Source/JavaScriptCore/ChangeLog

   1 2015-04-03  Geoffrey Garen  <ggaren@apple.com>
   2
   3         JavaScriptCore API should support type checking for Array and Date
   4         https://bugs.webkit.org/show_bug.cgi?id=143324
   5
   6         Follow-up to address a comment by Dan.
   7
   8         * API/WebKitAvailability.h: Do use 10.0 because it was right all along.
   9         Added a comment explaining why.
  10
  11 2015-04-03  Csaba Osztrogonác  <ossy@webkit.org>
  12
  13         FTL JIT tests should fail if LLVM library isn't available
  14         https://bugs.webkit.org/show_bug.cgi?id=143374
  15
  16         Reviewed by Mark Lam.
  17
  18         * dfg/DFGPlan.cpp:
  19         (JSC::DFG::Plan::compileInThreadImpl):
  20         * runtime/Options.h:
  21
  22 2015-04-03  Zan Dobersek  <zdobersek@igalia.com>
  23
  24         Fix the EFL and GTK build after r182243
  25         https://bugs.webkit.org/show_bug.cgi?id=143361
  26
  27         Reviewed by Csaba Osztrogonác.
  28
  29         * CMakeLists.txt: InspectorBackendCommands.js is generated in the
  30         DerivedSources/JavaScriptCore/inspector/ directory.
  31
  32 2015-04-03  Zan Dobersek  <zdobersek@igalia.com>
  33
  34         Unreviewed, fixing Clang builds of the GTK port on Linux.
  35
  36         * runtime/Options.cpp:
  37         Include the <math.h> header for isnan().
  38
  39 2015-04-02  Mark Lam  <mark.lam@apple.com>
  40
  41         Enhance ability to dump JSC Options.
  42         <https://webkit.org/b/143357>
  43
  44         Reviewed by Benjamin Poulain.
  45
  46         Some enhancements to how the JSC options work:
  47
  48         1. Add a JSC_showOptions option which take values: 0 = None, 1 = Overridden only,
  49            2 = All, 3 = Verbose.
  50
  51            The default is 0 (None).  This dumps nothing.
  52            With the Overridden setting, at VM initialization time, we will dump all
  53            option values that have been changed from their default.
  54            With the All setting, at VM initialization time, we will dump all option values.
  55            With the Verbose setting, at VM initialization time, we will dump all option
  56            values along with their descriptions (if available).
  57
  58         2. We now store a copy of the default option values.
  59
  60            We later use this for comparison to tell if an option has been overridden, and
  61            print the default value for reference.  As a result, we no longer need the
  62            didOverride flag since we can compute whether the option is overridden at any time.
  63
  64         3. Added description strings to some options to be printed when JSC_showOptions=3 (Verbose).
  65
  66            This will come in handy later when we want to rename some of the options to more sane
  67            names that are easier to remember.  For example, we can change
  68            Options::dfgFunctionWhitelistFile() to Options::dfgWhiteList(), and
  69            Options::slowPathAllocsBetweenGCs() to Options::forcedGcRate().  With the availability
  70            of the description, we can afford to use shorter and less descriptive option names,
  71            but they will be easier to remember and use for day to day debugging work.
  72
  73            In this patch, I did not change the names of any of the options yet.  I only added
  74            description strings for options that I know about, and where I think the option name
  75            isn't already descriptive enough.
  76
  77         4. Also deleted some unused code.
  78
  79         * jsc.cpp:
  80         (CommandLine::parseArguments):
  81         * runtime/Options.cpp:
  82         (JSC::Options::initialize):
  83         (JSC::Options::setOption):
  84         (JSC::Options::dumpAllOptions):
  85         (JSC::Options::dumpOption):
  86         (JSC::Options::Option::dump):
  87         (JSC::Options::Option::operator==):
  88         * runtime/Options.h:
  89         (JSC::OptionRange::rangeString):
  90         (JSC::Options::Option::Option):
  91         (JSC::Options::Option::operator!=):
  92
  93 2015-04-02  Geoffrey Garen  <ggaren@apple.com>
  94
  95         JavaScriptCore API should support type checking for Array and Date
  96         https://bugs.webkit.org/show_bug.cgi?id=143324
  97
  98         Reviewed by Darin Adler, Sam Weinig, Dan Bernstein.
  99
 100         * API/JSValue.h:
 101         * API/JSValue.mm:
 102         (-[JSValue isArray]):
 103         (-[JSValue isDate]): Added an ObjC API.
 104
 105         * API/JSValueRef.cpp:
 106         (JSValueIsArray):
 107         (JSValueIsDate):
 108         * API/JSValueRef.h: Added a C API.
 109
 110         * API/WebKitAvailability.h: Brought our availability macros up to date
 111         and fixed a harmless bug where "10_10" translated to "10.0".
 112
 113         * API/tests/testapi.c:
 114         (main): Added a test and corrected a pre-existing leak.
 115
 116         * API/tests/testapi.mm:
 117         (testObjectiveCAPI): Added a test.
 118
 119 2015-04-02  Mark Lam  <mark.lam@apple.com>
 120
 121         Add Options::dumpSourceAtDFGTime().
 122         <https://webkit.org/b/143349>
 123
 124         Reviewed by Oliver Hunt, and Michael Saboff.
 125
 126         Sometimes, we will want to see the JS source code that we're compiling, and it
 127         would be nice to be able to do this without having to jump thru a lot of hoops.
 128         So, let's add a Options::dumpSourceAtDFGTime() option just like we have a
 129         Options::dumpBytecodeAtDFGTime() option.
 130
 131         Also added versions of CodeBlock::dumpSource() and CodeBlock::dumpBytecode()
 132         that explicitly take no arguments (instead of relying on the version that takes
 133         the default argument).  These versions are friendlier to use when we want to call
 134         them from an interactive debugging session.
 135
 136         * bytecode/CodeBlock.cpp:
 137         (JSC::CodeBlock::dumpSource):
 138         (JSC::CodeBlock::dumpBytecode):
 139         * bytecode/CodeBlock.h:
 140         * dfg/DFGByteCodeParser.cpp:
 141         (JSC::DFG::ByteCodeParser::parseCodeBlock):
 142         * runtime/Options.h:
 143
 144 2015-04-02  Yusuke Suzuki  <utatane.tea@gmail.com>
 145
 146         Clean up EnumerationMode to easily extend
 147         https://bugs.webkit.org/show_bug.cgi?id=143276
 148
 149         Reviewed by Geoffrey Garen.
 150
 151         To make the followings easily,
 152         1. Adding new flag Include/ExcludeSymbols in the Object.getOwnPropertySymbols patch
 153         2. Make ExcludeSymbols implicitly default for the existing flags
 154         we encapsulate EnumerationMode flags into EnumerationMode class.
 155
 156         And this class manages 2 flags. Later it will be extended to 3.
 157         1. DontEnumPropertiesMode (default is Exclude)
 158         2. JSObjectPropertiesMode (default is Include)
 159         3. SymbolPropertiesMode (default is Exclude)
 160             SymbolPropertiesMode will be added in Object.getOwnPropertySymbols patch.
 161
 162         This patch replaces places using ExcludeDontEnumProperties
 163         to EnumerationMode() value which represents default mode.
 164
 165         * API/JSCallbackObjectFunctions.h:
 166         (JSC::JSCallbackObject<Parent>::getOwnNonIndexPropertyNames):
 167         * API/JSObjectRef.cpp:
 168         (JSObjectCopyPropertyNames):
 169         * bindings/ScriptValue.cpp:
 170         (Deprecated::jsToInspectorValue):
 171         * bytecode/ObjectAllocationProfile.h:
 172         (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount):
 173         * runtime/ArrayPrototype.cpp:
 174         (JSC::arrayProtoFuncSort):
 175         * runtime/EnumerationMode.h:
 176         (JSC::EnumerationMode::EnumerationMode):
 177         (JSC::EnumerationMode::includeDontEnumProperties):
 178         (JSC::EnumerationMode::includeJSObjectProperties):
 179         (JSC::shouldIncludeDontEnumProperties): Deleted.
 180         (JSC::shouldExcludeDontEnumProperties): Deleted.
 181         (JSC::shouldIncludeJSObjectPropertyNames): Deleted.
 182         (JSC::modeThatSkipsJSObject): Deleted.
 183         * runtime/GenericArgumentsInlines.h:
 184         (JSC::GenericArguments<Type>::getOwnPropertyNames):
 185         * runtime/JSArray.cpp:
 186         (JSC::JSArray::getOwnNonIndexPropertyNames):
 187         * runtime/JSArrayBuffer.cpp:
 188         (JSC::JSArrayBuffer::getOwnNonIndexPropertyNames):
 189         * runtime/JSArrayBufferView.cpp:
 190         (JSC::JSArrayBufferView::getOwnNonIndexPropertyNames):
 191         * runtime/JSFunction.cpp:
 192         (JSC::JSFunction::getOwnNonIndexPropertyNames):
 193         * runtime/JSFunction.h:
 194         * runtime/JSGenericTypedArrayViewInlines.h:
 195         (JSC::JSGenericTypedArrayView<Adaptor>::getOwnNonIndexPropertyNames):
 196         * runtime/JSLexicalEnvironment.cpp:
 197         (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
 198         * runtime/JSONObject.cpp:
 199         (JSC::Stringifier::Holder::appendNextProperty):
 200         (JSC::Walker::walk):
 201         * runtime/JSObject.cpp:
 202         (JSC::getClassPropertyNames):
 203         (JSC::JSObject::getOwnPropertyNames):
 204         (JSC::JSObject::getOwnNonIndexPropertyNames):
 205         (JSC::JSObject::getGenericPropertyNames):
 206         * runtime/JSPropertyNameEnumerator.h:
 207         (JSC::propertyNameEnumerator):
 208         * runtime/JSSymbolTableObject.cpp:
 209         (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
 210         * runtime/ObjectConstructor.cpp:
 211         (JSC::objectConstructorGetOwnPropertyNames):
 212         (JSC::objectConstructorKeys):
 213         (JSC::defineProperties):
 214         (JSC::objectConstructorSeal):
 215         (JSC::objectConstructorFreeze):
 216         (JSC::objectConstructorIsSealed):
 217         (JSC::objectConstructorIsFrozen):
 218         * runtime/RegExpObject.cpp:
 219         (JSC::RegExpObject::getOwnNonIndexPropertyNames):
 220         (JSC::RegExpObject::getPropertyNames):
 221         (JSC::RegExpObject::getGenericPropertyNames):
 222         * runtime/StringObject.cpp:
 223         (JSC::StringObject::getOwnPropertyNames):
 224         * runtime/Structure.cpp:
 225         (JSC::Structure::getPropertyNamesFromStructure):
 226
 227 2015-04-01  Alex Christensen  <achristensen@webkit.org>
 228
 229         Progress towards CMake on Windows and Mac.
 230         https://bugs.webkit.org/show_bug.cgi?id=143293
 231
 232         Reviewed by Filip Pizlo.
 233
 234         * CMakeLists.txt:
 235         Enabled using assembly on Windows.
 236         Replaced unix commands with CMake commands.
 237         * PlatformMac.cmake:
 238         Tell open source builders where to find unicode headers.
 239
 240 2015-04-01  Yusuke Suzuki  <utatane.tea@gmail.com>
 241
 242         IteratorClose should be called when jumping over the target for-of loop
 243         https://bugs.webkit.org/show_bug.cgi?id=143140
 244
 245         Reviewed by Geoffrey Garen.
 246
 247         This patch fixes labeled break/continue behaviors with for-of and iterators.
 248
 249         1. Support IteratorClose beyond multiple loop contexts
 250         Previously, IteratorClose is only executed in for-of's breakTarget().
 251         However, this misses IteratorClose execution when statement roll-ups multiple control flow contexts.
 252         For example,
 253         outer: for (var e1 of outer) {
 254             inner: for (var e2 of inner) {
 255                 break outer;
 256             }
 257         }
 258         In this case, return method of inner should be called.
 259         We leverage the existing system for `finally` to execute inner.return method correctly.
 260         Leveraging `finally` system fixes `break`, `continue` and `return` cases.
 261         `throw` case is already supported by emitting try-catch handlers in for-of.
 262
 263         2. Incorrect LabelScope creation is done in ForOfNode
 264         ForOfNode creates duplicated LabelScope.
 265         It causes infinite loop when executing the following program that contains
 266         explicitly labeled for-of loop.
 267         For example,
 268         inner: for (var elm of array) {
 269             continue inner;
 270         }
 271
 272         * bytecompiler/BytecodeGenerator.cpp:
 273         (JSC::BytecodeGenerator::pushFinallyContext):
 274         (JSC::BytecodeGenerator::pushIteratorCloseContext):
 275         (JSC::BytecodeGenerator::popFinallyContext):
 276         (JSC::BytecodeGenerator::popIteratorCloseContext):
 277         (JSC::BytecodeGenerator::emitComplexPopScopes):
 278         (JSC::BytecodeGenerator::emitEnumeration):
 279         (JSC::BytecodeGenerator::emitIteratorClose):
 280         * bytecompiler/BytecodeGenerator.h:
 281         * bytecompiler/NodesCodegen.cpp:
 282         (JSC::ForOfNode::emitBytecode):
 283         * tests/stress/iterator-return-beyond-multiple-iteration-scopes.js: Added.
 284         (createIterator.iterator.return):
 285         (createIterator):
 286         * tests/stress/raise-error-in-iterator-close.js: Added.
 287         (createIterator.iterator.return):
 288         (createIterator):
 289
 290 2015-04-01  Yusuke Suzuki  <utatane.tea@gmail.com>
 291
 292         [ES6] Implement Symbol.unscopables
 293         https://bugs.webkit.org/show_bug.cgi?id=142829
 294
 295         Reviewed by Geoffrey Garen.
 296
 297         This patch introduces Symbol.unscopables functionality.
 298         In ES6, some generic names (like keys, values) are introduced
 299         as Array's method name. And this breaks the web since some web sites
 300         use like the following code.
 301
 302         var values = ...;
 303         with (array) {
 304             values;  // This values is trapped by array's method "values".
 305         }
 306
 307         To fix this, Symbol.unscopables introduces blacklist
 308         for with scope's trapping. When resolving scope,
 309         if name is found in the target scope and the target scope is with scope,
 310         we check Symbol.unscopables object to filter generic names.
 311
 312         This functionality is only active for with scopes.
 313         Global scope does not have unscopables functionality.
 314
 315         And since
 316         1) op_resolve_scope for with scope always return Dynamic resolve type,
 317         2) in that case, JSScope::resolve is always used in JIT and LLInt,
 318         3) the code which contains op_resolve_scope that returns Dynamic cannot be compiled with DFG and FTL,
 319         to implement this functionality, we just change JSScope::resolve and no need to change JIT code.
 320         So performance regression is only visible in Dynamic resolving case, and it is already much slow.
 321
 322         * runtime/ArrayPrototype.cpp:
 323         (JSC::ArrayPrototype::finishCreation):
 324         * runtime/CommonIdentifiers.h:
 325         * runtime/JSGlobalObject.h:
 326         (JSC::JSGlobalObject::runtimeFlags):
 327         * runtime/JSScope.cpp:
 328         (JSC::isUnscopable):
 329         (JSC::JSScope::resolve):
 330         * runtime/JSScope.h:
 331         (JSC::ScopeChainIterator::scope):
 332         * tests/stress/global-environment-does-not-trap-unscopables.js: Added.
 333         (test):
 334         * tests/stress/unscopables.js: Added.
 335         (test):
 336         (.):
 337
 338 2015-03-31  Ryosuke Niwa  <rniwa@webkit.org>
 339
 340         ES6 class syntax should allow static setters and getters
 341         https://bugs.webkit.org/show_bug.cgi?id=143180
 342
 343         Reviewed by Filip Pizlo
 344
 345         Apparently I misread the spec when I initially implemented parseClass.
 346         ES6 class syntax allows static getters and setters so just allow that.
 347
 348         * parser/Parser.cpp:
 349         (JSC::Parser<LexerType>::parseClass):
 350
 351 2015-03-31  Filip Pizlo  <fpizlo@apple.com>
 352
 353         PutClosureVar CSE def() rule has a wrong base
 354         https://bugs.webkit.org/show_bug.cgi?id=143280
 355
 356         Reviewed by Michael Saboff.
 357
 358         I think that this code was incorrect in a benign way, since the base of a
 359         PutClosureVar is not a JS-visible object. But it was preventing some optimizations.
 360
 361         * dfg/DFGClobberize.h:
 362         (JSC::DFG::clobberize):
 363
 364 2015-03-31  Commit Queue  <commit-queue@webkit.org>
 365
 366         Unreviewed, rolling out r182200.
 367         https://bugs.webkit.org/show_bug.cgi?id=143279
 368
 369         Probably causing assertion extravaganza on bots. (Requested by
 370         kling on #webkit).
 371
 372         Reverted changeset:
 373
 374         "Logically empty WeakBlocks should not pin down their
 375         MarkedBlocks indefinitely."
 376         https://bugs.webkit.org/show_bug.cgi?id=143210
 377         http://trac.webkit.org/changeset/182200
 378
 379 2015-03-31  Yusuke Suzuki  <utatane.tea@gmail.com>
 380
 381         Clean up Identifier factories to clarify the meaning of StringImpl*
 382         https://bugs.webkit.org/show_bug.cgi?id=143146
 383
 384         Reviewed by Filip Pizlo.
 385
 386         In the a lot of places, `Identifier(VM*/ExecState*, StringImpl*)` constructor is used.
 387         However, it's ambiguous because `StringImpl*` has 2 different meanings.
 388         1) normal string, it is replacable with `WTFString` and
 389         2) `uid`, which holds `isSymbol` information to represent Symbols.
 390         So we dropped Identifier constructors for strings and instead, introduced 2 factory functions.
 391         + `Identifier::fromString(VM*/ExecState*, const String&)`.
 392         Just construct Identifier from strings. The symbol-ness of StringImpl* is not kept.
 393         + `Identifier::fromUid(VM*/ExecState*, StringImpl*)`.
 394         This function is used for 2) `uid`. So symbol-ness of `StringImpl*` is kept.
 395
 396         And to clean up `StringImpl` which is used as uid,
 397         we introduce `StringKind` into `StringImpl`. There's 3 kinds
 398         1. StringNormal (non-atomic, non-symbol)
 399         2. StringAtomic (atomic, non-symbol)
 400         3. StringSymbol (non-atomic, symbol)
 401         They are mutually exclusive. And (atomic, symbol) case should not exist.
 402
 403         * API/JSCallbackObjectFunctions.h:
 404         (JSC::JSCallbackObject<Parent>::getOwnNonIndexPropertyNames):
 405         * API/JSObjectRef.cpp:
 406         (JSObjectMakeFunction):
 407         * API/OpaqueJSString.cpp:
 408         (OpaqueJSString::identifier):
 409         * bindings/ScriptFunctionCall.cpp:
 410         (Deprecated::ScriptFunctionCall::call):
 411         * builtins/BuiltinExecutables.cpp:
 412         (JSC::BuiltinExecutables::createExecutableInternal):
 413         * builtins/BuiltinNames.h:
 414         (JSC::BuiltinNames::BuiltinNames):
 415         * bytecompiler/BytecodeGenerator.cpp:
 416         (JSC::BytecodeGenerator::BytecodeGenerator):
 417         (JSC::BytecodeGenerator::emitThrowReferenceError):
 418         (JSC::BytecodeGenerator::emitThrowTypeError):
 419         (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
 420         (JSC::BytecodeGenerator::emitEnumeration):
 421         * dfg/DFGDesiredIdentifiers.cpp:
 422         (JSC::DFG::DesiredIdentifiers::reallyAdd):
 423         * inspector/JSInjectedScriptHost.cpp:
 424         (Inspector::JSInjectedScriptHost::functionDetails):
 425         (Inspector::constructInternalProperty):
 426         (Inspector::JSInjectedScriptHost::weakMapEntries):
 427         (Inspector::JSInjectedScriptHost::iteratorEntries):
 428         * inspector/JSInjectedScriptHostPrototype.cpp:
 429         (Inspector::JSInjectedScriptHostPrototype::finishCreation):
 430         * inspector/JSJavaScriptCallFramePrototype.cpp:
 431         * inspector/ScriptCallStackFactory.cpp:
 432         (Inspector::extractSourceInformationFromException):
 433         * jit/JITOperations.cpp:
 434         * jsc.cpp:
 435         (GlobalObject::finishCreation):
 436         (GlobalObject::addFunction):
 437         (GlobalObject::addConstructableFunction):
 438         (functionRun):
 439         (runWithScripts):
 440         * llint/LLIntData.cpp:
 441         (JSC::LLInt::Data::performAssertions):
 442         * llint/LowLevelInterpreter.asm:
 443         * parser/ASTBuilder.h:
 444         (JSC::ASTBuilder::addVar):
 445         * parser/Parser.cpp:
 446         (JSC::Parser<LexerType>::parseInner):
 447         (JSC::Parser<LexerType>::createBindingPattern):
 448         * parser/ParserArena.h:
 449         (JSC::IdentifierArena::makeIdentifier):
 450         (JSC::IdentifierArena::makeIdentifierLCharFromUChar):
 451         (JSC::IdentifierArena::makeNumericIdentifier):
 452         * runtime/ArgumentsIteratorPrototype.cpp:
 453         (JSC::ArgumentsIteratorPrototype::finishCreation):
 454         * runtime/ArrayIteratorPrototype.cpp:
 455         (JSC::ArrayIteratorPrototype::finishCreation):
 456         * runtime/ArrayPrototype.cpp:
 457         (JSC::ArrayPrototype::finishCreation):
 458         (JSC::arrayProtoFuncPush):
 459         * runtime/ClonedArguments.cpp:
 460         (JSC::ClonedArguments::getOwnPropertySlot):
 461         * runtime/CommonIdentifiers.cpp:
 462         (JSC::CommonIdentifiers::CommonIdentifiers):
 463         * runtime/CommonIdentifiers.h:
 464         * runtime/Error.cpp:
 465         (JSC::addErrorInfo):
 466         (JSC::hasErrorInfo):
 467         * runtime/ExceptionHelpers.cpp:
 468         (JSC::createUndefinedVariableError):
 469         * runtime/GenericArgumentsInlines.h:
 470         (JSC::GenericArguments<Type>::getOwnPropertySlot):
 471         * runtime/Identifier.h:
 472         (JSC::Identifier::isSymbol):
 473         (JSC::Identifier::Identifier):
 474         (JSC::Identifier::from): Deleted.
 475         * runtime/IdentifierInlines.h:
 476         (JSC::Identifier::Identifier):
 477         (JSC::Identifier::fromUid):
 478         (JSC::Identifier::fromString):
 479         * runtime/JSCJSValue.cpp:
 480         (JSC::JSValue::dumpInContextAssumingStructure):
 481         * runtime/JSCJSValueInlines.h:
 482         (JSC::JSValue::toPropertyKey):
 483         * runtime/JSGlobalObject.cpp:
 484         (JSC::JSGlobalObject::init):
 485         * runtime/JSLexicalEnvironment.cpp:
 486         (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
 487         * runtime/JSObject.cpp:
 488         (JSC::getClassPropertyNames):
 489         (JSC::JSObject::reifyStaticFunctionsForDelete):
 490         * runtime/JSObject.h:
 491         (JSC::makeIdentifier):
 492         * runtime/JSPromiseConstructor.cpp:
 493         (JSC::JSPromiseConstructorFuncRace):
 494         (JSC::JSPromiseConstructorFuncAll):
 495         * runtime/JSString.h:
 496         (JSC::JSString::toIdentifier):
 497         * runtime/JSSymbolTableObject.cpp:
 498         (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
 499         * runtime/LiteralParser.cpp:
 500         (JSC::LiteralParser<CharType>::tryJSONPParse):
 501         (JSC::LiteralParser<CharType>::makeIdentifier):
 502         * runtime/Lookup.h:
 503         (JSC::reifyStaticProperties):
 504         * runtime/MapConstructor.cpp:
 505         (JSC::constructMap):
 506         * runtime/MapIteratorPrototype.cpp:
 507         (JSC::MapIteratorPrototype::finishCreation):
 508         * runtime/MapPrototype.cpp:
 509         (JSC::MapPrototype::finishCreation):
 510         * runtime/MathObject.cpp:
 511         (JSC::MathObject::finishCreation):
 512         * runtime/NumberConstructor.cpp:
 513         (JSC::NumberConstructor::finishCreation):
 514         * runtime/ObjectConstructor.cpp:
 515         (JSC::ObjectConstructor::finishCreation):
 516         * runtime/PrivateName.h:
 517         (JSC::PrivateName::PrivateName):
 518         * runtime/PropertyMapHashTable.h:
 519         (JSC::PropertyTable::find):
 520         (JSC::PropertyTable::get):
 521         * runtime/PropertyName.h:
 522         (JSC::PropertyName::PropertyName):
 523         (JSC::PropertyName::publicName):
 524         (JSC::PropertyName::asIndex):
 525         * runtime/PropertyNameArray.cpp:
 526         (JSC::PropertyNameArray::add):
 527         * runtime/PropertyNameArray.h:
 528         (JSC::PropertyNameArray::addKnownUnique):
 529         * runtime/RegExpConstructor.cpp:
 530         (JSC::RegExpConstructor::finishCreation):
 531         * runtime/SetConstructor.cpp:
 532         (JSC::constructSet):
 533         * runtime/SetIteratorPrototype.cpp:
 534         (JSC::SetIteratorPrototype::finishCreation):
 535         * runtime/SetPrototype.cpp:
 536         (JSC::SetPrototype::finishCreation):
 537         * runtime/StringIteratorPrototype.cpp:
 538         (JSC::StringIteratorPrototype::finishCreation):
 539         * runtime/StringPrototype.cpp:
 540         (JSC::StringPrototype::finishCreation):
 541         * runtime/Structure.cpp:
 542         (JSC::Structure::getPropertyNamesFromStructure):
 543         * runtime/SymbolConstructor.cpp:
 544         * runtime/VM.cpp:
 545         (JSC::VM::throwException):
 546         * runtime/WeakMapConstructor.cpp:
 547         (JSC::constructWeakMap):
 548
 549 2015-03-31  Andreas Kling  <akling@apple.com>
 550
 551         Logically empty WeakBlocks should not pin down their MarkedBlocks indefinitely.
 552         <https://webkit.org/b/143210>
 553
 554         Reviewed by Geoffrey Garen.
 555
 556         Since a MarkedBlock cannot be destroyed until all the WeakBlocks pointing into it are gone,
 557         we had a little problem where WeakBlocks with only null pointers would still keep their
 558         MarkedBlock alive.
 559
 560         This patch fixes that by detaching WeakBlocks from their MarkedBlock once a sweep discovers
 561         that the WeakBlock contains no pointers to live objects. Ownership of the WeakBlock is passed
 562         to the Heap, which will sweep the list of these detached WeakBlocks as part of a full GC,
 563         destroying them once they're fully dead.
 564
 565         This allows the garbage collector to reclaim the 64kB MarkedBlocks much sooner, and resolves
 566         a mysterious issue where doing two full garbage collections back-to-back would free additional
 567         memory in the second collection.
 568
 569         Management of detached WeakBlocks is implemented as a Vector<WeakBlock*> in Heap, along with
 570         an index of the next block in that vector that needs to be swept. The IncrementalSweeper then
 571         calls into Heap::sweepNextLogicallyEmptyWeakBlock() to sweep one block at a time.
 572
 573         * heap/Heap.h:
 574         * heap/Heap.cpp:
 575         (JSC::Heap::collectAllGarbage): Add a final pass where we sweep the logically empty WeakBlocks
 576         owned by Heap, after everything else has been swept.
 577
 578         (JSC::Heap::notifyIncrementalSweeper): Set up an incremental sweep of logically empty WeakBlocks
 579         after a full garbage collection ends. Note that we don't do this after Eden collections, since
 580         they are unlikely to cause entire WeakBlocks to go empty.
 581
 582         (JSC::Heap::addLogicallyEmptyWeakBlock): Added. Interface for passing ownership of a WeakBlock
 583         to the Heap when it's detached from a WeakSet.
 584
 585         (JSC::Heap::sweepAllLogicallyEmptyWeakBlocks): Helper for collectAllGarbage() that sweeps all
 586         of the logically empty WeakBlocks owned by Heap.
 587
 588         (JSC::Heap::sweepNextLogicallyEmptyWeakBlock): Sweeps one logically empty WeakBlock if needed
 589         and updates the next-logically-empty-weak-block-to-sweep index.
 590
 591         (JSC::Heap::lastChanceToFinalize): call sweepAllLogicallyEmptyWeakBlocks() here, since there
 592         won't be another chance after this.
 593
 594         * heap/IncrementalSweeper.h:
 595         (JSC::IncrementalSweeper::hasWork): Deleted.
 596
 597         * heap/IncrementalSweeper.cpp:
 598         (JSC::IncrementalSweeper::fullSweep):
 599         (JSC::IncrementalSweeper::doSweep):
 600         (JSC::IncrementalSweeper::sweepNextBlock): Restructured IncrementalSweeper a bit to simplify
 601         adding a new sweeping stage for the Heap's logically empty WeakBlocks. sweepNextBlock() is
 602         changed to return a bool (true if there's more work to be done.)
 603
 604         * heap/WeakBlock.cpp:
 605         (JSC::WeakBlock::sweep): This now figures out if the WeakBlock is logically empty, i.e doesn't
 606         contain any pointers to live objects. The answer is stored in a new SweepResult member.
 607
 608         * heap/WeakBlock.h:
 609         (JSC::WeakBlock::isLogicallyEmptyButNotFree): Added. Can be queried after a sweep to determine
 610         if the WeakBlock could be detached from the MarkedBlock.
 611
 612         (JSC::WeakBlock::SweepResult::SweepResult): Deleted in favor of initializing member variables
 613         when declaring them.
 614
 615 2015-03-31  Ryosuke Niwa  <rniwa@webkit.org>
 616
 617         eval("this.foo") causes a crash if this had not been initialized in a derived class's constructor
 618         https://bugs.webkit.org/show_bug.cgi?id=142883
 619
 620         Reviewed by Filip Pizlo.
 621
 622         The crash was caused by eval inside the constructor of a derived class not checking TDZ.
 623
 624         Fixed the bug by adding a parser flag that forces the TDZ check to be always emitted when accessing "this"
 625         in eval inside a derived class' constructor.
 626
 627         * bytecode/EvalCodeCache.h:
 628         (JSC::EvalCodeCache::getSlow):
 629         * bytecompiler/NodesCodegen.cpp:
 630         (JSC::ThisNode::emitBytecode):
 631         * debugger/DebuggerCallFrame.cpp:
 632         (JSC::DebuggerCallFrame::evaluate):
 633         * interpreter/Interpreter.cpp:
 634         (JSC::eval):
 635         * parser/ASTBuilder.h:
 636         (JSC::ASTBuilder::thisExpr):
 637         * parser/NodeConstructors.h:
 638         (JSC::ThisNode::ThisNode):
 639         * parser/Nodes.h:
 640         * parser/Parser.cpp:
 641         (JSC::Parser<LexerType>::Parser):
 642         (JSC::Parser<LexerType>::parsePrimaryExpression):
 643         * parser/Parser.h:
 644         (JSC::parse):
 645         * parser/ParserModes.h:
 646         * parser/SyntaxChecker.h:
 647         (JSC::SyntaxChecker::thisExpr):
 648         * runtime/CodeCache.cpp:
 649         (JSC::CodeCache::getGlobalCodeBlock):
 650         (JSC::CodeCache::getProgramCodeBlock):
 651         (JSC::CodeCache::getEvalCodeBlock):
 652         * runtime/CodeCache.h:
 653         (JSC::SourceCodeKey::SourceCodeKey):
 654         * runtime/Executable.cpp:
 655         (JSC::EvalExecutable::create):
 656         * runtime/Executable.h:
 657         * runtime/JSGlobalObject.cpp:
 658         (JSC::JSGlobalObject::createEvalCodeBlock):
 659         * runtime/JSGlobalObject.h:
 660         * runtime/JSGlobalObjectFunctions.cpp:
 661         (JSC::globalFuncEval):
 662         * tests/stress/class-syntax-no-tdz-in-eval.js: Added.
 663         * tests/stress/class-syntax-tdz-in-eval.js: Added.
 664
 665 2015-03-31  Commit Queue  <commit-queue@webkit.org>
 666
 667         Unreviewed, rolling out r182186.
 668         https://bugs.webkit.org/show_bug.cgi?id=143270
 669
 670         it crashes all the WebGL tests on the Debug bots (Requested by
 671         dino on #webkit).
 672
 673         Reverted changeset:
 674
 675         "Web Inspector: add 2D/WebGL canvas instrumentation
 676         infrastructure"
 677         https://bugs.webkit.org/show_bug.cgi?id=137278
 678         http://trac.webkit.org/changeset/182186
 679
 680 2015-03-31  Yusuke Suzuki  <utatane.tea@gmail.com>
 681
 682         [ES6] Object type restrictions on a first parameter of several Object.* functions are relaxed
 683         https://bugs.webkit.org/show_bug.cgi?id=142937
 684
 685         Reviewed by Darin Adler.
 686
 687         In ES6, Object type restrictions on a first parameter of several Object.* functions are relaxed.
 688         In ES5 or prior, when a first parameter is not object type, these functions raise TypeError.
 689         But now, several functions perform ToObject onto a non-object parameter.
 690         And others behaves as if a parameter is a non-extensible ordinary object with no own properties.
 691         It is described in ES6 Annex E.
 692         Functions different from ES5 are following.
 693
 694         1. An attempt is make to coerce the argument using ToObject.
 695             Object.getOwnPropertyDescriptor
 696             Object.getOwnPropertyNames
 697             Object.getPrototypeOf
 698             Object.keys
 699
 700         2. Treated as if it was a non-extensible ordinary object with no own properties.
 701             Object.freeze
 702             Object.isExtensible
 703             Object.isFrozen
 704             Object.isSealed
 705             Object.preventExtensions
 706             Object.seal
 707
 708         * runtime/ObjectConstructor.cpp:
 709         (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
 710         (JSC::objectConstructorGetPrototypeOf):
 711         (JSC::objectConstructorGetOwnPropertyDescriptor):
 712         (JSC::objectConstructorGetOwnPropertyNames):
 713         (JSC::objectConstructorKeys):
 714         (JSC::objectConstructorSeal):
 715         (JSC::objectConstructorFreeze):
 716         (JSC::objectConstructorPreventExtensions):
 717         (JSC::objectConstructorIsSealed):
 718         (JSC::objectConstructorIsFrozen):
 719         (JSC::objectConstructorIsExtensible):
 720         * tests/stress/object-freeze-accept-non-object.js: Added.
 721         * tests/stress/object-get-own-property-descriptor-perform-to-object.js: Added.
 722         (canary):
 723         * tests/stress/object-get-own-property-names-perform-to-object.js: Added.
 724         (compare):
 725         * tests/stress/object-get-prototype-of-perform-to-object.js: Added.
 726         * tests/stress/object-is-extensible-accept-non-object.js: Added.
 727         * tests/stress/object-is-frozen-accept-non-object.js: Added.
 728         * tests/stress/object-is-sealed-accept-non-object.js: Added.
 729         * tests/stress/object-keys-perform-to-object.js: Added.
 730         (compare):
 731         * tests/stress/object-prevent-extensions-accept-non-object.js: Added.
 732         * tests/stress/object-seal-accept-non-object.js: Added.
 733
 734 2015-03-31  Matt Baker  <mattbaker@apple.com>
 735
 736         Web Inspector: add 2D/WebGL canvas instrumentation infrastructure
 737         https://bugs.webkit.org/show_bug.cgi?id=137278
 738
 739         Reviewed by Timothy Hatcher.
 740
 741         Added Canvas protocol which defines types used by InspectorCanvasAgent.
 742
 743         * CMakeLists.txt:
 744         * DerivedSources.make:
 745         * inspector/protocol/Canvas.json: Added.
 746
 747         * inspector/scripts/codegen/generator.py:
 748         (Generator.stylized_name_for_enum_value):
 749         Added special handling for 2D (always uppercase) and WebGL (rename mapping) enum strings.
 750
 751 2015-03-30  Ryosuke Niwa  <rniwa@webkit.org>
 752
 753         Extending null should set __proto__ to null
 754         https://bugs.webkit.org/show_bug.cgi?id=142882
 755
 756         Reviewed by Geoffrey Garen and Benjamin Poulain.
 757
 758         Set Derived.prototype.__proto__ to null when extending null.
 759
 760         * bytecompiler/NodesCodegen.cpp:
 761         (JSC::ClassExprNode::emitBytecode):
 762
 763 2015-03-30  Mark Lam  <mark.lam@apple.com>
 764
 765         REGRESSION (r181993): inspector-protocol/debugger/setBreakpoint-dfg-and-modify-local.html crashes.
 766         <https://webkit.org/b/143105>
 767
 768         Reviewed by Filip Pizlo.
 769
 770         With r181993, the DFG and FTL may elide the storing of the scope register.  As a result,
 771         on OSR exits from DFG / FTL frames where this elision has take place, we may get baseline
 772         JIT frames that may have its scope register not set.  The Debugger's current implementation
 773         which relies on the scope register is not happy about this.  For example, this results in a
 774         crash in the layout test inspector-protocol/debugger/setBreakpoint-dfg-and-modify-local.html.
 775
 776         The fix is to disable inlining when the debugger is in use.  Also, we add Flush nodes to
 777         ensure that the scope register value is flushed to the register in the stack frame.
 778
 779         * dfg/DFGByteCodeParser.cpp:
 780         (JSC::DFG::ByteCodeParser::ByteCodeParser):
 781         (JSC::DFG::ByteCodeParser::setLocal):
 782         (JSC::DFG::ByteCodeParser::flush):
 783         - Add code to flush the scope register.
 784         (JSC::DFG::ByteCodeParser::inliningCost):
 785         - Pretend that all codeBlocks are too expensive to inline if the debugger is in use, thereby
 786           disabling inlining whenever the debugger is in use.
 787         * dfg/DFGGraph.cpp:
 788         (JSC::DFG::Graph::Graph):
 789         * dfg/DFGGraph.h:
 790         (JSC::DFG::Graph::hasDebuggerEnabled):
 791         * dfg/DFGStackLayoutPhase.cpp:
 792         (JSC::DFG::StackLayoutPhase::run):
 793         - Update the DFG codeBlock's scopeRegister since it can be moved during stack layout.
 794         * ftl/FTLCompile.cpp:
 795         (JSC::FTL::mmAllocateDataSection):
 796         - Update the FTL codeBlock's scopeRegister since it can be moved during stack layout.
 797
 798 2015-03-30  Michael Saboff  <msaboff@apple.com>
 799
 800         Fix flakey float32-repeat-out-of-bounds.js and int8-repeat-out-of-bounds.js tests for ARM64
 801         https://bugs.webkit.org/show_bug.cgi?id=138391
 802
 803         Reviewed by Mark Lam.
 804
 805         Re-enabling these tests as I can't get them to fail on local iOS test devices.
 806         There have been many changes since these tests were disabled.
 807         I'll watch automated test results for failures.  If there are failures running automated
 808         testing, it might be due to the device's relative CPU performance.
 809
 810         * tests/stress/float32-repeat-out-of-bounds.js:
 811         * tests/stress/int8-repeat-out-of-bounds.js:
 812
 813 2015-03-30  Joseph Pecoraro  <pecoraro@apple.com>
 814
 815         Web Inspector: Regression: Preview for [[null]] shouldn't be []
 816         https://bugs.webkit.org/show_bug.cgi?id=143208
 817
 818         Reviewed by Mark Lam.
 819
 820         * inspector/InjectedScriptSource.js:
 821         Handle null when generating simple object previews.
 822
 823 2015-03-30  Per Arne Vollan  <peavo@outlook.com>
 824
 825         Avoid using hardcoded values for JSValue::Int32Tag, if possible.
 826         https://bugs.webkit.org/show_bug.cgi?id=143134
 827
 828         Reviewed by Geoffrey Garen.
 829
 830         * jit/JSInterfaceJIT.h:
 831         * jit/Repatch.cpp:
 832         (JSC::tryCacheGetByID):
 833
 834 2015-03-30  Filip Pizlo  <fpizlo@apple.com>
 835
 836         REGRESSION: js/regress/inline-arguments-local-escape.html is flaky
 837         https://bugs.webkit.org/show_bug.cgi?id=143104
 838
 839         Reviewed by Geoffrey Garen.
 840
 841         Created a test that is a 100% repro of the flaky failure. This test is called
 842         get-my-argument-by-val-for-inlined-escaped-arguments.js. It fails all of the time because it
 843         always causes the compiler to emit a GetMyArgumentByVal of the arguments object returned by
 844         the inlined function. Other than that, it's the same as inline-arguments-local-escape.
 845
 846         Also created three more tests for three similar, but not identical, failures.
 847
 848         Then fixed the bug: PreciseLocalClobberize was assuming that if we read(Stack) then we are
 849         only reading those parts of the stack that are relevant to the current semantic code origin.
 850         That's false after ArgumentsEliminationPhase - we might have operations on phantom arguments,
 851         like GetMyArgumentByVal, ForwardVarargs, CallForwardVarargs, and ConstructForwardVarargs, that
 852         read parts of the stack associated with the inline call frame for the phantom arguments. This
 853         may not be subsumed by the current semantic origin's stack area in cases that the arguments
 854         were allowed to "locally" escape.
 855
 856         The higher-order lesson here is that in DFG SSA IR, the current semantic origin's stack area
 857         is not really a meaningful concept anymore. It is only meaningful for nodes that will read
 858         the stack due to function.arguments, but there are a bunch of other ways that we could also
 859         read the stack and those operations may read any stack slot. I believe that this change makes
 860         PreciseLocalClobberize right: it will refine a read(Stack) from Clobberize correctly by casing
 861         on node type. In future, if we add a read(Stack) to Clobberize, we'll have to make sure that
 862         readTop() in PreciseLocalClobberize does the right thing.
 863
 864         * dfg/DFGClobberize.h:
 865         (JSC::DFG::clobberize):
 866         * dfg/DFGPreciseLocalClobberize.h:
 867         (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
 868         * dfg/DFGPutStackSinkingPhase.cpp:
 869         * tests/stress/call-forward-varargs-for-inlined-escaped-arguments.js: Added.
 870         * tests/stress/construct-forward-varargs-for-inlined-escaped-arguments.js: Added.
 871         * tests/stress/forward-varargs-for-inlined-escaped-arguments.js: Added.
 872         * tests/stress/get-my-argument-by-val-for-inlined-escaped-arguments.js: Added.
 873         * tests/stress/real-forward-varargs-for-inlined-escaped-arguments.js: Added.
 874
 875 2015-03-30  Benjamin Poulain  <benjamin@webkit.org>
 876
 877         Start the features.json files
 878         https://bugs.webkit.org/show_bug.cgi?id=143207
 879
 880         Reviewed by Darin Adler.
 881
 882         Start the features.json files to have something to experiment
 883         with for the UI.
 884
 885         * features.json: Added.
 886
 887 2015-03-29  Myles C. Maxfield  <mmaxfield@apple.com>
 888
 889         [Win] Addresing post-review comment after r182122
 890         https://bugs.webkit.org/show_bug.cgi?id=143189
 891
 892         Unreviewed.
 893
 894 2015-03-29  Myles C. Maxfield  <mmaxfield@apple.com>
 895
 896         [Win] Allow building JavaScriptCore without Cygwin
 897         https://bugs.webkit.org/show_bug.cgi?id=143189
 898
 899         Reviewed by Brent Fulgham.
 900
 901         Paths like /usr/bin/ don't exist on Windows.
 902         Hashbangs don't work on Windows. Instead we must explicitly call the executable.
 903         Prefixing commands with environment variables doesn't work on Windows.
 904         Windows doesn't have 'cmp'
 905         Windows uses 'del' instead of 'rm'
 906         Windows uses 'type NUL' intead of 'touch'
 907
 908         * DerivedSources.make:
 909         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
 910         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
 911         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.pl:
 912         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
 913         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.pl:
 914         * JavaScriptCore.vcxproj/build-generated-files.pl:
 915         * UpdateContents.py: Copied from Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.pl.
 916
 917 2015-03-28  Joseph Pecoraro  <pecoraro@apple.com>
 918
 919         Clean up JavaScriptCore/builtins
 920         https://bugs.webkit.org/show_bug.cgi?id=143177
 921
 922         Reviewed by Ryosuke Niwa.
 923
 924         * builtins/ArrayConstructor.js:
 925         (from):
 926         - We can compare to undefined instead of using a typeof undefined check.
 927         - Converge on double quoted strings everywhere.
 928
 929         * builtins/ArrayIterator.prototype.js:
 930         (next):
 931         * builtins/StringIterator.prototype.js:
 932         (next):
 933         - Use shorthand object construction to avoid duplication.
 934         - Improve grammar in error messages.
 935
 936         * tests/stress/array-iterators-next-with-call.js:
 937         * tests/stress/string-iterators.js:
 938         - Update for new error message strings.
 939
 940 2015-03-28  Saam Barati  <saambarati1@gmail.com>
 941
 942         Web Inspector: ES6: Better support for Symbol types in Type Profiler
 943         https://bugs.webkit.org/show_bug.cgi?id=141257
 944
 945         Reviewed by Joseph Pecoraro.
 946
 947         ES6 introduces the new primitive type Symbol. This patch makes JSC's
 948         type profiler support this new primitive type.
 949
 950         * dfg/DFGFixupPhase.cpp:
 951         (JSC::DFG::FixupPhase::fixupNode):
 952         * inspector/protocol/Runtime.json:
 953         * runtime/RuntimeType.cpp:
 954         (JSC::runtimeTypeForValue):
 955         * runtime/RuntimeType.h:
 956         (JSC::runtimeTypeIsPrimitive):
 957         * runtime/TypeSet.cpp:
 958         (JSC::TypeSet::addTypeInformation):
 959         (JSC::TypeSet::dumpTypes):
 960         (JSC::TypeSet::doesTypeConformTo):
 961         (JSC::TypeSet::displayName):
 962         (JSC::TypeSet::inspectorTypeSet):
 963         (JSC::TypeSet::toJSONString):
 964         * runtime/TypeSet.h:
 965         (JSC::TypeSet::seenTypes):
 966         * tests/typeProfiler/driver/driver.js:
 967         * tests/typeProfiler/symbol.js: Added.
 968         (wrapper.foo):
 969         (wrapper.bar):
 970         (wrapper.bar.bar.baz):
 971         (wrapper):
 972
 973 2015-03-27  Saam Barati  <saambarati1@gmail.com>
 974
 975         Deconstruction parameters are bound too late
 976         https://bugs.webkit.org/show_bug.cgi?id=143148
 977
 978         Reviewed by Filip Pizlo.
 979
 980         Currently, a deconstruction pattern named with the same
 981         name as a function will shadow the function. This is
 982         wrong. It should be the other way around.
 983
 984         * bytecompiler/BytecodeGenerator.cpp:
 985         (JSC::BytecodeGenerator::generate):
 986
 987 2015-03-27  Ryosuke Niwa  <rniwa@webkit.org>
 988
 989         parse doesn't initialize the 16-bit version of the JSC parser with defaultConstructorKind
 990         https://bugs.webkit.org/show_bug.cgi?id=143170
 991
 992         Reviewed by Benjamin Poulain.
 993
 994         Assert that we never use 16-bit version of the parser to parse a default constructor
 995         since both base and derived default constructors should be using a 8-bit string.
 996
 997         * parser/Parser.h:
 998         (JSC::parse):
 999
1000 2015-03-27  Ryosuke Niwa  <rniwa@webkit.org>
1001
1002         ES6 Classes: Runtime error in JIT'd class calling super() with arguments and superclass has default constructor
1003         https://bugs.webkit.org/show_bug.cgi?id=142862
1004
1005         Reviewed by Benjamin Poulain.
1006
1007         Add a test that used to fail in DFG now that the bug has been fixed by r181993.
1008
1009         * tests/stress/class-syntax-derived-default-constructor.js: Added.
1010
1011 2015-03-27  Michael Saboff  <msaboff@apple.com>
1012
1013         load8Signed() and load16Signed() should be renamed to avoid confusion
1014         https://bugs.webkit.org/show_bug.cgi?id=143168
1015
1016         Reviewed by Benjamin Poulain.
1017
1018         Renamed load8Signed() to load8SignedExtendTo32() and load16Signed() to load16SignedExtendTo32().
1019
1020         * assembler/MacroAssemblerARM.h:
1021         (JSC::MacroAssemblerARM::load8SignedExtendTo32):
1022         (JSC::MacroAssemblerARM::load16SignedExtendTo32):
1023         (JSC::MacroAssemblerARM::load8Signed): Deleted.
1024         (JSC::MacroAssemblerARM::load16Signed): Deleted.
1025         * assembler/MacroAssemblerARM64.h:
1026         (JSC::MacroAssemblerARM64::load16SignedExtendTo32):
1027         (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
1028         (JSC::MacroAssemblerARM64::load16Signed): Deleted.
1029         (JSC::MacroAssemblerARM64::load8Signed): Deleted.
1030         * assembler/MacroAssemblerARMv7.h:
1031         (JSC::MacroAssemblerARMv7::load16SignedExtendTo32):
1032         (JSC::MacroAssemblerARMv7::load8SignedExtendTo32):
1033         (JSC::MacroAssemblerARMv7::load16Signed): Deleted.
1034         (JSC::MacroAssemblerARMv7::load8Signed): Deleted.
1035         * assembler/MacroAssemblerMIPS.h:
1036         (JSC::MacroAssemblerMIPS::load8SignedExtendTo32):
1037         (JSC::MacroAssemblerMIPS::load16SignedExtendTo32):
1038         (JSC::MacroAssemblerMIPS::load8Signed): Deleted.
1039         (JSC::MacroAssemblerMIPS::load16Signed): Deleted.
1040         * assembler/MacroAssemblerSH4.h:
1041         (JSC::MacroAssemblerSH4::load8SignedExtendTo32):
1042         (JSC::MacroAssemblerSH4::load8):
1043         (JSC::MacroAssemblerSH4::load16SignedExtendTo32):
1044         (JSC::MacroAssemblerSH4::load16):
1045         (JSC::MacroAssemblerSH4::load8Signed): Deleted.
1046         (JSC::MacroAssemblerSH4::load16Signed): Deleted.
1047         * assembler/MacroAssemblerX86Common.h:
1048         (JSC::MacroAssemblerX86Common::load8SignedExtendTo32):
1049         (JSC::MacroAssemblerX86Common::load16SignedExtendTo32):
1050         (JSC::MacroAssemblerX86Common::load8Signed): Deleted.
1051         (JSC::MacroAssemblerX86Common::load16Signed): Deleted.
1052         * dfg/DFGSpeculativeJIT.cpp:
1053         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
1054         * jit/JITPropertyAccess.cpp:
1055         (JSC::JIT::emitIntTypedArrayGetByVal):
1056
1057 2015-03-27  Michael Saboff  <msaboff@apple.com>
1058
1059         Fix flakey dfg-int8array.js and dfg-int16array.js tests for ARM64
1060         https://bugs.webkit.org/show_bug.cgi?id=138390
1061
1062         Reviewed by Mark Lam.
1063
1064         Changed load8Signed() and load16Signed() to only sign extend the loaded value to 32 bits
1065         instead of 64 bits.  This is what X86-64 does.
1066
1067         * assembler/MacroAssemblerARM64.h:
1068         (JSC::MacroAssemblerARM64::load16Signed):
1069         (JSC::MacroAssemblerARM64::load8Signed):
1070
1071 2015-03-27  Saam Barati  <saambarati1@gmail.com>
1072
1073         Add back previously broken assert from bug 141869
1074         https://bugs.webkit.org/show_bug.cgi?id=143005
1075
1076         Reviewed by Michael Saboff.
1077
1078         * runtime/ExceptionHelpers.cpp:
1079         (JSC::invalidParameterInSourceAppender):
1080
1081 2015-03-26  Geoffrey Garen  <ggaren@apple.com>
1082
1083         Make some more objects use FastMalloc
1084         https://bugs.webkit.org/show_bug.cgi?id=143122
1085
1086         Reviewed by Csaba Osztrogonác.
1087
1088         * API/JSCallbackObject.h:
1089         * heap/IncrementalSweeper.h:
1090         * jit/JITThunks.h:
1091         * runtime/JSGlobalObjectDebuggable.h:
1092         * runtime/RegExpCache.h:
1093
1094 2015-03-27  Michael Saboff  <msaboff@apple.com>
1095
1096         Objects with numeric properties intermittently get a phantom 'length' property
1097         https://bugs.webkit.org/show_bug.cgi?id=142792
1098
1099         Reviewed by Csaba Osztrogonác.
1100
1101         Fixed a > (greater than) that should be a >> (right shift) in the code that disassembles
1102         test and branch instructions.  This function is used for linking tbz/tbnz branches between
1103         two seperately JIT'ed sections of code.  Sometime we'd create a bogus tbz instruction in
1104         the failure case checks in the GetById array length stub created for "obj.length" access.
1105         If the failure case code address was at a negative offset from the stub, we'd look for bit 1
1106         being set when we should have been looking for bit 0.
1107
1108         * assembler/ARM64Assembler.h:
1109         (JSC::ARM64Assembler::disassembleTestAndBranchImmediate):
1110
1111 2015-03-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1112
1113         Insert exception check around toPropertyKey call
1114         https://bugs.webkit.org/show_bug.cgi?id=142922
1115
1116         Reviewed by Geoffrey Garen.
1117
1118         In some places, exception check is missing after/before toPropertyKey.
1119         However, since it calls toString, it's observable to users,
1120
1121         Missing exception checks in Object.prototype methods can be
1122         observed since it would be overridden with toObject(null/undefined) errors.
1123         We inserted exception checks after toPropertyKey.
1124
1125         Missing exception checks in GetById related code can be
1126         observed since it would be overridden with toObject(null/undefined) errors.
1127         In this case, we need to insert exception checks before/after toPropertyKey
1128         since RequireObjectCoercible followed by toPropertyKey can cause exceptions.
1129
1130         JSValue::get checks null/undefined and raise an exception if |this| is null or undefined.
1131         However, we need to check whether the baseValue is object coercible before executing JSValue::toPropertyKey.
1132         According to the spec, we first perform RequireObjectCoercible and check the exception.
1133         And second, we perform ToPropertyKey and check the exception.
1134         Since JSValue::toPropertyKey can cause toString call, this is observable to users.
1135         For example, if the target is not object coercible,
1136         ToPropertyKey should not be executed, and toString should not be executed by ToPropertyKey.
1137         So the order of observable actions (RequireObjectCoercible and ToPropertyKey) should be correct to the spec.
1138
1139         This patch introduces JSValue::requireObjectCoercible and use it because of the following 2 reasons.
1140
1141         1. Using toObject instead of requireObjectCoercible produces unnecessary wrapper object.
1142
1143         toObject converts primitive types into wrapper objects.
1144         But it is not efficient since wrapper objects are not necessary
1145         if we look up methods from primitive values's prototype. (using synthesizePrototype is better).
1146
1147         2. Using the result of toObject is not correct to the spec.
1148
1149         To align to the spec correctly, we cannot use JSObject::get
1150         by using the wrapper object produced by the toObject suggested in (1).
1151         If we use JSObject that is converted by toObject, getter will be called by using this JSObject as |this|.
1152         It is not correct since getter should be called with the original |this| value that may be primitive types.
1153
1154         So in this patch, we use JSValue::requireObjectCoercible
1155         to check the target is object coercible and raise an error if it's not.
1156
1157         * dfg/DFGOperations.cpp:
1158         * jit/JITOperations.cpp:
1159         (JSC::getByVal):
1160         * llint/LLIntSlowPaths.cpp:
1161         (JSC::LLInt::getByVal):
1162         * runtime/CommonSlowPaths.cpp:
1163         (JSC::SLOW_PATH_DECL):
1164         * runtime/JSCJSValue.h:
1165         * runtime/JSCJSValueInlines.h:
1166         (JSC::JSValue::requireObjectCoercible):
1167         * runtime/ObjectPrototype.cpp:
1168         (JSC::objectProtoFuncHasOwnProperty):
1169         (JSC::objectProtoFuncDefineGetter):
1170         (JSC::objectProtoFuncDefineSetter):
1171         (JSC::objectProtoFuncLookupGetter):
1172         (JSC::objectProtoFuncLookupSetter):
1173         (JSC::objectProtoFuncPropertyIsEnumerable):
1174         * tests/stress/exception-in-to-property-key-should-be-handled-early-in-object-methods.js: Added.
1175         (shouldThrow):
1176         (if):
1177         * tests/stress/exception-in-to-property-key-should-be-handled-early.js: Added.
1178         (shouldThrow):
1179         (.):
1180
1181 2015-03-26  Joseph Pecoraro  <pecoraro@apple.com>
1182
1183         WebContent Crash when instantiating class with Type Profiling enabled
1184         https://bugs.webkit.org/show_bug.cgi?id=143037
1185
1186         Reviewed by Ryosuke Niwa.
1187
1188         * bytecompiler/BytecodeGenerator.h:
1189         * bytecompiler/BytecodeGenerator.cpp:
1190         (JSC::BytecodeGenerator::BytecodeGenerator):
1191         (JSC::BytecodeGenerator::emitMoveEmptyValue):
1192         We cannot profile the type of an uninitialized empty JSValue.
1193         Nor do we expect this to be necessary, since it is effectively
1194         an unseen undefined value. So add a way to put the empty value
1195         without profiling.
1196
1197         (JSC::BytecodeGenerator::emitMove):
1198         Add an assert to try to catch this issue early on, and force
1199         callers to explicitly use emitMoveEmptyValue instead.
1200
1201         * tests/typeProfiler/classes.js: Added.
1202         (wrapper.Base):
1203         (wrapper.Derived):
1204         (wrapper):
1205         Add test coverage both for this case and classes in general.
1206
1207 2015-03-26  Joseph Pecoraro  <pecoraro@apple.com>
1208
1209         Web Inspector: ES6: Provide a better view for Classes in the console
1210         https://bugs.webkit.org/show_bug.cgi?id=142999
1211
1212         Reviewed by Timothy Hatcher.
1213
1214         * inspector/protocol/Runtime.json:
1215         Provide a new `subtype` enum "class". This is a subtype of `type`
1216         "function", all other subtypes are subtypes of `object` types.
1217         For a class, the frontend will immediately want to get the prototype
1218         to enumerate its methods, so include the `classPrototype`.
1219
1220         * inspector/JSInjectedScriptHost.cpp:
1221         (Inspector::JSInjectedScriptHost::subtype):
1222         Denote class construction functions as "class" subtypes.
1223
1224         * inspector/InjectedScriptSource.js:
1225         Handling for the new "class" type.
1226
1227         * bytecode/UnlinkedCodeBlock.h:
1228         (JSC::UnlinkedFunctionExecutable::isClassConstructorFunction):
1229         * runtime/Executable.h:
1230         (JSC::FunctionExecutable::isClassConstructorFunction):
1231         * runtime/JSFunction.h:
1232         * runtime/JSFunctionInlines.h:
1233         (JSC::JSFunction::isClassConstructorFunction):
1234         Check if this function is a class constructor function. That information
1235         is on the UnlinkedFunctionExecutable, so plumb it through to JSFunction.
1236
1237 2015-03-26  Geoffrey Garen  <ggaren@apple.com>
1238
1239         Function.prototype.toString should not decompile the AST
1240         https://bugs.webkit.org/show_bug.cgi?id=142853
1241
1242         Reviewed by Darin Adler.
1243
1244         Following up on Darin's review comments.
1245
1246         * runtime/FunctionConstructor.cpp:
1247         (JSC::constructFunctionSkippingEvalEnabledCheck):
1248
1249 2015-03-26  Geoffrey Garen  <ggaren@apple.com>
1250
1251         "lineNo" does not match WebKit coding style guidelines
1252         https://bugs.webkit.org/show_bug.cgi?id=143119
1253
1254         Reviewed by Michael Saboff.
1255
1256         We can afford to use whole words.
1257
1258         * bytecode/CodeBlock.cpp:
1259         (JSC::CodeBlock::lineNumberForBytecodeOffset):
1260         (JSC::CodeBlock::expressionRangeForBytecodeOffset):
1261         * bytecode/UnlinkedCodeBlock.cpp:
1262         (JSC::UnlinkedFunctionExecutable::link):
1263         (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
1264         * bytecode/UnlinkedCodeBlock.h:
1265         * bytecompiler/NodesCodegen.cpp:
1266         (JSC::WhileNode::emitBytecode):
1267         * debugger/Debugger.cpp:
1268         (JSC::Debugger::toggleBreakpoint):
1269         * interpreter/Interpreter.cpp:
1270         (JSC::StackFrame::computeLineAndColumn):
1271         (JSC::GetStackTraceFunctor::operator()):
1272         (JSC::Interpreter::execute):
1273         * interpreter/StackVisitor.cpp:
1274         (JSC::StackVisitor::Frame::computeLineAndColumn):
1275         * parser/Nodes.h:
1276         (JSC::Node::firstLine):
1277         (JSC::Node::lineNo): Deleted.
1278         (JSC::StatementNode::firstLine): Deleted.
1279         * parser/ParserError.h:
1280         (JSC::ParserError::toErrorObject):
1281         * profiler/LegacyProfiler.cpp:
1282         (JSC::createCallIdentifierFromFunctionImp):
1283         * runtime/CodeCache.cpp:
1284         (JSC::CodeCache::getGlobalCodeBlock):
1285         * runtime/Executable.cpp:
1286         (JSC::ScriptExecutable::ScriptExecutable):
1287         (JSC::ScriptExecutable::newCodeBlockFor):
1288         (JSC::FunctionExecutable::fromGlobalCode):
1289         * runtime/Executable.h:
1290         (JSC::ScriptExecutable::firstLine):
1291         (JSC::ScriptExecutable::setOverrideLineNumber):
1292         (JSC::ScriptExecutable::hasOverrideLineNumber):
1293         (JSC::ScriptExecutable::overrideLineNumber):
1294         (JSC::ScriptExecutable::lineNo): Deleted.
1295         (JSC::ScriptExecutable::setOverrideLineNo): Deleted.
1296         (JSC::ScriptExecutable::hasOverrideLineNo): Deleted.
1297         (JSC::ScriptExecutable::overrideLineNo): Deleted.
1298         * runtime/FunctionConstructor.cpp:
1299         (JSC::constructFunctionSkippingEvalEnabledCheck):
1300         * runtime/FunctionConstructor.h:
1301         * tools/CodeProfile.cpp:
1302         (JSC::CodeProfile::report):
1303         * tools/CodeProfile.h:
1304         (JSC::CodeProfile::CodeProfile):
1305
1306 2015-03-26  Geoffrey Garen  <ggaren@apple.com>
1307
1308         Assertion firing in JavaScriptCore/parser/parser.h for statesman.com site
1309         https://bugs.webkit.org/show_bug.cgi?id=142974
1310
1311         Reviewed by Joseph Pecoraro.
1312
1313         This patch does two things:
1314
1315         (1) Restore JavaScriptCore's sanitization of line and column numbers to
1316         one-based values.
1317
1318         We need this because WebCore sometimes provides huge negative column
1319         numbers.
1320
1321         (2) Solve the attribute event listener line numbering problem a different
1322         way: Rather than offseting all line numbers by -1 in an attribute event
1323         listener in order to arrange for a custom result, instead use an explicit
1324         feature for saying "all errors in this code should map to this line number".
1325
1326         * bytecode/UnlinkedCodeBlock.cpp:
1327         (JSC::UnlinkedFunctionExecutable::link):
1328         (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
1329         * bytecode/UnlinkedCodeBlock.h:
1330         * interpreter/Interpreter.cpp:
1331         (JSC::StackFrame::computeLineAndColumn):
1332         (JSC::GetStackTraceFunctor::operator()):
1333         * interpreter/Interpreter.h:
1334         * interpreter/StackVisitor.cpp:
1335         (JSC::StackVisitor::Frame::computeLineAndColumn):
1336         * parser/ParserError.h:
1337         (JSC::ParserError::toErrorObject): Plumb through an override line number.
1338         When a function has an override line number, all syntax and runtime
1339         errors in the function will map to it. This is useful for attribute event
1340         listeners.
1341
1342         * parser/SourceCode.h:
1343         (JSC::SourceCode::SourceCode): Restore the old sanitization of line and
1344         column numbers to one-based integers. It was kind of a hack to remove this.
1345
1346         * runtime/Executable.cpp:
1347         (JSC::ScriptExecutable::ScriptExecutable):
1348         (JSC::FunctionExecutable::fromGlobalCode):
1349         * runtime/Executable.h:
1350         (JSC::ScriptExecutable::setOverrideLineNo):
1351         (JSC::ScriptExecutable::hasOverrideLineNo):
1352         (JSC::ScriptExecutable::overrideLineNo):
1353         * runtime/FunctionConstructor.cpp:
1354         (JSC::constructFunctionSkippingEvalEnabledCheck):
1355         * runtime/FunctionConstructor.h: Plumb through an override line number.
1356
1357 2015-03-26  Filip Pizlo  <fpizlo@apple.com>
1358
1359         If we're in code for accessing scoped arguments, we should probably check if the object is a scoped arguments rather than checking if it's a direct arguments.
1360
1361         Reviewed by Michael Saboff.
1362
1363         * jit/JITPropertyAccess.cpp:
1364         (JSC::JIT::emitScopedArgumentsGetByVal):
1365         * tests/stress/scoped-then-direct-arguments-get-by-val-in-baseline.js: Added.
1366
1367 2015-03-26  Filip Pizlo  <fpizlo@apple.com>
1368
1369         FTL ScopedArguments GetArrayLength generates incorrect code and crashes in LLVM
1370         https://bugs.webkit.org/show_bug.cgi?id=143098
1371
1372         Reviewed by Csaba Osztrogonác.
1373
1374         * ftl/FTLLowerDFGToLLVM.cpp:
1375         (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength): Fix a typo.
1376         * tests/stress/scoped-arguments-array-length.js: Added. This test previously always crashed in ftl-no-cjit mode.
1377
1378 2015-03-26  Csaba Osztrogonác  <ossy@webkit.org>
1379
1380         Unreviewed gardening, skip failing tests on AArch64 Linux.
1381
1382         * tests/mozilla/mozilla-tests.yaml:
1383         * tests/stress/cached-prototype-setter.js:
1384
1385 2015-03-26  Filip Pizlo  <fpizlo@apple.com>
1386
1387         Unreviewed, fixes to silly things. While landing fixes to r181993, I introduced crashes. This fixes them.
1388
1389         * dfg/DFGConstantFoldingPhase.cpp:
1390         (JSC::DFG::ConstantFoldingPhase::foldConstants): I landed a fix for a VS warning. It broke this. Now I'm fixing it.
1391         * ftl/FTLCompile.cpp:
1392         (JSC::FTL::compile): Make sure we pass the module when dumping. This makes FTL debugging possible again.
1393         * ftl/FTLState.cpp:
1394         (JSC::FTL::State::dumpState): New overload that takes a module, so that we can call this after FTL::compile() clears State's module.
1395         * ftl/FTLState.h:
1396
1397 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
1398
1399         Unreviewed, fix obvious goof that was causing 32-bit debug crashes. The 64-bit version did it
1400         right, so this just makes 32-bit do the same.
1401
1402         * dfg/DFGSpeculativeJIT32_64.cpp:
1403         (JSC::DFG::SpeculativeJIT::emitCall):
1404
1405 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
1406
1407         Fix a typo that ggaren found but that I didn't fix before.
1408
1409         * runtime/DirectArgumentsOffset.h:
1410
1411 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
1412
1413         Unreviewed, VC found a bug. This fixes the bug.
1414
1415         * dfg/DFGConstantFoldingPhase.cpp:
1416         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1417
1418 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
1419
1420         Unreviewed, try to fix Windows build.
1421
1422         * runtime/ClonedArguments.cpp:
1423         (JSC::ClonedArguments::createWithInlineFrame):
1424
1425 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
1426
1427         Unreviewed, fix debug build.
1428
1429         * bytecompiler/NodesCodegen.cpp:
1430         (JSC::ConstDeclNode::emitCodeSingle):
1431
1432 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
1433
1434         Unreviewed, fix CLOOP build.
1435
1436         * dfg/DFGMinifiedID.h:
1437
1438 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
1439
1440         Heap variables shouldn't end up in the stack frame
1441         https://bugs.webkit.org/show_bug.cgi?id=141174
1442
1443         Reviewed by Geoffrey Garen.
1444
1445         This is a major change to how JavaScriptCore handles declared variables (i.e. "var"). It removes
1446         any ambiguity about whether a variable should be in the heap or on the stack. A variable will no
1447         longer move between heap and stack during its lifetime. This enables a bunch of optimizations and
1448         simplifications:
1449
1450         - Accesses to variables no longer need checks or indirections to determine where the variable is
1451           at that moment in time. For example, loading a closure variable now takes just one load instead
1452           of two. Loading an argument by index now takes a bounds check and a load in the fastest case
1453           (when no arguments object allocation is required) while previously that same operation required
1454           a "did I allocate arguments yet" check, a bounds check, and then the load.
1455
1456         - Reasoning about the allocation of an activation or arguments object now follows the same simple
1457           logic as the allocation of any other kind of object. Previously, those objects were lazily
1458           allocated - so an allocation instruction wasn't the actual allocation site, since it might not
1459           allocate anything at all. This made the implementation of traditional escape analyses really
1460           awkward, and ultimately it meant that we missed important cases. Now, we can reason about the
1461           arguments object using the usual SSA tricks which allows for more comprehensive removal.
1462
1463         - The allocations of arguments objects, functions, and activations are now much faster. While
1464           this patch generally expands our ability to eliminate arguments object allocations, an earlier
1465           version of the patch - which lacked that functionality - was a progression on some arguments-
1466           and closure-happy benchmarks because although no allocations were eliminated, all allocations
1467           were faster.
1468
1469         - There is no tear-off. The runtime no loner needs to know about where on the stack a frame keeps
1470           its arguments objects or activations. The runtime doesn't have to do things to the arguments
1471           objects and activations that a frame allocated, when the frame is unwound. We always had horrid
1472           bugs in that code, so it's good to see it go. This removes *a ton* of machinery from the DFG,
1473           FTL, CodeBlock, and other places. All of the things having to do with "captured variables" is
1474           now gone. This also enables implementing block-scoping. Without this change, block-scope
1475           support would require telling CodeBlock and all of the rest of the runtime about all of the
1476           variables that store currently-live scopes. That would have been so disastrously hard that it
1477           might as well be impossible. With this change, it's fair game for the bytecode generator to
1478           simply allocate whatever activations it wants, wherever it wants, and to keep them live for
1479           however long it wants. This all works, because after bytecode generation, an activation is just
1480           an object and variables that refer to it are just normal variables.
1481
1482         - SymbolTable can now tell you explicitly where a variable lives. The answer is in the form of a
1483           VarOffset object, which has methods like isStack(), isScope(), etc. VirtualRegister is never
1484           used for offsets of non-stack variables anymore. We now have shiny new objects for other kinds
1485           of offsets - ScopeOffset for offsets into scopes, and DirectArgumentsOffset for offsets into
1486           an arguments object.
1487
1488         - Functions that create activations can now tier-up into the FTL. Previously they couldn't. Also,
1489           using activations used to prevent inlining; now functions that use activations can be inlined
1490           just fine.
1491
1492         This is a >1% speed-up on Octane. This is a >2% speed-up on CompressionBench. This is a tiny
1493         speed-up on AsmBench (~0.4% or something). This looks like it might be a speed-up on SunSpider.
1494         It's only a slow-down on very short-running microbenchmarks we had previously written for our old
1495         style of tear-off-based arguments optimization. Those benchmarks are not part of any major suite.
1496
1497         The easiest way of understanding this change is to start by looking at the changes in runtime/,
1498         and then the changes in bytecompiler/, and then sort of work your way up the compiler tiers.
1499
1500         * CMakeLists.txt:
1501         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1502         * JavaScriptCore.xcodeproj/project.pbxproj:
1503         * assembler/AbortReason.h:
1504         * assembler/AbstractMacroAssembler.h:
1505         (JSC::AbstractMacroAssembler::BaseIndex::withOffset):
1506         * bytecode/ByValInfo.h:
1507         (JSC::hasOptimizableIndexingForJSType):
1508         (JSC::hasOptimizableIndexing):
1509         (JSC::jitArrayModeForJSType):
1510         (JSC::jitArrayModePermitsPut):
1511         (JSC::jitArrayModeForStructure):
1512         * bytecode/BytecodeKills.h: Added.
1513         (JSC::BytecodeKills::BytecodeKills):
1514         (JSC::BytecodeKills::operandIsKilled):
1515         (JSC::BytecodeKills::forEachOperandKilledAt):
1516         (JSC::BytecodeKills::KillSet::KillSet):
1517         (JSC::BytecodeKills::KillSet::add):
1518         (JSC::BytecodeKills::KillSet::forEachLocal):
1519         (JSC::BytecodeKills::KillSet::contains):
1520         * bytecode/BytecodeList.json:
1521         * bytecode/BytecodeLivenessAnalysis.cpp:
1522         (JSC::isValidRegisterForLiveness):
1523         (JSC::stepOverInstruction):
1524         (JSC::BytecodeLivenessAnalysis::runLivenessFixpoint):
1525         (JSC::BytecodeLivenessAnalysis::getLivenessInfoAtBytecodeOffset):
1526         (JSC::BytecodeLivenessAnalysis::operandIsLiveAtBytecodeOffset):
1527         (JSC::BytecodeLivenessAnalysis::computeFullLiveness):
1528         (JSC::BytecodeLivenessAnalysis::computeKills):
1529         (JSC::indexForOperand): Deleted.
1530         (JSC::BytecodeLivenessAnalysis::getLivenessInfoForNonCapturedVarsAtBytecodeOffset): Deleted.
1531         (JSC::getLivenessInfo): Deleted.
1532         * bytecode/BytecodeLivenessAnalysis.h:
1533         * bytecode/BytecodeLivenessAnalysisInlines.h:
1534         (JSC::operandIsAlwaysLive):
1535         (JSC::operandThatIsNotAlwaysLiveIsLive):
1536         (JSC::operandIsLive):
1537         * bytecode/BytecodeUseDef.h:
1538         (JSC::computeUsesForBytecodeOffset):
1539         (JSC::computeDefsForBytecodeOffset):
1540         * bytecode/CodeBlock.cpp:
1541         (JSC::CodeBlock::dumpBytecode):
1542         (JSC::CodeBlock::CodeBlock):
1543         (JSC::CodeBlock::nameForRegister):
1544         (JSC::CodeBlock::validate):
1545         (JSC::CodeBlock::isCaptured): Deleted.
1546         (JSC::CodeBlock::framePointerOffsetToGetActivationRegisters): Deleted.
1547         (JSC::CodeBlock::machineSlowArguments): Deleted.
1548         * bytecode/CodeBlock.h:
1549         (JSC::unmodifiedArgumentsRegister): Deleted.
1550         (JSC::CodeBlock::setArgumentsRegister): Deleted.
1551         (JSC::CodeBlock::argumentsRegister): Deleted.
1552         (JSC::CodeBlock::uncheckedArgumentsRegister): Deleted.
1553         (JSC::CodeBlock::usesArguments): Deleted.
1554         (JSC::CodeBlock::captureCount): Deleted.
1555         (JSC::CodeBlock::captureStart): Deleted.
1556         (JSC::CodeBlock::captureEnd): Deleted.
1557         (JSC::CodeBlock::argumentIndexAfterCapture): Deleted.
1558         (JSC::CodeBlock::hasSlowArguments): Deleted.
1559         (JSC::ExecState::argumentAfterCapture): Deleted.
1560         * bytecode/CodeOrigin.h:
1561         * bytecode/DataFormat.h:
1562         (JSC::dataFormatToString):
1563         * bytecode/FullBytecodeLiveness.h:
1564         (JSC::FullBytecodeLiveness::getLiveness):
1565         (JSC::FullBytecodeLiveness::operandIsLive):
1566         (JSC::FullBytecodeLiveness::FullBytecodeLiveness): Deleted.
1567         (JSC::FullBytecodeLiveness::getOut): Deleted.
1568         * bytecode/Instruction.h:
1569         (JSC::Instruction::Instruction):
1570         * bytecode/Operands.h:
1571         (JSC::Operands::virtualRegisterForIndex):
1572         * bytecode/SpeculatedType.cpp:
1573         (JSC::dumpSpeculation):
1574         (JSC::speculationToAbbreviatedString):
1575         (JSC::speculationFromClassInfo):
1576         * bytecode/SpeculatedType.h:
1577         (JSC::isDirectArgumentsSpeculation):
1578         (JSC::isScopedArgumentsSpeculation):
1579         (JSC::isActionableMutableArraySpeculation):
1580         (JSC::isActionableArraySpeculation):
1581         (JSC::isArgumentsSpeculation): Deleted.
1582         * bytecode/UnlinkedCodeBlock.cpp:
1583         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
1584         * bytecode/UnlinkedCodeBlock.h:
1585         (JSC::UnlinkedCodeBlock::setArgumentsRegister): Deleted.
1586         (JSC::UnlinkedCodeBlock::usesArguments): Deleted.
1587         (JSC::UnlinkedCodeBlock::argumentsRegister): Deleted.
1588         * bytecode/ValueRecovery.cpp:
1589         (JSC::ValueRecovery::dumpInContext):
1590         * bytecode/ValueRecovery.h:
1591         (JSC::ValueRecovery::directArgumentsThatWereNotCreated):
1592         (JSC::ValueRecovery::outOfBandArgumentsThatWereNotCreated):
1593         (JSC::ValueRecovery::nodeID):
1594         (JSC::ValueRecovery::argumentsThatWereNotCreated): Deleted.
1595         * bytecode/VirtualRegister.h:
1596         (JSC::VirtualRegister::operator==):
1597         (JSC::VirtualRegister::operator!=):
1598         (JSC::VirtualRegister::operator<):
1599         (JSC::VirtualRegister::operator>):
1600         (JSC::VirtualRegister::operator<=):
1601         (JSC::VirtualRegister::operator>=):
1602         * bytecompiler/BytecodeGenerator.cpp:
1603         (JSC::BytecodeGenerator::generate):
1604         (JSC::BytecodeGenerator::BytecodeGenerator):
1605         (JSC::BytecodeGenerator::initializeNextParameter):
1606         (JSC::BytecodeGenerator::visibleNameForParameter):
1607         (JSC::BytecodeGenerator::emitMove):
1608         (JSC::BytecodeGenerator::variable):
1609         (JSC::BytecodeGenerator::createVariable):
1610         (JSC::BytecodeGenerator::emitResolveScope):
1611         (JSC::BytecodeGenerator::emitGetFromScope):
1612         (JSC::BytecodeGenerator::emitPutToScope):
1613         (JSC::BytecodeGenerator::initializeVariable):
1614         (JSC::BytecodeGenerator::emitInstanceOf):
1615         (JSC::BytecodeGenerator::emitNewFunction):
1616         (JSC::BytecodeGenerator::emitNewFunctionInternal):
1617         (JSC::BytecodeGenerator::emitCall):
1618         (JSC::BytecodeGenerator::emitReturn):
1619         (JSC::BytecodeGenerator::emitConstruct):
1620         (JSC::BytecodeGenerator::isArgumentNumber):
1621         (JSC::BytecodeGenerator::emitEnumeration):
1622         (JSC::BytecodeGenerator::addVar): Deleted.
1623         (JSC::BytecodeGenerator::emitInitLazyRegister): Deleted.
1624         (JSC::BytecodeGenerator::initializeCapturedVariable): Deleted.
1625         (JSC::BytecodeGenerator::resolveCallee): Deleted.
1626         (JSC::BytecodeGenerator::addCallee): Deleted.
1627         (JSC::BytecodeGenerator::addParameter): Deleted.
1628         (JSC::BytecodeGenerator::willResolveToArgumentsRegister): Deleted.
1629         (JSC::BytecodeGenerator::uncheckedLocalArgumentsRegister): Deleted.
1630         (JSC::BytecodeGenerator::createLazyRegisterIfNecessary): Deleted.
1631         (JSC::BytecodeGenerator::isCaptured): Deleted.
1632         (JSC::BytecodeGenerator::local): Deleted.
1633         (JSC::BytecodeGenerator::constLocal): Deleted.
1634         (JSC::BytecodeGenerator::emitResolveConstantLocal): Deleted.
1635         (JSC::BytecodeGenerator::emitGetArgumentsLength): Deleted.
1636         (JSC::BytecodeGenerator::emitGetArgumentByVal): Deleted.
1637         (JSC::BytecodeGenerator::emitLazyNewFunction): Deleted.
1638         (JSC::BytecodeGenerator::createArgumentsIfNecessary): Deleted.
1639         * bytecompiler/BytecodeGenerator.h:
1640         (JSC::Variable::Variable):
1641         (JSC::Variable::isResolved):
1642         (JSC::Variable::ident):
1643         (JSC::Variable::offset):
1644         (JSC::Variable::isLocal):
1645         (JSC::Variable::local):
1646         (JSC::Variable::isSpecial):
1647         (JSC::BytecodeGenerator::argumentsRegister):
1648         (JSC::BytecodeGenerator::emitNode):
1649         (JSC::BytecodeGenerator::registerFor):
1650         (JSC::Local::Local): Deleted.
1651         (JSC::Local::operator bool): Deleted.
1652         (JSC::Local::get): Deleted.
1653         (JSC::Local::isSpecial): Deleted.
1654         (JSC::ResolveScopeInfo::ResolveScopeInfo): Deleted.
1655         (JSC::ResolveScopeInfo::isLocal): Deleted.
1656         (JSC::ResolveScopeInfo::localIndex): Deleted.
1657         (JSC::BytecodeGenerator::hasSafeLocalArgumentsRegister): Deleted.
1658         (JSC::BytecodeGenerator::captureMode): Deleted.
1659         (JSC::BytecodeGenerator::shouldTearOffArgumentsEagerly): Deleted.
1660         (JSC::BytecodeGenerator::shouldCreateArgumentsEagerly): Deleted.
1661         (JSC::BytecodeGenerator::hasWatchableVariable): Deleted.
1662         (JSC::BytecodeGenerator::watchableVariableIdentifier): Deleted.
1663         * bytecompiler/NodesCodegen.cpp:
1664         (JSC::ResolveNode::isPure):
1665         (JSC::ResolveNode::emitBytecode):
1666         (JSC::BracketAccessorNode::emitBytecode):
1667         (JSC::DotAccessorNode::emitBytecode):
1668         (JSC::EvalFunctionCallNode::emitBytecode):
1669         (JSC::FunctionCallResolveNode::emitBytecode):
1670         (JSC::CallFunctionCallDotNode::emitBytecode):
1671         (JSC::ApplyFunctionCallDotNode::emitBytecode):
1672         (JSC::PostfixNode::emitResolve):
1673         (JSC::DeleteResolveNode::emitBytecode):
1674         (JSC::TypeOfResolveNode::emitBytecode):
1675         (JSC::PrefixNode::emitResolve):
1676         (JSC::ReadModifyResolveNode::emitBytecode):
1677         (JSC::AssignResolveNode::emitBytecode):
1678         (JSC::ConstDeclNode::emitCodeSingle):
1679         (JSC::EmptyVarExpression::emitBytecode):
1680         (JSC::ForInNode::tryGetBoundLocal):
1681         (JSC::ForInNode::emitLoopHeader):
1682         (JSC::ForOfNode::emitBytecode):
1683         (JSC::ArrayPatternNode::emitDirectBinding):
1684         (JSC::BindingNode::bindValue):
1685         (JSC::getArgumentByVal): Deleted.
1686         * dfg/DFGAbstractHeap.h:
1687         * dfg/DFGAbstractInterpreter.h:
1688         * dfg/DFGAbstractInterpreterInlines.h:
1689         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1690         (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberWorld):
1691         (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberCapturedVars): Deleted.
1692         * dfg/DFGAbstractValue.h:
1693         * dfg/DFGArgumentPosition.h:
1694         (JSC::DFG::ArgumentPosition::addVariable):
1695         * dfg/DFGArgumentsEliminationPhase.cpp: Added.
1696         (JSC::DFG::performArgumentsElimination):
1697         * dfg/DFGArgumentsEliminationPhase.h: Added.
1698         * dfg/DFGArgumentsSimplificationPhase.cpp: Removed.
1699         * dfg/DFGArgumentsSimplificationPhase.h: Removed.
1700         * dfg/DFGArgumentsUtilities.cpp: Added.
1701         (JSC::DFG::argumentsInvolveStackSlot):
1702         (JSC::DFG::emitCodeToGetArgumentsArrayLength):
1703         * dfg/DFGArgumentsUtilities.h: Added.
1704         * dfg/DFGArrayMode.cpp:
1705         (JSC::DFG::ArrayMode::refine):
1706         (JSC::DFG::ArrayMode::alreadyChecked):
1707         (JSC::DFG::arrayTypeToString):
1708         * dfg/DFGArrayMode.h:
1709         (JSC::DFG::ArrayMode::canCSEStorage):
1710         (JSC::DFG::ArrayMode::modeForPut):
1711         * dfg/DFGAvailabilityMap.cpp:
1712         (JSC::DFG::AvailabilityMap::prune):
1713         * dfg/DFGAvailabilityMap.h:
1714         (JSC::DFG::AvailabilityMap::closeOverNodes):
1715         (JSC::DFG::AvailabilityMap::closeStartingWithLocal):
1716         * dfg/DFGBackwardsPropagationPhase.cpp:
1717         (JSC::DFG::BackwardsPropagationPhase::propagate):
1718         * dfg/DFGByteCodeParser.cpp:
1719         (JSC::DFG::ByteCodeParser::newVariableAccessData):
1720         (JSC::DFG::ByteCodeParser::getLocal):
1721         (JSC::DFG::ByteCodeParser::setLocal):
1722         (JSC::DFG::ByteCodeParser::getArgument):
1723         (JSC::DFG::ByteCodeParser::setArgument):
1724         (JSC::DFG::ByteCodeParser::flushDirect):
1725         (JSC::DFG::ByteCodeParser::flush):
1726         (JSC::DFG::ByteCodeParser::noticeArgumentsUse):
1727         (JSC::DFG::ByteCodeParser::handleVarargsCall):
1728         (JSC::DFG::ByteCodeParser::attemptToInlineCall):
1729         (JSC::DFG::ByteCodeParser::handleInlining):
1730         (JSC::DFG::ByteCodeParser::parseBlock):
1731         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
1732         (JSC::DFG::ByteCodeParser::parseCodeBlock):
1733         * dfg/DFGCPSRethreadingPhase.cpp:
1734         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
1735         (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
1736         * dfg/DFGCSEPhase.cpp:
1737         * dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h: Added.
1738         (JSC::DFG::CallCreateDirectArgumentsSlowPathGenerator::CallCreateDirectArgumentsSlowPathGenerator):
1739         * dfg/DFGCapabilities.cpp:
1740         (JSC::DFG::isSupportedForInlining):
1741         (JSC::DFG::capabilityLevel):
1742         * dfg/DFGClobberize.h:
1743         (JSC::DFG::clobberize):
1744         * dfg/DFGCommon.h:
1745         * dfg/DFGCommonData.h:
1746         (JSC::DFG::CommonData::CommonData):
1747         * dfg/DFGConstantFoldingPhase.cpp:
1748         (JSC::DFG::ConstantFoldingPhase::foldConstants):
1749         * dfg/DFGDCEPhase.cpp:
1750         (JSC::DFG::DCEPhase::cleanVariables):
1751         * dfg/DFGDisassembler.h:
1752         * dfg/DFGDoesGC.cpp:
1753         (JSC::DFG::doesGC):
1754         * dfg/DFGFixupPhase.cpp:
1755         (JSC::DFG::FixupPhase::fixupNode):
1756         * dfg/DFGFlushFormat.cpp:
1757         (WTF::printInternal):
1758         * dfg/DFGFlushFormat.h:
1759         (JSC::DFG::resultFor):
1760         (JSC::DFG::useKindFor):
1761         (JSC::DFG::dataFormatFor):
1762         * dfg/DFGForAllKills.h: Added.
1763         (JSC::DFG::forAllLiveNodesAtTail):
1764         (JSC::DFG::forAllDirectlyKilledOperands):
1765         (JSC::DFG::forAllKilledOperands):
1766         (JSC::DFG::forAllKilledNodesAtNodeIndex):
1767         (JSC::DFG::forAllKillsInBlock):
1768         * dfg/DFGGraph.cpp:
1769         (JSC::DFG::Graph::Graph):
1770         (JSC::DFG::Graph::dump):
1771         (JSC::DFG::Graph::substituteGetLocal):
1772         (JSC::DFG::Graph::livenessFor):
1773         (JSC::DFG::Graph::killsFor):
1774         (JSC::DFG::Graph::tryGetConstantClosureVar):
1775         (JSC::DFG::Graph::tryGetRegisters): Deleted.
1776         * dfg/DFGGraph.h:
1777         (JSC::DFG::Graph::symbolTableFor):
1778         (JSC::DFG::Graph::uses):
1779         (JSC::DFG::Graph::bytecodeRegisterForArgument): Deleted.
1780         (JSC::DFG::Graph::capturedVarsFor): Deleted.
1781         (JSC::DFG::Graph::usesArguments): Deleted.
1782         (JSC::DFG::Graph::argumentsRegisterFor): Deleted.
1783         (JSC::DFG::Graph::machineArgumentsRegisterFor): Deleted.
1784         (JSC::DFG::Graph::uncheckedArgumentsRegisterFor): Deleted.
1785         * dfg/DFGHeapLocation.cpp:
1786         (WTF::printInternal):
1787         * dfg/DFGHeapLocation.h:
1788         * dfg/DFGInPlaceAbstractState.cpp:
1789         (JSC::DFG::InPlaceAbstractState::initialize):
1790         (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
1791         * dfg/DFGJITCompiler.cpp:
1792         (JSC::DFG::JITCompiler::link):
1793         * dfg/DFGMayExit.cpp:
1794         (JSC::DFG::mayExit):
1795         * dfg/DFGMinifiedID.h:
1796         * dfg/DFGMinifiedNode.cpp:
1797         (JSC::DFG::MinifiedNode::fromNode):
1798         * dfg/DFGMinifiedNode.h:
1799         (JSC::DFG::belongsInMinifiedGraph):
1800         (JSC::DFG::MinifiedNode::hasInlineCallFrame):
1801         (JSC::DFG::MinifiedNode::inlineCallFrame):
1802         * dfg/DFGNode.cpp:
1803         (JSC::DFG::Node::convertToIdentityOn):
1804         * dfg/DFGNode.h:
1805         (JSC::DFG::Node::hasConstant):
1806         (JSC::DFG::Node::constant):
1807         (JSC::DFG::Node::hasScopeOffset):
1808         (JSC::DFG::Node::scopeOffset):
1809         (JSC::DFG::Node::hasDirectArgumentsOffset):
1810         (JSC::DFG::Node::capturedArgumentsOffset):
1811         (JSC::DFG::Node::variablePointer):
1812         (JSC::DFG::Node::hasCallVarargsData):
1813         (JSC::DFG::Node::hasLoadVarargsData):
1814         (JSC::DFG::Node::hasHeapPrediction):
1815         (JSC::DFG::Node::hasCellOperand):
1816         (JSC::DFG::Node::objectMaterializationData):
1817         (JSC::DFG::Node::isPhantomAllocation):
1818         (JSC::DFG::Node::willHaveCodeGenOrOSR):
1819         (JSC::DFG::Node::shouldSpeculateDirectArguments):
1820         (JSC::DFG::Node::shouldSpeculateScopedArguments):
1821         (JSC::DFG::Node::isPhantomArguments): Deleted.
1822         (JSC::DFG::Node::hasVarNumber): Deleted.
1823         (JSC::DFG::Node::varNumber): Deleted.
1824         (JSC::DFG::Node::registerPointer): Deleted.
1825         (JSC::DFG::Node::shouldSpeculateArguments): Deleted.
1826         * dfg/DFGNodeType.h:
1827         * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
1828         (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
1829         (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
1830         * dfg/DFGOSRExitCompiler.cpp:
1831         (JSC::DFG::OSRExitCompiler::emitRestoreArguments):
1832         * dfg/DFGOSRExitCompiler.h:
1833         (JSC::DFG::OSRExitCompiler::badIndex): Deleted.
1834         (JSC::DFG::OSRExitCompiler::initializePoisoned): Deleted.
1835         (JSC::DFG::OSRExitCompiler::poisonIndex): Deleted.
1836         * dfg/DFGOSRExitCompiler32_64.cpp:
1837         (JSC::DFG::OSRExitCompiler::compileExit):
1838         * dfg/DFGOSRExitCompiler64.cpp:
1839         (JSC::DFG::OSRExitCompiler::compileExit):
1840         * dfg/DFGOSRExitCompilerCommon.cpp:
1841         (JSC::DFG::reifyInlinedCallFrames):
1842         (JSC::DFG::ArgumentsRecoveryGenerator::ArgumentsRecoveryGenerator): Deleted.
1843         (JSC::DFG::ArgumentsRecoveryGenerator::~ArgumentsRecoveryGenerator): Deleted.
1844         (JSC::DFG::ArgumentsRecoveryGenerator::generateFor): Deleted.
1845         * dfg/DFGOSRExitCompilerCommon.h:
1846         * dfg/DFGOperations.cpp:
1847         * dfg/DFGOperations.h:
1848         * dfg/DFGPlan.cpp:
1849         (JSC::DFG::Plan::compileInThreadImpl):
1850         * dfg/DFGPreciseLocalClobberize.h:
1851         (JSC::DFG::PreciseLocalClobberizeAdaptor::read):
1852         (JSC::DFG::PreciseLocalClobberizeAdaptor::write):
1853         (JSC::DFG::PreciseLocalClobberizeAdaptor::def):
1854         (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
1855         (JSC::DFG::preciseLocalClobberize):
1856         (JSC::DFG::PreciseLocalClobberizeAdaptor::writeTop): Deleted.
1857         (JSC::DFG::forEachLocalReadByUnwind): Deleted.
1858         * dfg/DFGPredictionPropagationPhase.cpp:
1859         (JSC::DFG::PredictionPropagationPhase::run):
1860         (JSC::DFG::PredictionPropagationPhase::propagate):
1861         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
1862         (JSC::DFG::PredictionPropagationPhase::propagateThroughArgumentPositions):
1863         * dfg/DFGPromoteHeapAccess.h:
1864         (JSC::DFG::promoteHeapAccess):
1865         * dfg/DFGPromotedHeapLocation.cpp:
1866         (WTF::printInternal):
1867         * dfg/DFGPromotedHeapLocation.h:
1868         * dfg/DFGSSAConversionPhase.cpp:
1869         (JSC::DFG::SSAConversionPhase::run):
1870         * dfg/DFGSafeToExecute.h:
1871         (JSC::DFG::safeToExecute):
1872         * dfg/DFGSpeculativeJIT.cpp:
1873         (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
1874         (JSC::DFG::SpeculativeJIT::emitGetLength):
1875         (JSC::DFG::SpeculativeJIT::emitGetCallee):
1876         (JSC::DFG::SpeculativeJIT::emitGetArgumentStart):
1877         (JSC::DFG::SpeculativeJIT::checkArray):
1878         (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
1879         (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
1880         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
1881         (JSC::DFG::SpeculativeJIT::compileNewFunction):
1882         (JSC::DFG::SpeculativeJIT::compileForwardVarargs):
1883         (JSC::DFG::SpeculativeJIT::compileCreateActivation):
1884         (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
1885         (JSC::DFG::SpeculativeJIT::compileGetFromArguments):
1886         (JSC::DFG::SpeculativeJIT::compilePutToArguments):
1887         (JSC::DFG::SpeculativeJIT::compileCreateScopedArguments):
1888         (JSC::DFG::SpeculativeJIT::compileCreateClonedArguments):
1889         (JSC::DFG::SpeculativeJIT::emitAllocateArguments): Deleted.
1890         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): Deleted.
1891         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength): Deleted.
1892         (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck): Deleted.
1893         (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression): Deleted.
1894         * dfg/DFGSpeculativeJIT.h:
1895         (JSC::DFG::SpeculativeJIT::callOperation):
1896         (JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize):
1897         (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
1898         (JSC::DFG::SpeculativeJIT::framePointerOffsetToGetActivationRegisters): Deleted.
1899         * dfg/DFGSpeculativeJIT32_64.cpp:
1900         (JSC::DFG::SpeculativeJIT::emitCall):
1901         (JSC::DFG::SpeculativeJIT::compile):
1902         * dfg/DFGSpeculativeJIT64.cpp:
1903         (JSC::DFG::SpeculativeJIT::emitCall):
1904         (JSC::DFG::SpeculativeJIT::compile):
1905         * dfg/DFGStackLayoutPhase.cpp:
1906         (JSC::DFG::StackLayoutPhase::run):
1907         * dfg/DFGStrengthReductionPhase.cpp:
1908         (JSC::DFG::StrengthReductionPhase::handleNode):
1909         * dfg/DFGStructureRegistrationPhase.cpp:
1910         (JSC::DFG::StructureRegistrationPhase::run):
1911         * dfg/DFGUnificationPhase.cpp:
1912         (JSC::DFG::UnificationPhase::run):
1913         * dfg/DFGValidate.cpp:
1914         (JSC::DFG::Validate::validateCPS):
1915         * dfg/DFGValueSource.cpp:
1916         (JSC::DFG::ValueSource::dump):
1917         * dfg/DFGValueSource.h:
1918         (JSC::DFG::dataFormatToValueSourceKind):
1919         (JSC::DFG::valueSourceKindToDataFormat):
1920         (JSC::DFG::ValueSource::ValueSource):
1921         (JSC::DFG::ValueSource::forFlushFormat):
1922         (JSC::DFG::ValueSource::valueRecovery):
1923         * dfg/DFGVarargsForwardingPhase.cpp: Added.
1924         (JSC::DFG::performVarargsForwarding):
1925         * dfg/DFGVarargsForwardingPhase.h: Added.
1926         * dfg/DFGVariableAccessData.cpp:
1927         (JSC::DFG::VariableAccessData::VariableAccessData):
1928         (JSC::DFG::VariableAccessData::flushFormat):
1929         (JSC::DFG::VariableAccessData::mergeIsCaptured): Deleted.
1930         * dfg/DFGVariableAccessData.h:
1931         (JSC::DFG::VariableAccessData::shouldNeverUnbox):
1932         (JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
1933         (JSC::DFG::VariableAccessData::isCaptured): Deleted.
1934         (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias): Deleted.
1935         (JSC::DFG::VariableAccessData::isArgumentsAlias): Deleted.
1936         * dfg/DFGVariableAccessDataDump.cpp:
1937         (JSC::DFG::VariableAccessDataDump::dump):
1938         * dfg/DFGVariableAccessDataDump.h:
1939         * dfg/DFGVariableEventStream.cpp:
1940         (JSC::DFG::VariableEventStream::tryToSetConstantRecovery):
1941         * dfg/DFGVariableEventStream.h:
1942         * ftl/FTLAbstractHeap.cpp:
1943         (JSC::FTL::AbstractHeap::dump):
1944         (JSC::FTL::AbstractField::dump):
1945         (JSC::FTL::IndexedAbstractHeap::dump):
1946         (JSC::FTL::NumberedAbstractHeap::dump):
1947         (JSC::FTL::AbsoluteAbstractHeap::dump):
1948         * ftl/FTLAbstractHeap.h:
1949         * ftl/FTLAbstractHeapRepository.cpp:
1950         * ftl/FTLAbstractHeapRepository.h:
1951         * ftl/FTLCapabilities.cpp:
1952         (JSC::FTL::canCompile):
1953         * ftl/FTLCompile.cpp:
1954         (JSC::FTL::mmAllocateDataSection):
1955         * ftl/FTLExitArgument.cpp:
1956         (JSC::FTL::ExitArgument::dump):
1957         * ftl/FTLExitPropertyValue.cpp:
1958         (JSC::FTL::ExitPropertyValue::withLocalsOffset):
1959         * ftl/FTLExitPropertyValue.h:
1960         * ftl/FTLExitTimeObjectMaterialization.cpp:
1961         (JSC::FTL::ExitTimeObjectMaterialization::ExitTimeObjectMaterialization):
1962         (JSC::FTL::ExitTimeObjectMaterialization::accountForLocalsOffset):
1963         * ftl/FTLExitTimeObjectMaterialization.h:
1964         (JSC::FTL::ExitTimeObjectMaterialization::origin):
1965         * ftl/FTLExitValue.cpp:
1966         (JSC::FTL::ExitValue::withLocalsOffset):
1967         (JSC::FTL::ExitValue::valueFormat):
1968         (JSC::FTL::ExitValue::dumpInContext):
1969         * ftl/FTLExitValue.h:
1970         (JSC::FTL::ExitValue::isArgument):
1971         (JSC::FTL::ExitValue::argumentsObjectThatWasNotCreated): Deleted.
1972         (JSC::FTL::ExitValue::isArgumentsObjectThatWasNotCreated): Deleted.
1973         (JSC::FTL::ExitValue::valueFormat): Deleted.
1974         * ftl/FTLInlineCacheSize.cpp:
1975         (JSC::FTL::sizeOfCallForwardVarargs):
1976         (JSC::FTL::sizeOfConstructForwardVarargs):
1977         (JSC::FTL::sizeOfICFor):
1978         * ftl/FTLInlineCacheSize.h:
1979         * ftl/FTLIntrinsicRepository.h:
1980         * ftl/FTLJSCallVarargs.cpp:
1981         (JSC::FTL::JSCallVarargs::JSCallVarargs):
1982         (JSC::FTL::JSCallVarargs::emit):
1983         * ftl/FTLJSCallVarargs.h:
1984         * ftl/FTLLowerDFGToLLVM.cpp:
1985         (JSC::FTL::LowerDFGToLLVM::lower):
1986         (JSC::FTL::LowerDFGToLLVM::compileNode):
1987         (JSC::FTL::LowerDFGToLLVM::compilePutStack):
1988         (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
1989         (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
1990         (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
1991         (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
1992         (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
1993         (JSC::FTL::LowerDFGToLLVM::compileArrayPop):
1994         (JSC::FTL::LowerDFGToLLVM::compileCreateActivation):
1995         (JSC::FTL::LowerDFGToLLVM::compileNewFunction):
1996         (JSC::FTL::LowerDFGToLLVM::compileCreateDirectArguments):
1997         (JSC::FTL::LowerDFGToLLVM::compileCreateScopedArguments):
1998         (JSC::FTL::LowerDFGToLLVM::compileCreateClonedArguments):
1999         (JSC::FTL::LowerDFGToLLVM::compileStringCharAt):
2000         (JSC::FTL::LowerDFGToLLVM::compileStringCharCodeAt):
2001         (JSC::FTL::LowerDFGToLLVM::compileGetGlobalVar):
2002         (JSC::FTL::LowerDFGToLLVM::compilePutGlobalVar):
2003         (JSC::FTL::LowerDFGToLLVM::compileGetArgumentCount):
2004         (JSC::FTL::LowerDFGToLLVM::compileGetClosureVar):
2005         (JSC::FTL::LowerDFGToLLVM::compilePutClosureVar):
2006         (JSC::FTL::LowerDFGToLLVM::compileGetFromArguments):
2007         (JSC::FTL::LowerDFGToLLVM::compilePutToArguments):
2008         (JSC::FTL::LowerDFGToLLVM::compileCallOrConstructVarargs):
2009         (JSC::FTL::LowerDFGToLLVM::compileForwardVarargs):
2010         (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorPname):
2011         (JSC::FTL::LowerDFGToLLVM::ArgumentsLength::ArgumentsLength):
2012         (JSC::FTL::LowerDFGToLLVM::getArgumentsLength):
2013         (JSC::FTL::LowerDFGToLLVM::getCurrentCallee):
2014         (JSC::FTL::LowerDFGToLLVM::getArgumentsStart):
2015         (JSC::FTL::LowerDFGToLLVM::baseIndex):
2016         (JSC::FTL::LowerDFGToLLVM::allocateObject):
2017         (JSC::FTL::LowerDFGToLLVM::allocateVariableSizedObject):
2018         (JSC::FTL::LowerDFGToLLVM::isArrayType):
2019         (JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
2020         (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
2021         (JSC::FTL::LowerDFGToLLVM::exitValueForAvailability):
2022         (JSC::FTL::LowerDFGToLLVM::exitValueForNode):
2023         (JSC::FTL::LowerDFGToLLVM::loadStructure):
2024         (JSC::FTL::LowerDFGToLLVM::compilePhantomArguments): Deleted.
2025         (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength): Deleted.
2026         (JSC::FTL::LowerDFGToLLVM::compileGetClosureRegisters): Deleted.
2027         (JSC::FTL::LowerDFGToLLVM::compileCheckArgumentsNotCreated): Deleted.
2028         (JSC::FTL::LowerDFGToLLVM::checkArgumentsNotCreated): Deleted.
2029         * ftl/FTLOSRExitCompiler.cpp:
2030         (JSC::FTL::compileRecovery):
2031         (JSC::FTL::compileStub):
2032         * ftl/FTLOperations.cpp:
2033         (JSC::FTL::operationMaterializeObjectInOSR):
2034         * ftl/FTLOutput.h:
2035         (JSC::FTL::Output::aShr):
2036         (JSC::FTL::Output::lShr):
2037         (JSC::FTL::Output::zeroExtPtr):
2038         * heap/CopyToken.h:
2039         * interpreter/CallFrame.h:
2040         (JSC::ExecState::getArgumentUnsafe):
2041         * interpreter/Interpreter.cpp:
2042         (JSC::sizeOfVarargs):
2043         (JSC::sizeFrameForVarargs):
2044         (JSC::loadVarargs):
2045         (JSC::unwindCallFrame):
2046         * interpreter/Interpreter.h:
2047         * interpreter/StackVisitor.cpp:
2048         (JSC::StackVisitor::Frame::createArguments):
2049         (JSC::StackVisitor::Frame::existingArguments): Deleted.
2050         * interpreter/StackVisitor.h:
2051         * jit/AssemblyHelpers.h:
2052         (JSC::AssemblyHelpers::storeValue):
2053         (JSC::AssemblyHelpers::loadValue):
2054         (JSC::AssemblyHelpers::storeTrustedValue):
2055         (JSC::AssemblyHelpers::branchIfNotCell):
2056         (JSC::AssemblyHelpers::branchIsEmpty):
2057         (JSC::AssemblyHelpers::argumentsStart):
2058         (JSC::AssemblyHelpers::baselineArgumentsRegisterFor): Deleted.
2059         (JSC::AssemblyHelpers::offsetOfLocals): Deleted.
2060         (JSC::AssemblyHelpers::offsetOfArguments): Deleted.
2061         * jit/CCallHelpers.h:
2062         (JSC::CCallHelpers::setupArgument):
2063         * jit/GPRInfo.h:
2064         (JSC::JSValueRegs::withTwoAvailableRegs):
2065         * jit/JIT.cpp:
2066         (JSC::JIT::privateCompileMainPass):
2067         (JSC::JIT::privateCompileSlowCases):
2068         * jit/JIT.h:
2069         * jit/JITCall.cpp:
2070         (JSC::JIT::compileSetupVarargsFrame):
2071         * jit/JITCall32_64.cpp:
2072         (JSC::JIT::compileSetupVarargsFrame):
2073         * jit/JITInlines.h:
2074         (JSC::JIT::callOperation):
2075         * jit/JITOpcodes.cpp:
2076         (JSC::JIT::emit_op_create_lexical_environment):
2077         (JSC::JIT::emit_op_new_func):
2078         (JSC::JIT::emit_op_create_direct_arguments):
2079         (JSC::JIT::emit_op_create_scoped_arguments):
2080         (JSC::JIT::emit_op_create_out_of_band_arguments):
2081         (JSC::JIT::emit_op_tear_off_arguments): Deleted.
2082         (JSC::JIT::emit_op_create_arguments): Deleted.
2083         (JSC::JIT::emit_op_init_lazy_reg): Deleted.
2084         (JSC::JIT::emit_op_get_arguments_length): Deleted.
2085         (JSC::JIT::emitSlow_op_get_arguments_length): Deleted.
2086         (JSC::JIT::emit_op_get_argument_by_val): Deleted.
2087         (JSC::JIT::emitSlow_op_get_argument_by_val): Deleted.
2088         * jit/JITOpcodes32_64.cpp:
2089         (JSC::JIT::emit_op_create_lexical_environment):
2090         (JSC::JIT::emit_op_tear_off_arguments): Deleted.
2091         (JSC::JIT::emit_op_create_arguments): Deleted.
2092         (JSC::JIT::emit_op_init_lazy_reg): Deleted.
2093         (JSC::JIT::emit_op_get_arguments_length): Deleted.
2094         (JSC::JIT::emitSlow_op_get_arguments_length): Deleted.
2095         (JSC::JIT::emit_op_get_argument_by_val): Deleted.
2096         (JSC::JIT::emitSlow_op_get_argument_by_val): Deleted.
2097         * jit/JITOperations.cpp:
2098         * jit/JITOperations.h:
2099         * jit/JITPropertyAccess.cpp:
2100         (JSC::JIT::emitGetClosureVar):
2101         (JSC::JIT::emitPutClosureVar):
2102         (JSC::JIT::emit_op_get_from_arguments):
2103         (JSC::JIT::emit_op_put_to_arguments):
2104         (JSC::JIT::emit_op_init_global_const):
2105         (JSC::JIT::privateCompileGetByVal):
2106         (JSC::JIT::emitDirectArgumentsGetByVal):
2107         (JSC::JIT::emitScopedArgumentsGetByVal):
2108         * jit/JITPropertyAccess32_64.cpp:
2109         (JSC::JIT::emitGetClosureVar):
2110         (JSC::JIT::emitPutClosureVar):
2111         (JSC::JIT::emit_op_get_from_arguments):
2112         (JSC::JIT::emit_op_put_to_arguments):
2113         (JSC::JIT::emit_op_init_global_const):
2114         * jit/SetupVarargsFrame.cpp:
2115         (JSC::emitSetupVarargsFrameFastCase):
2116         * llint/LLIntOffsetsExtractor.cpp:
2117         * llint/LLIntSlowPaths.cpp:
2118         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2119         * llint/LowLevelInterpreter.asm:
2120         * llint/LowLevelInterpreter32_64.asm:
2121         * llint/LowLevelInterpreter64.asm:
2122         * parser/Nodes.h:
2123         (JSC::ScopeNode::captures):
2124         * runtime/Arguments.cpp: Removed.
2125         * runtime/Arguments.h: Removed.
2126         * runtime/ArgumentsMode.h: Added.
2127         * runtime/DirectArgumentsOffset.cpp: Added.
2128         (JSC::DirectArgumentsOffset::dump):
2129         * runtime/DirectArgumentsOffset.h: Added.
2130         (JSC::DirectArgumentsOffset::DirectArgumentsOffset):
2131         * runtime/CommonSlowPaths.cpp:
2132         (JSC::SLOW_PATH_DECL):
2133         * runtime/CommonSlowPaths.h:
2134         * runtime/ConstantMode.cpp: Added.
2135         (WTF::printInternal):
2136         * runtime/ConstantMode.h:
2137         (JSC::modeForIsConstant):
2138         * runtime/DirectArguments.cpp: Added.
2139         (JSC::DirectArguments::DirectArguments):
2140         (JSC::DirectArguments::createUninitialized):
2141         (JSC::DirectArguments::create):
2142         (JSC::DirectArguments::createByCopying):
2143         (JSC::DirectArguments::visitChildren):
2144         (JSC::DirectArguments::copyBackingStore):
2145         (JSC::DirectArguments::createStructure):
2146         (JSC::DirectArguments::overrideThings):
2147         (JSC::DirectArguments::overrideThingsIfNecessary):
2148         (JSC::DirectArguments::overrideArgument):
2149         (JSC::DirectArguments::copyToArguments):
2150         (JSC::DirectArguments::overridesSize):
2151         * runtime/DirectArguments.h: Added.
2152         (JSC::DirectArguments::internalLength):
2153         (JSC::DirectArguments::length):
2154         (JSC::DirectArguments::canAccessIndexQuickly):
2155         (JSC::DirectArguments::getIndexQuickly):
2156         (JSC::DirectArguments::setIndexQuickly):
2157         (JSC::DirectArguments::callee):
2158         (JSC::DirectArguments::argument):
2159         (JSC::DirectArguments::overrodeThings):
2160         (JSC::DirectArguments::offsetOfCallee):
2161         (JSC::DirectArguments::offsetOfLength):
2162         (JSC::DirectArguments::offsetOfMinCapacity):
2163         (JSC::DirectArguments::offsetOfOverrides):
2164         (JSC::DirectArguments::storageOffset):
2165         (JSC::DirectArguments::offsetOfSlot):
2166         (JSC::DirectArguments::allocationSize):
2167         (JSC::DirectArguments::storage):
2168         * runtime/FunctionPrototype.cpp:
2169         * runtime/GenericArguments.h: Added.
2170         (JSC::GenericArguments::GenericArguments):
2171         * runtime/GenericArgumentsInlines.h: Added.
2172         (JSC::GenericArguments<Type>::getOwnPropertySlot):
2173         (JSC::GenericArguments<Type>::getOwnPropertySlotByIndex):
2174         (JSC::GenericArguments<Type>::getOwnPropertyNames):
2175         (JSC::GenericArguments<Type>::put):
2176         (JSC::GenericArguments<Type>::putByIndex):
2177         (JSC::GenericArguments<Type>::deleteProperty):
2178         (JSC::GenericArguments<Type>::deletePropertyByIndex):
2179         (JSC::GenericArguments<Type>::defineOwnProperty):
2180         (JSC::GenericArguments<Type>::copyToArguments):
2181         * runtime/GenericOffset.h: Added.
2182         (JSC::GenericOffset::GenericOffset):
2183         (JSC::GenericOffset::operator!):
2184         (JSC::GenericOffset::offsetUnchecked):
2185         (JSC::GenericOffset::offset):
2186         (JSC::GenericOffset::operator==):
2187         (JSC::GenericOffset::operator!=):
2188         (JSC::GenericOffset::operator<):
2189         (JSC::GenericOffset::operator>):
2190         (JSC::GenericOffset::operator<=):
2191         (JSC::GenericOffset::operator>=):
2192         (JSC::GenericOffset::operator+):
2193         (JSC::GenericOffset::operator-):
2194         (JSC::GenericOffset::operator+=):
2195         (JSC::GenericOffset::operator-=):
2196         * runtime/JSArgumentsIterator.cpp:
2197         (JSC::JSArgumentsIterator::finishCreation):
2198         (JSC::argumentsFuncIterator):
2199         * runtime/JSArgumentsIterator.h:
2200         (JSC::JSArgumentsIterator::create):
2201         (JSC::JSArgumentsIterator::next):
2202         * runtime/JSEnvironmentRecord.cpp:
2203         (JSC::JSEnvironmentRecord::visitChildren):
2204         * runtime/JSEnvironmentRecord.h:
2205         (JSC::JSEnvironmentRecord::variables):
2206         (JSC::JSEnvironmentRecord::isValid):
2207         (JSC::JSEnvironmentRecord::variableAt):
2208         (JSC::JSEnvironmentRecord::offsetOfVariables):
2209         (JSC::JSEnvironmentRecord::offsetOfVariable):
2210         (JSC::JSEnvironmentRecord::allocationSizeForScopeSize):
2211         (JSC::JSEnvironmentRecord::allocationSize):
2212         (JSC::JSEnvironmentRecord::JSEnvironmentRecord):
2213         (JSC::JSEnvironmentRecord::finishCreationUninitialized):
2214         (JSC::JSEnvironmentRecord::finishCreation):
2215         (JSC::JSEnvironmentRecord::registers): Deleted.
2216         (JSC::JSEnvironmentRecord::registerAt): Deleted.
2217         (JSC::JSEnvironmentRecord::addressOfRegisters): Deleted.
2218         (JSC::JSEnvironmentRecord::offsetOfRegisters): Deleted.
2219         * runtime/JSFunction.cpp:
2220         * runtime/JSGlobalObject.cpp:
2221         (JSC::JSGlobalObject::init):
2222         (JSC::JSGlobalObject::addGlobalVar):
2223         (JSC::JSGlobalObject::addFunction):
2224         (JSC::JSGlobalObject::visitChildren):
2225         (JSC::JSGlobalObject::addStaticGlobals):
2226         * runtime/JSGlobalObject.h:
2227         (JSC::JSGlobalObject::directArgumentsStructure):
2228         (JSC::JSGlobalObject::scopedArgumentsStructure):
2229         (JSC::JSGlobalObject::outOfBandArgumentsStructure):
2230         (JSC::JSGlobalObject::argumentsStructure): Deleted.
2231         * runtime/JSLexicalEnvironment.cpp:
2232         (JSC::JSLexicalEnvironment::symbolTableGet):
2233         (JSC::JSLexicalEnvironment::symbolTablePut):
2234         (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
2235         (JSC::JSLexicalEnvironment::symbolTablePutWithAttributes):
2236         (JSC::JSLexicalEnvironment::visitChildren): Deleted.
2237         * runtime/JSLexicalEnvironment.h:
2238         (JSC::JSLexicalEnvironment::create):
2239         (JSC::JSLexicalEnvironment::JSLexicalEnvironment):
2240         (JSC::JSLexicalEnvironment::registersOffset): Deleted.
2241         (JSC::JSLexicalEnvironment::storageOffset): Deleted.
2242         (JSC::JSLexicalEnvironment::storage): Deleted.
2243         (JSC::JSLexicalEnvironment::allocationSize): Deleted.
2244         (JSC::JSLexicalEnvironment::isValidIndex): Deleted.
2245         (JSC::JSLexicalEnvironment::isValid): Deleted.
2246         (JSC::JSLexicalEnvironment::registerAt): Deleted.
2247         * runtime/JSNameScope.cpp:
2248         (JSC::JSNameScope::visitChildren): Deleted.
2249         * runtime/JSNameScope.h:
2250         (JSC::JSNameScope::create):
2251         (JSC::JSNameScope::value):
2252         (JSC::JSNameScope::finishCreation):
2253         (JSC::JSNameScope::JSNameScope):
2254         * runtime/JSScope.cpp:
2255         (JSC::abstractAccess):
2256         * runtime/JSSegmentedVariableObject.cpp:
2257         (JSC::JSSegmentedVariableObject::findVariableIndex):
2258         (JSC::JSSegmentedVariableObject::addVariables):
2259         (JSC::JSSegmentedVariableObject::visitChildren):
2260         (JSC::JSSegmentedVariableObject::findRegisterIndex): Deleted.
2261         (JSC::JSSegmentedVariableObject::addRegisters): Deleted.
2262         * runtime/JSSegmentedVariableObject.h:
2263         (JSC::JSSegmentedVariableObject::variableAt):
2264         (JSC::JSSegmentedVariableObject::assertVariableIsInThisObject):
2265         (JSC::JSSegmentedVariableObject::registerAt): Deleted.
2266         (JSC::JSSegmentedVariableObject::assertRegisterIsInThisObject): Deleted.
2267         * runtime/JSSymbolTableObject.h:
2268         (JSC::JSSymbolTableObject::offsetOfSymbolTable):
2269         (JSC::symbolTableGet):
2270         (JSC::symbolTablePut):
2271         (JSC::symbolTablePutWithAttributes):
2272         * runtime/JSType.h:
2273         * runtime/Options.h:
2274         * runtime/ClonedArguments.cpp: Added.
2275         (JSC::ClonedArguments::ClonedArguments):
2276         (JSC::ClonedArguments::createEmpty):
2277         (JSC::ClonedArguments::createWithInlineFrame):
2278         (JSC::ClonedArguments::createWithMachineFrame):
2279         (JSC::ClonedArguments::createByCopyingFrom):
2280         (JSC::ClonedArguments::createStructure):
2281         (JSC::ClonedArguments::getOwnPropertySlot):
2282         (JSC::ClonedArguments::getOwnPropertyNames):
2283         (JSC::ClonedArguments::put):
2284         (JSC::ClonedArguments::deleteProperty):
2285         (JSC::ClonedArguments::defineOwnProperty):
2286         (JSC::ClonedArguments::materializeSpecials):
2287         (JSC::ClonedArguments::materializeSpecialsIfNecessary):
2288         * runtime/ClonedArguments.h: Added.
2289         (JSC::ClonedArguments::specialsMaterialized):
2290         * runtime/ScopeOffset.cpp: Added.
2291         (JSC::ScopeOffset::dump):
2292         * runtime/ScopeOffset.h: Added.
2293         (JSC::ScopeOffset::ScopeOffset):
2294         * runtime/ScopedArguments.cpp: Added.
2295         (JSC::ScopedArguments::ScopedArguments):
2296         (JSC::ScopedArguments::finishCreation):
2297         (JSC::ScopedArguments::createUninitialized):
2298         (JSC::ScopedArguments::create):
2299         (JSC::ScopedArguments::createByCopying):
2300         (JSC::ScopedArguments::createByCopyingFrom):
2301         (JSC::ScopedArguments::visitChildren):
2302         (JSC::ScopedArguments::createStructure):
2303         (JSC::ScopedArguments::overrideThings):
2304         (JSC::ScopedArguments::overrideThingsIfNecessary):
2305         (JSC::ScopedArguments::overrideArgument):
2306         (JSC::ScopedArguments::copyToArguments):
2307         * runtime/ScopedArguments.h: Added.
2308         (JSC::ScopedArguments::internalLength):
2309         (JSC::ScopedArguments::length):
2310         (JSC::ScopedArguments::canAccessIndexQuickly):
2311         (JSC::ScopedArguments::getIndexQuickly):
2312         (JSC::ScopedArguments::setIndexQuickly):
2313         (JSC::ScopedArguments::callee):
2314         (JSC::ScopedArguments::overrodeThings):
2315         (JSC::ScopedArguments::offsetOfOverrodeThings):
2316         (JSC::ScopedArguments::offsetOfTotalLength):
2317         (JSC::ScopedArguments::offsetOfTable):
2318         (JSC::ScopedArguments::offsetOfScope):
2319         (JSC::ScopedArguments::overflowStorageOffset):
2320         (JSC::ScopedArguments::allocationSize):
2321         (JSC::ScopedArguments::overflowStorage):
2322         * runtime/ScopedArgumentsTable.cpp: Added.
2323         (JSC::ScopedArgumentsTable::ScopedArgumentsTable):
2324         (JSC::ScopedArgumentsTable::~ScopedArgumentsTable):
2325         (JSC::ScopedArgumentsTable::destroy):
2326         (JSC::ScopedArgumentsTable::create):
2327         (JSC::ScopedArgumentsTable::clone):
2328         (JSC::ScopedArgumentsTable::setLength):
2329         (JSC::ScopedArgumentsTable::set):
2330         (JSC::ScopedArgumentsTable::createStructure):
2331         * runtime/ScopedArgumentsTable.h: Added.
2332         (JSC::ScopedArgumentsTable::length):
2333         (JSC::ScopedArgumentsTable::get):
2334         (JSC::ScopedArgumentsTable::lock):
2335         (JSC::ScopedArgumentsTable::offsetOfLength):
2336         (JSC::ScopedArgumentsTable::offsetOfArguments):
2337         (JSC::ScopedArgumentsTable::at):
2338         * runtime/SymbolTable.cpp:
2339         (JSC::SymbolTableEntry::prepareToWatch):
2340         (JSC::SymbolTable::SymbolTable):
2341         (JSC::SymbolTable::visitChildren):
2342         (JSC::SymbolTable::localToEntry):
2343         (JSC::SymbolTable::entryFor):
2344         (JSC::SymbolTable::cloneScopePart):
2345         (JSC::SymbolTable::prepareForTypeProfiling):
2346         (JSC::SymbolTable::uniqueIDForOffset):
2347         (JSC::SymbolTable::globalTypeSetForOffset):
2348         (JSC::SymbolTable::cloneCapturedNames): Deleted.
2349         (JSC::SymbolTable::uniqueIDForRegister): Deleted.
2350         (JSC::SymbolTable::globalTypeSetForRegister): Deleted.
2351         * runtime/SymbolTable.h:
2352         (JSC::SymbolTableEntry::varOffsetFromBits):
2353         (JSC::SymbolTableEntry::scopeOffsetFromBits):
2354         (JSC::SymbolTableEntry::Fast::varOffset):
2355         (JSC::SymbolTableEntry::Fast::scopeOffset):
2356         (JSC::SymbolTableEntry::Fast::isDontEnum):
2357         (JSC::SymbolTableEntry::Fast::getAttributes):
2358         (JSC::SymbolTableEntry::SymbolTableEntry):
2359         (JSC::SymbolTableEntry::varOffset):
2360         (JSC::SymbolTableEntry::isWatchable):
2361         (JSC::SymbolTableEntry::scopeOffset):
2362         (JSC::SymbolTableEntry::setAttributes):
2363         (JSC::SymbolTableEntry::constantMode):
2364         (JSC::SymbolTableEntry::isDontEnum):
2365         (JSC::SymbolTableEntry::disableWatching):
2366         (JSC::SymbolTableEntry::pack):
2367         (JSC::SymbolTableEntry::isValidVarOffset):
2368         (JSC::SymbolTable::createNameScopeTable):
2369         (JSC::SymbolTable::maxScopeOffset):
2370         (JSC::SymbolTable::didUseScopeOffset):
2371         (JSC::SymbolTable::didUseVarOffset):
2372         (JSC::SymbolTable::scopeSize):
2373         (JSC::SymbolTable::nextScopeOffset):
2374         (JSC::SymbolTable::takeNextScopeOffset):
2375         (JSC::SymbolTable::add):
2376         (JSC::SymbolTable::set):
2377         (JSC::SymbolTable::argumentsLength):
2378         (JSC::SymbolTable::setArgumentsLength):
2379         (JSC::SymbolTable::argumentOffset):
2380         (JSC::SymbolTable::setArgumentOffset):
2381         (JSC::SymbolTable::arguments):
2382         (JSC::SlowArgument::SlowArgument): Deleted.
2383         (JSC::SymbolTableEntry::Fast::getIndex): Deleted.
2384         (JSC::SymbolTableEntry::getIndex): Deleted.
2385         (JSC::SymbolTableEntry::isValidIndex): Deleted.
2386         (JSC::SymbolTable::captureStart): Deleted.
2387         (JSC::SymbolTable::setCaptureStart): Deleted.
2388         (JSC::SymbolTable::captureEnd): Deleted.
2389         (JSC::SymbolTable::setCaptureEnd): Deleted.
2390         (JSC::SymbolTable::captureCount): Deleted.
2391         (JSC::SymbolTable::isCaptured): Deleted.
2392         (JSC::SymbolTable::parameterCount): Deleted.
2393         (JSC::SymbolTable::parameterCountIncludingThis): Deleted.
2394         (JSC::SymbolTable::setParameterCountIncludingThis): Deleted.
2395         (JSC::SymbolTable::slowArguments): Deleted.
2396         (JSC::SymbolTable::setSlowArguments): Deleted.
2397         * runtime/VM.cpp:
2398         (JSC::VM::VM):
2399         * runtime/VM.h:
2400         * runtime/VarOffset.cpp: Added.
2401         (JSC::VarOffset::dump):
2402         (WTF::printInternal):
2403         * runtime/VarOffset.h: Added.
2404         (JSC::VarOffset::VarOffset):
2405         (JSC::VarOffset::assemble):
2406         (JSC::VarOffset::isValid):
2407         (JSC::VarOffset::operator!):
2408         (JSC::VarOffset::kind):
2409         (JSC::VarOffset::isStack):
2410         (JSC::VarOffset::isScope):
2411         (JSC::VarOffset::isDirectArgument):
2412         (JSC::VarOffset::stackOffsetUnchecked):
2413         (JSC::VarOffset::scopeOffsetUnchecked):
2414         (JSC::VarOffset::capturedArgumentsOffsetUnchecked):
2415         (JSC::VarOffset::stackOffset):
2416         (JSC::VarOffset::scopeOffset):
2417         (JSC::VarOffset::capturedArgumentsOffset):
2418         (JSC::VarOffset::rawOffset):
2419         (JSC::VarOffset::checkSanity):
2420         (JSC::VarOffset::operator==):
2421         (JSC::VarOffset::operator!=):
2422         (JSC::VarOffset::hash):
2423         (JSC::VarOffset::isHashTableDeletedValue):
2424         (JSC::VarOffsetHash::hash):
2425         (JSC::VarOffsetHash::equal):
2426         * tests/stress/arguments-exit-strict-mode.js: Added.
2427         * tests/stress/arguments-exit.js: Added.
2428         * tests/stress/arguments-inlined-exit-strict-mode-fixed.js: Added.
2429         * tests/stress/arguments-inlined-exit-strict-mode.js: Added.
2430         * tests/stress/arguments-inlined-exit.js: Added.
2431         * tests/stress/arguments-interference.js: Added.
2432         * tests/stress/arguments-interference-cfg.js: Added.
2433         * tests/stress/dead-get-closure-var.js: Added.
2434         * tests/stress/get-declared-unpassed-argument-in-direct-arguments.js: Added.
2435         * tests/stress/get-declared-unpassed-argument-in-scoped-arguments.js: Added.
2436         * tests/stress/varargs-closure-inlined-exit-strict-mode.js: Added.
2437         * tests/stress/varargs-closure-inlined-exit.js: Added.
2438         * tests/stress/varargs-exit.js: Added.
2439         * tests/stress/varargs-inlined-exit.js: Added.
2440         * tests/stress/varargs-inlined-simple-exit-aliasing-weird-reversed-args.js: Added.
2441         * tests/stress/varargs-inlined-simple-exit-aliasing-weird.js: Added.
2442         * tests/stress/varargs-inlined-simple-exit-aliasing.js: Added.
2443         * tests/stress/varargs-inlined-simple-exit.js: Added.
2444         * tests/stress/varargs-too-few-arguments.js: Added.
2445         * tests/stress/varargs-varargs-closure-inlined-exit.js: Added.
2446         * tests/stress/varargs-varargs-inlined-exit-strict-mode.js: Added.
2447         * tests/stress/varargs-varargs-inlined-exit.js: Added.
2448
2449 2015-03-25  Andy Estes  <aestes@apple.com>
2450
2451         [Cocoa] RemoteInspectorXPCConnection::deserializeMessage() leaks a NSDictionary under Objective-C GC
2452         https://bugs.webkit.org/show_bug.cgi?id=143068
2453
2454         Reviewed by Dan Bernstein.
2455
2456         * inspector/remote/RemoteInspectorXPCConnection.mm:
2457         (Inspector::RemoteInspectorXPCConnection::deserializeMessage): Used RetainPtr::autorelease(), which does the right thing under GC.
2458
2459 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
2460
2461         Use JITCompilationCanFail in more places, and make the fail path of JITCompilationMustSucceed a crash instead of attempting GC
2462         https://bugs.webkit.org/show_bug.cgi?id=142993
2463
2464         Reviewed by Geoffrey Garen and Mark Lam.
2465
2466         This changes the most commonly invoked paths that relied on JITCompilationMustSucceed
2467         into using JITCompilationCanFail and having a legit fallback path. This mostly involves
2468         having the FTL JIT do the same trick as the DFG JIT in case of any memory allocation
2469         failure, but also involves adding the same kind of thing to the stub generators in
2470         Repatch.
2471
2472         Because of that change, there are relatively few uses of JITCompilationMustSucceed. Most
2473         of those uses cannot handle a GC, and so cannot do releaseExecutableMemory(). Only a few,
2474         like host call stub generation, could handle a GC, but those get invoked very rarely. So,
2475         this patch changes the releaseExecutableMemory() call into a crash with some diagnostic
2476         printout.
2477
2478         Also add a way of inducing executable allocation failure, so that we can test this.
2479
2480         * CMakeLists.txt:
2481         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2482         * JavaScriptCore.xcodeproj/project.pbxproj:
2483         * dfg/DFGJITCompiler.cpp:
2484         (JSC::DFG::JITCompiler::compile):
2485         (JSC::DFG::JITCompiler::compileFunction):
2486         (JSC::DFG::JITCompiler::link): Deleted.
2487         (JSC::DFG::JITCompiler::linkFunction): Deleted.
2488         * dfg/DFGJITCompiler.h:
2489         * dfg/DFGPlan.cpp:
2490         (JSC::DFG::Plan::compileInThreadImpl):
2491         * ftl/FTLCompile.cpp:
2492         (JSC::FTL::mmAllocateCodeSection):
2493         (JSC::FTL::mmAllocateDataSection):
2494         * ftl/FTLLink.cpp:
2495         (JSC::FTL::link):
2496         * ftl/FTLState.h:
2497         * jit/ArityCheckFailReturnThunks.cpp:
2498         (JSC::ArityCheckFailReturnThunks::returnPCsFor):
2499         * jit/ExecutableAllocationFuzz.cpp: Added.
2500         (JSC::numberOfExecutableAllocationFuzzChecks):
2501         (JSC::doExecutableAllocationFuzzing):
2502         * jit/ExecutableAllocationFuzz.h: Added.
2503         (JSC::doExecutableAllocationFuzzingIfEnabled):
2504         * jit/ExecutableAllocatorFixedVMPool.cpp:
2505         (JSC::ExecutableAllocator::allocate):
2506         * jit/JIT.cpp:
2507         (JSC::JIT::privateCompile):
2508         * jit/JITCompilationEffort.h:
2509         * jit/Repatch.cpp:
2510         (JSC::generateByIdStub):
2511         (JSC::tryCacheGetByID):
2512         (JSC::tryBuildGetByIDList):
2513         (JSC::emitPutReplaceStub):
2514         (JSC::emitPutTransitionStubAndGetOldStructure):
2515         (JSC::tryCachePutByID):
2516         (JSC::tryBuildPutByIdList):
2517         (JSC::tryRepatchIn):
2518         (JSC::linkPolymorphicCall):
2519         * jsc.cpp:
2520         (jscmain):
2521         * runtime/Options.h:
2522         * runtime/TestRunnerUtils.h:
2523         * runtime/VM.cpp:
2524         * tests/executableAllocationFuzz: Added.
2525         * tests/executableAllocationFuzz.yaml: Added.
2526         * tests/executableAllocationFuzz/v8-raytrace.js: Added.
2527
2528 2015-03-25  Mark Lam  <mark.lam@apple.com>
2529
2530         REGRESSION(169139): LLINT intermittently fails JSC testapi tests.
2531         <https://webkit.org/b/135719>
2532
2533         Reviewed by Geoffrey Garen.
2534
2535         This is a regression introduced in http://trac.webkit.org/changeset/169139 which
2536         changed VM::watchdog from an embedded field into a std::unique_ptr, but did not
2537         update the LLINT to access it as such.
2538
2539         The issue has only manifested so far on the CLoop tests because those are LLINT
2540         only.  In the non-CLoop cases, the JIT kicks in and does the right thing, thereby
2541         hiding the bug in the LLINT.
2542
2543         * API/JSContextRef.cpp:
2544         (createWatchdogIfNeeded):
2545         (JSContextGroupSetExecutionTimeLimit):
2546         (JSContextGroupClearExecutionTimeLimit):
2547         * llint/LowLevelInterpreter.asm:
2548
2549 2015-03-25  Filip Pizlo  <fpizlo@apple.com>
2550
2551         Change Atomic methods from using the_wrong_naming_conventions to using theRightNamingConventions. Also make seq_cst the default.
2552
2553         Rubber stamped by Geoffrey Garen.
2554
2555         * bytecode/CodeBlock.cpp:
2556         (JSC::CodeBlock::visitAggregate):
2557
2558 2015-03-25  Joseph Pecoraro  <pecoraro@apple.com>
2559
2560         Fix formatting in BuiltinExecutables
2561         https://bugs.webkit.org/show_bug.cgi?id=143061
2562
2563         Reviewed by Ryosuke Niwa.
2564
2565         * builtins/BuiltinExecutables.cpp:
2566         (JSC::BuiltinExecutables::createExecutableInternal):
2567
2568 2015-03-25  Joseph Pecoraro  <pecoraro@apple.com>
2569
2570         ES6: Classes: Program level class statement throws exception in strict mode
2571         https://bugs.webkit.org/show_bug.cgi?id=143038
2572
2573         Reviewed by Ryosuke Niwa.
2574
2575         Classes expose a name to the current lexical environment. This treats
2576         "class X {}" like "var X = class X {}". Ideally it would be "let X = class X {}".
2577         Also, improve error messages for class statements where the class is missing a name.
2578
2579         * parser/Parser.h:
2580         * parser/Parser.cpp:
2581         (JSC::Parser<LexerType>::parseClass):
2582         Fill name in info parameter if needed. Better error message if name is needed and missing.
2583
2584         (JSC::Parser<LexerType>::parseClassDeclaration):
2585         Pass info parameter to get name, and expose the name as a variable name.
2586
2587         (JSC::Parser<LexerType>::parsePrimaryExpression):
2588         Pass info parameter that is ignored.
2589
2590         * parser/ParserFunctionInfo.h:
2591         Add a parser info for class, to extract the name.
2592
2593 2015-03-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2594
2595         New map and set modification tests in r181922 fails
2596         https://bugs.webkit.org/show_bug.cgi?id=143031
2597
2598         Reviewed and tweaked by Geoffrey Garen.
2599
2600         When packing Map/Set backing store, we need to decrement Map/Set iterator's m_index
2601         to adjust for the packed backing store.
2602
2603         Consider the following map data.
2604
2605         x: deleted, o: exists
2606         0 1 2 3 4
2607         x x x x o
2608
2609         And iterator with m_index 3.
2610
2611         When packing the map data, map data will become,
2612
2613         0
2614         o
2615
2616         At that time, we perfom didRemoveEntry 4 times on iterators.
2617         times => m_index/index/result
2618         1 => 3/0/dec
2619         2 => 2/1/dec
2620         3 => 1/2/nothing
2621         4 => 1/3/nothing
2622
2623         After iteration, iterator's m_index becomes 1. But we expected that becomes 0.
2624         This is because if we use decremented m_index for comparison,
2625         while provided deletedIndex is the index in old storage, m_index is the index in partially packed storage.
2626
2627         In this patch, we compare against the packed index instead.
2628         times => m_index/packedIndex/result
2629         1 => 3/0/dec
2630         2 => 2/0/dec
2631         3 => 1/0/dec
2632         4 => 0/0/nothing
2633
2634         So m_index becomes 0 as expected.
2635
2636         And according to the spec, once the iterator is closed (becomes done: true),
2637         its internal [[Map]]/[[Set]] is set to undefined.
2638         So after the iterator is finished, we don't revive the iterator (e.g. by clearing m_index = 0).
2639
2640         In this patch, we change 2 things.
2641         1.
2642         Compare an iterator's index against the packed index when removing an entry.
2643
2644         2.
2645         If the iterator is closed (isFinished()), we don't apply adjustment to the iterator.
2646
2647         * runtime/MapData.h:
2648         (JSC::MapDataImpl::IteratorData::finish):
2649         (JSC::MapDataImpl::IteratorData::isFinished):
2650         (JSC::MapDataImpl::IteratorData::didRemoveEntry):
2651         (JSC::MapDataImpl::IteratorData::didRemoveAllEntries):
2652         (JSC::MapDataImpl::IteratorData::startPackBackingStore):
2653         * runtime/MapDataInlines.h:
2654         (JSC::JSIterator>::replaceAndPackBackingStore):
2655         * tests/stress/modify-map-during-iteration.js:
2656         * tests/stress/modify-set-during-iteration.js:
2657
2658 2015-03-24  Joseph Pecoraro  <pecoraro@apple.com>
2659
2660         Setter should have a single formal parameter, Getter no parameters
2661         https://bugs.webkit.org/show_bug.cgi?id=142903
2662
2663         Reviewed by Geoffrey Garen.
2664
2665         * parser/Parser.cpp:
2666         (JSC::Parser<LexerType>::parseFunctionInfo):
2667         Enforce no parameters for getters and a single parameter
2668         for setters, with informational error messages.
2669
2670 2015-03-24  Joseph Pecoraro  <pecoraro@apple.com>
2671
2672         ES6: Classes: Early return in sub-class constructor results in returning undefined instead of instance
2673         https://bugs.webkit.org/show_bug.cgi?id=143012
2674
2675         Reviewed by Ryosuke Niwa.
2676
2677         * bytecompiler/BytecodeGenerator.cpp:
2678         (JSC::BytecodeGenerator::emitReturn):
2679         Fix handling of "undefined" when returned from a Derived class. It was
2680         returning "undefined" when it should have returned "this".
2681
2682 2015-03-24  Yusuke Suzuki  <utatane.tea@gmail.com>
2683
2684         REGRESSION (r181458): Heap use-after-free in JSSetIterator destructor
2685         https://bugs.webkit.org/show_bug.cgi?id=142696
2686
2687         Reviewed and tweaked by Geoffrey Garen.
2688
2689         Before r142556, JSSetIterator::destroy was not defined.
2690         So accidentally MapData::const_iterator in JSSet was never destroyed.
2691         But it had non trivial destructor, decrementing MapData->m_iteratorCount.
2692
2693         After r142556, JSSetIterator::destroy works.
2694         It correctly destruct MapData::const_iterator and m_iteratorCount partially works.
2695         But JSSetIterator::~JSSetIterator requires owned JSSet since it mutates MapData->m_iteratorCount.
2696
2697         It is guaranteed that JSSet is live since JSSetIterator has a reference to JSSet
2698         and marks it in visitChildren (WriteBarrier<Unknown>).
2699         However, the order of destructions is not guaranteed in GC-ed system.
2700
2701         Consider the following case,
2702         allocate JSSet and subsequently allocate JSSetIterator.
2703         And they resides in the separated MarkedBlock, <1> and <2>.
2704
2705         JSSet<1> <- JSSetIterator<2>
2706
2707         And after that, when performing GC, Marker decides that the above 2 objects are not marked.
2708         And Marker also decides MarkedBlocks <1> and <2> can be sweeped.
2709
2710         First Sweeper sweep <1>, destruct JSSet<1> and free MarkedBlock<1>.
2711         Second Sweeper sweep <2>, attempt to destruct JSSetIterator<2>.
2712         However, JSSetIterator<2>'s destructor,
2713         JSSetIterator::~JSSetIterator requires live JSSet<1>, it causes use-after-free.
2714
2715         In this patch, we introduce WeakGCMap into JSMap/JSSet to track live iterators.
2716         When packing the removed elements in JSSet/JSMap, we apply the change to all live
2717         iterators tracked by WeakGCMap.
2718
2719         WeakGCMap can only track JSCell since they are managed by GC.
2720         So we drop JSSet/JSMap C++ style iterators. Instead of C++ style iterator, this patch
2721         introduces JS style iterator signatures into C++ class IteratorData.
2722         If we need to iterate over JSMap/JSSet, use JSSetIterator/JSMapIterator instead of using
2723         IteratorData directly.
2724
2725         * runtime/JSMap.cpp:
2726         (JSC::JSMap::destroy):
2727         * runtime/JSMap.h:
2728         (JSC::JSMap::JSMap):
2729         (JSC::JSMap::begin): Deleted.
2730         (JSC::JSMap::end): Deleted.
2731         * runtime/JSMapIterator.cpp:
2732         (JSC::JSMapIterator::destroy):
2733         * runtime/JSMapIterator.h:
2734         (JSC::JSMapIterator::next):
2735         (JSC::JSMapIterator::nextKeyValue):
2736         (JSC::JSMapIterator::iteratorData):
2737         (JSC::JSMapIterator::JSMapIterator):
2738         * runtime/JSSet.cpp:
2739         (JSC::JSSet::destroy):
2740         * runtime/JSSet.h:
2741         (JSC::JSSet::JSSet):
2742         (JSC::JSSet::begin): Deleted.
2743         (JSC::JSSet::end): Deleted.
2744         * runtime/JSSetIterator.cpp:
2745         (JSC::JSSetIterator::destroy):
2746         * runtime/JSSetIterator.h:
2747         (JSC::JSSetIterator::next):
2748         (JSC::JSSetIterator::iteratorData):
2749         (JSC::JSSetIterator::JSSetIterator):
2750         * runtime/MapData.h:
2751         (JSC::MapDataImpl::IteratorData::finish):
2752         (JSC::MapDataImpl::IteratorData::isFinished):
2753         (JSC::MapDataImpl::shouldPack):
2754         (JSC::JSIterator>::MapDataImpl):
2755         (JSC::JSIterator>::KeyType::KeyType):
2756         (JSC::JSIterator>::IteratorData::IteratorData):
2757         (JSC::JSIterator>::IteratorData::next):
2758         (JSC::JSIterator>::IteratorData::ensureSlot):
2759         (JSC::JSIterator>::IteratorData::applyMapDataPatch):
2760         (JSC::JSIterator>::IteratorData::refreshCursor):
2761         (JSC::MapDataImpl::const_iterator::key): Deleted.
2762         (JSC::MapDataImpl::const_iterator::value): Deleted.
2763         (JSC::MapDataImpl::const_iterator::operator++): Deleted.
2764         (JSC::MapDataImpl::const_iterator::finish): Deleted.
2765         (JSC::MapDataImpl::const_iterator::atEnd): Deleted.
2766         (JSC::MapDataImpl::begin): Deleted.
2767         (JSC::MapDataImpl::end): Deleted.
2768         (JSC::MapDataImpl<Entry>::MapDataImpl): Deleted.
2769         (JSC::MapDataImpl<Entry>::clear): Deleted.
2770         (JSC::MapDataImpl<Entry>::KeyType::KeyType): Deleted.
2771         (JSC::MapDataImpl<Entry>::const_iterator::internalIncrement): Deleted.
2772         (JSC::MapDataImpl<Entry>::const_iterator::ensureSlot): Deleted.
2773         (JSC::MapDataImpl<Entry>::const_iterator::const_iterator): Deleted.
2774         (JSC::MapDataImpl<Entry>::const_iterator::~const_iterator): Deleted.
2775         (JSC::MapDataImpl<Entry>::const_iterator::operator): Deleted.
2776         (JSC::=): Deleted.
2777         * runtime/MapDataInlines.h:
2778         (JSC::JSIterator>::clear):
2779         (JSC::JSIterator>::find):
2780         (JSC::JSIterator>::contains):
2781         (JSC::JSIterator>::add):
2782         (JSC::JSIterator>::set):
2783         (JSC::JSIterator>::get):
2784         (JSC::JSIterator>::remove):
2785         (JSC::JSIterator>::replaceAndPackBackingStore):
2786         (JSC::JSIterator>::replaceBackingStore):
2787         (JSC::JSIterator>::ensureSpaceForAppend):
2788         (JSC::JSIterator>::visitChildren):
2789         (JSC::JSIterator>::copyBackingStore):
2790         (JSC::JSIterator>::applyMapDataPatch):
2791         (JSC::MapDataImpl<Entry>::find): Deleted.
2792         (JSC::MapDataImpl<Entry>::contains): Deleted.
2793         (JSC::MapDataImpl<Entry>::add): Deleted.
2794         (JSC::MapDataImpl<Entry>::set): Deleted.
2795         (JSC::MapDataImpl<Entry>::get): Deleted.
2796         (JSC::MapDataImpl<Entry>::remove): Deleted.
2797         (JSC::MapDataImpl<Entry>::replaceAndPackBackingStore): Deleted.
2798         (JSC::MapDataImpl<Entry>::replaceBackingStore): Deleted.
2799         (JSC::MapDataImpl<Entry>::ensureSpaceForAppend): Deleted.
2800         (JSC::MapDataImpl<Entry>::visitChildren): Deleted.
2801         (JSC::MapDataImpl<Entry>::copyBackingStore): Deleted.
2802         * runtime/MapPrototype.cpp:
2803         (JSC::mapProtoFuncForEach):
2804         * runtime/SetPrototype.cpp:
2805         (JSC::setProtoFuncForEach):
2806         * runtime/WeakGCMap.h:
2807         (JSC::WeakGCMap::forEach):
2808         * tests/stress/modify-map-during-iteration.js: Added.
2809         (testValue):
2810         (identityPairs):
2811         (.set if):
2812         (var):
2813         (set map):
2814         * tests/stress/modify-set-during-iteration.js: Added.
2815         (testValue):
2816         (set forEach):
2817         (set delete):
2818
2819 2015-03-24  Mark Lam  <mark.lam@apple.com>
2820
2821         The ExecutionTimeLimit test should use its own JSGlobalContextRef.
2822         <https://webkit.org/b/143024>
2823
2824         Reviewed by Geoffrey Garen.
2825
2826         Currently, the ExecutionTimeLimit test is using a JSGlobalContextRef
2827         passed in from testapi.c.  It should create its own for better
2828         encapsulation of the test.
2829
2830         * API/tests/ExecutionTimeLimitTest.cpp:
2831         (currentCPUTimeAsJSFunctionCallback):
2832         (testExecutionTimeLimit):
2833         * API/tests/ExecutionTimeLimitTest.h:
2834         * API/tests/testapi.c:
2835         (main):
2836
2837 2015-03-24  Joseph Pecoraro  <pecoraro@apple.com>
2838
2839         ES6: Object Literal Methods toString is missing method name
2840         https://bugs.webkit.org/show_bug.cgi?id=142992
2841
2842         Reviewed by Geoffrey Garen.
2843
2844         Always stringify functions in the pattern:
2845
2846           "function " + <function name> + <text from opening parenthesis to closing brace>.
2847
2848         * runtime/FunctionPrototype.cpp:
2849         (JSC::functionProtoFuncToString):
2850         Update the path that was not stringifying in this pattern.
2851
2852         * bytecode/UnlinkedCodeBlock.cpp:
2853         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
2854         * bytecode/UnlinkedCodeBlock.h:
2855         (JSC::UnlinkedFunctionExecutable::parametersStartOffset):
2856         * parser/Nodes.h:
2857         * runtime/Executable.cpp:
2858         (JSC::FunctionExecutable::FunctionExecutable):
2859         * runtime/Executable.h:
2860         (JSC::FunctionExecutable::parametersStartOffset):
2861         Pass the already known function parameter opening parenthesis
2862         start offset through to the FunctionExecutable.
2863
2864         * tests/mozilla/js1_5/Scope/regress-185485.js:
2865         (with.g):
2866         Add back original space in this test that was removed by r181810
2867         now that we have the space again in stringification.
2868
2869 2015-03-24  Michael Saboff  <msaboff@apple.com>
2870
2871         REGRESSION (172175-172177): Change in for...in processing causes properties added in loop to be enumerated
2872         https://bugs.webkit.org/show_bug.cgi?id=142856
2873
2874         Reviewed by Filip Pizlo.
2875
2876         Refactored the way the for .. in enumeration over objects is done.  We used to make three C++ calls to
2877         get info for three loops to iterate over indexed properties, structure properties and other properties,
2878         respectively.  We still have the three loops, but now we make one C++ call to get all the info needed
2879         for all loops before we exectue any enumeration.
2880
2881         The JSPropertyEnumerator has a count of the indexed properties and a list of named properties.
2882         The named properties are one list, with structured properties in the range [0,m_endStructurePropertyIndex)
2883         and the generic properties in the range [m_endStructurePropertyIndex, m_endGenericPropertyIndex);
2884
2885         Eliminated the bytecodes op_get_structure_property_enumerator, op_get_generic_property_enumerator and
2886         op_next_enumerator_pname.
2887         Added the bytecodes op_get_property_enumerator, op_enumerator_structure_pname and op_enumerator_generic_pname.
2888         The bytecodes op_enumerator_structure_pname and op_enumerator_generic_pname are similar except for what
2889         end value we stop iterating on.
2890
2891         Made corresponding node changes to the DFG and FTL for the bytecode changes.
2892
2893         * bytecode/BytecodeList.json:
2894         * bytecode/BytecodeUseDef.h:
2895         (JSC::computeUsesForBytecodeOffset):
2896         (JSC::computeDefsForBytecodeOffset):
2897         * bytecode/CodeBlock.cpp:
2898         (JSC::CodeBlock::dumpBytecode):
2899         * bytecompiler/BytecodeGenerator.cpp:
2900         (JSC::BytecodeGenerator::emitGetPropertyEnumerator):
2901         (JSC::BytecodeGenerator::emitEnumeratorStructurePropertyName):
2902         (JSC::BytecodeGenerator::emitEnumeratorGenericPropertyName):
2903         (JSC::BytecodeGenerator::emitGetStructurePropertyEnumerator): Deleted.
2904         (JSC::BytecodeGenerator::emitGetGenericPropertyEnumerator): Deleted.
2905         (JSC::BytecodeGenerator::emitNextEnumeratorPropertyName): Deleted.
2906         * bytecompiler/BytecodeGenerator.h:
2907         * bytecompiler/NodesCodegen.cpp:
2908         (JSC::ForInNode::emitMultiLoopBytecode):
2909         * dfg/DFGAbstractInterpreterInlines.h:
2910         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2911         * dfg/DFGByteCodeParser.cpp:
2912         (JSC::DFG::ByteCodeParser::parseBlock):
2913         * dfg/DFGCapabilities.cpp:
2914         (JSC::DFG::capabilityLevel):
2915         * dfg/DFGClobberize.h:
2916         (JSC::DFG::clobberize):
2917         * dfg/DFGDoesGC.cpp:
2918         (JSC::DFG::doesGC):
2919         * dfg/DFGFixupPhase.cpp:
2920         (JSC::DFG::FixupPhase::fixupNode):
2921         * dfg/DFGNodeType.h:
2922         * dfg/DFGPredictionPropagationPhase.cpp:
2923         (JSC::DFG::PredictionPropagationPhase::propagate):
2924         * dfg/DFGSafeToExecute.h:
2925         (JSC::DFG::safeToExecute):
2926         * dfg/DFGSpeculativeJIT32_64.cpp:
2927         (JSC::DFG::SpeculativeJIT::compile):
2928         * dfg/DFGSpeculativeJIT64.cpp:
2929         (JSC::DFG::SpeculativeJIT::compile):
2930         * ftl/FTLAbstractHeapRepository.h:
2931         * ftl/FTLCapabilities.cpp:
2932         (JSC::FTL::canCompile):
2933         * ftl/FTLLowerDFGToLLVM.cpp:
2934         (JSC::FTL::LowerDFGToLLVM::compileNode):
2935         (JSC::FTL::LowerDFGToLLVM::compileGetEnumerableLength):
2936         (JSC::FTL::LowerDFGToLLVM::compileGetPropertyEnumerator):
2937         (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorStructurePname):
2938         (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorGenericPname):
2939         (JSC::FTL::LowerDFGToLLVM::compileGetStructurePropertyEnumerator): Deleted.
2940         (JSC::FTL::LowerDFGToLLVM::compileGetGenericPropertyEnumerator): Deleted.
2941         (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorPname): Deleted.
2942         * jit/JIT.cpp:
2943         (JSC::JIT::privateCompileMainPass):
2944         * jit/JIT.h:
2945         * jit/JITOpcodes.cpp:
2946         (JSC::JIT::emit_op_enumerator_structure_pname):
2947         (JSC::JIT::emit_op_enumerator_generic_pname):
2948         (JSC::JIT::emit_op_get_property_enumerator):
2949         (JSC::JIT::emit_op_next_enumerator_pname): Deleted.
2950         (JSC::JIT::emit_op_get_structure_property_enumerator): Deleted.
2951         (JSC::JIT::emit_op_get_generic_property_enumerator): Deleted.
2952         * jit/JITOpcodes32_64.cpp:
2953         (JSC::JIT::emit_op_enumerator_structure_pname):
2954         (JSC::JIT::emit_op_enumerator_generic_pname):
2955         (JSC::JIT::emit_op_next_enumerator_pname): Deleted.
2956         * jit/JITOperations.cpp:
2957         * jit/JITOperations.h:
2958         * llint/LowLevelInterpreter.asm:
2959         * runtime/CommonSlowPaths.cpp:
2960         (JSC::SLOW_PATH_DECL):
2961         * runtime/CommonSlowPaths.h:
2962         * runtime/JSPropertyNameEnumerator.cpp:
2963         (JSC::JSPropertyNameEnumerator::create):
2964         (JSC::JSPropertyNameEnumerator::finishCreation):
2965         * runtime/JSPropertyNameEnumerator.h:
2966         (JSC::JSPropertyNameEnumerator::indexedLength):
2967         (JSC::JSPropertyNameEnumerator::endStructurePropertyIndex):
2968         (JSC::JSPropertyNameEnumerator::endGenericPropertyIndex):
2969         (JSC::JSPropertyNameEnumerator::indexedLengthOffset):
2970         (JSC::JSPropertyNameEnumerator::endStructurePropertyIndexOffset):
2971         (JSC::JSPropertyNameEnumerator::endGenericPropertyIndexOffset):
2972         (JSC::JSPropertyNameEnumerator::cachedInlineCapacityOffset):
2973         (JSC::propertyNameEnumerator):
2974         (JSC::JSPropertyNameEnumerator::cachedPropertyNamesLengthOffset): Deleted.
2975         (JSC::structurePropertyNameEnumerator): Deleted.
2976         (JSC::genericPropertyNameEnumerator): Deleted.
2977         * runtime/Structure.cpp:
2978         (JSC::Structure::setCachedPropertyNameEnumerator):
2979         (JSC::Structure::cachedPropertyNameEnumerator):
2980         (JSC::Structure::canCachePropertyNameEnumerator):
2981         (JSC::Structure::setCachedStructurePropertyNameEnumerator): Deleted.
2982         (JSC::Structure::cachedStructurePropertyNameEnumerator): Deleted.
2983         (JSC::Structure::setCachedGenericPropertyNameEnumerator): Deleted.
2984         (JSC::Structure::cachedGenericPropertyNameEnumerator): Deleted.
2985         (JSC::Structure::canCacheStructurePropertyNameEnumerator): Deleted.
2986         (JSC::Structure::canCacheGenericPropertyNameEnumerator): Deleted.
2987         * runtime/Structure.h:
2988         * runtime/StructureRareData.cpp:
2989         (JSC::StructureRareData::visitChildren):
2990         (JSC::StructureRareData::cachedPropertyNameEnumerator):
2991         (JSC::StructureRareData::setCachedPropertyNameEnumerator):
2992         (JSC::StructureRareData::cachedStructurePropertyNameEnumerator): Deleted.
2993         (JSC::StructureRareData::setCachedStructurePropertyNameEnumerator): Deleted.
2994         (JSC::StructureRareData::cachedGenericPropertyNameEnumerator): Deleted.
2995         (JSC::StructureRareData::setCachedGenericPropertyNameEnumerator): Deleted.
2996         * runtime/StructureRareData.h:
2997         * tests/stress/for-in-delete-during-iteration.js:
2998
2999 2015-03-24  Michael Saboff  <msaboff@apple.com>
3000
3001         Unreviewed build fix for debug builds.
3002
3003         * runtime/ExceptionHelpers.cpp:
3004         (JSC::invalidParameterInSourceAppender):
3005
3006 2015-03-24  Saam Barati  <saambarati1@gmail.com>
3007
3008         Improve error messages in JSC
3009         https://bugs.webkit.org/show_bug.cgi?id=141869
3010
3011         Reviewed by Geoffrey Garen.
3012
3013         JavaScriptCore has some unintuitive error messages associated
3014         with certain common errors. This patch changes some specific
3015         error messages to be more understandable and also creates a
3016         mechanism that will allow for easy modification of error messages
3017         in the future. The specific errors we change are not a function
3018         errors and invalid parameter errors.
3019
3020         * CMakeLists.txt:
3021         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3022         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
3023         * JavaScriptCore.xcodeproj/project.pbxproj:
3024         * interpreter/Interpreter.cpp:
3025         (JSC::sizeOfVarargs):
3026         * jit/JITOperations.cpp:
3027         op_throw_static_error always has a JSString as its argument.
3028         There is no need to dance around this, and we should assert
3029         that this always holds. This JSString represents the error
3030         message we want to display to the user, so there is no need
3031         to pass it into errorDescriptionForValue which will now place
3032         quotes around the string.
3033
3034         * llint/LLIntSlowPaths.cpp:
3035         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3036         * runtime/CommonSlowPaths.h:
3037         (JSC::CommonSlowPaths::opIn):
3038         * runtime/ErrorInstance.cpp:
3039         (JSC::ErrorInstance::ErrorInstance):
3040         * runtime/ErrorInstance.h:
3041         (JSC::ErrorInstance::hasSourceAppender):
3042         (JSC::ErrorInstance::sourceAppender):
3043         (JSC::ErrorInstance::setSourceAppender):
3044         (JSC::ErrorInstance::clearSourceAppender):
3045         (JSC::ErrorInstance::setRuntimeTypeForCause):
3046         (JSC::ErrorInstance::runtimeTypeForCause):
3047         (JSC::ErrorInstance::clearRuntimeTypeForCause):
3048         (JSC::ErrorInstance::appendSourceToMessage): Deleted.
3049         (JSC::ErrorInstance::setAppendSourceToMessage): Deleted.
3050         (JSC::ErrorInstance::clearAppendSourceToMessage): Deleted.
3051         * runtime/ExceptionHelpers.cpp:
3052         (JSC::errorDescriptionForValue):
3053         (JSC::defaultApproximateSourceError):
3054         (JSC::defaultSourceAppender):
3055         (JSC::functionCallBase):
3056         (JSC::notAFunctionSourceAppender):
3057         (JSC::invalidParameterInSourceAppender):
3058         (JSC::invalidParameterInstanceofSourceAppender):
3059         (JSC::createError):
3060         (JSC::createInvalidFunctionApplyParameterError):
3061         (JSC::createInvalidInParameterError):
3062         (JSC::createInvalidInstanceofParameterError):
3063         (JSC::createNotAConstructorError):
3064         (JSC::createNotAFunctionError):
3065         (JSC::createNotAnObjectError):
3066         (JSC::createInvalidParameterError): Deleted.
3067         * runtime/ExceptionHelpers.h:
3068         * runtime/JSObject.cpp:
3069         (JSC::JSObject::hasInstance):
3070         * runtime/RuntimeType.cpp: Added.
3071         (JSC::runtimeTypeForValue):
3072         (JSC::runtimeTypeAsString):
3073         * runtime/RuntimeType.h: Added.
3074         * runtime/TypeProfilerLog.cpp:
3075         (JSC::TypeProfilerLog::processLogEntries):
3076         * runtime/TypeSet.cpp:
3077         (JSC::TypeSet::getRuntimeTypeForValue): Deleted.
3078         * runtime/TypeSet.h:
3079         * runtime/VM.cpp:
3080         (JSC::appendSourceToError):
3081         (JSC::VM::throwException):
3082
3083 2015-03-23  Filip Pizlo  <fpizlo@apple.com>
3084
3085         JSC should have a low-cost asynchronous disassembler
3086         https://bugs.webkit.org/show_bug.cgi?id=142997
3087
3088         Reviewed by Mark Lam.
3089
3090         This adds a JSC_asyncDisassembly option that disassembles on a thread. Disassembly
3091         doesn't block execution. Some code will live a little longer because of this, since the
3092         work tasks hold a ref to the code, but other than that there is basically no overhead.
3093
3094         At present, this isn't really a replacement for JSC_showDisassembly, since it doesn't
3095         provide contextual IR information for Baseline and DFG disassemblies, and it doesn't do
3096         the separate IR dumps for FTL. Using JSC_showDisassembly and friends along with
3097         JSC_asyncDisassembly has bizarre behavior - so just choose one.
3098
3099         A simple way of understanding how great this is, is to run a small benchmark like
3100         V8Spider/earley-boyer.
3101
3102         Performance without any disassembly flags: 60ms
3103         Performance with JSC_showDisassembly=true: 477ms
3104         Performance with JSC_asyncDisassembly=true: 65ms
3105
3106         So, the overhead of disassembly goes from 8x to 8%.
3107
3108         Note that JSC_asyncDisassembly=true does make it incorrect to run "time" as a way of
3109         measuring benchmark performance. This is because at VM exit, we wait for all async
3110         disassembly requests to finish. For example, for earley-boyer, we spend an extra ~130ms
3111         after the benchmark completely finishes to finish the disassemblies. This small weirdness
3112         should be OK for the intended use-cases, since all you have to do to get around it is to
3113         measure the execution time of the benchmark payload rather than the end-to-end time of
3114         launching the VM.
3115
3116         * assembler/LinkBuffer.cpp:
3117         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
3118         * assembler/LinkBuffer.h:
3119         (JSC::LinkBuffer::wasAlreadyDisassembled):
3120         (JSC::LinkBuffer::didAlreadyDisassemble):
3121         * dfg/DFGJITCompiler.cpp:
3122         (JSC::DFG::JITCompiler::disassemble):
3123         * dfg/DFGJITFinalizer.cpp:
3124         (JSC::DFG::JITFinalizer::finalize):
3125         (JSC::DFG::JITFinalizer::finalizeFunction):
3126         * disassembler/Disassembler.cpp:
3127         (JSC::disassembleAsynchronously):
3128         (JSC::waitForAsynchronousDisassembly):
3129         * disassembler/Disassembler.h:
3130         * ftl/FTLCompile.cpp:
3131         (JSC::FTL::mmAllocateDataSection):
3132         * ftl/FTLLink.cpp:
3133         (JSC::FTL::link):
3134         * jit/JIT.cpp:
3135         (JSC::JIT::privateCompile):
3136         * jsc.cpp:
3137         * runtime/Options.h:
3138         * runtime/VM.cpp:
3139         (JSC::VM::~VM):
3140
3141 2015-03-23  Dean Jackson  <dino@apple.com>
3142
3143         ES7: Implement Array.prototype.includes
3144         https://bugs.webkit.org/show_bug.cgi?id=142707
3145
3146         Reviewed by Geoffrey Garen.
3147
3148         Add support for the ES7 includes method on Arrays.
3149         https://github.com/tc39/Array.prototype.includes
3150
3151         * builtins/Array.prototype.js:
3152         (includes): Implementation in JS.
3153         * runtime/ArrayPrototype.cpp: Add 'includes' to the lookup table.
3154
3155 2015-03-23  Joseph Pecoraro  <pecoraro@apple.com>
3156
3157         __defineGetter__/__defineSetter__ should throw exceptions
3158         https://bugs.webkit.org/show_bug.cgi?id=142934
3159
3160         Reviewed by Geoffrey Garen.
3161
3162         * runtime/ObjectPrototype.cpp:
3163         (JSC::objectProtoFuncDefineGetter):
3164         (JSC::objectProtoFuncDefineSetter):
3165         Throw exceptions when these functions are used directly.
3166
3167 2015-03-23  Joseph Pecoraro  <pecoraro@apple.com>
3168
3169         Fix DO_PROPERTYMAP_CONSTENCY_CHECK enabled build
3170         https://bugs.webkit.org/show_bug.cgi?id=142952
3171
3172         Reviewed by Geoffrey Garen.
3173
3174         * runtime/Structure.cpp:
3175         (JSC::PropertyTable::checkConsistency):
3176         The check offset method doesn't exist in PropertyTable, it exists in Structure.
3177
3178         (JSC::Structure::checkConsistency):
3179         So move it here, and always put it at the start to match normal behavior.
3180
3181 2015-03-22  Filip Pizlo  <fpizlo@apple.com>
3182
3183         Remove DFG::ValueRecoveryOverride; it's been dead since we removed forward speculations
3184         https://bugs.webkit.org/show_bug.cgi?id=142956
3185
3186         Rubber stamped by Gyuyoung Kim.
3187
3188         Just removing dead code.
3189
3190         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3191         * JavaScriptCore.xcodeproj/project.pbxproj:
3192         * dfg/DFGOSRExit.h:
3193         * dfg/DFGOSRExitCompiler.cpp:
3194         * dfg/DFGValueRecoveryOverride.h: Removed.
3195
3196 2015-03-22  Filip Pizlo  <fpizlo@apple.com>
3197
3198         DFG OSR exit shouldn't assume that the frame count for exit is greater than the frame count in DFG
3199         https://bugs.webkit.org/show_bug.cgi?id=142948
3200
3201         Reviewed by Sam Weinig.
3202
3203         It's necessary to ensure that the stack pointer accounts for the extent of our stack usage
3204         since a signal may clobber the area below the stack pointer. When the DFG is executing,
3205         the stack pointer accounts for the DFG's worst-case stack usage. When we OSR exit back to
3206         baseline, we will use a different amount of stack. This is because baseline is a different
3207         compiler. It will make different decisions. So it will use a different amount of stack.
3208
3209         This gets tricky when we are in the process of doing an OSR exit, because we are sort of
3210         incrementally transforming the stack from how it looked in the DFG to how it will look in
3211         baseline. The most conservative approach would be to set the stack pointer to the max of
3212         DFG and baseline.
3213
3214         When this code was written, a reckless assumption was made: that the stack usage in
3215         baseline is always at least as large as the stack usage in DFG. Based on this incorrect
3216         assumption, the code first adjusts the stack pointer to account for the baseline stack
3217         usage. This sort of usually works, because usually baseline does happen to use more stack.
3218         But that's not an invariant. Nobody guarantees this. We will never make any changes that
3219         would make this be guaranteed, because that would be antithetical to how optimizing
3220         compilers work. The DFG should be allowed to use however much stack it decides that it
3221         should use in order to get good performance, and it shouldn't try to guarantee that it
3222         always uses less stack than baseline.
3223
3224         As such, we must always assume that the frame size for DFG execution (i.e.
3225         frameRegisterCount) and the frame size in baseline once we exit (i.e.
3226         requiredRegisterCountForExit) are two independent quantities and they have no
3227         relationship.
3228
3229         Fortunately, though, this code can be made correct by just moving the stack adjustment to
3230         just before we do conversions. This is because we have since changed the OSR exit
3231         algorithm to first lift up all state from the DFG state into a scratch buffer, and then to
3232         drop it out of the scratch buffer and into the stack according to the baseline layout. The
3233         point just before conversions is the point where we have finished reading the DFG frame
3234         and will not read it anymore, and we haven't started writing the baseline frame. So, at
3235         this point it is safe to set the stack pointer to account for the frame size at exit.
3236
3237         This is benign because baseline happens to create larger frames than DFG.
3238
3239         * dfg/DFGOSRExitCompiler32_64.cpp:
3240         (JSC::DFG::OSRExitCompiler::compileExit):
3241         * dfg/DFGOSRExitCompiler64.cpp:
3242         (JSC::DFG::OSRExitCompiler::compileExit):
3243         * dfg/DFGOSRExitCompilerCommon.cpp:
3244         (JSC::DFG::adjustAndJumpToTarget):
3245
3246 2015-03-22  Filip Pizlo  <fpizlo@apple.com>
3247
3248         Shorten the number of iterations to 10,000 since that's enough to test all tiers.
3249
3250         Rubber stamped by Sam Weinig.
3251
3252         * tests/stress/equals-masquerader.js:
3253
3254 2015-03-22  Filip Pizlo  <fpizlo@apple.com>
3255
3256         tests/stress/*tdz* tests do 10x more iterations than necessary
3257         https://bugs.webkit.org/show_bug.cgi?id=142946
3258
3259         Reviewed by Ryosuke Niwa.
3260
3261         The stress test harness runs all of these tests in various configurations. This includes
3262         no-cjit, which has tier-up heuristics locked in such a way that 10,000 iterations is
3263         enough to get to the highest tier. The only exceptions are very large functions or
3264         functions that have some reoptimizations. That happens rarely, and when it does happen,
3265         usually 20,000 iterations is enough.
3266
3267         Therefore, these tests use 10x too many iterations. This is bad, since these tests
3268         allocate on each iteration, and so they run very slowly in debug mode.
3269
3270         * tests/stress/class-syntax-no-loop-tdz.js:
3271         * tests/stress/class-syntax-no-tdz-in-catch.js:
3272         * tests/stress/class-syntax-no-tdz-in-conditional.js:
3273         * tests/stress/class-syntax-no-tdz-in-loop-no-inline-super.js:
3274         * tests/stress/class-syntax-no-tdz-in-loop.js:
3275         * tests/stress/class-syntax-no-tdz.js:
3276         * tests/stress/class-syntax-tdz-in-catch.js:
3277         * tests/stress/class-syntax-tdz-in-conditional.js:
3278         * tests/stress/class-syntax-tdz-in-loop.js:
3279         * tests/stress/class-syntax-tdz.js:
3280
3281 2015-03-21  Joseph Pecoraro  <pecoraro@apple.com>
3282
3283         Fix a typo in Parser error message
3284         https://bugs.webkit.org/show_bug.cgi?id=142942
3285
3286         Reviewed by Alexey Proskuryakov.
3287
3288         * jit/JITPropertyAccess.cpp:
3289         (JSC::JIT::emitSlow_op_resolve_scope):
3290         * jit/JITPropertyAccess32_64.cpp:
3291         (JSC::JIT::emitSlow_op_resolve_scope):
3292         * parser/Parser.cpp:
3293         (JSC::Parser<LexerType>::parseClass):
3294         Fix a common identifier typo.
3295
3296 2015-03-21  Joseph Pecoraro  <pecoraro@apple.com>
3297
3298         Computed Property names should allow only AssignmentExpressions not any Expression
3299         https://bugs.webkit.org/show_bug.cgi?id=142902
3300
3301         Reviewed by Ryosuke Niwa.
3302
3303         * parser/Parser.cpp:
3304         (JSC::Parser<LexerType>::parseProperty):
3305         Limit computed expressions to just assignment expressions instead of
3306         any expression (which allowed comma expressions).
3307
3308 2015-03-21  Andreas Kling  <akling@apple.com>
3309
3310         Make UnlinkedFunctionExecutable fit in a 128-byte cell.
3311         <https://webkit.org/b/142939>
3312
3313         Reviewed by Mark Hahnenberg.
3314
3315         Re-arrange the members of UnlinkedFunctionExecutable so it can fit inside
3316         a 128-byte heap cell instead of requiring a 256-byte one.
3317
3318         Threw in a static_assert to catch anyone pushing it over the limit again.
3319
3320         * bytecode/UnlinkedCodeBlock.cpp:
3321         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
3322         * bytecode/UnlinkedCodeBlock.h:
3323         (JSC::UnlinkedFunctionExecutable::functionMode):
3324
3325 2015-03-20  Mark Hahnenberg  <mhahnenb@gmail.com>
3326
3327         GCTimer should know keep track of nested GC phases
3328         https://bugs.webkit.org/show_bug.cgi?id=142675
3329
3330         Reviewed by Darin Adler.
3331
3332         This improves the GC phase timing output in Heap.cpp by linking
3333         phases nested inside other phases together, allowing tools
3334         to compute how much time we're spending in various nested phases.
3335
3336         * heap/Heap.cpp:
3337
3338 2015-03-20  Geoffrey Garen  <ggaren@apple.com>
3339
3340         FunctionBodyNode should known where its parameters started
3341         https://bugs.webkit.org/show_bug.cgi?id=142926
3342
3343         Reviewed by Ryosuke Niwa.
3344
3345         This will allow us to re-parse parameters instead of keeping the
3346         parameters piece of the AST around forever.
3347
3348         I also took the opportunity to initialize most FunctionBodyNode data
3349         members at construction time, to help clarify that they are set right.
3350
3351         * parser/ASTBuilder.h:
3352         (JSC::ASTBuilder::createFunctionExpr): No need to pass
3353         functionKeywordStart here; we now provide it at FunctionBodyNode
3354         creation time.
3355
3356         (JSC::ASTBuilder::createFunctionBody): Require everything we need at
3357         construction time, including the start of our parameters.
3358
3359         (JSC::ASTBuilder::createGetterOrSetterProperty):
3360         (JSC::ASTBuilder::createFuncDeclStatement):  No need to pass
3361         functionKeywordStart here; we now provide it at FunctionBodyNode
3362         creation time.
3363
3364         (JSC::ASTBuilder::setFunctionNameStart): Deleted.
3365
3366         * parser/Nodes.cpp:
3367         (JSC::FunctionBodyNode::FunctionBodyNode): Initialize everything at
3368         construction time.
3369
3370         * parser/Nodes.h: Added a field for the location of our parameters.
3371
3372         * parser/Parser.cpp:
3373         (JSC::Parser<LexerType>::parseFunctionBody):
3374         (JSC::Parser<LexerType>::parseFunctionInfo):
3375         (JSC::Parser<LexerType>::parseFunctionDeclaration):
3376         (JSC::Parser<LexerType>::parseClass):
3377         (JSC::Parser<LexerType>::parsePropertyMethod):
3378         (JSC::Parser<LexerType>::parseGetterSetter):
3379         (JSC::Parser<LexerType>::parsePrimaryExpression):
3380         * parser/Parser.h: Refactored to match above interface changes.
3381
3382         * parser/SyntaxChecker.h:
3383         (JSC::SyntaxChecker::createFunctionExpr):
3384         (JSC::SyntaxChecker::createFunctionBody):
3385         (JSC::SyntaxChecker::createFuncDeclStatement):
3386         (JSC::SyntaxChecker::createGetterOrSetterProperty): Refactored to match
3387         above interface changes.
3388
3389         (JSC::SyntaxChecker::setFunctionNameStart): Deleted.
3390
3391 2015-03-20  Filip Pizlo  <fpizlo@apple.com>
3392
3393         Observably effectful nodes in DFG IR should come last in their bytecode instruction (i.e. forExit section), except for Hint nodes
3394         https://bugs.webkit.org/show_bug.cgi?id=142920
3395
3396         Reviewed by Oliver Hunt, Geoffrey Garen, and Mark Lam.
3397
3398         Observably effectful, n.: If we reexecute the bytecode instruction after this node has
3399         executed, then something other than the bytecode instruction's specified outcome will
3400         happen.
3401
3402         We almost never had observably effectful nodes except at the end of the bytecode
3403         instruction.  The exception is a lowered transitioning PutById:
3404
3405         PutStructure(@o, S1 -> S2)
3406         PutByOffset(@o, @o, @v)
3407
3408         The PutStructure is observably effectful: if you try to reexecute the bytecode after
3409         doing the PutStructure, then we'll most likely crash.  The generic PutById handling means
3410         first checking what the old structure of the object is; but if we reexecute, the old
3411         structure will seem to be the new structure.  But the property ensured by the new
3412         structure hasn't been stored yet, so any attempt to load it or scan it will crash.
3413
3414         Intriguingly, however, none of the other operations involved in the PutById are
3415         observably effectful.  Consider this example:
3416
3417         PutByOffset(@o, @o, @v)
3418         PutStructure(@o, S1 -> S2)
3419
3420         Note that the PutStructure node doesn't reallocate property storage; see further below
3421         for an example that does that. Because no property storage is happening, we know that we
3422         already had room for the new property.  This means that the PutByOffset is no observable
3423         until the PutStructure executes and "reveals" the property.  Hence, PutByOffset is not
3424         observably effectful.
3425
3426         Now consider this:
3427
3428         b: AllocatePropertyStorage(@o)
3429         PutByOffset(@b, @o, @v)
3430         PutStructure(@o, S1 -> S2)
3431
3432         Surprisingly, this is also safe, because the AllocatePropertyStorage is not observably
3433         effectful. It *does* reallocate the property storage and the new property storage pointer
3434         is stored into the object. But until the PutStructure occurs, the world will just think
3435         that the reallocation didn't happen, in the sense that we'll think that the property
3436         storage is using less memory than what we just allocated. That's harmless.
3437
3438         The AllocatePropertyStorage is safe in other ways, too. Even if we GC'd after the
3439         AllocatePropertyStorage but before the PutByOffset (or before the PutStructure),
3440         everything could be expected to be fine, so long as all of @o, @v and @b are on the
3441         stack. If they are all on the stack, then the GC will leave the property storage alone
3442         (so the extra memory we just allocated would be safe). The GC will not scan the part of
3443         the property storage that contains @v, but that's fine, so long as @v is on the stack.
3444
3445         The better long-term solution is probably bug 142921.
3446
3447         But for now, this:
3448
3449         - Fixes an object materialization bug, exemplified by the two tests, that previously
3450           crashed 100% of the time with FTL enabled and concurrent JIT disabled.
3451
3452         - Allows us to remove the workaround introduced in r174856.
3453
3454         * dfg/DFGByteCodeParser.cpp:
3455         (JSC::DFG::ByteCodeParser::handlePutById):
3456         * dfg/DFGConstantFoldingPhase.cpp:
3457         (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
3458         * dfg/DFGFixupPhase.cpp:
3459         (JSC::DFG::FixupPhase::insertCheck):
3460         (JSC::DFG::FixupPhase::indexOfNode): Deleted.
3461         (JSC::DFG::FixupPhase::indexOfFirstNodeOfExitOrigin): Deleted.
3462         * dfg/DFGInsertionSet.h:
3463         (JSC::DFG::InsertionSet::insertOutOfOrder): Deleted.
3464         (JSC::DFG::InsertionSet::insertOutOfOrderNode): Deleted.
3465         * tests/stress/materialize-past-butterfly-allocation.js: Added.
3466         (bar):
3467         (foo0):
3468         (foo1):
3469         (foo2):
3470         (foo3):
3471         (foo4):
3472         * tests/stress/materialize-past-put-structure.js: Added.
3473         (foo):
3474
3475 2015-03-20  Yusuke Suzuki  <utatane.tea@gmail.com>
3476
3477         REGRESSION (r179429): Potential Use after free in JavaScriptCore`WTF::StringImpl::ref + 83
3478         https://bugs.webkit.org/show_bug.cgi?id=142410
3479
3480         Reviewed by Geoffrey Garen.
3481
3482         Before this patch, added function JSValue::toPropertyKey returns PropertyName.
3483         Since PropertyName doesn't have AtomicStringImpl ownership,
3484         if Identifier is implicitly converted to PropertyName and Identifier is destructed,
3485         PropertyName may refer freed AtomicStringImpl*.
3486
3487         This patch changes the result type of JSValue::toPropertyName from PropertyName to Identifier,
3488         to keep AtomicStringImpl* ownership after the toPropertyName call is done.
3489         And receive the result value as Identifier type to keep ownership in the caller side.
3490
3491         To catch the result of toPropertyKey as is, we catch the result of toPropertyName as auto.
3492
3493         However, now we don't need to have both Identifier and PropertyName.
3494         So we'll merge PropertyName to Identifier in the subsequent patch.
3495
3496         * dfg/DFGOperations.cpp:
3497         (JSC::DFG::operationPutByValInternal):
3498         * jit/JITOperations.cpp:
3499         (JSC::getByVal):
3500         * llint/LLIntSlowPaths.cpp:
3501         (JSC::LLInt::getByVal):
3502         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3503         * runtime/CommonSlowPaths.cpp:
3504         (JSC::SLOW_PATH_DECL):
3505         * runtime/CommonSlowPaths.h:
3506         (JSC::CommonSlowPaths::opIn):
3507         * runtime/JSCJSValue.h:
3508         * runtime/JSCJSValueInlines.h:
3509         (JSC::JSValue::toPropertyKey):
3510         * runtime/ObjectConstructor.cpp:
3511         (JSC::objectConstructorGetOwnPropertyDescriptor):
3512         (JSC::objectConstructorDefineProperty):
3513         * runtime/ObjectPrototype.cpp:
3514         (JSC::objectProtoFuncPropertyIsEnumerable):
3515
3516 2015-03-18  Geoffrey Garen  <ggaren@apple.com>
3517
3518         Function.prototype.toString should not decompile the AST
3519         https://bugs.webkit.org/show_bug.cgi?id=142853
3520
3521         Reviewed by Sam Weinig.
3522
3523         To recover the function parameter string, Function.prototype.toString
3524         decompiles the function parameters from the AST. This is bad for a few
3525         reasons:
3526
3527         (1) It requires us to keep pieces of the AST live forever. This is an
3528         awkward design and a waste of memory.
3529
3530         (2) It doesn't match Firefox or Chrome (because it changes whitespace
3531         and ES6 destructuring expressions).
3532
3533         (3) It doesn't scale to ES6 default argument parameters, which require
3534         arbitrarily complex decompilation.
3535
3536         (4) It can counterfeit all the line numbers in a function (because
3537         whitespace can include newlines).
3538
3539         (5) It's expensive, and we've seen cases where websites invoke
3540         Function.prototype.toString a lot by accident.
3541
3542         The fix is to do what we do for the rest of the function: Just quote the
3543         original source text.
3544
3545         Since this change inevitably changes some function stringification, I
3546         took the opportunity to make our stringification match Firefox's and
3547         Chrome's.
3548
3549         * API/tests/testapi.c:
3550         (assertEqualsAsUTF8String): Be more informative when this fails.
3551
3552         (main): Updated to match new stringification rules.
3553
3554         * bytecode/UnlinkedCodeBlock.cpp:
3555         (JSC::UnlinkedFunctionExecutable::paramString): Deleted. Yay!
3556         * bytecode/UnlinkedCodeBlock.h:
3557
3558         * parser/Nodes.h:
3559         (JSC::StatementNode::isFuncDeclNode): New helper for constructing
3560         anonymous functions.
3561
3562         * parser/SourceCode.h:
3563         (JSC::SourceCode::SourceCode): Allow zero because WebCore wants it.
3564
3565         * runtime/CodeCache.cpp:
3566         (JSC::CodeCache::getFunctionExecutableFromGlobalCode): Updated for use
3567         of function declaration over function expression.
3568
3569         * runtime/Executable.cpp:
3570         (JSC::FunctionExecutable::paramString): Deleted. Yay!
3571         * runtime/Executable.h:
3572         (JSC::FunctionExecutable::parameterCount):
3573
3574         * runtime/FunctionConstructor.cpp:
3575         (JSC::constructFunctionSkippingEvalEnabledCheck): Added a newline after
3576         the opening brace to match Firefox and Chrome, and a space after the comma
3577         to match Firefox and WebKit coding style. Added the function name to
3578         the text of the function so it would look right when stringify-ing. Switched
3579         from parentheses to braces to produce a function declaration instead of
3580         a function expression because we are required to exclude the function's
3581         name from its scope, and that's what a function declaration does.
3582
3583         * runtime/FunctionPrototype.cpp:
3584         (JSC::functionProtoFuncToString): Removed an old workaround because the
3585         library it worked around doesn't really exist anymore, and the behavior
3586         doesn't match Firefox or Chrome. Use type profiling offsets instead of
3587         function body offsets because we want to include the function name and
3588         the parameter string, rather than stitching them in manually by
3589         decompiling the AST.
3590
3591         (JSC::insertSemicolonIfNeeded): Deleted.
3592
3593         * tests/mozilla/js1_2/function/tostring-1.js:
3594         * tests/mozilla/js1_5/Scope/regress-185485.js:
3595         (with.g): Updated these test results for formatting changes.
3596
3597 2015-03-20  Joseph Pecoraro  <pecoraro@apple.com>
3598
3599         SyntaxChecker assertion is trapped with computed property name and getter
3600         https://bugs.webkit.org/show_bug.cgi?id=142863
3601
3602         Reviewed by Ryosuke Niwa.
3603
3604         * parser/SyntaxChecker.h:
3605         (JSC::SyntaxChecker::getName):
3606         Remove invalid assert. Computed properties will not have a name
3607         and the calling code is checking for null expecting it. The
3608         AST path (non-CheckingPath) already does this without the assert
3609         so it is well tested.
3610
3611 2015-03-19  Mark Lam  <mark.lam@apple.com>
3612
3613         JSCallbackObject<JSGlobalObject> should not destroy its JSCallbackObjectData before all its finalizers have been called.
3614         <https://webkit.org/b/142846>
3615
3616         Reviewed by Geoffrey Garen.
3617
3618         Currently, JSCallbackObject<JSGlobalObject> registers weak finalizers via 2 mechanisms:
3619         1. JSCallbackObject<Parent>::init() registers a weak finalizer for all JSClassRef
3620            that a JSCallbackObject references.
3621         2. JSCallbackObject<JSGlobalObject>::create() registers a finalizer via
3622            vm.heap.addFinalizer() which destroys the JSCallbackObject.
3623
3624         The first finalizer is implemented as a virtual function of a JSCallbackObjectData
3625         instance that will be destructed if the 2nd finalizer is called.  Hence, if the
3626         2nd finalizer if called first, the later invocation of the 1st finalizer will
3627         result in a crash.
3628
3629         This patch fixes the issue by eliminating the finalizer registration in init().
3630         Instead, we'll have the JSCallbackObject destructor call all the JSClassRef finalizers
3631         if needed.  This ensures that these finalizers are called before the JSCallbackObject
3632         is destructor.
3633
3634         Also added assertions to a few Heap functions because JSCell::classInfo() expects
3635         all objects that are allocated from MarkedBlock::Normal blocks to be derived from
3636         JSDestructibleObject.  These assertions will help us catch violations of this
3637         expectation earlier.
3638
3639         * API/JSCallbackObject.cpp:
3640         (JSC::JSCallbackObjectData::finalize): Deleted.
3641         * API/JSCallbackObject.h:
3642         (JSC::JSCallbackObjectData::~JSCallbackObjectData):
3643         * API/JSCallbackObjectFunctions.h:
3644         (JSC::JSCallbackObject<Parent>::~JSCallbackObject):
3645         (JSC::JSCallbackObject<Parent>::init):
3646         * API/tests/GlobalContextWithFinalizerTest.cpp: Added.
3647         (finalize):
3648         (testGlobalContextWithFinalizer):
3649         * API/tests/GlobalContextWithFinalizerTest.h: Added.
3650         * API/tests/testapi.c:
3651         (main):
3652         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
3653         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
3654         * JavaScriptCore.xcodeproj/project.pbxproj:
3655         * heap/HeapInlines.h:
3656         (JSC::Heap::allocateObjectOfType):
3657         (JSC::Heap::subspaceForObjectOfType):
3658         (JSC::Heap::allocatorForObjectOfType):
3659
3660 2015-03-19  Andreas Kling  <akling@apple.com>
3661
3662         JSCallee unnecessarily overrides a bunch of things in the method table.
3663         <https://webkit.org/b/142855>
3664
3665         Reviewed by Geoffrey Garen.
3666
3667         Remove JSCallee method table overrides that simply call to base class.
3668         This makes JSFunction property slot lookups slightly more efficient since
3669         they can take the fast path when passing over JSCallee in the base class chain.
3670
3671         * runtime/JSCallee.cpp:
3672         (JSC::JSCallee::getOwnPropertySlot): Deleted.
3673         (JSC::JSCallee::getOwnNonIndexPropertyNames): Deleted.
3674         (JSC::JSCallee::put): Deleted.
3675         (JSC::JSCallee::deleteProperty): Deleted.
3676         (JSC::JSCallee::defineOwnProperty): Deleted.
3677         * runtime/JSCallee.h:
3678
3679 2015-03-19  Andreas Kling  <akling@apple.com>
3680
3681         DFGAllocator should use bmalloc's aligned allocator.
3682         <https://webkit.org/b/142871>
3683
3684         Reviewed by Geoffrey Garen.
3685
3686         Switch DFGAllocator to using bmalloc through fastAlignedMalloc().
3687
3688         * dfg/DFGAllocator.h:
3689         (JSC::DFG::Allocator<T>::allocateSlow):
3690         (JSC::DFG::Allocator<T>::freeRegionsStartingAt):
3691         * heap/CopiedSpace.h:
3692         * heap/MarkedBlock.h:
3693         * heap/MarkedSpace.h:
3694
3695 2015-03-18  Joseph Pecoraro  <pecoraro@apple.com>
3696
3697         ES6 Classes: Extends should accept an expression without parenthesis
3698         https://bugs.webkit.org/show_bug.cgi?id=142840
3699
3700         Reviewed by Ryosuke Niwa.
3701
3702         * parser/Parser.cpp:
3703         (JSC::Parser<LexerType>::parseClass):
3704         "extends" allows a LeftHandExpression (new expression / call expression,
3705         which includes a member expression), not a primary expression. Our
3706         parseMemberExpression does all of these.
3707
3708 2015-03-18  Joseph Pecoraro  <pecoraro@apple.com>
3709
3710         Web Inspector: Debugger Popovers and Probes should use FormattedValue/ObjectTreeView instead of Custom/ObjectPropertiesSection
3711         https://bugs.webkit.org/show_bug.cgi?id=142830
3712
3713         Reviewed by Timothy Hatcher.
3714
3715         * inspector/agents/InspectorDebuggerAgent.cpp:
3716         (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
3717         Give Probe Samples object previews.
3718
3719 2015-03-17  Ryuan Choi  <ryuan.choi@navercorp.com>
3720
3721         [EFL] Expose JavaScript binding interface through ewk_extension
3722         https://bugs.webkit.org/show_bug.cgi?id=142033
3723
3724         Reviewed by Gyuyoung Kim.
3725
3726         * PlatformEfl.cmake: Install Javascript APIs.
3727
3728 2015-03-17  Geoffrey Garen  <ggaren@apple.com>
3729
3730         Function bodies should always include braces
3731         https://bugs.webkit.org/show_bug.cgi?id=142795
3732
3733         Reviewed by Michael Saboff.
3734
3735         Having a mode for excluding the opening and closing braces from a function
3736         body was unnecessary and confusing.
3737
3738         * bytecode/CodeBlock.cpp:
3739         (JSC::CodeBlock::CodeBlock): Adopt the new one true linking function.
3740
3741         * bytecode/UnlinkedCodeBlock.cpp:
3742         (JSC::generateFunctionCodeBlock):
3743         (JSC::UnlinkedFunctionExecutable::link):
3744         (JSC::UnlinkedFunctionExecutable::codeBlockFor): No need to pass through
3745         a boolean: there is only one kind of function now.
3746
3747         (JSC::UnlinkedFunctionExecutable::linkInsideExecutable): Deleted.
3748         (JSC::UnlinkedFunctionExecutable::linkGlobalCode): Deleted. Let's only
3749         have one way to do things. This removes the old mode that would pretend
3750         that a function always started at column 1. That pretense was not true:
3751         an attribute event listener does not necessarily start at column 1.
3752
3753         * bytecode/UnlinkedCodeBlock.h:
3754         * generate-js-builtins: Adopt the new one true linking function.
3755
3756         * parser/Parser.h:
3757         (JSC::Parser<LexerType>::parse):
3758         (JSC::parse): needsReparsingAdjustment is always true now, so I removed it.
3759
3760         * runtime/Executable.cpp:
3761         (JSC::ScriptExecutable::newCodeBlockFor):
3762         (JSC::FunctionExecutable::FunctionExecutable):
3763         (JSC::ProgramExecutable::initializeGlobalProperties):
3764         (JSC::FunctionExecutable::fromGlobalCode):
3765         * runtime/Executable.h:
3766         (JSC::FunctionExecutable::create):
3767         (JSC::FunctionExecutable::bodyIncludesBraces): Deleted. Removed unused stuff.
3768
3769         * runtime/FunctionConstructor.cpp:
3770         (JSC::constructFunctionSkippingEvalEnabledCheck): Always provide a
3771         leading space because that's what this function's comment says is required
3772         for web compatibility. We used to fake this up after the fact when
3773         stringifying, based on the bodyIncludesBraces flag, but that flag is gone now.
3774
3775         * runtime/FunctionPrototype.cpp:
3776         (JSC::insertSemicolonIfNeeded):
3777         (JSC::functionProtoFuncToString): No need to add braces and/or a space
3778         after the fact -- we always have them now.
3779
3780 2015-03-17  Mark Lam  <mark.lam@apple.com>
3781
3782         Refactor execution time limit tests out of testapi.c.
3783         <https://webkit.org/b/142798>
3784
3785         Rubber stamped by Michael Saboff.
3786
3787         These tests were sometimes failing to time out on C loop builds.  Let's
3788         refactor them out of the big monolith that is testapi.c so that we can
3789         reason more easily about them and make adjustments if needed.
3790
3791         * API/tests/ExecutionTimeLimitTest.cpp: Added.
3792         (currentCPUTime):
3793         (currentCPUTimeAsJSFunctionCallback):
3794         (shouldTerminateCallback):
3795         (cancelTerminateCallback):
3796         (extendTerminateCallback):
3797         (testExecutionTimeLimit):
3798         * API/tests/ExecutionTimeLimitTest.h: Added.
3799         * API/tests/testapi.c:
3800         (main):
3801         (currentCPUTime): Deleted.
3802         (currentCPUTime_callAsFunction): Deleted.
3803         (shouldTerminateCallback): Deleted.
3804         (cancelTerminateCallback): Deleted.
3805         (extendTerminateCallback): Deleted.
3806         * JavaScriptCore.xcodeproj/project.pbxproj:
3807
3808 2015-03-17  Geoffrey Garen  <ggaren@apple.com>
3809
3810         Built-in functions should know that they use strict mode
3811         https://bugs.webkit.org/show_bug.cgi?id=142788
3812
3813         Reviewed by Mark Lam.
3814
3815         Even though all of our builtin functions use strict mode, the parser
3816         thinks that they don't. This is because Executable::toStrictness treats
3817         builtin-ness and strict-ness as mutually exclusive.
3818
3819         The fix is to disambiguate builtin-ness from strict-ness.
3820
3821         This bug is currently unobservable because of some other parser bugs. But
3822         it causes lots of test failures once those other bugs are fixed.
3823
3824         * API/JSScriptRef.cpp:
3825         (parseScript):
3826         * builtins/BuiltinExecutables.cpp:
3827         (JSC::BuiltinExecutables::createBuiltinExecutable): Adopt the new API
3828         for a separate value to indicate builtin-ness vs strict-ness.
3829
3830         * bytecode/UnlinkedCodeBlock.cpp:
3831         (JSC::generateFunctionCodeBlock):
3832         (JSC::UnlinkedFunctionExecutable::codeBlockFor): Ditto.
3833
3834         * bytecode/UnlinkedCodeBlock.h:
3835         (JSC::UnlinkedFunctionExecutable::toStrictness): Deleted. This function
3836         was misleading since it pretended that no builtin function was ever
3837         strict, which is the opposite of true.
3838
3839         * parser/Lexer.cpp:
3840         (JSC::Lexer<T>::Lexer):
3841         * parser/Lexer.h:
3842         * parser/Parser.cpp:
3843         (JSC::Parser<LexerType>::Parser):
3844         * parser/Parser.h:
3845         (JSC::parse): Adopt the new API.
3846
3847         * parser/ParserModes.h: Added JSParserBuiltinMode, and tried to give
3848         existing modes clearer names.
3849
3850         * runtime/CodeCache.cpp:
3851         (JSC::CodeCache::getGlobalCodeBlock):
3852         (JSC::CodeCache::getProgramCodeBlock):
3853         (JSC::CodeCache::getEvalCodeBlock):
3854         (JSC::CodeCache::getFunctionExecutableFromGlobalCode): Adopt the new API.
3855
3856         * runtime/CodeCache.h:
3857         (JSC::SourceCodeKey::SourceCodeKey): Be sure to treat strict-ness and
3858         bulitin-ness as separate pieces of the code cache key. We would not want
3859         a user function to match a built-in function in the cache, even if they
3860         agreed about strictness, since builtin functions have different lexing
3861         rules.
3862
3863         * runtime/Completion.cpp:
3864         (JSC::checkSyntax):
3865         * runtime/Executable.cpp:
3866         (JSC::FunctionExecutable::FunctionExecutable):
3867         (JSC::ProgramExecutable::checkSyntax):
3868         * runtime/Executable.h:
3869         (JSC::FunctionExecutable::create):
3870         * runtime/JSGlobalObject.cpp:
3871         (JSC::JSGlobalObject::createProgramCodeBlock):
3872         (JSC::JSGlobalObject::createEvalCodeBlock): Adopt the new API.
3873
3874 2015-03-16  Filip Pizlo  <fpizlo@apple.com>
3875
3876         DFG IR shouldn't have a separate node for every kind of put hint that could be described using PromotedLocationDescriptor
3877         https://bugs.webkit.org/show_bug.cgi?id=142769
3878
3879         Reviewed by Michael Saboff.
3880
3881         When we sink an object allocation, we need to have some way of tracking what stores would
3882         have happened had the allocation not been sunk, so that we know how to rematerialize the
3883         object on OSR exit. Prior to this change, trunk had two ways of describing such a "put
3884