Unreviewed, rolling out r149349 and r149354.
[WebKit-https.git] / Source / JavaScriptCore / ChangeLog
1 2013-04-30  Commit Queue  <rniwa@webkit.org>
2
3         Unreviewed, rolling out r149349 and r149354.
4         http://trac.webkit.org/changeset/149349
5         http://trac.webkit.org/changeset/149354
6         https://bugs.webkit.org/show_bug.cgi?id=115444
7
8          The Thumb version of compileSoftModulo make invalid use of
9         registers (Requested by benjaminp on #webkit).
10
11         * CMakeLists.txt:
12         * GNUmakefile.list.am:
13         * JavaScriptCore.xcodeproj/project.pbxproj:
14         * assembler/ARMv7Assembler.h:
15         (ARMv7Assembler):
16         * assembler/AbstractMacroAssembler.h:
17         (JSC::isARMv7s):
18         (JSC):
19         * assembler/MacroAssemblerARMv7.cpp: Removed.
20         * assembler/MacroAssemblerARMv7.h:
21         (MacroAssemblerARMv7):
22         * dfg/DFGFixupPhase.cpp:
23         (JSC::DFG::FixupPhase::fixupNode):
24         * dfg/DFGOperations.cpp:
25         * dfg/DFGOperations.h:
26         * dfg/DFGSpeculativeJIT.cpp:
27         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
28         (DFG):
29         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
30         * dfg/DFGSpeculativeJIT.h:
31         (JSC::DFG::SpeculativeJIT::callOperation):
32         (SpeculativeJIT):
33         * dfg/DFGSpeculativeJIT32_64.cpp:
34         (JSC::DFG::SpeculativeJIT::compile):
35
36 2013-04-30  Zalan Bujtas  <zalan@apple.com>
37
38         Animations fail to start on http://www.google.com/insidesearch/howsearchworks/thestory/
39         https://bugs.webkit.org/show_bug.cgi?id=111244
40
41         Reviewed by David Kilzer.
42         
43         Enable performance.now() as a minimal subset of Web Timing API. 
44         It returns DOMHighResTimeStamp, a monotonically increasing value representing the 
45         number of milliseconds from the start of the navigation of the current document.
46         JS libraries use this API to check against the requestAnimationFrame() timestamp.
47
48         * Configurations/FeatureDefines.xcconfig:
49
50 2013-04-30  Zoltan Arvai  <zarvai@inf.u-szeged.hu>
51
52         Unreviewed. Speculative build fix on Qt Arm and Mips after r149349.
53
54         * dfg/DFGSpeculativeJIT.cpp:
55         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
56
57 2013-04-29  Cosmin Truta  <ctruta@blackberry.com>
58
59         [ARM] Expand the use of integer division
60         https://bugs.webkit.org/show_bug.cgi?id=115138
61
62         Reviewed by Benjamin Poulain.
63
64         If availability of hardware integer division isn't known at compile
65         time, check the CPU flags and decide at runtime whether to fall back
66         to software. Currently, this OS-specific check is implemented on QNX.
67
68         Moreover, use operator % instead of fmod() in the calculation of the
69         software modulo. Even when it's software-emulated, operator % is faster
70         than fmod(): on ARM v7 QNX, without hardware division, we noticed
71         >3% speedup on SunSpider.
72
73         * CMakeLists.txt:
74         * GNUmakefile.list.am:
75         * JavaScriptCore.xcodeproj/project.pbxproj:
76         * assembler/ARMv7Assembler.h:
77         (JSC::ARMv7Assembler::sdiv): Did not compile conditionally.
78         (JSC::ARMv7Assembler::udiv): Ditto.
79         * assembler/AbstractMacroAssembler.h:
80         (JSC::isARMv7s): Removed.
81         * assembler/MacroAssemblerARMv7.cpp: Added.
82         (JSC::isIntegerDivSupported): Added.
83         * assembler/MacroAssemblerARMv7.h:
84         (JSC::MacroAssemblerARMv7::supportsIntegerDiv): Added.
85         * dfg/DFGFixupPhase.cpp:
86         (JSC::DFG::FixupPhase::fixupNode): Checked MacroAssembler::supportsIntegerDiv() in ArithDiv case.
87         * dfg/DFGOperations.cpp:
88         (JSC::DFG::operationModOnInts): Added.
89         * dfg/DFGOperations.h:
90         (JSC::DFG::Z_DFGOperation_ZZ): Added.
91         * dfg/DFGSpeculativeJIT.cpp:
92         (JSC::DFG::SpeculativeJIT::compileSoftModulo): Separated the X86-specific and ARM-specific codegen
93         from the common implementation; used operationModOnInts on ARM.
94         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARM): Renamed from compileIntegerArithDivForARMv7.
95         (JSC::DFG::SpeculativeJIT::compileArithMod): Allowed run-time detection of integer div on ARM.
96         * dfg/DFGSpeculativeJIT.h:
97         (JSC::DFG::SpeculativeJIT::callOperation): Added overloads with Z_DFGOperation_ZZ arguments.
98         * dfg/DFGSpeculativeJIT32_64.cpp:
99         (JSC::DFG::SpeculativeJIT::compile): Used compileIntegerArithDivForARM.
100
101 2013-04-29  Benjamin Poulain  <benjamin@webkit.org>
102
103         Unify the data access of StringImpl members from JavaScriptCore
104         https://bugs.webkit.org/show_bug.cgi?id=115320
105
106         Reviewed by Andreas Kling.
107
108         DFG accesses the member infos by directly calling the methods on StringImpl,
109         while the baseline JIT was using helper methods on ThunkHelpers.
110
111         Cut the middle man, and use StringImpl directly everywhere.
112
113         * jit/JITInlines.h:
114         (JSC::JIT::emitLoadCharacterString):
115         * jit/JITPropertyAccess.cpp:
116         (JSC::JIT::stringGetByValStubGenerator):
117         * jit/JITPropertyAccess32_64.cpp:
118         (JSC::JIT::stringGetByValStubGenerator):
119         * jit/JSInterfaceJIT.h:
120         * jit/ThunkGenerators.cpp:
121         (JSC::stringCharLoad):
122
123 2013-04-29  Benjamin Poulain  <bpoulain@apple.com>
124
125         Use push and pop for iOS math function thunks
126         https://bugs.webkit.org/show_bug.cgi?id=115215
127
128         Reviewed by Filip Pizlo.
129
130         The iOS ABI is a little different than regular ARM ABI regarding stack alignment.
131         The requirement is 4 bytes:
132         "The ARM environment uses a stack that—at the point of function calls—is 4-byte aligned,
133          grows downward, and contains local variables and a function’s parameters."
134
135         Subsequently, we can just use push and pop to preserve the link register.
136
137         * jit/ThunkGenerators.cpp:
138
139 2013-04-29  Brent Fulgham  <bfulgham@webkit.org>
140
141         [Windows, WinCairo] Get rid of last few pthread include/link references.
142         https://bugs.webkit.org/show_bug.cgi?id=115375
143
144         Reviewed by Tim Horton.
145
146         * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
147         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
148         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
149         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
150         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
151         * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
152
153 2013-04-29  Roger Fong  <roger_fong@apple.com>
154
155         Unreviewed. AppleWin VS2010 build fix.
156
157         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
158
159 2013-04-26  Mark Hahnenberg  <mhahnenberg@apple.com>
160
161         ~BlockAllocator should ASSERT that it has no more Regions left
162         https://bugs.webkit.org/show_bug.cgi?id=115287
163
164         Reviewed by Andreas Kling.
165
166         * heap/BlockAllocator.cpp:
167         (JSC::BlockAllocator::~BlockAllocator):
168         (JSC::BlockAllocator::allRegionSetsAreEmpty):
169         * heap/BlockAllocator.h:
170         (RegionSet):
171         (JSC::BlockAllocator::RegionSet::isEmpty):
172         (BlockAllocator):
173
174 2013-04-29  Mark Hahnenberg  <mhahnenberg@apple.com>
175
176         IndexingTypes should use hex
177         https://bugs.webkit.org/show_bug.cgi?id=115286
178
179         Decimal is kind of confusing/hard to read because they're used as bit masks. Hex seems more appropriate.
180
181         Reviewed by Geoffrey Garen.
182
183         * runtime/IndexingType.h:
184
185 2013-04-29  Carlos Garcia Campos  <cgarcia@igalia.com>
186
187         Unreviewed. Fix make distcheck.
188
189         * GNUmakefile.list.am: Add missing headers files to compilation
190         and offlineasm/sh4.rb script.
191
192 2013-04-28  Dean Jackson  <dino@apple.com>
193
194         [Mac] Disable canvas backing store scaling (HIGH_DPI_CANVAS)
195         https://bugs.webkit.org/show_bug.cgi?id=115310
196
197         Reviewed by Simon Fraser.
198
199         Remove ENABLE_HIGH_DPI_CANVAS_macosx.
200
201         * Configurations/FeatureDefines.xcconfig:
202
203 2013-04-27  Darin Adler  <darin@apple.com>
204
205         Move from constructor and member function adoptCF/NS to free function adoptCF/NS.
206         https://bugs.webkit.org/show_bug.cgi?id=115307
207
208         Reviewed by Geoffrey Garen.
209
210         * heap/HeapTimer.cpp:
211         (JSC::HeapTimer::HeapTimer):
212         * runtime/VM.cpp:
213         (JSC::enableAssembler):
214         Use adoptCF free function.
215
216 2013-04-27  Anders Carlsson  <andersca@apple.com>
217
218         Try to fix the Windows build.
219
220         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
221
222 2013-04-25  Geoffrey Garen  <ggaren@apple.com>
223
224         Cleaned up pre/post inc/dec in bytecode
225         https://bugs.webkit.org/show_bug.cgi?id=115222
226
227         Reviewed by Filip Pizlo.
228
229         A few related changes here:
230
231         (*) Removed post_inc and post_dec. The two-result form was awkward to
232         reason about. Being explicit about the intermediate mov and to_number
233         reduces DFG overhead, removes some fragile ASSERTs from the DFG, and
234         fixes a const bug. Plus, we get to blow away 262 lines of code.
235
236         (*) Renamed pre_inc and pre_dec to inc and dec, since there's only one
237         version now.
238
239         (*) Renamed to_jsnumber to to_number, to match the ECMA name.
240
241         (*) Tightened up the codegen and runtime support for to_number.
242
243
244         * JavaScriptCore.order: Order!
245
246         * bytecode/CodeBlock.cpp:
247         (JSC::CodeBlock::dumpBytecode):
248         * bytecode/Opcode.h:
249         (JSC::padOpcodeName):
250         * bytecompiler/BytecodeGenerator.cpp:
251         (JSC::BytecodeGenerator::emitInc):
252         (JSC::BytecodeGenerator::emitDec):
253         * bytecompiler/BytecodeGenerator.h:
254         (JSC::BytecodeGenerator::emitToNumber):
255         (BytecodeGenerator): Removed post_inc and post_dec.
256
257         * bytecompiler/NodesCodegen.cpp:
258         (JSC::emitPreIncOrDec): Updated for rename.
259
260         (JSC::emitPostIncOrDec): Issue an explicit mov and to_number when needed.
261         These are rare, and they boil away in the DFG.
262
263         (JSC::PostfixNode::emitResolve):
264         (JSC::PrefixNode::emitResolve): For const, use an explicit mov instead
265         of any special forms. This fixes a bug where we would do string
266         add/subtract instead of number.
267
268         * dfg/DFGByteCodeParser.cpp:
269         (JSC::DFG::ByteCodeParser::parseBlock):
270         * dfg/DFGCapabilities.h:
271         (JSC::DFG::canCompileOpcode):
272         * jit/JIT.cpp:
273         (JSC::JIT::privateCompileMainPass):
274         (JSC::JIT::privateCompileSlowCases):
275         * jit/JIT.h:
276         * jit/JITArithmetic.cpp:
277         (JSC::JIT::emit_op_inc):
278         (JSC::JIT::emitSlow_op_inc):
279         (JSC::JIT::emit_op_dec):
280         (JSC::JIT::emitSlow_op_dec):
281         * jit/JITArithmetic32_64.cpp:
282         (JSC::JIT::emit_op_inc):
283         (JSC::JIT::emitSlow_op_inc):
284         (JSC::JIT::emit_op_dec):
285         (JSC::JIT::emitSlow_op_dec): Removed post_inc/dec, and updated for renames.
286
287         * jit/JITOpcodes.cpp:
288         (JSC::JIT::emit_op_to_number):
289         (JSC::JIT::emitSlow_op_to_number): Removed a test for number cells. There's
290         no such thing!
291
292         * jit/JITOpcodes32_64.cpp:
293         (JSC::JIT::emit_op_to_number): Use LowestTag to avoid making assumptions
294         about the lowest valued tag.
295
296         (JSC::JIT::emitSlow_op_to_number): Updated for renames.
297
298         * jit/JITStubs.cpp:
299         (JSC::DEFINE_STUB_FUNCTION):
300         * jit/JITStubs.h:
301         * llint/LLIntSlowPaths.cpp:
302         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
303         * llint/LLIntSlowPaths.h:
304         * llint/LowLevelInterpreter32_64.asm:
305         * llint/LowLevelInterpreter64.asm:
306         * parser/NodeConstructors.h:
307         (JSC::UnaryPlusNode::UnaryPlusNode): Removed post_inc/dec, and updated for renames.
308
309         * runtime/Operations.cpp:
310         (JSC::jsIsObjectType): Removed a test for number cells. There's
311         no such thing!
312
313 2013-04-27  Julien Brianceau  <jbrianceau@nds.com>
314
315         REGRESSION(r149114): cache flush for SH4 arch may flush an extra page.
316         https://bugs.webkit.org/show_bug.cgi?id=115305
317
318         Reviewed by Andreas Kling.
319
320         * assembler/SH4Assembler.h:
321         (JSC::SH4Assembler::cacheFlush):
322
323 2013-04-26  Geoffrey Garen  <ggaren@apple.com>
324
325         Re-landing <http://trac.webkit.org/changeset/148999>
326
327             Filled out more cases of branch folding in bytecode when emitting
328             expressions into a branching context
329             https://bugs.webkit.org/show_bug.cgi?id=115057
330
331             Reviewed by Phil Pizlo.
332
333         We can't fold the number == 1 case to boolean because all non-zero numbers
334         down-cast to true, but only 1 is == to true.
335
336 2013-04-26  Filip Pizlo  <fpizlo@apple.com>
337
338         Correct indentation of SymbolTable.h
339         
340         Rubber stamped by Mark Hahnenberg.
341
342         * runtime/SymbolTable.h:
343
344 2013-04-26  Roger Fong  <roger_fong@apple.com>
345
346         Make Apple Windows VS2010 build results into and get dependencies from __32 suffixed folders.
347         Make the DebugSuffix configuration use _debug dependencies.
348
349         * JavaScriptCore.vcxproj/JavaScriptCore.make:
350         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
351         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
352         * JavaScriptCore.vcxproj/JavaScriptCoreCF.props:
353         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
354         * JavaScriptCore.vcxproj/JavaScriptCoreDebug.props:
355         * JavaScriptCore.vcxproj/JavaScriptCoreDebugCFLite.props:
356         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
357         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters:
358         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorBuildCmd.cmd:
359         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
360         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props:
361         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
362         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPreBuild.cmd:
363         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorProduction.props:
364         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props:
365         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
366         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
367         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedCommon.props:
368         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedDebug.props:
369         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedProduction.props:
370         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props:
371         * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd:
372         * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
373         * JavaScriptCore.vcxproj/JavaScriptCoreProduction.props:
374         * JavaScriptCore.vcxproj/JavaScriptCoreRelease.props:
375         * JavaScriptCore.vcxproj/JavaScriptCoreReleaseCFLite.props:
376         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
377         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
378         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
379         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
380         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
381         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
382         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
383         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
384         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props:
385         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorProduction.props:
386         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props:
387         * JavaScriptCore.vcxproj/build-generated-files.sh:
388         * JavaScriptCore.vcxproj/copy-files.cmd:
389         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
390         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
391         * JavaScriptCore.vcxproj/jsc/jscDebug.props:
392         * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
393         * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
394         * JavaScriptCore.vcxproj/jsc/jscProduction.props:
395         * JavaScriptCore.vcxproj/jsc/jscRelease.props:
396         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
397         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters:
398         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
399         * JavaScriptCore.vcxproj/testRegExp/testRegExpDebug.props:
400         * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd:
401         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd:
402         * JavaScriptCore.vcxproj/testRegExp/testRegExpProduction.props:
403         * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props:
404         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
405         * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
406         * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props:
407         * JavaScriptCore.vcxproj/testapi/testapiDebug.props:
408         * JavaScriptCore.vcxproj/testapi/testapiDebugCFLite.props:
409         * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd:
410         * JavaScriptCore.vcxproj/testapi/testapiProduction.props:
411         * JavaScriptCore.vcxproj/testapi/testapiRelease.props:
412         * JavaScriptCore.vcxproj/testapi/testapiReleaseCFLite.props:
413
414 2013-04-26  Roger Fong  <roger_fong@apple.com>
415
416         Disable sub-pixel layout on mac.
417         https://bugs.webkit.org/show_bug.cgi?id=114999.
418
419         Reviewed by Simon Fraser.
420
421         * Configurations/FeatureDefines.xcconfig:
422
423 2013-04-26  Oliver Hunt  <oliver@apple.com>
424
425         Make stack tracing more robust
426         https://bugs.webkit.org/show_bug.cgi?id=115272
427
428         Reviewed by Geoffrey Garen.
429
430         CallFrame already handles stack walking confusion robustly,
431         so we should make sure that the actual walk handles that as well.
432
433         * interpreter/Interpreter.cpp:
434         (JSC::getCallerInfo):
435
436 2013-04-26  Mark Hahnenberg  <mhahnenberg@apple.com>
437
438         REGRESSION(r149165): It made many tests crash on 32 bit
439         https://bugs.webkit.org/show_bug.cgi?id=115227
440
441         Reviewed by Csaba Osztrogonác.
442
443         m_reservation is uninitialized when ENABLE(SUPER_REGION) is false.
444
445         * heap/SuperRegion.cpp:
446         (JSC::SuperRegion::~SuperRegion):
447
448 2013-04-26  Julien Brianceau  <jbrianceau@nds.com>
449
450         Fix SH4 build broken since r149159.
451         https://bugs.webkit.org/show_bug.cgi?id=115229
452
453         Add BranchTruncateType enum in SH4 port and handle it in branchTruncateDoubleToInt32.
454
455         Reviewed by Allan Sandfeld Jensen.
456
457         * assembler/MacroAssemblerSH4.h:
458         (JSC::MacroAssemblerSH4::branchTruncateDoubleToInt32):
459
460 2013-04-25  Mark Hahnenberg  <mhahnenberg@apple.com>
461
462         SuperRegion doesn't call deallocate() on its PageReservation
463         https://bugs.webkit.org/show_bug.cgi?id=115208
464
465         Reviewed by Geoffrey Garen.
466
467         It should. This doesn't cause us to leak physical memory, but it does cause us to leak virtual 
468         address space (and probably mach ports), which is also bad :-( FixedVMPoolExecutableAllocator 
469         also has this bug, but it doesn't matter much because there's only one instance of that class 
470         throughout the entire lifetime of the process, whereas each VM has its own SuperRegion. 
471
472         * heap/SuperRegion.cpp:
473         (JSC::SuperRegion::~SuperRegion):
474         * heap/SuperRegion.h:
475         (SuperRegion):
476         * jit/ExecutableAllocatorFixedVMPool.cpp:
477         (FixedVMPoolExecutableAllocator):
478         (JSC::FixedVMPoolExecutableAllocator::~FixedVMPoolExecutableAllocator):
479
480 2013-04-25  Filip Pizlo  <fpizlo@apple.com>
481
482         DFG doesn't support to_jsnumber
483         https://bugs.webkit.org/show_bug.cgi?id=115129
484
485         Reviewed by Geoffrey Garen.
486         
487         Based on Oliver's patch. Implements to_jsnumber as Identity(Number:@thingy), and then does
488         an optimization in Fixup to turn Identity(Number:) into Identity(Int32:) if the predictions
489         tell us to. Identity is later turned into Phantom.
490         
491         Also fixed BackPropMask, which appeared to have NodeDoesNotExit included in it. That's
492         wrong; NodeDoesNotExit is not a backward propagation property.
493         
494         Also fixed Identity to be marked as CanExit (i.e. not NodeDoesNotExit).
495         
496         This more than doubles the FPS on ammo.
497
498         * dfg/DFGByteCodeParser.cpp:
499         (JSC::DFG::ByteCodeParser::parseBlock):
500         * dfg/DFGCapabilities.h:
501         (JSC::DFG::canCompileOpcode):
502         * dfg/DFGFixupPhase.cpp:
503         (JSC::DFG::FixupPhase::fixupNode):
504         (FixupPhase):
505         (JSC::DFG::FixupPhase::observeUseKindOnNode):
506         (JSC::DFG::FixupPhase::observeUseKindOnEdge):
507         * dfg/DFGNodeFlags.h:
508         (DFG):
509         * dfg/DFGNodeType.h:
510         (DFG):
511         * dfg/DFGPredictionPropagationPhase.cpp:
512         (JSC::DFG::PredictionPropagationPhase::propagate):
513
514 2013-04-24  Oliver Hunt  <oliver@apple.com>
515
516         Add support for Math.imul
517         https://bugs.webkit.org/show_bug.cgi?id=115143
518
519         Reviewed by Filip Pizlo.
520
521         Add support for Math.imul, a thunk generator for Math.imul,
522         and an intrinsic.
523
524         Fairly self explanatory set of changes, DFG intrinsics simply
525         leverages the existing ValueToInt32 nodes.
526
527         * create_hash_table:
528         * dfg/DFGAbstractState.cpp:
529         (JSC::DFG::AbstractState::executeEffects):
530         * dfg/DFGBackwardsPropagationPhase.cpp:
531         (JSC::DFG::BackwardsPropagationPhase::propagate):
532         * dfg/DFGByteCodeParser.cpp:
533         (JSC::DFG::ByteCodeParser::handleIntrinsic):
534         * dfg/DFGCSEPhase.cpp:
535         (JSC::DFG::CSEPhase::performNodeCSE):
536         * dfg/DFGFixupPhase.cpp:
537         (JSC::DFG::FixupPhase::fixupNode):
538         * dfg/DFGNodeType.h:
539         (DFG):
540         * dfg/DFGPredictionPropagationPhase.cpp:
541         (JSC::DFG::PredictionPropagationPhase::propagate):
542         * dfg/DFGSpeculativeJIT.cpp:
543         (JSC::DFG::SpeculativeJIT::compileArithIMul):
544         * dfg/DFGSpeculativeJIT.h:
545         (SpeculativeJIT):
546         * dfg/DFGSpeculativeJIT32_64.cpp:
547         (JSC::DFG::SpeculativeJIT::compile):
548         * dfg/DFGSpeculativeJIT64.cpp:
549         (JSC::DFG::SpeculativeJIT::compile):
550         * jit/ThunkGenerators.cpp:
551         (JSC::imulThunkGenerator):
552         (JSC):
553         * jit/ThunkGenerators.h:
554         (JSC):
555         * runtime/Intrinsic.h:
556         * runtime/MathObject.cpp:
557         (JSC):
558         (JSC::mathProtoFuncIMul):
559         * runtime/VM.cpp:
560         (JSC::thunkGeneratorForIntrinsic):
561
562 2013-04-25  Filip Pizlo  <fpizlo@apple.com>
563
564         Unreviewed, roll out http://trac.webkit.org/changeset/148999
565         It broke http://kripken.github.io/ammo.js/examples/new/ammo.html
566
567         * JavaScriptCore.order:
568         * bytecompiler/BytecodeGenerator.cpp:
569         (JSC::BytecodeGenerator::emitNewArray):
570         (JSC::BytecodeGenerator::emitThrowReferenceError):
571         (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
572         * bytecompiler/BytecodeGenerator.h:
573         (JSC::BytecodeGenerator::shouldEmitProfileHooks):
574         (BytecodeGenerator):
575         * bytecompiler/NodesCodegen.cpp:
576         (JSC):
577         (JSC::NullNode::emitBytecode):
578         (JSC::BooleanNode::emitBytecode):
579         (JSC::NumberNode::emitBytecode):
580         (JSC::StringNode::emitBytecode):
581         (JSC::IfNode::emitBytecode):
582         (JSC::IfElseNode::emitBytecode):
583         * parser/ASTBuilder.h:
584         (JSC::ASTBuilder::createIfStatement):
585         (ASTBuilder):
586         * parser/NodeConstructors.h:
587         (JSC):
588         (JSC::NullNode::NullNode):
589         (JSC::BooleanNode::BooleanNode):
590         (JSC::NumberNode::NumberNode):
591         (JSC::StringNode::StringNode):
592         (JSC::IfNode::IfNode):
593         (JSC::IfElseNode::IfElseNode):
594         * parser/Nodes.h:
595         (JSC::ExpressionNode::isPure):
596         (JSC::ExpressionNode::isSubtract):
597         (StatementNode):
598         (NullNode):
599         (JSC::NullNode::isNull):
600         (BooleanNode):
601         (JSC::BooleanNode::isPure):
602         (NumberNode):
603         (JSC::NumberNode::value):
604         (JSC::NumberNode::isPure):
605         (StringNode):
606         (JSC::StringNode::isPure):
607         (JSC::StringNode::isString):
608         (BinaryOpNode):
609         (IfNode):
610         (JSC):
611         (IfElseNode):
612         (ContinueNode):
613         (BreakNode):
614         * parser/Parser.cpp:
615         (JSC::::parseIfStatement):
616         * parser/ResultType.h:
617         (ResultType):
618         * runtime/JSCJSValueInlines.h:
619         (JSC::JSValue::pureToBoolean):
620         * runtime/JSCell.h:
621         (JSCell):
622         * runtime/JSCellInlines.h:
623         (JSC):
624
625 2013-04-25  Filip Pizlo  <fpizlo@apple.com>
626
627         PreciseJumpTargets should treat loop_hint as a jump target
628         https://bugs.webkit.org/show_bug.cgi?id=115209
629
630         Reviewed by Mark Hahnenberg.
631         
632         I didn't add a test but I turned this into a release assertion. Running Octane is enough
633         to trigger it.
634
635         * bytecode/PreciseJumpTargets.cpp:
636         (JSC::computePreciseJumpTargets):
637         * dfg/DFGByteCodeParser.cpp:
638         (JSC::DFG::ByteCodeParser::parseBlock):
639
640 2013-04-25  Roman Zhuykov  <zhroma@ispras.ru>
641
642         Fix problems with processing negative zero on DFG.
643         https://bugs.webkit.org/show_bug.cgi?id=113862
644
645         Reviewed by Filip Pizlo.
646
647         Fix NodeNeedsNegZero flag propagation in BackwardPropagationPhase.
648         Function arithNodeFlags should not mask NodeNeedsNegZero flag for ArithNegate and DoubleAsInt32
649         nodes and this flag should be always used to decide where we need to generate nezative-zero checks.
650         Remove unnecessary negative-zero checks from integer ArithDiv on ARM.
651         Also remove such checks from integer ArithMod on ARM and X86, and make them always to
652         check not only "modulo_result == 0" but also "dividend < 0".
653         Generate faster code for case when ArithMod operation divisor is constant power of 2 on ARMv7
654         in the same way as on ARMv7s, and add negative-zero checks into this code when needed.
655         Change speculationCheck ExitKind from Overflow to NegativeZero where applicable.
656  
657         This shows 30% speedup of math-spectral-norm, and 5% speedup
658         on SunSpider overall on ARMv7 Linux.
659
660         * assembler/MacroAssemblerARM.h:
661         (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
662         * assembler/MacroAssemblerARMv7.h:
663         (JSC::MacroAssemblerARMv7::branchConvertDoubleToInt32):
664         * assembler/MacroAssemblerMIPS.h:
665         (JSC::MacroAssemblerMIPS::branchConvertDoubleToInt32):
666         * assembler/MacroAssemblerSH4.h:
667         (JSC::MacroAssemblerSH4::branchConvertDoubleToInt32):
668         * assembler/MacroAssemblerX86Common.h:
669         (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
670         * dfg/DFGBackwardsPropagationPhase.cpp:
671         (JSC::DFG::BackwardsPropagationPhase::isNotNegZero):
672         (JSC::DFG::BackwardsPropagationPhase::isNotPosZero):
673         (JSC::DFG::BackwardsPropagationPhase::propagate):
674         * dfg/DFGNode.h:
675         (JSC::DFG::Node::arithNodeFlags):
676         * dfg/DFGSpeculativeJIT.cpp:
677         (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
678         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
679         (JSC::DFG::SpeculativeJIT::compileArithNegate):
680
681 2013-04-25  Oliver Hunt  <oliver@apple.com>
682
683         Stack guards are too conservative
684         https://bugs.webkit.org/show_bug.cgi?id=115147
685
686         Reviewed by Mark Hahnenberg.
687
688         Increase stack guard to closer to old size.
689
690         * interpreter/Interpreter.cpp:
691         (JSC::Interpreter::StackPolicy::StackPolicy):
692
693 2013-04-25  Oliver Hunt  <oliver@apple.com>
694
695         Stack guards are too conservative
696         https://bugs.webkit.org/show_bug.cgi?id=115147
697
698         Reviewed by Geoffrey Garen.
699
700         Reduce the limits and simplify the decision making.
701
702         * interpreter/Interpreter.cpp:
703         (JSC::Interpreter::StackPolicy::StackPolicy):
704
705 2013-04-25  Nick Diego Yamane  <nick.yamane@openbossa.org>
706
707         JSC: Fix interpreter misbehavior in builds with JIT disabled
708         https://bugs.webkit.org/show_bug.cgi?id=115190
709
710         Reviewed by Oliver Hunt.
711
712         Commit http://trac.webkit.org/changeset/147858 modified
713         some details on how JS stack traces are built. The method
714         "getLineNumberForCallFrame", renamed in that changeset to
715         "getBytecodeOffsetForCallFrame" is always returning `0' when
716         JIT is disabled
717
718         How to reproduce:
719          - Build webkit with JIT disabled
720          - Open MiniBrowser, for example, with http://google.com
721          - In a debug build, WebProcess will hit the following ASSERT:
722            Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:279 ASSERT(low);
723
724         * interpreter/Interpreter.cpp:
725         (JSC::getBytecodeOffsetForCallFrame):
726
727 2013-04-25  Oliver Hunt  <oliver@apple.com>
728
729         Make checkSyntax take a VM instead of an ExecState
730
731         RS=Tim
732
733         * jsc.cpp:
734         (runInteractive):
735         * runtime/Completion.cpp:
736         (JSC::checkSyntax):
737         * runtime/Completion.h:
738         (JSC):
739
740 2013-04-25  Michael Saboff  <msaboff@apple.com>
741
742         32 Bit: Crash due to RegExpTest nodes not setting result type to Boolean
743         https://bugs.webkit.org/show_bug.cgi?id=115188
744
745         Reviewed by Geoffrey Garen.
746
747         Changed the RegExpTest node to set the AbstractValue to boolean, since that
748         what it is.
749
750         * dfg/DFGAbstractState.cpp:
751         (JSC::DFG::AbstractState::executeEffects):
752
753 2013-04-25  Julien Brianceau  <jbrianceau@nds.com>
754
755         REGRESSION(r137994): Random crashes occur with SH4 JSC.
756         https://bugs.webkit.org/show_bug.cgi?id=115167.
757
758         Reviewed by Oliver Hunt.
759
760         Since r137994, uncommited pages could be inside the area of memory in
761         parameter of the cacheFlush function. That's why we have to flush each
762         page separately to avoid a fail of the whole flush, if an uncommited page
763         is in the area.
764
765         This patch is very similar to changeset 145194 made for ARMv7 architecture,
766         see https://bugs.webkit.org/show_bug.cgi?id=111441 for further information.
767
768         * assembler/SH4Assembler.h:
769         (JSC::SH4Assembler::cacheFlush):
770
771 2013-04-24  Mark Lam  <mark.lam@apple.com>
772
773         Add watchdog timer polling for the DFG.
774         https://bugs.webkit.org/show_bug.cgi?id=115134.
775
776         Reviewed by Geoffrey Garen.
777
778         The strategy is to add a speculation check to the DFG generated code to
779         test if the watchdog timer has fired or not. If the watchdog timer has
780         fired, the generated code will do an OSR exit to the baseline JIT, and
781         let it handle servicing the watchdog timer.
782
783         If the watchdog is not enabled, this speculation check will not be
784         emitted.
785
786         * API/tests/testapi.c:
787         (currentCPUTime_callAsFunction):
788         (extendTerminateCallback):
789         (main):
790         - removed try/catch statements so that we can test the watchdog on the DFG.
791         - added JS bindings to a native currentCPUTime() function so that the timeout
792           tests can be more accurate.
793         - also shortened the time values so that the tests can complete sooner.
794
795         * bytecode/ExitKind.h:
796         * dfg/DFGAbstractState.cpp:
797         (JSC::DFG::AbstractState::executeEffects):
798         * dfg/DFGByteCodeParser.cpp:
799         (JSC::DFG::ByteCodeParser::parseBlock):
800         * dfg/DFGFixupPhase.cpp:
801         (JSC::DFG::FixupPhase::fixupNode):
802         * dfg/DFGNodeType.h:
803         * dfg/DFGPredictionPropagationPhase.cpp:
804         (JSC::DFG::PredictionPropagationPhase::propagate):
805         * dfg/DFGSpeculativeJIT32_64.cpp:
806         (JSC::DFG::SpeculativeJIT::compile):
807         * dfg/DFGSpeculativeJIT64.cpp:
808         (JSC::DFG::SpeculativeJIT::compile):
809         * runtime/Watchdog.cpp:
810         (JSC::Watchdog::setTimeLimit):
811
812 2013-04-24  Filip Pizlo  <fpizlo@apple.com>
813
814         Special thunks for math functions should work on ARMv7
815         https://bugs.webkit.org/show_bug.cgi?id=115144
816
817         Reviewed by Gavin Barraclough and Oliver Hunt.
818         
819         The only hard bit here was ensuring that we implemented the very special
820         "cheap C call" convention on ARMv7.
821
822         * assembler/AbstractMacroAssembler.h:
823         (JSC::isARMv7s):
824         (JSC):
825         (JSC::isX86):
826         * dfg/DFGCommon.h:
827         * jit/SpecializedThunkJIT.h:
828         (SpecializedThunkJIT):
829         (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
830         * jit/ThunkGenerators.cpp:
831         (JSC::floorThunkGenerator):
832         (JSC::ceilThunkGenerator):
833         (JSC::roundThunkGenerator):
834         (JSC::expThunkGenerator):
835         (JSC::logThunkGenerator):
836
837 2013-04-24  Julien Brianceau  <jbrianceau@nds.com>
838
839         Misc bugfix and cleaning in sh4 base JIT.
840         https://bugs.webkit.org/show_bug.cgi?id=115022.
841
842         Reviewed by Oliver Hunt.
843
844         Remove unused add32() and sub32() with scratchreg parameter to avoid
845         confusion as this function prototype means another behaviour.
846         Remove unused "void push(Address)" function which seems quite buggy.
847
848         * assembler/MacroAssemblerSH4.h:
849         (JSC::MacroAssemblerSH4::and32): Cosmetic change.
850         (JSC::MacroAssemblerSH4::lshift32): Cosmetic change.
851         (JSC::MacroAssemblerSH4::or32): Cosmetic change.
852         (JSC::MacroAssemblerSH4::xor32): Cosmetic change.
853         (MacroAssemblerSH4):
854         (JSC::MacroAssemblerSH4::load32): Cosmetic change.
855         (JSC::MacroAssemblerSH4::load8Signed): Fix invalid offset upper limit
856         when using r0 register and cosmetic changes.
857         (JSC::MacroAssemblerSH4::load8): Reuse load8Signed to avoid duplication.
858         (JSC::MacroAssemblerSH4::load16): Fix invalid offset upper limit when
859         using r0 register, fix missing offset shift and cosmetic changes.
860         (JSC::MacroAssemblerSH4::store32): Cosmetic change.
861         (JSC::MacroAssemblerSH4::branchAdd32): Store result value before branch.
862
863 2013-04-24  Patrick Gansterer  <paroga@webkit.org>
864
865         [WIN] Remove pthread from Visual Studio files in JavaScriptCore
866         https://bugs.webkit.org/show_bug.cgi?id=114864
867
868         Reviewed by Brent Fulgham.
869
870         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
871         * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.vsprops:
872         * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
873         * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops:
874         * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
875         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
876         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
877         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
878         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
879         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
880         * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
881         * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props:
882
883 2013-04-24  Filip Pizlo  <fpizlo@apple.com>
884
885         DFG should keep the operand to create_this alive if it's emitting code for create_this
886         https://bugs.webkit.org/show_bug.cgi?id=115133
887
888         Reviewed by Mark Hahnenberg.
889         
890         The DFG must model bytecode liveness, or else OSR exit is going to have a really bad time.
891
892         * dfg/DFGByteCodeParser.cpp:
893         (JSC::DFG::ByteCodeParser::parseBlock):
894
895 2013-04-24  Roger Fong  <roger_fong@apple.com>
896
897         Have VS2010 WebKit solution look in WebKit_Libraries/lib32 for dependencies.
898
899         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
900         * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
901         * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
902         * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
903         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters:
904         * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd:
905         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd:
906         * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd:
907
908 2013-04-24  Geoffrey Garen  <ggaren@apple.com>
909
910         32-bit build fix.
911
912         Unreviewed.
913
914         * dfg/DFGSpeculativeJIT.cpp:
915         (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch): Explicitly
916         truncate to 32-bit to avoid compiler warnings. It's safe to truncate
917         because the payload of a boolean is the low bits on both 64-bit and 32-bit.
918
919 2013-04-23  Geoffrey Garen  <ggaren@apple.com>
920
921         Filled out more cases of branch folding in the DFG
922         https://bugs.webkit.org/show_bug.cgi?id=115088
923
924         Reviewed by Oliver Hunt.
925
926         No change on the benchmarks we track, but a 3X speedup on a
927         microbenchmark that uses these techniques.
928
929         * dfg/DFGByteCodeParser.cpp:
930         (JSC::DFG::ByteCodeParser::parseBlock): (!/=)= and (!/=)== can constant
931         fold all types, not just numbers, because true constants have no
932         side effects when type-converted at runtime.
933
934         * dfg/DFGFixupPhase.cpp:
935         (JSC::DFG::FixupPhase::fixupNode):
936         * dfg/DFGNode.h:
937         (JSC::DFG::Node::shouldSpeculateBoolean): Added support for fixing up
938         boolean uses, like we do for other types like number.
939
940         * dfg/DFGSpeculativeJIT.cpp:
941         (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):
942         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
943         (JSC::DFG::SpeculativeJIT::compare):
944         (JSC::DFG::SpeculativeJIT::compileStrictEq):
945         (JSC::DFG::SpeculativeJIT::compileBooleanCompare): Peephole fuse
946         boolean compare and/or compare-branch, now that we have the types for
947         them.
948
949         * dfg/DFGSpeculativeJIT.h: Updated declarations.
950
951 == Rolled over to ChangeLog-2013-04-24 ==