Source/JavaScriptCore: VM::throwException() crashes reproducibly in testapi with...
[WebKit-https.git] / Source / JavaScriptCore / ChangeLog
1 2013-08-29  Chris Curtis  <chris_curtis@apple.com>
2
3         VM::throwException() crashes reproducibly in testapi with !ENABLE(JIT)
4         https://bugs.webkit.org/show_bug.cgi?id=120472
5
6         Reviewed by Filip Pizlo.
7         
8         With the JIT disabled, interpreterThrowInCaller was attempting to throw an error, 
9         but the topCallFrame was not set yet. By passing the error object into interpreterThrowInCaller
10         throwException can be called when topCallFrame is set.
11         * llint/LLIntSlowPaths.cpp:
12         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
13         * runtime/CommonSlowPaths.cpp:
14         (JSC::SLOW_PATH_DECL):
15         * runtime/CommonSlowPathsExceptions.cpp:
16         (JSC::CommonSlowPaths::interpreterThrowInCaller):
17         * runtime/CommonSlowPathsExceptions.h:
18
19         Renamed genericThrow -> genericUnwind, because this function no longer has the ability
20         to throw errors. It unwinds the stack in order to report them. 
21         * dfg/DFGOperations.cpp:
22         * jit/JITExceptions.cpp:
23         (JSC::genericUnwind):
24         (JSC::jitThrowNew):
25         (JSC::jitThrow):
26         * jit/JITExceptions.h:
27         * llint/LLIntExceptions.cpp:
28         (JSC::LLInt::doThrow):
29     
30 2013-08-29  Commit Queue  <commit-queue@webkit.org>
31
32         Unreviewed, rolling out r154804.
33         http://trac.webkit.org/changeset/154804
34         https://bugs.webkit.org/show_bug.cgi?id=120477
35
36         Broke Windows build (assumes LLInt features not enabled on
37         this build) (Requested by bfulgham on #webkit).
38
39         * CMakeLists.txt:
40         * GNUmakefile.list.am:
41         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
42         * JavaScriptCore.xcodeproj/project.pbxproj:
43         * Target.pri:
44         * bytecode/CodeBlock.cpp:
45         (JSC::CodeBlock::linkIncomingCall):
46         (JSC::CodeBlock::unlinkIncomingCalls):
47         (JSC::CodeBlock::reoptimize):
48         (JSC::ProgramCodeBlock::replacement):
49         (JSC::EvalCodeBlock::replacement):
50         (JSC::FunctionCodeBlock::replacement):
51         (JSC::ProgramCodeBlock::compileOptimized):
52         (JSC::ProgramCodeBlock::replaceWithDeferredOptimizedCode):
53         (JSC::EvalCodeBlock::compileOptimized):
54         (JSC::EvalCodeBlock::replaceWithDeferredOptimizedCode):
55         (JSC::FunctionCodeBlock::compileOptimized):
56         (JSC::FunctionCodeBlock::replaceWithDeferredOptimizedCode):
57         (JSC::ProgramCodeBlock::jitCompileImpl):
58         (JSC::EvalCodeBlock::jitCompileImpl):
59         (JSC::FunctionCodeBlock::jitCompileImpl):
60         * bytecode/CodeBlock.h:
61         (JSC::CodeBlock::jitType):
62         (JSC::CodeBlock::jitCompile):
63         * bytecode/DeferredCompilationCallback.cpp: Removed.
64         * bytecode/DeferredCompilationCallback.h: Removed.
65         * dfg/DFGDriver.cpp:
66         (JSC::DFG::compile):
67         (JSC::DFG::tryCompile):
68         (JSC::DFG::tryCompileFunction):
69         (JSC::DFG::tryFinalizePlan):
70         * dfg/DFGDriver.h:
71         (JSC::DFG::tryCompile):
72         (JSC::DFG::tryCompileFunction):
73         (JSC::DFG::tryFinalizePlan):
74         * dfg/DFGFailedFinalizer.cpp:
75         (JSC::DFG::FailedFinalizer::finalize):
76         (JSC::DFG::FailedFinalizer::finalizeFunction):
77         * dfg/DFGFailedFinalizer.h:
78         * dfg/DFGFinalizer.h:
79         * dfg/DFGJITFinalizer.cpp:
80         (JSC::DFG::JITFinalizer::finalize):
81         (JSC::DFG::JITFinalizer::finalizeFunction):
82         * dfg/DFGJITFinalizer.h:
83         * dfg/DFGOSRExitPreparation.cpp:
84         (JSC::DFG::prepareCodeOriginForOSRExit):
85         * dfg/DFGOperations.cpp:
86         * dfg/DFGPlan.cpp:
87         (JSC::DFG::Plan::Plan):
88         (JSC::DFG::Plan::compileInThreadImpl):
89         (JSC::DFG::Plan::finalize):
90         * dfg/DFGPlan.h:
91         * dfg/DFGSpeculativeJIT32_64.cpp:
92         (JSC::DFG::SpeculativeJIT::compile):
93         * dfg/DFGWorklist.cpp:
94         (JSC::DFG::Worklist::completeAllReadyPlansForVM):
95         (JSC::DFG::Worklist::runThread):
96         * ftl/FTLJITFinalizer.cpp:
97         (JSC::FTL::JITFinalizer::finalize):
98         (JSC::FTL::JITFinalizer::finalizeFunction):
99         * ftl/FTLJITFinalizer.h:
100         * heap/Heap.h:
101         * interpreter/Interpreter.cpp:
102         (JSC::Interpreter::execute):
103         (JSC::Interpreter::executeCall):
104         (JSC::Interpreter::executeConstruct):
105         (JSC::Interpreter::prepareForRepeatCall):
106         * jit/JITDriver.h: Added.
107         (JSC::jitCompileIfAppropriateImpl):
108         (JSC::jitCompileFunctionIfAppropriateImpl):
109         (JSC::jitCompileIfAppropriate):
110         (JSC::jitCompileFunctionIfAppropriate):
111         * jit/JITStubs.cpp:
112         (JSC::DEFINE_STUB_FUNCTION):
113         (JSC::jitCompileFor):
114         (JSC::lazyLinkFor):
115         * jit/JITToDFGDeferredCompilationCallback.cpp: Removed.
116         * jit/JITToDFGDeferredCompilationCallback.h: Removed.
117         * llint/LLIntEntrypoints.cpp:
118         (JSC::LLInt::getFunctionEntrypoint):
119         (JSC::LLInt::getEvalEntrypoint):
120         (JSC::LLInt::getProgramEntrypoint):
121         * llint/LLIntEntrypoints.h:
122         (JSC::LLInt::getEntrypoint):
123         * llint/LLIntSlowPaths.cpp:
124         (JSC::LLInt::jitCompileAndSetHeuristics):
125         (JSC::LLInt::setUpCall):
126         * runtime/ArrayPrototype.cpp:
127         (JSC::isNumericCompareFunction):
128         * runtime/CommonSlowPaths.cpp:
129         * runtime/CompilationResult.cpp:
130         (WTF::printInternal):
131         * runtime/CompilationResult.h:
132         * runtime/Executable.cpp:
133         (JSC::EvalExecutable::compileOptimized):
134         (JSC::EvalExecutable::jitCompile):
135         (JSC::EvalExecutable::compileInternal):
136         (JSC::EvalExecutable::replaceWithDeferredOptimizedCode):
137         (JSC::ProgramExecutable::compileOptimized):
138         (JSC::ProgramExecutable::jitCompile):
139         (JSC::ProgramExecutable::compileInternal):
140         (JSC::ProgramExecutable::replaceWithDeferredOptimizedCode):
141         (JSC::FunctionExecutable::compileOptimizedForCall):
142         (JSC::FunctionExecutable::compileOptimizedForConstruct):
143         (JSC::FunctionExecutable::jitCompileForCall):
144         (JSC::FunctionExecutable::jitCompileForConstruct):
145         (JSC::FunctionExecutable::produceCodeBlockFor):
146         (JSC::FunctionExecutable::compileForCallInternal):
147         (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeForCall):
148         (JSC::FunctionExecutable::compileForConstructInternal):
149         (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeForConstruct):
150         * runtime/Executable.h:
151         (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor):
152         (JSC::ExecutableBase::offsetOfNumParametersFor):
153         (JSC::ExecutableBase::catchRoutineFor):
154         (JSC::EvalExecutable::compile):
155         (JSC::ProgramExecutable::compile):
156         (JSC::FunctionExecutable::compileForCall):
157         (JSC::FunctionExecutable::compileForConstruct):
158         (JSC::FunctionExecutable::compileFor):
159         (JSC::FunctionExecutable::compileOptimizedFor):
160         (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeFor):
161         (JSC::FunctionExecutable::jitCompileFor):
162         * runtime/ExecutionHarness.h: Added.
163         (JSC::prepareForExecutionImpl):
164         (JSC::prepareFunctionForExecutionImpl):
165         (JSC::installOptimizedCode):
166         (JSC::prepareForExecution):
167         (JSC::prepareFunctionForExecution):
168         (JSC::replaceWithDeferredOptimizedCode):
169
170 2013-08-28  Filip Pizlo  <fpizlo@apple.com>
171
172         CodeBlock compilation and installation should be simplified and rationalized
173         https://bugs.webkit.org/show_bug.cgi?id=120326
174
175         Reviewed by Oliver Hunt.
176         
177         Previously Executable owned the code for generating JIT code; you always had
178         to go through Executable. But often you also had to go through CodeBlock,
179         because ScriptExecutable couldn't have virtual methods, but CodeBlock could.
180         So you'd ask CodeBlock to do something, which would dispatch through a
181         virtual method that would select the appropriate Executable subtype's method.
182         This all meant that the same code would often be duplicated, because most of
183         the work needed to compile something was identical regardless of code type.
184         But then we tried to fix this, by having templatized helpers in
185         ExecutionHarness.h and JITDriver.h. The result was that if you wanted to find
186         out what happened when you asked for something to be compiled, you'd go on a
187         wild ride that started with CodeBlock, touched upon Executable, and then
188         ricocheted into either ExecutionHarness or JITDriver (likely both).
189         
190         Another awkwardness was that for concurrent compiles, the DFG::Worklist had
191         super-special inside knowledge of what JITStubs.cpp's cti_optimize would have
192         done once the compilation finished.
193         
194         Also, most of the DFG JIT drivers assumed that they couldn't install the
195         JITCode into the CodeBlock directly - instead they would return it via a
196         reference, which happened to be a reference to the JITCode pointer in
197         Executable. This was super weird.
198         
199         Finally, there was no notion of compiling code into a special CodeBlock that
200         wasn't used for handling calls into an Executable. I'd like this for FTL OSR
201         entry.
202         
203         This patch solves these problems by reducing all of that complexity into just
204         three primitives:
205         
206         - Executable::newCodeBlock(). This gives you a new code block, either for call
207           or for construct, and either to serve as the baseline code or the optimized
208           code. The new code block is then owned by the caller; Executable doesn't
209           register it anywhere. The new code block has no JITCode and isn't callable,
210           but it has all of the bytecode.
211         
212         - CodeBlock::prepareForExecution(). This takes the CodeBlock's bytecode and
213           produces a JITCode, and then installs the JITCode into the CodeBlock. This
214           method takes a JITType, and always compiles with that JIT. If you ask for
215           JITCode::InterpreterThunk then you'll get JITCode that just points to the
216           LLInt entrypoints. Once this returns, it is possible to call into the
217           CodeBlock if you do so manually - but the Executable still won't know about
218           it so JS calls to that Executable will still be routed to whatever CodeBlock
219           is associated with the Executable.
220         
221         - Executable::installCode(). This takes a CodeBlock and makes it the code-for-
222           entry for that Executable. This involves unlinking the Executable's last
223           CodeBlock, if there was one. This also tells the GC about any effect on
224           memory usage and does a bunch of weird data structure rewiring, since
225           Executable caches some of CodeBlock's fields for the benefit of virtual call
226           fast paths.
227         
228         This functionality is then wrapped around three convenience methods:
229         
230         - Executable::prepareForExecution(). If there is no code block for that
231           Executable, then one is created (newCodeBlock()), compiled
232           (CodeBlock::prepareForExecution()) and installed (installCode()).
233         
234         - CodeBlock::newReplacement(). Asks the Executable for a new CodeBlock that
235           can serve as an optimized replacement of the current one.
236         
237         - CodeBlock::install(). Asks the Executable to install this code block.
238         
239         This patch allows me to kill *a lot* of code and to remove a lot of
240         specializations for functions vs. not-functions, and a lot of places where we
241         pass around JITCode references and such. ExecutionHarness and JITDriver are
242         both gone. Overall this patch has more red than green.
243         
244         It also allows me to work on FTL OSR entry and tier-up:
245         
246         - FTL tier-up: this will involve DFGOperations.cpp asking the DFG::Worklist
247           to do some compilation, but it will require the DFG::Worklist to do
248           something different than what JITStubs.cpp would want, once the compilation
249           finishes. This patch introduces a callback mechanism for that purpose.
250         
251         - FTL OSR entry: this will involve creating a special auto-jettisoned
252           CodeBlock that is used only for FTL OSR entry. The new set of primitives
253           allows for this: Executable can vend you a fresh new CodeBlock, and you can
254           ask that CodeBlock to compile itself with any JIT of your choosing. Or you
255           can take that CodeBlock and compile it yourself. Previously the act of
256           producing a CodeBlock-for-optimization and the act of compiling code for it
257           were tightly coupled; now you can separate them and you can create such
258           auto-jettisoned CodeBlocks that are used for a one-shot OSR entry.
259
260         * CMakeLists.txt:
261         * GNUmakefile.list.am:
262         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
263         * JavaScriptCore.xcodeproj/project.pbxproj:
264         * Target.pri:
265         * bytecode/CodeBlock.cpp:
266         (JSC::CodeBlock::prepareForExecution):
267         (JSC::CodeBlock::install):
268         (JSC::CodeBlock::newReplacement):
269         (JSC::FunctionCodeBlock::jettisonImpl):
270         (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
271         * bytecode/CodeBlock.h:
272         (JSC::CodeBlock::hasBaselineJITProfiling):
273         * bytecode/DeferredCompilationCallback.cpp: Added.
274         (JSC::DeferredCompilationCallback::DeferredCompilationCallback):
275         (JSC::DeferredCompilationCallback::~DeferredCompilationCallback):
276         * bytecode/DeferredCompilationCallback.h: Added.
277         * dfg/DFGDriver.cpp:
278         (JSC::DFG::tryCompile):
279         * dfg/DFGDriver.h:
280         (JSC::DFG::tryCompile):
281         * dfg/DFGFailedFinalizer.cpp:
282         (JSC::DFG::FailedFinalizer::finalize):
283         (JSC::DFG::FailedFinalizer::finalizeFunction):
284         * dfg/DFGFailedFinalizer.h:
285         * dfg/DFGFinalizer.h:
286         * dfg/DFGJITFinalizer.cpp:
287         (JSC::DFG::JITFinalizer::finalize):
288         (JSC::DFG::JITFinalizer::finalizeFunction):
289         * dfg/DFGJITFinalizer.h:
290         * dfg/DFGOSRExitPreparation.cpp:
291         (JSC::DFG::prepareCodeOriginForOSRExit):
292         * dfg/DFGOperations.cpp:
293         * dfg/DFGPlan.cpp:
294         (JSC::DFG::Plan::Plan):
295         (JSC::DFG::Plan::compileInThreadImpl):
296         (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
297         (JSC::DFG::Plan::finalizeAndNotifyCallback):
298         * dfg/DFGPlan.h:
299         * dfg/DFGWorklist.cpp:
300         (JSC::DFG::Worklist::completeAllReadyPlansForVM):
301         * ftl/FTLJITFinalizer.cpp:
302         (JSC::FTL::JITFinalizer::finalize):
303         (JSC::FTL::JITFinalizer::finalizeFunction):
304         * ftl/FTLJITFinalizer.h:
305         * heap/Heap.h:
306         (JSC::Heap::isDeferred):
307         * interpreter/Interpreter.cpp:
308         (JSC::Interpreter::execute):
309         (JSC::Interpreter::executeCall):
310         (JSC::Interpreter::executeConstruct):
311         (JSC::Interpreter::prepareForRepeatCall):
312         * jit/JITDriver.h: Removed.
313         * jit/JITStubs.cpp:
314         (JSC::DEFINE_STUB_FUNCTION):
315         (JSC::jitCompileFor):
316         (JSC::lazyLinkFor):
317         * jit/JITToDFGDeferredCompilationCallback.cpp: Added.
318         (JSC::JITToDFGDeferredCompilationCallback::JITToDFGDeferredCompilationCallback):
319         (JSC::JITToDFGDeferredCompilationCallback::~JITToDFGDeferredCompilationCallback):
320         (JSC::JITToDFGDeferredCompilationCallback::create):
321         (JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
322         * jit/JITToDFGDeferredCompilationCallback.h: Added.
323         * llint/LLIntEntrypoints.cpp:
324         (JSC::LLInt::setFunctionEntrypoint):
325         (JSC::LLInt::setEvalEntrypoint):
326         (JSC::LLInt::setProgramEntrypoint):
327         * llint/LLIntEntrypoints.h:
328         * llint/LLIntSlowPaths.cpp:
329         (JSC::LLInt::jitCompileAndSetHeuristics):
330         (JSC::LLInt::setUpCall):
331         * runtime/ArrayPrototype.cpp:
332         (JSC::isNumericCompareFunction):
333         * runtime/CommonSlowPaths.cpp:
334         * runtime/CompilationResult.cpp:
335         (WTF::printInternal):
336         * runtime/CompilationResult.h:
337         * runtime/Executable.cpp:
338         (JSC::ScriptExecutable::installCode):
339         (JSC::ScriptExecutable::newCodeBlockFor):
340         (JSC::ScriptExecutable::newReplacementCodeBlockFor):
341         (JSC::ScriptExecutable::prepareForExecutionImpl):
342         * runtime/Executable.h:
343         (JSC::ScriptExecutable::prepareForExecution):
344         (JSC::FunctionExecutable::jettisonOptimizedCodeFor):
345         * runtime/ExecutionHarness.h: Removed.
346
347 2013-08-28  Chris Curtis  <chris_curtis@apple.com>
348
349         https://bugs.webkit.org/show_bug.cgi?id=119548
350         Refactoring Exception throws.
351         
352         Reviewed by Geoffrey Garen.
353         
354         Gardening of exception throws. The act of throwing an exception was being handled in 
355         different ways depending on whether the code was running in the LLint, Baseline JIT, 
356         or the DFG Jit. This made development in the vm exception and error objects difficult.
357         
358          * runtime/VM.cpp:
359         (JSC::appendSourceToError): 
360         This function moved from the interpreter into the VM. It views the developers code
361         (if there is a codeBlock) to extract what was trying to be evaluated when the error
362         occurred.
363         
364         (JSC::VM::throwException):
365         This function takes in the error object and sets the following:
366             1: The VM's exception stack
367             2: The VM's exception 
368             3: Appends extra information on the error message(via appendSourceToError)
369             4: The error object's line number
370             5: The error object's column number
371             6: The error object's sourceURL
372             7: The error object's stack trace (unless it already exists because the developer 
373                 created the error object). 
374
375         (JSC::VM::getExceptionInfo):
376         (JSC::VM::setExceptionInfo):
377         (JSC::VM::clearException):
378         (JSC::clearExceptionStack):
379         * runtime/VM.h:
380         (JSC::VM::exceptionOffset):
381         (JSC::VM::exception):
382         (JSC::VM::addressOfException):
383         (JSC::VM::exceptionStack):
384         VM exception and exceptionStack are now private data members.
385
386         * interpreter/Interpreter.h:
387         (JSC::ClearExceptionScope::ClearExceptionScope):
388         Created this structure to temporarily clear the exception within the VM. This 
389         needed to see if addition errors occur when setting the debugger as we are 
390         unwinding the stack.
391
392          * interpreter/Interpreter.cpp:
393         (JSC::Interpreter::unwind): 
394         Removed the code that would try to add error information if it did not exist. 
395         All of this functionality has moved into the VM and all error information is set 
396         at the time the error occurs. 
397
398         The rest of these functions reference the new calling convention to throw an error.
399
400         * API/APICallbackFunction.h:
401         (JSC::APICallbackFunction::call):
402         * API/JSCallbackConstructor.cpp:
403         (JSC::constructJSCallback):
404         * API/JSCallbackObjectFunctions.h:
405         (JSC::::getOwnPropertySlot):
406         (JSC::::defaultValue):
407         (JSC::::put):
408         (JSC::::putByIndex):
409         (JSC::::deleteProperty):
410         (JSC::::construct):
411         (JSC::::customHasInstance):
412         (JSC::::call):
413         (JSC::::getStaticValue):
414         (JSC::::staticFunctionGetter):
415         (JSC::::callbackGetter):
416         * debugger/Debugger.cpp:
417         (JSC::evaluateInGlobalCallFrame):
418         * debugger/DebuggerCallFrame.cpp:
419         (JSC::DebuggerCallFrame::evaluate):
420         * dfg/DFGAssemblyHelpers.h:
421         (JSC::DFG::AssemblyHelpers::emitExceptionCheck):
422         * dfg/DFGOperations.cpp:
423         (JSC::DFG::operationPutByValInternal):
424         * ftl/FTLLowerDFGToLLVM.cpp:
425         (JSC::FTL::LowerDFGToLLVM::callCheck):
426         * heap/Heap.cpp:
427         (JSC::Heap::markRoots):
428         * interpreter/CallFrame.h:
429         (JSC::ExecState::clearException):
430         (JSC::ExecState::exception):
431         (JSC::ExecState::hadException):
432         * interpreter/Interpreter.cpp:
433         (JSC::eval):
434         (JSC::loadVarargs):
435         (JSC::stackTraceAsString):
436         (JSC::Interpreter::execute):
437         (JSC::Interpreter::executeCall):
438         (JSC::Interpreter::executeConstruct):
439         (JSC::Interpreter::prepareForRepeatCall):
440         * interpreter/Interpreter.h:
441         (JSC::ClearExceptionScope::ClearExceptionScope):
442         * jit/JITCode.cpp:
443         (JSC::JITCode::execute):
444         * jit/JITExceptions.cpp:
445         (JSC::genericThrow):
446         * jit/JITOpcodes.cpp:
447         (JSC::JIT::emit_op_catch):
448         * jit/JITOpcodes32_64.cpp:
449         (JSC::JIT::privateCompileCTINativeCall):
450         (JSC::JIT::emit_op_catch):
451         * jit/JITStubs.cpp:
452         (JSC::returnToThrowTrampoline):
453         (JSC::throwExceptionFromOpCall):
454         (JSC::DEFINE_STUB_FUNCTION):
455         (JSC::jitCompileFor):
456         (JSC::lazyLinkFor):
457         (JSC::putByVal):
458         (JSC::cti_vm_handle_exception):
459         * jit/SlowPathCall.h:
460         (JSC::JITSlowPathCall::call):
461         * jit/ThunkGenerators.cpp:
462         (JSC::nativeForGenerator):
463         * jsc.cpp:
464         (functionRun):
465         (functionLoad):
466         (functionCheckSyntax):
467         * llint/LLIntExceptions.cpp:
468         (JSC::LLInt::doThrow):
469         (JSC::LLInt::returnToThrow):
470         (JSC::LLInt::callToThrow):
471         * llint/LLIntSlowPaths.cpp:
472         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
473         * llint/LowLevelInterpreter.cpp:
474         (JSC::CLoop::execute):
475         * llint/LowLevelInterpreter32_64.asm:
476         * llint/LowLevelInterpreter64.asm:
477         * runtime/ArrayConstructor.cpp:
478         (JSC::constructArrayWithSizeQuirk):
479         * runtime/CommonSlowPaths.cpp:
480         (JSC::SLOW_PATH_DECL):
481         * runtime/CommonSlowPaths.h:
482         (JSC::CommonSlowPaths::opIn):
483         * runtime/CommonSlowPathsExceptions.cpp:
484         (JSC::CommonSlowPaths::interpreterThrowInCaller):
485         * runtime/Completion.cpp:
486         (JSC::evaluate):
487         * runtime/Error.cpp:
488         (JSC::addErrorInfo):
489         (JSC::throwTypeError):
490         (JSC::throwSyntaxError):
491         * runtime/Error.h:
492         (JSC::throwVMError):
493         * runtime/ExceptionHelpers.cpp:
494         (JSC::throwOutOfMemoryError):
495         (JSC::throwStackOverflowError):
496         (JSC::throwTerminatedExecutionException):
497         * runtime/Executable.cpp:
498         (JSC::EvalExecutable::create):
499         (JSC::FunctionExecutable::produceCodeBlockFor):
500         * runtime/FunctionConstructor.cpp:
501         (JSC::constructFunction):
502         (JSC::constructFunctionSkippingEvalEnabledCheck):
503         * runtime/JSArray.cpp:
504         (JSC::JSArray::defineOwnProperty):
505         (JSC::JSArray::put):
506         (JSC::JSArray::push):
507         * runtime/JSCJSValue.cpp:
508         (JSC::JSValue::toObjectSlowCase):
509         (JSC::JSValue::synthesizePrototype):
510         (JSC::JSValue::putToPrimitive):
511         * runtime/JSFunction.cpp:
512         (JSC::JSFunction::defineOwnProperty):
513         * runtime/JSGenericTypedArrayViewInlines.h:
514         (JSC::::create):
515         (JSC::::createUninitialized):
516         (JSC::::validateRange):
517         (JSC::::setWithSpecificType):
518         * runtime/JSGlobalObjectFunctions.cpp:
519         (JSC::encode):
520         (JSC::decode):
521         (JSC::globalFuncProtoSetter):
522         * runtime/JSNameScope.cpp:
523         (JSC::JSNameScope::put):
524         * runtime/JSONObject.cpp:
525         (JSC::Stringifier::appendStringifiedValue):
526         (JSC::Walker::walk):
527         * runtime/JSObject.cpp:
528         (JSC::JSObject::put):
529         (JSC::JSObject::defaultValue):
530         (JSC::JSObject::hasInstance):
531         (JSC::JSObject::defaultHasInstance):
532         (JSC::JSObject::defineOwnNonIndexProperty):
533         (JSC::throwTypeError):
534         * runtime/ObjectConstructor.cpp:
535         (JSC::toPropertyDescriptor):
536         * runtime/RegExpConstructor.cpp:
537         (JSC::constructRegExp):
538         * runtime/StringObject.cpp:
539         (JSC::StringObject::defineOwnProperty):
540         * runtime/StringRecursionChecker.cpp:
541         (JSC::StringRecursionChecker::throwStackOverflowError):
542
543 2013-08-28  Zan Dobersek  <zdobersek@igalia.com>
544
545         [GTK] Add support for building JSC with FTL JIT enabled
546         https://bugs.webkit.org/show_bug.cgi?id=120270
547
548         Reviewed by Filip Pizlo.
549
550         * GNUmakefile.am: Add LLVM_LIBS to the list of linker flags and LLVM_CFLAGS to the list of
551         compiler flags for the JSC library.
552         * GNUmakefile.list.am: Add the missing build targets.
553         * ftl/FTLAbbreviations.h: Include the <cstring> header and use std::strlen. This avoids compilation
554         failures when using the Clang compiler with the libstdc++ standard library.
555         (JSC::FTL::mdKindID):
556         (JSC::FTL::mdString):
557
558 2013-08-23  Andy Estes  <aestes@apple.com>
559
560         Fix issues found by the Clang Static Analyzer
561         https://bugs.webkit.org/show_bug.cgi?id=120230
562
563         Reviewed by Darin Adler.
564
565         * API/JSValue.mm:
566         (valueToString): Don't leak every CFStringRef when in Objective-C GC.
567         * API/ObjCCallbackFunction.mm:
568         (JSC::ObjCCallbackFunctionImpl::~ObjCCallbackFunctionImpl): Don't
569         release m_invocation's target since NSInvocation will do it for us on
570         -dealloc.
571         (objCCallbackFunctionForBlock): Tell NSInvocation to retain its target
572         and -release our reference to the copied block.
573         * API/tests/minidom.c:
574         (createStringWithContentsOfFile): Free buffer before returning.
575         * API/tests/testapi.c:
576         (createStringWithContentsOfFile): Ditto.
577
578 2013-08-26  Brent Fulgham  <bfulgham@apple.com>
579
580         [Windows] Unreviewed build fix after r154629.
581
582         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add missing build files.
583         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
584
585 2013-08-26  Ryosuke Niwa  <rniwa@webkit.org>
586
587         Windows build fix attempt after r154629.
588
589         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
590
591 2013-08-25  Mark Hahnenberg  <mhahnenberg@apple.com>
592
593         JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage does a check on the length of the ArrayStorage after possible reallocing it
594         https://bugs.webkit.org/show_bug.cgi?id=120278
595
596         Reviewed by Geoffrey Garen.
597
598         * runtime/JSObject.cpp:
599         (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
600
601 2013-08-26  Filip Pizlo  <fpizlo@apple.com>
602
603         Fix indention of Executable.h.
604
605         Rubber stamped by Mark Hahnenberg.
606
607         * runtime/Executable.h:
608
609 2013-08-26  Mark Hahnenberg  <mhahnenberg@apple.com>
610
611         Object.defineProperty should be able to create a PropertyDescriptor where m_attributes == 0
612         https://bugs.webkit.org/show_bug.cgi?id=120314
613
614         Reviewed by Darin Adler.
615
616         Currently with the way that defineProperty works, we leave a stray low bit set in 
617         PropertyDescriptor::m_attributes in the following code:
618
619         var o = {};
620         Object.defineProperty(o, 100, {writable:true, enumerable:true, configurable:true, value:"foo"});
621         
622         This is due to the fact that the lowest non-zero attribute (ReadOnly) is represented as 1 << 1 
623         instead of 1 << 0. We then calculate the default attributes as (DontDelete << 1) - 1, which is 0xF, 
624         but only the top three bits mean anything. Even in the case above, the top three bits are set 
625         to 0 but the bottom bit remains set, which causes us to think m_attributes is non-zero.
626
627         Since some of these attributes and their corresponding values are exposed in the JavaScriptCore 
628         framework's public C API, it's safer to just change how we calculate the default value, which is
629         where the weirdness was originating from in the first place.
630
631         * runtime/PropertyDescriptor.cpp:
632
633 2013-08-24  Sam Weinig  <sam@webkit.org>
634
635         Add support for Promises
636         https://bugs.webkit.org/show_bug.cgi?id=120260
637
638         Reviewed by Darin Adler.
639
640         Add an initial implementation of Promises - http://dom.spec.whatwg.org/#promises.
641         - Despite Promises being defined in the DOM, the implementation is being put in JSC
642           in preparation for the Promises eventually being defined in ECMAScript.
643
644         * CMakeLists.txt:
645         * DerivedSources.make:
646         * DerivedSources.pri:
647         * GNUmakefile.list.am:
648         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
649         * JavaScriptCore.xcodeproj/project.pbxproj:
650         * Target.pri:
651         Add new files.
652
653         * jsc.cpp:
654         Update jsc's GlobalObjectMethodTable to stub out the new QueueTaskToEventLoop callback. This mean's
655         you can't quite use Promises with with the command line tool yet.
656     
657         * interpreter/CallFrame.h:
658         (JSC::ExecState::promisePrototypeTable):
659         (JSC::ExecState::promiseConstructorTable):
660         (JSC::ExecState::promiseResolverPrototypeTable):
661         * runtime/VM.cpp:
662         (JSC::VM::VM):
663         (JSC::VM::~VM):
664         * runtime/VM.h:
665         Add supporting code for the new static lookup tables.
666
667         * runtime/CommonIdentifiers.h:
668         Add 3 new identifiers, "Promise", "PromiseResolver", and "then".
669
670         * runtime/JSGlobalObject.cpp:
671         (JSC::JSGlobalObject::reset):
672         (JSC::JSGlobalObject::visitChildren):
673         Add supporting code Promise and PromiseResolver's constructors and structures.
674
675         * runtime/JSGlobalObject.h:
676         (JSC::TaskContext::~TaskContext):
677         Add a new callback to the GlobalObjectMethodTable to post a task on the embedder's runloop.
678
679         (JSC::JSGlobalObject::promisePrototype):
680         (JSC::JSGlobalObject::promiseResolverPrototype):
681         (JSC::JSGlobalObject::promiseStructure):
682         (JSC::JSGlobalObject::promiseResolverStructure):
683         (JSC::JSGlobalObject::promiseCallbackStructure):
684         (JSC::JSGlobalObject::promiseWrapperCallbackStructure):
685         Add supporting code Promise and PromiseResolver's constructors and structures.
686
687         * runtime/JSPromise.cpp: Added.
688         * runtime/JSPromise.h: Added.
689         * runtime/JSPromiseCallback.cpp: Added.
690         * runtime/JSPromiseCallback.h: Added.
691         * runtime/JSPromiseConstructor.cpp: Added.
692         * runtime/JSPromiseConstructor.h: Added.
693         * runtime/JSPromisePrototype.cpp: Added.
694         * runtime/JSPromisePrototype.h: Added.
695         * runtime/JSPromiseResolver.cpp: Added.
696         * runtime/JSPromiseResolver.h: Added.
697         * runtime/JSPromiseResolverConstructor.cpp: Added.
698         * runtime/JSPromiseResolverConstructor.h: Added.
699         * runtime/JSPromiseResolverPrototype.cpp: Added.
700         * runtime/JSPromiseResolverPrototype.h: Added.
701         Add Promise implementation.
702
703 2013-08-26  Zan Dobersek  <zdobersek@igalia.com>
704
705         Plenty of -Wcast-align warnings in KeywordLookup.h
706         https://bugs.webkit.org/show_bug.cgi?id=120316
707
708         Reviewed by Darin Adler.
709
710         * KeywordLookupGenerator.py: Use reinterpret_cast instead of a C-style cast when casting
711         the character pointers to types of larger size. This avoids spewing lots of warnings
712         in the KeywordLookup.h header when compiling with the -Wcast-align option.
713
714 2013-08-26  Gavin Barraclough  <barraclough@apple.com>
715
716         RegExpMatchesArray should not call [[put]]
717         https://bugs.webkit.org/show_bug.cgi?id=120317
718
719         Reviewed by Oliver Hunt.
720
721         This will call accessors on the JSObject/JSArray prototypes - so adding an accessor or read-only
722         property called index or input to either of these prototypes will result in broken behavior.
723
724         * runtime/RegExpMatchesArray.cpp:
725         (JSC::RegExpMatchesArray::reifyAllProperties):
726             - put -> putDirect
727
728 2013-08-24  Filip Pizlo  <fpizlo@apple.com>
729
730         FloatTypedArrayAdaptor::toJSValue should almost certainly not use jsNumber() since that attempts int conversions
731         https://bugs.webkit.org/show_bug.cgi?id=120228
732
733         Reviewed by Oliver Hunt.
734         
735         It turns out that there were three problems:
736         
737         - Using jsNumber() meant that we were converting doubles to integers and then
738           possibly back again whenever doing a set() between floating point arrays.
739         
740         - Slow-path accesses to double typed arrays were slower than necessary because
741           of the to-int conversion attempt.
742         
743         - The use of JSValue as an intermediate for converting between differen types
744           in typedArray.set() resulted in worse code than I had previously expected.
745         
746         This patch solves the problem by using template double-dispatch to ensure that
747         that C++ compiler sees the simplest possible combination of casts between any
748         combination of typed array types, while still preserving JS and typed array
749         conversion semantics. Conversions are done as follows:
750         
751             SourceAdaptor::convertTo<TargetAdaptor>(value)
752         
753         Internally, convertTo() calls one of three possible methods on TargetAdaptor,
754         with one method for each of int32_t, uint32_t, and double. This means that the
755         C++ compiler will at worst see a widening cast to one of those types followed
756         by a narrowing conversion (not necessarily a cast - may have clamping or the
757         JS toInt32() function).
758         
759         This change doesn't just affect typedArray.set(); it also affects slow-path
760         accesses to typed arrays as well. This patch also adds a bunch of new test
761         coverage.
762         
763         This change is a ~50% speed-up on typedArray.set() involving floating point
764         types.
765
766         * GNUmakefile.list.am:
767         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
768         * JavaScriptCore.xcodeproj/project.pbxproj:
769         * runtime/GenericTypedArrayView.h:
770         (JSC::GenericTypedArrayView::set):
771         * runtime/JSDataViewPrototype.cpp:
772         (JSC::setData):
773         * runtime/JSGenericTypedArrayView.h:
774         (JSC::JSGenericTypedArrayView::setIndexQuicklyToDouble):
775         (JSC::JSGenericTypedArrayView::setIndexQuickly):
776         * runtime/JSGenericTypedArrayViewInlines.h:
777         (JSC::::setWithSpecificType):
778         (JSC::::set):
779         * runtime/ToNativeFromValue.h: Added.
780         (JSC::toNativeFromValue):
781         * runtime/TypedArrayAdaptors.h:
782         (JSC::IntegralTypedArrayAdaptor::toJSValue):
783         (JSC::IntegralTypedArrayAdaptor::toDouble):
784         (JSC::IntegralTypedArrayAdaptor::toNativeFromInt32):
785         (JSC::IntegralTypedArrayAdaptor::toNativeFromUint32):
786         (JSC::IntegralTypedArrayAdaptor::toNativeFromDouble):
787         (JSC::IntegralTypedArrayAdaptor::convertTo):
788         (JSC::FloatTypedArrayAdaptor::toJSValue):
789         (JSC::FloatTypedArrayAdaptor::toDouble):
790         (JSC::FloatTypedArrayAdaptor::toNativeFromInt32):
791         (JSC::FloatTypedArrayAdaptor::toNativeFromUint32):
792         (JSC::FloatTypedArrayAdaptor::toNativeFromDouble):
793         (JSC::FloatTypedArrayAdaptor::convertTo):
794         (JSC::Uint8ClampedAdaptor::toJSValue):
795         (JSC::Uint8ClampedAdaptor::toDouble):
796         (JSC::Uint8ClampedAdaptor::toNativeFromInt32):
797         (JSC::Uint8ClampedAdaptor::toNativeFromUint32):
798         (JSC::Uint8ClampedAdaptor::toNativeFromDouble):
799         (JSC::Uint8ClampedAdaptor::convertTo):
800
801 2013-08-24  Dan Bernstein  <mitz@apple.com>
802
803         [mac] link against libz in a more civilized manner
804         https://bugs.webkit.org/show_bug.cgi?id=120258
805
806         Reviewed by Darin Adler.
807
808         * Configurations/JavaScriptCore.xcconfig: Removed “-lz” from OTHER_LDFLAGS_BASE.
809         * JavaScriptCore.xcodeproj/project.pbxproj: Added libz.dylib to the JavaScriptCore target’s
810         Link Binary With Libraries build phase.
811
812 2013-08-23  Laszlo Papp  <lpapp@kde.org>
813
814         Failure building with python3
815         https://bugs.webkit.org/show_bug.cgi?id=106645
816
817         Reviewed by Benjamin Poulain.
818
819         Use print functions instead of python statements to be compatible with python 3.X and 2.7 as well.
820         Archlinux has been using python3 and that is what causes issues while packaging QtWebKit along with Qt5.
821
822         * disassembler/udis86/itab.py:
823         (UdItabGenerator.genInsnTable):
824         * disassembler/udis86/ud_opcode.py:
825         (UdOpcodeTables.print_table):
826         * disassembler/udis86/ud_optable.py:
827         (UdOptableXmlParser.parseDef):
828         (UdOptableXmlParser.parse):
829         (printFn):
830
831 2013-08-23  Filip Pizlo  <fpizlo@apple.com>
832
833         Incorrect TypedArray#set behavior
834         https://bugs.webkit.org/show_bug.cgi?id=83818
835
836         Reviewed by Oliver Hunt and Mark Hahnenberg.
837         
838         This was so much fun! typedArray.set() is like a memmove on steroids, and I'm
839         not smart enough to figure out optimal versions for *all* of the cases. But I
840         did come up with optimal implementations for most of the cases, and I wrote
841         spec-literal code (i.e. copy via a transfer buffer) for the cases I'm not smart
842         enough to write optimal code for.
843
844         * runtime/JSArrayBufferView.h:
845         (JSC::JSArrayBufferView::hasArrayBuffer):
846         * runtime/JSArrayBufferViewInlines.h:
847         (JSC::JSArrayBufferView::buffer):
848         (JSC::JSArrayBufferView::existingBufferInButterfly):
849         (JSC::JSArrayBufferView::neuter):
850         (JSC::JSArrayBufferView::byteOffset):
851         * runtime/JSGenericTypedArrayView.h:
852         * runtime/JSGenericTypedArrayViewInlines.h:
853         (JSC::::setWithSpecificType):
854         (JSC::::set):
855         (JSC::::existingBuffer):
856
857 2013-08-23  Alex Christensen  <achristensen@apple.com>
858
859         Re-separating Win32 and Win64 builds.
860         https://bugs.webkit.org/show_bug.cgi?id=120178
861
862         Reviewed by Brent Fulgham.
863
864         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
865         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
866         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
867         Pass PlatformArchitecture as a command line parameter to bash scripts.
868         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
869         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
870         * JavaScriptCore.vcxproj/build-generated-files.sh:
871         Use PlatformArchitecture from command line to determine which object directory to use (obj32 or obj64).
872
873 2013-08-22  Filip Pizlo  <fpizlo@apple.com>
874
875         build-jsc --ftl-jit should work
876         https://bugs.webkit.org/show_bug.cgi?id=120194
877
878         Reviewed by Oliver Hunt.
879
880         * Configurations/Base.xcconfig: CPPFLAGS should include FEATURE_DEFINES
881         * Configurations/JSC.xcconfig: The 'jsc' tool includes headers where field layout may depend on FEATURE_DEFINES
882         * Configurations/ToolExecutable.xcconfig: All other tools include headers where field layout may depend on FEATURE_DEFINES
883         * ftl/FTLLowerDFGToLLVM.cpp: Build fix
884         (JSC::FTL::LowerDFGToLLVM::compilePutStructure):
885         (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
886
887 2013-08-23  Oliver Hunt  <oliver@apple.com>
888
889         Re-sort xcode project file
890
891         * JavaScriptCore.xcodeproj/project.pbxproj:
892
893 2013-08-23  Oliver Hunt  <oliver@apple.com>
894
895         Support in memory compression of rarely used data
896         https://bugs.webkit.org/show_bug.cgi?id=120143
897
898         Reviewed by Gavin Barraclough.
899
900         Include zlib in LD_FLAGS and make UnlinkedCodeBlock make use of CompressibleVector.  This saves ~200k on google maps.
901
902         * Configurations/JavaScriptCore.xcconfig:
903         * bytecode/UnlinkedCodeBlock.cpp:
904         (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset):
905         (JSC::UnlinkedCodeBlock::addExpressionInfo):
906         * bytecode/UnlinkedCodeBlock.h:
907
908 2013-08-22  Mark Hahnenberg  <mhahnenberg@apple.com>
909
910         JSObject and JSArray code shouldn't have to tiptoe around garbage collection
911         https://bugs.webkit.org/show_bug.cgi?id=120179
912
913         Reviewed by Geoffrey Garen.
914
915         There are many places in the code for JSObject and JSArray where they are manipulating their 
916         Butterfly/Structure, e.g. after expanding their out-of-line backing storage via allocating. Within 
917         these places there are certain "critical sections" where a GC would be disastrous. Gen GC looks 
918         like it will make this dance even more intricate. To make everybody's lives easier we should use 
919         the DeferGC mechanism in these functions to make these GC critical sections both obvious in the 
920         code and trivially safe. Deferring collections will usually only last marginally longer, thus we 
921         should not incur any additional overhead.
922
923         * heap/Heap.h:
924         * runtime/JSArray.cpp:
925         (JSC::JSArray::unshiftCountSlowCase):
926         * runtime/JSObject.cpp:
927         (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
928         (JSC::JSObject::createInitialUndecided):
929         (JSC::JSObject::createInitialInt32):
930         (JSC::JSObject::createInitialDouble):
931         (JSC::JSObject::createInitialContiguous):
932         (JSC::JSObject::createArrayStorage):
933         (JSC::JSObject::convertUndecidedToArrayStorage):
934         (JSC::JSObject::convertInt32ToArrayStorage):
935         (JSC::JSObject::convertDoubleToArrayStorage):
936         (JSC::JSObject::convertContiguousToArrayStorage):
937         (JSC::JSObject::increaseVectorLength):
938         (JSC::JSObject::ensureLengthSlow):
939         * runtime/JSObject.h:
940         (JSC::JSObject::putDirectInternal):
941         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
942         (JSC::JSObject::putDirectWithoutTransition):
943
944 2013-08-22  Filip Pizlo  <fpizlo@apple.com>
945
946         Update LLVM binary drops and scripts to the latest version from SVN
947         https://bugs.webkit.org/show_bug.cgi?id=120184
948
949         Reviewed by Mark Hahnenberg.
950
951         * dfg/DFGPlan.cpp:
952         (JSC::DFG::Plan::compileInThreadImpl):
953
954 2013-08-22  Gavin Barraclough  <barraclough@apple.com>
955
956         Don't leak registers for redeclared variables
957         https://bugs.webkit.org/show_bug.cgi?id=120174
958
959         Reviewed by Geoff Garen.
960
961         We currently always allocate registers for new global variables, but these are wasted when the variable is being redeclared.
962         Only allocate new registers when necessary.
963
964         No performance impact.
965
966         * interpreter/Interpreter.cpp:
967         (JSC::Interpreter::execute):
968         * runtime/Executable.cpp:
969         (JSC::ProgramExecutable::initializeGlobalProperties):
970             - Don't allocate the register here.
971         * runtime/JSGlobalObject.cpp:
972         (JSC::JSGlobalObject::addGlobalVar):
973             - Allocate the register here instead.
974
975 2013-08-22  Gavin Barraclough  <barraclough@apple.com>
976
977         https://bugs.webkit.org/show_bug.cgi?id=120128
978         Remove putDirectVirtual
979
980         Unreviewed, checked in commented out code. :-(
981
982         * interpreter/Interpreter.cpp:
983         (JSC::Interpreter::execute):
984             - delete commented out code
985
986 2013-08-22  Gavin Barraclough  <barraclough@apple.com>
987
988         Error.stack should not be enumerable
989         https://bugs.webkit.org/show_bug.cgi?id=120171
990
991         Reviewed by Oliver Hunt.
992
993         Breaks ECMA tests.
994
995         * runtime/ErrorInstance.cpp:
996         (JSC::ErrorInstance::finishCreation):
997             - None -> DontEnum
998
999 2013-08-21  Gavin Barraclough  <barraclough@apple.com>
1000
1001         https://bugs.webkit.org/show_bug.cgi?id=120128
1002         Remove putDirectVirtual
1003
1004         Reviewed by Sam Weinig.
1005
1006         This could most generously be described as 'vestigial'.
1007         No performance impact.
1008
1009         * API/JSObjectRef.cpp:
1010         (JSObjectSetProperty):
1011             - changed to use defineOwnProperty
1012         * debugger/DebuggerActivation.cpp:
1013         * debugger/DebuggerActivation.h:
1014             - remove putDirectVirtual
1015         * interpreter/Interpreter.cpp:
1016         (JSC::Interpreter::execute):
1017             - changed to use defineOwnProperty
1018         * runtime/ClassInfo.h:
1019         * runtime/JSActivation.cpp:
1020         * runtime/JSActivation.h:
1021         * runtime/JSCell.cpp:
1022         * runtime/JSCell.h:
1023         * runtime/JSGlobalObject.cpp:
1024         * runtime/JSGlobalObject.h:
1025         * runtime/JSObject.cpp:
1026         * runtime/JSObject.h:
1027         * runtime/JSProxy.cpp:
1028         * runtime/JSProxy.h:
1029         * runtime/JSSymbolTableObject.cpp:
1030         * runtime/JSSymbolTableObject.h:
1031             - remove putDirectVirtual
1032         * runtime/PropertyDescriptor.h:
1033         (JSC::PropertyDescriptor::PropertyDescriptor):
1034             - added constructor for convenience
1035
1036 2013-08-22  Chris Curtis  <chris_curtis@apple.com>
1037
1038         errorDescriptionForValue() should not assume error value is an Object
1039         https://bugs.webkit.org/show_bug.cgi?id=119812
1040
1041         Reviewed by Geoffrey Garen.
1042
1043         Added a check to make sure that the JSValue was an object before casting it as an object. Also, in case the parameterized JSValue
1044         has no type, the function now returns the empty string. 
1045         * runtime/ExceptionHelpers.cpp:
1046         (JSC::errorDescriptionForValue):
1047
1048 2013-08-22  Julien Brianceau  <jbrianceau@nds.com>
1049
1050         Fix P_DFGOperation_EJS call for MIPS and ARM EABI.
1051         https://bugs.webkit.org/show_bug.cgi?id=120107
1052
1053         Reviewed by Yong Li.
1054
1055         EncodedJSValue parameters must be aligned to even registers for MIPS and ARM EABI.
1056
1057         * dfg/DFGSpeculativeJIT.h:
1058         (JSC::DFG::SpeculativeJIT::callOperation):
1059
1060 2013-08-21  Commit Queue  <commit-queue@webkit.org>
1061
1062         Unreviewed, rolling out r154416.
1063         http://trac.webkit.org/changeset/154416
1064         https://bugs.webkit.org/show_bug.cgi?id=120147
1065
1066         Broke Windows builds (Requested by rniwa on #webkit).
1067
1068         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
1069         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
1070         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
1071         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
1072         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
1073         * JavaScriptCore.vcxproj/build-generated-files.sh:
1074
1075 2013-08-21  Gavin Barraclough  <barraclough@apple.com>
1076
1077         Clarify var/const/function declaration
1078         https://bugs.webkit.org/show_bug.cgi?id=120144
1079
1080         Reviewed by Sam Weinig.
1081
1082         Add methods to JSGlobalObject to declare vars, consts, and functions.
1083
1084         * runtime/Executable.cpp:
1085         (JSC::ProgramExecutable::initializeGlobalProperties):
1086         * runtime/Executable.h:
1087             - Moved declaration code to JSGlobalObject
1088         * runtime/JSGlobalObject.cpp:
1089         (JSC::JSGlobalObject::addGlobalVar):
1090             - internal implementation of addVar, addConst, addFunction
1091         * runtime/JSGlobalObject.h:
1092         (JSC::JSGlobalObject::addVar):
1093         (JSC::JSGlobalObject::addConst):
1094         (JSC::JSGlobalObject::addFunction):
1095             - Added methods to declare vars, consts, and functions
1096
1097 2013-08-21  Yi Shen  <max.hong.shen@gmail.com>
1098
1099         https://bugs.webkit.org/show_bug.cgi?id=119900
1100         Exception in global setter doesn't unwind correctly
1101
1102         Reviewed by Geoffrey Garen.
1103
1104         Call VM_THROW_EXCEPTION_AT_END in op_put_to_scope if the setter throws exception.
1105
1106         * jit/JITStubs.cpp:
1107         (JSC::DEFINE_STUB_FUNCTION):
1108
1109 2013-08-21  Mark Hahnenberg  <mhahnenberg@apple.com>
1110
1111         Rename/refactor setButterfly/setStructure
1112         https://bugs.webkit.org/show_bug.cgi?id=120138
1113
1114         Reviewed by Geoffrey Garen.
1115
1116         setButterfly becomes setStructureAndButterfly.
1117
1118         Also removed the Butterfly* argument from setStructure and just implicitly
1119         used m_butterfly internally since that's what every single client of setStructure
1120         was doing already.
1121
1122         * jit/JITStubs.cpp:
1123         (JSC::DEFINE_STUB_FUNCTION):
1124         * runtime/JSObject.cpp:
1125         (JSC::JSObject::notifyPresenceOfIndexedAccessors):
1126         (JSC::JSObject::createInitialUndecided):
1127         (JSC::JSObject::createInitialInt32):
1128         (JSC::JSObject::createInitialDouble):
1129         (JSC::JSObject::createInitialContiguous):
1130         (JSC::JSObject::createArrayStorage):
1131         (JSC::JSObject::convertUndecidedToInt32):
1132         (JSC::JSObject::convertUndecidedToDouble):
1133         (JSC::JSObject::convertUndecidedToContiguous):
1134         (JSC::JSObject::convertUndecidedToArrayStorage):
1135         (JSC::JSObject::convertInt32ToDouble):
1136         (JSC::JSObject::convertInt32ToContiguous):
1137         (JSC::JSObject::convertInt32ToArrayStorage):
1138         (JSC::JSObject::genericConvertDoubleToContiguous):
1139         (JSC::JSObject::convertDoubleToArrayStorage):
1140         (JSC::JSObject::convertContiguousToArrayStorage):
1141         (JSC::JSObject::switchToSlowPutArrayStorage):
1142         (JSC::JSObject::setPrototype):
1143         (JSC::JSObject::putDirectAccessor):
1144         (JSC::JSObject::seal):
1145         (JSC::JSObject::freeze):
1146         (JSC::JSObject::preventExtensions):
1147         (JSC::JSObject::reifyStaticFunctionsForDelete):
1148         (JSC::JSObject::removeDirect):
1149         * runtime/JSObject.h:
1150         (JSC::JSObject::setStructureAndButterfly):
1151         (JSC::JSObject::setStructure):
1152         (JSC::JSObject::putDirectInternal):
1153         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
1154         (JSC::JSObject::putDirectWithoutTransition):
1155         * runtime/Structure.cpp:
1156         (JSC::Structure::flattenDictionaryStructure):
1157
1158 2013-08-21  Gavin Barraclough  <barraclough@apple.com>
1159
1160         https://bugs.webkit.org/show_bug.cgi?id=120127
1161         Remove JSObject::propertyIsEnumerable
1162
1163         Unreviewed typo fix
1164
1165         * runtime/JSObject.h:
1166             - fix typo
1167
1168 2013-08-21  Gavin Barraclough  <barraclough@apple.com>
1169
1170         https://bugs.webkit.org/show_bug.cgi?id=120139
1171         PropertyDescriptor argument to define methods should be const
1172
1173         Rubber stamped by Sam Weinig.
1174
1175         This should never be modified, and this way we can use rvalues.
1176
1177         * debugger/DebuggerActivation.cpp:
1178         (JSC::DebuggerActivation::defineOwnProperty):
1179         * debugger/DebuggerActivation.h:
1180         * runtime/Arguments.cpp:
1181         (JSC::Arguments::defineOwnProperty):
1182         * runtime/Arguments.h:
1183         * runtime/ClassInfo.h:
1184         * runtime/JSArray.cpp:
1185         (JSC::JSArray::defineOwnProperty):
1186         * runtime/JSArray.h:
1187         * runtime/JSArrayBuffer.cpp:
1188         (JSC::JSArrayBuffer::defineOwnProperty):
1189         * runtime/JSArrayBuffer.h:
1190         * runtime/JSArrayBufferView.cpp:
1191         (JSC::JSArrayBufferView::defineOwnProperty):
1192         * runtime/JSArrayBufferView.h:
1193         * runtime/JSCell.cpp:
1194         (JSC::JSCell::defineOwnProperty):
1195         * runtime/JSCell.h:
1196         * runtime/JSFunction.cpp:
1197         (JSC::JSFunction::defineOwnProperty):
1198         * runtime/JSFunction.h:
1199         * runtime/JSGenericTypedArrayView.h:
1200         * runtime/JSGenericTypedArrayViewInlines.h:
1201         (JSC::::defineOwnProperty):
1202         * runtime/JSGlobalObject.cpp:
1203         (JSC::JSGlobalObject::defineOwnProperty):
1204         * runtime/JSGlobalObject.h:
1205         * runtime/JSObject.cpp:
1206         (JSC::JSObject::putIndexedDescriptor):
1207         (JSC::JSObject::defineOwnIndexedProperty):
1208         (JSC::putDescriptor):
1209         (JSC::JSObject::defineOwnNonIndexProperty):
1210         (JSC::JSObject::defineOwnProperty):
1211         * runtime/JSObject.h:
1212         * runtime/JSProxy.cpp:
1213         (JSC::JSProxy::defineOwnProperty):
1214         * runtime/JSProxy.h:
1215         * runtime/RegExpMatchesArray.h:
1216         (JSC::RegExpMatchesArray::defineOwnProperty):
1217         * runtime/RegExpObject.cpp:
1218         (JSC::RegExpObject::defineOwnProperty):
1219         * runtime/RegExpObject.h:
1220         * runtime/StringObject.cpp:
1221         (JSC::StringObject::defineOwnProperty):
1222         * runtime/StringObject.h:
1223             - make PropertyDescriptor const
1224
1225 2013-08-21  Filip Pizlo  <fpizlo@apple.com>
1226
1227         REGRESSION: Crash under JITCompiler::link while loading Gmail
1228         https://bugs.webkit.org/show_bug.cgi?id=119872
1229
1230         Reviewed by Mark Hahnenberg.
1231         
1232         Apparently, unsigned + signed = unsigned. Work around it with a cast.
1233
1234         * dfg/DFGByteCodeParser.cpp:
1235         (JSC::DFG::ByteCodeParser::parseBlock):
1236
1237 2013-08-21  Alex Christensen  <achristensen@apple.com>
1238
1239         <https://webkit.org/b/120137> Separating Win32 and Win64 builds.
1240
1241         Reviewed by Brent Fulgham.
1242
1243         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
1244         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
1245         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
1246         Pass PlatformArchitecture as a command line parameter to bash scripts.
1247         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
1248         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
1249         * JavaScriptCore.vcxproj/build-generated-files.sh:
1250         Use PlatformArchitecture from command line to determine which object directory to use (obj32 or obj64).
1251
1252 2013-08-21  Filip Pizlo  <fpizlo@apple.com>
1253
1254         Assertion failure in JSC::SlotVisitor::copyLater when marking JSDataView
1255         https://bugs.webkit.org/show_bug.cgi?id=120099
1256
1257         Reviewed by Mark Hahnenberg.
1258         
1259         JSDataView should not store the ArrayBuffer* in the butterfly indexing header, since
1260         JSDataView may have ordinary JS indexed properties.
1261
1262         * runtime/ClassInfo.h:
1263         * runtime/JSArrayBufferView.cpp:
1264         (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
1265         (JSC::JSArrayBufferView::finishCreation):
1266         * runtime/JSArrayBufferView.h:
1267         (JSC::hasArrayBuffer):
1268         * runtime/JSArrayBufferViewInlines.h:
1269         (JSC::JSArrayBufferView::buffer):
1270         (JSC::JSArrayBufferView::neuter):
1271         (JSC::JSArrayBufferView::byteOffset):
1272         * runtime/JSCell.cpp:
1273         (JSC::JSCell::slowDownAndWasteMemory):
1274         * runtime/JSCell.h:
1275         * runtime/JSDataView.cpp:
1276         (JSC::JSDataView::JSDataView):
1277         (JSC::JSDataView::create):
1278         (JSC::JSDataView::slowDownAndWasteMemory):
1279         * runtime/JSDataView.h:
1280         (JSC::JSDataView::buffer):
1281         * runtime/JSGenericTypedArrayView.h:
1282         * runtime/JSGenericTypedArrayViewInlines.h:
1283         (JSC::::visitChildren):
1284         (JSC::::slowDownAndWasteMemory):
1285
1286 2013-08-21  Mark Hahnenberg  <mhahnenberg@apple.com>
1287
1288         Remove incorrect ASSERT from CopyVisitor::visitItem
1289
1290         Rubber stamped by Filip Pizlo.
1291
1292         * heap/CopyVisitorInlines.h:
1293         (JSC::CopyVisitor::visitItem):
1294
1295 2013-08-21  Gavin Barraclough  <barraclough@apple.com>
1296
1297         https://bugs.webkit.org/show_bug.cgi?id=120127
1298         Remove JSObject::propertyIsEnumerable
1299
1300         Reviewed by Sam Weinig.
1301
1302         This method is just a wart - it contains unnecessary const-casting, function call overhead, and LOC.
1303
1304         * runtime/JSObject.cpp:
1305         * runtime/JSObject.h:
1306             - remove propertyIsEnumerable
1307         * runtime/ObjectPrototype.cpp:
1308         (JSC::objectProtoFuncPropertyIsEnumerable):
1309             - Move implementation here using getOwnPropertyDescriptor directly.
1310
1311 2013-08-20  Filip Pizlo  <fpizlo@apple.com>
1312
1313         DFG should inline new typedArray()
1314         https://bugs.webkit.org/show_bug.cgi?id=120022
1315
1316         Reviewed by Oliver Hunt.
1317         
1318         Adds inlining of typed array allocations in the DFG. Any operation of the
1319         form:
1320         
1321             new foo(blah)
1322         
1323         or:
1324         
1325             foo(blah)
1326         
1327         where 'foo' is a typed array constructor and 'blah' is exactly one argument,
1328         is turned into the NewTypedArray intrinsic. Later, of child1 (i.e. 'blah')
1329         is predicted integer, we generate inline code for an allocation. Otherwise
1330         it turns into a call to an operation that behaves like the constructor would
1331         if it was passed one argument (i.e. it may wrap a buffer or it may create a
1332         copy or another array, or it may allocate an array of that length).
1333
1334         * bytecode/SpeculatedType.cpp:
1335         (JSC::speculationFromTypedArrayType):
1336         (JSC::speculationFromClassInfo):
1337         * bytecode/SpeculatedType.h:
1338         * dfg/DFGAbstractInterpreterInlines.h:
1339         (JSC::DFG::::executeEffects):
1340         * dfg/DFGBackwardsPropagationPhase.cpp:
1341         (JSC::DFG::BackwardsPropagationPhase::propagate):
1342         * dfg/DFGByteCodeParser.cpp:
1343         (JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
1344         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
1345         * dfg/DFGCCallHelpers.h:
1346         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
1347         * dfg/DFGCSEPhase.cpp:
1348         (JSC::DFG::CSEPhase::putStructureStoreElimination):
1349         * dfg/DFGClobberize.h:
1350         (JSC::DFG::clobberize):
1351         * dfg/DFGFixupPhase.cpp:
1352         (JSC::DFG::FixupPhase::fixupNode):
1353         * dfg/DFGGraph.cpp:
1354         (JSC::DFG::Graph::dump):
1355         * dfg/DFGNode.h:
1356         (JSC::DFG::Node::hasTypedArrayType):
1357         (JSC::DFG::Node::typedArrayType):
1358         * dfg/DFGNodeType.h:
1359         * dfg/DFGOperations.cpp:
1360         (JSC::DFG::newTypedArrayWithSize):
1361         (JSC::DFG::newTypedArrayWithOneArgument):
1362         * dfg/DFGOperations.h:
1363         (JSC::DFG::operationNewTypedArrayWithSizeForType):
1364         (JSC::DFG::operationNewTypedArrayWithOneArgumentForType):
1365         * dfg/DFGPredictionPropagationPhase.cpp:
1366         (JSC::DFG::PredictionPropagationPhase::propagate):
1367         * dfg/DFGSafeToExecute.h:
1368         (JSC::DFG::safeToExecute):
1369         * dfg/DFGSpeculativeJIT.cpp:
1370         (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
1371         * dfg/DFGSpeculativeJIT.h:
1372         (JSC::DFG::SpeculativeJIT::callOperation):
1373         * dfg/DFGSpeculativeJIT32_64.cpp:
1374         (JSC::DFG::SpeculativeJIT::compile):
1375         * dfg/DFGSpeculativeJIT64.cpp:
1376         (JSC::DFG::SpeculativeJIT::compile):
1377         * jit/JITOpcodes.cpp:
1378         (JSC::JIT::emit_op_new_object):
1379         * jit/JITOpcodes32_64.cpp:
1380         (JSC::JIT::emit_op_new_object):
1381         * runtime/JSArray.h:
1382         (JSC::JSArray::allocationSize):
1383         * runtime/JSArrayBufferView.h:
1384         (JSC::JSArrayBufferView::allocationSize):
1385         * runtime/JSGenericTypedArrayViewConstructorInlines.h:
1386         (JSC::constructGenericTypedArrayView):
1387         * runtime/JSObject.h:
1388         (JSC::JSFinalObject::allocationSize):
1389         * runtime/TypedArrayType.cpp:
1390         (JSC::constructorClassInfoForType):
1391         * runtime/TypedArrayType.h:
1392         (JSC::indexToTypedArrayType):
1393
1394 2013-08-21  Julien Brianceau  <jbrianceau@nds.com>
1395
1396         <https://webkit.org/b/120106> Fix V_DFGOperation_EJPP signature in DFG.
1397
1398         Reviewed by Geoffrey Garen.
1399
1400         * dfg/DFGOperations.h:
1401
1402 2013-08-20  Gavin Barraclough  <barraclough@apple.com>
1403
1404         https://bugs.webkit.org/show_bug.cgi?id=120093
1405         Remove getOwnPropertyDescriptor trap
1406
1407         Reviewed by Geoff Garen.
1408
1409         All implementations of this method are now called via the method table, and equivalent in behaviour.
1410         Remove all duplicate implementations (and the method table trap), and add a single member function implementation on JSObject.
1411
1412         * API/JSCallbackObject.h:
1413         * API/JSCallbackObjectFunctions.h:
1414         * debugger/DebuggerActivation.cpp:
1415         * debugger/DebuggerActivation.h:
1416         * runtime/Arguments.cpp:
1417         * runtime/Arguments.h:
1418         * runtime/ArrayConstructor.cpp:
1419         * runtime/ArrayConstructor.h:
1420         * runtime/ArrayPrototype.cpp:
1421         * runtime/ArrayPrototype.h:
1422         * runtime/BooleanPrototype.cpp:
1423         * runtime/BooleanPrototype.h:
1424             - remove getOwnPropertyDescriptor
1425         * runtime/ClassInfo.h:
1426             - remove getOwnPropertyDescriptor from MethodTable
1427         * runtime/DateConstructor.cpp:
1428         * runtime/DateConstructor.h:
1429         * runtime/DatePrototype.cpp:
1430         * runtime/DatePrototype.h:
1431         * runtime/ErrorPrototype.cpp:
1432         * runtime/ErrorPrototype.h:
1433         * runtime/JSActivation.cpp:
1434         * runtime/JSActivation.h:
1435         * runtime/JSArray.cpp:
1436         * runtime/JSArray.h:
1437         * runtime/JSArrayBuffer.cpp:
1438         * runtime/JSArrayBuffer.h:
1439         * runtime/JSArrayBufferView.cpp:
1440         * runtime/JSArrayBufferView.h:
1441         * runtime/JSCell.cpp:
1442         * runtime/JSCell.h:
1443         * runtime/JSDataView.cpp:
1444         * runtime/JSDataView.h:
1445         * runtime/JSDataViewPrototype.cpp:
1446         * runtime/JSDataViewPrototype.h:
1447         * runtime/JSFunction.cpp:
1448         * runtime/JSFunction.h:
1449         * runtime/JSGenericTypedArrayView.h:
1450         * runtime/JSGenericTypedArrayViewInlines.h:
1451         * runtime/JSGlobalObject.cpp:
1452         * runtime/JSGlobalObject.h:
1453         * runtime/JSNotAnObject.cpp:
1454         * runtime/JSNotAnObject.h:
1455         * runtime/JSONObject.cpp:
1456         * runtime/JSONObject.h:
1457             - remove getOwnPropertyDescriptor
1458         * runtime/JSObject.cpp:
1459         (JSC::JSObject::propertyIsEnumerable):
1460             - switch to call new getOwnPropertyDescriptor member function
1461         (JSC::JSObject::getOwnPropertyDescriptor):
1462             - new, based on imlementation from GET_OWN_PROPERTY_DESCRIPTOR_IMPL
1463         (JSC::JSObject::defineOwnNonIndexProperty):
1464             - switch to call new getOwnPropertyDescriptor member function
1465         * runtime/JSObject.h:
1466         * runtime/JSProxy.cpp:
1467         * runtime/JSProxy.h:
1468         * runtime/NamePrototype.cpp:
1469         * runtime/NamePrototype.h:
1470         * runtime/NumberConstructor.cpp:
1471         * runtime/NumberConstructor.h:
1472         * runtime/NumberPrototype.cpp:
1473         * runtime/NumberPrototype.h:
1474             - remove getOwnPropertyDescriptor
1475         * runtime/ObjectConstructor.cpp:
1476         (JSC::objectConstructorGetOwnPropertyDescriptor):
1477         (JSC::objectConstructorSeal):
1478         (JSC::objectConstructorFreeze):
1479         (JSC::objectConstructorIsSealed):
1480         (JSC::objectConstructorIsFrozen):
1481             - switch to call new getOwnPropertyDescriptor member function
1482         * runtime/ObjectConstructor.h:
1483             - remove getOwnPropertyDescriptor
1484         * runtime/PropertyDescriptor.h:
1485             - remove GET_OWN_PROPERTY_DESCRIPTOR_IMPL
1486         * runtime/RegExpConstructor.cpp:
1487         * runtime/RegExpConstructor.h:
1488         * runtime/RegExpMatchesArray.cpp:
1489         * runtime/RegExpMatchesArray.h:
1490         * runtime/RegExpObject.cpp:
1491         * runtime/RegExpObject.h:
1492         * runtime/RegExpPrototype.cpp:
1493         * runtime/RegExpPrototype.h:
1494         * runtime/StringConstructor.cpp:
1495         * runtime/StringConstructor.h:
1496         * runtime/StringObject.cpp:
1497         * runtime/StringObject.h:
1498             - remove getOwnPropertyDescriptor
1499
1500 2013-08-20  Mark Hahnenberg  <mhahnenberg@apple.com>
1501
1502         <https://webkit.org/b/120079> Flattening a dictionary can cause CopiedSpace corruption
1503
1504         Reviewed by Oliver Hunt.
1505
1506         When we flatten an object in dictionary mode, we compact its properties. If the object 
1507         had out-of-line storage in the form of a Butterfly prior to this compaction, and after 
1508         compaction its properties fit inline, the object's Structure "forgets" that the object 
1509         has a non-zero Butterfly pointer. During GC, we check the Butterfly and reportLiveBytes 
1510         with bytes = 0, which causes all sorts of badness in CopiedSpace.
1511
1512         Instead, after we flatten a dictionary, if properties fit inline we should clear the 
1513         Butterfly pointer so that the GC doesn't get confused later.
1514
1515         This patch does this clearing, and it also adds JSObject::checkStructure, which overrides
1516         JSCell::checkStructure to add an ASSERT that makes sure that the Structure being assigned
1517         agrees with the whether or not the object has a Butterfly. Also added an ASSERT to check
1518         that the number of bytes reported to SlotVisitor::copyLater is non-zero.
1519
1520         * heap/SlotVisitorInlines.h:
1521         (JSC::SlotVisitor::copyLater):
1522         * runtime/JSObject.cpp:
1523         (JSC::JSObject::notifyPresenceOfIndexedAccessors):
1524         (JSC::JSObject::convertUndecidedToInt32):
1525         (JSC::JSObject::convertUndecidedToDouble):
1526         (JSC::JSObject::convertUndecidedToContiguous):
1527         (JSC::JSObject::convertInt32ToDouble):
1528         (JSC::JSObject::convertInt32ToContiguous):
1529         (JSC::JSObject::genericConvertDoubleToContiguous):
1530         (JSC::JSObject::switchToSlowPutArrayStorage):
1531         (JSC::JSObject::setPrototype):
1532         (JSC::JSObject::putDirectAccessor):
1533         (JSC::JSObject::seal):
1534         (JSC::JSObject::freeze):
1535         (JSC::JSObject::preventExtensions):
1536         (JSC::JSObject::reifyStaticFunctionsForDelete):
1537         (JSC::JSObject::removeDirect):
1538         * runtime/JSObject.h:
1539         (JSC::JSObject::setButterfly):
1540         (JSC::JSObject::putDirectInternal):
1541         (JSC::JSObject::setStructure):
1542         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
1543         * runtime/Structure.cpp:
1544         (JSC::Structure::flattenDictionaryStructure):
1545
1546 2013-08-20  Alex Christensen  <achristensen@apple.com>
1547
1548         Compile fix for Win64 after r154156.
1549
1550         Rubber stamped by Oliver Hunt.
1551
1552         * jit/JITStubsMSVC64.asm:
1553         Renamed ctiVMThrowTrampolineSlowpath to ctiVMHandleException and
1554         cti_vm_throw_slowpath to cti_vm_handle_exception.
1555
1556 2013-08-20  Alex Christensen  <achristensen@apple.com>
1557
1558         <https://webkit.org/b/120076> More work towards a Win64 build
1559
1560         Reviewed by Brent Fulgham.
1561
1562         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
1563         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
1564         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
1565         * JavaScriptCore.vcxproj/copy-files.cmd:
1566         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
1567         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
1568         Use PlatformArchitecture macro instead of bin32, lib32, and obj32.
1569
1570 2013-08-20  Mark Hahnenberg  <mhahnenberg@apple.com>
1571
1572         <https://webkit.org/b/119919> Concurrent JIT crashes in various fast/js/dfg-* tests while the main thread is setting innerHTML
1573
1574         Reviewed by Geoffrey Garen.
1575
1576         More fixes for WriteBarrier deferral during concurrent JIT-ing. This patch makes the use of DesiredWriteBarriers class and the 
1577         initializeLazyWriteBarrierFor* wrapper functions more sane. 
1578
1579         Refactored DesiredWriteBarrier to require an owner, a type, a CodeBlock, and an index. The type indicates how to use the CodeBlock
1580         and index when triggering the WriteBarrier at the end of compilation. 
1581
1582         The client code of initializeLazy* is now responsible for creating the WriteBarrier that will be initialized as well as passing
1583         in the relevant index to be used at the end of compilation. Things were kind of muddled before in that one function did a 
1584         little extra work that really shouldn't have been its responsibility.
1585
1586         * dfg/DFGByteCodeParser.cpp:
1587         (JSC::DFG::ByteCodeParser::addConstant):
1588         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
1589         * dfg/DFGDesiredWriteBarriers.cpp:
1590         (JSC::DFG::DesiredWriteBarrier::DesiredWriteBarrier):
1591         (JSC::DFG::DesiredWriteBarrier::trigger):
1592         * dfg/DFGDesiredWriteBarriers.h:
1593         (JSC::DFG::DesiredWriteBarriers::add):
1594         (JSC::DFG::initializeLazyWriteBarrierForInlineCallFrameExecutable):
1595         (JSC::DFG::initializeLazyWriteBarrierForInlineCallFrameCallee):
1596         (JSC::DFG::initializeLazyWriteBarrierForConstant):
1597         * dfg/DFGFixupPhase.cpp:
1598         (JSC::DFG::FixupPhase::truncateConstantToInt32):
1599         * dfg/DFGGraph.h:
1600         (JSC::DFG::Graph::constantRegisterForConstant):
1601
1602 2013-08-20  Michael Saboff  <msaboff@apple.com>
1603
1604         https://bugs.webkit.org/show_bug.cgi?id=120075
1605         REGRESSION (r128400): BBC4 website not displaying pictures
1606
1607         Reviewed by Oliver Hunt.
1608
1609         * runtime/RegExpMatchesArray.h:
1610         (JSC::RegExpMatchesArray::createStructure): Changed the array IndexingType to be ArrayWithSlowPutArrayStorage
1611         so that the match results will be reified before any other modification to the results array.
1612
1613 2013-08-19  Filip Pizlo  <fpizlo@apple.com>
1614
1615         Incorrect behavior on emscripten-compiled cube2hash
1616         https://bugs.webkit.org/show_bug.cgi?id=120033
1617
1618         Reviewed by Mark Hahnenberg.
1619         
1620         If PutClosureVar is may-aliased to another PutClosureVar or GetClosureVar
1621         then we should bail attempts to CSE.
1622
1623         * dfg/DFGCSEPhase.cpp:
1624         (JSC::DFG::CSEPhase::scopedVarLoadElimination):
1625         (JSC::DFG::CSEPhase::scopedVarStoreElimination):
1626
1627 2013-08-20  Gavin Barraclough  <barraclough@apple.com>
1628
1629         https://bugs.webkit.org/show_bug.cgi?id=120073
1630         Remove use of GOPD from JSFunction::defineProperty
1631
1632         Reviewed by Oliver Hunt.
1633
1634         Call getOwnPropertySlot to check for existing properties instead.
1635
1636         * runtime/JSFunction.cpp:
1637         (JSC::JSFunction::defineOwnProperty):
1638             - getOwnPropertyDescriptor -> getOwnPropertySlot
1639
1640 2013-08-20  Gavin Barraclough  <barraclough@apple.com>
1641
1642         https://bugs.webkit.org/show_bug.cgi?id=120067
1643         Remove getPropertyDescriptor
1644
1645         Reviewed by Oliver Hunt.
1646
1647         This is used by lookupGetter/lookupSetter - this can easily bee replaced by getPropertySlot.
1648         Since we'll be getting the GetterSetter from the slot in the setter case, rename isGetter() to isAccessor().
1649
1650         * runtime/JSObject.cpp:
1651         * runtime/JSObject.h:
1652             - remove getPropertyDescriptor
1653         * runtime/ObjectPrototype.cpp:
1654         (JSC::objectProtoFuncLookupGetter):
1655         (JSC::objectProtoFuncLookupSetter):
1656             - replace call to getPropertyDescriptor with getPropertySlot
1657         * runtime/PropertyDescriptor.h:
1658         * runtime/PropertySlot.h:
1659         (JSC::PropertySlot::isAccessor):
1660         (JSC::PropertySlot::isCacheableGetter):
1661         (JSC::PropertySlot::getterSetter):
1662             - rename isGetter() to isAccessor()
1663
1664 2013-08-20  Gavin Barraclough  <barraclough@apple.com>
1665
1666         https://bugs.webkit.org/show_bug.cgi?id=120054
1667         Remove some dead code following getOwnPropertyDescriptor cleanup
1668
1669         Reviewed by Oliver Hunt.
1670
1671         * runtime/Lookup.h:
1672         (JSC::getStaticFunctionSlot):
1673             - remove getStaticPropertyDescriptor, getStaticFunctionDescriptor, getStaticValueDescriptor.
1674
1675 2013-08-20  Gavin Barraclough  <barraclough@apple.com>
1676
1677         https://bugs.webkit.org/show_bug.cgi?id=120052
1678         Remove custom getOwnPropertyDescriptor for JSProxy
1679
1680         Reviewed by Geoff Garen.
1681
1682         GET_OWN_PROPERTY_DESCRIPTOR_IMPL runs afoul with JSProxy due to the workaround for JSDOMWindow's broken behavior.
1683         Because the window object incorrectly searches the prototype chain in getOwnPropertySlot we check that the base
1684         object matches, but in the case of JSProxy we can end up comparing the window object to the window shell & falsely
1685         assuming this is a prototype property. Add toThis conversion to correctly identify proxied own access. I've kept
1686         the original slotBase check as a fast case, and also so that direct access on JSDOMWindow still works.
1687
1688         * runtime/JSProxy.cpp:
1689             - Remove custom getOwnPropertyDescriptor implementation.
1690         * runtime/PropertyDescriptor.h:
1691             - Modify own property access check to perform toThis conversion.
1692
1693 2013-08-20  Alex Christensen  <achristensen@apple.com>
1694
1695         Use PlatformArchitecture to distinguish between 32-bit and 64-bit builds on Windows.
1696         https://bugs.webkit.org/show_bug.cgi?id=119512
1697
1698         Reviewed by Brent Fulgham.
1699
1700         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1701         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1702         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
1703         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
1704         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
1705         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
1706         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
1707         Replaced obj32, bin32, and lib32 with macros for 64-bit build.
1708
1709 2013-08-20  Julien Brianceau  <jbrianceau@nds.com>
1710
1711         <https://webkit.org/b/120062> Missing ensureSpace call in sh4 baseline JIT.
1712
1713         Reviewed by Allan Sandfeld Jensen.
1714
1715         branchPtrWithPatch() of baseline JIT must ensure that space is available for its
1716         instructions and two constants now DFG is enabled for sh4 architecture.
1717         These missing ensureSpace calls lead to random crashes.
1718
1719         * assembler/MacroAssemblerSH4.h:
1720         (JSC::MacroAssemblerSH4::branchPtrWithPatch):
1721
1722 2013-08-19  Gavin Barraclough  <barraclough@apple.com>
1723
1724         https://bugs.webkit.org/show_bug.cgi?id=120034
1725         Remove custom getOwnPropertyDescriptor for global objects
1726
1727         Reviewed by Geoff Garen.
1728
1729         Fix attributes of JSC SynbolTableObject entries, ensure that cross frame access is safe, and suppress prototype chain walk.
1730
1731         * runtime/JSGlobalObject.cpp:
1732             - Remove custom getOwnPropertyDescriptor implementation.
1733         * runtime/JSSymbolTableObject.h:
1734         (JSC::symbolTableGet):
1735             - The symbol table does not store the DontDelete attribute, we should be adding it back in.
1736         * runtime/PropertyDescriptor.h:
1737             - JSDOMWindow walks the prototype chain on own access. This is bad, but for now workaround for the getOwnPropertyDescriptor case.
1738         * runtime/PropertySlot.h:
1739         (JSC::PropertySlot::setUndefined):
1740             - This is used by WebCore when blocking access to properties on cross-frame access.
1741               Mark blocked properties as read-only, non-configurable to prevent defineProperty.
1742
1743 2013-08-17  Filip Pizlo  <fpizlo@apple.com>
1744
1745         DFG should inline typedArray.byteOffset
1746         https://bugs.webkit.org/show_bug.cgi?id=119962
1747
1748         Reviewed by Oliver Hunt.
1749         
1750         This adds a new node, GetTypedArrayByteOffset, which inlines
1751         typedArray.byteOffset.
1752         
1753         Also, I improved a bunch of the clobbering logic related to typed arrays
1754         and clobbering in general. For example, PutByOffset/PutStructure are not
1755         clobber-world so they can be handled by most default cases in CSE. Also,
1756         It's better to use the 'Class_field' notation for typed arrays now that
1757         they no longer involve magical descriptor thingies.
1758
1759         * bytecode/SpeculatedType.h:
1760         * dfg/DFGAbstractHeap.h:
1761         * dfg/DFGAbstractInterpreterInlines.h:
1762         (JSC::DFG::::executeEffects):
1763         * dfg/DFGArrayMode.h:
1764         (JSC::DFG::neverNeedsStorage):
1765         * dfg/DFGCSEPhase.cpp:
1766         (JSC::DFG::CSEPhase::getByValLoadElimination):
1767         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
1768         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
1769         (JSC::DFG::CSEPhase::checkArrayElimination):
1770         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
1771         (JSC::DFG::CSEPhase::getTypedArrayByteOffsetLoadElimination):
1772         (JSC::DFG::CSEPhase::performNodeCSE):
1773         * dfg/DFGClobberize.h:
1774         (JSC::DFG::clobberize):
1775         * dfg/DFGFixupPhase.cpp:
1776         (JSC::DFG::FixupPhase::fixupNode):
1777         (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteLength):
1778         (JSC::DFG::FixupPhase::convertToGetArrayLength):
1779         (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteOffset):
1780         * dfg/DFGNodeType.h:
1781         * dfg/DFGPredictionPropagationPhase.cpp:
1782         (JSC::DFG::PredictionPropagationPhase::propagate):
1783         * dfg/DFGSafeToExecute.h:
1784         (JSC::DFG::safeToExecute):
1785         * dfg/DFGSpeculativeJIT.cpp:
1786         (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
1787         * dfg/DFGSpeculativeJIT.h:
1788         * dfg/DFGSpeculativeJIT32_64.cpp:
1789         (JSC::DFG::SpeculativeJIT::compile):
1790         * dfg/DFGSpeculativeJIT64.cpp:
1791         (JSC::DFG::SpeculativeJIT::compile):
1792         * dfg/DFGTypeCheckHoistingPhase.cpp:
1793         (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
1794         * runtime/ArrayBuffer.h:
1795         (JSC::ArrayBuffer::offsetOfData):
1796         * runtime/Butterfly.h:
1797         (JSC::Butterfly::offsetOfArrayBuffer):
1798         * runtime/IndexingHeader.h:
1799         (JSC::IndexingHeader::offsetOfArrayBuffer):
1800
1801 2013-08-18  Filip Pizlo  <fpizlo@apple.com>
1802
1803         <https://webkit.org/b/119994> DFG new Array() inlining could get confused about global objects
1804
1805         Reviewed by Geoffrey Garen.
1806
1807         * dfg/DFGByteCodeParser.cpp:
1808         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
1809
1810 2013-08-18  Gavin Barraclough  <barraclough@apple.com>
1811
1812         https://bugs.webkit.org/show_bug.cgi?id=119995
1813         Start removing custom implementations of getOwnPropertyDescriptor
1814
1815         Reviewed by Oliver Hunt.
1816
1817         This can now typically implemented in terms of getOwnPropertySlot.
1818         Add a macro to PropertyDescriptor to define an implementation of GOPD in terms of GOPS.
1819         Switch over most classes in JSC & the WebCore bindings generator to use this.
1820
1821         * API/JSCallbackObjectFunctions.h:
1822         * debugger/DebuggerActivation.cpp:
1823         * runtime/Arguments.cpp:
1824         * runtime/ArrayConstructor.cpp:
1825         * runtime/ArrayPrototype.cpp:
1826         * runtime/BooleanPrototype.cpp:
1827         * runtime/DateConstructor.cpp:
1828         * runtime/DatePrototype.cpp:
1829         * runtime/ErrorPrototype.cpp:
1830         * runtime/JSActivation.cpp:
1831         * runtime/JSArray.cpp:
1832         * runtime/JSArrayBuffer.cpp:
1833         * runtime/JSArrayBufferView.cpp:
1834         * runtime/JSCell.cpp:
1835         * runtime/JSDataView.cpp:
1836         * runtime/JSDataViewPrototype.cpp:
1837         * runtime/JSFunction.cpp:
1838         * runtime/JSGenericTypedArrayViewInlines.h:
1839         * runtime/JSNotAnObject.cpp:
1840         * runtime/JSONObject.cpp:
1841         * runtime/JSObject.cpp:
1842         * runtime/NamePrototype.cpp:
1843         * runtime/NumberConstructor.cpp:
1844         * runtime/NumberPrototype.cpp:
1845         * runtime/ObjectConstructor.cpp:
1846             - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.
1847         * runtime/PropertyDescriptor.h:
1848             - Added GET_OWN_PROPERTY_DESCRIPTOR_IMPL macro.
1849         * runtime/PropertySlot.h:
1850         (JSC::PropertySlot::isValue):
1851         (JSC::PropertySlot::isGetter):
1852         (JSC::PropertySlot::isCustom):
1853         (JSC::PropertySlot::isCacheableValue):
1854         (JSC::PropertySlot::isCacheableGetter):
1855         (JSC::PropertySlot::isCacheableCustom):
1856         (JSC::PropertySlot::attributes):
1857         (JSC::PropertySlot::getterSetter):
1858             - Add accessors necessary to convert PropertySlot to descriptor.
1859         * runtime/RegExpConstructor.cpp:
1860         * runtime/RegExpMatchesArray.cpp:
1861         * runtime/RegExpMatchesArray.h:
1862         * runtime/RegExpObject.cpp:
1863         * runtime/RegExpPrototype.cpp:
1864         * runtime/StringConstructor.cpp:
1865         * runtime/StringObject.cpp:
1866             - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.
1867
1868 2013-08-19  Michael Saboff  <msaboff@apple.com>
1869
1870         https://bugs.webkit.org/show_bug.cgi?id=120015 DFG 32Bit: Crash loading "Classic" site @ translate.google.com
1871
1872         Reviewed by Sam Weinig.
1873
1874         * dfg/DFGSpeculativeJIT32_64.cpp:
1875         (JSC::DFG::SpeculativeJIT::fillSpeculateCell): Added checks for spillFormat being
1876         DataFormatInteger or DataFormatDouble similar to what is in the 64 bit code and in
1877         all versions of fillSpeculateBoolean().
1878
1879 2013-08-19  Michael Saboff  <msaboff@apple.com>
1880
1881         https://bugs.webkit.org/show_bug.cgi?id=120020 Change Set 154207 causes wrong register to be used for 32 bit tests
1882
1883         Reviewed by Benjamin Poulain.
1884
1885         Change branshTest32 to only use the byte for 8 bit test on the lower 4 registers.
1886         Registers 4 through 7 as byte regisers are ah, ch, dh and bh instead of sp, bp, si and di.
1887
1888         * assembler/MacroAssemblerX86Common.h:
1889         (JSC::MacroAssemblerX86Common::branchTest32):
1890
1891 2013-08-16  Oliver Hunt  <oliver@apple.com>
1892
1893         <https://webkit.org/b/119860> Crash during exception unwinding
1894
1895         Reviewed by Filip Pizlo.
1896
1897         Add an "Unreachable" NodeType, and then rearrange op_throw and op_throw_reference_error
1898         to plant Throw or ThrowReferenceError followed by a flush and then the Unreachable node.
1899
1900         We need this so that Throw and ThrowReferenceError no longer need to be treated as
1901         terminals and the subsequent flush keeps the activation (and other registers) live.
1902
1903         * dfg/DFGAbstractInterpreterInlines.h:
1904         (JSC::DFG::::executeEffects):
1905         * dfg/DFGByteCodeParser.cpp:
1906         (JSC::DFG::ByteCodeParser::parseBlock):
1907         * dfg/DFGClobberize.h:
1908         (JSC::DFG::clobberize):
1909         * dfg/DFGFixupPhase.cpp:
1910         (JSC::DFG::FixupPhase::fixupNode):
1911         * dfg/DFGNode.h:
1912         (JSC::DFG::Node::isTerminal):
1913         * dfg/DFGNodeType.h:
1914         * dfg/DFGPredictionPropagationPhase.cpp:
1915         (JSC::DFG::PredictionPropagationPhase::propagate):
1916         * dfg/DFGSafeToExecute.h:
1917         (JSC::DFG::safeToExecute):
1918         * dfg/DFGSpeculativeJIT32_64.cpp:
1919         (JSC::DFG::SpeculativeJIT::compile):
1920         * dfg/DFGSpeculativeJIT64.cpp:
1921         (JSC::DFG::SpeculativeJIT::compile):
1922
1923 2013-08-19  Víctor Manuel Jáquez Leal  <vjaquez@igalia.com>
1924
1925         <https://webkit.org/b/120008> [GTK][ARM] javascriptcore compilation is broken
1926
1927         Reviewed by Oliver Hunt.
1928
1929         Guard the compilation of these files only if DFG_JIT is enabled.
1930
1931         * dfg/DFGDesiredTransitions.cpp:
1932         * dfg/DFGDesiredTransitions.h:
1933         * dfg/DFGDesiredWeakReferences.cpp:
1934         * dfg/DFGDesiredWeakReferences.h:
1935         * dfg/DFGDesiredWriteBarriers.cpp:
1936         * dfg/DFGDesiredWriteBarriers.h:
1937
1938 2013-08-17  Filip Pizlo  <fpizlo@apple.com>
1939
1940         REGRESSION(r154218): DFG::FixupPhase no longer turns GetById's child1 into CellUse
1941         https://bugs.webkit.org/show_bug.cgi?id=119961
1942
1943         Reviewed by Mark Hahnenberg.
1944
1945         * dfg/DFGFixupPhase.cpp:
1946         (JSC::DFG::FixupPhase::fixupNode):
1947
1948 2013-08-18  Gavin Barraclough  <barraclough@apple.com>
1949
1950         https://bugs.webkit.org/show_bug.cgi?id=119972
1951         Add attributes field to PropertySlot
1952
1953         Reviewed by Geoff Garen.
1954
1955         For all JSC types, this makes getOwnPropertyDescriptor redundant.
1956         There will be a bit more hacking required in WebCore to remove GOPD whilst maintaining current behaviour.
1957         (Current behaviour is in many ways broken, particularly in that GOPD & GOPS are inconsistent, but we should fix incrementally).
1958
1959         No performance impact.
1960
1961         * runtime/PropertySlot.h:
1962         (JSC::PropertySlot::setValue):
1963         (JSC::PropertySlot::setCustom):
1964         (JSC::PropertySlot::setCacheableCustom):
1965         (JSC::PropertySlot::setCustomIndex):
1966         (JSC::PropertySlot::setGetterSlot):
1967         (JSC::PropertySlot::setCacheableGetterSlot):
1968             - These mathods now all require 'attributes'.
1969         * runtime/JSObject.h:
1970         (JSC::JSObject::getDirect):
1971         (JSC::JSObject::getDirectOffset):
1972         (JSC::JSObject::inlineGetOwnPropertySlot):
1973             - Added variants of getDirect, getDirectOffset that return the attributes.
1974         * API/JSCallbackObjectFunctions.h:
1975         (JSC::::getOwnPropertySlot):
1976         * runtime/Arguments.cpp:
1977         (JSC::Arguments::getOwnPropertySlotByIndex):
1978         (JSC::Arguments::getOwnPropertySlot):
1979         * runtime/JSActivation.cpp:
1980         (JSC::JSActivation::symbolTableGet):
1981         (JSC::JSActivation::getOwnPropertySlot):
1982         * runtime/JSArray.cpp:
1983         (JSC::JSArray::getOwnPropertySlot):
1984         * runtime/JSArrayBuffer.cpp:
1985         (JSC::JSArrayBuffer::getOwnPropertySlot):
1986         * runtime/JSArrayBufferView.cpp:
1987         (JSC::JSArrayBufferView::getOwnPropertySlot):
1988         * runtime/JSDataView.cpp:
1989         (JSC::JSDataView::getOwnPropertySlot):
1990         * runtime/JSFunction.cpp:
1991         (JSC::JSFunction::getOwnPropertySlot):
1992         * runtime/JSGenericTypedArrayViewInlines.h:
1993         (JSC::::getOwnPropertySlot):
1994         (JSC::::getOwnPropertySlotByIndex):
1995         * runtime/JSObject.cpp:
1996         (JSC::JSObject::getOwnPropertySlotByIndex):
1997         (JSC::JSObject::fillGetterPropertySlot):
1998         * runtime/JSString.h:
1999         (JSC::JSString::getStringPropertySlot):
2000         * runtime/JSSymbolTableObject.h:
2001         (JSC::symbolTableGet):
2002         * runtime/Lookup.cpp:
2003         (JSC::setUpStaticFunctionSlot):
2004         * runtime/Lookup.h:
2005         (JSC::getStaticPropertySlot):
2006         (JSC::getStaticPropertyDescriptor):
2007         (JSC::getStaticValueSlot):
2008         (JSC::getStaticValueDescriptor):
2009         * runtime/RegExpObject.cpp:
2010         (JSC::RegExpObject::getOwnPropertySlot):
2011         * runtime/SparseArrayValueMap.cpp:
2012         (JSC::SparseArrayEntry::get):
2013             - Pass attributes to PropertySlot::set* methods.
2014
2015 2013-08-17  Mark Hahnenberg  <mhahnenberg@apple.com>
2016
2017         <https://webkit.org/b/119919> Concurrent JIT crashes in various fast/js/dfg-* tests while the main thread is setting innerHTML
2018
2019         Reviewed by Filip Pizlo.
2020
2021         Added a new mode for DesiredWriteBarrier that allows it to track a position in a 
2022         Vector of WriteBarriers rather than the specific address. The fact that we were 
2023         arbitrarily storing into a Vector's backing store for constants at the end of 
2024         compilation after the Vector could have resized was causing crashes.
2025
2026         * bytecode/CodeBlock.h:
2027         (JSC::CodeBlock::constants):
2028         (JSC::CodeBlock::addConstantLazily):
2029         * dfg/DFGByteCodeParser.cpp:
2030         (JSC::DFG::ByteCodeParser::addConstant):
2031         * dfg/DFGDesiredWriteBarriers.cpp:
2032         (JSC::DFG::DesiredWriteBarrier::DesiredWriteBarrier):
2033         (JSC::DFG::DesiredWriteBarrier::trigger):
2034         (JSC::DFG::initializeLazyWriteBarrierForConstant):
2035         * dfg/DFGDesiredWriteBarriers.h:
2036         (JSC::DFG::DesiredWriteBarriers::add):
2037         * dfg/DFGFixupPhase.cpp:
2038         (JSC::DFG::FixupPhase::truncateConstantToInt32):
2039         * dfg/DFGGraph.h:
2040         (JSC::DFG::Graph::constantRegisterForConstant):
2041
2042 2013-08-16  Filip Pizlo  <fpizlo@apple.com>
2043
2044         DFG should optimize typedArray.byteLength
2045         https://bugs.webkit.org/show_bug.cgi?id=119909
2046
2047         Reviewed by Oliver Hunt.
2048         
2049         This adds typedArray.byteLength inlining to the DFG, and does so without changing
2050         the IR: byteLength is turned into GetArrayLength followed by BitLShift. This is
2051         legal since the byteLength of a typed array cannot exceed
2052         numeric_limits<int32_t>::max().
2053
2054         * bytecode/SpeculatedType.cpp:
2055         (JSC::typedArrayTypeFromSpeculation):
2056         * bytecode/SpeculatedType.h:
2057         * dfg/DFGArrayMode.cpp:
2058         (JSC::DFG::toArrayType):
2059         * dfg/DFGArrayMode.h:
2060         * dfg/DFGFixupPhase.cpp:
2061         (JSC::DFG::FixupPhase::fixupNode):
2062         (JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):
2063         (JSC::DFG::FixupPhase::attemptToMakeGetByteLength):
2064         (JSC::DFG::FixupPhase::convertToGetArrayLength):
2065         (JSC::DFG::FixupPhase::prependGetArrayLength):
2066         * dfg/DFGGraph.h:
2067         (JSC::DFG::Graph::constantRegisterForConstant):
2068         (JSC::DFG::Graph::convertToConstant):
2069         * runtime/TypedArrayType.h:
2070         (JSC::logElementSize):
2071         (JSC::elementSize):
2072
2073 2013-08-16  Filip Pizlo  <fpizlo@apple.com>
2074
2075         DFG optimizes out strict mode arguments tear off
2076         https://bugs.webkit.org/show_bug.cgi?id=119504
2077
2078         Reviewed by Mark Hahnenberg and Oliver Hunt.
2079         
2080         Don't do the optimization for strict mode.
2081
2082         * dfg/DFGArgumentsSimplificationPhase.cpp:
2083         (JSC::DFG::ArgumentsSimplificationPhase::run):
2084         (JSC::DFG::ArgumentsSimplificationPhase::pruneObviousArgumentCreations):
2085
2086 2013-08-16  Benjamin Poulain  <benjamin@webkit.org>
2087
2088         [JSC] x86: improve code generation for xxxTest32
2089         https://bugs.webkit.org/show_bug.cgi?id=119876
2090
2091         Reviewed by Geoffrey Garen.
2092
2093         Try to use testb whenever possible when testing for an immediate value.
2094
2095         When the input is an address and an offset, we can tweak the mask
2096         and offset to be able to generate testb for any byte of the mask.
2097
2098         When the input is a register, we can use testb if we are only interested
2099         in testing the low bits.
2100
2101         * assembler/MacroAssemblerX86Common.h:
2102         (JSC::MacroAssemblerX86Common::branchTest32):
2103         (JSC::MacroAssemblerX86Common::test32):
2104         (JSC::MacroAssemblerX86Common::generateTest32):
2105
2106 2013-08-16  Mark Lam  <mark.lam@apple.com>
2107
2108         <https://bugs.webkit.org/show_bug.cgi?id=119913> Baseline JIT gives erroneous
2109         error message that an object is not a constructor though it expects a function
2110
2111         Reviewed by Michael Saboff.
2112
2113         * jit/JITStubs.cpp:
2114         (JSC::DEFINE_STUB_FUNCTION):
2115
2116 2013-08-16  Filip Pizlo  <fpizlo@apple.com>
2117
2118         Object properties added using dot syntax (o.f = ...) from code that isn't in eval should be less likely to cause an object to become a dictionary
2119         https://bugs.webkit.org/show_bug.cgi?id=119897
2120
2121         Reviewed by Oliver Hunt.
2122         
2123         6-10x speed-up on microbenchmarks that create large static objects. 40-65% speed-up
2124         on Octane/gbemu. 3% overall speed-up on Octane. No slow-downs anywhere; our ability
2125         to turn objects into dictionaries when you're storing using bracket syntax or using
2126         eval is still in place.
2127
2128         * bytecode/CodeBlock.h:
2129         (JSC::CodeBlock::putByIdContext):
2130         * dfg/DFGOperations.cpp:
2131         * jit/JITStubs.cpp:
2132         (JSC::DEFINE_STUB_FUNCTION):
2133         * llint/LLIntSlowPaths.cpp:
2134         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2135         * runtime/JSObject.h:
2136         (JSC::JSObject::putDirectInternal):
2137         * runtime/PutPropertySlot.h:
2138         (JSC::PutPropertySlot::PutPropertySlot):
2139         (JSC::PutPropertySlot::context):
2140         * runtime/Structure.cpp:
2141         (JSC::Structure::addPropertyTransition):
2142         * runtime/Structure.h:
2143
2144 2013-08-16  Balazs Kilvady  <kilvadyb@homejinni.com>
2145
2146         <https://webkit.org/b/119742> REGRESSION(FTL): Fix register usage in mips implementation of ctiVMHandleException
2147
2148         Reviewed by Allan Sandfeld Jensen.
2149
2150         ctiVMHandleException must jump/return using register ra (r31).
2151
2152         * jit/JITStubsMIPS.h:
2153
2154 2013-08-16  Julien Brianceau  <jbrianceau@nds.com>
2155
2156         <https://webkit.org/b/119879> Fix sh4 build after r154156.
2157
2158         Reviewed by Allan Sandfeld Jensen.
2159
2160         Fix typo in JITStubsSH4.h file.
2161
2162         * jit/JITStubsSH4.h:
2163
2164 2013-08-15  Mark Hahnenberg  <mhahnenberg@apple.com>
2165
2166         <https://webkit.org/b/119833> Concurrent compilation thread should not trigger WriteBarriers
2167
2168         Reviewed by Oliver Hunt.
2169
2170         The concurrent compilation thread should interact minimally with the Heap, including not 
2171         triggering WriteBarriers. This is a prerequisite for generational GC.
2172
2173         * JavaScriptCore.xcodeproj/project.pbxproj:
2174         * bytecode/CodeBlock.cpp:
2175         (JSC::CodeBlock::addOrFindConstant):
2176         (JSC::CodeBlock::findConstant):
2177         * bytecode/CodeBlock.h:
2178         (JSC::CodeBlock::addConstantLazily):
2179         * dfg/DFGByteCodeParser.cpp:
2180         (JSC::DFG::ByteCodeParser::getJSConstantForValue):
2181         (JSC::DFG::ByteCodeParser::constantUndefined):
2182         (JSC::DFG::ByteCodeParser::constantNull):
2183         (JSC::DFG::ByteCodeParser::one):
2184         (JSC::DFG::ByteCodeParser::constantNaN):
2185         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
2186         * dfg/DFGCommonData.cpp:
2187         (JSC::DFG::CommonData::notifyCompilingStructureTransition):
2188         * dfg/DFGCommonData.h:
2189         * dfg/DFGDesiredTransitions.cpp: Added.
2190         (JSC::DFG::DesiredTransition::DesiredTransition):
2191         (JSC::DFG::DesiredTransition::reallyAdd):
2192         (JSC::DFG::DesiredTransitions::DesiredTransitions):
2193         (JSC::DFG::DesiredTransitions::~DesiredTransitions):
2194         (JSC::DFG::DesiredTransitions::addLazily):
2195         (JSC::DFG::DesiredTransitions::reallyAdd):
2196         * dfg/DFGDesiredTransitions.h: Added.
2197         * dfg/DFGDesiredWeakReferences.cpp: Added.
2198         (JSC::DFG::DesiredWeakReferences::DesiredWeakReferences):
2199         (JSC::DFG::DesiredWeakReferences::~DesiredWeakReferences):
2200         (JSC::DFG::DesiredWeakReferences::addLazily):
2201         (JSC::DFG::DesiredWeakReferences::reallyAdd):
2202         * dfg/DFGDesiredWeakReferences.h: Added.
2203         * dfg/DFGDesiredWriteBarriers.cpp: Added.
2204         (JSC::DFG::DesiredWriteBarrier::DesiredWriteBarrier):
2205         (JSC::DFG::DesiredWriteBarrier::trigger):
2206         (JSC::DFG::DesiredWriteBarriers::DesiredWriteBarriers):
2207         (JSC::DFG::DesiredWriteBarriers::~DesiredWriteBarriers):
2208         (JSC::DFG::DesiredWriteBarriers::addImpl):
2209         (JSC::DFG::DesiredWriteBarriers::trigger):
2210         * dfg/DFGDesiredWriteBarriers.h: Added.
2211         (JSC::DFG::DesiredWriteBarriers::add):
2212         (JSC::DFG::initializeLazyWriteBarrier):
2213         * dfg/DFGFixupPhase.cpp:
2214         (JSC::DFG::FixupPhase::truncateConstantToInt32):
2215         * dfg/DFGGraph.h:
2216         (JSC::DFG::Graph::convertToConstant):
2217         * dfg/DFGJITCompiler.h:
2218         (JSC::DFG::JITCompiler::addWeakReference):
2219         * dfg/DFGPlan.cpp:
2220         (JSC::DFG::Plan::Plan):
2221         (JSC::DFG::Plan::reallyAdd):
2222         * dfg/DFGPlan.h:
2223         * dfg/DFGSpeculativeJIT32_64.cpp:
2224         (JSC::DFG::SpeculativeJIT::compile):
2225         * dfg/DFGSpeculativeJIT64.cpp:
2226         (JSC::DFG::SpeculativeJIT::compile):
2227         * runtime/WriteBarrier.h:
2228         (JSC::WriteBarrierBase::set):
2229         (JSC::WriteBarrier::WriteBarrier):
2230
2231 2013-08-15  Benjamin Poulain  <benjamin@webkit.org>
2232
2233         Fix x86 32bits build after r154158
2234
2235         * assembler/X86Assembler.h: Add missing #ifdef for the x86_64 instructions.
2236
2237 2013-08-15  Ryosuke Niwa  <rniwa@webkit.org>
2238
2239         Build fix attempt after r154156.
2240
2241         * jit/JITStubs.cpp:
2242         (JSC::cti_vm_handle_exception): encode!
2243
2244 2013-08-15  Benjamin Poulain  <benjamin@webkit.org>
2245
2246         [JSC] x86: Use inc and dec when possible
2247         https://bugs.webkit.org/show_bug.cgi?id=119831
2248
2249         Reviewed by Geoffrey Garen.
2250
2251         When incrementing or decrementing by an immediate of 1, use the insctructions
2252         inc and dec instead of add and sub.
2253         The instructions have good timing and their encoding is smaller.
2254
2255         * assembler/MacroAssemblerX86Common.h:
2256         (JSC::MacroAssemblerX86_64::add32):
2257         (JSC::MacroAssemblerX86_64::sub32):
2258         * assembler/MacroAssemblerX86_64.h:
2259         (JSC::MacroAssemblerX86_64::add64):
2260         (JSC::MacroAssemblerX86_64::sub64):
2261         * assembler/X86Assembler.h:
2262         (JSC::X86Assembler::dec_r):
2263         (JSC::X86Assembler::decq_r):
2264         (JSC::X86Assembler::inc_r):
2265         (JSC::X86Assembler::incq_r):
2266
2267 2013-08-15  Filip Pizlo  <fpizlo@apple.com>
2268
2269         Sometimes, the DFG uses a GetById for typed array length accesses despite profiling data that indicates that it's a typed array length access
2270         https://bugs.webkit.org/show_bug.cgi?id=119874
2271
2272         Reviewed by Oliver Hunt and Mark Hahnenberg.
2273         
2274         It was a confusion between heuristics in DFG::ArrayMode that are assuming that
2275         you'll use ForceExit if array profiles are empty, the JIT creating empty profiles
2276         sometimes for typed array length accesses, and the FixupPhase assuming that a
2277         ForceExit ArrayMode means that it should continue using a generic GetById.
2278
2279         This fixes the confusion.
2280
2281         * dfg/DFGFixupPhase.cpp:
2282         (JSC::DFG::FixupPhase::fixupNode):
2283
2284 2013-08-15  Mark Lam  <mark.lam@apple.com>
2285
2286         Fix crash when performing activation tearoff.
2287         https://bugs.webkit.org/show_bug.cgi?id=119848
2288
2289         Reviewed by Oliver Hunt.
2290
2291         The activation tearoff crash was due to a bug in the baseline JIT.
2292         If we have a scenario where the a baseline JIT frame calls a LLINT
2293         frame, an exception may be thrown while in the LLINT.
2294
2295         Interpreter::throwException() which handles the exception will unwind
2296         all frames until it finds a catcher or sees a host frame. When we
2297         return from the LLINT to the baseline JIT code, the baseline JIT code
2298         errorneously sets topCallFrame to the value in its call frame register,
2299         and starts unwinding the stack frames that have already been unwound.
2300
2301         The fix is:
2302         1. Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
2303            This is a more accurate description of what this runtime function
2304            is supposed to do i.e. it handles the exception which include doing
2305            nothing (if there are no more frames to unwind).
2306         2. Fix up topCallFrame values so that the HostCallFrameFlag is never
2307            set on it.
2308         3. Reloading the call frame register from topCallFrame when we're
2309            returning from a callee and detect exception handling in progress.
2310
2311         * interpreter/Interpreter.cpp:
2312         (JSC::Interpreter::unwindCallFrame):
2313         - Ensure that topCallFrame is not set with the HostCallFrameFlag.
2314         (JSC::Interpreter::getStackTrace):
2315         * interpreter/Interpreter.h:
2316         (JSC::TopCallFrameSetter::TopCallFrameSetter):
2317         (JSC::TopCallFrameSetter::~TopCallFrameSetter):
2318         (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
2319         - Ensure that topCallFrame is not set with the HostCallFrameFlag.
2320         * jit/JIT.h:
2321         * jit/JITExceptions.cpp:
2322         (JSC::uncaughtExceptionHandler):
2323         - Convenience function to get the handler for uncaught exceptions.
2324         * jit/JITExceptions.h:
2325         * jit/JITInlines.h:
2326         (JSC::JIT::reloadCallFrameFromTopCallFrame):
2327         * jit/JITOpcodes32_64.cpp:
2328         (JSC::JIT::privateCompileCTINativeCall):
2329         - Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
2330         * jit/JITStubs.cpp:
2331         (JSC::throwExceptionFromOpCall):
2332         - Ensure that topCallFrame is not set with the HostCallFrameFlag.
2333         (JSC::cti_vm_handle_exception):
2334         - Check for the case when there are no more frames to unwind.
2335         * jit/JITStubs.h:
2336         * jit/JITStubsARM.h:
2337         * jit/JITStubsARMv7.h:
2338         * jit/JITStubsMIPS.h:
2339         * jit/JITStubsSH4.h:
2340         * jit/JITStubsX86.h:
2341         * jit/JITStubsX86_64.h:
2342         - Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
2343         * jit/SlowPathCall.h:
2344         (JSC::JITSlowPathCall::call):
2345         - reload cfr from topcallFrame when handling an exception.
2346         - Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
2347         * jit/ThunkGenerators.cpp:
2348         (JSC::nativeForGenerator):
2349         * llint/LowLevelInterpreter32_64.asm:
2350         * llint/LowLevelInterpreter64.asm:
2351         - reload cfr from topcallFrame when handling an exception.
2352         * runtime/VM.cpp:
2353         (JSC::VM::VM):
2354         - Ensure that topCallFrame is not set with the HostCallFrameFlag.
2355
2356 2013-08-15  Filip Pizlo  <fpizlo@apple.com>
2357
2358         Remove some code duplication.
2359         
2360         Rubber stamped by Mark Hahnenberg.
2361
2362         * runtime/JSDataViewPrototype.cpp:
2363         (JSC::getData):
2364         (JSC::setData):
2365
2366 2013-08-15  Julien Brianceau  <jbrianceau@nds.com>
2367
2368         [DFG] isDouble() and isNumerical() should return true with KnownNumberUse UseKind.
2369         https://bugs.webkit.org/show_bug.cgi?id=119794
2370
2371         Reviewed by Filip Pizlo.
2372
2373         This patch fixes ASSERTs failures in debug builds for sh4 and mips architecture.
2374
2375         * dfg/DFGUseKind.h:
2376         (JSC::DFG::isNumerical):
2377         (JSC::DFG::isDouble):
2378
2379 2013-08-15  Filip Pizlo  <fpizlo@apple.com>
2380
2381         http://trac.webkit.org/changeset/154120 accidentally changed DFGCapabilities to read the resolve type from operand 4, not 3; it should be 3.
2382
2383         Rubber stamped by Oliver Hunt.
2384         
2385         This was causing some test crashes for me.
2386
2387         * dfg/DFGCapabilities.cpp:
2388         (JSC::DFG::capabilityLevel):
2389
2390 2013-08-15  Brent Fulgham  <bfulgham@apple.com>
2391
2392         [Windows] Clear up improper export declaration.
2393
2394         * runtime/ArrayBufferView.h:
2395
2396 2013-08-15  Filip Pizlo  <fpizlo@apple.com>
2397
2398         Unreviewed, remove some unnecessary periods from exceptions.
2399
2400         * runtime/JSDataViewPrototype.cpp:
2401         (JSC::getData):
2402         (JSC::setData):
2403
2404 2013-08-15  Filip Pizlo  <fpizlo@apple.com>
2405
2406         Unreviewed, fix 32-bit build.
2407
2408         * dfg/DFGSpeculativeJIT32_64.cpp:
2409         (JSC::DFG::SpeculativeJIT::compile):
2410
2411 2013-08-14  Filip Pizlo  <fpizlo@apple.com>
2412
2413         Typed arrays should be rewritten
2414         https://bugs.webkit.org/show_bug.cgi?id=119064
2415
2416         Reviewed by Oliver Hunt.
2417         
2418         Typed arrays were previously deficient in several major ways:
2419         
2420         - They were defined separately in WebCore and in the jsc shell. The two
2421           implementations were different, and the jsc shell one was basically wrong.
2422           The WebCore one was quite awful, also.
2423         
2424         - Typed arrays were not visible to the JIT except through some weird hooks.
2425           For example, the JIT could not ask "what is the Structure that this typed
2426           array would have if I just allocated it from this global object". Also,
2427           it was difficult to wire any of the typed array intrinsics, because most
2428           of the functionality wasn't visible anywhere in JSC.
2429         
2430         - Typed array allocation was brain-dead. Allocating a typed array involved
2431           two JS objects, two GC weak handles, and three malloc allocations.
2432         
2433         - Neutering. It involved keeping tabs on all native views but not the view
2434           wrappers, even though the native views can autoneuter just by asking the
2435           buffer if it was neutered anytime you touch them; while the JS view
2436           wrappers are the ones that you really want to reach out to.
2437         
2438         - Common case-ing. Most typed arrays have one buffer and one view, and
2439           usually nobody touches the buffer. Yet we created all of that stuff
2440           anyway, using data structures optimized for the case where you had a lot
2441           of views.
2442         
2443         - Semantic goofs. Typed arrays should, in the future, behave like ES
2444           features rather than DOM features, for example when it comes to exceptions.
2445           Firefox already does this and I agree with them.
2446         
2447         This patch cleanses our codebase of these sins:
2448         
2449         - Typed arrays are almost entirely defined in JSC. Only the lifecycle
2450           management of native references to buffers is left to WebCore.
2451         
2452         - Allocating a typed array requires either two GC allocations (a cell and a
2453           copied storage vector) or one GC allocation, a malloc allocation, and a
2454           weak handle (a cell and a malloc'd storage vector, plus a finalizer for the
2455           latter). The latter is only used for oversize arrays. Remember that before
2456           it was 7 allocations no matter what.
2457         
2458         - Typed arrays require just 4 words of overhead: Structure*, Butterfly*,
2459           mode/length, void* vector. Before it was a lot more than that - remember,
2460           there were five additional objects that did absolutely nothing for anybody.
2461         
2462         - Native views aren't tracked by the buffer, or by the wrappers. They are
2463           transient. In the future we'll probably switch to not even having them be
2464           malloc'd.
2465         
2466         - Native array buffers have an efficient way of tracking all of their JS view
2467           wrappers, both for neutering, and for lifecycle management. The GC
2468           special-cases native array buffers. This saves a bunch of grief; for example
2469           it means that a JS view wrapper can refer to its buffer via the butterfly,
2470           which would be dead by the time we went to finalize.
2471         
2472         - Typed array semantics now match Firefox, which also happens to be where the
2473           standards are going. The discussion on webkit-dev seemed to confirm that
2474           Chrome is also heading in this direction. This includes making
2475           Uint8ClampedArray not a subtype of Uint8Array, and getting rid of
2476           ArrayBufferView as a JS-visible construct.
2477         
2478         This is up to a 10x speed-up on programs that allocate a lot of typed arrays.
2479         It's a 1% speed-up on Octane. It also opens up a bunch of possibilities for
2480         further typed array optimizations in the JSC JITs, including inlining typed
2481         array allocation, inlining more of the accessors, reducing the cost of type
2482         checks, etc.
2483         
2484         An additional property of this patch is that typed arrays are mostly
2485         implemented using templates. This deduplicates a bunch of code, but does mean
2486         that we need some hacks for exporting s_info's of template classes. See
2487         JSGenericTypedArrayView.h and JSTypedArrays.cpp. Those hacks are fairly
2488         low-impact compared to code duplication.
2489         
2490         Automake work courtesy of Zan Dobersek <zdobersek@igalia.com>.
2491
2492         * CMakeLists.txt:
2493         * DerivedSources.make:
2494         * GNUmakefile.list.am:
2495         * JSCTypedArrayStubs.h: Removed.
2496         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2497         * JavaScriptCore.xcodeproj/project.pbxproj:
2498         * Target.pri:
2499         * bytecode/ByValInfo.h:
2500         (JSC::hasOptimizableIndexingForClassInfo):
2501         (JSC::jitArrayModeForClassInfo):
2502         (JSC::typedArrayTypeForJITArrayMode):
2503         * bytecode/SpeculatedType.cpp:
2504         (JSC::speculationFromClassInfo):
2505         * dfg/DFGArrayMode.cpp:
2506         (JSC::DFG::toTypedArrayType):
2507         * dfg/DFGArrayMode.h:
2508         (JSC::DFG::ArrayMode::typedArrayType):
2509         * dfg/DFGSpeculativeJIT.cpp:
2510         (JSC::DFG::SpeculativeJIT::checkArray):
2511         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
2512         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
2513         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
2514         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
2515         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
2516         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
2517         * dfg/DFGSpeculativeJIT.h:
2518         * dfg/DFGSpeculativeJIT32_64.cpp:
2519         (JSC::DFG::SpeculativeJIT::compile):
2520         * dfg/DFGSpeculativeJIT64.cpp:
2521         (JSC::DFG::SpeculativeJIT::compile):
2522         * heap/CopyToken.h:
2523         * heap/DeferGC.h:
2524         (JSC::DeferGCForAWhile::DeferGCForAWhile):
2525         (JSC::DeferGCForAWhile::~DeferGCForAWhile):
2526         * heap/GCIncomingRefCounted.h: Added.
2527         (JSC::GCIncomingRefCounted::GCIncomingRefCounted):
2528         (JSC::GCIncomingRefCounted::~GCIncomingRefCounted):
2529         (JSC::GCIncomingRefCounted::numberOfIncomingReferences):
2530         (JSC::GCIncomingRefCounted::incomingReferenceAt):
2531         (JSC::GCIncomingRefCounted::singletonFlag):
2532         (JSC::GCIncomingRefCounted::hasVectorOfCells):
2533         (JSC::GCIncomingRefCounted::hasAnyIncoming):
2534         (JSC::GCIncomingRefCounted::hasSingleton):
2535         (JSC::GCIncomingRefCounted::singleton):
2536         (JSC::GCIncomingRefCounted::vectorOfCells):
2537         * heap/GCIncomingRefCountedInlines.h: Added.
2538         (JSC::::addIncomingReference):
2539         (JSC::::filterIncomingReferences):
2540         * heap/GCIncomingRefCountedSet.h: Added.
2541         (JSC::GCIncomingRefCountedSet::size):
2542         * heap/GCIncomingRefCountedSetInlines.h: Added.
2543         (JSC::::GCIncomingRefCountedSet):
2544         (JSC::::~GCIncomingRefCountedSet):
2545         (JSC::::addReference):
2546         (JSC::::sweep):
2547         (JSC::::removeAll):
2548         (JSC::::removeDead):
2549         * heap/Heap.cpp:
2550         (JSC::Heap::addReference):
2551         (JSC::Heap::extraSize):
2552         (JSC::Heap::size):
2553         (JSC::Heap::capacity):
2554         (JSC::Heap::collect):
2555         (JSC::Heap::decrementDeferralDepth):
2556         (JSC::Heap::decrementDeferralDepthAndGCIfNeeded):
2557         * heap/Heap.h:
2558         * interpreter/CallFrame.h:
2559         (JSC::ExecState::dataViewTable):
2560         * jit/JIT.h:
2561         * jit/JITPropertyAccess.cpp:
2562         (JSC::JIT::privateCompileGetByVal):
2563         (JSC::JIT::privateCompilePutByVal):
2564         (JSC::JIT::emitIntTypedArrayGetByVal):
2565         (JSC::JIT::emitFloatTypedArrayGetByVal):
2566         (JSC::JIT::emitIntTypedArrayPutByVal):
2567         (JSC::JIT::emitFloatTypedArrayPutByVal):
2568         * jsc.cpp:
2569         (GlobalObject::finishCreation):
2570         * runtime/ArrayBuffer.cpp:
2571         (JSC::ArrayBuffer::transfer):
2572         * runtime/ArrayBuffer.h:
2573         (JSC::ArrayBuffer::createAdopted):
2574         (JSC::ArrayBuffer::ArrayBuffer):
2575         (JSC::ArrayBuffer::gcSizeEstimateInBytes):
2576         (JSC::ArrayBuffer::pin):
2577         (JSC::ArrayBuffer::unpin):
2578         (JSC::ArrayBufferContents::tryAllocate):
2579         * runtime/ArrayBufferView.cpp:
2580         (JSC::ArrayBufferView::ArrayBufferView):
2581         (JSC::ArrayBufferView::~ArrayBufferView):
2582         (JSC::ArrayBufferView::setNeuterable):
2583         * runtime/ArrayBufferView.h:
2584         (JSC::ArrayBufferView::isNeutered):
2585         (JSC::ArrayBufferView::buffer):
2586         (JSC::ArrayBufferView::baseAddress):
2587         (JSC::ArrayBufferView::byteOffset):
2588         (JSC::ArrayBufferView::verifySubRange):
2589         (JSC::ArrayBufferView::clampOffsetAndNumElements):
2590         (JSC::ArrayBufferView::calculateOffsetAndLength):
2591         * runtime/ClassInfo.h:
2592         * runtime/CommonIdentifiers.h:
2593         * runtime/DataView.cpp: Added.
2594         (JSC::DataView::DataView):
2595         (JSC::DataView::create):
2596         (JSC::DataView::wrap):
2597         * runtime/DataView.h: Added.
2598         (JSC::DataView::byteLength):
2599         (JSC::DataView::getType):
2600         (JSC::DataView::get):
2601         (JSC::DataView::set):
2602         * runtime/Float32Array.h:
2603         * runtime/Float64Array.h:
2604         * runtime/GenericTypedArrayView.h: Added.
2605         (JSC::GenericTypedArrayView::data):
2606         (JSC::GenericTypedArrayView::set):
2607         (JSC::GenericTypedArrayView::setRange):
2608         (JSC::GenericTypedArrayView::zeroRange):
2609         (JSC::GenericTypedArrayView::zeroFill):
2610         (JSC::GenericTypedArrayView::length):
2611         (JSC::GenericTypedArrayView::byteLength):
2612         (JSC::GenericTypedArrayView::item):
2613         (JSC::GenericTypedArrayView::checkInboundData):
2614         (JSC::GenericTypedArrayView::getType):
2615         * runtime/GenericTypedArrayViewInlines.h: Added.
2616         (JSC::::GenericTypedArrayView):
2617         (JSC::::create):
2618         (JSC::::createUninitialized):
2619         (JSC::::subarray):
2620         (JSC::::wrap):
2621         * runtime/IndexingHeader.h:
2622         (JSC::IndexingHeader::arrayBuffer):
2623         (JSC::IndexingHeader::setArrayBuffer):
2624         * runtime/Int16Array.h:
2625         * runtime/Int32Array.h:
2626         * runtime/Int8Array.h:
2627         * runtime/JSArrayBuffer.cpp: Added.
2628         (JSC::JSArrayBuffer::JSArrayBuffer):
2629         (JSC::JSArrayBuffer::finishCreation):
2630         (JSC::JSArrayBuffer::create):
2631         (JSC::JSArrayBuffer::createStructure):
2632         (JSC::JSArrayBuffer::getOwnPropertySlot):
2633         (JSC::JSArrayBuffer::getOwnPropertyDescriptor):
2634         (JSC::JSArrayBuffer::put):
2635         (JSC::JSArrayBuffer::defineOwnProperty):
2636         (JSC::JSArrayBuffer::deleteProperty):
2637         (JSC::JSArrayBuffer::getOwnNonIndexPropertyNames):
2638         * runtime/JSArrayBuffer.h: Added.
2639         (JSC::JSArrayBuffer::impl):
2640         (JSC::toArrayBuffer):
2641         * runtime/JSArrayBufferConstructor.cpp: Added.
2642         (JSC::JSArrayBufferConstructor::JSArrayBufferConstructor):
2643         (JSC::JSArrayBufferConstructor::finishCreation):
2644         (JSC::JSArrayBufferConstructor::create):
2645         (JSC::JSArrayBufferConstructor::createStructure):
2646         (JSC::constructArrayBuffer):
2647         (JSC::JSArrayBufferConstructor::getConstructData):
2648         (JSC::JSArrayBufferConstructor::getCallData):
2649         * runtime/JSArrayBufferConstructor.h: Added.
2650         * runtime/JSArrayBufferPrototype.cpp: Added.
2651         (JSC::arrayBufferProtoFuncSlice):
2652         (JSC::JSArrayBufferPrototype::JSArrayBufferPrototype):
2653         (JSC::JSArrayBufferPrototype::finishCreation):
2654         (JSC::JSArrayBufferPrototype::create):
2655         (JSC::JSArrayBufferPrototype::createStructure):
2656         * runtime/JSArrayBufferPrototype.h: Added.
2657         * runtime/JSArrayBufferView.cpp: Added.
2658         (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
2659         (JSC::JSArrayBufferView::JSArrayBufferView):
2660         (JSC::JSArrayBufferView::finishCreation):
2661         (JSC::JSArrayBufferView::getOwnPropertySlot):
2662         (JSC::JSArrayBufferView::getOwnPropertyDescriptor):
2663         (JSC::JSArrayBufferView::put):
2664         (JSC::JSArrayBufferView::defineOwnProperty):
2665         (JSC::JSArrayBufferView::deleteProperty):
2666         (JSC::JSArrayBufferView::getOwnNonIndexPropertyNames):
2667         (JSC::JSArrayBufferView::finalize):
2668         * runtime/JSArrayBufferView.h: Added.
2669         (JSC::JSArrayBufferView::sizeOf):
2670         (JSC::JSArrayBufferView::ConstructionContext::operator!):
2671         (JSC::JSArrayBufferView::ConstructionContext::structure):
2672         (JSC::JSArrayBufferView::ConstructionContext::vector):
2673         (JSC::JSArrayBufferView::ConstructionContext::length):
2674         (JSC::JSArrayBufferView::ConstructionContext::mode):
2675         (JSC::JSArrayBufferView::ConstructionContext::butterfly):
2676         (JSC::JSArrayBufferView::mode):
2677         (JSC::JSArrayBufferView::vector):
2678         (JSC::JSArrayBufferView::length):
2679         (JSC::JSArrayBufferView::offsetOfVector):
2680         (JSC::JSArrayBufferView::offsetOfLength):
2681         (JSC::JSArrayBufferView::offsetOfMode):
2682         * runtime/JSArrayBufferViewInlines.h: Added.
2683         (JSC::JSArrayBufferView::slowDownAndWasteMemoryIfNecessary):
2684         (JSC::JSArrayBufferView::buffer):
2685         (JSC::JSArrayBufferView::impl):
2686         (JSC::JSArrayBufferView::neuter):
2687         (JSC::JSArrayBufferView::byteOffset):
2688         * runtime/JSCell.cpp:
2689         (JSC::JSCell::slowDownAndWasteMemory):
2690         (JSC::JSCell::getTypedArrayImpl):
2691         * runtime/JSCell.h:
2692         * runtime/JSDataView.cpp: Added.
2693         (JSC::JSDataView::JSDataView):
2694         (JSC::JSDataView::create):
2695         (JSC::JSDataView::createUninitialized):
2696         (JSC::JSDataView::set):
2697         (JSC::JSDataView::typedImpl):
2698         (JSC::JSDataView::getOwnPropertySlot):
2699         (JSC::JSDataView::getOwnPropertyDescriptor):
2700         (JSC::JSDataView::slowDownAndWasteMemory):
2701         (JSC::JSDataView::getTypedArrayImpl):
2702         (JSC::JSDataView::createStructure):
2703         * runtime/JSDataView.h: Added.
2704         * runtime/JSDataViewPrototype.cpp: Added.
2705         (JSC::JSDataViewPrototype::JSDataViewPrototype):
2706         (JSC::JSDataViewPrototype::create):
2707         (JSC::JSDataViewPrototype::createStructure):
2708         (JSC::JSDataViewPrototype::getOwnPropertySlot):
2709         (JSC::JSDataViewPrototype::getOwnPropertyDescriptor):
2710         (JSC::getData):
2711         (JSC::setData):
2712         (JSC::dataViewProtoFuncGetInt8):
2713         (JSC::dataViewProtoFuncGetInt16):
2714         (JSC::dataViewProtoFuncGetInt32):
2715         (JSC::dataViewProtoFuncGetUint8):
2716         (JSC::dataViewProtoFuncGetUint16):
2717         (JSC::dataViewProtoFuncGetUint32):
2718         (JSC::dataViewProtoFuncGetFloat32):
2719         (JSC::dataViewProtoFuncGetFloat64):
2720         (JSC::dataViewProtoFuncSetInt8):
2721         (JSC::dataViewProtoFuncSetInt16):
2722         (JSC::dataViewProtoFuncSetInt32):
2723         (JSC::dataViewProtoFuncSetUint8):
2724         (JSC::dataViewProtoFuncSetUint16):
2725         (JSC::dataViewProtoFuncSetUint32):
2726         (JSC::dataViewProtoFuncSetFloat32):
2727         (JSC::dataViewProtoFuncSetFloat64):
2728         * runtime/JSDataViewPrototype.h: Added.
2729         * runtime/JSFloat32Array.h: Added.
2730         * runtime/JSFloat64Array.h: Added.
2731         * runtime/JSGenericTypedArrayView.h: Added.
2732         (JSC::JSGenericTypedArrayView::byteLength):
2733         (JSC::JSGenericTypedArrayView::byteSize):
2734         (JSC::JSGenericTypedArrayView::typedVector):
2735         (JSC::JSGenericTypedArrayView::canGetIndexQuickly):
2736         (JSC::JSGenericTypedArrayView::canSetIndexQuickly):
2737         (JSC::JSGenericTypedArrayView::getIndexQuicklyAsNativeValue):
2738         (JSC::JSGenericTypedArrayView::getIndexQuicklyAsDouble):
2739         (JSC::JSGenericTypedArrayView::getIndexQuickly):
2740         (JSC::JSGenericTypedArrayView::setIndexQuicklyToNativeValue):
2741         (JSC::JSGenericTypedArrayView::setIndexQuicklyToDouble):
2742         (JSC::JSGenericTypedArrayView::setIndexQuickly):
2743         (JSC::JSGenericTypedArrayView::canAccessRangeQuickly):
2744         (JSC::JSGenericTypedArrayView::typedImpl):
2745         (JSC::JSGenericTypedArrayView::createStructure):
2746         (JSC::JSGenericTypedArrayView::info):
2747         (JSC::toNativeTypedView):
2748         * runtime/JSGenericTypedArrayViewConstructor.h: Added.
2749         * runtime/JSGenericTypedArrayViewConstructorInlines.h: Added.
2750         (JSC::::JSGenericTypedArrayViewConstructor):
2751         (JSC::::finishCreation):
2752         (JSC::::create):
2753         (JSC::::createStructure):
2754         (JSC::constructGenericTypedArrayView):
2755         (JSC::::getConstructData):
2756         (JSC::::getCallData):
2757         * runtime/JSGenericTypedArrayViewInlines.h: Added.
2758         (JSC::::JSGenericTypedArrayView):
2759         (JSC::::create):
2760         (JSC::::createUninitialized):
2761         (JSC::::validateRange):
2762         (JSC::::setWithSpecificType):
2763         (JSC::::set):
2764         (JSC::::getOwnPropertySlot):
2765         (JSC::::getOwnPropertyDescriptor):
2766         (JSC::::put):
2767         (JSC::::defineOwnProperty):
2768         (JSC::::deleteProperty):
2769         (JSC::::getOwnPropertySlotByIndex):
2770         (JSC::::putByIndex):
2771         (JSC::::deletePropertyByIndex):
2772         (JSC::::getOwnNonIndexPropertyNames):
2773         (JSC::::getOwnPropertyNames):
2774         (JSC::::visitChildren):
2775         (JSC::::copyBackingStore):
2776         (JSC::::slowDownAndWasteMemory):
2777         (JSC::::getTypedArrayImpl):
2778         * runtime/JSGenericTypedArrayViewPrototype.h: Added.
2779         * runtime/JSGenericTypedArrayViewPrototypeInlines.h: Added.
2780         (JSC::genericTypedArrayViewProtoFuncSet):
2781         (JSC::genericTypedArrayViewProtoFuncSubarray):
2782         (JSC::::JSGenericTypedArrayViewPrototype):
2783         (JSC::::finishCreation):
2784         (JSC::::create):
2785         (JSC::::createStructure):
2786         * runtime/JSGlobalObject.cpp:
2787         (JSC::JSGlobalObject::reset):
2788         (JSC::JSGlobalObject::visitChildren):
2789         * runtime/JSGlobalObject.h:
2790         (JSC::JSGlobalObject::arrayBufferPrototype):
2791         (JSC::JSGlobalObject::arrayBufferStructure):
2792         (JSC::JSGlobalObject::typedArrayStructure):
2793         * runtime/JSInt16Array.h: Added.
2794         * runtime/JSInt32Array.h: Added.
2795         * runtime/JSInt8Array.h: Added.
2796         * runtime/JSTypedArrayConstructors.cpp: Added.
2797         * runtime/JSTypedArrayConstructors.h: Added.
2798         * runtime/JSTypedArrayPrototypes.cpp: Added.
2799         * runtime/JSTypedArrayPrototypes.h: Added.
2800         * runtime/JSTypedArrays.cpp: Added.
2801         * runtime/JSTypedArrays.h: Added.
2802         * runtime/JSUint16Array.h: Added.
2803         * runtime/JSUint32Array.h: Added.
2804         * runtime/JSUint8Array.h: Added.
2805         * runtime/JSUint8ClampedArray.h: Added.
2806         * runtime/Operations.h:
2807         * runtime/Options.h:
2808         * runtime/SimpleTypedArrayController.cpp: Added.
2809         (JSC::SimpleTypedArrayController::SimpleTypedArrayController):
2810         (JSC::SimpleTypedArrayController::~SimpleTypedArrayController):
2811         (JSC::SimpleTypedArrayController::toJS):
2812         * runtime/SimpleTypedArrayController.h: Added.
2813         * runtime/Structure.h:
2814         (JSC::Structure::couldHaveIndexingHeader):
2815         * runtime/StructureInlines.h:
2816         (JSC::Structure::hasIndexingHeader):
2817         * runtime/TypedArrayAdaptors.h: Added.
2818         (JSC::IntegralTypedArrayAdaptor::toNative):
2819         (JSC::IntegralTypedArrayAdaptor::toJSValue):
2820         (JSC::IntegralTypedArrayAdaptor::toDouble):
2821         (JSC::FloatTypedArrayAdaptor::toNative):
2822         (JSC::FloatTypedArrayAdaptor::toJSValue):
2823         (JSC::FloatTypedArrayAdaptor::toDouble):
2824         (JSC::Uint8ClampedAdaptor::toNative):
2825         (JSC::Uint8ClampedAdaptor::toJSValue):
2826         (JSC::Uint8ClampedAdaptor::toDouble):
2827         (JSC::Uint8ClampedAdaptor::clamp):
2828         * runtime/TypedArrayController.cpp: Added.
2829         (JSC::TypedArrayController::TypedArrayController):
2830         (JSC::TypedArrayController::~TypedArrayController):
2831         * runtime/TypedArrayController.h: Added.
2832         * runtime/TypedArrayDescriptor.h: Removed.
2833         * runtime/TypedArrayInlines.h: Added.
2834         * runtime/TypedArrayType.cpp: Added.
2835         (JSC::classInfoForType):
2836         (WTF::printInternal):
2837         * runtime/TypedArrayType.h: Added.
2838         (JSC::toIndex):
2839         (JSC::isTypedView):
2840         (JSC::elementSize):
2841         (JSC::isInt):
2842         (JSC::isFloat):
2843         (JSC::isSigned):
2844         (JSC::isClamped):
2845         * runtime/TypedArrays.h: Added.
2846         * runtime/Uint16Array.h:
2847         * runtime/Uint32Array.h:
2848         * runtime/Uint8Array.h:
2849         * runtime/Uint8ClampedArray.h:
2850         * runtime/VM.cpp:
2851         (JSC::VM::VM):
2852         (JSC::VM::~VM):
2853         * runtime/VM.h:
2854
2855 2013-08-15  Oliver Hunt  <oliver@apple.com>
2856
2857         <https://webkit.org/b/119830> Assigning to a readonly global results in DFG byte code parse failure
2858
2859         Reviewed by Filip Pizlo.
2860
2861         Make sure dfgCapabilities doesn't report a Dynamic put as
2862         being compilable when we don't actually support it.  
2863
2864         * bytecode/CodeBlock.cpp:
2865         (JSC::CodeBlock::dumpBytecode):
2866         * dfg/DFGCapabilities.cpp:
2867         (JSC::DFG::capabilityLevel):
2868
2869 2013-08-15  Brent Fulgham  <bfulgham@apple.com>
2870
2871         [Windows] Incorrect DLL Linkage for JSC ArrayBuffer and ArrayBufferView
2872         https://bugs.webkit.org/show_bug.cgi?id=119847
2873
2874         Reviewed by Oliver Hunt.
2875
2876         * runtime/ArrayBuffer.h: Switch from WTF_EXPORT_PRIVATE to JS_EXPORT_PRIVATE
2877         * runtime/ArrayBufferView.h: Ditto.
2878
2879 2013-08-15  Gavin Barraclough  <barraclough@apple.com>
2880
2881         https://bugs.webkit.org/show_bug.cgi?id=119843
2882         PropertySlot::setValue is ambiguous
2883
2884         Reviewed by Geoff Garen.
2885
2886         There are three different versions of PropertySlot::setValue, one for cacheable properties, and two that are used interchangeably and inconsistently.
2887         The problematic variants are the ones that just take a value, and one that takes a value and also the object containing the property.
2888         Unify on always providing the object, and remove the version that just takes a value.
2889         This always works except for JSString, where we optimize out the object (logically we should be instantiating a temporary StringObject on every property access).
2890         Provide a version of setValue that takes a JSString as the owner of the property.
2891         We won't store this, but it makes it clear that this interface should only be used from JSString.
2892
2893         * API/JSCallbackObjectFunctions.h:
2894         (JSC::::getOwnPropertySlot):
2895         * JSCTypedArrayStubs.h:
2896         * runtime/Arguments.cpp:
2897         (JSC::Arguments::getOwnPropertySlotByIndex):
2898         (JSC::Arguments::getOwnPropertySlot):
2899         * runtime/JSActivation.cpp:
2900         (JSC::JSActivation::symbolTableGet):
2901         (JSC::JSActivation::getOwnPropertySlot):
2902         * runtime/JSArray.cpp:
2903         (JSC::JSArray::getOwnPropertySlot):
2904         * runtime/JSObject.cpp:
2905         (JSC::JSObject::getOwnPropertySlotByIndex):
2906         * runtime/JSString.h:
2907         (JSC::JSString::getStringPropertySlot):
2908         * runtime/JSSymbolTableObject.h:
2909         (JSC::symbolTableGet):
2910         * runtime/SparseArrayValueMap.cpp:
2911         (JSC::SparseArrayEntry::get):
2912             - Pass object containing property to PropertySlot::setValue
2913         * runtime/PropertySlot.h:
2914         (JSC::PropertySlot::setValue):
2915             - Logically, the base of a string property access is a temporary StringObject, but we optimize that away.
2916         (JSC::PropertySlot::setUndefined):
2917             - removed setValue(JSValue), added setValue(JSString*, JSValue)
2918
2919 2013-08-15  Oliver Hunt  <oliver@apple.com>
2920
2921         Remove bogus assertion.
2922
2923         RS=Filip Pizlo
2924
2925         * dfg/DFGAbstractInterpreterInlines.h:
2926         (JSC::DFG::::executeEffects):
2927
2928 2013-08-15  Allan Sandfeld Jensen  <allan.jensen@digia.com>
2929
2930         REGRESSION(r148790) Made 7 tests fail on x86 32bit
2931         https://bugs.webkit.org/show_bug.cgi?id=114913
2932
2933         Reviewed by Filip Pizlo.
2934
2935         The X87 register was not freed before some calls. Instead
2936         of inserting resetX87Registers to the last call sites,
2937         the two X87 registers are now freed in every call.
2938
2939         * llint/LowLevelInterpreter32_64.asm:
2940         * llint/LowLevelInterpreter64.asm:
2941         * offlineasm/instructions.rb:
2942         * offlineasm/x86.rb:
2943
2944 2013-08-14  Michael Saboff  <msaboff@apple.com>
2945
2946         Fixed jit on Win64.
2947         https://bugs.webkit.org/show_bug.cgi?id=119601
2948
2949         Reviewed by Oliver Hunt.
2950
2951         * jit/JITStubsMSVC64.asm: Added ctiVMThrowTrampolineSlowpath implementation.
2952         * jit/JSInterfaceJIT.h: Added thirdArgumentRegister.
2953         * jit/SlowPathCall.h:
2954         (JSC::JITSlowPathCall::call): Added correct calling convention for Win64.
2955
2956 2013-08-14  Alex Christensen  <achristensen@apple.com>
2957
2958         Compile fix for Win64 with jit disabled.
2959         https://bugs.webkit.org/show_bug.cgi?id=119804
2960
2961         Reviewed by Michael Saboff.
2962
2963         * offlineasm/cloop.rb: Added std:: before isnan.
2964
2965 2013-08-14  Julien Brianceau  <jbrianceau@nds.com>
2966
2967         DFG_JIT implementation for sh4 architecture.
2968         https://bugs.webkit.org/show_bug.cgi?id=119737
2969
2970         Reviewed by Oliver Hunt.
2971
2972         * assembler/MacroAssemblerSH4.h:
2973         (JSC::MacroAssemblerSH4::invert):
2974         (JSC::MacroAssemblerSH4::add32):
2975         (JSC::MacroAssemblerSH4::and32):
2976         (JSC::MacroAssemblerSH4::lshift32):
2977         (JSC::MacroAssemblerSH4::mul32):
2978         (JSC::MacroAssemblerSH4::or32):
2979         (JSC::MacroAssemblerSH4::rshift32):
2980         (JSC::MacroAssemblerSH4::sub32):
2981         (JSC::MacroAssemblerSH4::xor32):
2982         (JSC::MacroAssemblerSH4::store32):
2983         (JSC::MacroAssemblerSH4::swapDouble):
2984         (JSC::MacroAssemblerSH4::storeDouble):
2985         (JSC::MacroAssemblerSH4::subDouble):
2986         (JSC::MacroAssemblerSH4::mulDouble):
2987         (JSC::MacroAssemblerSH4::divDouble):
2988         (JSC::MacroAssemblerSH4::negateDouble):
2989         (JSC::MacroAssemblerSH4::zeroExtend32ToPtr):
2990         (JSC::MacroAssemblerSH4::branchTruncateDoubleToUint32):
2991         (JSC::MacroAssemblerSH4::truncateDoubleToUint32):
2992         (JSC::MacroAssemblerSH4::swap):
2993         (JSC::MacroAssemblerSH4::jump):
2994         (JSC::MacroAssemblerSH4::branchNeg32):
2995         (JSC::MacroAssemblerSH4::branchAdd32):
2996         (JSC::MacroAssemblerSH4::branchMul32):
2997         (JSC::MacroAssemblerSH4::urshift32):
2998         * assembler/SH4Assembler.h:
2999         (JSC::SH4Assembler::SH4Assembler):
3000         (JSC::SH4Assembler::labelForWatchpoint):
3001         (JSC::SH4Assembler::label):
3002         (JSC::SH4Assembler::debugOffset):
3003         * dfg/DFGAssemblyHelpers.h:
3004         (JSC::DFG::AssemblyHelpers::preserveReturnAddressAfterCall):
3005         (JSC::DFG::AssemblyHelpers::restoreReturnAddressBeforeReturn):
3006         (JSC::DFG::AssemblyHelpers::debugCall):
3007         * dfg/DFGCCallHelpers.h:
3008         (JSC::DFG::CCallHelpers::setupArguments):
3009         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
3010         * dfg/DFGFPRInfo.h:
3011         (JSC::DFG::FPRInfo::toRegister):
3012         (JSC::DFG::FPRInfo::toIndex):
3013         (JSC::DFG::FPRInfo::debugName):
3014         * dfg/DFGGPRInfo.h:
3015         (JSC::DFG::GPRInfo::toRegister):
3016         (JSC::DFG::GPRInfo::toIndex):
3017         (JSC::DFG::GPRInfo::debugName):
3018         * dfg/DFGOperations.cpp:
3019         * dfg/DFGSpeculativeJIT.h:
3020         (JSC::DFG::SpeculativeJIT::callOperation):
3021         * jit/JITStubs.h:
3022         * jit/JITStubsSH4.h:
3023
3024 2013-08-13  Filip Pizlo  <fpizlo@apple.com>
3025
3026         Unreviewed, fix build.
3027
3028         * API/JSValue.mm:
3029         (isDate):
3030         (isArray):
3031         * API/JSWrapperMap.mm:
3032         (tryUnwrapObjcObject):
3033         * API/ObjCCallbackFunction.mm:
3034         (tryUnwrapBlock):
3035
3036 2013-08-13  Filip Pizlo  <fpizlo@apple.com>
3037
3038         Foo::s_info should be Foo::info(), so that you can change how the s_info is actually linked
3039         https://bugs.webkit.org/show_bug.cgi?id=119770
3040
3041         Reviewed by Mark Hahnenberg.
3042
3043         * API/JSCallbackConstructor.cpp:
3044         (JSC::JSCallbackConstructor::finishCreation):
3045         * API/JSCallbackConstructor.h:
3046         (JSC::JSCallbackConstructor::createStructure):
3047         * API/JSCallbackFunction.cpp:
3048         (JSC::JSCallbackFunction::finishCreation):
3049         * API/JSCallbackFunction.h:
3050         (JSC::JSCallbackFunction::createStructure):
3051         * API/JSCallbackObject.cpp:
3052         (JSC::::createStructure):
3053         * API/JSCallbackObject.h:
3054         (JSC::JSCallbackObject::visitChildren):
3055         * API/JSCallbackObjectFunctions.h:
3056         (JSC::::asCallbackObject):
3057         (JSC::::finishCreation):
3058         * API/JSObjectRef.cpp:
3059         (JSObjectGetPrivate):
3060         (JSObjectSetPrivate):
3061         (JSObjectGetPrivateProperty):
3062         (JSObjectSetPrivateProperty):
3063         (JSObjectDeletePrivateProperty):
3064         * API/JSValueRef.cpp:
3065         (JSValueIsObjectOfClass):
3066         * API/JSWeakObjectMapRefPrivate.cpp:
3067         * API/ObjCCallbackFunction.h:
3068         (JSC::ObjCCallbackFunction::createStructure):
3069         * JSCTypedArrayStubs.h:
3070         * bytecode/CallLinkStatus.cpp:
3071         (JSC::CallLinkStatus::CallLinkStatus):
3072         (JSC::CallLinkStatus::function):
3073         (JSC::CallLinkStatus::internalFunction):
3074         * bytecode/CodeBlock.h:
3075         (JSC::baselineCodeBlockForInlineCallFrame):
3076         * bytecode/SpeculatedType.cpp:
3077         (JSC::speculationFromClassInfo):
3078         * bytecode/UnlinkedCodeBlock.cpp:
3079         (JSC::UnlinkedFunctionExecutable::visitChildren):
3080         (JSC::UnlinkedCodeBlock::visitChildren):
3081         (JSC::UnlinkedProgramCodeBlock::visitChildren):
3082         * bytecode/UnlinkedCodeBlock.h:
3083         (JSC::UnlinkedFunctionExecutable::createStructure):
3084         (JSC::UnlinkedProgramCodeBlock::createStructure):
3085         (JSC::UnlinkedEvalCodeBlock::createStructure):
3086         (JSC::UnlinkedFunctionCodeBlock::createStructure):
3087         * debugger/Debugger.cpp:
3088         * debugger/DebuggerActivation.cpp:
3089         (JSC::DebuggerActivation::visitChildren):
3090         * debugger/DebuggerActivation.h:
3091         (JSC::DebuggerActivation::createStructure):
3092         * debugger/DebuggerCallFrame.cpp:
3093         (JSC::DebuggerCallFrame::functionName):
3094         * dfg/DFGAbstractInterpreterInlines.h:
3095         (JSC::DFG::::executeEffects):
3096         * dfg/DFGByteCodeParser.cpp:
3097         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
3098         (JSC::DFG::ByteCodeParser::parseBlock):
3099         * dfg/DFGFixupPhase.cpp:
3100         (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
3101         (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
3102         * dfg/DFGGraph.cpp:
3103         (JSC::DFG::Graph::dump):
3104         * dfg/DFGGraph.h:
3105         (JSC::DFG::Graph::isInternalFunctionConstant):
3106         * dfg/DFGOperations.cpp:
3107         * dfg/DFGSpeculativeJIT.cpp:
3108         (JSC::DFG::SpeculativeJIT::checkArray):
3109         (JSC::DFG::SpeculativeJIT::compileNewStringObject):
3110         * dfg/DFGThunks.cpp:
3111         (JSC::DFG::virtualForThunkGenerator):
3112         * interpreter/Interpreter.cpp:
3113         (JSC::loadVarargs):
3114         * jsc.cpp:
3115         (GlobalObject::createStructure):
3116         * profiler/LegacyProfiler.cpp:
3117         (JSC::LegacyProfiler::createCallIdentifier):
3118         * runtime/Arguments.cpp:
3119         (JSC::Arguments::visitChildren):
3120         * runtime/Arguments.h:
3121         (JSC::Arguments::createStructure):
3122         (JSC::asArguments):
3123         (JSC::Arguments::finishCreation):
3124         * runtime/ArrayConstructor.cpp:
3125         (JSC::arrayConstructorIsArray):
3126         * runtime/ArrayConstructor.h:
3127         (JSC::ArrayConstructor::createStructure):
3128         * runtime/ArrayPrototype.cpp:
3129         (JSC::ArrayPrototype::finishCreation):
3130         (JSC::arrayProtoFuncConcat):
3131         (JSC::attemptFastSort):
3132         * runtime/ArrayPrototype.h:
3133         (JSC::ArrayPrototype::createStructure):
3134         * runtime/BooleanConstructor.h:
3135         (JSC::BooleanConstructor::createStructure):
3136         * runtime/BooleanObject.cpp:
3137         (JSC::BooleanObject::finishCreation):
3138         * runtime/BooleanObject.h:
3139         (JSC::BooleanObject::createStructure):
3140         (JSC::asBooleanObject):
3141         * runtime/BooleanPrototype.cpp:
3142         (JSC::BooleanPrototype::finishCreation):
3143         (JSC::booleanProtoFuncToString):
3144         (JSC::booleanProtoFuncValueOf):
3145         * runtime/BooleanPrototype.h:
3146         (JSC::BooleanPrototype::createStructure):
3147         * runtime/DateConstructor.cpp:
3148         (JSC::constructDate):
3149         * runtime/DateConstructor.h:
3150         (JSC::DateConstructor::createStructure):
3151         * runtime/DateInstance.cpp:
3152         (JSC::DateInstance::finishCreation):
3153         * runtime/DateInstance.h:
3154         (JSC::DateInstance::createStructure):
3155         (JSC::asDateInstance):
3156         * runtime/DatePrototype.cpp:
3157         (JSC::formateDateInstance):
3158         (JSC::DatePrototype::finishCreation):
3159         (JSC::dateProtoFuncToISOString):
3160         (JSC::dateProtoFuncToLocaleString):
3161         (JSC::dateProtoFuncToLocaleDateString):
3162         (JSC::dateProtoFuncToLocaleTimeString):
3163         (JSC::dateProtoFuncGetTime):
3164         (JSC::dateProtoFuncGetFullYear):
3165         (JSC::dateProtoFuncGetUTCFullYear):
3166         (JSC::dateProtoFuncGetMonth):
3167         (JSC::dateProtoFuncGetUTCMonth):
3168         (JSC::dateProtoFuncGetDate):
3169         (JSC::dateProtoFuncGetUTCDate):
3170         (JSC::dateProtoFuncGetDay):
3171         (JSC::dateProtoFuncGetUTCDay):
3172         (JSC::dateProtoFuncGetHours):
3173         (JSC::dateProtoFuncGetUTCHours):
3174         (JSC::dateProtoFuncGetMinutes):
3175         (JSC::dateProtoFuncGetUTCMinutes):
3176         (JSC::dateProtoFuncGetSeconds):
3177         (JSC::dateProtoFuncGetUTCSeconds):
3178         (JSC::dateProtoFuncGetMilliSeconds):
3179         (JSC::dateProtoFuncGetUTCMilliseconds):
3180         (JSC::dateProtoFuncGetTimezoneOffset):
3181         (JSC::dateProtoFuncSetTime):
3182         (JSC::setNewValueFromTimeArgs):
3183         (JSC::setNewValueFromDateArgs):
3184         (JSC::dateProtoFuncSetYear):
3185         (JSC::dateProtoFuncGetYear):
3186         * runtime/DatePrototype.h:
3187         (JSC::DatePrototype::createStructure):
3188         * runtime/Error.h:
3189         (JSC::StrictModeTypeErrorFunction::createStructure):
3190         * runtime/ErrorConstructor.h:
3191         (JSC::ErrorConstructor::createStructure):
3192         * runtime/ErrorInstance.cpp:
3193         (JSC::ErrorInstance::finishCreation):
3194         * runtime/ErrorInstance.h:
3195         (JSC::ErrorInstance::createStructure):
3196         * runtime/ErrorPrototype.cpp:
3197         (JSC::ErrorPrototype::finishCreation):
3198         * runtime/ErrorPrototype.h:
3199         (JSC::ErrorPrototype::createStructure):
3200         * runtime/ExceptionHelpers.cpp:
3201         (JSC::isTerminatedExecutionException):
3202         * runtime/ExceptionHelpers.h:
3203         (JSC::TerminatedExecutionError::createStructure):
3204         * runtime/Executable.cpp:
3205         (JSC::EvalExecutable::visitChildren):
3206         (JSC::ProgramExecutable::visitChildren):
3207         (JSC::FunctionExecutable::visitChildren):
3208         (JSC::ExecutableBase::hashFor):
3209         * runtime/Executable.h:
3210         (JSC::ExecutableBase::createStructure):
3211         (JSC::NativeExecutable::createStructure):
3212         (JSC::EvalExecutable::createStructure):
3213         (JSC::ProgramExecutable::createStructure):
3214         (JSC::FunctionExecutable::compileFor):
3215         (JSC::FunctionExecutable::compileOptimizedFor):
3216         (JSC::FunctionExecutable::createStructure):
3217         * runtime/FunctionConstructor.h:
3218         (JSC::FunctionConstructor::createStructure):
3219         * runtime/FunctionPrototype.cpp:
3220         (JSC::functionProtoFuncToString):
3221         (JSC::functionProtoFuncApply):
3222         (JSC::functionProtoFuncBind):
3223         * runtime/FunctionPrototype.h:
3224         (JSC::FunctionPrototype::createStructure):
3225         * runtime/GetterSetter.cpp:
3226         (JSC::GetterSetter::visitChildren):
3227         * runtime/GetterSetter.h:
3228         (JSC::GetterSetter::createStructure):
3229         * runtime/InternalFunction.cpp:
3230         (JSC::InternalFunction::finishCreation):
3231         * runtime/InternalFunction.h:
3232         (JSC::InternalFunction::createStructure):
3233         (JSC::asInternalFunction):
3234         * runtime/JSAPIValueWrapper.h:
3235         (JSC::JSAPIValueWrapper::createStructure):
3236         * runtime/JSActivation.cpp:
3237         (JSC::JSActivation::visitChildren):
3238         (JSC::JSActivation::argumentsGetter):
3239         * runtime/JSActivation.h:
3240         (JSC::JSActivation::createStructure):
3241         (JSC::asActivation):
3242         * runtime/JSArray.h:
3243         (JSC::JSArray::createStructure):
3244         (JSC::asArray):
3245         (JSC::isJSArray):
3246         * runtime/JSBoundFunction.cpp:
3247         (JSC::JSBoundFunction::finishCreation):
3248         (JSC::JSBoundFunction::visitChildren):
3249         * runtime/JSBoundFunction.h:
3250         (JSC::JSBoundFunction::createStructure):
3251         * runtime/JSCJSValue.cpp:
3252         (JSC::JSValue::dumpInContext):
3253         * runtime/JSCJSValueInlines.h:
3254         (JSC::JSValue::isFunction):
3255         * runtime/JSCell.h:
3256         (JSC::jsCast):
3257         (JSC::jsDynamicCast):
3258         * runtime/JSCellInlines.h:
3259         (JSC::allocateCell):
3260         * runtime/JSFunction.cpp:
3261         (JSC::JSFunction::finishCreation):
3262         (JSC::JSFunction::visitChildren):
3263         (JSC::skipOverBoundFunctions):
3264         (JSC::JSFunction::callerGetter):
3265         * runtime/JSFunction.h:
3266         (JSC::JSFunction::createStructure):
3267         * runtime/JSGlobalObject.cpp:
3268         (JSC::JSGlobalObject::visitChildren):
3269         (JSC::slowValidateCell):
3270         * runtime/JSGlobalObject.h:
3271         (JSC::JSGlobalObject::createStructure):
3272         * runtime/JSNameScope.cpp:
3273         (JSC::JSNameScope::visitChildren):
3274         * runtime/JSNameScope.h:
3275         (JSC::JSNameScope::createStructure):
3276         * runtime/JSNotAnObject.h:
3277         (JSC::JSNotAnObject::createStructure):
3278         * runtime/JSONObject.cpp:
3279         (JSC::JSONObject::finishCreation):
3280         (JSC::unwrapBoxedPrimitive):
3281         (JSC::Stringifier::Stringifier):
3282         (JSC::Stringifier::appendStringifiedValue):
3283         (JSC::Stringifier::Holder::Holder):
3284         (JSC::Walker::walk):
3285         (JSC::JSONProtoFuncStringify):
3286         * runtime/JSONObject.h:
3287         (JSC::JSONObject::createStructure):
3288         * runtime/JSObject.cpp:
3289         (JSC::getCallableObjectSlow):
3290         (JSC::JSObject::visitChildren):
3291         (JSC::JSObject::copyBackingStore):
3292         (JSC::JSFinalObject::visitChildren):
3293         (JSC::JSObject::ensureInt32Slow):
3294         (JSC::JSObject::ensureDoubleSlow):
3295         (JSC::JSObject::ensureContiguousSlow):
3296         (JSC::JSObject::ensureArrayStorageSlow):
3297         * runtime/JSObject.h:
3298         (JSC::JSObject::finishCreation):
3299         (JSC::JSObject::createStructure):
3300         (JSC::JSNonFinalObject::createStructure):
3301         (JSC::JSFinalObject::createStructure):
3302         (JSC::isJSFinalObject):
3303         * runtime/JSPropertyNameIterator.cpp:
3304         (JSC::JSPropertyNameIterator::visitChildren):
3305         * runtime/JSPropertyNameIterator.h:
3306         (JSC::JSPropertyNameIterator::createStructure):
3307         * runtime/JSProxy.cpp:
3308         (JSC::JSProxy::visitChildren):
3309         * runtime/JSProxy.h:
3310         (JSC::JSProxy::createStructure):
3311         * runtime/JSScope.cpp:
3312         (JSC::JSScope::visitChildren):
3313         * runtime/JSSegmentedVariableObject.cpp:
3314         (JSC::JSSegmentedVariableObject::visitChildren):
3315         * runtime/JSString.h:
3316         (JSC::JSString::createStructure):
3317         (JSC::isJSString):
3318         * runtime/JSSymbolTableObject.cpp:
3319         (JSC::JSSymbolTableObject::visitChildren):
3320         * runtime/JSVariableObject.h:
3321         * runtime/JSWithScope.cpp:
3322         (JSC::JSWithScope::visitChildren):
3323         * runtime/JSWithScope.h:
3324         (JSC::JSWithScope::createStructure):
3325         * runtime/JSWrapperObject.cpp:
3326         (JSC::JSWrapperObject::visitChildren):
3327         * runtime/JSWrapperObject.h:
3328         (JSC::JSWrapperObject::createStructure):
3329         * runtime/MathObject.cpp:
3330         (JSC::MathObject::finishCreation):
3331         * runtime/MathObject.h:
3332         (JSC::MathObject::createStructure):
3333         * runtime/NameConstructor.h:
3334         (JSC::NameConstructor::createStructure):
3335         * runtime/NameInstance.h:
3336         (JSC::NameInstance::createStructure):
3337         (JSC::NameInstance::finishCreation):
3338         * runtime/NamePrototype.cpp:
3339         (JSC::NamePrototype::finishCreation):
3340         (JSC::privateNameProtoFuncToString):
3341         * runtime/NamePrototype.h:
3342         (JSC::NamePrototype::createStructure):
3343         * runtime/NativeErrorConstructor.cpp:
3344         (JSC::NativeErrorConstructor::visitChildren):
3345         * runtime/NativeErrorConstructor.h:
3346         (JSC::NativeErrorConstructor::createStructure):
3347         (JSC::NativeErrorConstructor::finishCreation):
3348         * runtime/NumberConstructor.cpp:
3349         (JSC::NumberConstructor::finishCreation):
3350         * runtime/NumberConstructor.h:
3351         (JSC::NumberConstructor::createStructure):
3352         * runtime/NumberObject.cpp:
3353         (JSC::NumberObject::finishCreation):
3354         * runtime/NumberObject.h:
3355         (JSC::NumberObject::createStructure):
3356         * runtime/NumberPrototype.cpp:
3357         (JSC::NumberPrototype::finishCreation):
3358         * runtime/NumberPrototype.h:
3359         (JSC::NumberPrototype::createStructure):
3360         * runtime/ObjectConstructor.h:
3361         (JSC::ObjectConstructor::createStructure):
3362         * runtime/ObjectPrototype.cpp:
3363         (JSC::ObjectPrototype::finishCreation):
3364         * runtime/ObjectPrototype.h:
3365         (JSC::ObjectPrototype::createStructure):
3366         * runtime/PropertyMapHashTable.h:
3367         (JSC::PropertyTable::createStructure):
3368         * runtime/PropertyTable.cpp:
3369         (JSC::PropertyTable::visitChildren):
3370         * runtime/RegExp.h:
3371         (JSC::RegExp::createStructure):
3372         * runtime/RegExpConstructor.cpp:
3373         (JSC::RegExpConstructor::finishCreation):
3374         (JSC::RegExpConstructor::visitChildren):
3375         (JSC::constructRegExp):
3376         * runtime/RegExpConstructor.h:
3377         (JSC::RegExpConstructor::createStructure):
3378         (JSC::asRegExpConstructor):
3379         * runtime/RegExpMatchesArray.cpp: