use):
2458         (SpeculateIntegerOperand):
2459         (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
2460         (JSC::DFG::SpeculateStrictInt32Operand::node):
2461         (JSC::DFG::SpeculateStrictInt32Operand::gpr):
2462         (JSC::DFG::SpeculateStrictInt32Operand::use):
2463         (SpeculateStrictInt32Operand):
2464         (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
2465         (JSC::DFG::SpeculateDoubleOperand::node):
2466         (JSC::DFG::SpeculateDoubleOperand::fpr):
2467         (JSC::DFG::SpeculateDoubleOperand::use):
2468         (SpeculateDoubleOperand):
2469         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
2470         (JSC::DFG::SpeculateCellOperand::node):
2471         (JSC::DFG::SpeculateCellOperand::gpr):
2472         (JSC::DFG::SpeculateCellOperand::use):
2473         (SpeculateCellOperand):
2474         (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
2475         (JSC::DFG::SpeculateBooleanOperand::node):
2476         (JSC::DFG::SpeculateBooleanOperand::gpr):
2477         (JSC::DFG::SpeculateBooleanOperand::use):
2478         (SpeculateBooleanOperand):
2479         * dfg/DFGSpeculativeJIT32_64.cpp:
2480         (JSC::DFG::SpeculativeJIT::fillInteger):
2481         (JSC::DFG::SpeculativeJIT::fillDouble):
2482         (JSC::DFG::SpeculativeJIT::fillJSValue):
2483         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
2484         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
2485         (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
2486         (JSC::DFG::SpeculativeJIT::cachedPutById):
2487         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
2488         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
2489         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
2490         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
2491         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
2492         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
2493         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
2494         (JSC::DFG::SpeculativeJIT::emitCall):
2495         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
2496         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
2497         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
2498         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
2499         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
2500         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
2501         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
2502         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
2503         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
2504         (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
2505         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
2506         (JSC::DFG::SpeculativeJIT::compileValueAdd):
2507         (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
2508         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
2509         (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
2510         (JSC::DFG::SpeculativeJIT::emitBranch):
2511         (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
2512         (JSC::DFG::SpeculativeJIT::compile):
2513         * dfg/DFGSpeculativeJIT64.cpp:
2514         (JSC::DFG::SpeculativeJIT::fillInteger):
2515         (JSC::DFG::SpeculativeJIT::fillDouble):
2516         (JSC::DFG::SpeculativeJIT::fillJSValue):
2517         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
2518         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
2519         (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
2520         (JSC::DFG::SpeculativeJIT::cachedPutById):
2521         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
2522         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
2523         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
2524         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
2525         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
2526         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
2527         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
2528         (JSC::DFG::SpeculativeJIT::emitCall):
2529         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
2530         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
2531         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
2532         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
2533         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
2534         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
2535         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
2536         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
2537         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
2538         (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
2539         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
2540         (JSC::DFG::SpeculativeJIT::compileValueAdd):
2541         (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
2542         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
2543         (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
2544         (JSC::DFG::SpeculativeJIT::emitBranch):
2545         (JSC::DFG::SpeculativeJIT::compile):
2546         * dfg/DFGStructureAbstractValue.h:
2547         (StructureAbstractValue):
2548         * dfg/DFGStructureCheckHoistingPhase.cpp:
2549         (JSC::DFG::StructureCheckHoistingPhase::run):
2550         * dfg/DFGValidate.cpp:
2551         (DFG):
2552         (Validate):
2553         (JSC::DFG::Validate::validate):
2554         (JSC::DFG::Validate::reportValidationContext):
2555         * dfg/DFGValidate.h:
2556         * dfg/DFGValueSource.cpp:
2557         (JSC::DFG::ValueSource::dump):
2558         * dfg/DFGValueSource.h:
2559         (JSC::DFG::ValueSource::ValueSource):
2560         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
2561         (JSC::DFG::VirtualRegisterAllocationPhase::run):
2562         * runtime/FunctionExecutableDump.cpp: Added.
2563         (JSC):
2564         (JSC::FunctionExecutableDump::dump):
2565         * runtime/FunctionExecutableDump.h: Added.
2566         (JSC):
2567         (FunctionExecutableDump):
2568         (JSC::FunctionExecutableDump::FunctionExecutableDump):
2569         * runtime/JSGlobalData.cpp:
2570         (JSC::JSGlobalData::JSGlobalData):
2571         * runtime/JSGlobalData.h:
2572         (JSC):
2573         (DFG):
2574         (JSGlobalData):
2575         * runtime/Options.h:
2576         (JSC):
2577
2578 2013-01-28  Laszlo Gombos  <l.gombos@samsung.com>
2579
2580         Collapse testing for a list of PLATFORM() into OS() and USE() tests
2581         https://bugs.webkit.org/show_bug.cgi?id=108018
2582
2583         Reviewed by Eric Seidel.
2584
2585         No functional change as "OS(DARWIN) && USE(CF)" equals to the
2586         following platforms: MAC, WX, QT and CHROMIUM. CHROMIUM
2587         is not using JavaScriptCore.
2588
2589         * runtime/DatePrototype.cpp:
2590         (JSC):
2591
2592 2013-01-28  Geoffrey Garen  <ggaren@apple.com>
2593
2594         Static size inference for JavaScript objects
2595         https://bugs.webkit.org/show_bug.cgi?id=108093
2596
2597         Reviewed by Phil Pizlo.
2598
2599         * API/JSObjectRef.cpp:
2600         * JavaScriptCore.order:
2601         * JavaScriptCore.xcodeproj/project.pbxproj: Pay the tax man.
2602
2603         * bytecode/CodeBlock.cpp:
2604         (JSC::CodeBlock::dumpBytecode): op_new_object and op_create_this now
2605         have an extra inferredInlineCapacity argument. This is the statically
2606         inferred inline capacity, just from analyzing source text. op_new_object
2607         also gets a pointer to an allocation profile. (For op_create_this, the
2608         profile is in the construtor function.)
2609
2610         (JSC::CodeBlock::CodeBlock): Link op_new_object.
2611
2612         (JSC::CodeBlock::stronglyVisitStrongReferences): Mark our profiles.
2613
2614         * bytecode/CodeBlock.h:
2615         (CodeBlock): Removed some dead code. Added object allocation profiles.
2616
2617         * bytecode/Instruction.h:
2618         (JSC): New union type, since an instruction operand may point to an
2619         object allocation profile now.
2620
2621         * bytecode/ObjectAllocationProfile.h: Added.
2622         (JSC):
2623         (ObjectAllocationProfile):
2624         (JSC::ObjectAllocationProfile::offsetOfAllocator):
2625         (JSC::ObjectAllocationProfile::offsetOfStructure):
2626         (JSC::ObjectAllocationProfile::ObjectAllocationProfile):
2627         (JSC::ObjectAllocationProfile::isNull):
2628         (JSC::ObjectAllocationProfile::initialize):
2629         (JSC::ObjectAllocationProfile::structure):
2630         (JSC::ObjectAllocationProfile::inlineCapacity):
2631         (JSC::ObjectAllocationProfile::clear):
2632         (JSC::ObjectAllocationProfile::visitAggregate):
2633         (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount): New class
2634         for tracking a prediction about object allocation: structure, inline
2635         capacity, allocator to use.
2636
2637         * bytecode/Opcode.h:
2638         (JSC):
2639         (JSC::padOpcodeName): Updated instruction sizes.
2640
2641         * bytecode/UnlinkedCodeBlock.cpp:
2642         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
2643         * bytecode/UnlinkedCodeBlock.h:
2644         (JSC):
2645         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile):
2646         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles):
2647         (UnlinkedCodeBlock): Unlinked support for allocation profiles.
2648
2649         * bytecompiler/BytecodeGenerator.cpp:
2650         (JSC::BytecodeGenerator::generate): Kill all remaining analyses at the
2651         end of codegen, since this is our last opportunity.
2652
2653         (JSC::BytecodeGenerator::BytecodeGenerator): Added a static property
2654         analyzer to bytecode generation. It tracks initializing assignments and
2655         makes a guess about how many will happen.
2656
2657         (JSC::BytecodeGenerator::newObjectAllocationProfile):
2658         (JSC):
2659         (JSC::BytecodeGenerator::emitProfiledOpcode):
2660         (JSC::BytecodeGenerator::emitMove):
2661         (JSC::BytecodeGenerator::emitResolve):
2662         (JSC::BytecodeGenerator::emitResolveBase):
2663         (JSC::BytecodeGenerator::emitResolveBaseForPut):
2664         (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
2665         (JSC::BytecodeGenerator::emitResolveWithThis):
2666         (JSC::BytecodeGenerator::emitGetById):
2667         (JSC::BytecodeGenerator::emitPutById):
2668         (JSC::BytecodeGenerator::emitDirectPutById):
2669         (JSC::BytecodeGenerator::emitPutGetterSetter):
2670         (JSC::BytecodeGenerator::emitGetArgumentByVal):
2671         (JSC::BytecodeGenerator::emitGetByVal): Added hooks to the static property
2672         analyzer, so it can observe allocations and stores.
2673
2674         (JSC::BytecodeGenerator::emitCreateThis): Factored this into a helper
2675         function because it was a significant amount of logic, and I wanted to
2676         add to it.
2677
2678         (JSC::BytecodeGenerator::emitNewObject):
2679         (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
2680         (JSC::BytecodeGenerator::emitCall):
2681         (JSC::BytecodeGenerator::emitCallVarargs):
2682         (JSC::BytecodeGenerator::emitConstruct): Added a hook to profiled opcodes
2683         to track their stores, in case a store kills a profiled allocation. Since
2684         profiled opcodes are basically the only interesting stores we do, this
2685         is a convenient place to notice any store that might kill an allocation.
2686
2687         * bytecompiler/BytecodeGenerator.h:
2688         (BytecodeGenerator): As above.
2689
2690         * bytecompiler/StaticPropertyAnalysis.h: Added.
2691         (JSC):
2692         (StaticPropertyAnalysis):
2693         (JSC::StaticPropertyAnalysis::create):
2694         (JSC::StaticPropertyAnalysis::addPropertyIndex):
2695         (JSC::StaticPropertyAnalysis::record):
2696         (JSC::StaticPropertyAnalysis::propertyIndexCount):
2697         (JSC::StaticPropertyAnalysis::StaticPropertyAnalysis): Simple helper
2698         class for tracking allocations and stores.
2699
2700         * bytecompiler/StaticPropertyAnalyzer.h: Added.
2701         (StaticPropertyAnalyzer):
2702         (JSC::StaticPropertyAnalyzer::StaticPropertyAnalyzer):
2703         (JSC::StaticPropertyAnalyzer::createThis):
2704         (JSC::StaticPropertyAnalyzer::newObject):
2705         (JSC::StaticPropertyAnalyzer::putById):
2706         (JSC::StaticPropertyAnalyzer::mov):
2707         (JSC::StaticPropertyAnalyzer::kill): Helper class for observing allocations
2708         and stores and making an inline capacity guess. The heuristics here are
2709         intentionally minimal because we don't want this one class to try to
2710         re-create something like a DFG or a runtime analysis. If we discover that
2711         we need those kinds of analyses, we should just replace this class with
2712         something else.
2713
2714         This class tracks multiple registers that alias the same object -- that
2715         happens a lot, when moving locals into temporary registers -- but it
2716         doesn't track control flow or multiple objects that alias the same register.
2717
2718         * dfg/DFGAbstractState.cpp:
2719         (JSC::DFG::AbstractState::execute): Updated for rename.
2720
2721         * dfg/DFGByteCodeParser.cpp:
2722         (JSC::DFG::ByteCodeParser::parseBlock): Updated for inline capacity and
2723         allocation profile.
2724
2725         * dfg/DFGNode.h:
2726         (JSC::DFG::Node::hasInlineCapacity):
2727         (Node):
2728         (JSC::DFG::Node::inlineCapacity):
2729         (JSC::DFG::Node::hasFunction): Give the graph a good way to represent
2730         inline capacity for an allocation.
2731
2732         * dfg/DFGNodeType.h:
2733         (DFG): Updated for rename.
2734
2735         * dfg/DFGOperations.cpp: Updated for interface change.
2736
2737         * dfg/DFGOperations.h: We pass the inline capacity to the slow case as
2738         an argument. This is the simplest way, since it's stored as a bytecode operand.
2739
2740         * dfg/DFGPredictionPropagationPhase.cpp:
2741         (JSC::DFG::PredictionPropagationPhase::propagate): Updated for rename.
2742
2743         * dfg/DFGRepatch.cpp:
2744         (JSC::DFG::tryCacheGetByID): Fixed a horrible off-by-one-half bug that only
2745         appears when doing an inline cached load for property number 64 on a 32-bit
2746         system. In JSVALUE32_64 land, "offsetRelativeToPatchedStorage" is the
2747         offset of the 64bit JSValue -- but we'll actually issue two loads, one for
2748         the payload at that offset, and one for the tag at that offset + 4. We need
2749         to ensure that both loads have a compact representation, or we'll corrupt
2750         the instruction stream.
2751
2752         * dfg/DFGSpeculativeJIT.cpp:
2753         (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
2754         * dfg/DFGSpeculativeJIT.h:
2755         (JSC::DFG::SpeculativeJIT::callOperation):
2756         (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
2757         (SpeculativeJIT):
2758         (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
2759         * dfg/DFGSpeculativeJIT32_64.cpp:
2760         (JSC::DFG::SpeculativeJIT::compile):
2761         * dfg/DFGSpeculativeJIT64.cpp:
2762         (JSC::DFG::SpeculativeJIT::compile): Lots of refactoring to support
2763         passing an allocator to our allocation function, and/or passing a Structure
2764         as a register instead of an immediate.
2765
2766         * heap/MarkedAllocator.h:
2767         (DFG):
2768         (MarkedAllocator):
2769         (JSC::MarkedAllocator::offsetOfFreeListHead): Added an accessor to simplify
2770         JIT code generation of allocation from an arbitrary allocator.
2771
2772         * jit/JIT.h:
2773         (JSC):
2774         * jit/JITInlines.h:
2775         (JSC):
2776         (JSC::JIT::emitAllocateJSObject):
2777         * jit/JITOpcodes.cpp:
2778         (JSC::JIT::emit_op_new_object):
2779         (JSC::JIT::emitSlow_op_new_object):
2780         (JSC::JIT::emit_op_create_this):
2781         (JSC::JIT::emitSlow_op_create_this):
2782         * jit/JITOpcodes32_64.cpp:
2783         (JSC::JIT::emit_op_new_object):
2784         (JSC::JIT::emitSlow_op_new_object):
2785         (JSC::JIT::emit_op_create_this):
2786         (JSC::JIT::emitSlow_op_create_this): Same refactoring as done for the DFG.
2787
2788         * jit/JITStubs.cpp:
2789         (JSC::tryCacheGetByID): Fixed the same bug mentioned above.
2790
2791         (JSC::DEFINE_STUB_FUNCTION): Updated for interface changes.
2792
2793         * llint/LLIntData.cpp:
2794         (JSC::LLInt::Data::performAssertions): Updated for interface changes.
2795
2796         * llint/LLIntSlowPaths.cpp:
2797         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2798         * llint/LowLevelInterpreter.asm:
2799         * llint/LowLevelInterpreter32_64.asm:
2800         * llint/LowLevelInterpreter64.asm: Same refactoring as for the JITs.
2801
2802         * profiler/ProfilerBytecode.cpp:
2803         * profiler/ProfilerBytecodes.cpp:
2804         * profiler/ProfilerCompilation.cpp:
2805         * profiler/ProfilerCompiledBytecode.cpp:
2806         * profiler/ProfilerDatabase.cpp:
2807         * profiler/ProfilerOSRExit.cpp:
2808         * profiler/ProfilerOrigin.cpp:
2809         * profiler/ProfilerProfiledBytecodes.cpp: Include ObjectConstructor.h
2810         because that's where createEmptyObject() lives now.
2811
2812         * runtime/Executable.h:
2813         (JSC::JSFunction::JSFunction): Updated for rename.
2814
2815         * runtime/JSCellInlines.h:
2816         (JSC::allocateCell): Updated to match the allocator selection code in
2817         the JIT, so it's clearer that both are correct.
2818
2819         * runtime/JSFunction.cpp:
2820         (JSC::JSFunction::JSFunction):
2821         (JSC::JSFunction::createAllocationProfile):
2822         (JSC::JSFunction::visitChildren):
2823         (JSC::JSFunction::getOwnPropertySlot):
2824         (JSC::JSFunction::put):
2825         (JSC::JSFunction::defineOwnProperty):
2826         (JSC::JSFunction::getConstructData):
2827         * runtime/JSFunction.h:
2828         (JSC::JSFunction::offsetOfScopeChain):
2829         (JSC::JSFunction::offsetOfExecutable):
2830         (JSC::JSFunction::offsetOfAllocationProfile):
2831         (JSC::JSFunction::allocationProfile):
2832         (JSFunction):
2833         (JSC::JSFunction::tryGetAllocationProfile):
2834         (JSC::JSFunction::addAllocationProfileWatchpoint): Changed inheritorID
2835         data member to be an ObjectAllocationProfile, which includes a pointer
2836         to the desired allocator. This simplifies JIT code, since we don't have
2837         to compute the allocator on the fly. I verified by code inspection that
2838         JSFunction is still only 64 bytes.
2839
2840         * runtime/JSGlobalObject.cpp:
2841         (JSC::JSGlobalObject::reset):
2842         (JSC::JSGlobalObject::visitChildren):
2843         * runtime/JSGlobalObject.h:
2844         (JSGlobalObject):
2845         (JSC::JSGlobalObject::dateStructure): No direct pointer to the empty
2846         object structure anymore, because now clients need to specify how much
2847         inline capacity they want.
2848
2849         * runtime/JSONObject.cpp:
2850         * runtime/JSObject.h:
2851         (JSC):
2852         (JSFinalObject):
2853         (JSC::JSFinalObject::defaultInlineCapacity):
2854         (JSC::JSFinalObject::maxInlineCapacity):
2855         (JSC::JSFinalObject::createStructure): A little refactoring to try to
2856         clarify where some of these constants derive from.
2857
2858         (JSC::maxOffsetRelativeToPatchedStorage): Used for bug fix, above.
2859
2860         * runtime/JSProxy.cpp:
2861         (JSC::JSProxy::setTarget): Ugly, but effective.
2862
2863         * runtime/LiteralParser.cpp:
2864         * runtime/ObjectConstructor.cpp:
2865         (JSC::constructObject):
2866         (JSC::constructWithObjectConstructor):
2867         (JSC::callObjectConstructor):
2868         (JSC::objectConstructorCreate): Updated for interface changes.
2869
2870         * runtime/ObjectConstructor.h:
2871         (JSC::constructEmptyObject): Clarified your options for how to allocate
2872         an empty object, to emphasize what things can actually vary.
2873
2874         * runtime/PropertyOffset.h: These constants have moved because they're
2875         really higher level concepts to do with the layout of objects and the
2876         collector. PropertyOffset is just an abstract number line, independent
2877         of those things.
2878
2879         * runtime/PrototypeMap.cpp:
2880         (JSC::PrototypeMap::emptyObjectStructureForPrototype):
2881         (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
2882         * runtime/PrototypeMap.h:
2883         (PrototypeMap): The map key is now a pair of prototype and inline capacity,
2884         since Structure encodes inline capacity.
2885
2886         * runtime/Structure.cpp:
2887         (JSC::Structure::Structure):
2888         (JSC::Structure::materializePropertyMap):
2889         (JSC::Structure::addPropertyTransition):
2890         (JSC::Structure::nonPropertyTransition):
2891         (JSC::Structure::copyPropertyTableForPinning):
2892         * runtime/Structure.h:
2893         (Structure):
2894         (JSC::Structure::totalStorageSize):
2895         (JSC::Structure::transitionCount):
2896         (JSC::Structure::create): Fixed a nasty refactoring bug that only shows
2897         up after enabling variable-sized inline capacities: we were passing our
2898         type info where our inline capacity was expected. The compiler didn't
2899         notice because both have type int :(.
2900
2901 2013-01-28  Oliver Hunt  <oliver@apple.com>
2902
2903         Add more assertions to the property storage use in arrays
2904         https://bugs.webkit.org/show_bug.cgi?id=107728
2905
2906         Reviewed by Filip Pizlo.
2907
2908         Add a bunch of assertions to array and object butterfly
2909         usage.  This should make debugging somewhat easier.
2910
2911         I also converted a couple of assertions to release asserts
2912         as they were so low cost it seemed a sensible thing to do.
2913
2914         * runtime/JSArray.cpp:
2915         (JSC::JSArray::sortVector):
2916         (JSC::JSArray::compactForSorting):
2917         * runtime/JSObject.h:
2918         (JSC::JSObject::getHolyIndexQuickly):
2919
2920 2013-01-28  Adam Barth  <abarth@webkit.org>
2921
2922         Remove webkitNotifications.createHTMLNotification
2923         https://bugs.webkit.org/show_bug.cgi?id=107598
2924
2925         Reviewed by Benjamin Poulain.
2926
2927         * Configurations/FeatureDefines.xcconfig:
2928
2929 2013-01-28  Michael Saboff  <msaboff@apple.com>
2930
2931         Cleanup ARM version of debugName() in DFGFPRInfo.h
2932         https://bugs.webkit.org/show_bug.cgi?id=108090
2933
2934         Reviewed by David Kilzer.
2935
2936         Fixed debugName() so it will compile by adding static_cast<int> and missing commas.
2937
2938         * dfg/DFGFPRInfo.h:
2939         (JSC::DFG::FPRInfo::debugName):
2940
2941 2013-01-27  Andreas Kling  <akling@apple.com>
2942
2943         JSC: FunctionParameters are memory hungry.
2944         <http://webkit.org/b/108033>
2945         <rdar://problem/13094803>
2946
2947         Reviewed by Sam Weinig.
2948
2949         Instead of inheriting from Vector<Identifier>, make FunctionParameters a simple fixed-size array
2950         with a custom-allocating create() function. Removes one step of indirection and cuts memory usage
2951         roughly in half.
2952
2953         2.73 MB progression on Membuster3.
2954
2955         * bytecode/UnlinkedCodeBlock.cpp:
2956         (JSC::UnlinkedFunctionExecutable::paramString):
2957         * bytecompiler/BytecodeGenerator.cpp:
2958         (JSC::BytecodeGenerator::BytecodeGenerator):
2959         * parser/Nodes.cpp:
2960         (JSC::FunctionParameters::create):
2961         (JSC::FunctionParameters::FunctionParameters):
2962         (JSC::FunctionParameters::~FunctionParameters):
2963         * parser/Nodes.h:
2964         (FunctionParameters):
2965         (JSC::FunctionParameters::size):
2966         (JSC::FunctionParameters::at):
2967         (JSC::FunctionParameters::identifiers):
2968
2969 2013-01-27  Andreas Kling  <akling@apple.com>
2970
2971         JSC: SourceProviderCache is memory hungry.
2972         <http://webkit.org/b/108029>
2973         <rdar://problem/13094806>
2974
2975         Reviewed by Sam Weinig.
2976
2977         Use fixed-size arrays for SourceProviderCacheItem's lists of captured variables.
2978         Since the lists never change after the object is created, there's no need to keep them in Vectors
2979         and we can instead create the whole cache item in a single allocation.
2980
2981         13.37 MB progression on Membuster3.
2982
2983         * parser/Parser.cpp:
2984         (JSC::::parseFunctionInfo):
2985         * parser/Parser.h:
2986         (JSC::Scope::copyCapturedVariablesToVector):
2987         (JSC::Scope::fillParametersForSourceProviderCache):
2988         (JSC::Scope::restoreFromSourceProviderCache):
2989         * parser/SourceProviderCacheItem.h:
2990         (SourceProviderCacheItemCreationParameters):
2991         (SourceProviderCacheItem):
2992         (JSC::SourceProviderCacheItem::approximateByteSize):
2993         (JSC::SourceProviderCacheItem::usedVariables):
2994         (JSC::SourceProviderCacheItem::writtenVariables):
2995         (JSC::SourceProviderCacheItem::~SourceProviderCacheItem):
2996         (JSC::SourceProviderCacheItem::create):
2997         (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
2998
2999 2013-01-27  Zoltan Arvai  <zarvai@inf.u-szeged.hu>
3000
3001         Fixing atomicIncrement implementation for Windows by dropping support before XP SP2.
3002         https://bugs.webkit.org/show_bug.cgi?id=106740
3003
3004         Reviewed by Benjamin Poulain.
3005
3006         * config.h:
3007
3008 2013-01-25  Filip Pizlo  <fpizlo@apple.com>
3009
3010         DFG variable event stream shouldn't use NodeIndex
3011         https://bugs.webkit.org/show_bug.cgi?id=107996
3012
3013         Reviewed by Oliver Hunt.
3014
3015         Introduce the notion of a DFG::MinifiedID, which is just a unique ID of a DFG Node.
3016         Internally it currently uses a NodeIndex, but we could change this without having
3017         to recode all of the users of MinifiedID. This effectively decouples the OSR exit
3018         compiler's way of identifying nodes from the speculative JIT's way of identifying
3019         nodes, and should make it easier to make changes to the speculative JIT's internals
3020         in the future.
3021
3022         Also changed variable event stream logging to exclude information about births and
3023         deaths of constants, since the OSR exit compiler never cares about which register
3024         holds a constant; if a value is constant then the OSR exit compiler can reify it.
3025
3026         Also changed the variable event stream's value recovery computation to use a
3027         HashMap keyed by MinifiedID rather than a Vector indexed by NodeIndex.
3028
3029         This appears to be performance-neutral. It's primarily meant as a small step
3030         towards https://bugs.webkit.org/show_bug.cgi?id=106868.
3031
3032         * GNUmakefile.list.am:
3033         * JavaScriptCore.xcodeproj/project.pbxproj:
3034         * dfg/DFGGenerationInfo.h:
3035         (JSC::DFG::GenerationInfo::GenerationInfo):
3036         (JSC::DFG::GenerationInfo::initConstant):
3037         (JSC::DFG::GenerationInfo::initInteger):
3038         (JSC::DFG::GenerationInfo::initJSValue):
3039         (JSC::DFG::GenerationInfo::initCell):
3040         (JSC::DFG::GenerationInfo::initBoolean):
3041         (JSC::DFG::GenerationInfo::initDouble):
3042         (JSC::DFG::GenerationInfo::initStorage):
3043         (JSC::DFG::GenerationInfo::noticeOSRBirth):
3044         (JSC::DFG::GenerationInfo::use):
3045         (JSC::DFG::GenerationInfo::appendFill):
3046         (JSC::DFG::GenerationInfo::appendSpill):
3047         (GenerationInfo):
3048         * dfg/DFGJITCompiler.cpp:
3049         (JSC::DFG::JITCompiler::link):
3050         * dfg/DFGMinifiedGraph.h:
3051         (JSC::DFG::MinifiedGraph::at):
3052         (MinifiedGraph):
3053         * dfg/DFGMinifiedID.h: Added.
3054         (DFG):
3055         (MinifiedID):
3056         (JSC::DFG::MinifiedID::MinifiedID):
3057         (JSC::DFG::MinifiedID::operator!):
3058         (JSC::DFG::MinifiedID::nodeIndex):
3059         (JSC::DFG::MinifiedID::operator==):
3060         (JSC::DFG::MinifiedID::operator!=):
3061         (JSC::DFG::MinifiedID::operator<):
3062         (JSC::DFG::MinifiedID::operator>):
3063         (JSC::DFG::MinifiedID::operator<=):
3064         (JSC::DFG::MinifiedID::operator>=):
3065         (JSC::DFG::MinifiedID::hash):
3066         (JSC::DFG::MinifiedID::dump):
3067         (JSC::DFG::MinifiedID::isHashTableDeletedValue):
3068         (JSC::DFG::MinifiedID::invalidID):
3069         (JSC::DFG::MinifiedID::otherInvalidID):
3070         (JSC::DFG::MinifiedID::fromBits):
3071         (JSC::DFG::MinifiedIDHash::hash):
3072         (JSC::DFG::MinifiedIDHash::equal):
3073         (MinifiedIDHash):
3074         (WTF):
3075         * dfg/DFGMinifiedNode.cpp:
3076         (JSC::DFG::MinifiedNode::fromNode):
3077         * dfg/DFGMinifiedNode.h:
3078         (JSC::DFG::MinifiedNode::id):
3079         (JSC::DFG::MinifiedNode::child1):
3080         (JSC::DFG::MinifiedNode::getID):
3081         (JSC::DFG::MinifiedNode::compareByNodeIndex):
3082         (MinifiedNode):
3083         * dfg/DFGSpeculativeJIT.cpp:
3084         (JSC::DFG::SpeculativeJIT::compileMovHint):
3085         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
3086         * dfg/DFGSpeculativeJIT.h:
3087         (JSC::DFG::SpeculativeJIT::setNodeIndexForOperand):
3088         * dfg/DFGValueSource.cpp:
3089         (JSC::DFG::ValueSource::dump):
3090         * dfg/DFGValueSource.h:
3091         (JSC::DFG::ValueSource::ValueSource):
3092         (JSC::DFG::ValueSource::isSet):
3093         (JSC::DFG::ValueSource::kind):
3094         (JSC::DFG::ValueSource::id):
3095         (ValueSource):
3096         (JSC::DFG::ValueSource::idFromKind):
3097         (JSC::DFG::ValueSource::kindFromID):
3098         * dfg/DFGVariableEvent.cpp:
3099         (JSC::DFG::VariableEvent::dump):
3100         (JSC::DFG::VariableEvent::dumpFillInfo):
3101         (JSC::DFG::VariableEvent::dumpSpillInfo):
3102         * dfg/DFGVariableEvent.h:
3103         (JSC::DFG::VariableEvent::fillGPR):
3104         (JSC::DFG::VariableEvent::fillPair):
3105         (JSC::DFG::VariableEvent::fillFPR):
3106         (JSC::DFG::VariableEvent::spill):
3107         (JSC::DFG::VariableEvent::death):
3108         (JSC::DFG::VariableEvent::movHint):
3109         (JSC::DFG::VariableEvent::id):
3110         (VariableEvent):
3111         * dfg/DFGVariableEventStream.cpp:
3112         (DFG):
3113         (JSC::DFG::VariableEventStream::tryToSetConstantRecovery):
3114         (JSC::DFG::VariableEventStream::reconstruct):
3115         * dfg/DFGVariableEventStream.h:
3116         (VariableEventStream):
3117
3118 2013-01-25  Roger Fong  <roger_fong@apple.com>
3119
3120         Unreviewed. Rename LLInt projects folder and make appropriate changes to solutions.
3121
3122         * JavaScriptCore.vcxproj/JavaScriptCore.sln:
3123         * JavaScriptCore.vcxproj/LLInt: Copied from JavaScriptCore.vcxproj/LLInt.vcproj.
3124         * JavaScriptCore.vcxproj/LLInt.vcproj: Removed.
3125         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly: Removed.
3126         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.make: Removed.
3127         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj: Removed.
3128         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj.user: Removed.
3129         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Removed.
3130         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets: Removed.
3131         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Removed.
3132         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj: Removed.
3133         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj.user: Removed.
3134         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Removed.
3135         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor: Removed.
3136         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj: Removed.
3137         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj.user: Removed.
3138         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props: Removed.
3139         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Removed.
3140         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props: Removed.
3141
3142 2013-01-24  Roger Fong  <roger_fong@apple.com>
3143
3144         VS2010 JavascriptCore: Clean up property sheets, add a JSC solution, add testRegExp and testAPI projects.
3145         https://bugs.webkit.org/show_bug.cgi?id=106987
3146
3147         Reviewed by Brent Fulgham.
3148
3149         * JavaScriptCore.vcxproj/JavaScriptCore.sln: Added.
3150         * JavaScriptCore.vcxproj/JavaScriptCoreCF.props:
3151         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
3152         * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
3153         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
3154         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
3155         * JavaScriptCore.vcxproj/jsc/jscDebug.props:
3156         * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
3157         * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
3158         * JavaScriptCore.vcxproj/testRegExp: Added.
3159         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj: Added.
3160         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters: Added.
3161         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.user: Added.
3162         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props: Added.
3163         * JavaScriptCore.vcxproj/testRegExp/testRegExpDebug.props: Added.
3164         * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd: Added.
3165         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreBuild.cmd: Added.
3166         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd: Added.
3167         * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props: Added.
3168         * JavaScriptCore.vcxproj/testapi: Added.
3169         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Added.
3170         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters: Added.
3171         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.user: Added.
3172         * JavaScriptCore.vcxproj/testapi/testapiCommon.props: Added.
3173         * JavaScriptCore.vcxproj/testapi/testapiDebug.props: Added.
3174         * JavaScriptCore.vcxproj/testapi/testapiPostBuild.cmd: Added.
3175         * JavaScriptCore.vcxproj/testapi/testapiPreBuild.cmd: Added.
3176         * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd: Added.
3177         * JavaScriptCore.vcxproj/testapi/testapiRelease.props: Added.
3178
3179 2013-01-24  Roger Fong  <roger_fong@apple.com>
3180
3181         Unreviewed. Windows build fix.
3182
3183         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3184
3185 2013-01-24  Filip Pizlo  <fpizlo@apple.com>
3186
3187         DFG::JITCompiler::getSpeculation() methods are badly named and superfluous
3188         https://bugs.webkit.org/show_bug.cgi?id=107860
3189
3190         Reviewed by Mark Hahnenberg.
3191
3192         * dfg/DFGJITCompiler.h:
3193         (JITCompiler):
3194         * dfg/DFGSpeculativeJIT64.cpp:
3195         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
3196         (JSC::DFG::SpeculativeJIT::emitBranch):
3197
3198 2013-01-24  Mark Hahnenberg  <mhahnenberg@apple.com>
3199
3200         Objective-C API: Rename JSValue.h/APIJSValue.h to JSCJSValue.h/JSValue.h
3201         https://bugs.webkit.org/show_bug.cgi?id=107327
3202
3203         Reviewed by Filip Pizlo.
3204
3205         We're renaming these two files, so we have to replace the names everywhere.
3206
3207         * API/APICast.h:
3208         * API/APIJSValue.h: Removed.
3209         * API/JSBlockAdaptor.mm:
3210         * API/JSStringRefCF.cpp:
3211         * API/JSValue.h: Copied from Source/JavaScriptCore/API/APIJSValue.h.
3212         * API/JSValue.mm:
3213         * API/JSValueInternal.h:
3214         * API/JSValueRef.cpp:
3215         * API/JSWeakObjectMapRefPrivate.cpp:
3216         * API/JavaScriptCore.h:
3217         * CMakeLists.txt:
3218         * GNUmakefile.list.am:
3219         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3220         * JavaScriptCore.xcodeproj/project.pbxproj:
3221         * Target.pri:
3222         * bytecode/CallLinkStatus.h:
3223         * bytecode/CodeBlock.cpp:
3224         * bytecode/MethodOfGettingAValueProfile.h:
3225         * bytecode/ResolveGlobalStatus.cpp:
3226         * bytecode/ResolveGlobalStatus.h:
3227         * bytecode/SpeculatedType.h:
3228         * bytecode/ValueRecovery.h:
3229         * dfg/DFGByteCodeParser.cpp:
3230         * dfg/DFGJITCompiler.cpp:
3231         * dfg/DFGNode.h:
3232         * dfg/DFGSpeculativeJIT.cpp:
3233         * dfg/DFGSpeculativeJIT64.cpp:
3234         * heap/CopiedBlock.h:
3235         * heap/HandleStack.cpp:
3236         * heap/HandleTypes.h:
3237         * heap/WeakImpl.h:
3238         * interpreter/Interpreter.h:
3239         * interpreter/Register.h:
3240         * interpreter/VMInspector.h:
3241         * jit/HostCallReturnValue.cpp:
3242         * jit/HostCallReturnValue.h:
3243         * jit/JITCode.h:
3244         * jit/JITExceptions.cpp:
3245         * jit/JITExceptions.h:
3246         * jit/JSInterfaceJIT.h:
3247         * llint/LLIntCLoop.h:
3248         * llint/LLIntData.h:
3249         * llint/LLIntSlowPaths.cpp:
3250         * profiler/ProfilerBytecode.h:
3251         * profiler/ProfilerBytecodeSequence.h:
3252         * profiler/ProfilerBytecodes.h:
3253         * profiler/ProfilerCompilation.h:
3254         * profiler/ProfilerCompiledBytecode.h:
3255         * profiler/ProfilerDatabase.h:
3256         * profiler/ProfilerOSRExit.h:
3257         * profiler/ProfilerOSRExitSite.h:
3258         * profiler/ProfilerOrigin.h:
3259         * profiler/ProfilerOriginStack.h:
3260         * runtime/ArgList.cpp:
3261         * runtime/CachedTranscendentalFunction.h:
3262         * runtime/CallData.h:
3263         * runtime/Completion.h:
3264         * runtime/ConstructData.h:
3265         * runtime/DateConstructor.cpp:
3266         * runtime/DateInstance.cpp:
3267         * runtime/DatePrototype.cpp:
3268         * runtime/JSAPIValueWrapper.h:
3269         * runtime/JSCJSValue.cpp: Copied from Source/JavaScriptCore/runtime/JSValue.cpp.
3270         * runtime/JSCJSValue.h: Copied from Source/JavaScriptCore/runtime/JSValue.h.
3271         (JSValue):
3272         * runtime/JSCJSValueInlines.h: Copied from Source/JavaScriptCore/runtime/JSValueInlines.h.
3273         * runtime/JSGlobalData.h:
3274         * runtime/JSGlobalObject.cpp:
3275         * runtime/JSGlobalObjectFunctions.h:
3276         * runtime/JSStringJoiner.h:
3277         * runtime/JSValue.cpp: Removed.
3278         * runtime/JSValue.h: Removed.
3279         * runtime/JSValueInlines.h: Removed.
3280         * runtime/LiteralParser.h:
3281         * runtime/Operations.h:
3282         * runtime/PropertyDescriptor.h:
3283         * runtime/PropertySlot.h:
3284         * runtime/Protect.h:
3285         * runtime/RegExpPrototype.cpp:
3286         * runtime/Structure.h:
3287
3288 2013-01-23  Oliver Hunt  <oliver@apple.com>
3289
3290         Harden JSC a bit with RELEASE_ASSERT
3291         https://bugs.webkit.org/show_bug.cgi?id=107766
3292
3293         Reviewed by Mark Hahnenberg.
3294
3295         Went through and replaced a pile of ASSERTs that were covering
3296         significantly important details (bounds checks, etc) where
3297         having the checks did not impact release performance in any
3298         measurable way.
3299
3300         * API/JSContextRef.cpp:
3301         (JSContextCreateBacktrace):
3302         * assembler/MacroAssembler.h:
3303         (JSC::MacroAssembler::branchAdd32):
3304         (JSC::MacroAssembler::branchMul32):
3305         * bytecode/CodeBlock.cpp:
3306         (JSC::CodeBlock::dumpBytecode):
3307         (JSC::CodeBlock::handlerForBytecodeOffset):
3308         (JSC::CodeBlock::lineNumberForBytecodeOffset):
3309         (JSC::CodeBlock::bytecodeOffset):
3310         * bytecode/CodeBlock.h:
3311         (JSC::CodeBlock::bytecodeOffsetForCallAtIndex):
3312         (JSC::CodeBlock::bytecodeOffset):
3313         (JSC::CodeBlock::exceptionHandler):
3314         (JSC::CodeBlock::codeOrigin):
3315         (JSC::CodeBlock::immediateSwitchJumpTable):
3316         (JSC::CodeBlock::characterSwitchJumpTable):
3317         (JSC::CodeBlock::stringSwitchJumpTable):
3318         (JSC::CodeBlock::setIdentifiers):
3319         (JSC::baselineCodeBlockForInlineCallFrame):
3320         (JSC::ExecState::uncheckedR):
3321         * bytecode/CodeOrigin.cpp:
3322         (JSC::CodeOrigin::inlineStack):
3323         * bytecode/CodeOrigin.h:
3324         (JSC::CodeOrigin::CodeOrigin):
3325         * dfg/DFGCSEPhase.cpp:
3326         * dfg/DFGOSRExit.cpp:
3327         * dfg/DFGScratchRegisterAllocator.h:
3328         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
3329         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
3330         * dfg/DFGSpeculativeJIT.h:
3331         (JSC::DFG::SpeculativeJIT::allocate):
3332         (JSC::DFG::SpeculativeJIT::spill):
3333         (JSC::DFG::SpeculativeJIT::integerResult):
3334         * dfg/DFGSpeculativeJIT64.cpp:
3335         (JSC::DFG::SpeculativeJIT::fillInteger):
3336         (JSC::DFG::SpeculativeJIT::fillDouble):
3337         (JSC::DFG::SpeculativeJIT::fillJSValue):
3338         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
3339         (JSC::DFG::SpeculativeJIT::emitCall):
3340         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
3341         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
3342         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
3343         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
3344         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
3345         (JSC::DFG::SpeculativeJIT::compile):
3346         * dfg/DFGValueSource.h:
3347         (JSC::DFG::dataFormatToValueSourceKind):
3348         (JSC::DFG::ValueSource::ValueSource):
3349         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
3350         * heap/BlockAllocator.cpp:
3351         (JSC::BlockAllocator::BlockAllocator):
3352         (JSC::BlockAllocator::releaseFreeRegions):
3353         (JSC::BlockAllocator::blockFreeingThreadMain):
3354         * heap/Heap.cpp:
3355         (JSC::Heap::lastChanceToFinalize):
3356         (JSC::Heap::collect):
3357         * interpreter/Interpreter.cpp:
3358         (JSC::Interpreter::throwException):
3359         (JSC::Interpreter::execute):
3360         * jit/GCAwareJITStubRoutine.cpp:
3361         (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
3362         * jit/JIT.cpp:
3363         (JSC::JIT::privateCompileMainPass):
3364         (JSC::JIT::privateCompileSlowCases):
3365         * jit/JITExceptions.cpp:
3366         (JSC::genericThrow):
3367         * jit/JITInlines.h:
3368         (JSC::JIT::emitLoad):
3369         * jit/JITOpcodes.cpp:
3370         (JSC::JIT::emit_op_end):
3371         (JSC::JIT::emit_resolve_operations):
3372         * jit/JITStubRoutine.cpp:
3373         (JSC::JITStubRoutine::observeZeroRefCount):
3374         * jit/JITStubs.cpp:
3375         (JSC::returnToThrowTrampoline):
3376         * runtime/Arguments.cpp:
3377         (JSC::Arguments::getOwnPropertySlot):
3378         (JSC::Arguments::getOwnPropertyDescriptor):
3379         (JSC::Arguments::deleteProperty):
3380         (JSC::Arguments::defineOwnProperty):
3381         (JSC::Arguments::didTearOffActivation):
3382         * runtime/ArrayPrototype.cpp:
3383         (JSC::shift):
3384         (JSC::unshift):
3385         (JSC::arrayProtoFuncLastIndexOf):
3386         * runtime/ButterflyInlines.h:
3387         (JSC::Butterfly::growPropertyStorage):
3388         * runtime/CodeCache.cpp: