Source/JavaScriptCore/ChangeLog

   1 2013-04-30  Commit Queue  <rniwa@webkit.org>
   2
   3         Unreviewed, rolling out r149349 and r149354.
   4         http://trac.webkit.org/changeset/149349
   5         http://trac.webkit.org/changeset/149354
   6         https://bugs.webkit.org/show_bug.cgi?id=115444
   7
   8          The Thumb version of compileSoftModulo make invalid use of
   9         registers (Requested by benjaminp on #webkit).
  10
  11         * CMakeLists.txt:
  12         * GNUmakefile.list.am:
  13         * JavaScriptCore.xcodeproj/project.pbxproj:
  14         * assembler/ARMv7Assembler.h:
  15         (ARMv7Assembler):
  16         * assembler/AbstractMacroAssembler.h:
  17         (JSC::isARMv7s):
  18         (JSC):
  19         * assembler/MacroAssemblerARMv7.cpp: Removed.
  20         * assembler/MacroAssemblerARMv7.h:
  21         (MacroAssemblerARMv7):
  22         * dfg/DFGFixupPhase.cpp:
  23         (JSC::DFG::FixupPhase::fixupNode):
  24         * dfg/DFGOperations.cpp:
  25         * dfg/DFGOperations.h:
  26         * dfg/DFGSpeculativeJIT.cpp:
  27         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
  28         (DFG):
  29         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
  30         * dfg/DFGSpeculativeJIT.h:
  31         (JSC::DFG::SpeculativeJIT::callOperation):
  32         (SpeculativeJIT):
  33         * dfg/DFGSpeculativeJIT32_64.cpp:
  34         (JSC::DFG::SpeculativeJIT::compile):
  35
  36 2013-04-30  Zalan Bujtas  <zalan@apple.com>
  37
  38         Animations fail to start on http://www.google.com/insidesearch/howsearchworks/thestory/
  39         https://bugs.webkit.org/show_bug.cgi?id=111244
  40
  41         Reviewed by David Kilzer.
  42
  43         Enable performance.now() as a minimal subset of Web Timing API.
  44         It returns DOMHighResTimeStamp, a monotonically increasing value representing the
  45         number of milliseconds from the start of the navigation of the current document.
  46         JS libraries use this API to check against the requestAnimationFrame() timestamp.
  47
  48         * Configurations/FeatureDefines.xcconfig:
  49
  50 2013-04-30  Zoltan Arvai  <zarvai@inf.u-szeged.hu>
  51
  52         Unreviewed. Speculative build fix on Qt Arm and Mips after r149349.
  53
  54         * dfg/DFGSpeculativeJIT.cpp:
  55         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
  56
  57 2013-04-29  Cosmin Truta  <ctruta@blackberry.com>
  58
  59         [ARM] Expand the use of integer division
  60         https://bugs.webkit.org/show_bug.cgi?id=115138
  61
  62         Reviewed by Benjamin Poulain.
  63
  64         If availability of hardware integer division isn't known at compile
  65         time, check the CPU flags and decide at runtime whether to fall back
  66         to software. Currently, this OS-specific check is implemented on QNX.
  67
  68         Moreover, use operator % instead of fmod() in the calculation of the
  69         software modulo. Even when it's software-emulated, operator % is faster
  70         than fmod(): on ARM v7 QNX, without hardware division, we noticed
  71         >3% speedup on SunSpider.
  72
  73         * CMakeLists.txt:
  74         * GNUmakefile.list.am:
  75         * JavaScriptCore.xcodeproj/project.pbxproj:
  76         * assembler/ARMv7Assembler.h:
  77         (JSC::ARMv7Assembler::sdiv): Did not compile conditionally.
  78         (JSC::ARMv7Assembler::udiv): Ditto.
  79         * assembler/AbstractMacroAssembler.h:
  80         (JSC::isARMv7s): Removed.
  81         * assembler/MacroAssemblerARMv7.cpp: Added.
  82         (JSC::isIntegerDivSupported): Added.
  83         * assembler/MacroAssemblerARMv7.h:
  84         (JSC::MacroAssemblerARMv7::supportsIntegerDiv): Added.
  85         * dfg/DFGFixupPhase.cpp:
  86         (JSC::DFG::FixupPhase::fixupNode): Checked MacroAssembler::supportsIntegerDiv() in ArithDiv case.
  87         * dfg/DFGOperations.cpp:
  88         (JSC::DFG::operationModOnInts): Added.
  89         * dfg/DFGOperations.h:
  90         (JSC::DFG::Z_DFGOperation_ZZ): Added.
  91         * dfg/DFGSpeculativeJIT.cpp:
  92         (JSC::DFG::SpeculativeJIT::compileSoftModulo): Separated the X86-specific and ARM-specific codegen
  93         from the common implementation; used operationModOnInts on ARM.
  94         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARM): Renamed from compileIntegerArithDivForARMv7.
  95         (JSC::DFG::SpeculativeJIT::compileArithMod): Allowed run-time detection of integer div on ARM.
  96         * dfg/DFGSpeculativeJIT.h:
  97         (JSC::DFG::SpeculativeJIT::callOperation): Added overloads with Z_DFGOperation_ZZ arguments.
  98         * dfg/DFGSpeculativeJIT32_64.cpp:
  99         (JSC::DFG::SpeculativeJIT::compile): Used compileIntegerArithDivForARM.
 100
 101 2013-04-29  Benjamin Poulain  <benjamin@webkit.org>
 102
 103         Unify the data access of StringImpl members from JavaScriptCore
 104         https://bugs.webkit.org/show_bug.cgi?id=115320
 105
 106         Reviewed by Andreas Kling.
 107
 108         DFG accesses the member infos by directly calling the methods on StringImpl,
 109         while the baseline JIT was using helper methods on ThunkHelpers.
 110
 111         Cut the middle man, and use StringImpl directly everywhere.
 112
 113         * jit/JITInlines.h:
 114         (JSC::JIT::emitLoadCharacterString):
 115         * jit/JITPropertyAccess.cpp:
 116         (JSC::JIT::stringGetByValStubGenerator):
 117         * jit/JITPropertyAccess32_64.cpp:
 118         (JSC::JIT::stringGetByValStubGenerator):
 119         * jit/JSInterfaceJIT.h:
 120         * jit/ThunkGenerators.cpp:
 121         (JSC::stringCharLoad):
 122
 123 2013-04-29  Benjamin Poulain  <bpoulain@apple.com>
 124
 125         Use push and pop for iOS math function thunks
 126         https://bugs.webkit.org/show_bug.cgi?id=115215
 127
 128         Reviewed by Filip Pizlo.
 129
 130         The iOS ABI is a little different than regular ARM ABI regarding stack alignment.
 131         The requirement is 4 bytes:
 132         "The ARM environment uses a stack that—at the point of function calls—is 4-byte aligned,
 133          grows downward, and contains local variables and a function’s parameters."
 134
 135         Subsequently, we can just use push and pop to preserve the link register.
 136
 137         * jit/ThunkGenerators.cpp:
 138
 139 2013-04-29  Brent Fulgham  <bfulgham@webkit.org>
 140
 141         [Windows, WinCairo] Get rid of last few pthread include/link references.
 142         https://bugs.webkit.org/show_bug.cgi?id=115375
 143
 144         Reviewed by Tim Horton.
 145
 146         * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
 147         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
 148         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
 149         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
 150         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
 151         * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
 152
 153 2013-04-29  Roger Fong  <roger_fong@apple.com>
 154
 155         Unreviewed. AppleWin VS2010 build fix.
 156
 157         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
 158
 159 2013-04-26  Mark Hahnenberg  <mhahnenberg@apple.com>
 160
 161         ~BlockAllocator should ASSERT that it has no more Regions left
 162         https://bugs.webkit.org/show_bug.cgi?id=115287
 163
 164         Reviewed by Andreas Kling.
 165
 166         * heap/BlockAllocator.cpp:
 167         (JSC::BlockAllocator::~BlockAllocator):
 168         (JSC::BlockAllocator::allRegionSetsAreEmpty):
 169         * heap/BlockAllocator.h:
 170         (RegionSet):
 171         (JSC::BlockAllocator::RegionSet::isEmpty):
 172         (BlockAllocator):
 173
 174 2013-04-29  Mark Hahnenberg  <mhahnenberg@apple.com>
 175
 176         IndexingTypes should use hex
 177         https://bugs.webkit.org/show_bug.cgi?id=115286
 178
 179         Decimal is kind of confusing/hard to read because they're used as bit masks. Hex seems more appropriate.
 180
 181         Reviewed by Geoffrey Garen.
 182
 183         * runtime/IndexingType.h:
 184
 185 2013-04-29  Carlos Garcia Campos  <cgarcia@igalia.com>
 186
 187         Unreviewed. Fix make distcheck.
 188
 189         * GNUmakefile.list.am: Add missing headers files to compilation
 190         and offlineasm/sh4.rb script.
 191
 192 2013-04-28  Dean Jackson  <dino@apple.com>
 193
 194         [Mac] Disable canvas backing store scaling (HIGH_DPI_CANVAS)
 195         https://bugs.webkit.org/show_bug.cgi?id=115310
 196
 197         Reviewed by Simon Fraser.
 198
 199         Remove ENABLE_HIGH_DPI_CANVAS_macosx.
 200
 201         * Configurations/FeatureDefines.xcconfig:
 202
 203 2013-04-27  Darin Adler  <darin@apple.com>
 204
 205         Move from constructor and member function adoptCF/NS to free function adoptCF/NS.
 206         https://bugs.webkit.org/show_bug.cgi?id=115307
 207
 208         Reviewed by Geoffrey Garen.
 209
 210         * heap/HeapTimer.cpp:
 211         (JSC::HeapTimer::HeapTimer):
 212         * runtime/VM.cpp:
 213         (JSC::enableAssembler):
 214         Use adoptCF free function.
 215
 216 2013-04-27  Anders Carlsson  <andersca@apple.com>
 217
 218         Try to fix the Windows build.
 219
 220         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
 221
 222 2013-04-25  Geoffrey Garen  <ggaren@apple.com>
 223
 224         Cleaned up pre/post inc/dec in bytecode
 225         https://bugs.webkit.org/show_bug.cgi?id=115222
 226
 227         Reviewed by Filip Pizlo.
 228
 229         A few related changes here:
 230
 231         (*) Removed post_inc and post_dec. The two-result form was awkward to
 232         reason about. Being explicit about the intermediate mov and to_number
 233         reduces DFG overhead, removes some fragile ASSERTs from the DFG, and
 234         fixes a const bug. Plus, we get to blow away 262 lines of code.
 235
 236         (*) Renamed pre_inc and pre_dec to inc and dec, since there's only one
 237         version now.
 238
 239         (*) Renamed to_jsnumber to to_number, to match the ECMA name.
 240
 241         (*) Tightened up the codegen and runtime support for to_number.
 242
 243
 244         * JavaScriptCore.order: Order!
 245
 246         * bytecode/CodeBlock.cpp:
 247         (JSC::CodeBlock::dumpBytecode):
 248         * bytecode/Opcode.h:
 249         (JSC::padOpcodeName):
 250         * bytecompiler/BytecodeGenerator.cpp:
 251         (JSC::BytecodeGenerator::emitInc):
 252         (JSC::BytecodeGenerator::emitDec):
 253         * bytecompiler/BytecodeGenerator.h:
 254         (JSC::BytecodeGenerator::emitToNumber):
 255         (BytecodeGenerator): Removed post_inc and post_dec.
 256
 257         * bytecompiler/NodesCodegen.cpp:
 258         (JSC::emitPreIncOrDec): Updated for rename.
 259
 260         (JSC::emitPostIncOrDec): Issue an explicit mov and to_number when needed.
 261         These are rare, and they boil away in the DFG.
 262
 263         (JSC::PostfixNode::emitResolve):
 264         (JSC::PrefixNode::emitResolve): For const, use an explicit mov instead
 265         of any special forms. This fixes a bug where we would do string
 266         add/subtract instead of number.
 267
 268         * dfg/DFGByteCodeParser.cpp:
 269         (JSC::DFG::ByteCodeParser::parseBlock):
 270         * dfg/DFGCapabilities.h:
 271         (JSC::DFG::canCompileOpcode):
 272         * jit/JIT.cpp:
 273         (JSC::JIT::privateCompileMainPass):
 274         (JSC::JIT::privateCompileSlowCases):
 275         * jit/JIT.h:
 276         * jit/JITArithmetic.cpp:
 277         (JSC::JIT::emit_op_inc):
 278         (JSC::JIT::emitSlow_op_inc):
 279         (JSC::JIT::emit_op_dec):
 280         (JSC::JIT::emitSlow_op_dec):
 281         * jit/JITArithmetic32_64.cpp:
 282         (JSC::JIT::emit_op_inc):
 283         (JSC::JIT::emitSlow_op_inc):
 284         (JSC::JIT::emit_op_dec):
 285         (JSC::JIT::emitSlow_op_dec): Removed post_inc/dec, and updated for renames.
 286
 287         * jit/JITOpcodes.cpp:
 288         (JSC::JIT::emit_op_to_number):
 289         (JSC::JIT::emitSlow_op_to_number): Removed a test for number cells. There's
 290         no such thing!
 291
 292         * jit/JITOpcodes32_64.cpp:
 293         (JSC::JIT::emit_op_to_number): Use LowestTag to avoid making assumptions
 294         about the lowest valued tag.
 295
 296         (JSC::JIT::emitSlow_op_to_number): Updated for renames.
 297
 298         * jit/JITStubs.cpp:
 299         (JSC::DEFINE_STUB_FUNCTION):
 300         * jit/JITStubs.h:
 301         * llint/LLIntSlowPaths.cpp:
 302         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 303         * llint/LLIntSlowPaths.h:
 304         * llint/LowLevelInterpreter32_64.asm:
 305         * llint/LowLevelInterpreter64.asm:
 306         * parser/NodeConstructors.h:
 307         (JSC::UnaryPlusNode::UnaryPlusNode): Removed post_inc/dec, and updated for renames.
 308
 309         * runtime/Operations.cpp:
 310         (JSC::jsIsObjectType): Removed a test for number cells. There's
 311         no such thing!
 312
 313 2013-04-27  Julien Brianceau  <jbrianceau@nds.com>
 314
 315         REGRESSION(r149114): cache flush for SH4 arch may flush an extra page.
 316         https://bugs.webkit.org/show_bug.cgi?id=115305
 317
 318         Reviewed by Andreas Kling.
 319
 320         * assembler/SH4Assembler.h:
 321         (JSC::SH4Assembler::cacheFlush):
 322
 323 2013-04-26  Geoffrey Garen  <ggaren@apple.com>
 324
 325         Re-landing <http://trac.webkit.org/changeset/148999>
 326
 327             Filled out more cases of branch folding in bytecode when emitting
 328             expressions into a branching context
 329             https://bugs.webkit.org/show_bug.cgi?id=115057
 330
 331             Reviewed by Phil Pizlo.
 332
 333         We can't fold the number == 1 case to boolean because all non-zero numbers
 334         down-cast to true, but only 1 is == to true.
 335
 336 2013-04-26  Filip Pizlo  <fpizlo@apple.com>
 337
 338         Correct indentation of SymbolTable.h
 339
 340         Rubber stamped by Mark Hahnenberg.
 341
 342         * runtime/SymbolTable.h:
 343
 344 2013-04-26  Roger Fong  <roger_fong@apple.com>
 345
 346         Make Apple Windows VS2010 build results into and get dependencies from __32 suffixed folders.
 347         Make the DebugSuffix configuration use _debug dependencies.
 348
 349         * JavaScriptCore.vcxproj/JavaScriptCore.make:
 350         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 351         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
 352         * JavaScriptCore.vcxproj/JavaScriptCoreCF.props:
 353         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
 354         * JavaScriptCore.vcxproj/JavaScriptCoreDebug.props:
 355         * JavaScriptCore.vcxproj/JavaScriptCoreDebugCFLite.props:
 356         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
 357         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters:
 358         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorBuildCmd.cmd:
 359         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
 360         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props:
 361         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
 362         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPreBuild.cmd:
 363         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorProduction.props:
 364         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props:
 365         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
 366         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
 367         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedCommon.props:
 368         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedDebug.props:
 369         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedProduction.props:
 370         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props:
 371         * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd:
 372         * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
 373         * JavaScriptCore.vcxproj/JavaScriptCoreProduction.props:
 374         * JavaScriptCore.vcxproj/JavaScriptCoreRelease.props:
 375         * JavaScriptCore.vcxproj/JavaScriptCoreReleaseCFLite.props:
 376         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
 377         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
 378         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
 379         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
 380         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
 381         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
 382         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
 383         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
 384         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props:
 385         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorProduction.props:
 386         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props:
 387         * JavaScriptCore.vcxproj/build-generated-files.sh:
 388         * JavaScriptCore.vcxproj/copy-files.cmd:
 389         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
 390         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
 391         * JavaScriptCore.vcxproj/jsc/jscDebug.props:
 392         * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
 393         * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
 394         * JavaScriptCore.vcxproj/jsc/jscProduction.props:
 395         * JavaScriptCore.vcxproj/jsc/jscRelease.props:
 396         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
 397         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters:
 398         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
 399         * JavaScriptCore.vcxproj/testRegExp/testRegExpDebug.props:
 400         * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd:
 401         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd:
 402         * JavaScriptCore.vcxproj/testRegExp/testRegExpProduction.props:
 403         * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props:
 404         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
 405         * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
 406         * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props:
 407         * JavaScriptCore.vcxproj/testapi/testapiDebug.props:
 408         * JavaScriptCore.vcxproj/testapi/testapiDebugCFLite.props:
 409         * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd:
 410         * JavaScriptCore.vcxproj/testapi/testapiProduction.props:
 411         * JavaScriptCore.vcxproj/testapi/testapiRelease.props:
 412         * JavaScriptCore.vcxproj/testapi/testapiReleaseCFLite.props:
 413
 414 2013-04-26  Roger Fong  <roger_fong@apple.com>
 415
 416         Disable sub-pixel layout on mac.
 417         https://bugs.webkit.org/show_bug.cgi?id=114999.
 418
 419         Reviewed by Simon Fraser.
 420
 421         * Configurations/FeatureDefines.xcconfig:
 422
 423 2013-04-26  Oliver Hunt  <oliver@apple.com>
 424
 425         Make stack tracing more robust
 426         https://bugs.webkit.org/show_bug.cgi?id=115272
 427
 428         Reviewed by Geoffrey Garen.
 429
 430         CallFrame already handles stack walking confusion robustly,
 431         so we should make sure that the actual walk handles that as well.
 432
 433         * interpreter/Interpreter.cpp:
 434         (JSC::getCallerInfo):
 435
 436 2013-04-26  Mark Hahnenberg  <mhahnenberg@apple.com>
 437
 438         REGRESSION(r149165): It made many tests crash on 32 bit
 439         https://bugs.webkit.org/show_bug.cgi?id=115227
 440
 441         Reviewed by Csaba Osztrogonác.
 442
 443         m_reservation is uninitialized when ENABLE(SUPER_REGION) is false.
 444
 445         * heap/SuperRegion.cpp:
 446         (JSC::SuperRegion::~SuperRegion):
 447
 448 2013-04-26  Julien Brianceau  <jbrianceau@nds.com>
 449
 450         Fix SH4 build broken since r149159.
 451         https://bugs.webkit.org/show_bug.cgi?id=115229
 452
 453         Add BranchTruncateType enum in SH4 port and handle it in branchTruncateDoubleToInt32.
 454
 455         Reviewed by Allan Sandfeld Jensen.
 456
 457         * assembler/MacroAssemblerSH4.h:
 458         (JSC::MacroAssemblerSH4::branchTruncateDoubleToInt32):
 459
 460 2013-04-25  Mark Hahnenberg  <mhahnenberg@apple.com>
 461
 462         SuperRegion doesn't call deallocate() on its PageReservation
 463         https://bugs.webkit.org/show_bug.cgi?id=115208
 464
 465         Reviewed by Geoffrey Garen.
 466
 467         It should. This doesn't cause us to leak physical memory, but it does cause us to leak virtual
 468         address space (and probably mach ports), which is also bad :-( FixedVMPoolExecutableAllocator
 469         also has this bug, but it doesn't matter much because there's only one instance of that class
 470         throughout the entire lifetime of the process, whereas each VM has its own SuperRegion.
 471
 472         * heap/SuperRegion.cpp:
 473         (JSC::SuperRegion::~SuperRegion):
 474         * heap/SuperRegion.h:
 475         (SuperRegion):
 476         * jit/ExecutableAllocatorFixedVMPool.cpp:
 477         (FixedVMPoolExecutableAllocator):
 478         (JSC::FixedVMPoolExecutableAllocator::~FixedVMPoolExecutableAllocator):
 479
 480 2013-04-25  Filip Pizlo  <fpizlo@apple.com>
 481
 482         DFG doesn't support to_jsnumber
 483         https://bugs.webkit.org/show_bug.cgi?id=115129
 484
 485         Reviewed by Geoffrey Garen.
 486
 487         Based on Oliver's patch. Implements to_jsnumber as Identity(Number:@thingy), and then does
 488         an optimization in Fixup to turn Identity(Number:) into Identity(Int32:) if the predictions
 489         tell us to. Identity is later turned into Phantom.
 490
 491         Also fixed BackPropMask, which appeared to have NodeDoesNotExit included in it. That's
 492         wrong; NodeDoesNotExit is not a backward propagation property.
 493
 494         Also fixed Identity to be marked as CanExit (i.e. not NodeDoesNotExit).
 495
 496         This more than doubles the FPS on ammo.
 497
 498         * dfg/DFGByteCodeParser.cpp:
 499         (JSC::DFG::ByteCodeParser::parseBlock):
 500         * dfg/DFGCapabilities.h:
 501         (JSC::DFG::canCompileOpcode):
 502         * dfg/DFGFixupPhase.cpp:
 503         (JSC::DFG::FixupPhase::fixupNode):
 504         (FixupPhase):
 505         (JSC::DFG::FixupPhase::observeUseKindOnNode):
 506         (JSC::DFG::FixupPhase::observeUseKindOnEdge):
 507         * dfg/DFGNodeFlags.h:
 508         (DFG):
 509         * dfg/DFGNodeType.h:
 510         (DFG):
 511         * dfg/DFGPredictionPropagationPhase.cpp:
 512         (JSC::DFG::PredictionPropagationPhase::propagate):
 513
 514 2013-04-24  Oliver Hunt  <oliver@apple.com>
 515
 516         Add support for Math.imul
 517         https://bugs.webkit.org/show_bug.cgi?id=115143
 518
 519         Reviewed by Filip Pizlo.
 520
 521         Add support for Math.imul, a thunk generator for Math.imul,
 522         and an intrinsic.
 523
 524         Fairly self explanatory set of changes, DFG intrinsics simply
 525         leverages the existing ValueToInt32 nodes.
 526
 527         * create_hash_table:
 528         * dfg/DFGAbstractState.cpp:
 529         (JSC::DFG::AbstractState::executeEffects):
 530         * dfg/DFGBackwardsPropagationPhase.cpp:
 531         (JSC::DFG::BackwardsPropagationPhase::propagate):
 532         * dfg/DFGByteCodeParser.cpp:
 533         (JSC::DFG::ByteCodeParser::handleIntrinsic):
 534         * dfg/DFGCSEPhase.cpp:
 535         (JSC::DFG::CSEPhase::performNodeCSE):
 536         * dfg/DFGFixupPhase.cpp:
 537         (JSC::DFG::FixupPhase::fixupNode):
 538         * dfg/DFGNodeType.h:
 539         (DFG):
 540         * dfg/DFGPredictionPropagationPhase.cpp:
 541         (JSC::DFG::PredictionPropagationPhase::propagate):
 542         * dfg/DFGSpeculativeJIT.cpp:
 543         (JSC::DFG::SpeculativeJIT::compileArithIMul):
 544         * dfg/DFGSpeculativeJIT.h:
 545         (SpeculativeJIT):
 546         * dfg/DFGSpeculativeJIT32_64.cpp:
 547         (JSC::DFG::SpeculativeJIT::compile):
 548         * dfg/DFGSpeculativeJIT64.cpp:
 549         (JSC::DFG::SpeculativeJIT::compile):
 550         * jit/ThunkGenerators.cpp:
 551         (JSC::imulThunkGenerator):
 552         (JSC):
 553         * jit/ThunkGenerators.h:
 554         (JSC):
 555         * runtime/Intrinsic.h:
 556         * runtime/MathObject.cpp:
 557         (JSC):
 558         (JSC::mathProtoFuncIMul):
 559         * runtime/VM.cpp:
 560         (JSC::thunkGeneratorForIntrinsic):
 561
 562 2013-04-25  Filip Pizlo  <fpizlo@apple.com>
 563
 564         Unreviewed, roll out http://trac.webkit.org/changeset/148999
 565         It broke http://kripken.github.io/ammo.js/examples/new/ammo.html
 566
 567         * JavaScriptCore.order:
 568         * bytecompiler/BytecodeGenerator.cpp:
 569         (JSC::BytecodeGenerator::emitNewArray):
 570         (JSC::BytecodeGenerator::emitThrowReferenceError):
 571         (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
 572         * bytecompiler/BytecodeGenerator.h:
 573         (JSC::BytecodeGenerator::shouldEmitProfileHooks):
 574         (BytecodeGenerator):
 575         * bytecompiler/NodesCodegen.cpp:
 576         (JSC):
 577         (JSC::NullNode::emitBytecode):
 578         (JSC::BooleanNode::emitBytecode):
 579         (JSC::NumberNode::emitBytecode):
 580         (JSC::StringNode::emitBytecode):
 581         (JSC::IfNode::emitBytecode):
 582         (JSC::IfElseNode::emitBytecode):
 583         * parser/ASTBuilder.h:
 584         (JSC::ASTBuilder::createIfStatement):
 585         (ASTBuilder):
 586         * parser/NodeConstructors.h:
 587         (JSC):
 588         (JSC::NullNode::NullNode):
 589         (JSC::BooleanNode::BooleanNode):
 590         (JSC::NumberNode::NumberNode):
 591         (JSC::StringNode::StringNode):
 592         (JSC::IfNode::IfNode):
 593         (JSC::IfElseNode::IfElseNode):
 594         * parser/Nodes.h:
 595         (JSC::ExpressionNode::isPure):
 596         (JSC::ExpressionNode::isSubtract):
 597         (StatementNode):
 598         (NullNode):
 599         (JSC::NullNode::isNull):
 600         (BooleanNode):
 601         (JSC::BooleanNode::isPure):
 602         (NumberNode):
 603         (JSC::NumberNode::value):
 604         (JSC::NumberNode::isPure):
 605         (StringNode):
 606         (JSC::StringNode::isPure):
 607         (JSC::StringNode::isString):
 608         (BinaryOpNode):
 609         (IfNode):
 610         (JSC):
 611         (IfElseNode):
 612         (ContinueNode):
 613         (BreakNode):
 614         * parser/Parser.cpp:
 615         (JSC::::parseIfStatement):
 616         * parser/ResultType.h:
 617         (ResultType):
 618         * runtime/JSCJSValueInlines.h:
 619         (JSC::JSValue::pureToBoolean):
 620         * runtime/JSCell.h:
 621         (JSCell):
 622         * runtime/JSCellInlines.h:
 623         (JSC):
 624
 625 2013-04-25  Filip Pizlo  <fpizlo@apple.com>
 626
 627         PreciseJumpTargets should treat loop_hint as a jump target
 628         https://bugs.webkit.org/show_bug.cgi?id=115209
 629
 630         Reviewed by Mark Hahnenberg.
 631
 632         I didn't add a test but I turned this into a release assertion. Running Octane is enough
 633         to trigger it.
 634
 635         * bytecode/PreciseJumpTargets.cpp:
 636         (JSC::computePreciseJumpTargets):
 637         * dfg/DFGByteCodeParser.cpp:
 638         (JSC::DFG::ByteCodeParser::parseBlock):
 639
 640 2013-04-25  Roman Zhuykov  <zhroma@ispras.ru>
 641
 642         Fix problems with processing negative zero on DFG.
 643         https://bugs.webkit.org/show_bug.cgi?id=113862
 644
 645         Reviewed by Filip Pizlo.
 646
 647         Fix NodeNeedsNegZero flag propagation in BackwardPropagationPhase.
 648         Function arithNodeFlags should not mask NodeNeedsNegZero flag for ArithNegate and DoubleAsInt32
 649         nodes and this flag should be always used to decide where we need to generate nezative-zero checks.
 650         Remove unnecessary negative-zero checks from integer ArithDiv on ARM.
 651         Also remove such checks from integer ArithMod on ARM and X86, and make them always to
 652         check not only "modulo_result == 0" but also "dividend < 0".
 653         Generate faster code for case when ArithMod operation divisor is constant power of 2 on ARMv7
 654         in the same way as on ARMv7s, and add negative-zero checks into this code when needed.
 655         Change speculationCheck ExitKind from Overflow to NegativeZero where applicable.
 656
 657         This shows 30% speedup of math-spectral-norm, and 5% speedup
 658         on SunSpider overall on ARMv7 Linux.
 659
 660         * assembler/MacroAssemblerARM.h:
 661         (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
 662         * assembler/MacroAssemblerARMv7.h:
 663         (JSC::MacroAssemblerARMv7::branchConvertDoubleToInt32):
 664         * assembler/MacroAssemblerMIPS.h:
 665         (JSC::MacroAssemblerMIPS::branchConvertDoubleToInt32):
 666         * assembler/MacroAssemblerSH4.h:
 667         (JSC::MacroAssemblerSH4::branchConvertDoubleToInt32):
 668         * assembler/MacroAssemblerX86Common.h:
 669         (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
 670         * dfg/DFGBackwardsPropagationPhase.cpp:
 671         (JSC::DFG::BackwardsPropagationPhase::isNotNegZero):
 672         (JSC::DFG::BackwardsPropagationPhase::isNotPosZero):
 673         (JSC::DFG::BackwardsPropagationPhase::propagate):
 674         * dfg/DFGNode.h:
 675         (JSC::DFG::Node::arithNodeFlags):
 676         * dfg/DFGSpeculativeJIT.cpp:
 677         (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
 678         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
 679         (JSC::DFG::SpeculativeJIT::compileArithNegate):
 680
 681 2013-04-25  Oliver Hunt  <oliver@apple.com>
 682
 683         Stack guards are too conservative
 684         https://bugs.webkit.org/show_bug.cgi?id=115147
 685
 686         Reviewed by Mark Hahnenberg.
 687
 688         Increase stack guard to closer to old size.
 689
 690         * interpreter/Interpreter.cpp:
 691         (JSC::Interpreter::StackPolicy::StackPolicy):
 692
 693 2013-04-25  Oliver Hunt  <oliver@apple.com>
 694
 695         Stack guards are too conservative
 696         https://bugs.webkit.org/show_bug.cgi?id=115147
 697
 698         Reviewed by Geoffrey Garen.
 699
 700         Reduce the limits and simplify the decision making.
 701
 702         * interpreter/Interpreter.cpp:
 703         (JSC::Interpreter::StackPolicy::StackPolicy):
 704
 705 2013-04-25  Nick Diego Yamane  <nick.yamane@openbossa.org>
 706
 707         JSC: Fix interpreter misbehavior in builds with JIT disabled
 708         https://bugs.webkit.org/show_bug.cgi?id=115190
 709
 710         Reviewed by Oliver Hunt.
 711
 712         Commit http://trac.webkit.org/changeset/147858 modified
 713         some details on how JS stack traces are built. The method
 714         "getLineNumberForCallFrame", renamed in that changeset to
 715         "getBytecodeOffsetForCallFrame" is always returning `0' when
 716         JIT is disabled
 717
 718         How to reproduce:
 719          - Build webkit with JIT disabled
 720          - Open MiniBrowser, for example, with http://google.com
 721          - In a debug build, WebProcess will hit the following ASSERT:
 722            Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:279 ASSERT(low);
 723
 724         * interpreter/Interpreter.cpp:
 725         (JSC::getBytecodeOffsetForCallFrame):
 726
 727 2013-04-25  Oliver Hunt  <oliver@apple.com>
 728
 729         Make checkSyntax take a VM instead of an ExecState
 730
 731         RS=Tim
 732
 733         * jsc.cpp:
 734         (runInteractive):
 735         * runtime/Completion.cpp:
 736         (JSC::checkSyntax):
 737         * runtime/Completion.h:
 738         (JSC):
 739
 740 2013-04-25  Michael Saboff  <msaboff@apple.com>
 741
 742         32 Bit: Crash due to RegExpTest nodes not setting result type to Boolean
 743         https://bugs.webkit.org/show_bug.cgi?id=115188
 744
 745         Reviewed by Geoffrey Garen.
 746
 747         Changed the RegExpTest node to set the AbstractValue to boolean, since that
 748         what it is.
 749
 750         * dfg/DFGAbstractState.cpp:
 751         (JSC::DFG::AbstractState::executeEffects):
 752
 753 2013-04-25  Julien Brianceau  <jbrianceau@nds.com>
 754
 755         REGRESSION(r137994): Random crashes occur with SH4 JSC.
 756         https://bugs.webkit.org/show_bug.cgi?id=115167.
 757
 758         Reviewed by Oliver Hunt.
 759
 760         Since r137994, uncommited pages could be inside the area of memory in
 761         parameter of the cacheFlush function. That's why we have to flush each
 762         page separately to avoid a fail of the whole flush, if an uncommited page
 763         is in the area.
 764
 765         This patch is very similar to changeset 145194 made for ARMv7 architecture,
 766         see https://bugs.webkit.org/show_bug.cgi?id=111441 for further information.
 767
 768         * assembler/SH4Assembler.h:
 769         (JSC::SH4Assembler::cacheFlush):
 770
 771 2013-04-24  Mark Lam  <mark.lam@apple.com>
 772
 773         Add watchdog timer polling for the DFG.
 774         https://bugs.webkit.org/show_bug.cgi?id=115134.
 775
 776         Reviewed by Geoffrey Garen.
 777
 778         The strategy is to add a speculation check to the DFG generated code to
 779         test if the watchdog timer has fired or not. If the watchdog timer has
 780         fired, the generated code will do an OSR exit to the baseline JIT, and
 781         let it handle servicing the watchdog timer.
 782
 783         If the watchdog is not enabled, this speculation check will not be
 784         emitted.
 785
 786         * API/tests/testapi.c:
 787         (currentCPUTime_callAsFunction):
 788         (extendTerminateCallback):
 789         (main):
 790         - removed try/catch statements so that we can test the watchdog on the DFG.
 791         - added JS bindings to a native currentCPUTime() function so that the timeout
 792           tests can be more accurate.
 793         - also shortened the time values so that the tests can complete sooner.
 794
 795         * bytecode/ExitKind.h:
 796         * dfg/DFGAbstractState.cpp:
 797         (JSC::DFG::AbstractState::executeEffects):
 798         * dfg/DFGByteCodeParser.cpp:
 799         (JSC::DFG::ByteCodeParser::parseBlock):
 800         * dfg/DFGFixupPhase.cpp:
 801         (JSC::DFG::FixupPhase::fixupNode):
 802         * dfg/DFGNodeType.h:
 803         * dfg/DFGPredictionPropagationPhase.cpp:
 804         (JSC::DFG::PredictionPropagationPhase::propagate):
 805         * dfg/DFGSpeculativeJIT32_64.cpp:
 806         (JSC::DFG::SpeculativeJIT::compile):
 807         * dfg/DFGSpeculativeJIT64.cpp:
 808         (JSC::DFG::SpeculativeJIT::compile):
 809         * runtime/Watchdog.cpp:
 810         (JSC::Watchdog::setTimeLimit):
 811
 812 2013-04-24  Filip Pizlo  <fpizlo@apple.com>
 813
 814         Special thunks for math functions should work on ARMv7
 815         https://bugs.webkit.org/show_bug.cgi?id=115144
 816
 817         Reviewed by Gavin Barraclough and Oliver Hunt.
 818
 819         The only hard bit here was ensuring that we implemented the very special
 820         "cheap C call" convention on ARMv7.
 821
 822         * assembler/AbstractMacroAssembler.h:
 823         (JSC::isARMv7s):
 824         (JSC):
 825         (JSC::isX86):
 826         * dfg/DFGCommon.h:
 827         * jit/SpecializedThunkJIT.h:
 828         (SpecializedThunkJIT):
 829         (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
 830         * jit/ThunkGenerators.cpp:
 831         (JSC::floorThunkGenerator):
 832         (JSC::ceilThunkGenerator):
 833         (JSC::roundThunkGenerator):
 834         (JSC::expThunkGenerator):
 835         (JSC::logThunkGenerator):
 836
 837 2013-04-24  Julien Brianceau  <jbrianceau@nds.com>
 838
 839         Misc bugfix and cleaning in sh4 base JIT.
 840         https://bugs.webkit.org/show_bug.cgi?id=115022.
 841
 842         Reviewed by Oliver Hunt.
 843
 844         Remove unused add32() and sub32() with scratchreg parameter to avoid
 845         confusion as this function prototype means another behaviour.
 846         Remove unused "void push(Address)" function which seems quite buggy.
 847
 848         * assembler/MacroAssemblerSH4.h:
 849         (JSC::MacroAssemblerSH4::and32): Cosmetic change.
 850         (JSC::MacroAssemblerSH4::lshift32): Cosmetic change.
 851         (JSC::MacroAssemblerSH4::or32): Cosmetic change.
 852         (JSC::MacroAssemblerSH4::xor32): Cosmetic change.
 853         (MacroAssemblerSH4):
 854         (JSC::MacroAssemblerSH4::load32): Cosmetic change.
 855         (JSC::MacroAssemblerSH4::load8Signed): Fix invalid offset upper limit
 856         when using r0 register and cosmetic changes.
 857         (JSC::MacroAssemblerSH4::load8): Reuse load8Signed to avoid duplication.
 858         (JSC::MacroAssemblerSH4::load16): Fix invalid offset upper limit when
 859         using r0 register, fix missing offset shift and cosmetic changes.
 860         (JSC::MacroAssemblerSH4::store32): Cosmetic change.
 861         (JSC::MacroAssemblerSH4::branchAdd32): Store result value before branch.
 862
 863 2013-04-24  Patrick Gansterer  <paroga@webkit.org>
 864
 865         [WIN] Remove pthread from Visual Studio files in JavaScriptCore
 866         https://bugs.webkit.org/show_bug.cgi?id=114864
 867
 868         Reviewed by Brent Fulgham.
 869
 870         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
 871         * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.vsprops:
 872         * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
 873         * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops:
 874         * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
 875         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
 876         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
 877         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
 878         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
 879         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
 880         * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
 881         * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props:
 882
 883 2013-04-24  Filip Pizlo  <fpizlo@apple.com>
 884
 885         DFG should keep the operand to create_this alive if it's emitting code for create_this
 886         https://bugs.webkit.org/show_bug.cgi?id=115133
 887
 888         Reviewed by Mark Hahnenberg.
 889
 890         The DFG must model bytecode liveness, or else OSR exit is going to have a really bad time.
 891
 892         * dfg/DFGByteCodeParser.cpp:
 893         (JSC::DFG::ByteCodeParser::parseBlock):
 894
 895 2013-04-24  Roger Fong  <roger_fong@apple.com>
 896
 897         Have VS2010 WebKit solution look in WebKit_Libraries/lib32 for dependencies.
 898
 899         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
 900         * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
 901         * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
 902         * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
 903         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters:
 904         * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd:
 905         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd:
 906         * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd:
 907
 908 2013-04-24  Geoffrey Garen  <ggaren@apple.com>
 909
 910         32-bit build fix.
 911
 912         Unreviewed.
 913
 914         * dfg/DFGSpeculativeJIT.cpp:
 915         (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch): Explicitly
 916         truncate to 32-bit to avoid compiler warnings. It's safe to truncate
 917         because the payload of a boolean is the low bits on both 64-bit and 32-bit.
 918
 919 2013-04-23  Geoffrey Garen  <ggaren@apple.com>
 920
 921         Filled out more cases of branch folding in the DFG
 922         https://bugs.webkit.org/show_bug.cgi?id=115088
 923
 924         Reviewed by Oliver Hunt.
 925
 926         No change on the benchmarks we track, but a 3X speedup on a
 927         microbenchmark that uses these techniques.
 928
 929         * dfg/DFGByteCodeParser.cpp:
 930         (JSC::DFG::ByteCodeParser::parseBlock): (!/=)= and (!/=)== can constant
 931         fold all types, not just numbers, because true constants have no
 932         side effects when type-converted at runtime.
 933
 934         * dfg/DFGFixupPhase.cpp:
 935         (JSC::DFG::FixupPhase::fixupNode):
 936         * dfg/DFGNode.h:
 937         (JSC::DFG::Node::shouldSpeculateBoolean): Added support for fixing up
 938         boolean uses, like we do for other types like number.
 939
 940         * dfg/DFGSpeculativeJIT.cpp:
 941         (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):
 942         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
 943         (JSC::DFG::SpeculativeJIT::compare):
 944         (JSC::DFG::SpeculativeJIT::compileStrictEq):
 945         (JSC::DFG::SpeculativeJIT::compileBooleanCompare): Peephole fuse
 946         boolean compare and/or compare-branch, now that we have the types for
 947         them.
 948
 949         * dfg/DFGSpeculativeJIT.h: Updated declarations.
 950
 951 == Rolled over to ChangeLog-2013-04-24 ==